Merge branch 'variadic-enumerators'

This adds several changes to enumerator_t and linked_list_t to improve
portability.  In particular to Apple's ARM64 iOS platform, whose calling
convention for variadic and regular functions are different.  This means
that assigning a non-variadic function to a variadic function pointer,
as we did with our enumerator_t::enumerate() implementations and several
callbacks, will result in crashes as the called function will access the
arguments differently than the caller provided them.

To avoid this issue the enumerator_t interface is now fully variadic.
A new mandatory method is added, venumerate(), that takes a va_list with
the arguments provided while enumerating.  enumerate() is replaced with
a generic implementation that prepares a va_list and calls the
enumerator's venumerate() implementation.  As this allows passing the
arguments of one enumerator to another it avoids the five pointer hack
used by enumerator_create_nested() and enumerator_create_cleaner().
To simplify the implementation of venumerate() a helper macro is provided
that assigns values from a given va_list to local variables.

The signature of the callback passed to enumerator_create_filter() has
also changed significantly.  It's now required to enumerate over the
original enumerator in the callback as this avoids the previous in/out
pointer hack. The arguments to the outer enumerator are provided in a
va_list.

Similar changes to avoid such five pointer hacks affect the signatures
of the callbacks for linked_list_t's invoke_function() and find_first()
methods.  For the latter the return type also changed from status_t to
bool, which is important as SUCCESS is defined as 0, so checks for ==
SUCCESS will now fail.

35 files changed, 1214 insertions, 773 deletions

diff --git a/src/libstrongswan/collections/array.c b/src/libstrongswan/collections/array.c
index 69e7df99e..c3dd6e0e9 100644
--- a/src/libstrongswan/collections/array.c
+++ b/src/libstrongswan/collections/array.c
@@ -214,9 +214,11 @@ typedef struct {
 } array_enumerator_t;
 
 METHOD(enumerator_t, enumerate, bool,
-	array_enumerator_t *this, void **out)
+	array_enumerator_t *this, va_list args)
 {
-	void *pos;
+	void *pos, **out;
+
+	VA_ARGS_VGET(args, out);
 
 	if (this->idx >= this->array->count)
 	{
@@ -250,7 +252,8 @@ enumerator_t* array_create_enumerator(array_t *array)
 
 	INIT(enumerator,
 		.public = {
-			.enumerate = (void*)_enumerate,
+			.enumerate = enumerator_enumerate_default,
+			.venumerate = _enumerate,
 			.destroy = (void*)free,
 		},
 		.array = array,
diff --git a/src/libstrongswan/collections/enumerator.c b/src/libstrongswan/collections/enumerator.c
index fa277e7c8..52c9e1cd5 100644
--- a/src/libstrongswan/collections/enumerator.c
+++ b/src/libstrongswan/collections/enumerator.c
@@ -1,7 +1,7 @@
 /*
- * Copyright (C) 2008-2013 Tobias Brunner
+ * Copyright (C) 2008-2017 Tobias Brunner
  * Copyright (C) 2007 Martin Willi
- * Hochschule fuer Technik Rapperswil
+ * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the
@@ -31,22 +31,43 @@
 
 #include <utils/debug.h>
 
-/**
- * Implementation of enumerator_create_empty().enumerate
+/*
+ * Described in header.
  */
-static bool enumerate_empty(enumerator_t *enumerator, ...)
+bool enumerator_enumerate_default(enumerator_t *enumerator, ...)
+{
+	va_list args;
+	bool result;
+
+	if (!enumerator->venumerate)
+	{
+		DBG1(DBG_LIB, "!!! ENUMERATE DEFAULT: venumerate() missing !!!");
+		return FALSE;
+	}
+	va_start(args, enumerator);
+	result = enumerator->venumerate(enumerator, args);
+	va_end(args);
+	return result;
+}
+
+METHOD(enumerator_t, enumerate_empty, bool,
+	enumerator_t *enumerator, va_list args)
 {
 	return FALSE;
 }
 
-/**
- * See header
+/*
+ * Described in header
  */
 enumerator_t* enumerator_create_empty()
 {
-	enumerator_t *this = malloc_thing(enumerator_t);
-	this->enumerate = enumerate_empty;
-	this->destroy = (void*)free;
+	enumerator_t *this;
+
+	INIT(this,
+		.enumerate = enumerator_enumerate_default,
+		.venumerate = _enumerate_empty,
+		.destroy = (void*)free,
+	);
 	return this;
 }
 
@@ -64,32 +85,31 @@ typedef struct {
 	char *full_end;
 } dir_enum_t;
 
-/**
- * Implementation of enumerator_create_directory().destroy
- */
-static void destroy_dir_enum(dir_enum_t *this)
+METHOD(enumerator_t, destroy_dir_enum, void,
+	dir_enum_t *this)
 {
 	closedir(this->dir);
 	free(this);
 }
 
-/**
- * Implementation of enumerator_create_directory().enumerate
- */
-static bool enumerate_dir_enum(dir_enum_t *this, char **relative,
-							   char **absolute, struct stat *st)
+METHOD(enumerator_t, enumerate_dir_enum, bool,
+	dir_enum_t *this, va_list args)
 {
 	struct dirent *entry = readdir(this->dir);
+	struct stat *st;
 	size_t remaining;
+	char **relative, **absolute;
 	int len;
 
+	VA_ARGS_VGET(args, relative, absolute, st);
+
 	if (!entry)
 	{
 		return FALSE;
 	}
 	if (streq(entry->d_name, ".") || streq(entry->d_name, ".."))
 	{
-		return enumerate_dir_enum(this, relative, absolute, st);
+		return this->public.enumerate(&this->public, relative, absolute, st);
 	}
 	if (relative)
 	{
@@ -122,15 +142,21 @@ static bool enumerate_dir_enum(dir_enum_t *this, char **relative,
 	return TRUE;
 }
 
-/**
- * See header
+/*
+ * Described in header
  */
 enumerator_t* enumerator_create_directory(const char *path)
 {
+	dir_enum_t *this;
 	int len;
-	dir_enum_t *this = malloc_thing(dir_enum_t);
-	this->public.enumerate = (void*)enumerate_dir_enum;
-	this->public.destroy = (void*)destroy_dir_enum;
+
+	INIT(this,
+		.public = {
+			.enumerate = enumerator_enumerate_default,
+			.venumerate = _enumerate_dir_enum,
+			.destroy = _destroy_dir_enum,
+		},
+	);
 
 	if (*path == '\0')
 	{
@@ -152,9 +178,10 @@ enumerator_t* enumerator_create_directory(const char *path)
 	this->full_end = &this->full[len];
 
 	this->dir = opendir(path);
-	if (this->dir == NULL)
+	if (!this->dir)
 	{
-		DBG1(DBG_LIB, "opening directory '%s' failed: %s", path, strerror(errno));
+		DBG1(DBG_LIB, "opening directory '%s' failed: %s", path,
+			 strerror(errno));
 		free(this);
 		return NULL;
 	}
@@ -177,21 +204,21 @@ typedef struct {
 	char full[PATH_MAX];
 } glob_enum_t;
 
-/**
- * Implementation of enumerator_create_glob().destroy
- */
-static void destroy_glob_enum(glob_enum_t *this)
+METHOD(enumerator_t, destroy_glob_enum, void,
+	glob_enum_t *this)
 {
 	globfree(&this->glob);
 	free(this);
 }
 
-/**
- * Implementation of enumerator_create_glob().enumerate
- */
-static bool enumerate_glob_enum(glob_enum_t *this, char **file, struct stat *st)
+METHOD(enumerator_t, enumerate_glob_enum, bool,
+	glob_enum_t *this, va_list args)
 {
+	struct stat *st;
 	char *match;
+	char **file;
+
+	VA_ARGS_VGET(args, file, st);
 
 	if (this->pos >= this->glob.gl_pathc)
 	{
@@ -202,20 +229,17 @@ static bool enumerate_glob_enum(glob_enum_t *this, char **file, struct stat *st)
 	{
 		*file = match;
 	}
-	if (st)
+	if (st && stat(match, st))
 	{
-		if (stat(match, st))
-		{
-			DBG1(DBG_LIB, "stat() on '%s' failed: %s", match,
-				 strerror(errno));
-			return FALSE;
-		}
+		DBG1(DBG_LIB, "stat() on '%s' failed: %s", match,
+			 strerror(errno));
+		return FALSE;
 	}
 	return TRUE;
 }
 
-/**
- * See header
+/*
+ * Described in header
  */
 enumerator_t* enumerator_create_glob(const char *pattern)
 {
@@ -229,8 +253,9 @@ enumerator_t* enumerator_create_glob(const char *pattern)
 
 	INIT(this,
 		.public = {
-			.enumerate = (void*)enumerate_glob_enum,
-			.destroy = (void*)destroy_glob_enum,
+			.enumerate = enumerator_enumerate_default,
+			.venumerate = _enumerate_glob_enum,
+			.destroy = _destroy_glob_enum,
 		},
 	);
 
@@ -272,24 +297,22 @@ typedef struct {
 	const char *trim;
 } token_enum_t;
 
-/**
- * Implementation of enumerator_create_token().destroy
- */
-static void destroy_token_enum(token_enum_t *this)
+METHOD(enumerator_t, destroy_token_enum, void,
+	token_enum_t *this)
 {
 	free(this->string);
 	free(this);
 }
 
-/**
- * Implementation of enumerator_create_token().enumerate
- */
-static bool enumerate_token_enum(token_enum_t *this, char **token)
+METHOD(enumerator_t, enumerate_token_enum, bool,
+	token_enum_t *this, va_list args)
 {
 	const char *sep, *trim;
-	char *pos = NULL, *tmp;
+	char *pos = NULL, *tmp, **token;
 	bool last = FALSE;
 
+	VA_ARGS_VGET(args, token);
+
 	/* trim leading characters/separators */
 	while (*this->pos)
 	{
@@ -390,52 +413,48 @@ static bool enumerate_token_enum(token_enum_t *this, char **token)
 	return FALSE;
 }
 
-/**
- * See header
+/*
+ * Described in header
  */
 enumerator_t* enumerator_create_token(const char *string, const char *sep,
 									  const char *trim)
 {
-	token_enum_t *enumerator = malloc_thing(token_enum_t);
+	token_enum_t *this;
 
-	enumerator->public.enumerate = (void*)enumerate_token_enum;
-	enumerator->public.destroy = (void*)destroy_token_enum;
-	enumerator->string = strdup(string);
-	enumerator->pos = enumerator->string;
-	enumerator->sep = sep;
-	enumerator->trim = trim;
+	INIT(this,
+		.public = {
+			.enumerate = enumerator_enumerate_default,
+			.venumerate = _enumerate_token_enum,
+			.destroy = _destroy_token_enum,
+		},
+		.string = strdup(string),
+		.sep = sep,
+		.trim = trim,
+	);
+	this->pos = this->string;
 
-	return &enumerator->public;
+	return &this->public;
 }
 
 /**
- * enumerator for nested enumerations
+ * Enumerator for nested enumerations
  */
 typedef struct {
-	/* implements enumerator_t */
 	enumerator_t public;
-	/* outer enumerator */
 	enumerator_t *outer;
-	/* inner enumerator */
 	enumerator_t *inner;
-	/* constructor for inner enumerator */
 	enumerator_t *(*create_inner)(void *outer, void *data);
-	/* data to pass to constructor above */
 	void *data;
-	/* destructor for data */
-	void (*destroy_data)(void *data);
+	void (*destructor)(void *data);
 } nested_enumerator_t;
 
 
-/**
- * Implementation of enumerator_create_nested().enumerate()
- */
-static bool enumerate_nested(nested_enumerator_t *this, void *v1, void *v2,
-							 void *v3, void *v4, void *v5)
+METHOD(enumerator_t, enumerate_nested, bool,
+	nested_enumerator_t *this, va_list args)
 {
 	while (TRUE)
 	{
-		while (this->inner == NULL)
+		while (!this->inner)
 		{
 			void *outer;
 
@@ -444,8 +463,13 @@ static bool enumerate_nested(nested_enumerator_t *this, void *v1, void *v2,
 				return FALSE;
 			}
 			this->inner = this->create_inner(outer, this->data);
+			if (this->inner && !this->inner->venumerate)
+			{
+				DBG1(DBG_LIB, "!!! ENUMERATE NESTED: venumerate() missing !!!");
+				return FALSE;
+			}
 		}
-		if (this->inner->enumerate(this->inner, v1, v2, v3, v4, v5))
+		if (this->inner->venumerate(this->inner, args))
 		{
 			return TRUE;
 		}
@@ -454,103 +478,100 @@ static bool enumerate_nested(nested_enumerator_t *this, void *v1, void *v2,
 	}
 }
 
-/**
- * Implementation of enumerator_create_nested().destroy()
- **/
-static void destroy_nested(nested_enumerator_t *this)
+METHOD(enumerator_t, destroy_nested, void,
+	nested_enumerator_t *this)
 {
-	if (this->destroy_data)
+	if (this->destructor)
 	{
-		this->destroy_data(this->data);
+		this->destructor(this->data);
 	}
 	DESTROY_IF(this->inner);
 	this->outer->destroy(this->outer);
 	free(this);
 }
 
-/**
- * See header
+/*
+ * Described in header
  */
 enumerator_t *enumerator_create_nested(enumerator_t *outer,
 					enumerator_t *(inner_constructor)(void *outer, void *data),
-					void *data, void (*destroy_data)(void *data))
+					void *data, void (*destructor)(void *data))
 {
-	nested_enumerator_t *enumerator = malloc_thing(nested_enumerator_t);
+	nested_enumerator_t *this;
 
-	enumerator->public.enumerate = (void*)enumerate_nested;
-	enumerator->public.destroy = (void*)destroy_nested;
-	enumerator->outer = outer;
-	enumerator->inner = NULL;
-	enumerator->create_inner = (void*)inner_constructor;
-	enumerator->data = data;
-	enumerator->destroy_data = destroy_data;
-
-	return &enumerator->public;
+	INIT(this,
+		.public = {
+			.enumerate = enumerator_enumerate_default,
+			.venumerate = _enumerate_nested,
+			.destroy = _destroy_nested,
+		},
+		.outer = outer,
+		.create_inner = inner_constructor,
+		.data = data,
+		.destructor = destructor,
+	);
+	return &this->public;
 }
 
 /**
- * enumerator for filtered enumerator
+ * Enumerator for filtered enumerator
  */
 typedef struct {
 	enumerator_t public;
-	enumerator_t *unfiltered;
+	enumerator_t *orig;
 	void *data;
-	bool (*filter)(void *data, ...);
+	bool (*filter)(void*,enumerator_t*,va_list);
 	void (*destructor)(void *data);
 } filter_enumerator_t;
 
-/**
- * Implementation of enumerator_create_filter().destroy
- */
-static void destroy_filter(filter_enumerator_t *this)
+METHOD(enumerator_t, destroy_filter, void,
+	filter_enumerator_t *this)
 {
 	if (this->destructor)
 	{
 		this->destructor(this->data);
 	}
-	this->unfiltered->destroy(this->unfiltered);
+	this->orig->destroy(this->orig);
 	free(this);
 }
 
-/**
- * Implementation of enumerator_create_filter().enumerate
- */
-static bool enumerate_filter(filter_enumerator_t *this, void *o1, void *o2,
-							 void *o3, void *o4, void *o5)
+METHOD(enumerator_t, enumerate_filter, bool,
+	filter_enumerator_t *this, va_list args)
 {
-	void *i1, *i2, *i3, *i4, *i5;
+	bool result = FALSE;
 
-	while (this->unfiltered->enumerate(this->unfiltered, &i1, &i2, &i3, &i4, &i5))
+	if (this->filter(this->data, this->orig, args))
 	{
-		if (this->filter(this->data, &i1, o1, &i2, o2, &i3, o3, &i4, o4, &i5, o5))
-		{
-			return TRUE;
-		}
+		result = TRUE;
 	}
-	return FALSE;
+	return result;
 }
 
-/**
- * see header
+/*
+ * Described in header
  */
-enumerator_t *enumerator_create_filter(enumerator_t *unfiltered,
-									   bool (*filter)(void *data, ...),
-									   void *data, void (*destructor)(void *data))
+enumerator_t *enumerator_create_filter(enumerator_t *orig,
+			bool (*filter)(void *data, enumerator_t *orig, va_list args),
+			void *data, void (*destructor)(void *data))
 {
-	filter_enumerator_t *this = malloc_thing(filter_enumerator_t);
-
-	this->public.enumerate = (void*)enumerate_filter;
-	this->public.destroy = (void*)destroy_filter;
-	this->unfiltered = unfiltered;
-	this->filter = filter;
-	this->data = data;
-	this->destructor = destructor;
+	filter_enumerator_t *this;
 
+	INIT(this,
+		.public = {
+			.enumerate = enumerator_enumerate_default,
+			.venumerate = _enumerate_filter,
+			.destroy = _destroy_filter,
+		},
+		.orig = orig,
+		.filter = filter,
+		.data = data,
+		.destructor = destructor,
+	);
 	return &this->public;
 }
 
 /**
- * enumerator for cleaner enumerator
+ * Enumerator for cleaner enumerator
  */
 typedef struct {
 	enumerator_t public;
@@ -559,44 +580,48 @@ typedef struct {
 	void *data;
 } cleaner_enumerator_t;
 
-/**
- * Implementation of enumerator_create_cleanup().destroy
- */
-static void destroy_cleaner(cleaner_enumerator_t *this)
+METHOD(enumerator_t, destroy_cleaner, void,
+	cleaner_enumerator_t *this)
 {
 	this->cleanup(this->data);
 	this->wrapped->destroy(this->wrapped);
 	free(this);
 }
 
-/**
- * Implementation of enumerator_create_cleaner().enumerate
- */
-static bool enumerate_cleaner(cleaner_enumerator_t *this, void *v1, void *v2,
-							  void *v3, void *v4, void *v5)
+METHOD(enumerator_t, enumerate_cleaner, bool,
+	cleaner_enumerator_t *this, va_list args)
 {
-	return this->wrapped->enumerate(this->wrapped, v1, v2, v3, v4, v5);
+	if (!this->wrapped->venumerate)
+	{
+		DBG1(DBG_LIB, "!!! CLEANER ENUMERATOR: venumerate() missing !!!");
+		return FALSE;
+	}
+	return this->wrapped->venumerate(this->wrapped, args);
 }
 
-/**
- * see header
+/*
+ * Described in header
  */
 enumerator_t *enumerator_create_cleaner(enumerator_t *wrapped,
 										void (*cleanup)(void *data), void *data)
 {
-	cleaner_enumerator_t *this = malloc_thing(cleaner_enumerator_t);
-
-	this->public.enumerate = (void*)enumerate_cleaner;
-	this->public.destroy = (void*)destroy_cleaner;
-	this->wrapped = wrapped;
-	this->cleanup = cleanup;
-	this->data = data;
+	cleaner_enumerator_t *this;
 
+	INIT(this,
+		.public = {
+			.enumerate = enumerator_enumerate_default,
+			.venumerate = _enumerate_cleaner,
+			.destroy = _destroy_cleaner,
+		},
+		.wrapped = wrapped,
+		.cleanup = cleanup,
+		.data = data,
+	);
 	return &this->public;
 }
 
 /**
- * enumerator for single enumerator
+ * Enumerator for single enumerator
  */
 typedef struct {
 	enumerator_t public;
@@ -605,10 +630,8 @@ typedef struct {
 	bool done;
 } single_enumerator_t;
 
-/**
- * Implementation of enumerator_create_single().destroy
- */
-static void destroy_single(single_enumerator_t *this)
+METHOD(enumerator_t, destroy_single, void,
+	single_enumerator_t *this)
 {
 	if (this->cleanup)
 	{
@@ -617,11 +640,12 @@ static void destroy_single(single_enumerator_t *this)
 	free(this);
 }
 
-/**
- * Implementation of enumerator_create_single().enumerate
- */
-static bool enumerate_single(single_enumerator_t *this, void **item)
+METHOD(enumerator_t, enumerate_single, bool,
+	single_enumerator_t *this, va_list args)
 {
+	void **item;
+
+	VA_ARGS_VGET(args, item);
 	if (this->done)
 	{
 		return FALSE;
@@ -631,19 +655,21 @@ static bool enumerate_single(single_enumerator_t *this, void **item)
 	return TRUE;
 }
 
-/**
- * see header
+/*
+ * Described in header
  */
 enumerator_t *enumerator_create_single(void *item, void (*cleanup)(void *item))
 {
-	single_enumerator_t *this = malloc_thing(single_enumerator_t);
-
-	this->public.enumerate = (void*)enumerate_single;
-	this->public.destroy = (void*)destroy_single;
-	this->item = item;
-	this->cleanup = cleanup;
-	this->done = FALSE;
+	single_enumerator_t *this;
 
+	INIT(this,
+		.public = {
+			.enumerate = enumerator_enumerate_default,
+			.venumerate = _enumerate_single,
+			.destroy = _destroy_single,
+		},
+		.item = item,
+		.cleanup = cleanup,
+	);
 	return &this->public;
 }
-
diff --git a/src/libstrongswan/collections/enumerator.h b/src/libstrongswan/collections/enumerator.h
index 55f8d83e6..99f8847e4 100644
--- a/src/libstrongswan/collections/enumerator.h
+++ b/src/libstrongswan/collections/enumerator.h
@@ -1,7 +1,7 @@
 /*
- * Copyright (C) 2013 Tobias Brunner
+ * Copyright (C) 2013-2017 Tobias Brunner
  * Copyright (C) 2007 Martin Willi
- * Hochschule fuer Technik Rapperswil
+ * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the
@@ -34,8 +34,11 @@ struct enumerator_t {
 	/**
 	 * Enumerate collection.
 	 *
-	 * The enumerate function takes a variable argument list containing
-	 * pointers where the enumerated values get written.
+	 * The enumerate() method takes a variable number of pointer arguments
+	 * where the enumerated values get written to.
+	 *
+	 * @note Just assigning the generic enumerator_enumerate_default() function
+	 * that calls the enumerator's venumerate() method is usually enough.
 	 *
 	 * @param ...	variable list of enumerated items, implementation dependent
 	 * @return		TRUE if pointers returned
@@ -43,12 +46,34 @@ struct enumerator_t {
 	bool (*enumerate)(enumerator_t *this, ...);
 
 	/**
-	 * Destroy a enumerator instance.
+	 * Enumerate collection.
+	 *
+	 * The venumerate() method takes a variable argument list containing
+	 * pointers where the enumerated values get written to.
+	 *
+	 * To simplify the implementation the VA_ARGS_VGET() macro may be used.
+	 *
+	 * @param args	variable list of enumerated items, implementation dependent
+	 * @return		TRUE if pointers returned
+	 */
+	bool (*venumerate)(enumerator_t *this, va_list args);
+
+	/**
+	 * Destroy an enumerator_t instance.
 	 */
 	void (*destroy)(enumerator_t *this);
 };
 
 /**
+ * Generic implementation of enumerator_t::enumerate() that simply calls
+ * the enumerator's venumerate() method.
+ *
+ * @param enumerator	the enumerator
+ * @param ...			arguments passed to enumerate()
+ */
+bool enumerator_enumerate_default(enumerator_t *enumerator, ...);
+
+/**
  * Create an enumerator which enumerates over nothing
  *
  * @return			an enumerator over no values
@@ -147,38 +172,41 @@ enumerator_t* enumerator_create_token(const char *string, const char *sep,
 /**
  * Creates an enumerator which enumerates over enumerated enumerators :-).
  *
- * The variable argument list of enumeration values is limit to 5.
+ * The outer enumerator is expected to return objects that, when passed to
+ * inner_contructor, will create a new enumerator that will be enumerated until
+ * completion (to this enumerator will the pointer arguments that are passed to
+ * this enumerator be forwarded) at which point a new element from the outer
+ * enumerator is requested to create a new inner enumerator.
  *
  * @param outer					outer enumerator
- * @param inner_constructor		constructor to inner enumerator
+ * @param inner_constructor		constructor to create inner enumerator
  * @param data					data to pass to each inner_constructor call
- * @param destroy_data			destructor to pass to data
+ * @param destructor			destructor function to clean up data after use
  * @return						the nested enumerator
  */
 enumerator_t *enumerator_create_nested(enumerator_t *outer,
 					enumerator_t *(*inner_constructor)(void *outer, void *data),
-					void *data, void (*destroy_data)(void *data));
+					void *data, void (*destructor)(void *data));
 
 /**
- * Creates an enumerator which filters output of another enumerator.
+ * Creates an enumerator which filters/maps output of another enumerator.
  *
- * The filter function receives the user supplied "data" followed by a
- * unfiltered enumeration item, followed by an output pointer where to write
- * the filtered data. Then the next input/output pair follows.
- * It returns TRUE to deliver the
- * values to the caller of enumerate(), FALSE to filter this enumeration.
+ * The filter function receives the user supplied "data" followed by the
+ * original enumerator, followed by the arguments passed to the outer
+ * enumerator.  It returns TRUE to deliver the values assigned to these
+ * arguments to the caller of enumerate() and FALSE to end the enumeration.
+ * Filtering items is simple as the filter function may just skip enumerated
+ * items from the original enumerator.
  *
- * The variable argument list of enumeration values is limit to 5.
- *
- * @param unfiltered			unfiltered enumerator to wrap, gets destroyed
+ * @param orig					original enumerator to wrap, gets destroyed
  * @param filter				filter function
  * @param data					user data to supply to filter
  * @param destructor			destructor function to clean up data after use
  * @return						the filtered enumerator
  */
-enumerator_t *enumerator_create_filter(enumerator_t *unfiltered,
-					bool (*filter)(void *data, ...),
-					void *data, void (*destructor)(void *data));
+enumerator_t *enumerator_create_filter(enumerator_t *orig,
+				bool (*filter)(void *data, enumerator_t *orig, va_list args),
+				void *data, void (*destructor)(void *data));
 
 /**
  * Create an enumerator wrapper which does a cleanup on destroy.
diff --git a/src/libstrongswan/collections/hashtable.c b/src/libstrongswan/collections/hashtable.c
index 2b77a37cc..b0eda9e6a 100644
--- a/src/libstrongswan/collections/hashtable.c
+++ b/src/libstrongswan/collections/hashtable.c
@@ -379,8 +379,13 @@ METHOD(hashtable_t, get_count, u_int,
 }
 
 METHOD(enumerator_t, enumerate, bool,
-	private_enumerator_t *this, const void **key, void **value)
+	private_enumerator_t *this, va_list args)
 {
+	const void **key;
+	void **value;
+
+	VA_ARGS_VGET(args, key, value);
+
 	while (this->count && this->row < this->table->capacity)
 	{
 		this->prev = this->current;
@@ -417,7 +422,8 @@ METHOD(hashtable_t, create_enumerator, enumerator_t*,
 
 	INIT(enumerator,
 		.enumerator = {
-			.enumerate = (void*)_enumerate,
+			.enumerate = enumerator_enumerate_default,
+			.venumerate = _enumerate,
 			.destroy = (void*)free,
 		},
 		.table = this,
diff --git a/src/libstrongswan/collections/linked_list.c b/src/libstrongswan/collections/linked_list.c
index b8fe81578..f877be5a6 100644
--- a/src/libstrongswan/collections/linked_list.c
+++ b/src/libstrongswan/collections/linked_list.c
@@ -47,6 +47,17 @@ struct element_t {
 	element_t *next;
 };
 
+/*
+ * Described in header
+ */
+bool linked_list_match_str(void *item, va_list args)
+{
+	char *a = item, *b;
+
+	VA_ARGS_VGET(args, b);
+	return streq(a, b);
+}
+
 /**
  * Creates an empty linked list object.
  */
@@ -119,8 +130,12 @@ struct private_enumerator_t {
 };
 
 METHOD(enumerator_t, enumerate, bool,
-	private_enumerator_t *this, void **item)
+	private_enumerator_t *this, va_list args)
 {
+	void **item;
+
+	VA_ARGS_VGET(args, item);
+
 	if (this->finished)
 	{
 		return FALSE;
@@ -152,7 +167,8 @@ METHOD(linked_list_t, create_enumerator, enumerator_t*,
 
 	INIT(enumerator,
 		.enumerator = {
-			.enumerate = (void*)_enumerate,
+			.enumerate = enumerator_enumerate_default,
+			.venumerate = _enumerate,
 			.destroy = (void*)free,
 		},
 		.list = this,
@@ -366,52 +382,68 @@ METHOD(linked_list_t, remove_at, void,
 	}
 }
 
-METHOD(linked_list_t, find_first, status_t,
-	private_linked_list_t *this, linked_list_match_t match,
-	void **item, void *d1, void *d2, void *d3, void *d4, void *d5)
+METHOD(linked_list_t, find_first, bool,
+	private_linked_list_t *this, linked_list_match_t match, void **item, ...)
 {
 	element_t *current = this->first;
+	va_list args;
+	bool matched = FALSE;
+
+	if (!match && !item)
+	{
+		return FALSE;
+	}
 
 	while (current)
 	{
-		if ((match && match(current->value, d1, d2, d3, d4, d5)) ||
-			(!match && item && current->value == *item))
+		if (match)
+		{
+			va_start(args, item);
+			matched = match(current->value, args);
+			va_end(args);
+		}
+		else
+		{
+			matched = current->value == *item;
+		}
+		if (matched)
 		{
 			if (item != NULL)
 			{
 				*item = current->value;
 			}
-			return SUCCESS;
+			return TRUE;
 		}
 		current = current->next;
 	}
-	return NOT_FOUND;
+	return FALSE;
 }
 
 METHOD(linked_list_t, invoke_offset, void,
-	private_linked_list_t *this, size_t offset,
-	void *d1, void *d2, void *d3, void *d4, void *d5)
+	private_linked_list_t *this, size_t offset)
 {
 	element_t *current = this->first;
-	linked_list_invoke_t *method;
+	void (**method)(void*);
 
 	while (current)
 	{
 		method = current->value + offset;
-		(*method)(current->value, d1, d2, d3, d4, d5);
+		(*method)(current->value);
 		current = current->next;
 	}
 }
 
 METHOD(linked_list_t, invoke_function, void,
-	private_linked_list_t *this, linked_list_invoke_t fn,
-	void *d1, void *d2, void *d3, void *d4, void *d5)
+	private_linked_list_t *this, linked_list_invoke_t fn, ...)
 {
 	element_t *current = this->first;
+	va_list args;
 
 	while (current)
 	{
-		fn(current->value, d1, d2, d3, d4, d5);
+		va_start(args, fn);
+		fn(current->value, args);
+		va_end(args);
 		current = current->next;
 	}
 }
@@ -542,7 +574,7 @@ linked_list_t *linked_list_create()
 			.reset_enumerator = (void*)_reset_enumerator,
 			.get_first = _get_first,
 			.get_last = _get_last,
-			.find_first = (void*)_find_first,
+			.find_first = _find_first,
 			.insert_first = _insert_first,
 			.insert_last = _insert_last,
 			.insert_before = (void*)_insert_before,
@@ -550,8 +582,8 @@ linked_list_t *linked_list_create()
 			.remove_last = _remove_last,
 			.remove = _remove_,
 			.remove_at = (void*)_remove_at,
-			.invoke_offset = (void*)_invoke_offset,
-			.invoke_function = (void*)_invoke_function,
+			.invoke_offset = _invoke_offset,
+			.invoke_function = _invoke_function,
 			.clone_offset = _clone_offset,
 			.equals_offset = _equals_offset,
 			.equals_function = _equals_function,
diff --git a/src/libstrongswan/collections/linked_list.h b/src/libstrongswan/collections/linked_list.h
index 0b73079d3..246b9a5c5 100644
--- a/src/libstrongswan/collections/linked_list.h
+++ b/src/libstrongswan/collections/linked_list.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007-2015 Tobias Brunner
+ * Copyright (C) 2007-2017 Tobias Brunner
  * Copyright (C) 2005-2008 Martin Willi
  * Copyright (C) 2005 Jan Hutter
  * Hochschule fuer Technik Rapperswil
@@ -28,23 +28,30 @@ typedef struct linked_list_t linked_list_t;
 #include <collections/enumerator.h>
 
 /**
- * Method to match elements in a linked list (used in find_* functions)
+ * Function to match elements in a linked list
  *
  * @param item			current list item
- * @param ...			user supplied data (only pointers, at most 5)
+ * @param args			user supplied data
+ * @return				TRUE, if the item matched, FALSE otherwise
+ */
+typedef bool (*linked_list_match_t)(void *item, va_list args);
+
+/**
+ * Helper function to match a string in a linked list of strings
+ *
+ * @param item			list item (char*)
+ * @param args			user supplied data (char*)
  * @return
- *						- TRUE, if the item matched
- *						- FALSE, otherwise
  */
-typedef bool (*linked_list_match_t)(void *item, ...);
+bool linked_list_match_str(void *item, va_list args);
 
 /**
- * Method to be invoked on elements in a linked list (used in invoke_* functions)
+ * Function to be invoked on elements in a linked list
  *
  * @param item			current list item
- * @param ...			user supplied data (only pointers, at most 5)
+ * @param args			user supplied data
  */
-typedef void (*linked_list_invoke_t)(void *item, ...);
+typedef void (*linked_list_invoke_t)(void *item, va_list args);
 
 /**
  * Class implementing a double linked list.
@@ -167,21 +174,20 @@ struct linked_list_t {
 	 *
 	 * The first object passed to the match function is the current list item,
 	 * followed by the user supplied data.
-	 * If the supplied function returns TRUE this function returns SUCCESS, and
-	 * the current object is returned in the third parameter, otherwise,
+	 * If the supplied function returns TRUE so does this function, and the
+	 * current object is returned in the third parameter (if given), otherwise,
 	 * the next item is checked.
 	 *
 	 * If match is NULL, *item and the current object are compared.
 	 *
-	 * @warning Only use pointers as user supplied data.
-	 *
 	 * @param match			comparison function to call on each object, or NULL
-	 * @param item			the list item, if found
-	 * @param ...			user data to supply to match function (limited to 5 arguments)
-	 * @return				SUCCESS if found, NOT_FOUND otherwise
+	 * @param item			the list item, if found, or NULL
+	 * @param ...			user data to supply to match function
+	 * @return				TRUE if found, FALSE otherwise (or if neither match,
+	 *						nor item is supplied)
 	 */
-	status_t (*find_first) (linked_list_t *this, linked_list_match_t match,
-							void **item, ...);
+	bool (*find_first)(linked_list_t *this, linked_list_match_t match,
+					   void **item, ...);
 
 	/**
 	 * Invoke a method on all of the contained objects.
@@ -192,22 +198,18 @@ struct linked_list_t {
 	 * which can be evalutated at compile time using the offsetof
 	 * macro, e.g.: list->invoke(list, offsetof(object_t, method));
 	 *
-	 * @warning Only use pointers as user supplied data.
-	 *
 	 * @param offset	offset of the method to invoke on objects
-	 * @param ...		user data to supply to called function (limited to 5 arguments)
 	 */
-	void (*invoke_offset) (linked_list_t *this, size_t offset, ...);
+	void (*invoke_offset)(linked_list_t *this, size_t offset);
 
 	/**
 	 * Invoke a function on all of the contained objects.
 	 *
-	 * @warning Only use pointers as user supplied data.
-	 *
-	 * @param function	offset of the method to invoke on objects
-	 * @param ...		user data to supply to called function (limited to 5 arguments)
+	 * @param function	function to call for each object
+	 * @param ...		user data to supply to called function
 	 */
-	void (*invoke_function) (linked_list_t *this, linked_list_invoke_t function, ...);
+	void (*invoke_function)(linked_list_t *this, linked_list_invoke_t function,
+							...);
 
 	/**
 	 * Clones a list and its objects using the objects' clone method.
diff --git a/src/libstrongswan/credentials/auth_cfg.c b/src/libstrongswan/credentials/auth_cfg.c
index 8a3e659fd..a9c8b3904 100644
--- a/src/libstrongswan/credentials/auth_cfg.c
+++ b/src/libstrongswan/credentials/auth_cfg.c
@@ -146,12 +146,14 @@ typedef struct {
 	bool enumerated[AUTH_RULE_MAX];
 } entry_enumerator_t;
 
-/**
- * enumerate function for item_enumerator_t
- */
-static bool enumerate(entry_enumerator_t *this, auth_rule_t *type, void **value)
+METHOD(enumerator_t, enumerate, bool,
+	entry_enumerator_t *this, va_list args)
 {
+	auth_rule_t *type;
 	entry_t *entry;
+	void **value;
+
+	VA_ARGS_VGET(args, type, value);
 
 	while (this->inner->enumerate(this->inner, &entry))
 	{
@@ -174,10 +176,8 @@ static bool enumerate(entry_enumerator_t *this, auth_rule_t *type, void **value)
 	return FALSE;
 }
 
-/**
- * destroy function for item_enumerator_t
- */
-static void entry_enumerator_destroy(entry_enumerator_t *this)
+METHOD(enumerator_t, entry_enumerator_destroy, void,
+	entry_enumerator_t *this)
 {
 	this->inner->destroy(this->inner);
 	free(this);
@@ -190,8 +190,9 @@ METHOD(auth_cfg_t, create_enumerator, enumerator_t*,
 
 	INIT(enumerator,
 		.public = {
-			.enumerate = (void*)enumerate,
-			.destroy = (void*)entry_enumerator_destroy,
+			.enumerate = enumerator_enumerate_default,
+			.venumerate = _enumerate,
+			.destroy = _entry_enumerator_destroy,
 		},
 		.inner = array_create_enumerator(this->entries),
 	);
diff --git a/src/libstrongswan/credentials/credential_factory.c b/src/libstrongswan/credentials/credential_factory.c
index 94c7820e1..07e6ea343 100644
--- a/src/libstrongswan/credentials/credential_factory.c
+++ b/src/libstrongswan/credentials/credential_factory.c
@@ -163,17 +163,23 @@ METHOD(credential_factory_t, create, void*,
 	return construct;
 }
 
-/**
- * Filter function for builder enumerator
- */
-static bool builder_filter(void *null, entry_t **entry, credential_type_t *type,
-						   void *dummy1, int *subtype)
+CALLBACK(builder_filter, bool,
+	void *null, enumerator_t *orig, va_list args)
 {
-	if ((*entry)->final)
+	entry_t *entry;
+	credential_type_t *type;
+	int *subtype;
+
+	VA_ARGS_VGET(args, type, subtype);
+
+	while (orig->enumerate(orig, &entry))
 	{
-		*type = (*entry)->type;
-		*subtype = (*entry)->subtype;
-		return TRUE;
+		if (entry->final)
+		{
+			*type = entry->type;
+			*subtype = entry->subtype;
+			return TRUE;
+		}
 	}
 	return FALSE;
 }
@@ -184,7 +190,7 @@ METHOD(credential_factory_t, create_builder_enumerator, enumerator_t*,
 	this->lock->read_lock(this->lock);
 	return enumerator_create_filter(
 				this->constructors->create_enumerator(this->constructors),
-				(void*)builder_filter, this->lock, (void*)this->lock->unlock);
+				builder_filter, this->lock, (void*)this->lock->unlock);
 }
 
 METHOD(credential_factory_t, destroy, void,
diff --git a/src/libstrongswan/credentials/credential_manager.c b/src/libstrongswan/credentials/credential_manager.c
index 8e8be7ef2..0a8d3d101 100644
--- a/src/libstrongswan/credentials/credential_manager.c
+++ b/src/libstrongswan/credentials/credential_manager.c
@@ -155,8 +155,12 @@ METHOD(credential_manager_t, call_hook, void,
 }
 
 METHOD(enumerator_t, sets_enumerate, bool,
-	sets_enumerator_t *this, credential_set_t **set)
+	sets_enumerator_t *this, va_list args)
 {
+	credential_set_t **set;
+
+	VA_ARGS_VGET(args, set);
+
 	if (this->exclusive)
 	{
 		if (this->exclusive->enumerate(this->exclusive, set))
@@ -202,7 +206,8 @@ static enumerator_t *create_sets_enumerator(private_credential_manager_t *this)
 
 	INIT(enumerator,
 		.public = {
-			.enumerate = (void*)_sets_enumerate,
+			.enumerate = enumerator_enumerate_default,
+			.venumerate = _sets_enumerate,
 			.destroy = _sets_destroy,
 		},
 	);
@@ -807,11 +812,12 @@ static bool verify_trust_chain(private_credential_manager_t *this,
 	return trusted;
 }
 
-/**
- * List find match function for certificates
- */
-static bool cert_equals(certificate_t *a, certificate_t *b)
+CALLBACK(cert_equals, bool,
+	certificate_t *a, va_list args)
 {
+	certificate_t *b;
+
+	VA_ARGS_VGET(args, b);
 	return a->equals(a, b);
 }
 
@@ -840,9 +846,12 @@ typedef struct {
 } trusted_enumerator_t;
 
 METHOD(enumerator_t, trusted_enumerate, bool,
-	trusted_enumerator_t *this, certificate_t **cert, auth_cfg_t **auth)
+	trusted_enumerator_t *this, va_list args)
 {
-	certificate_t *current;
+	certificate_t *current, **cert;
+	auth_cfg_t **auth;
+
+	VA_ARGS_VGET(args, cert, auth);
 
 	DESTROY_IF(this->auth);
 	this->auth = auth_cfg_create();
@@ -888,8 +897,7 @@ METHOD(enumerator_t, trusted_enumerate, bool,
 			continue;
 		}
 
-		if (this->failed->find_first(this->failed, (void*)cert_equals,
-									 NULL, current) == SUCCESS)
+		if (this->failed->find_first(this->failed, cert_equals, NULL, current))
 		{	/* check each candidate only once */
 			continue;
 		}
@@ -931,7 +939,8 @@ METHOD(credential_manager_t, create_trusted_enumerator, enumerator_t*,
 
 	INIT(enumerator,
 		.public = {
-			.enumerate = (void*)_trusted_enumerate,
+			.enumerate = enumerator_enumerate_default,
+			.venumerate = _trusted_enumerate,
 			.destroy = _trusted_destroy,
 		},
 		.this = this,
@@ -960,9 +969,13 @@ typedef struct {
 } public_enumerator_t;
 
 METHOD(enumerator_t, public_enumerate, bool,
-	public_enumerator_t *this, public_key_t **key, auth_cfg_t **auth)
+	public_enumerator_t *this, va_list args)
 {
 	certificate_t *cert;
+	public_key_t **key;
+	auth_cfg_t **auth;
+
+	VA_ARGS_VGET(args, key, auth);
 
 	while (this->inner->enumerate(this->inner, &cert, auth))
 	{
@@ -1001,7 +1014,8 @@ METHOD(credential_manager_t, create_public_enumerator, enumerator_t*,
 
 	INIT(enumerator,
 		.public = {
-			.enumerate = (void*)_public_enumerate,
+			.enumerate = enumerator_enumerate_default,
+			.venumerate = _public_enumerate,
 			.destroy = _public_destroy,
 		},
 		.inner = create_trusted_enumerator(this, type, id, online),
diff --git a/src/libstrongswan/credentials/keys/public_key.c b/src/libstrongswan/credentials/keys/public_key.c
index 2c76ad680..87f7e6664 100644
--- a/src/libstrongswan/credentials/keys/public_key.c
+++ b/src/libstrongswan/credentials/keys/public_key.c
@@ -272,8 +272,12 @@ typedef struct  {
 } private_enumerator_t;
 
 METHOD(enumerator_t, signature_schemes_enumerate, bool,
-	private_enumerator_t *this, signature_scheme_t *scheme)
+	private_enumerator_t *this, va_list args)
 {
+	signature_scheme_t *scheme;
+
+	VA_ARGS_VGET(args, scheme);
+
 	while (++this->index < countof(scheme_map))
 	{
 		if (this->type == scheme_map[this->index].type &&
@@ -296,7 +300,8 @@ enumerator_t *signature_schemes_for_key(key_type_t type, int size)
 
 	INIT(this,
 		.public = {
-			.enumerate = (void*)_signature_schemes_enumerate,
+			.enumerate = enumerator_enumerate_default,
+			.venumerate = _signature_schemes_enumerate,
 			.destroy = (void*)free,
 		},
 		.index = -1,
diff --git a/src/libstrongswan/credentials/sets/auth_cfg_wrapper.c b/src/libstrongswan/credentials/sets/auth_cfg_wrapper.c
index 8393d5b18..1cd4b9d03 100644
--- a/src/libstrongswan/credentials/sets/auth_cfg_wrapper.c
+++ b/src/libstrongswan/credentials/sets/auth_cfg_wrapper.c
@@ -112,15 +112,15 @@ static bool fetch_cert(wrapper_enumerator_t *enumerator,
 	return TRUE;
 }
 
-/**
- * enumerate function for wrapper_enumerator_t
- */
-static bool enumerate(wrapper_enumerator_t *this, certificate_t **cert)
+METHOD(enumerator_t, enumerate, bool,
+	wrapper_enumerator_t *this, va_list args)
 {
 	auth_rule_t rule;
-	certificate_t *current;
+	certificate_t *current, **cert;
 	public_key_t *public;
 
+	VA_ARGS_VGET(args, cert);
+
 	while (this->inner->enumerate(this->inner, &rule, &current))
 	{
 		if (rule == AUTH_HELPER_IM_HASH_URL ||
@@ -164,10 +164,8 @@ static bool enumerate(wrapper_enumerator_t *this, certificate_t **cert)
 	return FALSE;
 }
 
-/**
- * destroy function for wrapper_enumerator_t
- */
-static void wrapper_enumerator_destroy(wrapper_enumerator_t *this)
+METHOD(enumerator_t, wrapper_enumerator_destroy, void,
+	wrapper_enumerator_t *this)
 {
 	this->inner->destroy(this->inner);
 	free(this);
@@ -183,14 +181,18 @@ METHOD(credential_set_t, create_enumerator, enumerator_t*,
 	{
 		return NULL;
 	}
-	enumerator = malloc_thing(wrapper_enumerator_t);
-	enumerator->auth = this->auth;
-	enumerator->cert = cert;
-	enumerator->key = key;
-	enumerator->id = id;
-	enumerator->inner = this->auth->create_enumerator(this->auth);
-	enumerator->public.enumerate = (void*)enumerate;
-	enumerator->public.destroy = (void*)wrapper_enumerator_destroy;
+	INIT(enumerator,
+		.public = {
+			.enumerate = enumerator_enumerate_default,
+			.venumerate = _enumerate,
+			.destroy = _wrapper_enumerator_destroy,
+		},
+		.auth = this->auth,
+		.cert = cert,
+		.key = key,
+		.id = id,
+		.inner = this->auth->create_enumerator(this->auth),
+	);
 	return &enumerator->public;
 }
 
diff --git a/src/libstrongswan/credentials/sets/callback_cred.c b/src/libstrongswan/credentials/sets/callback_cred.c
index bff33f029..0d72452da 100644
--- a/src/libstrongswan/credentials/sets/callback_cred.c
+++ b/src/libstrongswan/credentials/sets/callback_cred.c
@@ -60,9 +60,12 @@ typedef struct {
 } shared_enumerator_t;
 
 METHOD(enumerator_t, shared_enumerate, bool,
-	shared_enumerator_t *this, shared_key_t **out,
-	id_match_t *match_me, id_match_t *match_other)
+	shared_enumerator_t *this, va_list args)
 {
+	shared_key_t **out;
+	id_match_t *match_me, *match_other;
+
+	VA_ARGS_VGET(args, out, match_me, match_other);
 	DESTROY_IF(this->current);
 	this->current = this->this->cb.shared(this->this->data, this->type,
 								this->me, this->other, match_me, match_other);
@@ -89,7 +92,8 @@ METHOD(credential_set_t, create_shared_enumerator, enumerator_t*,
 
 	INIT(enumerator,
 		.public = {
-			.enumerate = (void*)_shared_enumerate,
+			.enumerate = enumerator_enumerate_default,
+			.venumerate = _shared_enumerate,
 			.destroy = _shared_destroy,
 		},
 		.this = this,
diff --git a/src/libstrongswan/credentials/sets/cert_cache.c b/src/libstrongswan/credentials/sets/cert_cache.c
index 24fdb194b..92d5efdc6 100644
--- a/src/libstrongswan/credentials/sets/cert_cache.c
+++ b/src/libstrongswan/credentials/sets/cert_cache.c
@@ -252,13 +252,14 @@ typedef struct {
 	int locked;
 } cert_enumerator_t;
 
-/**
- * filter function for certs enumerator
- */
-static bool cert_enumerate(cert_enumerator_t *this, certificate_t **out)
+METHOD(enumerator_t, cert_enumerate, bool,
+	cert_enumerator_t *this, va_list args)
 {
 	public_key_t *public;
 	relation_t *rel;
+	certificate_t **out;
+
+	VA_ARGS_VGET(args, out);
 
 	if (this->locked >= 0)
 	{
@@ -311,10 +312,8 @@ static bool cert_enumerate(cert_enumerator_t *this, certificate_t **out)
 	return FALSE;
 }
 
-/**
- * clean up enumeration data
- */
-static void cert_enumerator_destroy(cert_enumerator_t *this)
+METHOD(enumerator_t, cert_enumerator_destroy, void,
+	cert_enumerator_t *this)
 {
 	relation_t *rel;
 
@@ -336,16 +335,19 @@ METHOD(credential_set_t, create_enumerator, enumerator_t*,
 	{
 		return NULL;
 	}
-	enumerator = malloc_thing(cert_enumerator_t);
-	enumerator->public.enumerate = (void*)cert_enumerate;
-	enumerator->public.destroy = (void*)cert_enumerator_destroy;
-	enumerator->cert = cert;
-	enumerator->key = key;
-	enumerator->id = id;
-	enumerator->relations = this->relations;
-	enumerator->index = -1;
-	enumerator->locked = -1;
-
+	INIT(enumerator,
+		.public = {
+			.enumerate = enumerator_enumerate_default,
+			.venumerate = _cert_enumerate,
+			.destroy = _cert_enumerator_destroy,
+		},
+		.cert = cert,
+		.key = key,
+		.id = id,
+		.relations = this->relations,
+		.index = -1,
+		.locked = -1,
+	);
 	return &enumerator->public;
 }
 
diff --git a/src/libstrongswan/credentials/sets/mem_cred.c b/src/libstrongswan/credentials/sets/mem_cred.c
index 53e035f98..4d594e439 100644
--- a/src/libstrongswan/credentials/sets/mem_cred.c
+++ b/src/libstrongswan/credentials/sets/mem_cred.c
@@ -74,25 +74,27 @@ typedef struct {
 	identification_t *id;
 } cert_data_t;
 
-/**
- * destroy cert_data
- */
-static void cert_data_destroy(cert_data_t *data)
+CALLBACK(cert_data_destroy, void,
+	cert_data_t *data)
 {
 	data->lock->unlock(data->lock);
 	free(data);
 }
 
-/**
- * filter function for certs enumerator
- */
-static bool certs_filter(cert_data_t *data, certificate_t **in, certificate_t **out)
+CALLBACK(certs_filter, bool,
+	cert_data_t *data, enumerator_t *orig, va_list args)
 {
 	public_key_t *public;
-	certificate_t *cert = *in;
+	certificate_t *cert, **out;
+
+	VA_ARGS_VGET(args, out);
 
-	if (data->cert == CERT_ANY || data->cert == cert->get_type(cert))
+	while (orig->enumerate(orig, &cert))
 	{
+		if (data->cert != CERT_ANY && data->cert != cert->get_type(cert))
+		{
+			continue;
+		}
 		public = cert->get_public_key(cert);
 		if (public)
 		{
@@ -102,7 +104,7 @@ static bool certs_filter(cert_data_t *data, certificate_t **in, certificate_t **
 											data->id->get_encoding(data->id)))
 				{
 					public->destroy(public);
-					*out = *in;
+					*out = cert;
 					return TRUE;
 				}
 			}
@@ -110,11 +112,11 @@ static bool certs_filter(cert_data_t *data, certificate_t **in, certificate_t **
 		}
 		else if (data->key != KEY_ANY)
 		{
-			return FALSE;
+			continue;
 		}
-		if (data->id == NULL || cert->has_subject(cert, data->id))
+		if (!data->id || cert->has_subject(cert, data->id))
 		{
-			*out = *in;
+			*out = cert;
 			return TRUE;
 		}
 	}
@@ -143,12 +145,16 @@ METHOD(credential_set_t, create_cert_enumerator, enumerator_t*,
 	{
 		enumerator = this->untrusted->create_enumerator(this->untrusted);
 	}
-	return enumerator_create_filter(enumerator, (void*)certs_filter, data,
-									(void*)cert_data_destroy);
+	return enumerator_create_filter(enumerator, certs_filter, data,
+									cert_data_destroy);
 }
 
-static bool certificate_equals(certificate_t *item, certificate_t *cert)
+CALLBACK(certificate_equals, bool,
+	certificate_t *item, va_list args)
 {
+	certificate_t *cert;
+
+	VA_ARGS_VGET(args, cert);
 	return item->equals(item, cert);
 }
 
@@ -161,9 +167,8 @@ static certificate_t *add_cert_internal(private_mem_cred_t *this, bool trusted,
 {
 	certificate_t *cached;
 	this->lock->write_lock(this->lock);
-	if (this->untrusted->find_first(this->untrusted,
-									(linked_list_match_t)certificate_equals,
-									(void**)&cached, cert) == SUCCESS)
+	if (this->untrusted->find_first(this->untrusted, certificate_equals,
+									(void**)&cached, cert))
 	{
 		cert->destroy(cert);
 		cert = cached->get_ref(cached);
@@ -199,9 +204,8 @@ METHOD(mem_cred_t, get_cert_ref, certificate_t*,
 	certificate_t *cached;
 
 	this->lock->read_lock(this->lock);
-	if (this->untrusted->find_first(this->untrusted,
-									(linked_list_match_t)certificate_equals,
-									(void**)&cached, cert) == SUCCESS)
+	if (this->untrusted->find_first(this->untrusted, certificate_equals,
+									(void**)&cached, cert))
 	{
 		cert->destroy(cert);
 		cert = cached->get_ref(cached);
@@ -301,30 +305,30 @@ typedef struct {
 	identification_t *id;
 } key_data_t;
 
-/**
- * Destroy key enumerator data
- */
-static void key_data_destroy(key_data_t *data)
+CALLBACK(key_data_destroy, void,
+	key_data_t *data)
 {
 	data->lock->unlock(data->lock);
 	free(data);
 }
 
-/**
- * filter function for private key enumerator
- */
-static bool key_filter(key_data_t *data, private_key_t **in, private_key_t **out)
+CALLBACK(key_filter, bool,
+	key_data_t *data, enumerator_t *orig, va_list args)
 {
-	private_key_t *key;
+	private_key_t *key, **out;
+
+	VA_ARGS_VGET(args, out);
 
-	key = *in;
-	if (data->type == KEY_ANY || data->type == key->get_type(key))
+	while (orig->enumerate(orig, &key))
 	{
-		if (data->id == NULL ||
-			key->has_fingerprint(key, data->id->get_encoding(data->id)))
+		if (data->type == KEY_ANY || data->type == key->get_type(key))
 		{
-			*out = key;
-			return TRUE;
+			if (data->id == NULL ||
+				key->has_fingerprint(key, data->id->get_encoding(data->id)))
+			{
+				*out = key;
+				return TRUE;
+			}
 		}
 	}
 	return FALSE;
@@ -342,7 +346,7 @@ METHOD(credential_set_t, create_private_enumerator, enumerator_t*,
 	);
 	this->lock->read_lock(this->lock);
 	return enumerator_create_filter(this->keys->create_enumerator(this->keys),
-							(void*)key_filter, data, (void*)key_data_destroy);
+									key_filter, data, key_data_destroy);
 }
 
 METHOD(mem_cred_t, add_key, void,
@@ -468,10 +472,8 @@ typedef struct {
 	shared_key_type_t type;
 } shared_data_t;
 
-/**
- * free shared key enumerator data and unlock list
- */
-static void shared_data_destroy(shared_data_t *data)
+CALLBACK(shared_data_destroy, void,
+	shared_data_t *data)
 {
 	data->lock->unlock(data->lock);
 	free(data);
@@ -499,44 +501,47 @@ static id_match_t has_owner(shared_entry_t *entry, identification_t *owner)
 	return best;
 }
 
-/**
- * enumerator filter function for shared entries
- */
-static bool shared_filter(shared_data_t *data,
-						  shared_entry_t **in, shared_key_t **out,
-						  void **unused1, id_match_t *me,
-						  void **unused2, id_match_t *other)
+CALLBACK(shared_filter, bool,
+	shared_data_t *data, enumerator_t *orig, va_list args)
 {
 	id_match_t my_match = ID_MATCH_NONE, other_match = ID_MATCH_NONE;
-	shared_entry_t *entry = *in;
+	shared_entry_t *entry;
+	shared_key_t **out;
+	id_match_t *me, *other;
 
-	if (data->type != SHARED_ANY &&
-		entry->shared->get_type(entry->shared) != data->type)
-	{
-		return FALSE;
-	}
-	if (data->me)
-	{
-		my_match = has_owner(entry, data->me);
-	}
-	if (data->other)
-	{
-		other_match = has_owner(entry, data->other);
-	}
-	if ((data->me || data->other) && (!my_match && !other_match))
-	{
-		return FALSE;
-	}
-	*out = entry->shared;
-	if (me)
-	{
-		*me = my_match;
-	}
-	if (other)
+	VA_ARGS_VGET(args, out, me, other);
+
+	while (orig->enumerate(orig, &entry))
 	{
-		*other = other_match;
+		if (data->type != SHARED_ANY &&
+			entry->shared->get_type(entry->shared) != data->type)
+		{
+			continue;
+		}
+		if (data->me)
+		{
+			my_match = has_owner(entry, data->me);
+		}
+		if (data->other)
+		{
+			other_match = has_owner(entry, data->other);
+		}
+		if ((data->me || data->other) && (!my_match && !other_match))
+		{
+			continue;
+		}
+		*out = entry->shared;
+		if (me)
+		{
+			*me = my_match;
+		}
+		if (other)
+		{
+			*other = other_match;
+		}
+		return TRUE;
 	}
-	return TRUE;
+	return FALSE;
 }
 
 METHOD(credential_set_t, create_shared_enumerator, enumerator_t*,
@@ -554,7 +559,7 @@ METHOD(credential_set_t, create_shared_enumerator, enumerator_t*,
 	data->lock->read_lock(data->lock);
 	return enumerator_create_filter(
 						this->shared->create_enumerator(this->shared),
-						(void*)shared_filter, data, (void*)shared_data_destroy);
+						shared_filter, data, shared_data_destroy);
 }
 
 METHOD(mem_cred_t, add_shared_unique, void,
@@ -648,23 +653,27 @@ METHOD(mem_cred_t, remove_shared_unique, void,
 	this->lock->unlock(this->lock);
 }
 
-/**
- * Filter unique ids of shared keys (ingore secrets without unique id)
- */
-static bool unique_filter(void *unused,
-						  shared_entry_t **in, char **id)
+CALLBACK(unique_filter, bool,
+	void *unused, enumerator_t *orig, va_list args)
 {
-	shared_entry_t *entry = *in;
+	shared_entry_t *entry;
+	char **id;
 
-	if (!entry->id)
-	{
-		return FALSE;
-	}
-	if (id)
+	VA_ARGS_VGET(args, id);
+
+	while (orig->enumerate(orig, &entry))
 	{
-		*id = entry->id;
+		if (!entry->id)
+		{
+			continue;
+		}
+		if (id)
+		{
+			*id = entry->id;
+		}
+		return TRUE;
 	}
-	return TRUE;
+	return FALSE;
 }
 
 METHOD(mem_cred_t, create_unique_shared_enumerator, enumerator_t*,
@@ -673,7 +682,7 @@ METHOD(mem_cred_t, create_unique_shared_enumerator, enumerator_t*,
 	this->lock->read_lock(this->lock);
 	return enumerator_create_filter(
 								this->shared->create_enumerator(this->shared),
-								(void*)unique_filter, this->lock,
+								unique_filter, this->lock,
 								(void*)this->lock->unlock);
 }
 
@@ -721,30 +730,35 @@ typedef struct {
 	rwlock_t *lock;
 } cdp_data_t;
 
-/**
- * Clean up CDP enumerator data
- */
-static void cdp_data_destroy(cdp_data_t *data)
+CALLBACK(cdp_data_destroy, void,
+	cdp_data_t *data)
 {
 	data->lock->unlock(data->lock);
 	free(data);
 }
 
-/**
- * CDP enumerator filter
- */
-static bool cdp_filter(cdp_data_t *data, cdp_t **cdp, char **uri)
+CALLBACK(cdp_filter, bool,
+	cdp_data_t *data, enumerator_t *orig, va_list args)
 {
-	if (data->type != CERT_ANY && data->type != (*cdp)->type)
-	{
-		return FALSE;
-	}
-	if (data->id && !(*cdp)->id->matches((*cdp)->id, data->id))
+	cdp_t *cdp;
+	char **uri;
+
+	VA_ARGS_VGET(args, uri);
+
+	while (orig->enumerate(orig, &cdp))
 	{
-		return FALSE;
+		if (data->type != CERT_ANY && data->type != cdp->type)
+		{
+			continue;
+		}
+		if (data->id && !cdp->id->matches(cdp->id, data->id))
+		{
+			continue;
+		}
+		*uri = cdp->uri;
+		return TRUE;
 	}
-	*uri = (*cdp)->uri;
-	return TRUE;
+	return FALSE;
 }
 
 METHOD(credential_set_t, create_cdp_enumerator, enumerator_t*,
@@ -759,7 +773,7 @@ METHOD(credential_set_t, create_cdp_enumerator, enumerator_t*,
 	);
 	this->lock->read_lock(this->lock);
 	return enumerator_create_filter(this->cdps->create_enumerator(this->cdps),
-							(void*)cdp_filter, data, (void*)cdp_data_destroy);
+									cdp_filter, data, cdp_data_destroy);
 
 }
 
diff --git a/src/libstrongswan/credentials/sets/ocsp_response_wrapper.c b/src/libstrongswan/credentials/sets/ocsp_response_wrapper.c
index 151d69216..12d3f8156 100644
--- a/src/libstrongswan/credentials/sets/ocsp_response_wrapper.c
+++ b/src/libstrongswan/credentials/sets/ocsp_response_wrapper.c
@@ -49,14 +49,15 @@ typedef struct {
 	identification_t *id;
 } wrapper_enumerator_t;
 
-/**
- * enumerate function wrapper_enumerator_t
- */
-static bool enumerate(wrapper_enumerator_t *this, certificate_t **cert)
+METHOD(enumerator_t, enumerate, bool,
+	wrapper_enumerator_t *this, va_list args)
 {
-	certificate_t *current;
+	certificate_t *current, **cert;
 	public_key_t *public;
 
+
+	VA_ARGS_VGET(args, cert);
+
 	while (this->inner->enumerate(this->inner, &current))
 	{
 		if (this->cert != CERT_ANY && this->cert != current->get_type(current))
@@ -85,10 +86,8 @@ static bool enumerate(wrapper_enumerator_t *this, certificate_t **cert)
 	return FALSE;
 }
 
-/**
- * destroy function for wrapper_enumerator_t
- */
-static void enumerator_destroy(wrapper_enumerator_t *this)
+METHOD(enumerator_t, enumerator_destroy, void,
+	wrapper_enumerator_t *this)
 {
 	this->inner->destroy(this->inner);
 	free(this);
@@ -105,13 +104,17 @@ METHOD(credential_set_t, create_enumerator, enumerator_t*,
 		return NULL;
 	}
 
-	enumerator = malloc_thing(wrapper_enumerator_t);
-	enumerator->cert = cert;
-	enumerator->key = key;
-	enumerator->id = id;
-	enumerator->inner = this->response->create_cert_enumerator(this->response);
-	enumerator->public.enumerate = (void*)enumerate;
-	enumerator->public.destroy = (void*)enumerator_destroy;
+	INIT(enumerator,
+		.public = {
+			.enumerate = enumerator_enumerate_default,
+			.venumerate = _enumerate,
+			.destroy = _enumerator_destroy,
+		},
+		.cert = cert,
+		.key = key,
+		.id = id,
+		.inner = this->response->create_cert_enumerator(this->response),
+	);
 	return &enumerator->public;
 }
 
diff --git a/src/libstrongswan/crypto/crypto_factory.c b/src/libstrongswan/crypto/crypto_factory.c
index bab59a06f..096bcbc9c 100644
--- a/src/libstrongswan/crypto/crypto_factory.c
+++ b/src/libstrongswan/crypto/crypto_factory.c
@@ -811,51 +811,66 @@ METHOD(crypto_factory_t, remove_dh, void,
 	this->lock->unlock(this->lock);
 }
 
-/**
- * match algorithms of an entry?
- */
-static bool entry_match(entry_t *a, entry_t *b)
+CALLBACK(entry_match, bool,
+	entry_t *a, va_list args)
 {
+	entry_t *b;
+
+	VA_ARGS_VGET(args, b);
 	return a->algo == b->algo;
 }
 
-/**
- * check for uniqueness of an entry
- */
-static bool unique_check(linked_list_t *list, entry_t **in, entry_t **out)
+CALLBACK(unique_check, bool,
+	linked_list_t *list, enumerator_t *orig, va_list args)
 {
-	if (list->find_first(list, (void*)entry_match, NULL, *in) == SUCCESS)
+	entry_t *entry, **out;
+
+	VA_ARGS_VGET(args, out);
+
+	while (orig->enumerate(orig, &entry))
 	{
-		return FALSE;
+		if (list->find_first(list, entry_match, NULL, entry))
+		{
+			continue;
+		}
+		*out = entry;
+		list->insert_last(list, entry);
+		return TRUE;
 	}
-	*out = *in;
-	list->insert_last(list, *in);
-	return TRUE;
+	return FALSE;
 }
 
 /**
  * create an enumerator over entry->algo in list with locking and unique check
  */
 static enumerator_t *create_enumerator(private_crypto_factory_t *this,
-									   linked_list_t *list, void *filter)
+									linked_list_t *list,
+									bool (*filter)(void*,enumerator_t*,va_list))
 {
 	this->lock->read_lock(this->lock);
 	return enumerator_create_filter(
 				enumerator_create_filter(
-					list->create_enumerator(list), (void*)unique_check,
+					list->create_enumerator(list), unique_check,
 					linked_list_create(), (void*)list->destroy),
 				filter,	this->lock, (void*)this->lock->unlock);
 }
 
-/**
- * Filter function to enumerate algorithm, not entry
- */
-static bool crypter_filter(void *n, entry_t **entry, encryption_algorithm_t *algo,
-						   void *i2, const char **plugin_name)
+CALLBACK(crypter_filter, bool,
+	void *n, enumerator_t *orig, va_list args)
 {
-	*algo = (*entry)->algo;
-	*plugin_name = (*entry)->plugin_name;
-	return TRUE;
+	entry_t *entry;
+	encryption_algorithm_t *algo;
+	const char **plugin_name;
+
+	VA_ARGS_VGET(args, algo, plugin_name);
+
+	if (orig->enumerate(orig, &entry))
+	{
+		*algo = entry->algo;
+		*plugin_name = entry->plugin_name;
+		return TRUE;
+	}
+	return FALSE;
 }
 
 METHOD(crypto_factory_t, create_crypter_enumerator, enumerator_t*,
@@ -870,15 +885,22 @@ METHOD(crypto_factory_t, create_aead_enumerator, enumerator_t*,
 	return create_enumerator(this, this->aeads, crypter_filter);
 }
 
-/**
- * Filter function to enumerate algorithm, not entry
- */
-static bool signer_filter(void *n, entry_t **entry, integrity_algorithm_t *algo,
-						  void *i2, const char **plugin_name)
+CALLBACK(signer_filter, bool,
+	void *n, enumerator_t *orig, va_list args)
 {
-	*algo = (*entry)->algo;
-	*plugin_name = (*entry)->plugin_name;
-	return TRUE;
+	entry_t *entry;
+	integrity_algorithm_t *algo;
+	const char **plugin_name;
+
+	VA_ARGS_VGET(args, algo, plugin_name);
+
+	if (orig->enumerate(orig, &entry))
+	{
+		*algo = entry->algo;
+		*plugin_name = entry->plugin_name;
+		return TRUE;
+	}
+	return FALSE;
 }
 
 METHOD(crypto_factory_t, create_signer_enumerator, enumerator_t*,
@@ -887,15 +909,22 @@ METHOD(crypto_factory_t, create_signer_enumerator, enumerator_t*,
 	return create_enumerator(this, this->signers, signer_filter);
 }
 
-/**
- * Filter function to enumerate algorithm, not entry
- */
-static bool hasher_filter(void *n, entry_t **entry, hash_algorithm_t *algo,
-						  void *i2, const char **plugin_name)
+CALLBACK(hasher_filter, bool,
+	void *n, enumerator_t *orig, va_list args)
 {
-	*algo = (*entry)->algo;
-	*plugin_name = (*entry)->plugin_name;
-	return TRUE;
+	entry_t *entry;
+	hash_algorithm_t *algo;
+	const char **plugin_name;
+
+	VA_ARGS_VGET(args, algo, plugin_name);
+
+	if (orig->enumerate(orig, &entry))
+	{
+		*algo = entry->algo;
+		*plugin_name = entry->plugin_name;
+		return TRUE;
+	}
+	return FALSE;
 }
 
 METHOD(crypto_factory_t, create_hasher_enumerator, enumerator_t*,
@@ -904,15 +933,22 @@ METHOD(crypto_factory_t, create_hasher_enumerator, enumerator_t*,
 	return create_enumerator(this, this->hashers, hasher_filter);
 }
 
-/**
- * Filter function to enumerate algorithm, not entry
- */
-static bool prf_filter(void *n, entry_t **entry, pseudo_random_function_t *algo,
-					   void *i2, const char **plugin_name)
+CALLBACK(prf_filter, bool,
+	void *n, enumerator_t *orig, va_list args)
 {
-	*algo = (*entry)->algo;
-	*plugin_name = (*entry)->plugin_name;
-	return TRUE;
+	entry_t *entry;
+	pseudo_random_function_t *algo;
+	const char **plugin_name;
+
+	VA_ARGS_VGET(args, algo, plugin_name);
+
+	if (orig->enumerate(orig, &entry))
+	{
+		*algo = entry->algo;
+		*plugin_name = entry->plugin_name;
+		return TRUE;
+	}
+	return FALSE;
 }
 
 METHOD(crypto_factory_t, create_prf_enumerator, enumerator_t*,
@@ -921,15 +957,22 @@ METHOD(crypto_factory_t, create_prf_enumerator, enumerator_t*,
 	return create_enumerator(this, this->prfs, prf_filter);
 }
 
-/**
- * Filter function to enumerate algorithm, not entry
- */
-static bool xof_filter(void *n, entry_t **entry, ext_out_function_t *algo,
-					   void *i2, const char **plugin_name)
+CALLBACK(xof_filter, bool,
+	void *n, enumerator_t *orig, va_list args)
 {
-	*algo = (*entry)->algo;
-	*plugin_name = (*entry)->plugin_name;
-	return TRUE;
+	entry_t *entry;
+	ext_out_function_t *algo;
+	const char **plugin_name;
+
+	VA_ARGS_VGET(args, algo, plugin_name);
+
+	if (orig->enumerate(orig, &entry))
+	{
+		*algo = entry->algo;
+		*plugin_name = entry->plugin_name;
+		return TRUE;
+	}
+	return FALSE;
 }
 
 METHOD(crypto_factory_t, create_xof_enumerator, enumerator_t*,
@@ -938,15 +981,22 @@ METHOD(crypto_factory_t, create_xof_enumerator, enumerator_t*,
 	return create_enumerator(this, this->xofs, xof_filter);
 }
 
-/**
- * Filter function to enumerate group, not entry
- */
-static bool dh_filter(void *n, entry_t **entry, diffie_hellman_group_t *group,
-					  void *i2, const char **plugin_name)
+CALLBACK(dh_filter, bool,
+	void *n, enumerator_t *orig, va_list args)
 {
-	*group = (*entry)->algo;
-	*plugin_name = (*entry)->plugin_name;
-	return TRUE;
+	entry_t *entry;
+	diffie_hellman_group_t *algo;
+	const char **plugin_name;
+
+	VA_ARGS_VGET(args, algo, plugin_name);
+
+	if (orig->enumerate(orig, &entry))
+	{
+		*algo = entry->algo;
+		*plugin_name = entry->plugin_name;
+		return TRUE;
+	}
+	return FALSE;
 }
 
 METHOD(crypto_factory_t, create_dh_enumerator, enumerator_t*,
@@ -955,15 +1005,22 @@ METHOD(crypto_factory_t, create_dh_enumerator, enumerator_t*,
 	return create_enumerator(this, this->dhs, dh_filter);
 }
 
-/**
- * Filter function to enumerate strength, not entry
- */
-static bool rng_filter(void *n, entry_t **entry, rng_quality_t *quality,
-					   void *i2, const char **plugin_name)
+CALLBACK(rng_filter, bool,
+	void *n, enumerator_t *orig, va_list args)
 {
-	*quality = (*entry)->algo;
-	*plugin_name = (*entry)->plugin_name;
-	return TRUE;
+	entry_t *entry;
+	rng_quality_t *algo;
+	const char **plugin_name;
+
+	VA_ARGS_VGET(args, algo, plugin_name);
+
+	if (orig->enumerate(orig, &entry))
+	{
+		*algo = entry->algo;
+		*plugin_name = entry->plugin_name;
+		return TRUE;
+	}
+	return FALSE;
 }
 
 METHOD(crypto_factory_t, create_rng_enumerator, enumerator_t*,
@@ -972,13 +1029,20 @@ METHOD(crypto_factory_t, create_rng_enumerator, enumerator_t*,
 	return create_enumerator(this, this->rngs, rng_filter);
 }
 
-/**
- * Filter function to enumerate plugin name, not entry
- */
-static bool nonce_gen_filter(void *n, entry_t **entry, const char **plugin_name)
+CALLBACK(nonce_gen_filter, bool,
+	void *n, enumerator_t *orig, va_list args)
 {
-	*plugin_name = (*entry)->plugin_name;
-	return TRUE;
+	entry_t *entry;
+	const char **plugin_name;
+
+	VA_ARGS_VGET(args, plugin_name);
+
+	if (orig->enumerate(orig, &entry))
+	{
+		*plugin_name = entry->plugin_name;
+		return TRUE;
+	}
+	return FALSE;
 }
 
 METHOD(crypto_factory_t, create_nonce_gen_enumerator, enumerator_t*,
@@ -1026,9 +1090,14 @@ typedef struct {
 } verify_enumerator_t;
 
 METHOD(enumerator_t, verify_enumerate, bool,
-	verify_enumerator_t *this, u_int *alg, const char **plugin, bool *valid)
+	verify_enumerator_t *this, va_list args)
 {
+	const char **plugin;
 	entry_t *entry;
+	u_int *alg;
+	bool *valid;
+
+	VA_ARGS_VGET(args, alg, plugin, valid);
 
 	if (!this->inner->enumerate(this->inner, &entry))
 	{
@@ -1123,7 +1192,8 @@ METHOD(crypto_factory_t, create_verify_enumerator, enumerator_t*,
 	}
 	INIT(enumerator,
 		.public = {
-			.enumerate = (void*)_verify_enumerate,
+			.enumerate = enumerator_enumerate_default,
+			.venumerate = _verify_enumerate,
 			.destroy = _verify_destroy,
 		},
 		.inner = inner,
diff --git a/src/libstrongswan/crypto/hashers/hash_algorithm_set.c b/src/libstrongswan/crypto/hashers/hash_algorithm_set.c
index 93b67cb13..4087fe1d9 100644
--- a/src/libstrongswan/crypto/hashers/hash_algorithm_set.c
+++ b/src/libstrongswan/crypto/hashers/hash_algorithm_set.c
@@ -71,17 +71,26 @@ METHOD(hash_algorithm_set_t, count, int,
 	return array_count(this->algorithms);
 }
 
-static bool hash_filter(void *data, void **in, hash_algorithm_t *out)
+CALLBACK(hash_filter, bool,
+	void *data, enumerator_t *orig, va_list args)
 {
-	*out = **(hash_algorithm_t**)in;
-	return TRUE;
+	hash_algorithm_t *algo, *out;
+
+	VA_ARGS_VGET(args, out);
+
+	if (orig->enumerate(orig, &algo))
+	{
+		*out = *algo;
+		return TRUE;
+	}
+	return FALSE;
 }
 
 METHOD(hash_algorithm_set_t, create_enumerator, enumerator_t*,
 	private_hash_algorithm_set_t *this)
 {
 	return enumerator_create_filter(array_create_enumerator(this->algorithms),
-									(void*)hash_filter, NULL, NULL);
+									hash_filter, NULL, NULL);
 }
 
 METHOD(hash_algorithm_set_t, destroy, void,
diff --git a/src/libstrongswan/plugins/mysql/mysql_database.c b/src/libstrongswan/plugins/mysql/mysql_database.c
index 871cc59a0..211eba704 100644
--- a/src/libstrongswan/plugins/mysql/mysql_database.c
+++ b/src/libstrongswan/plugins/mysql/mysql_database.c
@@ -403,10 +403,8 @@ typedef struct {
 	unsigned long *length;
 } mysql_enumerator_t;
 
-/**
- * create a mysql enumerator
- */
-static void mysql_enumerator_destroy(mysql_enumerator_t *this)
+METHOD(enumerator_t, mysql_enumerator_destroy, void,
+	mysql_enumerator_t *this)
 {
 	int columns, i;
 
@@ -434,13 +432,10 @@ static void mysql_enumerator_destroy(mysql_enumerator_t *this)
 	free(this);
 }
 
-/**
- * Implementation of database.query().enumerate
- */
-static bool mysql_enumerator_enumerate(mysql_enumerator_t *this, ...)
+METHOD(enumerator_t, mysql_enumerator_enumerate, bool,
+	mysql_enumerator_t *this, va_list args)
 {
 	int i, columns;
-	va_list args;
 
 	columns = mysql_stmt_field_count(this->stmt);
 
@@ -477,7 +472,6 @@ static bool mysql_enumerator_enumerate(mysql_enumerator_t *this, ...)
 			return FALSE;
 	}
 
-	va_start(args, this);
 	for (i = 0; i < columns; i++)
 	{
 		switch (this->bind[i].buffer_type)
@@ -526,7 +520,6 @@ static bool mysql_enumerator_enumerate(mysql_enumerator_t *this, ...)
 				break;
 		}
 	}
-	va_end(args);
 	return TRUE;
 }
 
@@ -552,9 +545,9 @@ METHOD(database_t, query, enumerator_t*,
 
 		INIT(enumerator,
 			.public = {
-				.enumerate = (void*)mysql_enumerator_enumerate,
-				.destroy = (void*)mysql_enumerator_destroy,
-
+				.enumerate = enumerator_enumerate_default,
+				.venumerate = _mysql_enumerator_enumerate,
+				.destroy = _mysql_enumerator_destroy,
 			},
 			.db = this,
 			.stmt = stmt,
diff --git a/src/libstrongswan/plugins/openssl/openssl_crl.c b/src/libstrongswan/plugins/openssl/openssl_crl.c
index 20bac6be5..61cf3e884 100644
--- a/src/libstrongswan/plugins/openssl/openssl_crl.c
+++ b/src/libstrongswan/plugins/openssl/openssl_crl.c
@@ -142,8 +142,14 @@ typedef struct {
 
 
 METHOD(enumerator_t, crl_enumerate, bool,
-	crl_enumerator_t *this, chunk_t *serial, time_t *date, crl_reason_t *reason)
+	crl_enumerator_t *this, va_list args)
 {
+	crl_reason_t *reason;
+	chunk_t *serial;
+	time_t *date;
+
+	VA_ARGS_VGET(args, serial, date, reason);
+
 	if (this->i < this->num)
 	{
 		X509_REVOKED *revoked;
@@ -188,7 +194,8 @@ METHOD(crl_t, create_enumerator, enumerator_t*,
 
 	INIT(enumerator,
 		.public = {
-			.enumerate = (void*)_crl_enumerate,
+			.enumerate = enumerator_enumerate_default,
+			.venumerate = _crl_enumerate,
 			.destroy = (void*)free,
 		},
 		.stack = X509_CRL_get_REVOKED(this->crl),
diff --git a/src/libstrongswan/plugins/openssl/openssl_pkcs7.c b/src/libstrongswan/plugins/openssl/openssl_pkcs7.c
index 5752d96de..83ac8df5b 100644
--- a/src/libstrongswan/plugins/openssl/openssl_pkcs7.c
+++ b/src/libstrongswan/plugins/openssl/openssl_pkcs7.c
@@ -136,8 +136,12 @@ METHOD(enumerator_t, cert_destroy, void,
 }
 
 METHOD(enumerator_t, cert_enumerate, bool,
-	cert_enumerator_t *this, certificate_t **out)
+	cert_enumerator_t *this, va_list args)
 {
+	certificate_t **out;
+
+	VA_ARGS_VGET(args, out);
+
 	if (!this->certs)
 	{
 		return FALSE;
@@ -176,7 +180,8 @@ METHOD(pkcs7_t, create_cert_enumerator, enumerator_t*,
 	{
 		INIT(enumerator,
 			.public = {
-				.enumerate = (void*)_cert_enumerate,
+				.enumerate = enumerator_enumerate_default,
+				.venumerate = _cert_enumerate,
 				.destroy = _cert_destroy,
 			},
 			.certs = CMS_get1_certs(this->cms),
@@ -320,8 +325,12 @@ static bool verify_digest(CMS_ContentInfo *cms, CMS_SignerInfo *si, int hash_oid
 }
 
 METHOD(enumerator_t, signature_enumerate, bool,
-	signature_enumerator_t *this, auth_cfg_t **out)
+	signature_enumerator_t *this, va_list args)
 {
+	auth_cfg_t **out;
+
+	VA_ARGS_VGET(args, out);
+
 	if (!this->signers)
 	{
 		return FALSE;
@@ -382,7 +391,8 @@ METHOD(container_t, create_signature_enumerator, enumerator_t*,
 
 		INIT(enumerator,
 			.public = {
-				.enumerate = (void*)_signature_enumerate,
+				.enumerate = enumerator_enumerate_default,
+				.venumerate = _signature_enumerate,
 				.destroy = _signature_destroy,
 			},
 			.cms = this->cms,
diff --git a/src/libstrongswan/plugins/pkcs11/pkcs11_creds.c b/src/libstrongswan/plugins/pkcs11/pkcs11_creds.c
index e65f3a06b..b1575540d 100644
--- a/src/libstrongswan/plugins/pkcs11/pkcs11_creds.c
+++ b/src/libstrongswan/plugins/pkcs11/pkcs11_creds.c
@@ -153,30 +153,32 @@ static bool load_certificates(private_pkcs11_creds_t *this)
 	return TRUE;
 }
 
-/**
- * filter function for certs enumerator
- */
-static bool certs_filter(identification_t *id,
-						 certificate_t **in, certificate_t **out)
+CALLBACK(certs_filter, bool,
+	identification_t *id, enumerator_t *orig, va_list args)
 {
 	public_key_t *public;
-	certificate_t *cert = *in;
+	certificate_t *cert, **out;
 
-	if (id == NULL || cert->has_subject(cert, id))
-	{
-		*out = *in;
-		return TRUE;
-	}
-	public = cert->get_public_key(cert);
-	if (public)
+	VA_ARGS_VGET(args, out);
+
+	while (orig->enumerate(orig, &cert))
 	{
-		if (public->has_fingerprint(public, id->get_encoding(id)))
+		if (id == NULL || cert->has_subject(cert, id))
 		{
-			public->destroy(public);
-			*out = *in;
+			*out = cert;
 			return TRUE;
 		}
-		public->destroy(public);
+		public = cert->get_public_key(cert);
+		if (public)
+		{
+			if (public->has_fingerprint(public, id->get_encoding(id)))
+			{
+				public->destroy(public);
+				*out = cert;
+				return TRUE;
+			}
+			public->destroy(public);
+		}
 	}
 	return FALSE;
 }
@@ -199,7 +201,7 @@ METHOD(credential_set_t, create_cert_enumerator, enumerator_t*,
 	{
 		inner = this->untrusted->create_enumerator(this->untrusted);
 	}
-	return enumerator_create_filter(inner, (void*)certs_filter, id, NULL);
+	return enumerator_create_filter(inner, certs_filter, id, NULL);
 }
 
 METHOD(pkcs11_creds_t, get_library, pkcs11_library_t*,
diff --git a/src/libstrongswan/plugins/pkcs11/pkcs11_library.c b/src/libstrongswan/plugins/pkcs11/pkcs11_library.c
index dc8a1f17a..89ae1969e 100644
--- a/src/libstrongswan/plugins/pkcs11/pkcs11_library.c
+++ b/src/libstrongswan/plugins/pkcs11/pkcs11_library.c
@@ -719,12 +719,14 @@ static bool get_attributes(object_enumerator_t *this, CK_OBJECT_HANDLE object)
 }
 
 METHOD(enumerator_t, object_enumerate, bool,
-	object_enumerator_t *this, CK_OBJECT_HANDLE *out)
+	object_enumerator_t *this, va_list args)
 {
-	CK_OBJECT_HANDLE object;
+	CK_OBJECT_HANDLE object, *out;
 	CK_ULONG found;
 	CK_RV rv;
 
+	VA_ARGS_VGET(args, out);
+
 	if (!this->object)
 	{
 		rv = this->lib->f->C_FindObjects(this->session, &object, 1, &found);
@@ -786,7 +788,8 @@ METHOD(pkcs11_library_t, create_object_enumerator, enumerator_t*,
 
 	INIT(enumerator,
 		.public = {
-			.enumerate = (void*)_object_enumerate,
+			.enumerate = enumerator_enumerate_default,
+			.venumerate = _object_enumerate,
 			.destroy = _object_destroy,
 		},
 		.session = session,
@@ -806,7 +809,8 @@ METHOD(pkcs11_library_t, create_object_attr_enumerator, enumerator_t*,
 
 	INIT(enumerator,
 		.public = {
-			.enumerate = (void*)_object_enumerate,
+			.enumerate = enumerator_enumerate_default,
+			.venumerate = _object_enumerate,
 			.destroy = _object_destroy,
 		},
 		.session = session,
@@ -838,11 +842,14 @@ typedef struct {
 } mechanism_enumerator_t;
 
 METHOD(enumerator_t, enumerate_mech, bool,
-	mechanism_enumerator_t *this, CK_MECHANISM_TYPE* type,
-	CK_MECHANISM_INFO *info)
+	mechanism_enumerator_t *this, va_list args)
 {
+	CK_MECHANISM_INFO *info;
+	CK_MECHANISM_TYPE *type;
 	CK_RV rv;
 
+	VA_ARGS_VGET(args, type, info);
+
 	if (this->current >= this->count)
 	{
 		return FALSE;
@@ -876,7 +883,8 @@ METHOD(pkcs11_library_t, create_mechanism_enumerator, enumerator_t*,
 
 	INIT(enumerator,
 		.public = {
-			.enumerate = (void*)_enumerate_mech,
+			.enumerate = enumerator_enumerate_default,
+			.venumerate = _enumerate_mech,
 			.destroy = _destroy_mech,
 		},
 		.lib = &this->public,
diff --git a/src/libstrongswan/plugins/pkcs11/pkcs11_manager.c b/src/libstrongswan/plugins/pkcs11/pkcs11_manager.c
index 96c4a180d..31bcb0d25 100644
--- a/src/libstrongswan/plugins/pkcs11/pkcs11_manager.c
+++ b/src/libstrongswan/plugins/pkcs11/pkcs11_manager.c
@@ -265,8 +265,13 @@ typedef struct {
 } token_enumerator_t;
 
 METHOD(enumerator_t, enumerate_token, bool,
-	token_enumerator_t *this, pkcs11_library_t **out, CK_SLOT_ID *slot)
+	token_enumerator_t *this, va_list args)
 {
+	pkcs11_library_t **out;
+	CK_SLOT_ID *slot;
+
+	VA_ARGS_VGET(args, out, slot);
+
 	if (this->current >= this->count)
 	{
 		free(this->slots);
@@ -301,7 +306,8 @@ METHOD(pkcs11_manager_t, create_token_enumerator, enumerator_t*,
 
 	INIT(enumerator,
 		.public = {
-			.enumerate = (void*)_enumerate_token,
+			.enumerate = enumerator_enumerate_default,
+			.venumerate = _enumerate_token,
 			.destroy = _destroy_token,
 		},
 		.inner = this->libs->create_enumerator(this->libs),
diff --git a/src/libstrongswan/plugins/pkcs7/pkcs7_signed_data.c b/src/libstrongswan/plugins/pkcs7/pkcs7_signed_data.c
index d224ef3aa..413c3fff5 100644
--- a/src/libstrongswan/plugins/pkcs7/pkcs7_signed_data.c
+++ b/src/libstrongswan/plugins/pkcs7/pkcs7_signed_data.c
@@ -179,7 +179,7 @@ typedef struct {
 } signature_enumerator_t;
 
 METHOD(enumerator_t, enumerate, bool,
-	signature_enumerator_t *this, auth_cfg_t **out)
+	signature_enumerator_t *this, va_list args)
 {
 	signerinfo_t *info;
 	signature_scheme_t scheme;
@@ -187,11 +187,13 @@ METHOD(enumerator_t, enumerate, bool,
 	enumerator_t *enumerator;
 	certificate_t *cert;
 	public_key_t *key;
-	auth_cfg_t *auth;
+	auth_cfg_t *auth, **out;
 	chunk_t chunk, hash, content;
 	hasher_t *hasher;
 	bool valid;
 
+	VA_ARGS_VGET(args, out);
+
 	while (this->inner->enumerate(this->inner, &info))
 	{
 		/* clean up previous round */
@@ -300,7 +302,8 @@ METHOD(container_t, create_signature_enumerator, enumerator_t*,
 
 	INIT(enumerator,
 		.public = {
-			.enumerate = (void*)_enumerate,
+			.enumerate = enumerator_enumerate_default,
+			.venumerate = _enumerate,
 			.destroy = _enumerator_destroy,
 		},
 		.inner = this->signerinfos->create_enumerator(this->signerinfos),
diff --git a/src/libstrongswan/plugins/plugin_loader.c b/src/libstrongswan/plugins/plugin_loader.c
index 4daf3f13e..42d443b7a 100644
--- a/src/libstrongswan/plugins/plugin_loader.c
+++ b/src/libstrongswan/plugins/plugin_loader.c
@@ -465,34 +465,48 @@ static plugin_entry_t *load_plugin(private_plugin_loader_t *this, char *name,
 	return entry;
 }
 
-/**
- * Convert enumerated provided_feature_t to plugin_feature_t
- */
-static bool feature_filter(void *null, provided_feature_t **provided,
-						   plugin_feature_t **feature)
+CALLBACK(feature_filter, bool,
+	void *null, enumerator_t *orig, va_list args)
 {
-	*feature = (*provided)->feature;
-	return (*provided)->loaded;
+	provided_feature_t *provided;
+	plugin_feature_t **feature;
+
+	VA_ARGS_VGET(args, feature);
+
+	while (orig->enumerate(orig, &provided))
+	{
+		if (provided->loaded)
+		{
+			*feature = provided->feature;
+			return TRUE;
+		}
+	}
+	return FALSE;
 }
 
-/**
- * Convert enumerated entries to plugin_t
- */
-static bool plugin_filter(void *null, plugin_entry_t **entry, plugin_t **plugin,
-						  void *in, linked_list_t **list)
+CALLBACK(plugin_filter, bool,
+	void *null, enumerator_t *orig, va_list args)
 {
-	plugin_entry_t *this = *entry;
+	plugin_entry_t *entry;
+	linked_list_t **list;
+	plugin_t **plugin;
 
-	*plugin = this->plugin;
-	if (list)
+	VA_ARGS_VGET(args, plugin, list);
+
+	if (orig->enumerate(orig, &entry))
 	{
-		enumerator_t *features;
-		features = enumerator_create_filter(
-							this->features->create_enumerator(this->features),
-							(void*)feature_filter, NULL, NULL);
-		*list = linked_list_create_from_enumerator(features);
+		*plugin = entry->plugin;
+		if (list)
+		{
+			enumerator_t *features;
+			features = enumerator_create_filter(
+							entry->features->create_enumerator(entry->features),
+							feature_filter, NULL, NULL);
+			*list = linked_list_create_from_enumerator(features);
+		}
+		return TRUE;
 	}
-	return TRUE;
+	return FALSE;
 }
 
 METHOD(plugin_loader_t, create_plugin_enumerator, enumerator_t*,
@@ -500,7 +514,7 @@ METHOD(plugin_loader_t, create_plugin_enumerator, enumerator_t*,
 {
 	return enumerator_create_filter(
 							this->plugins->create_enumerator(this->plugins),
-							(void*)plugin_filter, NULL, NULL);
+							plugin_filter, NULL, NULL);
 }
 
 METHOD(plugin_loader_t, has_feature, bool,
@@ -592,18 +606,14 @@ static void load_provided(private_plugin_loader_t *this,
 						  provided_feature_t *provided,
 						  int level);
 
-/**
- * Used to find a loaded feature
- */
-static bool is_feature_loaded(provided_feature_t *item)
+CALLBACK(is_feature_loaded, bool,
+	provided_feature_t *item, va_list args)
 {
 	return item->loaded;
 }
 
-/**
- * Used to find a loadable feature
- */
-static bool is_feature_loadable(provided_feature_t *item)
+CALLBACK(is_feature_loadable, bool,
+	provided_feature_t *item, va_list args)
 {
 	return !item->loading && !item->loaded && !item->failed;
 }
@@ -616,8 +626,7 @@ static bool loaded_feature_matches(registered_feature_t *a,
 {
 	if (plugin_feature_matches(a->feature, b->feature))
 	{
-		return b->plugins->find_first(b->plugins, (void*)is_feature_loaded,
-									  NULL) == SUCCESS;
+		return b->plugins->find_first(b->plugins, is_feature_loaded, NULL);
 	}
 	return FALSE;
 }
@@ -630,8 +639,7 @@ static bool loadable_feature_equals(registered_feature_t *a,
 {
 	if (plugin_feature_equals(a->feature, b->feature))
 	{
-		return b->plugins->find_first(b->plugins, (void*)is_feature_loadable,
-									  NULL) == SUCCESS;
+		return b->plugins->find_first(b->plugins, is_feature_loadable, NULL);
 	}
 	return FALSE;
 }
@@ -644,8 +652,7 @@ static bool loadable_feature_matches(registered_feature_t *a,
 {
 	if (plugin_feature_matches(a->feature, b->feature))
 	{
-		return b->plugins->find_first(b->plugins, (void*)is_feature_loadable,
-									  NULL) == SUCCESS;
+		return b->plugins->find_first(b->plugins, is_feature_loadable, NULL);
 	}
 	return FALSE;
 }
@@ -997,8 +1004,8 @@ static void purge_plugins(private_plugin_loader_t *this)
 		{	/* feature interface not supported */
 			continue;
 		}
-		if (entry->features->find_first(entry->features,
-									(void*)is_feature_loaded, NULL) != SUCCESS)
+		if (!entry->features->find_first(entry->features, is_feature_loaded,
+										 NULL))
 		{
 			DBG2(DBG_LIB, "unloading plugin '%s' without loaded features",
 				 entry->plugin->get_name(entry->plugin));
@@ -1048,6 +1055,15 @@ static bool find_plugin(char *path, char *name, char *buf, char **file)
 	return FALSE;
 }
 
+CALLBACK(find_plugin_cb, bool,
+	char *path, va_list args)
+{
+	char *name, *buf, **file;
+
+	VA_ARGS_VGET(args, name, buf, file);
+	return find_plugin(path, name, buf, file);
+}
+
 /**
  * Used to sort plugins by priority
  */
@@ -1095,14 +1111,20 @@ static int plugin_priority_cmp(const plugin_priority_t *a,
 	return diff;
 }
 
-/**
- * Convert enumerated plugin_priority_t to a plugin name
- */
-static bool plugin_priority_filter(void *null, plugin_priority_t **prio,
-						   char **name)
+CALLBACK(plugin_priority_filter, bool,
+	void *null, enumerator_t *orig, va_list args)
 {
-	*name = (*prio)->name;
-	return TRUE;
+	plugin_priority_t *prio;
+	char **name;
+
+	VA_ARGS_VGET(args, name);
+
+	if (orig->enumerate(orig, &prio))
+	{
+		*name = prio->name;
+		return TRUE;
+	}
+	return FALSE;
 }
 
 /**
@@ -1142,7 +1164,7 @@ static char *modular_pluginlist(char *list)
 	else
 	{
 		enumerator = enumerator_create_filter(array_create_enumerator(given),
-									(void*)plugin_priority_filter, NULL, NULL);
+										plugin_priority_filter, NULL, NULL);
 		load_def = TRUE;
 	}
 	while (enumerator->enumerate(enumerator, &plugin))
@@ -1224,8 +1246,8 @@ METHOD(plugin_loader_t, load_plugins, bool,
 		}
 		if (this->paths)
 		{
-			this->paths->find_first(this->paths, (void*)find_plugin, NULL,
-									token, buf, &file);
+			this->paths->find_first(this->paths, find_plugin_cb, NULL, token,
+									buf, &file);
 		}
 		if (!file)
 		{
diff --git a/src/libstrongswan/plugins/sqlite/sqlite_database.c b/src/libstrongswan/plugins/sqlite/sqlite_database.c
index 0a35e3017..9f874212e 100644
--- a/src/libstrongswan/plugins/sqlite/sqlite_database.c
+++ b/src/libstrongswan/plugins/sqlite/sqlite_database.c
@@ -174,10 +174,8 @@ typedef struct {
 	private_sqlite_database_t *database;
 } sqlite_enumerator_t;
 
-/**
- * destroy a sqlite enumerator
- */
-static void sqlite_enumerator_destroy(sqlite_enumerator_t *this)
+METHOD(enumerator_t, sqlite_enumerator_destroy, void,
+	sqlite_enumerator_t *this)
 {
 	sqlite3_finalize(this->stmt);
 	if (!is_threadsave())
@@ -188,13 +186,10 @@ static void sqlite_enumerator_destroy(sqlite_enumerator_t *this)
 	free(this);
 }
 
-/**
- * Implementation of database.query().enumerate
- */
-static bool sqlite_enumerator_enumerate(sqlite_enumerator_t *this, ...)
+METHOD(enumerator_t, sqlite_enumerator_enumerate, bool,
+	sqlite_enumerator_t *this, va_list args)
 {
 	int i;
-	va_list args;
 
 	switch (sqlite3_step(this->stmt))
 	{
@@ -207,7 +202,7 @@ static bool sqlite_enumerator_enumerate(sqlite_enumerator_t *this, ...)
 		case SQLITE_DONE:
 			return FALSE;
 	}
-	va_start(args, this);
+
 	for (i = 0; i < this->count; i++)
 	{
 		switch (this->columns[i])
@@ -245,11 +240,9 @@ static bool sqlite_enumerator_enumerate(sqlite_enumerator_t *this, ...)
 			}
 			default:
 				DBG1(DBG_LIB, "invalid result type supplied");
-				va_end(args);
 				return FALSE;
 		}
 	}
-	va_end(args);
 	return TRUE;
 }
 
@@ -270,13 +263,17 @@ METHOD(database_t, query, enumerator_t*,
 	stmt = run(this, sql, &args);
 	if (stmt)
 	{
-		enumerator = malloc_thing(sqlite_enumerator_t);
-		enumerator->public.enumerate = (void*)sqlite_enumerator_enumerate;
-		enumerator->public.destroy = (void*)sqlite_enumerator_destroy;
-		enumerator->stmt = stmt;
-		enumerator->count = sqlite3_column_count(stmt);
+		INIT(enumerator,
+			.public = {
+				.enumerate = enumerator_enumerate_default,
+				.venumerate = _sqlite_enumerator_enumerate,
+				.destroy = _sqlite_enumerator_destroy,
+			},
+			.stmt = stmt,
+			.count = sqlite3_column_count(stmt),
+			.database = this,
+		);
 		enumerator->columns = malloc(sizeof(db_type_t) * enumerator->count);
-		enumerator->database = this;
 		for (i = 0; i < enumerator->count; i++)
 		{
 			enumerator->columns[i] = va_arg(args, db_type_t);
diff --git a/src/libstrongswan/plugins/x509/x509_ac.c b/src/libstrongswan/plugins/x509/x509_ac.c
index 638b01fb5..ba459288b 100644
--- a/src/libstrongswan/plugins/x509/x509_ac.c
+++ b/src/libstrongswan/plugins/x509/x509_ac.c
@@ -804,20 +804,27 @@ METHOD(ac_t, get_authKeyIdentifier, chunk_t,
 	return this->authKeyIdentifier;
 }
 
-/**
- * Filter function for attribute enumeration
- */
-static bool attr_filter(void *null, group_t **in, ac_group_type_t *type,
-						void *in2, chunk_t *out)
+CALLBACK(attr_filter, bool,
+	void *null, enumerator_t *orig, va_list args)
 {
-	if ((*in)->type == AC_GROUP_TYPE_STRING &&
-		!chunk_printable((*in)->value, NULL, 0))
-	{	/* skip non-printable strings */
-		return FALSE;
+	group_t *group;
+	ac_group_type_t *type;
+	chunk_t *out;
+
+	VA_ARGS_VGET(args, type, out);
+
+	while (orig->enumerate(orig, &group))
+	{
+		if (group->type == AC_GROUP_TYPE_STRING &&
+			!chunk_printable(group->value, NULL, 0))
+		{	/* skip non-printable strings */
+			continue;
+		}
+		*type = group->type;
+		*out = group->value;
+		return TRUE;
 	}
-	*type = (*in)->type;
-	*out = (*in)->value;
-	return TRUE;
+	return FALSE;
 }
 
 METHOD(ac_t, create_group_enumerator, enumerator_t*,
@@ -825,7 +832,7 @@ METHOD(ac_t, create_group_enumerator, enumerator_t*,
 {
 	return enumerator_create_filter(
 							this->groups->create_enumerator(this->groups),
-							(void*)attr_filter, NULL, NULL);
+							attr_filter, NULL, NULL);
 }
 
 METHOD(certificate_t, get_type, certificate_type_t,
diff --git a/src/libstrongswan/plugins/x509/x509_crl.c b/src/libstrongswan/plugins/x509/x509_crl.c
index 414a03433..d8913ad73 100644
--- a/src/libstrongswan/plugins/x509/x509_crl.c
+++ b/src/libstrongswan/plugins/x509/x509_crl.c
@@ -364,25 +364,33 @@ end:
 	return success;
 }
 
-/**
- * enumerator filter callback for create_enumerator
- */
-static bool filter(void *data, revoked_t **revoked, chunk_t *serial, void *p2,
-				   time_t *date, void *p3, crl_reason_t *reason)
+CALLBACK(filter, bool,
+	void *data, enumerator_t *orig, va_list args)
 {
-	if (serial)
-	{
-		*serial = (*revoked)->serial;
-	}
-	if (date)
-	{
-		*date = (*revoked)->date;
-	}
-	if (reason)
+	revoked_t *revoked;
+	crl_reason_t *reason;
+	chunk_t *serial;
+	time_t *date;
+
+	VA_ARGS_VGET(args, serial, date, reason);
+
+	if (orig->enumerate(orig, &revoked))
 	{
-		*reason = (*revoked)->reason;
+		if (serial)
+		{
+			*serial = revoked->serial;
+		}
+		if (date)
+		{
+			*date = revoked->date;
+		}
+		if (reason)
+		{
+			*reason = revoked->reason;
+		}
+		return TRUE;
 	}
-	return TRUE;
+	return FALSE;
 }
 
 METHOD(crl_t, get_serial, chunk_t,
@@ -422,7 +430,7 @@ METHOD(crl_t, create_enumerator, enumerator_t*,
 {
 	return enumerator_create_filter(
 								this->revoked->create_enumerator(this->revoked),
-								(void*)filter, NULL, NULL);
+								filter, NULL, NULL);
 }
 
 METHOD(certificate_t, get_type, certificate_type_t,
diff --git a/src/libstrongswan/plugins/x509/x509_ocsp_response.c b/src/libstrongswan/plugins/x509/x509_ocsp_response.c
index b46af30fe..140e9bfa9 100644
--- a/src/libstrongswan/plugins/x509/x509_ocsp_response.c
+++ b/src/libstrongswan/plugins/x509/x509_ocsp_response.c
@@ -228,32 +228,38 @@ METHOD(ocsp_response_t, create_cert_enumerator, enumerator_t*,
 	return this->certs->create_enumerator(this->certs);
 }
 
-/**
- * enumerator filter callback for create_response_enumerator
- */
-static bool filter(void *data, single_response_t **response,
-				   chunk_t *serialNumber,
-				   void *p2, cert_validation_t *status,
-				   void *p3, time_t *revocationTime,
-				   void *p4, crl_reason_t *revocationReason)
+CALLBACK(filter, bool,
+	void *data, enumerator_t *orig, va_list args)
 {
-	if (serialNumber)
-	{
-		*serialNumber = (*response)->serialNumber;
-	}
-	if (status)
-	{
-		*status = (*response)->status;
-	}
-	if (revocationTime)
-	{
-		*revocationTime = (*response)->revocationTime;
-	}
-	if (revocationReason)
+	single_response_t *response;
+	cert_validation_t *status;
+	crl_reason_t *revocationReason;
+	chunk_t *serialNumber;
+	time_t *revocationTime;
+
+	VA_ARGS_VGET(args, serialNumber, status, revocationTime, revocationReason);
+
+	if (orig->enumerate(orig, &response))
 	{
-		*revocationReason = (*response)->revocationReason;
+		if (serialNumber)
+		{
+			*serialNumber = response->serialNumber;
+		}
+		if (status)
+		{
+			*status = response->status;
+		}
+		if (revocationTime)
+		{
+			*revocationTime = response->revocationTime;
+		}
+		if (revocationReason)
+		{
+			*revocationReason = response->revocationReason;
+		}
+		return TRUE;
 	}
-	return TRUE;
+	return FALSE;
 }
 
 METHOD(ocsp_response_t, create_response_enumerator, enumerator_t*,
@@ -261,7 +267,7 @@ METHOD(ocsp_response_t, create_response_enumerator, enumerator_t*,
 {
 	return enumerator_create_filter(
 				this->responses->create_enumerator(this->responses),
-				(void*)filter, NULL, NULL);
+				filter, NULL, NULL);
 }
 
 /**
diff --git a/src/libstrongswan/settings/settings.c b/src/libstrongswan/settings/settings.c
index b00e8190c..2a92d523b 100644
--- a/src/libstrongswan/settings/settings.c
+++ b/src/libstrongswan/settings/settings.c
@@ -744,10 +744,8 @@ typedef struct {
 	hashtable_t *seen;
 } enumerator_data_t;
 
-/**
- * Destroy enumerator data
- */
-static void enumerator_destroy(enumerator_data_t *this)
+CALLBACK(enumerator_destroy, void,
+	enumerator_data_t *this)
 {
 	this->settings->lock->unlock(this->settings->lock);
 	this->seen->destroy(this->seen);
@@ -755,18 +753,25 @@ static void enumerator_destroy(enumerator_data_t *this)
 	free(this);
 }
 
-/**
- * Enumerate section names, not sections
- */
-static bool section_filter(hashtable_t *seen, section_t **in, char **out)
+CALLBACK(section_filter, bool,
+	hashtable_t *seen, enumerator_t *orig, va_list args)
 {
-	*out = (*in)->name;
-	if (seen->get(seen, *out))
+	section_t *section;
+	char **out;
+
+	VA_ARGS_VGET(args, out);
+
+	while (orig->enumerate(orig, &section))
 	{
-		return FALSE;
+		if (seen->get(seen, section->name))
+		{
+			continue;
+		}
+		*out = section->name;
+		seen->put(seen, section->name, section->name);
+		return TRUE;
 	}
-	seen->put(seen, *out, *out);
-	return TRUE;
+	return FALSE;
 }
 
 /**
@@ -776,8 +781,8 @@ static enumerator_t *section_enumerator(section_t *section,
 										enumerator_data_t *data)
 {
 	return enumerator_create_filter(
-			array_create_enumerator(section->sections_order),
-				(void*)section_filter, data->seen, NULL);
+							array_create_enumerator(section->sections_order),
+							section_filter, data->seen, NULL);
 }
 
 METHOD(settings_t, create_section_enumerator, enumerator_t*,
@@ -803,23 +808,29 @@ METHOD(settings_t, create_section_enumerator, enumerator_t*,
 		.seen = hashtable_create(hashtable_hash_str, hashtable_equals_str, 8),
 	);
 	return enumerator_create_nested(array_create_enumerator(sections),
-					(void*)section_enumerator, data, (void*)enumerator_destroy);
+						(void*)section_enumerator, data, enumerator_destroy);
 }
 
-/**
- * Enumerate key and values, not kv_t entries
- */
-static bool kv_filter(hashtable_t *seen, kv_t **in, char **key,
-					  void *none, char **value)
+CALLBACK(kv_filter, bool,
+	hashtable_t *seen, enumerator_t *orig, va_list args)
 {
-	*key = (*in)->key;
-	if (seen->get(seen, *key) || !(*in)->value)
+	kv_t *kv;
+	char **key, **value;
+
+	VA_ARGS_VGET(args, key, value);
+
+	while (orig->enumerate(orig, &kv))
 	{
-		return FALSE;
+		if (seen->get(seen, kv->key) || !kv->value)
+		{
+			continue;
+		}
+		*key = kv->key;
+		*value = kv->value;
+		seen->put(seen, kv->key, kv->key);
+		return TRUE;
 	}
-	*value = (*in)->value;
-	seen->put(seen, *key, *key);
-	return TRUE;
+	return FALSE;
 }
 
 /**
@@ -828,7 +839,7 @@ static bool kv_filter(hashtable_t *seen, kv_t **in, char **key,
 static enumerator_t *kv_enumerator(section_t *section, enumerator_data_t *data)
 {
 	return enumerator_create_filter(array_create_enumerator(section->kv_order),
-					(void*)kv_filter, data->seen, NULL);
+									kv_filter, data->seen, NULL);
 }
 
 METHOD(settings_t, create_key_value_enumerator, enumerator_t*,
diff --git a/src/libstrongswan/tests/suites/test_enumerator.c b/src/libstrongswan/tests/suites/test_enumerator.c
index 9bd6d24f2..b781ae9fd 100644
--- a/src/libstrongswan/tests/suites/test_enumerator.c
+++ b/src/libstrongswan/tests/suites/test_enumerator.c
@@ -104,25 +104,45 @@ static void destroy_data(void *data)
  * filtered test
  */
 
-static bool filter(int *data, int **v, int *vo, int **w, int *wo,
-				   int **x, int *xo, int **y, int *yo, int **z, int *zo)
+CALLBACK(filter, bool,
+	int *data, enumerator_t *orig, va_list args)
 {
-	int val = **v;
+	int *item, *vo, *wo, *xo, *yo, *zo;
 
-	*vo = val++;
-	*wo = val++;
-	*xo = val++;
-	*yo = val++;
-	*zo = val++;
-	fail_if(data != (void*)101, "data does not match '101' in filter function");
-	return TRUE;
+	VA_ARGS_VGET(args, vo, wo, xo, yo, zo);
+
+	if (orig->enumerate(orig, &item))
+	{
+		int val = *item;
+		*vo = val++;
+		*wo = val++;
+		*xo = val++;
+		*yo = val++;
+		*zo = val++;
+		fail_if(data != (void*)101, "data does not match '101' in filter function");
+		return TRUE;
+	}
+	return FALSE;
 }
 
-static bool filter_odd(void *data, int **item, int *out)
+CALLBACK(filter_odd, bool,
+	void *data, enumerator_t *orig, va_list args)
 {
+	int *item, *out;
+
+	VA_ARGS_VGET(args, out);
+
 	fail_if(data != (void*)101, "data does not match '101' in filter function");
-	*out = **item;
-	return **item % 2 == 0;
+
+	while (orig->enumerate(orig, &item))
+	{
+		if (*item % 2 == 0)
+		{
+			*out = *item;
+			return TRUE;
+		}
+	}
+	return FALSE;
 }
 
 START_TEST(test_filtered)
@@ -136,7 +156,7 @@ START_TEST(test_filtered)
 
 	round = 1;
 	enumerator = enumerator_create_filter(list->create_enumerator(list),
-									(void*)filter, (void*)101, destroy_data);
+										  filter, (void*)101, destroy_data);
 	while (enumerator->enumerate(enumerator, &v, &w, &x, &y, &z))
 	{
 		ck_assert_int_eq(v, round);
@@ -166,7 +186,7 @@ START_TEST(test_filtered_filter)
 	/* should also work without destructor, so set this manually */
 	destroy_data_called = 1;
 	enumerator = enumerator_create_filter(list->create_enumerator(list),
-										 (void*)filter_odd, (void*)101, NULL);
+										  filter_odd, (void*)101, NULL);
 	while (enumerator->enumerate(enumerator, &x))
 	{
 		ck_assert(x % 2 == 0);
diff --git a/src/libstrongswan/tests/suites/test_linked_list.c b/src/libstrongswan/tests/suites/test_linked_list.c
index 7a161817c..aa1e0429f 100644
--- a/src/libstrongswan/tests/suites/test_linked_list.c
+++ b/src/libstrongswan/tests/suites/test_linked_list.c
@@ -183,26 +183,48 @@ END_TEST
  * find
  */
 
-static bool match_a_b(void *item, void *a, void *b)
+CALLBACK(find_a_b, bool,
+	void *item, va_list args)
 {
+	void *a, *b;
+
+	VA_ARGS_VGET(args, a, b);
 	ck_assert(a == (void*)1);
 	ck_assert(b == (void*)2);
 	return item == a || item == b;
 }
 
+CALLBACK(find_a, bool,
+	void *item, va_list args)
+{
+	void *a;
+
+	VA_ARGS_VGET(args, a);
+	return match_a(item, a);
+}
+
+CALLBACK(find_b, bool,
+	void *item, va_list args)
+{
+	void *b;
+
+	VA_ARGS_VGET(args, b);
+	return match_b(item, b);
+}
+
 START_TEST(test_find)
 {
 	void *a = (void*)1, *b = (void*)2;
 
-	ck_assert(list->find_first(list, NULL, &a) == NOT_FOUND);
+	ck_assert(!list->find_first(list, NULL, &a));
 	list->insert_last(list, a);
-	ck_assert(list->find_first(list, NULL, &a) == SUCCESS);
-	ck_assert(list->find_first(list, NULL, &b) == NOT_FOUND);
+	ck_assert(list->find_first(list, NULL, &a));
+	ck_assert(!list->find_first(list, NULL, &b));
 	list->insert_last(list, b);
-	ck_assert(list->find_first(list, NULL, &a) == SUCCESS);
-	ck_assert(list->find_first(list, NULL, &b) == SUCCESS);
+	ck_assert(list->find_first(list, NULL, &a));
+	ck_assert(list->find_first(list, NULL, &b));
 
-	ck_assert(list->find_first(list, NULL, NULL) == NOT_FOUND);
+	ck_assert(!list->find_first(list, NULL, NULL));
 }
 END_TEST
 
@@ -210,29 +232,57 @@ START_TEST(test_find_callback)
 {
 	void *a = (void*)1, *b = (void*)2, *x = NULL;
 
-	ck_assert(list->find_first(list, (linked_list_match_t)match_a_b, &x, a, b) == NOT_FOUND);
+	ck_assert(!list->find_first(list, find_a_b, &x, a, b));
 	list->insert_last(list, a);
-	ck_assert(list->find_first(list, (linked_list_match_t)match_a, NULL, a) == SUCCESS);
+	ck_assert(list->find_first(list, find_a, NULL, a));
 	x = NULL;
-	ck_assert(list->find_first(list, (linked_list_match_t)match_a, &x, a) == SUCCESS);
+	ck_assert(list->find_first(list, find_a, &x, a));
 	ck_assert(a == x);
-	ck_assert(list->find_first(list, (linked_list_match_t)match_b, &x, b) == NOT_FOUND);
+	ck_assert(!list->find_first(list, find_b, &x, b));
 	ck_assert(a == x);
 	x = NULL;
-	ck_assert(list->find_first(list, (linked_list_match_t)match_a_b, &x, a, b) == SUCCESS);
+	ck_assert(list->find_first(list, find_a_b, &x, a, b));
 	ck_assert(a == x);
 
 	list->insert_last(list, b);
-	ck_assert(list->find_first(list, (linked_list_match_t)match_a, &x, a) == SUCCESS);
+	ck_assert(list->find_first(list, find_a, &x, a));
 	ck_assert(a == x);
-	ck_assert(list->find_first(list, (linked_list_match_t)match_b, &x, b) == SUCCESS);
+	ck_assert(list->find_first(list, find_b, &x, b));
 	ck_assert(b == x);
 	x = NULL;
-	ck_assert(list->find_first(list, (linked_list_match_t)match_a_b, &x, a, b) == SUCCESS);
+	ck_assert(list->find_first(list, find_a_b, &x, a, b));
 	ck_assert(a == x);
 }
 END_TEST
 
+CALLBACK(find_args, bool,
+	void *item, va_list args)
+{
+	uint64_t d, e;
+	level_t c;
+	int *a, b;
+
+	VA_ARGS_VGET(args, a, b, c, d, e);
+	ck_assert_int_eq(*a, 1);
+	ck_assert_int_eq(b, 2);
+	ck_assert_int_eq(c, LEVEL_PRIVATE);
+	ck_assert_int_eq(d, UINT64_MAX);
+	ck_assert_int_eq(e, UINT64_MAX-1);
+	return item == a;
+}
+
+START_TEST(test_find_callback_args)
+{
+	int a = 1, b = 2, *x;
+	uint64_t d = UINT64_MAX;
+
+	list->insert_last(list, &a);
+	ck_assert(list->find_first(list, find_args, (void**)&x, &a, b,
+							   LEVEL_PRIVATE, d, UINT64_MAX-1));
+	ck_assert_int_eq(a, *x);
+}
+END_TEST
+
 /*******************************************************************************
  * invoke
  */
@@ -241,11 +291,16 @@ typedef struct invoke_t invoke_t;
 
 struct invoke_t {
 	int val;
-	void (*invoke)(invoke_t *item, void *a, void *b, void *c, void *d, int *sum);
+	void (*invoke)(invoke_t *item);
 };
 
-static void invoke(intptr_t item, void *a, void *b, void *c, void *d, int *sum)
+CALLBACK(invoke, void,
+	intptr_t item, va_list args)
 {
+	void *a, *b, *c, *d;
+	int *sum;
+
+	VA_ARGS_VGET(args, a, b, c, d, sum);
 	ck_assert_int_eq((uintptr_t)a, 1);
 	ck_assert_int_eq((uintptr_t)b, 2);
 	ck_assert_int_eq((uintptr_t)c, 3);
@@ -253,9 +308,9 @@ static void invoke(intptr_t item, void *a, void *b, void *c, void *d, int *sum)
 	*sum += item;
 }
 
-static void invoke_offset(invoke_t *item, void *a, void *b, void *c, void *d, int *sum)
+static void invoke_offset(invoke_t *item)
 {
-	invoke(item->val, a, b, c, d, sum);
+	item->val++;
 }
 
 START_TEST(test_invoke_function)
@@ -267,8 +322,7 @@ START_TEST(test_invoke_function)
 	list->insert_last(list, (void*)3);
 	list->insert_last(list, (void*)4);
 	list->insert_last(list, (void*)5);
-	list->invoke_function(list, (linked_list_invoke_t)invoke,
-						  (uintptr_t)1, (uintptr_t)2,
+	list->invoke_function(list, invoke, (uintptr_t)1, (uintptr_t)2,
 						  (uintptr_t)3, (uintptr_t)4, &sum);
 	ck_assert_int_eq(sum, 15);
 }
@@ -282,17 +336,19 @@ START_TEST(test_invoke_offset)
 		{ .val = 3, .invoke = invoke_offset, },
 		{ .val = 4, .invoke = invoke_offset, },
 		{ .val = 5, .invoke = invoke_offset, },
-	};
-	int i, sum = 0;
+	}, *item;
+	int i;
 
 	for (i = 0; i < countof(items); i++)
 	{
 		list->insert_last(list, &items[i]);
 	}
-	list->invoke_offset(list, offsetof(invoke_t, invoke),
-						(uintptr_t)1, (uintptr_t)2,
-						(uintptr_t)3, (uintptr_t)4, &sum);
-	ck_assert_int_eq(sum, 15);
+	list->invoke_offset(list, offsetof(invoke_t, invoke));
+	i = 2;
+	while (list->remove_first(list, (void**)&item) == SUCCESS)
+	{
+		ck_assert_int_eq(item->val, i++);
+	}
 }
 END_TEST
 
@@ -458,6 +514,7 @@ Suite *linked_list_suite_create()
 	tcase_add_checked_fixture(tc, setup_list, teardown_list);
 	tcase_add_test(tc, test_find);
 	tcase_add_test(tc, test_find_callback);
+	tcase_add_test(tc, test_find_callback_args);
 	suite_add_tcase(s, tc);
 
 	tc = tcase_create("invoke");
diff --git a/src/libstrongswan/utils/backtrace.c b/src/libstrongswan/utils/backtrace.c
index 6dd68d60e..18b19166e 100644
--- a/src/libstrongswan/utils/backtrace.c
+++ b/src/libstrongswan/utils/backtrace.c
@@ -668,8 +668,12 @@ typedef struct {
 } frame_enumerator_t;
 
 METHOD(enumerator_t, frame_enumerate, bool,
-	frame_enumerator_t *this, void **addr)
+	frame_enumerator_t *this, va_list args)
 {
+	void **addr;
+
+	VA_ARGS_VGET(args, addr);
+
 	if (this->i < this->bt->frame_count)
 	{
 		*addr = this->bt->frames[this->i++];
@@ -685,7 +689,8 @@ METHOD(backtrace_t, create_frame_enumerator, enumerator_t*,
 
 	INIT(enumerator,
 		.public = {
-			.enumerate = (void*)_frame_enumerate,
+			.enumerate = enumerator_enumerate_default,
+			.venumerate = _frame_enumerate,
 			.destroy = (void*)free,
 		},
 		.bt = this,
diff --git a/src/libstrongswan/utils/identification.c b/src/libstrongswan/utils/identification.c
index 384bd6c92..1a4769063 100644
--- a/src/libstrongswan/utils/identification.c
+++ b/src/libstrongswan/utils/identification.c
@@ -136,9 +136,12 @@ typedef struct {
 } rdn_enumerator_t;
 
 METHOD(enumerator_t, rdn_enumerate, bool,
-	rdn_enumerator_t *this, chunk_t *oid, u_char *type, chunk_t *data)
+	rdn_enumerator_t *this, va_list args)
 {
-	chunk_t rdn;
+	chunk_t rdn, *oid, *data;
+	u_char *type;
+
+	VA_ARGS_VGET(args, oid, type, data);
 
 	/* a DN contains one or more SET, each containing one or more SEQUENCES,
 	 * each containing a OID/value RDN */
@@ -173,7 +176,8 @@ static enumerator_t* create_rdn_enumerator(chunk_t dn)
 
 	INIT(e,
 		.public = {
-			.enumerate = (void*)_rdn_enumerate,
+			.enumerate = enumerator_enumerate_default,
+			.venumerate = _rdn_enumerate,
 			.destroy = (void*)free,
 		},
 	);
@@ -199,10 +203,11 @@ typedef struct {
 } rdn_part_enumerator_t;
 
 METHOD(enumerator_t, rdn_part_enumerate, bool,
-	rdn_part_enumerator_t *this, id_part_t *type, chunk_t *data)
+	rdn_part_enumerator_t *this, va_list args)
 {
 	int i, known_oid, strtype;
-	chunk_t oid, inner_data;
+	chunk_t oid, inner_data, *data;
+	id_part_t *type;
 	static const struct {
 		int oid;
 		id_part_t type;
@@ -228,6 +233,8 @@ METHOD(enumerator_t, rdn_part_enumerate, bool,
 		{OID_EMPLOYEE_NUMBER,	ID_PART_RDN_EN},
 	};
 
+	VA_ARGS_VGET(args, type, data);
+
 	while (this->inner->enumerate(this->inner, &oid, &strtype, &inner_data))
 	{
 		known_oid = asn1_known_oid(oid);
@@ -263,7 +270,8 @@ METHOD(identification_t, create_part_enumerator, enumerator_t*,
 			INIT(e,
 				.inner = create_rdn_enumerator(this->encoded),
 				.public = {
-					.enumerate = (void*)_rdn_part_enumerate,
+					.enumerate = enumerator_enumerate_default,
+					.venumerate = _rdn_part_enumerate,
 					.destroy = _rdn_part_enumerator_destroy,
 				},
 			);
diff --git a/src/libstrongswan/utils/utils.h b/src/libstrongswan/utils/utils.h
index 0aed842b1..33b8d1956 100644
--- a/src/libstrongswan/utils/utils.h
+++ b/src/libstrongswan/utils/utils.h
@@ -1,7 +1,7 @@
 /*
- * Copyright (C) 2008-2015 Tobias Brunner
+ * Copyright (C) 2008-2017 Tobias Brunner
  * Copyright (C) 2008 Martin Willi
- * Hochschule fuer Technik Rapperswil
+ * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the
@@ -28,6 +28,7 @@
 #include <stddef.h>
 #include <sys/time.h>
 #include <string.h>
+#include <stdarg.h>
 
 #ifdef HAVE_SYS_PARAM_H
 #include <sys/param.h>
@@ -141,6 +142,49 @@ void utils_deinit();
 #define __VA_ARGS_DISPATCH(func, num) func ## num
 
 /**
+ * Assign variadic arguments to the given variables.
+ *
+ * @note The order and types of the variables are significant and must match the
+ * variadic arguments passed to the function that calls this macro exactly.
+ *
+ * @param last		the last argument before ... in the function that calls this
+ * @param ...		variable names
+ */
+#define VA_ARGS_GET(last, ...) ({ \
+	va_list _va_args_get_ap; \
+	va_start(_va_args_get_ap, last); \
+	_VA_ARGS_GET_ASGN(__VA_ARGS__) \
+	va_end(_va_args_get_ap); \
+})
+
+/**
+ * Assign variadic arguments from a va_list to the given variables.
+ *
+ * @note The order and types of the variables are significant and must match the
+ * variadic arguments passed to the function that calls this macro exactly.
+ *
+ * @param list		the va_list variable in the function that calls this
+ * @param ...		variable names
+ */
+#define VA_ARGS_VGET(list, ...) ({ \
+	va_list _va_args_get_ap; \
+	va_copy(_va_args_get_ap, list); \
+	_VA_ARGS_GET_ASGN(__VA_ARGS__) \
+	va_end(_va_args_get_ap); \
+})
+
+#define _VA_ARGS_GET_ASGN(...) VA_ARGS_DISPATCH(_VA_ARGS_GET_ASGN, __VA_ARGS__)(__VA_ARGS__)
+#define _VA_ARGS_GET_ASGN1(v1) __VA_ARGS_GET_ASGN(v1)
+#define _VA_ARGS_GET_ASGN2(v1,v2) __VA_ARGS_GET_ASGN(v1) __VA_ARGS_GET_ASGN(v2)
+#define _VA_ARGS_GET_ASGN3(v1,v2,v3) __VA_ARGS_GET_ASGN(v1) __VA_ARGS_GET_ASGN(v2) \
+	__VA_ARGS_GET_ASGN(v3)
+#define _VA_ARGS_GET_ASGN4(v1,v2,v3,v4) __VA_ARGS_GET_ASGN(v1) __VA_ARGS_GET_ASGN(v2) \
+	__VA_ARGS_GET_ASGN(v3) __VA_ARGS_GET_ASGN(v4)
+#define _VA_ARGS_GET_ASGN5(v1,v2,v3,v4,v5) __VA_ARGS_GET_ASGN(v1) __VA_ARGS_GET_ASGN(v2) \
+	__VA_ARGS_GET_ASGN(v3) __VA_ARGS_GET_ASGN(v4) __VA_ARGS_GET_ASGN(v5)
+#define __VA_ARGS_GET_ASGN(v) v = va_arg(_va_args_get_ap, typeof(v));
+
+/**
  * Macro to allocate a sized type.
  */
 #define malloc_thing(thing) ((thing*)malloc(sizeof(thing)))