19 files changed, 417 insertions, 177 deletions

diff --git a/src/charon-tkm/Makefile.am b/src/charon-tkm/Makefile.am
index 0fef1f62d..d2b81a3ea 100644
--- a/src/charon-tkm/Makefile.am
+++ b/src/charon-tkm/Makefile.am
@@ -1,26 +1,30 @@
-SRC = $(top_builddir)/src
+SRC = $(abs_top_srcdir)/src
+OBJ = $(abs_top_builddir)/src
 
-# includes relative to obj directory
 AM_CPPFLAGS = \
-	-include $(top_builddir)/config.h \
-	-I../$(SRC)/libstrongswan \
-	-I../$(SRC)/libhydra \
-	-I../$(SRC)/libcharon
+	-include $(abs_top_builddir)/config.h \
+	-I$(SRC)/libstrongswan \
+	-I$(SRC)/libhydra \
+	-I$(SRC)/libcharon
 
 LIBLD = \
-	-L$(SRC)/libstrongswan/.libs \
-	-L$(SRC)/libhydra/.libs \
-	-L$(SRC)/libcharon/.libs
-LIBPT = $(SRC)/libstrongswan/.libs:$(SRC)/libhydra/.libs:$(SRC)/libcharon/.libs
+	-L$(OBJ)/libstrongswan/.libs \
+	-L$(OBJ)/libhydra/.libs \
+	-L$(OBJ)/libcharon/.libs
+LIBPT = $(OBJ)/libstrongswan/.libs:$(OBJ)/libhydra/.libs:$(OBJ)/libcharon/.libs
 LIBFL = -lstrongswan -lhydra -lcharon
 
 DEFS += -DPLUGINS=\""$(PLUGINS)\"" -DIPSEC_PIDDIR=\"${piddir}\"
 
 BUILD_OPTS = \
-	-XOBJ_DIR=$(CURDIR)/obj \
+	-XOBJ_DIR=$(abs_builddir)/obj \
 	-cargs $(AM_CPPFLAGS) $(DEFS) \
 	-largs $(LIBLD) $(LIBFL)
 
+TEST_OPTS = \
+	-cargs -DBUILDDIR=\"${abs_top_builddir}\" \
+	-largs -L$(OBJ)/libstrongswan/tests/.libs -ltest
+
 # plugins to enable
 PLUGINS = \
 	kernel-netlink \
@@ -35,15 +39,15 @@ build_charon: build_charon.gpr src/charon-tkm.c
 	@$(GPRBUILD) -p $< $(BUILD_OPTS)
 
 build_tests: build_tests.gpr
-	@$(GPRBUILD) -p $< $(BUILD_OPTS) -cargs @CHECK_CFLAGS@ -largs @CHECK_LIBS@
+	@$(GPRBUILD) -p $< $(BUILD_OPTS) $(TEST_OPTS)
+
+check-tkm: build_tests
+	@LD_LIBRARY_PATH=$(LIBPT) obj/tests
 
-if UNITTESTS
-check: build_tests
-	@LD_LIBRARY_PATH=$(LIBPT) obj/test_runner
-else
 check:
-	@echo "reconfigure with --enable-unit-tests"
-endif
+	@echo "TKM tests are not run automatically because they have to be run as root" >&2
+	@echo "and require a properly configured TKM daemon to be running." >&2
+	@echo "They can be run from '$(abs_builddir)' with 'make check-tkm'" >&2
 
 install: build_charon
 	$(INSTALL) -m 755 obj/charon-tkm $(DESTDIR)$(ipsecdir)
diff --git a/src/charon-tkm/Makefile.in b/src/charon-tkm/Makefile.in
index 5f878acf9..15e654d00 100644
--- a/src/charon-tkm/Makefile.in
+++ b/src/charon-tkm/Makefile.in
@@ -131,8 +131,6 @@ BTLIB = @BTLIB@
 CC = @CC@
 CCDEPMODE = @CCDEPMODE@
 CFLAGS = @CFLAGS@
-CHECK_CFLAGS = @CHECK_CFLAGS@
-CHECK_LIBS = @CHECK_LIBS@
 COVERAGE_CFLAGS = @COVERAGE_CFLAGS@
 COVERAGE_LDFLAGS = @COVERAGE_LDFLAGS@
 CPP = @CPP@
@@ -200,6 +198,11 @@ PKG_CONFIG = @PKG_CONFIG@
 PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@
 PKG_CONFIG_PATH = @PKG_CONFIG_PATH@
 PTHREADLIB = @PTHREADLIB@
+PYTHON = @PYTHON@
+PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@
+PYTHON_PLATFORM = @PYTHON_PLATFORM@
+PYTHON_PREFIX = @PYTHON_PREFIX@
+PYTHON_VERSION = @PYTHON_VERSION@
 RANLIB = @RANLIB@
 RTLIB = @RTLIB@
 RUBY = @RUBY@
@@ -288,12 +291,16 @@ pcsclite_CFLAGS = @pcsclite_CFLAGS@
 pcsclite_LIBS = @pcsclite_LIBS@
 pdfdir = @pdfdir@
 piddir = @piddir@
+pkgpyexecdir = @pkgpyexecdir@
+pkgpythondir = @pkgpythondir@
 pki_plugins = @pki_plugins@
 plugindir = @plugindir@
 pool_plugins = @pool_plugins@
 prefix = @prefix@
 program_transform_name = @program_transform_name@
 psdir = @psdir@
+pyexecdir = @pyexecdir@
+pythondir = @pythondir@
 random_device = @random_device@
 resolv_conf = @resolv_conf@
 routing_table = @routing_table@
@@ -308,6 +315,7 @@ soup_LIBS = @soup_LIBS@
 srcdir = @srcdir@
 starter_plugins = @starter_plugins@
 strongswan_conf = @strongswan_conf@
+strongswan_options = @strongswan_options@
 sysconfdir = @sysconfdir@
 systemdsystemunitdir = @systemdsystemunitdir@
 t_plugins = @t_plugins@
@@ -318,27 +326,30 @@ top_srcdir = @top_srcdir@
 urandom_device = @urandom_device@
 xml_CFLAGS = @xml_CFLAGS@
 xml_LIBS = @xml_LIBS@
-SRC = $(top_builddir)/src
-
-# includes relative to obj directory
+SRC = $(abs_top_srcdir)/src
+OBJ = $(abs_top_builddir)/src
 AM_CPPFLAGS = \
-	-include $(top_builddir)/config.h \
-	-I../$(SRC)/libstrongswan \
-	-I../$(SRC)/libhydra \
-	-I../$(SRC)/libcharon
+	-include $(abs_top_builddir)/config.h \
+	-I$(SRC)/libstrongswan \
+	-I$(SRC)/libhydra \
+	-I$(SRC)/libcharon
 
 LIBLD = \
-	-L$(SRC)/libstrongswan/.libs \
-	-L$(SRC)/libhydra/.libs \
-	-L$(SRC)/libcharon/.libs
+	-L$(OBJ)/libstrongswan/.libs \
+	-L$(OBJ)/libhydra/.libs \
+	-L$(OBJ)/libcharon/.libs
 
-LIBPT = $(SRC)/libstrongswan/.libs:$(SRC)/libhydra/.libs:$(SRC)/libcharon/.libs
+LIBPT = $(OBJ)/libstrongswan/.libs:$(OBJ)/libhydra/.libs:$(OBJ)/libcharon/.libs
 LIBFL = -lstrongswan -lhydra -lcharon
 BUILD_OPTS = \
-	-XOBJ_DIR=$(CURDIR)/obj \
+	-XOBJ_DIR=$(abs_builddir)/obj \
 	-cargs $(AM_CPPFLAGS) $(DEFS) \
 	-largs $(LIBLD) $(LIBFL)
 
+TEST_OPTS = \
+	-cargs -DBUILDDIR=\"${abs_top_builddir}\" \
+	-largs -L$(OBJ)/libstrongswan/tests/.libs -ltest
+
 
 # plugins to enable
 PLUGINS = \
@@ -543,12 +554,15 @@ build_charon: build_charon.gpr src/charon-tkm.c
 	@$(GPRBUILD) -p $< $(BUILD_OPTS)
 
 build_tests: build_tests.gpr
-	@$(GPRBUILD) -p $< $(BUILD_OPTS) -cargs @CHECK_CFLAGS@ -largs @CHECK_LIBS@
+	@$(GPRBUILD) -p $< $(BUILD_OPTS) $(TEST_OPTS)
+
+check-tkm: build_tests
+	@LD_LIBRARY_PATH=$(LIBPT) obj/tests
 
-@UNITTESTS_TRUE@check: build_tests
-@UNITTESTS_TRUE@	@LD_LIBRARY_PATH=$(LIBPT) obj/test_runner
-@UNITTESTS_FALSE@check:
-@UNITTESTS_FALSE@	@echo "reconfigure with --enable-unit-tests"
+check:
+	@echo "TKM tests are not run automatically because they have to be run as root" >&2
+	@echo "and require a properly configured TKM daemon to be running." >&2
+	@echo "They can be run from '$(abs_builddir)' with 'make check-tkm'" >&2
 
 install: build_charon
 	$(INSTALL) -m 755 obj/charon-tkm $(DESTDIR)$(ipsecdir)
diff --git a/src/charon-tkm/build_common.gpr b/src/charon-tkm/build_common.gpr
index ac322d713..102f6b7a2 100644
--- a/src/charon-tkm/build_common.gpr
+++ b/src/charon-tkm/build_common.gpr
@@ -5,7 +5,7 @@ project Build_Common is
 
    for Source_Dirs use ();
 
-   Obj_Dir := "obj";
+   Obj_Dir := external ("OBJ_DIR", "obj");
 
    C_Compiler_Switches   := ("-W",
                              "-Wall",
diff --git a/src/charon-tkm/build_tests.gpr b/src/charon-tkm/build_tests.gpr
index 032c7969e..2bdc99650 100644
--- a/src/charon-tkm/build_tests.gpr
+++ b/src/charon-tkm/build_tests.gpr
@@ -4,11 +4,15 @@ project Build_Tests is
 
    for Languages use ("Ada", "C");
    for Source_Dirs use ("src/ees", "src/ehandler", "src/tkm", "tests");
-   for Main use ("test_runner");
+   for Main use ("tests");
    for Object_Dir use Build_Common.Obj_Dir;
 
    package Compiler is
       for Default_Switches ("c") use Build_Common.C_Compiler_Switches;
    end Compiler;
 
+   package Binder is
+      for Default_Switches ("ada") use Build_Common.Ada_Binder_Switches;
+   end Binder;
+
 end Build_Tests;
diff --git a/src/charon-tkm/src/charon-tkm.c b/src/charon-tkm/src/charon-tkm.c
index 14a735590..9a22f9ad9 100644
--- a/src/charon-tkm/src/charon-tkm.c
+++ b/src/charon-tkm/src/charon-tkm.c
@@ -250,13 +250,13 @@ int main(int argc, char *argv[])
 	dbg = dbg_syslog;
 
 	/* initialize library */
-	if (!library_init(NULL))
+	if (!library_init(NULL, dmn_name))
 	{
 		library_deinit();
 		exit(status);
 	}
 
-	if (!libhydra_init(dmn_name))
+	if (!libhydra_init())
 	{
 		dbg_syslog(DBG_DMN, 1, "initialization failed - aborting %s", dmn_name);
 		libhydra_deinit();
@@ -264,7 +264,7 @@ int main(int argc, char *argv[])
 		exit(status);
 	}
 
-	if (!libcharon_init(dmn_name))
+	if (!libcharon_init())
 	{
 		dbg_syslog(DBG_DMN, 1, "initialization failed - aborting %s", dmn_name);
 		goto deinit;
@@ -288,10 +288,6 @@ int main(int argc, char *argv[])
 	static plugin_feature_t features[] = {
 		PLUGIN_REGISTER(NONCE_GEN, tkm_nonceg_create),
 			PLUGIN_PROVIDE(NONCE_GEN),
-		PLUGIN_REGISTER(DH, tkm_diffie_hellman_create),
-			PLUGIN_PROVIDE(DH, MODP_2048_BIT),
-			PLUGIN_PROVIDE(DH, MODP_3072_BIT),
-			PLUGIN_PROVIDE(DH, MODP_4096_BIT),
 		PLUGIN_REGISTER(PUBKEY, tkm_public_key_load, TRUE),
 			PLUGIN_PROVIDE(PUBKEY, KEY_RSA),
 			PLUGIN_PROVIDE(PUBKEY_VERIFY, SIGN_RSA_EMSA_PKCS1_SHA1),
@@ -302,6 +298,12 @@ int main(int argc, char *argv[])
 	lib->plugins->add_static_features(lib->plugins, "tkm-backend", features,
 			countof(features), TRUE);
 
+	if (!register_dh_mapping())
+	{
+		DBG1(DBG_DMN, "no DH group mapping defined - aborting %s", dmn_name);
+		goto deinit;
+	}
+
 	/* register TKM keymat variant */
 	keymat_register_constructor(IKEV2, (keymat_constructor_t)tkm_keymat_create);
 
@@ -380,6 +382,7 @@ int main(int argc, char *argv[])
 	lib->encoding->remove_encoder(lib->encoding, tkm_encoder_encode);
 
 deinit:
+	destroy_dh_mapping();
 	libcharon_deinit();
 	libhydra_deinit();
 	library_deinit();
diff --git a/src/charon-tkm/src/tkm/tkm.c b/src/charon-tkm/src/tkm/tkm.c
index a39221dc2..61eb6056c 100644
--- a/src/charon-tkm/src/tkm/tkm.c
+++ b/src/charon-tkm/src/tkm/tkm.c
@@ -61,7 +61,7 @@ bool tkm_init()
 	ehandler_init();
 
 	ikesock = lib->settings->get_str(lib->settings, "%s.ike_socket", IKE_SOCKET,
-									 charon->name);
+									 lib->ns);
 	if (ike_init(ikesock) != TKM_OK)
 	{
 		tkmlib_final();
@@ -70,7 +70,7 @@ bool tkm_init()
 	DBG1(DBG_DMN, "connected to TKM via socket '%s'", ikesock);
 
 	eessock = lib->settings->get_str(lib->settings, "%s.ees_socket", EES_SOCKET,
-									 charon->name);
+									 lib->ns);
 	ees_server_init(eessock);
 	DBG1(DBG_DMN, "serving EES requests on socket '%s'", eessock);
 
diff --git a/src/charon-tkm/src/tkm/tkm_diffie_hellman.c b/src/charon-tkm/src/tkm/tkm_diffie_hellman.c
index 19f57de01..a34d0b1d4 100644
--- a/src/charon-tkm/src/tkm/tkm_diffie_hellman.c
+++ b/src/charon-tkm/src/tkm/tkm_diffie_hellman.c
@@ -21,10 +21,13 @@
 #include "tkm_utils.h"
 #include "tkm_diffie_hellman.h"
 
-#include <utils/debug.h>
+#include <daemon.h>
+#include <collections/hashtable.h>
 
 typedef struct private_tkm_diffie_hellman_t private_tkm_diffie_hellman_t;
 
+static hashtable_t *group_map = NULL;
+
 /**
  * Private data of a tkm_diffie_hellman_t object.
  */
@@ -102,6 +105,95 @@ METHOD(tkm_diffie_hellman_t, get_id, dh_id_type,
 	return this->context_id;
 }
 
+static u_int hash(void *key)
+{
+	diffie_hellman_group_t k = *(diffie_hellman_group_t*)key;
+	return chunk_hash(chunk_from_thing(k));
+}
+
+static bool equals(void *key, void *other_key)
+{
+	return *(diffie_hellman_group_t*)key == *(diffie_hellman_group_t*)other_key;
+}
+
+/*
+ * Described in header.
+ */
+int register_dh_mapping()
+{
+	int count, i;
+	char *iana_id_str, *tkm_id_str;
+	diffie_hellman_group_t *iana_id;
+	u_int64_t *tkm_id;
+	hashtable_t *map;
+	enumerator_t *enumerator;
+
+	map = hashtable_create((hashtable_hash_t)hash,
+						   (hashtable_equals_t)equals, 16);
+
+	enumerator = lib->settings->create_key_value_enumerator(lib->settings,
+															"%s.dh_mapping",
+															lib->ns);
+
+	while (enumerator->enumerate(enumerator, &iana_id_str, &tkm_id_str))
+	{
+		iana_id = malloc_thing(diffie_hellman_group_t);
+		*iana_id = settings_value_as_int(iana_id_str, 0);
+		tkm_id = malloc_thing(u_int64_t);
+		*tkm_id = settings_value_as_int(tkm_id_str, 0);
+
+		map->put(map, iana_id, tkm_id);
+	}
+	enumerator->destroy(enumerator);
+
+	count = map->get_count(map);
+	plugin_feature_t f[count + 1];
+	f[0] = PLUGIN_REGISTER(DH, tkm_diffie_hellman_create);
+
+	i = 1;
+	enumerator = map->create_enumerator(map);
+	while (enumerator->enumerate(enumerator, &iana_id, &tkm_id))
+	{
+		f[i] = PLUGIN_PROVIDE(DH, *iana_id);
+		i++;
+	}
+	enumerator->destroy(enumerator);
+
+	lib->plugins->add_static_features(lib->plugins, "tkm-dh", f, countof(f), TRUE);
+
+	if (count > 0)
+	{
+		group_map = map;
+	}
+	else
+	{
+		map->destroy(map);
+	}
+
+	return count;
+}
+
+/*
+ * Described in header.
+ */
+void destroy_dh_mapping()
+{
+	enumerator_t *enumerator;
+	char *key, *value;
+
+	if (group_map)
+	{
+		enumerator = group_map->create_enumerator(group_map);
+		while (enumerator->enumerate(enumerator, &key, &value))
+		{
+			free(key);
+			free(value);
+		}
+		enumerator->destroy(enumerator);
+		group_map->destroy(group_map);
+	}
+}
+
 /*
  * Described in header.
  */
@@ -109,6 +201,11 @@ tkm_diffie_hellman_t *tkm_diffie_hellman_create(diffie_hellman_group_t group)
 {
 	private_tkm_diffie_hellman_t *this;
 
+	if (!group_map)
+	{
+		return NULL;
+	}
+
 	INIT(this,
 		.public = {
 			.dh = {
@@ -130,7 +227,14 @@ tkm_diffie_hellman_t *tkm_diffie_hellman_create(diffie_hellman_group_t group)
 		return NULL;
 	}
 
-	if (ike_dh_create(this->context_id, group, &this->pubvalue) != TKM_OK)
+	u_int64_t *dha_id = group_map->get(group_map, &group);
+	if (!dha_id)
+	{
+		free(this);
+		return NULL;
+	}
+
+	if (ike_dh_create(this->context_id, *dha_id, &this->pubvalue) != TKM_OK)
 	{
 		free(this);
 		return NULL;
diff --git a/src/charon-tkm/src/tkm/tkm_diffie_hellman.h b/src/charon-tkm/src/tkm/tkm_diffie_hellman.h
index a144303fa..d38a414d8 100644
--- a/src/charon-tkm/src/tkm/tkm_diffie_hellman.h
+++ b/src/charon-tkm/src/tkm/tkm_diffie_hellman.h
@@ -47,6 +47,19 @@ struct tkm_diffie_hellman_t {
 };
 
 /**
+ * Loads IANA DH group identifier to TKM id mapping from config and registers
+ * the corresponding DH features.
+ *
+ * @return          number of registered mappings
+ */
+int register_dh_mapping();
+
+/**
+ * Destroy IANA DH group identifier to TKM id mapping.
+ */
+void destroy_dh_mapping();
+
+/**
  * Creates a new tkm_diffie_hellman_t object.
  *
  * @param group			Diffie Hellman group number to use
diff --git a/src/charon-tkm/src/tkm/tkm_id_manager.c b/src/charon-tkm/src/tkm/tkm_id_manager.c
index 407d0a87f..0fadf1acf 100644
--- a/src/charon-tkm/src/tkm/tkm_id_manager.c
+++ b/src/charon-tkm/src/tkm/tkm_id_manager.c
@@ -17,7 +17,6 @@
 #include "tkm_id_manager.h"
 
 #include <utils/debug.h>
-#include <collections/linked_list.h>
 #include <threading/rwlock.h>
 
 #define TKM_LIMIT 100
diff --git a/src/charon-tkm/tests/chunk_map_tests.c b/src/charon-tkm/tests/chunk_map_tests.c
index 6deef9a80..1283a787c 100644
--- a/src/charon-tkm/tests/chunk_map_tests.c
+++ b/src/charon-tkm/tests/chunk_map_tests.c
@@ -14,7 +14,7 @@
  * for more details.
  */
 
-#include <check.h>
+#include <tests/test_suite.h>
 
 #include "tkm_chunk_map.h"
 
@@ -48,11 +48,20 @@ START_TEST(test_chunk_map_handling)
 }
 END_TEST
 
-TCase *make_chunk_map_tests(void)
+Suite *make_chunk_map_tests()
 {
-	TCase *tc = tcase_create("Chunk map tests");
+	Suite *s;
+	TCase *tc;
+
+	s = suite_create("chunk map");
+
+	tc = tcase_create("creating");
 	tcase_add_test(tc, test_chunk_map_creation);
+	suite_add_tcase(s, tc);
+
+	tc = tcase_create("handling");
 	tcase_add_test(tc, test_chunk_map_handling);
+	suite_add_tcase(s, tc);
 
-	return tc;
+	return s;
 }
diff --git a/src/charon-tkm/tests/diffie_hellman_tests.c b/src/charon-tkm/tests/diffie_hellman_tests.c
index ffe99614d..89658a770 100644
--- a/src/charon-tkm/tests/diffie_hellman_tests.c
+++ b/src/charon-tkm/tests/diffie_hellman_tests.c
@@ -14,7 +14,8 @@
  * for more details.
  */
 
-#include <check.h>
+#include <daemon.h>
+#include <tests/test_suite.h>
 
 #include "tkm_diffie_hellman.h"
 
@@ -49,11 +50,20 @@ START_TEST(test_dh_get_my_pubvalue)
 }
 END_TEST
 
-TCase *make_diffie_hellman_tests(void)
+Suite *make_diffie_hellman_tests()
 {
-	TCase *tc = tcase_create("Diffie-Hellman tests");
+	Suite *s;
+	TCase *tc;
+
+	s = suite_create("Diffie-Hellman");
+
+	tc = tcase_create("creation");
 	tcase_add_test(tc, test_dh_creation);
+	suite_add_tcase(s, tc);
+
+	tc = tcase_create("get_my_pubvalue");
 	tcase_add_test(tc, test_dh_get_my_pubvalue);
+	suite_add_tcase(s, tc);
 
-	return tc;
+	return s;
 }
diff --git a/src/charon-tkm/tests/id_manager_tests.c b/src/charon-tkm/tests/id_manager_tests.c
index 15522f118..8157496ca 100644
--- a/src/charon-tkm/tests/id_manager_tests.c
+++ b/src/charon-tkm/tests/id_manager_tests.c
@@ -14,7 +14,7 @@
  * for more details.
  */
 
-#include <check.h>
+#include <tests/test_suite.h>
 
 #include "tkm_id_manager.h"
 
@@ -135,16 +135,28 @@ START_TEST(test_release_id_nonexistent)
 }
 END_TEST
 
-TCase *make_id_manager_tests(void)
+Suite *make_id_manager_tests()
 {
-	TCase *tc = tcase_create("Context id manager tests");
+	Suite *s;
+	TCase *tc;
+
+	s = suite_create("context id manager");
+
+	tc = tcase_create("creation");
 	tcase_add_test(tc, test_id_mgr_creation);
+	suite_add_tcase(s, tc);
+
+	tc = tcase_create("acquire");
 	tcase_add_test(tc, test_acquire_id);
 	tcase_add_test(tc, test_acquire_id_invalid_kind);
 	tcase_add_test(tc, test_acquire_id_same);
+	suite_add_tcase(s, tc);
+
+	tc = tcase_create("release");
 	tcase_add_test(tc, test_release_id);
 	tcase_add_test(tc, test_release_id_invalid_kind);
 	tcase_add_test(tc, test_release_id_nonexistent);
+	suite_add_tcase(s, tc);
 
-	return tc;
+	return s;
 }
diff --git a/src/charon-tkm/tests/kernel_sad_tests.c b/src/charon-tkm/tests/kernel_sad_tests.c
index 11785602d..6f0b396d3 100644
--- a/src/charon-tkm/tests/kernel_sad_tests.c
+++ b/src/charon-tkm/tests/kernel_sad_tests.c
@@ -14,7 +14,7 @@
  * for more details.
  */
 
-#include <check.h>
+#include <tests/test_suite.h>
 
 #include "tkm_kernel_sad.h"
 
@@ -107,16 +107,31 @@ START_TEST(test_remove_nonexistent)
 }
 END_TEST
 
-TCase *make_kernel_sad_tests(void)
+Suite *make_kernel_sad_tests()
 {
-	TCase *tc = tcase_create("Kernel SAD tests");
+	Suite *s;
+	TCase *tc;
+
+	s = suite_create("kernel SAD tests");
+
+	tc = tcase_create("creation");
 	tcase_add_test(tc, test_sad_creation);
+	suite_add_tcase(s, tc);
+
+	tc = tcase_create("insert");
 	tcase_add_test(tc, test_insert);
 	tcase_add_test(tc, test_insert_duplicate);
+	suite_add_tcase(s, tc);
+
+	tc = tcase_create("get_esa_id");
 	tcase_add_test(tc, test_get_esa_id);
 	tcase_add_test(tc, test_get_esa_id_nonexistent);
+	suite_add_tcase(s, tc);
+
+	tc = tcase_create("remove");
 	tcase_add_test(tc, test_remove);
 	tcase_add_test(tc, test_remove_nonexistent);
+	suite_add_tcase(s, tc);
 
-	return tc;
+	return s;
 }
diff --git a/src/charon-tkm/tests/keymat_tests.c b/src/charon-tkm/tests/keymat_tests.c
index 2a7525d4e..1982671d3 100644
--- a/src/charon-tkm/tests/keymat_tests.c
+++ b/src/charon-tkm/tests/keymat_tests.c
@@ -14,7 +14,8 @@
  * for more details.
  */
 
-#include <check.h>
+#include <tests/test_suite.h>
+
 #include <daemon.h>
 #include <hydra.h>
 #include <config/proposal.h>
@@ -139,11 +140,20 @@ START_TEST(test_derive_child_keys)
 }
 END_TEST
 
-TCase *make_keymat_tests(void)
+Suite *make_keymat_tests()
 {
-	TCase *tc = tcase_create("Keymat tests");
+	Suite *s;
+	TCase *tc;
+
+	s = suite_create("keymat");
+
+	tc = tcase_create("derive IKE keys");
 	tcase_add_test(tc, test_derive_ike_keys);
+	suite_add_tcase(s, tc);
+
+	tc = tcase_create("derive CHILD keys");
 	tcase_add_test(tc, test_derive_child_keys);
+	suite_add_tcase(s, tc);
 
-	return tc;
+	return s;
 }
diff --git a/src/charon-tkm/tests/nonceg_tests.c b/src/charon-tkm/tests/nonceg_tests.c
index 3a1effab8..6f524cb22 100644
--- a/src/charon-tkm/tests/nonceg_tests.c
+++ b/src/charon-tkm/tests/nonceg_tests.c
@@ -14,7 +14,8 @@
  * for more details.
  */
 
-#include <check.h>
+#include <tests/test_suite.h>
+
 #include <tkm/client.h>
 
 #include "tkm.h"
@@ -82,12 +83,24 @@ START_TEST(test_nonceg_get_nonce)
 }
 END_TEST
 
-TCase *make_nonceg_tests(void)
+Suite *make_nonceg_tests()
 {
-	TCase *tc = tcase_create("Nonce generator tests");
+	Suite *s;
+	TCase *tc;
+
+	s = suite_create("nonce generator");
+
+	tc = tcase_create("creation");
 	tcase_add_test(tc, test_nonceg_creation);
+	suite_add_tcase(s, tc);
+
+	tc = tcase_create("allocate");
 	tcase_add_test(tc, test_nonceg_allocate_nonce);
+	suite_add_tcase(s, tc);
+
+	tc = tcase_create("get");
 	tcase_add_test(tc, test_nonceg_get_nonce);
+	suite_add_tcase(s, tc);
 
-	return tc;
+	return s;
 }
diff --git a/src/charon-tkm/tests/test_runner.c b/src/charon-tkm/tests/test_runner.c
deleted file mode 100644
index 5ae032935..000000000
--- a/src/charon-tkm/tests/test_runner.c
+++ /dev/null
@@ -1,84 +0,0 @@
-/*
- * Copyright (C) 2012 Reto Buerki
- * Copyright (C) 2012 Adrian-Ken Rueegsegger
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-#include <library.h>
-#include <hydra.h>
-#include <daemon.h>
-
-#include "tkm.h"
-#include "tkm_nonceg.h"
-#include "tkm_diffie_hellman.h"
-#include "tkm_kernel_ipsec.h"
-#include "test_runner.h"
-
-int main(void)
-{
-	library_init(NULL);
-	libhydra_init("test_runner");
-	libcharon_init("test_runner");
-
-	lib->settings->set_int(lib->settings, "test_runner.filelog.stdout.default",
-						   1);
-	charon->load_loggers(charon, NULL, FALSE);
-
-	/* Register TKM specific plugins */
-	static plugin_feature_t features[] = {
-		PLUGIN_REGISTER(NONCE_GEN, tkm_nonceg_create),
-			PLUGIN_PROVIDE(NONCE_GEN),
-		PLUGIN_REGISTER(DH, tkm_diffie_hellman_create),
-			PLUGIN_PROVIDE(DH, MODP_3072_BIT),
-			PLUGIN_PROVIDE(DH, MODP_4096_BIT),
-		PLUGIN_CALLBACK(kernel_ipsec_register, tkm_kernel_ipsec_create),
-			PLUGIN_PROVIDE(CUSTOM, "kernel-ipsec"),
-	};
-	lib->plugins->add_static_features(lib->plugins, "tkm-tests", features,
-			countof(features), TRUE);
-
-	if (!charon->initialize(charon, PLUGINS))
-	{
-		fprintf(stderr, "Unable to init charon");
-		return EXIT_FAILURE;
-	}
-
-	if (!tkm_init())
-	{
-		fprintf(stderr, "Could not connect to TKM, aborting tests\n");
-		return EXIT_FAILURE;
-	}
-
-	int number_failed;
-	Suite *s = suite_create("TKM tests");
-	suite_add_tcase(s, make_id_manager_tests());
-	suite_add_tcase(s, make_chunk_map_tests());
-	suite_add_tcase(s, make_utility_tests());
-	suite_add_tcase(s, make_nonceg_tests());
-	suite_add_tcase(s, make_diffie_hellman_tests());
-	suite_add_tcase(s, make_keymat_tests());
-	suite_add_tcase(s, make_kernel_sad_tests());
-
-	SRunner *sr = srunner_create(s);
-
-	srunner_run_all(sr, CK_NORMAL);
-	number_failed = srunner_ntests_failed(sr);
-
-	tkm_deinit();
-	libcharon_deinit();
-	libhydra_deinit();
-	library_deinit();
-	srunner_free(sr);
-
-	return (number_failed == 0) ? EXIT_SUCCESS : EXIT_FAILURE;
-}
diff --git a/src/charon-tkm/tests/tests.c b/src/charon-tkm/tests/tests.c
new file mode 100644
index 000000000..18754c717
--- /dev/null
+++ b/src/charon-tkm/tests/tests.c
@@ -0,0 +1,114 @@
+/*
+ * Copyright (C) 2013 Tobias Brunner
+ * Copyright (C) 2012 Reto Buerki
+ * Copyright (C) 2012 Adrian-Ken Rueegsegger
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+#include <tests/test_runner.h>
+
+#include <library.h>
+#include <hydra.h>
+#include <daemon.h>
+
+#include "tkm.h"
+#include "tkm_nonceg.h"
+#include "tkm_diffie_hellman.h"
+#include "tkm_kernel_ipsec.h"
+
+/* declare test suite constructors */
+#define TEST_SUITE(x) test_suite_t* x();
+#define TEST_SUITE_DEPEND(x, ...) TEST_SUITE(x)
+#include "tests.h"
+#undef TEST_SUITE
+#undef TEST_SUITE_DEPEND
+
+static test_configuration_t tests[] = {
+#define TEST_SUITE(x) \
+	{ .suite = x, },
+#define TEST_SUITE_DEPEND(x, type, args) \
+	{ .suite = x, .feature = PLUGIN_DEPENDS(type, args) },
+#include "tests.h"
+	{ .suite = NULL, }
+};
+
+static bool tkm_initialized = false;
+
+static bool test_runner_init(bool init)
+{
+	bool result = TRUE;
+
+	if (init)
+	{
+		libhydra_init();
+		libcharon_init();
+		lib->settings->set_int(lib->settings,
+							   "test_runner.filelog.stdout.default", 0);
+		charon->load_loggers(charon, NULL, FALSE);
+
+		/* Register TKM specific plugins */
+		static plugin_feature_t features[] = {
+			PLUGIN_REGISTER(NONCE_GEN, tkm_nonceg_create),
+				PLUGIN_PROVIDE(NONCE_GEN),
+			PLUGIN_CALLBACK(kernel_ipsec_register, tkm_kernel_ipsec_create),
+				PLUGIN_PROVIDE(CUSTOM, "kernel-ipsec"),
+		};
+		lib->plugins->add_static_features(lib->plugins, "tkm-tests", features,
+										  countof(features), TRUE);
+
+		lib->settings->set_int(lib->settings, "%s.dh_mapping.%d", 1,
+							   lib->ns, MODP_3072_BIT);
+		lib->settings->set_int(lib->settings, "%s.dh_mapping.%d", 2,
+							   lib->ns, MODP_4096_BIT);
+		register_dh_mapping();
+
+		plugin_loader_add_plugindirs(BUILDDIR "/src/libstrongswan/plugins",
+									 PLUGINS);
+		plugin_loader_add_plugindirs(BUILDDIR "/src/libhydra/plugins",
+									 PLUGINS);
+		plugin_loader_add_plugindirs(BUILDDIR "/src/libcharon/plugins",
+									 PLUGINS);
+		if (charon->initialize(charon, PLUGINS))
+		{
+			if (!tkm_initialized)
+			{
+				if (!tkm_init())
+				{
+					return FALSE;
+				}
+				tkm_initialized = true;
+			}
+			return TRUE;
+		}
+		result = FALSE;
+	}
+
+	destroy_dh_mapping();
+	libcharon_deinit();
+	libhydra_deinit();
+	return result;
+}
+
+int main(int argc, char *argv[])
+{
+	bool result;
+
+	/* disable leak detective because of how tkm_init/deinit is called, which
+	 * does not work otherwise due to limitations of the external libraries */
+	setenv("LEAK_DETECTIVE_DISABLE", "1", 1);
+
+	result = test_runner_run("tkm", tests, test_runner_init);
+	tkm_deinit();
+
+	return result;
+}
diff --git a/src/charon-tkm/tests/test_runner.h b/src/charon-tkm/tests/tests.h
index 236a7f2a6..fb5e96a9c 100644
--- a/src/charon-tkm/tests/test_runner.h
+++ b/src/charon-tkm/tests/tests.h
@@ -14,17 +14,10 @@
  * for more details.
  */
 
-#ifndef TEST_RUNNER_H_
-#define TEST_RUNNER_H_
-
-#include <check.h>
-
-TCase *make_id_manager_tests(void);
-TCase *make_chunk_map_tests(void);
-TCase *make_utility_tests(void);
-TCase *make_nonceg_tests(void);
-TCase *make_diffie_hellman_tests(void);
-TCase *make_keymat_tests(void);
-TCase *make_kernel_sad_tests(void);
-
-#endif /** TEST_RUNNER_H_ */
+TEST_SUITE(make_id_manager_tests)
+TEST_SUITE(make_chunk_map_tests)
+TEST_SUITE(make_utility_tests)
+TEST_SUITE(make_nonceg_tests)
+TEST_SUITE(make_diffie_hellman_tests)
+TEST_SUITE(make_keymat_tests)
+TEST_SUITE(make_kernel_sad_tests)
diff --git a/src/charon-tkm/tests/utils_tests.c b/src/charon-tkm/tests/utils_tests.c
index b3ead7633..0a4d6fbd2 100644
--- a/src/charon-tkm/tests/utils_tests.c
+++ b/src/charon-tkm/tests/utils_tests.c
@@ -14,7 +14,8 @@
  * for more details.
  */
 
-#include <check.h>
+#include <tests/test_suite.h>
+
 #include <tkm/types.h>
 
 #include "tkm_utils.h"
@@ -53,11 +54,17 @@ START_TEST(test_chunk_to_sequence)
 }
 END_TEST
 
-TCase *make_utility_tests(void)
+Suite *make_utility_tests()
 {
-	TCase *tc = tcase_create("Utility tests");
+	Suite *s;
+	TCase *tc;
+
+	s = suite_create("utility tests");
+
+	tc = tcase_create("chunk<->sequence");
 	tcase_add_test(tc, test_sequence_to_chunk);
 	tcase_add_test(tc, test_chunk_to_sequence);
+	suite_add_tcase(s, tc);
 
-	return tc;
+	return s;
 }