diff --git a/strongswan-5.2.0/Makefile.am b/strongswan-5.2.0/Makefile.am
index 0703abc..15c71f9 100644
--- a/strongswan-5.2.0/Makefile.am
+++ b/strongswan-5.2.0/Makefile.am
@@ -1,4 +1,4 @@
-SUBDIRS = src man conf init testing
+SUBDIRS = src man conf init
 
 if USE_SCRIPTS
   SUBDIRS += scripts
@@ -10,11 +10,6 @@ endif
 
 ACLOCAL_AMFLAGS = -I m4/config
 
-EXTRA_DIST = Doxyfile.in LICENSE Android.common.mk.in Android.common.mk Android.mk
-CLEANFILES = Doxyfile
-BUILT_SOURCES = Android.common.mk
-MAINTAINERCLEANFILES = Android.common.mk
-
 if USE_DEV_HEADERS
 config_includedir = $(ipseclibdir)/include
 nodist_config_include_HEADERS = config.h
@@ -23,23 +18,6 @@ endif
 # we leave config files behind intentionally so prevent distcheck from complaining
 distuninstallcheck_listfiles = find . -type f \! -name '*.conf' -print
 
-Android.common.mk :	Android.common.mk.in configure.ac
-		$(AM_V_GEN) \
-		sed \
-		-e "s:\@PACKAGE_VERSION\@:$(PACKAGE_VERSION):" \
-		$(srcdir)/$@.in > $@
-
-Doxyfile :	Doxyfile.in
-		$(AM_V_GEN) \
-		sed \
-		-e "s:\@PACKAGE_VERSION\@:$(PACKAGE_VERSION):" \
-		-e "s:\@PACKAGE_NAME\@:$(PACKAGE_NAME):" \
-		-e "s:\@SRC_DIR\@:$(srcdir):" \
-		$(srcdir)/$@.in > $@
-
-apidoc :	Doxyfile
-		doxygen
-
 cov-reset-common:
 		@rm -rf $(top_builddir)/coverage
 		@find $(top_builddir)/src $(top_builddir)/scripts -name "*.gcda" -delete
diff --git a/strongswan-5.2.0/conf/Makefile.am b/strongswan-5.2.0/conf/Makefile.am
index 373be16..7745435 100644
--- a/strongswan-5.2.0/conf/Makefile.am
+++ b/strongswan-5.2.0/conf/Makefile.am
@@ -8,83 +8,21 @@ optionstemplatedir = $(templatesdir)/strongswan.d
 pluginstemplatedir = $(templatesdir)/plugins
 
 options = \
-	options/aikgen.opt \
-	options/attest.opt \
 	options/charon.opt \
 	options/charon-logging.opt \
-	options/imcv.opt \
-	options/manager.opt \
-	options/medsrv.opt \
-	options/pacman.opt \
-	options/pki.opt \
-	options/pool.opt \
-	options/scepclient.opt \
-	options/starter.opt \
-	options/swanctl.opt \
-	options/tnc.opt
+	options/starter.opt 
 
 plugins = \
-	plugins/android_log.opt \
 	plugins/attr.opt \
-	plugins/attr-sql.opt \
-	plugins/certexpire.opt \
-	plugins/coupling.opt \
 	plugins/dhcp.opt \
-	plugins/dnscert.opt \
-	plugins/duplicheck.opt \
-	plugins/eap-aka.opt \
-	plugins/eap-aka-3ggp2.opt \
-	plugins/eap-dynamic.opt \
-	plugins/eap-gtc.opt \
-	plugins/eap-peap.opt \
-	plugins/eap-radius.opt \
-	plugins/eap-sim.opt \
-	plugins/eap-simaka-sql.opt \
-	plugins/eap-tls.opt \
-	plugins/eap-tnc.opt \
-	plugins/eap-ttls.opt \
-	plugins/error-notify.opt \
-	plugins/gcrypt.opt \
-	plugins/ha.opt \
-	plugins/imc-attestation.opt \
-	plugins/imc-os.opt \
-	plugins/imc-scanner.opt \
-	plugins/imc-swid.opt \
-	plugins/imc-test.opt \
-	plugins/imv-attestation.opt \
-	plugins/imv-os.opt \
-	plugins/imv-scanner.opt \
-	plugins/imv-swid.opt \
-	plugins/imv-test.opt \
-	plugins/ipseckey.opt \
-	plugins/led.opt \
 	plugins/kernel-libipsec.opt \
 	plugins/kernel-netlink.opt \
-	plugins/kernel-pfroute.opt \
-	plugins/load-tester.opt \
-	plugins/lookip.opt \
-	plugins/ntru.opt \
 	plugins/openssl.opt \
-	plugins/pkcs11.opt \
-	plugins/radattr.opt \
 	plugins/random.opt \
 	plugins/resolve.opt \
 	plugins/socket-default.opt \
-	plugins/sql.opt \
 	plugins/stroke.opt \
-	plugins/systime-fix.opt \
-	plugins/tnc-ifmap.opt \
-	plugins/tnc-imc.opt \
-	plugins/tnc-imv.opt \
-	plugins/tnc-pdp.opt \
-	plugins/tnccs-11.opt \
-	plugins/tnccs-20.opt \
-	plugins/unbound.opt \
-	plugins/updown.opt \
-	plugins/vici.opt \
-	plugins/whitelist.opt \
-	plugins/xauth-eap.opt \
-	plugins/xauth-pam.opt
+	plugins/updown.opt
 
 alloptions = $(options) $(plugins)
 
diff --git a/strongswan-5.2.0/conf/plugins/kernel-libipsec.opt b/strongswan-5.2.0/conf/plugins/kernel-libipsec.opt
index e76db63..31c69af 100644
--- a/strongswan-5.2.0/conf/plugins/kernel-libipsec.opt
+++ b/strongswan-5.2.0/conf/plugins/kernel-libipsec.opt
@@ -1,4 +1,8 @@
-charon.plugins.kernel-libipsec.allow_peer_ts = no
+charon.plugins.kernel-libipsec.load = yes
+	Whether to load the plugin. Can also be an integer to increase the
+    priority of this plugin.
+
+charon.plugins.kernel-libipsec.allow_peer_ts = yes
 	Allow that the remote traffic selector equals the IKE peer.
 
 	Allow that the remote traffic selector equals the IKE peer. The route
diff --git a/strongswan-5.2.0/conf/plugins/kernel-netlink.opt b/strongswan-5.2.0/conf/plugins/kernel-netlink.opt
index a8e421b..1d6e5c3 100644
--- a/strongswan-5.2.0/conf/plugins/kernel-netlink.opt
+++ b/strongswan-5.2.0/conf/plugins/kernel-netlink.opt
@@ -1,4 +1,4 @@
-charon.plugins.kernel-netlink.fwmark =
+charon.plugins.kernel-netlink.fwmark = !0x42
 	Firewall mark to set on the routing rule that directs traffic to our routing
 	table.
 
diff --git a/strongswan-5.2.0/conf/plugins/socket-default.opt b/strongswan-5.2.0/conf/plugins/socket-default.opt
index 483a0f0..e4f8133 100644
--- a/strongswan-5.2.0/conf/plugins/socket-default.opt
+++ b/strongswan-5.2.0/conf/plugins/socket-default.opt
@@ -1,4 +1,4 @@
-charon.plugins.socket-default.fwmark =
+charon.plugins.socket-default.fwmark = 0x42
 	Firewall mark to set on outbound packets.
 
 charon.plugins.socket-default.set_source = yes
diff --git a/strongswan-5.2.0/configure.ac b/strongswan-5.2.0/configure.ac
index 8f4d763..b84fce1 100644
--- a/strongswan-5.2.0/configure.ac
+++ b/strongswan-5.2.0/configure.ac
@@ -13,13 +13,34 @@
 # WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 # or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 # for more details.
-#
-
+# 
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */  
+ 
 # ============================
 #  initialize & set some vars
 # ============================
 
-AC_INIT([strongSwan],[5.2.0])
+AC_INIT([strongSwanCont],[5.2.0])
 AM_INIT_AUTOMAKE(m4_esyscmd([
 	echo tar-ustar
 	echo subdir-objects
@@ -55,15 +76,10 @@ ARG_WITH_SUBST([ipsecdir],           [${libexecdir%/}/ipsec], [set installation
 ARG_WITH_SUBST([ipseclibdir],        [${libdir%/}/ipsec], [set installation path for ipsec libraries])
 ARG_WITH_SUBST([plugindir],          [${ipseclibdir%/}/plugins], [set the installation path of plugins])
 ARG_WITH_SUBST([imcvdir],            [${ipseclibdir%/}/imcvs], [set the installation path of IMC and IMV dynamic librariers])
-ARG_WITH_SUBST([nm-ca-dir],          [/usr/share/ca-certificates], [directory the NM backend uses to look up trusted root certificates])
-ARG_WITH_SUBST([swanctldir],         [${sysconfdir}/swanctl], [base directory for swanctl configuration files and credentials])
 ARG_WITH_SUBST([linux-headers],      [\${top_srcdir}/src/include], [set directory of linux header files to use])
 ARG_WITH_SUBST([routing-table],      [220], [set routing table to use for IPsec routes])
 ARG_WITH_SUBST([routing-table-prio], [220], [set priority for IPsec routing table])
 ARG_WITH_SUBST([ipsec-script],       [ipsec], [change the name of the ipsec script])
-ARG_WITH_SUBST([fips-mode],          [0], [set openssl FIPS mode: disabled(0), enabled(1), Suite B enabled(2)])
-
-ARG_WITH_SET([tss],                  [no], [set implementation of the Trusted Computing Group's Software Stack (TSS). Currently the only supported value is "trousers"])
 ARG_WITH_SET([capabilities],         [no], [set capability dropping library. Currently supported values are "libcap" and "native"])
 ARG_WITH_SET([mpz_powm_sec],         [yes], [use the more side-channel resistant mpz_powm_sec in libgmp, if available])
 ARG_WITH_SET([dev-headers],          [no], [install strongSwan development headers to directory.])
@@ -122,170 +138,44 @@ m4_include(m4/macros/enable-disable.m4)
 
 # crypto plugins
 ARG_DISBL_SET([aes],            [disable AES software implementation plugin.])
-ARG_ENABL_SET([af-alg],         [enable AF_ALG crypto interface to Linux Crypto API.])
-ARG_ENABL_SET([blowfish],       [enable Blowfish software implementation plugin.])
-ARG_ENABL_SET([ccm],            [enables the CCM AEAD wrapper crypto plugin.])
-ARG_DISBL_SET([cmac],           [disable CMAC crypto implementation plugin.])
-ARG_ENABL_SET([ctr],            [enables the Counter Mode wrapper crypto plugin.])
-ARG_DISBL_SET([des],            [disable DES/3DES software implementation plugin.])
-ARG_DISBL_SET([fips-prf],       [disable FIPS PRF software implementation plugin.])
-ARG_ENABL_SET([gcm],            [enables the GCM AEAD wrapper crypto plugin.])
-ARG_ENABL_SET([gcrypt],         [enables the libgcrypt plugin.])
+ARG_DISBL_SET([contactcrypto],  [disable ContactCrypto software implementation plugin.])
 ARG_DISBL_SET([gmp],            [disable GNU MP (libgmp) based crypto implementation plugin.])
 ARG_DISBL_SET([hmac],           [disable HMAC crypto implementation plugin.])
-ARG_ENABL_SET([md4],            [enable MD4 software implementation plugin.])
-ARG_DISBL_SET([md5],            [disable MD5 software implementation plugin.])
 ARG_DISBL_SET([nonce],          [disable nonce generation plugin.])
-ARG_ENABL_SET([ntru],           [enables the NTRU crypto plugin.])
-ARG_ENABL_SET([openssl],        [enables the OpenSSL crypto plugin.])
-ARG_ENABL_SET([padlock],        [enables VIA Padlock crypto plugin.])
 ARG_DISBL_SET([random],         [disable RNG implementation on top of /dev/(u)random.])
-ARG_DISBL_SET([rc2],            [disable RC2 software implementation plugin.])
-ARG_ENABL_SET([rdrand],         [enable Intel RDRAND random generator plugin.])
 ARG_DISBL_SET([sha1],           [disable SHA1 software implementation plugin.])
-ARG_DISBL_SET([sha2],           [disable SHA256/SHA384/SHA512 software implementation plugin.])
-ARG_DISBL_SET([xcbc],           [disable xcbc crypto implementation plugin.])
 # encoding/decoding plugins
-ARG_DISBL_SET([dnskey],         [disable DNS RR key decoding plugin.])
+ARG_DISBL_SET([usbbar],         [disable USBBAR private key plugin.])
 ARG_DISBL_SET([pem],            [disable PEM decoding plugin.])
-ARG_DISBL_SET([pgp],            [disable PGP key decoding plugin.])
-ARG_DISBL_SET([pkcs1],          [disable PKCS1 key decoding plugin.])
-ARG_DISBL_SET([pkcs7],          [disable PKCS7 container support plugin.])
-ARG_DISBL_SET([pkcs8],          [disable PKCS8 private key decoding plugin.])
-ARG_DISBL_SET([pkcs12],         [disable PKCS12 container support plugin.])
 ARG_DISBL_SET([pubkey],         [disable RAW public key support plugin.])
-ARG_DISBL_SET([sshkey],         [disable SSH key decoding plugin.])
 ARG_DISBL_SET([x509],           [disable X509 certificate implementation plugin.])
-# fetcher/resolver plugins
-ARG_ENABL_SET([curl],           [enable CURL fetcher plugin to fetch files via libcurl. Requires libcurl.])
-ARG_ENABL_SET([ldap],           [enable LDAP fetching plugin to fetch files via libldap. Requires openLDAP.])
-ARG_ENABL_SET([soup],           [enable soup fetcher plugin to fetch from HTTP via libsoup. Requires libsoup.])
-ARG_ENABL_SET([unbound],        [enable UNBOUND resolver plugin to perform DNS queries via libunbound. Requires libldns and libunbound.])
-ARG_ENABL_SET([winhttp],        [enable WinHTTP based HTTP/HTTPS fetching plugin.])
-# database plugins
-ARG_ENABL_SET([mysql],          [enable MySQL database support. Requires libmysqlclient_r.])
-ARG_ENABL_SET([sqlite],         [enable SQLite database support. Requires libsqlite3.])
 # authentication/credential plugins
-ARG_ENABL_SET([addrblock],      [enables RFC 3779 address block constraint support.])
-ARG_ENABL_SET([acert],          [enable X509 attribute certificate checking plugin.])
-ARG_ENABL_SET([agent],          [enables the ssh-agent signing plugin.])
 ARG_DISBL_SET([constraints],    [disable advanced X509 constraint checking plugin.])
-ARG_ENABL_SET([coupling],       [enable IKEv2 plugin to couple peer certificates permanently to authentication.])
-ARG_ENABL_SET([dnscert],        [enable DNSCERT authentication plugin.])
-ARG_ENABL_SET([eap-sim],        [enable SIM authentication module for EAP.])
-ARG_ENABL_SET([eap-sim-file],   [enable EAP-SIM backend based on a triplet file.])
-ARG_ENABL_SET([eap-sim-pcsc],   [enable EAP-SIM backend based on a smartcard reader. Requires libpcsclite.])
-ARG_ENABL_SET([eap-aka],        [enable EAP AKA authentication module.])
-ARG_ENABL_SET([eap-aka-3gpp2],  [enable EAP AKA backend implementing 3GPP2 algorithms in software. Requires libgmp.])
-ARG_ENABL_SET([eap-simaka-sql], [enable EAP-SIM/AKA backend based on a triplet/quintuplet SQL database.])
-ARG_ENABL_SET([eap-simaka-pseudonym], [enable EAP-SIM/AKA pseudonym storage plugin.])
-ARG_ENABL_SET([eap-simaka-reauth],    [enable EAP-SIM/AKA reauthentication data storage plugin.])
-ARG_ENABL_SET([eap-identity],   [enable EAP module providing EAP-Identity helper.])
-ARG_ENABL_SET([eap-md5],        [enable EAP MD5 (CHAP) authentication module.])
-ARG_ENABL_SET([eap-gtc],        [enable EAP GTC authentication module.])
-ARG_ENABL_SET([eap-mschapv2],   [enable EAP MS-CHAPv2 authentication module.])
-ARG_ENABL_SET([eap-tls],        [enable EAP TLS authentication module.])
-ARG_ENABL_SET([eap-ttls],       [enable EAP TTLS authentication module.])
-ARG_ENABL_SET([eap-peap],       [enable EAP PEAP authentication module.])
-ARG_ENABL_SET([eap-tnc],        [enable EAP TNC trusted network connect module.])
-ARG_ENABL_SET([eap-dynamic],    [enable dynamic EAP proxy module.])
-ARG_ENABL_SET([eap-radius],     [enable RADIUS proxy authentication module.])
-ARG_ENABL_SET([ipseckey],       [enable IPSECKEY authentication plugin.])
-ARG_ENABL_SET([keychain],       [enables OS X Keychain Services credential set.])
-ARG_ENABL_SET([pkcs11],         [enables the PKCS11 token support plugin.])
+ARG_DISBL_SET([eap-bsts],       [enable BSTS authentication module for EAP.])
 ARG_DISBL_SET([revocation],     [disable X509 CRL/OCSP revocation check plugin.])
-ARG_ENABL_SET([whitelist],      [enable peer identity whitelisting plugin.])
-ARG_DISBL_SET([xauth-generic],  [disable generic XAuth backend.])
-ARG_ENABL_SET([xauth-eap],      [enable XAuth backend using EAP methods to verify passwords.])
-ARG_ENABL_SET([xauth-pam],      [enable XAuth backend using PAM to verify passwords.])
-ARG_ENABL_SET([xauth-noauth],   [enable XAuth pseudo-backend that does not actually verify or even request any credentials.])
 # kernel interfaces / sockets
 ARG_DISBL_SET([kernel-netlink], [disable the netlink kernel interface.])
-ARG_ENABL_SET([kernel-pfkey],   [enable the PF_KEY kernel interface.])
-ARG_ENABL_SET([kernel-pfroute], [enable the PF_ROUTE kernel interface.])
-ARG_ENABL_SET([kernel-iph],     [enable the Windows IP Helper based networking backend.])
-ARG_ENABL_SET([kernel-libipsec],[enable the libipsec kernel interface.])
-ARG_ENABL_SET([kernel-wfp],     [enable the Windows Filtering Platform IPsec backend.])
+ARG_DISBL_SET([kernel-libipsec],[disable the libipsec kernel interface.])
 ARG_DISBL_SET([socket-default], [disable default socket implementation for charon.])
-ARG_ENABL_SET([socket-dynamic], [enable dynamic socket implementation for charon])
-ARG_ENABL_SET([socket-win],     [enable Winsock2 based socket implementation for charon])
 # configuration/control plugins
 ARG_DISBL_SET([stroke],         [disable charons stroke configuration backend.])
-ARG_ENABL_SET([smp],            [enable SMP configuration and control interface. Requires libxml.])
-ARG_ENABL_SET([sql],            [enable SQL database configuration backend.])
-ARG_ENABL_SET([uci],            [enable OpenWRT UCI configuration plugin.])
-ARG_ENABL_SET([vici],           [enable strongSwan IKE generic IPC interface plugin.])
 # attribute provider/consumer plugins
-ARG_ENABL_SET([android-dns],    [enable Android specific DNS handler.])
 ARG_DISBL_SET([attr],           [disable strongswan.conf based configuration attribute plugin.])
-ARG_ENABL_SET([attr-sql],       [enable SQL based configuration attribute plugin.])
-ARG_ENABL_SET([dhcp],           [enable DHCP based attribute provider plugin.])
-ARG_ENABL_SET([osx-attr],       [enable OS X SystemConfiguration attribute handler.])
+ARG_DISBL_SET([dhcp],           [enable DHCP based attribute provider plugin.])
 ARG_DISBL_SET([resolve],        [disable resolve DNS handler plugin.])
-ARG_ENABL_SET([unity],          [enables Cisco Unity extension plugin.])
-# TNC modules/plugins
-ARG_ENABL_SET([imc-test],       [enable IMC test module.])
-ARG_ENABL_SET([imv-test],       [enable IMV test module.])
-ARG_ENABL_SET([imc-scanner],    [enable IMC port scanner module.])
-ARG_ENABL_SET([imv-scanner],    [enable IMV port scanner module.])
-ARG_ENABL_SET([imc-os],         [enable IMC operating system module.])
-ARG_ENABL_SET([imv-os],         [enable IMV operating system module.])
-ARG_ENABL_SET([imc-attestation],[enable IMC attestation module.])
-ARG_ENABL_SET([imv-attestation],[enable IMV attestation module.])
-ARG_ENABL_SET([imc-swid],       [enable IMC swid module.])
-ARG_ENABL_SET([imv-swid],       [enable IMV swid module.])
-ARG_ENABL_SET([tnc-ifmap],      [enable TNC IF-MAP module. Requires libxml])
-ARG_ENABL_SET([tnc-imc],        [enable TNC IMC module.])
-ARG_ENABL_SET([tnc-imv],        [enable TNC IMV module.])
-ARG_ENABL_SET([tnc-pdp],        [enable TNC policy decision point module.])
-ARG_ENABL_SET([tnccs-11],       [enable TNCCS 1.1 protocol module. Requires libxml])
-ARG_ENABL_SET([tnccs-20],       [enable TNCCS 2.0 protocol module.])
-ARG_ENABL_SET([tnccs-dynamic],  [enable dynamic TNCCS protocol discovery module.])
 # misc plugins
-ARG_ENABL_SET([android-log],    [enable Android specific logger plugin.])
-ARG_ENABL_SET([certexpire],     [enable CSV export of expiration dates of used certificates.])
-ARG_ENABL_SET([duplicheck],     [advanced duplicate checking plugin using liveness checks.])
-ARG_ENABL_SET([error-notify],   [enable error notification plugin.])
-ARG_ENABL_SET([farp],           [enable ARP faking plugin that responds to ARP requests to peers virtual IP])
-ARG_ENABL_SET([ha],             [enable high availability cluster plugin.])
-ARG_ENABL_SET([led],            [enable plugin to control LEDs on IKEv2 activity using the Linux kernel LED subsystem.])
-ARG_ENABL_SET([load-tester],    [enable load testing plugin for IKEv2 daemon.])
-ARG_ENABL_SET([lookip],         [enable fast virtual IP lookup and notification plugin.])
-ARG_ENABL_SET([maemo],          [enable Maemo specific plugin.])
-ARG_ENABL_SET([radattr],        [enable plugin to inject and process custom RADIUS attributes as IKEv2 client.])
-ARG_ENABL_SET([systime-fix],    [enable plugin to handle cert lifetimes with invalid system time gracefully.])
-ARG_ENABL_SET([test-vectors],   [enable plugin providing crypto test vectors.])
-ARG_ENABL_SET([unit-tester],    [enable unit tests on IKEv2 daemon startup.])
 ARG_DISBL_SET([updown],         [disable updown firewall script plugin.])
 # programs/components
-ARG_ENABL_SET([aikgen],         [enable AIK generator.])
 ARG_DISBL_SET([charon],         [disable the IKEv1/IKEv2 keying daemon charon.])
-ARG_ENABL_SET([cmd],            [enable the command line IKE client charon-cmd.])
-ARG_ENABL_SET([conftest],       [enforce Suite B conformance test framework.])
-ARG_ENABL_SET([dumm],           [enable the DUMM UML test framework.])
-ARG_ENABL_SET([fast],           [enable libfast (FastCGI Application Server w/ templates.])
 ARG_ENABL_SET([libipsec],       [enable user space IPsec implementation.])
-ARG_ENABL_SET([manager],        [enable web management console (proof of concept).])
-ARG_ENABL_SET([medcli],         [enable mediation client configuration database plugin.])
-ARG_ENABL_SET([medsrv],         [enable mediation server web frontend and daemon plugin.])
-ARG_ENABL_SET([nm],             [enable NetworkManager backend.])
-ARG_DISBL_SET([pki],            [disable pki certificate utility.])
-ARG_DISBL_SET([scepclient],     [disable SCEP client tool.])
 ARG_DISBL_SET([scripts],        [disable additional utilities (found in directory scripts).])
-ARG_ENABL_SET([svc],            [enable charon Windows service.])
-ARG_ENABL_SET([swanctl],        [enable swanctl configuration and control tool.])
-ARG_ENABL_SET([tkm],            [enable Trusted Key Manager support.])
 # optional features
-ARG_ENABL_SET([bfd-backtraces], [use binutils libbfd to resolve backtraces for memory leaks and segfaults.])
-ARG_ENABL_SET([dbghelp-backtraces],[use dbghlp.dll on Windows to create and print backtraces for memory leaks and segfaults.])
-ARG_DISBL_SET([ikev1],          [disable IKEv1 protocol support in charon.])
+ARG_ENABL_SET([ikev1],          [disable IKEv1 protocol support in charon.])
 ARG_DISBL_SET([ikev2],          [disable IKEv2 protocol support in charon.])
 ARG_ENABL_SET([integrity-test], [enable integrity testing of libstrongswan and plugins.])
 ARG_DISBL_SET([load-warning],   [disable the charon plugin load option warning in starter.])
 ARG_ENABL_SET([mediation],      [enable IKEv2 Mediation Extension.])
-ARG_ENABL_SET([unwind-backtraces],[use libunwind to create backtraces for memory leaks and segfaults.])
 # compile options
-ARG_ENABL_SET([coverage],       [enable lcov coverage report generation.])
 ARG_ENABL_SET([leak-detective], [enable malloc hooks to find memory leaks.])
 ARG_ENABL_SET([lock-profiler],  [enable lock/mutex profiling code.])
 ARG_ENABL_SET([monolithic],     [build monolithic version of libstrongswan that includes all enabled plugins. Similarly, the plugins of charon are assembled in libcharon.])
@@ -320,10 +210,13 @@ fi
 #  set up compiler and flags
 # ===========================
 
+AC_LANG_PUSH(C++)
+CC = gcc
 if test -z "$CFLAGS"; then
 	CFLAGS="-g -O2 -Wall -Wno-format -Wno-format-security -Wno-pointer-sign"
 fi
-AC_PROG_CC
+AC_PROG_CC([gcc])
+AC_PROG_CXX([gcc])
 AM_PROG_CC_C_O
 
 AC_LIB_PREFIX
@@ -359,75 +252,10 @@ fi
 #  dependency calculation
 # ========================
 
-if test x$xauth_generic_given = xfalse -a x$ikev1 = xfalse; then
-	xauth_generic=false;
-fi
-
 if test x$kernel_libipsec = xtrue; then
 	libipsec=true;
 fi
 
-if test x$eap_aka_3gpp2 = xtrue; then
-	gmp=true;
-fi
-
-if test x$eap_aka = xtrue; then
-	fips_prf=true;
-	simaka=true;
-fi
-
-if test x$eap_sim = xtrue; then
-	fips_prf=true;
-	simaka=true;
-fi
-
-if test x$eap_radius = xtrue -o x$radattr = xtrue -o x$tnc_pdp = xtrue; then
-	radius=true;
-fi
-
-if test x$tnc_imc = xtrue -o x$tnc_imv = xtrue -o x$tnccs_11 = xtrue -o x$tnccs_11 = xtrue -o x$tnccs_dynamic = xtrue -o x$eap_tnc = xtrue; then
-	tnc_tnccs=true;
-fi
-
-if test x$eap_tls = xtrue -o x$eap_ttls = xtrue -o x$eap_peap = xtrue -o x$tnc_tnccs = xtrue; then
-	tls=true;
-fi
-
-if test x$imc_test = xtrue -o x$imv_test = xtrue -o x$imc_scanner = xtrue -o x$imv_scanner = xtrue -o x$imc_os = xtrue -o x$imv_os = xtrue -o x$imc_attestation = xtrue -o x$imv_attestation = xtrue -o x$imc_swid = xtrue -o x$imv_swid = xtrue; then
-	imcv=true;
-fi
-
-if test x$imc_attestation = xtrue -o x$imv_attestation = xtrue -o x$imc_swid = xtrue -o x$imv_swid = xtrue; then
-	pts=true;
-fi
-
-if test x$fips_prf = xtrue; then
-	if test x$openssl = xfalse; then
-		sha1=true;
-	fi
-fi
-
-if test x$swanctl = xtrue; then
-	vici=true
-fi
-
-if test x$smp = xtrue -o x$tnccs_11 = xtrue -o x$tnc_ifmap = xtrue; then
-	xml=true
-fi
-
-if test x$manager = xtrue; then
-	fast=true
-fi
-
-if test x$medsrv = xtrue; then
-	mediation=true
-	fast=true
-fi
-
-if test x$medcli = xtrue; then
-	mediation=true
-fi
-
 # ===========================================
 #  check required libraries and header files
 # ===========================================
@@ -869,82 +697,11 @@ if test x$xml = xtrue; then
 	AC_SUBST(xml_LIBS)
 fi
 
-if test x$tss = xtrousers; then
-	AC_CHECK_LIB([tspi],[main],[LIBS="$LIBS"],[AC_MSG_ERROR([TrouSerS library libtspi not found])],[])
-	AC_CHECK_HEADER([trousers/tss.h],,[AC_MSG_ERROR([TrouSerS header trousers/tss.h not found!])])
-	AC_DEFINE([TSS_TROUSERS], [], [use TrouSerS library libtspi as TSS implementation])
-fi
-
 if test x$imv_swid = xtrue; then
 	AC_CHECK_LIB([json],[main],[LIBS="$LIBS"],[AC_MSG_ERROR([JSON library libjson not found])],[])
 	AC_CHECK_HEADER([json/json.h],,[AC_MSG_ERROR([JSON header json/json.h not found!])])
 fi
 
-if test x$dumm = xtrue; then
-	PKG_CHECK_MODULES(gtk, [gtk+-2.0 vte])
-	AC_SUBST(gtk_CFLAGS)
-	AC_SUBST(gtk_LIBS)
-	AC_CHECK_PROGS(RUBY, ruby)
-	AC_MSG_CHECKING([for Ruby header files])
-	if test -n "$RUBY"; then
-		RUBYINCLUDE=
-		RUBYDIR=`($RUBY -r rbconfig -e 'print RbConfig::CONFIG[["rubyhdrdir"]] || ""') 2>/dev/null`
-		if test -n "$RUBYDIR" -a -r "$RUBYDIR/ruby.h"; then
-			RUBYARCH=`($RUBY -r rbconfig -e 'print RbConfig::CONFIG[["arch"]] || ""') 2>/dev/null`
-			if test -n "$RUBYARCH"; then
-				AC_MSG_RESULT([$RUBYDIR])
-				RUBYINCLUDE="-I$RUBYDIR -I$RUBYDIR/$RUBYARCH"
-			fi
-		else
-			RUBYDIR=`($RUBY -r rbconfig -e 'print RbConfig::CONFIG[["archdir"]] || ""') 2>/dev/null`
-			if test -n "$RUBYDIR" -a -r "$RUBYDIR/ruby.h"; then
-				AC_MSG_RESULT([$RUBYDIR])
-				RUBYINCLUDE="-I$RUBYDIR"
-			fi
-		fi
-		if test -z "$RUBYINCLUDE"; then
-			AC_MSG_ERROR([ruby.h not found])
-		fi
-		AC_SUBST(RUBYINCLUDE)
-	else
-		AC_MSG_ERROR([don't know how to run ruby])
-	fi
-	AC_MSG_CHECKING([for libruby])
-	saved_LIBS=$LIBS
-	LIBS=`($RUBY -r rbconfig -e 'print RbConfig::CONFIG[["LIBRUBYARG_SHARED"]] || ""') 2>/dev/null`
-	AC_TRY_LINK_FUNC(ruby_init,
-		[AC_MSG_RESULT([$LIBS]); RUBYLIB=$LIBS],
-		[AC_MSG_ERROR([not found])])
-	AC_SUBST(RUBYLIB)
-	AC_CHECK_FUNCS(rb_errinfo)
-	LIBS=$saved_LIBS
-fi
-
-if test x$fast = xtrue; then
-	AC_CHECK_LIB([neo_cgi],[main],[LIBS="$LIBS"],[AC_MSG_ERROR([ClearSilver library neo_cgi not found!])],[])
-	AC_CHECK_LIB([neo_utl],[main],[LIBS="$LIBS"],[AC_MSG_ERROR([ClearSilver library neo_utl not found!])],[])
-	AC_MSG_CHECKING([ClearSilver requires zlib])
-	saved_CFLAGS=$CFLAGS
-	saved_LIBS=$LIBS
-	LIBS="-lneo_cgi -lneo_cs -lneo_utl"
-	CFLAGS="-I/usr/include/ClearSilver"
-	AC_LINK_IFELSE(
-		[AC_LANG_PROGRAM(
-			[[#include <ClearSilver.h>]],
-			[[NEOERR *err = cgi_display(NULL, NULL);]])],
-		[AC_MSG_RESULT([no]); clearsilver_LIBS="$LIBS"],
-		[AC_MSG_RESULT([yes]); clearsilver_LIBS="$LIBS -lz"]
-	)
-	AC_SUBST(clearsilver_LIBS)
-	LIBS=$saved_LIBS
-	CFLAGS=$saved_CFLAGS
-# autoconf does not like CamelCase!? How to fix this?
-#	AC_CHECK_HEADER([ClearSilver/ClearSilver.h],,[AC_MSG_ERROR([ClearSilver header file ClearSilver/ClearSilver.h not found!])])
-
-	AC_CHECK_LIB([fcgi],[main],[LIBS="$LIBS"],[AC_MSG_ERROR([FastCGI library fcgi not found!])],[])
-	AC_CHECK_HEADER([fcgiapp.h],,[AC_MSG_ERROR([FastCGI header file fcgiapp.h not found!])])
-fi
-
 if test x$mysql = xtrue; then
 	if test "x$windows" = xtrue; then
 		AC_CHECK_HEADER([mysql.h],,[AC_MSG_ERROR([MySQL header file mysql.h not found!])])
@@ -985,11 +742,6 @@ if test x$sqlite = xtrue; then
 	)
 fi
 
-if test x$openssl = xtrue; then
-	AC_CHECK_LIB([$openssl_lib],[main],[LIBS="$LIBS"],[AC_MSG_ERROR([OpenSSL lib$openssl_lib not found])],[])
-	AC_CHECK_HEADER([openssl/evp.h],,[AC_MSG_ERROR([OpenSSL header openssl/evp.h not found!])])
-fi
-
 if test x$gcrypt = xtrue; then
 	AC_CHECK_LIB([gcrypt],[main],[LIBS="$LIBS"],[AC_MSG_ERROR([gcrypt library not found])],[-lgpg-error])
 	AC_CHECK_HEADER([gcrypt.h],,[AC_MSG_ERROR([gcrypt header gcrypt.h not found!])])
@@ -1032,15 +784,6 @@ if test x$eap_sim_pcsc = xtrue; then
 	AC_SUBST(pcsclite_LIBS)
 fi
 
-if test x$nm = xtrue; then
-	PKG_CHECK_EXISTS([libnm-glib],
-		[PKG_CHECK_MODULES(nm, [NetworkManager gthread-2.0 libnm-util libnm-glib libnm-glib-vpn])],
-		[PKG_CHECK_MODULES(nm, [NetworkManager gthread-2.0 libnm_util libnm_glib libnm_glib_vpn])]
-	)
-	AC_SUBST(nm_CFLAGS)
-	AC_SUBST(nm_LIBS)
-fi
-
 if test x$xauth_pam = xtrue; then
 	AC_CHECK_LIB([pam],[main],[LIBS="$LIBS"],[AC_MSG_ERROR([PAM library not found])],[])
 	AC_CHECK_HEADER([security/pam_appl.h],,[AC_MSG_ERROR([PAM header security/pam_appl.h not found!])])
@@ -1110,13 +853,6 @@ AC_SUBST(dev_headers)
 
 CFLAGS="$CFLAGS -include `pwd`/config.h"
 
-if test x$tkm = xtrue; then
-	AC_PATH_PROG([GPRBUILD], [gprbuild], [], [$PATH:/bin:/usr/bin:/usr/local/bin])
-	if test x$GPRBUILD = x; then
-		AC_MSG_ERROR([gprbuild not found])
-	fi
-fi
-
 if test x$coverage = xtrue; then
 	AC_PATH_PROG([LCOV], [lcov], [], [$PATH:/bin:/usr/bin:/usr/local/bin])
 	if test x$LCOV = x; then
@@ -1145,162 +881,44 @@ m4_include(m4/macros/add-plugin.m4)
 # plugin lists for all components
 charon_plugins=
 starter_plugins=
-pool_plugins=
-attest_plugins=
-scepclient_plugins=
-pki_plugins=
 scripts_plugins=
-manager_plugins=
-medsrv_plugins=
-nm_plugins=
-cmd_plugins=
-aikgen_plugins=
 
 # location specific lists for checksumming,
-# for src/libcharon, src/libhydra, src/libstrongswan and src/libtnccs
+# for src/libcharon, src/libhydra and src/libstrongswan
 c_plugins=
 h_plugins=
 s_plugins=
-t_plugins=
-
-ADD_PLUGIN([test-vectors],         [s charon scepclient pki])
-ADD_PLUGIN([curl],                 [s charon scepclient pki scripts nm cmd])
-ADD_PLUGIN([winhttp],              [s charon pki scripts])
-ADD_PLUGIN([soup],                 [s charon pki scripts nm cmd])
-ADD_PLUGIN([unbound],              [s charon scripts])
-ADD_PLUGIN([ldap],                 [s charon scepclient scripts nm cmd])
-ADD_PLUGIN([mysql],                [s charon pool manager medsrv attest])
-ADD_PLUGIN([sqlite],               [s charon pool manager medsrv attest])
-ADD_PLUGIN([pkcs11],               [s charon pki nm cmd])
-ADD_PLUGIN([aes],                  [s charon scepclient pki scripts nm cmd])
-ADD_PLUGIN([des],                  [s charon scepclient pki scripts nm cmd])
-ADD_PLUGIN([blowfish],             [s charon scepclient pki scripts nm cmd])
-ADD_PLUGIN([rc2],                  [s charon scepclient pki scripts nm cmd])
-ADD_PLUGIN([sha1],                 [s charon scepclient pki scripts medsrv attest nm cmd aikgen])
-ADD_PLUGIN([sha2],                 [s charon scepclient pki scripts medsrv attest nm cmd aikgen])
-ADD_PLUGIN([md4],                  [s charon manager scepclient pki nm cmd])
-ADD_PLUGIN([md5],                  [s charon scepclient pki scripts attest nm cmd aikgen])
-ADD_PLUGIN([rdrand],               [s charon scepclient pki scripts medsrv attest nm cmd aikgen])
-ADD_PLUGIN([random],               [s charon scepclient pki scripts medsrv attest nm cmd aikgen])
-ADD_PLUGIN([nonce],                [s charon nm cmd aikgen])
-ADD_PLUGIN([x509],                 [s charon scepclient pki scripts attest nm cmd aikgen])
-ADD_PLUGIN([revocation],           [s charon pki nm cmd])
-ADD_PLUGIN([constraints],          [s charon nm cmd])
-ADD_PLUGIN([acert],                [s charon])
-ADD_PLUGIN([pubkey],               [s charon cmd aikgen])
-ADD_PLUGIN([pkcs1],                [s charon scepclient pki scripts manager medsrv attest nm cmd aikgen])
-ADD_PLUGIN([pkcs7],                [s charon scepclient pki scripts nm cmd])
-ADD_PLUGIN([pkcs8],                [s charon scepclient pki scripts manager medsrv attest nm cmd])
-ADD_PLUGIN([pkcs12],               [s charon scepclient pki scripts cmd])
-ADD_PLUGIN([pgp],                  [s charon])
-ADD_PLUGIN([dnskey],               [s charon pki])
-ADD_PLUGIN([sshkey],               [s charon pki nm cmd])
-ADD_PLUGIN([dnscert],              [c charon])
-ADD_PLUGIN([ipseckey],             [c charon])
-ADD_PLUGIN([pem],                  [s charon scepclient pki scripts manager medsrv attest nm cmd aikgen])
-ADD_PLUGIN([padlock],              [s charon])
-ADD_PLUGIN([openssl],              [s charon scepclient pki scripts manager medsrv attest nm cmd aikgen])
-ADD_PLUGIN([gcrypt],               [s charon scepclient pki scripts manager medsrv attest nm cmd aikgen])
-ADD_PLUGIN([af-alg],               [s charon scepclient pki scripts medsrv attest nm cmd aikgen])
-ADD_PLUGIN([fips-prf],             [s charon nm cmd])
-ADD_PLUGIN([gmp],                  [s charon scepclient pki scripts manager medsrv attest nm cmd aikgen])
-ADD_PLUGIN([agent],                [s charon nm cmd])
-ADD_PLUGIN([keychain],             [s charon cmd])
-ADD_PLUGIN([xcbc],                 [s charon nm cmd])
-ADD_PLUGIN([cmac],                 [s charon nm cmd])
-ADD_PLUGIN([hmac],                 [s charon scripts nm cmd])
-ADD_PLUGIN([ctr],                  [s charon scripts nm cmd])
-ADD_PLUGIN([ccm],                  [s charon scripts nm cmd])
-ADD_PLUGIN([gcm],                  [s charon scripts nm cmd])
-ADD_PLUGIN([ntru],                 [s charon scripts nm cmd])
+
+ADD_PLUGIN([aes],                  [s charon scripts])
+ADD_PLUGIN([contactcrypto],        [s charon scripts])
+ADD_PLUGIN([gmp],                  [s charon scripts])
+ADD_PLUGIN([sha1],                 [s charon scripts])
+ADD_PLUGIN([random],               [s charon scripts])
+ADD_PLUGIN([nonce],                [s charon])
+ADD_PLUGIN([x509],                 [s charon scripts])
+ADD_PLUGIN([revocation],           [s charon])
+ADD_PLUGIN([constraints],          [s charon])
+ADD_PLUGIN([pubkey],               [s charon])
+ADD_PLUGIN([usbbar],               [s charon scripts])
+ADD_PLUGIN([pem],                  [s charon scripts])
+ADD_PLUGIN([hmac],                 [s charon scripts])
 ADD_PLUGIN([attr],                 [h charon])
-ADD_PLUGIN([attr-sql],             [h charon])
-ADD_PLUGIN([load-tester],          [c charon])
-ADD_PLUGIN([kernel-libipsec],      [c charon cmd])
-ADD_PLUGIN([kernel-wfp],           [c charon])
-ADD_PLUGIN([kernel-iph],           [c charon])
-ADD_PLUGIN([kernel-pfkey],         [h charon starter nm cmd])
-ADD_PLUGIN([kernel-pfroute],       [h charon starter nm cmd])
-ADD_PLUGIN([kernel-netlink],       [h charon starter nm cmd])
-ADD_PLUGIN([resolve],              [h charon cmd])
-ADD_PLUGIN([socket-default],       [c charon nm cmd])
-ADD_PLUGIN([socket-dynamic],       [c charon cmd])
-ADD_PLUGIN([socket-win],           [c charon])
-ADD_PLUGIN([farp],                 [c charon])
+ADD_PLUGIN([kernel-libipsec],      [c charon])
+ADD_PLUGIN([kernel-netlink],       [h charon starter])
+ADD_PLUGIN([resolve],              [h charon])
+ADD_PLUGIN([socket-default],       [c charon])
 ADD_PLUGIN([stroke],               [c charon])
-ADD_PLUGIN([vici],                 [c charon])
-ADD_PLUGIN([smp],                  [c charon])
-ADD_PLUGIN([sql],                  [c charon])
+ADD_PLUGIN([eap-bsts],             [c charon])
 ADD_PLUGIN([updown],               [c charon])
-ADD_PLUGIN([eap-identity],         [c charon nm cmd])
-ADD_PLUGIN([eap-sim],              [c charon])
-ADD_PLUGIN([eap-sim-file],         [c charon])
-ADD_PLUGIN([eap-sim-pcsc],         [c charon])
-ADD_PLUGIN([eap-aka],              [c charon])
-ADD_PLUGIN([eap-aka-3gpp2],        [c charon])
-ADD_PLUGIN([eap-simaka-sql],       [c charon])
-ADD_PLUGIN([eap-simaka-pseudonym], [c charon])
-ADD_PLUGIN([eap-simaka-reauth],    [c charon])
-ADD_PLUGIN([eap-md5],              [c charon nm cmd])
-ADD_PLUGIN([eap-gtc],              [c charon nm cmd])
-ADD_PLUGIN([eap-mschapv2],         [c charon nm cmd])
-ADD_PLUGIN([eap-dynamic],          [c charon])
-ADD_PLUGIN([eap-radius],           [c charon])
-ADD_PLUGIN([eap-tls],              [c charon nm cmd])
-ADD_PLUGIN([eap-ttls],             [c charon nm cmd])
-ADD_PLUGIN([eap-peap],             [c charon nm cmd])
-ADD_PLUGIN([eap-tnc],              [c charon])
-ADD_PLUGIN([xauth-generic],        [c charon cmd])
-ADD_PLUGIN([xauth-eap],            [c charon])
-ADD_PLUGIN([xauth-pam],            [c charon])
-ADD_PLUGIN([xauth-noauth],         [c charon])
-ADD_PLUGIN([tnc-ifmap],            [c charon])
-ADD_PLUGIN([tnc-pdp],              [c charon])
-ADD_PLUGIN([tnc-imc],              [t charon])
-ADD_PLUGIN([tnc-imv],              [t charon])
-ADD_PLUGIN([tnc-tnccs],            [t charon])
-ADD_PLUGIN([tnccs-20],             [t charon])
-ADD_PLUGIN([tnccs-11],             [t charon])
-ADD_PLUGIN([tnccs-dynamic],        [t charon])
-ADD_PLUGIN([medsrv],               [c charon])
-ADD_PLUGIN([medcli],               [c charon])
 ADD_PLUGIN([dhcp],                 [c charon])
-ADD_PLUGIN([osx-attr],             [c charon cmd])
-ADD_PLUGIN([android-dns],          [c charon])
-ADD_PLUGIN([android-log],          [c charon])
-ADD_PLUGIN([ha],                   [c charon])
-ADD_PLUGIN([whitelist],            [c charon])
-ADD_PLUGIN([lookip],               [c charon])
-ADD_PLUGIN([error-notify],         [c charon])
-ADD_PLUGIN([certexpire],           [c charon])
-ADD_PLUGIN([systime-fix],          [c charon])
-ADD_PLUGIN([led],                  [c charon])
-ADD_PLUGIN([duplicheck],           [c charon])
-ADD_PLUGIN([coupling],             [c charon])
-ADD_PLUGIN([radattr],              [c charon])
-ADD_PLUGIN([maemo],                [c charon])
-ADD_PLUGIN([uci],                  [c charon])
-ADD_PLUGIN([addrblock],            [c charon])
-ADD_PLUGIN([unity],                [c charon])
-ADD_PLUGIN([unit-tester],          [c charon])
 
 AC_SUBST(charon_plugins)
 AC_SUBST(starter_plugins)
-AC_SUBST(pool_plugins)
-AC_SUBST(attest_plugins)
-AC_SUBST(scepclient_plugins)
-AC_SUBST(pki_plugins)
 AC_SUBST(scripts_plugins)
-AC_SUBST(manager_plugins)
-AC_SUBST(medsrv_plugins)
-AC_SUBST(nm_plugins)
-AC_SUBST(cmd_plugins)
-AC_SUBST(aikgen_plugins)
 
 AC_SUBST(c_plugins)
 AC_SUBST(h_plugins)
 AC_SUBST(s_plugins)
-AC_SUBST(t_plugins)
 
 # ======================
 #  set Makefile.am vars
@@ -1308,190 +926,60 @@ AC_SUBST(t_plugins)
 
 #  libstrongswan plugins
 # -----------------------
-AM_CONDITIONAL(USE_TEST_VECTORS, test x$test_vectors = xtrue)
-AM_CONDITIONAL(USE_CURL, test x$curl = xtrue)
-AM_CONDITIONAL(USE_WINHTTP, test x$winhttp = xtrue)
-AM_CONDITIONAL(USE_UNBOUND, test x$unbound = xtrue)
-AM_CONDITIONAL(USE_SOUP, test x$soup = xtrue)
-AM_CONDITIONAL(USE_LDAP, test x$ldap = xtrue)
 AM_CONDITIONAL(USE_AES, test x$aes = xtrue)
-AM_CONDITIONAL(USE_DES, test x$des = xtrue)
-AM_CONDITIONAL(USE_BLOWFISH, test x$blowfish = xtrue)
-AM_CONDITIONAL(USE_RC2, test x$rc2 = xtrue)
-AM_CONDITIONAL(USE_MD4, test x$md4 = xtrue)
-AM_CONDITIONAL(USE_MD5, test x$md5 = xtrue)
+AM_CONDITIONAL(USE_CONTACTCRYPTO, test x$contactcrypto = xtrue)
 AM_CONDITIONAL(USE_SHA1, test x$sha1 = xtrue)
-AM_CONDITIONAL(USE_SHA2, test x$sha2 = xtrue)
-AM_CONDITIONAL(USE_FIPS_PRF, test x$fips_prf = xtrue)
 AM_CONDITIONAL(USE_GMP, test x$gmp = xtrue)
-AM_CONDITIONAL(USE_RDRAND, test x$rdrand = xtrue)
 AM_CONDITIONAL(USE_RANDOM, test x$random = xtrue)
 AM_CONDITIONAL(USE_NONCE, test x$nonce = xtrue)
 AM_CONDITIONAL(USE_X509, test x$x509 = xtrue)
 AM_CONDITIONAL(USE_REVOCATION, test x$revocation = xtrue)
 AM_CONDITIONAL(USE_CONSTRAINTS, test x$constraints = xtrue)
-AM_CONDITIONAL(USE_ACERT, test x$acert = xtrue)
 AM_CONDITIONAL(USE_PUBKEY, test x$pubkey = xtrue)
-AM_CONDITIONAL(USE_PKCS1, test x$pkcs1 = xtrue)
-AM_CONDITIONAL(USE_PKCS7, test x$pkcs7 = xtrue)
-AM_CONDITIONAL(USE_PKCS8, test x$pkcs8 = xtrue)
-AM_CONDITIONAL(USE_PKCS12, test x$pkcs12 = xtrue)
-AM_CONDITIONAL(USE_PGP, test x$pgp = xtrue)
-AM_CONDITIONAL(USE_DNSKEY, test x$dnskey = xtrue)
-AM_CONDITIONAL(USE_SSHKEY, test x$sshkey = xtrue)
+AM_CONDITIONAL(USE_USBBAR, test x$usbbar = xtrue)
 AM_CONDITIONAL(USE_PEM, test x$pem = xtrue)
 AM_CONDITIONAL(USE_HMAC, test x$hmac = xtrue)
-AM_CONDITIONAL(USE_CMAC, test x$cmac = xtrue)
-AM_CONDITIONAL(USE_XCBC, test x$xcbc = xtrue)
-AM_CONDITIONAL(USE_MYSQL, test x$mysql = xtrue)
-AM_CONDITIONAL(USE_SQLITE, test x$sqlite = xtrue)
-AM_CONDITIONAL(USE_PADLOCK, test x$padlock = xtrue)
-AM_CONDITIONAL(USE_OPENSSL, test x$openssl = xtrue)
-AM_CONDITIONAL(USE_GCRYPT, test x$gcrypt = xtrue)
-AM_CONDITIONAL(USE_AGENT, test x$agent = xtrue)
-AM_CONDITIONAL(USE_KEYCHAIN, test x$keychain = xtrue)
-AM_CONDITIONAL(USE_PKCS11, test x$pkcs11 = xtrue)
-AM_CONDITIONAL(USE_CTR, test x$ctr = xtrue)
-AM_CONDITIONAL(USE_CCM, test x$ccm = xtrue)
-AM_CONDITIONAL(USE_GCM, test x$gcm = xtrue)
-AM_CONDITIONAL(USE_AF_ALG, test x$af_alg = xtrue)
-AM_CONDITIONAL(USE_NTRU, test x$ntru = xtrue)
 
 #  charon plugins
 # ----------------
 AM_CONDITIONAL(USE_STROKE, test x$stroke = xtrue)
-AM_CONDITIONAL(USE_VICI, test x$vici = xtrue)
-AM_CONDITIONAL(USE_MEDSRV, test x$medsrv = xtrue)
-AM_CONDITIONAL(USE_MEDCLI, test x$medcli = xtrue)
-AM_CONDITIONAL(USE_UCI, test x$uci = xtrue)
-AM_CONDITIONAL(USE_OSX_ATTR, test x$osx_attr = xtrue)
-AM_CONDITIONAL(USE_ANDROID_DNS, test x$android_dns = xtrue)
-AM_CONDITIONAL(USE_ANDROID_LOG, test x$android_log = xtrue)
-AM_CONDITIONAL(USE_MAEMO, test x$maemo = xtrue)
-AM_CONDITIONAL(USE_SMP, test x$smp = xtrue)
-AM_CONDITIONAL(USE_SQL, test x$sql = xtrue)
-AM_CONDITIONAL(USE_DNSCERT, test x$dnscert = xtrue)
-AM_CONDITIONAL(USE_IPSECKEY, test x$ipseckey = xtrue)
+AM_CONDITIONAL(USE_EAP_BSTS, test x$eap_bsts = xtrue)
+AM_CONDITIONAL(USE_SOCKET_DEFAULT, test x$socket_default = xtrue)
 AM_CONDITIONAL(USE_UPDOWN, test x$updown = xtrue)
 AM_CONDITIONAL(USE_DHCP, test x$dhcp = xtrue)
-AM_CONDITIONAL(USE_UNIT_TESTS, test x$unit_tester = xtrue)
-AM_CONDITIONAL(USE_LOAD_TESTER, test x$load_tester = xtrue)
-AM_CONDITIONAL(USE_HA, test x$ha = xtrue)
-AM_CONDITIONAL(USE_KERNEL_LIBIPSEC, test x$kernel_libipsec = xtrue)
-AM_CONDITIONAL(USE_KERNEL_WFP, test x$kernel_wfp = xtrue)
-AM_CONDITIONAL(USE_KERNEL_IPH, test x$kernel_iph = xtrue)
-AM_CONDITIONAL(USE_WHITELIST, test x$whitelist = xtrue)
-AM_CONDITIONAL(USE_LOOKIP, test x$lookip = xtrue)
-AM_CONDITIONAL(USE_ERROR_NOTIFY, test x$error_notify = xtrue)
-AM_CONDITIONAL(USE_CERTEXPIRE, test x$certexpire = xtrue)
-AM_CONDITIONAL(USE_SYSTIME_FIX, test x$systime_fix = xtrue)
-AM_CONDITIONAL(USE_LED, test x$led = xtrue)
-AM_CONDITIONAL(USE_DUPLICHECK, test x$duplicheck = xtrue)
-AM_CONDITIONAL(USE_COUPLING, test x$coupling = xtrue)
-AM_CONDITIONAL(USE_RADATTR, test x$radattr = xtrue)
-AM_CONDITIONAL(USE_EAP_SIM, test x$eap_sim = xtrue)
-AM_CONDITIONAL(USE_EAP_SIM_FILE, test x$eap_sim_file = xtrue)
-AM_CONDITIONAL(USE_EAP_SIM_PCSC, test x$eap_sim_pcsc = xtrue)
-AM_CONDITIONAL(USE_EAP_SIMAKA_SQL, test x$eap_simaka_sql = xtrue)
-AM_CONDITIONAL(USE_EAP_SIMAKA_PSEUDONYM, test x$eap_simaka_pseudonym = xtrue)
-AM_CONDITIONAL(USE_EAP_SIMAKA_REAUTH, test x$eap_simaka_reauth = xtrue)
-AM_CONDITIONAL(USE_EAP_IDENTITY, test x$eap_identity = xtrue)
-AM_CONDITIONAL(USE_EAP_MD5, test x$eap_md5 = xtrue)
-AM_CONDITIONAL(USE_EAP_GTC, test x$eap_gtc = xtrue)
-AM_CONDITIONAL(USE_EAP_AKA, test x$eap_aka = xtrue)
-AM_CONDITIONAL(USE_EAP_AKA_3GPP2, test x$eap_aka_3gpp2 = xtrue)
-AM_CONDITIONAL(USE_EAP_MSCHAPV2, test x$eap_mschapv2 = xtrue)
-AM_CONDITIONAL(USE_EAP_TLS, test x$eap_tls = xtrue)
-AM_CONDITIONAL(USE_EAP_TTLS, test x$eap_ttls = xtrue)
-AM_CONDITIONAL(USE_EAP_PEAP, test x$eap_peap = xtrue)
-AM_CONDITIONAL(USE_EAP_TNC, test x$eap_tnc = xtrue)
-AM_CONDITIONAL(USE_EAP_DYNAMIC, test x$eap_dynamic = xtrue)
-AM_CONDITIONAL(USE_EAP_RADIUS, test x$eap_radius = xtrue)
-AM_CONDITIONAL(USE_XAUTH_GENERIC, test x$xauth_generic = xtrue)
-AM_CONDITIONAL(USE_XAUTH_EAP, test x$xauth_eap = xtrue)
-AM_CONDITIONAL(USE_XAUTH_PAM, test x$xauth_pam = xtrue)
-AM_CONDITIONAL(USE_XAUTH_NOAUTH, test x$xauth_noauth = xtrue)
-AM_CONDITIONAL(USE_TNC_IFMAP, test x$tnc_ifmap = xtrue)
-AM_CONDITIONAL(USE_TNC_PDP, test x$tnc_pdp = xtrue)
-AM_CONDITIONAL(USE_TNC_IMC, test x$tnc_imc = xtrue)
-AM_CONDITIONAL(USE_TNC_IMV, test x$tnc_imv = xtrue)
-AM_CONDITIONAL(USE_TNC_TNCCS, test x$tnc_tnccs = xtrue)
-AM_CONDITIONAL(USE_TNCCS_11, test x$tnccs_11 = xtrue)
-AM_CONDITIONAL(USE_TNCCS_20, test x$tnccs_20 = xtrue)
-AM_CONDITIONAL(USE_TNCCS_DYNAMIC, test x$tnccs_dynamic = xtrue)
-AM_CONDITIONAL(USE_IMC_TEST, test x$imc_test = xtrue)
-AM_CONDITIONAL(USE_IMV_TEST, test x$imv_test = xtrue)
-AM_CONDITIONAL(USE_IMC_SCANNER, test x$imc_scanner = xtrue)
-AM_CONDITIONAL(USE_IMV_SCANNER, test x$imv_scanner = xtrue)
-AM_CONDITIONAL(USE_IMC_OS, test x$imc_os = xtrue)
-AM_CONDITIONAL(USE_IMV_OS, test x$imv_os = xtrue)
-AM_CONDITIONAL(USE_IMC_ATTESTATION, test x$imc_attestation = xtrue)
-AM_CONDITIONAL(USE_IMV_ATTESTATION, test x$imv_attestation = xtrue)
-AM_CONDITIONAL(USE_IMC_SWID, test x$imc_swid = xtrue)
-AM_CONDITIONAL(USE_IMV_SWID, test x$imv_swid = xtrue)
-AM_CONDITIONAL(USE_SOCKET_DEFAULT, test x$socket_default = xtrue)
-AM_CONDITIONAL(USE_SOCKET_DYNAMIC, test x$socket_dynamic = xtrue)
-AM_CONDITIONAL(USE_SOCKET_WIN, test x$socket_win = xtrue)
-AM_CONDITIONAL(USE_FARP, test x$farp = xtrue)
-AM_CONDITIONAL(USE_ADDRBLOCK, test x$addrblock = xtrue)
-AM_CONDITIONAL(USE_UNITY, test x$unity = xtrue)
 
 #  hydra plugins
 # ---------------
 AM_CONDITIONAL(USE_ATTR, test x$attr = xtrue)
-AM_CONDITIONAL(USE_ATTR_SQL, test x$attr_sql = xtrue)
 AM_CONDITIONAL(USE_KERNEL_NETLINK, test x$kernel_netlink = xtrue)
-AM_CONDITIONAL(USE_KERNEL_PFKEY, test x$kernel_pfkey = xtrue)
-AM_CONDITIONAL(USE_KERNEL_PFROUTE, test x$kernel_pfroute = xtrue)
+AM_CONDITIONAL(USE_KERNEL_LIBIPSEC, test x$kernel_libipsec = xtrue)
 AM_CONDITIONAL(USE_RESOLVE, test x$resolve = xtrue)
 
 #  other options
 # ---------------
 AM_CONDITIONAL(USE_LEAK_DETECTIVE, test x$leak_detective = xtrue)
 AM_CONDITIONAL(USE_LOCK_PROFILER, test x$lock_profiler = xtrue)
-AM_CONDITIONAL(USE_DUMM, test x$dumm = xtrue)
-AM_CONDITIONAL(USE_FAST, test x$fast = xtrue)
-AM_CONDITIONAL(USE_MANAGER, test x$manager = xtrue)
 AM_CONDITIONAL(USE_ME, test x$mediation = xtrue)
 AM_CONDITIONAL(USE_INTEGRITY_TEST, test x$integrity_test = xtrue)
 AM_CONDITIONAL(USE_LOAD_WARNING, test x$load_warning = xtrue)
 AM_CONDITIONAL(USE_IKEV1, test x$ikev1 = xtrue)
 AM_CONDITIONAL(USE_IKEV2, test x$ikev2 = xtrue)
 AM_CONDITIONAL(USE_THREADS, test x$threads = xtrue)
-AM_CONDITIONAL(USE_ADNS, test x$adns = xtrue)
 AM_CONDITIONAL(USE_CHARON, test x$charon = xtrue)
-AM_CONDITIONAL(USE_NM, test x$nm = xtrue)
-AM_CONDITIONAL(USE_PKI, test x$pki = xtrue)
-AM_CONDITIONAL(USE_SCEPCLIENT, test x$scepclient = xtrue)
 AM_CONDITIONAL(USE_SCRIPTS, test x$scripts = xtrue)
-AM_CONDITIONAL(USE_CONFTEST, test x$conftest = xtrue)
-AM_CONDITIONAL(USE_LIBSTRONGSWAN, test x$charon = xtrue -o x$pki = xtrue -o x$scepclient = xtrue -o x$conftest = xtrue -o x$fast = xtrue -o x$imcv = xtrue -o x$nm = xtrue -o x$tkm = xtrue -o x$cmd = xtrue -o x$tls = xtrue -o x$tnc_tnccs = xtrue -o x$aikgen = xtrue -o x$svc = xtrue)
-AM_CONDITIONAL(USE_LIBHYDRA, test x$charon = xtrue -o x$nm = xtrue -o x$tkm = xtrue -o x$cmd = xtrue -o x$svc = xtrue)
-AM_CONDITIONAL(USE_LIBCHARON, test x$charon = xtrue -o x$conftest = xtrue -o x$nm = xtrue -o x$tkm = xtrue -o x$cmd = xtrue -o x$svc = xtrue)
+AM_CONDITIONAL(USE_LIBSTRONGSWAN, test x$charon = xtrue)
+AM_CONDITIONAL(USE_LIBHYDRA, test x$charon = xtrue)
+AM_CONDITIONAL(USE_LIBCHARON, test x$charon = xtrue)
 AM_CONDITIONAL(USE_LIBIPSEC, test x$libipsec = xtrue)
-AM_CONDITIONAL(USE_LIBTNCIF, test x$tnc_tnccs = xtrue -o x$imcv = xtrue)
-AM_CONDITIONAL(USE_LIBTNCCS, test x$tnc_tnccs = xtrue)
-AM_CONDITIONAL(USE_LIBPTTLS, test x$tnc_tnccs = xtrue)
 AM_CONDITIONAL(USE_FILE_CONFIG, test x$stroke = xtrue)
-AM_CONDITIONAL(USE_IPSEC_SCRIPT, test x$stroke = xtrue -o x$scepclient = xtrue -o x$conftest = xtrue)
+AM_CONDITIONAL(USE_IPSEC_SCRIPT, test x$stroke = xtrue)
 AM_CONDITIONAL(USE_LIBCAP, test x$capabilities = xlibcap)
 AM_CONDITIONAL(USE_VSTR, test x$printf_hooks = xvstr)
 AM_CONDITIONAL(USE_BUILTIN_PRINTF, test x$printf_hooks = xbuiltin)
-AM_CONDITIONAL(USE_SIMAKA, test x$simaka = xtrue)
-AM_CONDITIONAL(USE_TLS, test x$tls = xtrue)
-AM_CONDITIONAL(USE_RADIUS, test x$radius = xtrue)
-AM_CONDITIONAL(USE_IMCV, test x$imcv = xtrue)
-AM_CONDITIONAL(USE_PTS, test x$pts = xtrue)
-AM_CONDITIONAL(USE_TROUSERS, test x$tss = xtrousers -o x$aikgen = xtrue)
 AM_CONDITIONAL(MONOLITHIC, test x$monolithic = xtrue)
 AM_CONDITIONAL(USE_SILENT_RULES, test x$enable_silent_rules = xyes)
 AM_CONDITIONAL(COVERAGE, test x$coverage = xtrue)
 AM_CONDITIONAL(USE_DBGHELP, test x$dbghelp_backtraces = xtrue)
-AM_CONDITIONAL(USE_TKM, test x$tkm = xtrue)
-AM_CONDITIONAL(USE_CMD, test x$cmd = xtrue)
-AM_CONDITIONAL(USE_AIKGEN, test x$aikgen = xtrue)
-AM_CONDITIONAL(USE_SWANCTL, test x$swanctl = xtrue)
-AM_CONDITIONAL(USE_SVC, test x$svc = xtrue)
 
 # ========================
 #  set global definitions
@@ -1519,19 +1007,8 @@ fi
 
 strongswan_options=
 
-AM_COND_IF([USE_AIKGEN], [strongswan_options=${strongswan_options}" aikgen"])
-AM_COND_IF([USE_ATTR_SQL], [strongswan_options=${strongswan_options}" pool"])
 AM_COND_IF([USE_CHARON], [strongswan_options=${strongswan_options}" charon charon-logging"])
 AM_COND_IF([USE_FILE_CONFIG], [strongswan_options=${strongswan_options}" starter"])
-AM_COND_IF([USE_IMV_ATTESTATION], [strongswan_options=${strongswan_options}" attest"])
-AM_COND_IF([USE_IMCV], [strongswan_options=${strongswan_options}" imcv"])
-AM_COND_IF([USE_IMV_OS], [strongswan_options=${strongswan_options}" pacman"])
-AM_COND_IF([USE_LIBTNCCS], [strongswan_options=${strongswan_options}" tnc"])
-AM_COND_IF([USE_MANAGER], [strongswan_options=${strongswan_options}" manager"])
-AM_COND_IF([USE_MEDSRV], [strongswan_options=${strongswan_options}" medsrv"])
-AM_COND_IF([USE_SCEPCLIENT], [strongswan_options=${strongswan_options}" scepclient"])
-AM_COND_IF([USE_PKI], [strongswan_options=${strongswan_options}" pki"])
-AM_COND_IF([USE_SWANCTL], [strongswan_options=${strongswan_options}" swanctl"])
 
 AC_SUBST(strongswan_options)
 
@@ -1549,176 +1026,39 @@ AC_CONFIG_FILES([
 	src/include/Makefile
 	src/libstrongswan/Makefile
 	src/libstrongswan/plugins/aes/Makefile
-	src/libstrongswan/plugins/cmac/Makefile
-	src/libstrongswan/plugins/des/Makefile
-	src/libstrongswan/plugins/blowfish/Makefile
-	src/libstrongswan/plugins/rc2/Makefile
-	src/libstrongswan/plugins/md4/Makefile
-	src/libstrongswan/plugins/md5/Makefile
+	src/libstrongswan/plugins/contactcrypto/Makefile
 	src/libstrongswan/plugins/sha1/Makefile
-	src/libstrongswan/plugins/sha2/Makefile
-	src/libstrongswan/plugins/fips_prf/Makefile
 	src/libstrongswan/plugins/gmp/Makefile
-	src/libstrongswan/plugins/rdrand/Makefile
 	src/libstrongswan/plugins/random/Makefile
 	src/libstrongswan/plugins/nonce/Makefile
 	src/libstrongswan/plugins/hmac/Makefile
-	src/libstrongswan/plugins/xcbc/Makefile
 	src/libstrongswan/plugins/x509/Makefile
 	src/libstrongswan/plugins/revocation/Makefile
 	src/libstrongswan/plugins/constraints/Makefile
-	src/libstrongswan/plugins/acert/Makefile
 	src/libstrongswan/plugins/pubkey/Makefile
-	src/libstrongswan/plugins/pkcs1/Makefile
-	src/libstrongswan/plugins/pkcs7/Makefile
-	src/libstrongswan/plugins/pkcs8/Makefile
-	src/libstrongswan/plugins/pkcs12/Makefile
-	src/libstrongswan/plugins/pgp/Makefile
-	src/libstrongswan/plugins/dnskey/Makefile
-	src/libstrongswan/plugins/sshkey/Makefile
 	src/libstrongswan/plugins/pem/Makefile
-	src/libstrongswan/plugins/curl/Makefile
-	src/libstrongswan/plugins/winhttp/Makefile
-	src/libstrongswan/plugins/unbound/Makefile
-	src/libstrongswan/plugins/soup/Makefile
-	src/libstrongswan/plugins/ldap/Makefile
-	src/libstrongswan/plugins/mysql/Makefile
-	src/libstrongswan/plugins/sqlite/Makefile
-	src/libstrongswan/plugins/padlock/Makefile
-	src/libstrongswan/plugins/openssl/Makefile
-	src/libstrongswan/plugins/gcrypt/Makefile
-	src/libstrongswan/plugins/agent/Makefile
-	src/libstrongswan/plugins/keychain/Makefile
-	src/libstrongswan/plugins/pkcs11/Makefile
-	src/libstrongswan/plugins/ctr/Makefile
-	src/libstrongswan/plugins/ccm/Makefile
-	src/libstrongswan/plugins/gcm/Makefile
-	src/libstrongswan/plugins/af_alg/Makefile
-	src/libstrongswan/plugins/ntru/Makefile
-	src/libstrongswan/plugins/test_vectors/Makefile
+	src/libstrongswan/plugins/usbbar/Makefile
 	src/libstrongswan/tests/Makefile
 	src/libhydra/Makefile
 	src/libhydra/plugins/attr/Makefile
-	src/libhydra/plugins/attr_sql/Makefile
 	src/libhydra/plugins/kernel_netlink/Makefile
-	src/libhydra/plugins/kernel_pfkey/Makefile
-	src/libhydra/plugins/kernel_pfroute/Makefile
 	src/libhydra/plugins/resolve/Makefile
 	src/libipsec/Makefile
-	src/libsimaka/Makefile
-	src/libtls/Makefile
-	src/libtls/tests/Makefile
-	src/libradius/Makefile
-	src/libtncif/Makefile
-	src/libtnccs/Makefile
-	src/libtnccs/plugins/tnc_tnccs/Makefile
-	src/libtnccs/plugins/tnc_imc/Makefile
-	src/libtnccs/plugins/tnc_imv/Makefile
-	src/libtnccs/plugins/tnccs_11/Makefile
-	src/libtnccs/plugins/tnccs_20/Makefile
-	src/libtnccs/plugins/tnccs_dynamic/Makefile
-	src/libpttls/Makefile
-	src/libpts/Makefile
-	src/libpts/plugins/imc_attestation/Makefile
-	src/libpts/plugins/imv_attestation/Makefile
-	src/libpts/plugins/imc_swid/Makefile
-	src/libpts/plugins/imv_swid/Makefile
-	src/libimcv/Makefile
-	src/libimcv/plugins/imc_test/Makefile
-	src/libimcv/plugins/imv_test/Makefile
-	src/libimcv/plugins/imc_scanner/Makefile
-	src/libimcv/plugins/imv_scanner/Makefile
-	src/libimcv/plugins/imc_os/Makefile
-	src/libimcv/plugins/imv_os/Makefile
 	src/charon/Makefile
-	src/charon-nm/Makefile
-	src/charon-tkm/Makefile
-	src/charon-cmd/Makefile
-	src/charon-svc/Makefile
 	src/libcharon/Makefile
-	src/libcharon/plugins/eap_aka/Makefile
-	src/libcharon/plugins/eap_aka_3gpp2/Makefile
-	src/libcharon/plugins/eap_dynamic/Makefile
-	src/libcharon/plugins/eap_identity/Makefile
-	src/libcharon/plugins/eap_md5/Makefile
-	src/libcharon/plugins/eap_gtc/Makefile
-	src/libcharon/plugins/eap_sim/Makefile
-	src/libcharon/plugins/eap_sim_file/Makefile
-	src/libcharon/plugins/eap_sim_pcsc/Makefile
-	src/libcharon/plugins/eap_simaka_sql/Makefile
-	src/libcharon/plugins/eap_simaka_pseudonym/Makefile
-	src/libcharon/plugins/eap_simaka_reauth/Makefile
-	src/libcharon/plugins/eap_mschapv2/Makefile
-	src/libcharon/plugins/eap_tls/Makefile
-	src/libcharon/plugins/eap_ttls/Makefile
-	src/libcharon/plugins/eap_peap/Makefile
-	src/libcharon/plugins/eap_tnc/Makefile
-	src/libcharon/plugins/eap_radius/Makefile
-	src/libcharon/plugins/xauth_generic/Makefile
-	src/libcharon/plugins/xauth_eap/Makefile
-	src/libcharon/plugins/xauth_pam/Makefile
-	src/libcharon/plugins/xauth_noauth/Makefile
-	src/libcharon/plugins/tnc_ifmap/Makefile
-	src/libcharon/plugins/tnc_pdp/Makefile
-	src/libcharon/plugins/socket_default/Makefile
-	src/libcharon/plugins/socket_dynamic/Makefile
-	src/libcharon/plugins/socket_win/Makefile
-	src/libcharon/plugins/farp/Makefile
-	src/libcharon/plugins/smp/Makefile
-	src/libcharon/plugins/sql/Makefile
-	src/libcharon/plugins/dnscert/Makefile
-	src/libcharon/plugins/ipseckey/Makefile
-	src/libcharon/plugins/medsrv/Makefile
-	src/libcharon/plugins/medcli/Makefile
-	src/libcharon/plugins/addrblock/Makefile
-	src/libcharon/plugins/unity/Makefile
-	src/libcharon/plugins/uci/Makefile
-	src/libcharon/plugins/ha/Makefile
+	src/libcharon/plugins/eap_bsts/Makefile
 	src/libcharon/plugins/kernel_libipsec/Makefile
-	src/libcharon/plugins/kernel_wfp/Makefile
-	src/libcharon/plugins/kernel_iph/Makefile
-	src/libcharon/plugins/whitelist/Makefile
-	src/libcharon/plugins/lookip/Makefile
-	src/libcharon/plugins/error_notify/Makefile
-	src/libcharon/plugins/certexpire/Makefile
-	src/libcharon/plugins/systime_fix/Makefile
-	src/libcharon/plugins/led/Makefile
-	src/libcharon/plugins/duplicheck/Makefile
-	src/libcharon/plugins/coupling/Makefile
-	src/libcharon/plugins/radattr/Makefile
-	src/libcharon/plugins/osx_attr/Makefile
-	src/libcharon/plugins/android_dns/Makefile
-	src/libcharon/plugins/android_log/Makefile
-	src/libcharon/plugins/maemo/Makefile
+	src/libcharon/plugins/socket_default/Makefile
 	src/libcharon/plugins/stroke/Makefile
-	src/libcharon/plugins/vici/Makefile
 	src/libcharon/plugins/updown/Makefile
 	src/libcharon/plugins/dhcp/Makefile
-	src/libcharon/plugins/unit_tester/Makefile
-	src/libcharon/plugins/load_tester/Makefile
 	src/stroke/Makefile
 	src/ipsec/Makefile
 	src/starter/Makefile
 	src/starter/tests/Makefile
 	src/_updown/Makefile
 	src/_updown_espmark/Makefile
-	src/_copyright/Makefile
-	src/scepclient/Makefile
-	src/aikgen/Makefile
-	src/pki/Makefile
-	src/pki/man/Makefile
-	src/pool/Makefile
-	src/dumm/Makefile
-	src/dumm/ext/extconf.rb
-	src/libfast/Makefile
-	src/manager/Makefile
-	src/medsrv/Makefile
-	src/checksum/Makefile
-	src/conftest/Makefile
-	src/pt-tls-client/Makefile
-	src/swanctl/Makefile
 	scripts/Makefile
-	testing/Makefile
 ])
 
 # =================
@@ -1730,22 +1070,6 @@ AC_CONFIG_FILES([
 	conf/strongswan.conf.5.tail
 	man/ipsec.conf.5
 	man/ipsec.secrets.5
-	src/charon-cmd/charon-cmd.8
-	src/pki/man/pki.1
-	src/pki/man/pki---gen.1
-	src/pki/man/pki---issue.1
-	src/pki/man/pki---keyid.1
-	src/pki/man/pki---pkcs7.1
-	src/pki/man/pki---print.1
-	src/pki/man/pki---pub.1
-	src/pki/man/pki---req.1
-	src/pki/man/pki---self.1
-	src/pki/man/pki---signcrl.1
-	src/pki/man/pki---acert.1
-	src/pki/man/pki---verify.1
-	src/swanctl/swanctl.8
-	src/swanctl/swanctl.conf.5.head
-	src/swanctl/swanctl.conf.5.tail
 ])
 
 AC_OUTPUT
@@ -1755,11 +1079,9 @@ AC_OUTPUT
 # ========================
 
 AC_MSG_RESULT([])
-AC_MSG_RESULT([ strongSwan will be built with the following plugins])
+AC_MSG_RESULT([ strongSwanCont will be built with the following plugins])
 AC_MSG_RESULT([-----------------------------------------------------])
 
 AC_MSG_RESULT([libstrongswan:$s_plugins])
 AC_MSG_RESULT([libcharon:    $c_plugins])
 AC_MSG_RESULT([libhydra:     $h_plugins])
-AC_MSG_RESULT([libtnccs:     $t_plugins])
-AC_MSG_RESULT([])
diff --git a/strongswan-5.2.0/src/Makefile.am b/strongswan-5.2.0/src/Makefile.am
index 95c68d0..b4c03a2 100644
--- a/strongswan-5.2.0/src/Makefile.am
+++ b/strongswan-5.2.0/src/Makefile.am
@@ -12,38 +12,6 @@ if USE_LIBIPSEC
   SUBDIRS += libipsec
 endif
 
-if USE_SIMAKA
-  SUBDIRS += libsimaka
-endif
-
-if USE_TLS
-  SUBDIRS += libtls
-endif
-
-if USE_RADIUS
-  SUBDIRS += libradius
-endif
-
-if USE_LIBTNCIF
-  SUBDIRS += libtncif
-endif
-
-if USE_LIBTNCCS
-  SUBDIRS += libtnccs
-endif
-
-if USE_LIBPTTLS
-  SUBDIRS += libpttls
-endif
-
-if USE_IMCV
-  SUBDIRS += libimcv
-endif
-
-if USE_PTS
-  SUBDIRS += libpts
-endif
-
 if USE_LIBCHARON
   SUBDIRS += libcharon
 endif
@@ -53,85 +21,17 @@ if USE_FILE_CONFIG
 endif
 
 if USE_IPSEC_SCRIPT
-  SUBDIRS += ipsec _copyright
+  SUBDIRS += ipsec 
 endif
 
 if USE_CHARON
   SUBDIRS += charon
 endif
 
-if USE_NM
-  SUBDIRS += charon-nm
-endif
-
 if USE_STROKE
   SUBDIRS += stroke
 endif
 
 if USE_UPDOWN
   SUBDIRS += _updown _updown_espmark
-endif
-
-if USE_SCEPCLIENT
-  SUBDIRS += scepclient
-endif
-
-if USE_PKI
-  SUBDIRS += pki
-endif
-
-if USE_SWANCTL
-  SUBDIRS += swanctl
-endif
-
-if USE_CONFTEST
-  SUBDIRS += conftest
-endif
-
-if USE_DUMM
-  SUBDIRS += dumm
-endif
-
-if USE_FAST
-  SUBDIRS += libfast
-endif
-
-if USE_MANAGER
-  SUBDIRS += manager
-endif
-
-if USE_MEDSRV
-  SUBDIRS += medsrv
-endif
-
-if USE_ATTR_SQL
-  SUBDIRS += pool
-else
-if USE_SQL
-  SUBDIRS += pool
-endif
-endif
-
-if USE_TKM
-  SUBDIRS += charon-tkm
-endif
-
-if USE_CMD
-  SUBDIRS += charon-cmd
-endif
-
-if USE_SVC
-  SUBDIRS += charon-svc
-endif
-
-if USE_LIBPTTLS
-  SUBDIRS += pt-tls-client
-endif
-
-if USE_INTEGRITY_TEST
-  SUBDIRS += checksum
-endif
-
-if USE_AIKGEN
-  SUBDIRS += aikgen
-endif
+endif
\ No newline at end of file
diff --git a/strongswan-5.2.0/src/include/linux/pfkeyv2.h b/strongswan-5.2.0/src/include/linux/pfkeyv2.h
index 7379d1a..01da2f7 100644
--- a/strongswan-5.2.0/src/include/linux/pfkeyv2.h
+++ b/strongswan-5.2.0/src/include/linux/pfkeyv2.h
@@ -3,6 +3,28 @@
  * file will not be compliant.
  */
 
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
+
 #ifndef _LINUX_PFKEY2_H
 #define _LINUX_PFKEY2_H
 
@@ -296,6 +318,10 @@ struct sadb_x_kmaddress {
 #define SADB_X_AALG_SHA2_512HMAC	7
 #define SADB_X_AALG_RIPEMD160HMAC	8
 #define SADB_X_AALG_AES_XCBC_MAC	9
+#define SADB_X_AALG_BELT_HASH		10
+#define SADB_X_AALG_GOST_MAC		11
+#define SADB_X_AALG_BELT_MAC		12
+#define SADB_X_AALG_BELT_HMAC		13
 #define SADB_X_AALG_NULL		251	/* kame */
 #define SADB_AALG_MAX			251
 
@@ -304,7 +330,7 @@ struct sadb_x_kmaddress {
 #define SADB_EALG_DESCBC		2
 #define SADB_EALG_3DESCBC		3
 #define SADB_X_EALG_CASTCBC		6
-#define SADB_X_EALG_BLOWFISHCBC		7
+#define SADB_X_EALG_BLOWFISHCBC	7
 #define SADB_EALG_NULL			11
 #define SADB_X_EALG_AESCBC		12
 #define SADB_X_EALG_AESCTR		13
@@ -316,6 +342,13 @@ struct sadb_x_kmaddress {
 #define SADB_X_EALG_AES_GCM_ICV16	20
 #define SADB_X_EALG_CAMELLIACBC		22
 #define SADB_X_EALG_NULL_AES_GMAC	23
+#define SADB_X_EALG_GOST28147_ECB	24
+#define SADB_X_EALG_GOST28147_CTR	25
+#define SADB_X_EALG_GOST28147_CFB	26 
+#define SADB_X_EALG_BELT_ECB		27 
+#define SADB_X_EALG_BELT_CBC		28 
+#define SADB_X_EALG_BELT_CFB		29 
+#define SADB_X_EALG_BELT_CTR		30 
 #define SADB_EALG_MAX                   253 /* last EALG */
 /* private allocations should use 249-255 (RFC2407) */
 #define SADB_X_EALG_SERPENTCBC  252     /* draft-ietf-ipsec-ciph-aes-cbc-00 */
diff --git a/strongswan-5.2.0/src/libcharon/Makefile.am b/strongswan-5.2.0/src/libcharon/Makefile.am
index e81c424..564dba5 100644
--- a/strongswan-5.2.0/src/libcharon/Makefile.am
+++ b/strongswan-5.2.0/src/libcharon/Makefile.am
@@ -151,8 +151,6 @@ if USE_WINDOWS
   libcharon_la_LIBADD += -lws2_32
 endif
 
-EXTRA_DIST = Android.mk
-
 # compile options
 #################
 
@@ -174,10 +172,10 @@ else
 SUBDIRS = .
 endif
 
-if USE_LOAD_TESTER
-  SUBDIRS += plugins/load_tester
+if USE_DHCP
+  SUBDIRS += plugins/dhcp
 if MONOLITHIC
-  libcharon_la_LIBADD += plugins/load_tester/libstrongswan-load-tester.la
+  libcharon_la_LIBADD += plugins/dhcp/libstrongswan-dhcp.la
 endif
 endif
 
@@ -188,27 +186,6 @@ if MONOLITHIC
 endif
 endif
 
-if USE_SOCKET_DYNAMIC
-  SUBDIRS += plugins/socket_dynamic
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/socket_dynamic/libstrongswan-socket-dynamic.la
-endif
-endif
-
-if USE_SOCKET_WIN
-  SUBDIRS += plugins/socket_win
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/socket_win/libstrongswan-socket-win.la
-endif
-endif
-
-if USE_FARP
-  SUBDIRS += plugins/farp
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/farp/libstrongswan-farp.la
-endif
-endif
-
 if USE_STROKE
   SUBDIRS += plugins/stroke
 if MONOLITHIC
@@ -216,38 +193,17 @@ if MONOLITHIC
 endif
 endif
 
-if USE_VICI
-  SUBDIRS += plugins/vici
+if USE_EAP_BSTS
+  SUBDIRS += plugins/eap_bsts
 if MONOLITHIC
-  libcharon_la_LIBADD += plugins/vici/libstrongswan-vici.la
+  libcharon_la_LIBADD += plugins/eap_bsts/libstrongswan-eap-bsts.la
 endif
 endif
 
-if USE_SMP
-  SUBDIRS += plugins/smp
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/smp/libstrongswan-smp.la
-endif
-endif
-
-if USE_SQL
-  SUBDIRS += plugins/sql
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/sql/libstrongswan-sql.la
-endif
-endif
-
-if USE_DNSCERT
-  SUBDIRS += plugins/dnscert
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/dnscert/libstrongswan-dnscert.la
-endif
-endif
-
-if USE_IPSECKEY
-  SUBDIRS += plugins/ipseckey
+if USE_KERNEL_LIBIPSEC
+  SUBDIRS += plugins/kernel_libipsec
 if MONOLITHIC
-  libcharon_la_LIBADD += plugins/ipseckey/libstrongswan-ipseckey.la
+  libcharon_la_LIBADD += plugins/kernel_libipsec/libstrongswan-kernel_libipsec.la
 endif
 endif
 
@@ -256,368 +212,4 @@ if USE_UPDOWN
 if MONOLITHIC
   libcharon_la_LIBADD += plugins/updown/libstrongswan-updown.la
 endif
-endif
-
-if USE_EAP_IDENTITY
-  SUBDIRS += plugins/eap_identity
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/eap_identity/libstrongswan-eap-identity.la
-endif
-endif
-
-if USE_EAP_SIM
-  SUBDIRS += plugins/eap_sim
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/eap_sim/libstrongswan-eap-sim.la
-endif
-endif
-
-if USE_EAP_SIM_FILE
-  SUBDIRS += plugins/eap_sim_file
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/eap_sim_file/libstrongswan-eap-sim-file.la
-endif
-endif
-
-if USE_EAP_SIM_PCSC
-  SUBDIRS += plugins/eap_sim_pcsc
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/eap_sim_pcsc/libstrongswan-eap-sim-pcsc.la
-endif
-endif
-
-if USE_EAP_SIMAKA_SQL
-  SUBDIRS += plugins/eap_simaka_sql
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/eap_simaka_sql/libstrongswan-eap-simaka-sql.la
-endif
-endif
-
-if USE_EAP_SIMAKA_PSEUDONYM
-  SUBDIRS += plugins/eap_simaka_pseudonym
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/eap_simaka_pseudonym/libstrongswan-eap-simaka-pseudonym.la
-endif
-endif
-
-if USE_EAP_SIMAKA_REAUTH
-  SUBDIRS += plugins/eap_simaka_reauth
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/eap_simaka_reauth/libstrongswan-eap-simaka-reauth.la
-endif
-endif
-
-if USE_EAP_AKA
-  SUBDIRS += plugins/eap_aka
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/eap_aka/libstrongswan-eap-aka.la
-endif
-endif
-
-if USE_EAP_AKA_3GPP2
-  SUBDIRS += plugins/eap_aka_3gpp2
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/eap_aka_3gpp2/libstrongswan-eap-aka-3gpp2.la
-endif
-endif
-
-if USE_SIMAKA
-if MONOLITHIC
-  # otherwise this library is linked to both the eap_aka and the eap_sim plugin
-  libcharon_la_LIBADD += $(top_builddir)/src/libsimaka/libsimaka.la
-endif
-endif
-
-if USE_EAP_MD5
-  SUBDIRS += plugins/eap_md5
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/eap_md5/libstrongswan-eap-md5.la
-endif
-endif
-
-if USE_EAP_GTC
-  SUBDIRS += plugins/eap_gtc
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/eap_gtc/libstrongswan-eap-gtc.la
-endif
-endif
-
-if USE_EAP_MSCHAPV2
-  SUBDIRS += plugins/eap_mschapv2
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/eap_mschapv2/libstrongswan-eap-mschapv2.la
-endif
-endif
-
-if USE_EAP_DYNAMIC
-  SUBDIRS += plugins/eap_dynamic
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/eap_dynamic/libstrongswan-eap-dynamic.la
-endif
-endif
-
-if USE_EAP_RADIUS
-  SUBDIRS += plugins/eap_radius
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/eap_radius/libstrongswan-eap-radius.la
-endif
-endif
-
-if USE_EAP_TLS
-  SUBDIRS += plugins/eap_tls
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/eap_tls/libstrongswan-eap-tls.la
-endif
-endif
-
-if USE_EAP_TTLS
-  SUBDIRS += plugins/eap_ttls
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/eap_ttls/libstrongswan-eap-ttls.la
-endif
-endif
-
-if USE_EAP_PEAP
-  SUBDIRS += plugins/eap_peap
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/eap_peap/libstrongswan-eap-peap.la
-endif
-endif
-
-if USE_EAP_TNC
-  SUBDIRS += plugins/eap_tnc
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/eap_tnc/libstrongswan-eap-tnc.la
-endif
-endif
-
-if USE_TLS
-if MONOLITHIC
-  # otherwise this library is linked to eap_tls
-  libcharon_la_LIBADD += $(top_builddir)/src/libtls/libtls.la
-endif
-endif
-
-if USE_RADIUS
-if MONOLITHIC
-  # otherwise this library is linked to eap_radius
-  libcharon_la_LIBADD += $(top_builddir)/src/libradius/libradius.la
-endif
-endif
-
-if USE_TNC_IFMAP
-  SUBDIRS += plugins/tnc_ifmap
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/tnc_ifmap/libstrongswan-tnc-ifmap.la
-endif
-endif
-
-if USE_TNC_PDP
-  SUBDIRS += plugins/tnc_pdp
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/tnc_pdp/libstrongswan-tnc-pdp.la
-endif
-endif
-
-if USE_LIBTNCCS
-if MONOLITHIC
-  # otherwise this library is linked to the respective plugins
-  libcharon_la_LIBADD += $(top_builddir)/src/libtnccs/libtnccs.la
-endif
-endif
-
-if USE_MEDSRV
-  SUBDIRS += plugins/medsrv
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/medsrv/libstrongswan-medsrv.la
-endif
-endif
-
-if USE_MEDCLI
-  SUBDIRS += plugins/medcli
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/medcli/libstrongswan-medcli.la
-endif
-endif
-
-if USE_DHCP
-  SUBDIRS += plugins/dhcp
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/dhcp/libstrongswan-dhcp.la
-endif
-endif
-
-if USE_OSX_ATTR
-  SUBDIRS += plugins/osx_attr
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/osx_attr/libstrongswan-osx-attr.la
-endif
-endif
-
-if USE_ANDROID_DNS
-  SUBDIRS += plugins/android_dns
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/android_dns/libstrongswan-android-dns.la
-endif
-endif
-
-if USE_ANDROID_LOG
-  SUBDIRS += plugins/android_log
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/android_log/libstrongswan-android-log.la
-endif
-endif
-
-if USE_MAEMO
-  SUBDIRS += plugins/maemo
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/maemo/libstrongswan-maemo.la
-endif
-endif
-
-if USE_HA
-  SUBDIRS += plugins/ha
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/ha/libstrongswan-ha.la
-endif
-endif
-
-if USE_KERNEL_LIBIPSEC
-  SUBDIRS += plugins/kernel_libipsec
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/kernel_libipsec/libstrongswan-kernel-libipsec.la
-endif
-endif
-
-if USE_KERNEL_WFP
-  SUBDIRS += plugins/kernel_wfp
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/kernel_wfp/libstrongswan-kernel-wfp.la
-endif
-endif
-
-if USE_KERNEL_IPH
-  SUBDIRS += plugins/kernel_iph
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/kernel_iph/libstrongswan-kernel-iph.la
-endif
-endif
-
-if USE_WHITELIST
-  SUBDIRS += plugins/whitelist
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/whitelist/libstrongswan-whitelist.la
-endif
-endif
-
-if USE_LOOKIP
-  SUBDIRS += plugins/lookip
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/lookip/libstrongswan-lookip.la
-endif
-endif
-
-if USE_ERROR_NOTIFY
-  SUBDIRS += plugins/error_notify
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/error_notify/libstrongswan-error-notify.la
-endif
-endif
-
-if USE_CERTEXPIRE
-  SUBDIRS += plugins/certexpire
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/certexpire/libstrongswan-certexpire.la
-endif
-endif
-
-if USE_SYSTIME_FIX
-  SUBDIRS += plugins/systime_fix
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/systime_fix/libstrongswan-systime-fix.la
-endif
-endif
-
-if USE_LED
-  SUBDIRS += plugins/led
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/led/libstrongswan-led.la
-endif
-endif
-
-if USE_DUPLICHECK
-  SUBDIRS += plugins/duplicheck
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/duplicheck/libstrongswan-duplicheck.la
-endif
-endif
-
-if USE_COUPLING
-  SUBDIRS += plugins/coupling
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/coupling/libstrongswan-coupling.la
-endif
-endif
-
-if USE_RADATTR
-  SUBDIRS += plugins/radattr
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/radattr/libstrongswan-radattr.la
-endif
-endif
-
-if USE_UCI
-  SUBDIRS += plugins/uci
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/uci/libstrongswan-uci.la
-endif
-endif
-
-if USE_ADDRBLOCK
-  SUBDIRS += plugins/addrblock
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/addrblock/libstrongswan-addrblock.la
-endif
-endif
-
-if USE_UNITY
-  SUBDIRS += plugins/unity
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/unity/libstrongswan-unity.la
-endif
-endif
-
-if USE_UNIT_TESTS
-  SUBDIRS += plugins/unit_tester
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/unit_tester/libstrongswan-unit-tester.la
-endif
-endif
-
-if USE_XAUTH_GENERIC
-  SUBDIRS += plugins/xauth_generic
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/xauth_generic/libstrongswan-xauth-generic.la
-endif
-endif
-
-if USE_XAUTH_EAP
-  SUBDIRS += plugins/xauth_eap
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/xauth_eap/libstrongswan-xauth-eap.la
-endif
-endif
-
-if USE_XAUTH_PAM
-  SUBDIRS += plugins/xauth_pam
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/xauth_pam/libstrongswan-xauth-pam.la
-endif
-endif
-
-if USE_XAUTH_NOAUTH
-  SUBDIRS += plugins/xauth_noauth
-if MONOLITHIC
-  libcharon_la_LIBADD += plugins/xauth_noauth/libstrongswan-xauth-noauth.la
-endif
-endif
+endif
\ No newline at end of file
diff --git a/strongswan-5.2.0/src/libcharon/config/proposal.c b/strongswan-5.2.0/src/libcharon/config/proposal.c
index 4d881cd..94e4e1b 100644
--- a/strongswan-5.2.0/src/libcharon/config/proposal.c
+++ b/strongswan-5.2.0/src/libcharon/config/proposal.c
@@ -14,6 +14,28 @@
  * for more details.
  */
 
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
 #include <string.h>
 
 #include "proposal.h"
@@ -26,6 +48,7 @@
 #include <crypto/prfs/prf.h>
 #include <crypto/crypters/crypter.h>
 #include <crypto/signers/signer.h>
+#include <crypto/key_transformer.h>
 
 ENUM(protocol_id_names, PROTO_NONE, PROTO_IPCOMP,
 	"PROTO_NONE",
@@ -280,7 +303,8 @@ METHOD(proposal_t, select_proposal, proposal_t*,
 		!select_algo(this, other, selected, PSEUDO_RANDOM_FUNCTION, private) ||
 		!select_algo(this, other, selected, INTEGRITY_ALGORITHM, private) ||
 		!select_algo(this, other, selected, DIFFIE_HELLMAN_GROUP, private) ||
-		!select_algo(this, other, selected, EXTENDED_SEQUENCE_NUMBERS, private))
+		!select_algo(this, other, selected, EXTENDED_SEQUENCE_NUMBERS, private) ||
+		!select_algo(this, other, selected, KEY_TRANSFORM_ALGORITHM, private))
 	{
 		selected->destroy(selected);
 		return NULL;
@@ -366,7 +390,8 @@ METHOD(proposal_t, equals, bool,
 		algo_list_equals(this, other, INTEGRITY_ALGORITHM) &&
 		algo_list_equals(this, other, PSEUDO_RANDOM_FUNCTION) &&
 		algo_list_equals(this, other, DIFFIE_HELLMAN_GROUP) &&
-		algo_list_equals(this, other, EXTENDED_SEQUENCE_NUMBERS));
+		algo_list_equals(this, other, EXTENDED_SEQUENCE_NUMBERS) &&
+		algo_list_equals(this, other, KEY_TRANSFORM_ALGORITHM));
 }
 
 METHOD(proposal_t, clone_, proposal_t*,
@@ -402,7 +427,7 @@ static const struct {
 	{AUTH_HMAC_SHA2_256_128,			PRF_HMAC_SHA2_256				},
 	{AUTH_HMAC_SHA2_384_192,			PRF_HMAC_SHA2_384				},
 	{AUTH_HMAC_SHA2_512_256,			PRF_HMAC_SHA2_512				},
-	{AUTH_HMAC_MD5_96,					PRF_HMAC_MD5					},
+	{AUTH_HMAC_MD5_96,					PRF_HMAC_MD5		 			},
 	{AUTH_AES_XCBC_96,					PRF_AES128_XCBC					},
 	{AUTH_CAMELLIA_XCBC_96,				PRF_CAMELLIA128_XCBC			},
 	{AUTH_AES_CMAC_96,					PRF_AES128_CMAC					},
@@ -583,6 +608,8 @@ int proposal_printf_hook(printf_hook_data_t *data, printf_hook_spec_t *spec,
 						 diffie_hellman_group_names, &first);
 	written += print_alg(this, data, EXTENDED_SEQUENCE_NUMBERS,
 						 extended_sequence_numbers_names, &first);
+	written += print_alg(this, data, KEY_TRANSFORM_ALGORITHM,
+						 key_transform_algorithm_names, &first);
 	return written;
 }
 
@@ -634,6 +661,7 @@ static bool proposal_add_supported_ike(private_proposal_t *this, bool aead)
 	integrity_algorithm_t integrity;
 	pseudo_random_function_t prf;
 	diffie_hellman_group_t group;
+	key_transform_alorithm_t tfmer;
 	const char *plugin_name;
 
 	if (aead)
@@ -670,6 +698,24 @@ static bool proposal_add_supported_ike(private_proposal_t *this, bool aead)
 	}
 	else
 	{
+		/* first round, appending BY algos */
+		enumerator = lib->crypto->create_crypter_enumerator(lib->crypto);
+		while (enumerator->enumerate(enumerator, &encryption, &plugin_name))
+		{
+			switch (encryption)
+			{
+				case ENCR_BELT_CBC:
+				case ENCR_BELT_CFB:
+				case ENCR_BELT_CTR:
+					add_algorithm(this, ENCRYPTION_ALGORITHM, encryption, 256);
+					break;
+				default:
+					break;
+			}
+		}
+		enumerator->destroy(enumerator);
+
+		/* second round, appending others */
 		enumerator = lib->crypto->create_crypter_enumerator(lib->crypto);
 		while (enumerator->enumerate(enumerator, &encryption, &plugin_name))
 		{
@@ -690,6 +736,10 @@ static bool proposal_add_supported_ike(private_proposal_t *this, bool aead)
 				case ENCR_DES:
 					/* no, thanks */
 					break;
+				case ENCR_GOST28147_CFB:
+				case ENCR_GOST28147_CTR:
+					add_algorithm(this, ENCRYPTION_ALGORITHM, encryption, 256);
+					break;
 				default:
 					break;
 			}
@@ -701,6 +751,23 @@ static bool proposal_add_supported_ike(private_proposal_t *this, bool aead)
 			return FALSE;
 		}
 
+		/* first round, appending BY algos */
+		enumerator = lib->crypto->create_signer_enumerator(lib->crypto);
+		while (enumerator->enumerate(enumerator, &integrity, &plugin_name))
+		{
+			switch (integrity)
+			{
+				case AUTH_BELT_HMAC:
+				case AUTH_BELT_MAC:
+					add_algorithm(this, INTEGRITY_ALGORITHM, integrity, 0);
+					break;
+				default:
+					break;
+			}
+		}
+		enumerator->destroy(enumerator);
+
+		/* second round, appending others */
 		enumerator = lib->crypto->create_signer_enumerator(lib->crypto);
 		while (enumerator->enumerate(enumerator, &integrity, &plugin_name))
 		{
@@ -715,6 +782,10 @@ static bool proposal_add_supported_ike(private_proposal_t *this, bool aead)
 				case AUTH_AES_CMAC_96:
 					add_algorithm(this, INTEGRITY_ALGORITHM, integrity, 0);
 					break;
+				case AUTH_BELT_HASH:
+				case AUTH_GOST_MAC:
+					add_algorithm(this, INTEGRITY_ALGORITHM, integrity, 0);
+					break;
 				default:
 					break;
 			}
@@ -734,6 +805,8 @@ static bool proposal_add_supported_ike(private_proposal_t *this, bool aead)
 			case PRF_HMAC_MD5:
 			case PRF_AES128_XCBC:
 			case PRF_AES128_CMAC:
+			case PRF_BRNG_CTR_HBELT:
+			case PRF_BRNG_HMAC_HBELT:
 				add_algorithm(this, PSEUDO_RANDOM_FUNCTION, prf, 0);
 				break;
 			default:
@@ -771,6 +844,7 @@ static bool proposal_add_supported_ike(private_proposal_t *this, bool aead)
 			case ECP_256_BP:
 			case ECP_384_BP:
 			case ECP_512_BP:
+			case ECP_256_BIGN:
 			case NTRU_112_BIT:
 			case NTRU_128_BIT:
 			case NTRU_192_BIT:
@@ -783,6 +857,20 @@ static bool proposal_add_supported_ike(private_proposal_t *this, bool aead)
 	}
 	enumerator->destroy(enumerator);
 
+	enumerator = lib->crypto->create_key_transformer_enumerator(lib->crypto);
+	while (enumerator->enumerate(enumerator, &tfmer, &plugin_name))
+	{
+		switch (tfmer)
+		{
+			case BELT_KEYREP_TRANSFORM:
+				add_algorithm(this, KEY_TRANSFORM_ALGORITHM, tfmer, 0);
+				break;
+			default:
+				break;
+		}
+	}
+	enumerator->destroy(enumerator);
+
 	return TRUE;
 }
 
@@ -803,17 +891,30 @@ proposal_t *proposal_create_default(protocol_id_t protocol)
 			}
 			break;
 		case PROTO_ESP:
+			add_algorithm(this, ENCRYPTION_ALGORITHM,   ENCR_BELT_CBC,   	  256);
+			add_algorithm(this, ENCRYPTION_ALGORITHM,   ENCR_BELT_CFB,   	  256);
+			add_algorithm(this, ENCRYPTION_ALGORITHM,   ENCR_BELT_CTR,   	  256);
+			add_algorithm(this, ENCRYPTION_ALGORITHM,   ENCR_GOST28147_CFB,   256);
+			add_algorithm(this, ENCRYPTION_ALGORITHM,   ENCR_GOST28147_CTR,   256);
 			add_algorithm(this, ENCRYPTION_ALGORITHM,   ENCR_AES_CBC,         128);
 			add_algorithm(this, ENCRYPTION_ALGORITHM,   ENCR_AES_CBC,         192);
 			add_algorithm(this, ENCRYPTION_ALGORITHM,   ENCR_AES_CBC,         256);
 			add_algorithm(this, ENCRYPTION_ALGORITHM,   ENCR_3DES,              0);
 			add_algorithm(this, ENCRYPTION_ALGORITHM,   ENCR_BLOWFISH,        256);
+			add_algorithm(this, INTEGRITY_ALGORITHM,    AUTH_BELT_MAC,          0);
+			add_algorithm(this, INTEGRITY_ALGORITHM,    AUTH_BELT_HMAC,         0);
+			add_algorithm(this, INTEGRITY_ALGORITHM,    AUTH_GOST_MAC,          0);
+			add_algorithm(this, INTEGRITY_ALGORITHM,    AUTH_BELT_HASH,         0);
 			add_algorithm(this, INTEGRITY_ALGORITHM,    AUTH_HMAC_SHA1_96,      0);
 			add_algorithm(this, INTEGRITY_ALGORITHM,    AUTH_AES_XCBC_96,       0);
 			add_algorithm(this, INTEGRITY_ALGORITHM,    AUTH_HMAC_MD5_96,       0);
 			add_algorithm(this, EXTENDED_SEQUENCE_NUMBERS, NO_EXT_SEQ_NUMBERS,  0);
 			break;
 		case PROTO_AH:
+			add_algorithm(this, INTEGRITY_ALGORITHM,    AUTH_BELT_MAC,    		0);
+			add_algorithm(this, INTEGRITY_ALGORITHM,    AUTH_BELT_HMAC,    		0);
+			add_algorithm(this, INTEGRITY_ALGORITHM,    AUTH_GOST_MAC,    		0);
+			add_algorithm(this, INTEGRITY_ALGORITHM,    AUTH_BELT_HASH,    		0);
 			add_algorithm(this, INTEGRITY_ALGORITHM,    AUTH_HMAC_SHA1_96,      0);
 			add_algorithm(this, INTEGRITY_ALGORITHM,    AUTH_AES_XCBC_96,       0);
 			add_algorithm(this, INTEGRITY_ALGORITHM,    AUTH_HMAC_MD5_96,       0);
diff --git a/strongswan-5.2.0/src/libcharon/encoding/payloads/certreq_payload.c b/strongswan-5.2.0/src/libcharon/encoding/payloads/certreq_payload.c
index 6ac90a2..4b7acac 100644
--- a/strongswan-5.2.0/src/libcharon/encoding/payloads/certreq_payload.c
+++ b/strongswan-5.2.0/src/libcharon/encoding/payloads/certreq_payload.c
@@ -13,7 +13,29 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
- */
+ */ 
+
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 #include <stddef.h>
 
@@ -116,9 +138,9 @@ METHOD(payload_t, verify, status_t,
 	{
 		if (this->data.len % HASH_SIZE_SHA1)
 		{
-			DBG1(DBG_ENC, "invalid X509 hash length (%d) in certreq",
+			DBG1(DBG_ENC, "unknown X509 hash length (%d) in certreq",
 				 this->data.len);
-			return FAILED;
+			return SUCCESS;
 		}
 	}
 	return SUCCESS;
@@ -208,6 +230,7 @@ METHOD(enumerator_t, keyid_enumerate, bool,
 	{
 		chunk->ptr = this->pos;
 		chunk->len = HASH_SIZE_SHA1;
+
 		return TRUE;
 	}
 	return FALSE;
diff --git a/strongswan-5.2.0/src/libcharon/encoding/payloads/proposal_substructure.c b/strongswan-5.2.0/src/libcharon/encoding/payloads/proposal_substructure.c
index 53e8cf3..c191e73 100644
--- a/strongswan-5.2.0/src/libcharon/encoding/payloads/proposal_substructure.c
+++ b/strongswan-5.2.0/src/libcharon/encoding/payloads/proposal_substructure.c
@@ -13,7 +13,29 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
- */
+ */ 
+
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 #include <stddef.h>
 
@@ -171,6 +193,11 @@ typedef enum {
 	IKEV1_ENCR_CAST_CBC = 6,
 	IKEV1_ENCR_AES_CBC = 7,
 	IKEV1_ENCR_CAMELLIA_CBC = 8,
+	IKEV1_ENCR_GOST28147_CTR = 9,
+	IKEV1_ENCR_GOST28147_CFB = 10,
+	IKEV1_ENCR_BELT_CBC = 11,
+	IKEV1_ENCR_BELT_CFB = 12,
+	IKEV1_ENCR_BELT_CTR = 13,
 	/* FreeS/WAN proprietary */
 	IKEV1_ENCR_SERPENT_CBC = 65004,
 	IKEV1_ENCR_TWOFISH_CBC = 65005,
@@ -186,6 +213,10 @@ typedef enum {
 	IKEV1_HASH_SHA2_256 = 4,
 	IKEV1_HASH_SHA2_384 = 5,
 	IKEV1_HASH_SHA2_512 = 6,
+	IKEV1_BELT_HASH = 7,
+	IKEV1_GOST_MAC = 8,
+	IKEV1_BELT_MAC = 9,
+	IKEV1_BELT_HMAC = 10,
 } ikev1_hash_t;
 
 /**
@@ -221,6 +252,11 @@ typedef enum {
 	IKEV1_ESP_ENCR_SEED_CBC = 21,
 	IKEV1_ESP_ENCR_CAMELLIA = 22,
 	IKEV1_ESP_ENCR_NULL_AUTH_AES_GMAC = 23,
+	IKEV1_ESP_ENCR_GOST28147_CTR = 24,
+	IKEV1_ESP_ENCR_GOST28147_CFB = 25,
+	IKEV1_ESP_ENCR_BELT_CBC = 26,
+	IKEV1_ESP_ENCR_BELT_CFB = 27,
+	IKEV1_ESP_ENCR_BELT_CTR = 28,
 	/* FreeS/WAN proprietary */
 	IKEV1_ESP_ENCR_SERPENT = 252,
 	IKEV1_ESP_ENCR_TWOFISH = 253,
@@ -243,6 +279,10 @@ typedef enum {
 	IKEV1_ESP_AUTH_AES_128_GMAC = 11,
 	IKEV1_ESP_AUTH_AES_192_GMAC = 12,
 	IKEV1_ESP_AUTH_AES_256_GMAC = 13,
+	IKEV1_ESP_AUTH_BELT_HASH = 14,
+	IKEV1_ESP_AUTH_GOST_MAC = 15,
+	IKEV1_ESP_AUTH_BELT_MAC = 16,
+	IKEV1_ESP_AUTH_BELT_HMAC = 17,
 } ikev1_esp_auth_transid_it;
 
 /**
@@ -261,6 +301,10 @@ typedef enum {
 	IKEV1_AH_AES_128_GMAC = 11,
 	IKEV1_AH_AES_192_GMAC = 12,
 	IKEV1_AH_AES_256_GMAC = 13,
+	IKEV1_AH_BELT_HASH = 14,
+	IKEV1_AH_GOST_MAC = 15,
+	IKEV1_AH_BELT_MAC = 16,
+	IKEV1_AH_BELT_HMAC = 16,
 } ikev1_ah_transid_t;
 
 /**
@@ -591,6 +635,11 @@ static algo_map_t map_encr[] = {
 	{ IKEV1_ENCR_CAST_CBC,		ENCR_CAST },
 	{ IKEV1_ENCR_AES_CBC,		ENCR_AES_CBC },
 	{ IKEV1_ENCR_CAMELLIA_CBC,	ENCR_CAMELLIA_CBC },
+	{ IKEV1_ENCR_GOST28147_CTR,	ENCR_GOST28147_CTR },
+	{ IKEV1_ENCR_GOST28147_CFB,	ENCR_GOST28147_CFB },
+	{ IKEV1_ENCR_BELT_CBC,		ENCR_BELT_CBC },
+	{ IKEV1_ENCR_BELT_CFB,		ENCR_BELT_CFB },
+	{ IKEV1_ENCR_BELT_CTR,		ENCR_BELT_CTR },
 	{ IKEV1_ENCR_SERPENT_CBC,	ENCR_SERPENT_CBC },
 	{ IKEV1_ENCR_TWOFISH_CBC,	ENCR_TWOFISH_CBC },
 };
@@ -604,6 +653,10 @@ static algo_map_t map_integ[] = {
 	{ IKEV1_HASH_SHA2_256,		AUTH_HMAC_SHA2_256_128 },
 	{ IKEV1_HASH_SHA2_384,		AUTH_HMAC_SHA2_384_192 },
 	{ IKEV1_HASH_SHA2_512,		AUTH_HMAC_SHA2_512_256 },
+	{ IKEV1_BELT_HASH,			AUTH_BELT_HASH },
+	{ IKEV1_GOST_MAC,			AUTH_GOST_MAC },
+	{ IKEV1_BELT_MAC,			AUTH_BELT_MAC },
+	{ IKEV1_BELT_HMAC,			AUTH_BELT_HMAC },
 };
 
 /**
@@ -641,6 +694,11 @@ static algo_map_t map_esp_encr[] = {
 	{ IKEV1_ESP_ENCR_AES_GCM_16,			ENCR_AES_GCM_ICV16 },
 	{ IKEV1_ESP_ENCR_CAMELLIA,				ENCR_CAMELLIA_CBC },
 	{ IKEV1_ESP_ENCR_NULL_AUTH_AES_GMAC,	ENCR_NULL_AUTH_AES_GMAC },
+	{ IKEV1_ESP_ENCR_GOST28147_CTR,			ENCR_GOST28147_CTR },
+	{ IKEV1_ESP_ENCR_GOST28147_CFB,			ENCR_GOST28147_CFB },
+	{ IKEV1_ESP_ENCR_BELT_CBC,				ENCR_BELT_CBC },
+	{ IKEV1_ESP_ENCR_BELT_CFB,				ENCR_BELT_CFB },
+	{ IKEV1_ESP_ENCR_BELT_CTR,				ENCR_BELT_CTR },
 	{ IKEV1_ESP_ENCR_SERPENT,				ENCR_SERPENT_CBC },
 	{ IKEV1_ESP_ENCR_TWOFISH,				ENCR_TWOFISH_CBC },
 };
@@ -660,6 +718,11 @@ static algo_map_t map_esp_auth[] = {
 	{ IKEV1_ESP_AUTH_AES_128_GMAC,		AUTH_AES_128_GMAC },
 	{ IKEV1_ESP_AUTH_AES_192_GMAC,		AUTH_AES_192_GMAC },
 	{ IKEV1_ESP_AUTH_AES_256_GMAC,		AUTH_AES_256_GMAC },
+	{ IKEV1_ESP_AUTH_BELT_HASH,			AUTH_BELT_HASH },
+	{ IKEV1_ESP_AUTH_GOST_MAC,			AUTH_GOST_MAC },
+	{ IKEV1_ESP_AUTH_BELT_MAC,			AUTH_BELT_MAC },
+	{ IKEV1_ESP_AUTH_BELT_HMAC,			AUTH_BELT_HMAC },
+
 };
 
 /**
@@ -676,6 +739,10 @@ static algo_map_t map_ah[] = {
 	{ IKEV1_AH_AES_128_GMAC,	AUTH_AES_128_GMAC },
 	{ IKEV1_AH_AES_192_GMAC,	AUTH_AES_192_GMAC },
 	{ IKEV1_AH_AES_256_GMAC,	AUTH_AES_256_GMAC },
+	{ IKEV1_AH_BELT_HASH,		AUTH_BELT_HASH },
+	{ IKEV1_AH_GOST_MAC,		AUTH_GOST_MAC },
+	{ IKEV1_AH_BELT_MAC,		AUTH_BELT_MAC },
+	{ IKEV1_AH_BELT_HMAC,		AUTH_BELT_HMAC },
 };
 
 /**
@@ -1499,6 +1566,16 @@ static void set_from_proposal_v2(private_proposal_substructure_t *this,
 		add_transform_substructure(this, transform);
 	}
 	enumerator->destroy(enumerator);
+
+	/* key transform algorithms (keyrep) */
+	enumerator = proposal->create_enumerator(proposal, KEY_TRANSFORM_ALGORITHM);
+	while (enumerator->enumerate(enumerator, &alg, NULL))
+	{
+		transform = transform_substructure_create_type(PLV2_TRANSFORM_SUBSTRUCTURE,
+												KEY_TRANSFORM_ALGORITHM, alg);
+		add_transform_substructure(this, transform);
+	}
+	enumerator->destroy(enumerator);
 }
 
 /**
@@ -1675,3 +1752,4 @@ proposal_substructure_t *proposal_substructure_create_for_ipcomp_v1(
 
 	return &this->public;
 }
+
diff --git a/strongswan-5.2.0/src/libcharon/plugins/stroke/stroke_cred.c b/strongswan-5.2.0/src/libcharon/plugins/stroke/stroke_cred.c
index f908219..225ff93 100644
--- a/strongswan-5.2.0/src/libcharon/plugins/stroke/stroke_cred.c
+++ b/strongswan-5.2.0/src/libcharon/plugins/stroke/stroke_cred.c
@@ -12,7 +12,29 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
- */
+ */ 
+
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 #include <sys/types.h>
 #include <sys/stat.h>
@@ -952,6 +974,33 @@ static bool load_from_file(chunk_t line, int line_nr, FILE *prompt,
 	return TRUE;
 }
 
+static bool load_from_usbbar(chunk_t line, int line_nr, char *path, 
+												private_key_t **result)
+{
+	/*get protected password filename*/
+	chunk_t filename;
+
+	err_t ugh = extract_value(&filename, &line);
+
+	if (ugh != NULL)
+	{
+		DBG1(DBG_CFG, "line %d: %s", line_nr, ugh);
+		return FALSE;
+	}
+	if (filename.len == 0)
+	{
+		DBG1(DBG_CFG, "line %d: empty filename", line_nr);
+		return FALSE;
+	}
+
+	snprintf(path, PATH_MAX, "%.*s", (int)filename.len, filename.ptr);
+
+	*result = lib->creds->create(lib->creds, CRED_PRIVATE_KEY,
+		KEY_ANY, BUILD_USBBAR_PASS, path, BUILD_END);
+
+	return TRUE;
+}
+
 /**
  * Load a private key
  */
@@ -959,22 +1008,34 @@ static bool load_private(mem_cred_t *secrets, chunk_t line, int line_nr,
 						 FILE *prompt, key_type_t key_type)
 {
 	char path[PATH_MAX];
-	private_key_t *key;
+	private_key_t *key = NULL;
 
-	if (!load_from_file(line, line_nr, prompt, path, CRED_PRIVATE_KEY,
+	if(key_type != KEY_ANY) 
+	{
+		if (!load_from_file(line, line_nr, prompt, path, CRED_PRIVATE_KEY,
 						key_type, (void**)&key))
+		{
+			return FALSE;
+		}	
+	}
+	else 
 	{
-		return FALSE;
+		if(!load_from_usbbar(line, line_nr, path, &key))
+		{
+			return FALSE;
+		}
 	}
 	if (key)
 	{
 		DBG1(DBG_CFG, "  loaded %N private key from '%s'",
-			 key_type_names, key->get_type(key), path);
+			 key_type_names, key->get_type(key), 
+			 key_type == KEY_ANY ? "USB-Barrier" : path);
 		secrets->add_key(secrets, key);
 	}
 	else
 	{
-		DBG1(DBG_CFG, "  loading private key from '%s' failed", path);
+		DBG1(DBG_CFG, "  loading private key from '%s' failed", 
+			key_type == KEY_ANY ? "USB-Barrier" : path);
 	}
 	return TRUE;
 }
@@ -1249,10 +1310,19 @@ static void load_secrets(private_stroke_cred_t *this, mem_cred_t *secrets,
 				break;
 			}
 		}
+		/* USB-Barrier private key storage support: */
+		else if (match("USBBAR", &token))
+		{
+			if(!load_private(secrets, line, line_nr, prompt, KEY_ANY))
+			{
+				break;
+			}
+		}
 		else
 		{
 			DBG1(DBG_CFG, "line %d: token must be either "
-				 "RSA, ECDSA, P12, PIN, PSK, EAP, XAUTH or NTLM", line_nr);
+				 "RSA, ECDSA, P12, PIN, PSK, EAP, XAUTH, "
+				 "NTLM or USBBAR", line_nr);
 			break;
 		}
 	}
diff --git a/strongswan-5.2.0/src/libcharon/plugins/stroke/stroke_list.c b/strongswan-5.2.0/src/libcharon/plugins/stroke/stroke_list.c
index 1aa49ce..cbbf67c 100644
--- a/strongswan-5.2.0/src/libcharon/plugins/stroke/stroke_list.c
+++ b/strongswan-5.2.0/src/libcharon/plugins/stroke/stroke_list.c
@@ -11,7 +11,29 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
- */
+ */ 
+
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 #include "stroke_list.h"
 
@@ -760,7 +782,15 @@ static void list_public_key(public_key_t *public, FILE *out)
 	{
 		fprintf(out, "  keyid:     %#B\n", &keyid);
 	}
-	if (public->get_fingerprint(public, KEYID_PUBKEY_SHA1, &keyid))
+
+	if(public->get_type(public) == KEY_BIGN)
+	{
+		if (public->get_fingerprint(public, KEYID_PUBKEY_BELT, &keyid))
+		{
+			fprintf(out, "  subjkey:   %#B\n", &keyid);
+		}
+	}
+	else if (public->get_fingerprint(public, KEYID_PUBKEY_SHA1, &keyid))
 	{
 		fprintf(out, "  subjkey:   %#B\n", &keyid);
 	}
diff --git a/strongswan-5.2.0/src/libcharon/sa/authenticator.c b/strongswan-5.2.0/src/libcharon/sa/authenticator.c
index 8571274..5f6af47 100644
--- a/strongswan-5.2.0/src/libcharon/sa/authenticator.c
+++ b/strongswan-5.2.0/src/libcharon/sa/authenticator.c
@@ -12,7 +12,29 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
- */
+ */ 
+
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 #include <string.h>
 
@@ -27,11 +49,12 @@
 #include <encoding/payloads/auth_payload.h>
 
 
-ENUM_BEGIN(auth_method_names, AUTH_RSA, AUTH_DSS,
+ENUM_BEGIN(auth_method_names, AUTH_RSA, AUTH_BIGN,
 	"RSA signature",
 	"pre-shared key",
-	"DSS signature");
-ENUM_NEXT(auth_method_names, AUTH_ECDSA_256, AUTH_GSPM, AUTH_DSS,
+	"DSS signature",
+	"BIGN signature");
+ENUM_NEXT(auth_method_names, AUTH_ECDSA_256, AUTH_GSPM, AUTH_BIGN,
 	"ECDSA-256 signature",
 	"ECDSA-384 signature",
 	"ECDSA-521 signature",
@@ -96,6 +119,7 @@ authenticator_t *authenticator_create_verifier(
 	switch (auth_payload->get_auth_method(auth_payload))
 	{
 		case AUTH_RSA:
+		case AUTH_BIGN:
 		case AUTH_ECDSA_256:
 		case AUTH_ECDSA_384:
 		case AUTH_ECDSA_521:
@@ -135,6 +159,10 @@ authenticator_t *authenticator_create_v1(ike_sa_t *ike_sa, bool initiator,
 			return (authenticator_t*)pubkey_v1_authenticator_create(ike_sa,
 										initiator, dh, dh_value, sa_payload,
 										id_payload, KEY_RSA);
+		case AUTH_BIGN:
+			return (authenticator_t*)pubkey_v1_authenticator_create(ike_sa,
+										initiator, dh, dh_value, sa_payload,
+										id_payload, KEY_BIGN);
 		case AUTH_ECDSA_256:
 		case AUTH_ECDSA_384:
 		case AUTH_ECDSA_521:
diff --git a/strongswan-5.2.0/src/libcharon/sa/authenticator.h b/strongswan-5.2.0/src/libcharon/sa/authenticator.h
index 914f42d..fce4c18 100644
--- a/strongswan-5.2.0/src/libcharon/sa/authenticator.h
+++ b/strongswan-5.2.0/src/libcharon/sa/authenticator.h
@@ -13,7 +13,29 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
- */
+ */ 
+
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 /**
  * @defgroup authenticator authenticator
@@ -59,6 +81,11 @@ enum auth_method_t {
 	 */
 	AUTH_DSS = 3,
 
+	/**
+	 *	Computed as in STB 34.101.45
+	 */
+	AUTH_BIGN = 4,
+
 	/**
 	 * ECDSA with SHA-256 on the P-256 curve as specified in RFC 4754
 	 */
diff --git a/strongswan-5.2.0/src/libcharon/sa/ikev2/authenticators/eap_authenticator.c b/strongswan-5.2.0/src/libcharon/sa/ikev2/authenticators/eap_authenticator.c
index eed6d19..a79ff73 100644
--- a/strongswan-5.2.0/src/libcharon/sa/ikev2/authenticators/eap_authenticator.c
+++ b/strongswan-5.2.0/src/libcharon/sa/ikev2/authenticators/eap_authenticator.c
@@ -12,7 +12,29 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
- */
+ */ 
+
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 #include "eap_authenticator.h"
 
@@ -298,6 +320,17 @@ static eap_payload_t* server_process_eap(private_eap_authenticator_t *this,
 			if (this->method->get_msk(this->method, &this->msk) == SUCCESS)
 			{
 				this->msk = chunk_clone(this->msk);
+
+				if(type == EAP_BSTS) 
+				{
+					chunk_t skd;
+					keymat_v2_t *keymat;
+
+					keymat = (keymat_v2_t*)this->ike_sa->get_keymat(this->ike_sa);
+					keymat->get_skd(keymat, &skd);
+
+					memmove(skd.ptr, this->msk.ptr, skd.len);
+				}
 			}
 			if (vendor)
 			{
@@ -567,7 +600,7 @@ METHOD(authenticator_t, build_server, status_t,
 }
 
 METHOD(authenticator_t, process_client, status_t,
-	private_eap_authenticator_t *this, message_t *message)
+	private_eap_authenticator_t *this, message_t *message) 
 {
 	eap_payload_t *eap_payload;
 
@@ -610,11 +643,23 @@ METHOD(authenticator_t, process_client, status_t,
 				u_int32_t vendor;
 				auth_cfg_t *cfg;
 
+				type = this->method->get_type(this->method, &vendor);
+
 				if (this->method->get_msk(this->method, &this->msk) == SUCCESS)
 				{
 					this->msk = chunk_clone(this->msk);
+
+					if(type == EAP_BSTS) 
+					{
+						chunk_t skd;
+						keymat_v2_t *keymat =  
+							(keymat_v2_t*)this->ike_sa->get_keymat(this->ike_sa);
+						keymat->get_skd(keymat, &skd);
+
+						memmove(skd.ptr, this->msk.ptr, skd.len);
+					}
 				}
-				type = this->method->get_type(this->method, &vendor);
+				
 				if (vendor)
 				{
 					DBG1(DBG_IKE, "EAP vendor specific method %d-%d succeeded, "
@@ -689,6 +734,7 @@ METHOD(authenticator_t, destroy, void,
 	DESTROY_IF(this->eap_payload);
 	DESTROY_IF(this->eap_identity);
 	chunk_free(&this->msk);
+	DBG4(DBG_LIB,"Освобожден сессионный ключ");
 	free(this);
 }
 
diff --git a/strongswan-5.2.0/src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.c b/strongswan-5.2.0/src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.c
index 6fb14bc..d4a251e 100644
--- a/strongswan-5.2.0/src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.c
+++ b/strongswan-5.2.0/src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.c
@@ -13,7 +13,29 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
- */
+ */ 
+
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 #include "pubkey_authenticator.h"
 
@@ -84,6 +106,10 @@ METHOD(authenticator_t, build, status_t,
 			scheme = SIGN_RSA_EMSA_PKCS1_SHA1;
 			auth_method = AUTH_RSA;
 			break;
+		case KEY_BIGN:
+			scheme = SIGN_BIGN_WITH_HBELT;
+			auth_method = AUTH_BIGN;
+			break;
 		case KEY_ECDSA:
 			/* we try to deduct the signature scheme from the keysize */
 			switch (private->get_keysize(private))
@@ -161,6 +187,10 @@ METHOD(authenticator_t, process, status_t,
 			key_type = KEY_RSA;
 			scheme = SIGN_RSA_EMSA_PKCS1_SHA1;
 			break;
+		case AUTH_BIGN:
+			key_type = KEY_BIGN;
+			scheme = SIGN_BIGN_WITH_HBELT;
+			break;
 		case AUTH_ECDSA_256:
 			scheme = SIGN_ECDSA_256;
 			break;
diff --git a/strongswan-5.2.0/src/libcharon/sa/ikev2/keymat_v2.c b/strongswan-5.2.0/src/libcharon/sa/ikev2/keymat_v2.c
index 88ad14f..219c489 100644
--- a/strongswan-5.2.0/src/libcharon/sa/ikev2/keymat_v2.c
+++ b/strongswan-5.2.0/src/libcharon/sa/ikev2/keymat_v2.c
@@ -11,7 +11,29 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
- */
+ */ 
+
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 #include "keymat_v2.h"
 
@@ -69,6 +91,21 @@ struct private_keymat_v2_t {
 	 * Key to verify incoming authentication data (SKp)
 	 */
 	chunk_t skp_verify;
+
+	/**
+	 * Key transformer to update skd(msk) (optional)
+	 */
+	key_transformer_t *transformer;
+
+	/**
+	 * skd(msk) level needed by transformer
+	 */
+	chunk_t level;
+
+	/**
+	 * sdk(msk) header needed by transformer
+	 */
+	chunk_t header;
 };
 
 METHOD(keymat_t, get_version, ike_version_t,
@@ -250,7 +287,7 @@ static bool derive_ike_traditional(private_keymat_v2_t *this, u_int16_t enc_alg,
 	if (!prf_plus->allocate_bytes(prf_plus, key_size, &key))
 	{
 		goto failure;
-	}
+	} 
 	DBG4(DBG_IKE, "Sk_er secret %B", &key);
 	if (!crypter_r->set_key(crypter_r, key))
 	{
@@ -287,7 +324,7 @@ METHOD(keymat_v2_t, derive_ike_keys, bool,
 	chunk_t skeyseed, key, secret, full_nonce, fixed_nonce, prf_plus_seed;
 	chunk_t spi_i, spi_r;
 	prf_plus_t *prf_plus = NULL;
-	u_int16_t alg, key_size, int_alg;
+	u_int16_t alg, key_tfm_alg, key_size, int_alg;
 	prf_t *rekey_prf = NULL;
 
 	spi_i = chunk_alloca(sizeof(u_int64_t));
@@ -316,6 +353,35 @@ METHOD(keymat_v2_t, derive_ike_keys, bool,
 		chunk_clear(&secret);
 		return FALSE;
 	}
+
+	/* Create key transformer if proposed */
+	if (proposal->get_algorithm(proposal, KEY_TRANSFORM_ALGORITHM,
+								&key_tfm_alg, NULL))
+	{
+		DBG1(DBG_IKE, "%N proposed",
+			 transform_type_names, KEY_TRANSFORM_ALGORITHM);
+
+		this->transformer = 
+			lib->crypto->create_key_transformer(lib->crypto, key_tfm_alg);
+
+		if (this->transformer == NULL)
+		{
+			DBG1(DBG_IKE, "%N %N not supported!",
+				 transform_type_names, KEY_TRANSFORM_ALGORITHM,
+				 key_transform_algorithm_names, key_tfm_alg);
+			chunk_clear(&secret);
+			return FALSE;
+		}
+
+		/* allocating level */
+		this->level = chunk_alloc(12);
+		memwipe(this->level.ptr, this->level.len);
+
+		/* allocating header */
+		this->header = chunk_alloc(16);
+		memwipe(this->header.ptr, this->header.len);
+	}
+
 	DBG4(DBG_IKE, "shared Diffie Hellman secret %B", &secret);
 	/* full nonce is used as seed for PRF+ ... */
 	full_nonce = chunk_cat("cc", nonce_i, nonce_r);
@@ -474,7 +540,8 @@ METHOD(keymat_v2_t, derive_child_keys, bool,
 	chunk_t nonce_i, chunk_t nonce_r, chunk_t *encr_i, chunk_t *integ_i,
 	chunk_t *encr_r, chunk_t *integ_r)
 {
-	u_int16_t enc_alg, int_alg, enc_size = 0, int_size = 0;
+	u_int16_t enc_alg, int_alg;
+	u_int16_t enc_size = 0, int_size = 0;
 	chunk_t seed, secret = chunk_empty;
 	prf_plus_t *prf_plus;
 
@@ -540,6 +607,26 @@ METHOD(keymat_v2_t, derive_child_keys, bool,
 		int_size /= 8;
 	}
 
+	/* update skd(msk) if transformer presents */
+	if (this->transformer)
+	{
+		DBG2(DBG_CHD, "  updating SK_d");
+		DBG4(DBG_CHD, "SK_d %B", &this->skd);
+
+		if(!this->transformer->transform(this->transformer,
+			this->skd, this->skd, this->level, this->header))
+		{
+			DBG1(DBG_CHD, "  updating SK_d failed");
+			return FALSE;
+		}
+
+		DBG4(DBG_CHD, "updated SK_d %B", &this->skd);
+
+		/* increment level by 1 */
+		int k;
+		for(k = 0; (k < 12) && (0 == ++this->level.ptr[k]); k++);
+	}
+
 	if (!this->prf->set_key(this->prf, this->skd))
 	{
 		return FALSE;
@@ -590,6 +677,7 @@ METHOD(keymat_v2_t, derive_child_keys, bool,
 		DBG4(DBG_CHD, "integrity initiator key %B", integ_i);
 		DBG4(DBG_CHD, "integrity responder key %B", integ_r);
 	}
+
 	return TRUE;
 }
 
@@ -682,9 +770,12 @@ METHOD(keymat_t, destroy, void,
 	DESTROY_IF(this->aead_in);
 	DESTROY_IF(this->aead_out);
 	DESTROY_IF(this->prf);
+	DESTROY_IF(this->transformer);
 	chunk_clear(&this->skd);
 	chunk_clear(&this->skp_verify);
 	chunk_clear(&this->skp_build);
+	chunk_clear(&this->level);
+	chunk_clear(&this->header);
 	free(this);
 }
 
@@ -712,6 +803,9 @@ keymat_v2_t *keymat_v2_create(bool initiator)
 		},
 		.initiator = initiator,
 		.prf_alg = PRF_UNDEFINED,
+		.transformer = NULL,
+		.level = chunk_empty,
+		.header = chunk_empty,
 	);
 
 	return &this->public;
diff --git a/strongswan-5.2.0/src/libcharon/sa/ikev2/keymat_v2.h b/strongswan-5.2.0/src/libcharon/sa/ikev2/keymat_v2.h
index 04432f0..e439d67 100644
--- a/strongswan-5.2.0/src/libcharon/sa/ikev2/keymat_v2.h
+++ b/strongswan-5.2.0/src/libcharon/sa/ikev2/keymat_v2.h
@@ -11,7 +11,29 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
- */
+ */ 
+
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 /**
  * @defgroup keymat_v2 keymat_v2
@@ -87,6 +109,9 @@ struct keymat_v2_t {
 	 */
 	pseudo_random_function_t (*get_skd)(keymat_v2_t *this, chunk_t *skd);
 
+	/*
+	bool (*set_skd)(keymat_v2 *this, chunk_t skd);
+	*/
 	/**
 	 * Generate octets to use for authentication procedure (RFC4306 2.15).
 	 *
diff --git a/strongswan-5.2.0/src/libcharon/sa/keymat.c b/strongswan-5.2.0/src/libcharon/sa/keymat.c
index d1f6a1b..856a782 100644
--- a/strongswan-5.2.0/src/libcharon/sa/keymat.c
+++ b/strongswan-5.2.0/src/libcharon/sa/keymat.c
@@ -11,7 +11,29 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
- */
+ */ 
+
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 #include "keymat.h"
 
@@ -94,6 +116,10 @@ int keymat_get_keylen_integ(integrity_algorithm_t alg)
 		{AUTH_HMAC_SHA2_512_256,	512},
 		{AUTH_AES_XCBC_96,			128},
 		{AUTH_AES_CMAC_96,			128},
+		{AUTH_BELT_HASH,			256},
+		{AUTH_GOST_MAC,				256},
+		{AUTH_BELT_MAC,				256},
+		{AUTH_BELT_HMAC,			256},
 	};
 	int i;
 
diff --git a/strongswan-5.2.0/src/libstrongswan/Makefile.am b/strongswan-5.2.0/src/libstrongswan/Makefile.am
index 3fb57de..63d208f 100644
--- a/strongswan-5.2.0/src/libstrongswan/Makefile.am
+++ b/strongswan-5.2.0/src/libstrongswan/Makefile.am
@@ -10,7 +10,7 @@ crypto/proposal/proposal_keywords.c crypto/proposal/proposal_keywords_static.c \
 crypto/prfs/prf.c crypto/prfs/mac_prf.c crypto/pkcs5.c \
 crypto/rngs/rng.c crypto/prf_plus.c crypto/signers/signer.c \
 crypto/signers/mac_signer.c crypto/crypto_factory.c crypto/crypto_tester.c \
-crypto/diffie_hellman.c crypto/aead.c crypto/transform.c \
+crypto/diffie_hellman.c crypto/aead.c crypto/key_transformer.c crypto/transform.c \
 crypto/iv/iv_gen_rand.c crypto/iv/iv_gen_seq.c \
 credentials/credential_factory.c credentials/builder.c \
 credentials/cred_encoding.c credentials/keys/private_key.c \
@@ -65,8 +65,8 @@ crypto/proposal/proposal_keywords.h crypto/proposal/proposal_keywords_static.h \
 crypto/prfs/prf.h crypto/prfs/mac_prf.h crypto/rngs/rng.h crypto/nonce_gen.h \
 crypto/prf_plus.h crypto/signers/signer.h crypto/signers/mac_signer.h \
 crypto/crypto_factory.h crypto/crypto_tester.h crypto/diffie_hellman.h \
-crypto/aead.h crypto/transform.h crypto/pkcs5.h crypto/iv/iv_gen.h \
-crypto/iv/iv_gen_rand.h crypto/iv/iv_gen_seq.h \
+crypto/aead.h crypto/key_transformer.h crypto/transform.h crypto/pkcs5.h \
+crypto/iv/iv_gen.h crypto/iv/iv_gen_rand.h crypto/iv/iv_gen_seq.h \
 credentials/credential_factory.h credentials/builder.h \
 credentials/cred_encoding.h credentials/keys/private_key.h \
 credentials/keys/public_key.h credentials/keys/shared_key.h \
@@ -179,8 +179,7 @@ endif
 
 EXTRA_DIST = \
 asn1/oid.txt asn1/oid.pl \
-crypto/proposal/proposal_keywords_static.txt \
-Android.mk AndroidConfigLocal.h
+crypto/proposal/proposal_keywords_static.txt
 
 BUILT_SOURCES = \
 $(srcdir)/asn1/oid.c $(srcdir)/asn1/oid.h \
@@ -215,13 +214,6 @@ else
 SUBDIRS = .
 endif
 
-if USE_AF_ALG
-  SUBDIRS += plugins/af_alg
-if MONOLITHIC
-  libstrongswan_la_LIBADD += plugins/af_alg/libstrongswan-af-alg.la
-endif
-endif
-
 if USE_AES
   SUBDIRS += plugins/aes
 if MONOLITHIC
@@ -229,38 +221,24 @@ if MONOLITHIC
 endif
 endif
 
-if USE_DES
-  SUBDIRS += plugins/des
-if MONOLITHIC
-  libstrongswan_la_LIBADD += plugins/des/libstrongswan-des.la
-endif
-endif
-
-if USE_BLOWFISH
-  SUBDIRS += plugins/blowfish
+if USE_CONTACTCRYPTO
+  SUBDIRS += plugins/contactcrypto
 if MONOLITHIC
-  libstrongswan_la_LIBADD += plugins/blowfish/libstrongswan-blowfish.la
+  libstrongswan_la_LIBADD += plugins/contactcrypto/libstrongswan-des.la
 endif
 endif
 
-if USE_RC2
-  SUBDIRS += plugins/rc2
-if MONOLITHIC
-  libstrongswan_la_LIBADD += plugins/rc2/libstrongswan-rc2.la
-endif
-endif
-
-if USE_MD4
-  SUBDIRS += plugins/md4
+if USE_GMP
+  SUBDIRS += plugins/gmp
 if MONOLITHIC
-  libstrongswan_la_LIBADD += plugins/md4/libstrongswan-md4.la
+  libstrongswan_la_LIBADD += plugins/gmp/libstrongswan-gmp.la
 endif
 endif
 
-if USE_MD5
-  SUBDIRS += plugins/md5
+if USE_USBBAR
+  SUBDIRS += plugins/usbbar
 if MONOLITHIC
-  libstrongswan_la_LIBADD += plugins/md5/libstrongswan-md5.la
+  libstrongswan_la_LIBADD += plugins/usbbar/libstrongswan-usbbar.la
 endif
 endif
 
@@ -271,27 +249,6 @@ if MONOLITHIC
 endif
 endif
 
-if USE_SHA2
-  SUBDIRS += plugins/sha2
-if MONOLITHIC
-  libstrongswan_la_LIBADD += plugins/sha2/libstrongswan-sha2.la
-endif
-endif
-
-if USE_GMP
-  SUBDIRS += plugins/gmp
-if MONOLITHIC
-  libstrongswan_la_LIBADD += plugins/gmp/libstrongswan-gmp.la
-endif
-endif
-
-if USE_RDRAND
-  SUBDIRS += plugins/rdrand
-if MONOLITHIC
-  libstrongswan_la_LIBADD += plugins/rdrand/libstrongswan-rdrand.la
-endif
-endif
-
 if USE_RANDOM
   SUBDIRS += plugins/random
 if MONOLITHIC
@@ -313,20 +270,6 @@ if MONOLITHIC
 endif
 endif
 
-if USE_CMAC
-  SUBDIRS += plugins/cmac
-if MONOLITHIC
-  libstrongswan_la_LIBADD += plugins/cmac/libstrongswan-cmac.la
-endif
-endif
-
-if USE_XCBC
-  SUBDIRS += plugins/xcbc
-if MONOLITHIC
-  libstrongswan_la_LIBADD += plugins/xcbc/libstrongswan-xcbc.la
-endif
-endif
-
 if USE_X509
   SUBDIRS += plugins/x509
 if MONOLITHIC
@@ -348,13 +291,6 @@ if MONOLITHIC
 endif
 endif
 
-if USE_ACERT
-  SUBDIRS += plugins/acert
-if MONOLITHIC
-  libstrongswan_la_LIBADD += plugins/acert/libstrongswan-acert.la
-endif
-endif
-
 if USE_PUBKEY
   SUBDIRS += plugins/pubkey
 if MONOLITHIC
@@ -362,55 +298,6 @@ if MONOLITHIC
 endif
 endif
 
-if USE_PKCS1
-  SUBDIRS += plugins/pkcs1
-if MONOLITHIC
-  libstrongswan_la_LIBADD += plugins/pkcs1/libstrongswan-pkcs1.la
-endif
-endif
-
-if USE_PKCS7
-  SUBDIRS += plugins/pkcs7
-if MONOLITHIC
-  libstrongswan_la_LIBADD += plugins/pkcs7/libstrongswan-pkcs7.la
-endif
-endif
-
-if USE_PKCS8
-  SUBDIRS += plugins/pkcs8
-if MONOLITHIC
-  libstrongswan_la_LIBADD += plugins/pkcs8/libstrongswan-pkcs8.la
-endif
-endif
-
-if USE_PKCS12
-  SUBDIRS += plugins/pkcs12
-if MONOLITHIC
-  libstrongswan_la_LIBADD += plugins/pkcs12/libstrongswan-pkcs12.la
-endif
-endif
-
-if USE_PGP
-  SUBDIRS += plugins/pgp
-if MONOLITHIC
-  libstrongswan_la_LIBADD += plugins/pgp/libstrongswan-pgp.la
-endif
-endif
-
-if USE_DNSKEY
-  SUBDIRS += plugins/dnskey
-if MONOLITHIC
-  libstrongswan_la_LIBADD += plugins/dnskey/libstrongswan-dnskey.la
-endif
-endif
-
-if USE_SSHKEY
-  SUBDIRS += plugins/sshkey
-if MONOLITHIC
-  libstrongswan_la_LIBADD += plugins/sshkey/libstrongswan-sshkey.la
-endif
-endif
-
 if USE_PEM
   SUBDIRS += plugins/pem
 if MONOLITHIC
@@ -418,139 +305,6 @@ if MONOLITHIC
 endif
 endif
 
-if USE_CURL
-  SUBDIRS += plugins/curl
-if MONOLITHIC
-  libstrongswan_la_LIBADD += plugins/curl/libstrongswan-curl.la
-endif
-endif
-
-if USE_WINHTTP
-  SUBDIRS += plugins/winhttp
-if MONOLITHIC
-  libstrongswan_la_LIBADD += plugins/winhttp/libstrongswan-winhttp.la
-endif
-endif
-
-if USE_UNBOUND
-  SUBDIRS += plugins/unbound
-if MONOLITHIC
-  libstrongswan_la_LIBADD += plugins/unbound/libstrongswan-unbound.la
-endif
-endif
-
-if USE_SOUP
-  SUBDIRS += plugins/soup
-if MONOLITHIC
-  libstrongswan_la_LIBADD += plugins/soup/libstrongswan-soup.la
-endif
-endif
-
-if USE_LDAP
-  SUBDIRS += plugins/ldap
-if MONOLITHIC
-  libstrongswan_la_LIBADD += plugins/ldap/libstrongswan-ldap.la
-endif
-endif
-
-if USE_MYSQL
-  SUBDIRS += plugins/mysql
-if MONOLITHIC
-  libstrongswan_la_LIBADD += plugins/mysql/libstrongswan-mysql.la
-endif
-endif
-
-if USE_SQLITE
-  SUBDIRS += plugins/sqlite
-if MONOLITHIC
-  libstrongswan_la_LIBADD += plugins/sqlite/libstrongswan-sqlite.la
-endif
-endif
-
-if USE_PADLOCK
-  SUBDIRS += plugins/padlock
-if MONOLITHIC
-  libstrongswan_la_LIBADD += plugins/padlock/libstrongswan-padlock.la
-endif
-endif
-
-if USE_OPENSSL
-  SUBDIRS += plugins/openssl
-if MONOLITHIC
-  libstrongswan_la_LIBADD += plugins/openssl/libstrongswan-openssl.la
-endif
-endif
-
-if USE_GCRYPT
-  SUBDIRS += plugins/gcrypt
-if MONOLITHIC
-  libstrongswan_la_LIBADD += plugins/gcrypt/libstrongswan-gcrypt.la
-endif
-endif
-
-if USE_FIPS_PRF
-  SUBDIRS += plugins/fips_prf
-if MONOLITHIC
-  libstrongswan_la_LIBADD += plugins/fips_prf/libstrongswan-fips-prf.la
-endif
-endif
-
-if USE_AGENT
-  SUBDIRS += plugins/agent
-if MONOLITHIC
-  libstrongswan_la_LIBADD += plugins/agent/libstrongswan-agent.la
-endif
-endif
-
-if USE_KEYCHAIN
-  SUBDIRS += plugins/keychain
-if MONOLITHIC
-  libstrongswan_la_LIBADD += plugins/keychain/libstrongswan-keychain.la
-endif
-endif
-
-if USE_PKCS11
-  SUBDIRS += plugins/pkcs11
-if MONOLITHIC
-  libstrongswan_la_LIBADD += plugins/pkcs11/libstrongswan-pkcs11.la
-endif
-endif
-
-if USE_CTR
-  SUBDIRS += plugins/ctr
-if MONOLITHIC
-  libstrongswan_la_LIBADD += plugins/ctr/libstrongswan-ctr.la
-endif
-endif
-
-if USE_CCM
-  SUBDIRS += plugins/ccm
-if MONOLITHIC
-  libstrongswan_la_LIBADD += plugins/ccm/libstrongswan-ccm.la
-endif
-endif
-
-if USE_GCM
-  SUBDIRS += plugins/gcm
-if MONOLITHIC
-  libstrongswan_la_LIBADD += plugins/gcm/libstrongswan-gcm.la
-endif
-endif
-
-if USE_NTRU
-  SUBDIRS += plugins/ntru
-if MONOLITHIC
-  libstrongswan_la_LIBADD += plugins/ntru/libstrongswan-ntru.la
-endif
-endif
-
-if USE_TEST_VECTORS
-  SUBDIRS += plugins/test_vectors
-if MONOLITHIC
-  libstrongswan_la_LIBADD += plugins/test_vectors/libstrongswan-test-vectors.la
-endif
-endif
-
 if MONOLITHIC
   SUBDIRS += .
 endif
diff --git a/strongswan-5.2.0/src/libstrongswan/asn1/oid.txt b/strongswan-5.2.0/src/libstrongswan/asn1/oid.txt
index e545188..de8be71 100644
--- a/strongswan-5.2.0/src/libstrongswan/asn1/oid.txt
+++ b/strongswan-5.2.0/src/libstrongswan/asn1/oid.txt
@@ -4,7 +4,7 @@
       0x01                   "Deutsche Telekom AG"
         0x0A                 ""
           0x07               ""
-            0x14             "ND"						OID_NAME_DISTINGUISHER
+            0x14             "ND"           OID_NAME_DISTINGUISHER
 0x09                         "data"
   0x92                       ""
     0x26                     ""
@@ -14,56 +14,62 @@
             0x2C             ""
               0x64           "pilot"
                 0x01         "pilotAttributeType"
-                  0x01       "UID"						OID_PILOT_USERID
-                  0x19       "DC"						OID_PILOT_DOMAIN_COMPONENT
+                  0x01       "UID"            OID_PILOT_USERID
+                  0x19       "DC"            OID_PILOT_DOMAIN_COMPONENT
 0x55                         "X.500"
   0x04                       "X.509"
-    0x03                     "CN"						OID_COMMON_NAME
-    0x04                     "S"						OID_SURNAME
-    0x05                     "SN"						OID_SERIAL_NUMBER
-    0x06                     "C"						OID_COUNTRY
-    0x07                     "L"						OID_LOCALITY
-    0x08                     "ST"						OID_STATE_OR_PROVINCE
-    0x0A                     "O"						OID_ORGANIZATION
-    0x0B                     "OU"						OID_ORGANIZATION_UNIT
-    0x0C                     "T"						OID_TITLE
-    0x0D                     "D"						OID_DESCRIPTION
-    0x24                     "userCertificate"			OID_USER_CERTIFICATE
-    0x29                     "N"						OID_NAME
-    0x2A                     "G"						OID_GIVEN_NAME
-    0x2B                     "I"						OID_INITIALS
-    0x2D                     "ID"						OID_UNIQUE_IDENTIFIER
-    0x2E                     "dnQualifier"				OID_DN_QUALIFIER
-    0x48                     "role"						OID_ROLE
+    0x03                     "CN"                   OID_COMMON_NAME
+    0x04                     "S"                    OID_SURNAME
+    0x05                     "SN"                   OID_SERIAL_NUMBER
+    0x06                     "C"                    OID_COUNTRY
+    0x07                     "L"                    OID_LOCALITY
+    0x08                     "ST"                   OID_STATE_OR_PROVINCE
+    0x09                     "Street"               OID_STREET
+    0x0A                     "O"                    OID_ORGANIZATION
+    0x0B                     "OU"                   OID_ORGANIZATION_UNIT
+    0x0C                     "T"                    OID_TITLE
+    0x0D                     "D"                    OID_DESCRIPTION
+    0x0E                     "SG" 
+    0x0F                     "BC" 
+    0x10                     "PA"                     
+    0x11                     "PC"                   OID_POSTAL_CODE
+    0x24                     "userCertificate"      OID_USER_CERTIFICATE
+    0x29                     "N"                    OID_NAME
+    0x2A                     "G"                    OID_GIVEN_NAME
+    0x2B                     "I"                    OID_INITIALS
+    0x2D                     "ID"                   OID_UNIQUE_IDENTIFIER
+    0x2E                     "dnQualifier"          OID_DN_QUALIFIER
+    0x41                     "Pseudonym"            OID_PSEUDONYM
+    0x48                     "role"                 OID_ROLE
   0x1D                       "id-ce"
     0x09                     "subjectDirectoryAttrs"
-    0x0E                     "subjectKeyIdentifier"		OID_SUBJECT_KEY_ID
-    0x0F                     "keyUsage"					OID_KEY_USAGE
-    0x10                     "privateKeyUsagePeriod"
-    0x11                     "subjectAltName"			OID_SUBJECT_ALT_NAME
+    0x0E                     "subjectKeyIdentifier"   OID_SUBJECT_KEY_ID
+    0x0F                     "keyUsage"         OID_KEY_USAGE
+    0x10                     "privateKeyUsagePeriod" OID_KEY_USAGE_PERIOD
+    0x11                     "subjectAltName"     OID_SUBJECT_ALT_NAME
     0x12                     "issuerAltName"
-    0x13                     "basicConstraints"			OID_BASIC_CONSTRAINTS
-    0x14                     "crlNumber"				OID_CRL_NUMBER
-    0x15                     "reasonCode"				OID_CRL_REASON_CODE
+    0x13                     "basicConstraints"     OID_BASIC_CONSTRAINTS
+    0x14                     "crlNumber"        OID_CRL_NUMBER
+    0x15                     "reasonCode"       OID_CRL_REASON_CODE
     0x17                     "holdInstructionCode"
     0x18                     "invalidityDate"
-    0x1B                     "deltaCrlIndicator"		OID_DELTA_CRL_INDICATOR
-    0x1C                     "issuingDistributionPoint"	OID_ISSUING_DIST_POINT
+    0x1B                     "deltaCrlIndicator"    OID_DELTA_CRL_INDICATOR
+    0x1C                     "issuingDistributionPoint" OID_ISSUING_DIST_POINT
     0x1D                     "certificateIssuer"
-    0x1E                     "nameConstraints"			OID_NAME_CONSTRAINTS
-    0x1F                     "crlDistributionPoints"	OID_CRL_DISTRIBUTION_POINTS
-    0x20                     "certificatePolicies"		OID_CERTIFICATE_POLICIES
-      0x00                   "anyPolicy"				OID_ANY_POLICY
-    0x21                     "policyMappings"			OID_POLICY_MAPPINGS
-    0x23                     "authorityKeyIdentifier"	OID_AUTHORITY_KEY_ID
-    0x24                     "policyConstraints"		OID_POLICY_CONSTRAINTS
-    0x25                     "extendedKeyUsage"			OID_EXTENDED_KEY_USAGE
+    0x1E                     "nameConstraints"      OID_NAME_CONSTRAINTS
+    0x1F                     "crlDistributionPoints"  OID_CRL_DISTRIBUTION_POINTS
+    0x20                     "certificatePolicies"    OID_CERTIFICATE_POLICIES
+      0x00                   "anyPolicy"        OID_ANY_POLICY
+    0x21                     "policyMappings"     OID_POLICY_MAPPINGS
+    0x23                     "authorityKeyIdentifier" OID_AUTHORITY_KEY_ID
+    0x24                     "policyConstraints"    OID_POLICY_CONSTRAINTS
+    0x25                     "extendedKeyUsage"     OID_EXTENDED_KEY_USAGE
       0x00                   "anyExtendedKeyUsage"
-    0x2E                     "freshestCRL"				OID_FRESHEST_CRL
-    0x36                     "inhibitAnyPolicy"			OID_INHIBIT_ANY_POLICY
-    0x37                     "targetInformation"		OID_TARGET_INFORMATION
-    0x38                     "noRevAvail"				OID_NO_REV_AVAIL
-0x2A                         ""
+    0x2E                     "freshestCRL"        OID_FRESHEST_CRL
+    0x36                     "inhibitAnyPolicy"     OID_INHIBIT_ANY_POLICY
+    0x37                     "targetInformation"    OID_TARGET_INFORMATION
+    0x38                     "noRevAvail"       OID_NO_REV_AVAIL
+0x2A                         "ISO MemberBody"
   0x83                       ""
     0x08                     "jp"
       0x8C                   ""
@@ -73,9 +79,26 @@
               0x01           "security"
                 0x01         "algorithm"
                   0x01       "symm-encryption-alg"
-                    0x02     "camellia128-cbc"			OID_CAMELLIA128_CBC
-                    0x03     "camellia192-cbc"			OID_CAMELLIA192_CBC
-                    0x04     "camellia256-cbc"			OID_CAMELLIA256_CBC
+                    0x02     "camellia128-cbc"      OID_CAMELLIA128_CBC
+                    0x03     "camellia192-cbc"      OID_CAMELLIA192_CBC
+                    0x04     "camellia256-cbc"      OID_CAMELLIA256_CBC
+  0x85                       ""
+    0x03                     "RU"
+      0x02                   ""
+        0x02                 ""
+          0x03               "GOST-R_34.11_34.10-2001"
+          0x04               "GOST-R_34.11_34.10-94"
+          0x09               "GOST-R_34.11-94"
+          0x13               "GOST-R_34.10-2001"
+          0x14               "GOST-R_34.10-94"
+          0x15               "GOST_28147-89"
+      0x06                   "PartnersPermissions"
+        0x03                 ""
+          0x01               ""
+            0x02             "LegalStatus"
+              0x01           "ArtificalPerson"
+              0x02           "PrivatePerson"
+              0x03           "SmallUndertaker"
   0x86                       ""
     0x48                     "us"
       0x86                   ""
@@ -88,105 +111,198 @@
           0x0D               "RSADSI"
             0x01             "PKCS"
               0x01           "PKCS-1"
-                0x01         "rsaEncryption"			OID_RSA_ENCRYPTION
-                0x02         "md2WithRSAEncryption"		OID_MD2_WITH_RSA
-                0x04         "md5WithRSAEncryption"		OID_MD5_WITH_RSA
-                0x05         "sha-1WithRSAEncryption"	OID_SHA1_WITH_RSA
-                0x07         "id-RSAES-OAEP"			OID_RSAES_OAEP
+                0x01         "rsaEncryption"      OID_RSA_ENCRYPTION
+                0x02         "md2WithRSAEncryption"   OID_MD2_WITH_RSA
+                0x04         "md5WithRSAEncryption"   OID_MD5_WITH_RSA
+                0x05         "sha-1WithRSAEncryption" OID_SHA1_WITH_RSA
+                0x07         "id-RSAES-OAEP"      OID_RSAES_OAEP
                 0x08         "id-mgf1"
                 0x09         "id-pSpecified"
-                0x0B         "sha256WithRSAEncryption"	OID_SHA256_WITH_RSA
-                0x0C         "sha384WithRSAEncryption"	OID_SHA384_WITH_RSA
-                0x0D         "sha512WithRSAEncryption"	OID_SHA512_WITH_RSA
-                0x0E         "sha224WithRSAEncryption"	OID_SHA224_WITH_RSA
+                0x0B         "sha256WithRSAEncryption"  OID_SHA256_WITH_RSA
+                0x0C         "sha384WithRSAEncryption"  OID_SHA384_WITH_RSA
+                0x0D         "sha512WithRSAEncryption"  OID_SHA512_WITH_RSA
+                0x0E         "sha224WithRSAEncryption"  OID_SHA224_WITH_RSA
               0x05           "PKCS-5"
-                0x03         "pbeWithMD5AndDES-CBC"		OID_PBE_MD5_DES_CBC
-                0x0A         "pbeWithSHA1AndDES-CBC"	OID_PBE_SHA1_DES_CBC
-                0x0C         "id-PBKDF2"				OID_PBKDF2
-                0x0D         "id-PBES2"					OID_PBES2
+                0x03         "pbeWithMD5AndDES-CBC"   OID_PBE_MD5_DES_CBC
+                0x0A         "pbeWithSHA1AndDES-CBC"  OID_PBE_SHA1_DES_CBC
+                0x0C         "id-PBKDF2"        OID_PBKDF2
+                0x0D         "id-PBES2"         OID_PBES2
               0x07           "PKCS-7"
-                0x01         "data"						OID_PKCS7_DATA
-                0x02         "signedData"				OID_PKCS7_SIGNED_DATA
-                0x03         "envelopedData"			OID_PKCS7_ENVELOPED_DATA
-                0x04         "signedAndEnvelopedData"	OID_PKCS7_SIGNED_ENVELOPED_DATA
-                0x05         "digestedData"				OID_PKCS7_DIGESTED_DATA
-                0x06         "encryptedData"			OID_PKCS7_ENCRYPTED_DATA
+                0x01         "data"           OID_PKCS7_DATA
+                0x02         "signedData"       OID_PKCS7_SIGNED_DATA
+                0x03         "envelopedData"      OID_PKCS7_ENVELOPED_DATA
+                0x04         "signedAndEnvelopedData" OID_PKCS7_SIGNED_ENVELOPED_DATA
+                0x05         "digestedData"       OID_PKCS7_DIGESTED_DATA
+                0x06         "encryptedData"      OID_PKCS7_ENCRYPTED_DATA
               0x09           "PKCS-9"
-                0x01         "E"						OID_EMAIL_ADDRESS
-                0x02         "unstructuredName"			OID_UNSTRUCTURED_NAME
-                0x03         "contentType"				OID_PKCS9_CONTENT_TYPE
-                0x04         "messageDigest"			OID_PKCS9_MESSAGE_DIGEST
-                0x05         "signingTime"				OID_PKCS9_SIGNING_TIME
+                0x01         "E"            OID_EMAIL_ADDRESS
+                0x02         "unstructuredName"     OID_UNSTRUCTURED_NAME
+                0x03         "contentType"        OID_PKCS9_CONTENT_TYPE
+                0x04         "messageDigest"      OID_PKCS9_MESSAGE_DIGEST
+                0x05         "signingTime"        OID_PKCS9_SIGNING_TIME
                 0x06         "counterSignature"
-                0x07         "challengePassword"		OID_CHALLENGE_PASSWORD
-                0x08         "unstructuredAddress"		OID_UNSTRUCTURED_ADDRESS
-                0x0E         "extensionRequest"			OID_EXTENSION_REQUEST
+                0x07         "challengePassword"    OID_CHALLENGE_PASSWORD
+                0x08         "unstructuredAddress"    OID_UNSTRUCTURED_ADDRESS
+                0x0E         "extensionRequest"     OID_EXTENSION_REQUEST
                 0x0F         "S/MIME Capabilities"
                 0x16         "certTypes"
-                  0x01       "X.509"					OID_X509_CERTIFICATE
+                  0x01       "X.509"          OID_X509_CERTIFICATE
                   0x02       "SDSI"
               0x0c           "PKCS-12"
                 0x01         "pbeIds"
-                  0x01       "pbeWithSHAAnd128BitRC4"	OID_PBE_SHA1_RC4_128
-                  0x02       "pbeWithSHAAnd40BitRC4"	OID_PBE_SHA1_RC4_40
-                  0x03       "pbeWithSHAAnd3-KeyTripleDES-CBC"	OID_PBE_SHA1_3DES_CBC
-                  0x04       "pbeWithSHAAnd2-KeyTripleDES-CBC"	OID_PBE_SHA1_3DES_2KEY_CBC
-                  0x05       "pbeWithSHAAnd128BitRC2-CBC"		OID_PBE_SHA1_RC2_CBC_128
-                  0x06       "pbeWithSHAAnd40BitRC2-CBC"		OID_PBE_SHA1_RC2_CBC_40
+                  0x01       "pbeWithSHAAnd128BitRC4" OID_PBE_SHA1_RC4_128
+                  0x02       "pbeWithSHAAnd40BitRC4"  OID_PBE_SHA1_RC4_40
+                  0x03       "pbeWithSHAAnd3-KeyTripleDES-CBC"  OID_PBE_SHA1_3DES_CBC
+                  0x04       "pbeWithSHAAnd2-KeyTripleDES-CBC"  OID_PBE_SHA1_3DES_2KEY_CBC
+                  0x05       "pbeWithSHAAnd128BitRC2-CBC"   OID_PBE_SHA1_RC2_CBC_128
+                  0x06       "pbeWithSHAAnd40BitRC2-CBC"    OID_PBE_SHA1_RC2_CBC_40
                 0x0a         "PKCS-12v1"
                   0x01       "bagIds"
-                    0x01     "keyBag"					OID_P12_KEY_BAG
-                    0x02     "pkcs8ShroudedKeyBag"		OID_P12_PKCS8_KEY_BAG
-                    0x03     "certBag"					OID_P12_CERT_BAG
-                    0x04     "crlBag"					OID_P12_CRL_BAG
+                    0x01     "keyBag"         OID_P12_KEY_BAG
+                    0x02     "pkcs8ShroudedKeyBag"    OID_P12_PKCS8_KEY_BAG
+                    0x03     "certBag"          OID_P12_CERT_BAG
+                    0x04     "crlBag"         OID_P12_CRL_BAG
                     0x05     "secretBag"
                     0x06     "safeContentsBag"
             0x02             "digestAlgorithm"
-              0x02           "md2"						OID_MD2
-              0x05           "md5"						OID_MD5
+              0x02           "md2"            OID_MD2
+              0x05           "md5"            OID_MD5
             0x03             "encryptionAlgorithm"
-              0x07           "3des-ede-cbc"				OID_3DES_EDE_CBC
+              0x07           "3des-ede-cbc"       OID_3DES_EDE_CBC
       0xCE                   ""
         0x3D                 "ansi-X9-62"
           0x02               "id-publicKeyType"
-            0x01             "id-ecPublicKey"			OID_EC_PUBLICKEY
+            0x01             "id-ecPublicKey"     OID_EC_PUBLICKEY
           0x03               "ellipticCurve"
             0x00             "c-TwoCurve"
-              0x01           "c2pnb163v1"				OID_C2PNB163V1
-              0x02           "c2pnb163v2"				OID_C2PNB163V2
-              0x03           "c2pnb163v3"				OID_C2PNB163V3
-              0x04           "c2pnb176w1"				OID_C2PNB176W1
-              0x05           "c2tnb191v1"				OID_C2PNB191V1
-              0x06           "c2tnb191v2"				OID_C2PNB191V2
-              0x07           "c2tnb191v3"				OID_C2PNB191V3
-              0x08           "c2onb191v4"				OID_C2PNB191V4
-              0x09           "c2onb191v5"				OID_C2PNB191V5
-              0x0A           "c2pnb208w1"				OID_C2PNB208W1
-              0x0B           "c2tnb239v1"				OID_C2PNB239V1
-              0x0C           "c2tnb239v2"				OID_C2PNB239V2
-              0x0D           "c2tnb239v3"				OID_C2PNB239V3
-              0x0E           "c2onb239v4"				OID_C2PNB239V4
-              0x0F           "c2onb239v5"				OID_C2PNB239V5
-              0x10           "c2pnb272w1"				OID_C2PNB272W1
-              0x11           "c2pnb304w1"				OID_C2PNB304W1
-              0x12           "c2tnb359v1"				OID_C2PNB359V1
-              0x13           "c2pnb368w1"				OID_C2PNB368W1
-              0x14           "c2tnb431r1"				OID_C2PNB431R1
+              0x01           "c2pnb163v1"       OID_C2PNB163V1
+              0x02           "c2pnb163v2"       OID_C2PNB163V2
+              0x03           "c2pnb163v3"       OID_C2PNB163V3
+              0x04           "c2pnb176w1"       OID_C2PNB176W1
+              0x05           "c2tnb191v1"       OID_C2PNB191V1
+              0x06           "c2tnb191v2"       OID_C2PNB191V2
+              0x07           "c2tnb191v3"       OID_C2PNB191V3
+              0x08           "c2onb191v4"       OID_C2PNB191V4
+              0x09           "c2onb191v5"       OID_C2PNB191V5
+              0x0A           "c2pnb208w1"       OID_C2PNB208W1
+              0x0B           "c2tnb239v1"       OID_C2PNB239V1
+              0x0C           "c2tnb239v2"       OID_C2PNB239V2
+              0x0D           "c2tnb239v3"       OID_C2PNB239V3
+              0x0E           "c2onb239v4"       OID_C2PNB239V4
+              0x0F           "c2onb239v5"       OID_C2PNB239V5
+              0x10           "c2pnb272w1"       OID_C2PNB272W1
+              0x11           "c2pnb304w1"       OID_C2PNB304W1
+              0x12           "c2tnb359v1"       OID_C2PNB359V1
+              0x13           "c2pnb368w1"       OID_C2PNB368W1
+              0x14           "c2tnb431r1"       OID_C2PNB431R1
             0x01             "primeCurve"
-              0x01           "prime192v1"				OID_PRIME192V1
-              0x02           "prime192v2"				OID_PRIME192V2
-              0x03           "prime192v3"				OID_PRIME192V3
-              0x04           "prime239v1"				OID_PRIME239V1
-              0x05           "prime239v2"				OID_PRIME239V2
-              0x06           "prime239v3"				OID_PRIME239V3
-              0x07           "prime256v1"				OID_PRIME256V1
+              0x01           "prime192v1"       OID_PRIME192V1
+              0x02           "prime192v2"       OID_PRIME192V2
+              0x03           "prime192v3"       OID_PRIME192V3
+              0x04           "prime239v1"       OID_PRIME239V1
+              0x05           "prime239v2"       OID_PRIME239V2
+              0x06           "prime239v3"       OID_PRIME239V3
+              0x07           "prime256v1"       OID_PRIME256V1
           0x04               "id-ecSigType"
-            0x01             "ecdsa-with-SHA1"			OID_ECDSA_WITH_SHA1
+            0x01             "ecdsa-with-SHA1"      OID_ECDSA_WITH_SHA1
             0x03             "ecdsa-with-Specified"
-              0x01           "ecdsa-with-SHA224"		OID_ECDSA_WITH_SHA224
-              0x02           "ecdsa-with-SHA256"		OID_ECDSA_WITH_SHA256
-              0x03           "ecdsa-with-SHA384"		OID_ECDSA_WITH_SHA384
-              0x04           "ecdsa-with-SHA512"		OID_ECDSA_WITH_SHA512
+              0x01           "ecdsa-with-SHA224"    OID_ECDSA_WITH_SHA224
+              0x02           "ecdsa-with-SHA256"    OID_ECDSA_WITH_SHA256
+              0x03           "ecdsa-with-SHA384"    OID_ECDSA_WITH_SHA384
+              0x04           "ecdsa-with-SHA512"    OID_ECDSA_WITH_SHA512
+  0x70                       "BY"
+    0x00                     "by-Standard"
+      0x02                   "by-STD"
+        0x00                 "by-STB"
+          0x22               ""
+            0x65             ""
+              0x1F           "Belt"
+                0x17         "belt-cbc256"            OID_BELT_CBC
+                0x21         "belt-cfb256"            OID_BELT_CFB
+                0x2B         "belt-ctr256"            OID_BELT_CTR
+                0x35         "belt-mac256"            OID_BELT_MAC
+                0x51         "belt-hash256"           OID_BELT_HASH
+              0x2D           "Bign"
+                0x01         "BignModule"
+                  0x01       "BignModule_v1"
+                  0x02       "BignModule_v2"
+                0x02         "BignKeys"
+                  0x01       "BignPubKey"             OID_BIGN_PUB_KEY
+                0x03         "BignCurves" 
+                  0x01       "BignCurve256v1"         OID_BIGN_CURVE_256_V1
+                  0x02       "BignCurve384v1"         OID_BIGN_CURVE_384_V1
+                  0x03       "BignCurve512v1"         OID_BIGN_CURVE_512_V1
+                0x04         "BignFields"
+                  0x01       "BignPrimeField"
+                0x0B         "BignWithSpecHash"       OID_SPEC_HASH
+                0x0C         "BignWithBeltHash"       OID_HASH_BELT
+                0x15         "BignGenEC"
+                0x16         "BignValEC"
+                0x1F         "BignGenKeyPair"
+                0x20         "BignValPubKey"
+                0x29         "BignKeyTransport"
+                0x3D         "BignGenK"
+                0x47         "BignIBSwithSpecHash"
+                0x48         "BignIBSwithBeltHash"
+              0x2F           "Brng"
+                0x0C         "hmac-hbelt"             OID_BELT_HMAC
+                0x16         "brng-ctr-hbelt"
+                0x20         "brng-hmac-hbelt"
+              0x42           "Bake"
+                0x0C         "bake-bsts"
+          0x89               ""
+            0x18             "1176"
+              0x02           "STB_1176.2-99"
+                0x01         "STB_1176.2-99_Module"
+                  0x01       "STB_1176.2-99_Module_v1"          OID_MODULE_V1
+                0x02         "STB_1176.2-99_Keys"
+                  0x01       "STB_1176.2-99_PubKey"             OID_PUB_KEY
+                  0x02       "STB_1176.2-99_PrePubKey"          OID_PRE_PUB_KEY
+                  0x03       "STB_1176.2-99_BDH-PubKey"         OID_BDH_PUB_KEY
+                  0x04       "STB_1176.2-99_BDH-PrePubKey"      OID_BDH_PRE_PUB_KEY
+                0x03         "STB_1176.2-99_Params"
+                  0x03       "STB_1176.2-99_BDS_BDH_3"
+                    0x01     "STB_1176.2-99_BDS_3"              OID_BDS_3
+                    0x02     "STB_1176.2-99_BDH_3"              OID_BDH_3
+                  0x06       "STB_1176.2-99_BDS_BDH_6"
+                    0x01     "STB_1176.2-99_BDS_6"              OID_BDS_6
+                    0x02     "STB_1176.2-99_BDH_6"              OID_BDH_6
+                  0x0A       "STB_1176.2-99_BDS_BDH_10"
+                    0x01     "STB_1176.2-99_BDS_10"             OID_BDS_10
+                    0x02     "STB_1176.2-99_BDH_10"             OID_BDH_10
+                0x0B         "STB_1176.2-99_Sign"               OID_SIGN
+                0x0C         "STB_1176.2-99_PreSign"            OID_PRE_SIGN
+                0x15         "STB_1176.2-99_GenParam"           OID_GEN_PARAM
+                0x1F         "STB_1176.2-99_BDH_NoAuth"         OID_BDH_NO_AUTH
+                0x20         "STB_1176.2-99_BDH_Auth"           OID_BDH_AUTH
+                0x21         "STB_1176.2-99_BDH_OneSide"        OID_BDH_ONE_SIDE
+                0x22         "STB_1176.2-99_BDH_KeyTransport"   OID_BDH_KEY_KEY_TRANSPORT
+        0x01                 ""
+          0x81               ""
+            0xDB             ""
+              0x73           "gost28147"
+                0x0C         "gost28147-cfb"          OID_GOST28147_CFB
+                0x0D         "gost28147-ctr"          OID_GOST28147_CTR
+                0x0E         "gost28147-mac"          OID_GOST_MAC
+                0x03         ""
+                  0x01       "gost28147-sblock-1"
+    0x01                     "by-RegistrationAuthority"
+      0x00                   "by-GosStandard"
+      0x01                   "by-MPT"
+      0x02                   "by-OAC"
+      0x03                   "by-NBRB"
+        0x01                 "by-PKI_Gov"
+          0x01               "by-PKI_Gov_Ext"
+            0x01             "by-PKI_Gov_Name"
+              0x01           "by-PersonalNumber" 
+              0x02           "by-UNP"
+            0x02             "by-PKI_Gov_App"
+              0x01           "by-PublicKeyCard"
+                0x01         "by-PKC_RootCA"
+                0x02         "by-PKC_SubCA"
+                0x03         "by-PKC_RA"
+                0x04         "by-PKC_Org" 
+                0x05         "by-PKC_Person"
 0x2B                         ""
   0x06                       "dod"
     0x01                     "internet"
@@ -200,21 +316,53 @@
                   0x04       "msEncryptingFileSystem"
               0x14           "msEnrollmentInfrastructure"
                 0x02         "msCertificateTypeExtension"
-                  0x02       "msSmartcardLogon"			OID_MS_SMARTCARD_LOGON
-                  0x03       "msUPN"					OID_USER_PRINCIPAL_NAME
+                  0x02       "msSmartcardLogon"     OID_MS_SMARTCARD_LOGON
+                  0x03       "msUPN"          OID_USER_PRINCIPAL_NAME
               0x15           "msCertSrvInfrastructure"
                 0x07         "msCertTemplate"
-                0x0A         "msApplicationCertPolicies"
+                0x0A         "msApplicationCertPolicies"            
             0xA0             ""
               0x2A           "ITA"
-                0x01         "strongSwan"				OID_STRONGSWAN
+                0x01         "strongSwan"       OID_STRONGSWAN
+                0x02         "cps"
+                0x03         "e-voting"
+                0x05         "BLISS"
+                  0x01       "keyType"
+                    0x01     "blissPublicKey"     OID_BLISS_PUBLICKEY
+                  0x02       "parameters"
+                    0x01     "BLISS-I"          OID_BLISS_I
+                    0x02     "BLISS-II"         OID_BLISS_II
+                    0x03     "BLISS-III"        OID_BLISS_III
+                    0x04     "BLISS-IV"         OID_BLISS_IV
+                    0x05     "BLISS-B-I"        OID_BLISS_B_I
+                    0x06     "BLISS-B-II"       OID_BLISS_B_II
+                    0x07     "BLISS-B-III"        OID_BLISS_B_III
+                    0x08     "BLISS-B-IV"       OID_BLISS_B_IV
+                  0x03       "blissSigType"
+                    0x01     "BLISS-with-SHA512"    OID_BLISS_WITH_SHA512
+                    0x02     "BLISS-with-SHA384"    OID_BLISS_WITH_SHA384
+                    0x03     "BLISS-with-SHA256"    OID_BLISS_WITH_SHA256
+            0xBB             ""
+              0x1A           "BUTB"
+                0x01         "BUTB-TradePermissions"
+                  0x01       "BUTB-VisitorPermission"
+                  0x02       "BUTB-BrokerPermission"
+                0x02         "BUTB-TradeSectionAccess"
+                  0x01       "BUTB-SectionMetall"
+                  0x02       "BUTB-SectionTimber"
+                  0x03       "BUTB-SectionAgri"
+                  0x04       "BUTB-SectionPPT"
           0x89               ""
             0x31             ""
               0x01           ""
                 0x01         ""
                   0x02       ""
                     0x02     ""
-                      0x4B   "TCGID"					OID_TCGID
+                      0x4B   "TCGID"          OID_TCGID
+          0x97               ""
+            0x55             ""
+              0x01           ""
+                0x02         "blowfish-cbc"       OID_BLOWFISH_CBC
           0xC1               ""
             0x16             "ntruCryptosystems"
               0x01           "eess"
@@ -254,61 +402,99 @@
                     0x30     "ees593ep1"
                     0x31     "ees743ep1"
                   0x03       "eess1-encodingMethods"
+          0xDE               ""
+            0x7C             "CONTACT"
+              0x01           ""
+                0x01         "STB_1176.1-99"            OID_HASH_STB1176
+                0x02         "STB_1176.2-99"            OID_EDS_STB1176
+                0x03         "CommonKeysAlgorithm"      OID_COMMON_KEYS_ALG
+              0x02           ""
+                0x01         ""
+                  0x01       "CertificateValidity"      OID_CERT_VALID
+                  0x03       "UserType"                 OID_USER_TYPE
+                  0x05       "PrivateKeyActivationTime" OID_PRIV_KEY_ACTIV_TIME
+                  0x06       "UserContactPrivileges"    OID_USER_CONTACT_PRIVILEGES
+                0x02         ""
+                  0x01       "Nick"                     OID_NICK
+                  0x02       "Procuration"
+                    0x01     "ProcurationType"
+                    0x02     "ProcurationNumber"
+                    0x03     "ProcurationIssueDate"
+                    0x04     "PrivilegesStartTime"
+                    0x05     "PrivilegesEndTime"
+                  0x05       "District"
+                  0x0B       "PostalAddress"
+                  0x0C       "PassportData"
+                  0x0D       "MilitaryCard"
+                  0x0E       "PensionCard"
+                  0x0F       "TradeUnionCard"
+                  0x10       "StudentCard" 
+                  0x11       "IdentityCard"             OID_IDENTITY_CARD
+                    0x01     "IdentityCardName" 
+                    0x02     "IdentityCardNumber"
+                    0x03     "IdentityCardIssueDate"
+                    0x04     "IdentityCardIssuedBy"
+          0xE2               ""
+            0x70             "Avest"
+              0x05           ""
+                0x03         "avest-IdentificationNumber"
+              0x68           ""
+                0x03         "avest-UNP"
       0x05                   "security"
         0x05                 "mechanisms"
           0x07               "id-pkix"
             0x01             "id-pe"
-              0x01           "authorityInfoAccess"		OID_AUTHORITY_INFO_ACCESS
+              0x01           "authorityInfoAccess"    OID_AUTHORITY_INFO_ACCESS
               0x03           "qcStatements"
-              0x07           "ipAddrBlocks"				OID_IP_ADDR_BLOCKS
+              0x07           "ipAddrBlocks"       OID_IP_ADDR_BLOCKS
             0x02             "id-qt"
-              0x01           "cps"						OID_POLICY_QUALIFIER_CPS
-              0x02           "unotice"					OID_POLICY_QUALIFIER_UNOTICE
+              0x01           "cps"            OID_POLICY_QUALIFIER_CPS
+              0x02           "unotice"          OID_POLICY_QUALIFIER_UNOTICE
             0x03             "id-kp"
-              0x01           "serverAuth"				OID_SERVER_AUTH
-              0x02           "clientAuth"				OID_CLIENT_AUTH
+              0x01           "serverAuth"       OID_SERVER_AUTH
+              0x02           "clientAuth"       OID_CLIENT_AUTH
               0x03           "codeSigning"
               0x04           "emailProtection"
               0x05           "ipsecEndSystem"
               0x06           "ipsecTunnel"
               0x07           "ipsecUser"
               0x08           "timeStamping"
-              0x09           "ocspSigning"				OID_OCSP_SIGNING
+              0x09           "ocspSigning"        OID_OCSP_SIGNING
             0x08             "id-otherNames"
               0x01           "personalData"
               0x02           "userGroup"
               0x03           "id-on-permanentIdentifier"
               0x04           "id-on-hardwareModuleName"
-              0x05           "xmppAddr"					OID_XMPP_ADDR
+              0x05           "xmppAddr"         OID_XMPP_ADDR
               0x06           "id-on-SIM"
               0x07           "id-on-dnsSRV"
             0x0A             "id-aca"
-              0x01           "authenticationInfo"		OID_AUTHENTICATION_INFO
-              0x02           "accessIdentity"			OID_ACCESS_IDENTITY
-              0x03           "chargingIdentity"			OID_CHARGING_IDENTITY
-              0x04           "group"					OID_GROUP
+              0x01           "authenticationInfo"   OID_AUTHENTICATION_INFO
+              0x02           "accessIdentity"     OID_ACCESS_IDENTITY
+              0x03           "chargingIdentity"     OID_CHARGING_IDENTITY
+              0x04           "group"          OID_GROUP
             0x0B             "subjectInfoAccess"
             0x30             "id-ad"
-              0x01           "ocsp"						OID_OCSP
-                0x01         "basic"					OID_BASIC
-                0x02         "nonce"					OID_NONCE
-                0x03         "crl"						OID_CRL
-                0x04         "response"					OID_RESPONSE
-                0x05         "noCheck"					OID_NO_CHECK
-                0x06         "archiveCutoff"			OID_ARCHIVE_CUTOFF
-                0x07         "serviceLocator"			OID_SERVICE_LOCATOR
-              0x02           "caIssuers"				OID_CA_ISSUERS
+              0x01           "ocsp"           OID_OCSP
+                0x01         "basic"          OID_BASIC
+                0x02         "nonce"          OID_NONCE
+                0x03         "crl"            OID_CRL
+                0x04         "response"         OID_RESPONSE
+                0x05         "noCheck"          OID_NO_CHECK
+                0x06         "archiveCutoff"      OID_ARCHIVE_CUTOFF
+                0x07         "serviceLocator"     OID_SERVICE_LOCATOR
+              0x02           "caIssuers"        OID_CA_ISSUERS
               0x03           "timeStamping"
               0x05           "caRepository"
           0x08               "ipsec"
             0x02             "certificate"
-              0x02           "iKEIntermediate"			OID_IKE_INTERMEDIATE
+              0x02           "iKEIntermediate"      OID_IKE_INTERMEDIATE
   0x0E                       "oiw"
     0x03                     "secsig"
       0x02                   "algorithms"
-        0x07                 "des-cbc"					OID_DES_CBC
-        0x1A                 "sha-1"					OID_SHA1
-        0x1D                 "sha-1WithRSASignature"	OID_SHA1_WITH_RSA_OIW
+        0x07                 "des-cbc"          OID_DES_CBC
+        0x1A                 "sha-1"          OID_SHA1
+        0x1D                 "sha-1WithRSASignature"  OID_SHA1_WITH_RSA_OIW
   0x24                       "TeleTrusT"
     0x03                     "algorithm"
       0x03                   "signatureAlgorithm"
@@ -327,15 +513,15 @@
                 0x01         "basisType"
                   0x01       "ipBasis"
             0x02             "keyType"
-              0x01           "ecgPublicKey"				OID_ECGDSA_PUBKEY
+              0x01           "ecgPublicKey"       OID_ECGDSA_PUBKEY
             0x03             "curve"
             0x04             "signatures"
-              0x01           "ecgdsa-with-RIPEMD160"	OID_ECGDSA_SIG_WITH_RIPEMD160
-              0x02           "ecgdsa-with-SHA1"			OID_ECGDSA_SIG_WITH_SHA1
-              0x03           "ecgdsa-with-SHA224"		OID_ECGDSA_SIG_WITH_SHA224
-              0x04           "ecgdsa-with-SHA256"		OID_ECGDSA_SIG_WITH_SHA256
-              0x05           "ecgdsa-with-SHA384"		OID_ECGDSA_SIG_WITH_SHA384
-              0x06           "ecgdsa-with-SHA512"		OID_ECGDSA_SIG_WITH_SHA512
+              0x01           "ecgdsa-with-RIPEMD160"  OID_ECGDSA_SIG_WITH_RIPEMD160
+              0x02           "ecgdsa-with-SHA1"     OID_ECGDSA_SIG_WITH_SHA1
+              0x03           "ecgdsa-with-SHA224"   OID_ECGDSA_SIG_WITH_SHA224
+              0x04           "ecgdsa-with-SHA256"   OID_ECGDSA_SIG_WITH_SHA256
+              0x05           "ecgdsa-with-SHA384"   OID_ECGDSA_SIG_WITH_SHA384
+              0x06           "ecgdsa-with-SHA512"   OID_ECGDSA_SIG_WITH_SHA512
             0x05             "module"
               0x01           "1"
           0x08               "ecStdCurvesAndGeneration"
@@ -358,37 +544,37 @@
   0x81                       ""
     0x04                     "Certicom"
       0x00                   "curve"
-        0x01                 "sect163k1"				OID_SECT163K1
-        0x02                 "sect163r1"				OID_SECT163R1
-        0x03                 "sect239k1"				OID_SECT239K1
-        0x04                 "sect113r1"				OID_SECT113R1
-        0x05                 "sect113r2"				OID_SECT113R2
-        0x06                 "secp112r1"				OID_SECT112R1
-        0x07                 "secp112r2"				OID_SECT112R2
-        0x08                 "secp160r1"				OID_SECT160R1
-        0x09                 "secp160k1"				OID_SECT160K1
-        0x0A                 "secp256k1"				OID_SECT256K1
-        0x0F                 "sect163r2"				OID_SECT163R2
-        0x10                 "sect283k1"				OID_SECT283K1
-        0x11                 "sect283r1"				OID_SECT283R1
-        0x16                 "sect131r1"				OID_SECT131R1
-        0x17                 "sect131r2"				OID_SECT131R2
-        0x18                 "sect193r1"				OID_SECT193R1
-        0x19                 "sect193r2"				OID_SECT193R2
-        0x1A                 "sect233k1"				OID_SECT233K1
-        0x1B                 "sect233r1"				OID_SECT233R1
-        0x1C                 "secp128r1"				OID_SECT128R1
-        0x1D                 "secp128r2"				OID_SECT128R2
-        0x1E                 "secp160r2"				OID_SECT160R2
-        0x1F                 "secp192k1"				OID_SECT192K1
-        0x20                 "secp224k1"				OID_SECT224K1
-        0x21                 "secp224r1"				OID_SECT224R1
-        0x22                 "secp384r1"				OID_SECT384R1
-        0x23                 "secp521r1"				OID_SECT521R1
-        0x24                 "sect409k1"				OID_SECT409K1
-        0x25                 "sect409r1"				OID_SECT409R1
-        0x26                 "sect571k1"				OID_SECT571K1
-        0x27                 "sect571r1"				OID_SECT571R1
+        0x01                 "sect163k1"        OID_SECT163K1
+        0x02                 "sect163r1"        OID_SECT163R1
+        0x03                 "sect239k1"        OID_SECT239K1
+        0x04                 "sect113r1"        OID_SECT113R1
+        0x05                 "sect113r2"        OID_SECT113R2
+        0x06                 "secp112r1"        OID_SECT112R1
+        0x07                 "secp112r2"        OID_SECT112R2
+        0x08                 "secp160r1"        OID_SECT160R1
+        0x09                 "secp160k1"        OID_SECT160K1
+        0x0A                 "secp256k1"        OID_SECT256K1
+        0x0F                 "sect163r2"        OID_SECT163R2
+        0x10                 "sect283k1"        OID_SECT283K1
+        0x11                 "sect283r1"        OID_SECT283R1
+        0x16                 "sect131r1"        OID_SECT131R1
+        0x17                 "sect131r2"        OID_SECT131R2
+        0x18                 "sect193r1"        OID_SECT193R1
+        0x19                 "sect193r2"        OID_SECT193R2
+        0x1A                 "sect233k1"        OID_SECT233K1
+        0x1B                 "sect233r1"        OID_SECT233R1
+        0x1C                 "secp128r1"        OID_SECT128R1
+        0x1D                 "secp128r2"        OID_SECT128R2
+        0x1E                 "secp160r2"        OID_SECT160R2
+        0x1F                 "secp192k1"        OID_SECT192K1
+        0x20                 "secp224k1"        OID_SECT224K1
+        0x21                 "secp224r1"        OID_SECT224R1
+        0x22                 "secp384r1"        OID_SECT384R1
+        0x23                 "secp521r1"        OID_SECT521R1
+        0x24                 "sect409k1"        OID_SECT409K1
+        0x25                 "sect409r1"        OID_SECT409R1
+        0x26                 "sect571k1"        OID_SECT571K1
+        0x27                 "sect571r1"        OID_SECT571R1
 0x60                         ""
   0x86                       ""
     0x48                     ""
@@ -397,20 +583,20 @@
           0x03               "csor"
             0x04             "nistalgorithm"
               0x01           "aes"
-                0x02         "id-aes128-CBC"			OID_AES128_CBC
-                0x06         "id-aes128-GCM"			OID_AES128_GCM
-                0x07         "id-aes128-CCM"			OID_AES128_CCM
-                0x16         "id-aes192-CBC"			OID_AES192_CBC
-                0x1A         "id-aes192-GCM"			OID_AES192_GCM
-                0x1B         "id-aes192-CCM"			OID_AES192_CCM
-                0x2A         "id-aes256-CBC"			OID_AES256_CBC
-                0x2E         "id-aes256-GCM"			OID_AES256_GCM
-                0x2F         "id-aes256-CCM"			OID_AES256_CCM
+                0x02         "id-aes128-CBC"      OID_AES128_CBC
+                0x06         "id-aes128-GCM"      OID_AES128_GCM
+                0x07         "id-aes128-CCM"      OID_AES128_CCM
+                0x16         "id-aes192-CBC"      OID_AES192_CBC
+                0x1A         "id-aes192-GCM"      OID_AES192_GCM
+                0x1B         "id-aes192-CCM"      OID_AES192_CCM
+                0x2A         "id-aes256-CBC"      OID_AES256_CBC
+                0x2E         "id-aes256-GCM"      OID_AES256_GCM
+                0x2F         "id-aes256-CCM"      OID_AES256_CCM
               0x02           "hashalgs"
-                0x01         "id-sha256"				OID_SHA256
-                0x02         "id-sha384"				OID_SHA384
-                0x03         "id-sha512"				OID_SHA512
-                0x04         "id-sha224"				OID_SHA224
+                0x01         "id-sha256"        OID_SHA256
+                0x02         "id-sha384"        OID_SHA384
+                0x03         "id-sha512"        OID_SHA512
+                0x04         "id-sha224"        OID_SHA224
                 0x05         "id-sha512-224"
                 0x06         "id-sha512-256"
                 0x07         "id-sha3-224"
@@ -424,30 +610,30 @@
             0x42             "netscape"
               0x01           ""
                 0x01         "nsCertType"
-                0x03         "nsRevocationUrl"			OID_NS_REVOCATION_URL
-                0x04         "nsCaRevocationUrl"		OID_NS_CA_REVOCATION_URL
-                0x08         "nsCaPolicyUrl"			OID_NS_CA_POLICY_URL
-                0x0d         "nsComment"				OID_NS_COMMENT
+                0x03         "nsRevocationUrl"      OID_NS_REVOCATION_URL
+                0x04         "nsCaRevocationUrl"    OID_NS_CA_REVOCATION_URL
+                0x08         "nsCaPolicyUrl"      OID_NS_CA_POLICY_URL
+                0x0d         "nsComment"        OID_NS_COMMENT
               0x03           "directory"
                 0x01         ""
-                  0x03       "employeeNumber"			OID_EMPLOYEE_NUMBER
+                  0x03       "employeeNumber"     OID_EMPLOYEE_NUMBER
               0x04           "policy"
                 0x01         "nsSGC"
             0x45             "verisign"
               0x01           "pki"
                 0x09         "attributes"
-                  0x02       "messageType"				OID_PKI_MESSAGE_TYPE
-                  0x03       "pkiStatus"				OID_PKI_STATUS
-                  0x04       "failInfo"					OID_PKI_FAIL_INFO
-                  0x05       "senderNonce"				OID_PKI_SENDER_NONCE
-                  0x06       "recipientNonce"			OID_PKI_RECIPIENT_NONCE
-                  0x07       "transID"					OID_PKI_TRANS_ID
+                  0x02       "messageType"        OID_PKI_MESSAGE_TYPE
+                  0x03       "pkiStatus"        OID_PKI_STATUS
+                  0x04       "failInfo"         OID_PKI_FAIL_INFO
+                  0x05       "senderNonce"        OID_PKI_SENDER_NONCE
+                  0x06       "recipientNonce"     OID_PKI_RECIPIENT_NONCE
+                  0x07       "transID"          OID_PKI_TRANS_ID
                   0x08       "extensionReq"
 0x67                         ""
   0x81                       ""
     0x05                     ""
       0x02                   "tcg-attribute"
-        0x01                 "tcg-at-tpmManufacturer"	OID_TPM_MANUFACTURER
-        0x02                 "tcg-at-tpmModel"			OID_TPM_MODEL
-        0x03                 "tcg-at-tpmVersion"		OID_TPM_VERSION
-        0x0F                 "tcg-at-tpmIdLabel"		OID_TPM_ID_LABEL
+        0x01                 "tcg-at-tpmManufacturer" OID_TPM_MANUFACTURER
+        0x02                 "tcg-at-tpmModel"      OID_TPM_MODEL
+        0x03                 "tcg-at-tpmVersion"    OID_TPM_VERSION
+        0x0F                 "tcg-at-tpmIdLabel"    OID_TPM_ID_LABEL
\ No newline at end of file
diff --git a/strongswan-5.2.0/src/libstrongswan/credentials/builder.c b/strongswan-5.2.0/src/libstrongswan/credentials/builder.c
index ddb64ef..78ce3d9 100644
--- a/strongswan-5.2.0/src/libstrongswan/credentials/builder.c
+++ b/strongswan-5.2.0/src/libstrongswan/credentials/builder.c
@@ -11,7 +11,29 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
- */
+ */ 
+
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 #include "builder.h"
 
@@ -70,5 +92,8 @@ ENUM(builder_part_names, BUILD_FROM_FILE, BUILD_END,
 	"BUILD_SAFE_PRIMES",
 	"BUILD_SHARES",
 	"BUILD_THRESHOLD",
+	"BUILD_USBBAR_PASS",
+	"BUILD_BLOB_STB1176_KEY",
+	"BUILD_PUB_FROM_PRIV",
 	"BUILD_END",
 );
diff --git a/strongswan-5.2.0/src/libstrongswan/credentials/builder.h b/strongswan-5.2.0/src/libstrongswan/credentials/builder.h
index 627e093..6af027a 100644
--- a/strongswan-5.2.0/src/libstrongswan/credentials/builder.h
+++ b/strongswan-5.2.0/src/libstrongswan/credentials/builder.h
@@ -11,7 +11,29 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
- */
+ */ 
+
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 /**
  * @defgroup builder builder
@@ -151,6 +173,12 @@ enum builder_part_t {
 	BUILD_SHARES,
 	/** minimum number of participating private key shares */
 	BUILD_THRESHOLD,
+	/** usb barrier wraped password file path */
+	BUILD_USBBAR_PASS,
+	/** */
+	BUILD_BLOB_CONTACT_KEY,
+	/** */ 
+	BUILD_PUB_FROM_PRIV,
 	/** end of variable argument builder list */
 	BUILD_END,
 };
diff --git a/strongswan-5.2.0/src/libstrongswan/credentials/cred_encoding.h b/strongswan-5.2.0/src/libstrongswan/credentials/cred_encoding.h
index a6c9c30..6d16c3e 100644
--- a/strongswan-5.2.0/src/libstrongswan/credentials/cred_encoding.h
+++ b/strongswan-5.2.0/src/libstrongswan/credentials/cred_encoding.h
@@ -11,7 +11,29 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
- */
+ */ 
+
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 /**
  * @defgroup cred_encoding cred_encoding
@@ -71,6 +93,8 @@ enum cred_encoding_type_t {
 	KEYID_PGPV3,
 	/** PGPv4 fingerprint */
 	KEYID_PGPV4,
+	/** BELT fingerprint over subjectPublicKey */
+	KEYID_PUBKEY_BELT,
 
 	KEYID_MAX,
 
@@ -98,6 +122,11 @@ enum cred_encoding_type_t {
 	CERT_PEM,
 	/** PGP Packet encoded certificate */
 	CERT_PGP_PKT,
+	
+	/** BIGN subjectPublicKeyInfo encoding */
+	PUBKEY_SPKI_BIGN_ASN1_DER,
+	/** subjectPublicKey encoding */
+	PUBKEY_SPK_ASN1_DER,
 
 	CRED_ENCODING_MAX,
 };
@@ -144,6 +173,8 @@ enum cred_encoding_part_t {
 	CRED_PART_PKCS10_ASN1_DER,
 	/** a PGP encoded certificate */
 	CRED_PART_PGP_CERT,
+	/** a raw key value */
+	CRED_PART_RAW_KEY,
 
 	CRED_PART_END,
 };
diff --git a/strongswan-5.2.0/src/libstrongswan/credentials/keys/public_key.c b/strongswan-5.2.0/src/libstrongswan/credentials/keys/public_key.c
index 37bba77..656cc51 100644
--- a/strongswan-5.2.0/src/libstrongswan/credentials/keys/public_key.c
+++ b/strongswan-5.2.0/src/libstrongswan/credentials/keys/public_key.c
@@ -12,19 +12,43 @@
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
  */
+ 
 
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
+ 
 #include <asn1/oid.h>
 
 #include "public_key.h"
 
-ENUM(key_type_names, KEY_ANY, KEY_DSA,
+ENUM(key_type_names, KEY_ANY, KEY_BIGN,
 	"ANY",
 	"RSA",
 	"ECDSA",
-	"DSA"
+	"DSA",
+	"BIGN",
 );
 
-ENUM(signature_scheme_names, SIGN_UNKNOWN, SIGN_ECDSA_521,
+ENUM(signature_scheme_names, SIGN_UNKNOWN, SIGN_BIGN_WITH_HBELT,
 	"UNKNOWN",
 	"RSA_EMSA_PKCS1_NULL",
 	"RSA_EMSA_PKCS1_MD5",
@@ -41,6 +65,7 @@ ENUM(signature_scheme_names, SIGN_UNKNOWN, SIGN_ECDSA_521,
 	"ECDSA-256",
 	"ECDSA-384",
 	"ECDSA-521",
+	"BIGN_WITH_HBELT",
 );
 
 ENUM(encryption_scheme_names, ENCRYPT_UNKNOWN, ENCRYPT_RSA_OAEP_SHA512,
@@ -130,8 +155,11 @@ signature_scheme_t signature_scheme_from_oid(int oid)
 			return SIGN_ECDSA_WITH_SHA384_DER;
 		case OID_ECDSA_WITH_SHA512:
 			return SIGN_ECDSA_WITH_SHA512_DER;
+		case OID_HASH_BELT:
+			return SIGN_BIGN_WITH_HBELT;
 		default:
 			return SIGN_UNKNOWN;
+
 	}
 }
 
diff --git a/strongswan-5.2.0/src/libstrongswan/credentials/keys/public_key.h b/strongswan-5.2.0/src/libstrongswan/credentials/keys/public_key.h
index 2afcf83..98d4a8d 100644
--- a/strongswan-5.2.0/src/libstrongswan/credentials/keys/public_key.h
+++ b/strongswan-5.2.0/src/libstrongswan/credentials/keys/public_key.h
@@ -11,7 +11,29 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
- */
+ */ 
+
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 /**
  * @defgroup public_key public_key
@@ -42,7 +64,8 @@ enum key_type_t {
 	KEY_ECDSA = 2,
 	/** DSA */
 	KEY_DSA   = 3,
-	/** ElGamal, ... */
+	/** BIGN pub key */
+	KEY_BIGN = 4,
 };
 
 /**
@@ -90,6 +113,8 @@ enum signature_scheme_t {
 	SIGN_ECDSA_384,
 	/** ECDSA on the P-521 curve with SHA-512 as in RFC 4754           */
 	SIGN_ECDSA_521,
+	/** STB 34.101.45 signature with Belt-HASH 						   */
+	SIGN_BIGN_WITH_HBELT,
 };
 
 /**
diff --git a/strongswan-5.2.0/src/libstrongswan/crypto/crypters/crypter.c b/strongswan-5.2.0/src/libstrongswan/crypto/crypters/crypter.c
index 8123add..e1e4646 100644
--- a/strongswan-5.2.0/src/libstrongswan/crypto/crypters/crypter.c
+++ b/strongswan-5.2.0/src/libstrongswan/crypto/crypters/crypter.c
@@ -12,7 +12,29 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
- */
+ */ 
+
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 #include <asn1/oid.h>
 
@@ -46,8 +68,14 @@ ENUM_NEXT(encryption_algorithm_names, ENCR_CAMELLIA_CBC, ENCR_CAMELLIA_CCM_ICV16
 	"CAMELLIA_CCM_8",
 	"CAMELLIA_CCM_12",
 	"CAMELLIA_CCM_16");
-ENUM_NEXT(encryption_algorithm_names, ENCR_UNDEFINED, ENCR_RC2_CBC, ENCR_CAMELLIA_CCM_ICV16,
-	"UNDEFINED",
+ENUM_NEXT(encryption_algorithm_names, ENCR_GOST28147_CTR, ENCR_UNDEFINED, ENCR_CAMELLIA_CCM_ICV16,
+	"GOST28147_CTR",
+	"GOST28147_CFB",
+	"BELT_CBC",
+	"BELT_CFB",
+	"BELT_CTR",
+	"UNDEFINED");
+ENUM_NEXT(encryption_algorithm_names, ENCR_DES_ECB, ENCR_RC2_CBC, ENCR_UNDEFINED,
 	"DES_ECB",
 	"SERPENT_CBC",
 	"TWOFISH_CBC",
@@ -96,6 +124,26 @@ encryption_algorithm_t encryption_algorithm_from_oid(int oid, size_t *key_size)
 			alg = ENCR_CAMELLIA_CBC;
 			alg_key_size = 256;
 			break;
+		case OID_GOST28147_CTR:
+			alg = ENCR_GOST28147_CTR;
+			alg_key_size = 256;
+			break;
+		case OID_GOST28147_CFB:
+			alg = ENCR_GOST28147_CFB;
+			alg_key_size = 256;
+			break;
+		case OID_BELT_CBC:
+			alg = ENCR_BELT_CBC;
+			alg_key_size = 256;
+			break;		
+		case OID_BELT_CFB:
+			alg = ENCR_BELT_CFB;
+			alg_key_size = 256;
+			break;		
+		case OID_BELT_CTR:
+			alg = ENCR_BELT_CTR;
+			alg_key_size = 256;
+			break;		
 		default:
 			alg = ENCR_UNDEFINED;
 			alg_key_size = 0;
@@ -154,6 +202,21 @@ int encryption_algorithm_to_oid(encryption_algorithm_t alg, size_t key_size)
 					oid = OID_UNKNOWN;
 			}
 			break;
+		case ENCR_GOST28147_CTR:
+			oid = OID_GOST28147_CTR;
+			break;
+		case ENCR_GOST28147_CFB:
+			oid = OID_GOST28147_CFB;
+			break;
+		case ENCR_BELT_CBC:
+			oid = OID_BELT_CBC;
+			break;
+		case ENCR_BELT_CFB:
+			oid = OID_BELT_CFB;
+			break;
+		case ENCR_BELT_CTR:
+			oid = OID_BELT_CTR;
+			break;
 		default:
 			oid = OID_UNKNOWN;
 	}
diff --git a/strongswan-5.2.0/src/libstrongswan/crypto/crypters/crypter.h b/strongswan-5.2.0/src/libstrongswan/crypto/crypters/crypter.h
index 849aea5..4cc867b 100644
--- a/strongswan-5.2.0/src/libstrongswan/crypto/crypters/crypter.h
+++ b/strongswan-5.2.0/src/libstrongswan/crypto/crypters/crypter.h
@@ -12,7 +12,29 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
- */
+ */ 
+
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 /**
  * @defgroup crypter crypter
@@ -57,6 +79,11 @@ enum encryption_algorithm_t {
 	ENCR_CAMELLIA_CCM_ICV8 =  25,
 	ENCR_CAMELLIA_CCM_ICV12 = 26,
 	ENCR_CAMELLIA_CCM_ICV16 = 27,
+	ENCR_GOST28147_CTR =  	  28,
+	ENCR_GOST28147_CFB = 	  29,
+	ENCR_BELT_CBC =		 	  30,
+	ENCR_BELT_CFB =		 	  31,
+	ENCR_BELT_CTR =		 	  32,
 	ENCR_UNDEFINED =        1024,
 	ENCR_DES_ECB =          1025,
 	ENCR_SERPENT_CBC =      1026,
@@ -71,6 +98,11 @@ enum encryption_algorithm_t {
 #define CAMELLIA_BLOCK_SIZE		16
 #define SERPENT_BLOCK_SIZE		16
 #define TWOFISH_BLOCK_SIZE		16
+#define GOST_BLOCK_SIZE 		 8
+#define BELT_BLOCK_SIZE 	    16
+
+#define BELT_IV_SIZE			16
+
 
 /**
  * For RC2, if the effective key size in bits is not key_size * 8, it should
diff --git a/strongswan-5.2.0/src/libstrongswan/crypto/crypto_factory.c b/strongswan-5.2.0/src/libstrongswan/crypto/crypto_factory.c
index 96fbc0d..bf2d9aa 100644
--- a/strongswan-5.2.0/src/libstrongswan/crypto/crypto_factory.c
+++ b/strongswan-5.2.0/src/libstrongswan/crypto/crypto_factory.c
@@ -12,7 +12,29 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
- */
+ */ 
+
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 #include "crypto_factory.h"
 
@@ -54,6 +76,7 @@ struct entry_t {
 		rng_constructor_t create_rng;
 		nonce_gen_constructor_t create_nonce_gen;
 		dh_constructor_t create_dh;
+		key_tfmer_constructor_t create_key_tfmer;
 		void *create;
 	};
 };
@@ -110,6 +133,11 @@ struct private_crypto_factory_t {
 	 */
 	linked_list_t *dhs;
 
+	/**
+	 * registered key transformers, as entry_t
+	 */
+	linked_list_t *transformers;
+
 	/**
 	 * test manager to test crypto algorithms
 	 */
@@ -389,6 +417,32 @@ METHOD(crypto_factory_t, create_dh, diffie_hellman_t*,
 	return diffie_hellman;
 }
 
+METHOD(crypto_factory_t, create_key_transformer, key_transformer_t*,
+	private_crypto_factory_t* this, key_transform_alorithm_t algo)
+{
+	enumerator_t *enumerator;
+	entry_t *entry;
+	key_transformer_t *key_transformer = NULL;
+
+	this->lock->read_lock(this->lock);
+	enumerator = this->transformers->create_enumerator(this->transformers);
+	while (enumerator->enumerate(enumerator, &entry))
+	{
+		if (entry->algo == algo)
+		{
+			key_transformer = entry->create_key_tfmer(algo);
+			if (key_transformer)
+			{
+				break;
+			}
+		}
+	}
+	enumerator->destroy(enumerator);
+	this->lock->unlock(this->lock);
+
+	return key_transformer;
+}
+
 /**
  * Insert an algorithm entry to a list
  *
@@ -716,6 +770,34 @@ METHOD(crypto_factory_t, remove_dh, void,
 	this->lock->unlock(this->lock);
 }
 
+METHOD(crypto_factory_t, add_key_transformer, bool,
+	private_crypto_factory_t *this, key_transform_alorithm_t algo,
+	const char *plugin_name, key_tfmer_constructor_t create)
+{
+	add_entry(this, this->transformers, algo, plugin_name, 0, create);
+	return TRUE;
+}
+
+METHOD(crypto_factory_t, remove_key_transformer, void,
+	private_crypto_factory_t *this, key_tfmer_constructor_t create)
+{
+	entry_t *entry;
+	enumerator_t *enumerator;
+
+	this->lock->write_lock(this->lock);
+	enumerator = this->transformers->create_enumerator(this->transformers);
+	while (enumerator->enumerate(enumerator, &entry))
+	{
+		if (entry->create_key_tfmer == create)
+		{
+			this->transformers->remove_at(this->transformers, enumerator);
+			free(entry);
+		}
+	}
+	enumerator->destroy(enumerator);
+	this->lock->unlock(this->lock);
+}
+
 /**
  * match algorithms of an entry?
  */
@@ -875,6 +957,23 @@ METHOD(crypto_factory_t, create_nonce_gen_enumerator, enumerator_t*,
 	return create_enumerator(this, this->nonce_gens, nonce_gen_filter);
 }
 
+/**
+ * Filter function to enumerate algorithm, not entry
+ */
+static bool key_transformer_filter(void *n, entry_t **entry, 
+	key_transform_alorithm_t *algo, void *i2, const char **plugin_name)
+{
+	*algo = (*entry)->algo;
+	*plugin_name = (*entry)->plugin_name;
+	return TRUE;
+}
+
+METHOD(crypto_factory_t, create_key_transformer_enumerator, enumerator_t*,
+	private_crypto_factory_t *this)
+{
+	return create_enumerator(this, this->transformers, key_transformer_filter);
+}
+
 METHOD(crypto_factory_t, add_test_vector, void,
 	private_crypto_factory_t *this, transform_type_t type, void *vector)
 {
@@ -915,6 +1014,7 @@ METHOD(crypto_factory_t, destroy, void,
 	this->rngs->destroy(this->rngs);
 	this->nonce_gens->destroy(this->nonce_gens);
 	this->dhs->destroy(this->dhs);
+	this->transformers->destroy(this->transformers);
 	this->tester->destroy(this->tester);
 	this->lock->destroy(this->lock);
 	free(this);
@@ -937,6 +1037,7 @@ crypto_factory_t *crypto_factory_create()
 			.create_rng = _create_rng,
 			.create_nonce_gen = _create_nonce_gen,
 			.create_dh = _create_dh,
+			.create_key_transformer = _create_key_transformer,
 			.add_crypter = _add_crypter,
 			.remove_crypter = _remove_crypter,
 			.add_aead = _add_aead,
@@ -953,6 +1054,8 @@ crypto_factory_t *crypto_factory_create()
 			.remove_nonce_gen = _remove_nonce_gen,
 			.add_dh = _add_dh,
 			.remove_dh = _remove_dh,
+			.add_key_transformer = _add_key_transformer,
+			.remove_key_transformer = _remove_key_transformer,
 			.create_crypter_enumerator = _create_crypter_enumerator,
 			.create_aead_enumerator = _create_aead_enumerator,
 			.create_signer_enumerator = _create_signer_enumerator,
@@ -961,6 +1064,7 @@ crypto_factory_t *crypto_factory_create()
 			.create_dh_enumerator = _create_dh_enumerator,
 			.create_rng_enumerator = _create_rng_enumerator,
 			.create_nonce_gen_enumerator = _create_nonce_gen_enumerator,
+			.create_key_transformer_enumerator = _create_key_transformer_enumerator,
 			.add_test_vector = _add_test_vector,
 			.get_test_vector_failures = _get_test_vector_failures,
 			.destroy = _destroy,
@@ -973,6 +1077,7 @@ crypto_factory_t *crypto_factory_create()
 		.rngs = linked_list_create(),
 		.nonce_gens = linked_list_create(),
 		.dhs = linked_list_create(),
+		.transformers = linked_list_create(),
 		.lock = rwlock_create(RWLOCK_TYPE_DEFAULT),
 		.tester = crypto_tester_create(),
 		.test_on_add = lib->settings->get_bool(lib->settings,
diff --git a/strongswan-5.2.0/src/libstrongswan/crypto/crypto_factory.h b/strongswan-5.2.0/src/libstrongswan/crypto/crypto_factory.h
index 7865bcb..74aba4e 100644
--- a/strongswan-5.2.0/src/libstrongswan/crypto/crypto_factory.h
+++ b/strongswan-5.2.0/src/libstrongswan/crypto/crypto_factory.h
@@ -12,6 +12,28 @@
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
  */
+ 
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 /**
  * @defgroup crypto_factory crypto_factory
@@ -33,6 +55,7 @@ typedef struct crypto_factory_t crypto_factory_t;
 #include <crypto/rngs/rng.h>
 #include <crypto/nonce_gen.h>
 #include <crypto/diffie_hellman.h>
+#include <crypto/key_transformer.h>
 #include <crypto/transform.h>
 
 #define CRYPTO_MAX_ALG_LINE          120   /* characters */
@@ -80,6 +103,11 @@ typedef nonce_gen_t* (*nonce_gen_constructor_t)();
  */
 typedef diffie_hellman_t* (*dh_constructor_t)(diffie_hellman_group_t group, ...);
 
+/**
+ * Constructor function for key transformer
+ */
+typedef key_transformer_t* (*key_tfmer_constructor_t)(key_transform_alorithm_t algo);
+
 /**
  * Handles crypto modules and creates instances.
  */
@@ -158,6 +186,15 @@ struct crypto_factory_t {
 	diffie_hellman_t* (*create_dh)(crypto_factory_t *this,
 								   diffie_hellman_group_t group, ...);
 
+	/**
+	 * Create a key transformer instance.
+	 *
+	 * @param algo 			key transform algorithm to use
+	 * @return 				key_transformer_t instance, NULL if not supported
+	 */
+	key_transformer_t* (*create_key_transformer)(crypto_factory_t *this, 
+											key_transform_alorithm_t algo);
+
 	/**
 	 * Register a crypter constructor.
 	 *
@@ -302,6 +339,27 @@ struct crypto_factory_t {
 	 */
 	void (*remove_dh)(crypto_factory_t *this, dh_constructor_t create);
 
+	/**
+	 * Register key transformer constructor.
+	 *
+	 * @param algo			algorithm to constructor
+	 * @param plugin_name	plugin that registered this algorithm
+	 * @param create		constructor function for that algorithm
+	 * @return				TRUE if registered, FALSE if test vector failed
+	 */
+	bool (*add_key_transformer)(crypto_factory_t *this,
+								key_transform_alorithm_t algo, 
+								const char *plugin_name,
+								key_tfmer_constructor_t create);
+
+	/**
+	 * Unregister key transformer constructor.
+	 *
+	 * @param create		constructor function to unregiste
+	 */
+	void (*remove_key_transformer)(crypto_factory_t *this,
+								key_tfmer_constructor_t create);
+
 	/**
 	 * Create an enumerator over all registered crypter algorithms.
 	 *
@@ -358,6 +416,13 @@ struct crypto_factory_t {
 	 */
 	enumerator_t* (*create_nonce_gen_enumerator)(crypto_factory_t *this);
 
+	/**
+	 * Create an enumerator over all registered key transformers.
+	 *
+	 * @return				enumerator over key_transform_alorithm_t, plugin
+	 */
+	enumerator_t* (*create_key_transformer_enumerator)(crypto_factory_t *this);
+
 	/**
 	 * Add a test vector to the crypto factory.
 	 *
diff --git a/strongswan-5.2.0/src/libstrongswan/crypto/diffie_hellman.c b/strongswan-5.2.0/src/libstrongswan/crypto/diffie_hellman.c
index 5c1d08d..79648d5 100644
--- a/strongswan-5.2.0/src/libstrongswan/crypto/diffie_hellman.c
+++ b/strongswan-5.2.0/src/libstrongswan/crypto/diffie_hellman.c
@@ -13,7 +13,29 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
- */
+ */ 
+
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 #include "diffie_hellman.h"
 
@@ -42,7 +64,9 @@ ENUM_NEXT(diffie_hellman_group_names, MODP_1024_160, ECP_512_BP, ECP_521_BIT,
 	"ECP_256_BP",
 	"ECP_384_BP",
 	"ECP_512_BP");
-ENUM_NEXT(diffie_hellman_group_names, MODP_NULL, MODP_CUSTOM, ECP_512_BP,
+ENUM_NEXT(diffie_hellman_group_names, ECP_256_BIGN, ECP_256_BIGN, ECP_512_BP,
+	"ECP_256_BIGN");
+ENUM_NEXT(diffie_hellman_group_names, MODP_NULL, MODP_CUSTOM, ECP_256_BIGN,
 	"MODP_NULL",
 	"MODP_CUSTOM");
 ENUM_NEXT(diffie_hellman_group_names, NTRU_112_BIT, NTRU_256_BIT, MODP_CUSTOM,
@@ -475,6 +499,7 @@ bool diffie_hellman_group_is_ec(diffie_hellman_group_t group)
 		case ECP_256_BP:
 		case ECP_384_BP:
 		case ECP_512_BP:
+		case ECP_256_BIGN:
 			return TRUE;
 		default:
 			return FALSE;
diff --git a/strongswan-5.2.0/src/libstrongswan/crypto/diffie_hellman.h b/strongswan-5.2.0/src/libstrongswan/crypto/diffie_hellman.h
index 00d7003..84a410e 100644
--- a/strongswan-5.2.0/src/libstrongswan/crypto/diffie_hellman.h
+++ b/strongswan-5.2.0/src/libstrongswan/crypto/diffie_hellman.h
@@ -13,7 +13,29 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
- */
+ */ 
+
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 /**
  * @defgroup diffie_hellman diffie_hellman
@@ -60,6 +82,7 @@ enum diffie_hellman_group_t {
 	ECP_256_BP    = 28,
 	ECP_384_BP    = 29,
 	ECP_512_BP    = 30,
+	ECP_256_BIGN  = 31,
 	/** insecure NULL diffie hellman group for testing, in PRIVATE USE */
 	MODP_NULL = 1024,
 	/** MODP group with custom generator/prime */
@@ -80,7 +103,7 @@ extern enum_name_t *diffie_hellman_group_names;
  * Implementation of the Diffie-Hellman algorithm, as in RFC2631.
  */
 struct diffie_hellman_t {
-
+ 
 	/**
 	 * Returns the shared secret of this diffie hellman exchange.
 	 *
diff --git a/strongswan-5.2.0/src/libstrongswan/crypto/hashers/hasher.c b/strongswan-5.2.0/src/libstrongswan/crypto/hashers/hasher.c
index 13cbb5a..98628e7 100644
--- a/strongswan-5.2.0/src/libstrongswan/crypto/hashers/hasher.c
+++ b/strongswan-5.2.0/src/libstrongswan/crypto/hashers/hasher.c
@@ -14,12 +14,34 @@
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
  */
+ 
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 #include "hasher.h"
 
 #include <asn1/oid.h>
 
-ENUM(hash_algorithm_names, HASH_UNKNOWN, HASH_SHA512,
+ENUM(hash_algorithm_names, HASH_UNKNOWN, BELT_HMAC,
 	"HASH_UNKNOWN",
 	"HASH_MD2",
 	"HASH_MD4",
@@ -28,10 +50,15 @@ ENUM(hash_algorithm_names, HASH_UNKNOWN, HASH_SHA512,
 	"HASH_SHA224",
 	"HASH_SHA256",
 	"HASH_SHA384",
-	"HASH_SHA512"
+	"HASH_SHA512",
+	"BELT_HASH",
+	"GOST_MAC",
+	"BELT_MAC",
+	"BELT_HMAC"
+
 );
 
-ENUM(hash_algorithm_short_names, HASH_UNKNOWN, HASH_SHA512,
+ENUM(hash_algorithm_short_names, HASH_UNKNOWN, BELT_HMAC,
 	"unknown",
 	"md2",
 	"md4",
@@ -40,8 +67,12 @@ ENUM(hash_algorithm_short_names, HASH_UNKNOWN, HASH_SHA512,
 	"sha224",
 	"sha256",
 	"sha384",
-	"sha512"
-);
+	"sha512",
+	"belt_hash",
+	"gost_mac",
+	"belt_mac",
+	"belt_hmac"
+);	
 
 /*
  * Described in header.
@@ -71,6 +102,14 @@ hash_algorithm_t hasher_algorithm_from_oid(int oid)
 		case OID_SHA512:
 		case OID_SHA512_WITH_RSA:
 			return HASH_SHA512;
+		case OID_BELT_HASH:
+			return BELT_HASH;
+		case OID_GOST_MAC:
+			return GOST_MAC;
+		case OID_BELT_MAC:
+			return BELT_MAC;
+		case OID_BELT_HMAC:
+			return BELT_HMAC;
 		default:
 			return HASH_UNKNOWN;
 	}
@@ -101,6 +140,8 @@ hash_algorithm_t hasher_algorithm_from_prf(pseudo_random_function_t alg)
 		case PRF_FIPS_DES:
 		case PRF_CAMELLIA128_XCBC:
 		case PRF_UNDEFINED:
+		case PRF_BRNG_CTR_HBELT:
+		case PRF_BRNG_HMAC_HBELT:
 			break;
 	}
 	return HASH_UNKNOWN;
@@ -142,6 +183,11 @@ hash_algorithm_t hasher_algorithm_from_integrity(integrity_algorithm_t alg,
 			case AUTH_HMAC_SHA2_512_512:
 				*length = 64;
 				break;
+			case AUTH_BELT_HASH:
+			case AUTH_GOST_MAC:
+			case AUTH_BELT_MAC:
+			case AUTH_BELT_HMAC:
+				*length = 32;
 			default:
 				break;
 		}
@@ -166,6 +212,11 @@ hash_algorithm_t hasher_algorithm_from_integrity(integrity_algorithm_t alg,
 		case AUTH_HMAC_SHA2_512_256:
 		case AUTH_HMAC_SHA2_512_512:
 			return HASH_SHA512;
+		case AUTH_GOST_MAC:
+		case AUTH_BELT_MAC:
+		case AUTH_BELT_HMAC:
+		case AUTH_BELT_HASH:
+			return BELT_HASH;
 		case AUTH_AES_CMAC_96:
 		case AUTH_AES_128_GMAC:
 		case AUTH_AES_192_GMAC:
@@ -237,6 +288,14 @@ integrity_algorithm_t hasher_algorithm_to_integrity(hash_algorithm_t alg,
 					return AUTH_HMAC_SHA2_512_512;
 			}
 			break;
+		case BELT_HASH:
+			return AUTH_BELT_HASH;
+		case GOST_MAC:
+			return AUTH_GOST_MAC;
+		case BELT_MAC:
+			return AUTH_BELT_MAC;	
+		case BELT_HMAC:
+			return AUTH_BELT_HMAC;	
 		case HASH_MD2:
 		case HASH_MD4:
 		case HASH_SHA224:
@@ -276,6 +335,18 @@ int hasher_algorithm_to_oid(hash_algorithm_t alg)
 		case HASH_SHA512:
 			oid = OID_SHA512;
 			break;
+		case BELT_HASH:
+			oid = OID_BELT_HASH;
+			break;
+		case GOST_MAC:
+			oid = OID_GOST_MAC;
+			break;
+		case BELT_MAC:
+			oid = OID_BELT_MAC;
+			break;
+		case BELT_HMAC:
+			oid = OID_BELT_HMAC;
+			break;
 		default:
 			oid = OID_UNKNOWN;
 	}
@@ -323,8 +394,16 @@ int hasher_signature_algorithm_to_oid(hash_algorithm_t alg, key_type_t key)
 				default:
 					return OID_UNKNOWN;
 			}
+		case KEY_BIGN:
+			switch (alg)
+			{
+				case BELT_HASH:
+					return OID_HASH_BELT;
+				case HASH_UNKNOWN:									
+				default:
+					return OID_UNKNOWN;
+			}
 		default:
 			return OID_UNKNOWN;
 	}
-}
-
+}
\ No newline at end of file
diff --git a/strongswan-5.2.0/src/libstrongswan/crypto/hashers/hasher.h b/strongswan-5.2.0/src/libstrongswan/crypto/hashers/hasher.h
index 37ef0b6..b896898 100644
--- a/strongswan-5.2.0/src/libstrongswan/crypto/hashers/hasher.h
+++ b/strongswan-5.2.0/src/libstrongswan/crypto/hashers/hasher.h
@@ -13,7 +13,29 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
- */
+ */ 
+
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 /**
  * @defgroup hasher hasher
@@ -44,7 +66,12 @@ enum hash_algorithm_t {
 	HASH_SHA224			= 5,
 	HASH_SHA256 		= 6,
 	HASH_SHA384 		= 7,
-	HASH_SHA512 		= 8
+	HASH_SHA512 		= 8,
+	BELT_HASH			= 9,
+	GOST_MAC			= 10,
+	BELT_MAC			= 11,
+	BELT_HMAC			= 12
+
 };
 
 #define HASH_SIZE_MD2		16
@@ -55,6 +82,11 @@ enum hash_algorithm_t {
 #define HASH_SIZE_SHA256	32
 #define HASH_SIZE_SHA384	48
 #define HASH_SIZE_SHA512	64
+#define HASH_SIZE_BELT		32
+#define HASH_SIZE_GOST_MAC	 4
+#define HASH_SIZE_BELT_MAC	 8
+#define HASH_SIZE_BELT_HMAC	 32
+
 
 /**
  * enum names for hash_algorithm_t.
diff --git a/strongswan-5.2.0/src/libstrongswan/crypto/key_transformer.c b/strongswan-5.2.0/src/libstrongswan/crypto/key_transformer.c
new file mode 100644
index 0000000..c14ee88
--- /dev/null
+++ b/strongswan-5.2.0/src/libstrongswan/crypto/key_transformer.c
@@ -0,0 +1,28 @@
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
+
+#include "key_transformer.h"
+
+ENUM(key_transform_algorithm_names, KEYTFM_UNDEFINED, BELT_KEYREP_TRANSFORM,
+	"KEY_TRANSFORM_UNDEFINED",
+	"BELT_KEYREP_TRANSFORM",
+);
\ No newline at end of file
diff --git a/strongswan-5.2.0/src/libstrongswan/crypto/key_transformer.h b/strongswan-5.2.0/src/libstrongswan/crypto/key_transformer.h
new file mode 100644
index 0000000..5c42041
--- /dev/null
+++ b/strongswan-5.2.0/src/libstrongswan/crypto/key_transformer.h
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
+
+/**
+ * @defgroup key_transformer key_transformer
+ * @{ @ingroup crypto
+ */
+
+#ifndef KEY_TRANSFORMER_H_
+#define KEY_TRANSFORMER_H_
+
+typedef enum key_transform_alorithm_t key_transform_alorithm_t;
+typedef enum key_transform_args_t key_transform_args_t;
+typedef struct key_transformer_t key_transformer_t;
+
+#include <library.h>
+
+/**
+ *	Key transform algorithm
+ */
+enum key_transform_alorithm_t {
+
+	KEYTFM_UNDEFINED = 0,
+	
+	/** KeyRep algorithm from STB 34.101.31 */
+	BELT_KEYREP_TRANSFORM = 1,
+};
+
+/**
+ * enum strings for key_transform_alorithm_t.
+ */
+extern enum_name_t *key_transform_algorithm_names;
+
+/**
+ * Key transform interface.
+ */
+struct key_transformer_t {
+
+	/**
+	 * Transform key of proveded level into another key 
+	 * of level + 1 associated with proveded header.
+	 *
+	 * @param in 			a key to transform
+	 * @param out 			transformed key
+	 * @param in_level		level of the input key
+	 * @param out_header	header associated with produced key
+	 * @return				TRUE on successful transformation, FALSE otherwise
+	 */
+	bool (*transform)(key_transformer_t *this, chunk_t in, chunk_t out, 
+									chunk_t in_level, chunk_t out_header);
+
+	/**
+	 * Destructor.
+	 */
+	void (*destroy)(key_transformer_t *this);
+};
+
+#endif /** KEY_TRANSFORMER_H_ @}*/
diff --git a/strongswan-5.2.0/src/libstrongswan/crypto/prfs/prf.c b/strongswan-5.2.0/src/libstrongswan/crypto/prfs/prf.c
index 12e13ef..01d9be7 100644
--- a/strongswan-5.2.0/src/libstrongswan/crypto/prfs/prf.c
+++ b/strongswan-5.2.0/src/libstrongswan/crypto/prfs/prf.c
@@ -12,7 +12,29 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
- */
+ */ 
+
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 #include "prf.h"
 
@@ -22,7 +44,7 @@ ENUM_BEGIN(pseudo_random_function_names, PRF_UNDEFINED, PRF_CAMELLIA128_XCBC,
 	"PRF_FIPS_DES",
 	"PRF_KEYED_SHA1",
 	"PRF_CAMELLIA128_XCBC");
-ENUM_NEXT(pseudo_random_function_names, PRF_HMAC_MD5, PRF_AES128_CMAC, PRF_CAMELLIA128_XCBC,
+ENUM_NEXT(pseudo_random_function_names, PRF_HMAC_MD5, PRF_BRNG_HMAC_HBELT, PRF_CAMELLIA128_XCBC,
 	"PRF_HMAC_MD5",
 	"PRF_HMAC_SHA1",
 	"PRF_HMAC_TIGER",
@@ -30,6 +52,8 @@ ENUM_NEXT(pseudo_random_function_names, PRF_HMAC_MD5, PRF_AES128_CMAC, PRF_CAMEL
 	"PRF_HMAC_SHA2_256",
 	"PRF_HMAC_SHA2_384",
 	"PRF_HMAC_SHA2_512",
-	"PRF_AES128_CMAC");
-ENUM_END(pseudo_random_function_names, PRF_AES128_CMAC);
+	"PRF_AES128_CMAC",
+	"PRF_BRNG_CTR_HBELT",
+	"PRF_BRNG_HMAC_HBELT");
+ENUM_END(pseudo_random_function_names, PRF_BRNG_HMAC_HBELT);
 
diff --git a/strongswan-5.2.0/src/libstrongswan/crypto/prfs/prf.h b/strongswan-5.2.0/src/libstrongswan/crypto/prfs/prf.h
index 46e23b2..2b87a15 100644
--- a/strongswan-5.2.0/src/libstrongswan/crypto/prfs/prf.h
+++ b/strongswan-5.2.0/src/libstrongswan/crypto/prfs/prf.h
@@ -12,7 +12,29 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
- */
+ */ 
+
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 /**
  * @defgroup prf prf
@@ -50,6 +72,10 @@ enum pseudo_random_function_t {
 	PRF_HMAC_SHA2_512 = 7,
 	/** RFC4615 */
 	PRF_AES128_CMAC = 8,
+	/** PRFBRNG_CTR */
+	PRF_BRNG_CTR_HBELT = 9,
+	/** PRFBRNG_HMAC */
+	PRF_BRNG_HMAC_HBELT = 10,
 	/** FIPS 186-2-change1 */
 	PRF_FIPS_SHA1_160 = 1025,
 	/** FIPS 186-2-change1, uses fixed output size of 160bit */
diff --git a/strongswan-5.2.0/src/libstrongswan/crypto/proposal/proposal_keywords_static.txt b/strongswan-5.2.0/src/libstrongswan/crypto/proposal/proposal_keywords_static.txt
index 70e7915..befcbee 100644
--- a/strongswan-5.2.0/src/libstrongswan/crypto/proposal/proposal_keywords_static.txt
+++ b/strongswan-5.2.0/src/libstrongswan/crypto/proposal/proposal_keywords_static.txt
@@ -12,7 +12,29 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
- */
+ */ 
+
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 #include <string.h>
 
@@ -30,116 +52,22 @@ struct proposal_token {
 };
 %%
 null,             ENCRYPTION_ALGORITHM, ENCR_NULL,                 0
-des,              ENCRYPTION_ALGORITHM, ENCR_DES,                  0
-3des,             ENCRYPTION_ALGORITHM, ENCR_3DES,                 0
-aes,              ENCRYPTION_ALGORITHM, ENCR_AES_CBC,            128
-aes128,           ENCRYPTION_ALGORITHM, ENCR_AES_CBC,            128
-aes192,           ENCRYPTION_ALGORITHM, ENCR_AES_CBC,            192
 aes256,           ENCRYPTION_ALGORITHM, ENCR_AES_CBC,            256
-aes128ctr,        ENCRYPTION_ALGORITHM, ENCR_AES_CTR,            128
-aes192ctr,        ENCRYPTION_ALGORITHM, ENCR_AES_CTR,            192
-aes256ctr,        ENCRYPTION_ALGORITHM, ENCR_AES_CTR,            256
-aes128ccm8,       ENCRYPTION_ALGORITHM, ENCR_AES_CCM_ICV8,       128
-aes128ccm64,      ENCRYPTION_ALGORITHM, ENCR_AES_CCM_ICV8,       128
-aes128ccm12,      ENCRYPTION_ALGORITHM, ENCR_AES_CCM_ICV12,      128
-aes128ccm96,      ENCRYPTION_ALGORITHM, ENCR_AES_CCM_ICV12,      128
-aes128ccm16,      ENCRYPTION_ALGORITHM, ENCR_AES_CCM_ICV16,      128
-aes128ccm128,     ENCRYPTION_ALGORITHM, ENCR_AES_CCM_ICV16,      128
-aes192ccm8,       ENCRYPTION_ALGORITHM, ENCR_AES_CCM_ICV8,       192
-aes192ccm64,      ENCRYPTION_ALGORITHM, ENCR_AES_CCM_ICV8,       192
-aes192ccm12,      ENCRYPTION_ALGORITHM, ENCR_AES_CCM_ICV12,      192
-aes192ccm96,      ENCRYPTION_ALGORITHM, ENCR_AES_CCM_ICV12,      192
-aes192ccm16,      ENCRYPTION_ALGORITHM, ENCR_AES_CCM_ICV16,      192
-aes192ccm128,     ENCRYPTION_ALGORITHM, ENCR_AES_CCM_ICV16,      192
-aes256ccm8,       ENCRYPTION_ALGORITHM, ENCR_AES_CCM_ICV8,       256
-aes256ccm64,      ENCRYPTION_ALGORITHM, ENCR_AES_CCM_ICV8,       256
-aes256ccm12,      ENCRYPTION_ALGORITHM, ENCR_AES_CCM_ICV12,      256
-aes256ccm96,      ENCRYPTION_ALGORITHM, ENCR_AES_CCM_ICV12,      256
-aes256ccm16,      ENCRYPTION_ALGORITHM, ENCR_AES_CCM_ICV16,      256
-aes256ccm128,     ENCRYPTION_ALGORITHM, ENCR_AES_CCM_ICV16,      256
-aes128gcm8,       ENCRYPTION_ALGORITHM, ENCR_AES_GCM_ICV8,       128
-aes128gcm64,      ENCRYPTION_ALGORITHM, ENCR_AES_GCM_ICV8,       128
-aes128gcm12,      ENCRYPTION_ALGORITHM, ENCR_AES_GCM_ICV12,      128
-aes128gcm96,      ENCRYPTION_ALGORITHM, ENCR_AES_GCM_ICV12,      128
-aes128gcm16,      ENCRYPTION_ALGORITHM, ENCR_AES_GCM_ICV16,      128
-aes128gcm128,     ENCRYPTION_ALGORITHM, ENCR_AES_GCM_ICV16,      128
-aes192gcm8,       ENCRYPTION_ALGORITHM, ENCR_AES_GCM_ICV8,       192
-aes192gcm64,      ENCRYPTION_ALGORITHM, ENCR_AES_GCM_ICV8,       192
-aes192gcm12,      ENCRYPTION_ALGORITHM, ENCR_AES_GCM_ICV12,      192
-aes192gcm96,      ENCRYPTION_ALGORITHM, ENCR_AES_GCM_ICV12,      192
-aes192gcm16,      ENCRYPTION_ALGORITHM, ENCR_AES_GCM_ICV16,      192
-aes192gcm128,     ENCRYPTION_ALGORITHM, ENCR_AES_GCM_ICV16,      192
-aes256gcm8,       ENCRYPTION_ALGORITHM, ENCR_AES_GCM_ICV8,       256
-aes256gcm64,      ENCRYPTION_ALGORITHM, ENCR_AES_GCM_ICV8,       256
-aes256gcm12,      ENCRYPTION_ALGORITHM, ENCR_AES_GCM_ICV12,      256
-aes256gcm96,      ENCRYPTION_ALGORITHM, ENCR_AES_GCM_ICV12,      256
-aes256gcm16,      ENCRYPTION_ALGORITHM, ENCR_AES_GCM_ICV16,      256
-aes256gcm128,     ENCRYPTION_ALGORITHM, ENCR_AES_GCM_ICV16,      256
-aes128gmac,       ENCRYPTION_ALGORITHM, ENCR_NULL_AUTH_AES_GMAC, 128
-aes192gmac,       ENCRYPTION_ALGORITHM, ENCR_NULL_AUTH_AES_GMAC, 192
-aes256gmac,       ENCRYPTION_ALGORITHM, ENCR_NULL_AUTH_AES_GMAC, 256
-blowfish,         ENCRYPTION_ALGORITHM, ENCR_BLOWFISH,           128
-blowfish128,      ENCRYPTION_ALGORITHM, ENCR_BLOWFISH,           128
-blowfish192,      ENCRYPTION_ALGORITHM, ENCR_BLOWFISH,           192
-blowfish256,      ENCRYPTION_ALGORITHM, ENCR_BLOWFISH,           256
-camellia,         ENCRYPTION_ALGORITHM, ENCR_CAMELLIA_CBC,       128
-camellia128,      ENCRYPTION_ALGORITHM, ENCR_CAMELLIA_CBC,       128
-camellia192,      ENCRYPTION_ALGORITHM, ENCR_CAMELLIA_CBC,       192
-camellia256,      ENCRYPTION_ALGORITHM, ENCR_CAMELLIA_CBC,       256
-camellia128ctr,   ENCRYPTION_ALGORITHM, ENCR_CAMELLIA_CTR,       128
-camellia192ctr,   ENCRYPTION_ALGORITHM, ENCR_CAMELLIA_CTR,       192
-camellia256ctr,   ENCRYPTION_ALGORITHM, ENCR_CAMELLIA_CTR,       256
-camellia128ccm8,  ENCRYPTION_ALGORITHM, ENCR_CAMELLIA_CCM_ICV8,  128
-camellia128ccm64, ENCRYPTION_ALGORITHM, ENCR_CAMELLIA_CCM_ICV8,  128
-camellia128ccm12, ENCRYPTION_ALGORITHM, ENCR_CAMELLIA_CCM_ICV12, 128
-camellia128ccm96, ENCRYPTION_ALGORITHM, ENCR_CAMELLIA_CCM_ICV12, 128
-camellia128ccm16, ENCRYPTION_ALGORITHM, ENCR_CAMELLIA_CCM_ICV16, 128
-camellia128ccm128,ENCRYPTION_ALGORITHM, ENCR_CAMELLIA_CCM_ICV16, 128
-camellia192ccm8,  ENCRYPTION_ALGORITHM, ENCR_CAMELLIA_CCM_ICV8,  192
-camellia192ccm64, ENCRYPTION_ALGORITHM, ENCR_CAMELLIA_CCM_ICV8,  192
-camellia192ccm12, ENCRYPTION_ALGORITHM, ENCR_CAMELLIA_CCM_ICV12, 192
-camellia192ccm96, ENCRYPTION_ALGORITHM, ENCR_CAMELLIA_CCM_ICV12, 192
-camellia192ccm16, ENCRYPTION_ALGORITHM, ENCR_CAMELLIA_CCM_ICV16, 192
-camellia192ccm128,ENCRYPTION_ALGORITHM, ENCR_CAMELLIA_CCM_ICV16, 192
-camellia256ccm8,  ENCRYPTION_ALGORITHM, ENCR_CAMELLIA_CCM_ICV8,  256
-camellia256ccm64, ENCRYPTION_ALGORITHM, ENCR_CAMELLIA_CCM_ICV8,  256
-camellia256ccm12, ENCRYPTION_ALGORITHM, ENCR_CAMELLIA_CCM_ICV12, 256
-camellia256ccm96, ENCRYPTION_ALGORITHM, ENCR_CAMELLIA_CCM_ICV12, 256
-camellia256ccm16, ENCRYPTION_ALGORITHM, ENCR_CAMELLIA_CCM_ICV16, 256
-camellia256ccm128,ENCRYPTION_ALGORITHM, ENCR_CAMELLIA_CCM_ICV16, 256
-cast128,          ENCRYPTION_ALGORITHM, ENCR_CAST,               128
-serpent,          ENCRYPTION_ALGORITHM, ENCR_SERPENT_CBC,        128
-serpent128,       ENCRYPTION_ALGORITHM, ENCR_SERPENT_CBC,        128
-serpent192,       ENCRYPTION_ALGORITHM, ENCR_SERPENT_CBC,        192
-serpent256,       ENCRYPTION_ALGORITHM, ENCR_SERPENT_CBC,        256
-twofish,          ENCRYPTION_ALGORITHM, ENCR_TWOFISH_CBC,        128
-twofish128,       ENCRYPTION_ALGORITHM, ENCR_TWOFISH_CBC,        128
-twofish192,       ENCRYPTION_ALGORITHM, ENCR_TWOFISH_CBC,        192
-twofish256,       ENCRYPTION_ALGORITHM, ENCR_TWOFISH_CBC,        256
+gost28147_ctr,    ENCRYPTION_ALGORITHM, ENCR_GOST28147_CTR,      256
+gost28147_cfb,    ENCRYPTION_ALGORITHM, ENCR_GOST28147_CFB,      256
+belt_cbc,         ENCRYPTION_ALGORITHM, ENCR_BELT_CBC,           256
+belt_cfb,         ENCRYPTION_ALGORITHM, ENCR_BELT_CFB,           256
+belt_ctr,         ENCRYPTION_ALGORITHM, ENCR_BELT_CTR,           256
 sha,              INTEGRITY_ALGORITHM,  AUTH_HMAC_SHA1_96,         0
 sha1,             INTEGRITY_ALGORITHM,  AUTH_HMAC_SHA1_96,         0
 sha1_160,         INTEGRITY_ALGORITHM,  AUTH_HMAC_SHA1_160,        0
-sha256,           INTEGRITY_ALGORITHM,  AUTH_HMAC_SHA2_256_128,    0
-sha2_256,         INTEGRITY_ALGORITHM,  AUTH_HMAC_SHA2_256_128,    0
-sha256_96,        INTEGRITY_ALGORITHM,  AUTH_HMAC_SHA2_256_96,     0
-sha2_256_96,      INTEGRITY_ALGORITHM,  AUTH_HMAC_SHA2_256_96,     0
-sha384,           INTEGRITY_ALGORITHM,  AUTH_HMAC_SHA2_384_192,    0
-sha2_384,         INTEGRITY_ALGORITHM,  AUTH_HMAC_SHA2_384_192,    0
-sha512,           INTEGRITY_ALGORITHM,  AUTH_HMAC_SHA2_512_256,    0
-sha2_512,         INTEGRITY_ALGORITHM,  AUTH_HMAC_SHA2_512_256,    0
-md5,              INTEGRITY_ALGORITHM,  AUTH_HMAC_MD5_96,          0
-md5_128,          INTEGRITY_ALGORITHM,  AUTH_HMAC_MD5_128,         0
-aesxcbc,          INTEGRITY_ALGORITHM,  AUTH_AES_XCBC_96,          0
-camelliaxcbc,     INTEGRITY_ALGORITHM,  AUTH_CAMELLIA_XCBC_96,     0
-aescmac,          INTEGRITY_ALGORITHM,  AUTH_AES_CMAC_96,          0
+belt_hash,        INTEGRITY_ALGORITHM,  AUTH_BELT_HASH,            0
+gost_mac,         INTEGRITY_ALGORITHM,  AUTH_GOST_MAC,             0
+belt_mac,         INTEGRITY_ALGORITHM,  AUTH_BELT_MAC,             0
+belt_hmac,        INTEGRITY_ALGORITHM,  AUTH_BELT_HMAC,            0
 prfsha1,          PSEUDO_RANDOM_FUNCTION, PRF_HMAC_SHA1,           0
-prfsha256,        PSEUDO_RANDOM_FUNCTION, PRF_HMAC_SHA2_256,       0
-prfsha384,        PSEUDO_RANDOM_FUNCTION, PRF_HMAC_SHA2_384,       0
-prfsha512,        PSEUDO_RANDOM_FUNCTION, PRF_HMAC_SHA2_512,       0
-prfmd5,           PSEUDO_RANDOM_FUNCTION, PRF_HMAC_MD5,            0
-prfaesxcbc,       PSEUDO_RANDOM_FUNCTION, PRF_AES128_XCBC,         0
-prfcamelliaxcbc,  PSEUDO_RANDOM_FUNCTION, PRF_CAMELLIA128_XCBC,    0
-prfaescmac,       PSEUDO_RANDOM_FUNCTION, PRF_AES128_CMAC,         0
+prfbrng_ctr,      PSEUDO_RANDOM_FUNCTION, PRF_BRNG_CTR_HBELT,      0
+prfbrng_hmac,     PSEUDO_RANDOM_FUNCTION, PRF_BRNG_HMAC_HBELT,     0
 modpnull,         DIFFIE_HELLMAN_GROUP, MODP_NULL,                 0
 modp768,          DIFFIE_HELLMAN_GROUP, MODP_768_BIT,              0
 modp1024,         DIFFIE_HELLMAN_GROUP, MODP_1024_BIT,             0
@@ -161,6 +89,7 @@ ecp224bp,         DIFFIE_HELLMAN_GROUP, ECP_224_BP,                0
 ecp256bp,         DIFFIE_HELLMAN_GROUP, ECP_256_BP,                0
 ecp384bp,         DIFFIE_HELLMAN_GROUP, ECP_384_BP,                0
 ecp512bp,         DIFFIE_HELLMAN_GROUP, ECP_512_BP,                0
+ecp256bign,       DIFFIE_HELLMAN_GROUP, ECP_256_BIGN,              0
 ntru112,          DIFFIE_HELLMAN_GROUP, NTRU_112_BIT,              0
 ntru128,          DIFFIE_HELLMAN_GROUP, NTRU_128_BIT,              0
 ntru192,          DIFFIE_HELLMAN_GROUP, NTRU_192_BIT,              0
diff --git a/strongswan-5.2.0/src/libstrongswan/crypto/signers/signer.c b/strongswan-5.2.0/src/libstrongswan/crypto/signers/signer.c
index 522b4e2..b720938 100644
--- a/strongswan-5.2.0/src/libstrongswan/crypto/signers/signer.c
+++ b/strongswan-5.2.0/src/libstrongswan/crypto/signers/signer.c
@@ -12,7 +12,29 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
- */
+ */ 
+
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 #include "signer.h"
 
@@ -24,7 +46,7 @@ ENUM_BEGIN(integrity_algorithm_names, AUTH_UNDEFINED, AUTH_CAMELLIA_XCBC_96,
 	"HMAC_SHA2_384_384",
 	"HMAC_SHA2_512_512",
 	"CAMELLIA_XCBC_96");
-ENUM_NEXT(integrity_algorithm_names, AUTH_HMAC_MD5_96, AUTH_HMAC_SHA2_512_256, AUTH_CAMELLIA_XCBC_96,
+ENUM_NEXT(integrity_algorithm_names, AUTH_HMAC_MD5_96, AUTH_BELT_HASH, AUTH_CAMELLIA_XCBC_96,
 	"HMAC_MD5_96",
 	"HMAC_SHA1_96",
 	"DES_MAC",
@@ -38,6 +60,10 @@ ENUM_NEXT(integrity_algorithm_names, AUTH_HMAC_MD5_96, AUTH_HMAC_SHA2_512_256, A
 	"AES_256_GMAC",
 	"HMAC_SHA2_256_128",
 	"HMAC_SHA2_384_192",
-	"HMAC_SHA2_512_256");
-ENUM_END(integrity_algorithm_names, AUTH_HMAC_SHA2_512_256);
+	"HMAC_SHA2_512_256",
+	"GOST_MAC",
+	"BELT_MAC",
+	"BELT_HMAC",
+	"BELT_HASH");
+ENUM_END(integrity_algorithm_names, AUTH_BELT_HASH);
 
diff --git a/strongswan-5.2.0/src/libstrongswan/crypto/signers/signer.h b/strongswan-5.2.0/src/libstrongswan/crypto/signers/signer.h
index e0cf7eb..9a5d10b 100644
--- a/strongswan-5.2.0/src/libstrongswan/crypto/signers/signer.h
+++ b/strongswan-5.2.0/src/libstrongswan/crypto/signers/signer.h
@@ -12,7 +12,29 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
- */
+ */ 
+
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 /**
  * @defgroup signer signer
@@ -62,6 +84,14 @@ enum integrity_algorithm_t {
 	AUTH_HMAC_SHA2_384_192 = 13,
 	/** RFC4868 */
 	AUTH_HMAC_SHA2_512_256 = 14,
+	
+	AUTH_GOST_MAC	= 15,
+	
+	AUTH_BELT_MAC	= 16,
+
+	AUTH_BELT_HMAC	= 17,
+	
+	AUTH_BELT_HASH	= 18,
 	/** private use */
 	AUTH_HMAC_SHA1_128 = 1025,
 	/** SHA256 96 bit truncation variant, supported by Linux kernels */
@@ -154,3 +184,4 @@ struct signer_t {
 };
 
 #endif /** SIGNER_H_ @}*/
+
diff --git a/strongswan-5.2.0/src/libstrongswan/crypto/transform.c b/strongswan-5.2.0/src/libstrongswan/crypto/transform.c
index 5625297..63ab5db 100644
--- a/strongswan-5.2.0/src/libstrongswan/crypto/transform.c
+++ b/strongswan-5.2.0/src/libstrongswan/crypto/transform.c
@@ -11,7 +11,29 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
- */
+ */ 
+
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 #include <crypto/transform.h>
 
@@ -21,16 +43,17 @@ ENUM_BEGIN(transform_type_names, UNDEFINED_TRANSFORM_TYPE, COMPRESSION_ALGORITHM
 	"RANDOM_NUMBER_GENERATOR",
 	"AEAD_ALGORITHM",
 	"COMPRESSION_ALGORITHM");
-ENUM_NEXT(transform_type_names, ENCRYPTION_ALGORITHM, EXTENDED_SEQUENCE_NUMBERS, COMPRESSION_ALGORITHM,
+ENUM_NEXT(transform_type_names, ENCRYPTION_ALGORITHM, KEY_TRANSFORM_ALGORITHM, COMPRESSION_ALGORITHM,
 	"ENCRYPTION_ALGORITHM",
 	"PSEUDO_RANDOM_FUNCTION",
 	"INTEGRITY_ALGORITHM",
 	"DIFFIE_HELLMAN_GROUP",
-	"EXTENDED_SEQUENCE_NUMBERS");
-ENUM_END(transform_type_names, EXTENDED_SEQUENCE_NUMBERS);
+	"EXTENDED_SEQUENCE_NUMBERS",
+	"KEY_TRANSFORM_ALGORITHM");
+ENUM_END(transform_type_names, KEY_TRANSFORM_ALGORITHM);
 
 
 ENUM(extended_sequence_numbers_names, NO_EXT_SEQ_NUMBERS, EXT_SEQ_NUMBERS,
 	"NO_EXT_SEQ",
 	"EXT_SEQ",
-);
+);
\ No newline at end of file
diff --git a/strongswan-5.2.0/src/libstrongswan/crypto/transform.h b/strongswan-5.2.0/src/libstrongswan/crypto/transform.h
index a585e97..56d60fc 100644
--- a/strongswan-5.2.0/src/libstrongswan/crypto/transform.h
+++ b/strongswan-5.2.0/src/libstrongswan/crypto/transform.h
@@ -13,6 +13,28 @@
  * for more details.
  */
 
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
+
 /**
  * @defgroup transforms transforms
  * @{ @ingroup crypto
@@ -38,7 +60,8 @@ enum transform_type_t {
 	PSEUDO_RANDOM_FUNCTION = 2,
 	INTEGRITY_ALGORITHM = 3,
 	DIFFIE_HELLMAN_GROUP = 4,
-	EXTENDED_SEQUENCE_NUMBERS = 5
+	EXTENDED_SEQUENCE_NUMBERS = 5,
+	KEY_TRANSFORM_ALGORITHM = 6
 };
 
 /**
diff --git a/strongswan-5.2.0/src/libstrongswan/eap/eap.c b/strongswan-5.2.0/src/libstrongswan/eap/eap.c
index 64b5dbe..da50a7e 100644
--- a/strongswan-5.2.0/src/libstrongswan/eap/eap.c
+++ b/strongswan-5.2.0/src/libstrongswan/eap/eap.c
@@ -12,7 +12,29 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
- */
+ */ 
+
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 #include <stdlib.h>
 #include <errno.h>
@@ -26,7 +48,7 @@ ENUM(eap_code_names, EAP_REQUEST, EAP_FAILURE,
 	"EAP_RESPONSE",
 	"EAP_SUCCESS",
 	"EAP_FAILURE",
-);
+); 
 
 ENUM(eap_code_short_names, EAP_REQUEST, EAP_FAILURE,
 	"REQ",
@@ -59,7 +81,8 @@ ENUM_NEXT(eap_type_names, EAP_TNC, EAP_TNC, EAP_MSTLV,
 	"EAP_TNC");
 ENUM_NEXT(eap_type_names, EAP_PT_EAP, EAP_PT_EAP, EAP_TNC,
 	"EAP_PT_EAP");
-ENUM_NEXT(eap_type_names, EAP_EXPANDED, EAP_DYNAMIC, EAP_PT_EAP,
+ENUM_NEXT(eap_type_names, EAP_BSTS, EAP_DYNAMIC, EAP_PT_EAP,
+	"EAP_BSTS",
 	"EAP_EXPANDED",
 	"EAP_EXPERIMENTAL",
 	"EAP_RADIUS",
@@ -90,7 +113,8 @@ ENUM_NEXT(eap_type_short_names, EAP_TNC, EAP_TNC, EAP_MSTLV,
 	"TNC");
 ENUM_NEXT(eap_type_short_names, EAP_PT_EAP, EAP_PT_EAP, EAP_TNC,
 	"PT");
-ENUM_NEXT(eap_type_short_names, EAP_EXPANDED, EAP_DYNAMIC, EAP_PT_EAP,
+ENUM_NEXT(eap_type_short_names, EAP_BSTS, EAP_DYNAMIC, EAP_PT_EAP,
+	"BSTS",
 	"EXP",
 	"XP",
 	"RAD",
@@ -121,6 +145,7 @@ eap_type_t eap_type_from_string(char *name)
 		{"pt",			EAP_PT_EAP},
 		{"dynamic",		EAP_DYNAMIC},
 		{"radius",		EAP_RADIUS},
+		{"bsts",		EAP_BSTS},
 	};
 
 	for (i = 0; i < countof(types); i++)
@@ -167,7 +192,7 @@ eap_vendor_type_t *eap_vendor_type_from_string(char *str)
 			continue;
 		}
 		vendor = strtoul(part, &end, 0);
-		if (*end != '\0' || errno)
+		if (*end != '\0' || errno);
 		{
 			DBG1(DBG_LIB, "invalid EAP vendor: %s", part);
 			type = 0;
diff --git a/strongswan-5.2.0/src/libstrongswan/eap/eap.h b/strongswan-5.2.0/src/libstrongswan/eap/eap.h
index 08d88ba..0048300 100644
--- a/strongswan-5.2.0/src/libstrongswan/eap/eap.h
+++ b/strongswan-5.2.0/src/libstrongswan/eap/eap.h
@@ -14,6 +14,28 @@
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
  */
+ 
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 /**
  * @defgroup leap eap
@@ -68,6 +90,7 @@ enum eap_type_t {
 	EAP_MSTLV = 33,
 	EAP_TNC = 38,
 	EAP_PT_EAP = 54,
+	EAP_BSTS = 253,
 	EAP_EXPANDED = 254,
 	EAP_EXPERIMENTAL = 255,
 	/** not a method, but an implementation providing different methods */
diff --git a/strongswan-5.2.0/src/libstrongswan/plugins/x509/x509_cert.c b/strongswan-5.2.0/src/libstrongswan/plugins/x509/x509_cert.c
index bdc8234..90eba61 100644
--- a/strongswan-5.2.0/src/libstrongswan/plugins/x509/x509_cert.c
+++ b/strongswan-5.2.0/src/libstrongswan/plugins/x509/x509_cert.c
@@ -16,7 +16,29 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
- */
+ */ 
+
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 #define _GNU_SOURCE
 
@@ -1465,7 +1487,7 @@ static bool parse_certificate(private_x509_cert_t *this)
 				}
 				break;
 			case X509_OBJ_SIGNATURE:
-				this->signature = object;
+				this->signature = chunk_skip(object, 1);
 				break;
 			default:
 				break;
@@ -2046,6 +2068,7 @@ static bool generate(private_x509_cert_t *cert, certificate_t *sign_cert,
 	/* select signature scheme */
 	cert->algorithm = hasher_signature_algorithm_to_oid(digest_alg,
 								sign_key->get_type(sign_key));
+
 	if (cert->algorithm == OID_UNKNOWN)
 	{
 		return FALSE;
@@ -2155,7 +2178,7 @@ static bool generate(private_x509_cert_t *cert, certificate_t *sign_cert,
 	}
 
 	/* add subjectKeyIdentifier to CA and OCSP signer certificates */
-	if (cert->flags & (X509_CA | X509_OCSP_SIGNER | X509_CRL_SIGN))
+	if (cert->flags & (X509_CA | X509_OCSP_SIGNER | X509_CRL_SIGN) || cert->flags == 0)
 	{
 		chunk_t keyid;
 
@@ -2170,7 +2193,7 @@ static bool generate(private_x509_cert_t *cert, certificate_t *sign_cert,
 	}
 
 	/* add the keyid authKeyIdentifier for non self-signed certificates */
-	if (sign_cert)
+	if (sign_cert || cert->flags & X509_CA)
 	{
 		chunk_t keyid;
 
diff --git a/strongswan-5.2.0/src/libstrongswan/plugins/x509/x509_crl.c b/strongswan-5.2.0/src/libstrongswan/plugins/x509/x509_crl.c
index d6057c3..38070c4 100644
--- a/strongswan-5.2.0/src/libstrongswan/plugins/x509/x509_crl.c
+++ b/strongswan-5.2.0/src/libstrongswan/plugins/x509/x509_crl.c
@@ -11,7 +11,29 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
- */
+ */ 
+
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 #include "x509_crl.h"
 
@@ -347,7 +369,7 @@ static bool parse(private_x509_crl_t *this)
 				break;
 			}
 			case CRL_OBJ_SIGNATURE:
-				this->signature = object;
+				this->signature = chunk_skip(object, 1);
 				break;
 			default:
 				break;
@@ -470,7 +492,14 @@ METHOD(certificate_t, issued_by, bool,
 	{
 		chunk_t fingerprint;
 
-		if (!key->get_fingerprint(key, KEYID_PUBKEY_SHA1, &fingerprint) ||
+		cred_encoding_type_t type = KEYID_PUBKEY_SHA1;
+
+		if (key->get_type(key) == KEY_BIGN)
+		{
+			type = KEYID_PUBKEY_BELT;
+		}
+
+		if (!key->get_fingerprint(key, type, &fingerprint) ||
 			!chunk_equals(fingerprint, this->authKeyIdentifier))
 		{
 			return FALSE;
diff --git a/strongswan-5.2.0/src/libstrongswan/tests/suites/test_crypter.c b/strongswan-5.2.0/src/libstrongswan/tests/suites/test_crypter.c
index 4e7550a..e02fb48 100644
--- a/strongswan-5.2.0/src/libstrongswan/tests/suites/test_crypter.c
+++ b/strongswan-5.2.0/src/libstrongswan/tests/suites/test_crypter.c
@@ -11,7 +11,29 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
- */
+ */ 
+
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 #include "test_suite.h"
 
@@ -34,6 +56,11 @@ static crypter_oid_t oids[] = {
 	{ OID_AES128_CBC, ENCR_AES_CBC, 128 },
 	{ OID_AES192_CBC, ENCR_AES_CBC, 192 },
 	{ OID_AES256_CBC, ENCR_AES_CBC, 256 },
+	{ OID_GOST28147_CTR, ENCR_GOST28147_CTR, 256 },
+	{ OID_GOST28147_CFB, ENCR_GOST28147_CFB, 256 },
+	{ OID_BELT_CBC, ENCR_BELT_CBC, 256 },
+	{ OID_BELT_CFB, ENCR_BELT_CFB, 256 },
+	{ OID_BELT_CTR, ENCR_BELT_CTR, 256 },
 	{ OID_CAMELLIA128_CBC, ENCR_CAMELLIA_CBC, 128 },
 	{ OID_CAMELLIA192_CBC, ENCR_CAMELLIA_CBC, 192 },
 	{ OID_CAMELLIA256_CBC, ENCR_CAMELLIA_CBC, 256 }
diff --git a/strongswan-5.2.0/src/libstrongswan/tests/suites/test_hasher.c b/strongswan-5.2.0/src/libstrongswan/tests/suites/test_hasher.c
index 41a9d64..8290f5f 100644
--- a/strongswan-5.2.0/src/libstrongswan/tests/suites/test_hasher.c
+++ b/strongswan-5.2.0/src/libstrongswan/tests/suites/test_hasher.c
@@ -11,7 +11,29 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
- */
+ */ 
+
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 #include "test_suite.h"
 
@@ -35,6 +57,7 @@ static hasher_oid_t oids[] = {
 	{ OID_SHA256, HASH_SHA256, KEY_ANY },
 	{ OID_SHA384, HASH_SHA384, KEY_ANY },
 	{ OID_SHA512, HASH_SHA512, KEY_ANY },
+	{ OID_BELT_HASH, BELT_HASH, KEY_ANY },
 	{ OID_UNKNOWN, HASH_UNKNOWN, KEY_ANY },
 	{ OID_MD2_WITH_RSA, HASH_MD2, KEY_RSA },
 	{ OID_MD5_WITH_RSA, HASH_MD5, KEY_RSA },
diff --git a/strongswan-5.2.0/src/libstrongswan/utils/debug.c b/strongswan-5.2.0/src/libstrongswan/utils/debug.c
index e8c9e6b..d2f8b7b 100644
--- a/strongswan-5.2.0/src/libstrongswan/utils/debug.c
+++ b/strongswan-5.2.0/src/libstrongswan/utils/debug.c
@@ -12,12 +12,34 @@
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
  */
+ 
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 #include <stdarg.h>
 
 #include "debug.h"
 
-ENUM(debug_names, DBG_DMN, DBG_LIB,
+ENUM(debug_names, DBG_DMN, DBG_CNT,
 	"DMN",
 	"MGR",
 	"IKE",
@@ -36,9 +58,10 @@ ENUM(debug_names, DBG_DMN, DBG_LIB,
 	"APP",
 	"ESP",
 	"LIB",
+	"CNT",
 );
 
-ENUM(debug_lower_names, DBG_DMN, DBG_LIB,
+ENUM(debug_lower_names, DBG_DMN, DBG_CNT,
 	"dmn",
 	"mgr",
 	"ike",
@@ -57,6 +80,7 @@ ENUM(debug_lower_names, DBG_DMN, DBG_LIB,
 	"app",
 	"esp",
 	"lib",
+	"cnt",
 );
 
 /**
diff --git a/strongswan-5.2.0/src/libstrongswan/utils/debug.h b/strongswan-5.2.0/src/libstrongswan/utils/debug.h
index f1c8c70..513a4b8 100644
--- a/strongswan-5.2.0/src/libstrongswan/utils/debug.h
+++ b/strongswan-5.2.0/src/libstrongswan/utils/debug.h
@@ -11,7 +11,29 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
- */
+ */ 
+
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 /**
  * @defgroup debug debug
@@ -68,6 +90,8 @@ enum debug_t {
 	DBG_ESP,
 	/** libstrongswan */
 	DBG_LIB,
+	/** contact plugins */
+	DBG_CNT,	
 	/** number of groups */
 	DBG_MAX,
 	/** pseudo group with all groups */
diff --git a/strongswan-5.2.0/src/libstrongswan/utils/identification.c b/strongswan-5.2.0/src/libstrongswan/utils/identification.c
index 46ac7e8..931ffe6 100644
--- a/strongswan-5.2.0/src/libstrongswan/utils/identification.c
+++ b/strongswan-5.2.0/src/libstrongswan/utils/identification.c
@@ -13,7 +13,29 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
- */
+ */ 
+
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 #include <string.h>
 #include <stdio.h>
@@ -71,13 +93,18 @@ static const x501rdn_t x501rdns[] = {
 	{"C", 					OID_COUNTRY,				ASN1_PRINTABLESTRING},
 	{"L", 					OID_LOCALITY,				ASN1_PRINTABLESTRING},
 	{"ST",					OID_STATE_OR_PROVINCE,		ASN1_PRINTABLESTRING},
+	{"Street",				OID_STREET,					ASN1_PRINTABLESTRING},
 	{"O", 					OID_ORGANIZATION,			ASN1_PRINTABLESTRING},
 	{"OU", 					OID_ORGANIZATION_UNIT,		ASN1_PRINTABLESTRING},
 	{"T", 					OID_TITLE,					ASN1_PRINTABLESTRING},
 	{"D", 					OID_DESCRIPTION,			ASN1_PRINTABLESTRING},
 	{"N", 					OID_NAME,					ASN1_PRINTABLESTRING},
 	{"G", 					OID_GIVEN_NAME,				ASN1_PRINTABLESTRING},
+	{"PC", 					OID_POSTAL_CODE,			ASN1_PRINTABLESTRING},
 	{"I", 					OID_INITIALS,				ASN1_PRINTABLESTRING},
+	{"IdentityCard", 		OID_IDENTITY_CARD,			ASN1_PRINTABLESTRING},
+	{"Nick", 				OID_NICK,					ASN1_PRINTABLESTRING},
+	{"Pseudonym",			OID_PSEUDONYM,				ASN1_PRINTABLESTRING},
 	{"dnQualifier", 		OID_DN_QUALIFIER,			ASN1_PRINTABLESTRING},
 	{"ID", 					OID_UNIQUE_IDENTIFIER,		ASN1_PRINTABLESTRING},
 	{"EN", 					OID_EMPLOYEE_NUMBER,		ASN1_PRINTABLESTRING},
@@ -210,10 +237,12 @@ METHOD(enumerator_t, rdn_part_enumerate, bool,
 		{OID_COUNTRY,			ID_PART_RDN_C},
 		{OID_LOCALITY,			ID_PART_RDN_L},
 		{OID_STATE_OR_PROVINCE,	ID_PART_RDN_ST},
+		{OID_STREET, 			ID_PART_RDN_STR},
 		{OID_ORGANIZATION,		ID_PART_RDN_O},
 		{OID_ORGANIZATION_UNIT,	ID_PART_RDN_OU},
 		{OID_TITLE,				ID_PART_RDN_T},
 		{OID_DESCRIPTION,		ID_PART_RDN_D},
+		{OID_POSTAL_CODE,		ID_PART_RDN_PC},
 		{OID_NAME,				ID_PART_RDN_N},
 		{OID_GIVEN_NAME,		ID_PART_RDN_G},
 		{OID_INITIALS,			ID_PART_RDN_I},
@@ -221,6 +250,9 @@ METHOD(enumerator_t, rdn_part_enumerate, bool,
 		{OID_UNIQUE_IDENTIFIER,	ID_PART_RDN_ID},
 		{OID_EMAIL_ADDRESS,		ID_PART_RDN_E},
 		{OID_EMPLOYEE_NUMBER,	ID_PART_RDN_EN},
+		{OID_IDENTITY_CARD,		ID_PART_RDN_IC},
+		{OID_NICK,				ID_PART_RDN_NICK},
+		{OID_PSEUDONYM,			ID_PART_RDN_PSEUDONYM},
 	};
 
 	while (this->inner->enumerate(this->inner, &oid, &strtype, &inner_data))
diff --git a/strongswan-5.2.0/src/libstrongswan/utils/identification.h b/strongswan-5.2.0/src/libstrongswan/utils/identification.h
index e624468..a85edfa 100644
--- a/strongswan-5.2.0/src/libstrongswan/utils/identification.h
+++ b/strongswan-5.2.0/src/libstrongswan/utils/identification.h
@@ -13,7 +13,29 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
- */
+ */ 
+
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 /**
  * @defgroup identification identification
@@ -191,6 +213,16 @@ enum id_part_t {
 	ID_PART_RDN_ST,
 	/** Title RDN of a DN */
 	ID_PART_RDN_T,
+	/** Addres in state */
+	ID_PART_RDN_STR,
+	/** Postal code */
+	ID_PART_RDN_PC,
+	/** Identitu Card */
+	ID_PART_RDN_IC,
+	/** Nick */
+	ID_PART_RDN_NICK,
+	/** Pseudonym */
+	ID_PART_RDN_PSEUDONYM
 };
 
 /**
diff --git a/strongswan-5.2.0/src/starter/confread.c b/strongswan-5.2.0/src/starter/confread.c
index 17dca66..9038d3d 100644
--- a/strongswan-5.2.0/src/starter/confread.c
+++ b/strongswan-5.2.0/src/starter/confread.c
@@ -13,7 +13,29 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
- */
+ */ 
+
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 #include <sys/types.h>
 #include <sys/stat.h>
@@ -33,15 +55,15 @@
 #include "files.h"
 #include "parser/conf_parser.h"
 
-#define IKE_LIFETIME_DEFAULT         10800 /* 3 hours */
-#define IPSEC_LIFETIME_DEFAULT        3600 /* 1 hour */
+#define IKE_LIFETIME_DEFAULT          36000/* 10 hours */
+#define IPSEC_LIFETIME_DEFAULT        36000 /* 10 hour */
 #define SA_REPLACEMENT_MARGIN_DEFAULT  540 /* 9 minutes */
 #define SA_REPLACEMENT_FUZZ_DEFAULT    100 /* 100% of margin */
 #define SA_REPLACEMENT_RETRIES_DEFAULT   3
 #define SA_REPLAY_WINDOW_DEFAULT        -1 /* use charon.replay_window */
 
-static const char ike_defaults[] = "aes128-sha1-modp2048,3des-sha1-modp1536";
-static const char esp_defaults[] = "aes128-sha1,3des-sha1";
+static const char ike_defaults[] = "gost28147_ctr-gost_mac-prfbrng_ctr-modp2048,";
+static const char esp_defaults[] = "gost28147_ctr-gost_mac,";
 
 static const char firewall_defaults[] = IPSEC_SCRIPT " _updown iptables";
 
diff --git a/strongswan-5.2.0/src/starter/starter.c b/strongswan-5.2.0/src/starter/starter.c
index ef57808..41e113d 100644
--- a/strongswan-5.2.0/src/starter/starter.c
+++ b/strongswan-5.2.0/src/starter/starter.c
@@ -10,7 +10,29 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
- */
+ */ 
+
+/*
+ * Copyright (C) 2017 NTC CONTACT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */ 
 
 #define _GNU_SOURCE
 
@@ -258,12 +280,11 @@ static void fatal_signal_handler(int signal)
 	abort();
 }
 
-#ifdef GENERATE_SELFCERT
-static void generate_selfcert()
+static void generate_secrets()
 {
 	struct stat stb;
 
-	/* if ipsec.secrets file is missing then generate RSA default key pair */
+	/* if ipsec.secrets file is missing then generate it */
 	if (stat(SECRETS_FILE, &stb) != 0)
 	{
 		mode_t oldmask;
@@ -293,11 +314,6 @@ static void generate_selfcert()
 			}
 		}
 #endif
-		ignore_result(setegid(gid));
-		ignore_result(seteuid(uid));
-		ignore_result(system(IPSEC_SCRIPT " scepclient --out pkcs1 --out cert-self --quiet"));
-		ignore_result(seteuid(0));
-		ignore_result(setegid(0));
 
 		/* ipsec.secrets is root readable only */
 		oldmask = umask(0066);
@@ -307,14 +323,13 @@ static void generate_selfcert()
 		{
 			fprintf(f, "# /etc/ipsec.secrets - strongSwan IPsec secrets file\n");
 			fprintf(f, "\n");
-			fprintf(f, ": RSA myKey.der\n");
+			fprintf(f, ": PSK \"12345678\"\n");
 			fclose(f);
 		}
 		ignore_result(chown(SECRETS_FILE, uid, gid));
 		umask(oldmask);
 	}
 }
-#endif /* GENERATE_SELFCERT */
 
 static bool check_pid(char *pid_file)
 {
@@ -512,7 +527,7 @@ int main (int argc, char **argv)
 		exit(status);
 	}
 
-	DBG1(DBG_APP, "Starting %sSwan "VERSION" IPsec [starter]...",
+	DBG1(DBG_APP, "Starting %sSwanCont "VERSION" IPsec [starter]...",
 		lib->settings->get_bool(lib->settings,
 			"charon.i_dont_care_about_security_and_use_aggressive_mode_psk",
 				FALSE) ? "weak" : "strong");
@@ -550,14 +565,14 @@ int main (int argc, char **argv)
 	}
 	if (stat(DEV_RANDOM, &stb) != 0)
 	{
-		DBG1(DBG_APP, "unable to start strongSwan IPsec -- no %s!", DEV_RANDOM);
+		DBG1(DBG_APP, "unable to start strongSwanCont IPsec -- no %s!", DEV_RANDOM);
 		cleanup();
 		exit(LSB_RC_FAILURE);
 	}
 
 	if (stat(DEV_URANDOM, &stb)!= 0)
 	{
-		DBG1(DBG_APP, "unable to start strongSwan IPsec -- no %s!", DEV_URANDOM);
+		DBG1(DBG_APP, "unable to start strongSwanCont IPsec -- no %s!", DEV_URANDOM);
 		cleanup();
 		exit(LSB_RC_FAILURE);
 	}
@@ -565,7 +580,7 @@ int main (int argc, char **argv)
 	cfg = confread_load(config_file);
 	if (cfg == NULL || cfg->err > 0)
 	{
-		DBG1(DBG_APP, "unable to start strongSwan -- fatal errors in config");
+		DBG1(DBG_APP, "unable to start strongSwanCont -- fatal errors in config");
 		if (cfg)
 		{
 			confread_free(cfg);
@@ -596,9 +611,7 @@ int main (int argc, char **argv)
 		exit(LSB_RC_SUCCESS);
 	}
 
-#ifdef GENERATE_SELFCERT
-	generate_selfcert();
-#endif
+	generate_secrets();
 
 	/* fork if we're not debugging stuff */
 	if (!no_fork)
