The default strongSwan configuration interface have been updated to vici since version 5.9.2_1.
To use the stroke interface by default either compile the port without the vici option or
set 'strongswan_interface="stroke"' in your rc.conf file.
If upgrading from > 5.9.2_1:
The default strongSwan configuration interface have been updated to vici.
To use the stroke interface by default either compile the port without the vici option or
set 'strongswan_interface="stroke"' in your rc.conf file.
Reason:
The stroke starter interface has been deprecated by upstream
for some time now. The default interface for controlling the charon
daemon has switched from stroke to vici. Users still using the
legacy config files such as ipsec.conf and ipsec.secret (stroke, starter)
can easily revert to the old behavior by:
# sysrc strongswan_interface="stroke"
It is recommended to use the vici interface which is configured by swanctl.conf.
Check : https://wiki.strongswan.org/projects/strongswan/wiki/Fromipsecconf
to ease the transition from ipsec.* to swanctl.conf
Number of commits found: 119 (showing only 100 on this page) #
security/strongswan: Disable loading of kernel-libipsec plugin
115e0906c85a enables building with KERNELLIBIPSEC option by default.
This changes loading order of plugins and brokes some existing
configurations.
PR: 298098295828
Approved by: blanket (fix runtime)
Sponsored by: FLEX-IT LLC
Sponsored by: UNIS Labs (vvd, commit patch)
security/strongswan: Enable ML plugin by default to allow Post-Quantum Key
Exchange Methods
Currently ML-DSA (used for Digital Signatures) is a draft in strongswan
(ETA Version 6.1.0 or later). So CNSA 2.0 cannot be fully supported yet.
https://linux-ipsec.org/slides/2025/steffen-pqc-auth-for-ikev2.pdf
But most firewalls (Palo Alto / Fortigate) already support ML-KEM Key
Exchange in addition to standard proposals.
E.g. aes128gcm16-ecp256-ke1_mlkem512.
More details:
https://docs.strongswan.org/docs/latest/config/proposals.html
PR: 294305
Approved by: strongswan@Nanoteq.com (maintainer, timeout 2 weeks)
Sponsored by: UNIS Labs
security/strongswan: Allow old stroke interface to be enabled
Note that strongSwan has deprecated the stroke management interface for
years, and it is recommended to migrate the configuration to vici before
it is removed.
PR: 285049
Mk/**ldap.mk: Convert USE_LDAP to USES=ldap
Convert the USE_LDAP=yes to USES=ldap and adds the following features:
- Adds the argument USES=ldap:server to add openldap2{4|5|6}-server as
RUN_DEPENDS
- Adds the argument USES=ldap<version> and replaces WANT_OPENLDAP_VER
- Adds OPENLDAP versions in bsd.default-versions.mk
- Adds USE_OPENLDAP/WANT_OPENLDAP_VER in Mk/bsd.sanity.mk
- Changes consumers to use the features
Reviewed by: delphij
Approved by: portmgr
Differential Revision: https://reviews.freebsd.org/D38233
security/strongswan: Add GCM option to OPTIONS_DEFAULT
Avoid the message:
"plugin 'gcm': failed to load - gcm_plugin_create not found and no
plugin file available"
According to strongSwan's 5.9.8 release notes[1]:
The gcm plugin has been enabled by default, so that the TLS 1.3 unit
tests (now indirectly enabled if the pki tool is built due to the
implementation of EST) can be completed successfully with just the
default plugins.
Let's also enable it by default.
[1]: https://github.com/strongswan/strongswan/releases/tag/5.9.8
PR: 267352
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
security/strongswan: Fix key derivation
An issue in the upstream port causes key derivation to fail in version 5.9.6.
A work around is to enable the KDF pluging by default.
PR: 264667
Reported by: strongswan@Nanoteq.com (maintainer)
security/strongswan: Fix default control-interface
Fix default control-interface in rc.d script and also
make it user-selectable at build time, defaulting to VICI.
Also mention this change in pkg-message, as previously the
default was "stroke" and it was changed to "vici" with
only a short notice in UPDATING, that was not displayed
when using binary upgrades.
Committing a portfmt'd version.
PR: 255952
Approved by: strongswan@Nanoteq.com (maintainer)
security/strongswan: Update to version 5.9.1
Changelog: https://wiki.strongswan.org/versions/79
PR: 252202
Submitted by: Jose Luis Duran <jlduran@gmail.com>
Approved by: strongswan@nanoteq.com (maintainer)
security/strongswan: load ipsec kernel module by rc script
From the following discussion: https://reviews.freebsd.org/D20163
It makes sense to add ipsec as required module for the rc script
of strongSwan.
PR: 243316
Submitted by: Dries Michiels <driesm.michiels@gmail.com>
Approved by: maintainer
security/strongswan: add vici-based configuration for the rc script
The rc script is modified to allow both a legacy (ipsec.conf-based)
startup or a new (swanctl.conf-based) config. Default is the legacy.
The new setup is based on vici, the Versatile IKE Configuration Interface.
For more details, see:
https://wiki.strongswan.org/projects/strongswan/wiki/Vici
PR: 234648
Submitted by: Jose Luis Duran <jlduran@gmail.com>
Reviewed by: Sam Chen <sc.gear@one.caeon.com>
Approved by: strongswan@Nanoteq.com (maintainer)
Differential Revision: D19367
security/strongswan: Minor port improvements
- Follow the same patching logic for swanctl.conf as the other config
files.
- Silence warning: $strongswan_enable not properly set.
PR: 235340
Submitted by: Jose Luis Duran <jlduran@gmail.com>
Approved by: strongswan@Nanoteq.com (maintainer)
security/strongswan: update to version 5.7.2
PR: 234882
Submitted by: Jose Luis Duran <jlduran@gmail.com>
Approved by: strongswan@Nanoteq.com (maintainer)
security/strongswan: Fix rc startup script to support rc.conf settings like
_nice, _fib
Do not bump version since I'll commit the upgrade to 5.7.1 just after it
PR: 211108
Submitted by: Dmitry Wagin <dmitry.wagin@ya.ru>
Approved by: maintainer
Sponsored by: Rubicon Communications, LLC (Netgate)
Update to 5.6.3
Fixes:
- Denial-of-Service Vulnerability in the IKEv2 key derivation
(CVE-2018-10811)
- Denial-of-Service Vulnerability in the stroke plugin
(CVE-2018-5388)
- Crash on FreeBSD that was present in 5.6.2
- The kernel-pfkey plugin optionally installs routes via internal
interface (one with an IP in the local traffic selector). On
FreeBSD, enabling this selects the correct source IP when sending
packets from the gateway itself.
PR: 228631
Submitted by: maintainer
security/strongswan: update 5.5.3 -> 5.6.0
- the gmp plugin responsible for CVE-2017-11185 is not enabled
in the FreeBSD build
PR: 221716
Relnotes: https://wiki.strongswan.org/versions/66
Reported by: i.dani@outlook.com
Approved by: strongswan@nanoteq.com (maintainer)
security/strongswan: enable options to increase usefulness of default pkg
- Enable PKI, SWANCTL, and VICI options (no external dependencies)
- Document IMPLIES dependency on VICI for SWANCTL; mention in SWANCTL_DESC
- Bump PORTREVISION
PR: 205438
Reported by: Nick B <nicblais@clkroot.net>
Submitted by: strongswan@Nanoteq.com (maintainer)
- Update unbound to 1.5.7
- Bump PORTREVISIOn on dependent ports
Some Upgrade Notes:
This release fixes a validation failure for nodata with wildcards and
emptynonterminals. Fixes OpenSSL Library compability. Fixes correct
response for malformed EDNS queries. For crypto in libunbound there is
libnettle support.
Qname minimisation is implemented. Use qname-minimisation: yes to
enable it. This version sends the full query name when an error is
found for intermediate names. It should therefore not fail for names
on nonconformant servers. It combines well with
harden-below-nxdomain: yes because those nxdomains are probed by the
(Only the first 15 lines of the commit message are shown above )
Add @sample to gcm.conf missed when I introduced it. No bump on PORTREVISION
since GCM is disabled by default
Submitted by: Jose Luis Duran
Obtained from: https://github.com/pfsense/FreeBSD-ports/pull/2
- Add a new option, SWANCTL, to install swanctll utility
- When VICI option is selected, install libvici.h to include directory,
it's useful when you need to build a custom code linked to libvici
- Pass path to USE_LDCONFIG otherwise libraries will not be visible
PR: 204098
Approved by: maintainer
Obtained from: pfSense
Sponsored by: Rubicon Communications (Netgate)
- Add a new option (VICI) to build VICI management protocol
- Change SMP option description to show users it's deprecated
PR: 204090
Approved by: maintainer
strongSwan can be beuit using 3 different printf hooks: builtin, glibc
(compatible with FreeBSD's libc) and vstr (devel/vstr). Since it's not
selected any of them on CONFIGURE_ARGS, it uses auto, and end up using
glibc.
pfSense users reported memory leaks on strongSwan [2] [3] and a it was
reported to upstream [1].
Add a single option and let user choose which printf hook to use, and
change default to use builtin. Bump PORTREVISION due to default change
[1] https://wiki.strongswan.org/issues/1106
[2] https://forum.pfsense.org/index.php?topic=96767.0
[3] https://redmine.pfsense.org/issues/5149
PR: 204051
Approved by: maintainer
Obtained from: pfSense
MFH: 2015Q4
Sponsored by: Rubicon Communications (Netgate)
Add patches to fix Strongswan Management Protocol
SMP is an XML control interface for Strongswan used by pfSense and
Opnsense. SMP has been deprecated by upstream since 5.2.0 in favor of a
newer IPC mechanism called VICI. As a result upstream is not motivated
to take patches for SMP, and this uses non-portable strlcpy anyway.
The code has not been deleted from the project and if we can bludgeon it
into a working state I see no harm.
PR: 199442
