From 194ce7f2a6db159d850f9b2530e9aba9cd3a6731 Mon Sep 17 00:00:00 2001 From: Florian Eckert Date: Wed, 7 Oct 2026 13:58:18 +0200 Subject: [PATCH] strongswan: add uci option for aggressive mode PSK Add option 'aggressive' to the globals section of /etc/config/ipsec. When enabled, the charon setting 'i_dont_care_about_security_and_use_aggressive_mode_psk = yes' is written to the generated strongswan.conf. The setting is only emitted when the option is active. IKEv1 aggressive mode with PSK is sometimes required to interoperate with old peers that do not support main mode with PSK. If enabled, IKE Responders are allowed to use IKEv1 Aggressive Mode with Pre-Shared Keys (PSKs). This is strongly discouraged due to security concerns (offline attacks on the openly transmitted hash of the PSK). Signed-off-by: Florian Eckert --- net/strongswan/files/swanctl.init | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init index bd512f756e..b781ee9759 100644 --- a/net/strongswan/files/swanctl.init +++ b/net/strongswan/files/swanctl.init @@ -917,6 +917,16 @@ config_charon_common_install_routes() { swan_xappend1 "install_routes = $install_routes" } +config_charon_common_aggressive() { + local conf="$1" + + local aggressive + + config_get_bool aggressive "$conf" aggressive 0 + [ $aggressive -eq 1 ] && \ + swan_xappend1 "i_dont_care_about_security_and_use_aggressive_mode_psk = yes" +} + config_charon_common() { local conf="$1" @@ -924,6 +934,7 @@ config_charon_common() { config_charon_common_interfaces_use "$conf" config_charon_common_ignore_routing_tables "$conf" config_charon_common_install_routes "$conf" + config_charon_common_aggressive "$conf" } config_strongswan_generate() {