From a3ebb9545a9c600ee16b00649cffe95efdb40b74 Mon Sep 17 00:00:00 2001 From: Florian Eckert Date: Wed, 30 Sep 2026 16:02:24 +0200 Subject: [PATCH] strongswan: mark proposals and esp_proposals as optional The proposals (IKE_SA) and esp_proposals (CHILD_SA) settings in swanctl.conf do not have to be configured explicitly. If omitted, charon falls back to its default proposals: - IKE: the default proposals include all algorithms supported by the loaded plugins that are not considered insecure. - ESP: the default proposals are hard-coded, as the kernel can't be queried for its supported algorithms. They include the supported key exchange methods as well as "none", which makes PFS optional. The default ESP proposal is only used if neither ah_proposals nor esp_proposals are configured for a CHILD_SA. Update the config to reflect that both options are optional. Signed-off-by: Florian Eckert --- net/strongswan/files/swanctl.init | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init index e39656c02b..46a4b34f9b 100644 --- a/net/strongswan/files/swanctl.init +++ b/net/strongswan/files/swanctl.init @@ -390,7 +390,7 @@ config_child() { [ -n "$if_id" ] && swanctl_xappend4 "if_id_in = $if_id" "if_id_out = $if_id" [ -n "$start_action" -a "$start_action" != "none" ] && swanctl_xappend4 "start_action = $start_action" [ -n "$close_action" -a "$close_action" != "none" ] && swanctl_xappend4 "close_action = $close_action" - swanctl_xappend4 "esp_proposals = $esp_proposal" + [ -n "$esp_proposal" ] && swanctl_xappend4 "esp_proposals = $esp_proposal" swanctl_xappend4 "mode = $mode" if [ -n "$life_time" ]; then @@ -726,7 +726,7 @@ config_connection() { fi [ -n "$over_time" ] && swanctl_xappend2 "over_time = $over_time" - swanctl_xappend2 "proposals = $ike_proposal" + [ -n "$ike_proposal" ] && swanctl_xappend2 "proposals = $ike_proposal" [ -n "$dpd_delay" ] && swanctl_xappend2 "dpd_delay = $dpd_delay" [ $encap -eq 1 ] && swanctl_xappend2 "encap = yes" || swanctl_xappend2 "encap = no" [ "$keyingtries" = "%forever" ] && swanctl_xappend2 "keyingtries = 0" || swanctl_xappend2 "keyingtries = $keyingtries"