Skip to content

T8099: Update strongswan to 6.0.6 #1222

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dmbaturin merged 2 commits into from
Jun 19, 2026
Merged

T8099: Update strongswan to 6.0.6 #1222

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8c11ba4
T8099: Fix strongswan build
hedrok Jun 4, 2026
71dcf95
T8099: Update strongswan to 6.0.6
hedrok Jun 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 2 additions & 18 deletions data/live-build-config/hooks/live/30-strongswan-configs.chroot
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,38 +6,22 @@
# Since we do not do remote access IPsec, the simplest solution
# is to disable it entirely from the start.

import re

# Disable the 'cisco_unity' option in charon.conf
with open('/etc/strongswan.d/charon.conf', 'r') as f:
charon_conf = f.read()
charon_conf = re.sub(r'# (cisco_unity = no)', r"\1", charon_conf)

with open('/etc/strongswan.d/charon.conf', 'w') as f:
f.write(charon_conf)



# Prevent the 'cisco_unity' plugin from loading
with open('/etc/strongswan.d/charon/unity.conf', 'r') as f:
unity_conf = f.read()
unity_conf = re.sub(r'load = yes', r'load = no', unity_conf)
unity_conf = unity_conf.replace('load = yes', 'load = no')

with open('/etc/strongswan.d/charon/unity.conf', 'w') as f:
f.write(unity_conf)



# Prevent the 'farp' plugin from loading
with open('/etc/strongswan.d/charon/farp.conf', 'r') as f:
farp_conf = f.read()

farp_conf = re.sub(r'load = yes', r'load = no', farp_conf)
farp_conf = farp_conf.replace('load = yes', 'load = no')

with open('/etc/strongswan.d/charon/farp.conf', 'w') as f:
f.write(farp_conf)


# Add ike-name to logging
charon_logging = """
charon {
Expand Down
10 changes: 8 additions & 2 deletions scripts/package-build/strongswan/package.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,14 +1,20 @@
[[packages]]
name = "strongswan"
commit_id = "debian/5.9.11-2"
commit_id = "debian/6.0.6-1"
scm_url = "https://salsa.debian.org/debian/strongswan.git"

# systemd now contains pkg-config files and systemd-dev is not needed
# this changes debian/control so the change is needed before mk-build-deps
# call so cannot be included in normal patches
pre_build_hook = "sed -i '/ systemd-dev /d' debian/control"

@coderabbitai coderabbitai Bot Jun 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Brittle sed match may fail to remove systemd-dev.

Line 9 uses / systemd-dev /, which misses common control-file tokens like systemd-dev,. If it misses, the original dependency conflict remains and the build fix is ineffective.

Suggested fix 
-pre_build_hook = "sed -i '/ systemd-dev /d' debian/control"
+pre_build_hook = "sed -Ei '/\\bsystemd-dev\\b/d' debian/control"
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
pre_build_hook = "sed -i '/ systemd-dev /d' debian/control"
pre_build_hook = "sed -Ei '/\\bsystemd-dev\\b/d' debian/control"
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/package-build/strongswan/package.toml` at line 9, pre_build_hook
currently uses a brittle sed pattern "/ systemd-dev /" that can miss tokens like
"systemd-dev,"; update the pre_build_hook in package.toml to a more robust sed
invocation that removes the systemd-dev token regardless of surrounding
punctuation or line position (e.g., use a word-boundary-aware pattern such as
sed -i -E 's/(^|[[:space:],;])systemd-dev([[:space:],;]|$)/\1\2/g'
debian/control) so the dependency is reliably stripped; edit the pre_build_hook
entry (the string assigned to pre_build_hook) to replace the old sed command
with the improved pattern.


# build_cmd = "cd ..; yes | ./build.sh; ./build-vici.sh"
build_cmd = """
set -e
export DEBEMAIL="maintainers@vyos.net"
export DEBFULLNAME="VyOS Package Maintainers"

dch -v "5.9.11-2+vyos0" "Patchset for DMVPN support" -b
dch -v "6.0.6-1+vyos0" "Patchset for DMVPN support" -b
dpkg-buildpackage -uc -us -tc -b -d
cd ..; ./build-vici.sh
"""
Expand Down
103 changes: 51 additions & 52 deletions ...ngswan/patches/strongswan/0001-charon-add-optional-source-and-remote-overrides-for-.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,7 @@
From db627ec8a8e72bc6b23dc8ab00f4e6b4f448d01c Mon Sep 17 00:00:00 2001
From 309525ae10f390991f3bda79596142ba14b4994d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
Date: Mon, 21 Sep 2015 13:41:58 +0300
Subject: [PATCH 1/3] charon: add optional source and remote overrides for
initiate
Subject: [PATCH] charon: add optional source and remote overrides for initiate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Expand All @@ -21,19 +20,19 @@ Signed-off-by: Timo Teräs <timo.teras@iki.fi>
src/libcharon/control/controller.h | 3 +
src/libcharon/plugins/stroke/stroke_control.c | 5 +-
src/libcharon/plugins/vici/vici_config.c | 2 +-
src/libcharon/plugins/vici/vici_control.c | 64 ++++++++++++++++---
src/libcharon/plugins/vici/vici_control.c | 65 ++++++++++++++++---
.../processing/jobs/start_action_job.c | 2 +-
src/libcharon/sa/ike_sa_manager.c | 50 ++++++++++++++-
src/libcharon/sa/ike_sa_manager.c | 50 +++++++++++++-
src/libcharon/sa/ike_sa_manager.h | 8 ++-
src/libcharon/sa/trap_manager.c | 44 +++++--------
src/swanctl/commands/initiate.c | 40 +++++++++++-
11 files changed, 215 insertions(+), 47 deletions(-)
11 files changed, 216 insertions(+), 47 deletions(-)

diff --git a/src/charon-cmd/cmd/cmd_connection.c b/src/charon-cmd/cmd/cmd_connection.c
index 2e2cb3c..b9369a8 100644
index 65e522765..bfa07b812 100644
--- a/src/charon-cmd/cmd/cmd_connection.c
+++ b/src/charon-cmd/cmd/cmd_connection.c
@@ -439,7 +439,7 @@ static job_requeue_t initiate(private_cmd_connection_t *this)
@@ -453,7 +453,7 @@ static job_requeue_t initiate(private_cmd_connection_t *this)
child_cfg = create_child_cfg(this, peer_cfg);

if (charon->controller->initiate(charon->controller, peer_cfg, child_cfg,
Expand All @@ -43,7 +42,7 @@ index 2e2cb3c..b9369a8 100644
terminate(pid);
}
diff --git a/src/libcharon/control/controller.c b/src/libcharon/control/controller.c
index 027f48e..4ce8616 100644
index 42a4822bb..99133ee94 100644
--- a/src/libcharon/control/controller.c
+++ b/src/libcharon/control/controller.c
@@ -15,6 +15,28 @@
Expand Down Expand Up @@ -92,32 +91,31 @@ index 027f48e..4ce8616 100644
/**
* unique ID, used for various methods
*/
@@ -417,10 +449,15 @@ METHOD(job_t, initiate_execute, job_requeue_t,
@@ -438,9 +470,14 @@ METHOD(job_t, initiate_execute, job_requeue_t,
{
ike_sa_t *ike_sa;
interface_listener_t *listener = &job->listener;
peer_cfg_t *peer_cfg = listener->peer_cfg;
+ host_t *my_host = listener->my_host;
+ host_t *other_host = listener->other_host;

ike_sa = charon->ike_sa_manager->checkout_by_config(charon->ike_sa_manager,
- peer_cfg);
+ peer_cfg, my_host, other_host);
peer_cfg->destroy(peer_cfg);
- listener->peer_cfg);
+ listener->peer_cfg, my_host, other_host);
+ DESTROY_IF(my_host);
+ DESTROY_IF(other_host);
+
if (!ike_sa)
{
DESTROY_IF(listener->child_cfg);
@@ -499,6 +536,7 @@ METHOD(job_t, initiate_execute, job_requeue_t,
listener->status = FAILED;
@@ -520,6 +557,7 @@ METHOD(job_t, initiate_execute, job_requeue_t,

METHOD(controller_t, initiate, status_t,
private_controller_t *this, peer_cfg_t *peer_cfg, child_cfg_t *child_cfg,
+ host_t *my_host, host_t *other_host,
controller_cb_t callback, void *param, level_t max_level, u_int timeout,
bool limits)
{
@@ -523,6 +561,8 @@ METHOD(controller_t, initiate, status_t,
@@ -545,6 +583,8 @@ METHOD(controller_t, initiate, status_t,
.status = FAILED,
.child_cfg = child_cfg,
.peer_cfg = peer_cfg,
Expand All @@ -127,7 +125,7 @@ index 027f48e..4ce8616 100644
.options.limits = limits,
},
diff --git a/src/libcharon/control/controller.h b/src/libcharon/control/controller.h
index 36a1d46..a130fbb 100644
index 36a1d4631..a130fbb6b 100644
--- a/src/libcharon/control/controller.h
+++ b/src/libcharon/control/controller.h
@@ -81,6 +81,8 @@ struct controller_t {
Expand All @@ -148,7 +146,7 @@ index 36a1d46..a130fbb 100644
level_t max_level, u_int timeout, bool limits);

diff --git a/src/libcharon/plugins/stroke/stroke_control.c b/src/libcharon/plugins/stroke/stroke_control.c
index 2824c93..21ff6b3 100644
index 2824c93cb..21ff6b31f 100644
--- a/src/libcharon/plugins/stroke/stroke_control.c
+++ b/src/libcharon/plugins/stroke/stroke_control.c
@@ -109,7 +109,7 @@ static void charon_initiate(private_stroke_control_t *this, peer_cfg_t *peer_cfg
Expand All @@ -171,11 +169,11 @@ index 2824c93..21ff6b3 100644
switch (status)
{
diff --git a/src/libcharon/plugins/vici/vici_config.c b/src/libcharon/plugins/vici/vici_config.c
index 5221225..b1486e3 100644
index dd426df53..324935be1 100644
--- a/src/libcharon/plugins/vici/vici_config.c
+++ b/src/libcharon/plugins/vici/vici_config.c
@@ -2252,7 +2252,7 @@ static void run_start_action(private_vici_config_t *this, peer_cfg_t *peer_cfg,
DBG1(DBG_CFG, "initiating '%s'", child_cfg->get_name(child_cfg));
@@ -2395,7 +2395,7 @@ static void run_start_action(private_vici_config_t *this, peer_cfg_t *peer_cfg,
DBG1(DBG_CFG, "vici initiating '%s'", child_cfg->get_name(child_cfg));
charon->controller->initiate(charon->controller,
peer_cfg->get_ref(peer_cfg), child_cfg->get_ref(child_cfg),
- NULL, NULL, 0, 0, FALSE);
Expand All @@ -184,7 +182,7 @@ index 5221225..b1486e3 100644
}

diff --git a/src/libcharon/plugins/vici/vici_control.c b/src/libcharon/plugins/vici/vici_control.c
index 1c236d2..811d8db 100644
index 1c236d249..811d8dbc7 100644
--- a/src/libcharon/plugins/vici/vici_control.c
+++ b/src/libcharon/plugins/vici/vici_control.c
@@ -15,6 +15,28 @@
Expand Down Expand Up @@ -300,7 +298,7 @@ index 1c236d2..811d8db 100644

/**
diff --git a/src/libcharon/processing/jobs/start_action_job.c b/src/libcharon/processing/jobs/start_action_job.c
index 122e5ce..dec458c 100644
index 122e5cee9..dec458c84 100644
--- a/src/libcharon/processing/jobs/start_action_job.c
+++ b/src/libcharon/processing/jobs/start_action_job.c
@@ -84,7 +84,7 @@ METHOD(job_t, execute, job_requeue_t,
Expand All @@ -313,7 +311,7 @@ index 122e5ce..dec458c 100644
}
children->destroy(children);
diff --git a/src/libcharon/sa/ike_sa_manager.c b/src/libcharon/sa/ike_sa_manager.c
index fc31c2a..51e28bc 100644
index 7796efb65..39852578d 100644
--- a/src/libcharon/sa/ike_sa_manager.c
+++ b/src/libcharon/sa/ike_sa_manager.c
@@ -16,6 +16,28 @@
Expand Down Expand Up @@ -345,7 +343,7 @@ index fc31c2a..51e28bc 100644
#include <string.h>
#include <inttypes.h>

@@ -1497,7 +1519,8 @@ typedef struct {
@@ -1515,7 +1537,8 @@ typedef struct {
} config_entry_t;

METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
Expand All @@ -355,7 +353,7 @@ index fc31c2a..51e28bc 100644
{
enumerator_t *enumerator;
entry_t *entry;
@@ -1508,7 +1531,17 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
@@ -1526,7 +1549,17 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
u_int segment;
int i;

Expand All @@ -374,7 +372,7 @@ index fc31c2a..51e28bc 100644

if (!this->reuse_ikesa && peer_cfg->get_ike_version(peer_cfg) != IKEV1)
{ /* IKE_SA reuse disabled by config (not possible for IKEv1) */
@@ -1566,6 +1599,15 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
@@ -1586,6 +1619,15 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
continue;
}

Expand All @@ -390,7 +388,7 @@ index fc31c2a..51e28bc 100644
current_peer = entry->ike_sa->get_peer_cfg(entry->ike_sa);
if (current_peer && current_peer->equals(current_peer, peer_cfg))
{
@@ -1592,6 +1634,10 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
@@ -1612,6 +1654,10 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
{
ike_sa->set_peer_cfg(ike_sa, peer_cfg);
checkout_new(this, ike_sa);
Expand All @@ -402,7 +400,7 @@ index fc31c2a..51e28bc 100644
}
charon->bus->set_sa(charon->bus, ike_sa);
diff --git a/src/libcharon/sa/ike_sa_manager.h b/src/libcharon/sa/ike_sa_manager.h
index 004cc22..50f8246 100644
index 004cc2216..50f8246f8 100644
--- a/src/libcharon/sa/ike_sa_manager.h
+++ b/src/libcharon/sa/ike_sa_manager.h
@@ -123,7 +123,8 @@ struct ike_sa_manager_t {
Expand Down Expand Up @@ -430,19 +428,19 @@ index 004cc22..50f8246 100644
/**
* Reset initiator SPI.
diff --git a/src/libcharon/sa/trap_manager.c b/src/libcharon/sa/trap_manager.c
index d8d8a42..e7c906e 100644
index 90a29b29b..0d8447bfe 100644
--- a/src/libcharon/sa/trap_manager.c
+++ b/src/libcharon/sa/trap_manager.c
@@ -523,7 +523,7 @@ METHOD(trap_manager_t, acquire, void,
@@ -532,7 +532,7 @@ METHOD(trap_manager_t, acquire, void,
peer_cfg_t *peer;
child_cfg_t *child;
ike_sa_t *ike_sa;
- host_t *host;
+ host_t *host, *my_host = NULL, *other_host = NULL;
bool wildcard, ignore = FALSE;
- host_t *host = NULL;
+ host_t *host = NULL, *my_host = NULL, *other_host = NULL;
uint32_t allocated_reqid, seq = 0;
bool wildcard;

this->lock->read_lock(this->lock);
@@ -600,37 +600,27 @@ METHOD(trap_manager_t, acquire, void,
@@ -617,37 +617,27 @@ METHOD(trap_manager_t, acquire, void,
this->lock->unlock(this->lock);

if (wildcard)
Expand All @@ -457,34 +455,32 @@ index d8d8a42..e7c906e 100644
-
- ike_sa->set_peer_cfg(ike_sa, peer);
- ike_cfg = ike_sa->get_ike_cfg(ike_sa);
-
+ {
+ ike_cfg_t *ike_cfg;
+ uint16_t port;
+ uint8_t mask;

- port = ike_cfg->get_other_port(ike_cfg);
- data->dst->to_subnet(data->dst, &host, &mask);
- host->set_port(host, port);
- ike_sa->set_other_host(ike_sa, host);
-
+ ike_cfg = peer->get_ike_cfg(peer);

- port = ike_cfg->get_my_port(ike_cfg);
- data->src->to_subnet(data->src, &host, &mask);
- host->set_port(host, port);
- ike_sa->set_my_host(ike_sa, host);
-
+ port = ike_cfg->get_other_port(ike_cfg);
+ data->dst->to_subnet(data->dst, &other_host, &mask);
+ other_host->set_port(other_host, port);

- charon->bus->set_sa(charon->bus, ike_sa);
- }
- }
- else
{
- {
- ike_sa = charon->ike_sa_manager->checkout_by_config(
- charon->ike_sa_manager, peer);
+ ike_cfg_t *ike_cfg;
+ uint16_t port;
+ uint8_t mask;
+
+ ike_cfg = peer->get_ike_cfg(peer);
+
+ port = ike_cfg->get_other_port(ike_cfg);
+ data->dst->to_subnet(data->dst, &other_host, &mask);
+ other_host->set_port(other_host, port);
+
+ port = ike_cfg->get_my_port(ike_cfg);
+ data->src->to_subnet(data->src, &my_host, &mask);
+ my_host->set_port(my_host, port);
Expand All @@ -499,7 +495,7 @@ index d8d8a42..e7c906e 100644
if (ike_sa)
{
diff --git a/src/swanctl/commands/initiate.c b/src/swanctl/commands/initiate.c
index e0fffb9..dcaded5 100644
index e0fffb907..dcaded59d 100644
--- a/src/swanctl/commands/initiate.c
+++ b/src/swanctl/commands/initiate.c
@@ -14,6 +14,28 @@
Expand Down Expand Up @@ -577,3 +573,6 @@ index e0fffb9..dcaded5 100644
{"timeout", 't', 1, "timeout in seconds before detaching"},
{"raw", 'r', 0, "dump raw response message"},
{"pretty", 'P', 0, "dump raw response message in pretty print"},
--
2.51.2

Loading
Loading