Commit 2265fcd1b4 for strongswan.org

commit 2265fcd1b44e79722a00d8b21d8dd921acd7a7a2
Author: Tobias Brunner <tobias@strongswan.org>
Date:   Mon Aug 24 16:21:49 2026 +0200

    stroke: Avoid underflow when reporting number of SAs

    Since 5.9.6, the number of half-open SAs includes queued initial IKE
    messages.  So that number could be higher than the number of managed
    SAs, which causes an underflow in the output.

    Fixes: b866ee88bf54 ("ike: Track unprocessed initial IKE messages like half-open IKE_SAs")

diff --git a/src/libcharon/plugins/stroke/stroke_list.c b/src/libcharon/plugins/stroke/stroke_list.c
index afa6a0e7f3..e8e982037d 100644
--- a/src/libcharon/plugins/stroke/stroke_list.c
+++ b/src/libcharon/plugins/stroke/stroke_list.c
@@ -645,9 +645,8 @@ METHOD(stroke_list_t, status, void,

 	half_open = charon->ike_sa_manager->get_half_open_count(
 										charon->ike_sa_manager, NULL, FALSE);
-	fprintf(out, "Security Associations (%u up, %u connecting):\n",
-		charon->ike_sa_manager->get_count(charon->ike_sa_manager) - half_open,
-		half_open);
+	fprintf(out, "Security Associations (%u total, %u connecting):\n",
+		charon->ike_sa_manager->get_count(charon->ike_sa_manager), half_open);
 	enumerator = charon->controller->create_ike_sa_enumerator(
 													charon->controller, wait);
 	while (enumerator->enumerate(enumerator, &ike_sa) && ferror(out) == 0)