Commit bf438cb182 for strongswan.org

commit bf438cb1826cd59040d51bb280ac2a29903825c9
Author: Tobias Brunner <tobias@strongswan.org>
Date:   Fri Jul 24 16:34:41 2026 +0200

    vici: Make IKEv2 the default IKE version

    We don't want to accept IKEv1 clients anymore by default, so we also
    warn them about it in the log.

diff --git a/src/libcharon/plugins/vici/vici_config.c b/src/libcharon/plugins/vici/vici_config.c
index dd426df53f..1f4914ff8c 100644
--- a/src/libcharon/plugins/vici/vici_config.c
+++ b/src/libcharon/plugins/vici/vici_config.c
@@ -2804,7 +2804,7 @@ CALLBACK(config_sn, bool,
 		.send_certreq = TRUE,
 		.send_cert = CERT_SEND_IF_ASKED,
 		.ocsp = OCSP_SEND_REPLY,
-		.version = IKE_ANY,
+		.version = IKEV2,
 		.remote_port = IKEV2_UDP_PORT,
 		.fragmentation = FRAGMENTATION_YES,
 		.unique = UNIQUE_NO,
@@ -2936,6 +2936,14 @@ CALLBACK(config_sn, bool,

 	log_peer_data(&peer);

+#ifdef USE_IKEV1
+	if (peer.version != IKEV2)
+	{
+		DBG0(DBG_CFG, "WARNING: IKEv1 support is deprecated and will be "
+			 "removed soon, configure 'version = 2' in order to use IKEv2");
+	}
+#endif
+
 	ike = (ike_cfg_create_t){
 		.version = peer.version,
 		.local = peer.local_addrs,
diff --git a/src/swanctl/swanctl.opt b/src/swanctl/swanctl.opt
index 18bf0b9159..71154e1d93 100644
--- a/src/swanctl/swanctl.opt
+++ b/src/swanctl/swanctl.opt
@@ -11,11 +11,11 @@ connections { # }
 connections.<conn> { # }
 	Section for an IKE connection named <conn>.

-connections.<conn>.version = 0
+connections.<conn>.version = 2
 	IKE major version to use for connection.

 	IKE major version to use for connection. _1_ uses IKEv1 aka ISAKMP, _2_
-	uses IKEv2. A connection using the default of _0_ accepts both IKEv1
+	uses IKEv2 (the default). A connection using _0_ accepts both IKEv1
 	and IKEv2 as responder, and initiates the connection actively with IKEv2.

 connections.<conn>.local_addrs = %any
diff --git a/testing/tests/ike/frags-ipv4/hosts/moon/etc/swanctl/swanctl.conf b/testing/tests/ike/frags-ipv4/hosts/moon/etc/swanctl/swanctl.conf
index 2d219cdf0d..43d490a0ad 100755
--- a/testing/tests/ike/frags-ipv4/hosts/moon/etc/swanctl/swanctl.conf
+++ b/testing/tests/ike/frags-ipv4/hosts/moon/etc/swanctl/swanctl.conf
@@ -13,12 +13,13 @@ connections {
       }
       children {
          net {
-            local_ts  = 10.1.0.0/16
+            local_ts  = 10.1.0.0/16

             updown = /usr/local/libexec/ipsec/_updown iptables
             esp_proposals = aes128-sha256-ecp256
          }
       }
+      version = 0
       mobike = no
       fragmentation = yes
       proposals = aes128-sha256-ecp256
diff --git a/testing/tests/ike/frags-ipv6/hosts/moon/etc/swanctl/swanctl.conf b/testing/tests/ike/frags-ipv6/hosts/moon/etc/swanctl/swanctl.conf
index a6241e9fa3..0cd6d097f0 100755
--- a/testing/tests/ike/frags-ipv6/hosts/moon/etc/swanctl/swanctl.conf
+++ b/testing/tests/ike/frags-ipv6/hosts/moon/etc/swanctl/swanctl.conf
@@ -1,7 +1,7 @@
 connections {

    rw {
-      local_addrs = fec0::1
+      local_addrs = fec0::1

       local {
          auth = pubkey
@@ -13,12 +13,13 @@ connections {
       }
       children {
          net {
-            local_ts = fec1::/16
+            local_ts = fec1::/16

             updown = /usr/local/libexec/ipsec/_updown iptables
             esp_proposals = aes128-sha256-ecp256
          }
       }
+      version = 0
       mobike = no
       fragmentation = yes
       proposals = aes128-sha256-ecp256