From e0fd0f51eab5a4c4d4f2dde39062fb736e272d65 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 24 Jul 2026 16:24:42 +0200 Subject: [PATCH] configure: Disable IKEv1 support by default The protocol has long been replaced by IKEv2 and is officially deprecated since several years (RFC 9395). As a first step to removing support for it completely, this makes the configure option disabled by default and warns users about its use. --- configure.ac | 9 ++++++++- testing/scripts/recipes/013_strongswan.mk | 1 + 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac index 32b277094..c86d28198 100644 --- a/configure.ac +++ b/configure.ac @@ -288,7 +288,7 @@ ARG_ENABL_SET([cert-enroll], [enable automatic certificate enrollment via EST # optional features ARG_ENABL_SET([bfd-backtraces], [use binutils libbfd to resolve backtraces for memory leaks and segfaults.]) ARG_ENABL_SET([dbghelp-backtraces],[use dbghlp.dll on Windows to create and print backtraces for memory leaks and segfaults.]) -ARG_DISBL_SET([ikev1], [disable IKEv1 protocol support in charon.]) +ARG_ENABL_SET([ikev1], [enable deprecated IKEv1 protocol support in charon.]) ARG_DISBL_SET([ikev2], [disable IKEv2 protocol support in charon.]) ARG_ENABL_SET([integrity-test], [enable integrity testing of libstrongswan and plugins.]) ARG_DISBL_SET([load-warning], [disable the charon plugin load option warning in starter.]) @@ -2108,3 +2108,10 @@ AC_MSG_RESULT([libcharon: $c_plugins]) AC_MSG_RESULT([libtnccs: $t_plugins]) AC_MSG_RESULT([libtpmtss: $p_plugins]) AC_MSG_RESULT([]) + +if test x$ikev1 = xtrue; then + AC_MSG_WARN(m4_normalize([ + The IKEv1 protocol is deprecated. Support will be removed soon (disable + this warning with --disable-ikev1)])) + AC_MSG_RESULT([]) +fi diff --git a/testing/scripts/recipes/013_strongswan.mk b/testing/scripts/recipes/013_strongswan.mk index b53164ece..d7963b84b 100644 --- a/testing/scripts/recipes/013_strongswan.mk +++ b/testing/scripts/recipes/013_strongswan.mk @@ -22,6 +22,7 @@ CONFIG_OPTS = \ --with-strongswan-conf=/etc/strongswan.conf.testing \ --with-random-device=/dev/urandom \ --disable-load-warning \ + --enable-ikev1 \ --enable-curl \ --enable-ldap \ --enable-eap-aka \