Merge commit 'default-plugins'

Changes the default crypto plugins from the built-in ones to openssl.

configure.ac

@@ -132,7 +132,7 @@ AC_SUBST(ipsec_script_upper, [`echo -n "$ipsec_script" | tr a-z A-Z`])
 m4_include(m4/macros/enable-disable.m4)
 
 # crypto plugins
-ARG_DISBL_SET([aes],            [disable AES software implementation plugin.])
+ARG_ENABL_SET([aes],            [enable AES software implementation plugin.])
 ARG_ENABL_SET([af-alg],         [enable AF_ALG crypto interface to Linux Crypto API.])
 ARG_ENABL_SET([blowfish],       [enable Blowfish software implementation plugin.])
 ARG_ENABL_SET([botan],          [enables the Botan crypto plugin.])
@@ -140,29 +140,29 @@ ARG_ENABL_SET([ccm],            [enables the CCM AEAD wrapper crypto plugin.])
 ARG_ENABL_SET([chapoly],        [enables the ChaCha20/Poly1305 AEAD plugin.])
 ARG_DISBL_SET([cmac],           [disable CMAC crypto implementation plugin.])
 ARG_ENABL_SET([ctr],            [enables the Counter Mode wrapper crypto plugin.])
-ARG_DISBL_SET([des],            [disable DES/3DES software implementation plugin.])
+ARG_ENABL_SET([des],            [enable DES/3DES software implementation plugin.])
 ARG_DISBL_SET([drbg],           [disable the NIST Deterministic Random Bit Generator plugin.])
-ARG_DISBL_SET([fips-prf],       [disable FIPS PRF software implementation plugin.])
-ARG_DISBL_SET([gcm],            [disable the GCM AEAD wrapper crypto plugin.])
+ARG_ENABL_SET([fips-prf],       [enable FIPS PRF software implementation plugin.])
+ARG_ENABL_SET([gcm],            [enable the GCM AEAD wrapper crypto plugin.])
 ARG_ENABL_SET([gcrypt],         [enables the libgcrypt plugin.])
-ARG_DISBL_SET([gmp],            [disable GNU MP (libgmp) based crypto implementation plugin.])
-ARG_DISBL_SET([curve25519],     [disable Curve25519 Diffie-Hellman plugin.])
-ARG_DISBL_SET([hmac],           [disable HMAC crypto implementation plugin.])
+ARG_ENABL_SET([gmp],            [enable GNU MP (libgmp) based crypto implementation plugin.])
+ARG_ENABL_SET([curve25519],     [enable Curve25519 Diffie-Hellman plugin.])
+ARG_ENABL_SET([hmac],           [enable HMAC crypto implementation plugin.])
 ARG_DISBL_SET([kdf],            [disable KDF (prf+) implementation plugin.])
 ARG_ENABL_SET([md4],            [enable MD4 software implementation plugin.])
-ARG_DISBL_SET([md5],            [disable MD5 software implementation plugin.])
+ARG_ENABL_SET([md5],            [enable MD5 software implementation plugin.])
 ARG_ENABL_SET([mgf1],           [enable the MGF1 software implementation plugin.])
 ARG_ENABL_SET([ml],             [enable Module-Lattice-based crypto (ML-KEM) plugin.])
 ARG_DISBL_SET([nonce],          [disable nonce generation plugin.])
-ARG_ENABL_SET([openssl],        [enables the OpenSSL crypto plugin.])
+ARG_DISBL_SET([openssl],        [disable the OpenSSL crypto plugin.])
 ARG_ENABL_SET([wolfssl],        [enables the wolfSSL crypto plugin.])
 ARG_ENABL_SET([padlock],        [enables VIA Padlock crypto plugin.])
 ARG_DISBL_SET([random],         [disable RNG implementation on top of /dev/(u)random.])
-ARG_DISBL_SET([rc2],            [disable RC2 software implementation plugin.])
+ARG_ENABL_SET([rc2],            [enable RC2 software implementation plugin.])
 ARG_ENABL_SET([rdrand],         [enable Intel RDRAND random generator plugin.])
 ARG_ENABL_SET([aesni],          [enable Intel AES-NI crypto plugin.])
-ARG_DISBL_SET([sha1],           [disable SHA1 software implementation plugin.])
-ARG_DISBL_SET([sha2],           [disable SHA256/SHA384/SHA512 software implementation plugin.])
+ARG_ENABL_SET([sha1],           [enable SHA1 software implementation plugin.])
+ARG_ENABL_SET([sha2],           [enable SHA256/SHA384/SHA512 software implementation plugin.])
 ARG_ENABL_SET([sha3],           [enable SHA3_224/SHA3_256/SHA3_384/SHA3_512 software implementation plugin.])
 ARG_DISBL_SET([xcbc],           [disable xcbc crypto implementation plugin.])
 # encoding/decoding plugins
@@ -172,7 +172,7 @@ ARG_DISBL_SET([pgp],            [disable PGP key decoding plugin.])
 ARG_DISBL_SET([pkcs1],          [disable PKCS1 key decoding plugin.])
 ARG_DISBL_SET([pkcs7],          [disable PKCS7 container support plugin.])
 ARG_DISBL_SET([pkcs8],          [disable PKCS8 private key decoding plugin.])
-ARG_DISBL_SET([pkcs12],         [disable PKCS12 container support plugin.])
+ARG_ENABL_SET([pkcs12],         [enable PKCS12 container support plugin.])
 ARG_DISBL_SET([pubkey],         [disable RAW public key support plugin.])
 ARG_DISBL_SET([sshkey],         [disable SSH key decoding plugin.])
 ARG_DISBL_SET([x509],           [disable X509 certificate implementation plugin.])
@@ -235,7 +235,7 @@ ARG_DISBL_SET([socket-default], [disable default socket implementation for charo
 ARG_ENABL_SET([socket-dynamic], [enable dynamic socket implementation for charon])
 ARG_ENABL_SET([socket-win],     [enable Winsock2 based socket implementation for charon])
 # configuration/control plugins
-ARG_DISBL_SET([stroke],         [disable charons stroke configuration backend.])
+ARG_ENABL_SET([stroke],         [enable the stroke configuration backend.])
 ARG_ENABL_SET([smp],            [enable SMP configuration and control interface. Requires libxml.])
 ARG_ENABL_SET([sql],            [enable SQL database configuration backend.])
 ARG_ENABL_SET([uci],            [enable OpenWRT UCI configuration plugin.])
@@ -468,6 +468,10 @@ if test x$fips_prf = xtrue; then
 	fi
 fi
 
+if test x$pkcs12 = xtrue; then
+	rc2=true;
+fi
+
 if test x$swanctl = xtrue; then
 	vici=true
 fi

scripts/test.sh

@@ -214,6 +214,9 @@ case "$TEST" in
 default)
 	# should be the default, but lets make sure
 	CONFIG="--with-printf-hooks=glibc"
+	if system_uses_openssl3; then
+		prepare_system_openssl $1
+	fi
 	;;
 openssl*)
 	CONFIG="--disable-defaults --enable-pki --enable-openssl --enable-pem --enable-drbg"
@@ -253,6 +256,9 @@ wolfssl)
 	;;
 printf-builtin)
 	CONFIG="--with-printf-hooks=builtin"
+	if system_uses_openssl3; then
+		prepare_system_openssl $1
+	fi
 	;;
 all|alpine|codeql|coverage|sonarcloud|no-dbg)
 	if [ "$TEST" = "sonarcloud" ]; then

testing/scripts/build-certs-chroot

@@ -356,7 +356,7 @@ openssl pkcs12 -export -inkey ${HOST_KEY} -in ${HOST_CERT} -name "sun" \
         -certpbe aes-128-cbc -macalg sha256 -passout "pass:IxjQVCF3JGI+MoPi" > ${SUN_PKCS12}
 
 # Put a PKCS#12 copy into the botan/net2net-pkcs12 scenario
-for t in botan/net2net-pkcs12 openssl-ikev2/net2net-pkcs12
+for t in botan/net2net-pkcs12
 do
   TEST="${TEST_DIR}/${t}"
   mkdir -p ${TEST}/hosts/moon/${SWANCTL_DIR}/pkcs12
@@ -762,13 +762,6 @@ pki --issue --cakey ${CA_KEY} --cacert ${CA_CERT} --crl ${CA_CDP} --type rsa \
     --outform pem > ${TEST_CERT}
 cp ${TEST_CERT} ${CA_DIR}/certs/${SERIAL}.pem
 
-# Put a copy in the openssl-ikev2/critical extension scenario
-TEST="${TEST_DIR}/openssl-ikev2/critical-extension"
-mkdir -p ${TEST}/hosts/moon/${SWANCTL_DIR}/rsa
-mkdir -p ${TEST}/hosts/moon/${SWANCTL_DIR}/x509
-cp ${TEST_KEY} ${TEST}/hosts/moon/${SWANCTL_DIR}/rsa
-cp ${TEST_CERT} ${TEST}/hosts/moon/${SWANCTL_DIR}/x509
-
 # Generate sun certificate with an unsupported critical X.509 extension
 TEST="${TEST_DIR}/ikev2/critical-extension"
 TEST_KEY="${TEST}/hosts/sun/${SWANCTL_DIR}/rsa/sunKey.pem"
@@ -785,13 +778,6 @@ pki --issue --cakey ${CA_KEY} --cacert ${CA_CERT} --crl ${CA_CDP} --type rsa \
     --outform pem > ${TEST_CERT}
 cp ${TEST_CERT} ${CA_DIR}/certs/${SERIAL}.pem
 
-# Put a copy in the openssl-ikev2/critical extension scenario
-TEST="${TEST_DIR}/openssl-ikev2/critical-extension"
-mkdir -p ${TEST}/hosts/sun/${SWANCTL_DIR}/rsa
-mkdir -p ${TEST}/hosts/sun/${SWANCTL_DIR}/x509
-cp ${TEST_KEY} ${TEST}/hosts/sun/${SWANCTL_DIR}/rsa
-cp ${TEST_CERT} ${TEST}/hosts/sun/${SWANCTL_DIR}/x509
-
 # Generate winnetou server certificate
 HOST_KEY="${CA_DIR}/winnetouKey.pem"
 HOST_CERT="${CA_DIR}/winnetouCert.pem"
@@ -1153,10 +1139,10 @@ pki --self --type ecdsa --in ${ECDSA_KEY} \
     --dn "C=CH, O=${PROJECT}, CN=strongSwan EC Root CA" \
     --outform pem > ${ECDSA_CERT}
 
-# Put a copy in the openssl-ikev2/ecdsa-certs scenario
+# Put a copy in the ikev2/ecdsa-certs scenario
 for t in ecdsa-certs ecdsa-pkcs8
 do
-  TEST="${TEST_DIR}/openssl-ikev2/${t}"
+  TEST="${TEST_DIR}/ikev2/${t}"
   for h in moon carol dave
   do
     mkdir -p ${TEST}/hosts/${h}/${SWANCTL_DIR}/x509ca
@@ -1165,7 +1151,7 @@ do
 done
 
 # Generate a moon ECDSA 521 bit certificate
-TEST="${TEST_DIR}/openssl-ikev2/ecdsa-certs"
+TEST="${TEST_DIR}/ikev2/ecdsa-certs"
 MOON_KEY="${TEST}/hosts/moon/${SWANCTL_DIR}/ecdsa/moonKey.pem"
 MOON_CERT="${TEST}/hosts/moon/${SWANCTL_DIR}/x509/moonCert.pem"
 CN="moon.strongswan.org"
@@ -1207,8 +1193,8 @@ pki --issue --cakey ${ECDSA_KEY} --cacert ${ECDSA_CERT} --type ecdsa \
     --crl ${ECDSA_CDP} --outform pem > ${DAVE_CERT}
 cp ${DAVE_CERT} ${ECDSA_DIR}/certs/${SERIAL}.pem
 
-# Put CA and EE certificate copies in the openssl-ikev2/ecdsa-pkcs8 scenario
-TEST="${TEST_DIR}/openssl-ikev2/ecdsa-pkcs8"
+# Put CA and EE certificate copies in the ikev2/ecdsa-pkcs8 scenario
+TEST="${TEST_DIR}/ikev2/ecdsa-pkcs8"
 mkdir -p ${TEST}/hosts/moon/${SWANCTL_DIR}/x509
 mkdir -p ${TEST}/hosts/carol/${SWANCTL_DIR}/x509
 mkdir -p ${TEST}/hosts/dave/${SWANCTL_DIR}/x509
@@ -1233,8 +1219,8 @@ mkdir -p ${TEST}/hosts/dave/${SWANCTL_DIR}/pkcs8
 openssl pkcs8 -in ${DAVE_KEY} -nocrypt -topk8  -v2 aes128 \
               -passout "pass:OJlNZBx+80dLh4wC6fw5LmBd" -out ${TEST_KEY}
 
-# Put CA and EE certificate copies in the openssl-ikev1/ecdsa-certs scenario
-TEST="${TEST_DIR}/openssl-ikev1/ecdsa-certs"
+# Put CA and EE certificate copies in the ikev1/ecdsa-certs scenario
+TEST="${TEST_DIR}/ikev1/ecdsa-certs"
 cd ${TEST}/hosts/moon/${SWANCTL_DIR}
 mkdir -p ecdsa x509 x509ca
 cp ${MOON_KEY}   ecdsa
@@ -1419,8 +1405,8 @@ pki --issue --cakey ${SHA3_RSA_KEY} --cacert ${SHA3_RSA_CERT} --type rsa \
     --crl ${SHA3_RSA_CDP} --digest sha3_256 --outform pem > ${MOON_CERT}
 cp ${MOON_CERT} ${SHA3_RSA_DIR}/certs/${SERIAL}.pem
 
-# Put a copy in the botan openssl-ikev2 and wolfssl net2net-sha3-rsa-cert scenarios
-for d in botan openssl-ikev2 wolfssl
+# Put a copy in the botan and wolfssl net2net-sha3-rsa-cert scenarios
+for d in botan wolfssl
 do
   TEST="${TEST_DIR}/${d}/net2net-sha3-rsa-cert"
   cd ${TEST}/hosts/moon/${SWANCTL_DIR}

testing/scripts/recipes/013_strongswan.mk

@@ -64,7 +64,6 @@ CONFIG_OPTS = \
 	--enable-attr-sql \
 	--enable-mediation \
 	--enable-botan \
-	--enable-openssl \
 	--enable-blowfish \
 	--enable-kernel-pfkey \
 	--enable-integrity-test \
@@ -82,14 +81,14 @@ CONFIG_OPTS = \
 	--enable-ctr \
 	--enable-ccm \
 	--enable-gcm \
-	--enable-cmac \
+	--enable-hmac \
 	--enable-chapoly \
 	--enable-ha \
 	--enable-af-alg \
 	--enable-whitelist \
 	--enable-xauth-generic \
 	--enable-xauth-eap \
-	--enable-pkcs8 \
+	--enable-pkcs12 \
 	--enable-unity \
 	--enable-unbound \
 	--enable-ipseckey \
@@ -98,9 +97,17 @@ CONFIG_OPTS = \
 	--enable-cmd \
 	--enable-libipsec \
 	--enable-kernel-libipsec \
+	--enable-stroke \
 	--enable-tkm \
 	--enable-lookip \
+	--enable-des \
+	--enable-aes \
+	--enable-md5 \
+	--enable-sha1 \
+	--enable-sha2 \
 	--enable-sha3 \
+	--enable-gmp \
+	--enable-curve25519 \
 	--enable-systemd \
 	--enable-counters \
 	--enable-save-keys \

testing/tests/af-alg/alg-camellia/hosts/carol/etc/strongswan.conf

@@ -1,9 +1,9 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 swanctl {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+  load = pem pkcs1 revocation constraints pubkey openssl random
 }
 
 charon-systemd {
-  load = random nonce kdf pem pkcs1 af-alg gmp x509 revocation kernel-netlink curl socket-default updown vici
+  load = random nonce pem pkcs1 af-alg openssl revocation kernel-netlink curl socket-default updown vici
 }

testing/tests/af-alg/alg-camellia/hosts/moon/etc/strongswan.conf

@@ -1,9 +1,9 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 swanctl {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+  load = pem pkcs1 revocation constraints pubkey openssl random
 }
 
 charon-systemd {
-  load = random nonce kdf pem pkcs1 af-alg gmp x509 revocation kernel-netlink curl socket-default updown vici
+  load = random nonce pem pkcs1 af-alg openssl revocation kernel-netlink curl socket-default updown vici
 }

testing/tests/af-alg/rw-cert/description.txt

@@ -1,7 +1,7 @@
 The roadwarrior <b>carol</b> and the gateway <b>moon</b> use the <b>Crypto API</b>
 of the Linux kernel via the <b>af_alg</b> userland interface for all symmetric
-encryption and hash functions whereas roadwarrior <b>dave</b> uses the default
-<b>strongSwan</b> cryptographical plugins <b>aes des sha1 sha2 md5 gmp</b>.
+encryption and hash functions whereas roadwarrior <b>dave</b> uses <b>openssl</b>
+as the default <b>strongSwan</b> cryptographical plugin.
 <p>
 The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each 
 to gateway <b>moon</b>. The authentication is based on <b>X.509 certificates</b>.

testing/tests/af-alg/rw-cert/hosts/carol/etc/strongswan.conf

@@ -1,13 +1,9 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 swanctl {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+  load = pem pkcs1 revocation constraints pubkey openssl random
 }
 
 charon-systemd {
-  load = random nonce kdf test-vectors pem pkcs1 af-alg gmp x509 revocation curl ctr ccm gcm kernel-netlink socket-default updown vici
-  integrity_test = yes
-  crypto_test {
-    on_add = yes
-  }
+  load = random nonce test-vectors pem pkcs1 af-alg ccn gcm openssl revocation curl kernel-netlink socket-default updown vici
 }

testing/tests/af-alg/rw-cert/hosts/dave/etc/strongswan.conf

@@ -1,13 +1,9 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 swanctl {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+  load = pem pkcs1 revocation constraints pubkey openssl random
 }
 
 charon-systemd {
-  load = random nonce kdf test-vectors aes des sha1 sha2 md5 pem pkcs1 gmp x509 revocation curl hmac kdf xcbc ctr ccm gcm kernel-netlink socket-default updown vici
-  integrity_test = yes
-  crypto_test {
-    on_add = yes
-  }
+  load = random nonce openssl test-vectors pem pkcs1 revocation curl kernel-netlink socket-default updown vici
 }

testing/tests/af-alg/rw-cert/hosts/moon/etc/strongswan.conf

@@ -1,11 +1,12 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 swanctl {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+  load = pem pkcs1 revocation constraints pubkey openssl random
 }
 
 charon-systemd {
-  load = random nonce kdf test-vectors pem pkcs1 af-alg gmp x509 revocation curl ctr ccm gcm kernel-netlink socket-default updown vici
+  load = random nonce test-vectors pem pkcs1 af-alg ccm gcm openssl revocation curl kernel-netlink socket-default updown vici
+
   integrity_test = yes
   crypto_test {
     on_add = yes

testing/tests/botan/net2net-ed25519/description.txt

@@ -1,8 +1,8 @@
 A connection between the subnets behind the gateways <b>moon</b> and <b>sun</b> is set up.
 The authentication is based on <b>X.509 certificates</b> containing <b>Ed25519</b> keys.
 <b>moon</b> uses the botan plugin based on the Botan library for all
-cryptographical functions whereas <b>sun</b> uses the default strongSwan
-cryptographical plugins.
+cryptographical functions whereas <b>sun</b> uses <b>openssl</b>
+as the default <b>strongSwan</b> cryptographical plugin.
 <p/>
 Upon the successful establishment of the IPsec tunnel, the updown script automatically
 inserts iptables-based firewall rules that let pass the tunneled traffic.

testing/tests/botan/net2net-ed25519/hosts/sun/etc/strongswan.conf

@@ -1,9 +1,9 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 swanctl {
-  load = random pem sha1 pkcs1 pkcs8 curve25519 x509 revocation constraints
+  load = random pem pkcs1 openssl revocation constraints
 }
 
 charon-systemd {
-  load = random nonce aes sha1 sha2 hmac kdf pem pkcs1 pkcs8 x509 revocation constraints curve25519 curl kernel-netlink socket-default updown vici
+  load = random nonce openssl pem pkcs1 revocation constraints curl kernel-netlink socket-default updown vici
 }

testing/tests/botan/rw-cert/description.txt

@@ -1,8 +1,8 @@
 The roadwarrior <b>carol</b> and the gateway <b>moon</b> use the <b>botan</b>
 plugin based on the <b>Botan</b> library for all cryptographical functions whereas
-roadwarrior <b>dave</b> uses the default <b>strongSwan</b> cryptographical
-plugins. The authentication is based on <b>X.509 certificates</b> and the key exchange
-on <b>x25519</b>.
+roadwarrior <b>dave</b> uses <b>openssl</b> as the default <b>strongSwan</b>
+cryptographical plugin. The authentication is based on <b>X.509 certificates</b>
+and the key exchange on <b>x25519</b>.
 <p/>
 Upon the successful establishment of the IPsec tunnels, the updown script
 automatically inserts iptables-based firewall rules that let pass the tunneled traffic.

testing/tests/botan/rw-cert/hosts/dave/etc/strongswan.conf

@@ -5,7 +5,7 @@ swanctl {
 }
 
 charon-systemd {
-  load = random nonce sha1 sha2 aes curve25519 hmac kdf mgf1 pem pkcs1 x509 revocation constraints pubkey gmp curl kernel-netlink socket-default updown vici
+  load = random nonce openssl pem pkcs1 revocation constraints pubkey curl kernel-netlink socket-default updown vici
 
   rsa_pss = yes
 }

testing/tests/botan/rw-modp3072/description.txt

@@ -1,8 +1,8 @@
 The roadwarrior <b>carol</b> and the gateway <b>moon</b> use the <b>botan</b>
 plugin based on the <b>Botan</b> library for all cryptographical functions whereas
-roadwarrior <b>dave</b> uses the default <b>strongSwan</b> cryptographical
-plugins. The authentication is based on <b>X.509 certificates</b> and the key exchange
-on <b>modp3072</b>.
+roadwarrior <b>dave</b> uses t<b>openssl</b> as the default <b>strongSwan</b>
+cryptographical plugin. The authentication is based on <b>X.509 certificates</b>
+and the key exchange on <b>modp3072</b>.
 <p/>
 Upon the successful establishment of the IPsec tunnels, the updown script
 automatically inserts iptables-based firewall rules that let pass the tunneled traffic.

testing/tests/botan/rw-modp3072/hosts/dave/etc/strongswan.conf

@@ -1,11 +1,11 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 swanctl {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+  load = pem pkcs1 revocation constraints pubkey openssl random
 }
 
 charon-systemd {
-  load = random nonce sha1 sha2 aes hmac kdf mgf1 pem pkcs1 x509 revocation constraints pubkey gmp curl kernel-netlink socket-default updown vici
+  load = random nonce openssl pem pkcs1 revocation constraints pubkey curl kernel-netlink socket-default updown vici
 
   rsa_pss = yes
 }

testing/tests/gcrypt-ikev2/rw-cert/description.txt

@@ -1,7 +1,7 @@
 The roadwarrior <b>carol</b> and the gateway <b>moon</b> use the <b>gcrypt</b>
 plugin based on the <b>GNU Libgcrypt</b> library for all cryptographical functions
-whereas roadwarrior <b>dave</b> uses the default <b>strongSwan</b> cryptographical
-plugins <b>aes des sha1 sha2 md5 gmp</b>.
+whereas roadwarrior <b>dave</b> uses <b>openssl</b> as the default <b>strongSwan</b>
+cryptographical plugin.
 <p>
 The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each 
 to gateway <b>moon</b>. The authentication is based on <b>X.509 certificates</b>.
@@ -9,4 +9,3 @@ Upon the successful establishment of the IPsec tunnels, the <b>updown</b> direct
 in swanctl.conf automatically inserts iptables-based firewall rules that let pass the
 tunneled traffic. In order to test both tunnel and firewall, both <b>carol</b> and
 <b>dave</b> ping the client <b>alice</b> behind the gateway <b>moon</b>.
-

testing/tests/gcrypt-ikev2/rw-cert/hosts/dave/etc/strongswan.conf

@@ -5,7 +5,7 @@ swanctl {
 }
 
 charon-systemd {
-  load = test-vectors aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac kdf xcbc ctr ccm vici stroke kernel-netlink socket-default updown
+  load = test-vectors pem pkcs1 random nonce openssl curl revocation xcbc vici stroke kernel-netlink socket-default updown
   integrity_test = yes
   crypto_test {
     required = yes

testing/tests/ha/active-passive/evaltest.dat

@@ -1,11 +1,11 @@
 alice::cat /var/log/daemon.log::HA segment 1 was not handled, taking::YES
 moon:: cat /var/log/daemon.log::remote node takes segment 1::YES
-alice::swanctl --list-sas --ike-id 1 --raw 2> /dev/null::ha.*version=2 state=ESTABLISHED local-host=10.1.0.10 local-port=500 local-id=10.1.0.10 remote-host=10.1.0.1 remote-port=500 remote-id=10.1.0.1.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*ha.*reqid=1 state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.10/32\[icmp] 10.1.0.10/32\[udp/4510]] remote-ts=\[10.1.0.1/32\[icmp] 10.1.0.1/32\[udp/4510]]::YES
-alice::swanctl --list-sas --ike-id 2 --raw 2> /dev/null::ha.*version=2 state=ESTABLISHED local-host=10.1.0.10 local-port=500 local-id=10.1.0.10 remote-host=10.1.0.1 remote-port=500 remote-id=10.1.0.1.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*ha.*reqid=1 state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.10/32\[icmp] 10.1.0.10/32\[udp/4510]] remote-ts=\[10.1.0.1/32\[icmp] 10.1.0.1/32\[udp/4510]]::YES
+alice::swanctl --list-sas --ike-id 1 --raw 2> /dev/null::ha.*version=2 state=ESTABLISHED local-host=10.1.0.10 local-port=500 local-id=10.1.0.10 remote-host=10.1.0.1 remote-port=500 remote-id=10.1.0.1.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=ECP_256.*child-sas.*ha.*reqid=1 state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.10/32\[icmp] 10.1.0.10/32\[udp/4510]] remote-ts=\[10.1.0.1/32\[icmp] 10.1.0.1/32\[udp/4510]]::YES
+alice::swanctl --list-sas --ike-id 2 --raw 2> /dev/null::ha.*version=2 state=ESTABLISHED local-host=10.1.0.10 local-port=500 local-id=10.1.0.10 remote-host=10.1.0.1 remote-port=500 remote-id=10.1.0.1.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=ECP_256.*child-sas.*ha.*reqid=1 state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.10/32\[icmp] 10.1.0.10/32\[udp/4510]] remote-ts=\[10.1.0.1/32\[icmp] 10.1.0.1/32\[udp/4510]]::YES
 alice::swanctl --list-sas --ike-id 3 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.5 local-port=4500 local-id=mars.strongswan.org remote-host=192.168.0.100 remote-port=4500 remote-id=carol@strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net.*reqid=2 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES
 alice::swanctl --list-sas --ike-id 4 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.5 local-port=4500 local-id=mars.strongswan.org remote-host=192.168.0.200 remote-port=4500 remote-id=dave@strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net.*reqid=3 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.200/32]::YES
-moon::swanctl --list-sas --ike-id 1 --raw 2> /dev/null::ha.*version=2 state=ESTABLISHED local-host=10.1.0.1 local-port=500 local-id=10.1.0.1 remote-host=10.1.0.10 remote-port=500 remote-id=10.1.0.10.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*ha.*reqid=1 state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.1/32\[icmp] 10.1.0.1/32\[udp/4510]] remote-ts=\[10.1.0.10/32\[icmp] 10.1.0.10/32\[udp/4510]]::YES
-moon::swanctl --list-sas --ike-id 1 --raw 2> /dev/null::ha.*version=2 state=ESTABLISHED local-host=10.1.0.1 local-port=500 local-id=10.1.0.1 remote-host=10.1.0.10 remote-port=500 remote-id=10.1.0.10.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*ha.*reqid=1 state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.1/32\[icmp] 10.1.0.1/32\[udp/4510]] remote-ts=\[10.1.0.10/32\[icmp] 10.1.0.10/32\[udp/4510]]::YES
+moon::swanctl --list-sas --ike-id 1 --raw 2> /dev/null::ha.*version=2 state=ESTABLISHED local-host=10.1.0.1 local-port=500 local-id=10.1.0.1 remote-host=10.1.0.10 remote-port=500 remote-id=10.1.0.10.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=ECP_256.*child-sas.*ha.*reqid=1 state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.1/32\[icmp] 10.1.0.1/32\[udp/4510]] remote-ts=\[10.1.0.10/32\[icmp] 10.1.0.10/32\[udp/4510]]::YES
+moon::swanctl --list-sas --ike-id 1 --raw 2> /dev/null::ha.*version=2 state=ESTABLISHED local-host=10.1.0.1 local-port=500 local-id=10.1.0.1 remote-host=10.1.0.10 remote-port=500 remote-id=10.1.0.10.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=ECP_256.*child-sas.*ha.*reqid=1 state=INSTALLED mode=TRANSPORT.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.1/32\[icmp] 10.1.0.1/32\[udp/4510]] remote-ts=\[10.1.0.10/32\[icmp] 10.1.0.10/32\[udp/4510]]::YES
 moon ::swanctl --list-sas --ike-id 3 --raw 2> /dev/null::rw.*version=2 state=PASSIVE local-host=192.168.0.5 local-port=4500 local-id=mars.strongswan.org remote-host=192.168.0.100 remote-port=4500 remote-id=carol@strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net.*reqid=2 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES
 moon ::swanctl --list-sas --ike-id 4 --raw 2> /dev/null::rw.*version=2 state=PASSIVE local-host=192.168.0.5 local-port=4500 local-id=mars.strongswan.org remote-host=192.168.0.200 remote-port=4500 remote-id=dave@strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net.*reqid=3 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.200/32]::YES
 carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 local-id=carol@strongswan.org remote-host=192.168.0.5 remote-port=4500 remote-id=mars.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*home.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/16]::YES

testing/tests/ha/active-passive/hosts/alice/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon-systemd {
-  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default ha
+  load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default ha
 
   plugins {
     ha {

testing/tests/ha/active-passive/hosts/carol/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon-systemd {
-  load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default updown
+  load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default updown
 }

testing/tests/ha/active-passive/hosts/dave/etc/strongswan.conf

@@ -1,6 +1,6 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon-systemd {
-  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default updown
+  load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default updown
 }
 

testing/tests/ha/active-passive/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon-systemd {
-  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default ha
+  load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default ha
 
   plugins {
     ha {

testing/tests/ha/both-active/hosts/alice/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon-systemd {
-  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default ha
+  load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default ha
 
   plugins {
     ha {

testing/tests/ha/both-active/hosts/carol/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon-systemd {
-  load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default updown
+  load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default updown
 }

testing/tests/ha/both-active/hosts/dave/etc/strongswan.conf

@@ -1,6 +1,6 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon-systemd {
-  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default updown
+  load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default updown
 }
 

testing/tests/ha/both-active/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon-systemd {
-  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default ha
+  load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default ha
 
   plugins {
     ha {

testing/tests/ike/frags-ipv4/hosts/carol/etc/strongswan.conf

@@ -1,11 +1,11 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 swanctl {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+  load = pem pkcs1 revocation constraints pubkey openssl random
 }
 
 charon-systemd {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random nonce curl kernel-netlink socket-default updown vici
+  load = pem pkcs1 revocation constraints pubkey openssl random nonce curl kernel-netlink socket-default updown vici
 
   fragment_size = 1400
 }

testing/tests/ike/frags-ipv4/hosts/dave/etc/strongswan.conf

@@ -1,11 +1,11 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 swanctl {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+  load = pem pkcs1 revocation constraints pubkey openssl random
 }
 
 charon-systemd {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random nonce curl kernel-netlink socket-default updown vici
+  load = pem pkcs1 revocation constraints pubkey openssl random nonce curl kernel-netlink socket-default updown vici
 
   fragment_size = 1400
 }

testing/tests/ike/frags-ipv4/hosts/moon/etc/strongswan.conf

@@ -1,11 +1,11 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 swanctl {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+  load = pem pkcs1 revocation constraints pubkey openssl random
 }
 
 charon-systemd {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random nonce curl kernel-netlink socket-default updown vici
+  load = pem pkcs1 revocation constraints pubkey openssl random nonce curl kernel-netlink socket-default updown vici
 
   fragment_size = 1400
 }

testing/tests/ike/frags-ipv6/hosts/carol/etc/strongswan.conf

@@ -1,11 +1,11 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 swanctl {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+  load = pem pkcs1 revocation constraints pubkey openssl random
 }
 
 charon-systemd {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random nonce curl kernel-netlink socket-default updown vici
+  load = pem pkcs1 revocation constraints pubkey openssl random nonce curl kernel-netlink socket-default updown vici
 
   fragment_size = 1400
 }

testing/tests/ike/frags-ipv6/hosts/dave/etc/strongswan.conf

@@ -1,11 +1,11 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 swanctl {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+  load = pem pkcs1 revocation constraints pubkey openssl random
 }
 
 charon-systemd {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random nonce curl kernel-netlink socket-default updown vici
+  load = pem pkcs1 revocation constraints pubkey openssl random nonce curl kernel-netlink socket-default updown vici
 
   fragment_size = 1400
 }

testing/tests/ike/frags-ipv6/hosts/moon/etc/strongswan.conf

@@ -1,11 +1,11 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 swanctl {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+  load = pem pkcs1 revocation constraints pubkey openssl random
 }
 
 charon-systemd {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random nonce curl kernel-netlink socket-default updown vici
+  load = pem pkcs1 revocation constraints pubkey openssl random nonce curl kernel-netlink socket-default updown vici
 
   fragment_size = 1400
 }

testing/tests/ike/rw-cert/hosts/carol/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf stroke kernel-netlink socket-default
+  load = random nonce openssl pem pkcs1 curl revocation stroke kernel-netlink socket-default
 }

testing/tests/ike/rw-cert/hosts/dave/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf stroke kernel-netlink socket-default
+  load = random nonce openssl pem pkcs1 curl revocation stroke kernel-netlink socket-default
 }

testing/tests/ike/rw-cert/hosts/moon/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf stroke kernel-netlink socket-default
+  load = random nonce openssl pem pkcs1 curl revocation stroke kernel-netlink socket-default
 }

testing/tests/ike/rw_v1-net_v2/hosts/carol/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp hmac kdf x509 curl revocation stroke kernel-netlink socket-default
+  load = random nonce openssl pem pkcs1 curl revocation stroke kernel-netlink socket-default
 }

testing/tests/ike/rw_v1-net_v2/hosts/moon/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp hmac kdf x509 curl revocation stroke kernel-netlink socket-default
+  load = random nonce openssl pem pkcs1 curl revocation stroke kernel-netlink socket-default
 }

testing/tests/ike/rw_v1-net_v2/hosts/sun/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp hmac kdf x509 curl revocation stroke kernel-netlink socket-default
+  load = random nonce openssl pem pkcs1 curl revocation stroke kernel-netlink socket-default
 }

testing/tests/ikev1-algs/alg-3des-md5/hosts/carol/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = random nonce des md5 sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default
+  load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default
 }

testing/tests/ikev1-algs/alg-3des-md5/hosts/moon/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = random nonce des md5 sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default
+  load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default
 }

testing/tests/ikev1-algs/alg-blowfish/hosts/carol/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = random nonce blowfish sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default
+  load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default
 }

testing/tests/ikev1-algs/alg-blowfish/hosts/dave/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = random nonce blowfish sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default
+  load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default
 }

testing/tests/ikev1-algs/alg-blowfish/hosts/moon/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = random nonce blowfish sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default
+  load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default
 }

testing/tests/ikev1-algs/alg-modp-subgroup/hosts/carol/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default
+  load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default
 }

testing/tests/ikev1-algs/alg-modp-subgroup/hosts/dave/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default
+  load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default
 }

testing/tests/ikev1-algs/alg-modp-subgroup/hosts/moon/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default
+  load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default
 }

testing/tests/ikev1-algs/alg-sha256/hosts/carol/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default
+  load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default
 }

testing/tests/ikev1-algs/alg-sha256/hosts/moon/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default
+  load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default
 }

testing/tests/ikev1-algs/alg-sha384/hosts/carol/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default
+  load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default
 }

testing/tests/ikev1-algs/alg-sha384/hosts/moon/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default
+  load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default
 }

testing/tests/ikev1-algs/alg-sha512/hosts/carol/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default
+  load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default
 }

testing/tests/ikev1-algs/alg-sha512/hosts/moon/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default
+  load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default
 }

testing/tests/ikev1-algs/esp-alg-aes-ccm/hosts/carol/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default
+  load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default
 }

testing/tests/ikev1-algs/esp-alg-aes-ccm/hosts/moon/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default
+  load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default
 }

testing/tests/ikev1-algs/esp-alg-aes-ctr/hosts/carol/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default
+  load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default
 }

testing/tests/ikev1-algs/esp-alg-aes-ctr/hosts/moon/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default
+  load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default
 }

testing/tests/ikev1-algs/esp-alg-aes-gcm/hosts/carol/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default
+  load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default
 }

testing/tests/ikev1-algs/esp-alg-aes-gcm/hosts/moon/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default
+  load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default
 }

testing/tests/ikev1-algs/esp-alg-aes-gmac/hosts/carol/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default
+  load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default
 }

testing/tests/ikev1-algs/esp-alg-aes-gmac/hosts/moon/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default
+  load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default
 }

testing/tests/ikev1-algs/esp-alg-aes-xcbc/hosts/carol/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default
+  load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default
 }

testing/tests/ikev1-algs/esp-alg-aes-xcbc/hosts/moon/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default
+  load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default
 }

testing/tests/ikev1-algs/esp-alg-null/hosts/carol/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default
+  load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default
 }

testing/tests/ikev1-algs/esp-alg-null/hosts/moon/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf vici kernel-netlink socket-default
+  load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default
 }

testing/tests/ikev1-stroke/config-payload-push/hosts/carol/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf stroke kernel-netlink socket-default updown resolve
+  load = random nonce openssl pem pkcs1 curl revocation stroke kernel-netlink socket-default updown resolve
 }

testing/tests/ikev1-stroke/config-payload-push/hosts/dave/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf stroke kernel-netlink socket-default updown resolve
+  load = random nonce openssl pem pkcs1 curl revocation stroke kernel-netlink socket-default updown resolve
 }

testing/tests/ikev1-stroke/config-payload-push/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf stroke kernel-netlink socket-default updown attr
+  load = random nonce openssl pem pkcs1 curl revocation stroke kernel-netlink socket-default updown attr
 
   dns1 = PH_IP_WINNETOU
   dns2 = PH_IP_VENUS

testing/tests/ikev1-stroke/config-payload/hosts/carol/etc/strongswan.conf

@@ -1,5 +1,5 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
 charon {
-  load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac kdf stroke kernel-netlink socket-default updown resolve
+  load = random nonce openssl pem pkcs1 curl revocation stroke kernel-netlink socket-default updown resolve
 }