The default strongSwan configuration interface have been updated to vici since version 5.9.2_1.
To use the stroke interface by default either compile the port without the vici option or
set 'strongswan_interface="stroke"' in your rc.conf file.
Shown after upgrading
The default strongSwan configuration interface have been updated to vici.
To use the stroke interface by default either compile the port without the vici option or
set 'strongswan_interface="stroke"' in your rc.conf file.
Packages by version and architecture
latest
FreeBSD version
amd64
aarch64
i386
FreeBSD 16
6.1.0
6.1.0
–
FreeBSD 15
6.1.0
6.1.0
–
FreeBSD 14
6.1.0
6.1.0
6.1.0
quarterly (2026Q4)
FreeBSD version
amd64
aarch64
i386
FreeBSD 15
6.1.0
6.1.0
–
FreeBSD 14
6.1.0
6.1.0
6.1.0
version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.
Unaddressed and VuXML only (0)
No unaddressed CVE and nothing reported by pkg audit for the packaged version 6.1.0.
Fixed (27)
Show 27 fixed
VuXML entries whose affected range the packaged version has left, plus CVEs from the last 90 days that this version is already past (fixed by update).
strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a missing or mismatched inner EAP identity.
strongSwan 5.0.2 through 6.0.7 allows PKCS#7 certificate enumeration in the openssl plugin that leads to a lack of release of memory after its effective lifetime.
security/strongswan: Disable loading of kernel-libipsec plugin
115e0906c85a enables building with KERNELLIBIPSEC option by default.
This changes loading order of plugins and brokes some existing
configurations.
PR: 298098 295828
Approved by: blanket (fix runtime)
Sponsored by: FLEX-IT LLC
Sponsored by: UNIS Labs (vvd, commit patch)
security/strongswan: Enable ML plugin by default to allow Post-Quantum Key Exchange Methods
Currently ML-DSA (used for Digital Signatures) is a draft in strongswan
(ETA Version 6.1.0 or later). So CNSA 2.0 cannot be fully supported yet.
https://linux-ipsec.org/slides/2025/steffen-pqc-auth-for-ikev2.pdf
But most firewalls (Palo Alto / Fortigate) already support ML-KEM Key
Exchange in addition to standard proposals.
E.g. aes128gcm16-ecp256-ke1_mlkem512.
More details:
https://docs.strongswan.org/docs/latest/config/proposals.html
PR: 294305
Approved by: strongswan@Nanoteq.com (maintainer, timeout 2 weeks)
Sponsored by: UNIS Labs
security/strongswan: Allow old stroke interface to be enabled
Note that strongSwan has deprecated the stroke management interface for
years, and it is recommended to migrate the configuration to vici before
it is removed.
PR: 285049
security/strongswan: fix CVE-2023-41913
This is urgent change adding official patch
https://download.strongswan.org/security/CVE-2023-41913/strongswan-5.9.7-5.9.11_charon_tkm_dh_len.patch
that is identical to the change made for strongswan-5.9.12:
https://github.com/strongswan/strongswan/commit/96d793718955820dfe5e6d8aa6127a34795ae39e
It is upto port maintainer to review and maybe upgrade the port to 5.9.12
Obtained from: strongSwan
Security: CVE-2023-41913
security/strongswan: fix CVE-2023-26463
This is urgent change adding official patch
https://download.strongswan.org/security/CVE-2023-26463/strongswan-5.9.8-5.9.9_tls_auth_bypass_exp_pointer.patch
It is upto port maintainer to review and maybe upgrade
the port to 5.9.10.
Obtained from: strongSwan
Security: CVE-2023-26463
Mk/**ldap.mk: Convert USE_LDAP to USES=ldap
Convert the USE_LDAP=yes to USES=ldap and adds the following features:
- Adds the argument USES=ldap:server to add openldap2{4|5|6}-server as
RUN_DEPENDS
- Adds the argument USES=ldap<version> and replaces WANT_OPENLDAP_VER
- Adds OPENLDAP versions in bsd.default-versions.mk
- Adds USE_OPENLDAP/WANT_OPENLDAP_VER in Mk/bsd.sanity.mk
- Changes consumers to use the features
Reviewed by: delphij
Approved by: portmgr
Differential Revision: https://reviews.freebsd.org/D38233
security/strongswan: Add GCM option to OPTIONS_DEFAULT
Avoid the message:
"plugin 'gcm': failed to load - gcm_plugin_create not found and no
plugin file available"
According to strongSwan's 5.9.8 release notes[1]:
The gcm plugin has been enabled by default, so that the TLS 1.3 unit
tests (now indirectly enabled if the pki tool is built due to the
implementation of EST) can be completed successfully with just the
default plugins.
Let's also enable it by default.
[1]: https://github.com/strongswan/strongswan/releases/tag/5.9.8
PR: 267352
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.
There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.
The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.
Approved by: portmgr (tcberner)
security/strongswan: Fix key derivation
An issue in the upstream port causes key derivation to fail in version 5.9.6.
A work around is to enable the KDF pluging by default.
PR: 264667
Reported by: strongswan@Nanoteq.com (maintainer)
security/strongswan: Fix default control-interface
Fix default control-interface in rc.d script and also
make it user-selectable at build time, defaulting to VICI.
Also mention this change in pkg-message, as previously the
default was "stroke" and it was changed to "vici" with
only a short notice in UPDATING, that was not displayed
when using binary upgrades.
Committing a portfmt'd version.
PR: 255952
Approved by: strongswan@Nanoteq.com (maintainer)
security/strongswan: Update to version 5.9.1
Changelog: https://wiki.strongswan.org/versions/79
PR: 252202
Submitted by: Jose Luis Duran <jlduran@gmail.com>
Approved by: strongswan@nanoteq.com (maintainer)
security/strongswan: update 5.8.4 -> 5.9.0
- Also link the tpm2-tss package for testing with the TPM plugin:
https://wiki.strongswan.org/projects/strongswan/wiki/TpmPlugin
PR: 249470
Submitted by: Jose Luis Duran <jlduran@gmail.com>
Approved by: strongswan@Nanoteq.com (maintainer)
Relnotes: https://wiki.strongswan.org/versions/78
security/strongswan: load ipsec kernel module by rc script
From the following discussion: https://reviews.freebsd.org/D20163
It makes sense to add ipsec as required module for the rc script
of strongSwan.
PR: 243316
Submitted by: Dries Michiels <driesm.michiels@gmail.com>
Approved by: maintainer