Merge branch 'user/strongswan/1' into 'master'

user/strongswan: import from Alpine

Imported from Alpine.

This package excludes the printf test suite because it was segfaulting. However, that test suite only tests the libc implementations of vsnprintf. All other tests pass.

See merge request !69

8 files changed, 1166 insertions, 0 deletions

diff --git a/user/strongswan/0205-ike-Adhere-to-IKE_SA-limit-when-checking-out-by-conf.patch b/user/strongswan/0205-ike-Adhere-to-IKE_SA-limit-when-checking-out-by-conf.patch
new file mode 100644
index 000000000..cc14dab02
--- /dev/null
+++ b/user/strongswan/0205-ike-Adhere-to-IKE_SA-limit-when-checking-out-by-conf.patch
@@ -0,0 +1,104 @@
+From 5a5b26a7dce4c112f62882cfe16dc37659d766e8 Mon Sep 17 00:00:00 2001
+From: Tobias Brunner <tobias@strongswan.org>
+Date: Fri, 17 Jul 2015 11:53:58 +0200
+Subject: [PATCH 1/5] ike: Adhere to IKE_SA limit when checking out by config
+
+This prevents new SAs from getting created if we hit the global IKE_SA
+limit (we still allow checkout_new(), which is used for rekeying).
+---
+ src/libcharon/sa/ike_sa_manager.c | 71 ++++++++++++++++++++-------------------
+ 1 file changed, 37 insertions(+), 34 deletions(-)
+
+diff --git a/src/libcharon/sa/ike_sa_manager.c b/src/libcharon/sa/ike_sa_manager.c
+index ce44207..37d49da 100644
+--- a/src/libcharon/sa/ike_sa_manager.c
++++ b/src/libcharon/sa/ike_sa_manager.c
+@@ -1419,48 +1419,51 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
+ 
+ 	DBG2(DBG_MGR, "checkout IKE_SA by config");
+ 
+-	if (!this->reuse_ikesa && peer_cfg->get_ike_version(peer_cfg) != IKEV1)
+-	{	/* IKE_SA reuse disabled by config (not possible for IKEv1) */
+-		ike_sa = checkout_new(this, peer_cfg->get_ike_version(peer_cfg), TRUE);
+-		charon->bus->set_sa(charon->bus, ike_sa);
+-		goto out;
+-	}
+-
+-	enumerator = create_table_enumerator(this);
+-	while (enumerator->enumerate(enumerator, &entry, &segment))
++	if (this->reuse_ikesa || peer_cfg->get_ike_version(peer_cfg) == IKEV1)
+ 	{
+-		if (!wait_for_entry(this, entry, segment))
++		enumerator = create_table_enumerator(this);
++		while (enumerator->enumerate(enumerator, &entry, &segment))
+ 		{
+-			continue;
+-		}
+-		if (entry->ike_sa->get_state(entry->ike_sa) == IKE_DELETING ||
+-			entry->ike_sa->get_state(entry->ike_sa) == IKE_REKEYED)
+-		{	/* skip IKE_SAs which are not usable, wake other waiting threads */
+-			entry->condvar->signal(entry->condvar);
+-			continue;
+-		}
+-
+-		current_peer = entry->ike_sa->get_peer_cfg(entry->ike_sa);
+-		if (current_peer && current_peer->equals(current_peer, peer_cfg))
+-		{
+-			current_ike = current_peer->get_ike_cfg(current_peer);
+-			if (current_ike->equals(current_ike, peer_cfg->get_ike_cfg(peer_cfg)))
++			if (!wait_for_entry(this, entry, segment))
+ 			{
+-				entry->checked_out = thread_current();
+-				ike_sa = entry->ike_sa;
+-				DBG2(DBG_MGR, "found existing IKE_SA %u with a '%s' config",
+-						ike_sa->get_unique_id(ike_sa),
+-						current_peer->get_name(current_peer));
+-				break;
++				continue;
+ 			}
++			if (entry->ike_sa->get_state(entry->ike_sa) == IKE_DELETING ||
++				entry->ike_sa->get_state(entry->ike_sa) == IKE_REKEYED)
++			{	/* skip IKE_SAs which are not usable, wake other waiting threads */
++				entry->condvar->signal(entry->condvar);
++				continue;
++			}
++			current_peer = entry->ike_sa->get_peer_cfg(entry->ike_sa);
++			if (current_peer && current_peer->equals(current_peer, peer_cfg))
++			{
++				current_ike = current_peer->get_ike_cfg(current_peer);
++				if (current_ike->equals(current_ike,
++										peer_cfg->get_ike_cfg(peer_cfg)))
++				{
++					entry->checked_out = thread_current();
++					ike_sa = entry->ike_sa;
++					DBG2(DBG_MGR, "found existing IKE_SA %u with a '%s' config",
++							ike_sa->get_unique_id(ike_sa),
++							current_peer->get_name(current_peer));
++					break;
++				}
++			}
++			/* other threads might be waiting for this entry */
++			entry->condvar->signal(entry->condvar);
+ 		}
+-		/* other threads might be waiting for this entry */
+-		entry->condvar->signal(entry->condvar);
++		enumerator->destroy(enumerator);
+ 	}
+-	enumerator->destroy(enumerator);
+ 
+ 	if (!ike_sa)
+-	{	/* no IKE_SA using such a config, hand out a new */
++	{	/* no IKE_SA using such a config, or reuse disabled, hand out a new */
++		if (this->ikesa_limit &&
++			this->public.get_count(&this->public) >= this->ikesa_limit)
++		{
++			DBG1(DBG_MGR, "IKE_SA creation failed, hitting IKE_SA limit (%u)",
++				 this->ikesa_limit);
++			return NULL;
++		}
+ 		ike_sa = checkout_new(this, peer_cfg->get_ike_version(peer_cfg), TRUE);
+ 	}
+ 	charon->bus->set_sa(charon->bus, ike_sa);
+-- 
+2.5.0
+
diff --git a/user/strongswan/1001-charon-add-optional-source-and-remote-overrides-for-.patch b/user/strongswan/1001-charon-add-optional-source-and-remote-overrides-for-.patch
new file mode 100644
index 000000000..d9aea3c4d
--- /dev/null
+++ b/user/strongswan/1001-charon-add-optional-source-and-remote-overrides-for-.patch
@@ -0,0 +1,597 @@
+From 460e0f52d88433071b27603e47995517514ef8b9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
+Date: Mon, 21 Sep 2015 13:41:58 +0300
+Subject: [PATCH] charon: add optional source and remote overrides for initiate
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This introduces support for specifying optional IKE SA specific
+source and remote address for child sa initiation. This allows
+to initiate wildcard connection for known address via vici.
+
+In addition this allows impler implementation of trap-any patches
+and is a prerequisite for dmvpn support.
+
+Signed-off-by: Timo Teräs <timo.teras@iki.fi>
+---
+ src/charon-cmd/cmd/cmd_connection.c              |  2 +-
+ src/charon-nm/nm/nm_service.c                    |  2 +-
+ src/libcharon/control/controller.c               | 43 +++++++++++++++-
+ src/libcharon/control/controller.h               |  3 ++
+ src/libcharon/plugins/stroke/stroke_control.c    |  5 +-
+ src/libcharon/plugins/vici/vici_config.c         |  2 +-
+ src/libcharon/plugins/vici/vici_control.c        | 63 ++++++++++++++++++++----
+ src/libcharon/processing/jobs/start_action_job.c |  2 +-
+ src/libcharon/sa/ike_sa_manager.c                | 51 ++++++++++++++++++-
+ src/libcharon/sa/ike_sa_manager.h                |  8 ++-
+ src/libcharon/sa/trap_manager.c                  | 45 +++++++----------
+ src/swanctl/commands/initiate.c                  | 40 ++++++++++++++-
+ 12 files changed, 218 insertions(+), 48 deletions(-)
+
+diff --git a/src/charon-cmd/cmd/cmd_connection.c b/src/charon-cmd/cmd/cmd_connection.c
+index 71df92f7e..13b31de8a 100644
+--- a/src/charon-cmd/cmd/cmd_connection.c
++++ b/src/charon-cmd/cmd/cmd_connection.c
+@@ -436,7 +436,7 @@ static job_requeue_t initiate(private_cmd_connection_t *this)
+ 	child_cfg = create_child_cfg(this, peer_cfg);
+ 
+ 	if (charon->controller->initiate(charon->controller, peer_cfg, child_cfg,
+-								controller_cb_empty, NULL, 0, FALSE) != SUCCESS)
++								NULL, NULL, controller_cb_empty, NULL, 0, FALSE) != SUCCESS)
+ 	{
+ 		terminate(pid);
+ 	}
+diff --git a/src/charon-nm/nm/nm_service.c b/src/charon-nm/nm/nm_service.c
+index 571c0edba..e7922cf4d 100644
+--- a/src/charon-nm/nm/nm_service.c
++++ b/src/charon-nm/nm/nm_service.c
+@@ 6220,7 +622,7 @@ static gboolean connect_(NMVPNPlugin *plugin, NMConnection *connection,
+ 	 * Prepare IKE_SA
+ 	 */
+ 	ike_sa = charon->ike_sa_manager->checkout_by_config(charon->ike_sa_manager,
+-														peer_cfg);
++														peer_cfg, NULL, NULL);
+ 	if (!ike_sa)
+ 	{
+ 		peer_cfg->destroy(peer_cfg);
+diff --git a/src/libcharon/control/controller.c b/src/libcharon/control/controller.c
+index 8e7816b39..7d7b3bcbc 100644
+--- a/src/libcharon/control/controller.c
++++ b/src/libcharon/control/controller.c
+@@ -15,6 +15,28 @@
+  * for more details.
+  */
+ 
++/*
++ * Copyright (C) 2014 Timo Teräs <timo.teras@iki.fi>
++ *
++ * Permission is hereby granted, free of charge, to any person obtaining a copy
++ * of this software and associated documentation files (the "Software"), to deal
++ * in the Software without restriction, including without limitation the rights
++ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
++ * copies of the Software, and to permit persons to whom the Software is
++ * furnished to do so, subject to the following conditions:
++ *
++ * The above copyright notice and this permission notice shall be included in
++ * all copies or substantial portions of the Software.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
++ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
++ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
++ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
++ * THE SOFTWARE.
++ */
++
+ #include "controller.h"
+ 
+ #include <sys/types.h>
+@@ -103,6 +125,16 @@ struct interface_listener_t {
+ 	ike_sa_t *ike_sa;
+ 
+ 	/**
++	 * Our host hint.
++	 */
++	host_t *my_host;
++
++	/**
++	 * Other host hint.
++	 */
++	host_t *other_host;
++
++	/**
+ 	 * unique ID, used for various methods
+ 	 */
+ 	uint32_t id;
+@@ -409,9 +441,14 @@ METHOD(job_t, initiate_execute, job_requeue_t,
+ 	ike_sa_t *ike_sa;
+ 	interface_listener_t *listener = &job->listener;
+ 	peer_cfg_t *peer_cfg = listener->peer_cfg;
++	host_t *my_host = listener->my_host;
++	host_t *other_host = listener->other_host;
+ 
+ 	ike_sa = charon->ike_sa_manager->checkout_by_config(charon->ike_sa_manager,
+-														peer_cfg);
++														peer_cfg, my_host, other_host);
++	DESTROY_IF(my_host);
++	DESTROY_IF(other_host);
++
+ 	if (!ike_sa)
+ 	{
+ 		listener->child_cfg->destroy(listener->child_cfg);
+@@ -420,6 +457,7 @@ METHOD(job_t, initiate_execute, job_requeue_t,
+ 		listener_done(listener);
+ 		return JOB_REQUEUE_NONE;
+ 	}
++
+ 	listener->lock->lock(listener->lock);
+ 	listener->ike_sa = ike_sa;
+ 	listener->lock->unlock(listener->lock);
+@@ -492,6 +530,7 @@ METHOD(job_t, initiate_execute, job_requeue_t,
+ 
+ METHOD(controller_t, initiate, status_t,
+ 	private_controller_t *this, peer_cfg_t *peer_cfg, child_cfg_t *child_cfg,
++	host_t *my_host, host_t *other_host,
+ 	controller_cb_t callback, void *param, u_int timeout, bool limits)
+ {
+ 	interface_job_t *job;
+@@ -514,6 +553,8 @@ METHOD(controller_t, initiate, status_t,
+ 			.status = FAILED,
+ 			.child_cfg = child_cfg,
+ 			.peer_cfg = peer_cfg,
++			.my_host = my_host ? my_host->clone(my_host) : NULL,
++			.other_host = other_host ? other_host->clone(other_host) : NULL,
+ 			.lock = spinlock_create(),
+ 			.limits = limits,
+ 		},
+diff --git a/src/libcharon/control/controller.h b/src/libcharon/control/controller.h
+index 9524f53b9..7c51ba4ca 100644
+--- a/src/libcharon/control/controller.h
++++ b/src/libcharon/control/controller.h
+@@ -79,6 +79,8 @@ struct controller_t {
+ 	 *
+ 	 * @param peer_cfg		peer_cfg to use for IKE_SA setup
+ 	 * @param child_cfg		child_cfg to set up CHILD_SA from
++	 * @param my_host		optional address hint for source
++	 * @param other_host	optional address hint for destination
+ 	 * @param cb			logging callback
+ 	 * @param param			parameter to include in each call of cb
+ 	 * @param timeout		timeout in ms to wait for callbacks, 0 to disable
+@@ -92,6 +94,7 @@ struct controller_t {
+ 	 */
+ 	status_t (*initiate)(controller_t *this,
+ 						 peer_cfg_t *peer_cfg, child_cfg_t *child_cfg,
++						 host_t *my_host, host_t *other_host,
+ 						 controller_cb_t callback, void *param, u_int timeout,
+ 						 bool limits);
+ 
+diff --git a/src/libcharon/plugins/stroke/stroke_control.c b/src/libcharon/plugins/stroke/stroke_control.c
+index ee8306772..0736a6427 100644
+--- a/src/libcharon/plugins/stroke/stroke_control.c
++++ b/src/libcharon/plugins/stroke/stroke_control.c
+@@ -108,7 +108,7 @@ static void charon_initiate(private_stroke_control_t *this, peer_cfg_t *peer_cfg
+ 	if (msg->output_verbosity < 0)
+ 	{
+ 		charon->controller->initiate(charon->controller, peer_cfg, child_cfg,
+-									 NULL, NULL, 0, FALSE);
++									 NULL, NULL, NULL, NULL, 0, FALSE);
+ 	}
+ 	else
+ 	{
+@@ -116,7 +116,8 @@ static void charon_initiate(private_stroke_control_t *this, peer_cfg_t *peer_cfg
+ 		status_t status;
+ 
+ 		status = charon->controller->initiate(charon->controller,
+-							peer_cfg, child_cfg, (controller_cb_t)stroke_log,
++							peer_cfg, child_cfg, NULL, NULL,
++							(controller_cb_t)stroke_log,
+ 							&info, this->timeout, FALSE);
+ 		switch (status)
+ 		{
+diff --git a/src/libcharon/plugins/vici/vici_config.c b/src/libcharon/plugins/vici/vici_config.c
+index 12497ec5e..ba954e5cb 100644
+--- a/src/libcharon/plugins/vici/vici_config.c
++++ b/src/libcharon/plugins/vici/vici_config.c
+@@ -1978,7 +1978,7 @@ static void run_start_action(private_vici_config_t *this, peer_cfg_t *peer_cfg,
+ 			DBG1(DBG_CFG, "initiating '%s'", child_cfg->get_name(child_cfg));
+ 			charon->controller->initiate(charon->controller,
+ 					peer_cfg->get_ref(peer_cfg), child_cfg->get_ref(child_cfg),
+-					NULL, NULL, 0, FALSE);
++					NULL, NULL, NULL, NULL, 0, FALSE);
+ 			break;
+ 		case ACTION_ROUTE:
+ 			DBG1(DBG_CFG, "installing '%s'", child_cfg->get_name(child_cfg));
+diff --git a/src/libcharon/plugins/vici/vici_control.c b/src/libcharon/plugins/vici/vici_control.c
+index afee649f7..94bb2eecb 100644
+--- a/src/libcharon/plugins/vici/vici_control.c
++++ b/src/libcharon/plugins/vici/vici_control.c
+@@ -16,6 +16,28 @@
+  * for more details.
+  */
+ 
++/*
++ * Copyright (C) 2014 Timo Teräs <timo.teras@iki.fi>
++ *
++ * Permission is hereby granted, free of charge, to any person obtaining a copy
++ * of this software and associated documentation files (the "Software"), to deal
++ * in the Software without restriction, including without limitation the rights
++ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
++ * copies of the Software, and to permit persons to whom the Software is
++ * furnished to do so, subject to the following conditions:
++ *
++ * The above copyright notice and this permission notice shall be included in
++ * all copies or substantial portions of the Software.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
++ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
++ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
++ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
++ * THE SOFTWARE.
++ */
++
+ #include "vici_control.h"
+ #include "vici_builder.h"
+ 
+@@ -169,9 +191,11 @@ static child_cfg_t* find_child_cfg(char *name, char *pname, peer_cfg_t **out)
+ CALLBACK(initiate, vici_message_t*,
+ 	private_vici_control_t *this, char *name, u_int id, vici_message_t *request)
+ {
++	vici_message_t* msg;
+ 	child_cfg_t *child_cfg = NULL;
+ 	peer_cfg_t *peer_cfg;
+-	char *child, *ike;
++	host_t *my_host = NULL, *other_host = NULL;
++	char *child, *ike, *my_host_str, *other_host_str;
+ 	int timeout;
+ 	bool limits;
+ 	controller_cb_t log_cb = NULL;
+@@ -185,6 +209,8 @@ CALLBACK(initiate, vici_message_t*,
+ 	timeout = request->get_int(request, 0, "timeout");
+ 	limits = request->get_bool(request, FALSE, "init-limits");
+ 	log.level = request->get_int(request, 1, "loglevel");
++	my_host_str = request->get_str(request, NULL, "my-host");
++	other_host_str = request->get_str(request, NULL, "other-host");
+ 
+ 	if (!child)
+ 	{
+@@ -195,28 +221,47 @@ CALLBACK(initiate, vici_message_t*,
+ 		log_cb = (controller_cb_t)log_vici;
+ 	}
+ 
+-	DBG1(DBG_CFG, "vici initiate '%s'", child);
++	if (my_host_str)
++	{
++		my_host = host_create_from_string(my_host_str, 0);
++	}
++	if (other_host_str)
++	{
++		other_host = host_create_from_string(other_host_str, 0);
++	}
++
++	DBG1(DBG_CFG, "vici initiate '%s', me %H, other %H, limits %d", child, my_host, other_host, limits);
+ 
+ 	child_cfg = find_child_cfg(child, ike, &peer_cfg);
+ 	if (!child_cfg)
+ 	{
+-		return send_reply(this, "CHILD_SA config '%s' not found", child);
++		msg = send_reply(this, "CHILD_SA config '%s' not found", child);
++		goto ret;
+ 	}
+-	switch (charon->controller->initiate(charon->controller, peer_cfg,
+-									child_cfg, log_cb, &log, timeout, limits))
++	switch (charon->controller->initiate(charon->controller,
++				peer_cfg, child_cfg, my_host, other_host,
++				log_cb, &log, timeout, limits))
+ 	{
+ 		case SUCCESS:
+-			return send_reply(this, NULL);
++			msg = send_reply(this, NULL);
++			break;
+ 		case OUT_OF_RES:
+-			return send_reply(this, "CHILD_SA '%s' not established after %dms",
++			msg = send_reply(this, "CHILD_SA '%s' not established after %dms",
+ 							  child, timeout);
++			break;
+ 		case INVALID_STATE:
+-			return send_reply(this, "establishing CHILD_SA '%s' not possible "
++			msg = send_reply(this, "establishing CHILD_SA '%s' not possible "
+ 							  "at the moment due to limits", child);
++			break;
+ 		case FAILED:
+ 		default:
+-			return send_reply(this, "establishing CHILD_SA '%s' failed", child);
++			msg = send_reply(this, "establishing CHILD_SA '%s' failed", child);
++			break;
+ 	}
++ret:
++	if (my_host) my_host->destroy(my_host);
++	if (other_host) other_host->destroy(other_host);
++	return msg;
+ }
+ 
+ CALLBACK(terminate, vici_message_t*,
+diff --git a/src/libcharon/processing/jobs/start_action_job.c b/src/libcharon/processing/jobs/start_action_job.c
+index 654ec6abe..3d5a48cb8 100644
+--- a/src/libcharon/processing/jobs/start_action_job.c
++++ b/src/libcharon/processing/jobs/start_action_job.c
+@@ -61,7 +61,7 @@ METHOD(job_t, execute, job_requeue_t,
+ 					charon->controller->initiate(charon->controller,
+ 												 peer_cfg->get_ref(peer_cfg),
+ 												 child_cfg->get_ref(child_cfg),
+-												 NULL, NULL, 0, FALSE);
++												 NULL, NULL, NULL, NULL, 0, FALSE);
+ 					break;
+ 				case ACTION_ROUTE:
+ 					DBG1(DBG_JOB, "start action: route '%s'", name);
+diff --git a/src/libcharon/sa/ike_sa_manager.c b/src/libcharon/sa/ike_sa_manager.c
+index 3ee233c1f..def2a6f1b 100644
+--- a/src/libcharon/sa/ike_sa_manager.c
++++ b/src/libcharon/sa/ike_sa_manager.c
+@@ -17,6 +17,28 @@
+  * for more details.
+  */
+ 
++/*
++ * Copyright (C) 2014 Timo Teräs <timo.teras@iki.fi>
++ *
++ * Permission is hereby granted, free of charge, to any person obtaining a copy
++ * of this software and associated documentation files (the "Software"), to deal
++ * in the Software without restriction, including without limitation the rights
++ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
++ * copies of the Software, and to permit persons to whom the Software is
++ * furnished to do so, subject to the following conditions:
++ *
++ * The above copyright notice and this permission notice shall be included in
++ * all copies or substantial portions of the Software.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
++ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
++ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
++ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
++ * THE SOFTWARE.
++ */
++
+ #include <string.h>
+ #include <inttypes.h>
+ 
+@@ -1408,7 +1430,8 @@ out:
+ }
+ 
+ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
+-	private_ike_sa_manager_t *this, peer_cfg_t *peer_cfg)
++	private_ike_sa_manager_t *this, peer_cfg_t *peer_cfg,
++	host_t *my_host, host_t *other_host)
+ {
+ 	enumerator_t *enumerator;
+ 	entry_t *entry;
+@@ -1417,7 +1440,17 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
+ 	ike_cfg_t *current_ike;
+ 	u_int segment;
+ 
+-	DBG2(DBG_MGR, "checkout IKE_SA by config");
++	if (my_host && my_host->get_port(my_host) == 0)
++	{
++		my_host->set_port(my_host, IKEV2_UDP_PORT);
++	}
++	if (other_host && other_host->get_port(other_host) == 0)
++	{
++		other_host->set_port(other_host, IKEV2_UDP_PORT);
++	}
++
++	DBG2(DBG_MGR, "checkout IKE_SA by config '%s', me %H, other %H",
++		 peer_cfg->get_name(peer_cfg), my_host, other_host);
+ 
+ 	if (this->reuse_ikesa || peer_cfg->get_ike_version(peer_cfg) == IKEV1)
+ 	{
+@@ -1434,6 +1457,16 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
+ 				entry->condvar->signal(entry->condvar);
+ 				continue;
+ 			}
++
++			if (my_host && !my_host->ip_equals(my_host, entry->ike_sa->get_my_host(entry->ike_sa)))
++			{
++				continue;
++			}
++			if (other_host && !other_host->ip_equals(other_host, entry->ike_sa->get_other_host(entry->ike_sa)))
++			{
++				continue;
++			}
++
+ 			current_peer = entry->ike_sa->get_peer_cfg(entry->ike_sa);
+ 			if (current_peer && current_peer->equals(current_peer, peer_cfg))
+ 			{
+@@ -1465,6 +1508,10 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
+ 			return NULL;
+ 		}
+ 		ike_sa = checkout_new(this, peer_cfg->get_ike_version(peer_cfg), TRUE);
++		if (my_host || other_host)
++		{
++			ike_sa->update_hosts(ike_sa, my_host, other_host, TRUE);
++		}
+ 	}
+ 	charon->bus->set_sa(charon->bus, ike_sa);
+ 
+diff --git a/src/libcharon/sa/ike_sa_manager.h b/src/libcharon/sa/ike_sa_manager.h
+index 4298c54e2..47d6e6a37 100644
+--- a/src/libcharon/sa/ike_sa_manager.h
++++ b/src/libcharon/sa/ike_sa_manager.h
+@@ -93,7 +93,8 @@ struct ike_sa_manager_t {
+ 	ike_sa_t* (*checkout_by_message) (ike_sa_manager_t* this, message_t *message);
+ 
+ 	/**
+-	 * Checkout an IKE_SA for initiation by a peer_config.
++	 * Checkout an IKE_SA for initiation by a peer_config and optional
++	 * source and remote host addresses.
+ 	 *
+ 	 * To initiate, a CHILD_SA may be established within an existing IKE_SA.
+ 	 * This call checks for an existing IKE_SA by comparing the configuration.
+@@ -103,10 +104,13 @@ struct ike_sa_manager_t {
+ 	 * the found IKE_SA is in the DELETING state.
+ 	 *
+ 	 * @param peer_cfg			configuration used to find an existing IKE_SA
++	 * @param my_host			source host address for wildcard peer_cfg
++	 * @param other_host		remote host address for wildcard peer_cfg
+ 	 * @return					checked out/created IKE_SA
+ 	 */
+ 	ike_sa_t* (*checkout_by_config) (ike_sa_manager_t* this,
+-									 peer_cfg_t *peer_cfg);
++									 peer_cfg_t *peer_cfg,
++									 host_t *my_host, host_t *other_host);
+ 
+ 	/**
+ 	 * Check for duplicates of the given IKE_SA.
+diff --git a/src/libcharon/sa/trap_manager.c b/src/libcharon/sa/trap_manager.c
+index 40a0682f2..ea79d95ae 100644
+--- a/src/libcharon/sa/trap_manager.c
++++ b/src/libcharon/sa/trap_manager.c
+@@ -421,7 +421,7 @@ METHOD(trap_manager_t, acquire, void,
+ 	peer_cfg_t *peer;
+ 	child_cfg_t *child;
+ 	ike_sa_t *ike_sa;
+-	host_t *host;
++	host_t *host, *my_host = NULL, *other_host = NULL;
+ 	bool wildcard, ignore = FALSE;
+ 
+ 	this->lock->read_lock(this->lock);
+@@ -497,36 +497,27 @@ METHOD(trap_manager_t, acquire, void,
+ 	this->lock->unlock(this->lock);
+ 
+ 	if (wildcard)
+-	{	/* the peer config would match IKE_SAs with other peers */
+-		ike_sa = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager,
+-											peer->get_ike_version(peer), TRUE);
+-		if (ike_sa)
+-		{
+-			ike_cfg_t *ike_cfg;
+-			uint16_t port;
+-			uint8_t mask;
+-
+-			ike_sa->set_peer_cfg(ike_sa, peer);
+-			ike_cfg = ike_sa->get_ike_cfg(ike_sa);
++	{
++		ike_cfg_t *ike_cfg;
++		uint16_t port;
++		uint8_t mask;
+ 
+-			port = ike_cfg->get_other_port(ike_cfg);
+-			dst->to_subnet(dst, &host, &mask);
+-			host->set_port(host, port);
+-			ike_sa->set_other_host(ike_sa, host);
++		ike_cfg = peer->get_ike_cfg(peer);
+ 
+-			port = ike_cfg->get_my_port(ike_cfg);
+-			src->to_subnet(src, &host, &mask);
+-			host->set_port(host, port);
+-			ike_sa->set_my_host(ike_sa, host);
++		port = ike_cfg->get_other_port(ike_cfg);
++		dst->to_subnet(dst, &other_host, &mask);
++		other_host->set_port(other_host, port);
+ 
+-			charon->bus->set_sa(charon->bus, ike_sa);
+-		}
+-	}
+-	else
+-	{
+-		ike_sa = charon->ike_sa_manager->checkout_by_config(
+-											charon->ike_sa_manager, peer);
++		port = ike_cfg->get_my_port(ike_cfg);
++		src->to_subnet(src, &my_host, &mask);
++		my_host->set_port(my_host, port);
+ 	}
++	ike_sa = charon->ike_sa_manager->checkout_by_config(
++											charon->ike_sa_manager, peer,
++											my_host, other_host);
++	DESTROY_IF(my_host);
++	DESTROY_IF(other_host);
++
+ 	if (ike_sa)
+ 	{
+ 		if (ike_sa->get_peer_cfg(ike_sa) == NULL)
+diff --git a/src/swanctl/commands/initiate.c b/src/swanctl/commands/initiate.c
+index 8e452a6f6..b27bb8194 100644
+--- a/src/swanctl/commands/initiate.c
++++ b/src/swanctl/commands/initiate.c
+@@ -13,6 +13,28 @@
+  * for more details.
+  */
+ 
++/*
++ * Copyright (C) 2014 Timo Teräs <timo.teras@iki.fi>
++ *
++ * Permission is hereby granted, free of charge, to any person obtaining a copy
++ * of this software and associated documentation files (the "Software"), to deal
++ * in the Software without restriction, including without limitation the rights
++ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
++ * copies of the Software, and to permit persons to whom the Software is
++ * furnished to do so, subject to the following conditions:
++ *
++ * The above copyright notice and this permission notice shall be included in
++ * all copies or substantial portions of the Software.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
++ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
++ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
++ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
++ * THE SOFTWARE.
++ */
++
+ #include "command.h"
+ 
+ #include <errno.h>
+@@ -37,7 +59,7 @@ static int initiate(vici_conn_t *conn)
+ 	vici_req_t *req;
+ 	vici_res_t *res;
+ 	command_format_options_t format = COMMAND_FORMAT_NONE;
+-	char *arg, *child = NULL, *ike = NULL;
++	char *arg, *child = NULL, *ike = NULL, *my_host = NULL, *other_host = NULL;
+ 	int ret = 0, timeout = 0, level = 1;
+ 
+ 	while (TRUE)
+@@ -64,6 +86,12 @@ static int initiate(vici_conn_t *conn)
+ 			case 'l':
+ 				level = atoi(arg);
+ 				continue;
++			case 'S':
++				my_host = arg;
++				continue;
++			case 'R':
++				other_host = arg;
++				continue;
+ 			case EOF:
+ 				break;
+ 			default:
+@@ -87,6 +115,14 @@ static int initiate(vici_conn_t *conn)
+ 	{
+ 		vici_add_key_valuef(req, "ike", "%s", ike);
+ 	}
++	if (my_host)
++	{
++		vici_add_key_valuef(req, "my-host", "%s", my_host);
++	}
++	if (other_host)
++	{
++		vici_add_key_valuef(req, "other-host", "%s", other_host);
++	}
+ 	if (timeout)
+ 	{
+ 		vici_add_key_valuef(req, "timeout", "%d", timeout * 1000);
+@@ -133,6 +169,8 @@ static void __attribute__ ((constructor))reg()
+ 			{"help",		'h', 0, "show usage information"},
+ 			{"child",		'c', 1, "initate a CHILD_SA configuration"},
+ 			{"ike",			'i', 1, "name of the connection to which the child belongs"},
++			{"source",		'S', 1, "override source address"},
++			{"remote",		'R', 1, "override remote address"},
+ 			{"timeout",		't', 1, "timeout in seconds before detaching"},
+ 			{"raw",			'r', 0, "dump raw response message"},
+ 			{"pretty",		'P', 0, "dump raw response message in pretty print"},
+-- 
+2.12.1
+
diff --git a/user/strongswan/1002-vici-send-certificates-for-ike-sa-events.patch b/user/strongswan/1002-vici-send-certificates-for-ike-sa-events.patch
new file mode 100644
index 000000000..94814e13d
--- /dev/null
+++ b/user/strongswan/1002-vici-send-certificates-for-ike-sa-events.patch
@@ -0,0 +1,131 @@
+From 61556ac61b9d7c564dfe13d5cf549a53f889ae36 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
+Date: Mon, 21 Sep 2015 13:42:05 +0300
+Subject: [PATCH] vici: send certificates for ike-sa events
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Timo Teräs <timo.teras@iki.fi>
+---
+ src/libcharon/plugins/vici/vici_query.c | 48 ++++++++++++++++++++++++++++-----
+ 1 file changed, 41 insertions(+), 7 deletions(-)
+
+diff --git a/src/libcharon/plugins/vici/vici_query.c b/src/libcharon/plugins/vici/vici_query.c
+index c0f4e2de9..309a11c03 100644
+--- a/src/libcharon/plugins/vici/vici_query.c
++++ b/src/libcharon/plugins/vici/vici_query.c
+@@ -337,7 +337,7 @@ static void list_vips(private_vici_query_t *this, vici_builder_t *b,
+  * List details of an IKE_SA
+  */
+ static void list_ike(private_vici_query_t *this, vici_builder_t *b,
+-					 ike_sa_t *ike_sa, time_t now)
++					 ike_sa_t *ike_sa, time_t now, bool add_certs)
+ {
+ 	time_t t;
+ 	ike_sa_id_t *id;
+@@ -345,6 +345,8 @@ static void list_ike(private_vici_query_t *this, vici_builder_t *b,
+ 	proposal_t *proposal;
+ 	uint16_t alg, ks;
+ 	host_t *host;
++	auth_cfg_t *auth_cfg;
++	enumerator_t *enumerator;
+ 
+ 	b->add_kv(b, "uniqueid", "%u", ike_sa->get_unique_id(ike_sa));
+ 	b->add_kv(b, "version", "%u", ike_sa->get_version(ike_sa));
+@@ -354,11 +356,43 @@ static void list_ike(private_vici_query_t *this, vici_builder_t *b,
+ 	b->add_kv(b, "local-host", "%H", host);
+ 	b->add_kv(b, "local-port", "%d", host->get_port(host));
+ 	b->add_kv(b, "local-id", "%Y", ike_sa->get_my_id(ike_sa));
++	if (add_certs)
++	{
++		enumerator = ike_sa->create_auth_cfg_enumerator(ike_sa, TRUE);
++		if (enumerator->enumerate(enumerator, &auth_cfg))
++		{
++			certificate_t *cert = auth_cfg->get(auth_cfg, AUTH_RULE_SUBJECT_CERT);
++			chunk_t encoding;
++
++			if (cert && cert->get_encoding(cert, CERT_ASN1_DER, &encoding))
++			{
++				b->add(b, VICI_KEY_VALUE, "local-cert-data", encoding);
++				free(encoding.ptr);
++			}
++		}
++		enumerator->destroy(enumerator);
++	}
+ 
+ 	host = ike_sa->get_other_host(ike_sa);
+ 	b->add_kv(b, "remote-host", "%H", host);
+ 	b->add_kv(b, "remote-port", "%d", host->get_port(host));
+ 	b->add_kv(b, "remote-id", "%Y", ike_sa->get_other_id(ike_sa));
++	if (add_certs)
++	{
++		enumerator = ike_sa->create_auth_cfg_enumerator(ike_sa, FALSE);
++		if (enumerator->enumerate(enumerator, &auth_cfg))
++		{
++			certificate_t *cert = auth_cfg->get(auth_cfg, AUTH_RULE_SUBJECT_CERT);
++			chunk_t encoding;
++
++			if (cert && cert->get_encoding(cert, CERT_ASN1_DER, &encoding))
++			{
++				b->add(b, VICI_KEY_VALUE, "remote-cert-data", encoding);
++				free(encoding.ptr);
++			}
++		}
++		enumerator->destroy(enumerator);
++	}
+ 
+ 	eap = ike_sa->get_other_eap_id(ike_sa);
+ 
+@@ -476,7 +510,7 @@ CALLBACK(list_sas, vici_message_t*,
+ 		b = vici_builder_create();
+ 		b->begin_section(b, ike_sa->get_name(ike_sa));
+ 
+-		list_ike(this, b, ike_sa, now);
++		list_ike(this, b, ike_sa, now, TRUE);
+ 
+ 		b->begin_section(b, "child-sas");
+ 		csas = ike_sa->create_child_sa_enumerator(ike_sa);
+@@ -1624,7 +1658,7 @@ METHOD(listener_t, ike_updown, bool,
+ 	}
+ 
+ 	b->begin_section(b, ike_sa->get_name(ike_sa));
+-	list_ike(this, b, ike_sa, now);
++	list_ike(this, b, ike_sa, now, up);
+ 	b->end_section(b);
+ 
+ 	this->dispatcher->raise_event(this->dispatcher,
+@@ -1649,10 +1683,10 @@ METHOD(listener_t, ike_rekey, bool,
+ 	b = vici_builder_create();
+ 	b->begin_section(b, old->get_name(old));
+ 	b->begin_section(b, "old");
+-	list_ike(this, b, old, now);
++	list_ike(this, b, old, now, TRUE);
+ 	b->end_section(b);
+ 	b->begin_section(b, "new");
+-	list_ike(this, b, new, now);
++	list_ike(this, b, new, now, TRUE);
+ 	b->end_section(b);
+ 	b->end_section(b);
+ 
+@@ -1682,7 +1716,7 @@ METHOD(listener_t, child_updown, bool,
+ 	}
+ 
+ 	b->begin_section(b, ike_sa->get_name(ike_sa));
+-	list_ike(this, b, ike_sa, now);
++	list_ike(this, b, ike_sa, now, up);
+ 	b->begin_section(b, "child-sas");
+ 
+ 	b->begin_section(b, child_sa->get_name(child_sa));
+@@ -1714,7 +1748,7 @@ METHOD(listener_t, child_rekey, bool,
+ 	b = vici_builder_create();
+ 
+ 	b->begin_section(b, ike_sa->get_name(ike_sa));
+-	list_ike(this, b, ike_sa, now);
++	list_ike(this, b, ike_sa, now, TRUE);
+ 	b->begin_section(b, "child-sas");
+ 
+ 	b->begin_section(b, old->get_name(old));
+-- 
+2.12.1
+
diff --git a/user/strongswan/1003-vici-add-support-for-individual-sa-state-changes.patch b/user/strongswan/1003-vici-add-support-for-individual-sa-state-changes.patch
new file mode 100644
index 000000000..06dc121e8
--- /dev/null
+++ b/user/strongswan/1003-vici-add-support-for-individual-sa-state-changes.patch
@@ -0,0 +1,159 @@
+From 0e4f1118e68736bb96ae23f4c6cb85f2ebbc998d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
+Date: Mon, 21 Sep 2015 13:42:11 +0300
+Subject: [PATCH] vici: add support for individual sa state changes
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Useful for monitoring and tracking full SA.
+
+Signed-off-by: Timo Teräs <timo.teras@iki.fi>
+---
+ src/libcharon/plugins/vici/vici_query.c | 105 ++++++++++++++++++++++++++++++++
+ 1 file changed, 105 insertions(+)
+
+diff --git a/src/libcharon/plugins/vici/vici_query.c b/src/libcharon/plugins/vici/vici_query.c
+index 309a11c03..83a5daaa7 100644
+--- a/src/libcharon/plugins/vici/vici_query.c
++++ b/src/libcharon/plugins/vici/vici_query.c
+@@ -1624,8 +1624,16 @@ static void manage_commands(private_vici_query_t *this, bool reg)
+ 	this->dispatcher->manage_event(this->dispatcher, "list-cert", reg);
+ 	this->dispatcher->manage_event(this->dispatcher, "ike-updown", reg);
+ 	this->dispatcher->manage_event(this->dispatcher, "ike-rekey", reg);
++	this->dispatcher->manage_event(this->dispatcher, "ike-state-established", reg);
++	this->dispatcher->manage_event(this->dispatcher, "ike-state-destroying", reg);
+ 	this->dispatcher->manage_event(this->dispatcher, "child-updown", reg);
+ 	this->dispatcher->manage_event(this->dispatcher, "child-rekey", reg);
++	this->dispatcher->manage_event(this->dispatcher, "child-state-installing", reg);
++	this->dispatcher->manage_event(this->dispatcher, "child-state-installed", reg);
++	this->dispatcher->manage_event(this->dispatcher, "child-state-updating", reg);
++	this->dispatcher->manage_event(this->dispatcher, "child-state-rekeying", reg);
++	this->dispatcher->manage_event(this->dispatcher, "child-state-rekeyed", reg);
++	this->dispatcher->manage_event(this->dispatcher, "child-state-destroying", reg);
+ 	manage_command(this, "list-sas", list_sas, reg);
+ 	manage_command(this, "list-policies", list_policies, reg);
+ 	manage_command(this, "list-conns", list_conns, reg);
+@@ -1696,6 +1704,45 @@ METHOD(listener_t, ike_rekey, bool,
+ 	return TRUE;
+ }
+ 
++METHOD(listener_t, ike_state_change, bool,
++	private_vici_query_t *this, ike_sa_t *ike_sa, ike_sa_state_t state)
++{
++	char *event;
++	vici_builder_t *b;
++	time_t now;
++
++	switch (state)
++	{
++	case IKE_ESTABLISHED:
++		event = "ike-state-established";
++		break;
++	case IKE_DESTROYING:
++		event = "ike-state-destroying";
++		break;
++	default:
++		return TRUE;
++	}
++
++	if (!this->dispatcher->has_event_listeners(this->dispatcher, event))
++	{
++		return TRUE;
++	}
++
++	now = time_monotonic(NULL);
++
++	b = vici_builder_create();
++	b->begin_section(b, ike_sa->get_name(ike_sa));
++	list_ike(this, b, ike_sa, now, state != IKE_DESTROYING);
++	b->begin_section(b, "child-sas");
++	b->end_section(b);
++	b->end_section(b);
++
++	this->dispatcher->raise_event(this->dispatcher,
++								  event, 0, b->finalize(b));
++
++	return TRUE;
++}
++
+ METHOD(listener_t, child_updown, bool,
+ 	private_vici_query_t *this, ike_sa_t *ike_sa, child_sa_t *child_sa, bool up)
+ {
+@@ -1771,6 +1818,62 @@ METHOD(listener_t, child_rekey, bool,
+ 	return TRUE;
+ }
+ 
++METHOD(listener_t, child_state_change, bool,
++	private_vici_query_t *this, ike_sa_t *ike_sa, child_sa_t *child_sa, child_sa_state_t state)
++{
++	char *event;
++	vici_builder_t *b;
++	time_t now;
++
++	switch (state)
++	{
++	case CHILD_INSTALLING:
++		event = "child-state-installing";
++		break;
++	case CHILD_INSTALLED:
++		event = "child-state-installed";
++		break;
++	case CHILD_UPDATING:
++		event = "child-state-updating";
++		break;
++	case CHILD_REKEYING:
++		event = "child-state-rekeying";
++		break;
++	case CHILD_REKEYED:
++		event = "child-state-rekeyed";
++		break;
++	case CHILD_DESTROYING:
++		event = "child-state-destroying";
++		break;
++	default:
++		return TRUE;
++	}
++
++	if (!this->dispatcher->has_event_listeners(this->dispatcher, event))
++	{
++		return TRUE;
++	}
++
++	now = time_monotonic(NULL);
++
++	b = vici_builder_create();
++	b->begin_section(b, ike_sa->get_name(ike_sa));
++	list_ike(this, b, ike_sa, now, state != CHILD_DESTROYING);
++	b->begin_section(b, "child-sas");
++
++	b->begin_section(b, child_sa->get_name(child_sa));
++	list_child(this, b, child_sa, now);
++	b->end_section(b);
++
++	b->end_section(b);
++	b->end_section(b);
++
++	this->dispatcher->raise_event(this->dispatcher,
++								  event, 0, b->finalize(b));
++
++	return TRUE;
++}
++
+ METHOD(vici_query_t, destroy, void,
+ 	private_vici_query_t *this)
+ {
+@@ -1790,8 +1893,10 @@ vici_query_t *vici_query_create(vici_dispatcher_t *dispatcher)
+ 			.listener = {
+ 				.ike_updown = _ike_updown,
+ 				.ike_rekey = _ike_rekey,
++				.ike_state_change = _ike_state_change,
+ 				.child_updown = _child_updown,
+ 				.child_rekey = _child_rekey,
++				.child_state_change = _child_state_change,
+ 			},
+ 			.destroy = _destroy,
+ 		},
+-- 
+2.12.1
+
diff --git a/user/strongswan/APKBUILD b/user/strongswan/APKBUILD
new file mode 100644
index 000000000..a89a10a6c
--- /dev/null
+++ b/user/strongswan/APKBUILD
@@ -0,0 +1,104 @@
+# Contributor: Jesse Young <jlyo@jlyo.org>
+# Contributor: Natanael Copa <ncopa@alpinelinux.org>
+# Maintainer: Lee Starnes <lee@canned-death.us>
+pkgname=strongswan
+pkgver=5.7.0
+_pkgver=${pkgver//_rc/rc}
+pkgrel=0
+pkgdesc="IPsec-based VPN solution focused on security and ease of use, supporting IKEv1/IKEv2 and MOBIKE"
+url="https://www.strongswan.org/"
+arch="all"
+pkgusers="ipsec"
+pkggroups="ipsec"
+license="GPL-2.0 AND RSA-MD5 AND RSA-PKCS11 AND DES"
+depends="iproute2"
+depends_dev=""
+makedepends="$depends_dev linux-headers python3 sqlite-dev openssl-dev curl-dev
+	gmp-dev libcap-dev"
+install="$pkgname.pre-install"
+subpackages="$pkgname-doc $pkgname-dbg $pkgname-openrc"
+source="https://download.strongswan.org/$pkgname-$_pkgver.tar.bz2
+	0205-ike-Adhere-to-IKE_SA-limit-when-checking-out-by-conf.patch
+	1001-charon-add-optional-source-and-remote-overrides-for-.patch
+	1002-vici-send-certificates-for-ike-sa-events.patch
+	1003-vici-add-support-for-individual-sa-state-changes.patch
+
+	strongswan.initd
+	charon.initd
+	"
+builddir="$srcdir/$pkgname-$_pkgver"
+
+build() {
+	cd "$builddir"
+
+	# notes about configuration:
+	# - try to keep options in ./configure --help order
+	# - apk depends on openssl, so we use that
+	# - openssl provides ciphers, randomness, etc
+	#   -> disable all redundant in-tree copies
+
+	./configure --prefix=/usr \
+		--sysconfdir=/etc \
+		--libexecdir=/usr/lib \
+		--with-ipsecdir=/usr/lib/strongswan \
+		--with-capabilities=libcap \
+		--with-user=ipsec \
+		--with-group=ipsec \
+		--enable-curl \
+		--disable-ldap \
+		--disable-aes \
+		--disable-des \
+		--disable-rc2 \
+		--disable-md5 \
+		--disable-sha1 \
+		--disable-sha2 \
+		--enable-gmp \
+		--disable-hmac \
+		--disable-mysql \
+		--enable-sqlite \
+		--enable-eap-sim \
+		--enable-eap-sim-file \
+		--enable-eap-aka \
+		--enable-eap-aka-3gpp2 \
+		--enable-eap-simaka-pseudonym \
+		--enable-eap-simaka-reauth \
+		--enable-eap-identity \
+		--enable-eap-md5 \
+		--enable-eap-tls \
+		--disable-eap-gtc \
+		--enable-eap-mschapv2 \
+		--enable-eap-radius \
+		--enable-xauth-eap \
+		--enable-farp \
+		--enable-vici \
+		--enable-attr-sql \
+		--enable-dhcp \
+		--enable-openssl \
+		--enable-unity \
+		--enable-ha \
+		--enable-cmd \
+		--enable-swanctl \
+		--enable-shared \
+		--disable-static
+	make
+}
+
+check() {
+	cd "$builddir"
+	env TESTS_SUITES_EXCLUDE=printf make check
+}
+
+package() {
+	cd "$builddir"
+	make DESTDIR="$pkgdir" install
+	install -m755 -D "$srcdir/$pkgname.initd" "$pkgdir/etc/init.d/$pkgname"
+	install -m755 -D "$srcdir/charon.initd" "$pkgdir/etc/init.d/charon"
+}
+
+sha512sums="811bfa79aa2b17fcf298c45a2b4109cf4235286e90c4def3e09022ed94c7fa481fc25b8d5054529e4ff4e33011ce6f6ba9874595d16c1a8fe13ef924c4ec6395  strongswan-5.7.0.tar.bz2
+193d845e2751c23d98cdf84134c7803f2e412197669c6d6c1c9974041608d154b85594ed3d9ffb923ca22a4d5926c7f2373787ddc7da47b52019e284a1d13211  0205-ike-Adhere-to-IKE_SA-limit-when-checking-out-by-conf.patch
+21db8f153f535ef13cc7c9c011f9b90b8c794e0072bd93fda6a0a56dc00d32d04e186b1a72a87a85613b7e511eed5cb96623abf0721c67dd5c96446db969a185  1001-charon-add-optional-source-and-remote-overrides-for-.patch
+f7d98fb99b4855e8bfbb7369292c170536b1987e717feeda71f64ab71b35538e7d462609a773c6a6ed08c8e6ee7a186df12e1ea7d64b9dac0b17d4c7af17dab3  1002-vici-send-certificates-for-ike-sa-events.patch
+a4235cd07e17ad3441dc391ded11ee9f4debdffa1e8218809731e73a545ca6fcdc0bb87239d41b1102b0b6719a4d31d43758972d2193ebe298b275285de2ce54  1003-vici-add-support-for-individual-sa-state-changes.patch
+8b61e3ffbb39b837733e602ec329e626dc519bf7308d3d4192b497d18f38176789d23ef5afec51f8463ee1ddaf4d74546b965c03184132e217cbc27017e886c9  strongswan.initd
+1c44c801f66305c0331f76e580c0d60f1b7d5cd3cc371be55826b06c3899f542664628a912a7fb48626e34d864f72ca5dcd34b2f0d507c4f19c510d0047054c1  charon.initd"
diff --git a/user/strongswan/charon.initd b/user/strongswan/charon.initd
new file mode 100644
index 000000000..6f79679c0
--- /dev/null
+++ b/user/strongswan/charon.initd
@@ -0,0 +1,30 @@
+#!/sbin/openrc-run
+
+description="strongSwan charon IKE daemon"
+command="/usr/lib/strongswan/charon"
+pidfile="/var/run/charon.pid"
+start_stop_daemon_args="--background"
+extra_started_commands="reload fullstatus"
+
+depend() {
+	need net
+	after firewall
+	provide ipsec
+}
+
+start_post() {
+	ebegin "Loading ${name:-$RC_SVCNAME} configuration"
+	sleep 0.2
+	swanctl --load-all &>/dev/null
+	eend $?
+}
+
+reload() {
+	swanctl --reload-settings
+	swanctl --load-all
+}
+
+fullstatus() {
+	swanctl --list-conns
+	swanctl --list-sas
+}
diff --git a/user/strongswan/strongswan.initd b/user/strongswan/strongswan.initd
new file mode 100644
index 000000000..78fecb0ee
--- /dev/null
+++ b/user/strongswan/strongswan.initd
@@ -0,0 +1,35 @@
+#!/sbin/openrc-run
+
+extra_started_commands="fullstatus"
+
+depend() {
+	need net
+	after firewall
+	provide ipsec
+}
+
+start() {
+	ebegin "Starting StrongSwan"
+	ipsec start
+	eend $?
+}
+
+stop () {
+	ebegin "Stopping StrongSwan"
+	ipsec stop
+	eend $?
+}
+
+restart() {
+	ebegin "Restarting StrongSwan"
+	svc_stop
+	sleep 2
+	svc_start
+	eend $?
+}
+
+fullstatus() {
+	ebegin "StrongSwan Status (verbose):"
+	ipsec statusall
+	eend $?
+}
diff --git a/user/strongswan/strongswan.pre-install b/user/strongswan/strongswan.pre-install
new file mode 100644
index 000000000..da43ede66
--- /dev/null
+++ b/user/strongswan/strongswan.pre-install
@@ -0,0 +1,6 @@
+#!/bin/sh
+
+addgroup -S ipsec 2>/dev/null
+adduser -S -D -H -h /var/empty -s /sbin/nologin -G ipsec -g ipsec ipsec 2>/dev/null
+
+exit 0