Merge branch 'swanctl-plugins'

Uses a separate default plugin list for swanctl (instead of just loading
all of libstrongswan's plugins) to avoid some side-effects of loaded but
unused plugins.  The load statements in the regression tests have been
updated accordingly.

A new configure option for maintainers of distributions that ship
plugins in separate packages changes the message if a plugin is not
found and reduces its log level.  This confused users of tools that don't
use modular plugin loading (e.g. pki or swanctl).

Also changes command line handling in pki and swanctl so that the shared
options can be passed before the actual command and that the debug level
also affects library/plugin initialization.

References strongswan/strongswan#2971

configure.ac

@@ -68,6 +68,7 @@ ARG_WITH_SET([dev-headers],          [no], [install strongSwan development heade
 ARG_WITH_SET([printf-hooks],         [auto], [force the use of a specific printf hook implementation (auto, builtin, glibc, vstr).])
 ARG_WITH_SET([rubygemdir],           ["gem environment gemdir"], [path to install ruby gems to])
 ARG_WITH_SET([testable-ke],          [yes], [make key exchange implementations testable by providing a set_seed() method])
+ARG_WITH_SET([plugins-packaged-seperately], [no], [changes e.g. log messages for distributions that package plugins seperately])
 
 if test -n "$PKG_CONFIG"; then
 	systemdsystemunitdir_default=$($PKG_CONFIG --variable=systemdsystemunitdir systemd)
@@ -1519,6 +1520,7 @@ CFLAGS="$WARN_CFLAGS $CFLAGS"
 
 # plugin lists for all components
 charon_plugins=
+swanctl_plugins=
 pool_plugins=
 attest_plugins=
 pki_plugins=
@@ -1537,61 +1539,61 @@ s_plugins=
 t_plugins=
 p_plugins=
 
-ADD_PLUGIN([test-vectors],         [s charon pki])
+ADD_PLUGIN([test-vectors],         [s charon swanctl pki])
 ADD_PLUGIN([unbound],              [s charon scripts])
-ADD_PLUGIN([ldap],                 [s charon scripts nm cmd])
+ADD_PLUGIN([ldap],                 [s charon pki scripts nm cmd])
 ADD_PLUGIN([pkcs11],               [s charon pki nm cmd])
 ADD_PLUGIN([tpm],                  [p charon pki nm cmd])
-ADD_PLUGIN([aesni],                [s charon pki scripts medsrv attest nm cmd aikgen])
-ADD_PLUGIN([aes],                  [s charon pki scripts nm cmd])
-ADD_PLUGIN([des],                  [s charon pki scripts nm cmd])
-ADD_PLUGIN([blowfish],             [s charon pki scripts nm cmd])
-ADD_PLUGIN([rc2],                  [s charon pki scripts nm cmd])
-ADD_PLUGIN([sha2],                 [s charon pki scripts medsrv attest nm cmd aikgen fuzz])
-ADD_PLUGIN([sha3],                 [s charon pki scripts medsrv attest nm cmd aikgen fuzz])
-ADD_PLUGIN([sha1],                 [s charon pki scripts manager medsrv attest nm cmd aikgen fuzz])
-ADD_PLUGIN([md4],                  [s charon pki nm cmd])
-ADD_PLUGIN([md5],                  [s charon pki scripts attest nm cmd aikgen])
-ADD_PLUGIN([mgf1],                 [s charon pki scripts medsrv attest nm cmd aikgen])
-ADD_PLUGIN([rdrand],               [s charon pki scripts medsrv attest nm cmd aikgen])
-ADD_PLUGIN([random],               [s charon pki scripts manager medsrv attest nm cmd aikgen])
+ADD_PLUGIN([aesni],                [s charon swanctl pki scripts medsrv attest nm cmd aikgen])
+ADD_PLUGIN([aes],                  [s charon swanctl pki scripts nm cmd])
+ADD_PLUGIN([des],                  [s charon swanctl pki scripts nm cmd])
+ADD_PLUGIN([blowfish],             [s charon swanctl pki scripts nm cmd])
+ADD_PLUGIN([rc2],                  [s charon swanctl pki scripts nm cmd])
+ADD_PLUGIN([sha2],                 [s charon swanctl pki scripts medsrv attest nm cmd aikgen fuzz])
+ADD_PLUGIN([sha3],                 [s charon swanctl pki scripts medsrv attest nm cmd aikgen fuzz])
+ADD_PLUGIN([sha1],                 [s charon swanctl pki scripts manager medsrv attest nm cmd aikgen fuzz])
+ADD_PLUGIN([md4],                  [s charon swanctl pki nm cmd])
+ADD_PLUGIN([md5],                  [s charon swanctl pki scripts attest nm cmd aikgen])
+ADD_PLUGIN([mgf1],                 [s charon swanctl pki scripts medsrv attest nm cmd aikgen])
+ADD_PLUGIN([rdrand],               [s charon swanctl pki scripts medsrv attest nm cmd aikgen])
+ADD_PLUGIN([random],               [s charon swanctl pki scripts manager medsrv attest nm cmd aikgen])
 ADD_PLUGIN([nonce],                [s charon nm cmd aikgen])
-ADD_PLUGIN([x509],                 [s charon pki scripts attest nm cmd aikgen fuzz])
+ADD_PLUGIN([x509],                 [s charon swanctl pki scripts attest nm cmd aikgen fuzz])
 ADD_PLUGIN([revocation],           [s charon pki nm cmd])
 ADD_PLUGIN([constraints],          [s charon pki nm cmd])
 ADD_PLUGIN([acert],                [s charon])
-ADD_PLUGIN([pubkey],               [s charon pki cmd aikgen])
-ADD_PLUGIN([pkcs1],                [s charon pki scripts manager medsrv attest nm cmd aikgen fuzz])
-ADD_PLUGIN([pkcs7],                [s charon pki scripts nm cmd])
-ADD_PLUGIN([pkcs12],               [s charon pki scripts cmd])
+ADD_PLUGIN([pubkey],               [s charon swanctl pki cmd aikgen])
+ADD_PLUGIN([pkcs1],                [s charon swanctl pki scripts manager medsrv attest nm cmd aikgen fuzz])
+ADD_PLUGIN([pkcs7],                [s charon swanctl pki scripts nm cmd])
+ADD_PLUGIN([pkcs12],               [s charon swanctl pki scripts cmd])
 ADD_PLUGIN([pgp],                  [s charon])
-ADD_PLUGIN([dnskey],               [s charon pki])
-ADD_PLUGIN([sshkey],               [s charon pki nm cmd])
+ADD_PLUGIN([dnskey],               [s charon swanctl pki])
+ADD_PLUGIN([sshkey],               [s charon swanctl pki nm cmd])
 ADD_PLUGIN([dnscert],              [c charon])
 ADD_PLUGIN([ipseckey],             [c charon])
-ADD_PLUGIN([pem],                  [s charon pki scripts manager medsrv attest nm cmd aikgen fuzz])
+ADD_PLUGIN([pem],                  [s charon swanctl pki scripts manager medsrv attest nm cmd aikgen fuzz])
 ADD_PLUGIN([padlock],              [s charon])
-ADD_PLUGIN([openssl],              [s charon pki scripts manager medsrv attest nm cmd aikgen])
-ADD_PLUGIN([wolfssl],              [s charon pki scripts manager medsrv attest nm cmd aikgen])
-ADD_PLUGIN([gcrypt],               [s charon pki scripts manager medsrv attest nm cmd aikgen])
-ADD_PLUGIN([botan],                [s charon pki scripts manager medsrv attest nm cmd aikgen])
-ADD_PLUGIN([pkcs8],                [s charon pki scripts manager medsrv attest nm cmd])
-ADD_PLUGIN([af-alg],               [s charon pki scripts medsrv attest nm cmd aikgen])
+ADD_PLUGIN([openssl],              [s charon swanctl pki scripts manager medsrv attest nm cmd aikgen])
+ADD_PLUGIN([wolfssl],              [s charon swanctl pki scripts manager medsrv attest nm cmd aikgen])
+ADD_PLUGIN([gcrypt],               [s charon swanctl pki scripts manager medsrv attest nm cmd aikgen])
+ADD_PLUGIN([botan],                [s charon swanctl pki scripts manager medsrv attest nm cmd aikgen])
+ADD_PLUGIN([pkcs8],                [s charon swanctl pki scripts manager medsrv attest nm cmd])
+ADD_PLUGIN([af-alg],               [s charon swanctl pki scripts medsrv attest nm cmd aikgen])
 ADD_PLUGIN([fips-prf],             [s charon nm cmd])
-ADD_PLUGIN([gmp],                  [s charon pki scripts manager medsrv attest nm cmd aikgen fuzz])
-ADD_PLUGIN([curve25519],           [s charon pki scripts nm cmd])
+ADD_PLUGIN([gmp],                  [s charon swanctl pki scripts manager medsrv attest nm cmd aikgen fuzz])
+ADD_PLUGIN([curve25519],           [s charon swanctl pki scripts nm cmd])
 ADD_PLUGIN([agent],                [s charon nm cmd])
 ADD_PLUGIN([keychain],             [s charon cmd])
 ADD_PLUGIN([chapoly],              [s charon scripts nm cmd])
 ADD_PLUGIN([xcbc],                 [s charon nm cmd])
 ADD_PLUGIN([cmac],                 [s charon nm cmd])
-ADD_PLUGIN([hmac],                 [s charon pki scripts nm cmd])
-ADD_PLUGIN([kdf],                  [s charon pki scripts nm cmd])
+ADD_PLUGIN([hmac],                 [s charon swanctl pki scripts nm cmd])
+ADD_PLUGIN([kdf],                  [s charon swanctl pki scripts nm cmd])
 ADD_PLUGIN([ctr],                  [s charon scripts nm cmd])
 ADD_PLUGIN([ccm],                  [s charon scripts nm cmd])
 ADD_PLUGIN([gcm],                  [s charon scripts nm cmd])
 ADD_PLUGIN([ml],                   [s charon scripts nm cmd])
-ADD_PLUGIN([drbg],                 [s charon pki scripts nm cmd])
+ADD_PLUGIN([drbg],                 [s charon swanctl pki scripts nm cmd])
 ADD_PLUGIN([curl],                 [s charon pki scripts nm cmd])
 ADD_PLUGIN([files],                [s charon pki scripts nm cmd])
 ADD_PLUGIN([winhttp],              [s charon pki scripts])
@@ -1677,6 +1679,7 @@ ADD_PLUGIN([unity],                [c charon])
 ADD_PLUGIN([counters],             [c charon])
 
 AC_SUBST(charon_plugins)
+AC_SUBST(swanctl_plugins)
 AC_SUBST(pool_plugins)
 AC_SUBST(attest_plugins)
 AC_SUBST(pki_plugins)
@@ -1942,6 +1945,10 @@ fi
 if test x$imc_swima = xtrue -o x$imv_swima = xtrue; then
 	AC_DEFINE([USE_JSON], [], [build code for JSON])
 fi
+if test "x$plugins_packaged_seperately" != xno; then
+	AC_DEFINE([PLUGINS_PACKAGED_SEPARATELY], [], [distribution ships plugins in multiple packages])
+fi
+
 
 # ====================================================
 #  options for enabled modules (see conf/Makefile.am)

src/libstrongswan/plugins/plugin_loader.c

@@ -477,8 +477,13 @@ static plugin_entry_t *load_plugin(private_plugin_loader_t *this, char *name,
 			{	/* try to load the plugin from a file */
 				break;
 			}
+#ifndef PLUGINS_PACKAGED_SEPARATELY
 			DBG1(DBG_LIB, "plugin '%s': failed to load - %s not found and no "
 				 "plugin file available", name, create);
+#else
+			DBG2(DBG_LIB, "plugin '%s': failed to load - %s not found, plugin "
+				 "may be shipped in a separate package", name, create);
+#endif
 			/* fall-through */
 		default:
 			return NULL;

src/libstrongswan/utils/debug.c

@@ -114,6 +114,18 @@ void dbg_default_set_level_group(debug_t group, level_t level)
 	}
 }
 
+/*
+ * Described in header
+ */
+level_t dbg_default_get_level_group(debug_t group)
+{
+	if (group < DBG_ANY)
+	{
+		return default_level[group] + 1;
+	}
+	return default_level[0];
+}
+
 /*
  * Described in header
  */

src/libstrongswan/utils/debug.h

@@ -159,6 +159,9 @@ void dbg_default_set_level(level_t level);
 /** set the level logged by dbg_default() for a specific group */
 void dbg_default_set_level_group(debug_t group, level_t level);
 
+/** get the level logged by dbg_default() for a specific group */
+level_t dbg_default_get_level_group(debug_t group);
+
 /** set the stream logged by dbg_default() to */
 void dbg_default_set_stream(FILE *stream);
 

src/pki/command.c

@@ -1,4 +1,5 @@
 /*
+ * Copyright (C) 2012-2026 Tobias Brunner
  * Copyright (C) 2009 Martin Willi
  *
  * Copyright (C) secunet Security Networks AG
@@ -63,12 +64,48 @@ static struct option command_opts[MAX_COMMANDS > MAX_OPTIONS ? MAX_COMMANDS : MA
  */
 static char command_optstring[(MAX_COMMANDS > MAX_OPTIONS ? MAX_COMMANDS : MAX_OPTIONS) * 3];
 
+/**
+ * Common options
+ */
+static command_option_t shared_options[] = {
+	{
+		"debug", 'v', 1, "set debug level, default: 1"
+	},
+	{
+		"options", '+', 1, "read command line options from file"
+	},
+};
+
+/**
+ * Add a single option to command_opts/command_optstr at the current locations.
+ */
+static void build_option(command_option_t *option, int i, int *pos)
+{
+	command_opts[i].name = option->name;
+	command_opts[i].has_arg = option->arg;
+	command_opts[i].val = option->op;
+
+	command_optstring[(*pos)++] = option->op;
+	switch (option->arg)
+	{
+		case optional_argument:
+			command_optstring[(*pos)++] = ':';
+			/* FALL */
+		case required_argument:
+			command_optstring[(*pos)++] = ':';
+			/* FALL */
+		case no_argument:
+		default:
+			break;
+	}
+}
+
 /**
  * Build command_opts/command_optstr for the active command
  */
 static void build_opts()
 {
-	int i, pos = 0;
+	int i, j, pos = 0;
 
 	memset(command_opts, 0, sizeof(command_opts));
 	memset(command_optstring, 0, sizeof(command_optstring));
@@ -80,33 +117,32 @@ static void build_opts()
 			command_opts[i].val = cmds[i].op;
 			command_optstring[i] = cmds[i].op;
 		}
+		/* add shared options not as actual option but as commands with
+		 * argument (which commands usually don't take) */
+		if (i > MAX_COMMANDS - countof(shared_options))
+		{
+			fprintf(stderr, "unable to add global shared options, please "
+					"increase MAX_COMMANDS\n");
+		}
+		else
+		{
+			for (j = 0, pos = i; j < countof(shared_options); j++, i++)
+			{
+				build_option(&shared_options[j], i, &pos);
+			}
+		}
 	}
 	else
 	{
-		for (i = 0; cmds[active].options[i].name; i++)
+		for (i = 0; i < MAX_OPTIONS && cmds[active].options[i].name; i++)
 		{
-			command_opts[i].name = cmds[active].options[i].name;
-			command_opts[i].has_arg = cmds[active].options[i].arg;
-			command_opts[i].val = cmds[active].options[i].op;
-			command_optstring[pos++] = cmds[active].options[i].op;
-			switch (cmds[active].options[i].arg)
-			{
-				case optional_argument:
-					command_optstring[pos++] = ':';
-					/* FALL */
-				case required_argument:
-					command_optstring[pos++] = ':';
-					/* FALL */
-				case no_argument:
-				default:
-					break;
-			}
+			build_option(&cmds[active].options[i], i, &pos);
 		}
 	}
 }
 
 /**
- * getopt_long wrapper
+ * Wrapper around getopt_long() that skippes common options
  */
 int command_getopt(char **arg)
 {
@@ -121,17 +157,25 @@ int command_getopt(char **arg)
 			case 'v':
 				continue;
 			default:
-				*arg = optarg;
+				if (arg)
+				{
+					*arg = optarg;
+				}
 				return op;
 		}
 	}
 }
 
 /**
- * Process options common for all commands
+ * Pre-process options common for all commands
  */
-static bool process_common_opts()
+static bool process_common_opts(bool init)
 {
+	int prevoptind = optind;
+	bool success = TRUE;
+
+	/* don't report any errors during this pre-processing */
+	opterr = 0;
 	while (TRUE)
 	{
 		switch (getopt_long(argc, argv, command_optstring, command_opts, NULL))
@@ -139,20 +183,30 @@ static bool process_common_opts()
 			case '+':
 				if (!options->from(options, optarg, &argc, &argv, optind))
 				{
-					return FALSE;
+					success = FALSE;
+					break;
 				}
 				continue;
 			case 'v':
 				dbg_default_set_level(atoi(optarg));
 				continue;
 			default:
+				if (init)
+				{	/* stop if we found a known command during initialization,
+					 * otherwise we'd process e.g. --options twice */
+					break;
+				}
 				continue;
 			case '?':
-				return FALSE;
 			case EOF:
-				return TRUE;
+				break;
 		}
+		break;
 	}
+	/* restore option parser state after pre-processing */
+	optind = prevoptind;
+	opterr = 1;
+	return success;
 }
 
 /**
@@ -160,7 +214,7 @@ static bool process_common_opts()
  */
 void command_register(command_t command)
 {
-	int i;
+	int i, j;
 
 	if (registered == MAX_COMMANDS)
 	{
@@ -173,26 +227,24 @@ void command_register(command_t command)
 	/* append default options, but not to --help */
 	if (!active)
 	{
-		for (i = 0; i < countof(cmds[registered].options) - 1; i++)
+		for (i = 0; i < MAX_OPTIONS; i++)
 		{
 			if (!cmds[registered].options[i].name)
 			{
 				break;
 			}
 		}
-		if (i > countof(cmds[registered].options) - 3)
+		if (i > MAX_OPTIONS - countof(shared_options))
 		{
 			fprintf(stderr, "command '%s' registered too many options, please "
 					"increase MAX_OPTIONS\n", command.cmd);
 		}
 		else
 		{
-			cmds[registered].options[i++] = (command_option_t) {
-				"debug",	'v', 1, "set debug level, default: 1"
-			};
-			cmds[registered].options[i++] = (command_option_t) {
-				"options",	'+', 1, "read command line options from file"
-			};
+			for (j = 0; j < countof(shared_options); j++)
+			{
+				cmds[registered].options[i++] = shared_options[j];
+			}
 		}
 		for (i = 0; cmds[registered].line[i]; i++)
 		{
@@ -223,14 +275,25 @@ int command_usage(char *error)
 
 	if (active == help_idx)
 	{
-		fprintf(out, "\nloaded plugins: %s\nusage:\n"
-				"  pki command [options]\ncommands:\n",
-				lib->plugins->loaded_plugins(lib->plugins));
+		fprintf(out, "\n");
+		if (lib)
+		{
+			fprintf(out, "loaded plugins: %s\nusage:\n"
+					"  pki command [options]\ncommands:\n",
+					lib->plugins->loaded_plugins(lib->plugins));
+		}
 		for (i = 0; i < MAX_COMMANDS && cmds[i].cmd; i++)
 		{
 			fprintf(out, "  --%-7s (-%c)  %s\n",
 					cmds[i].cmd, cmds[i].op, cmds[i].description);
 		}
+		fprintf(out, "options:\n");
+		for (i = 0; i < countof(shared_options); i++)
+		{
+			fprintf(out, "  --%-7s (-%c)  %s\n",
+					shared_options[i].name, shared_options[i].op,
+					shared_options[i].desc);
+		}
 	}
 	else
 	{
@@ -249,7 +312,7 @@ int command_usage(char *error)
 			}
 		}
 		fprintf(out, "options:\n");
-		for (i = 0; cmds[active].options[i].name; i++)
+		for (i = 0; i < MAX_OPTIONS && cmds[active].options[i].name; i++)
 		{
 			fprintf(out, "  --%-15s (-%c)  %s\n",
 					cmds[active].options[i].name, cmds[active].options[i].op,
@@ -280,35 +343,51 @@ static void cleanup()
 	options->destroy(options);
 }
 
-/**
- * Dispatch commands.
+/*
+ * Described in header
  */
-int command_dispatch(int c, char *v[])
+int command_init(int c, char *v[])
 {
 	int op, i;
 
-	options = options_create();
-	atexit(cleanup);
-	active = help_idx = registered;
 	argc = c;
 	argv = v;
-	command_register((command_t){help, 'h', "help", "show usage information"});
+
+	options = options_create();
+	atexit(cleanup);
+
+	active = help_idx = registered;
+	command_register((command_t){help, 'h', "help", "show usage, version and "
+					 "plugin information"});
 
 	build_opts();
-	op = getopt_long(c, v, command_optstring, command_opts, NULL);
+	/* handle common options until we find a command */
+	if (!process_common_opts(TRUE))
+	{
+		return command_usage("invalid --options");
+	}
+	op = command_getopt(NULL);
 	for (i = 0; i < MAX_COMMANDS && cmds[i].cmd; i++)
 	{
 		if (cmds[i].op == op)
 		{
 			active = i;
 			build_opts();
-			if (!process_common_opts())
+			/* handle common options again, now with specific options loaded */
+			if (!process_common_opts(FALSE))
 			{
-				return command_usage("invalid options");
+				return command_usage("invalid --options");
 			}
-			optind = 2;
-			return cmds[i].call();
+			return 0;
 		}
 	}
-	return command_usage(c > 1 ? "invalid operation" : NULL);
+	return command_usage(op != EOF ? "invalid command" : NULL);
+}
+
+/*
+ * Described in header
+ */
+int command_dispatch()
+{
+	return cmds[active].call();
 }

src/pki/command.h

@@ -1,4 +1,5 @@
 /*
+ * Copyright (C) 2014-2026 Tobias Brunner
  * Copyright (C) 2009 Martin Willi
  *
  * Copyright (C) secunet Security Networks AG
@@ -23,14 +24,14 @@
 #define COMMAND_H_
 
 /**
- * Maximum number of commands (+1).
+ * Maximum number of commands (+2).
  */
-#define MAX_COMMANDS 19
+#define MAX_COMMANDS 21
 
 /**
- * Maximum number of options in a command (+3)
+ * Maximum number of options in a command (+2)
  */
-#define MAX_OPTIONS 36
+#define MAX_OPTIONS 35
 
 /**
  * Maximum number of usage summary lines (+1)
@@ -83,10 +84,15 @@ int command_getopt(char **arg);
  */
 void command_register(command_t command);
 
+/**
+ * Initialize command parsing/dispatching.
+ */
+int command_init(int argc, char *argv[]);
+
 /**
  * Dispatch commands.
  */
-int command_dispatch(int argc, char *argv[]);
+int command_dispatch();
 
 /**
  * Show usage information of active command.

src/pki/pki.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012-2023 Tobias Brunner
+ * Copyright (C) 2012-2026 Tobias Brunner
  * Copyright (C) 2009 Martin Willi
  *
  * Copyright (C) secunet Security Networks AG
@@ -485,6 +485,13 @@ static void remove_callback()
 int main(int argc, char *argv[])
 {
 	char *plugins;
+	int status;
+
+	status = command_init(argc, argv);
+	if (status)
+	{
+		return status;
+	}
 
 	atexit(library_deinit);
 	if (!library_init(NULL, "pki"))
@@ -509,5 +516,5 @@ int main(int argc, char *argv[])
 
 	add_callback();
 	atexit(remove_callback);
-	return command_dispatch(argc, argv);
+	return command_dispatch();
 }

src/swanctl/Makefile.am

@@ -38,7 +38,7 @@ AM_CPPFLAGS = \
 	-I$(top_srcdir)/src/libstrongswan \
 	-I$(top_srcdir)/src/libcharon/plugins/vici \
 	-DSWANCTLDIR=\""${swanctldir}\"" \
-	-DPLUGINS=\""${s_plugins}\""
+	-DPLUGINS=\""${swanctl_plugins}\""
 
 man_MANS = \
 	swanctl.8 \

src/swanctl/command.c

@@ -1,4 +1,5 @@
 /*
+ * Copyright (C) 2015-2026 Tobias Brunner
  * Copyright (C) 2009 Martin Willi
  *
  * Copyright (C) secunet Security Networks AG
@@ -70,12 +71,51 @@ static struct option command_opts[MAX_COMMANDS > MAX_OPTIONS ?
 static char command_optstring[(MAX_COMMANDS > MAX_OPTIONS ?
 								MAX_COMMANDS : MAX_OPTIONS) * 3];
 
+/**
+ * Common options
+ */
+static command_option_t shared_options[] = {
+	{
+		"debug", 'v', 1, "set debug level, default: 1"
+	},
+	{
+		"options", '+', 1, "read command line options from file"
+	},
+	{
+		"uri", 'u', 1, "service URI to connect to"
+	},
+};
+
+/**
+ * Add a single option to command_opts/command_optstr at the current locations.
+ */
+static void build_option(command_option_t *option, int i, int *pos)
+{
+	command_opts[i].name = option->name;
+	command_opts[i].has_arg = option->arg;
+	command_opts[i].val = option->op;
+
+	command_optstring[(*pos)++] = option->op;
+	switch (option->arg)
+	{
+		case optional_argument:
+			command_optstring[(*pos)++] = ':';
+			/* FALL */
+		case required_argument:
+			command_optstring[(*pos)++] = ':';
+			/* FALL */
+		case no_argument:
+		default:
+			break;
+	}
+}
+
 /**
  * Build command_opts/command_optstr for the active command
  */
 static void build_opts()
 {
-	int i, pos = 0;
+	int i, j, pos = 0;
 
 	memset(command_opts, 0, sizeof(command_opts));
 	memset(command_optstring, 0, sizeof(command_optstring));
@@ -87,27 +127,26 @@ static void build_opts()
 			command_opts[i].val = cmds[i].op;
 			command_optstring[i] = cmds[i].op;
 		}
+		/* add shared options not as actual option but as commands with
+		 * argument (which commands usually don't take) */
+		if (i > MAX_COMMANDS - countof(shared_options))
+		{
+			fprintf(stderr, "unable to add global shared options, please "
+					"increase MAX_COMMANDS\n");
+		}
+		else
+		{
+			for (j = 0, pos = i; j < countof(shared_options); j++, i++)
+			{
+				build_option(&shared_options[j], i, &pos);
+			}
+		}
 	}
 	else
 	{
 		for (i = 0; cmds[active].options[i].name; i++)
 		{
-			command_opts[i].name = cmds[active].options[i].name;
-			command_opts[i].has_arg = cmds[active].options[i].arg;
-			command_opts[i].val = cmds[active].options[i].op;
-			command_optstring[pos++] = cmds[active].options[i].op;
-			switch (cmds[active].options[i].arg)
-			{
-				case optional_argument:
-					command_optstring[pos++] = ':';
-					/* FALL */
-				case required_argument:
-					command_optstring[pos++] = ':';
-					/* FALL */
-				case no_argument:
-				default:
-					break;
-			}
+			build_option(&cmds[active].options[i], i, &pos);
 		}
 	}
 }
@@ -129,18 +168,65 @@ int command_getopt(char **arg)
 			case 'u':
 				continue;
 			default:
-				*arg = optarg;
+				if (arg)
+				{
+					*arg = optarg;
+				}
 				return op;
 		}
 	}
 }
 
+/**
+ * Pre-process options common for all commands
+ */
+static bool process_common_opts(bool init)
+{
+	int prevoptind = optind;
+	bool success = TRUE;
+
+	while (TRUE)
+	{
+		switch (getopt_long(argc, argv, command_optstring, command_opts, NULL))
+		{
+			case '+':
+				if (!options->from(options, optarg, &argc, &argv, optind))
+				{
+					success = FALSE;
+					break;
+				}
+				continue;
+			case 'v':
+				dbg_default_set_level(atoi(optarg));
+				continue;
+			case 'u':
+				uri = optarg;
+				continue;
+			default:
+				if (init)
+				{	/* stop if we found a known command during initialization,
+					 * otherwise we'd process e.g. --options twice */
+					break;
+				}
+				continue;
+			case '?':
+			case EOF:
+				break;
+		}
+		break;
+	}
+	/* restore option parser state after pre-processing */
+	optind = prevoptind;
+	opterr = 1;
+	return success;
+}
+
 /**
  * Register a command
  */
 void command_register(command_t command)
 {
-	int i;
+	int i, j;
 
 	if (registered == MAX_COMMANDS)
 	{
@@ -162,29 +248,24 @@ void command_register(command_t command)
 	/* append default options, but not to --help */
 	if (!active)
 	{
-		for (i = 0; i < countof(cmds[registered].options) - 1; i++)
+		for (i = 0; i < MAX_OPTIONS; i++)
 		{
 			if (!cmds[registered].options[i].name)
 			{
 				break;
 			}
 		}
-		if (i > countof(cmds[registered].options) - 3)
+		if (i > MAX_OPTIONS - countof(shared_options))
 		{
 			fprintf(stderr, "command '%s' registered too many options, please "
 					"increase MAX_OPTIONS\n", command.cmd);
 		}
 		else
 		{
-			cmds[registered].options[i++] = (command_option_t) {
-				"debug",	'v', 1, "set debug level, default: 1"
-			};
-			cmds[registered].options[i++] = (command_option_t) {
-				"options",	'+', 1, "read command line options from file"
-			};
-			cmds[registered].options[i++] = (command_option_t) {
-				"uri",		'u', 1, "service URI to connect to"
-			};
+			for (j = 0; j < countof(shared_options); j++)
+			{
+				cmds[registered].options[i++] = shared_options[j];
+			}
 		}
 		for (i = 0; cmds[registered].line[i]; i++)
 		{
@@ -216,14 +297,25 @@ int command_usage(char *error, ...)
 
 	if (active == help_idx)
 	{
-		fprintf(out, "\nloaded plugins: %s\nusage:\n"
-				"  swanctl command [options]\ncommands:\n",
-				lib->plugins->loaded_plugins(lib->plugins));
+		fprintf(out, "\n");
+		if (lib)
+		{
+			fprintf(out, "loaded plugins: %s\nusage:\n"
+					"  swanctl command [options]\ncommands:\n",
+					lib->plugins->loaded_plugins(lib->plugins));
+		}
 		for (i = 0; i < MAX_COMMANDS && cmds[i].cmd; i++)
 		{
 			fprintf(out, "  --%-16s (-%c)  %s\n",
 					cmds[i].cmd, cmds[i].op, cmds[i].description);
 		}
+		fprintf(out, "options:\n");
+		for (i = 0; i < countof(shared_options); i++)
+		{
+			fprintf(out, "  --%-16s (-%c)  %s\n",
+					shared_options[i].name, shared_options[i].op,
+					shared_options[i].desc);
+		}
 	}
 	else
 	{
@@ -242,7 +334,7 @@ int command_usage(char *error, ...)
 			}
 		}
 		fprintf(out, "options:\n");
-		for (i = 0; cmds[active].options[i].name; i++)
+		for (i = 0; i < MAX_OPTIONS && cmds[active].options[i].name; i++)
 		{
 			fprintf(out, "  --%-15s (-%c)  %s\n",
 					cmds[active].options[i].name, cmds[active].options[i].op,
@@ -268,37 +360,6 @@ static void cleanup()
 	options->destroy(options);
 }
 
-/**
- * Process options common for all commands
- */
-static bool process_common_opts()
-{
-	while (TRUE)
-	{
-		switch (getopt_long(argc, argv, command_optstring, command_opts, NULL))
-		{
-			case '+':
-				if (!options->from(options, optarg, &argc, &argv, optind))
-				{
-					return FALSE;
-				}
-				continue;
-			case 'v':
-				dbg_default_set_level(atoi(optarg));
-				continue;
-			case 'u':
-				uri = optarg;
-				continue;
-			default:
-				continue;
-			case '?':
-				return FALSE;
-			case EOF:
-				return TRUE;
-		}
-	}
-}
-
 /**
  * Open vici connection, call a command
  */
@@ -320,43 +381,65 @@ static int call_command(command_t *cmd)
 	return ret;
 }
 
-/**
- * Dispatch commands.
+/*
+ * Described in header
  */
-int command_dispatch(int c, char *v[])
+int command_init(int c, char *v[])
 {
 	int op, i;
 
-	uri = lib->settings->get_str(lib->settings, "%s.socket",
-			lib->settings->get_str(lib->settings, "%s.plugins.vici.socket",
-								   NULL, lib->ns), lib->ns);
+	argc = c;
+	argv = v;
 
 	options = options_create();
 	atexit(cleanup);
+
 	active = help_idx = registered;
-	argc = c;
-	argv = v;
-	command_register((command_t){NULL, 'h', "help", "show usage information"});
+	command_register((command_t){NULL, 'h', "help", "show usage, version and "
+					 "plugin information"});
 
 	build_opts();
-	op = getopt_long(c, v, command_optstring, command_opts, NULL);
+	/* handle common options until we find a command */
+	if (!process_common_opts(TRUE))
+	{
+		return command_usage("invalid --options");
+	}
+	op = command_getopt(NULL);
 	for (i = 0; i < MAX_COMMANDS && cmds[i].cmd; i++)
 	{
 		if (cmds[i].op == op)
 		{
 			active = i;
 			build_opts();
-			if (help_idx == i)
+			/* handle common options again, now with specific options loaded */
+			if (!process_common_opts(FALSE))
 			{
-				return command_usage(NULL);
+				return command_usage("invalid --options");
 			}
-			if (!process_common_opts())
-			{
-				return command_usage("invalid options");
-			}
-			optind = 2;
-			return call_command(&cmds[i]);
+			return 0;
 		}
 	}
-	return command_usage(c > 1 ? "invalid operation" : NULL);
+	return command_usage(op != EOF ? "invalid command" : NULL);
+}
+
+
+/*
+ * Described in header
+ */
+int command_dispatch()
+{
+	/* no callback registered for --help and we don't want to connect to the
+	 * socket anyway */
+	if (active == help_idx)
+	{
+		return command_usage(NULL);
+	}
+
+	if (!uri)
+	{
+		uri = lib->settings->get_str(lib->settings, "%s.socket",
+				lib->settings->get_str(lib->settings, "%s.plugins.vici.socket",
+									   NULL, lib->ns), lib->ns);
+	}
+	return call_command(&cmds[active]);
 }

src/swanctl/command.h

@@ -1,4 +1,5 @@
 /*
+ * Copyright (C) 2016-2026 Tobias Brunner
  * Copyright (C) 2009 Martin Willi
  *
  * Copyright (C) secunet Security Networks AG
@@ -26,9 +27,9 @@
 #include <library.h>
 
 /**
- * Maximum number of commands (+1).
+ * Maximum number of commands (+3).
  */
-#define MAX_COMMANDS 26
+#define MAX_COMMANDS 29
 
 /**
  * Maximum number of options in a command (+3)
@@ -96,10 +97,15 @@ int command_getopt(char **arg);
  */
 void command_register(command_t command);
 
+/**
+ * Initialize command parsing/dispatching.
+ */
+int command_init(int argc, char *argv[]);
+
 /**
  * Dispatch commands.
  */
-int command_dispatch(int argc, char *argv[]);
+int command_dispatch();
 
 /**
  * Show usage information of active command.

src/swanctl/swanctl.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2018 Tobias Brunner
+ * Copyright (C) 2018-2026 Tobias Brunner
  * Copyright (C) 2014 Martin Willi
  *
  * Copyright (C) secunet Security Networks AG
@@ -95,6 +95,14 @@ static void cleanup()
  */
 int main(int argc, char *argv[])
 {
+	level_t level;
+	int status;
+
+	status = command_init(argc, argv);
+	if (status)
+	{
+		return status;
+	}
 	atexit(cleanup);
 	if (!library_init(NULL, "swanctl"))
 	{
@@ -114,9 +122,14 @@ int main(int argc, char *argv[])
 
 	swanctl_dir = strdup(getenv("SWANCTL_DIR") ?: SWANCTLDIR);
 
-	dbg_default_set_level(0);
+	/* suppress log message when spawning threads by default */
+	level = dbg_default_get_level_group(DBG_JOB);
+	if (level == 1)
+	{
+		dbg_default_set_level_group(DBG_JOB, 0);
+	}
 	lib->processor->set_threads(lib->processor, 4);
-	dbg_default_set_level(1);
+	dbg_default_set_level_group(DBG_JOB, level);
 
-	return command_dispatch(argc, argv);
+	return command_dispatch();
 }

testing/tests/af-alg/alg-camellia/hosts/carol/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/af-alg/alg-camellia/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/af-alg/rw-cert/hosts/carol/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/af-alg/rw-cert/hosts/dave/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/af-alg/rw-cert/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/botan/net2net-ed25519/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = random pem botan x509 revocation constraints
+ swanctl {
+  load = random pem botan x509
 }
 
 charon-systemd {

testing/tests/botan/net2net-ed25519/hosts/sun/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = random pem pkcs1 openssl revocation constraints
+ swanctl {
+  load = random pem pkcs1 openssl
 }
 
 charon-systemd {

testing/tests/botan/net2net-pkcs12/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs7 pkcs8 pkcs12 botan x509 revocation constraints
+ swanctl {
+  load = pem pkcs7 pkcs8 pkcs12 botan x509
 }
 
 charon-systemd {

testing/tests/botan/net2net-pkcs12/hosts/sun/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs7 pkcs8 pkcs12 botan x509 revocation constraints
+ swanctl {
+  load = pem pkcs7 pkcs8 pkcs12 botan x509
 }
 
 charon-systemd {

testing/tests/botan/net2net-sha3-rsa-cert/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem x509 revocation constraints pubkey botan random
+ swanctl {
+  load = pem x509 pubkey botan random
 }
 
 charon-systemd {

testing/tests/botan/net2net-sha3-rsa-cert/hosts/sun/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem x509 revocation constraints pubkey botan random
+ swanctl {
+  load = pem x509 pubkey botan random
 }
 
 charon-systemd {

testing/tests/botan/rw-cert/hosts/carol/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = botan pem x509 revocation constraints pubkey
+ swanctl {
+  load = botan pem x509 pubkey
 }
 
 charon-systemd {

testing/tests/botan/rw-cert/hosts/dave/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 x509 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/botan/rw-cert/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem botan x509 revocation constraints pubkey
+ swanctl {
+  load = pem botan x509 pubkey
 }
 
 charon-systemd {

testing/tests/botan/rw-ecp256/hosts/carol/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = botan pem x509 revocation constraints pubkey
+ swanctl {
+  load = botan pem x509 pubkey
 }
 
 charon-systemd {

testing/tests/botan/rw-ecp256/hosts/dave/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 x509 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/botan/rw-ecp256/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem botan x509 revocation constraints pubkey
+ swanctl {
+  load = pem botan x509 pubkey
 }
 
 charon-systemd {

testing/tests/botan/rw-mlkem/hosts/carol/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = botan pem x509 revocation constraints pubkey
+ swanctl {
+  load = botan pem x509 pubkey
 }
 
 charon-systemd {

testing/tests/botan/rw-mlkem/hosts/dave/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 x509 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/botan/rw-mlkem/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem botan x509 revocation constraints pubkey
+ swanctl {
+  load = pem botan x509 pubkey
 }
 
 charon-systemd {

testing/tests/botan/rw-modp3072/hosts/carol/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = botan pem x509 revocation constraints pubkey
+ swanctl {
+  load = botan pem x509 pubkey
 }
 
 charon-systemd {

testing/tests/botan/rw-modp3072/hosts/dave/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/botan/rw-modp3072/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem botan x509 revocation constraints pubkey
+ swanctl {
+  load = pem botan x509 pubkey
 }
 
 charon-systemd {

testing/tests/gcrypt-ikev1/alg-serpent/hosts/carol/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 x509 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/gcrypt-ikev1/alg-serpent/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 x509 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/gcrypt-ikev1/alg-twofish/hosts/carol/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 x509 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/gcrypt-ikev1/alg-twofish/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 x509 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/gcrypt-ikev2/alg-camellia/hosts/carol/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 x509 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/gcrypt-ikev2/alg-camellia/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 x509 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/gcrypt-ikev2/rw-cert/hosts/carol/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 x509 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/gcrypt-ikev2/rw-cert/hosts/dave/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 x509 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/gcrypt-ikev2/rw-cert/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 x509 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ike/frags-ipv4/hosts/carol/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ike/frags-ipv4/hosts/dave/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ike/frags-ipv4/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ike/frags-ipv6/hosts/carol/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ike/frags-ipv6/hosts/dave/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ike/frags-ipv6/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1-multi-ca/certreq-init/hosts/carol/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 x509 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1-multi-ca/certreq-init/hosts/dave/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 x509 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1-multi-ca/certreq-init/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 x509 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1-multi-ca/certreq-resp/hosts/carol/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 x509 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1-multi-ca/certreq-resp/hosts/dave/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 x509 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1-multi-ca/certreq-resp/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 x509 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1-multi-ca/crls/hosts/carol/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 x509 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1-multi-ca/crls/hosts/dave/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 x509 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1-multi-ca/crls/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 x509 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/config-payload-push/hosts/carol/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/config-payload-push/hosts/dave/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/config-payload-push/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/config-payload/hosts/carol/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/config-payload/hosts/dave/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/config-payload/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/dynamic-initiator/hosts/carol/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/dynamic-initiator/hosts/dave/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/dynamic-initiator/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/dynamic-responder/hosts/carol/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/dynamic-responder/hosts/dave/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/dynamic-responder/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/host2host-ah/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/host2host-ah/hosts/sun/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/host2host-cert/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/host2host-cert/hosts/sun/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/host2host-transport/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/host2host-transport/hosts/sun/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/ip-pool-db/hosts/carol/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/ip-pool-db/hosts/dave/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/ip-pool-db/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/ip-pool/hosts/carol/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/ip-pool/hosts/dave/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/ip-pool/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/nat-virtual-ip/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/nat-virtual-ip/hosts/sun/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/net2net-ah/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/net2net-ah/hosts/sun/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/net2net-cert/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/net2net-cert/hosts/sun/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/net2net-esn/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/net2net-esn/hosts/sun/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/net2net-psk-fail/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/net2net-psk-fail/hosts/sun/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/net2net-psk/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/net2net-psk/hosts/sun/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/rw-cert-aggressive/hosts/carol/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/rw-cert-aggressive/hosts/dave/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/rw-cert-aggressive/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/rw-cert/hosts/carol/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/rw-cert/hosts/dave/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {

testing/tests/ikev1/rw-cert/hosts/moon/etc/strongswan.conf

@@ -1,7 +1,7 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-swanctl {
-  load = pem pkcs1 revocation constraints pubkey openssl random
+ swanctl {
+  load = pem pkcs1 pubkey openssl random
 }
 
 charon-systemd {