vici: Make IKEv2 the default IKE version

We don't want to accept IKEv1 clients anymore by default, so we also
warn them about it in the log.

src/libcharon/plugins/vici/vici_config.c

@@ -2804,7 +2804,7 @@ CALLBACK(config_sn, bool,
 		.send_certreq = TRUE,
 		.send_cert = CERT_SEND_IF_ASKED,
 		.ocsp = OCSP_SEND_REPLY,
-		.version = IKE_ANY,
+		.version = IKEV2,
 		.remote_port = IKEV2_UDP_PORT,
 		.fragmentation = FRAGMENTATION_YES,
 		.unique = UNIQUE_NO,
@@ -2936,6 +2936,14 @@ CALLBACK(config_sn, bool,
 
 	log_peer_data(&peer);
 
+#ifdef USE_IKEV1
+	if (peer.version != IKEV2)
+	{
+		DBG0(DBG_CFG, "WARNING: IKEv1 support is deprecated and will be "
+			 "removed soon, configure 'version = 2' in order to use IKEv2");
+	}
+#endif
+
 	ike = (ike_cfg_create_t){
 		.version = peer.version,
 		.local = peer.local_addrs,

src/swanctl/swanctl.opt

@@ -11,11 +11,11 @@ connections { # }
 connections.<conn> { # }
 	Section for an IKE connection named <conn>.
 
-connections.<conn>.version = 0
+connections.<conn>.version = 2
 	IKE major version to use for connection.
 
 	IKE major version to use for connection. _1_ uses IKEv1 aka ISAKMP, _2_
-	uses IKEv2. A connection using the default of _0_ accepts both IKEv1
+	uses IKEv2 (the default). A connection using _0_ accepts both IKEv1
 	and IKEv2 as responder, and initiates the connection actively with IKEv2.
 
 connections.<conn>.local_addrs = %any

testing/tests/ike/frags-ipv4/hosts/moon/etc/swanctl/swanctl.conf

@@ -13,12 +13,13 @@ connections {
       }
       children {
          net {
-            local_ts  = 10.1.0.0/16 
+            local_ts  = 10.1.0.0/16
 
             updown = /usr/local/libexec/ipsec/_updown iptables
             esp_proposals = aes128-sha256-ecp256
          }
       }
+      version = 0
       mobike = no
       fragmentation = yes
       proposals = aes128-sha256-ecp256

testing/tests/ike/frags-ipv6/hosts/moon/etc/swanctl/swanctl.conf

@@ -1,7 +1,7 @@
 connections {
 
    rw {
-      local_addrs = fec0::1 
+      local_addrs = fec0::1
 
       local {
          auth = pubkey
@@ -13,12 +13,13 @@ connections {
       }
       children {
          net {
-            local_ts = fec1::/16 
+            local_ts = fec1::/16
 
             updown = /usr/local/libexec/ipsec/_updown iptables
             esp_proposals = aes128-sha256-ecp256
          }
       }
+      version = 0
       mobike = no
       fragmentation = yes
       proposals = aes128-sha256-ecp256