Query & Status Commands

VICI commands for querying daemon status, algorithms, pools, certificates, and counters.

These commands query the current state of the charon daemon without modifying any configuration or SAs.

version

Return daemon and system version information.

Input

No input parameters.

Response

daemon · string

IKE daemon name (e.g., charon).

version · string

strongSwan version string.

sysname · string

Operating system name (e.g., Linux).

release · string

Operating system release string.

machine · string

Hardware identifier (e.g., x86_64).

Python example

ver = v.version()
print("{daemon} {version} ({sysname}, {release}, {machine})".format(**{
    k.decode(): v.decode() for k, v in ver.items()
}))

---

stats

Return IKE daemon statistics and load information.

Input

No input parameters.

Response

uptime · section

Show fields

running · string

Relative uptime in human-readable form (e.g., 5 minutes).

since · string

Absolute startup time.

workers · section

Show fields

total · string

Total number of worker threads.

idle · string

Number of worker threads currently idle.

active · section

Active thread counts broken down by job priority: critical, high, medium, low.

queues · section

Job queue depths by priority: critical, high, medium, low.

scheduled · string

Number of jobs scheduled for future timed execution.

ikesas · section

Show fields

total · string

Total number of active IKE_SAs.

half-open · string

Number of IKE_SAs in a half-open state.

plugins · list

Names of all loaded plugins.

mem · section

Available when built with leak-detective support or on Windows. Contains total (bytes) and allocs (block count) fields.

mallinfo · section

Available on systems with mallinfo() support. Contains sbrk, mmap, used, and free fields.

---

reload-settings

Reload strongswan.conf settings and reinitialize all plugins that support configuration reload.

Input

No input parameters.

Response

success · string

yes on success, no on failure.

errmsg · string

Human-readable error description on failure.

---

list-certs

Stream currently loaded certificates as list-cert events. Includes all certificates known to the daemon, not only those loaded over VICI.

This is a streaming command. Register for the list-cert event before issuing this command.

Input

type · string

Filter by certificate type. One of: X509, X509_AC, X509_CRL, OCSP_RESPONSE, PUBKEY, or ANY.

flag · string

Filter by X.509 certificate flag. One of: NONE, CA, AA, OCSP, or ANY.

subject · string

Only list certificates that contain this subject.

Response

An empty message ({}). All certificate data arrives via list-cert events.

---

list-authorities

Stream currently loaded CA information as list-authority events.

This is a streaming command. Register for the list-authority event before issuing this command.

Input

name · string

Only list the CA authority with this name.

Response

An empty message ({}). All authority data arrives via list-authority events.

---

get-authorities

Return a list of currently loaded CA authority names.

Input

No input parameters.

Response

authorities · list

List of certification authority names.

---

load-pool

Load an in-memory virtual IP and configuration attribute pool. Existing pools with the same name are updated in place if possible.

Input

<pool name> · section · required

A section named after the pool.

Show fields

addrs · string · required

Subnet of virtual IP addresses in CIDR notation (e.g., 10.10.0.0/24).

<attribute type> · list

Optional configuration attribute lists. Attribute types include: address, dns, nbns, dhcp, netmask, server, subnet, split_include, split_exclude, or a numeric attribute type identifier.

Response

success · string

yes on success, no on failure.

errmsg · string

Human-readable error description on failure.

---

unload-pool

Unload a virtual IP pool. Unloading fails if the pool has any leases currently online.

Input

name · string · required

Name of the virtual IP pool to delete.

Response

success · string

yes on success, no on failure.

errmsg · string

Human-readable error description on failure.

---

get-pools

List currently loaded virtual IP pools, optionally including lease information.

Input

leases · string

Set to yes to include lease details in the response.

name · string

Name of a specific pool to query. Omit to list all pools.

Response

<pool name> · section

One section per pool.

Show fields

base · string

Pool base address.

size · string

Total number of addresses in the pool.

online · string

Number of leases currently online.

offline · string

Number of leases currently offline.

leases · section

Present when leases=yes. Contains zero-based indexed subsections, each with address, identity, and status (online|offline) fields.

---

get-algorithms

List all loaded cryptographic algorithms and the plugin that provides each implementation.

Input

No input parameters.

Response

<algorithm type> · section

One section per algorithm category (e.g., encryption, integrity, dh). Each section maps algorithm names to the providing plugin name.

---

get-counters

Retrieve IKE event counters, either globally or per connection.

Input

name · string

Connection name for per-connection counters. Omit to get global counters.

all · string

Set to yes to retrieve counters for all connections. The name field is ignored when this is set.

Response

counters · section

Contains one subsection per connection name (or an empty-named section for global counters). Each subsection maps counter names to 64-bit integer values encoded as strings.

success · string

yes on success, no on failure.

errmsg · string

Human-readable error description on failure.

---

reset-counters

Reset IKE event counters, either globally or per connection.

Input

name · string

Connection name to reset counters for. Omit to reset global counters.

all · string

Set to yes to reset counters for all connections.

Response

success · string

yes on success, no on failure.

errmsg · string

Human-readable error description on failure.