From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4d2vgH1z1Kz332Y for ; Fri, 07 Nov 2025 09:59:55 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "R12" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4d2vgC6Ntzz2yrL for ; Fri, 07 Nov 2025 09:59:51 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4d2vg92Ywsz14q; Fri, 07 Nov 2025 09:59:49 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1762509589; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=EhoSDy8FKytuG6p6erLQmqhaRBP8VaPTvWDkXYB+Pic=; b=vc50c/hnJXNC4BijF8hRKoHaphJaTLBpG1CcTQL4dsCm7x8XWFnXus7k9ZgeIE8eKlP/Dc CDyBfyhsmbccqeDA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1762509589; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=EhoSDy8FKytuG6p6erLQmqhaRBP8VaPTvWDkXYB+Pic=; b=ZXZmxMkiVHAG7tDDzIcYYeCpRwcgnLtOSbt0e6SZtTL+yRq3SAEgUB6USDikuyZXEQuAmk IHYs08jy1Jj+APKlAPpc7eMMkc1kfpFsYIbP6/c+l3BqFXjFso3bz38Po+BoGCDXbNAvte AsjYS4PE8rRW2dLQ52KZiPUeJcrb6rtJ5thxT2BFTnJ/S0Eu6C0biG2rWBV8W/TfgQqzPy gRlR3ddnF0g+gbAceOW5Z9btwTlZQgc6Iu6XGOWUGMzX3WnpWt/Y/O3zNFrpstZr9QqXJt 1/nezFhZZg9f50IeeVtOb/rkHTAa/dh5z8zR0hgfKkO6TRleNb6+QVoOJ/8X0A== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH 1/2] strongswan: Update to version 6.0.3 Date: Fri, 7 Nov 2025 10:59:43 +0100 Message-ID: <20251107095944.1089282-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit - Update from version 6.0.2 to 6.0.3 - Update of rootfile - Changelog 6.0.3 - Fixed a vulnerability in the eap-mschapv2 plugin related to processing Failure Request packets on the client that can lead to a heap-based buffer overflow and potentially remote code execution. This vulnerability has been registered as CVE-2025-62291. - The new `alert` event for vici is raised for certain error conditions. - Only plugins with matching version number are loaded by programs. - IKE SAs redirected during IKE_AUTH are now properly tracked by controller and trap-manager. - Fallback to the IKE identity for clients that don't provide an EAP-Identity to fix a regression in 6.0.2. - Detecting unwrapped CKA_EC_POINTs has been improved in the pkcs11 plugin. - The whitelist plugin uses non-blocking I/O to avoid issues with clients that stay connected for a long time. The buffer size for IDs was increased to 256. - The certexpire plugins also uses 256 bytes for its identity buffer. - Convenient decorators for event handling are provided by the Python bindings for vici. - The openssl plugin also supports Ed25519 via AWS-LC. It also loads EdDSA keys from PKCS#12 containers. - The testing environment is now based on Debian 13 (trixie), by default. Signed-off-by: Adolf Belka --- config/rootfiles/common/strongswan | 2 -- lfs/strongswan | 58 +++++++++++++++--------------- 2 files changed, 28 insertions(+), 32 deletions(-) diff --git a/config/rootfiles/common/strongswan b/config/rootfiles/common/strongswan index 48f4fdf43..2e1671b11 100644 --- a/config/rootfiles/common/strongswan +++ b/config/rootfiles/common/strongswan @@ -130,8 +130,6 @@ usr/lib/ipsec/plugins/libstrongswan-kdf.so usr/lib/ipsec/plugins/libstrongswan-kernel-netlink.so usr/lib/ipsec/plugins/libstrongswan-mgf1.so usr/lib/ipsec/plugins/libstrongswan-ml.so -usr/lib/ipsec/plugins/libstrongswan-ml.so.0 -usr/lib/ipsec/plugins/libstrongswan-ml.so.0.0.0 usr/lib/ipsec/plugins/libstrongswan-nonce.so usr/lib/ipsec/plugins/libstrongswan-openssl.so usr/lib/ipsec/plugins/libstrongswan-pem.so diff --git a/lfs/strongswan b/lfs/strongswan index 7075ab7ef..728e01636 100644 --- a/lfs/strongswan +++ b/lfs/strongswan @@ -24,7 +24,7 @@ include Config -VER = 6.0.2 +VER = 6.0.3 THISAPP = strongswan-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -43,7 +43,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 3cfc248831832a9b75da549fcaf490a4a0c33e2f680e04a02d04a035c05215ae0236f1fdcdb4a00b71b5a08d07626e8028959045aff1b77827c21fe7e1fb13ad +$(DL_FILE)_BLAKE2 = 355dff5de259e545b1bb5e24853dc91148c3d400b1977a2de35271e019dfc236c838ccac4552974a4999e2768900150c432753fc0d422444d4cc34486566e192 install : $(TARGET) @@ -75,36 +75,34 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/strongswan-disable-ipv6.patch cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/strongswan-ipfire.patch - $(UPDATE_AUTOMAKE) cd $(DIR_APP) && ./configure \ - --prefix="/usr" \ - --sysconfdir="/etc" \ - --enable-curl \ - --enable-dhcp \ - --enable-farp \ - --enable-openssl \ - --enable-gcrypt \ - --enable-ccm \ - --enable-ctr \ - --enable-gcm \ - --enable-xauth-eap \ - --enable-xauth-noauth \ - --enable-eap-radius \ - --enable-eap-tls \ - --enable-eap-ttls \ - --enable-eap-peap \ - --enable-eap-mschapv2 \ - --enable-eap-identity \ - --enable-chapoly \ - --enable-sha3 \ - --enable-stroke \ - --enable-fips-prf \ - --enable-mgf1 \ - --enable-hmac \ - --enable-ml \ - $(CONFIGURE_OPTIONS) - + --prefix="/usr" \ + --sysconfdir="/etc" \ + --enable-curl \ + --enable-dhcp \ + --enable-farp \ + --enable-openssl \ + --enable-gcrypt \ + --enable-ccm \ + --enable-ctr \ + --enable-gcm \ + --enable-xauth-eap \ + --enable-xauth-noauth \ + --enable-eap-radius \ + --enable-eap-tls \ + --enable-eap-ttls \ + --enable-eap-peap \ + --enable-eap-mschapv2 \ + --enable-eap-identity \ + --enable-chapoly \ + --enable-sha3 \ + --enable-stroke \ + --enable-fips-prf \ + --enable-mgf1 \ + --enable-hmac \ + --enable-ml \ + $(CONFIGURE_OPTIONS) cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install -- 2.51.2