[PATCH] cifs-utils: Update to version 7.7

[PATCH] cifs-utils: Update to version 7.7

[Adolf Belka]

- Update from version 7.4 to 7.7
- No change in rootfile
- Changelog
7.7
	cifs-utils: bump version to 7.7
	cifs.upcall: fix regression with krb5 + creduid
	cifs.upcall: Avoid int overflow after year 2038
	mount.cifs: fix const correctness in parse_options
	cifs.upcall: fix compiler warning with -Wvla
	smbinfo: parse action and filename from change notifications
7.6
	cifs-utils: bump version to 7.6
	cifs.upcall: remove getpwuid() dependency
	smbinfo: update notify subcommand
	smbinfo: add filecompressioninfo subcommand
	cifs.upcall: Adjust log level
	docs: Enable debug logs
	cifs.upcall: add option to enable debug logs
	cifs.upcall: Retry krb5 TGS request with uppercase service name
	mount.cifs: remove runtime pass_length calculation
	mount.cifs: adjust get_password_from_file() buf size
	build_assert: add ccan build_assert.h header
	mount.cifs: fix buffer overrun in set_password
	smbinfo: fix decimated subseconds in smbinfo filebasicinfo timestamp output
	smbinfo: add notify subcommand
	docs: update username= option to drop invalid examples
	cifs.upcall: fix calloc() argument order in main()
7.5
	No detailed release announcement made, only "Various fixes for utilities"

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 lfs/cifs-utils | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/lfs/cifs-utils b/lfs/cifs-utils
index 22330de9e..053ff928d 100644
--- a/lfs/cifs-utils
+++ b/lfs/cifs-utils
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2025  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2026  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -26,7 +26,7 @@ include Config
 
 SUMMARY    = Utilities for doing and managing mounts of the Linux CIFS filesystem
 
-VER        = 7.4
+VER        = 7.7
 
 THISAPP    = cifs-utils-$(VER)
 DL_FILE    = $(THISAPP).tar.bz2
@@ -34,7 +34,7 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = cifs-utils
-PAK_VER    = 8
+PAK_VER    = 9
 
 DEPS       = libtalloc
 
@@ -51,7 +51,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 57e03bb050b2345229dd4e0de22ac7baae7dcf080fba54c1dc339d8ecc6e60254e30feaa160568f8465698769ee513447c77de3bf8b0cd9c234ec4590e8e4270
+$(DL_FILE)_BLAKE2 = 4b0934778a803863cdca37375c9273c601494a6656d070ab5ad510616adbce92c68b0c952146257b839a19d15c42216d3c4f0f1b83942b9f0dd8e0d3d06916ea
 
 install : $(TARGET)
 
-- 
2.55.0

[PATCH] core205: Ship lmdb

[Adolf Belka]

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/rootfiles/core/205/filelists/lmdb | 1 +
 1 file changed, 1 insertion(+)
 create mode 120000 config/rootfiles/core/205/filelists/lmdb

diff --git a/config/rootfiles/core/205/filelists/lmdb b/config/rootfiles/core/205/filelists/lmdb
new file mode 120000
index 000000000..c25767da5
--- /dev/null
+++ b/config/rootfiles/core/205/filelists/lmdb
@@ -0,0 +1 @@
+../../../common/lmdb
\ No newline at end of file
-- 
2.55.0

[PATCH] core205: Ship strongswan

[Adolf Belka]

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/rootfiles/core/205/filelists/strongswan | 1 +
 1 file changed, 1 insertion(+)
 create mode 120000 config/rootfiles/core/205/filelists/strongswan

diff --git a/config/rootfiles/core/205/filelists/strongswan b/config/rootfiles/core/205/filelists/strongswan
new file mode 120000
index 000000000..90c727e26
--- /dev/null
+++ b/config/rootfiles/core/205/filelists/strongswan
@@ -0,0 +1 @@
+../../../common/strongswan
\ No newline at end of file
-- 
2.55.0

[PATCH] lmdb: Update to version 1.0.2

[Adolf Belka]

- Update from version 0.9.35 to 1.0.2
- Update of rootfile
- Changelog
1.0.2
	ITS#10569 - fix version in lmdb.pc
	ITS#10572 - more upgrade notes
	ITS#10575 - Windows WRITEMAP fix
1.0.1
	ITS#10529 - invalidate DBIs in rollback
	ITS#10534 - update mdb_env_get_maxkeysize() doc
	ITS#10536 - re-fix mdb_drop(MAIN_DBI)
	ITS#10538 - fix large writes on Windows
	ITS#10539 - Windows build fixes
	ITS#10540 - cleanup outdated license notices
	ITS#10542 - Windows buffered/writethru write behavior
	ITS#10551 - fix mdb_page_split nodesize calculation
	ITS#10553 - Another Windows build fix
1.0.0
	Many fixes/enhancements
0.9.36
	ITS#7772 - limit sub-page growth when re-adding existing data
	ITS#8335 - more input validation for put(MDB_MULTIPLE)
	ITS#8386 - be a bit more precise that mdb_get retrieves data in intro.doc
	ITS#8590 - suppress SIGPIPE on Mac OSX for mdb_copy/compact
	ITS#8739 - don't use fdatasync on FreeBSD 11.0 and older
	ITS#8824 - mdb_dump: cleanup check for MDB_SUCCESS
	ITS#9388 - fix mdb_stat page counts for dupsort DBs
	ITS#10054 - fix write of 2GB values
	ITS#10108 - mdb_dump: fix comment
	ITS#10454 - fix metapage sync on Mac OSX
	ITS#10504 - silence linker warning on Mac OSX
	ITS#10522 - reject 0-length values in DUPSORT DBs
	ITS#10538 - fix large writes on Windows

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/rootfiles/common/lmdb | 4 ++++
 lfs/lmdb                     | 4 ++--
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/config/rootfiles/common/lmdb b/config/rootfiles/common/lmdb
index a65849b9e..b250bb047 100644
--- a/config/rootfiles/common/lmdb
+++ b/config/rootfiles/common/lmdb
@@ -1,10 +1,14 @@
 #usr/bin/mdb_copy
+#usr/bin/mdb_drop
 #usr/bin/mdb_dump
 #usr/bin/mdb_load
 #usr/bin/mdb_stat
 #usr/include/lmdb.h
 usr/lib/liblmdb.so
+usr/lib/liblmdb.so.1
+usr/lib/liblmdb.so.1.0
 #usr/share/man/man1/mdb_copy.1
+#usr/share/man/man1/mdb_drop.1
 #usr/share/man/man1/mdb_dump.1
 #usr/share/man/man1/mdb_load.1
 #usr/share/man/man1/mdb_stat.1
diff --git a/lfs/lmdb b/lfs/lmdb
index 407ea7703..f7f00aac0 100644
--- a/lfs/lmdb
+++ b/lfs/lmdb
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 0.9.35
+VER        = 1.0.2
 
 THISAPP    = openldap-LMDB_$(VER)
 DL_FILE    = $(THISAPP).tar.bz2
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 2c0b8c732cf774ac373420f41c95cbded18a8a23215351944ba51ae61f265aa80ba08dcf376d8f9105b02a31c3f0ff78d1920a52f1daa8630df8e5a1ab1638dd
+$(DL_FILE)_BLAKE2 = a29847c099f238773799ceee1aab0fac62e5d129717408a81bd2d2d59fa360d64264092d9b0c54d7e3f39f43cad5bd05e2c841ca52d172cb60d577a6f6fd80b7
 
 install : $(TARGET)
 
-- 
2.55.0

[PATCH] rpcbind: Update to version 1.3.1

[Adolf Belka]

- Update from version 1.2.8 to 1.3.1
- No change in rootfile
- Changelog
1.3.1
    rpcbind: only free the forward slot if the reply xid matched the request xid
    rpcbind: check for null netmask in addrmerge()
    rpcbind: restrict RPCBPROC_GETSTAT to loopback callers
    rpcbind: fully disable remote calls when --enable-rmtcalls is unset
    rpcbind: bound stats lists in rpcbs_getaddr() and rpcbs_rmtcall()
    rpcbind: only log failures in check_callit() if connection logging is enabled
    rpcinfo: stack buffer overflow in rpcinfo rpcbdump()
    rpcbind: fix leak of nconf in main()
1.2.9
   rpcinfo: stack buffer overflow in rpcinfo rpcbaddrlist()
    rpcbind: Stop unauthenticated oversized allocation in PMAPPROC_CALLIT decode
    rpcbind: fix memory leaks in network_init()
    rpcbind: fix memory leak in init_transport()

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 lfs/rpcbind | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/lfs/rpcbind b/lfs/rpcbind
index 196089af6..ca4a7f0bb 100644
--- a/lfs/rpcbind
+++ b/lfs/rpcbind
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2025  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2026  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -26,7 +26,7 @@ include Config
 
 SUMMARY    = Transport independent RPC portmapper
 
-VER        = 1.2.8
+VER        = 1.3.1
 
 THISAPP    = rpcbind-$(VER)
 DL_FILE    = $(THISAPP).tar.bz2
@@ -34,7 +34,7 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = rpcbind
-PAK_VER    = 9
+PAK_VER    = 10
 
 DEPS       =
 
@@ -48,7 +48,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 70bef658aafc4b1b626a7e9ff312b34748e0142a0a93d058c28d6599545281464f27a5546abe287f0dd369e5264cb38940f85e5e6c128cb0e0f7aaa4b841ab77
+$(DL_FILE)_BLAKE2 = 8a7ea0ac9152c0daf3c05f17f9af0430b41ec6e6f74faed62553ab27803e165443efaac81e920ab633f1365f6400131c267e0e9ec66cccd56ad4069c2d870d99
 
 install : $(TARGET)
 
-- 
2.55.0

[PATCH] strongswan: Update to version 6.1.0

[Adolf Belka]

- Update from version 6.0.7 to 6.1.0
- Update of rootfile
- IKEv1 is now disabled by default. Therefore had to add --enable-ikev1 to the configure
   options.
- Somewhere in the next year their plan (although no definitive timeline yet) is to
   remove support from the IKEv1 protocol from the strongswan code.
- Having --enable-ikev1 set means that strongswan will log a message about its impending
   removal.
- Therefore with CU205 we will need to provide a warning to all IPSec users that if they
   are using IKEv1 they should plan and action a migration to IKEv2.
- A range of plugins and components have also been removed with this version, including
   gcrypt so gcrypt.conf and libstrongswan-gcrypt.so are no longer in the rootfile
- 10 CVE fixes in 6.1.0
- Changelog
6.1.0
Vulnerabilities
    CVE-2026-78123 - Fixed a vulnerability in the openssl plugin related to the
	processing of PKCS#7 containers that can result in a crash. Affects 5.0.2 and
	newer.
    CVE-2026-78124 - Fixed a vulnerability in the openssl plugin related to the
	enumeration of certificates in PKCS#7 containers that can result in memory
	leaks. Affects 5.0.2 and newer.
    CVE-2026-78126 - Fixed a vulnerability in the eap-aka plugin related to
	processing an unexpected AKA-Synchronization-Failure that can result in a
	crash. Affects 4.1.10 and newer.
    CVE-2026-78127 - Fixed a vulnerability in libcharon related to the logging of
	IKE messages that can result in a denial of service via memory exhaustion.
	Affects 4.1.2 and newer.
    CVE-2026-78129 - Fixed a vulnerability in libstrongswan related to the processing
	of encrypted PKCS#7 containers that can result in a denial of service.
	Affects 4.6.2 and newer.
    CVE-2026-78130 - Fixed a vulnerability in the x509 plugin related to the
	verification of X.509 attribute certificates that can lead to a denial of
	service. Affects 4.2.0 and newer.
    CVE-2026-78131 - Fixed a vulnerability in the x509 plugin related to the parsing
	of identities in X.509 attribute certificates that can lead to a denial of
	service via memory exhaustion. Affects 4.2.0 and newer.
    CVE-2026-78132 - Fixed a vulnerability in the x509 plugin related to the parsing
	of the ietfAttrSyntax ASN.1 type in X.509 attribute certificates that can
	lead to a denial of service. Affects 5.1.3 and newer.
    CVE-2026-78133 - Fixed a vulnerability in libcharon related to the handling of
	IKEv2 rekeying collisions that can result in a use-after-free and potentially
	remote code execution. Affects 6.0.0 and newer.
    CVE-2026-78134 - Fixed a vulnerability in the eap-peap and eap-ttls plugins
	related to the propagation of authentication details from inner EAP methods
	that can result in incorrect identity binding and potential authorization
	bypass. Affects 4.5.0 and newer.
    CVE-2026-78135 - Fixed a vulnerability in libcharon related to the handling of
	CREATE_CHILD_SA requests on unestablished IKE SAs that can result in the
	creation of a usable Child SA before authentication completes. Affects 5.9.7
	and newer.
Plugin and Configuration Changes
    IKEv1 is now disabled by default. Support for the protocol will be removed in a
     future release, likely within the next year (there is no definitive timeline yet).
        When building, IKEv1 has to be enabled explicitly via --enable-ikev1. A
	warning about its impending removal is logged.
        In the configuration, version now defaults to 2. If it is set to 0 or 1, a
	warning is logged when the configuration is loaded.
    Removed the following plugins and components: af-alg, android-dns, blowfish,
	charon-xpc, duplicheck, gcrypt, keychain, led, libfast, manager,
	medsrv/medcli, padlock, smp, soup, tnc-ifmap, tnccs-11, tnccs-dynamic. We
	recommend that they not be enabled when building older releases either.
    Removed the retry mechanism from the eap-mschapv2 plugin if the password is
	incorrect, because it could potentially get exploited for a DoS attack and
	its usefulness was questionable anyway (e53e2c7).
    CRLs that contain critical issuingDistributionPoint extensions are not silently
	accepted anymore as the plugins don't support it, which could lead to
	incorrect validation (2092fe6).
    The stroke plugin now reports the total number of SAs instead of the number of
	"up" SAs to avoid an integer underflow if there are more queued initial
	messages than SAs (2265fcd).
New Features
    Support for the XFRM_MSG_MIGRATE_STATE message in Linux 7.2 has been added. This
	allows migrating specific SAs to different IPs (and changing other
	properties), which enables updating SAs even when the kernel's lockdown
	feature is set to confidentiality (i.e. we don't get the keys back when we
	query an SA). The behavior for the latter when running on older kernels is
	also improved (715515c).
    charon-tkm now maps proposals to ia and ea identitifers (3b58c67).
Enhancements and Optimizations
    Simplified X.509 policy constraints handling in the constraints plugin and fixed
	some issues (62a4cde). The previous code was too strict in some respects
	(e.g. for inhibitPolicyMapping and inhibitAnyPolicy constraints) but also
	contained other flaws. In particular the handling of requireExplicitPolicy
	constraints. The latter now causes end entity certificates to get rejected if
	no valid policy is found (see the commit messages for details).
    Ensure nonces of unequal lengths are correctly compared if the shorter is the
	prefix of the longer when resolving rekey collisions (00830dd).
    Increased the receive buffer size for the ha plugin's sync socket and made it
	configurable (9d5e619).
    Changed the build of the aesni plugin so the plugin constructor is not compiled
	with flags that could cause the use of instructions that trigger SIGILL on
	unsupported platforms (24c70db).
    Implemented the block multiplication in the gcm plugin in constant time (87bbfe4).
    Implemented the padding and MAC checks in libtls in constant time (dafb082).
    TLS signature schemes are now filtered by config and rejected if not defined for
	the negotiated TLS version (5e89dd5).
    Use Absorb/SqueezeBlocks API for SHAKE-128/256 XOFs in the wolfssl plugin (3ec8d3c).
    The wolfssl plugin now validates X25519/X448 public keys (05625ac) and properly
	handles RNGs during RSA/ECDSA operations to avoid state corruption (d9cf1b0).
    The curve25519 plugin now explicitly rejects all-zero shared secrets (589a3a6).
	Tests were added to ensure plugins enforce this (9598de4, note that wolfSSL
	before 5.9.2 requires a compile option). The derived shared secret is now
	also explicitly wiped when the object is destroyed (14a811b).
    All ML-KEM implementations now ensure no empty shared secrets are returned (889d83b).
    Avoid truncating identities that contain \0 characters when creating them from
	data blobs (7e7c280).
    Explicitly compute PCR value independently during verification and reject
	mismatches (a885a3d).
    Avoid potential TOCTOU issues when opening log files and changing owner; log
	files are not world-readable anymore (ea7a721).
    Avoid potential TOCTOU issues when accessing/writing PID file in charon and
	charon-tkm (18a1046, d19591e).
    Replaced calls to deprecated functions in the ldap plugin and added support for
	LDAPS (e37aac7).
    Ensure resource records parsed in the unbound plugin match the queried or
	canonical name (e64877b).
    Bind IKE sockets exclusively in the socket-win plugin (47a583d).
    Log warning if UID changes and no capability backend is compiled in (8efb533).
    Allow SA deletion in either order in the kernel-wfp plugin (485f764).
    Added a limit for concurrently cached DAE responses in the eap-radius plugin
	(6419fc8).
    Ensure only secrets that match the username are used in the xauth-generic plugin
	(dd6a984).
Fixes
    Fixed that IKE SAs don't fail if the initial Child SA's installation fails, which
	was broken since 6.0.0 (6894b33).
    Fixed crash if responder doesn't send TS payloads, which was broken since 6.0.0
	(65a30f7).
    Fixed that initiators fail if no KE payload is received in IKE_INTERMEDIATE
	response (c40e821).
    Fixed enforcing the ppk_required constraint on the initiator (50177b4).
    Fixed not resetting state of Child SA if passive rekeying fails while
	concurrently rekeying it actively (4611f41).
    Fixed notifying threads waiting on controller_t::initiate() after
	INVALID_KE_PAYLOAD retry failed (cef4bce).
    Fixed race conditions when inserting CRLs/OCSP responses into the certificate
	cache (87f0bc2).
    Fixed potential race condition when accepting sockets in stream_service_t (b52fc6c).
    Fixed potential race condition in token hot-plug handling of the pkcs11 plugin
	(f4798de).
    Fixed potential race condition between install and uninstall in the shunt
	manager (6dca323).
    Fixed that a skipped CRL lookup/fetch in the revocation plugin prevents fetching
	delta CRLs (45b2f8d).
    Fixed transaction handling for multiple concurrent threads in the sqlite plugin
	(9290658)
    Fixed a potential bypass of EAP-TNC after authenticating a client via certificate
	in EAP-PEAP (8323fba).
    Fixed compatibility of the wolfssl plugin's ML-KEM implementation with newer
	wolfSSL versions (98b133c).
    Fixed implementation of ByteDecode with d=12 in the ml plugin to be more strict
	when parsing public keys (4f3e572).
    Fixed the validity calculation in the pgp plugin and avoid potential overflows on
	32-bit systems (b3c0019).
    Fixed memory leaks in many AEAD implementations when ICV verification fails if
	not using in-place decryption (libipsec uses it that way, but not IKEv2).
	ESP packet handling in libipsec is fixed separately (dae65dd). The affected
	plugins are aesni (a2f83d3), botan (40aa0a1), ccm (85c02dc), chapoly
	(c6adb20), openssl (023c626), and wolfssl (1fe813f).
    Fixed potential memory leaks in hasher implementations that could potentially
	fail (a4a123e).
    Fixed the addresses when removing firewall rules during ike_update in the
	connmark plugin (b031cd2). Also only install one rule per Child SA in
	PREROUTING (not one per policy, 77cfa83).
    Fixed return value in pt-tls-server when handling a PB-TNC batch fails (dbaca2d),
	also fixed a memory leak if SASL authentication fails (0a9445a).
    Fixed keeping the watcher callbacks registered in the tnc-pdp plugin when
	processing a request fails (dc8fa5f). Also fixed the lock type when
	adding/replacing a connection (5e51fc7).
    Fixed timeout handling in the RADIUS socket abstraction (6dfebce).
    Fixed a potential NULL-pointer dereference in the XAuth backend of the eap-radius
	plugin (db3f4c2).
    Fixed potential issues when accessing IKE_SA when sending interim accounting
	updates in the eap-radius plugin (2ed81ed).
    Fixed the generation of SQN in the eap-aka-3gpp and eap-aka-3gpp2 plugins
	(371c356, cfc72fe). Also increased log levels for potentially sensitive data
	in these plugins (d3d7a27, 7a215e5).
    Fixed memory leaks when processing invalid TLS certificate or Finished messages
	on the server (be0ee2e) or when processing of TLS 1.3 Finished messages fails
	on the client (4feb31d).
    Fixed a memory leak in the x509 plugin if an OCSP response contains multiple
	nonce extensions (7bf9b6b).
    Fixed a memory leak in the Android app's DNS proxy (67bf005).
    Fixed reading the last path character in the process_t abstraction on Windows
	(097c7a1).
    Fixed a leak when replacing an exclude route in the kernel-pfkey and
	kernel-libipsec plugins (e36a8c0, 7a316d9).
    Fixed a memory leak in the pkcs11 plugin's hasher_t implementation (4d843d3).
    Fixed a memory leak in the ha plugin if Child SA key derivation fails (98fd5e9).
    Fixed memory leaks in the vici plugin if loading CA cert in authority section
	fails (e03ec46), as well as when selectors for redirect command are missing
	or invalid (268c11f).
    Fixed memory leak due to repeated challenges in the eap-md5 plugin (918e052).
    Fixed memory leaks in the eap-ttls plugin if eap-identity plugin is not loaded
	(94e97eb).
    Fixed releasing context if determining list of readers fails in eap-sim-pcsc
	plugin fails (322d947).
    Fixed removing addresses from hashtable if an interface goes down in the
	kernel-pfroute plugin (8b1f8e0).
    Fixed cleanup of pending entry if virtual IP address installation fails in
	kernel-netlink plugin (c52fd0c).
    Fixed the check for peer ID payloads in ME_CONNECT requests in the mediation task
	(9965a64).
    Fixed potential crash by ignoring mediation extension connectivity checks on
	incomplete checklists (d8c7fe0), as well as another when processing endpoints
	with invalid NO_FAMILY (2c65dac).
    Fixed potential use-after-free when checking online status of a mediation peer
	(207ae20).
    Fixed ECDH key derivation in the pkcs11 plugin (2eeb896).
    Fixed skipping IPv6 fragment headers in libipsec (c3b99c6).
    Fixed mismatch between hash buffer size and largest possible hash when creating a
	PTS file measurement (c720ae2).
    Fixed potential buffer overflow when adding reference PTS file measurements
	(4be1883), and consistently use hex encoding in the database (ca4db3c).
    Fixed potential crash when resolving symlinks in PTS file measurements (2dfc1ac).
    Fixed arguments when logging an IKEv1 UNITY_LOAD_BALANCE attribute with invalid
	address (d5e7426).
    Fixed wiping cached PINs when clearing credentials in the vici plugin (7a1c801).
    Fixed wiping derived key for EAP and PSK authentication (4e7ade0).
    Fixed potential command injection in sec-updater (8ae96ed).
    Fixed a potential use-after-free in charon-tkm's chunk map (71fff07).
    Fixed reading split-tunneling block settings in managed configs (2367cda).
    Fixed handling of encrypted PEM files without DEK-Info in the pem plugin
	(40f4097), also fixed potential integer overflow when verifying padding after
	decryption (52b689c).
    Fixed double-frees and memory leaks in error cases in charon-nm (ad7d50f).
    Fixed potential overflow in in-memory pools and enforce the size limit also for
	range-based pools (e3607d5).
    Fixed offset checks in ha address pool (c52fd0c).
    Fixed applying the second padding bit on big-endian platforms in the sha3 plugin
	(1b9b037).
    Fixed potential use-after-free when joining threads on Windows (f00b85d), and
	avoid potential races when canceling them (5011838).
    Fixed potential issues when multiple clients list certificates via stroke plugin
	(b6ff363).
    Fixed potential issues when printing very long strings with the built-in printf
	hooks (f95c6a2).
    Avoid modifying DHCP transactions after receiving unexpected offers in the dhcp
	plugin (289d776).
    Release pre-allocated SPIs in libipsec if the Child SA creation fails (2cea904).
    libtls now correctly rejects unencrypted TLS 1.3 records (bff18d9).
    The coupling plugin now creates individual hasher instances to avoid accessing a
	shared instance by multiple threads concurrently (4436c12).
    Prevent corrupting hashtables in the eap-simaka-pseudonym and eap-simaka-reauth
	plugins (0b5143a, 4bef380).
    Avoid potential buffer overflow when generating EAP-AKA messages and correct
	handling of AT_PADDING and AT_NOTIFICATION (cd24806).
    Avoid a race condition in the xauth-pam plugin during concurrent authentication
	attempts (eec3164), fixed the initialization of the response array when
	handling sessions (be4b9f4).
    Reject EAP Start messages from clients in TLS-based EAP methods (fd7fcca). Also,
	only process ACKs on the server after processing at least one actual packet
	(09d48b7).
    Correctly forward remote ports from acquires triggered via the kernel-wfp plugin
	(3a30390). Also remove policies before deleting the provider (6b58665).
    Properly handle conflict during concurrent FD removal in watcher_t (313d1ef)
    Avoid unnecessarily locking the global thread lock on Windows (4110d27).
    Avoid overflows when converting OIDs with large sub-identifiers to strings
	(502fa14, a5d815a, 75baeb9).
    Avoid undefined shifts if the selector is /0 in the forecast and connmark
	plugins (117cf65, c485080).
    Avoid logging passwords when parsing URIs fails in the mysql plugin (11999f1).
    Avoid issues when re-inserting an existing element into a value-based array
	(588c7a8).
    Properly unregister validator in the systime-fix plugin when the time gets valid
	to avoid accepting expired certificates again should the time get rolled back
	for some reason(dd94e8d).
    Partially reverted d7608ca in charon-nm as it didn't really improve the security
	(e6dc515).
For Developers
    The CRED_HOOK_POLICY_VIOLATION hook now receives the subject certificate instead
	of the issuer certificate as it's that certificate's missing/invalid policies
	that trigger it.
    host_create_from_subnet() does proper validation of the subnet mask value and
	returns NULL if it's invalid or e.g. data follows the string (4ebd1c5).
    Improved the the constant time comparison of chunks of unequal length via
	chunk_equals_const(). Note that the function now expects the
	expected/reference value as first argument and the input as second, its
	runtime is strictly bound by the first argument's length. See the commit
	message for details (459fcab)
    key_exchange_verify_pubkey() has been renamed to key_exchange_check_pubkey_len()
	in order to clarify what the function actually does (80f8f5e).
    asn1_oid_to_string() returns NULL when conversion of an OID fails due to a large
	sub-identifiers.
    Sockets wrapped by stream_service_create_from_fd() are now explicitly set to
	non-blocking mode while those accepted by the service later are explicitly
	set to blocking mode to match what stream_t expects on all platforms (b52fc6c).
    The atomic ref_cur() now uses ACQUIRE memory ordering to sync with a concurrent
	ref_put() (bcef2c8). Added atomic helpers to store/load bools (3934089).
    Primitives for constant-time comparison of uint64_t values have been added to the
	utils.
    Improved the ability to cancel a test run (3ef0918).
    The link to the test results is now formatted as hyperlink via OSC 8 (fa56cca).

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/rootfiles/common/strongswan | 3 ---
 lfs/strongswan                     | 5 +++--
 2 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/config/rootfiles/common/strongswan b/config/rootfiles/common/strongswan
index 2e1671b11..c83b7d61c 100644
--- a/config/rootfiles/common/strongswan
+++ b/config/rootfiles/common/strongswan
@@ -34,7 +34,6 @@ etc/strongswan.d/charon/eap-ttls.conf
 etc/strongswan.d/charon/farp.conf
 etc/strongswan.d/charon/fips-prf.conf
 etc/strongswan.d/charon/gcm.conf
-etc/strongswan.d/charon/gcrypt.conf
 etc/strongswan.d/charon/hmac.conf
 etc/strongswan.d/charon/kdf.conf
 etc/strongswan.d/charon/kernel-netlink.conf
@@ -124,7 +123,6 @@ usr/lib/ipsec/plugins/libstrongswan-eap-ttls.so
 usr/lib/ipsec/plugins/libstrongswan-farp.so
 usr/lib/ipsec/plugins/libstrongswan-fips-prf.so
 usr/lib/ipsec/plugins/libstrongswan-gcm.so
-usr/lib/ipsec/plugins/libstrongswan-gcrypt.so
 usr/lib/ipsec/plugins/libstrongswan-hmac.so
 usr/lib/ipsec/plugins/libstrongswan-kdf.so
 usr/lib/ipsec/plugins/libstrongswan-kernel-netlink.so
@@ -208,7 +206,6 @@ usr/sbin/swanctl
 #usr/share/strongswan/templates/config/plugins/farp.conf
 #usr/share/strongswan/templates/config/plugins/fips-prf.conf
 #usr/share/strongswan/templates/config/plugins/gcm.conf
-#usr/share/strongswan/templates/config/plugins/gcrypt.conf
 #usr/share/strongswan/templates/config/plugins/hmac.conf
 #usr/share/strongswan/templates/config/plugins/kdf.conf
 #usr/share/strongswan/templates/config/plugins/kernel-netlink.conf
diff --git a/lfs/strongswan b/lfs/strongswan
index 9b3d71cbd..b711ee817 100644
--- a/lfs/strongswan
+++ b/lfs/strongswan
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 6.0.7
+VER        = 6.1.0
 
 THISAPP    = strongswan-$(VER)
 DL_FILE    = $(THISAPP).tar.bz2
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 503973ad437545ebae12297fefea80a6e0e3d9db8781cadc1dc37bfe8dcd8895c4442bf4a3b6f84051ae14ee1024471c4b3d5a5ac99036122d08413ddf3923c8
+$(DL_FILE)_BLAKE2 = c4466095f79a23d7ae98235fca2271d3599afbb047c327c0787b016da1e9b2677a3f80462ed2c1258193947ac3b5a3f05d6b2e9a5256205aeaf827f47df0fa40
 
 install : $(TARGET)
 
@@ -99,6 +99,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 				--enable-mgf1 \
 				--enable-hmac \
 				--enable-ml \
+				--enable-ikev1 \
 				$(CONFIGURE_OPTIONS)
 	cd $(DIR_APP) && make $(MAKETUNING)
 	cd $(DIR_APP) && make install
-- 
2.55.0