From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4dVsw72csfz2xnx for ; Tue, 16 Dec 2025 10:04:07 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "R12" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4dVsw71gXDz2xMw for ; Tue, 16 Dec 2025 10:04:07 +0000 (UTC) Received: from people01.haj.ipfire.org (people01.haj.ipfire.org [IPv6:2001:678:b28::161]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature ECDSA (secp384r1) client-digest SHA384) (Client CN "people01.haj.ipfire.org", Issuer "E8" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4dVsw41SktzPZ for ; Tue, 16 Dec 2025 10:04:04 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1765879444; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=C0jjUQAFlqYMYfvKaVi6QAT/pHL43z3WRFSGtOmTlmc=; b=+cmMbiBCZjUN1LIfBn5h2wP/rE5amBvnoHpiUlL+KoaYvuN2Y0UWmTTR1i10C+lfHbJD1s qAQe5672J5K6OtDQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1765879444; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=C0jjUQAFlqYMYfvKaVi6QAT/pHL43z3WRFSGtOmTlmc=; b=axh0kuNSWrTIif+RoRr1lYqbBr8CCH8CGRn0bn05++I8nWCsmt4IAWWvY74Ep/R5C0CCI+ 7f71qpSETmSP4Dco63katcpFou8BbMLoJ/Hr7peaMHD8F6n9RMcD+YaKkqiDxLiKldhu5B 9iL/h4pOyhGtGVvPA55k4+PtpibU7QgRrJHlqxNtU2oqYR5rol+kJiTC5h6auuGICHgA9d yDoqloIZM+4FDGxkfOx1R8oI8n2qathsVEYPVJDE0WD/iH7yh6Ga6/QXl/Ab69T8NTziif uGMaQPnhjBRa+Olo2wbCDT7sp6l75gK0Bia+EPq2Cq1sxgOESr4lBg0estdeDA== Received: by people01.haj.ipfire.org (Postfix, from userid 1000) id 4dVsw22zsdz2y35; Tue, 16 Dec 2025 10:04:02 +0000 (UTC) To: ipfire-scm@lists.ipfire.org Subject: [git.ipfire.org] IPFire 2.x development tree branch, next, updated. 745db366f92f55e0968cfbc12e25153a01078035 X-Git-Refname: refs/heads/next X-Git-Reftype: branch X-Git-Oldrev: ccc95f5e34c31df6dcd3e68484ef9b9c6af3c38d X-Git-Newrev: 745db366f92f55e0968cfbc12e25153a01078035 Message-Id: <4dVsw22zsdz2y35@people01.haj.ipfire.org> Date: Tue, 16 Dec 2025 10:04:02 +0000 (UTC) From: Michael Tremer Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 745db366f92f55e0968cfbc12e25153a01078035 (commit) via 8fc45892adac49f478803037d7235f36d627751e (commit) via 3484ca7289adf920ba4beb16e08c92bf7545ec55 (commit) from ccc95f5e34c31df6dcd3e68484ef9b9c6af3c38d (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 745db366f92f55e0968cfbc12e25153a01078035 Author: Michael Tremer Date: Tue Dec 16 10:03:47 2025 +0000 core200: Restart IPsec during the update Signed-off-by: Michael Tremer commit 8fc45892adac49f478803037d7235f36d627751e Author: Adolf Belka Date: Mon Dec 15 22:46:49 2025 +0100 core200: Ship Strongswan Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer commit 3484ca7289adf920ba4beb16e08c92bf7545ec55 Author: Adolf Belka Date: Mon Dec 15 22:46:50 2025 +0100 strongswan: Update to version 6.0.4 - Update from version 6.0.3 to 6.0.4 - No change to the rootfile - Changelog 6.0.4 Vulnerabilities Fixed a vulnerability in the NetworkManager plugin that potentially allows using credentials of other local users. This vulnerability has been registered as CVE-2025-9615. Please refer to our blog for details. Enhancements and Optimizations Concurrent requests to fetch the same CRL URI by multiple threads are now combined by the revocation plugin (#2918). Only the first thread actually fetches it, the others wait for that result. This is particularly helpful if the CRL can currently not be fetched due to DNS or HTTP/LDAP timeouts as it avoids that each thread has to wait individually, reducing the number of SAs that can concurrently be established as threads are blocked longer. A negative result is cached for a while (currently 30 seconds) so requests can fail quickly and threads can continue establishing SAs if they use a relaxed revocation policy. The maximum supported length for section names in swanctl.conf has been increased to the upper limit of 256 characters that's enforced by VICI (#2936). Fixes Prevent a crash if a confused peer rekeys a Child SA twice before sending a delete (#2945). Fixed a memory leak if a peer's self-signed certificate is untrusted (#2954). Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer ----------------------------------------------------------------------- Summary of changes: config/rootfiles/{oldcore/106 => core/200}/filelists/strongswan | 0 config/rootfiles/core/200/update.sh | 1 + lfs/strongswan | 4 ++-- 3 files changed, 3 insertions(+), 2 deletions(-) copy config/rootfiles/{oldcore/106 => core/200}/filelists/strongswan (100%) Difference in files: diff --git a/config/rootfiles/core/200/filelists/strongswan b/config/rootfiles/core/200/filelists/strongswan new file mode 120000 index 000000000..90c727e26 --- /dev/null +++ b/config/rootfiles/core/200/filelists/strongswan @@ -0,0 +1 @@ +../../../common/strongswan \ No newline at end of file diff --git a/config/rootfiles/core/200/update.sh b/config/rootfiles/core/200/update.sh index 3005baa43..b2b078811 100644 --- a/config/rootfiles/core/200/update.sh +++ b/config/rootfiles/core/200/update.sh @@ -76,6 +76,7 @@ sudo -u nobody /srv/web/ipfire/cgi-bin/ovpnmain.cgi /etc/init.d/apache restart /etc/init.d/unbound restart /etc/init.d/openvpn-rw restart +/etc/init.d/ipsec restart # Build initial ramdisks (for intel-microcode & dracut-ng) dracut --regenerate-all --force diff --git a/lfs/strongswan b/lfs/strongswan index 728e01636..a993dd39e 100644 --- a/lfs/strongswan +++ b/lfs/strongswan @@ -24,7 +24,7 @@ include Config -VER = 6.0.3 +VER = 6.0.4 THISAPP = strongswan-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -43,7 +43,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 355dff5de259e545b1bb5e24853dc91148c3d400b1977a2de35271e019dfc236c838ccac4552974a4999e2768900150c432753fc0d422444d4cc34486566e192 +$(DL_FILE)_BLAKE2 = 2291900bda3e679cb68f35e44fe20011d82b44e7a9ed3fd0ae7c40ed57154c5ecded1ab5bffc9ab30c93de667ef9b103a7da1a2b31d8e2eae97b268f0be11f01 install : $(TARGET) hooks/post-receive -- IPFire 2.x development tree