strongswan: Update to 5.6.0

Fixes CVE-2017-11185:

Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input validation
when verifying RSA signatures, which requires decryption with the operation m^e mod n,
where m is the signature, and e and n are the exponent and modulus of the public key.
The value m is an integer between 0 and n-1, however, the gmp plugin did not verify this.
So if m equals n the calculation results in 0, in which case mpz_export() returns NULL.
This result wasn't handled properly causing a null-pointer dereference.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/config/rootfiles/core/114/filelists/i586/strongswan-padlock b/config/rootfiles/core/114/filelists/i586/strongswan-padlock
new file mode 120000 (symlink)
index 0000000..2412824
--- /dev/null
+++ b/config/rootfiles/core/114/filelists/i586/strongswan-padlock
@@ -0,0 +1 @@
+../../../../common/i586/strongswan-padlock
\ No newline at end of file

diff --git a/config/rootfiles/core/114/filelists/strongswan b/config/rootfiles/core/114/filelists/strongswan
new file mode 120000 (symlink)
index 0000000..90c727e
--- /dev/null
+++ b/config/rootfiles/core/114/filelists/strongswan
@@ -0,0 +1 @@
+../../../common/strongswan
\ No newline at end of file

diff --git a/config/rootfiles/core/114/update.sh b/config/rootfiles/core/114/update.sh
index b68af03e6e398b26b62d99fabc877ffd702c8cdf..54a2062304fd6d969d2b13620b9a4cae48a6db07 100644 (file)
--- a/config/rootfiles/core/114/update.sh
+++ b/config/rootfiles/core/114/update.sh
@@ -32,6 +32,7 @@ for (( i=1; i<=$core; i++ )); do
 done
 
 # Stop services
+ipsec stop
 /etc/init.d/squid stop
 /etc/init.d/unbound stop
 
@@ -50,6 +51,10 @@ ldconfig
 /etc/init.d/unbound start
 /etc/init.d/squid start
 
+if grep -q "ENABLED=on" /var/ipfire/vpn/settings; then
+       ipsec start
+fi
+
 # This update need a reboot...
 touch /var/run/need_reboot
 

diff --git a/lfs/strongswan b/lfs/strongswan
index 85c4f2b85815d492cb69a7777afd8723d2b33415..600c012dc5a1515b0ca58264b6e61a487f7205f3 100644 (file)
--- a/lfs/strongswan
+++ b/lfs/strongswan
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 5.5.3
+VER        = 5.6.0
 
 THISAPP    = strongswan-$(VER)
 DL_FILE    = $(THISAPP).tar.bz2
@@ -48,7 +48,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = 4afffe3c219bb2e04f09510905af836b
+$(DL_FILE)_MD5 = befb5e827d02433fea6669c20e11530a
 
 install : $(TARGET)