strongswan: Update to version 6.0.3

- Update from version 6.0.2 to 6.0.3
- Update of rootfile
- Changelog
    6.0.3
	- Fixed a vulnerability in the eap-mschapv2 plugin related to processing Failure
	  Request packets on the client that can lead to a heap-based buffer overflow
	  and potentially remote code execution.
	  This vulnerability has been registered as CVE-2025-62291.
	- The new `alert` event for vici is raised for certain error conditions.
	- Only plugins with matching version number are loaded by programs.
	- IKE SAs redirected during IKE_AUTH are now properly tracked by controller and
	  trap-manager.
	- Fallback to the IKE identity for clients that don't provide an EAP-Identity to
	  fix a regression in 6.0.2.
	- Detecting unwrapped CKA_EC_POINTs has been improved in the pkcs11 plugin.
	- The whitelist plugin uses non-blocking I/O to avoid issues with clients that
	  stay connected for a long time.  The buffer size for IDs was increased to 256.
	- The certexpire plugins also uses 256 bytes for its identity buffer.
	- Convenient decorators for event handling are provided by the Python bindings
	  for vici.
	- The openssl plugin also supports Ed25519 via AWS-LC.  It also loads EdDSA keys
	  from PKCS#12 containers.
	- The testing environment is now based on Debian 13 (trixie), by default.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/config/rootfiles/common/strongswan b/config/rootfiles/common/strongswan
index 48f4fdf43c6f5e10c4a62b58a5091d85712e18c1..2e1671b114c54513adf829139be3e69c2418c183 100644 (file)
--- a/config/rootfiles/common/strongswan
+++ b/config/rootfiles/common/strongswan
@@ -130,8 +130,6 @@ usr/lib/ipsec/plugins/libstrongswan-kdf.so
 usr/lib/ipsec/plugins/libstrongswan-kernel-netlink.so
 usr/lib/ipsec/plugins/libstrongswan-mgf1.so
 usr/lib/ipsec/plugins/libstrongswan-ml.so
-usr/lib/ipsec/plugins/libstrongswan-ml.so.0
-usr/lib/ipsec/plugins/libstrongswan-ml.so.0.0.0
 usr/lib/ipsec/plugins/libstrongswan-nonce.so
 usr/lib/ipsec/plugins/libstrongswan-openssl.so
 usr/lib/ipsec/plugins/libstrongswan-pem.so

diff --git a/lfs/strongswan b/lfs/strongswan
index 7075ab7ef72d9af55db2e909654f4ce67167eae4..728e016366b09299698e6f7574d7f9b3f6fad1ac 100644 (file)
--- a/lfs/strongswan
+++ b/lfs/strongswan
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 6.0.2
+VER        = 6.0.3
 
 THISAPP    = strongswan-$(VER)
 DL_FILE    = $(THISAPP).tar.bz2
@@ -43,7 +43,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 3cfc248831832a9b75da549fcaf490a4a0c33e2f680e04a02d04a035c05215ae0236f1fdcdb4a00b71b5a08d07626e8028959045aff1b77827c21fe7e1fb13ad
+$(DL_FILE)_BLAKE2 = 355dff5de259e545b1bb5e24853dc91148c3d400b1977a2de35271e019dfc236c838ccac4552974a4999e2768900150c432753fc0d422444d4cc34486566e192
 
 install : $(TARGET)
 
@@ -75,36 +75,34 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
        @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
        cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/strongswan-disable-ipv6.patch
        cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/strongswan-ipfire.patch
-
        $(UPDATE_AUTOMAKE)
        cd $(DIR_APP) && ./configure \
-               --prefix="/usr" \
-               --sysconfdir="/etc" \
-               --enable-curl \
-               --enable-dhcp \
-               --enable-farp \
-               --enable-openssl \
-               --enable-gcrypt \
-               --enable-ccm \
-               --enable-ctr \
-               --enable-gcm \
-               --enable-xauth-eap \
-               --enable-xauth-noauth \
-               --enable-eap-radius \
-               --enable-eap-tls \
-               --enable-eap-ttls \
-               --enable-eap-peap \
-               --enable-eap-mschapv2 \
-               --enable-eap-identity \
-               --enable-chapoly \
-               --enable-sha3 \
-               --enable-stroke \
-               --enable-fips-prf \
-               --enable-mgf1 \
-               --enable-hmac \
-               --enable-ml \
-               $(CONFIGURE_OPTIONS)
-
+                               --prefix="/usr" \
+                               --sysconfdir="/etc" \
+                               --enable-curl \
+                               --enable-dhcp \
+                               --enable-farp \
+                               --enable-openssl \
+                               --enable-gcrypt \
+                               --enable-ccm \
+                               --enable-ctr \
+                               --enable-gcm \
+                               --enable-xauth-eap \
+                               --enable-xauth-noauth \
+                               --enable-eap-radius \
+                               --enable-eap-tls \
+                               --enable-eap-ttls \
+                               --enable-eap-peap \
+                               --enable-eap-mschapv2 \
+                               --enable-eap-identity \
+                               --enable-chapoly \
+                               --enable-sha3 \
+                               --enable-stroke \
+                               --enable-fips-prf \
+                               --enable-mgf1 \
+                               --enable-hmac \
+                               --enable-ml \
+                               $(CONFIGURE_OPTIONS)
        cd $(DIR_APP) && make $(MAKETUNING)
        cd $(DIR_APP) && make install