From: Adolf Belka <adolf.belka@ipfire.org>
Date: Fri, 7 Nov 2025 09:59:43 +0000 (+0100)
Subject: strongswan: Update to version 6.0.3
X-Git-Tag: v2.29-core199~17^2~54
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=580cd121d6712606f367bfbf7abec3a8671c6b78;p=ipfire-2.x.git

strongswan: Update to version 6.0.3

- Update from version 6.0.2 to 6.0.3
- Update of rootfile
- Changelog
    6.0.3
	- Fixed a vulnerability in the eap-mschapv2 plugin related to processing Failure
	  Request packets on the client that can lead to a heap-based buffer overflow
	  and potentially remote code execution.
	  This vulnerability has been registered as CVE-2025-62291.
	- The new `alert` event for vici is raised for certain error conditions.
	- Only plugins with matching version number are loaded by programs.
	- IKE SAs redirected during IKE_AUTH are now properly tracked by controller and
	  trap-manager.
	- Fallback to the IKE identity for clients that don't provide an EAP-Identity to
	  fix a regression in 6.0.2.
	- Detecting unwrapped CKA_EC_POINTs has been improved in the pkcs11 plugin.
	- The whitelist plugin uses non-blocking I/O to avoid issues with clients that
	  stay connected for a long time.  The buffer size for IDs was increased to 256.
	- The certexpire plugins also uses 256 bytes for its identity buffer.
	- Convenient decorators for event handling are provided by the Python bindings
	  for vici.
	- The openssl plugin also supports Ed25519 via AWS-LC.  It also loads EdDSA keys
	  from PKCS#12 containers.
	- The testing environment is now based on Debian 13 (trixie), by default.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
---

diff --git a/config/rootfiles/common/strongswan b/config/rootfiles/common/strongswan
index 48f4fdf43..2e1671b11 100644
--- a/config/rootfiles/common/strongswan
+++ b/config/rootfiles/common/strongswan
@@ -130,8 +130,6 @@ usr/lib/ipsec/plugins/libstrongswan-kdf.so
 usr/lib/ipsec/plugins/libstrongswan-kernel-netlink.so
 usr/lib/ipsec/plugins/libstrongswan-mgf1.so
 usr/lib/ipsec/plugins/libstrongswan-ml.so
-usr/lib/ipsec/plugins/libstrongswan-ml.so.0
-usr/lib/ipsec/plugins/libstrongswan-ml.so.0.0.0
 usr/lib/ipsec/plugins/libstrongswan-nonce.so
 usr/lib/ipsec/plugins/libstrongswan-openssl.so
 usr/lib/ipsec/plugins/libstrongswan-pem.so
diff --git a/lfs/strongswan b/lfs/strongswan
index 7075ab7ef..728e01636 100644
--- a/lfs/strongswan
+++ b/lfs/strongswan
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 6.0.2
+VER        = 6.0.3
 
 THISAPP    = strongswan-$(VER)
 DL_FILE    = $(THISAPP).tar.bz2
@@ -43,7 +43,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 3cfc248831832a9b75da549fcaf490a4a0c33e2f680e04a02d04a035c05215ae0236f1fdcdb4a00b71b5a08d07626e8028959045aff1b77827c21fe7e1fb13ad
+$(DL_FILE)_BLAKE2 = 355dff5de259e545b1bb5e24853dc91148c3d400b1977a2de35271e019dfc236c838ccac4552974a4999e2768900150c432753fc0d422444d4cc34486566e192
 
 install : $(TARGET)
 
@@ -75,36 +75,34 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
 	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/strongswan-disable-ipv6.patch
 	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/strongswan-ipfire.patch
-
 	$(UPDATE_AUTOMAKE)
 	cd $(DIR_APP) && ./configure \
-		--prefix="/usr" \
-		--sysconfdir="/etc" \
-		--enable-curl \
-		--enable-dhcp \
-		--enable-farp \
-		--enable-openssl \
-		--enable-gcrypt \
-		--enable-ccm \
-		--enable-ctr \
-		--enable-gcm \
-		--enable-xauth-eap \
-		--enable-xauth-noauth \
-		--enable-eap-radius \
-		--enable-eap-tls \
-		--enable-eap-ttls \
-		--enable-eap-peap \
-		--enable-eap-mschapv2 \
-		--enable-eap-identity \
-		--enable-chapoly \
-		--enable-sha3 \
-		--enable-stroke \
-		--enable-fips-prf \
-		--enable-mgf1 \
-		--enable-hmac \
-		--enable-ml \
-		$(CONFIGURE_OPTIONS)
-
+				--prefix="/usr" \
+				--sysconfdir="/etc" \
+				--enable-curl \
+				--enable-dhcp \
+				--enable-farp \
+				--enable-openssl \
+				--enable-gcrypt \
+				--enable-ccm \
+				--enable-ctr \
+				--enable-gcm \
+				--enable-xauth-eap \
+				--enable-xauth-noauth \
+				--enable-eap-radius \
+				--enable-eap-tls \
+				--enable-eap-ttls \
+				--enable-eap-peap \
+				--enable-eap-mschapv2 \
+				--enable-eap-identity \
+				--enable-chapoly \
+				--enable-sha3 \
+				--enable-stroke \
+				--enable-fips-prf \
+				--enable-mgf1 \
+				--enable-hmac \
+				--enable-ml \
+				$(CONFIGURE_OPTIONS)
 	cd $(DIR_APP) && make $(MAKETUNING)
 	cd $(DIR_APP) && make install