- Update from version 6.0.2 to 6.0.3
- Update of rootfile
- Changelog
6.0.3
- Fixed a vulnerability in the eap-mschapv2 plugin related to
processing Failure
Request packets on the client that can lead to a heap-based buffer
overflow
and potentially remote code execution.
This vulnerability has been registered as CVE-2025-62291.
- The new `alert` event for vici is raised for certain error conditions.
- Only plugins with matching version number are loaded by programs.
- IKE SAs redirected during IKE_AUTH are now properly tracked by
controller and
trap-manager.
- Fallback to the IKE identity for clients that don't provide an
EAP-Identity to
fix a regression in 6.0.2.
- Detecting unwrapped CKA_EC_POINTs has been improved in the pkcs11
plugin.
- The whitelist plugin uses non-blocking I/O to avoid issues with
clients that
stay connected for a long time. The buffer size for IDs was
increased to 256.
- The certexpire plugins also uses 256 bytes for its identity buffer.
- Convenient decorators for event handling are provided by the Python
bindings
for vici.
- The openssl plugin also supports Ed25519 via AWS-LC. It also loads
EdDSA keys
from PKCS#12 containers.
- The testing environment is now based on Debian 13 (trixie), by
default.
Signed-off-by: Adolf Belka <[email protected]>
---
config/rootfiles/common/strongswan | 2 --
lfs/strongswan | 58 +++++++++++++++---------------
2 files changed, 28 insertions(+), 32 deletions(-)
diff --git a/config/rootfiles/common/strongswan
b/config/rootfiles/common/strongswan
index 48f4fdf43..2e1671b11 100644
--- a/config/rootfiles/common/strongswan
+++ b/config/rootfiles/common/strongswan
@@ -130,8 +130,6 @@ usr/lib/ipsec/plugins/libstrongswan-kdf.so
usr/lib/ipsec/plugins/libstrongswan-kernel-netlink.so
usr/lib/ipsec/plugins/libstrongswan-mgf1.so
usr/lib/ipsec/plugins/libstrongswan-ml.so
-usr/lib/ipsec/plugins/libstrongswan-ml.so.0
-usr/lib/ipsec/plugins/libstrongswan-ml.so.0.0.0
usr/lib/ipsec/plugins/libstrongswan-nonce.so
usr/lib/ipsec/plugins/libstrongswan-openssl.so
usr/lib/ipsec/plugins/libstrongswan-pem.so
diff --git a/lfs/strongswan b/lfs/strongswan
index 7075ab7ef..728e01636 100644
--- a/lfs/strongswan
+++ b/lfs/strongswan
@@ -24,7 +24,7 @@
include Config
-VER = 6.0.2
+VER = 6.0.3
THISAPP = strongswan-$(VER)
DL_FILE = $(THISAPP).tar.bz2
@@ -43,7 +43,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 =
3cfc248831832a9b75da549fcaf490a4a0c33e2f680e04a02d04a035c05215ae0236f1fdcdb4a00b71b5a08d07626e8028959045aff1b77827c21fe7e1fb13ad
+$(DL_FILE)_BLAKE2 =
355dff5de259e545b1bb5e24853dc91148c3d400b1977a2de35271e019dfc236c838ccac4552974a4999e2768900150c432753fc0d422444d4cc34486566e192
install : $(TARGET)
@@ -75,36 +75,34 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
cd $(DIR_APP) && patch -Np1 -i
$(DIR_SRC)/src/patches/strongswan-disable-ipv6.patch
cd $(DIR_APP) && patch -Np1 -i
$(DIR_SRC)/src/patches/strongswan-ipfire.patch
-
$(UPDATE_AUTOMAKE)
cd $(DIR_APP) && ./configure \
- --prefix="/usr" \
- --sysconfdir="/etc" \
- --enable-curl \
- --enable-dhcp \
- --enable-farp \
- --enable-openssl \
- --enable-gcrypt \
- --enable-ccm \
- --enable-ctr \
- --enable-gcm \
- --enable-xauth-eap \
- --enable-xauth-noauth \
- --enable-eap-radius \
- --enable-eap-tls \
- --enable-eap-ttls \
- --enable-eap-peap \
- --enable-eap-mschapv2 \
- --enable-eap-identity \
- --enable-chapoly \
- --enable-sha3 \
- --enable-stroke \
- --enable-fips-prf \
- --enable-mgf1 \
- --enable-hmac \
- --enable-ml \
- $(CONFIGURE_OPTIONS)
-
+ --prefix="/usr" \
+ --sysconfdir="/etc" \
+ --enable-curl \
+ --enable-dhcp \
+ --enable-farp \
+ --enable-openssl \
+ --enable-gcrypt \
+ --enable-ccm \
+ --enable-ctr \
+ --enable-gcm \
+ --enable-xauth-eap \
+ --enable-xauth-noauth \
+ --enable-eap-radius \
+ --enable-eap-tls \
+ --enable-eap-ttls \
+ --enable-eap-peap \
+ --enable-eap-mschapv2 \
+ --enable-eap-identity \
+ --enable-chapoly \
+ --enable-sha3 \
+ --enable-stroke \
+ --enable-fips-prf \
+ --enable-mgf1 \
+ --enable-hmac \
+ --enable-ml \
+ $(CONFIGURE_OPTIONS)
cd $(DIR_APP) && make $(MAKETUNING)
cd $(DIR_APP) && make install
--
2.51.2
