From patchwork Wed Sep 16 14:35:52 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 10237 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4hlLzg2fL1z3wqG for ; Wed, 16 Sep 2026 14:36:15 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [IPv6:2001:678:b28::201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "YE1" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4hlLzf4jKVz6lR for ; Wed, 16 Sep 2026 14:36:14 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4hlLzf3xN1z2xXQ for ; Wed, 16 Sep 2026 14:36:14 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4hlLzW5Hxvz30LN for ; Wed, 16 Sep 2026 14:36:07 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4hlLzV3K97z6Jy; Wed, 16 Sep 2026 14:36:06 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1789569366; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=pg1hAca5ol4VT2oiQYIq7SQIaESxpfmaf6gpGYSZMc8=; b=Hx5dGUZD9kiaqO37lB7KVGn0FxJpYl6OllyrCgObiMSr22YBafArjhniVyEPh9iv606yIv S4CEHrABOuAOYPBA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1789569366; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=pg1hAca5ol4VT2oiQYIq7SQIaESxpfmaf6gpGYSZMc8=; b=mBvdhXPW2ni63Bv5Q/30kh+0dJRP5/U7DSUY7SKISBIv6YjYEjwUqewiBf0qYyCKDLuz2u vcFv/zGMIbdtKU5TYhhFTgEXJl4R9a0a/NZGlmOr3DV78Kh0Fo+uWPP0QC3RWuX89fk9aL IeTlZGsop6YhS5BisM2R4jQ2S1MqaUFYkybUOcmLLqnF4kOD3w62HpQ1adls5GAmSwFft4 8UMG1Zm4YVTSWlp+A4118sjyQpIkBkmmMlaaWkGZC4iJlTUv+wOTcGHMJ+Yi8VKutq7kyo 77LBqcpN6/X7D5gHJCi/dFdoLeGvaAEHIrqeYpm6Avrkiwv/aAdFa0M5RHvfNA== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH] strongswan: Update to version 6.1.0 Date: Wed, 16 Sep 2026 16:35:52 +0200 Message-ID: <20260916143552.3536823-6-adolf.belka@ipfire.org> In-Reply-To: <20260916143552.3536823-1-adolf.belka@ipfire.org> References: <20260916143552.3536823-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 - Update from version 6.0.7 to 6.1.0 - Update of rootfile - IKEv1 is now disabled by default. Therefore had to add --enable-ikev1 to the configure options. - Somewhere in the next year their plan (although no definitive timeline yet) is to remove support from the IKEv1 protocol from the strongswan code. - Having --enable-ikev1 set means that strongswan will log a message about its impending removal. - Therefore with CU205 we will need to provide a warning to all IPSec users that if they are using IKEv1 they should plan and action a migration to IKEv2. - A range of plugins and components have also been removed with this version, including gcrypt so gcrypt.conf and libstrongswan-gcrypt.so are no longer in the rootfile - 10 CVE fixes in 6.1.0 - Changelog 6.1.0 Vulnerabilities CVE-2026-78123 - Fixed a vulnerability in the openssl plugin related to the processing of PKCS#7 containers that can result in a crash. Affects 5.0.2 and newer. CVE-2026-78124 - Fixed a vulnerability in the openssl plugin related to the enumeration of certificates in PKCS#7 containers that can result in memory leaks. Affects 5.0.2 and newer. CVE-2026-78126 - Fixed a vulnerability in the eap-aka plugin related to processing an unexpected AKA-Synchronization-Failure that can result in a crash. Affects 4.1.10 and newer. CVE-2026-78127 - Fixed a vulnerability in libcharon related to the logging of IKE messages that can result in a denial of service via memory exhaustion. Affects 4.1.2 and newer. CVE-2026-78129 - Fixed a vulnerability in libstrongswan related to the processing of encrypted PKCS#7 containers that can result in a denial of service. Affects 4.6.2 and newer. CVE-2026-78130 - Fixed a vulnerability in the x509 plugin related to the verification of X.509 attribute certificates that can lead to a denial of service. Affects 4.2.0 and newer. CVE-2026-78131 - Fixed a vulnerability in the x509 plugin related to the parsing of identities in X.509 attribute certificates that can lead to a denial of service via memory exhaustion. Affects 4.2.0 and newer. CVE-2026-78132 - Fixed a vulnerability in the x509 plugin related to the parsing of the ietfAttrSyntax ASN.1 type in X.509 attribute certificates that can lead to a denial of service. Affects 5.1.3 and newer. CVE-2026-78133 - Fixed a vulnerability in libcharon related to the handling of IKEv2 rekeying collisions that can result in a use-after-free and potentially remote code execution. Affects 6.0.0 and newer. CVE-2026-78134 - Fixed a vulnerability in the eap-peap and eap-ttls plugins related to the propagation of authentication details from inner EAP methods that can result in incorrect identity binding and potential authorization bypass. Affects 4.5.0 and newer. CVE-2026-78135 - Fixed a vulnerability in libcharon related to the handling of CREATE_CHILD_SA requests on unestablished IKE SAs that can result in the creation of a usable Child SA before authentication completes. Affects 5.9.7 and newer. Plugin and Configuration Changes IKEv1 is now disabled by default. Support for the protocol will be removed in a future release, likely within the next year (there is no definitive timeline yet). When building, IKEv1 has to be enabled explicitly via --enable-ikev1. A warning about its impending removal is logged. In the configuration, version now defaults to 2. If it is set to 0 or 1, a warning is logged when the configuration is loaded. Removed the following plugins and components: af-alg, android-dns, blowfish, charon-xpc, duplicheck, gcrypt, keychain, led, libfast, manager, medsrv/medcli, padlock, smp, soup, tnc-ifmap, tnccs-11, tnccs-dynamic. We recommend that they not be enabled when building older releases either. Removed the retry mechanism from the eap-mschapv2 plugin if the password is incorrect, because it could potentially get exploited for a DoS attack and its usefulness was questionable anyway (e53e2c7). CRLs that contain critical issuingDistributionPoint extensions are not silently accepted anymore as the plugins don't support it, which could lead to incorrect validation (2092fe6). The stroke plugin now reports the total number of SAs instead of the number of "up" SAs to avoid an integer underflow if there are more queued initial messages than SAs (2265fcd). New Features Support for the XFRM_MSG_MIGRATE_STATE message in Linux 7.2 has been added. This allows migrating specific SAs to different IPs (and changing other properties), which enables updating SAs even when the kernel's lockdown feature is set to confidentiality (i.e. we don't get the keys back when we query an SA). The behavior for the latter when running on older kernels is also improved (715515c). charon-tkm now maps proposals to ia and ea identitifers (3b58c67). Enhancements and Optimizations Simplified X.509 policy constraints handling in the constraints plugin and fixed some issues (62a4cde). The previous code was too strict in some respects (e.g. for inhibitPolicyMapping and inhibitAnyPolicy constraints) but also contained other flaws. In particular the handling of requireExplicitPolicy constraints. The latter now causes end entity certificates to get rejected if no valid policy is found (see the commit messages for details). Ensure nonces of unequal lengths are correctly compared if the shorter is the prefix of the longer when resolving rekey collisions (00830dd). Increased the receive buffer size for the ha plugin's sync socket and made it configurable (9d5e619). Changed the build of the aesni plugin so the plugin constructor is not compiled with flags that could cause the use of instructions that trigger SIGILL on unsupported platforms (24c70db). Implemented the block multiplication in the gcm plugin in constant time (87bbfe4). Implemented the padding and MAC checks in libtls in constant time (dafb082). TLS signature schemes are now filtered by config and rejected if not defined for the negotiated TLS version (5e89dd5). Use Absorb/SqueezeBlocks API for SHAKE-128/256 XOFs in the wolfssl plugin (3ec8d3c). The wolfssl plugin now validates X25519/X448 public keys (05625ac) and properly handles RNGs during RSA/ECDSA operations to avoid state corruption (d9cf1b0). The curve25519 plugin now explicitly rejects all-zero shared secrets (589a3a6). Tests were added to ensure plugins enforce this (9598de4, note that wolfSSL before 5.9.2 requires a compile option). The derived shared secret is now also explicitly wiped when the object is destroyed (14a811b). All ML-KEM implementations now ensure no empty shared secrets are returned (889d83b). Avoid truncating identities that contain \0 characters when creating them from data blobs (7e7c280). Explicitly compute PCR value independently during verification and reject mismatches (a885a3d). Avoid potential TOCTOU issues when opening log files and changing owner; log files are not world-readable anymore (ea7a721). Avoid potential TOCTOU issues when accessing/writing PID file in charon and charon-tkm (18a1046, d19591e). Replaced calls to deprecated functions in the ldap plugin and added support for LDAPS (e37aac7). Ensure resource records parsed in the unbound plugin match the queried or canonical name (e64877b). Bind IKE sockets exclusively in the socket-win plugin (47a583d). Log warning if UID changes and no capability backend is compiled in (8efb533). Allow SA deletion in either order in the kernel-wfp plugin (485f764). Added a limit for concurrently cached DAE responses in the eap-radius plugin (6419fc8). Ensure only secrets that match the username are used in the xauth-generic plugin (dd6a984). Fixes Fixed that IKE SAs don't fail if the initial Child SA's installation fails, which was broken since 6.0.0 (6894b33). Fixed crash if responder doesn't send TS payloads, which was broken since 6.0.0 (65a30f7). Fixed that initiators fail if no KE payload is received in IKE_INTERMEDIATE response (c40e821). Fixed enforcing the ppk_required constraint on the initiator (50177b4). Fixed not resetting state of Child SA if passive rekeying fails while concurrently rekeying it actively (4611f41). Fixed notifying threads waiting on controller_t::initiate() after INVALID_KE_PAYLOAD retry failed (cef4bce). Fixed race conditions when inserting CRLs/OCSP responses into the certificate cache (87f0bc2). Fixed potential race condition when accepting sockets in stream_service_t (b52fc6c). Fixed potential race condition in token hot-plug handling of the pkcs11 plugin (f4798de). Fixed potential race condition between install and uninstall in the shunt manager (6dca323). Fixed that a skipped CRL lookup/fetch in the revocation plugin prevents fetching delta CRLs (45b2f8d). Fixed transaction handling for multiple concurrent threads in the sqlite plugin (9290658) Fixed a potential bypass of EAP-TNC after authenticating a client via certificate in EAP-PEAP (8323fba). Fixed compatibility of the wolfssl plugin's ML-KEM implementation with newer wolfSSL versions (98b133c). Fixed implementation of ByteDecode with d=12 in the ml plugin to be more strict when parsing public keys (4f3e572). Fixed the validity calculation in the pgp plugin and avoid potential overflows on 32-bit systems (b3c0019). Fixed memory leaks in many AEAD implementations when ICV verification fails if not using in-place decryption (libipsec uses it that way, but not IKEv2). ESP packet handling in libipsec is fixed separately (dae65dd). The affected plugins are aesni (a2f83d3), botan (40aa0a1), ccm (85c02dc), chapoly (c6adb20), openssl (023c626), and wolfssl (1fe813f). Fixed potential memory leaks in hasher implementations that could potentially fail (a4a123e). Fixed the addresses when removing firewall rules during ike_update in the connmark plugin (b031cd2). Also only install one rule per Child SA in PREROUTING (not one per policy, 77cfa83). Fixed return value in pt-tls-server when handling a PB-TNC batch fails (dbaca2d), also fixed a memory leak if SASL authentication fails (0a9445a). Fixed keeping the watcher callbacks registered in the tnc-pdp plugin when processing a request fails (dc8fa5f). Also fixed the lock type when adding/replacing a connection (5e51fc7). Fixed timeout handling in the RADIUS socket abstraction (6dfebce). Fixed a potential NULL-pointer dereference in the XAuth backend of the eap-radius plugin (db3f4c2). Fixed potential issues when accessing IKE_SA when sending interim accounting updates in the eap-radius plugin (2ed81ed). Fixed the generation of SQN in the eap-aka-3gpp and eap-aka-3gpp2 plugins (371c356, cfc72fe). Also increased log levels for potentially sensitive data in these plugins (d3d7a27, 7a215e5). Fixed memory leaks when processing invalid TLS certificate or Finished messages on the server (be0ee2e) or when processing of TLS 1.3 Finished messages fails on the client (4feb31d). Fixed a memory leak in the x509 plugin if an OCSP response contains multiple nonce extensions (7bf9b6b). Fixed a memory leak in the Android app's DNS proxy (67bf005). Fixed reading the last path character in the process_t abstraction on Windows (097c7a1). Fixed a leak when replacing an exclude route in the kernel-pfkey and kernel-libipsec plugins (e36a8c0, 7a316d9). Fixed a memory leak in the pkcs11 plugin's hasher_t implementation (4d843d3). Fixed a memory leak in the ha plugin if Child SA key derivation fails (98fd5e9). Fixed memory leaks in the vici plugin if loading CA cert in authority section fails (e03ec46), as well as when selectors for redirect command are missing or invalid (268c11f). Fixed memory leak due to repeated challenges in the eap-md5 plugin (918e052). Fixed memory leaks in the eap-ttls plugin if eap-identity plugin is not loaded (94e97eb). Fixed releasing context if determining list of readers fails in eap-sim-pcsc plugin fails (322d947). Fixed removing addresses from hashtable if an interface goes down in the kernel-pfroute plugin (8b1f8e0). Fixed cleanup of pending entry if virtual IP address installation fails in kernel-netlink plugin (c52fd0c). Fixed the check for peer ID payloads in ME_CONNECT requests in the mediation task (9965a64). Fixed potential crash by ignoring mediation extension connectivity checks on incomplete checklists (d8c7fe0), as well as another when processing endpoints with invalid NO_FAMILY (2c65dac). Fixed potential use-after-free when checking online status of a mediation peer (207ae20). Fixed ECDH key derivation in the pkcs11 plugin (2eeb896). Fixed skipping IPv6 fragment headers in libipsec (c3b99c6). Fixed mismatch between hash buffer size and largest possible hash when creating a PTS file measurement (c720ae2). Fixed potential buffer overflow when adding reference PTS file measurements (4be1883), and consistently use hex encoding in the database (ca4db3c). Fixed potential crash when resolving symlinks in PTS file measurements (2dfc1ac). Fixed arguments when logging an IKEv1 UNITY_LOAD_BALANCE attribute with invalid address (d5e7426). Fixed wiping cached PINs when clearing credentials in the vici plugin (7a1c801). Fixed wiping derived key for EAP and PSK authentication (4e7ade0). Fixed potential command injection in sec-updater (8ae96ed). Fixed a potential use-after-free in charon-tkm's chunk map (71fff07). Fixed reading split-tunneling block settings in managed configs (2367cda). Fixed handling of encrypted PEM files without DEK-Info in the pem plugin (40f4097), also fixed potential integer overflow when verifying padding after decryption (52b689c). Fixed double-frees and memory leaks in error cases in charon-nm (ad7d50f). Fixed potential overflow in in-memory pools and enforce the size limit also for range-based pools (e3607d5). Fixed offset checks in ha address pool (c52fd0c). Fixed applying the second padding bit on big-endian platforms in the sha3 plugin (1b9b037). Fixed potential use-after-free when joining threads on Windows (f00b85d), and avoid potential races when canceling them (5011838). Fixed potential issues when multiple clients list certificates via stroke plugin (b6ff363). Fixed potential issues when printing very long strings with the built-in printf hooks (f95c6a2). Avoid modifying DHCP transactions after receiving unexpected offers in the dhcp plugin (289d776). Release pre-allocated SPIs in libipsec if the Child SA creation fails (2cea904). libtls now correctly rejects unencrypted TLS 1.3 records (bff18d9). The coupling plugin now creates individual hasher instances to avoid accessing a shared instance by multiple threads concurrently (4436c12). Prevent corrupting hashtables in the eap-simaka-pseudonym and eap-simaka-reauth plugins (0b5143a, 4bef380). Avoid potential buffer overflow when generating EAP-AKA messages and correct handling of AT_PADDING and AT_NOTIFICATION (cd24806). Avoid a race condition in the xauth-pam plugin during concurrent authentication attempts (eec3164), fixed the initialization of the response array when handling sessions (be4b9f4). Reject EAP Start messages from clients in TLS-based EAP methods (fd7fcca). Also, only process ACKs on the server after processing at least one actual packet (09d48b7). Correctly forward remote ports from acquires triggered via the kernel-wfp plugin (3a30390). Also remove policies before deleting the provider (6b58665). Properly handle conflict during concurrent FD removal in watcher_t (313d1ef) Avoid unnecessarily locking the global thread lock on Windows (4110d27). Avoid overflows when converting OIDs with large sub-identifiers to strings (502fa14, a5d815a, 75baeb9). Avoid undefined shifts if the selector is /0 in the forecast and connmark plugins (117cf65, c485080). Avoid logging passwords when parsing URIs fails in the mysql plugin (11999f1). Avoid issues when re-inserting an existing element into a value-based array (588c7a8). Properly unregister validator in the systime-fix plugin when the time gets valid to avoid accepting expired certificates again should the time get rolled back for some reason(dd94e8d). Partially reverted d7608ca in charon-nm as it didn't really improve the security (e6dc515). For Developers The CRED_HOOK_POLICY_VIOLATION hook now receives the subject certificate instead of the issuer certificate as it's that certificate's missing/invalid policies that trigger it. host_create_from_subnet() does proper validation of the subnet mask value and returns NULL if it's invalid or e.g. data follows the string (4ebd1c5). Improved the the constant time comparison of chunks of unequal length via chunk_equals_const(). Note that the function now expects the expected/reference value as first argument and the input as second, its runtime is strictly bound by the first argument's length. See the commit message for details (459fcab) key_exchange_verify_pubkey() has been renamed to key_exchange_check_pubkey_len() in order to clarify what the function actually does (80f8f5e). asn1_oid_to_string() returns NULL when conversion of an OID fails due to a large sub-identifiers. Sockets wrapped by stream_service_create_from_fd() are now explicitly set to non-blocking mode while those accepted by the service later are explicitly set to blocking mode to match what stream_t expects on all platforms (b52fc6c). The atomic ref_cur() now uses ACQUIRE memory ordering to sync with a concurrent ref_put() (bcef2c8). Added atomic helpers to store/load bools (3934089). Primitives for constant-time comparison of uint64_t values have been added to the utils. Improved the ability to cancel a test run (3ef0918). The link to the test results is now formatted as hyperlink via OSC 8 (fa56cca). Signed-off-by: Adolf Belka --- config/rootfiles/common/strongswan | 3 --- lfs/strongswan | 5 +++-- 2 files changed, 3 insertions(+), 5 deletions(-) diff --git a/config/rootfiles/common/strongswan b/config/rootfiles/common/strongswan index 2e1671b11..c83b7d61c 100644 --- a/config/rootfiles/common/strongswan +++ b/config/rootfiles/common/strongswan @@ -34,7 +34,6 @@ etc/strongswan.d/charon/eap-ttls.conf etc/strongswan.d/charon/farp.conf etc/strongswan.d/charon/fips-prf.conf etc/strongswan.d/charon/gcm.conf -etc/strongswan.d/charon/gcrypt.conf etc/strongswan.d/charon/hmac.conf etc/strongswan.d/charon/kdf.conf etc/strongswan.d/charon/kernel-netlink.conf @@ -124,7 +123,6 @@ usr/lib/ipsec/plugins/libstrongswan-eap-ttls.so usr/lib/ipsec/plugins/libstrongswan-farp.so usr/lib/ipsec/plugins/libstrongswan-fips-prf.so usr/lib/ipsec/plugins/libstrongswan-gcm.so -usr/lib/ipsec/plugins/libstrongswan-gcrypt.so usr/lib/ipsec/plugins/libstrongswan-hmac.so usr/lib/ipsec/plugins/libstrongswan-kdf.so usr/lib/ipsec/plugins/libstrongswan-kernel-netlink.so @@ -208,7 +206,6 @@ usr/sbin/swanctl #usr/share/strongswan/templates/config/plugins/farp.conf #usr/share/strongswan/templates/config/plugins/fips-prf.conf #usr/share/strongswan/templates/config/plugins/gcm.conf -#usr/share/strongswan/templates/config/plugins/gcrypt.conf #usr/share/strongswan/templates/config/plugins/hmac.conf #usr/share/strongswan/templates/config/plugins/kdf.conf #usr/share/strongswan/templates/config/plugins/kernel-netlink.conf diff --git a/lfs/strongswan b/lfs/strongswan index 9b3d71cbd..b711ee817 100644 --- a/lfs/strongswan +++ b/lfs/strongswan @@ -24,7 +24,7 @@ include Config -VER = 6.0.7 +VER = 6.1.0 THISAPP = strongswan-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 503973ad437545ebae12297fefea80a6e0e3d9db8781cadc1dc37bfe8dcd8895c4442bf4a3b6f84051ae14ee1024471c4b3d5a5ac99036122d08413ddf3923c8 +$(DL_FILE)_BLAKE2 = c4466095f79a23d7ae98235fca2271d3599afbb047c327c0787b016da1e9b2677a3f80462ed2c1258193947ac3b5a3f05d6b2e9a5256205aeaf827f47df0fa40 install : $(TARGET) @@ -99,6 +99,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) --enable-mgf1 \ --enable-hmac \ --enable-ml \ + --enable-ikev1 \ $(CONFIGURE_OPTIONS) cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install