linux/meta-openembedded.git/meta-networking/recipes-support/strongswan, branch scarthgap

strongswan: fix for CVE-2026-35334

2026-05-21T03:27:48+00:00

Pick patch according to [1] [1] https://download.strongswan.org/security/CVE-2026-35334 [2] https://www.strongswan.org/blog/2026/04/22/strongswan-vulnerability-(cve-2026-35334).html [3] https://security-tracker.debian.org/tracker/CVE-2026-35334 Signed-off-by: Hitendra Prajapati Signed-off-by: Anuj Mittal

strongswan: Fix CVE-2026-25075

2026-04-03T09:30:48+00:00

Pick patch according to [1] [1] https://download.strongswan.org/security/CVE-2026-25075/ [2] https://www.strongswan.org/blog/2026/03/23/strongswan-vulnerability-(cve-2026-25075).html Signed-off-by: Vijay Anusuri Signed-off-by: Anuj Mittal

strongswan: patch CVE-2025-62291

2026-01-26T04:34:45+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2025-62291 Pick the patch that is mentioned on the vendor's blog[1], that is also referenced in the NVD report. [1]: https://www.strongswan.org/blog/2025/10/27/strongswan-vulnerability-%28cve-2025-62291%29.html Signed-off-by: Gyorgy Sarvari Signed-off-by: Anuj Mittal

strongswan: upgrade 5.9.13 -> 5.9.14

2024-03-26T15:37:19+00:00

ChangeLog: https://github.com/strongswan/strongswan/releases/tag/5.9.14 Signed-off-by: Yi Zhao Signed-off-by: Khem Raj

strongswan: upgrade 5.9.12 -> 5.9.13

2023-12-19T06:17:23+00:00

Changelog: - Fixes a regression with handling OCSP error responses and adds a new option to specify the length of nonces in OCSP requests. Also adds some other improvements for OCSP handling and fuzzers for OCSP requests/responses. Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj

strongswan: upgrade 5.9.11 -> 5.9.12

2023-11-22T06:44:40+00:00

Changelog: ========== - Fixed a vulnerability in charon-tkm related to processing DH public values that can lead to a buffer overflow and potentially remote code execution. - The new `pki --ocsp` command produces OCSP responses based on certificate status information provided by plugins. - The cert-enroll script handles the initial enrollment of an X.509 host certificate with a PKI server via the EST or SCEP protocols. - The --priv argument for charon-cmd allows using any type of private key. - Support for nameConstraints of type iPAddress has been added (the openssl plugin previously didn't support nameConstraints at all). - SANs of type uniformResourceIdentifier can now be encoded in certificates. - Password-less PKCS#12 and PKCS#8 files are supported. - A new global option allows preventing peers from authenticating with trusted end-entity certificates (i.e. local certificates). - ECDSA public keys that encode curve parameters explicitly are now rejected by all plugins that support ECDSA. - charon-nm now actually uses the XFRM interfaces added with 5.9.10, it can also use the name in connection.interface-name. - The resolve plugin tries to maintain the order of installed DNS servers. - The kernel-libipsec plugin always installs routes even if no address is found in the local traffic selectors. - Increased the default receive buffer size for Netlink sockets to 8 MiB and simplified its configuration. - Copy the issuer's subjectKeyIdentifier as authorityKeyIdentifier instead of always generating a hash of the subjectPublicKey. - Fixed issues while reestablishing multiple CHILD_SAs (e.g. after a DPD timeout) that could cause a reqid to get assigned to multiple CHILD_SAs with unrelated traffic selectors. - Fixed a possible infinite loop issue in watcher_t and removed WATCHER_EXCEPT, instead callbacks are always invoked even if only errors are signaled. - Fixed a regression in the IKE_SA_INIT tracking code added with 5.9.6 when handling invalid messages. - Fixed adding the XFRMA_REPLAY_ESN_VAL attribute twice when updating SAs. - Correctly encode SPI from REKEY_SA notify in CHILD_SA_NOT_FOUND notify if CHILD_SA is not found during rekeying. - The testing environment is now based on Debian 12 (bookworm), by default. Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj

strongswan: upgrade 5.9.10 -> 5.9.11

2023-06-19T17:24:49+00:00

Changelog: ========== - A deadlock in the vici plugin has been fixed that could get triggered when multiple connections were initiated/terminated concurrently and control-log events were raised by the watcher_t component. - CRLs have to be signed by a certificate that has the cRLSign keyUsage bit encoded (even if it's a CA), or a CA certificate without keyUsage extension. - Optional CA labels in EST server URIs are supported by `pki --est/estca`. - CMS-style signatures in PKCS#7 containers are supported by the pkcs7 and openssl plugins, which allows verifying RSA-PSS and ECDSA signatures. - Fixed a regression in the server implementation of EAP-TLS with TLS 1.2 or earlier that was introduced with 5.9.10. - Ensure the TLS handshake is complete in the EAP-TLS client with TLS <= 1.2. - kernel-libipsec can process raw ESP packets on Linux (disabled by default) and gained support for trap policies. - The dhcp plugin uses an alternate method to determine the source address for unicast DHCP requests that's not affected by interface filtering. - Certificate and trust chain selection as initiator has been improved in case the local trust chain is incomplete and an unrelated certreq is received. - ECDSA and EdDSA keys in IPSECKEY RRs are supported by the ipseckey plugin. - To bypass tunnel mode SAs/policies, the kernel-wfp plugin installs bypass policies also on the FWPM_SUBLAYER_IPSEC_TUNNEL sublayer. - Stale OCSP responses are now replace in-place in the certificate cache. - Fixed parsing of SCEP server capabilities by `pki --scep/scepca`. Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj

strongswan: add PACKAGECONFIG for the NetworkManager module

2023-05-11T18:28:34+00:00

Disabled by default. When enabled, a package 'strongswan-nm' gets created. The package naming follows Debian/Ubuntu. Signed-off-by: Petr Gotthard Signed-off-by: Khem Raj

strongswan: 5.9.9 -> 5.9.10

2023-03-06T16:41:13+00:00

Changelog: https://github.com/strongswan/strongswan/releases/tag/5.9.10 Signed-off-by: Yi Zhao Signed-off-by: Khem Raj

strongswan: upgrade 5.9.8 -> 5.9.9

2023-01-11T16:37:58+00:00

Changelog: https://github.com/strongswan/strongswan/releases/tag/5.9.9 Signed-off-by: Yi Zhao Signed-off-by: Khem Raj