linux/meta-openembedded.git/meta-networking/recipes-support/strongswan, branch styhead-next

strongswan: upgrade 5.9.13 -> 5.9.14

2024-03-26T15:37:19+00:00

ChangeLog: https://github.com/strongswan/strongswan/releases/tag/5.9.14 Signed-off-by: Yi Zhao Signed-off-by: Khem Raj

strongswan: upgrade 5.9.12 -> 5.9.13

2023-12-19T06:17:23+00:00

Changelog: - Fixes a regression with handling OCSP error responses and adds a new option to specify the length of nonces in OCSP requests. Also adds some other improvements for OCSP handling and fuzzers for OCSP requests/responses. Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj

strongswan: upgrade 5.9.11 -> 5.9.12

2023-11-22T06:44:40+00:00

Changelog: ========== - Fixed a vulnerability in charon-tkm related to processing DH public values that can lead to a buffer overflow and potentially remote code execution. - The new `pki --ocsp` command produces OCSP responses based on certificate status information provided by plugins. - The cert-enroll script handles the initial enrollment of an X.509 host certificate with a PKI server via the EST or SCEP protocols. - The --priv argument for charon-cmd allows using any type of private key. - Support for nameConstraints of type iPAddress has been added (the openssl plugin previously didn't support nameConstraints at all). - SANs of type uniformResourceIdentifier can now be encoded in certificates. - Password-less PKCS#12 and PKCS#8 files are supported. - A new global option allows preventing peers from authenticating with trusted end-entity certificates (i.e. local certificates). - ECDSA public keys that encode curve parameters explicitly are now rejected by all plugins that support ECDSA. - charon-nm now actually uses the XFRM interfaces added with 5.9.10, it can also use the name in connection.interface-name. - The resolve plugin tries to maintain the order of installed DNS servers. - The kernel-libipsec plugin always installs routes even if no address is found in the local traffic selectors. - Increased the default receive buffer size for Netlink sockets to 8 MiB and simplified its configuration. - Copy the issuer's subjectKeyIdentifier as authorityKeyIdentifier instead of always generating a hash of the subjectPublicKey. - Fixed issues while reestablishing multiple CHILD_SAs (e.g. after a DPD timeout) that could cause a reqid to get assigned to multiple CHILD_SAs with unrelated traffic selectors. - Fixed a possible infinite loop issue in watcher_t and removed WATCHER_EXCEPT, instead callbacks are always invoked even if only errors are signaled. - Fixed a regression in the IKE_SA_INIT tracking code added with 5.9.6 when handling invalid messages. - Fixed adding the XFRMA_REPLAY_ESN_VAL attribute twice when updating SAs. - Correctly encode SPI from REKEY_SA notify in CHILD_SA_NOT_FOUND notify if CHILD_SA is not found during rekeying. - The testing environment is now based on Debian 12 (bookworm), by default. Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj

strongswan: upgrade 5.9.10 -> 5.9.11

2023-06-19T17:24:49+00:00

Changelog: ========== - A deadlock in the vici plugin has been fixed that could get triggered when multiple connections were initiated/terminated concurrently and control-log events were raised by the watcher_t component. - CRLs have to be signed by a certificate that has the cRLSign keyUsage bit encoded (even if it's a CA), or a CA certificate without keyUsage extension. - Optional CA labels in EST server URIs are supported by `pki --est/estca`. - CMS-style signatures in PKCS#7 containers are supported by the pkcs7 and openssl plugins, which allows verifying RSA-PSS and ECDSA signatures. - Fixed a regression in the server implementation of EAP-TLS with TLS 1.2 or earlier that was introduced with 5.9.10. - Ensure the TLS handshake is complete in the EAP-TLS client with TLS <= 1.2. - kernel-libipsec can process raw ESP packets on Linux (disabled by default) and gained support for trap policies. - The dhcp plugin uses an alternate method to determine the source address for unicast DHCP requests that's not affected by interface filtering. - Certificate and trust chain selection as initiator has been improved in case the local trust chain is incomplete and an unrelated certreq is received. - ECDSA and EdDSA keys in IPSECKEY RRs are supported by the ipseckey plugin. - To bypass tunnel mode SAs/policies, the kernel-wfp plugin installs bypass policies also on the FWPM_SUBLAYER_IPSEC_TUNNEL sublayer. - Stale OCSP responses are now replace in-place in the certificate cache. - Fixed parsing of SCEP server capabilities by `pki --scep/scepca`. Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj

strongswan: add PACKAGECONFIG for the NetworkManager module

2023-05-11T18:28:34+00:00

Disabled by default. When enabled, a package 'strongswan-nm' gets created. The package naming follows Debian/Ubuntu. Signed-off-by: Petr Gotthard Signed-off-by: Khem Raj

strongswan: 5.9.9 -> 5.9.10

2023-03-06T16:41:13+00:00

Changelog: https://github.com/strongswan/strongswan/releases/tag/5.9.10 Signed-off-by: Yi Zhao Signed-off-by: Khem Raj

strongswan: upgrade 5.9.8 -> 5.9.9

2023-01-11T16:37:58+00:00

Changelog: https://github.com/strongswan/strongswan/releases/tag/5.9.9 Signed-off-by: Yi Zhao Signed-off-by: Khem Raj

strongswan: upgrade 5.9.7 -> 5.9.8

2022-10-08T18:36:57+00:00

ChangeLog: https://github.com/strongswan/strongswan/releases/tag/5.9.8 * Drop PACKAGECONFIG[scep] as scepclient has been removed. * Add plugin-gcm to RDEPENDS as gcm plugin has been added to the default plugins. Signed-off-by: Yi Zhao Signed-off-by: Khem Raj

strongswan: upgrade 5.9.6 -> 5.9.7

2022-08-06T16:40:09+00:00

ChangeLog: https://github.com/strongswan/strongswan/releases/tag/5.9.7 * Drop backport patch 0001-enum-Fix-compiler-warning.patch. * Update RDEPENDS to fix strongswan startup failures: plugin 'mgf1': failed to load - mgf1_plugin_create not found and no plugin file available plugin 'fips-prf': failed to load - fips_prf_plugin_create not found and no plugin file available plugin 'kdf': failed to load - kdf_plugin_create not found and no plugin file available plugin 'drbg': failed to load - drbg_plugin_create not found and no plugin file available Signed-off-by: Yi Zhao Signed-off-by: Khem Raj

strongswan: upgrade 5.9.5 -> 5.9.6

2022-07-02T15:37:03+00:00

* Drop backport patch 0001-openssl-Don-t-unload-providers.patch * Backport a patch to fix the build error: src/libstrongswan/utils/enum.c: In function 'enum_flags_to_string': src/libstrongswan/utils/enum.c:100:9: error: format not a string literal and no format arguments [-Werror=format-security] 100 | if (snprintf(buf, len, e->names[0]) >= len) | ^~ Signed-off-by: Yi Zhao Signed-off-by: Khem Raj