strongswan (5.9.13-2ubuntu4.24.04.4) noble-security; urgency=medium

  * SECURITY UPDATE: Double-Free When Destroying Certain Cloned Identities
    - debian/patches/CVE-2026-47895.patch: identification: Fix double-free when
      cloning empty IDs in src/libstrongswan/tests/suites/test_identification.c,
      src/libstrongswan/utils/identification.c.
    - CVE-2026-47895

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 27 May 2026 11:21:24 -0400

strongswan (5.9.13-2ubuntu4.24.04.3) noble-security; urgency=medium

  * SECURITY UPDATE: Infinite Loop When Handling Supported Versions TLS
    Extension
    - debian/patches/CVE-2026-35328.patch: prevent infinite loop if
      supported versions are too short in src/libtls/tls_server.c.
    - CVE-2026-35328
  * SECURITY UPDATE: NULL-Pointer Dereference When Processing Padding in
    PKCS#7
    - debian/patches/CVE-2026-35329.patch: avoid NULL pointer dereference
      when verifying padding in src/libstrongswan/crypto/pkcs5.c,
      src/libstrongswan/plugins/pkcs7/pkcs7_enveloped_data.c.
    - CVE-2026-35329
  * SECURITY UPDATE: Integer Underflow When Handling EAP-SIM/AKA Attributes
    - debian/patches/CVE-2026-35330.patch: reject zero-length EAP-SIM/AKA
      attributes in src/libsimaka/simaka_message.c.
    - CVE-2026-35330
  * SECURITY UPDATE: Accepting Certificates Violating Name Constraints
    - debian/patches/CVE-2026-35331.patch: case-insensitive matching and
      reject excluded DN name constraints in
      src/libstrongswan/plugins/constraints/constraints_validator.c,
      src/libstrongswan/tests/suites/test_certnames.c.
    - CVE-2026-35331
  * SECURITY UPDATE: NULL-Pointer Dereference When Handling ECDH Public
    Value in TLS
    - debian/patches/CVE-2026-35332.patch: only accept non-empty ECDH
      public keys with TLS < 1.3 in src/libtls/tls_server.c.
    - CVE-2026-35332
  * SECURITY UPDATE: Integer Underflow When Handling RADIUS Attributes
    - debian/patches/CVE-2026-35333.patch: reject undersized attributes in
      enumerator in src/libradius/radius_message.c.
    - CVE-2026-35333
  * SECURITY UPDATE: Possible NULL-Pointer Dereference in RSA Decryption
    - debian/patches/CVE-2026-35334.patch: avoid crash and timing leaks in
      PKCS#1 v1.5 decryption padding validation in
      src/libstrongswan/plugins/gmp/gmp_rsa_private_key.c,
      src/libstrongswan/utils/utils.h,
      src/libstrongswan/utils/utils/constant_time.h.
    - CVE-2026-35334

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 17 Apr 2026 16:00:25 -0400

strongswan (5.9.13-2ubuntu4.24.04.2) noble-security; urgency=medium

  * SECURITY UPDATE: Integer Underflow When Handling EAP-TTLS AVP
    - debian/patches/CVE-2026-25075.patch: prevent crash if AVP length
      header field is invalid in
      src/libcharon/plugins/eap_ttls/eap_ttls_avp.c.
    - CVE-2026-25075

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 11 Mar 2026 09:16:06 -0400

strongswan (5.9.13-2ubuntu4.24.04.1) noble-security; urgency=medium

  * SECURITY UPDATE: Buffer Overflow When Handling EAP-MSCHAPv2 Failure
    Requests
    - debian/patches/CVE-2025-62291.patch: fix length check for Failure
      Request packets on the client in
      src/libcharon/plugins/eap_mschapv2/eap_mschapv2.c.
    - CVE-2025-62291

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 21 Oct 2025 11:06:11 -0400

strongswan (5.9.13-2ubuntu4) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- William Grant <wgrant@ubuntu.com>  Mon, 01 Apr 2024 15:55:30 +1100

strongswan (5.9.13-2ubuntu3) noble; urgency=medium

  * No-change rebuild against libcurl4t64

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sat, 16 Mar 2024 07:03:41 +0000

strongswan (5.9.13-2ubuntu2) noble; urgency=medium

  * No-change rebuild against libssl3t64

 -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 04 Mar 2024 21:28:04 +0000

strongswan (5.9.13-2ubuntu1) noble; urgency=medium

  * Merge with Debian unstable (LP: #2050099). Remaining changes:
    - d/control: strongswan-starter hard-depends on strongswan-charon,
      therefore bump the dependency from Recommends to Depends. At the same
      time avoid a circular dependency by dropping
      strongswan-charon->strongswan-starter from Depends to Recommends as the
      binaries can work without the services but not vice versa.
    - re-add post-quantum encryption algorithm (NTRU) (LP #1863749)
      + d/control: mention plugins in package description
      + d/rules: enable ntru at build time
      + d/libstrongswan-extra-plugins.install: ship config and shared objects
    - Re-enable eap-{dynamic,peap} libcharon plugins (LP #1878887)
      + d/control: update libcharon-extra-plugins description.
      + d/libcharon-extra-plugins.install: install .so and conf files.
      + d/rules: add plugins to the configuration arguments.
    - Remove conf files of plugins removed from libcharon-extra-plugins
      + The conf file of the following plugins were removed: eap-aka-3gpp2,
        eap-sim-file, eap-sim-pcsc, eap-sim, eap-simaka-pseudonym,
        eap-simaka-reauth, eap-simaka-sql, xauth-noauth.
      + Created d/libcharon-extra-plugins.maintscript to handle the removals
        properly.
    - d/t/{control,host-to-host,utils}: new host-to-host test
      (LP #1999525)
    - d/usr.sbin.swanctl: allow "m" flag for /usr/sbin/swanctl
      (LP #1999935)

 -- Andreas Hasenack <andreas@canonical.com>  Mon, 22 Jan 2024 11:48:33 -0300

strongswan (5.9.13-2) unstable; urgency=medium

  * d/control: drop build-dep on systemd (Closes: #1060509)

 -- Yves-Alexis Perez <corsac@debian.org>  Sun, 21 Jan 2024 14:12:25 +0100

strongswan (5.9.13-1) unstable; urgency=medium

  * New upstream version 5.9.13

 -- Yves-Alexis Perez <corsac@debian.org>  Thu, 11 Jan 2024 17:09:17 +0100

strongswan (5.9.12-1ubuntu1) noble; urgency=medium

  * Merge with Debian unstable (LP: #2040430). Remaining changes:
    - d/control: strongswan-starter hard-depends on strongswan-charon,
      therefore bump the dependency from Recommends to Depends. At the same
      time avoid a circular dependency by dropping
      strongswan-charon->strongswan-starter from Depends to Recommends as the
      binaries can work without the services but not vice versa.
    - re-add post-quantum encryption algorithm (NTRU) (LP #1863749)
      + d/control: mention plugins in package description
      + d/rules: enable ntru at build time
      + d/libstrongswan-extra-plugins.install: ship config and shared objects
    - Re-enable eap-{dynamic,peap} libcharon plugins (LP #1878887)
      + d/control: update libcharon-extra-plugins description.
      + d/libcharon-extra-plugins.install: install .so and conf files.
      + d/rules: add plugins to the configuration arguments.
    - Remove conf files of plugins removed from libcharon-extra-plugins
      + The conf file of the following plugins were removed: eap-aka-3gpp2,
        eap-sim-file, eap-sim-pcsc, eap-sim, eap-simaka-pseudonym,
        eap-simaka-reauth, eap-simaka-sql, xauth-noauth.
      + Created d/libcharon-extra-plugins.maintscript to handle the removals
        properly.
    - d/t/{control,host-to-host,utils}: new host-to-host test
      (LP #1999525)
    - d/usr.sbin.swanctl: allow "m" flag for /usr/sbin/swanctl
      (LP #1999935)
  * Dropped:
    - SECURITY UPDATE: Buffer Overflow When Handling DH Public Values
      + debian/patches/CVE-2023-41913.patch: Validate DH public key to fix
        potential buffer overflow in
        src/charon-tkm/src/tkm/tkm_diffie_hellman.c.
      + CVE-2023-41913
      [Fixed upstream in 5.9.12]

 -- Andreas Hasenack <andreas@canonical.com>  Thu, 04 Jan 2024 10:25:23 -0300

strongswan (5.9.12-1) unstable; urgency=medium

  * New upstream version 5.9.12
    - includes fix for CVE-2023-41913 in charon-tkm
      Buffer Overflow When Handling DH Public Values
  * d/strongswan-pki.install: install pki --ocsp manpage

 -- Yves-Alexis Perez <corsac@debian.org>  Mon, 20 Nov 2023 22:19:21 +0100

strongswan (5.9.11-2) unstable; urgency=medium

  [ Helmut Grohne ]
  * Fix FTBFS when systemd.pc changes systemdsystemunitdir (Closes: #1052718)

 -- Yves-Alexis Perez <corsac@debian.org>  Mon, 13 Nov 2023 20:22:47 +0100

strongswan (5.9.11-1ubuntu2) noble; urgency=medium

  * SECURITY UPDATE: Buffer Overflow When Handling DH Public Values
    - debian/patches/CVE-2023-41913.patch: Validate DH public key to fix
      potential buffer overflow in
      src/charon-tkm/src/tkm/tkm_diffie_hellman.c.
    - CVE-2023-41913

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 07 Nov 2023 11:43:00 +0200

strongswan (5.9.11-1ubuntu1) mantic; urgency=medium

  * Merge with Debian unstable (LP: #2018113). Remaining changes:
    - d/control: strongswan-starter hard-depends on strongswan-charon,
      therefore bump the dependency from Recommends to Depends. At the same
      time avoid a circular dependency by dropping
      strongswan-charon->strongswan-starter from Depends to Recommends as the
      binaries can work without the services but not vice versa.
    - re-add post-quantum encryption algorithm (NTRU) (LP #1863749)
      + d/control: mention plugins in package description
      + d/rules: enable ntru at build time
      + d/libstrongswan-extra-plugins.install: ship config and shared objects
    - Re-enable eap-{dynamic,peap} libcharon plugins (LP #1878887)
      + d/control: update libcharon-extra-plugins description.
      + d/libcharon-extra-plugins.install: install .so and conf files.
      + d/rules: add plugins to the configuration arguments.
    - Remove conf files of plugins removed from libcharon-extra-plugins
      + The conf file of the following plugins were removed: eap-aka-3gpp2,
        eap-sim-file, eap-sim-pcsc, eap-sim, eap-simaka-pseudonym,
        eap-simaka-reauth, eap-simaka-sql, xauth-noauth.
      + Created d/libcharon-extra-plugins.maintscript to handle the removals
        properly.
    - d/t/{control,host-to-host,utils}: new host-to-host test
      (LP #1999525)
    - d/usr.sbin.swanctl: allow "m" flag for /usr/sbin/swanctl
      (LP #1999935)
  * Dropped:
    - SECURITY UPDATE: Incorrectly Accepted Untrusted Public Key With
      Incorrect Refcount
      + debian/patches/CVE-2023-26463.patch: fix authentication bypass and
        expired pointer dereference in src/libtls/tls_server.c.
      + CVE-2023-26463
      [Fixed upstream in 5.9.10]

 -- Andreas Hasenack <andreas@canonical.com>  Fri, 23 Jun 2023 14:05:18 -0300

strongswan (5.9.11-1) unstable; urgency=medium

  * New upstream version 5.9.10
  * d/patches: 0005-libtls-Fix-authentication-bypass-and-expired-pointer
    dropped, included upstream
  * New upstream version 5.9.11
  * d/patches: rebase against new upstream

 -- Yves-Alexis Perez <corsac@debian.org>  Sun, 18 Jun 2023 11:53:15 +0200

strongswan (5.9.8-4) unstable; urgency=medium

  * d/patches: libtls-Fix-authentication-bypass-and-expired-pointer added.
    Fix authentication bypass and use-after-free in libtls (CVE-2023-26463)
  * d/control: replace lsb-base dependency by sysvinit-utils
  * d/control: update standards version to 4.6.2

 -- Yves-Alexis Perez <corsac@debian.org>  Sun, 26 Feb 2023 09:40:09 +0100

strongswan (5.9.8-3ubuntu4) lunar; urgency=medium

  * d/t/utils: also give `cloud-init status --wait` the same amount of
    ${limit} seconds to complete, and bump limit to 5min. The logs show
    the container started up fine, with an IP.

 -- Andreas Hasenack <andreas@canonical.com>  Mon, 06 Mar 2023 11:00:58 -0300

strongswan (5.9.8-3ubuntu3) lunar; urgency=medium

  * SECURITY UPDATE: Incorrectly Accepted Untrusted Public Key With
    Incorrect Refcount
    - debian/patches/CVE-2023-26463.patch: fix authentication bypass and
      expired pointer dereference in src/libtls/tls_server.c.
    - CVE-2023-26463

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 02 Mar 2023 12:58:47 -0500

strongswan (5.9.8-3ubuntu2) lunar; urgency=medium

  * d/usr.sbin.swanctl: allow "m" flag for /usr/sbin/swanctl
    (LP: #1999935)

 -- Andreas Hasenack <andreas@canonical.com>  Fri, 16 Dec 2022 16:07:51 -0300

strongswan (5.9.8-3ubuntu1) lunar; urgency=medium

  * Merge with Debian unstable (LP: #1993449). Remaining changes:
    - d/control: strongswan-starter hard-depends on strongswan-charon,
      therefore bump the dependency from Recommends to Depends. At the same
      time avoid a circular dependency by dropping
      strongswan-charon->strongswan-starter from Depends to Recommends as the
      binaries can work without the services but not vice versa.
    - re-add post-quantum encryption algorithm (NTRU) (LP #1863749)
      + d/control: mention plugins in package description
      + d/rules: enable ntru at build time
      + d/libstrongswan-extra-plugins.install: ship config and shared objects
    - Re-enable eap-{dynamic,peap} libcharon plugins (LP #1878887)
      + d/control: update libcharon-extra-plugins description.
      + d/libcharon-extra-plugins.install: install .so and conf files.
      + d/rules: add plugins to the configuration arguments.
    - Remove conf files of plugins removed from libcharon-extra-plugins
      + The conf file of the following plugins were removed: eap-aka-3gpp2,
        eap-sim-file, eap-sim-pcsc, eap-sim, eap-simaka-pseudonym,
        eap-simaka-reauth, eap-simaka-sql, xauth-noauth.
      + Created d/libcharon-extra-plugins.maintscript to handle the removals
        properly.
  * Dropped:
    - SECURITY UPDATE: Using Untrusted URIs for Revocation Checking
      + debian/patches/CVE-2022-40617.patch: do online revocation checks only
        after basic trust chain validation in
        src/libstrongswan/credentials/credential_manager.c.
      + CVE-2022-40617
        [Included upstream in 5.9.8]
  * Added:
    - d/t/{control,host-to-host,utils}: new host-to-host test
      (LP: #1999525)

 -- Andreas Hasenack <andreas@canonical.com>  Tue, 13 Dec 2022 11:04:24 -0300

strongswan (5.9.8-3) unstable; urgency=medium

  * d/tests: also drop _copyright test since the util is gone as well

 -- Yves-Alexis Perez <corsac@debian.org>  Thu, 03 Nov 2022 18:17:42 +0100

strongswan (5.9.8-2) unstable; urgency=medium

  * d/tests: remove scepclient tests since it's gone (Closes: #1023224)

 -- Yves-Alexis Perez <corsac@debian.org>  Thu, 03 Nov 2022 13:05:27 +0100

strongswan (5.9.8-1) unstable; urgency=medium

  * New upstream version 5.9.8
    - Includes fix for  CVE-2022-40617, denial of service due to the
    revocation plugin potentially using untrusted OCSP URIs and CRL
    distribution points in CRLs. (closes: #1021271)
  * Remove strongswan-scepclient package, replaced by a pki(1) command
  * d/p/0006-fix-format-string-issue-in-enum_flags_to_string dropped, included
    upstream
  * remove dropped _copyright utility
  * d/strongswan-pki.install: install est/estca manpages (RFC 7070)
  * d/s-{started,swanctl}.lintian-overrides updated for new lintian
  * d/copyright updated for new upstream release

 -- Yves-Alexis Perez <corsac@debian.org>  Wed, 05 Oct 2022 15:25:18 +0200

strongswan (5.9.6-1ubuntu2) kinetic; urgency=medium

  * SECURITY UPDATE: Using Untrusted URIs for Revocation Checking
    - debian/patches/CVE-2022-40617.patch: do online revocation checks only
      after basic trust chain validation in
      src/libstrongswan/credentials/credential_manager.c.
    - CVE-2022-40617

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 05 Oct 2022 08:11:03 -0400

strongswan (5.9.6-1ubuntu1) kinetic; urgency=medium

  * Merge with Debian unstable (LP: #1971328). Remaining changes:
    - d/control: strongswan-starter hard-depends on strongswan-charon,
      therefore bump the dependency from Recommends to Depends. At the same
      time avoid a circular dependency by dropping
      strongswan-charon->strongswan-starter from Depends to Recommends as the
      binaries can work without the services but not vice versa.
    - re-add post-quantum encryption algorithm (NTRU) (LP #1863749)
      + d/control: mention plugins in package description
      + d/rules: enable ntru at build time
      + d/libstrongswan-extra-plugins.install: ship config and shared objects
    - Re-enable eap-{dynamic,peap} libcharon plugins (LP #1878887)
      + d/control: update libcharon-extra-plugins description.
      + d/libcharon-extra-plugins.install: install .so and conf files.
      + d/rules: add plugins to the configuration arguments.
    - Remove conf files of plugins removed from libcharon-extra-plugins
      + The conf file of the following plugins were removed: eap-aka-3gpp2,
        eap-sim-file, eap-sim-pcsc, eap-sim, eap-simaka-pseudonym,
        eap-simaka-reauth, eap-simaka-sql, xauth-noauth.
      + Created d/libcharon-extra-plugins.maintscript to handle the removals
        properly.
  * Dropped:
    - d/p/lp1964977-fix-ipsec-pki-segfault.patch: Fix "ipsec pki"
      segmentation fault; don't access OpenSSL objects inside atexit()
      handlers. (LP #1964977)
      [included by upstream in version 5.9.6]

 -- Lucas Kanashiro <kanashiro@ubuntu.com>  Fri, 10 Jun 2022 15:03:17 -0300

strongswan (5.9.6-1) unstable; urgency=medium

  * New upstream version 5.9.6
  * d/p/0006-fix-format-string-issue-in-enum_flags_to_string added
  * d/libstrongswan.install: install kdf plugin in libstrongswan

 -- Yves-Alexis Perez <corsac@debian.org>  Sat, 07 May 2022 20:19:18 +0200

strongswan (5.9.5-2ubuntu2) jammy; urgency=medium

  * d/p/lp1964977-fix-ipsec-pki-segfault.patch: Fix "ipsec pki"
    segmentation fault; don't access OpenSSL objects inside atexit()
    handlers. (LP: #1964977)

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Fri, 18 Mar 2022 14:24:34 -0400

strongswan (5.9.5-2ubuntu1) jammy; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - d/control: strongswan-starter hard-depends on strongswan-charon,
      therefore bump the dependency from Recommends to Depends. At the same
      time avoid a circular dependency by dropping
      strongswan-charon->strongswan-starter from Depends to Recommends as the
      binaries can work without the services but not vice versa.
    - re-add post-quantum encryption algorithm (NTRU) (LP #1863749)
      + d/control: mention plugins in package description
      + d/rules: enable ntru at build time
      + d/libstrongswan-extra-plugins.install: ship config and shared objects
    - Re-enable eap-{dynamic,peap} libcharon plugins (LP: 1878887)
      + d/control: update libcharon-extra-plugins description.
      + d/libcharon-extra-plugins.install: install .so and conf files.
      + d/rules: add plugins to the configuration arguments.
    - Remove conf files of plugins removed from libcharon-extra-plugins
      + The conf file of the following plugins were removed: eap-aka-3gpp2,
        eap-sim-file, eap-sim-pcsc, eap-sim, eap-simaka-pseudonym,
        eap-simaka-reauth, eap-simaka-sql, xauth-noauth.
      + Created d/libcharon-extra-plugins.maintscript to handle the removals
        properly.
   * Dropped patches included in new version:
    - debian/patches/CVE-2021-45079.patch
    - debian/patches/load-legacy-provider-in-openssl3.patch

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 03 Feb 2022 10:49:49 -0500

strongswan (5.9.5-2) unstable; urgency=medium

  * actually fix lintian overrides

 -- Yves-Alexis Perez <corsac@debian.org>  Wed, 26 Jan 2022 16:29:17 +0100

strongswan (5.9.5-1) unstable; urgency=medium

  * New upstream version 5.9.5
    - eap-authenticator: Enforce failure if MSK generation fails
      Fix incorrect handling of Early EAP-Success Messages (CVE-2021-45079)
  * update lintian overrides to match RUNPATH

 -- Yves-Alexis Perez <corsac@debian.org>  Wed, 26 Jan 2022 14:38:54 +0100

strongswan (5.9.4-1ubuntu4) jammy; urgency=medium

  * SECURITY UPDATE: Incorrect Handling of Early EAP-Success Messages
    - debian/patches/CVE-2021-45079.patch: enforce failure if MSK
      generation fails in src/libcharon/plugins/eap_gtc/eap_gtc.c,
      src/libcharon/plugins/eap_md5/eap_md5.c,
      src/libcharon/plugins/eap_radius/eap_radius.c,
      src/libcharon/sa/eap/eap_method.h,
      src/libcharon/sa/ikev2/authenticators/eap_authenticator.c.
    - CVE-2021-45079

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 01 Feb 2022 07:23:37 -0500

strongswan (5.9.4-1ubuntu3) jammy; urgency=medium

  * No-change rebuild against libssl3

 -- Steve Langasek <steve.langasek@ubuntu.com>  Thu, 09 Dec 2021 00:19:38 +0000

strongswan (5.9.4-1ubuntu2) jammy; urgency=medium

  * Add d/p/load-legacy-provider-in-openssl3.patch.
    Upstream cherry-pick to fix FTBFS against OpenSSL 3.0. (LP: #1946213)

 -- Paride Legovini <paride@ubuntu.com>  Wed, 17 Nov 2021 17:04:27 +0100

strongswan (5.9.4-1ubuntu1) jammy; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - d/control: strongswan-starter hard-depends on strongswan-charon,
      therefore bump the dependency from Recommends to Depends. At the same
      time avoid a circular dependency by dropping
      strongswan-charon->strongswan-starter from Depends to Recommends as the
      binaries can work without the services but not vice versa.
    - re-add post-quantum encryption algorithm (NTRU) (LP #1863749)
      + d/control: mention plugins in package description
      + d/rules: enable ntru at build time
      + d/libstrongswan-extra-plugins.install: ship config and shared objects
    - Re-enable eap-{dynamic,peap} libcharon plugins (LP: 1878887)
      + d/control: update libcharon-extra-plugins description.
      + d/libcharon-extra-plugins.install: install .so and conf files.
      + d/rules: add plugins to the configuration arguments.
    - Remove conf files of plugins removed from libcharon-extra-plugins
      + The conf file of the following plugins were removed: eap-aka-3gpp2,
        eap-sim-file, eap-sim-pcsc, eap-sim, eap-simaka-pseudonym,
        eap-simaka-reauth, eap-simaka-sql, xauth-noauth.
      + Created d/libcharon-extra-plugins.maintscript to handle the removals
        properly.
  * Dropped changes:
    - Compile the tpm plugin against the tpm2 software stack (tss2).
      Merged in Debian (5.9.4-1).

 -- Paride Legovini <paride@ubuntu.com>  Fri, 12 Nov 2021 12:34:30 +0100

strongswan (5.9.4-1) unstable; urgency=medium

  [ Paride Legovini ]
  * tpm plugin: compile against the tpm2 software stack (tss2)
    (Closes: #994396, Ubuntu#1940079)

  [ Yves-Alexis Perez ]
  * New upstream version 5.9.4
  * d/patches rebased against new upstream
  * Enable forecast plugin (Closes: #943457)
  * update lintian overrides for new lintian
  * d/control: update standards version to 4.6.0
  * d/s-starter.postrm: use which to check for command existence

 -- Yves-Alexis Perez <corsac@debian.org>  Tue, 19 Oct 2021 22:34:40 +0200

strongswan (5.9.1-1ubuntu3.1) impish-security; urgency=medium

  * SECURITY UPDATE: Integer Overflow in gmp Plugin
    - debian/patches/CVE-2021-41990.patch: reject RSASSA-PSS params with
      negative salt length in
      src/libstrongswan/credentials/keys/signature_params.c,
      src/libstrongswan/plugins/gmp/gmp_rsa_public_key.c.
    - CVE-2021-41990
  * SECURITY UPDATE: Integer Overflow When Replacing Certificates in Cache
    - debian/patches/CVE-2021-41991.patch: prevent crash due to integer
      overflow/sign change in
      src/libstrongswan/credentials/sets/cert_cache.c.
    - CVE-2021-41991

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 18 Oct 2021 13:10:30 -0400

strongswan (5.9.1-1ubuntu3) impish; urgency=medium

  * Compile the tpm plugin against the tpm2 software stack (tss2)
    (Debian packaging cherry-pick, LP: #1940079)
    - d/rules: add the --enable-tss-tss2 configure flag
    - d/control: add Build-Depends: libtss2-dev

 -- Paride Legovini <paride@ubuntu.com>  Thu, 16 Sep 2021 11:40:38 +0200

strongswan (5.9.1-1ubuntu2) impish; urgency=medium

  * No-change rebuild due to OpenLDAP soname bump.

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Mon, 21 Jun 2021 18:09:22 -0400

strongswan (5.9.1-1ubuntu1) hirsute; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - d/control: strongswan-starter hard-depends on strongswan-charon,
      therefore bump the dependency from Recommends to Depends. At the same
      time avoid a circular dependency by dropping
      strongswan-charon->strongswan-starter from Depends to Recommends as the
      binaries can work without the services but not vice versa.
    - re-add post-quantum encryption algorithm (NTRU) (LP: 1863749)
      + d/control: mention plugins in package description
      + d/rules: enable ntru at build time
      + d/libstrongswan-extra-plugins.install: ship config and shared objects
    - Re-enable eap-{dynamic,peap} libcharon plugins (LP: 1878887)
      + d/control: update libcharon-extra-plugins description.
      + d/libcharon-extra-plugins.install: install .so and conf files.
      + d/rules: add plugins to the configuration arguments.
    - Remove conf files of plugins removed from libcharon-extra-plugins
      + The conf file of the following plugins were removed: eap-aka-3gpp2,
        eap-sim-file, eap-sim-pcsc, eap-sim, eap-simaka-pseudonym,
        eap-simaka-reauth, eap-simaka-sql, xauth-noauth.
      + Created d/libcharon-extra-plugins.maintscript to handle the removals
        properly.

 -- Christian Ehrhardt <christian.ehrhardt@canonical.com>  Tue, 19 Jan 2021 12:39:11 +0100

strongswan (5.9.1-1) unstable; urgency=medium

  * New upstream version 5.9.1
  * d/patches: rebase against new upstream version
  * d/watch: update to version 4

 -- Yves-Alexis Perez <corsac@debian.org>  Wed, 11 Nov 2020 17:54:34 +0100

strongswan (5.9.0-1) unstable; urgency=medium

  * New upstream version 5.9.0

 -- Yves-Alexis Perez <corsac@debian.org>  Thu, 17 Sep 2020 10:21:30 +0200

strongswan (5.8.4-1ubuntu2) groovy; urgency=medium

  * Re-enable eap-{dynamic,peap} libcharon plugins (LP: #1878887)
    - d/control: update libcharon-extra-plugins description.
    - d/libcharon-extra-plugins.install: install .so and conf files.
    - d/rules: add plugins to the configuration arguments.
  * Remove conf files of plugins removed from libcharon-extra-plugins
    - The conf file of the following plugins were removed: eap-aka-3gpp2,
      eap-sim-file, eap-sim-pcsc, eap-sim, eap-simaka-pseudonym,
      eap-simaka-reauth, eap-simaka-sql, xauth-noauth.
    - Created d/libcharon-extra-plugins.maintscript to handle the removals
      properly.

 -- Lucas Kanashiro <kanashiro@ubuntu.com>  Thu, 21 May 2020 14:53:05 -0300

strongswan (5.8.4-1ubuntu1) groovy; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - d/control: strongswan-starter hard-depends on strongswan-charon,
      therefore bump the dependency from Recommends to Depends. At the same
      time avoid a circular dependency by dropping
      strongswan-charon->strongswan-starter from Depends to Recommends as the
      binaries can work without the services but not vice versa.
    - re-add post-quantum encryption algorithm (NTRU) (LP: 1863749)
      + d/control: mention plugins in package description
      + d/rules: enable ntru at build time
      + d/libstrongswan-extra-plugins.install: ship config and shared objects
  * Dropped:
    - d/control: build-depend on libiptc-dev to avoid FTBFS (LP: #1861975)
      This is needed due to changes in regard to Debian bug 947176 and 939243
      and can later be dropped again.
      [applied by Debian in version 5.8.2-2]
    - d/control: Transition from former Ubuntu only libcharon-standard-plugins
      to common libcharon-extauth-plugins (drop after 20.04)
    - d/control: Transition from strongswan-tnc-* being in extra packages
      to libcharon-extra-plugins (drop after 20.04)

 -- Lucas Kanashiro <lucas.kanashiro@canonical.com>  Thu, 30 Apr 2020 18:06:55 -0300

strongswan (5.8.4-1) unstable; urgency=medium

  * New upstream version 5.8.4 (Closes: #956446)
  * d/rules: drop --as-needed from linker flags
  * d/control: update standards version to 4.5.0

 -- Yves-Alexis Perez <corsac@debian.org>  Thu, 30 Apr 2020 08:57:26 +0200

strongswan (5.8.2-2) unstable; urgency=medium

  * d/control: replace libip{4,6}tc-dev by libiptc-dev (Closes: #951016)
  * d/copyright updated

 -- Yves-Alexis Perez <corsac@debian.org>  Thu, 13 Feb 2020 22:46:40 +0100

strongswan (5.8.2-1ubuntu3) focal; urgency=medium

  * Reverting part of 5.8.2-1ubuntu2 changes to remove BLISS again as
    there is a potential local side-channel attack on strongSwan's BLISS
    implementation (https://eprint.iacr.org/2017/505). (LP: #1866765)

 -- Christian Ehrhardt <christian.ehrhardt@canonical.com>  Tue, 10 Mar 2020 07:56:56 +0100

strongswan (5.8.2-1ubuntu2) focal; urgency=medium

  * re-add post-quantum computer signature scheme (BLISS) and encryption
    algorithm (NTRU) as well as the dependent nttfft library (LP: #1863749)
    - d/control: mention plugins in package description
    - d/rules: enable ntru and bliss at build time
    - d/libstrongswan-extra-plugins.install: ship config and shared objects

 -- Christian Ehrhardt <christian.ehrhardt@canonical.com>  Wed, 04 Mar 2020 07:54:26 +0100

strongswan (5.8.2-1ubuntu1) focal; urgency=medium

  * Merge with Debian unstable (LP: #1861971). Remaining changes:
    - d/control: Transition from strongswan-tnc-* being in extra packages
      to libcharon-extra-plugins (drop after 20.04)
    - d/control: Transition from former Ubuntu only libcharon-standard-plugins
      to common libcharon-extauth-plugins (drop after 20.04)
    - d/control: strongswan-starter hard-depends on strongswan-charon,
      therefore bump the dependency from Recommends to Depends. At the same
      time avoid a circular dependency by dropping
      strongswan-charon->strongswan-starter from Depends to Recommends as the
      binaries can work without the services but not vice versa.
  * Added Changes
    - d/control: build-depend on libiptc-dev to avoid FTBFS (LP: #1861975)
      This is needed due to changes in regard to Debian bug 947176 and 939243
      and can later be dropped again.

 -- Christian Ehrhardt <christian.ehrhardt@canonical.com>  Wed, 05 Feb 2020 08:28:30 +0100

strongswan (5.8.2-1) unstable; urgency=medium

  [ Jean-Michel Vourgère ]
  * README.Debian: Fixed typo

  [ Yves-Alexis Perez ]
  * d/control: replace iptables-dev b-dep by libip{4,6}tc-dev (Closes: #946148)
  * d/watch: use uscan special strings
  * New upstream version 5.8.2
  * d/control: update dh compat level to 12
  * strongswan-nm: update path for dbus service file
  * install DRBG plugin to libstrongswan
  * d/control: add ${misc:Pre-Depends} to strongswan-starter

 -- Yves-Alexis Perez <corsac@debian.org>  Wed, 01 Jan 2020 14:35:46 +0100

strongswan (5.8.1-1ubuntu1) focal; urgency=medium

  * Merge with Debian unstable (LP: #1852579). Remaining changes:
    - d/control: Transition from strongswan-tnc-* being in extra packages
      to libcharon-extra-plugins
  * Added Changes:
    - d/control: Transition from former Ubuntu only libcharon-standard-plugins
      to common libcharon-extauth-plugins (drop after 20.04)
    - d/control: strongswan-starter hard-depends on strongswan-charon,
      therefore bump the dependency from Recommends to Depends. At the same
      time avoid a circular dependency by dropping
      strongswan-charon->strongswan-starter from Depends to Recommends as the
      binaries can work without the services but not vice versa.
  * Dropped Changes (now in Debian):
    - Clean up d/strongswan-starter.postinst: section about runlevel changes
    - Clean up d/strongswan-starter.postinst: Removed entire section on
      opportunistic encryption disabling - this was never in strongSwan and
      won't be see upstream issue #2160.
    - d/rules: Removed patching ipsec.conf on build (not using the
      debconf-managed config.)
    - d/ipsec.secrets.proto: Removed ipsec.secrets.inc reference (was
      used for debconf-managed include of private key).
    - Add plugin kernel-libipsec to allow the use of strongswan in containers
      via this userspace implementation (please do note that this is still
      considered experimental by upstream).
      + d/libcharon-extra-plugins.install: Add kernel-libipsec components
      + d/control: List kernel-libipsec plugin at extra plugins description
      + d/p/dont-load-kernel-libipsec-plugin-by-default.patch: As
        upstream recommends to not load kernel-libipsec by default.
    - d/control: Mention mgf1 plugin which is in libstrongswan now
    - Complete the disabling of libfast; This was partially accepted in Debian,
      it is no more packaging medcli and medsrv, but still builds and
      mentions it.
      + d/rules: Add --disable-fast to avoid build time and dependencies
      + d/control: Remove medcli, medsrv from package description
    - Add now built (since 5.5.1) libraries libtpmtss and nttfft to
      libstrongswan-extra-plugins (no deps from default plugins).
    - d/control, d/libcharon-{extras,standard}-plugins.install: Move charon
      plugins for the most common use cases from extra-plugins into a new
      standard-plugins package. This will allow those use cases without pulling
      in too much more plugins (a bit like the tnc package). Recommend that
      package from strongswan-libcharon.
    - d/usr.lib.ipsec.charon: allow reading of own FDs (LP 1786250)
    - d/usr.sbin.charon-systemd: allow CLUSTERIP for ha plugin (LP 1773956)
    - executables need to be able to read map and execute themselves otherwise
      execution in some environments e.g. containers is blocked (LP 1780534)
      + d/usr.lib.ipsec.stroke: add rmix permission to stroke binary
      + d/usr.lib.ipsec.lookip: add rmix permission to lookip binary
    - d/usr.lib.ipsec.charon, d/usr.sbin.charon-systemd: resync apparmor
      profiles of both ways to start charon (LP 1807664)
    - d/usr.sbin.swanctl: add apparmor rule for af-alg plugin (LP 1807962)
    - We fixed up tpmtss and nttfft in the past, but tpmtss is now packaged in
      Debian so this part was be dropped. Two changes remain
      - d/control: fix the mentioning of tpmtss in d/control
    - apparmor fixes for container and root usage (LP 1826238)
      + d/usr.sbin.swanctl: allow reading own binary
      + d/usr.sbin.charon-systemd: allow accessing the binary
      + d/usr.sbin.swanctl: add attach_disconnected to work inside containers
      + d/usr.lib.ipsec.charon, d/usr.sbin.charon-systemd: add CAP_SETPCAP
        to apparmor to allow dropping caps
  * Dropped Changes (too uncommon to support by default)
    - d/libstrongswan.install: Add kernel-netlink configuration files
    - d/usr.sbin.charon-systemd: allow to contact mysql for sql and
      attr-sql plugins (LP 1766240) - no more needed as itisn't enabled.
    - Mass enablement of extra plugins and features to allow a user to use
      strongswan for a variety of extra use cases without having to rebuild.
      + d/control: Add required additional build-deps
      + d/control: Mention addtionally enabled plugins
      + d/rules: Enable features at configure stage
      + d/libbstrongswan-extra-plugins.install: Add plugins (so, lib, conf)
      + d/libstrongswan.install: Add plugins (so, conf)
      + d/strongswan-starter.install: Install pool feature, which is useful
        since we now have attr-sql plugin enabled it.
    - Enable additional TNC plugins and add them to libcharon-extra-plugins

 -- Christian Ehrhardt <christian.ehrhardt@canonical.com>  Thu, 14 Nov 2019 15:00:15 +0100

strongswan (5.8.1-1) unstable; urgency=medium

  * d/rules: disable http and stream tests under CI
  * New upstream version 5.8.1

 -- Yves-Alexis Perez <corsac@debian.org>  Fri, 18 Oct 2019 16:44:27 +0200

strongswan (5.8.0-2) unstable; urgency=medium

  [ Christian Ehrhardt ]
  * d/control: Mention mgf1 plugin which is in libstrongswan now
  * Complete the disabling of libfast
  * Clean up d/strongswan-starter.postinst: section about runlevel changes
  * Clean up d/strongswan-starter.postinst: opportunistic encryption
  * Enable kernel-libipsec for use of strongswan in containers
  * d/control, d/libcharon-{extras,extauth}-plugins.install: Add
    extauth-plugins package (Recommends)
  * apparmor: d/usr.lib.ipsec.charon: sync notify rule from charon-systemd
  * apparmor: fix apparmor denies reading the own FDs (LP: 1786250)
  * apparmor: d/usr.sbin.charon-systemd: allow CLUSTERIP for ha plugin
    (LP: 1773956)
  * apparmor: d/usr.lib.ipsec.stroke: executables need to be able to read map
    and execute themselves
  * apparmor: d/usr.lib.ipsec.lookip: executables need to be able to read map
    and execute themselves
  * apparmor: d/usr.sbin.swanctl: add apparmor rule for af-alg plugin
    (LP: 1807962)
  * d/control: libtpmtss is actually packaged in libstrongswan-extra-plugins

  [ Ryan Harper ]
  * Remove code related to unused debconf managed config

  [ Yves-Alexis Perez ]
  * ship xfrmi only on Linux, fix FTBFS on kfreebsd
  * d/libcharon-extra-plugins.install: drop plugins disabled in Debian
  * d/control: update standards version to 4.4.1
  * d/strongswan-starter.templates: drop runlevel_changes
  * let dh_installinit handle update-rc.d calls
  * d/salsa-ci.yml: add a salsa pipeline config
  * d/rules: drop dbgsym migration
  * strongswan-starter: update line number in lintian override

 -- Yves-Alexis Perez <corsac@debian.org>  Sat, 05 Oct 2019 15:03:59 +0200

strongswan (5.8.0-1) unstable; urgency=medium

  [ Christian Ehrhardt ]
  * Fix fails in debian CI (Closes: #926479)

  [ Simon Deziel ]
  * d/usr.lib.ipsec.charon, d/usr.sbin.charon-systemd: add CAP_SETPCAP to
    apparmor to allow dropping caps
  * d/usr.sbin.swanctl: add attach_disconnected to work inside containers
  * d/usr.sbin.charon-systemd: allow accessing the binary
  * d/usr.sbin.swanctl: allow reading own binary

  [ Yves-Alexis Perez ]
  * New upstream version 5.8.0
  * d/control: update standards version to 4.4.0
  * use debhelper-compat b-d for dh compat level
  * d/control: bump dh compat level to 11
  * d/rules: drop systemd addon, useless in compat 11
  * strongswan-libcharon: install xfrmi binary
  * d/patches refreshed for new upstream release
  * handle renaming of systemd service files
  * d/control: remove obsolete breaks/replaces

 -- Yves-Alexis Perez <corsac@debian.org>  Mon, 26 Aug 2019 12:58:23 +0200

strongswan (5.7.2-1ubuntu3) eoan; urgency=medium

  * No change rebuild for libmysqlclient21.

 -- Christian Ehrhardt <christian.ehrhardt@canonical.com>  Thu, 15 Aug 2019 09:34:34 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libstrongswan`.
