Project

General

Profile

Actions
Copy link

Todo #16509

open

Update strongSwan

Added by Silmor Senedlen 3 days ago. Updated 3 days ago.

Status:
New
Priority:
Normal
Assignee:
-
Category:
IPsec
Target version:
2.9.0
Start date:
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
25.11
Release Notes:
Default

Description

Good day
Since current version(5.9.14 / March 2024), there are already 1 major and 3 minor releases.
https://github.com/strongswan/strongswan/releases

There are plenty of improvements, bug fixes and new features.
Some of them:

- Add PQC key exchange method ML-KEM support (but only for OpenSSL 3.5.0+ or other crypto libs)
- Multiple Key Exchanges for IKEv2
- Handling of CHILD_SA rekey collisions has been improved
- IKE ports are now considered when matching connections

- IKE fragment sizes can be configured for each address family explicitly

- TUN devices can properly handle IPv6 addresses and routes via them are now correctly installed on FreeBSD
- When deciding whether to send a DPD, inbound traffic on Child SAs is now ignored unless UDP-encapsulation is used. Without UDP-encapsulation, the IKE and IPsec traffic is not directly related (other than via IPs). So firewalls might not keep the state for IKE/UDP traffic alive if constant IPsec traffic prevents DPDs from getting exchanged.

Also fix(in 6.0.3) vulnerability in eap-mschapv2 plugin (CVE-2025-62291), but impact varies by compile options:
https://www.strongswan.org/blog/2025/10/27/strongswan-vulnerability-(cve-2025-62291).html

Actions
Copy link
 #1

Updated by Marcos M 3 days ago

  • Subject changed from Update swtongSwan to 6.0.3 to Update strongswan to 6.0.3
Actions
Copy link
 #2

Updated by Jim Pingle 3 days ago

  • Subject changed from Update strongswan to 6.0.3 to Update strongSwan
  • Target version set to 2.9.0
  • Plus Target Version set to 25.11

We try not to put a specific version in the titles of these, odds are they could change again before a release.

Actions
Copy link
 #3

Updated by Silmor Senedlen 3 days ago

Jim Pingle wrote in #note-2:

We try not to put a specific version in the titles of these, odds are they could change again before a release.

Got it, I'll keep it in mind.
Thx

Actions
Copy link
 #4

Updated by Jim Pingle 3 days ago

After a deeper reading of the CVE on the new strongSwan release, it would not apply to strongSwan on pfSense software. There is no support for configuring strongSwan on pfSense software as an EAP client to a remote server, and the client role is the only role that is vulnerable.

We are still going to update strongSwan for the next release, but existing versions are not affected.

Actions
Copy link

Also available in: Atom PDF