strongswan: Fail to build against OpenSSL 3.0

The upstream bug I just linked affects 5.9.4-1 which I'm currently merging from Debian.

Apparently this is an OpenSSL 3 bug uncovered by the strongswan testsuite:

https://github.com/openssl/openssl/issues/17017

It's actively being worked on upstream.

I've just uploaded a new version to my PPA, with a patch from https://github.com/openssl/openssl/pull/17041 that should fix this.

Thanks! I'll re-test the strongswan build once 3.0.0-1ubuntu1~ppa2 gets published in the PPA.

With openssl 3.0.0-1ubuntu1~ppa2 the ed25519_fail issue is fixed, but we then hit another (unrelated) test failure. I reported it upstream here:

https://github.com/strongswan/strongswan/issues/759

Issue #735 has been closed as it's actually an OpenSSL bug (and we already have a task for that). I'm making this track #759 instead.

This bug was fixed in the package strongswan - 5.9.4-1ubuntu2

---------------
strongswan (5.9.4-1ubuntu2) jammy; urgency=medium

  * Add d/p/load-legacy-provider-in-openssl3.patch.
    Upstream cherry-pick to fix FTBFS against OpenSSL 3.0. (LP: #1946213)

 -- Paride Legovini <email address hidden> Wed, 17 Nov 2021 17:04:27 +0100

This bug was fixed in the package openssl - 3.0.0-1ubuntu1

---------------
openssl (3.0.0-1ubuntu1) jammy; urgency=medium

  * Manual merge of version 3.0.0-1 from Debian experimental, remaining
    changes:
    - Replace duplicate files in the doc directory with symlinks.
    - debian/libssl1.1.postinst:
      + Display a system restart required notification on libssl1.1
        upgrade on servers, unless needrestart is available.
      + Use a different priority for libssl1.1/restart-services depending
        on whether a desktop, or server dist-upgrade is being performed.
      + Skip services restart & reboot notification if needrestart is in-use.
      + Bump version check to to 1.1.1.
      + Import libraries/restart-without-asking template as used by above.
    - Revert "Enable system default config to enforce TLS1.2 as a
      minimum" & "Increase default security level from 1 to 2".
    - Reword the NEWS entry, as applicable on Ubuntu.
    - Set OPENSSL_TLS_SECURITY_LEVEL=2 as compiled-in minimum security
      level. Change meaning of SECURITY_LEVEL=2 to prohibit TLS versions
      below 1.2 and update documentation. Previous default of 1, can be set
      by calling SSL_CTX_set_security_level(), SSL_set_security_level() or
      using ':@SECLEVEL=1' CipherString value in openssl.cfg.
    - Add support for building with noudeb build profile.
  * d/p/Don-t-create-an-ECX-key-with-short-keys.patch:
    Backported from upstream to fix a regression with short keys (LP: #1946213)
  * d/p/Add-null-digest-implementation-to-the-default-provid.patch:
    Backported from upstream to fix a compatibility issue with 1.1.1l
  * Manually call dh_installdirs to fix build failure
  * Drop some Ubuntu patches merged upstream
    + The s390x series (00xx) has been applied upstream
    + The lp-1927161 Intel CET series has been applied upstream
    + CVE-2021-3449 has been fixed upstream
    + CVE-2021-3450 doesn't apply to 3.0 branch
  * Refresh and adapt the remaining patches

openssl (3.0.0-1) experimental; urgency=medium

  * Import 3.0.0.
  * Add avr32, patch by Vineet Gupta (Closes: #989442).

openssl (3.0.0~~beta2-1) experimental; urgency=medium

  * Import 3.0.0-beta2.

openssl (3.0.0~~beta1-1) experimental; urgency=medium

  * Import 3.0.0-beta1.
  * Use HARNESS_VERBOSE again (otherwise the test suite might killed since no
    progress is visible).

openssl (3.0.0~~alpha16-1) experimental; urgency=medium

  * Import 3.0.0-alpha16.
  * Use VERBOSE_FAILURE to log only failures in the build log.

openssl (3.0.0~~alpha15-1) experimental; urgency=medium

  * Import 3.0.0-alpha15.

openssl (3.0.0~~alpha13-2) experimental; urgency=medium

  * Add a proposed patch from upstream to skip negativ errno number in the
    testsuite to pass the testsute on hurd.
  * Always link against libatomic.

openssl (3.0.0~~alpha13-1) experimental; urgency=medium

  * Import 3.0.0-alpha13.
  * Move configuration.h to architecture specific include folder. Patch from
    Antonio Terceiro (Closes: #985555).
  * Enable LFS. Thanks to Dan Nicholson for debugging (Closes: #923479).
  * drop `lsof', the testsuite is not using it anymore.
  * Enable ktls.

openssl (3.0.0~~al...

The upstream commit [1] included as a patch in strongswan (5.9.4-1ubuntu2) should be released in strongswan 5.9.5 [2].

[1] https://github.com/strongswan/strongswan/commit/b158c08c4b919b878ded10bb57e969ed7b3cabc3
[2] https://github.com/strongswan/strongswan/milestone/3?closed=1