Merge ~lucaskanashiro/ubuntu/+source/strongswan:focal-bug-fixes into ubuntu/+source/strongswan:ubuntu/focal-devel

[Lucas Kanashiro]

Fix the following 2 bugs in Focal:

https://bugs.launchpad.net/ubuntu/+source/strongswan/+bug/1878887
https://bugs.launchpad.net/ubuntu/+source/strongswan/+bug/1879692

Here is a PPA with the proposed package:

https://launchpad.net/~lucaskanashiro/+archive/ubuntu/focal-strongswan-bug-fixes/+packages

No regression reported by autopkgtest:

autopkgtest [18:24:34]: @@@@@@@@@@@@@@@@@@@@ summary
admin-strongswan-charon PASS
admin-strongswan-starter PASS
daemon PASS
plugins PASS

[Christian Ehrhardt  (paelzer)]

For the conffile handling the same comment as https://code.launchpad.net/~lucaskanashiro/ubuntu/+source/strongswan/+git/strongswan/+merge/384385/comments/1009777 applies

review: Needs Fixing

[Christian Ehrhardt  (paelzer)]

+1 on adding plugins back and that this should make sense even in the SRU context.

+1 on the fixes for "chunk_from_chars".
The names became rather short now just being 1,2,3,4,5 but that is fine - I usually use the git-format-patch naming which is a bit more readable, but this is just a suggestion for next time no change required.

+1 overall after the conffile handling is resolved

[Lucas Kanashiro (lucaskanashiro)]

Removal of conf files was fixed. I uploaded a new version to the PPA fwiw.

Up for review again.

review: Needs Resubmitting

[Lucas Kanashiro (lucaskanashiro)]

review: Abstain

[Christian Ehrhardt  (paelzer)]

LGTM now if the testing of the conffile removal works I'm fine - thanks for reworking this for me.

review: Approve

[Lucas Kanashiro (lucaskanashiro)]

I did test it again and it worked as expected (old conf files removed). Since it is good enough now, I am going to upload it.

[Lucas Kanashiro (lucaskanashiro)]

$ git push pkg upload/5.8.2-1ubuntu3.1
Enumerating objects: 33, done.
Counting objects: 100% (33/33), done.
Delta compression using up to 8 threads
Compressing objects: 100% (25/25), done.
Writing objects: 100% (25/25), 8.80 KiB | 2.93 MiB/s, done.
Total 25 (delta 13), reused 0 (delta 0)
To ssh://git.launchpad.net/~usd-import-team/ubuntu/+source/strongswan
 * [new tag] upload/5.8.2-1ubuntu3.1 -> upload/5.8.2-1ubuntu3.1

$ dput ubuntu ../strongswan_5.8.2-1ubuntu3.1_source.changes
Checking signature on .changes
gpg: ../strongswan_5.8.2-1ubuntu3.1_source.changes: Valid signature from F823A2729883C97C
Checking signature on .dsc
gpg: ../strongswan_5.8.2-1ubuntu3.1.dsc: Valid signature from F823A2729883C97C
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading strongswan_5.8.2-1ubuntu3.1.dsc: done.
  Uploading strongswan_5.8.2-1ubuntu3.1.debian.tar.xz: done.
  Uploading strongswan_5.8.2-1ubuntu3.1_source.buildinfo: done.
  Uploading strongswan_5.8.2-1ubuntu3.1_source.changes: done.
Successfully uploaded packages.

diff --git a/debian/changelog b/debian/changelog
index aa4f342..0443e1b 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,22 @@
+strongswan (5.8.2-1ubuntu3.1) focal; urgency=medium
+
+  * Re-enable eap-{dynamic,peap} libcharon plugins (LP: #1878887)
+    - d/control: update libcharon-extra-plugins description.
+    - d/libcharon-extra-plugins.install: install .so and conf files.
+    - d/rules: add plugins to the configuration arguments.
+  * Remove conf files of plugins removed from libcharon-extra-plugins
+    - The conf file of the following plugins were removed: eap-aka-3gpp2,
+      eap-sim-file, eap-sim-pcsc, eap-sim, eap-simaka-pseudonym,
+      eap-simaka-reauth, eap-simaka-sql, xauth-noauth.
+    - Created d/libcharon-extra-plugins.maintscript to handle the removals
+      properly.
+  * Add patches to fix the chunk_from_chars() macro compiled with GCC 9+
+    (LP: #1879692)
+    - Patches backported from upstream: lp-1879692-{1,2,3,4,5}.patch.
+    - Fix the pki CA certificate creation issue.
+
+ -- Lucas Kanashiro <[e-mail]>  Fri, 22 May 2020 10:53:07 -0300
+
 strongswan (5.8.2-1ubuntu3) focal; urgency=medium
 
   * Reverting part of 5.8.2-1ubuntu2 changes to remove BLISS again as
diff --git a/debian/control b/debian/control
index 6a88299..3859289 100644
--- a/debian/control
+++ b/debian/control
@@ -260,6 +260,9 @@ Description: strongSwan charon library (extra plugins)
   - unity (Cisco Unity extensions for IKEv1)
   - xauth-eap (XAuth backend that uses EAP methods to verify passwords)
   - xauth-pam (XAuth backend that uses PAM modules to verify passwords)
+  - eap-dynamic (EAP proxy plugin that dynamically selects an EAP method
+    requested/supported by the client (since 5.0.1))
+  - eap-peap (EAP-PEAP protocol handler, wraps other EAP methods securely)
 
 Package: strongswan-starter
 Architecture: any
diff --git a/debian/libcharon-extra-plugins.install b/debian/libcharon-extra-plugins.install
index 7765f20..cc0bf6f 100644
--- a/debian/libcharon-extra-plugins.install
+++ b/debian/libcharon-extra-plugins.install
@@ -2,9 +2,11 @@
 usr/lib/ipsec/plugins/libstrongswan-addrblock.so
 usr/lib/ipsec/plugins/libstrongswan-certexpire.so
 usr/lib/ipsec/plugins/libstrongswan-eap-aka.so
+usr/lib/ipsec/plugins/libstrongswan-eap-dynamic.so
 usr/lib/ipsec/plugins/libstrongswan-eap-gtc.so
 usr/lib/ipsec/plugins/libstrongswan-eap-identity.so
 usr/lib/ipsec/plugins/libstrongswan-eap-md5.so
+usr/lib/ipsec/plugins/libstrongswan-eap-peap.so
 usr/lib/ipsec/plugins/libstrongswan-eap-radius.so
 usr/lib/ipsec/plugins/libstrongswan-eap-tls.so
 usr/lib/ipsec/plugins/libstrongswan-eap-tnc.so
@@ -24,9 +26,11 @@ usr/lib/ipsec/plugins/libstrongswan-xauth-pam.so
 usr/share/strongswan/templates/config/plugins/addrblock.conf
 usr/share/strongswan/templates/config/plugins/certexpire.conf
 usr/share/strongswan/templates/config/plugins/eap-aka.conf
+usr/share/strongswan/templates/config/plugins/eap-dynamic.conf
 usr/share/strongswan/templates/config/plugins/eap-gtc.conf
 usr/share/strongswan/templates/config/plugins/eap-identity.conf
 usr/share/strongswan/templates/config/plugins/eap-md5.conf
+usr/share/strongswan/templates/config/plugins/eap-peap.conf
 usr/share/strongswan/templates/config/plugins/eap-radius.conf
 usr/share/strongswan/templates/config/plugins/eap-tls.conf
 usr/share/strongswan/templates/config/plugins/eap-tnc.conf
@@ -47,9 +51,11 @@ etc/strongswan.d/tnc.conf
 etc/strongswan.d/charon/addrblock.conf
 etc/strongswan.d/charon/certexpire.conf
 etc/strongswan.d/charon/eap-aka.conf
+etc/strongswan.d/charon/eap-dynamic.conf
 etc/strongswan.d/charon/eap-gtc.conf
 etc/strongswan.d/charon/eap-identity.conf
 etc/strongswan.d/charon/eap-md5.conf
+etc/strongswan.d/charon/eap-peap.conf
 etc/strongswan.d/charon/eap-radius.conf
 etc/strongswan.d/charon/eap-tls.conf
 etc/strongswan.d/charon/eap-tnc.conf
diff --git a/debian/libcharon-extra-plugins.maintscript b/debian/libcharon-extra-plugins.maintscript
new file mode 100644
index 0000000..61b27e6
--- /dev/null
+++ b/debian/libcharon-extra-plugins.maintscript
@@ -0,0 +1,8 @@
+rm_conffile /etc/strongswan.d/charon/eap-aka-3gpp2.conf 5.8.2-1ubuntu3.1~ libcharon-extra-plugins
+rm_conffile /etc/strongswan.d/charon/eap-sim-file.conf 5.8.2-1ubuntu3.1~ libcharon-extra-plugins
+rm_conffile /etc/strongswan.d/charon/eap-sim-pcsc.conf 5.8.2-1ubuntu3.1~ libcharon-extra-plugins
+rm_conffile /etc/strongswan.d/charon/eap-sim.conf 5.8.2-1ubuntu3.1~ libcharon-extra-plugins
+rm_conffile /etc/strongswan.d/charon/eap-simaka-pseudonym.conf 5.8.2-1ubuntu3.1~ libcharon-extra-plugins
+rm_conffile /etc/strongswan.d/charon/eap-simaka-reauth.conf 5.8.2-1ubuntu3.1~ libcharon-extra-plugins
+rm_conffile /etc/strongswan.d/charon/eap-simaka-sql.conf 5.8.2-1ubuntu3.1~ libcharon-extra-plugins
+rm_conffile /etc/strongswan.d/charon/xauth-noauth.conf 5.8.2-1ubuntu3.1~ libcharon-extra-plugins
diff --git a/debian/patches/lp-1879692-1.patch b/debian/patches/lp-1879692-1.patch
new file mode 100644
index 0000000..dad8ff4
--- /dev/null
+++ b/debian/patches/lp-1879692-1.patch
@@ -0,0 +1,75 @@
+From ef4113a49dbf3d0315d5c3e486a3717dda5f4c7c Mon Sep 17 00:00:00 2001
+From: Tobias Brunner <[e-mail]>
+Date: Wed, 29 Jan 2020 11:22:07 +0100
+Subject: [PATCH] libtpmtss: Fix problematic usage of chunk_from_chars() in
+ TSS2 implementations
+
+See 8ea13bbc5ccd for details.
+
+References #3249.
+
+Origin: upstream, https://git.strongswan.org/?p=strongswan.git;a=commitdiff;h=ef4113a49dbf3d0315d5c3e486a3717dda5f4c7c
+Reviewed-By: Lucas Kanashiro <[e-mail]>
+Last-Updated: 2020-05-22
+---
+ src/libtpmtss/tpm_tss_tss2_v1.c | 9 +++------
+ src/libtpmtss/tpm_tss_tss2_v2.c | 9 +++------
+ 2 files changed, 6 insertions(+), 12 deletions(-)
+
+diff --git a/src/libtpmtss/tpm_tss_tss2_v1.c b/src/libtpmtss/tpm_tss_tss2_v1.c
+index fb26d05..31465da 100644
+--- a/src/libtpmtss/tpm_tss_tss2_v1.c
++++ b/src/libtpmtss/tpm_tss_tss2_v1.c
+@@ -494,7 +494,8 @@ METHOD(tpm_tss_t, get_public, chunk_t,
+ 		{
+ 			TPM2B_PUBLIC_KEY_RSA *rsa;
+ 			TPMT_RSA_SCHEME *scheme;
+-			chunk_t aik_exponent, aik_modulus;
++			chunk_t aik_exponent = chunk_from_chars(0x01, 0x00, 0x01);
++			chunk_t aik_modulus;
+ 			uint32_t exponent;
+ 
+ 			scheme = &public.t.publicArea.parameters.rsaDetail.scheme;
+@@ -504,11 +505,7 @@ METHOD(tpm_tss_t, get_public, chunk_t,
+ 			rsa = &public.t.publicArea.unique.rsa;
+ 			aik_modulus = chunk_create(rsa->t.buffer, rsa->t.size);
+ 			exponent = htonl(public.t.publicArea.parameters.rsaDetail.exponent);
+-			if (!exponent)
+-			{
+-				aik_exponent = chunk_from_chars(0x01, 0x00, 0x01);
+-			}
+-			else
++			if (exponent)
+ 			{
+ 				aik_exponent = chunk_from_thing(exponent);
+ 			}
+diff --git a/src/libtpmtss/tpm_tss_tss2_v2.c b/src/libtpmtss/tpm_tss_tss2_v2.c
+index c5d78d6..fef32e1 100644
+--- a/src/libtpmtss/tpm_tss_tss2_v2.c
++++ b/src/libtpmtss/tpm_tss_tss2_v2.c
+@@ -448,7 +448,8 @@ METHOD(tpm_tss_t, get_public, chunk_t,
+ 		{
+ 			TPM2B_PUBLIC_KEY_RSA *rsa;
+ 			TPMT_RSA_SCHEME *scheme;
+-			chunk_t aik_exponent, aik_modulus;
++			chunk_t aik_exponent = chunk_from_chars(0x01, 0x00, 0x01);
++			chunk_t aik_modulus;
+ 			uint32_t exponent;
+ 
+ 			scheme = &public.publicArea.parameters.rsaDetail.scheme;
+@@ -458,11 +459,7 @@ METHOD(tpm_tss_t, get_public, chunk_t,
+ 			rsa = &public.publicArea.unique.rsa;
+ 			aik_modulus = chunk_create(rsa->buffer, rsa->size);
+ 			exponent = htonl(public.publicArea.parameters.rsaDetail.exponent);
+-			if (!exponent)
+-			{
+-				aik_exponent = chunk_from_chars(0x01, 0x00, 0x01);
+-			}
+-			else
++			if (exponent)
+ 			{
+ 				aik_exponent = chunk_from_thing(exponent);
+ 			}
+-- 
+2.7.4
+
diff --git a/debian/patches/lp-1879692-2.patch b/debian/patches/lp-1879692-2.patch
new file mode 100644
index 0000000..2dddeac
--- /dev/null
+++ b/debian/patches/lp-1879692-2.patch
@@ -0,0 +1,50 @@
+From 776433505b8581866010c2c82bf7611f4f0946e8 Mon Sep 17 00:00:00 2001
+From: Tobias Brunner <[e-mail]>
+Date: Wed, 29 Jan 2020 11:12:12 +0100
+Subject: [PATCH] x509: Replace problematic calls of chunk_from_chars() for
+ keyUsage extension
+
+As noted in 8ea13bbc5ccd newer compilers might optimize out the
+assignment leading to invalid values in the keyUsage extension (as the
+length was still set, the extension was encoded, just not with the
+intended values).
+
+Fixes #3249.
+
+Origin: upstream, https://git.strongswan.org/?p=strongswan.git;a=commitdiff;h=776433505b8581866010c2c82bf7611f4f0946e8
+Reviewed-By: Lucas Kanashiro <[e-mail]>
+Last-Updated: 2020-05-22
+---
+ src/libstrongswan/plugins/x509/x509_cert.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/src/libstrongswan/plugins/x509/x509_cert.c b/src/libstrongswan/plugins/x509/x509_cert.c
+index 7311708..5a3f838 100644
+--- a/src/libstrongswan/plugins/x509/x509_cert.c
++++ b/src/libstrongswan/plugins/x509/x509_cert.c
+@@ -2198,6 +2198,8 @@ static chunk_t generate_ts(traffic_selector_t *ts)
+ static bool generate(private_x509_cert_t *cert, certificate_t *sign_cert,
+ 					 private_key_t *sign_key, int digest_alg)
+ {
++	const chunk_t keyUsageCrlSign = chunk_from_chars(0x01, 0x02);
++	const chunk_t keyUsageCertSignCrlSign = chunk_from_chars(0x01, 0x06);
+ 	chunk_t extensions = chunk_empty, extendedKeyUsage = chunk_empty;
+ 	chunk_t serverAuth = chunk_empty, clientAuth = chunk_empty;
+ 	chunk_t ocspSigning = chunk_empty, certPolicies = chunk_empty;
+@@ -2317,11 +2319,11 @@ static bool generate(private_x509_cert_t *cert, certificate_t *sign_cert,
+ 												chunk_from_chars(0xFF)),
+ 											pathLenConstraint)));
+ 		/* set CertificateSign and implicitly CRLsign */
+-		keyUsageBits = chunk_from_chars(0x01, 0x06);
++		keyUsageBits = keyUsageCertSignCrlSign;
+ 	}
+ 	else if (cert->flags & X509_CRL_SIGN)
+ 	{
+-		keyUsageBits = chunk_from_chars(0x01, 0x02);
++		keyUsageBits = keyUsageCrlSign;
+ 	}
+ 	if (keyUsageBits.len)
+ 	{
+-- 
+2.7.4
+
diff --git a/debian/patches/lp-1879692-3.patch b/debian/patches/lp-1879692-3.patch
new file mode 100644
index 0000000..5b6152a
--- /dev/null
+++ b/debian/patches/lp-1879692-3.patch
@@ -0,0 +1,37 @@
+From d16e81077808c9c898e35db0f4b8f60e0490bf09 Mon Sep 17 00:00:00 2001
+From: Tobias Brunner <[e-mail]>
+Date: Wed, 29 Jan 2020 11:05:30 +0100
+Subject: [PATCH] pki: Remove unnecessary and problematic chunk_from_chars()
+ usage in --signcrl
+
+If the serial is not yet set, the same default value is set just below.
+
+See 8ea13bbc5ccd for details on chunk_from_chars().
+
+References #3249.
+
+Origin: upstream, https://git.strongswan.org/?p=strongswan.git;a=commitdiff;h=d16e81077808c9c898e35db0f4b8f60e0490bf09
+Reviewed-By: Lucas Kanashiro <[e-mail]>
+Last-Updated: 2020-05-22
+---
+ src/pki/commands/signcrl.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/src/pki/commands/signcrl.c b/src/pki/commands/signcrl.c
+index dfe1ce0..60d880e 100644
+--- a/src/pki/commands/signcrl.c
++++ b/src/pki/commands/signcrl.c
+@@ -385,10 +385,6 @@ static int sign_crl()
+ 	}
+ 	else
+ 	{
+-		if (!crl_serial.ptr)
+-		{
+-			crl_serial = chunk_from_chars(0x00);
+-		}
+ 		lastenum = enumerator_create_empty();
+ 	}
+ 
+-- 
+2.7.4
+
diff --git a/debian/patches/lp-1879692-4.patch b/debian/patches/lp-1879692-4.patch
new file mode 100644
index 0000000..348b1c2
--- /dev/null
+++ b/debian/patches/lp-1879692-4.patch
@@ -0,0 +1,42 @@
+From d5cf2d1f8549a3492916dab3178fba50030e8884 Mon Sep 17 00:00:00 2001
+From: Tobias Brunner <[e-mail]>
+Date: Wed, 29 Jan 2020 10:02:38 +0100
+Subject: [PATCH] tls-crypto: Fix usage of chunk_from_chars()
+
+See 8ea13bbc5ccd for details.
+
+References #3249.
+
+Origin: upstream, https://git.strongswan.org/?p=strongswan.git;a=commitdiff;h=d5cf2d1f8549a3492916dab3178fba50030e8884
+Reviewed-By: Lucas Kanashiro <[e-mail]>
+Last-Updated: 2020-05-22
+---
+ src/libtls/tls_crypto.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/src/libtls/tls_crypto.c b/src/libtls/tls_crypto.c
+index 0ec2f5c..ebadb91 100644
+--- a/src/libtls/tls_crypto.c
++++ b/src/libtls/tls_crypto.c
+@@ -1409,6 +1409,8 @@ METHOD(tls_crypto_t, sign, bool,
+ {
+ 	if (this->tls->get_version(this->tls) >= TLS_1_2)
+ 	{
++		const chunk_t hashsig_def = chunk_from_chars(
++					TLS_HASH_SHA1, TLS_SIG_RSA, TLS_HASH_SHA1, TLS_SIG_ECDSA);
+ 		signature_scheme_t scheme;
+ 		bio_reader_t *reader;
+ 		uint8_t hash, alg;
+@@ -1417,8 +1419,7 @@ METHOD(tls_crypto_t, sign, bool,
+ 
+ 		if (!hashsig.len)
+ 		{	/* fallback if none given */
+-			hashsig = chunk_from_chars(
+-				TLS_HASH_SHA1, TLS_SIG_RSA, TLS_HASH_SHA1, TLS_SIG_ECDSA);
++			hashsig = hashsig_def;
+ 		}
+ 		reader = bio_reader_create(hashsig);
+ 		while (reader->remaining(reader) >= 2)
+-- 
+2.7.4
+
diff --git a/debian/patches/lp-1879692-5.patch b/debian/patches/lp-1879692-5.patch
new file mode 100644
index 0000000..85efd71
--- /dev/null
+++ b/debian/patches/lp-1879692-5.patch
@@ -0,0 +1,111 @@
+From 8ea13bbc5ccdb7a67e5b2c0e0465d432dd24614b Mon Sep 17 00:00:00 2001
+From: Tobias Brunner <[e-mail]>
+Date: Mon, 27 Jan 2020 15:16:51 +0100
+Subject: [PATCH] lgtm: Add query to detect problematic uses of
+ chunk_from_chars()
+
+GCC 9+ and clang 4+ (partially) optimize out usages of
+chunk_from_chars() if the value is read outside of the block where the
+macro is used.  For instance:
+
+```
+chunk_t chunk = chunk_empty;
+if (...)
+{
+	chunk = chunk_from_chars(0x01, 0x06);
+}
+/* do something with chunk */
+```
+
+The chunk_from_chars() macro expands to a chunk_t declaration, which is
+technically only defined inside that block.
+
+Still, with older GCC versions the fourth line was compiled to something
+like this:
+
+```
+mov     WORD PTR [rsp+14], 1537 # 0x0106 in little-endian
+lea     rdx, [rsp+14]
+mov     ecx, 2
+```
+
+However, with GCC 9.1 and -O2 the first instruction might be omitted
+(strangely the others usually were not, so the chunk pointed to whatever
+was stored on the stack).  It's not easily reproducible, so there are
+situations where the seemingly identical code is not optimized in this
+way.
+
+This query should detect such problematic uses of the macro (definition
+and usage in different blocks).
+
+References #3249.
+
+Origin: upstream, https://git.strongswan.org/?p=strongswan.git;a=commitdiff;h=8ea13bbc5ccdb7a67e5b2c0e0465d432dd24614b
+Reviewed-By: Lucas Kanashiro <[e-mail]>
+Last-Updated: 2020-05-22
+
+---
+ .lgtm/cpp-queries/chunk_from_chars.ql | 51 +++++++++++++++++++++++++++++++++++
+ 1 file changed, 51 insertions(+)
+ create mode 100644 .lgtm/cpp-queries/chunk_from_chars.ql
+
+diff --git a/.lgtm/cpp-queries/chunk_from_chars.ql b/.lgtm/cpp-queries/chunk_from_chars.ql
+new file mode 100644
+index 0000000..c393e7e
+--- /dev/null
++++ b/.lgtm/cpp-queries/chunk_from_chars.ql
+@@ -0,0 +1,51 @@
++/**
++ * @name Invalid use of chunk_from_chars() macro
++ * @description The chunk_from_chars() macro creates a temporary chunk_t, which
++ *              is not defined outside of the block in which it has been used,
++ *              therefore, compilers might optimize out the assignment.
++ * @kind path-problem
++ * @problem.severity error
++ * @id strongswan/invalid-chunk-from-chars
++ * @tags correctness
++ * @precision very-high
++ */
++import cpp
++import DataFlow::PathGraph
++import semmle.code.cpp.dataflow.DataFlow
++
++class ChunkFromChars extends Expr {
++  ChunkFromChars() {
++    this = any(MacroInvocation mi |
++      mi.getOutermostMacroAccess().getMacroName() = "chunk_from_chars"
++      /* ignore global static uses of the macro */
++      and exists (Block b | mi.getExpr().getEnclosingBlock() = b)
++    ).getExpr()
++  }
++}
++
++class ChunkFromCharsUsage extends DataFlow::Configuration {
++  ChunkFromCharsUsage() { this = "ChunkFromCharsUsage" }
++
++  override predicate isSource(DataFlow::Node source) {
++    source.asExpr() instanceof ChunkFromChars
++  }
++
++  override predicate isSink(DataFlow::Node sink) {
++    exists(sink.asExpr())
++  }
++
++  override predicate isBarrierOut(DataFlow::Node node) {
++    /* don't track beyond function calls */
++    exists(FunctionCall fc | node.asExpr().getParent*() = fc)
++  }
++}
++
++Block enclosingBlock(Block b) {
++  result = b.getEnclosingBlock()
++}
++
++from ChunkFromCharsUsage usage, DataFlow::PathNode source, DataFlow::PathNode sink
++where
++  usage.hasFlowPath(source, sink)
++  and not source.getNode().asExpr().getEnclosingBlock() = enclosingBlock*(sink.getNode().asExpr().getEnclosingBlock())
++select source, source, sink, "Invalid use of chunk_from_chars() result in sibling/parent block."
+-- 
+2.7.4
+
diff --git a/debian/patches/series b/debian/patches/series
index c72895f..d5cd0fd 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -3,3 +3,8 @@
 03_systemd-service.patch
 04_disable-libtls-tests.patch
 dont-load-kernel-libipsec-plugin-by-default.patch
+lp-1879692-1.patch
+lp-1879692-2.patch
+lp-1879692-3.patch
+lp-1879692-4.patch
+lp-1879692-5.patch
diff --git a/debian/rules b/debian/rules
index 7ee20ea..f012b4d 100755
--- a/debian/rules
+++ b/debian/rules
@@ -15,9 +15,11 @@ CONFIGUREARGS := --libdir=/usr/lib --libexecdir=/usr/lib \
 		--enable-curl \
 		--enable-eap-aka \
 		--enable-eap-gtc \
+		--enable-eap-dynamic \
 		--enable-eap-identity \
 		--enable-eap-md5 \
 		--enable-eap-mschapv2 \
+		--enable-eap-peap \
 		--enable-eap-radius \
 		--enable-eap-tls \
 		--enable-eap-tnc \