Merge ~paelzer/ubuntu/+source/strongswan:merge-5.7.2-1-eoan into ubuntu/+source/strongswan:debian/sid

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

PPA: https://launchpad.net/~paelzer/+archive/ubuntu/eoan-merge-strongswan-5.7.2-1

Note: Once re-built with all the package re-locations (to be better mergeable with Debian) I'll do some upgrade tests, but the actual MP can already be reviewed.

[Christian Ehrhardt  (paelzer)]

I hope there is not too much confusion, but this time the logical tag looks much different than last time. This was done to re-group and re-order the changes for Debian submission.

Tags pushed for review:
 * [new tag] lp999999/logical/5.7.1-1ubuntu2 -> lp999999/logical/5.7.1-1ubuntu2
 * [new tag] lp999999/new/debian -> lp999999/new/debian
 * [new tag] lp999999/old/debian -> lp999999/old/debian
 * [new tag] lp999999/old/ubuntu -> lp999999/old/ubuntu
 * [new tag] lp999999/reconstruct/5.7.1-1ubuntu2 -> lp999999/reconstruct/5.7.1-1ubuntu2
 * [new tag] lp999999/split/5.7.1-1ubuntu2 -> lp999999/split/5.7.1-1ubuntu2

[Christian Ehrhardt  (paelzer)]

Since we had issues getting the mass enabling into Debian I have now opened [1] which contains all but these and we can re-visit those changes later. Hopefully that allows us to reduce the Delta.

Furthermore as a note, once this is in Eoan I will have to clear the seeds, it seems we already depend on plenty of no more existing binaries and removing the TNC packages made this even worse now.

[1]: https://salsa.debian.org/debian/strongswan/merge_requests/5

[Andreas Hasenack (ahasenack)]

Review ongoing, I'll write up individual questions or points so they are easy to reply to individually.

What happened to the pool feature? It's in reconstruct, split, but gone from logical with no drop mention:

commit a4c1fbe64282b855e709372dc17e4befbb35a6aa
Author: Christian Ehrhardt <email address hidden>
Date: Thu May 4 13:50:54 2017 +0200

        - d/strongswan-starter.install: Install pool feature, which is useful since
          we have attr-sql plugin enabled as well using it.

review: Needs Information

[Andreas Hasenack (ahasenack)]

This commit mentions one file only, but it changes two;
commit 6d58030fa2e807019f164d02a5df1532bdafc387
Author: Christian Ehrhardt <email address hidden>
Date: Fri Apr 26 10:59:02 2019 +0200

    apparmor: d/usr.sbin.charon-systemd: allow CLUSTERIP for ha plugin (LP: 1773956)

it also changes d/usr.lib.ipsec.charon

[Andreas Hasenack (ahasenack)]

This other commit also mentions one file, but changes two:
commit 5bb46ca49e2a42fc55a66a55c2355f46305bcb96
Author: Christian Ehrhardt <email address hidden>
Date: Tue May 29 08:53:44 2018 +0200

    apparmor: d/usr.sbin.charon-systemd: allow to contact mysql for sql and attr-sql plugins (LP: 1766240)

it also changes d/usr.lib.ipsec.charon

[Andreas Hasenack (ahasenack)]

Regarding the pool feature, looks like it's part of commit 11741ef89c44870ababc41531978375047310019 now, but not mentioned:
commit 11741ef89c44870ababc41531978375047310019
Author: Christian Ehrhardt <email address hidden>
Date: Fri Apr 26 10:32:21 2019 +0200

    - Mass enablement of extra plugins

      Add features to allow a user to use strongswan for a variety of extra use
      cases without having to rebuild.
      + d/control: Add required additional build-deps
      + d/control: Mention addtionally enabled plugins
      + d/rules: Enable features at configure stage
      + d/libbstrongswan-extra-plugins.install: Add plugins (so, lib, conf)
      + d/libstrongswan.install: Add plugins (so, conf)

...
--- a/debian/strongswan-starter.install
+++ b/debian/strongswan-starter.install
@@ -16,3 +16,7 @@ usr/lib/ipsec/plugins/libstrongswan-stroke.so
 usr/share/strongswan/templates/config/plugins/stroke.conf
 etc/strongswan.d/charon/stroke.conf
 debian/usr.lib.ipsec.stroke /etc/apparmor.d/
+#pool
+usr/lib/ipsec/pool
+usr/share/strongswan/templates/config/strongswan.d/pool.conf
+etc/strongswan.d/pool.conf

[Andreas Hasenack (ahasenack)]

In d/changelog:
  [ Simon Deziel ]
  * Added changes:
    - apparmor fixes for contianer and root usage (LP: #1826238)
    - d/usr.sbin.swanctl: allow reading own binary
    - d/usr.sbin.charon-systemd: allow accessing the binary
    - d/usr.sbin.swanctl: add attach_disconnected to work inside containers
    - d/usr.lib.ipsec.charon, d/usr.sbin.charon-systemd: add CAP_SETPCAP
      to apparmor to allow dropping caps

Shouldn't the changes below the bug line be indented? Also, typo: "contianer"

[Andreas Hasenack (ahasenack)]

In the "mass enablement" commit f0eab84f7 I mentioned earlier, about the missing debian/strongswan-starter.install entry, you should probably make the change to strongswan-starter.install its own commit, then it will match what's already in d/changelog:
    - Mass enablement of extra plugins and features to allow a user to use
      strongswan for a variety of extra use cases without having to rebuild.
      + d/control: Add required additional build-deps
      + d/control: Mention addtionally enabled plugins
      + d/rules: Enable features at configure stage
      + d/libbstrongswan-extra-plugins.install: Add plugins (so, lib, conf)
      + d/libstrongswan.install: Add plugins (so, conf)
--> - d/strongswan-starter.install: Install pool feature, which is useful since
      we have attr-sql plugin enabled as well using it.

[Andreas Hasenack (ahasenack)]

Many typos in commit message 0abd1089ba3c9dff6a4000e01871fdba2054c73d, but since that is the current logical and will be gone next time, probably not worth it. It shows that I read the commit message, though :)

[Andreas Hasenack (ahasenack)]

In 97c74a90966a9a639b5d996e235352fde08e63a8, where you are taking care of the package transition according to case #6 from the wiki, you added a single Provides for "A", i.e.:

+Provides: strongswan-tnc-base

Even though that line is optional, shouldn't it be providing all the other strongswan-tnc-* packages that are now empty?

review: Needs Information

[Andreas Hasenack (ahasenack)]

+# Transition back from strongswan-tnc-* being in extra packages
+# Can be dropped after 20.04
+Package: strongswan-tnc-ifmap
+Depends: libcharon-extra-plugins, ${misc:Depends}

Don't you need to depend on a specific version of libcharon-extra-plugins? Like:

Depends: libcharon-extra-plugins (>= 5.7.2-1ubuntu1)

review: Needs Information

[Andreas Hasenack (ahasenack)]

    - d/libstrongswan.install: Reorder conf and .so alphabetically

is listed twice in d/changelog: once under "remaining changes", and once more under "Dropped changes"

[Christian Ehrhardt  (paelzer)]

Thanks for the review!
Answers:
- Some commit messages change more files than mentioned
  As explained on IRC this is due to merging changes.
  I fixed those two up.
- Q: "What happened to the pool feature?"
  A: This is only needed due to the "mass enablement", therefore it is now part of that (not lost and intentionally there)
  You found that later yourself.
  But I added mentioning it in the commit message as well as better indent in the changelog to reflect it is now part of it.
- Q: apparmor fixes for contianer
  A: Fixed typo and indented the sub-entries
- Q: typos in 97c74a909
  A: yes since this will be gone I'm not cleaning it up
- Q: Provides: strongswan-tnc-base, but not listing others
  A: Provides is optional and only needed for packages which have dependencies "to them". In this case this is only strongswan-tnc-base
- Q: transitionals to get a version depends?
  A: The example at
  https://wiki.debian.org/RenamingPackages#Transition_package_method has no version, but it feels right. You don't need a version there, when you have a repo that makes the new transitonal available you also have the new version of the replacing package.
  I have checked other packages and they behavie ... differently.
  Some have "(= ${source:Version})" and that would work and not hurt. I'm adding that.
- Q: "Reorder conf" listed twice
  A. Fixed

Thanks for the questions, I'll push an updated branch any minute ..

[Christian Ehrhardt  (paelzer)]

Updated changes pushed.

In addition to the mentioned changes I also squashed the nttftt change to the mass enablement, former commit already was "MERGE mass enablement commit"

Ready for re-review

[Andreas Hasenack (ahasenack)]

I entered a rabbit hole troubleshooting postgresql migration issues, but I think I found the issue now. This means I'll go over your changes here only tomorrow, though.

[Andreas Hasenack (ahasenack)]

> Thanks for the review!
> Answers:
> - Some commit messages change more files than mentioned
> As explained on IRC this is due to merging changes.
> I fixed those two up.

Thanks. This saves time during reviews.

> - Q: "What happened to the pool feature?"
> A: This is only needed due to the "mass enablement", therefore it is now
> part of that (not lost and intentionally there)
> You found that later yourself.
> But I added mentioning it in the commit message as well as better indent in
> the changelog to reflect it is now part of it.

Thanks. This saves time, as the reviewer then doesn't have to go hunting down the missing piece(s).

> - Q: apparmor fixes for contianer
> A: Fixed typo and indented the sub-entries
> - Q: typos in 97c74a909
> A: yes since this will be gone I'm not cleaning it up

Agreed

> - Q: Provides: strongswan-tnc-base, but not listing others
> A: Provides is optional and only needed for packages which have dependencies
> "to them". In this case this is only strongswan-tnc-base

ok

> - Q: transitionals to get a version depends?
> A: The example at
> https://wiki.debian.org/RenamingPackages#Transition_package_method has no
> version, but it feels right. You don't need a version there, when you have a
> repo that makes the new transitonal available you also have the new version of
> the replacing package.
> I have checked other packages and they behavie ... differently.
> Some have "(= ${source:Version})" and that would work and not hurt. I'm
> adding that.

The #6 example in https://wiki.debian.org/PackageTransition actually does use a version for everything with the exception of the optional provides:

A and B existed, all from A goes into B, A becomes transitional
A: strongswan-tnc-*
B: libcharon-extra-plugins

Flags for new A package: Depends: B (>=2)
Flags for new B package:
Breaks: A (<<2)
Replaces: A (<<2)
optional* -- Provides: A

Just making sure we are reading the same thing, up to you :)

I did a quick test with the packages that are in the ppa. They don't have these latest changes yet.

Starting with these installed packages: https://pastebin.ubuntu.com/p/kgcGXbDqxX/

Dist upgrade prompted me like this:
The following packages will be REMOVED:
  strongswan-tnc-base strongswan-tnc-client strongswan-tnc-ifmap
  strongswan-tnc-pdp strongswan-tnc-server
The following packages will be upgraded:
  charon-cmd libcharon-extra-plugins libcharon-standard-plugins libstrongswan
  libstrongswan-extra-plugins libstrongswan-standard-plugins strongswan-charon
  strongswan-libcharon strongswan-starter strongswan-swanctl

I found the removal part odd. I was expecting the packages to be upgraded to the transitional ones, which I would later remove via "apt autoremove".

Furthermore, there was this issue during the transaction:
(...)
Fetched 2535 kB in 27s (92.7 kB/s)
(Reading database ... 29859 files and directories currently installed.)
Removing strongswan-tnc-client (5.7.1-1ubuntu2) ...
Removing strongswan-tnc-pdp (5.7.1-1ubuntu2) ...
Removing strongswan-tnc-server (5.7.1-1ubuntu2) ...
Removing strongswan-tnc-ifmap (5.7.1-1ubuntu2) ...
dpkg: strongswan-tnc-base: dependency problems, but removing anyway...

[Christian Ehrhardt  (paelzer)]

FYI: Looks the same with the versioned depends from the transitional packages.
It is actually nice that it cleans up all the transitionals right away.
I see - as you did - that all works fine - yet the message still is here:

dpkg: strongswan-tnc-base: dependency problems, but removing anyway as you requested:
 libcharon-extra-plugins depends on strongswan-tnc-base.

That dependency is only on "the old" version of libcharon-extra-plugins.
The new one breaks, replaces and provides it which should be fine.

The upgrade path is like:
- removal of strongswan-tnc-base (triggers the message as old libcharon-extra-plugins is still there)
- It knows it is save as it knows the new libcharon-extra-plugins will not have a problem
- after upgrade all is fine

I think I know why it is different:
- Most of the time a transitional is only going away
- In that case it will stay around as empty transitional
- later autoremoval can remove it (without that warning)
- but in our case we moved the files, so the new libcharon-extra-plugins has breaks
- that breaks enforces the strongswan-tnc-base to be removed before unpack starts

I think there is not much we can do, I'd leave it as is if you are ok.
I'm open for suggestions thou if there are any how this would work even better.

[Andreas Hasenack (ahasenack)]

+1, thanks for checking.

review: Approve

[Christian Ehrhardt  (paelzer)]

Thanks, tagged and uploaded

diff --git a/debian/changelog b/debian/changelog
index 996d1ff..c849065 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,84 @@
+strongswan (5.7.2-1ubuntu1) eoan; urgency=medium
+
+  [ Christian Ehrhardt ]
+  * Merge with Debian unstable. Remaining changes:
+    - Clean up d/strongswan-starter.postinst: section about runlevel changes
+    - Clean up d/strongswan-starter.postinst: Removed entire section on
+      opportunistic encryption disabling - this was never in strongSwan and
+      won't be see upstream issue #2160.
+    - d/rules: Removed patching ipsec.conf on build (not using the
+      debconf-managed config.)
+    - d/ipsec.secrets.proto: Removed ipsec.secrets.inc reference (was
+      used for debconf-managed include of private key).
+    - Mass enablement of extra plugins and features to allow a user to use
+      strongswan for a variety of extra use cases without having to rebuild.
+      + d/control: Add required additional build-deps
+      + d/control: Mention addtionally enabled plugins
+      + d/rules: Enable features at configure stage
+      + d/libbstrongswan-extra-plugins.install: Add plugins (so, lib, conf)
+      + d/libstrongswan.install: Add plugins (so, conf)
+      + d/strongswan-starter.install: Install pool feature, which is useful
+        since we now have attr-sql plugin enabled it.
+    - Add plugin kernel-libipsec to allow the use of strongswan in containers
+      via this userspace implementation (please do note that this is still
+      considered experimental by upstream).
+      + d/libcharon-extra-plugins.install: Add kernel-libipsec components
+      + d/control: List kernel-libipsec plugin at extra plugins description
+      + d/p/dont-load-kernel-libipsec-plugin-by-default.patch: As
+        upstream recommends to not load kernel-libipsec by default.
+    - d/libstrongswan.install: Add kernel-netlink configuration files
+    - Complete the disabling of libfast; This was partially accepted in Debian,
+      it is no more packaging medcli and medsrv, but still builds and
+      mentions it.
+      + d/rules: Add --disable-fast to avoid build time and dependencies
+      + d/control: Remove medcli, medsrv from package description
+    - d/control: Mention mgf1 plugin which is in libstrongswan now
+    - Add now built (since 5.5.1) libraries libtpmtss and nttfft to
+      libstrongswan-extra-plugins (no deps from default plugins).
+    - d/control, d/libcharon-{extras,standard}-plugins.install: Move charon
+      plugins for the most common use cases from extra-plugins into a new
+      standard-plugins package. This will allow those use cases without pulling
+      in too much more plugins (a bit like the tnc package). Recommend that
+      package from strongswan-libcharon.
+    - d/usr.sbin.charon-systemd: allow to contact mysql for sql and
+      attr-sql plugins (LP #1766240)
+    - d/usr.lib.ipsec.charon: allow reading of own FDs (LP #1786250)
+    - d/usr.sbin.charon-systemd: allow CLUSTERIP for ha plugin (LP: 1773956)
+    - executables need to be able to read map and execute themselves otherwise
+      execution in some environments e.g. containers is blocked (LP: 1780534)
+      + d/usr.lib.ipsec.stroke: add rmix permission to stroke binary
+      + d/usr.lib.ipsec.lookip: add rmix permission to lookip binary
+    - d/usr.lib.ipsec.charon, d/usr.sbin.charon-systemd: resync apparmor
+      profiles of both ways to start charon (LP: 1807664)
+    - d/usr.sbin.swanctl: add apparmor rule for af-alg plugin (LP: 1807962)
+  * Dropped changes
+    - d/p/lp1795813-mysql-Don-t-release-the-connection-if-transactions-a.patch:
+      fix SIGSEGV when using mysql plugin (LP: 1795813)
+      [upstream in 5.7.2]
+    - d/libstrongswan.install: Reorder conf and .so alphabetically
+      [was a non functional change, dropped to avoid merge noise]
+    - Relocate tnc plugin
+      [TNC is back at libcharon-extra-plugins as it is in Debian]
+  * Added changes:
+    - We fixed up tpmtss and nttfft in the past, but tpmtss is now packaged in
+      Debian so this part was be dropped. Two changes remain
+      - d/control: fix the mentioning of tpmtss in d/control
+      - add nttfft (can be merged with the mass enablement change later)
+    - Transitional packages to go back from strongswan-tnc-* being in extra
+      packages to be part of libcharon-extra-plugins.
+      [can be dropped after 20.04]
+
+  [ Simon Deziel ]
+  * Added changes:
+    - apparmor fixes for container and root usage (LP: #1826238)
+      + d/usr.sbin.swanctl: allow reading own binary
+      + d/usr.sbin.charon-systemd: allow accessing the binary
+      + d/usr.sbin.swanctl: add attach_disconnected to work inside containers
+      + d/usr.lib.ipsec.charon, d/usr.sbin.charon-systemd: add CAP_SETPCAP
+        to apparmor to allow dropping caps
+
+ -- Christian Ehrhardt <[e-mail]>  Fri, 26 Apr 2019 11:31:17 +0200
+
 strongswan (5.7.2-1) unstable; urgency=medium
 
   * d/control: remove Rene from Uploaders, thanks!
@@ -16,6 +97,86 @@ strongswan (5.7.2-1) unstable; urgency=medium
 
  -- Yves-Alexis Perez <[e-mail]>  Wed, 02 Jan 2019 13:02:11 +0100
 
+strongswan (5.7.1-1ubuntu2) disco; urgency=medium
+
+  * d/usr.sbin.charon-systemd: fix rule for CLUSTERIP to match effective
+    path (LP: #1773956)
+  * d/usr.lib.ipsec.charon, d/usr.sbin.charon-systemd: resync apparmor
+    profiles of both ways to start charon (LP: #1807664)
+  * d/usr.sbin.swanctl: add apparmor rule for af-alg plugin (LP: #1807962)
+
+ -- Christian Ehrhardt <[e-mail]>  Mon, 10 Dec 2018 08:30:01 +0100
+
+strongswan (5.7.1-1ubuntu1) disco; urgency=medium
+
+  * Merge with Debian unstable (LP: #1806401). Remaining changes:
+    - Clean up d/strongswan-starter.postinst: section about runlevel changes
+    - Clean up d/strongswan-starter.postinst: Removed entire section on
+      opportunistic encryption disabling - this was never in strongSwan and
+      won't be see upstream issue #2160.
+    - d/rules: Removed patching ipsec.conf on build (not using the
+      debconf-managed config.)
+    - d/ipsec.secrets.proto: Removed ipsec.secrets.inc reference (was
+      used for debconf-managed include of private key).
+    - Mass enablement of extra plugins and features to allow a user to use
+      strongswan for a variety of extra use cases without having to rebuild.
+      + d/control: Add required additional build-deps
+      + d/control: Mention addtionally enabled plugins
+      + d/rules: Enable features at configure stage
+      + d/libbstrongswan-extra-plugins.install: Add plugins (so, lib, conf)
+      + d/libstrongswan.install: Add plugins (so, conf)
+    - d/strongswan-starter.install: Install pool feature, which is useful since
+      we have attr-sql plugin enabled as well using it.
+    - Add plugin kernel-libipsec to allow the use of strongswan in containers
+      via this userspace implementation (please do note that this is still
+      considered experimental by upstream).
+      + d/libcharon-extra-plugins.install: Add kernel-libipsec components
+      + d/control: List kernel-libipsec plugin at extra plugins description
+      + d/p/dont-load-kernel-libipsec-plugin-by-default.patch: As
+        upstream recommends to not load kernel-libipsec by default.
+    - Relocate tnc plugin
+      + debian/libcharon-extra-plugins.install: Drop tnc from extra plugins
+      + Add new subpackage for TNC in d/strongswan-tnc-* and d/control
+    - d/libstrongswan.install: Reorder conf and .so alphabetically
+    - d/libstrongswan.install: Add kernel-netlink configuration files
+    - Complete the disabling of libfast; This was partially accepted in Debian,
+      it is no more packaging medcli and medsrv, but still builds and
+      mentions it.
+      + d/rules: Add --disable-fast to avoid build time and dependencies
+      + d/control: Remove medcli, medsrv from package description
+    - d/control: Mention mgf1 plugin which is in libstrongswan now
+    - Add now built (since 5.5.1) libraries libtpmtss and nttfft to
+      libstrongswan-extra-plugins (no deps from default plugins).
+    - d/control, d/libcharon-{extras,standard}-plugins.install: Move charon
+      plugins for the most common use cases from extra-plugins into a new
+      standard-plugins package. This will allow those use cases without pulling
+      in too much more plugins (a bit like the tnc package). Recommend that
+      package from strongswan-libcharon.
+    - d/usr.sbin.charon-systemd: allow to contact mysql for sql and
+      attr-sql plugins (LP #1766240)
+    - d/usr.lib.ipsec.charon: allow reading of own FDs (LP #1786250)
+  * Added Changes:
+    - d/p/lp1795813-mysql-Don-t-release-the-connection-if-transactions-a.patch:
+      fix SIGSEGV when using mysql plugin (LP: #1795813)
+    - d/usr.sbin.charon-systemd: allow CLUSTERIP for ha plugin (LP: #1773956)
+    - executables need to be able to read map and execute themselves otherwise
+      execution in some environments e.g. containers is blocked (LP: #1780534)
+      + d/usr.lib.ipsec.stroke: add rmix permission to stroke binary
+      + d/usr.lib.ipsec.lookip: add rmix permission to lookip binary
+    - adapt "mass enablement of extra plugins" to match 5.7.x changes
+      + d/rules: use new options for swima instead of swid
+      + d/strongswan-tnc-server.install: add new sec updater tool
+      + d/strongswan-tnc-client.install: add new sw-collector tool
+  * Dropped (in Debian now):
+    - SECURITY UPDATE: Insufficient input validation in gmp plugin
+      (CVE-2018-17540)
+    - SECURITY UPDATE: Insufficient input validation in gmp plugin
+      (CVE-2018-16151 CVE-2018-16152)
+    - d/usr.lib.ipsec.charon, d/usr/sbin/charon-systemd: Add support for
+      usr-merge, thanks to Christian Ehrhardt. LP #1784023
+
+ -- Christian Ehrhardt <[e-mail]>  Mon, 03 Dec 2018 15:18:31 +0100
+
 strongswan (5.7.1-1) unstable; urgency=medium
 
   [ Ondřej Nový ]
@@ -46,6 +207,96 @@ strongswan (5.7.0-1) unstable; urgency=medium
 
  -- Yves-Alexis Perez <[e-mail]>  Mon, 24 Sep 2018 16:36:28 +0200
 
+strongswan (5.6.3-1ubuntu5) disco; urgency=medium
+
+  * No-change rebuild against libunbound8
+
+ -- Steve Langasek <[e-mail]>  Sun, 11 Nov 2018 09:01:53 +0000
+
+strongswan (5.6.3-1ubuntu4) cosmic; urgency=medium
+
+  * d/usr.lib.ipsec.charon: allow reading of own FDs (LP: #1786250)
+    Thanks to Matt Callaghan.
+
+ -- Andreas Hasenack <[e-mail]>  Thu, 04 Oct 2018 10:34:01 -0300
+
+strongswan (5.6.3-1ubuntu3) cosmic; urgency=medium
+
+  * SECURITY UPDATE: Insufficient input validation in gmp plugin
+    - debian/patches/strongswan-4.4.0-5.7.0_gmp-pkcs1-overflow.patch: fix
+      buffer overflow with very small RSA keys in
+      src/libstrongswan/plugins/gmp/gmp_rsa_private_key.c.
+    - CVE-2018-17540
+
+ -- Marc Deslauriers <[e-mail]>  Mon, 01 Oct 2018 13:23:59 -0400
+
+strongswan (5.6.3-1ubuntu2) cosmic; urgency=medium
+
+  * SECURITY UPDATE: Insufficient input validation in gmp plugin
+    - debian/patches/strongswan-5.6.1-5.6.3_gmp-pkcs1-verify.patch: don't
+      parse PKCS1 v1.5 RSA signatures to verify them in
+      src/libstrongswan/plugins/gmp/gmp_rsa_private_key.c,
+      src/libstrongswan/plugins/gmp/gmp_rsa_public_key.c.
+    - CVE-2018-16151
+    - CVE-2018-16152
+
+ -- Marc Deslauriers <[e-mail]>  Tue, 25 Sep 2018 10:16:15 -0400
+
+strongswan (5.6.3-1ubuntu1) cosmic; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - Clean up d/strongswan-starter.postinst: section about runlevel changes
+    - Clean up d/strongswan-starter.postinst: Removed entire section on
+      opportunistic encryption disabling - this was never in strongSwan and
+      won't be see upstream issue #2160.
+    - d/rules: Removed patching ipsec.conf on build (not using the
+      debconf-managed config.)
+    - d/ipsec.secrets.proto: Removed ipsec.secrets.inc reference (was
+      used for debconf-managed include of private key).
+    - Mass enablement of extra plugins and features to allow a user to use
+      strongswan for a variety of extra use cases without having to rebuild.
+      + d/control: Add required additional build-deps
+      + d/control: Mention addtionally enabled plugins
+      + d/rules: Enable features at configure stage
+      + d/libbstrongswan-extra-plugins.install: Add plugins (so, lib, conf)
+      + d/libstrongswan.install: Add plugins (so, conf)
+    - d/strongswan-starter.install: Install pool feature, which is useful since
+      we have attr-sql plugin enabled as well using it.
+    - Add plugin kernel-libipsec to allow the use of strongswan in containers
+      via this userspace implementation (please do note that this is still
+      considered experimental by upstream).
+      + d/libcharon-extra-plugins.install: Add kernel-libipsec components
+      + d/control: List kernel-libipsec plugin at extra plugins description
+      + d/p/dont-load-kernel-libipsec-plugin-by-default.patch: As
+        upstream recommends to not load kernel-libipsec by default.
+    - Relocate tnc plugin
+      + debian/libcharon-extra-plugins.install: Drop tnc from extra plugins
+      + Add new subpackage for TNC in d/strongswan-tnc-* and d/control
+    - d/libstrongswan.install: Reorder conf and .so alphabetically
+    - d/libstrongswan.install: Add kernel-netlink configuration files
+    - Complete the disabling of libfast; This was partially accepted in Debian,
+      it is no more packaging medcli and medsrv, but still builds and
+      mentions it.
+      + d/rules: Add --disable-fast to avoid build time and dependencies
+      + d/control: Remove medcli, medsrv from package description
+    - d/control: Mention mgf1 plugin which is in libstrongswan now
+    - Add now built (since 5.5.1) libraries libtpmtss and nttfft to
+      libstrongswan-extra-plugins (no deps from default plugins).
+    - d/control, d/libcharon-{extras,standard}-plugins.install: Move charon
+      plugins for the most common use cases from extra-plugins into a new
+      standard-plugins package. This will allow those use cases without pulling
+      in too much more plugins (a bit like the tnc package). Recommend that
+      package from strongswan-libcharon.
+    - d/usr.sbin.charon-systemd: allow to contact mysql for sql and
+      attr-sql plugins (LP #1766240)
+    - d/usr.lib.ipsec.charon, d/usr/sbin/charon-systemd: Add support for
+      usr-merge, thanks to Christian Ehrhardt. LP #1784023
+  * Dropped:
+    - d/usr.sbin.charon-systemd: allow systemd notifications (LP: #1765652)
+      [Fixed in 5.6.3-1]
+
+ -- Andreas Hasenack <[e-mail]>  Thu, 23 Aug 2018 13:05:11 -0300
+
 strongswan (5.6.3-1) unstable; urgency=medium
 
   * New upstream version 5.6.2
@@ -61,6 +312,78 @@ strongswan (5.6.3-1) unstable; urgency=medium
 
  -- Yves-Alexis Perez <[e-mail]>  Mon, 04 Jun 2018 10:23:22 +0200
 
+strongswan (5.6.2-2ubuntu2) cosmic; urgency=medium
+
+  * Add support for usr-merge, thanks to Christian Ehrhardt. LP: #1784023
+
+ -- Dimitri John Ledkov <[e-mail]>  Tue, 21 Aug 2018 00:42:38 +0100
+
+strongswan (5.6.2-2ubuntu1) cosmic; urgency=medium
+
+  * Merge with Debian unstable, closes LP: #1773814 and LP: #1772705.
+    Remaining changes:
+    + Clean up d/strongswan-starter.postinst: section about runlevel changes
+    + Clean up d/strongswan-starter.postinst: Removed entire section on
+      opportunistic encryption disabling - this was never in strongSwan and
+      won't be see upstream issue #2160.
+    + d/rules: Removed patching ipsec.conf on build (not using the
+      debconf-managed config.)
+    + d/ipsec.secrets.proto: Removed ipsec.secrets.inc reference (was
+      used for debconf-managed include of private key).
+    + Mass enablement of extra plugins and features to allow a user to use
+      strongswan for a variety of extra use cases without having to rebuild.
+      - d/control: Add required additional build-deps
+      - d/control: Mention addtionally enabled plugins
+      - d/rules: Enable features at configure stage
+      - d/libbstrongswan-extra-plugins.install: Add plugins (so, lib, conf)
+      - d/libstrongswan.install: Add plugins (so, conf)
+    + d/strongswan-starter.install: Install pool feature, which is useful since
+      we have attr-sql plugin enabled as well using it.
+    + Add plugin kernel-libipsec to allow the use of strongswan in containers
+      via this userspace implementation (please do note that this is still
+      considered experimental by upstream).
+      - d/libcharon-extra-plugins.install: Add kernel-libipsec components
+      - d/control: List kernel-libipsec plugin at extra plugins description
+      - d/p/dont-load-kernel-libipsec-plugin-by-default.patch: As
+        upstream recommends to not load kernel-libipsec by default.
+    + Relocate tnc plugin
+     - debian/libcharon-extra-plugins.install: Drop tnc from extra plugins
+     - Add new subpackage for TNC in d/strongswan-tnc-* and d/control
+    + d/libstrongswan.install: Reorder conf and .so alphabetically
+    + d/libstrongswan.install: Add kernel-netlink configuration files
+    + Complete the disabling of libfast; This was partially accepted in Debian,
+        it is no more packaging medcli and medsrv, but still builds and
+        mentions it.
+      - d/rules: Add --disable-fast to avoid build time and dependencies
+      - d/control: Remove medcli, medsrv from package description
+    + d/control: Mention mgf1 plugin which is in libstrongswan now
+    + Add now built (since 5.5.1) libraries libtpmtss and nttfft to
+      libstrongswan-extra-plugins (no deps from default plugins).
+    + d/control, d/libcharon-{extras,standard}-plugins.install: Move charon
+      plugins for the most common use cases from extra-plugins into a new
+      standard-plugins package. This will allow those use cases without pulling
+      in too much more plugins (a bit like the tnc package). Recommend that
+      package from strongswan-libcharon.
+  * Dropped Changes (no more needed after 18.04)
+    + Add rm_conffile for /etc/init.d/ipsec (transition from precies had
+      missed that, droppable after 18.04)
+    + d/control: bump breaks/replaces from libstrongswan-extra-plugins to
+      libstrongswan as we dropped relocating ccm and test-vectors.
+      (droppable >18.04).
+    + d/control: add breaks/replace from libstrongswan to
+      libstrongswan-extra-plugins for the move of mgf1 to libstrongswan.
+      (droppable >18.04).
+    + d/control: bump breaks/replaces for the move of the updown plugin
+      (Missed Changelog entry on last merge)
+    + d/control: fix dependencies of strongswan-libcharon due to the move
+      the updown plugin (droppable >18.04).
+  * Added Changes:
+    + d/usr.sbin.charon-systemd: allow to contact mysql for sql and
+      attr-sql plugins (LP: #1766240)
+    + d/usr.sbin.charon-systemd: allow systemd notifications (LP: #1765652)
+
+ -- Christian Ehrhardt <[e-mail]>  Tue, 29 May 2018 08:21:42 +0200
+
 strongswan (5.6.2-2) unstable; urgency=medium
 
   * charon-nm: Fix building list of DNS/MDNS servers with libnm
@@ -71,6 +394,74 @@ strongswan (5.6.2-2) unstable; urgency=medium
 
  -- Yves-Alexis Perez <[e-mail]>  Fri, 13 Apr 2018 13:46:04 +0200
 
+strongswan (5.6.2-1ubuntu2) bionic; urgency=medium
+
+  * d/control: fix dependencies of strongswan-libcharon due to the move
+    the updown plugin.
+
+ -- Christian Ehrhardt <[e-mail]>  Tue, 20 Mar 2018 07:37:29 +0100
+
+strongswan (5.6.2-1ubuntu1) bionic; urgency=medium
+
+  * Merge with Debian unstable (LP: #1753018). Remaining changes:
+    + Clean up d/strongswan-starter.postinst: section about runlevel changes
+    + Clean up d/strongswan-starter.postinst: Removed entire section on
+      opportunistic encryption disabling - this was never in strongSwan and
+      won't be see upstream issue #2160.
+    + Ubuntu is not using the debconf triggered private key generation
+      - d/rules: Removed patching ipsec.conf on build (not using the
+        debconf-managed config.)
+      - d/ipsec.secrets.proto: Removed ipsec.secrets.inc reference (was
+        used for debconf-managed include of private key).
+    + Mass enablement of extra plugins and features to allow a user to use
+      strongswan for a variety of extra use cases without having to rebuild.
+      - d/control: Add required additional build-deps
+      - d/control: Mention addtionally enabled plugins
+      - d/rules: Enable features at configure stage
+      - d/libbstrongswan-extra-plugins.install: Add plugins (so, lib, conf)
+      - d/libstrongswan.install: Add plugins (so, conf)
+    + d/strongswan-starter.install: Install pool feature, which is useful since
+      we have attr-sql plugin enabled as well using it.
+    + Add plugin kernel-libipsec to allow the use of strongswan in containers
+      via this userspace implementation (please do note that this is still
+      considered experimental by upstream).
+      - d/libcharon-extra-plugins.install: Add kernel-libipsec components
+      - d/control: List kernel-libipsec plugin at extra plugins description
+      - d/p/dont-load-kernel-libipsec-plugin-by-default.patch: As
+        upstream recommends to not load kernel-libipsec by default.
+    + Relocate tnc plugin
+     - debian/libcharon-extra-plugins.install: Drop tnc from extra plugins
+     - Add new subpackage for TNC in d/strongswan-tnc-* and d/control
+    + d/libstrongswan.install: Reorder conf and .so alphabetically
+    + d/libstrongswan.install: Add kernel-netlink configuration files
+    + Complete the disabling of libfast; This was partially accepted in Debian,
+        it is no more packaging medcli and medsrv, but still builds and
+        mentions it.
+      - d/rules: Add --disable-fast to avoid build time and dependencies
+      - d/control: Remove medcli, medsrv from package description
+    + d/control: Mention mgf1 plugin which is in libstrongswan now
+    + Add now built (since 5.5.1) libraries libtpmtss and nttfft to
+      libstrongswan-extra-plugins (no deps from default plugins).
+    + Add rm_conffile for /etc/init.d/ipsec (transition from precies had
+      missed that, droppable after 18.04)
+    + d/control, d/libcharon-{extras,standard}-plugins.install: Move charon
+      plugins for the most common use cases from extra-plugins into a new
+      standard-plugins package. This will allow those use cases without pulling
+      in too much more plugins (a bit like the tnc package). Recommend that
+      package from strongswan-libcharon.
+    + d/control: bump breaks/replaces from libstrongswan-extra-plugins to
+      libstrongswan as we dropped relocating ccm and test-vectors.
+      (droppable >18.04).
+    + d/control: add breaks/replace from libstrongswan to
+      libstrongswan-extra-plugins for the move of mgf1 to libstrongswan.
+      (droppable >18.04).
+  * Added Changes:
+    + d/control: bump breaks/replaces from strongswan-libcharon to strongswan-
+      starter as we followed Debian to move the updown plugin but need to
+      match Ubuntu versions (Droppable >18.04).
+
+ -- Christian Ehrhardt <[e-mail]>  Fri, 16 Mar 2018 11:08:47 +0100
+
 strongswan (5.6.2-1) unstable; urgency=medium
 
   * d/NEWS: add information about disabled algorithms (closes: #883072)
@@ -93,6 +484,129 @@ strongswan (5.6.1-3) unstable; urgency=medium
 
  -- Yves-Alexis Perez <[e-mail]>  Sun, 17 Dec 2017 16:40:39 +0100
 
+strongswan (5.6.1-2ubuntu4) bionic; urgency=medium
+
+  * SECURITY UPDATE: DoS via crafted RSASSA-PSS signature
+    - debian/patches/CVE-2018-6459.patch: Properly handle MGF1 algorithm
+      identifier without parameters in
+      src/libstrongswan/credentials/keys/signature_params.c.
+    - CVE-2018-6459
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 07 Mar 2018 14:52:02 +0100
+
+strongswan (5.6.1-2ubuntu3) bionic; urgency=medium
+
+  * No-change rebuild against libcurl4
+
+ -- Steve Langasek <[e-mail]>  Wed, 28 Feb 2018 08:52:09 +0000
+
+strongswan (5.6.1-2ubuntu2) bionic; urgency=high
+
+  * No change rebuild against openssl1.1.
+
+ -- Dimitri John Ledkov <[e-mail]>  Mon, 12 Feb 2018 16:00:24 +0000
+
+strongswan (5.6.1-2ubuntu1) bionic; urgency=medium
+
+  * Merge with Debian unstable (LP: #1717343).
+    Also fixes and issue with multiple psk's (LP: #1734207). Remaining changes:
+    + Clean up d/strongswan-starter.postinst: section about runlevel changes
+    + Clean up d/strongswan-starter.postinst: Removed entire section on
+      opportunistic encryption disabling - this was never in strongSwan and
+      won't be see upstream issue #2160.
+    + Ubuntu is not using the debconf triggered private key generation
+      - d/rules: Removed patching ipsec.conf on build (not using the
+        debconf-managed config.)
+      - d/ipsec.secrets.proto: Removed ipsec.secrets.inc reference (was
+        used for debconf-managed include of private key).
+    + Mass enablement of extra plugins and features to allow a user to use
+      strongswan for a variety of extra use cases without having to rebuild.
+      - d/control: Add required additional build-deps
+      - d/control: Mention addtionally enabled plugins
+      - d/rules: Enable features at configure stage
+      - d/libbstrongswan-extra-plugins.install: Add plugins (so, lib, conf)
+      - d/libstrongswan.install: Add plugins (so, conf)
+    + d/strongswan-starter.install: Install pool feature, which is useful since
+      we have attr-sql plugin enabled as well using it.
+    + Add plugin kernel-libipsec to allow the use of strongswan in containers
+      via this userspace implementation (please do note that this is still
+      considered experimental by upstream).
+      - d/libcharon-extra-plugins.install: Add kernel-libipsec components
+      - d/control: List kernel-libipsec plugin at extra plugins description
+      - d/p/dont-load-kernel-libipsec-plugin-by-default.patch: As
+        upstream recommends to not load kernel-libipsec by default.
+    + Relocate tnc plugin
+     - debian/libcharon-extra-plugins.install: Drop tnc from extra plugins
+     - Add new subpackage for TNC in d/strongswan-tnc-* and d/control
+    + d/libstrongswan.install: Reorder conf and .so alphabetically
+    + d/libstrongswan.install: Add kernel-netlink configuration files
+    + Complete the disabling of libfast; This was partially accepted in Debian,
+        it is no more packaging medcli and medsrv, but still builds and
+        mentions it.
+      - d/rules: Add --disable-fast to avoid build time and dependencies
+      - d/control: Remove medcli, medsrv from package description
+    + d/control: Mention mgf1 plugin which is in libstrongswan now
+    + Add now built (since 5.5.1) libraries libtpmtss and nttfft to
+      libstrongswan-extra-plugins (no deps from default plugins).
+    + Add rm_conffile for /etc/init.d/ipsec (transition from precies had
+      missed that, droppable after 18.04)
+    + d/control, d/libcharon-{extras,standard}-plugins.install: Move charon
+      plugins for the most common use cases from extra-plugins into a new
+      standard-plugins package. This will allow those use cases without pulling
+      in too much more plugins (a bit like the tnc package). Recommend that
+      package from strongswan-libcharon.
+  * Added changes:
+    + d/strongswan-tnc-client.install (relocate tnc) swidtag creation changed
+      in 5.6
+    + d/strongswan-tnc-server.install (relocate tnc) pacman no more needed
+    + d/control: bump breaks/replaces from libstrongswan-extra-plugins to
+      libstrongswan as we dropped relocating ccm and test-vectors.
+      (droppable >18.04).
+    - d/control: add breaks/replace from libstrongswan to
+      libstrongswan-extra-plugins for the move of mgf1 to libstrongswan.
+      (droppable >18.04).
+  * Dropped changes:
+    + Update init/service handling (debian default matches Ubuntu past now)
+      Dropping this fixes (LP: #1734886)
+      - d/rules: Change init/systemd program name to strongswan
+      - d/strongswan-starter.strongswan.service: Add new systemd file instead of
+        patching upstream
+      - d/strongswan-starter.links: Removed, use Ubuntu systemd file instead of
+        linking to upstream
+    + d/strongswan-starter.postrm: Removed 'update-rc.d ipsec remove' call
+      (this is a never failing no-op for us, no need for Delta).
+    + d/strongswan-starter.prerm: Stop strongswan service on package removal
+      (ipsec now maps to strongswan service, so this works as-is).
+    + Clean up d/strongswan-starter.postinst: rename service ipsec to
+      strongswan (ipsec now maps to strongswan service, so this works as-is)
+    + Clean up d/strongswan-starter.postinst: daemon enable/disable (the
+      whole section is disabled, so no need for delta)
+    + (is upstream) CVE-2017-11185 patches
+    + (is upstream) FTBFS upstream fix for changed include files
+    + (is upstream) debian/patches/increase-bliss-test-timeout.patch: Under
+       QEMU/KVM autopkgtest the bliss test takes longer than the default
+    + (in Debian) add now built (since 5.5.1) mgf1 plugin to
+      libstrongswan-extra-plugins.
+    + (in Debian) d/strongswan-starter.install: install stroke apparmor profile
+    + (this was enabled as part of the former delta, squash changes to no-up)
+      d/rules: Disable duplicheck.
+    + (not needed) Relocate plugins test-vectors from extra-plugins to
+      libstrongswan
+      - d/libstrongswan-extra-plugins.install: Remove plugins/conffiles
+      - d/libstrongswan.install: Add plugins/confiles
+      - d/control: move package descriptions and add required breaks/replaces
+    + (not needed) Relocate plugins ccm from extra-plugins to libstrongswan
+      - d/libstrongswan-extra-plugins.install: Remove plugins/conffiles
+      - d/libstrongswan.install: Add plugins/confiles
+      - d/control: move package descriptions and add required breaks/replaces
+    + (while using it requires special kernel, it does not hurt to be
+      available in the package) Remove ha plugin
+      - d/libcharon-extra-plugins.install: Stop installing ha (so, conf)
+      - d/rules: Do not enable ha plugin
+      - d/control: Drop listing the ha plugin in the package description
+
+ -- Christian Ehrhardt <[e-mail]>  Wed, 29 Nov 2017 15:55:18 +0100
+
 strongswan (5.6.1-2) unstable; urgency=medium
 
   * move counters plugin from -starter to -libcharon. closes: #882431
@@ -179,6 +693,213 @@ strongswan (5.5.2-1) experimental; urgency=medium
 
  -- Yves-Alexis Perez <[e-mail]>  Fri, 19 May 2017 11:32:00 +0200
 
+strongswan (5.5.1-4ubuntu3) bionic; urgency=medium
+
+  * Fix Artful FTBFS due to newer glibc (LP: #1724859)
+    - d/p/utils-Include-stdint.h.patch: upstream fix for changed include
+      files.
+
+ -- Christian Ehrhardt <[e-mail]>  Thu, 19 Oct 2017 15:18:52 +0200
+
+strongswan (5.5.1-4ubuntu2) artful; urgency=medium
+
+  * SECURITY UPDATE: Fix RSA signature verification
+    - debian/patches/CVE-2017-11185.patch: does some
+      verifications in order to avoid null-point dereference
+      in src/libstrongswan/gmp/gmp_rsa_public_key.c
+    - CVE-2017-11185
+
+ -- Leonidas S. Barbosa <[e-mail]>  Tue, 15 Aug 2017 14:49:49 -0300
+
+strongswan (5.5.1-4ubuntu1) artful; urgency=medium
+
+  * Merge from Debian to pick up latest security changes (CVE-2017-9022,
+    CVE-2017-9023).
+  * Remaining Changes:
+    + Update init/service handling
+      - d/rules: Change init/systemd program name to strongswan
+      - d/strongswan-starter.strongswan.service: Add new systemd file instead of
+        patching upstream
+      - d/strongswan-starter.links: Removed, use Ubuntu systemd file instead of
+        linking to upstream
+      - d/strongswan-starter.postrm: Removed 'update-rc.d ipsec remove' call.
+      - d/strongswan-starter.prerm: Stop strongswan service on package
+        removal (as opposed to using the old init.d script).
+    + Clean up d/strongswan-starter.postinst:
+      - Removed section about runlevel changes
+      - Adapted service restart section for Upstart (kept to be Trusty
+        backportable).
+      - Remove old symlinks to init.d files is necessary.
+      - Removed further out-dated code
+      - Removed entire section on opportunistic encryption - this was never in
+        strongSwan.
+    + d/rules: Removed pieces on 'patching ipsec.conf' on build.
+    + Mass enablement of extra plugins and features to allow a user to use
+      strongswan for a variety of use cases without having to rebuild.
+      - d/control: Add required additional build-deps
+      - d/rules: Enable features at configure stage
+      - d/control: Mention addtionally enabled plugins
+      - d/libbstrongswan-extra-plugins.install: Add plugins (so, lib, conf)
+      - d/libstrongswan.install: Add plugins (so, conf)
+    + d/rules: Disable duplicheck as per
+      https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=718291#10
+    + Remove ha plugin (requires special kernel)
+      - d/libcharon-extra-plugins.install: Stop installing ha (so, conf)
+      - d/rules: Do not enable ha plugin
+      - d/control: Drop listing the ha plugin in the package description
+    + Add plugin kernel-libipsec to allow the use of strongswan in containers
+      via this userspace implementation (please do note that this is still
+      considered experimental by upstream).
+      - d/libcharon-extra-plugins.install: Add kernel-libipsec components
+      - d/control: List kernel-libipsec plugin at extra plugins description
+      - d/p/dont-load-kernel-libipsec-plugin-by-default.patch: As
+        upstream recommends to not load kernel-libipsec by default.
+    + Relocate tnc plugin
+     - debian/libcharon-extra-plugins.install: Drop tnc from extra plugins
+     - Add new subpackage for TNC in d/strongswan-tnc-* and d/control
+    + d/strongswan-starter.install: Install pool feature, that useful due to
+      having attr-sql plugin that is enabled now.
+    + Relocate plugins test-vectors and ccm from extra-plugins to libstrongswan
+      - d/libstrongswan-extra-plugins.install: Remove plugins/conffiles
+      - d/libstrongswan.install: Add plugins/confiles
+      - d/control: move package descriptions and add required breaks/replaces
+    + d/libstrongswan.install: Reorder conf and .so alphabetically
+    + d/libstrongswan.install: Add kernel-netlink configuration files
+    + d/ipsec.secrets.proto: Removed ipsec.secrets.inc reference.
+    + debian/patches/increase-bliss-test-timeout.patch: Under QEMU/KVM
+      autopkgtest the bliss test takes longer than the default (Upstream in
+      5.5.2 via issue 2204)
+    + Complete the disabling of libfast; This was partially accepted in Debian,
+        it is no more packaging medcli and medsrv, but still builds and
+        mentions it.
+      - d/rules: Add --disable-fast to avoid build time and dependencies
+      - d/control: Remove medcli, medsrv from package description
+    + Add now built (5.5.1 vs 5.3.5) mgf1 plugin to libstrongswan-extra-plugins.
+      "only" to extra-plugins Mgf1 is not listed as default plugin at
+      https://wiki.strongswan.org/projects/strongswan/wiki/Pluginlist.
+    + Add now built (5.5.1 vs 5.3.5) libraries libtpmtss and nttfft to
+      libstrongswan-extra-plugins.
+    + Add missing mention of md4 plugin in d/control
+    + Add rm_conffile for /etc/init.d/ipsec (transition from precies had
+      missed that)
+    + d/control, d/libcharon-{extras,standard}-plugins.install: Move charon
+      plugins for the most common use cases from extra-plugins into a new
+      standard-plugins package. This will allow those use cases without pulling
+      in too much more plugins (a bit like the tnc package). Recommend that
+      package from strongswan-libcharon.
+
+ -- Christian Ehrhardt <[e-mail]>  Wed, 31 May 2017 15:57:54 +0200
+
+strongswan (5.5.1-3ubuntu1) artful; urgency=medium
+
+  * Merge from Debian to pick up latest changes. Among others this includes:
+    - a lot of the Delta we upstreamed to Debian (more discussions are ongoing
+      but likely have to wait until Debian stretch was released)
+    - enabling mediation support (LP: #1657413)
+  * Remaining Changes:
+    + Update init/service handling
+      - d/rules: Change init/systemd program name to strongswan
+      - d/strongswan-starter.strongswan.service: Add new systemd file instead of
+        patching upstream
+      - d/strongswan-starter.links: Removed, use Ubuntu systemd file instead of
+        linking to upstream
+      - d/strongswan-starter.postrm: Removed 'update-rc.d ipsec remove' call.
+      - d/strongswan-starter.prerm: Stop strongswan service on package
+        removal (as opposed to using the old init.d script).
+    + Clean up d/strongswan-starter.postinst:
+      - Removed section about runlevel changes
+      - Adapted service restart section for Upstart (kept to be Trusty
+        backportable).
+      - Remove old symlinks to init.d files is necessary.
+      - Removed further out-dated code
+      - Removed entire section on opportunistic encryption - this was never in
+        strongSwan.
+    + d/rules: Removed pieces on 'patching ipsec.conf' on build.
+    + Mass enablement of extra plugins and features to allow a user to use
+      strongswan for a variety of use cases without having to rebuild.
+      - d/control: Add required additional build-deps
+      - d/rules: Enable features at configure stage
+      - d/control: Mention addtionally enabled plugins
+      - d/libbstrongswan-extra-plugins.install: Add plugins (so, lib, conf)
+      - d/libstrongswan.install: Add plugins (so, conf)
+    + d/rules: Disable duplicheck as per
+      https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=718291#10
+    + Remove ha plugin (requires special kernel)
+      - d/libcharon-extra-plugins.install: Stop installing ha (so, conf)
+      - d/rules: Do not enable ha plugin
+      - d/control: Drop listing the ha plugin in the package description
+    + Add plugin kernel-libipsec to allow the use of strongswan in containers
+      via this userspace implementation (please do note that this is still
+      considered experimental by upstream).
+      - d/libcharon-extra-plugins.install: Add kernel-libipsec components
+      - d/control: List kernel-libipsec plugin at extra plugins description
+      - d/p/dont-load-kernel-libipsec-plugin-by-default.patch: As
+        upstream recommends to not load kernel-libipsec by default.
+    + Relocate tnc plugin
+     - debian/libcharon-extra-plugins.install: Drop tnc from extra plugins
+     - Add new subpackage for TNC in d/strongswan-tnc-* and d/control
+    + d/strongswan-starter.install: Install pool feature, that useful due to
+      having attr-sql plugin that is enabled now.
+    + Relocate plugins test-vectors and ccm from extra-plugins to libstrongswan
+      - d/libstrongswan-extra-plugins.install: Remove plugins/conffiles
+      - d/libstrongswan.install: Add plugins/confiles
+      - d/control: move package descriptions and add required breaks/replaces
+    + d/libstrongswan.install: Reorder conf and .so alphabetically
+    + d/libstrongswan.install: Add kernel-netlink configuration files
+    + d/ipsec.secrets.proto: Removed ipsec.secrets.inc reference.
+    + debian/patches/increase-bliss-test-timeout.patch: Under QEMU/KVM
+      autopkgtest the bliss test takes longer than the default (Upstream in
+      5.5.2 via issue 2204)
+    + Complete the disabling of libfast; This was partially accepted in Debian,
+        it is no more packaging medcli and medsrv, but still builds and
+        mentions it.
+      - d/rules: Add --disable-fast to avoid build time and dependencies
+      - d/control: Remove medcli, medsrv from package description
+    + Add now built (5.5.1 vs 5.3.5) mgf1 plugin to libstrongswan-extra-plugins.
+      "only" to extra-plugins Mgf1 is not listed as default plugin at
+      https://wiki.strongswan.org/projects/strongswan/wiki/Pluginlist.
+    + Add now built (5.5.1 vs 5.3.5) libraries libtpmtss and nttfft to
+      libstrongswan-extra-plugins.
+    + Add missing mention of md4 plugin in d/control
+    + Add rm_conffile for /etc/init.d/ipsec (transition from precies had
+      missed that)
+    + d/control, d/libcharon-{extras,standard}-plugins.install: Move charon
+      plugins for the most common use cases from extra-plugins into a new
+      standard-plugins package. This will allow those use cases without pulling
+      in too much more plugins (a bit like the tnc package). Recommend that
+      package from strongswan-libcharon.
+  * Dropped Changes:
+    + Add and install apparmor profiles (in Debian)
+      - d/rules: Install AppArmor profiles
+      - d/control: Add dh-apparmor build-dep
+      - d/usr.lib.ipsec.{charon, lookip, stroke}: Add latest AppArmor profiles
+        for charon, lookip and stroke
+      - d/libcharon-extra-plugins.install: Install profile for lookip
+      - d/strongswan-charon.install: Install profile for charon
+      - d/strongswan-starter.install: Install profile for stroke
+      - Fix strongswan ipsec status issue with apparmor
+      - Fix Dep8 tests for the now extra strongswan-pki package for pki
+      - Fix Dep8 tests for the now extra strongswan-scepclient package
+    + d/rules: Sorted and only one enable option per configure line (in
+      Debian)
+    + Add updated logcheck rules (in Debian)
+      - debian/libstrongswan.strongswan.logcheck.*:  Remove outdated files
+      - debian/strongswan.logcheck: Add updated logcheck rules
+    + Add updated DEP8 tests (in Debian)
+      - d/tests/*: Add DEP8 tests
+      - d/control: Enable autotestpkg
+    + d/rules: do not strip for library integrity checking (After Discussion
+      with Debian this isn't acceptable there, but at the same time it turned
+      out the real use-case of this never uses this lib but instead third
+      party checks of checksums for e.g. FIPS cert; so drop the Delta)
+      - Use override_dh_strip to to avoid overwriting user build flags.
+      - Add missing mention of libchecksum integrity test in d/control
+    + d/rules: Set TESTS_REDUCED_KEYLENGTHS to one generate smallest key-lengths
+      in tests to avoid issues in low entropy environments. (Debian has
+      disabled !x86 tests for the same reason, one solution is enough)
+
+ -- Christian Ehrhardt <[e-mail]>  Thu, 04 May 2017 14:06:23 +0200
+
 strongswan (5.5.1-3) unstable; urgency=medium
 
   [ Christian Ehrhardt ]
@@ -212,6 +933,136 @@ strongswan (5.5.1-2) unstable; urgency=medium
 
  -- Yves-Alexis Perez <[e-mail]>  Wed, 07 Dec 2016 08:34:52 +0100
 
+strongswan (5.5.1-1ubuntu2) zesty; urgency=medium
+
+  * Update Maintainers which was missed while merging 5.5.1-1.
+
+ -- Christian Ehrhardt <[e-mail]>  Mon, 19 Dec 2016 16:02:40 +0100
+
+strongswan (5.5.1-1ubuntu1) zesty; urgency=medium
+
+  * Merge from Debian (complex delta, discussions and broken out changes can be
+    found in the merge proposal linked from the merge bug LP: #1631198)
+  * Remaining Changes:
+    + d/rules: Enforcing DEB_BUILD_OPTIONS=nostrip for library integrity
+      checking.
+    + d/rules: Set TESTS_REDUCED_KEYLENGTHS to one generate smallest key-lengths
+      in tests to avoid issues in low entropy environments.
+    + Update init/service handling
+      - d/rules: Change init/systemd program name to strongswan
+      - d/strongswan-starter.strongswan.service: Add new systemd file instead of
+        patching upstream
+      - d/strongswan-starter.links: Removed, use Ubuntu systemd file instead of
+        linking to upstream
+      - d/strongswan-starter.postrm: Removed 'update-rc.d ipsec remove' call.
+      - d/strongswan-starter.prerm: Stop strongswan service on package
+        removal (as opposed to using the old init.d script).
+    + Clean up d/strongswan-starter.postinst:
+      - Removed section about runlevel changes
+      - Adapted service restart section for Upstart (kept to be Trusty
+        backportable).
+      - Remove old symlinks to init.d files is necessary.
+      - Removed further out-dated code
+      - Removed entire section on opportunistic encryption - this was never in
+        strongSwan.
+    + Add and install apparmor profiles
+      - d/rules: Install AppArmor profiles
+      - d/control: Add dh-apparmor build-dep
+      - d/usr.lib.ipsec.{charon, lookip, stroke}: Add latest AppArmor profiles
+        for charon, lookip and stroke
+      - d/libcharon-extra-plugins.install: Install profile for lookip
+      - d/strongswan-charon.install: Install profile for charon
+      - d/strongswan-starter.install: Install profile for stroke
+    + d/rules: Removed pieces on 'patching ipsec.conf' on build.
+    + d/rules: Sorted and only one enable option per configure line
+    + Mass enablement of extra plugins and features to allow a user to use
+      strongswan for a variety of use cases without having to rebuild.
+      - d/control: Add required additional build-deps
+      - d/rules: Enable features at configure stage
+      - d/control: Mention addtionally enabled plugins
+      - d/libbstrongswan-extra-plugins.install: Add plugins (so, lib, conf)
+      - d/libstrongswan.install: Add plugins (so, conf)
+    + d/rules: Disable duplicheck as per
+      https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=718291#10
+    + Remove ha plugin (requires special kernel)
+      - d/libcharon-extra-plugins.install: Stop installing ha (so, conf)
+      - d/rules: Do not enable ha plugin
+      - d/control: Drop listing the ha plugin in the package description
+    + Add plugin kernel-libipsec to allow the use of strongswan in containers
+      via this userspace implementation (please do note that this is still
+      considered experimental by upstream).
+      - d/libcharon-extra-plugins.install: Add kernel-libipsec components
+      - d/control: List kernel-libipsec plugin at extra plugins description
+      - d/p/dont-load-kernel-libipsec-plugin-by-default.patch: As
+        upstream recommends to not load kernel-libipsec by default.
+    + Relocate tnc plugin
+     - debian/libcharon-extra-plugins.install: Drop tnc from extra plugins
+     - Add new subpackage for TNC in d/strongswan-tnc-* and d/control
+    + d/strongswan-starter.install: Install pool feature, that useful due to
+      having attr-sql plugin that is enabled now.
+    + Relocate plugins test-vectors and ccm from extra-plugins to libstrongswan
+      - d/libstrongswan-extra-plugins.install: Remove plugins
+      - d/libstrongswan.install: Add plugins
+    + d/libstrongswan.install: Reorder conf and .so alphabetically
+    + d/libstrongswan.install: Add kernel-netlink configuration files
+    + d/ipsec.secrets.proto: Removed ipsec.secrets.inc reference.
+    + Add updated logcheck rules
+      - debian/libstrongswan.strongswan.logcheck.*:  Remove outdated files
+      - debian/strongswan.logcheck: Add updated logcheck rules
+    + Add updated DEP8 tests
+      - d/tests/*: Add DEP8 tests
+      - d/control: Enable autotestpkg
+    + debian/patches/increase-bliss-test-timeout.patch: Under QEMU/KVM
+      autopkgtest the bliss test takes longer than the default
+    + Complete the disabling of libfast
+      - Note: This was partially accepted in Debian, it is no more
+        packaging medcli and medsrv, but still builds and mentions it
+      - d/rules: Add --disable-fast to avoid build time and dependencies
+      - d/control: Remove medcli, medsrv from package description
+  * Dropped Changes:
+    + Adding build-dep to iptables-dev (no change, was only in Changelog)
+    + Dropping of build deps libfcgi-dev, clearsilver-dev (in Debian)
+    + Adding strongswan-plugin-* virtual packages for dist-upgrade (no
+      upgrade path left needing them)
+    + Most of "disabling libfast" (Debian dropped it from package content)
+    + Transition for ipsec service (no upgrade path left)
+    + Reverted part of the cleanup to d/strongswan-starter.postinst as using
+      service should rather use invoke-rc.d (so it is a partial revert of our
+      delta)
+    + Transition handling (breaks/replaces) from per-plugin packages to the
+      three grouped plugin packages (no upgrade path left)
+    + debian/strongswan-starter.dirs: Don't touch /etc/init.d. (while "correct"
+      it is effectively a no-op still, so not worth the delta)
+    + Lower dpkg-dev to 1.16.1 from 1.16.2 to enable backporting to Precise
+      (no more needed)
+    + d/rules: Remove configure option --enable-unit-test (unit tests run by
+      default)
+  * Added Changes:
+    + Fix strongswan ipsec status issue with apparmor (LP: #1587886)
+    + d/control, d/libstrongswan.install, d/libstrongswan-extra-plugins: Fixup
+      the relocation of the ccm plugin which missed to move the conffiles.
+    + Complete move of test-vectors (was missing in d/control)
+    + Add now built (5.5.1 vs 5.3.5) mgf1 plugin to libstrongswan-extra-plugins.
+      "only" to extra-plugins Mgf1 is not listed as default plugin at
+      https://wiki.strongswan.org/projects/strongswan/wiki/Pluginlist.
+    + Add now built (5.5.1 vs 5.3.5) libraries libtpmtss and nttfft to
+      libstrongswan-extra-plugins.
+    + Add missing mention of md4 plugin in d/control
+    + Add missing mention of libchecksum integrity test in d/control
+    + Add rm_conffile for /etc/init.d/ipsec (transition from precies had
+      missed that)
+    + Use override_dh_strip to to fix library integrity checking instead of
+      DEB_BUILD_OPTION to avoid overwriting user build flags.
+    + d/control, d/libcharon-{extras,standard}-plugins.install: Move charon
+      plugins for the most common use cases from extra-plugins into a new
+      standard-plugins package. This will allow those use cases without pulling
+      in too much more plugins (a bit like the tnc package). Recommend that
+      package from strongswan-libcharon (LP: #1640826).
+    + Fix Dep8 tests for the now extra strongswan-pki package for pki
+    + Fix Dep8 tests for the now extra strongswan-scepclient package
+
+ -- Christian Ehrhardt <[e-mail]>  Mon, 07 Nov 2016 16:16:41 +0100
+
 strongswan (5.5.1-1) unstable; urgency=medium
 
   * New upstream bugfix release.
@@ -328,6 +1179,177 @@ strongswan (5.3.5-2) unstable; urgency=medium
 
  -- Yves-Alexis Perez <[e-mail]>  Mon, 14 Mar 2016 23:53:34 +0100
 
+strongswan (5.3.5-1ubuntu4) yakkety; urgency=medium
+
+  * Build-depend on libjson-c-dev instead of libjson0-dev.
+  * Rebuild against libjson-c3.
+
+ -- Graham Inggs <[e-mail]>  Fri, 29 Apr 2016 19:04:22 +0200
+
+strongswan (5.3.5-1ubuntu3) xenial; urgency=medium
+
+  * Rebuild against libmysqlclient20.
+
+ -- Robie Basak <[e-mail]>  Tue, 05 Apr 2016 13:02:48 +0000
+
+strongswan (5.3.5-1ubuntu2) xenial; urgency=medium
+
+  * debian/tests/plugins: rdrand may or may not be loaded, depending on the
+    cpu features.
+
+ -- Iain Lane <[e-mail]>  Mon, 22 Feb 2016 17:13:01 +0000
+
+strongswan (5.3.5-1ubuntu1) xenial; urgency=medium
+
+  * debian/{rules,control,libstrongswan-extra-plugins.install}
+    Enable bliss plugin
+  * debian/{rules,control,libstrongswan-extra-plugins.install}
+    Enable chapoly plugin
+  * debian/patches/dont-load-kernel-libipsec-plugin-by-default.patch
+    Upstream suggests to not load this plugin by default as it has
+    some limitations.
+    https://wiki.strongswan.org/projects/strongswan/wiki/Kernel-libipsec
+  * debian/patches/increase-bliss-test-timeout.patch
+    Under QEMU/KVM for autopkgtest bliss test takes a bit longer then default
+  * Update Apparmor profiles
+    - usr.lib.ipsec.charon
+      - add capability audit_write for xauth-pam (LP: #1470277)
+      - add capability dac_override (needed by agent plugin)
+      - allow priv dropping (LP: #1333655)
+      - allow caching CRLs (LP: #1505222)
+      - allow rw access to /dev/net/tun for kernel-libipsec (LP: #1309594)
+    - usr.lib.ipsec.stroke
+      - allow priv dropping (LP: #1333655)
+      - add local include
+    - usr.lib.ipsec.lookip
+      - add local include
+  * Merge from Debian, which includes fixes for all previous CVEs
+    Fixes (LP: #1330504, #1451091, #1448870, #1470277)
+    Remaining changes:
+      * debian/control
+        - Lower dpkg-dev to 1.16.1 from 1.16.2 to enable backporting to Precise
+        - Update Maintainer for Ubuntu
+        - Add build-deps
+          - dh-apparmor
+          - iptables-dev
+          - libjson0-dev
+          - libldns-dev
+          - libmysqlclient-dev
+          - libpcsclite-dev
+          - libsoup2.4-dev
+          - libtspi-dev
+          - libunbound-dev
+        - Drop build-deps
+          - libfcgi-dev
+          - clearsilver-dev
+        - Create virtual packages for all strongswan-plugin-* for dist-upgrade
+        - Set XS-Testsuite: autopkgtest
+      * debian/rules:
+        - Enforcing DEB_BUILD_OPTIONS=nostrip for library integrity checking.
+        - Set TESTS_REDUCED_KEYLENGTHS to one generate smallest key-lengths in
+          tests.
+        - Change init/systemd program name to strongswan
+        - Install AppArmor profiles
+        - Removed pieces on 'patching ipsec.conf' on build.
+        - Enablement of features per Ubuntu current config suggested from
+          upstream recommendation
+        - Unpack and sort enabled features to one-per-line
+        - Disable duplicheck as per
+          https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=718291#10
+        - Disable libfast (--disable-fast):
+          Requires dropping medsrv, medcli plugins which depend on libfast
+        - Add configure options
+          --with-tss=trousers
+        - Remove configure options:
+          --enable-ha (requires special kernel)
+          --enable-unit-test (unit tests run by default)
+        - Drop logcheck install
+      * debian/tests/*
+        - Add DEP8 test for strongswan service and plugins
+      * debian/strongswan-starter.strongswan.service
+        - Add new systemd file instead of patching upstream
+      * debian/strongswan-starter.links
+        - removed, use Ubuntu systemd file instead of linking to upstream
+      * debian/usr.lib.ipsec.{charon, lookip, stroke}
+        - added AppArmor profiles for charon, lookip and stroke
+      * debian/libcharon-extra-plugins.install
+        - Add plugins
+          - kernel-libipsec.{so, lib, conf, apparmor}
+        - Remove plugins
+          - libstrongswan-ha.so
+        - Relocate plugins
+          - libstrongswan-tnc-tnccs.so (strongswan-tnc-base.install)
+      * debian/libstrongswan-extra-plugins.install
+        - Add plugins (so, lib, conf)
+          - acert
+          - attr-sql
+          - coupling
+          - dnscert
+          - fips-prf
+          - gmp
+          - ipseckey
+          - load-tester
+          - mysql
+          - ntru
+          - radattr
+          - soup
+          - sqlite
+          - sql
+          - systime-fix
+          - unbound
+          - whitelist
+        - Relocate plugins (so, lib, conf)
+          - ccm (libstrongswan.install)
+          - test-vectors (libstrongswan.install)
+      * debian/libstrongswan.install
+        - Sort sections
+        - Add plugins (so, lib, conf)
+          - libchecksum
+          - ccm
+          - eap-identity
+          - md4
+          - test-vectors
+      * debian/strongswan-charon.install
+        - Add AppArmor profile for charon
+      * debian/strongswan-starter.install
+        - Add tools, manpages, conf
+          - openac
+          - pool
+          - _updown_espmark
+        - Add AppArmor profile for stroke
+      * debian/strongswan-tnc-base.install
+        - Add new subpackage for TNC
+        - remove non-existent (dropped in 5.2.1) libpts library files
+      * debian/strongswan-tnc-client.install
+        - Add new subpackage for TNC
+      * debian/strongswan-tnc-ifmap.install
+        - Add new subpackage for TNC
+      * debian/strongswan-tnc-pdp.install
+        - Add new subpackage for TNC
+      * debian/strongswan-tnc-server.install
+        - Add new subpackage for TNC
+      * debian/strongswan-starter.postinit:
+        - Removed section about runlevel changes, it's almost 2014.
+        - Adapted service restart section for Upstart.
+        - Remove old symlinks to init.d files is necessary.
+      * debian/strongswan-starter.dirs: Don't touch /etc/init.d.
+      * debian/strongswan-starter.postrm: Removed 'update-rc.d ipsec remove' call.
+      * debian/strongswan-starter.prerm: Stop strongswan service on package
+        removal (as opposed to using the old init.d script).
+      * debian/libstrongswan.strongswan.logcheck combined into debian/strongswan.logcheck
+        - logcheck patterns updated to be helpful
+      * debian/strongswan-starter.postinst: Removed further out-dated code and
+        entire section on opportunistic encryption - this was never in strongSwan.
+      * debian/ipsec.secrets.proto: Removed ipsec.secrets.inc reference.
+    Drop changes:
+      * debian/control
+        - Per-plugin package breakup: Reducing packaging delta from Debian 
+        - Don't build dhcp, farp subpackages: Reduce packging delta from Debian
+      * debian/watch: Already exists in Debian merge
+      * debian/upstream/signing-key.asc:  Upstream has newer version.
+
+ -- Ryan Harper <[e-mail]>  Fri, 12 Feb 2016 11:24:53 -0600
+
 strongswan (5.3.5-1) unstable; urgency=medium
 
   * New upstream bugfix release.
@@ -600,6 +1622,210 @@ strongswan (5.1.2-1) unstable; urgency=medium
 
  -- Yves-Alexis Perez <[e-mail]>  Wed, 12 Mar 2014 11:22:38 +0100
 
+strongswan (5.1.2-0ubuntu8) xenial; urgency=medium
+
+  * Import FTBFS for s390x from Debian 5.1.2-3 upload. (LP: #1521240)
+
+ -- Dimitri John Ledkov <[e-mail]>  Mon, 30 Nov 2015 15:46:06 +0000
+
+strongswan (5.1.2-0ubuntu7) xenial; urgency=medium
+
+  * SECURITY UPDATE: authentication bypass in eap-mschapv2 plugin
+    - debian/patches/CVE-2015-8023.patch: only succeed authentication if
+      MSK was established in
+      src/libcharon/plugins/eap_mschapv2/eap_mschapv2.c.
+    - CVE-2015-8023
+  * debian/patches/disable_ntru_test.patch: disable test causing FTBFS
+    until regression is properly investigated.
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 19 Nov 2015 14:00:17 -0500
+
+strongswan (5.1.2-0ubuntu6) wily; urgency=medium
+
+  * SECURITY UPDATE: user credential disclosure to rogue servers
+    - debian/patches/CVE-2015-4171.patch: enforce remote authentication
+      config before proceeding with own authentication in
+      src/libcharon/sa/ikev2/tasks/ike_auth.c.
+    - CVE-2015-4171
+  * debian/rules: don't FTBFS from unused service file
+
+ -- Marc Deslauriers <[e-mail]>  Mon, 08 Jun 2015 12:50:38 -0400
+
+strongswan (5.1.2-0ubuntu5) vivid; urgency=medium
+
+  * Add a systemd unit corresponding to strongswan-starter.strongswan.upstart.
+
+ -- Martin Pitt <[e-mail]>  Fri, 16 Jan 2015 08:27:54 +0100
+
+strongswan (5.1.2-0ubuntu4) vivid; urgency=medium
+
+  * SECURITY UPDATE: denial of service via DH group 1025
+    - debian/patches/CVE-2014-9221.patch: define MODP_CUSTOM outside of
+      IKE DH range in src/libstrongswan/crypto/diffie_hellman.c,
+      src/libstrongswan/crypto/diffie_hellman.h.
+    - CVE-2014-9221
+
+ -- Tyler Hicks <[e-mail]>  Mon, 05 Jan 2015 08:25:29 -0500
+
+strongswan (5.1.2-0ubuntu3) utopic; urgency=low
+
+  * Added "libgcrypt20-dev | libgcrypt11-dev" to build dependencies to fix
+    build.
+
+ -- Jonathan Davies <[e-mail]>  Wed, 15 Oct 2014 16:49:18 +0000
+
+strongswan (5.1.2-0ubuntu2) trusty; urgency=medium
+
+  * SECURITY UPDATE: remote authentication bypass
+    - debian/patches/CVE-2014-2338.patch: reject CREATE_CHILD_SA exchange
+      on unestablished IKE_SAs in src/libcharon/sa/ikev2/task_manager_v2.c.
+    - CVE-2014-2338
+
+ -- Marc Deslauriers <[e-mail]>  Mon, 14 Apr 2014 11:24:34 -0400
+
+strongswan (5.1.2-0ubuntu1) trusty; urgency=low
+
+  * New upstream release.
+
+ -- Jonathan Davies <[e-mail]>  Sat, 01 Mar 2014 08:53:17 +0000
+
+strongswan (5.1.2~rc2-0ubuntu2) trusty; urgency=low
+
+  * debian/ipsec.secrets.proto: Removed ipsec.secrets.inc reference.
+  * debian/usr.lib.ipsec.charon: Allow read access to /run/charon.
+
+ -- Jonathan Davies <[e-mail]>  Wed, 19 Feb 2014 13:07:16 +0000
+
+strongswan (5.1.2~rc2-0ubuntu1) trusty; urgency=low
+
+  * New upstream release candidate.
+
+ -- Jonathan Davies <[e-mail]>  Wed, 19 Feb 2014 12:59:21 +0000
+
+strongswan (5.1.2~rc1-0ubuntu4) trusty; urgency=medium
+
+  * debian/strongswan-tnc-*.install: Fixed files so libraries go into correct
+    packages.
+  * debian/usr.lib.ipsec.stroke: Allow access to strongswan.d directories.
+
+ -- Jonathan Davies <[e-mail]>  Mon, 17 Feb 2014 18:12:38 +0000
+
+strongswan (5.1.2~rc1-0ubuntu3) trusty; urgency=low
+
+  * debian/rules: Exclude rdrand.conf in dh_install's --fail-missing.
+
+ -- Jonathan Davies <[e-mail]>  Sat, 15 Feb 2014 15:46:46 +0000
+
+strongswan (5.1.2~rc1-0ubuntu2) trusty; urgency=low
+
+  * debian/libstrongswan.install: Moved rdrand plugin configuration to rules
+    as it's only useful on amd64.
+  * debian/watch: Added opts=pgpsigurlmangle option.
+  * debian/upstream/signing-key.asc: Added key: 0xB34DBA77.
+
+ -- Jonathan Davies <[e-mail]>  Sat, 15 Feb 2014 15:32:10 +0000
+
+strongswan (5.1.2~rc1-0ubuntu1) trusty; urgency=medium
+
+  * New upstream release candidate.
+  * debian/*.install - include new configuration files for plugins in
+    appropiate packages.
+
+ -- Jonathan Davies <[e-mail]>  Sat, 15 Feb 2014 15:03:14 +0000
+
+strongswan (5.1.2~dr3+git20130120-0ubuntu3) trusty; urgency=low
+
+  * debian/control:
+    - Added Breaks/Replaces for all library files which have been moved
+      about (LP: #1278176).
+    - Removed build-dependency on check and added one on dh-apparmor.
+  * debian/strongswan-starter.postinst: Removed further out-dated code and
+    entire section on opportunistic encryption - this was never in strongSwan.
+  * debian/rules: Removed pieces on 'patching ipsec.conf' on build.
+
+ -- Jonathan Davies <[e-mail]>  Sun, 09 Feb 2014 23:53:23 +0000
+
+strongswan (5.1.2~dr3+git20130120-0ubuntu2) trusty; urgency=low
+
+  * debian/control: Fixed references to plugin-fips-prf.
+
+ -- Jonathan Davies <[e-mail]>  Wed, 22 Jan 2014 11:22:14 +0000
+
+strongswan (5.1.2~dr3+git20130120-0ubuntu1) trusty; urgency=low
+
+  * Upstream Git snapshot for build fixes with regards to entropy.
+  * debian/rules:
+    - Enforcing DEB_BUILD_OPTIONS=nostrip for library integrity checking.
+    - Set TESTS_REDUCED_KEYLENGTHS to one generate smallest key-lengths in
+      tests.
+
+ -- Jonathan Davies <[e-mail]>  Mon, 20 Jan 2014 19:00:59 +0000
+
+strongswan (5.1.2~dr3-0ubuntu1) trusty; urgency=low
+
+  * New upstream developer release.
+  * Made changes to packaging per upstream suggestions.
+    - Dropped medcli and medsrv packages - not recommended by upstream at this
+      time.
+    - Dropped ha plugin - needs special kernel.
+    - Improved all package descriptions in general.
+    - Drop build-dep on clearsilver-dev and libfcgi-dev - no longer needed.
+    - Removed debian/*logcheck* files - not relevant to strongSwan.
+    - Split dhcp and farp packages into sub-packages.
+    - Build kernel-libipsec, ntru, systime-fix, and xauth-noauth plugins.
+    - Changes to TNC-related packages.
+  * Created AppArmor profiles for lookip and stroke.
+
+ -- Jonathan Davies <[e-mail]>  Wed, 15 Jan 2014 22:52:53 +0000
+
+strongswan (5.1.2~dr2+git20130106-0ubuntu2) trusty; urgency=low
+
+  * libstrongswan.install: Removed lingering unit-tester.so reference.
+
+ -- Jonathan Davies <[e-mail]>  Mon, 06 Jan 2014 20:29:59 +0000
+
+strongswan (5.1.2~dr2+git20130106-0ubuntu1) trusty; urgency=low
+
+  * Git snapshot of commit 94e10f15e51ead788d9947e966878ebfdc95b7ce.
+    Incorporates upstream fixes for:
+      - Integrity testing.
+      - Unit test failures on little endian systems.
+  * Dropped debian/patches/02_test_asn1_fix_32bit_time_test.patch - fixed
+    upstream.
+  * debian/rules:
+    - Stop using CK_TIMEOUT_MULTIPLIER.
+    - Stop enabling the test suite only on non-powerpc arches (it runs
+      anyway).
+
+ -- Jonathan Davies <[e-mail]>  Mon, 06 Jan 2014 20:17:20 +0000
+
+strongswan (5.1.2~dr2-0ubuntu3) trusty; urgency=low
+
+  * debian/control: Reinstate missing comma in dependencies.
+
+ -- Jonathan Davies <[e-mail]>  Fri, 03 Jan 2014 05:39:13 +0000
+
+strongswan (5.1.2~dr2-0ubuntu2) trusty; urgency=low
+
+  * Added debian/patches/02_test_asn1_fix_32bit_time_test.patch - fixes issue
+    where test for >2038 tests on 32-bit platforms is broken.
+    - Reported upstream: https://wiki.strongswan.org/issues/477
+  * debian/control: Added strongswan-plugin-ntru to strongswan-ike Suggests.
+
+ -- Jonathan Davies <[e-mail]>  Fri, 03 Jan 2014 05:02:32 +0000
+
+strongswan (5.1.2~dr2-0ubuntu1) trusty; urgency=low
+
+  * New upstream developer release.
+  * debian/rules: Configure with: --enable-af-alg, --enable-ntru, --enable-soup,
+    and --enable-unity.
+  * debian/control:
+    - New plugin packages created for the above
+    - Split fips-prf into its own package.
+    - Added build-dependency on libsoup2.4-dev.
+
+ -- Jonathan Davies <[e-mail]>  Thu, 02 Jan 2014 17:37:33 +0000
+
 strongswan (5.1.1-3) unstable; urgency=low
 
   * Upload to unstable.
@@ -691,6 +1917,192 @@ strongswan (5.1.1-1) unstable; urgency=low
 
  -- Yves-Alexis Perez <[e-mail]>  Fri, 24 Jan 2014 21:22:32 +0100
 
+strongswan (5.1.1-0ubuntu17) trusty; urgency=low
+
+  * debian/control:
+    - Make strongswan-ike depend on iproute2.
+    - Added xauth plugin dependency on strongswan-plugin-eap-gtc.
+    - Created strongswan-libfast package.
+
+ -- Jonathan Davies <[e-mail]>  Wed, 01 Jan 2014 17:04:45 +0000
+
+strongswan (5.1.1-0ubuntu16) trusty; urgency=low
+
+  * debian/control:
+    - Further splitting of plugins into subpackages (such as all EAP plugins
+      to their own packages).
+    - Added libpcsclite-dev to build-dependencies.
+  * debian/rules:
+    - Sort configure options in alphabetical order.
+    - Added configure option of --enable-eap-aka-3gpp2, --enable-eap-dynamic,
+      --enable-eap-sim-file, --enable-eap-sim-pcsc,
+      --enable-eap-simaka-pseudonym, --enable-eap-simaka-reauth and
+      --enable-eap-simaka-sql.
+    - Don't exclude medsrv from install.
+  * Moved eap-identity.so to libstrongswan package as it's used by all the
+    other EAP plugins.
+
+ -- Jonathan Davies <[e-mail]>  Tue, 31 Dec 2013 21:25:50 +0000
+
+strongswan (5.1.1-0ubuntu15) trusty; urgency=low
+
+  * debian/control:
+    - Split plugins from libstrongswan package into modular subpackages.
+    - Added libmysqlclient-dev to build-dependencies.
+    - strongswan-ike: Set to depend on either strongswan-plugins-openssl or
+      strongswan-plugins-gcrypt.
+    - strongswan-ike: All other plugins added to Suggests.
+    - Created two new TNC packages: strongswan-tnc-ifmap and
+      strongswan-tnc-pdp and added to tnc-imcvs Suggests.
+  * debian/rules: Added to CONFIGUREARGS: --enable-certexpire,
+    --enable-error-notify, --enable-mysql, --enable-load-tester,
+    --enable-radattr, --enable-tnc-pdp, and --enable-whitelist.
+  * debian/strongswan-ike.install: Moved eap-identity.so to -tnc-imcvs package.
+
+ -- Jonathan Davies <[e-mail]>  Tue, 31 Dec 2013 16:15:32 +0000
+
+strongswan (5.1.1-0ubuntu14) trusty; urgency=low
+
+  * debian/rules:
+    - CK_TIMEOUT_MULTIPLIER back down to 6.
+    - Disable unit tests on powerpc.
+
+ -- Jonathan Davies <[e-mail]>  Tue, 31 Dec 2013 07:39:48 +0000
+
+strongswan (5.1.1-0ubuntu13) trusty; urgency=low
+
+  * debian/rules: CK_TIMEOUT_MULTIPLIER to 10 as just powerppc is being stubborn.
+
+ -- Jonathan Davies <[e-mail]>  Tue, 31 Dec 2013 07:23:42 +0000
+
+strongswan (5.1.1-0ubuntu12) trusty; urgency=low
+
+  * debian/rules: Bring CK_TIMEOUT_MULTIPLIER up to 6 to fix powerppc and
+    armhf.
+
+ -- Jonathan Davies <[e-mail]>  Tue, 31 Dec 2013 07:03:40 +0000
+
+strongswan (5.1.1-0ubuntu11) trusty; urgency=low
+
+  * 02_increase-test_rsa_generate-timeout.patch: Removed - only fixed build on
+    one extra arch.
+  * debian/rules: Set CK_TIMEOUT_MULTIPLIER to 4.
+
+ -- Jonathan Davies <[e-mail]>  Tue, 31 Dec 2013 06:51:47 +0000
+
+strongswan (5.1.1-0ubuntu10) trusty; urgency=low
+
+  * debian/patches: Added patch 02_increase-test_rsa_generate-timeout.patch -
+    - Increases RSA key generate test timeout to 30 seconds so that it doesn't
+      fail on armhf, arm64, and powerppc.
+  * Contrary to what the last changelog entry says, we are still running
+    strongswan as root (with AppArmor protection).
+
+ -- Jonathan Davies <[e-mail]>  Tue, 31 Dec 2013 06:06:47 +0000
+
+strongswan (5.1.1-0ubuntu9) trusty; urgency=low
+
+  * debian/rules: Added to configure options:
+    - --enable-tnc-ifmap: enable TNC IF-MAP module.
+    - --enable-duplicheck: enable duplicheck plugin.
+    - --enable-imv-swid, --enable-imc-swid: Added.
+    - Run strongswan as it's own user.
+  * debian/strongswan-starter.install: Install duplicheck.
+  * debian/strongswan-tnc-imcvs.install: Install swidtags.
+
+ -- Jonathan Davies <[e-mail]>  Mon, 30 Dec 2013 19:33:27 +0000
+
+strongswan (5.1.1-0ubuntu8) trusty; urgency=low
+
+  * debian/rules: Added to configure options:
+    - --enable-unit-tests: check unit testing on build.
+    - --enable-unbound: for validating DNS lookups.
+    - --enable-dnscert: for DNSCERT peer authentication.
+    - --enable-ipseckey: for IPSEC key authentication.
+    - --enable-lookip: for LookIP functionality.
+    - --enable-coupling: certificate coupling functionality.
+  * debian/control: Added check, libldns-dev, libunbound-dev to
+    build-dependencies.
+  * debian/libstrongswan.install: Install new plugin .so's.
+  * debian/strongswan-starter.install: Added lookip.
+
+ -- Jonathan Davies <[e-mail]>  Mon, 30 Dec 2013 17:52:07 +0000
+
+strongswan (5.1.1-0ubuntu7) trusty; urgency=low
+
+  * strongswan-starter.install: Moved pt-tls-client to tnc-imcvs (to prevent
+    the former from depending on the latter).
+
+ -- Jonathan Davies <[e-mail]>  Mon, 30 Dec 2013 17:30:19 +0000
+
+strongswan (5.1.1-0ubuntu6) trusty; urgency=low
+
+  * debian/strongswan-starter.prerm: Stop strongswan service on package
+    removal (as opposed to using the old init.d script).
+
+ -- Jonathan Davies <[e-mail]>  Mon, 30 Dec 2013 17:22:10 +0000
+
+strongswan (5.1.1-0ubuntu5) trusty; urgency=low
+
+  * debian/rules:
+    - CONFIGUREARGS: Merged Debian and RPM options.
+    - Brings in TNC functionality.
+  * debian/control:
+    - Added build-dependency on libtspi-dev.
+    - Created strongswan-tnc-imcvs binary package for TNC components.
+    - Added strongswan-tnc-imcvs to libstrongswan's Suggests.
+  * debian/libstrongswan.install:
+    - Included newly built MD4 and SQLite libraries.
+    - Removed 'tnc' references (moved to TNC package).
+  * debian/strongswan-tnc-imcvs.install: Created - handle new TNC libraries and
+    binaries.
+  * debian/usr.lib.ipsec.charon: Allow access to TNC modules.
+
+ -- Jonathan Davies <[e-mail]>  Mon, 30 Dec 2013 14:05:43 +0000
+
+strongswan (5.1.1-0ubuntu4) trusty; urgency=low
+
+  * debian/usr.lib.ipsec.charon: Added - AppArmor profile for charon.
+  * debian/strongswan-starter.postrm: Removed 'update-rc.d ipsec remove' call.
+  * debian/control: strongswan-ike - Stop depending on ipsec-tools. 
+
+ -- Jonathan Davies <[e-mail]>  Mon, 30 Dec 2013 05:35:17 +0000
+
+strongswan (5.1.1-0ubuntu3) trusty; urgency=low
+
+  * strongswan-starter.strongswan.upstart - Only start strongSwan when a
+    network connection is available.
+  * debian/control: Downgrade build-dep version of dpkg-dev from 1.16.2 to
+    1.16.1 - to make precise backporting easier.
+
+ -- Jonathan Davies <[e-mail]>  Thu, 12 Dec 2013 10:43:15 +0000
+
+strongswan (5.1.1-0ubuntu2) trusty; urgency=low
+
+  * strongswan-starter.strongswan.upstart - Created Upstart job for
+    strongSwan.
+  * debian/rules: Set dh_installinit to install above file.
+  * debian/strongswan-starter.postinit:
+    - Removed section about runlevel changes, it's almost 2014.
+    - Adapted service restart section for Upstart.
+    - Remove old symlinks to init.d files is necessary.
+  * debian/strongswan-starter.dirs: Don't touch /etc/init.d.
+
+ -- Jonathan Davies <[e-mail]>  Wed, 11 Dec 2013 23:10:28 +0000
+
+strongswan (5.1.1-0ubuntu1) trusty; urgency=low
+
+  * New upstream release.
+  * Removed: debian/patches/CVE-2013-6075, CVE-2013-6076.patch - upsteamed.
+  * debian/control: Updated Standards-Version to 3.9.5 and applied
+    XSBC-Original-Maintainer policy.
+  * strongswan-starter.install:
+    - pki tool is now in /usr/bin.
+    - Install pt-tls-client.
+    - Install manpages (LP: #1206263).
+
+ -- Jonathan Davies <[e-mail]>  Sun, 01 Dec 2013 17:43:59 +0000
+
 strongswan (5.1.0-3) unstable; urgency=high
 
   * urgency=high for the security fixes.
diff --git a/debian/control b/debian/control
index 44a2f85..2fdf03a 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: strongswan
 Section: net
 Priority: optional
-Maintainer: strongSwan Maintainers <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: strongSwan Maintainers <[e-mail]>
 Uploaders: Yves-Alexis Perez <[e-mail]>
 Standards-Version: 4.3.0
 Vcs-Browser: https://salsa.debian.org/debian/strongswan
@@ -18,14 +19,21 @@ Build-Depends: bison,
                libcurl4-openssl-dev | libcurl3-dev | libcurl2-dev,
                libgcrypt20-dev | libgcrypt11-dev,
                libgmp3-dev,
+               libjson-c-dev,
                libkrb5-dev,
                libldap2-dev,
+               libldns-dev,
+               libmysqlclient-dev,
                libnm-dev [linux-any],
                libpam0g-dev,
+               libpcsclite-dev,
+               libsoup2.4-dev,
                libsqlite3-dev,
                libssl-dev (>= 0.9.8),
                libsystemd-dev [linux-any],
                libtool,
+               libtspi-dev,
+               libunbound-dev,
                libxml2-dev,
                pkg-config,
                po-debconf,
@@ -66,7 +74,9 @@ Description: strongSwan utility and crypto library
   - fips-prf (PRF specified by FIPS, used by EAP-SIM/AKA algorithms)
   - gmp (RSA/DH crypto backend based on libgmp)
   - hmac (HMAC wrapper using various hashers)
+  - md4 (MD4 hasher software implementation)
   - md5 (MD5 hasher software implementation)
+  - mgf1 (Mask Generation Functions based on the SHA-1, SHA-256 and SHA-512)
   - nonce (Default nonce generation plugin)
   - pem (PEM encoding/decoding routines)
   - pgp (PGP encoding/decoding routines)
@@ -90,9 +100,6 @@ Description: strongSwan utility and crypto library
   - kernel-pfroute [kfreebsd] (Networking kernel interface using PF_ROUTE)
   - resolve (Writes name servers received via IKE to a resolv.conf file or
     installs them via resolvconf(8))
- .
- Also included is the libtpmtss library adding support for TPM plugin
- (https://wiki.strongswan.org/projects/strongswan/wiki/TpmPlugin)
 
 Package: libstrongswan-standard-plugins
 Architecture: any
@@ -129,30 +136,110 @@ Description: strongSwan utility and crypto library (extra plugins)
  cryptographic library.
  .
  Included plugins are:
+  - acert (Support of X.509 attribute certificates (since 5.1.3))
   - af-alg [linux] (AF_ALG Linux crypto API interface, provides
     ciphers/hashers/hmac/xcbc)
+  - attr-sql (provide IKE attributes read from a database to peers)
+  - bliss (Bimodal Lattice Signature Scheme (BLISS) post-quantum computer
+    signature scheme)
   - ccm (CCM cipher mode wrapper)
+  - chapoly (ChaCha20/Poly1305 AEAD implementation)
   - cmac (CMAC cipher mode wrapper)
   - ctr (CTR cipher mode wrapper)
+  - coupling (Permanent peer certificate coupling)
   - curl (libcurl based HTTP/FTP fetcher)
   - curve25519 (support for Diffie-Hellman group 31 using Curve25519 and
     support for the Ed25519 digital signature algorithm for IKEv2)
+  - dnscert (authentication via CERT RRs protected by DNSSEC)
   - gcrypt (Crypto backend based on libgcrypt, provides
     RSA/DH/ciphers/hashers/rng)
+  - ipseckey (authentication via IPSECKEY RRs protected by DNSSEC)
   - ldap (LDAP fetching plugin based on libldap)
+  - load-tester (perform IKE load tests against self or gateway)
+  - mysql (database backend)
+  - ntru (key exchanged based on post-quantum computer NTRU)
+  - nttfft (Number Theoretic Transform via the FFT algorithm)
   - padlock (VIA padlock crypto backend, provides AES128/SHA1)
   - pkcs11 (PKCS#11 smartcard backend)
+  - radattr (inject and process custom RADIUS attributes as IKEv2 client)
+  - sql (SQL configuration and creds engine)
+  - sqlite (SQLite database backend)
+  - soup (libsoup based HTTP fetcher)
   - rdrand (High quality / high performance random source using the Intel
     rdrand instruction found on Ivy Bridge processors)
   - test-vectors (Set of test vectors for various algorithms)
+  - unbound (DNSSEC enabled resolver using libunbound)
+  - whitelist (peer verification against a whitelist)
+ .
+ Also included is the libtpmtss library adding support for TPM plugin
+ (https://wiki.strongswan.org/projects/strongswan/wiki/TpmPlugin)
+
+Package: libcharon-standard-plugins
+Architecture: any
+Depends: libstrongswan (= ${binary:Version}),
+         ${misc:Depends},
+         ${shlibs:Depends}
+Breaks: libcharon-extra-plugins (<< 5.5.1-1ubuntu1~)
+Replaces: libcharon-extra-plugins (<< 5.5.1-1ubuntu1~)
+Description: strongSwan charon library (standard plugins)
+ The strongSwan VPN suite uses the native IPsec stack in the standard
+ Linux kernel. It supports both the IKEv1 and IKEv2 protocols.
+ .
+ This package provides standard plugins for the charon library:
+  - eap-mschapv2 (EAP-MSCHAPv2 protocol handler using passwords/NT hashes)
+  - xauth-generic (Generic XAuth backend that provides passwords from
+    ipsec.secrets and other credential sets)
+
+# Transition back from strongswan-tnc-* being in extra packages
+# Can be dropped after 20.04
+Package: strongswan-tnc-ifmap
+Depends: libcharon-extra-plugins (= ${source:Version}), ${misc:Depends}
+Architecture: all
+Priority: optional
+Section: oldlibs
+Description: transitional package
+ This is a transitional package. It can safely be removed.
+
+Package: strongswan-tnc-base
+Depends: libcharon-extra-plugins (= ${source:Version}), ${misc:Depends}
+Architecture: all
+Priority: optional
+Section: oldlibs
+Description: transitional package
+ This is a transitional package. It can safely be removed.
+
+Package: strongswan-tnc-client
+Depends: libcharon-extra-plugins (= ${source:Version}), ${misc:Depends}
+Architecture: all
+Priority: optional
+Section: oldlibs
+Description: transitional package
+ This is a transitional package. It can safely be removed.
+
+Package: strongswan-tnc-server
+Depends: libcharon-extra-plugins (= ${source:Version}), ${misc:Depends}
+Architecture: all
+Priority: optional
+Section: oldlibs
+Description: transitional package
+ This is a transitional package. It can safely be removed.
+
+Package: strongswan-tnc-pdp
+Depends: libcharon-extra-plugins (= ${source:Version}), ${misc:Depends}
+Architecture: all
+Priority: optional
+Section: oldlibs
+Description: transitional package
+ This is a transitional package. It can safely be removed.
 
 Package: libcharon-extra-plugins
 Architecture: any
 Depends: libstrongswan (= ${binary:Version}),
          ${misc:Depends},
          ${shlibs:Depends}
-Breaks: libstrongswan (<= 5.1.1-1), strongswan-ike (<= 5.1.1-1)
-Replaces: libstrongswan (<= 5.1.1-1), strongswan-ike (<= 5.1.1-1)
+Breaks: libstrongswan (<= 5.1.1-1), strongswan-ike (<= 5.1.1-1), strongswan-tnc-ifmap (<< 5.7.2-1ubuntu1), strongswan-tnc-base (<< 5.7.2-1ubuntu1), strongswan-tnc-client (<< 5.7.2-1ubuntu1), strongswan-tnc-server (<< 5.7.2-1ubuntu1), strongswan-tnc-pdp (<< 5.7.2-1ubuntu1)
+Replaces: libstrongswan (<= 5.1.1-1), strongswan-ike (<= 5.1.1-1), strongswan-tnc-ifmap (<< 5.7.2-1ubuntu1), strongswan-tnc-base (<< 5.7.2-1ubuntu1), strongswan-tnc-client (<< 5.7.2-1ubuntu1), strongswan-tnc-server (<< 5.7.2-1ubuntu1), strongswan-tnc-pdp (<< 5.7.2-1ubuntu1)
+Provides: strongswan-tnc-base
 Description: strongSwan charon library (extra plugins)
  The strongSwan VPN suite uses the native IPsec stack in the standard
  Linux kernel. It supports both the IKEv1 and IKEv2 protocols.
@@ -160,13 +247,13 @@ Description: strongSwan charon library (extra plugins)
  This package provides extra plugins for the charon library:
   - addrblock (Narrow traffic selectors to RFC 3779 address blocks in X.509
     certificates)
+  - dhcp (Forwarding of DHCP requests for virtual IPs to DHCP server)
   - certexpire (Export expiration dates of used certificates)
   - eap-aka (Generic EAP-AKA protocol handler using different backends)
   - eap-gtc (EAP-GTC protocol handler authenticating with XAuth backends)
   - eap-identity (EAP-Identity identity exchange algorithm, to use with other
     EAP protocols)
   - eap-md5 (EAP-MD5 protocol handler using passwords)
-  - eap-mschapv2 (EAP-MSCHAPv2 protocol handler using passwords/NT hashes)
   - eap-radius (EAP server proxy plugin forwarding EAP conversations to a
     RADIUS server)
   - eap-tls (EAP-TLS protocol handler, to authenticate with certificates in
@@ -174,17 +261,25 @@ Description: strongSwan charon library (extra plugins)
   - eap-tnc (EAP-TNC protocol handler, Trusted Network Connect in a TLS tunnel)
   - eap-ttls (EAP-TTLS protocol handler, wraps other EAP methods securely)
   - error-notify (Notification about errors via UNIX socket)
+  - farp (fake ARP responses for requests to virtual IP address)
   - ha (High-Availability clustering)
+  - kernel-libipsec (Userspace IPsec Backend with TUN devices)
   - led (Let Linux LED subsystem LEDs blink on IKE activity)
   - lookip (Virtual IP lookup facility using a UNIX socket)
-  - medcli (Web interface based mediation client interface)
-  - medsrv (Web interface based mediation server interface)
   - tnc (Trusted Network Connect)
   - unity (Cisco Unity extensions for IKEv1)
   - xauth-eap (XAuth backend that uses EAP methods to verify passwords)
-  - xauth-generic (Generic XAuth backend that provides passwords from
-    ipsec.secrets and other credential sets)
   - xauth-pam (XAuth backend that uses PAM modules to verify passwords)
+  - eap-aka-3gpp2 (EAP-AKA backend implementing standard 3GPP2 algorithm in software)
+  - eap-dynamic (EAP proxy plugin that dynamically selects an EAP method requested/supported by the client (since 5.0.1))
+  - eap-peap (EAP-PEAP protocol handler, wraps other EAP methods securely)
+  - eap-sim (Generic EAP-SIM protocol handler using different backends)
+  - eap-sim-file (EAP-SIM backend reading triplets from a file)
+  - eap-sim-pcsc (EAP-SIM backend based on a PC/SC smartcard reader)
+  - eap-simaka-pseudonym (EAP-SIM/AKA in-memory pseudonym identity database)
+  - eap-simaka-reauth (EAP-SIM/AKA in-memory reauthentication identity database)
+  - eap-simaka-sql (EAP-SIM/AKA backend reading triplets/quintuplets from a SQL database)
+  - xauth-noauth (XAuth backend that does not do any authentication (since 5.0.3))
 
 Package: strongswan-starter
 Architecture: any
@@ -210,6 +305,7 @@ Depends: libstrongswan (= ${binary:Version}),
          ${shlibs:Depends}
 Breaks: strongswan-starter (<= 5.6.1-2)
 Replaces: strongswan-starter (<= 5.6.1-2)
+Recommends: libcharon-standard-plugins
 Suggests: libcharon-extra-plugins
 Description: strongSwan charon library
  The strongSwan VPN suite uses the native IPsec stack in the standard
diff --git a/debian/ipsec.secrets.proto b/debian/ipsec.secrets.proto
index dfa6dde..309e3fc 100644
--- a/debian/ipsec.secrets.proto
+++ b/debian/ipsec.secrets.proto
@@ -3,6 +3,3 @@
 # RSA private key for this host, authenticating it to any other host
 # which knows the public part.
 
-# this file is managed with debconf and will contain the automatically created private key
-include /var/lib/strongswan/ipsec.secrets.inc
-
diff --git a/debian/libcharon-extra-plugins.install b/debian/libcharon-extra-plugins.install
index 1b0cbca..c7b0a66 100644
--- a/debian/libcharon-extra-plugins.install
+++ b/debian/libcharon-extra-plugins.install
@@ -1,46 +1,104 @@
 # libcharon plugins
 usr/lib/ipsec/plugins/libstrongswan-addrblock.so
 usr/lib/ipsec/plugins/libstrongswan-certexpire.so
-usr/lib/ipsec/plugins/libstrongswan-eap*.so
+usr/lib/ipsec/plugins/libstrongswan-eap-aka-3gpp2.so
+usr/lib/ipsec/plugins/libstrongswan-eap-aka.so
+usr/lib/ipsec/plugins/libstrongswan-eap-dynamic.so
+usr/lib/ipsec/plugins/libstrongswan-eap-gtc.so
+usr/lib/ipsec/plugins/libstrongswan-eap-identity.so
+usr/lib/ipsec/plugins/libstrongswan-eap-md5.so
+usr/lib/ipsec/plugins/libstrongswan-eap-peap.so
+usr/lib/ipsec/plugins/libstrongswan-eap-radius.so
+usr/lib/ipsec/plugins/libstrongswan-eap-sim-file.so
+usr/lib/ipsec/plugins/libstrongswan-eap-sim-pcsc.so
+usr/lib/ipsec/plugins/libstrongswan-eap-sim.so
+usr/lib/ipsec/plugins/libstrongswan-eap-simaka-pseudonym.so
+usr/lib/ipsec/plugins/libstrongswan-eap-simaka-reauth.so
+usr/lib/ipsec/plugins/libstrongswan-eap-simaka-sql.so
+usr/lib/ipsec/plugins/libstrongswan-eap-tls.so
+usr/lib/ipsec/plugins/libstrongswan-eap-tnc.so
+usr/lib/ipsec/plugins/libstrongswan-eap-ttls.so
 usr/lib/ipsec/plugins/libstrongswan-error-notify.so
 usr/lib/ipsec/plugins/libstrongswan-ha.so
+usr/lib/ipsec/plugins/libstrongswan-kernel-libipsec.so
 usr/lib/ipsec/plugins/libstrongswan-led.so
 usr/lib/ipsec/plugins/libstrongswan-lookip.so
 #usr/lib/ipsec/plugins/libstrongswan-medsrv.so
 #usr/lib/ipsec/plugins/libstrongswan-medcli.so
 usr/lib/ipsec/plugins/libstrongswan-tnc-tnccs.so
 usr/lib/ipsec/plugins/libstrongswan-unity.so
-usr/lib/ipsec/plugins/libstrongswan-xauth-*.so
+usr/lib/ipsec/plugins/libstrongswan-xauth-eap.so
+usr/lib/ipsec/plugins/libstrongswan-xauth-noauth.so
+usr/lib/ipsec/plugins/libstrongswan-xauth-pam.so
 # standard configuration files
 usr/share/strongswan/templates/config/plugins/addrblock.conf
 usr/share/strongswan/templates/config/plugins/certexpire.conf
-usr/share/strongswan/templates/config/plugins/eap-*.conf
+usr/share/strongswan/templates/config/plugins/eap-aka-3gpp2.conf
+usr/share/strongswan/templates/config/plugins/eap-aka.conf
+usr/share/strongswan/templates/config/plugins/eap-dynamic.conf
+usr/share/strongswan/templates/config/plugins/eap-gtc.conf
+usr/share/strongswan/templates/config/plugins/eap-identity.conf
+usr/share/strongswan/templates/config/plugins/eap-md5.conf
+usr/share/strongswan/templates/config/plugins/eap-peap.conf
+usr/share/strongswan/templates/config/plugins/eap-radius.conf
+usr/share/strongswan/templates/config/plugins/eap-sim-file.conf
+usr/share/strongswan/templates/config/plugins/eap-sim-pcsc.conf
+usr/share/strongswan/templates/config/plugins/eap-sim.conf
+usr/share/strongswan/templates/config/plugins/eap-simaka-pseudonym.conf
+usr/share/strongswan/templates/config/plugins/eap-simaka-reauth.conf
+usr/share/strongswan/templates/config/plugins/eap-simaka-sql.conf
+usr/share/strongswan/templates/config/plugins/eap-tls.conf
+usr/share/strongswan/templates/config/plugins/eap-tnc.conf
+usr/share/strongswan/templates/config/plugins/eap-ttls.conf
 usr/share/strongswan/templates/config/plugins/error-notify.conf
 usr/share/strongswan/templates/config/plugins/ha.conf
+usr/share/strongswan/templates/config/plugins/kernel-libipsec.conf
 usr/share/strongswan/templates/config/plugins/led.conf
 usr/share/strongswan/templates/config/plugins/lookip.conf
 #usr/share/strongswan/templates/config/plugins/medsrv.conf
 #usr/share/strongswan/templates/config/plugins/medcli.conf
 usr/share/strongswan/templates/config/plugins/tnc-tnccs.conf
 usr/share/strongswan/templates/config/plugins/unity.conf
-usr/share/strongswan/templates/config/plugins/xauth-*.conf
+usr/share/strongswan/templates/config/plugins/xauth-eap.conf
+usr/share/strongswan/templates/config/plugins/xauth-noauth.conf
+usr/share/strongswan/templates/config/plugins/xauth-pam.conf
 usr/share/strongswan/templates/config/strongswan.d/tnc.conf
 etc/strongswan.d/tnc.conf
 etc/strongswan.d/charon/addrblock.conf
 etc/strongswan.d/charon/certexpire.conf
-etc/strongswan.d/charon/eap-*.conf
+etc/strongswan.d/charon/eap-aka-3gpp2.conf
+etc/strongswan.d/charon/eap-aka.conf
+etc/strongswan.d/charon/eap-dynamic.conf
+etc/strongswan.d/charon/eap-gtc.conf
+etc/strongswan.d/charon/eap-identity.conf
+etc/strongswan.d/charon/eap-md5.conf
+etc/strongswan.d/charon/eap-peap.conf
+etc/strongswan.d/charon/eap-radius.conf
+etc/strongswan.d/charon/eap-sim-file.conf
+etc/strongswan.d/charon/eap-sim-pcsc.conf
+etc/strongswan.d/charon/eap-sim.conf
+etc/strongswan.d/charon/eap-simaka-pseudonym.conf
+etc/strongswan.d/charon/eap-simaka-reauth.conf
+etc/strongswan.d/charon/eap-simaka-sql.conf
+etc/strongswan.d/charon/eap-tls.conf
+etc/strongswan.d/charon/eap-tnc.conf
+etc/strongswan.d/charon/eap-ttls.conf
 etc/strongswan.d/charon/error-notify.conf
 etc/strongswan.d/charon/ha.conf
+etc/strongswan.d/charon/kernel-libipsec.conf
 etc/strongswan.d/charon/led.conf
 etc/strongswan.d/charon/lookip.conf
 #etc/strongswan.d/charon/medsrv.conf
 #etc/strongswan.d/charon/medcli.conf
 etc/strongswan.d/charon/tnc-tnccs.conf
 etc/strongswan.d/charon/unity.conf
-etc/strongswan.d/charon/xauth-*.conf
+etc/strongswan.d/charon/xauth-eap.conf
+etc/strongswan.d/charon/xauth-noauth.conf
+etc/strongswan.d/charon/xauth-pam.conf
 debian/usr.lib.ipsec.lookip /etc/apparmor.d/
 # support libs
 #usr/lib/ipsec/libfast.so*
+usr/lib/ipsec/libipsec.so*
 usr/lib/ipsec/libpttls.so*
 usr/lib/ipsec/libradius.so*
 usr/lib/ipsec/libsimaka.so*
@@ -52,3 +110,48 @@ usr/lib/ipsec/error-notify
 usr/lib/ipsec/lookip
 # manpages
 usr/share/man/man1/pt-tls-client.1
+# Further TNC plugin files
+etc/strongswan.d/attest.conf
+etc/strongswan.d/charon/tnc-ifmap.conf
+etc/strongswan.d/charon/tnc-imc.conf
+etc/strongswan.d/charon/tnc-imv.conf
+etc/strongswan.d/charon/tnc-pdp.conf
+etc/strongswan.d/charon/tnc-tnccs.conf
+etc/strongswan.d/charon/tnccs-11.conf
+etc/strongswan.d/charon/tnccs-20.conf
+etc/strongswan.d/charon/tnccs-dynamic.conf
+etc/strongswan.d/imcv.conf
+etc/strongswan.d/sec-updater.conf
+etc/strongswan.d/tnc.conf
+usr/lib/ipsec/_imv_policy
+usr/lib/ipsec/attest
+usr/lib/ipsec/imcvs/imc-*.so
+usr/lib/ipsec/imcvs/imv-*.so
+usr/lib/ipsec/imv_policy_manager
+usr/lib/ipsec/libimcv.*
+usr/lib/ipsec/libtnccs.so*
+usr/lib/ipsec/plugins/libstrongswan-tnc-ifmap.so
+usr/lib/ipsec/plugins/libstrongswan-tnc-imc.so
+usr/lib/ipsec/plugins/libstrongswan-tnc-imv.so
+usr/lib/ipsec/plugins/libstrongswan-tnc-pdp.so
+usr/lib/ipsec/plugins/libstrongswan-tnc-tnccs.so
+usr/lib/ipsec/plugins/libstrongswan-tnccs-*.so
+usr/sbin/sec-updater
+usr/sbin/sw-collector
+usr/share/man/man8/sec-updater.8
+usr/share/man/man8/sw-collector.8
+usr/share/strongswan/swidtag/strongswan.org__strongSwan-*.swidtag
+usr/share/strongswan/templates/config/plugins/tnc-ifmap.conf
+usr/share/strongswan/templates/config/plugins/tnc-imc.conf
+usr/share/strongswan/templates/config/plugins/tnc-imv.conf
+usr/share/strongswan/templates/config/plugins/tnc-pdp.conf
+usr/share/strongswan/templates/config/plugins/tnc-tnccs.conf
+usr/share/strongswan/templates/config/plugins/tnccs-11.conf
+usr/share/strongswan/templates/config/plugins/tnccs-20.conf
+usr/share/strongswan/templates/config/plugins/tnccs-dynamic.conf
+usr/share/strongswan/templates/config/strongswan.d/attest.conf
+usr/share/strongswan/templates/config/strongswan.d/imcv.conf
+usr/share/strongswan/templates/config/strongswan.d/sec-updater.conf
+usr/share/strongswan/templates/config/strongswan.d/tnc.conf
+usr/share/strongswan/templates/database/imv/*.sql
+usr/share/strongswan/templates/database/sw-collector/sw_collector_tables.sql
diff --git a/debian/libcharon-standard-plugins.install b/debian/libcharon-standard-plugins.install
new file mode 100644
index 0000000..25e580c
--- /dev/null
+++ b/debian/libcharon-standard-plugins.install
@@ -0,0 +1,19 @@
+# most commonly used libcharon plugins
+# 1) eap-mschapv2 is required on the client side to connect to VPN
+# concentrators configured for Windows 7+ and modern OSX/iOS using IKEv2.
+# In such scenario, the VPN concentrator identifies itself with a public
+# key and asks the client to authenticate with MSCHAPv2.
+# 2) xauth-generic is required on the client side to connect to VPN
+# concentrators configured for Android and older OSX/iOS using IKEv1 and
+# XAUTH. In such scenario, the VPN concentrator identifies itself with a
+# public key or a shared secret and asks the client to authenticate with a
+# XAUTH password.
+# plugins
+usr/lib/ipsec/plugins/libstrongswan-eap-mschapv2.so
+usr/lib/ipsec/plugins/libstrongswan-xauth-generic.so
+# config templates
+usr/share/strongswan/templates/config/plugins/eap-mschapv2.conf
+usr/share/strongswan/templates/config/plugins/xauth-generic.conf
+# configuration files
+etc/strongswan.d/charon/eap-mschapv2.conf
+etc/strongswan.d/charon/xauth-generic.conf
diff --git a/debian/libstrongswan-extra-plugins.install b/debian/libstrongswan-extra-plugins.install
index 2846e21..0f25a59 100644
--- a/debian/libstrongswan-extra-plugins.install
+++ b/debian/libstrongswan-extra-plugins.install
@@ -1,40 +1,94 @@
 # Tool for TPM PCR extension
 usr/bin/tpm_extendpcr
 # libstrongswan plugins
+usr/lib/ipsec/plugins/libstrongswan-acert.so
+usr/lib/ipsec/plugins/libstrongswan-attr-sql.so
+usr/lib/ipsec/plugins/libstrongswan-bliss.so
 usr/lib/ipsec/plugins/libstrongswan-ccm.so
 usr/lib/ipsec/plugins/libstrongswan-chapoly.so
 usr/lib/ipsec/plugins/libstrongswan-cmac.so
+usr/lib/ipsec/plugins/libstrongswan-coupling.so
 usr/lib/ipsec/plugins/libstrongswan-ctr.so
 usr/lib/ipsec/plugins/libstrongswan-curl.so
 usr/lib/ipsec/plugins/libstrongswan-curve25519.so
+usr/lib/ipsec/plugins/libstrongswan-dnscert.so
 usr/lib/ipsec/plugins/libstrongswan-gcrypt.so
+usr/lib/ipsec/plugins/libstrongswan-ipseckey.so
 usr/lib/ipsec/plugins/libstrongswan-ldap.so
+usr/lib/ipsec/plugins/libstrongswan-load-tester.so
+usr/lib/ipsec/plugins/libstrongswan-mysql.so
+usr/lib/ipsec/plugins/libstrongswan-ntru.so
 usr/lib/ipsec/plugins/libstrongswan-pkcs11.so
+usr/lib/ipsec/plugins/libstrongswan-radattr.so
+usr/lib/ipsec/plugins/libstrongswan-soup.so
+usr/lib/ipsec/plugins/libstrongswan-sqlite.so
+usr/lib/ipsec/plugins/libstrongswan-sql.so
+usr/lib/ipsec/plugins/libstrongswan-systime-fix.so
 usr/lib/ipsec/plugins/libstrongswan-test-vectors.so
 usr/lib/ipsec/plugins/libstrongswan-tpm.so
+usr/lib/ipsec/plugins/libstrongswan-unbound.so
+usr/lib/ipsec/plugins/libstrongswan-whitelist.so
 # default configuration files
+usr/share/strongswan/templates/config/plugins/acert.conf
+usr/share/strongswan/templates/config/plugins/attr-sql.conf
+usr/share/strongswan/templates/config/plugins/bliss.conf
 usr/share/strongswan/templates/config/plugins/ccm.conf
 usr/share/strongswan/templates/config/plugins/cmac.conf
 usr/share/strongswan/templates/config/plugins/chapoly.conf
+usr/share/strongswan/templates/config/plugins/coupling.conf
 usr/share/strongswan/templates/config/plugins/ctr.conf
 usr/share/strongswan/templates/config/plugins/curl.conf
 usr/share/strongswan/templates/config/plugins/curve25519.conf
+usr/share/strongswan/templates/config/plugins/dnscert.conf
 usr/share/strongswan/templates/config/plugins/gcrypt.conf
+usr/share/strongswan/templates/config/plugins/ipseckey.conf
 usr/share/strongswan/templates/config/plugins/ldap.conf
+usr/share/strongswan/templates/config/plugins/load-tester.conf
+usr/share/strongswan/templates/config/plugins/mysql.conf
+usr/share/strongswan/templates/config/plugins/ntru.conf
 usr/share/strongswan/templates/config/plugins/pkcs11.conf
+usr/share/strongswan/templates/config/plugins/radattr.conf
+usr/share/strongswan/templates/config/plugins/soup.conf
+usr/share/strongswan/templates/config/plugins/sql.conf
+usr/share/strongswan/templates/config/plugins/sqlite.conf
+usr/share/strongswan/templates/config/plugins/systime-fix.conf
 usr/share/strongswan/templates/config/plugins/test-vectors.conf
 usr/share/strongswan/templates/config/plugins/tpm.conf
+usr/share/strongswan/templates/config/plugins/unbound.conf
+usr/share/strongswan/templates/config/plugins/whitelist.conf
+usr/share/strongswan/templates/database/sql/mysql.sql
+usr/share/strongswan/templates/database/sql/sqlite.sql
+etc/strongswan.d/charon/acert.conf
+etc/strongswan.d/charon/attr-sql.conf
+etc/strongswan.d/charon/bliss.conf
 etc/strongswan.d/charon/ccm.conf
 etc/strongswan.d/charon/chapoly.conf
 etc/strongswan.d/charon/cmac.conf
+etc/strongswan.d/charon/coupling.conf
 etc/strongswan.d/charon/ctr.conf
 etc/strongswan.d/charon/curl.conf
 etc/strongswan.d/charon/curve25519.conf
+etc/strongswan.d/charon/dnscert.conf
 etc/strongswan.d/charon/gcrypt.conf
+etc/strongswan.d/charon/ipseckey.conf
 etc/strongswan.d/charon/ldap.conf
+etc/strongswan.d/charon/load-tester.conf
+etc/strongswan.d/charon/mysql.conf
+etc/strongswan.d/charon/ntru.conf
 etc/strongswan.d/charon/pkcs11.conf
+etc/strongswan.d/charon/radattr.conf
+etc/strongswan.d/charon/soup.conf
+etc/strongswan.d/charon/sql.conf
+etc/strongswan.d/charon/sqlite.conf
+etc/strongswan.d/charon/systime-fix.conf
 etc/strongswan.d/charon/test-vectors.conf
 etc/strongswan.d/charon/tpm.conf
 # TPM libs
 usr/lib/ipsec/libtpmtss.so.*
 usr/lib/ipsec/libtpmtss.so
+etc/strongswan.d/charon/unbound.conf
+etc/strongswan.d/charon/whitelist.conf
+usr/lib/ipsec/load-tester
+usr/lib/ipsec/whitelist
+# Number Theoretic Transform via FFT libs
+usr/lib/ipsec/libnttfft.so*
diff --git a/debian/libstrongswan.install b/debian/libstrongswan.install
index 072ff7e..a86c3af 100644
--- a/debian/libstrongswan.install
+++ b/debian/libstrongswan.install
@@ -6,6 +6,7 @@ usr/lib/ipsec/plugins/libstrongswan-dnskey.so
 usr/lib/ipsec/plugins/libstrongswan-fips-prf.so
 usr/lib/ipsec/plugins/libstrongswan-gmp.so
 usr/lib/ipsec/plugins/libstrongswan-hmac.so
+usr/lib/ipsec/plugins/libstrongswan-md4.so
 usr/lib/ipsec/plugins/libstrongswan-md5.so
 usr/lib/ipsec/plugins/libstrongswan-mgf1.so
 usr/lib/ipsec/plugins/libstrongswan-nonce.so
@@ -31,6 +32,8 @@ usr/share/strongswan/templates/config/plugins/dnskey.conf
 usr/share/strongswan/templates/config/plugins/fips-prf.conf
 usr/share/strongswan/templates/config/plugins/gmp.conf
 usr/share/strongswan/templates/config/plugins/hmac.conf
+usr/share/strongswan/templates/config/plugins/kernel-netlink.conf
+usr/share/strongswan/templates/config/plugins/md4.conf
 usr/share/strongswan/templates/config/plugins/md5.conf
 usr/share/strongswan/templates/config/plugins/mgf1.conf
 usr/share/strongswan/templates/config/plugins/nonce.conf
@@ -55,6 +58,8 @@ etc/strongswan.d/charon/dnskey.conf
 etc/strongswan.d/charon/fips-prf.conf
 etc/strongswan.d/charon/gmp.conf
 etc/strongswan.d/charon/hmac.conf
+etc/strongswan.d/charon/kernel-netlink.conf
+etc/strongswan.d/charon/md4.conf
 etc/strongswan.d/charon/md5.conf
 etc/strongswan.d/charon/mgf1.conf
 etc/strongswan.d/charon/nonce.conf
diff --git a/debian/patches/dont-load-kernel-libipsec-plugin-by-default.patch b/debian/patches/dont-load-kernel-libipsec-plugin-by-default.patch
new file mode 100644
index 0000000..004b50b
--- /dev/null
+++ b/debian/patches/dont-load-kernel-libipsec-plugin-by-default.patch
@@ -0,0 +1,11 @@
+--- a/conf/plugins/kernel-libipsec.conf
++++ b/conf/plugins/kernel-libipsec.conf
+@@ -5,7 +5,7 @@
+ 
+     # Whether to load the plugin. Can also be an integer to increase the
+     # priority of this plugin.
+-    load = yes
++    load = no
+ 
+ }
+ 
diff --git a/debian/patches/series b/debian/patches/series
index fde45f5..c72895f 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -2,3 +2,4 @@
 02_disable-bypass-lan.patch
 03_systemd-service.patch
 04_disable-libtls-tests.patch
+dont-load-kernel-libipsec-plugin-by-default.patch
diff --git a/debian/rules b/debian/rules
index ca02a06..5faee99 100755
--- a/debian/rules
+++ b/debian/rules
@@ -4,21 +4,36 @@ export DEB_LDFLAGS_MAINT_APPEND=-Wl,--as-needed -Wl,-O1
 export DEB_BUILD_MAINT_OPTIONS=hardening=+all
 
 CONFIGUREARGS := --libdir=/usr/lib --libexecdir=/usr/lib \
+		--enable-tss-trousers \
+		--enable-acert \
 		--enable-addrblock \
 		--enable-agent \
 		--enable-bypass-lan \
+		--enable-attr-sql \
+		--enable-bliss \
 		--enable-ccm \
 		--enable-certexpire \
 		--enable-chapoly \
 		--enable-cmd \
+		--enable-coupling \
 		--enable-ctr \
 		--enable-curl \
+		--enable-dnscert \
 		--enable-eap-aka \
+		--enable-eap-aka-3gpp2 \
+		--enable-eap-dynamic \
 		--enable-eap-gtc \
 		--enable-eap-identity \
 		--enable-eap-md5 \
 		--enable-eap-mschapv2 \
+		--enable-eap-peap \
 		--enable-eap-radius \
+		--enable-eap-sim \
+		--enable-eap-simaka-pseudonym \
+		--enable-eap-simaka-reauth \
+		--enable-eap-simaka-sql \
+		--enable-eap-sim-file \
+		--enable-eap-sim-pcsc \
 		--enable-eap-tls \
 		--enable-eap-tnc \
 		--enable-eap-ttls \
@@ -26,18 +41,51 @@ CONFIGUREARGS := --libdir=/usr/lib --libexecdir=/usr/lib \
 		--enable-gcm \
 		--enable-gcrypt \
 		--enable-ha \
+		--enable-imc-attestation \
+		--enable-imc-os \
+		--enable-imc-scanner \
+		--enable-imc-swima \
+		--enable-imc-test \
+		--enable-imv-attestation \
+		--enable-imv-os \
+		--enable-imv-scanner  \
+		--enable-imv-swima \
+		--enable-imv-test \
+		--enable-ipseckey \
+		--enable-kernel-libipsec \
 		--enable-ldap \
 		--enable-led \
+		--enable-load-tester \
 		--enable-lookip \
 		--enable-mediation \
+		--enable-md4 \
+		--enable-mysql \
+		--enable-ntru \
 		--enable-openssl \
 		--enable-pkcs11 \
+		--enable-radattr \
+		--enable-soup \
+		--enable-sql \
+		--enable-sqlite \
+		--enable-systime-fix \
 		--enable-test-vectors \
 		--enable-tpm \
+		--enable-tnccs-11 \
+		--enable-tnccs-20 \
+		--enable-tnccs-dynamic \
+		--enable-tnc-ifmap \
+		--enable-tnc-imc \
+		--enable-tnc-imv \
+		--enable-tnc-pdp \
+		--enable-unbound \
 		--enable-unity \
+		--enable-whitelist \
 		--enable-xauth-eap \
+		--enable-xauth-generic \
+		--enable-xauth-noauth \
 		--enable-xauth-pam \
 		--disable-blowfish \
+		--disable-fast \
 		--disable-des # BSD-Young license
 	#--with-user=strongswan --with-group=nogroup
 	#	--enable-kernel-pfkey --enable-kernel-klips \
@@ -191,12 +239,6 @@ endif
 
 	# add additional files not covered by upstream makefile...
 	install --mode=0600 $(CURDIR)/debian/ipsec.secrets.proto $(CURDIR)/debian/strongswan-starter/etc/ipsec.secrets
-	# also "patch" ipsec.conf to include the debconf-managed file
-	echo >> $(CURDIR)/debian/strongswan-starter/etc/ipsec.conf
-	echo "include /var/lib/strongswan/ipsec.conf.inc" >> $(CURDIR)/debian/strongswan-starter/etc/ipsec.conf
-	# and to enable both IKEv1 and IKEv2 by default
-	sed -r 's/^[ \t]+# *charonstart=(yes|no) */\tcharonstart=yes/' < $(CURDIR)/debian/strongswan-starter/etc/ipsec.conf > $(CURDIR)/debian/strongswan-starter/etc/ipsec.conf.tmp
-	mv $(CURDIR)/debian/strongswan-starter/etc/ipsec.conf.tmp $(CURDIR)/debian/strongswan-starter/etc/ipsec.conf
 
 	# set permissions on ipsec.secrets and private key directories
 	chmod 600 $(CURDIR)/debian/strongswan-starter/etc/ipsec.secrets
diff --git a/debian/strongswan-starter.install b/debian/strongswan-starter.install
index 9a4c0d1..b5250dc 100644
--- a/debian/strongswan-starter.install
+++ b/debian/strongswan-starter.install
@@ -16,3 +16,7 @@ usr/lib/ipsec/plugins/libstrongswan-stroke.so
 usr/share/strongswan/templates/config/plugins/stroke.conf
 etc/strongswan.d/charon/stroke.conf
 debian/usr.lib.ipsec.stroke /etc/apparmor.d/
+#pool
+usr/lib/ipsec/pool
+usr/share/strongswan/templates/config/strongswan.d/pool.conf
+etc/strongswan.d/pool.conf
diff --git a/debian/strongswan-starter.postinst b/debian/strongswan-starter.postinst
index 9e4d7b1..9b7c734 100644
--- a/debian/strongswan-starter.postinst
+++ b/debian/strongswan-starter.postinst
@@ -220,63 +220,6 @@ case "$1" in
 	    db_set strongswan/install_x509_certificate false
 	fi
 
-	# lets see if we are already using dependency based booting or the correct runlevel parameters
-	if ! ( [ "`find /etc/init.d/ -name '.depend.*'`" ] || [ "$runlevels" = "0K841K842S163S164S165S166K84" ] ); then
-	    db_fset strongswan/runlevel_changes seen false
-	    db_input high strongswan/runlevel_changes || true
-	    db_go
-
-	    # if the admin did not change the runlevels which got installed by older packages we can modify them
-	    if [ "$runlevels" = "0K346K34SS41" ] || [ "$runlevels" = "0K301K302S153S154S155S156K30" ] || [ "$runlevels" = "0K191K192S213S214S215S216K19" ]; then
-		update-rc.d -f ipsec remove
-	    fi
-
-	    update-rc.d ipsec defaults 16 84 > /dev/null
-	fi
-
-        db_get strongswan/enable-oe
-        if [ "$RET" != "true" ]; then
-            echo -n "Disabling opportunistic encryption (OE) in config file ... "
-            if [ -e $CONF_FILE ] && egrep -q "include /etc/ipsec.d/examples/no_oe.conf$" $CONF_FILE; then
-                # also update to new-style config
-                sed 's/.*include \/etc\/ipsec.d\/examples\/no_oe.conf/#include \/etc\/ipsec.d\/examples\/oe.conf/' < $CONF_FILE > $CONF_FILE.tmp
-                mv $CONF_FILE.tmp $CONF_FILE
-                echo -n "converted old config line to new format"
-            fi
-            if [ -e $CONF_FILE ] && egrep -q "^include /etc/ipsec.d/examples/oe.conf$" $CONF_FILE; then
-            	sed 's/include \/etc\/ipsec.d\/examples\/oe.conf/#include \/etc\/ipsec.d\/examples\/oe.conf/' < $CONF_FILE > $CONF_FILE.tmp
-                mv $CONF_FILE.tmp $CONF_FILE
-                echo "done"
-            elif [ ! -e $CONF_FILE ]; then
-                echo "#include /etc/ipsec.d/examples/oe.conf" > $CONF_FILE
-            else
-                echo "already disabled"
-            fi
-	else
-            echo -n "Enabling opportunistic encryption (OE) in config file ... "
-            if [ -e $CONF_FILE ] && egrep -q "include /etc/ipsec.d/examples/no_oe.conf$" $CONF_FILE; then
-                # also update to new-style config
-            	sed 's/.*include \/etc\/ipsec.d\/examples\/no_oe.conf/include \/etc\/ipsec.d\/examples\/oe.conf/' < $CONF_FILE > $CONF_FILE.tmp
-                mv $CONF_FILE.tmp $CONF_FILE
-                echo -n "converted old config line to new format"
-            fi
-            if [ -e $CONF_FILE ] && egrep -q "^include /etc/ipsec.d/examples/oe.conf$" $CONF_FILE; then
-                echo "already enabled"
-            elif [ -e $CONF_FILE ] && egrep -q "^#.*include /etc/ipsec.d/examples/oe.conf$" $CONF_FILE; then
-            	sed 's/#.*include \/etc\/ipsec.d\/examples\/oe.conf/include \/etc\/ipsec.d\/examples\/oe.conf/' < $CONF_FILE > $CONF_FILE.tmp
-                mv $CONF_FILE.tmp $CONF_FILE
-                echo "done"
-            elif [ ! -e $CONF_FILE ]; then
-                echo "include /etc/ipsec.d/examples/oe.conf" > $CONF_FILE
-            else
-                cat <<EOF >> $CONF_FILE
-#Enable Opportunistic Encryption
-include /etc/ipsec.d/examples/oe.conf
-EOF
-              echo "done"
-            fi
-        fi
-
 	# disabled for now, until we can solve the don't-edit-conffiles issue
         #db_get strongswan/ikev1
         #if [ "$RET" != "true" ]; then
diff --git a/debian/usr.lib.ipsec.charon b/debian/usr.lib.ipsec.charon
index de110d8..58bfbcd 100644
--- a/debian/usr.lib.ipsec.charon
+++ b/debian/usr.lib.ipsec.charon
@@ -19,6 +19,7 @@
   #include <abstractions/authentication>
   #include <abstractions/openssl>
   #include <abstractions/p11-kit>
+  #include <abstractions/mysql>
 
   capability ipc_lock,
   capability net_admin,
@@ -28,6 +29,7 @@
   capability chown,
   capability setgid,
   capability setuid,
+  capability setpcap,
 
   # libcharon-extra-plugins: xauth-pam
   capability audit_write,
@@ -68,6 +70,16 @@
 
   /var/lib/strongswan/*     r,
 
+  /{,var/}run/systemd/notify w,
+
+  # allow self to read file descriptors (LP #1786250)
+  # restrict to our own process-ID as per apparmor vars
+  @{PROC}/@{pid}/fd/        r,
+
+  # for using the ha plugin (LP: #1773956)
+  @{PROC}/@{pid}/net/ipt_CLUSTERIP/ r,
+  @{PROC}/@{pid}/net/ipt_CLUSTERIP/* rw,
+
   # Site-specific additions and overrides. See local/README for details.
   #include <local/usr.lib.ipsec.charon>
 }
diff --git a/debian/usr.lib.ipsec.lookip b/debian/usr.lib.ipsec.lookip
index de10433..614cda8 100644
--- a/debian/usr.lib.ipsec.lookip
+++ b/debian/usr.lib.ipsec.lookip
@@ -15,6 +15,8 @@
 /usr/lib/ipsec/lookip {
   #include <abstractions/base>
 
+  /usr/lib/ipsec/lookip     rmix,
+
   /run/charon.lkp           rw,
 
   # Site-specific additions and overrides. See local/README for details.
diff --git a/debian/usr.lib.ipsec.stroke b/debian/usr.lib.ipsec.stroke
index 9d20ee7..af9cdcc 100644
--- a/debian/usr.lib.ipsec.stroke
+++ b/debian/usr.lib.ipsec.stroke
@@ -17,6 +17,8 @@
 
   capability dac_override,
 
+  /usr/lib/ipsec/stroke         rmix,
+
   /etc/strongswan.conf          r,
   /etc/strongswan.d/            r,
   /etc/strongswan.d/**          r,
diff --git a/debian/usr.sbin.charon-systemd b/debian/usr.sbin.charon-systemd
index 0540b89..92de81c 100644
--- a/debian/usr.sbin.charon-systemd
+++ b/debian/usr.sbin.charon-systemd
@@ -19,6 +19,7 @@
   #include <abstractions/authentication>
   #include <abstractions/openssl>
   #include <abstractions/p11-kit>
+  #include <abstractions/mysql>
 
   capability ipc_lock,
   capability net_admin,
@@ -28,6 +29,7 @@
   capability chown,
   capability setgid,
   capability setuid,
+  capability setpcap,
 
   # libcharon-extra-plugins: xauth-pam
   capability audit_write,
@@ -60,7 +62,7 @@
   /run/charon.*             rw,
   /run/pcscd/pcscd.comm     rw,
 
-  /usr/lib/ipsec/charon     rmix,
+  /usr/sbin/charon-systemd  rmix,
   /usr/lib/ipsec/imcvs/     r,
   /usr/lib/ipsec/imcvs/**   rm,
 
@@ -70,6 +72,14 @@
 
   /{,var/}run/systemd/notify w,
 
+  # allow self to read file descriptors (LP #1786250)
+  # restrict to our own process-ID as per apparmor vars
+  @{PROC}/@{pid}/fd/        r,
+
+  # for using the ha plugin (LP: #1773956)
+  @{PROC}/@{pid}/net/ipt_CLUSTERIP/ r,
+  @{PROC}/@{pid}/net/ipt_CLUSTERIP/* rw,
+
   # Site-specific additions and overrides. See local/README for details.
   #include <local/usr.sbin.charon-systemd>
 }
diff --git a/debian/usr.sbin.swanctl b/debian/usr.sbin.swanctl
index 627f5c0..276c359 100644
--- a/debian/usr.sbin.swanctl
+++ b/debian/usr.sbin.swanctl
@@ -1,6 +1,6 @@
 #include <tunables/global>
 
-/usr/sbin/swanctl {
+/usr/sbin/swanctl flags=(attach_disconnected) {
   #include <abstractions/base>
 
   # Allow /etc/swanctl/x509ca/ files to symlink to system-wide ca-certificates
@@ -21,6 +21,12 @@
   # Allow communication with VICI plugin UNIX domain socket
   /run/charon.vici              rw,
 
+  # for af-alg plugin
+  network alg seqpacket,
+
+  # Allow reading own binary
+  /usr/sbin/swanctl             r,
+
   # As of 5.5.2, swanctl unnecessarily loads plugins by default, even though no
   # plugins are actually used by swanctl.  The following can be removed if
   # plugin loading is disabled.