Merge ~paride/ubuntu/+source/strongswan:lp1940079-tss2-focal into ubuntu/+source/strongswan:ubuntu/devel

[Paride Legovini]

Focal SRU fix for LP #1940079. This is the same change that landed in the Debian packaging (git) and in Impish, applied to Focal.

Test Plan: see the SRU template.
Test PPA: https://launchpad.net/~paride/+archive/ubuntu/strongswan

Fix verified by the bug submitter using the PPA package.

Please review; no sponsorship needed.

[Christian Ehrhardt  (paelzer)]

This one was abandoned (wrong merge target)

Unmerged commits

58edb43... by Paride Legovini on 2021-09-17

Update d/changelog for 5.8.2-1ubuntu3.2

aaaf3bd... by Paride Legovini on 2021-09-15

tpm plugin: compile against the tpm2 software stack (tss2)

d/rules: configure with --enable-tss-tss2
d/control: build-depend on libtss2-dev

Closes: #994396, LP: #1940079

c50c2d7... by Lucas Kanashiro on 2020-05-22

Update changelog

546ba27... by Lucas Kanashiro on 2020-05-22

Add patches to fix the chunk_from_chars() macro compiled with GCC 9+

Those patches fix also the pki CA certificate creation issue reported on
LP: #1879692.

06156b5... by Lucas Kanashiro on 2020-05-21

Remove conf files of plugins removed from libcharon-extra-plugins

These plugins were removed in version 5.8.0-2, and after upgrading to a
greater version an user might get confused since the conf files are
there but the plugins are not installed.

1a29456... by Lucas Kanashiro on 2020-05-15

Re-enable eap-{dynamic,peap} libcharon plugins (LP: #1878887)

eap-dynamic might be quite useful for users because it allows clients to
select an alternative EAP method if the one selected by the server
initially is not supported.

eap-peap is still widely used by users because it is what most of the
clients implements. It is often used in combination with EAP-MSCHAPv2 to
authenticate e.g. WiFi clients (the TLS connection in EAP-PEAP protects
the potentially weak password authentication in EAP-MSCHAPv2). For
instance, using the same protocol for VPN clients allows reusing the
existing AAA infrastructure (AD/RADIUS server).

174d2fa... by Christian Ehrhardt  on 2020-03-10

5.8.2-1ubuntu3 (patches unapplied)

Imported using git-ubuntu import.

e718509... by Christian Ehrhardt  on 2020-03-04

changelog: re-add BLISS and NTRU (LP: #1863749)

Signed-off-by: Christian Ehrhardt <email address hidden>

a224d03... by Christian Ehrhardt  on 2020-03-05

d/control: d/libstrongswan-extra-plugins.install: re-add nttfft (Number Theoretic Transform via the FFT algorithm) which is required by BLISS

Note: Debian won't follow (for now) so this is intentional delta for now
=> https://salsa.debian.org/debian/strongswan/-/merge_requests/8
=> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=803787

Signed-off-by: Christian Ehrhardt <email address hidden>

26d1d13... by Christian Ehrhardt  on 2020-03-04

d/control: d/rules: d/libstrongswan-extra-plugins.install: re-add BLISS (Bimodal Lattice Signature Scheme post-quantum computer signature scheme) plugin (LP: #1863749)

Note: Debian won't follow (for now) so this is intentional delta for now
=> https://salsa.debian.org/debian/strongswan/-/merge_requests/8
=> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=803787

Signed-off-by: Christian Ehrhardt <email address hidden>

diff --git a/debian/changelog b/debian/changelog
index 436a5e3..e303419 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,10 +1,15 @@
+<<<<<<< debian/changelog
 strongswan (5.9.1-1ubuntu3) impish; urgency=medium
+=======
+strongswan (5.8.2-1ubuntu3.2) focal; urgency=medium
+>>>>>>> debian/changelog
 
   * Compile the tpm plugin against the tpm2 software stack (tss2)
     (Debian packaging cherry-pick, LP: #1940079)
     - d/rules: add the --enable-tss-tss2 configure flag
     - d/control: add Build-Depends: libtss2-dev
 
+<<<<<<< debian/changelog
  -- Paride Legovini <[e-mail]>  Thu, 16 Sep 2021 11:40:38 +0200
 
 strongswan (5.9.1-1ubuntu2) impish; urgency=medium
@@ -53,6 +58,11 @@ strongswan (5.9.0-1) unstable; urgency=medium
  -- Yves-Alexis Perez <[e-mail]>  Thu, 17 Sep 2020 10:21:30 +0200
 
 strongswan (5.8.4-1ubuntu2) groovy; urgency=medium
+=======
+ -- Paride Legovini <[e-mail]>  Fri, 17 Sep 2021 10:48:56 +0200
+
+strongswan (5.8.2-1ubuntu3.1) focal; urgency=medium
+>>>>>>> debian/changelog
 
   * Re-enable eap-{dynamic,peap} libcharon plugins (LP: #1878887)
     - d/control: update libcharon-extra-plugins description.
@@ -64,6 +74,7 @@ strongswan (5.8.4-1ubuntu2) groovy; urgency=medium
       eap-simaka-reauth, eap-simaka-sql, xauth-noauth.
     - Created d/libcharon-extra-plugins.maintscript to handle the removals
       properly.
+<<<<<<< debian/changelog
 
  -- Lucas Kanashiro <[e-mail]>  Thu, 21 May 2020 14:53:05 -0300
 
@@ -105,6 +116,14 @@ strongswan (5.8.2-2) unstable; urgency=medium
   * d/copyright updated
 
  -- Yves-Alexis Perez <[e-mail]>  Thu, 13 Feb 2020 22:46:40 +0100
+=======
+  * Add patches to fix the chunk_from_chars() macro compiled with GCC 9+
+    (LP: #1879692)
+    - Patches backported from upstream: lp-1879692-{1,2,3,4,5}.patch.
+    - Fix the pki CA certificate creation issue.
+
+ -- Lucas Kanashiro <[e-mail]>  Fri, 22 May 2020 10:53:07 -0300
+>>>>>>> debian/changelog
 
 strongswan (5.8.2-1ubuntu3) focal; urgency=medium
 
diff --git a/debian/control b/debian/control
index a64a176..382587e 100644
--- a/debian/control
+++ b/debian/control
@@ -14,6 +14,11 @@ Build-Depends: bison,
                dpkg-dev (>= 1.16.2),
                flex,
                gperf,
+<<<<<<< debian/control
+=======
+               libip4tc-dev [linux-any],
+               libip6tc-dev [linux-any],
+>>>>>>> debian/control
                libiptc-dev [linux-any],
                libcap-dev [linux-any],
                libcurl4-openssl-dev | libcurl3-dev | libcurl2-dev,
@@ -152,8 +157,8 @@ Architecture: any
 Depends: libstrongswan (= ${binary:Version}),
          ${misc:Depends},
          ${shlibs:Depends}
-Breaks: libcharon-extra-plugins (<< 5.8.0-2~)
-Replaces: libcharon-extra-plugins (<< 5.8.0-2~)
+Breaks: libcharon-extra-plugins (<< 5.8.0-2~), libcharon-standard-plugins (<< 5.8.1-1ubuntu1~)
+Replaces: libcharon-extra-plugins (<< 5.8.0-2~), libcharon-standard-plugins (<< 5.8.1-1ubuntu1~)
 Description: strongSwan charon library (extended authentication plugins)
  The strongSwan VPN suite uses the native IPsec stack in the standard
  Linux kernel. It supports both the IKEv1 and IKEv2 protocols.
@@ -172,11 +177,65 @@ Description: strongSwan charon library (extended authentication plugins)
  These are the "not always, but still more commonly used" plugins, for further
  needs even more plugins can be found in the package libcharon-extra-plugins.
 
+# Transition from former Ubuntu only libcharon-standard-plugins to common libcharon-extauth-plugins
+Package: libcharon-standard-plugins
+Depends: libcharon-extauth-plugins (= ${source:Version}), ${misc:Depends}
+Architecture: all
+Priority: optional
+Section: oldlibs
+Description: transitional package
+ This is a transitional package. It can safely be removed.
+
+# Transition back from strongswan-tnc-* being in extra packages
+# Can be dropped after 20.04
+Package: strongswan-tnc-ifmap
+Depends: libcharon-extra-plugins (= ${source:Version}), ${misc:Depends}
+Architecture: all
+Priority: optional
+Section: oldlibs
+Description: transitional package
+ This is a transitional package. It can safely be removed.
+
+Package: strongswan-tnc-base
+Depends: libcharon-extra-plugins (= ${source:Version}), ${misc:Depends}
+Architecture: all
+Priority: optional
+Section: oldlibs
+Description: transitional package
+ This is a transitional package. It can safely be removed.
+
+Package: strongswan-tnc-client
+Depends: libcharon-extra-plugins (= ${source:Version}), ${misc:Depends}
+Architecture: all
+Priority: optional
+Section: oldlibs
+Description: transitional package
+ This is a transitional package. It can safely be removed.
+
+Package: strongswan-tnc-server
+Depends: libcharon-extra-plugins (= ${source:Version}), ${misc:Depends}
+Architecture: all
+Priority: optional
+Section: oldlibs
+Description: transitional package
+ This is a transitional package. It can safely be removed.
+
+Package: strongswan-tnc-pdp
+Depends: libcharon-extra-plugins (= ${source:Version}), ${misc:Depends}
+Architecture: all
+Priority: optional
+Section: oldlibs
+Description: transitional package
+ This is a transitional package. It can safely be removed.
+
 Package: libcharon-extra-plugins
 Architecture: any
 Depends: libstrongswan (= ${binary:Version}),
          ${misc:Depends},
          ${shlibs:Depends}
+Breaks: strongswan-tnc-ifmap (<< 5.7.2-1ubuntu1), strongswan-tnc-base (<< 5.7.2-1ubuntu1), strongswan-tnc-client (<< 5.7.2-1ubuntu1), strongswan-tnc-server (<< 5.7.2-1ubuntu1), strongswan-tnc-pdp (<< 5.7.2-1ubuntu1)
+Replaces: strongswan-tnc-ifmap (<< 5.7.2-1ubuntu1), strongswan-tnc-base (<< 5.7.2-1ubuntu1), strongswan-tnc-client (<< 5.7.2-1ubuntu1), strongswan-tnc-server (<< 5.7.2-1ubuntu1), strongswan-tnc-pdp (<< 5.7.2-1ubuntu1)
+Provides: strongswan-tnc-base
 Description: strongSwan charon library (extra plugins)
  The strongSwan VPN suite uses the native IPsec stack in the standard
  Linux kernel. It supports both the IKEv1 and IKEv2 protocols.
diff --git a/debian/libcharon-extra-plugins.maintscript b/debian/libcharon-extra-plugins.maintscript
index f6e7a3a..8c58c56 100644
--- a/debian/libcharon-extra-plugins.maintscript
+++ b/debian/libcharon-extra-plugins.maintscript
@@ -1,3 +1,4 @@
+<<<<<<< debian/libcharon-extra-plugins.maintscript
 rm_conffile /etc/strongswan.d/charon/eap-aka-3gpp2.conf 5.8.4-1ubuntu2~ libcharon-extra-plugins
 rm_conffile /etc/strongswan.d/charon/eap-sim-file.conf 5.8.4-1ubuntu2~ libcharon-extra-plugins
 rm_conffile /etc/strongswan.d/charon/eap-sim-pcsc.conf 5.8.4-1ubuntu2~ libcharon-extra-plugins
@@ -6,3 +7,13 @@ rm_conffile /etc/strongswan.d/charon/eap-simaka-pseudonym.conf 5.8.4-1ubuntu2~ l
 rm_conffile /etc/strongswan.d/charon/eap-simaka-reauth.conf 5.8.4-1ubuntu2~ libcharon-extra-plugins
 rm_conffile /etc/strongswan.d/charon/eap-simaka-sql.conf 5.8.4-1ubuntu2~ libcharon-extra-plugins
 rm_conffile /etc/strongswan.d/charon/xauth-noauth.conf 5.8.4-1ubuntu2~ libcharon-extra-plugins
+=======
+rm_conffile /etc/strongswan.d/charon/eap-aka-3gpp2.conf 5.8.2-1ubuntu3.1~ libcharon-extra-plugins
+rm_conffile /etc/strongswan.d/charon/eap-sim-file.conf 5.8.2-1ubuntu3.1~ libcharon-extra-plugins
+rm_conffile /etc/strongswan.d/charon/eap-sim-pcsc.conf 5.8.2-1ubuntu3.1~ libcharon-extra-plugins
+rm_conffile /etc/strongswan.d/charon/eap-sim.conf 5.8.2-1ubuntu3.1~ libcharon-extra-plugins
+rm_conffile /etc/strongswan.d/charon/eap-simaka-pseudonym.conf 5.8.2-1ubuntu3.1~ libcharon-extra-plugins
+rm_conffile /etc/strongswan.d/charon/eap-simaka-reauth.conf 5.8.2-1ubuntu3.1~ libcharon-extra-plugins
+rm_conffile /etc/strongswan.d/charon/eap-simaka-sql.conf 5.8.2-1ubuntu3.1~ libcharon-extra-plugins
+rm_conffile /etc/strongswan.d/charon/xauth-noauth.conf 5.8.2-1ubuntu3.1~ libcharon-extra-plugins
+>>>>>>> debian/libcharon-extra-plugins.maintscript
diff --git a/debian/patches/lp-1879692-1.patch b/debian/patches/lp-1879692-1.patch
new file mode 100644
index 0000000..dad8ff4
--- /dev/null
+++ b/debian/patches/lp-1879692-1.patch
@@ -0,0 +1,75 @@
+From ef4113a49dbf3d0315d5c3e486a3717dda5f4c7c Mon Sep 17 00:00:00 2001
+From: Tobias Brunner <[e-mail]>
+Date: Wed, 29 Jan 2020 11:22:07 +0100
+Subject: [PATCH] libtpmtss: Fix problematic usage of chunk_from_chars() in
+ TSS2 implementations
+
+See 8ea13bbc5ccd for details.
+
+References #3249.
+
+Origin: upstream, https://git.strongswan.org/?p=strongswan.git;a=commitdiff;h=ef4113a49dbf3d0315d5c3e486a3717dda5f4c7c
+Reviewed-By: Lucas Kanashiro <[e-mail]>
+Last-Updated: 2020-05-22
+---
+ src/libtpmtss/tpm_tss_tss2_v1.c | 9 +++------
+ src/libtpmtss/tpm_tss_tss2_v2.c | 9 +++------
+ 2 files changed, 6 insertions(+), 12 deletions(-)
+
+diff --git a/src/libtpmtss/tpm_tss_tss2_v1.c b/src/libtpmtss/tpm_tss_tss2_v1.c
+index fb26d05..31465da 100644
+--- a/src/libtpmtss/tpm_tss_tss2_v1.c
++++ b/src/libtpmtss/tpm_tss_tss2_v1.c
+@@ -494,7 +494,8 @@ METHOD(tpm_tss_t, get_public, chunk_t,
+ 		{
+ 			TPM2B_PUBLIC_KEY_RSA *rsa;
+ 			TPMT_RSA_SCHEME *scheme;
+-			chunk_t aik_exponent, aik_modulus;
++			chunk_t aik_exponent = chunk_from_chars(0x01, 0x00, 0x01);
++			chunk_t aik_modulus;
+ 			uint32_t exponent;
+ 
+ 			scheme = &public.t.publicArea.parameters.rsaDetail.scheme;
+@@ -504,11 +505,7 @@ METHOD(tpm_tss_t, get_public, chunk_t,
+ 			rsa = &public.t.publicArea.unique.rsa;
+ 			aik_modulus = chunk_create(rsa->t.buffer, rsa->t.size);
+ 			exponent = htonl(public.t.publicArea.parameters.rsaDetail.exponent);
+-			if (!exponent)
+-			{
+-				aik_exponent = chunk_from_chars(0x01, 0x00, 0x01);
+-			}
+-			else
++			if (exponent)
+ 			{
+ 				aik_exponent = chunk_from_thing(exponent);
+ 			}
+diff --git a/src/libtpmtss/tpm_tss_tss2_v2.c b/src/libtpmtss/tpm_tss_tss2_v2.c
+index c5d78d6..fef32e1 100644
+--- a/src/libtpmtss/tpm_tss_tss2_v2.c
++++ b/src/libtpmtss/tpm_tss_tss2_v2.c
+@@ -448,7 +448,8 @@ METHOD(tpm_tss_t, get_public, chunk_t,
+ 		{
+ 			TPM2B_PUBLIC_KEY_RSA *rsa;
+ 			TPMT_RSA_SCHEME *scheme;
+-			chunk_t aik_exponent, aik_modulus;
++			chunk_t aik_exponent = chunk_from_chars(0x01, 0x00, 0x01);
++			chunk_t aik_modulus;
+ 			uint32_t exponent;
+ 
+ 			scheme = &public.publicArea.parameters.rsaDetail.scheme;
+@@ -458,11 +459,7 @@ METHOD(tpm_tss_t, get_public, chunk_t,
+ 			rsa = &public.publicArea.unique.rsa;
+ 			aik_modulus = chunk_create(rsa->buffer, rsa->size);
+ 			exponent = htonl(public.publicArea.parameters.rsaDetail.exponent);
+-			if (!exponent)
+-			{
+-				aik_exponent = chunk_from_chars(0x01, 0x00, 0x01);
+-			}
+-			else
++			if (exponent)
+ 			{
+ 				aik_exponent = chunk_from_thing(exponent);
+ 			}
+-- 
+2.7.4
+
diff --git a/debian/patches/lp-1879692-2.patch b/debian/patches/lp-1879692-2.patch
new file mode 100644
index 0000000..2dddeac
--- /dev/null
+++ b/debian/patches/lp-1879692-2.patch
@@ -0,0 +1,50 @@
+From 776433505b8581866010c2c82bf7611f4f0946e8 Mon Sep 17 00:00:00 2001
+From: Tobias Brunner <[e-mail]>
+Date: Wed, 29 Jan 2020 11:12:12 +0100
+Subject: [PATCH] x509: Replace problematic calls of chunk_from_chars() for
+ keyUsage extension
+
+As noted in 8ea13bbc5ccd newer compilers might optimize out the
+assignment leading to invalid values in the keyUsage extension (as the
+length was still set, the extension was encoded, just not with the
+intended values).
+
+Fixes #3249.
+
+Origin: upstream, https://git.strongswan.org/?p=strongswan.git;a=commitdiff;h=776433505b8581866010c2c82bf7611f4f0946e8
+Reviewed-By: Lucas Kanashiro <[e-mail]>
+Last-Updated: 2020-05-22
+---
+ src/libstrongswan/plugins/x509/x509_cert.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/src/libstrongswan/plugins/x509/x509_cert.c b/src/libstrongswan/plugins/x509/x509_cert.c
+index 7311708..5a3f838 100644
+--- a/src/libstrongswan/plugins/x509/x509_cert.c
++++ b/src/libstrongswan/plugins/x509/x509_cert.c
+@@ -2198,6 +2198,8 @@ static chunk_t generate_ts(traffic_selector_t *ts)
+ static bool generate(private_x509_cert_t *cert, certificate_t *sign_cert,
+ 					 private_key_t *sign_key, int digest_alg)
+ {
++	const chunk_t keyUsageCrlSign = chunk_from_chars(0x01, 0x02);
++	const chunk_t keyUsageCertSignCrlSign = chunk_from_chars(0x01, 0x06);
+ 	chunk_t extensions = chunk_empty, extendedKeyUsage = chunk_empty;
+ 	chunk_t serverAuth = chunk_empty, clientAuth = chunk_empty;
+ 	chunk_t ocspSigning = chunk_empty, certPolicies = chunk_empty;
+@@ -2317,11 +2319,11 @@ static bool generate(private_x509_cert_t *cert, certificate_t *sign_cert,
+ 												chunk_from_chars(0xFF)),
+ 											pathLenConstraint)));
+ 		/* set CertificateSign and implicitly CRLsign */
+-		keyUsageBits = chunk_from_chars(0x01, 0x06);
++		keyUsageBits = keyUsageCertSignCrlSign;
+ 	}
+ 	else if (cert->flags & X509_CRL_SIGN)
+ 	{
+-		keyUsageBits = chunk_from_chars(0x01, 0x02);
++		keyUsageBits = keyUsageCrlSign;
+ 	}
+ 	if (keyUsageBits.len)
+ 	{
+-- 
+2.7.4
+
diff --git a/debian/patches/lp-1879692-3.patch b/debian/patches/lp-1879692-3.patch
new file mode 100644
index 0000000..5b6152a
--- /dev/null
+++ b/debian/patches/lp-1879692-3.patch
@@ -0,0 +1,37 @@
+From d16e81077808c9c898e35db0f4b8f60e0490bf09 Mon Sep 17 00:00:00 2001
+From: Tobias Brunner <[e-mail]>
+Date: Wed, 29 Jan 2020 11:05:30 +0100
+Subject: [PATCH] pki: Remove unnecessary and problematic chunk_from_chars()
+ usage in --signcrl
+
+If the serial is not yet set, the same default value is set just below.
+
+See 8ea13bbc5ccd for details on chunk_from_chars().
+
+References #3249.
+
+Origin: upstream, https://git.strongswan.org/?p=strongswan.git;a=commitdiff;h=d16e81077808c9c898e35db0f4b8f60e0490bf09
+Reviewed-By: Lucas Kanashiro <[e-mail]>
+Last-Updated: 2020-05-22
+---
+ src/pki/commands/signcrl.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/src/pki/commands/signcrl.c b/src/pki/commands/signcrl.c
+index dfe1ce0..60d880e 100644
+--- a/src/pki/commands/signcrl.c
++++ b/src/pki/commands/signcrl.c
+@@ -385,10 +385,6 @@ static int sign_crl()
+ 	}
+ 	else
+ 	{
+-		if (!crl_serial.ptr)
+-		{
+-			crl_serial = chunk_from_chars(0x00);
+-		}
+ 		lastenum = enumerator_create_empty();
+ 	}
+ 
+-- 
+2.7.4
+
diff --git a/debian/patches/lp-1879692-4.patch b/debian/patches/lp-1879692-4.patch
new file mode 100644
index 0000000..348b1c2
--- /dev/null
+++ b/debian/patches/lp-1879692-4.patch
@@ -0,0 +1,42 @@
+From d5cf2d1f8549a3492916dab3178fba50030e8884 Mon Sep 17 00:00:00 2001
+From: Tobias Brunner <[e-mail]>
+Date: Wed, 29 Jan 2020 10:02:38 +0100
+Subject: [PATCH] tls-crypto: Fix usage of chunk_from_chars()
+
+See 8ea13bbc5ccd for details.
+
+References #3249.
+
+Origin: upstream, https://git.strongswan.org/?p=strongswan.git;a=commitdiff;h=d5cf2d1f8549a3492916dab3178fba50030e8884
+Reviewed-By: Lucas Kanashiro <[e-mail]>
+Last-Updated: 2020-05-22
+---
+ src/libtls/tls_crypto.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/src/libtls/tls_crypto.c b/src/libtls/tls_crypto.c
+index 0ec2f5c..ebadb91 100644
+--- a/src/libtls/tls_crypto.c
++++ b/src/libtls/tls_crypto.c
+@@ -1409,6 +1409,8 @@ METHOD(tls_crypto_t, sign, bool,
+ {
+ 	if (this->tls->get_version(this->tls) >= TLS_1_2)
+ 	{
++		const chunk_t hashsig_def = chunk_from_chars(
++					TLS_HASH_SHA1, TLS_SIG_RSA, TLS_HASH_SHA1, TLS_SIG_ECDSA);
+ 		signature_scheme_t scheme;
+ 		bio_reader_t *reader;
+ 		uint8_t hash, alg;
+@@ -1417,8 +1419,7 @@ METHOD(tls_crypto_t, sign, bool,
+ 
+ 		if (!hashsig.len)
+ 		{	/* fallback if none given */
+-			hashsig = chunk_from_chars(
+-				TLS_HASH_SHA1, TLS_SIG_RSA, TLS_HASH_SHA1, TLS_SIG_ECDSA);
++			hashsig = hashsig_def;
+ 		}
+ 		reader = bio_reader_create(hashsig);
+ 		while (reader->remaining(reader) >= 2)
+-- 
+2.7.4
+
diff --git a/debian/patches/lp-1879692-5.patch b/debian/patches/lp-1879692-5.patch
new file mode 100644
index 0000000..85efd71
--- /dev/null
+++ b/debian/patches/lp-1879692-5.patch
@@ -0,0 +1,111 @@
+From 8ea13bbc5ccdb7a67e5b2c0e0465d432dd24614b Mon Sep 17 00:00:00 2001
+From: Tobias Brunner <[e-mail]>
+Date: Mon, 27 Jan 2020 15:16:51 +0100
+Subject: [PATCH] lgtm: Add query to detect problematic uses of
+ chunk_from_chars()
+
+GCC 9+ and clang 4+ (partially) optimize out usages of
+chunk_from_chars() if the value is read outside of the block where the
+macro is used.  For instance:
+
+```
+chunk_t chunk = chunk_empty;
+if (...)
+{
+	chunk = chunk_from_chars(0x01, 0x06);
+}
+/* do something with chunk */
+```
+
+The chunk_from_chars() macro expands to a chunk_t declaration, which is
+technically only defined inside that block.
+
+Still, with older GCC versions the fourth line was compiled to something
+like this:
+
+```
+mov     WORD PTR [rsp+14], 1537 # 0x0106 in little-endian
+lea     rdx, [rsp+14]
+mov     ecx, 2
+```
+
+However, with GCC 9.1 and -O2 the first instruction might be omitted
+(strangely the others usually were not, so the chunk pointed to whatever
+was stored on the stack).  It's not easily reproducible, so there are
+situations where the seemingly identical code is not optimized in this
+way.
+
+This query should detect such problematic uses of the macro (definition
+and usage in different blocks).
+
+References #3249.
+
+Origin: upstream, https://git.strongswan.org/?p=strongswan.git;a=commitdiff;h=8ea13bbc5ccdb7a67e5b2c0e0465d432dd24614b
+Reviewed-By: Lucas Kanashiro <[e-mail]>
+Last-Updated: 2020-05-22
+
+---
+ .lgtm/cpp-queries/chunk_from_chars.ql | 51 +++++++++++++++++++++++++++++++++++
+ 1 file changed, 51 insertions(+)
+ create mode 100644 .lgtm/cpp-queries/chunk_from_chars.ql
+
+diff --git a/.lgtm/cpp-queries/chunk_from_chars.ql b/.lgtm/cpp-queries/chunk_from_chars.ql
+new file mode 100644
+index 0000000..c393e7e
+--- /dev/null
++++ b/.lgtm/cpp-queries/chunk_from_chars.ql
+@@ -0,0 +1,51 @@
++/**
++ * @name Invalid use of chunk_from_chars() macro
++ * @description The chunk_from_chars() macro creates a temporary chunk_t, which
++ *              is not defined outside of the block in which it has been used,
++ *              therefore, compilers might optimize out the assignment.
++ * @kind path-problem
++ * @problem.severity error
++ * @id strongswan/invalid-chunk-from-chars
++ * @tags correctness
++ * @precision very-high
++ */
++import cpp
++import DataFlow::PathGraph
++import semmle.code.cpp.dataflow.DataFlow
++
++class ChunkFromChars extends Expr {
++  ChunkFromChars() {
++    this = any(MacroInvocation mi |
++      mi.getOutermostMacroAccess().getMacroName() = "chunk_from_chars"
++      /* ignore global static uses of the macro */
++      and exists (Block b | mi.getExpr().getEnclosingBlock() = b)
++    ).getExpr()
++  }
++}
++
++class ChunkFromCharsUsage extends DataFlow::Configuration {
++  ChunkFromCharsUsage() { this = "ChunkFromCharsUsage" }
++
++  override predicate isSource(DataFlow::Node source) {
++    source.asExpr() instanceof ChunkFromChars
++  }
++
++  override predicate isSink(DataFlow::Node sink) {
++    exists(sink.asExpr())
++  }
++
++  override predicate isBarrierOut(DataFlow::Node node) {
++    /* don't track beyond function calls */
++    exists(FunctionCall fc | node.asExpr().getParent*() = fc)
++  }
++}
++
++Block enclosingBlock(Block b) {
++  result = b.getEnclosingBlock()
++}
++
++from ChunkFromCharsUsage usage, DataFlow::PathNode source, DataFlow::PathNode sink
++where
++  usage.hasFlowPath(source, sink)
++  and not source.getNode().asExpr().getEnclosingBlock() = enclosingBlock*(sink.getNode().asExpr().getEnclosingBlock())
++select source, source, sink, "Invalid use of chunk_from_chars() result in sibling/parent block."
+-- 
+2.7.4
+
diff --git a/debian/patches/series b/debian/patches/series
index c72895f..d5cd0fd 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -3,3 +3,8 @@
 03_systemd-service.patch
 04_disable-libtls-tests.patch
 dont-load-kernel-libipsec-plugin-by-default.patch
+lp-1879692-1.patch
+lp-1879692-2.patch
+lp-1879692-3.patch
+lp-1879692-4.patch
+lp-1879692-5.patch