Merge ~paride/ubuntu/+source/strongswan:lp1946213-JAMMY into ubuntu/+source/strongswan:ubuntu/devel

[Paride Legovini]

Add d/p/load-legacy-provider-in-openssl3.patch.
Upstream cherry-pick to fix FTBFS against OpenSSL 3.0.
Fixes LP: #1946213.

Test PPA: https://launchpad.net/~paride/+archive/ubuntu/strongswan-openssl3

The test PPA builds with jammy-proposed and with https://launchpad.net/~schopin/+archive/ubuntu/openssl-3.0.0 as a dependency.

I verified from the build logs that the builds are actually done against openssl3, see for example: https://launchpadlibrarian.net/569418904/buildlog_ubuntu-jammy-amd64.strongswan_5.9.4-1ubuntu2~paride1_BUILDING.txt.gz

The PPA builds on all the supported archs.

# Autopkgtest results

Tested out of the PPAs:

$ autopkgtest --add-apt-source={deb,deb-src}' [trusted=yes] http://ppa.launchpad.net/paride/strongswan-openssl3/ubuntu jammy main' --add-apt-source='deb [trusted=yes] http://ppa.launchpad.net/schopin/openssl-3.0.0/ubuntu jammy main' -U --no-built-binaries strongswan -- qemu ~/ubuntu/autopkgtest-images/autopkgtest-jammy-amd64.img

Results:

autopkgtest [18:14:07]: @@@@@@@@@@@@@@@@@@@@ summary
admin-strongswan-charon PASS
admin-strongswan-starter PASS
daemon PASS
plugins PASS

[Paride Legovini (paride)]

Added "upstream" to the Origin DEP-3 header, thanks Sergio.

This is now ready for review.

[Lucas Kanashiro (lucaskanashiro)]

Thanks Paride, LGTM. I am sponsoring this upload for you:

$ dput ubuntu ../strongswan_5.9.4-1ubuntu2_source.changes
Checking signature on .changes
gpg: ../strongswan_5.9.4-1ubuntu2_source.changes: Valid signature from F823A2729883C97C
Checking signature on .dsc
gpg: ../strongswan_5.9.4-1ubuntu2.dsc: Valid signature from F823A2729883C97C
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading strongswan_5.9.4-1ubuntu2.dsc: done.
  Uploading strongswan_5.9.4.orig.tar.bz2: done.
  Uploading strongswan_5.9.4.orig.tar.bz2.asc: done.
  Uploading strongswan_5.9.4-1ubuntu2.debian.tar.xz: done.
  Uploading strongswan_5.9.4-1ubuntu2_source.buildinfo: done.
  Uploading strongswan_5.9.4-1ubuntu2_source.changes: done.
Successfully uploaded packages.

review: Approve

diff --git a/debian/changelog b/debian/changelog
index 420061f..d430fc2 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+strongswan (5.9.4-1ubuntu2) jammy; urgency=medium
+
+  * Add d/p/load-legacy-provider-in-openssl3.patch.
+    Upstream cherry-pick to fix FTBFS against OpenSSL 3.0. (LP: #1946213)
+
+ -- Paride Legovini <[e-mail]>  Wed, 17 Nov 2021 17:04:27 +0100
+
 strongswan (5.9.4-1ubuntu1) jammy; urgency=medium
 
   * Merge with Debian unstable. Remaining changes:
diff --git a/debian/patches/load-legacy-provider-in-openssl3.patch b/debian/patches/load-legacy-provider-in-openssl3.patch
 new file mode 100644
index 0000000..96399cb
--- /dev/null
+++ b/debian/patches/load-legacy-provider-in-openssl3.patch
@@ -0,0 +1,116 @@
+From: Tobias Brunner <[e-mail]>
+Date: Thu, 30 Sep 2021 09:41:57 +0200
+Origin: upstream, https://github.com/strongswan/strongswan/commit/a373b6aee36c01b7f6c5ca052c932595bc93d471
+Bug: https://github.com/strongswan/strongswan/issues/759
+Bug-Ubuntu: https://bugs.launchpad.net/strongswan/+bug/1946213
+Last-Update: 2021-11-17
+Subject: [PATCH] openssl: Load "legacy" provider in OpenSSL 3 for algorithms
+ like MD4, DES etc.
+
+We still require these algorithms for e.g. EAP-MSCHAPv2, so the option is
+enabled, by default.  To use other providers (e.g. fips or even custom
+ones), the option can be disabled and the providers to load/activate can
+be configured in openssl.cnf.  For instance, the following has the same
+effect as enabling the option:
+
+    openssl_conf = openssl_init
+
+    [openssl_init]
+    providers = providers
+
+    [providers]
+    default = activate
+    legacy = activate
+
+    [activate]
+    activate = yes
+---
+ conf/plugins/openssl.opt                      |  5 +++
+ .../plugins/openssl/openssl_plugin.c          | 33 +++++++++++++++++++
+ 2 files changed, 38 insertions(+)
+
+diff --git a/conf/plugins/openssl.opt b/conf/plugins/openssl.opt
+index 55d8dcaa184..29aabd3682c 100644
+--- a/conf/plugins/openssl.opt
++++ b/conf/plugins/openssl.opt
+@@ -3,3 +3,8 @@ charon.plugins.openssl.engine_id = pkcs11
+ 
+ charon.plugins.openssl.fips_mode = 0
+ 	Set OpenSSL FIPS mode: disabled(0), enabled(1), Suite B enabled(2).
++
++charon.plugins.openssl.load_legacy = yes
++	Load the legacy provider in OpenSSL 3+ for algorithms like MD4, DES, or
++	Blowfish. If disabled, the default provider is loaded, or those configured
++	in the OpenSSL config.
+diff --git a/src/libstrongswan/plugins/openssl/openssl_plugin.c b/src/libstrongswan/plugins/openssl/openssl_plugin.c
+index 5009f4e3f08..36c0c45be70 100644
+--- a/src/libstrongswan/plugins/openssl/openssl_plugin.c
++++ b/src/libstrongswan/plugins/openssl/openssl_plugin.c
+@@ -16,6 +16,7 @@
+ 
+ #include <library.h>
+ #include <utils/debug.h>
++#include <collections/array.h>
+ #include <threading/thread.h>
+ #include <threading/mutex.h>
+ #include <threading/thread_value.h>
+@@ -28,6 +29,9 @@
+ #ifndef OPENSSL_NO_ENGINE
+ #include <openssl/engine.h>
+ #endif
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++#include <openssl/provider.h>
++#endif
+ 
+ #include "openssl_plugin.h"
+ #include "openssl_util.h"
+@@ -67,6 +71,13 @@ struct private_openssl_plugin_t {
+ 	 * public functions
+ 	 */
+ 	openssl_plugin_t public;
++
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++	/**
++	 * Loaded providers
++	 */
++	array_t *providers;
++#endif
+ };
+ 
+ /**
+@@ -813,6 +824,15 @@ METHOD(plugin_t, get_features, int,
+ METHOD(plugin_t, destroy, void,
+ 	private_openssl_plugin_t *this)
+ {
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++	OSSL_PROVIDER *provider;
++	while (array_remove(this->providers, ARRAY_TAIL, &provider))
++	{
++		OSSL_PROVIDER_unload(provider);
++	}
++	array_destroy(this->providers);
++#endif /* OPENSSL_VERSION_NUMBER */
++
+ /* OpenSSL 1.1.0 cleans up itself at exit and while OPENSSL_cleanup() exists we
+  * can't call it as we couldn't re-initialize the library (as required by the
+  * unit tests and the Android app) */
+@@ -889,6 +909,19 @@ plugin_t *openssl_plugin_create()
+ #endif /* OPENSSL_NO_ENGINE */
+ #endif /* OPENSSL_VERSION_NUMBER */
+ 
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++	if (lib->settings->get_bool(lib->settings, "%s.plugins.openssl.load_legacy",
++								TRUE, lib->ns))
++	{
++		/* load the legacy provider for algorithms like MD4, DES, BF etc. */
++		array_insert_create(&this->providers, ARRAY_TAIL,
++							OSSL_PROVIDER_load(NULL, "legacy"));
++		/* explicitly load the default provider, as mentioned by crypto(7) */
++		array_insert_create(&this->providers, ARRAY_TAIL,
++							OSSL_PROVIDER_load(NULL, "default"));
++	}
++#endif /* OPENSSL_VERSION_NUMBER */
++
+ #ifdef OPENSSL_FIPS
+ 	/* we do this here as it may have been enabled via openssl.conf */
+ 	fips_mode = FIPS_mode();
diff --git a/debian/patches/series b/debian/patches/series
index c72895f..b77b047 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -3,3 +3,4 @@
 03_systemd-service.patch
 04_disable-libtls-tests.patch
 dont-load-kernel-libipsec-plugin-by-default.patch
+load-legacy-provider-in-openssl3.patch