Please enable mediation support for strongswan

[Carl-Daniel Hailfinger]

Latest strongswan from debian has mediation support enabled which allows peer-to-peer IPsec even if both peers are behind NAT. IPsec mediation is somewhat similar to STUN and requires a publicly reachable third party which helps with mediation.
Please note that medcli/medsrv are not required for mediation, they are just optional web frontends for mediation management. As such, I'm not asking for enabling of medcli/medsrv.

Debian bug #851507 is virtually identical to this and has been fixed in Debian strongswan 5.5.1-3 . Syncing that package version from debian should be enough to have mediation enabled.

The required switch during configure is --enable-mediation

Thank you!

[Christian Ehrhardt  (paelzer)]

Hi,
thank you for your report and your help to make Ubuntu better.

We are feature frozen for Zesty already and have picked up 5.5.1-1 there.
We will pick up the feature for the release after zesty.

If you think this is urgent and important please make this a FFE (https://wiki.ubuntu.com/FreezeExceptionProcess).
But I'd think and hope that zesty+1 is ok for that.

[Christian Ehrhardt  (paelzer)]

This will be part of the merge I do for the coming Artful release.

[Launchpad Janitor (janitor)]

This bug was fixed in the package strongswan - 5.5.1-3ubuntu1

---------------
strongswan (5.5.1-3ubuntu1) artful; urgency=medium

  * Merge from Debian to pick up latest changes. Among others this includes:
    - a lot of the Delta we upstreamed to Debian (more discussions are ongoing
      but likely have to wait until Debian stretch was released)
    - enabling mediation support (LP: #1657413)
  * Remaining Changes:
    + Update init/service handling
      - d/rules: Change init/systemd program name to strongswan
      - d/strongswan-starter.strongswan.service: Add new systemd file instead of
        patching upstream
      - d/strongswan-starter.links: Removed, use Ubuntu systemd file instead of
        linking to upstream
      - d/strongswan-starter.postrm: Removed 'update-rc.d ipsec remove' call.
      - d/strongswan-starter.prerm: Stop strongswan service on package
        removal (as opposed to using the old init.d script).
    + Clean up d/strongswan-starter.postinst:
      - Removed section about runlevel changes
      - Adapted service restart section for Upstart (kept to be Trusty
        backportable).
      - Remove old symlinks to init.d files is necessary.
      - Removed further out-dated code
      - Removed entire section on opportunistic encryption - this was never in
        strongSwan.
    + d/rules: Removed pieces on 'patching ipsec.conf' on build.
    + Mass enablement of extra plugins and features to allow a user to use
      strongswan for a variety of use cases without having to rebuild.
      - d/control: Add required additional build-deps
      - d/rules: Enable features at configure stage
      - d/control: Mention addtionally enabled plugins
      - d/libbstrongswan-extra-plugins.install: Add plugins (so, lib, conf)
      - d/libstrongswan.install: Add plugins (so, conf)
    + d/rules: Disable duplicheck as per
      https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=718291#10
    + Remove ha plugin (requires special kernel)
      - d/libcharon-extra-plugins.install: Stop installing ha (so, conf)
      - d/rules: Do not enable ha plugin
      - d/control: Drop listing the ha plugin in the package description
    + Add plugin kernel-libipsec to allow the use of strongswan in containers
      via this userspace implementation (please do note that this is still
      considered experimental by upstream).
      - d/libcharon-extra-plugins.install: Add kernel-libipsec components
      - d/control: List kernel-libipsec plugin at extra plugins description
      - d/p/dont-load-kernel-libipsec-plugin-by-default.patch: As
        upstream recommends to not load kernel-libipsec by default.
    + Relocate tnc plugin
     - debian/libcharon-extra-plugins.install: Drop tnc from extra plugins
     - Add new subpackage for TNC in d/strongswan-tnc-* and d/control
    + d/strongswan-starter.install: Install pool feature, that useful due to
      having attr-sql plugin that is enabled now.
    + Relocate plugins test-vectors and ccm from extra-plugins to libstrongswan
      - d/libstrongswan-extra-plugins.install: Remove plugins/conffiles
      - d/libstrongswan.install: Add plugins/confiles
      - d/control: move package descri...