strongswan: patch CVE-2026-78134

Use patch[1] provided by strongSwan[2] Details: https://nvd.nist.gov/vuln/detail/cve-2026-78134 [1]https://download.strongswan.org/security/CVE-2026-78134/strongswan-5.9.10-6.0.7_eap_inner_auth_cfg.patch [2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78134).html Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-10-15 06:17:16 +00:00 · 2026-10-06 09:50:51 +05:30
1 parent 9b02fe4850
commit 2352f80100
@@ -0,0 +1,712 @@
+From d95e9d363b0e23d0ba3080bb518695e05a453748 Mon Sep 17 00:00:00 2001
+From: Tobias Brunner <tobias@strongswan.org>
+Date: Mon, 27 Jul 2026 15:05:45 +0200
+Subject: [PATCH] eap-ttls/peap: Return auth-cfg with details on TLS and inner
+ EAP method
+
+This fixes several issues with binding identities to the IKE SA.
+
+If the client is authenticated with a certificate, the previous code still
+used the client's proclaimed inner EAP-Identity when starting the EAP-TNC
+method.  So that method would potentially operate on an unverified
+identity.
+
+Second, if the inner EAP method overrides the client identity (the only
+one is currently EAP-MSCHAPV2), the missing merge meant that the outer
+IKE/EAP identity could potentially be unconfirmed.
+
+For inner methods that don't override the identity (e.g. EAP-MD5), not
+propagating the inner EAP-Identity could potentially have the same
+effect.
+
+While the EAP-TTLS implementation returned the auth-cfg of the TLS
+exchange since the first referenced commit, this was mainly intended to
+enforce public key constraints.  So it didn't cover the phase 2 EAP
+methods.  For some reason EAP-PEAP did not get that method at all in that
+changeset, so we'll add that now.
+
+Additionally, the EAP-PEAP implementation now forwards the phase 2 EAP
+method type to EAP-TNC like the EAP-TTLS implementation already did,
+which allows a more informed decision on the client's identity.
+
+Fixes: 0864a31d13ff ("eap-ttls: Support EAP auth information getter in EAP-TTLS")
+Fixes: 79f2102cb442 ("implemented server side support for EAP-TTLS")
+Fixes: 2a421163bf4f ("make TNC client authentication type available to IMVs")
+Fixes: 1be296dfb2af ("implemented the PEAP tunneling protocol as an EAP plugin")
+Fixes: CVE-2026-78134
+
+CVE: CVE-2026-78134
+Upstream-Status: Backport [1][2]
+
+[1]https://github.com/strongswan/strongswan/commit/e059077d3f3e307e78be7f91e5648aa5f94916a8
+[2]https://github.com/strongswan/strongswan/commit/6a7210731f6dd2889d22bf20310ab0ed7274d0d8
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/libcharon/plugins/eap_peap/eap_peap.c     | 49 ++++++++++-
+ .../plugins/eap_peap/eap_peap_peer.c          | 20 +++++
+ .../plugins/eap_peap/eap_peap_peer.h          |  7 ++
+ .../plugins/eap_peap/eap_peap_server.c        | 81 ++++++++++++++++---
+ .../plugins/eap_peap/eap_peap_server.h        |  7 ++
+ src/libcharon/plugins/eap_ttls/eap_ttls.c     | 43 +++++++++-
+ .../plugins/eap_ttls/eap_ttls_peer.c          | 19 +++++
+ .../plugins/eap_ttls/eap_ttls_peer.h          |  7 ++
+ .../plugins/eap_ttls/eap_ttls_server.c        | 56 +++++++++++--
+ .../plugins/eap_ttls/eap_ttls_server.h        |  7 ++
+ 10 files changed, 278 insertions(+), 18 deletions(-)
+
+diff --git a/src/libcharon/plugins/eap_peap/eap_peap.c b/src/libcharon/plugins/eap_peap/eap_peap.c
+index 3573cba..cd942f1 100644
+--- a/src/libcharon/plugins/eap_peap/eap_peap.c
+++ b/src/libcharon/plugins/eap_peap/eap_peap.c
+@@ -40,6 +40,25 @@ struct private_eap_peap_t {
+ 	 * TLS stack, wrapped by EAP helper
+ 	 */
+ 	tls_eap_t *tls_eap;
+
+	/**
+	 * Role
+	 */
+	bool is_server;
+
+	/**
+	 * Actual server/client implementation
+	 */
+	union {
+		tls_application_t *application;
+		eap_peap_server_t *server;
+		eap_peap_peer_t *client;
+	} impl;
+
+	/**
+	 * Cached auth data for TLS and inner EAP methods
+	 */
+	auth_cfg_t *auth;
+ };
+ 
+ /** Maximum number of EAP-PEAP messages/fragments allowed */
+@@ -113,10 +132,34 @@ METHOD(eap_method_t, is_mutual, bool,
+ 	return TRUE;
+ }
+ 
+METHOD(eap_method_t, get_auth, auth_cfg_t*,
+	private_eap_peap_t *this)
+{
+	if (!this->auth)
+	{
+		auth_cfg_t *inner;
+
+		this->auth = auth_cfg_create();
+		this->auth->merge(this->auth,
+						  this->tls_eap->get_auth(this->tls_eap), FALSE);
+		if (this->is_server)
+		{
+			inner = this->impl.server->get_auth(this->impl.server);
+		}
+		else
+		{
+			inner = this->impl.client->get_auth(this->impl.client);
+		}
+		this->auth->merge(this->auth, inner, FALSE);
+	}
+	return this->auth;
+}
+
+ METHOD(eap_method_t, destroy, void,
+ 	private_eap_peap_t *this)
+ {
+ 	this->tls_eap->destroy(this->tls_eap);
+	DESTROY_IF(this->auth);
+ 	free(this);
+ }
+ 
+@@ -135,6 +178,7 @@ static private_eap_peap_t *eap_peap_create_empty(void)
+ 				.get_type = _get_type,
+ 				.is_mutual = _is_mutual,
+ 				.get_msk = _get_msk,
+				.get_auth = _get_auth,
+ 				.get_identifier = _get_identifier,
+ 				.set_identifier = _set_identifier,
+ 				.destroy = _destroy,
+@@ -147,7 +191,7 @@ static private_eap_peap_t *eap_peap_create_empty(void)
+ /**
+  * Generic private constructor
+  */
+-static eap_peap_t *eap_peap_create(private_eap_peap_t * this,
+static eap_peap_t *eap_peap_create(private_eap_peap_t *this,
+ 								   identification_t *server,
+ 								   identification_t *peer, bool is_server,
+ 								   tls_application_t *application)
+@@ -157,6 +201,9 @@ static eap_peap_t *eap_peap_create(private_eap_peap_t * this,
+ 	bool include_length;
+ 	tls_t *tls;
+ 
+	this->is_server = is_server;
+	this->impl.application = application;
+
+ 	if (is_server && !lib->settings->get_bool(lib->settings,
+ 								"%s.plugins.eap-peap.request_peer_auth", FALSE,
+ 								lib->ns))
+diff --git a/src/libcharon/plugins/eap_peap/eap_peap_peer.c b/src/libcharon/plugins/eap_peap/eap_peap_peer.c
+index 95213a3..f6c087a 100644
+--- a/src/libcharon/plugins/eap_peap/eap_peap_peer.c
+++ b/src/libcharon/plugins/eap_peap/eap_peap_peer.c
+@@ -52,6 +52,11 @@ struct private_eap_peap_peer_t {
+ 	 */
+ 	eap_method_t *ph2_method;
+ 
+	/**
+	 * Auth data for phase 2 methods
+	 */
+	auth_cfg_t *auth;
+
+ 	/**
+      * Pending outbound EAP message
+ 	 */
+@@ -166,6 +171,12 @@ METHOD(tls_application_t, process, status_t,
+ 	switch (status)
+ 	{
+ 		case SUCCESS:
+			if (this->ph2_method->get_auth)
+			{
+				this->auth->merge(this->auth,
+								  this->ph2_method->get_auth(this->ph2_method),
+								  FALSE);
+			}
+ 			this->ph2_method->destroy(this->ph2_method);
+ 			this->ph2_method = NULL;
+ 			/* fall through to NEED_MORE */
+@@ -220,11 +231,18 @@ METHOD(tls_application_t, build, status_t,
+ 	return INVALID_STATE;
+ }
+ 
+METHOD(eap_peap_peer_t, get_auth, auth_cfg_t*,
+	private_eap_peap_peer_t *this)
+{
+	return this->auth;
+}
+
+ METHOD(tls_application_t, destroy, void,
+ 	private_eap_peap_peer_t *this)
+ {
+ 	this->server->destroy(this->server);
+ 	this->peer->destroy(this->peer);
+	this->auth->destroy(this->auth);
+ 	DESTROY_IF(this->ph2_method);
+ 	DESTROY_IF(this->out);
+ 	this->avp->destroy(this->avp);
+@@ -247,10 +265,12 @@ eap_peap_peer_t *eap_peap_peer_create(identification_t *server,
+ 				.build = _build,
+ 				.destroy = _destroy,
+ 			},
+			.get_auth = _get_auth,
+ 		},
+ 		.server = server->clone(server),
+ 		.peer = peer->clone(peer),
+ 		.ph1_method = eap_method,
+		.auth = auth_cfg_create(),
+ 		.avp = eap_peap_avp_create(FALSE),
+ 	);
+ 
+diff --git a/src/libcharon/plugins/eap_peap/eap_peap_peer.h b/src/libcharon/plugins/eap_peap/eap_peap_peer.h
+index 53c25cd..7d16957 100644
+--- a/src/libcharon/plugins/eap_peap/eap_peap_peer.h
+++ b/src/libcharon/plugins/eap_peap/eap_peap_peer.h
+@@ -38,6 +38,13 @@ struct eap_peap_peer_t {
+ 	 * Implements the TLS application data handler.
+ 	 */
+ 	tls_application_t application;
+
+	/**
+	 * Get authentication details of this EAP method and its inner method(s).
+	 *
+	 * @return				auth method, internal data
+	 */
+	auth_cfg_t *(*get_auth)(eap_peap_peer_t *this);
+ };
+ 
+ /**
+diff --git a/src/libcharon/plugins/eap_peap/eap_peap_server.c b/src/libcharon/plugins/eap_peap/eap_peap_server.c
+index 29ab9b4..388c3c6 100644
+--- a/src/libcharon/plugins/eap_peap/eap_peap_server.c
+++ b/src/libcharon/plugins/eap_peap/eap_peap_server.c
+@@ -20,6 +20,8 @@
+ #include <utils/debug.h>
+ #include <daemon.h>
+ 
+#include <sa/eap/eap_inner_method.h>
+
+ typedef struct private_eap_peap_server_t private_eap_peap_server_t;
+ 
+ /**
+@@ -77,6 +79,16 @@ struct private_eap_peap_server_t {
+ 	 */
+ 	eap_method_t *ph2_method;
+ 
+	/**
+	 * Type of the completed phase 2 EAP method
+	 */
+	eap_type_t phase2_type;
+
+	/**
+	 * Auth data for phase 2 method
+	 */
+	auth_cfg_t *auth;
+
+ 	/**
+      * Pending outbound EAP message
+ 	 */
+@@ -132,8 +144,11 @@ static status_t start_phase2_auth(private_eap_peap_server_t *this)
+ /**
+  * If configured, start EAP-TNC protocol
+  */
+-static status_t start_phase2_tnc(private_eap_peap_server_t *this)
+static status_t start_phase2_tnc(private_eap_peap_server_t *this,
+								 eap_type_t auth_type)
+ {
+	eap_inner_method_t *inner_method;
+
+ 	if (this->start_phase2_tnc && lib->settings->get_bool(lib->settings,
+ 						"%s.plugins.eap-peap.phase2_tnc", FALSE, lib->ns))
+ 	{
+@@ -145,6 +160,8 @@ static status_t start_phase2_tnc(private_eap_peap_server_t *this)
+ 			DBG1(DBG_IKE, "%N method not available", eap_type_names, EAP_TNC);
+ 			return FAILED;
+ 		}
+		inner_method = (eap_inner_method_t *)this->ph2_method;
+		inner_method->set_auth_type(inner_method, auth_type);
+ 		this->start_phase2_tnc = FALSE;
+ 
+ 		/* synchronize EAP message identifiers of inner protocol with outer */
+@@ -218,9 +235,13 @@ METHOD(tls_application_t, process, status_t,
+ 		DBG1(DBG_IKE, "received tunneled EAP-PEAP AVP [EAP/%N]",
+ 								eap_code_short_names, code);
+ 		in->destroy(in);
+-		/* if EAP_SUCCESS check if to continue phase2 with EAP-TNC */
+-		return (this->phase2_result == EAP_SUCCESS && code == EAP_SUCCESS) ?
+-			   start_phase2_tnc(this) : FAILED;
+		if (this->phase2_result == EAP_SUCCESS && code == EAP_SUCCESS)
+		{
+			/* only accept SUCCESS once after a successful inner method */
+			this->phase2_result = EAP_FAILURE;
+			return start_phase2_tnc(this, this->phase2_type);
+		}
+		return FAILED;
+ 	}
+ 
+ 	if (this->ph2_method)
+@@ -245,6 +266,10 @@ METHOD(tls_application_t, process, status_t,
+ 	if (!received_vendor && received_type == EAP_IDENTITY)
+ 	{
+ 		chunk_t eap_id;
+		bool peer_auth;
+
+		peer_auth = lib->settings->get_bool(lib->settings,
+					"%s.plugins.eap-peap.request_peer_auth", FALSE, lib->ns);
+ 
+ 		if (this->ph2_method == NULL)
+ 		{
+@@ -271,9 +296,22 @@ METHOD(tls_application_t, process, status_t,
+ 
+ 		if (this->ph2_method->get_msk(this->ph2_method, &eap_id) == SUCCESS)
+ 		{
+-			this->peer->destroy(this->peer);
+-			this->peer = identification_create_from_data(eap_id);
+-			DBG1(DBG_IKE, "received EAP identity '%Y'", this->peer);
+			identification_t *id;
+
+			id = identification_create_from_data(eap_id);
+			if (peer_auth && !id->equals(id, this->peer))
+			{
+				DBG1(DBG_IKE, "received tunneled EAP identity '%Y', keeping "
+					 "certificate-authenticated identity '%Y'", id, this->peer);
+				id->destroy(id);
+			}
+			else
+			{
+				DBG1(DBG_IKE, "received EAP identity '%Y'", id);
+				this->auth->add(this->auth, AUTH_RULE_EAP_IDENTITY, id);
+				this->peer->destroy(this->peer);
+				this->peer = id->clone(id);
+			}
+ 		}
+ 
+ 		in->destroy(in);
+@@ -281,10 +319,9 @@ METHOD(tls_application_t, process, status_t,
+ 		this->ph2_method = NULL;
+ 
+ 		/* Start Phase 2 of EAP-PEAP authentication */
+-		if (lib->settings->get_bool(lib->settings,
+-					"%s.plugins.eap-peap.request_peer_auth", FALSE, lib->ns))
+		if (peer_auth)
+ 		{
+-			return start_phase2_tnc(this);
+			return start_phase2_tnc(this, EAP_TLS);
+ 		}
+ 		else
+ 		{
+@@ -305,11 +342,26 @@ METHOD(tls_application_t, process, status_t,
+ 	switch (status)
+ 	{
+ 		case SUCCESS:
+			if (this->ph2_method->get_auth)
+			{
+				identification_t *id;
+				auth_cfg_t *auth;
+
+				auth = this->ph2_method->get_auth(this->ph2_method);
+				id = auth->get(auth, AUTH_RULE_EAP_IDENTITY);
+				if (id)
+				{
+					this->peer->destroy(this->peer);
+					this->peer = id->clone(id);
+				}
+				this->auth->merge(this->auth, auth, FALSE);
+			}
+ 			DBG1(DBG_IKE, "%N phase2 authentication of '%Y' with %N successful",
+ 							eap_type_names, EAP_PEAP, this->peer,
+ 							eap_type_names, type);
+ 			this->ph2_method->destroy(this->ph2_method);
+ 			this->ph2_method = NULL;
+			this->phase2_type = type;
+ 
+ 			/* EAP-PEAP requires the sending of an inner EAP_SUCCESS message */
+ 			this->phase2_result = EAP_SUCCESS;
+@@ -407,11 +459,18 @@ METHOD(eap_peap_server_t, set_tls, void,
+ 	this->tls = tls;
+ }
+ 
+METHOD(eap_peap_server_t, get_auth, auth_cfg_t*,
+	private_eap_peap_server_t *this)
+{
+	return this->auth;
+}
+
+ METHOD(tls_application_t, destroy, void,
+ 	private_eap_peap_server_t *this)
+ {
+ 	this->server->destroy(this->server);
+ 	this->peer->destroy(this->peer);
+	this->auth->destroy(this->auth);
+ 	DESTROY_IF(this->ph2_method);
+ 	DESTROY_IF(this->out);
+ 	this->avp->destroy(this->avp);
+@@ -435,10 +494,12 @@ eap_peap_server_t *eap_peap_server_create(identification_t *server,
+ 				.destroy = _destroy,
+ 			},
+ 			.set_tls = _set_tls,
+			.get_auth = _get_auth,
+ 		},
+ 		.server = server->clone(server),
+ 		.peer = peer->clone(peer),
+ 		.ph1_method = eap_method,
+		.auth = auth_cfg_create(),
+ 		.start_phase2 = TRUE,
+ 		.start_phase2_tnc = TRUE,
+ 		.start_phase2_id = lib->settings->get_bool(lib->settings,
+diff --git a/src/libcharon/plugins/eap_peap/eap_peap_server.h b/src/libcharon/plugins/eap_peap/eap_peap_server.h
+index 3abe88b..8080e9f 100644
+--- a/src/libcharon/plugins/eap_peap/eap_peap_server.h
+++ b/src/libcharon/plugins/eap_peap/eap_peap_server.h
+@@ -47,6 +47,13 @@ struct eap_peap_server_t {
+ 	 * @param tls		TLS connection
+ 	 */
+ 	void (*set_tls)(eap_peap_server_t *this, tls_t *tls);
+
+	/**
+	 * Get authentication details of this EAP method and its inner method(s).
+	 *
+	 * @return				auth method, internal data
+	 */
+	auth_cfg_t *(*get_auth)(eap_peap_server_t *this);
+ };
+ 
+ /**
+diff --git a/src/libcharon/plugins/eap_ttls/eap_ttls.c b/src/libcharon/plugins/eap_ttls/eap_ttls.c
+index d8ad781..3df78bb 100644
+--- a/src/libcharon/plugins/eap_ttls/eap_ttls.c
+++ b/src/libcharon/plugins/eap_ttls/eap_ttls.c
+@@ -40,6 +40,25 @@ struct private_eap_ttls_t {
+ 	 * TLS stack, wrapped by EAP helper
+ 	 */
+ 	tls_eap_t *tls_eap;
+
+	/**
+	 * Role
+	 */
+	bool is_server;
+
+	/**
+	 * Actual server/client implementation
+	 */
+	union {
+		tls_application_t *application;
+		eap_ttls_server_t *server;
+		eap_ttls_peer_t *client;
+	} impl;
+
+	/**
+	 * Cached auth data for TLS and inner EAP methods
+	 */
+	auth_cfg_t *auth;
+ };
+ 
+ /** Maximum number of EAP-TTLS messages/fragments allowed */
+@@ -116,13 +135,31 @@ METHOD(eap_method_t, is_mutual, bool,
+ METHOD(eap_method_t, get_auth, auth_cfg_t*,
+ 	private_eap_ttls_t *this)
+ {
+-	return this->tls_eap->get_auth(this->tls_eap);
+	if (!this->auth)
+	{
+		auth_cfg_t *inner;
+
+		this->auth = auth_cfg_create();
+		this->auth->merge(this->auth,
+						  this->tls_eap->get_auth(this->tls_eap), FALSE);
+		if (this->is_server)
+		{
+			inner = this->impl.server->get_auth(this->impl.server);
+		}
+		else
+		{
+			inner = this->impl.client->get_auth(this->impl.client);
+		}
+		this->auth->merge(this->auth, inner, FALSE);
+	}
+	return this->auth;
+ }
+ 
+ METHOD(eap_method_t, destroy, void,
+ 	private_eap_ttls_t *this)
+ {
+ 	this->tls_eap->destroy(this->tls_eap);
+	DESTROY_IF(this->auth);
+ 	free(this);
+ }
+ 
+@@ -153,6 +190,10 @@ static eap_ttls_t *eap_ttls_create(identification_t *server,
+ 				.destroy = _destroy,
+ 			},
+ 		},
+		.is_server = is_server,
+		.impl = {
+			.application = application,
+		},
+ 	);
+ 	if (is_server && !lib->settings->get_bool(lib->settings,
+ 								"%s.plugins.eap-ttls.request_peer_auth", FALSE,
+diff --git a/src/libcharon/plugins/eap_ttls/eap_ttls_peer.c b/src/libcharon/plugins/eap_ttls/eap_ttls_peer.c
+index 63126a5..f8229f5 100644
+--- a/src/libcharon/plugins/eap_ttls/eap_ttls_peer.c
+++ b/src/libcharon/plugins/eap_ttls/eap_ttls_peer.c
+@@ -54,6 +54,11 @@ struct private_eap_ttls_peer_t {
+ 	 */
+ 	eap_method_t *method;
+ 
+	/**
+	 * Auth data for phase 2 method
+	 */
+	auth_cfg_t *auth;
+
+ 	/**
+      * Pending outbound EAP message
+ 	 */
+@@ -215,6 +220,11 @@ METHOD(tls_application_t, process, status_t,
+ 	switch (status)
+ 	{
+ 		case SUCCESS:
+			if (this->method->get_auth)
+			{
+				this->auth->merge(this->auth,
+								  this->method->get_auth(this->method), FALSE);
+			}
+ 			this->method->destroy(this->method);
+ 			this->method = NULL;
+ 			/* fall through to NEED_MORE */
+@@ -275,11 +285,18 @@ METHOD(tls_application_t, build, status_t,
+ 	return INVALID_STATE;
+ }
+ 
+METHOD(eap_ttls_peer_t, get_auth, auth_cfg_t*,
+	private_eap_ttls_peer_t *this)
+{
+	return this->auth;
+}
+
+ METHOD(tls_application_t, destroy, void,
+ 	private_eap_ttls_peer_t *this)
+ {
+ 	this->server->destroy(this->server);
+ 	this->peer->destroy(this->peer);
+	this->auth->destroy(this->auth);
+ 	DESTROY_IF(this->method);
+ 	DESTROY_IF(this->out);
+ 	this->avp->destroy(this->avp);
+@@ -301,10 +318,12 @@ eap_ttls_peer_t *eap_ttls_peer_create(identification_t *server,
+ 				.build = _build,
+ 				.destroy = _destroy,
+ 			},
+			.get_auth = _get_auth,
+ 		},
+ 		.server = server->clone(server),
+ 		.peer = peer->clone(peer),
+ 		.start_phase2 = TRUE,
+		.auth = auth_cfg_create(),
+ 		.avp = eap_ttls_avp_create(),
+ 	);
+ 
+diff --git a/src/libcharon/plugins/eap_ttls/eap_ttls_peer.h b/src/libcharon/plugins/eap_ttls/eap_ttls_peer.h
+index 0c3d90a..69a8435 100644
+--- a/src/libcharon/plugins/eap_ttls/eap_ttls_peer.h
+++ b/src/libcharon/plugins/eap_ttls/eap_ttls_peer.h
+@@ -37,6 +37,13 @@ struct eap_ttls_peer_t {
+ 	 * Implements the TLS application data handler.
+ 	 */
+ 	tls_application_t application;
+
+	/**
+	 * Get authentication details of this EAP method and its inner method(s).
+	 *
+	 * @return				auth method, internal data
+	 */
+	auth_cfg_t *(*get_auth)(eap_ttls_peer_t *this);
+ };
+ 
+ /**
+diff --git a/src/libcharon/plugins/eap_ttls/eap_ttls_server.c b/src/libcharon/plugins/eap_ttls/eap_ttls_server.c
+index fc97f81..e1de1bf 100644
+--- a/src/libcharon/plugins/eap_ttls/eap_ttls_server.c
+++ b/src/libcharon/plugins/eap_ttls/eap_ttls_server.c
+@@ -60,6 +60,11 @@ struct private_eap_ttls_server_t {
+ 	 */
+ 	eap_method_t *method;
+ 
+	/**
+	 * Auth data for phase 2 method
+	 */
+	auth_cfg_t *auth;
+
+ 	/**
+      * Pending outbound EAP message
+ 	 */
+@@ -220,6 +225,10 @@ METHOD(tls_application_t, process, status_t,
+ 	if (!received_vendor && received_type == EAP_IDENTITY)
+ 	{
+ 		chunk_t eap_id;
+		bool peer_auth;
+
+		peer_auth = lib->settings->get_bool(lib->settings,
+					"%s.plugins.eap-ttls.request_peer_auth", FALSE, lib->ns);
+ 
+ 		if (this->method == NULL)
+ 		{
+@@ -244,9 +253,22 @@ METHOD(tls_application_t, process, status_t,
+ 
+ 		if (this->method->get_msk(this->method, &eap_id) == SUCCESS)
+ 		{
+-			this->peer->destroy(this->peer);
+-			this->peer = identification_create_from_data(eap_id);
+-			DBG1(DBG_IKE, "received EAP identity '%Y'", this->peer);
+			identification_t *id;
+
+			id = identification_create_from_data(eap_id);
+			if (peer_auth && !id->equals(id, this->peer))
+			{
+				DBG1(DBG_IKE, "received tunneled EAP identity '%Y', keeping "
+					 "certificate-authenticated identity '%Y'", id, this->peer);
+				id->destroy(id);
+			}
+			else
+			{
+				DBG1(DBG_IKE, "received EAP identity '%Y'", id);
+				this->auth->add(this->auth, AUTH_RULE_EAP_IDENTITY, id);
+				this->peer->destroy(this->peer);
+				this->peer = id->clone(id);
+			}
+ 		}
+ 
+ 		in->destroy(in);
+@@ -254,8 +276,7 @@ METHOD(tls_application_t, process, status_t,
+ 		this->method = NULL;
+ 
+ 		/* Start Phase 2 of EAP-TTLS authentication */
+-		if (lib->settings->get_bool(lib->settings,
+-					"%s.plugins.eap-ttls.request_peer_auth", FALSE, lib->ns))
+		if (peer_auth)
+ 		{
+ 			return start_phase2_tnc(this, EAP_TLS);
+ 		}
+@@ -278,6 +299,20 @@ METHOD(tls_application_t, process, status_t,
+ 	switch (status)
+ 	{
+ 		case SUCCESS:
+			if (this->method->get_auth)
+			{
+				identification_t *id;
+				auth_cfg_t *auth;
+
+				auth = this->method->get_auth(this->method);
+				id = auth->get(auth, AUTH_RULE_EAP_IDENTITY);
+				if (id)
+				{
+					this->peer->destroy(this->peer);
+					this->peer = id->clone(id);
+				}
+				this->auth->merge(this->auth, auth, FALSE);
+			}
+ 			DBG1(DBG_IKE, "%N phase2 authentication of '%Y' with %N successful",
+ 							eap_type_names, EAP_TTLS, this->peer,
+ 							eap_type_names, type);
+@@ -348,11 +383,18 @@ METHOD(tls_application_t, build, status_t,
+ 	return INVALID_STATE;
+ }
+ 
+METHOD(eap_ttls_server_t, get_auth, auth_cfg_t*,
+	private_eap_ttls_server_t *this)
+{
+	return this->auth;
+}
+
+ METHOD(tls_application_t, destroy, void,
+ 	private_eap_ttls_server_t *this)
+ {
+ 	this->server->destroy(this->server);
+ 	this->peer->destroy(this->peer);
+	this->auth->destroy(this->auth);
+ 	DESTROY_IF(this->method);
+ 	DESTROY_IF(this->out);
+ 	this->avp->destroy(this->avp);
+@@ -374,11 +416,13 @@ eap_ttls_server_t *eap_ttls_server_create(identification_t *server,
+ 				.build = _build,
+ 				.destroy = _destroy,
+ 			},
+			.get_auth = _get_auth,
+ 		},
+ 		.server = server->clone(server),
+-		.peer = peer->clone(peer),
+		.auth = auth_cfg_create(),
+ 		.start_phase2 = TRUE,
+ 		.start_phase2_tnc = TRUE,
+		.peer = peer->clone(peer),
+ 		.avp = eap_ttls_avp_create(),
+ 	);
+ 
+diff --git a/src/libcharon/plugins/eap_ttls/eap_ttls_server.h b/src/libcharon/plugins/eap_ttls/eap_ttls_server.h
+index 1e13f55..3348706 100644
+--- a/src/libcharon/plugins/eap_ttls/eap_ttls_server.h
+++ b/src/libcharon/plugins/eap_ttls/eap_ttls_server.h
+@@ -37,6 +37,13 @@ struct eap_ttls_server_t {
+ 	 * Implements the TLS application data handler.
+ 	 */
+ 	tls_application_t application;
+
+	/**
+	 * Get authentication details of this EAP method and its inner method(s).
+	 *
+	 * @return				auth method, internal data
+	 */
+	auth_cfg_t *(*get_auth)(eap_ttls_server_t *this);
+ };
+ 
+ /**
@@ -20,6 +20,7 @@ SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \
           file://CVE-2026-78130.patch \
           file://CVE-2026-78132.patch \
           file://CVE-2026-78135.patch \
+           file://CVE-2026-78134.patch \
 "

 SRC_URI[sha256sum] = "07df7cedae56a7f3bb07e66d21a1f9f87e961db70e99184e11d3819413e4f87c"