From 0d9086bcac54f171d4b3aa35bafd7ece78747866 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 23 Mar 2026 19:25:28 +0000
Subject: [PATCH 1/2] strongswan: 6.0.4 -> 6.0.5

---
 pkgs/by-name/st/strongswan/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/st/strongswan/package.nix b/pkgs/by-name/st/strongswan/package.nix
index f1fdf9fd0212..93c13de36207 100644
--- a/pkgs/by-name/st/strongswan/package.nix
+++ b/pkgs/by-name/st/strongswan/package.nix
@@ -122,13 +122,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "strongswan";
-  version = "6.0.4"; # Make sure to also update <nixpkgs/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix> when upgrading!
+  version = "6.0.5"; # Make sure to also update <nixpkgs/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix> when upgrading!
 
   src = fetchFromGitHub {
     owner = "strongswan";
     repo = "strongswan";
     tag = finalAttrs.version;
-    hash = "sha256-KRfEH7puwn+PgQvOrkTEowPnGzCtXdsUqg7wBNMypkQ=";
+    hash = "sha256-AB0PNy5UIPb5Pwois9APhyQxDPd55mnwYdhpkKpV+uM=";
   };
 
   patches = [
@@ -192,7 +192,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "OpenSource IPsec-based VPN solution";
     homepage = "https://www.strongswan.org/";
-    changelog = "https://github.com/strongswan/strongswan/blob/${finalAttrs.src.rev}/ChangeLog";
+    changelog = "https://github.com/strongswan/strongswan/blob/${finalAttrs.src.rev}/NEWS";
     license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [ nickcao ];
     mainProgram = "swanctl";

From 3dc24cae1ea6cc57edabdfb3860c69b6bff4be06 Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Mon, 23 Mar 2026 17:01:47 -0400
Subject: [PATCH 2/2] nixos/strongswan-swanctl: update options for strongswan
 6.0.5

---
 .../strongswan-swanctl/swanctl-params.nix           | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix b/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix
index f17d36341e1d..4ceac71e94d6 100644
--- a/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix
+++ b/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix
@@ -1093,6 +1093,19 @@ in
                 all kernel interfaces.
               '';
 
+              icmp = mkYesNoParam no ''
+                Whether to forward certain ICMP error messages even if their source IP
+                doesn't match the negotiated IPsec policies.
+
+                ICMP error messages, such as Destination Unreachable, Time Exceeded or
+                Fragmentation Needed, may be generated by a host whose IP address isn't
+                included in the negotiated traffic selectors and therefore doesn't match the
+                IPsec policies. If this option is enabled and the kernel supports it, such
+                packets may still be forwarded. As ICMP errors contain parts of the IP
+                packet that triggered them, the kernel will base its decision on a reverse
+                policy lookup using that IP header.
+              '';
+
               start_action = mkEnumParam [ "none" "trap" "start" "trap|start" ] "none" ''
                 Action to perform after loading the configuration.