diff --git a/0001-libreswan-anolis-rebrand-to-anolis.patch b/0001-libreswan-anolis-rebrand-to-anolis.patch deleted file mode 100644 index 77f073f1cc53b6082aff3adebb8eed5ef236f7d0..0000000000000000000000000000000000000000 --- a/0001-libreswan-anolis-rebrand-to-anolis.patch +++ /dev/null @@ -1,87 +0,0 @@ -From c0ae1f9070d386036a793d3e8eac7a787e7017a0 Mon Sep 17 00:00:00 2001 -From: "yangxiaoxuan@openanolis.org" -Date: Mon, 21 Jun 2021 22:48:03 +0800 -Subject: [PATCH] libreswan anolis rebrand to anolis - ---- - Makefile | 2 +- - mk/defaults/linux.mk | 2 +- - programs/barf/barf.in | 2 +- - testing/guestbin/swan-transmogrify | 8 +++++--- - 4 files changed, 8 insertions(+), 6 deletions(-) - -diff --git a/Makefile b/Makefile -index db230d4..bafddc2 100644 ---- a/Makefile -+++ b/Makefile -@@ -27,7 +27,7 @@ include ${LIBRESWANSRCDIR}/Makefile.inc - MAIN_RPM_VERSION = $(shell make showversion | sed "s/-.*//") - MAIN_RPM_PREVER = $(shell make showversion | sed -e "s/^.[^-]*-\([^-]*\)-\(.*\)/rc\1_\2/" -e "s/-/_/g") - MAIN_RPM_PREFIX = libreswan-$(MAIN_RPM_VERSION)$(MAIN_RPM_PREVER) --MAIN_RPM_RHEL_PKG = $(shell rpm -qf /etc/redhat-release) -+MAIN_RPM_RHEL_PKG = $(shell rpm -qf /etc/anolis-release) - MAIN_RPM_RHEL_VERSION = $(shell echo $(MAIN_RPM_RHEL_PKG) | sed "s/.*-release-\(.\).*/\1/") - MAIN_RPM_SPECFILE = $(shell if [ -f /etc/fedora-release ]; then echo packaging/fedora/libreswan.spec; elif [ -n "$(MAIN_RPM_RHEL_VERSION)" ]; then echo packaging/rhel/$(MAIN_RPM_RHEL_VERSION)/libreswan.spec; else echo "unknown distro, cannot find spec file to use in packaging directory"; fi) - RHEL_LIKE= $(shell cat /etc/os-release | grep ID_LIKE | sed -e "s/ID_LIKE=//" -e 's/"//g' -e "s/ .*//") -diff --git a/mk/defaults/linux.mk b/mk/defaults/linux.mk -index c286a7d..56a3e20 100644 ---- a/mk/defaults/linux.mk -+++ b/mk/defaults/linux.mk -@@ -131,7 +131,7 @@ ifndef INITSYSTEM - INITSYSTEM=systemd - else ifneq ($(and $(wildcard /lib/systemd/systemd),$(wildcard /var/run/systemd)),) - INITSYSTEM=systemd -- else ifneq ($(and $(wildcard /sbin/start),$(wildcard /etc/redhat-release)),) -+ else ifneq ($(and $(wildcard /sbin/start),$(wildcard /etc/anolis-release)),) - # override for rhel/centos to use sysvinit - INITSYSTEM=sysvinit - else ifneq ($(wildcard /sbin/start),) -diff --git a/programs/barf/barf.in b/programs/barf/barf.in -index e76c62f..7a7a61a 100755 ---- a/programs/barf/barf.in -+++ b/programs/barf/barf.in -@@ -248,7 +248,7 @@ if [ -r /proc/config_built_with ]; then - cat /proc/config_built_with - fi - _________________________ distro-release --for distro in /etc/redhat-release /etc/debian-release /etc/SuSE-release /etc/mandrake-release /etc/mandriva-release /etc/gentoo-release -+for distro in /etc/redhat-release /etc/anolis-release /etc/debian-release /etc/SuSE-release /etc/mandrake-release /etc/mandriva-release /etc/gentoo-release - do - if [ -f ${distro} ]; then - cat ${distro} -diff --git a/testing/guestbin/swan-transmogrify b/testing/guestbin/swan-transmogrify -index 0afa1f1..4dc7539 100755 ---- a/testing/guestbin/swan-transmogrify -+++ b/testing/guestbin/swan-transmogrify -@@ -34,7 +34,9 @@ macs['sunset'] = "12:00:00:ab:cd:01" - # conflicts with north - #macs['japan'] = "12:00:00:ab:cd:02" - --if os.path.isfile("/etc/redhat-release"): -+if os.path.isfile("/etc/anolis-release"): -+ GUESTOS = "anolis" -+elif os.path.isfile("/etc/redhat-release"): - GUESTOS = "redhat" - elif os.path.isfile("/etc/debian_version"): - GUESTOS = "debian" -@@ -136,7 +138,7 @@ else: - if os.path.isfile(hostname_file): - shutil.copyfile(hostname_file, "/etc/hostname") - --if GUESTOS == "redhat": -+if GUESTOS == "anolis": - - # these files are needed for systemd-networkd too - fnames = glob.glob("/testing/baseconfigs/all/etc/sysconfig/*") -@@ -216,7 +218,7 @@ for dbfile in glob.glob("/etc/ipsec.d/*.db"): - os.chmod(dbfile, 0o600) - - # SElinux fixup --if GUESTOS == "redhat": -+if GUESTOS == "anolis": - output += "\n" + subprocess.getoutput("restorecon -R /etc/") - - # selinux does not like our /testing include files --- -2.18.4 - diff --git a/dist b/dist new file mode 100644 index 0000000000000000000000000000000000000000..f0303ad6bc67047392cc47112b4135cc82a0e690 --- /dev/null +++ b/dist @@ -0,0 +1 @@ +an9_2 diff --git a/download b/download new file mode 100644 index 0000000000000000000000000000000000000000..66226917ea182f5327e5f29969c586f834709c82 --- /dev/null +++ b/download @@ -0,0 +1 @@ +584ee91ace5208db1a517b4c8e7a3971 libreswan-4.9.tar.gz diff --git a/libreswan-3.32-1861360-nodefault-rsa-pss.patch b/libreswan-3.32-1861360-nodefault-rsa-pss.patch deleted file mode 100644 index e9d50e06f60799d6a8fa298c079aea3c26d629b2..0000000000000000000000000000000000000000 --- a/libreswan-3.32-1861360-nodefault-rsa-pss.patch +++ /dev/null @@ -1,18 +0,0 @@ -diff -Naur libreswan-3.32-orig/lib/libipsecconf/confread.c libreswan-3.32/lib/libipsecconf/confread.c ---- libreswan-3.32-orig/lib/libipsecconf/confread.c 2020-07-28 20:25:54.618261606 -0400 -+++ libreswan-3.32/lib/libipsecconf/confread.c 2020-07-28 20:28:03.952421236 -0400 -@@ -1498,9 +1498,14 @@ - } else if (streq(val, "rsasig") || streq(val, "rsa")) { - conn->policy |= POLICY_RSASIG; - conn->policy |= POLICY_RSASIG_v1_5; -+ /* -+ * These cause failure with RSA 1024 bits because it uses RSA-PSS -+ */ -+#if 0 - conn->sighash_policy |= POL_SIGHASH_SHA2_256; - conn->sighash_policy |= POL_SIGHASH_SHA2_384; - conn->sighash_policy |= POL_SIGHASH_SHA2_512; -+#endif - } else if (streq(val, "never")) { - conn->policy |= POLICY_AUTH_NEVER; - /* everything else is only supported for IKEv2 */ diff --git a/libreswan-4.1-maintain-obsolete-keywords.patch b/libreswan-4.1-maintain-obsolete-keywords.patch deleted file mode 100644 index 539dcd1c3e23331cd9bf5acb93c466dfa49310c5..0000000000000000000000000000000000000000 --- a/libreswan-4.1-maintain-obsolete-keywords.patch +++ /dev/null @@ -1,123 +0,0 @@ -diff -Naur libreswan-4.2-orig/lib/libipsecconf/keywords.c libreswan-4.2/lib/libipsecconf/keywords.c ---- libreswan-4.2-orig/lib/libipsecconf/keywords.c 2021-02-02 20:36:01.000000000 -0500 -+++ libreswan-4.2/lib/libipsecconf/keywords.c 2021-02-04 19:22:05.880228930 -0500 -@@ -374,6 +374,8 @@ - { "interfaces", kv_config, kt_string, KSF_INTERFACES, NULL, NULL, }, - { "curl-iface", kv_config, kt_string, KSF_CURLIFACE, NULL, NULL, }, - { "curl-timeout", kv_config, kt_time, KBF_CURLTIMEOUT, NULL, NULL, }, -+ { "curl_iface", kv_config | kv_alias, kt_string, KSF_CURLIFACE, NULL, NULL, }, /* obsolete _ */ -+ { "curl_timeout", kv_config | kv_alias, kt_time, KBF_CURLTIMEOUT, NULL, NULL, }, /* obsolete _ */ - - { "myvendorid", kv_config, kt_string, KSF_MYVENDORID, NULL, NULL, }, - { "syslog", kv_config, kt_string, KSF_SYSLOG, NULL, NULL, }, -@@ -381,6 +383,7 @@ - { "logfile", kv_config, kt_filename, KSF_LOGFILE, NULL, NULL, }, - { "plutostderrlog", kv_config, kt_filename, KSF_LOGFILE, NULL, NULL, }, /* obsolete name, but very common :/ */ - { "logtime", kv_config, kt_bool, KBF_LOGTIME, NULL, NULL, }, -+ { "plutostderrlogtime", kv_config | kv_alias, kt_bool, KBF_LOGTIME, NULL, NULL, }, /* obsolete */ - { "logappend", kv_config, kt_bool, KBF_LOGAPPEND, NULL, NULL, }, - { "logip", kv_config, kt_bool, KBF_LOGIP, NULL, NULL, }, - { "audit-log", kv_config, kt_bool, KBF_AUDIT_LOG, NULL, NULL, }, -@@ -400,13 +403,20 @@ - { "global-redirect-to", kv_config, kt_string, KSF_GLOBAL_REDIRECT_TO, NULL, NULL, }, - - { "crl-strict", kv_config, kt_bool, KBF_CRL_STRICT, NULL, NULL, }, -+ { "crl_strict", kv_config | kv_alias, kt_bool, KBF_CRL_STRICT, NULL, NULL, }, /* obsolete _ */ - { "crlcheckinterval", kv_config, kt_time, KBF_CRL_CHECKINTERVAL, NULL, NULL, }, -+ { "strictcrlpolicy", kv_config | kv_alias, kt_bool, KBF_CRL_STRICT, NULL, NULL, }, /* obsolete; used on openswan */ - - { "ocsp-strict", kv_config, kt_bool, KBF_OCSP_STRICT, NULL, NULL, }, -+ { "ocsp_strict", kv_config | kv_alias, kt_bool, KBF_OCSP_STRICT, NULL, NULL, }, /* obsolete _ */ - { "ocsp-enable", kv_config, kt_bool, KBF_OCSP_ENABLE, NULL, NULL, }, -+ { "ocsp_enable", kv_config | kv_alias, kt_bool, KBF_OCSP_ENABLE, NULL, NULL, }, /* obsolete _ */ - { "ocsp-uri", kv_config, kt_string, KSF_OCSP_URI, NULL, NULL, }, -+ { "ocsp_uri", kv_config | kv_alias, kt_string, KSF_OCSP_URI, NULL, NULL, }, /* obsolete _ */ - { "ocsp-timeout", kv_config, kt_number, KBF_OCSP_TIMEOUT, NULL, NULL, }, -+ { "ocsp_timeout", kv_config | kv_alias, kt_number, KBF_OCSP_TIMEOUT, NULL, NULL, }, /* obsolete _ */ - { "ocsp-trustname", kv_config, kt_string, KSF_OCSP_TRUSTNAME, NULL, NULL, }, -+ { "ocsp_trust_name", kv_config | kv_alias, kt_string, KSF_OCSP_TRUSTNAME, NULL, NULL, }, /* obsolete _ */ - { "ocsp-cache-size", kv_config, kt_number, KBF_OCSP_CACHE_SIZE, NULL, NULL, }, - { "ocsp-cache-min-age", kv_config, kt_time, KBF_OCSP_CACHE_MIN, NULL, NULL, }, - { "ocsp-cache-max-age", kv_config, kt_time, KBF_OCSP_CACHE_MAX, NULL, NULL, }, -@@ -426,6 +436,7 @@ - { "virtual_private", kv_config, kt_string, KSF_VIRTUALPRIVATE, NULL, NULL, }, /* obsolete variant, very common */ - { "seedbits", kv_config, kt_number, KBF_SEEDBITS, NULL, NULL, }, - { "keep-alive", kv_config, kt_number, KBF_KEEPALIVE, NULL, NULL, }, -+ { "keep_alive", kv_config | kv_alias, kt_number, KBF_KEEPALIVE, NULL, NULL, }, /* obsolete _ */ - - { "listen-tcp", kv_config, kt_bool, KBF_LISTEN_TCP, NULL, NULL }, - { "listen-udp", kv_config, kt_bool, KBF_LISTEN_UDP, NULL, NULL }, -@@ -437,6 +448,8 @@ - #ifdef HAVE_LABELED_IPSEC - { "ikev1-secctx-attr-type", kv_config, kt_number, KBF_SECCTX, NULL, NULL, }, /* obsolete: not a value, a type */ - { "secctx-attr-type", kv_config | kv_alias, kt_number, KBF_SECCTX, NULL, NULL, }, -+ { "secctx_attr_value", kv_config | kv_alias, kt_number, KBF_SECCTX, NULL, NULL, }, /* obsolete _ */ -+ { "secctx-attr-value", kv_config, kt_number, KBF_SECCTX, NULL, NULL, }, /* obsolete: not a value, a type */ - #endif - - /* these options are obsoleted (and not old aliases) */ -@@ -467,6 +480,7 @@ - { "username", kv_conn | kv_leftright, kt_string, KSCF_USERNAME, NULL, NULL, }, - /* xauthusername is still used in NetworkManager-libreswan :/ */ - { "xauthusername", kv_conn | kv_leftright, kt_string, KSCF_USERNAME, NULL, NULL, }, /* old alias */ -+ { "xauthname", kv_conn | kv_leftright, kt_string, KSCF_USERNAME, NULL, NULL, }, /* old alias */ - { "addresspool", kv_conn | kv_leftright, kt_range, KSCF_ADDRESSPOOL, NULL, NULL, }, - { "auth", kv_conn | kv_leftright, kt_enum, KNCF_AUTH, &kw_authby_lr_list, NULL, }, - { "cat", kv_conn | kv_leftright, kt_bool, KNCF_CAT, NULL, NULL, }, -@@ -489,6 +503,8 @@ - { "esn", kv_conn | kv_processed, kt_enum, KNCF_ESN, &kw_esn_list, NULL, }, - { "decap-dscp", kv_conn | kv_processed, kt_bool, KNCF_DECAP_DSCP, NULL, NULL, }, - { "nopmtudisc", kv_conn | kv_processed, kt_bool, KNCF_NOPMTUDISC, NULL, NULL, }, -+ { "ike_frag", kv_conn | kv_processed | kv_alias, kt_enum, KNCF_IKE_FRAG, &kw_ynf_list, NULL, }, /* obsolete _ */ -+ { "ike-frag", kv_conn | kv_processed | kv_alias, kt_enum, KNCF_IKE_FRAG, &kw_ynf_list, NULL, }, /* obsolete name */ - { "fragmentation", kv_conn | kv_processed, kt_enum, KNCF_IKE_FRAG, &kw_ynf_list, NULL, }, - { "mobike", kv_conn, kt_bool, KNCF_MOBIKE, NULL, NULL, }, - { "narrowing", kv_conn, kt_bool, KNCF_IKEv2_ALLOW_NARROWING, NULL, NULL, }, -@@ -499,13 +515,18 @@ - { "accept-redirect-to", kv_conn, kt_string, KSCF_ACCEPT_REDIRECT_TO, NULL, NULL, }, - { "pfs", kv_conn, kt_bool, KNCF_PFS, NULL, NULL, }, - -+ { "nat_keepalive", kv_conn | kv_alias, kt_bool, KNCF_NAT_KEEPALIVE, NULL, NULL, }, /* obsolete _ */ - { "nat-keepalive", kv_conn, kt_bool, KNCF_NAT_KEEPALIVE, NULL, NULL, }, - -+ { "initial_contact", kv_conn | kv_alias, kt_bool, KNCF_INITIAL_CONTACT, NULL, NULL, }, /* obsolete _ */ - { "initial-contact", kv_conn, kt_bool, KNCF_INITIAL_CONTACT, NULL, NULL, }, -+ { "cisco_unity", kv_conn | kv_alias, kt_bool, KNCF_CISCO_UNITY, NULL, NULL, }, /* obsolete _ */ - { "cisco-unity", kv_conn, kt_bool, KNCF_CISCO_UNITY, NULL, NULL, }, - { "send-no-esp-tfc", kv_conn, kt_bool, KNCF_NO_ESP_TFC, NULL, NULL, }, - { "fake-strongswan", kv_conn, kt_bool, KNCF_VID_STRONGSWAN, NULL, NULL, }, -+ { "send_vendorid", kv_conn | kv_alias, kt_bool, KNCF_SEND_VENDORID, NULL, NULL, }, /* obsolete _ */ - { "send-vendorid", kv_conn, kt_bool, KNCF_SEND_VENDORID, NULL, NULL, }, -+ { "sha2_truncbug", kv_conn | kv_alias, kt_bool, KNCF_SHA2_TRUNCBUG, NULL, NULL, }, /* obsolete _ */ - { "sha2-truncbug", kv_conn, kt_bool, KNCF_SHA2_TRUNCBUG, NULL, NULL, }, - { "ms-dh-downgrade", kv_conn, kt_bool, KNCF_MSDH_DOWNGRADE, NULL, NULL, }, - { "require-id-on-certificate", kv_conn, kt_bool, KNCF_SAN_ON_CERT, NULL, NULL, }, -@@ -520,7 +541,10 @@ - {"ikepad", kv_conn, kt_bool, KNCF_IKEPAD, NULL, NULL, }, - { "nat-ikev1-method", kv_conn | kv_processed, kt_enum, KNCF_IKEV1_NATT, &kw_ikev1natt_list, NULL, }, - -+ { "labeled_ipsec", kv_conn, kt_obsolete, KNCF_WARNIGNORE, NULL, NULL, }, /* obsolete */ -+ { "labeled-ipsec", kv_conn, kt_obsolete, KNCF_WARNIGNORE, NULL, NULL, }, /* obsolete */ - { "policy-label", kv_conn, kt_string, KSCF_SA_SEC_LABEL, NULL, NULL, }, /* obsolete variant */ -+ { "policy_label", kv_conn, kt_string, KSCF_SA_SEC_LABEL, NULL, NULL, }, /* obsolete variant */ - { "sec-label", kv_conn, kt_string, KSCF_SA_SEC_LABEL, NULL, NULL, }, /* really stored into struct end */ - - /* Cisco interop: remote peer type */ -@@ -531,13 +555,17 @@ - /* Network Manager support */ - #ifdef HAVE_NM - { "nm-configured", kv_conn, kt_bool, KNCF_NMCONFIGURED, NULL, NULL, }, -+ { "nm_configured", kv_conn, kt_bool, KNCF_NMCONFIGURED, NULL, NULL, }, /* obsolete _ */ - #endif - - { "xauthby", kv_conn, kt_enum, KNCF_XAUTHBY, &kw_xauthby, NULL, }, - { "xauthfail", kv_conn, kt_enum, KNCF_XAUTHFAIL, &kw_xauthfail, NULL, }, - { "modecfgpull", kv_conn, kt_invertbool, KNCF_MODECONFIGPULL, NULL, NULL, }, - { "modecfgdns", kv_conn, kt_string, KSCF_MODECFGDNS, NULL, NULL, }, -+ { "modecfgdns1", kv_conn | kv_alias, kt_string, KSCF_MODECFGDNS, NULL, NULL, }, /* obsolete */ -+ { "modecfgdns2", kv_conn, kt_obsolete, KNCF_WARNIGNORE, NULL, NULL, }, /* obsolete */ - { "modecfgdomains", kv_conn, kt_string, KSCF_MODECFGDOMAINS, NULL, NULL, }, -+ { "modecfgdomain", kv_conn | kv_alias, kt_string, KSCF_MODECFGDOMAINS, NULL, NULL, }, /* obsolete */ - { "modecfgbanner", kv_conn, kt_string, KSCF_MODECFGBANNER, NULL, NULL, }, - { "ignore-peer-dns", kv_conn, kt_bool, KNCF_IGNORE_PEER_DNS, NULL, NULL, }, - { "mark", kv_conn, kt_string, KSCF_CONN_MARK_BOTH, NULL, NULL, }, diff --git a/libreswan-4.3-1934186-config.patch b/libreswan-4.3-1934186-config.patch deleted file mode 100644 index 022fb47ff06f789e4fa5db4c01afa7eb3f17da4a..0000000000000000000000000000000000000000 --- a/libreswan-4.3-1934186-config.patch +++ /dev/null @@ -1,11 +0,0 @@ -diff -Naur libreswan-4.3-orig/configs/ipsec.conf.in libreswan-4.3/configs/ipsec.conf.in ---- libreswan-4.3-orig/configs/ipsec.conf.in 2021-03-04 14:29:50.591912834 -0500 -+++ libreswan-4.3/configs/ipsec.conf.in 2021-03-04 14:30:27.227389433 -0500 -@@ -32,6 +32,7 @@ - # listen-tcp=yes - # To enable IKE and IPsec over TCP for VPN client, also specify - # tcp-remote-port=4500 in the client's conn section. -+ virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v4:100.64.0.0/10,%v6:fd00::/8,%v6:fe80::/10 - - # if it exists, include system wide crypto-policy defaults - # include /etc/crypto-policies/back-ends/libreswan.config diff --git a/libreswan-4.3-maintain-different-v1v2-split.patch b/libreswan-4.3-maintain-different-v1v2-split.patch deleted file mode 100644 index 33bf0fb0be6e26e2321b247b43d63c81a615b56a..0000000000000000000000000000000000000000 --- a/libreswan-4.3-maintain-different-v1v2-split.patch +++ /dev/null @@ -1,70 +0,0 @@ -diff -Naur libreswan-4.3-orig/configs/d.ipsec.conf/ikev2.xml libreswan-4.3/configs/d.ipsec.conf/ikev2.xml ---- libreswan-4.3-orig/configs/d.ipsec.conf/ikev2.xml 2021-02-21 12:03:03.000000000 -0500 -+++ libreswan-4.3/configs/d.ipsec.conf/ikev2.xml 2021-02-21 12:33:36.226284499 -0500 -@@ -1,15 +1,15 @@ - - ikev2 - --Whether to use IKEv1 (RFC 4301) or IKEv2 (RFC 7296) settings to be used. --Currently the accepted values are no(the default), --signifying only IKEv1 is accepted, or yes, -+Wether to use IKEv1 (RFC 4301) or IKEv2 (RFC 7296) as the Internet Key Exchange (IKE) protcol. -+Currently the accepted values are no (or never) -+signifying only IKEv1 is accepted, or insist(the default), - signifying only IKEv2 is accepted. Previous versions allowed the keywords --propose or permit --that would allow either IKEv1 or IKEv2, but this is no longer supported. The --permit option is interpreted as no and the propose option is interpreted as --yes. Older versions also supported keyword --insist which is now interpreted as yes. -+propose, yes or permit -+that would allow either IKEv1 or IKEv2, but this is no longer supported and both options -+now cause the connection to fail to load. WARNING: This behaviour differs from upstream -+libreswan, which only accepts yes or no where yes means -+the same as insist. - - - -diff -Naur libreswan-4.3-orig/lib/libipsecconf/confread.c libreswan-4.3/lib/libipsecconf/confread.c ---- libreswan-4.3-orig/lib/libipsecconf/confread.c 2021-02-21 12:03:03.000000000 -0500 -+++ libreswan-4.3/lib/libipsecconf/confread.c 2021-02-21 12:37:43.138031929 -0500 -@@ -1310,11 +1310,17 @@ - - switch (conn->options[KNCF_IKEv2]) { - case fo_never: -- case fo_permit: - conn->ike_version = IKEv1; - break; - -+ case fo_permit: -+ starter_error_append(perrl, "ikev2=permit is no longer accepted. Use ikev2=insist or ikev2=no|never"); -+ return TRUE; -+ - case fo_propose: -+ starter_error_append(perrl, "ikev2=propose or ikev2=yes is no longer accepted. Use ikev2=insist or ikev2=no|never"); -+ return TRUE; -+ - case fo_insist: - conn->ike_version = IKEv2; - break; -diff -Naur libreswan-4.3-orig/programs/whack/whack.c libreswan-4.3/programs/whack/whack.c ---- libreswan-4.3-orig/programs/whack/whack.c 2021-02-21 12:03:03.000000000 -0500 -+++ libreswan-4.3/programs/whack/whack.c 2021-02-21 12:39:27.066188354 -0500 -@@ -801,7 +801,7 @@ - { "ikev1-allow", no_argument, NULL, CD_IKEv1 + OO }, /* obsolete name */ - { "ikev2", no_argument, NULL, CD_IKEv2 +OO }, - { "ikev2-allow", no_argument, NULL, CD_IKEv2 +OO }, /* obsolete name */ -- { "ikev2-propose", no_argument, NULL, CD_IKEv2 +OO }, /* obsolete, map onto allow */ -+ /* not in RHEL8 { "ikev2-propose", no_argument, NULL, CD_IKEv2 +OO }, */ - - PS("allow-narrowing", IKEV2_ALLOW_NARROWING), - #ifdef AUTH_HAVE_PAM -@@ -1762,7 +1762,7 @@ - end_seen = LEMPTY; - continue; - -- /* --ikev1 --ikev2 --ikev2-propose */ -+ /* --ikev1 --ikev2 */ - case CD_IKEv1: - case CD_IKEv2: - { diff --git a/libreswan-4.4-ikev1-disable-diagnostics.patch b/libreswan-4.4-ikev1-disable-diagnostics.patch deleted file mode 100644 index 0f5bc475778154aa8bf9f8a6c195989e114d7e6c..0000000000000000000000000000000000000000 --- a/libreswan-4.4-ikev1-disable-diagnostics.patch +++ /dev/null @@ -1,20 +0,0 @@ -Index: libreswan-4.4/programs/pluto/ikev1.c -=================================================================== ---- libreswan-4.4.orig/programs/pluto/ikev1.c -+++ libreswan-4.4/programs/pluto/ikev1.c -@@ -2102,7 +2102,6 @@ void process_packet_tail(struct msg_dige - diag_t d = pbs_in_struct(&md->message_pbs, &isakmp_ignore_desc, - &pd->payload, sizeof(pd->payload), &pd->pbs); - if (d != NULL) { -- llog_diag(RC_LOG, st->st_logger, &d, "%s", ""); - LOG_PACKET(RC_LOG_SERIOUS, - "%smalformed payload in packet", - excuse); -@@ -2171,7 +2170,6 @@ void process_packet_tail(struct msg_dige - &pd->payload, sizeof(pd->payload), - &pd->pbs); - if (d != NULL) { -- llog_diag(RC_LOG, st->st_logger, &d, "%s", ""); - LOG_PACKET(RC_LOG_SERIOUS, - "%smalformed payload in packet", - excuse); diff --git a/libreswan-4.4.tar.gz b/libreswan-4.4.tar.gz deleted file mode 100644 index 4bc7a719d2c60ec537ee13a603e7c949edb77c0f..0000000000000000000000000000000000000000 Binary files a/libreswan-4.4.tar.gz and /dev/null differ diff --git a/libreswan-4.6-ikev1-policy-defaults-to-drop.patch b/libreswan-4.6-ikev1-policy-defaults-to-drop.patch new file mode 100644 index 0000000000000000000000000000000000000000..40073d5c0e973daa71f3de55610301b79b872ce8 --- /dev/null +++ b/libreswan-4.6-ikev1-policy-defaults-to-drop.patch @@ -0,0 +1,63 @@ +From 13720e0dedcab1eaf3334a73a42b68581acd9f3b Mon Sep 17 00:00:00 2001 +From: Daniel Kahn Gillmor +Date: Fri, 7 Jan 2022 18:36:47 -0500 +Subject: [PATCH] ikev1-policy defaults to drop + +IKEv2 has been available for 16 years (RFC 4306 was published December +2005). At some point, we should be discouraging IKEv1 adoption. + +To the extent that a user needs IKEv1, they can manually add +ikev1-policy=accept to /etc/ipsec.conf. +--- + configs/d.ipsec.conf/ikev1-policy.xml | 7 ++++--- + include/ipsecconf/keywords.h | 2 +- + lib/libipsecconf/confread.c | 1 + + programs/pluto/server.c | 5 ----- + 4 files changed, 6 insertions(+), 9 deletions(-) + +diff --git a/configs/d.ipsec.conf/ikev1-policy.xml b/configs/d.ipsec.conf/ikev1-policy.xml +index 17d1747e3b..3bd6702564 100644 +--- a/configs/d.ipsec.conf/ikev1-policy.xml ++++ b/configs/d.ipsec.conf/ikev1-policy.xml +@@ -3,9 +3,10 @@ + + + What to do with received IKEv1 packets. Valid options are +-accept (default), reject which +-will reply with an error, and drop which will silently drop +-any received IKEv1 packet. If this option is set to drop or reject, an attempt to load an ++drop (default) which will silently drop ++any received IKEv1 packet, accept, and ++reject which will reply with an error. ++If this option is set to drop or reject, an attempt to load an + IKEv1 connection will fail, as these connections would never be able to receive a packet + for processing. + +diff --git a/include/ipsecconf/keywords.h b/include/ipsecconf/keywords.h +index 660847733c..31b519242a 100644 +--- a/include/ipsecconf/keywords.h ++++ b/include/ipsecconf/keywords.h +@@ -111,7 +111,7 @@ enum keyword_numeric_config_field { + + KBF_LISTEN_TCP, /* listen on TCP port 4500 - default no */ + KBF_LISTEN_UDP, /* listen on UDP port 500/4500 - default yes */ +- KBF_GLOBAL_IKEv1, /* global ikev1 policy - default accept */ ++ KBF_GLOBAL_IKEv1, /* global ikev1 policy - default drop */ + KBF_ROOF + }; + +diff --git a/lib/libipsecconf/confread.c b/lib/libipsecconf/confread.c +index 5b5aba723f..68fbccf442 100644 +--- a/lib/libipsecconf/confread.c ++++ b/lib/libipsecconf/confread.c +@@ -95,6 +95,7 @@ static void ipsecconf_default_values(struct starter_config *cfg) + /* Don't inflict BSI requirements on everyone */ + SOPT(KBF_SEEDBITS, 0); + SOPT(KBF_DROP_OPPO_NULL, false); ++ SOPT(KBF_GLOBAL_IKEv1, GLOBAL_IKEv1_DROP); + + #ifdef HAVE_LABELED_IPSEC + SOPT(KBF_SECCTX, SECCTX); +-- +2.34.1 + diff --git a/libreswan-4.9-cve-2023-23009.patch b/libreswan-4.9-cve-2023-23009.patch new file mode 100644 index 0000000000000000000000000000000000000000..bbcf25ef9466d5c94112a38ed125e31d02acadb0 --- /dev/null +++ b/libreswan-4.9-cve-2023-23009.patch @@ -0,0 +1,84 @@ +From 7a6c217f47b1ae37e32b173dc6d3ea7fdb86d532 Mon Sep 17 00:00:00 2001 +From: Paul Wouters +Date: Tue, 28 Feb 2023 11:24:22 -0500 +Subject: [PATCH 1/2] pluto: abort processing corrupt TS payloads + CVE-2023-23009 + +Latest updates on this issue at https://libreswan.org/security/CVE-2023-23009 +--- + programs/pluto/ikev2_ts.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/programs/pluto/ikev2_ts.c b/programs/pluto/ikev2_ts.c +index 3f7519ca38..f06c40ba46 100644 +--- a/programs/pluto/ikev2_ts.c ++++ b/programs/pluto/ikev2_ts.c +@@ -437,6 +437,11 @@ static bool v2_parse_tss(struct payload_digest *const ts_pd, + d = pbs_in_struct(&ts_pd->pbs, &ikev2_ts_header_desc, + &ts_h, sizeof(ts_h), &ts_body_pbs); + ++ if (d != NULL) { ++ llog_diag(RC_LOG, logger, &d, "%s", ""); ++ return false; ++ } ++ + switch (ts_h.isath_type) { + case IKEv2_TS_IPV4_ADDR_RANGE: + case IKEv2_TS_IPV6_ADDR_RANGE: +-- +2.39.2 + + +From 52c19ccc9455ccd91fa4946b09f8e11222f1c923 Mon Sep 17 00:00:00 2001 +From: Andrew Cagney +Date: Tue, 28 Feb 2023 14:10:44 -0500 +Subject: [PATCH 2/2] ikev1: only clean up a connection when it isn't deleted + +fix #1018 reported by Wolfgang. +see also ecb9c88910df1fb070488835bf3180096f3ccba3: +IKEv1: Remove all IPsec SA's of a connection when newest SA is removed. +--- + programs/pluto/ikev1_main.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/programs/pluto/ikev1_main.c b/programs/pluto/ikev1_main.c +index a616c5ccf3..21765d4002 100644 +--- a/programs/pluto/ikev1_main.c ++++ b/programs/pluto/ikev1_main.c +@@ -2130,15 +2130,16 @@ bool accept_delete(struct msg_digest *md, + ntohl(spi)); + } + +- struct connection *rc = dst->st_connection; ++ /* save for post delete_state() code */ ++ co_serial_t rc_serialno = dst->st_connection->serialno; + + if (nat_traversal_enabled && dst->st_connection->ikev1_natt != NATT_NONE) { + nat_traversal_change_port_lookup(md, dst); + v1_maybe_natify_initiator_endpoints(st, HERE); + } + +- if (rc->newest_ipsec_sa == dst->st_serialno && +- (rc->policy & POLICY_UP)) { ++ if (dst->st_connection->newest_ipsec_sa == dst->st_serialno && ++ (dst->st_connection->policy & POLICY_UP)) { + /* + * Last IPsec SA for a permanent + * connection that we have initiated. +@@ -2162,7 +2163,12 @@ bool accept_delete(struct msg_digest *md, + md->v1_st = NULL; + } + +- if (rc->newest_ipsec_sa == SOS_NOBODY) { ++ /* ++ * Either .newest_ipsec_sa matches DST ++ * and is cleared, or was never set. ++ */ ++ struct connection *rc = connection_by_serialno(rc_serialno); ++ if (rc != NULL && rc->newest_ipsec_sa == SOS_NOBODY) { + dbg("%s() connection '%s' -POLICY_UP", __func__, rc->name); + rc->policy &= ~POLICY_UP; + if (!shared_phase1_connection(rc)) { +-- +2.39.2 + diff --git a/libreswan-4.9-cve-2023-30570.patch b/libreswan-4.9-cve-2023-30570.patch new file mode 100644 index 0000000000000000000000000000000000000000..d175506c92dd082ec1bd09bdb1075c533403cb04 --- /dev/null +++ b/libreswan-4.9-cve-2023-30570.patch @@ -0,0 +1,129 @@ +diff --git a/programs/pluto/ikev1.c b/programs/pluto/ikev1.c +index e0615323ed..401618b6dd 100644 +--- a/programs/pluto/ikev1.c ++++ b/programs/pluto/ikev1.c +@@ -1101,10 +1101,20 @@ void process_v1_packet(struct msg_digest *md) + struct state *st = NULL; + enum state_kind from_state = STATE_UNDEFINED; /* state we started in */ + ++ /* ++ * For the initial responses, don't leak the responder's SPI. ++ * Hence the use of send_v1_notification_from_md(). ++ * ++ * AGGR mode is a mess in that the R0->R1 transition happens ++ * well before the transition succeeds. ++ */ + #define SEND_NOTIFICATION(t) \ + { \ + pstats(ikev1_sent_notifies_e, t); \ +- if (st != NULL) \ ++ if (st != NULL && \ ++ st->st_state->kind != STATE_AGGR_R0 && \ ++ st->st_state->kind != STATE_AGGR_R1 && \ ++ st->st_state->kind != STATE_MAIN_R0) \ + send_v1_notification_from_state(st, from_state, t); \ + else \ + send_v1_notification_from_md(md, t); \ +@@ -1168,17 +1178,26 @@ void process_v1_packet(struct msg_digest *md) + from_state = (md->hdr.isa_xchg == ISAKMP_XCHG_IDPROT ? + STATE_MAIN_R0 : STATE_AGGR_R0); + } else { +- /* not an initial message */ ++ /* ++ * Possibly not an initial message. Possibly ++ * from initiator. Possibly from responder. ++ * ++ * Possibly. Which is probably hopeless. ++ */ + + st = find_state_ikev1(&md->hdr.isa_ike_spis, + md->hdr.isa_msgid); + + if (st == NULL) { + /* +- * perhaps this is a first message ++ * Perhaps this is a first message + * from the responder and contains a + * responder cookie that we've not yet + * seen. ++ * ++ * Perhaps this is a random message ++ * with a bogus non-zero responder IKE ++ * SPI. + */ + st = find_state_ikev1_init(&md->hdr.isa_ike_initiator_spi, + md->hdr.isa_msgid); +@@ -1189,6 +1208,21 @@ void process_v1_packet(struct msg_digest *md) + /* XXX Could send notification back */ + return; + } ++ if (st->st_state->kind == STATE_AGGR_R0) { ++ /* ++ * The only way for this to ++ * happen is for the attacker ++ * to guess the responder's ++ * IKE SPI that hasn't been ++ * sent over the wire? ++ * ++ * Well that or played 1/2^32 ++ * odds. ++ */ ++ llog_pexpect(md->md_logger, HERE, ++ "phase 1 message matching AGGR_R0 state"); ++ return; ++ } + } + from_state = st->st_state->kind; + } +@@ -2870,7 +2904,28 @@ void complete_v1_state_transition(struct state *st, struct msg_digest *md, stf_s + delete_state(st); + /* wipe out dangling pointer to st */ + md->v1_st = NULL; ++ } else if (st->st_state->kind == STATE_AGGR_R0 || ++ st->st_state->kind == STATE_AGGR_R1 || ++ st->st_state->kind == STATE_MAIN_R0) { ++ /* ++ * ++ * Wipe out the incomplete larval state. ++ * ++ * ARGH! In <=v4.10, the aggr code flipped the ++ * larval state to R1 right at the start of ++ * the transition and not the end, so using ++ * state to figure things out is close to ++ * useless. ++ * ++ * Deleting the state means that pluto has no ++ * way to detect and ignore amplification ++ * attacks. ++ */ ++ delete_state(st); ++ /* wipe out dangling pointer to st */ ++ md->v1_st = NULL; + } ++ + break; + } + } +diff --git a/programs/pluto/ikev1_aggr.c b/programs/pluto/ikev1_aggr.c +index 2732951beb..87be80cb6c 100644 +--- a/programs/pluto/ikev1_aggr.c ++++ b/programs/pluto/ikev1_aggr.c +@@ -169,7 +169,7 @@ stf_status aggr_inI1_outR1(struct state *null_st UNUSED, + /* Set up state */ + struct ike_sa *ike = new_v1_rstate(c, md); + md->v1_st = &ike->sa; /* (caller will reset cur_state) */ +- change_v1_state(&ike->sa, STATE_AGGR_R1); ++ change_v1_state(&ike->sa, STATE_AGGR_R0); + + /* + * Warn when peer is expected to use especially dangerous +@@ -197,7 +197,8 @@ stf_status aggr_inI1_outR1(struct state *null_st UNUSED, + + if (!v1_decode_certs(md)) { + llog_sa(RC_LOG, ike, "X509: CERT payload bogus or revoked"); +- return false; ++ /* XXX notification is in order! */ ++ return STF_FAIL_v1N + v1N_INVALID_ID_INFORMATION; + } + + /* diff --git a/libreswan.spec b/libreswan.spec index 3be55c943db242d02d945797d06298de9b71b791..5dd129f5722bc5d856b5cb1b632c40367f918ed1 100644 --- a/libreswan.spec +++ b/libreswan.spec @@ -1,69 +1,55 @@ -%define anolis_release .0.1 %global _hardened_build 1 # These are rpm macros and are 0 or 1 %global with_efence 0 %global with_development 0 %global with_cavstests 1 -# minimum version for support for rhbz#1651314 -# should prob update for nss with IKEv1 quick mode support -%global nss_version 3.53.1 +%global nss_version 3.52 %global unbound_version 1.6.6 +# Libreswan config options %global libreswan_config \\\ FINALLIBEXECDIR=%{_libexecdir}/ipsec \\\ FINALMANDIR=%{_mandir} \\\ - FINALNSSDIR=%{_sysconfdir}/ipsec.d \\\ - INITSYSTEM=systemd \\\ - NSS_HAS_IPSEC_PROFILE=true \\\ - NSS_REQ_AVA_COPY=false \\\ PREFIX=%{_prefix} \\\ + INITSYSTEM=systemd \\\ PYTHON_BINARY=%{__python3} \\\ SHELL_BINARY=%{_bindir}/sh \\\ USE_DNSSEC=true \\\ - USE_FIPSCHECK=false \\\ USE_LABELED_IPSEC=true \\\ USE_LDAP=true \\\ USE_LIBCAP_NG=true \\\ USE_LIBCURL=true \\\ USE_LINUX_AUDIT=true \\\ USE_NM=true \\\ - USE_NSS_KDF=true \\\ + USE_NSS_IPSEC_PROFILE=true \\\ USE_SECCOMP=true \\\ USE_AUTHPAM=true \\\ - USE_DH2=true \\\ %{nil} -#global prever rc1 +#global prever dr1 Name: libreswan -Summary: IPsec implementation with IKEv1 and IKEv2 keying protocols +Summary: Internet Key Exchange (IKEv1 and IKEv2) implementation for IPsec # version is generated in the release script -Version: 4.4 -Release: %{?prever:0.}4%{?prever:.%{prever}}%{anolis_release}%{?dist} +Version: 4.9 +Release: %{?prever:0.}4%{?prever:.%{prever}}%{?dist} License: GPLv2 Url: https://libreswan.org/ - -Source0: https://download.libreswan.org/%{?prever:with_development/}%{name}-%{version}%{?prever}.tar.gz +Source0: https://download.libreswan.org/%{?prever:development/}%{name}-%{version}%{?prever}.tar.gz %if 0%{with_cavstests} Source1: https://download.libreswan.org/cavs/ikev1_dsa.fax.bz2 Source2: https://download.libreswan.org/cavs/ikev1_psk.fax.bz2 Source3: https://download.libreswan.org/cavs/ikev2.fax.bz2 %endif - -Patch1: libreswan-4.3-maintain-different-v1v2-split.patch -Patch2: libreswan-3.32-1861360-nodefault-rsa-pss.patch -Patch3: libreswan-4.1-maintain-obsolete-keywords.patch -Patch6: libreswan-4.3-1934186-config.patch -Patch7: libreswan-4.4-ikev1-disable-diagnostics.patch - -#Add by Anolis -Patch1000: 0001-libreswan-anolis-rebrand-to-anolis.patch -#End +Patch: libreswan-4.6-ikev1-policy-defaults-to-drop.patch +Patch: libreswan-4.9-cve-2023-23009.patch +Patch: libreswan-4.9-cve-2023-30570.patch BuildRequires: audit-libs-devel BuildRequires: bison BuildRequires: curl-devel BuildRequires: flex BuildRequires: gcc make +BuildRequires: hostname BuildRequires: ldns-devel BuildRequires: libcap-ng-devel BuildRequires: libevent-devel @@ -71,12 +57,10 @@ BuildRequires: libseccomp-devel BuildRequires: libselinux-devel BuildRequires: nspr-devel BuildRequires: nss-devel >= %{nss_version} -BuildRequires: nss-tools +BuildRequires: nss-tools >= %{nss_version} BuildRequires: openldap-devel BuildRequires: pam-devel BuildRequires: pkgconfig -BuildRequires: hostname -BuildRequires: redhat-rpm-config BuildRequires: systemd-devel BuildRequires: unbound-devel >= %{unbound_version} BuildRequires: xmlto @@ -95,7 +79,7 @@ Requires(preun): systemd Requires(postun): systemd %description -Libreswan is a free implementation of IKE/IPsec for Linux. IPsec is +Libreswan is a free implementation of IPsec & IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks. Everything passing @@ -112,18 +96,9 @@ Libreswan is based on Openswan-2.6.38 which in turn is based on FreeS/WAN-2.04 %prep %setup -q -n libreswan-%{version}%{?prever} -%patch1 -p1 -%patch2 -p1 -%patch3 -p1 -%patch6 -p1 -%patch7 -p1 - -%patch1000 -p1 -# linking to freebl is not needed -sed -i "s/-lfreebl //" mk/config.mk - # enable crypto-policies support sed -i "s:#[ ]*include \(.*\)\(/crypto-policies/back-ends/libreswan.config\)$:include \1\2:" configs/ipsec.conf.in +%autopatch -p1 %build make %{?_smp_mflags} \ @@ -132,20 +107,21 @@ make %{?_smp_mflags} \ %else OPTIMIZE_CFLAGS="%{optflags}" \ %endif + WERROR_CFLAGS="-Werror -Wno-missing-field-initializers -Wno-lto-type-mismatch -Wno-maybe-uninitialized" \ %if 0%{with_efence} USE_EFENCE=true \ %endif - WERROR_CFLAGS="-Werror -Wno-missing-field-initializers" \ - USERLINK="%{?__global_ldflags}" \ + USERLINK="%{?__global_ldflags} -Wl,-z,relro -Wl,--as-needed -Wl,-z,now -flto --no-lto" \ %{libreswan_config} \ programs FS=$(pwd) + %install make \ - DESTDIR=%{buildroot} \ - %{libreswan_config} \ - install + DESTDIR=%{buildroot} \ + %{libreswan_config} \ + install FS=$(pwd) rm -rf %{buildroot}/usr/share/doc/libreswan rm -rf %{buildroot}%{_libexecdir}/ipsec/*check @@ -155,10 +131,10 @@ install -d %{buildroot}%{_sbindir} install -d %{buildroot}%{_sysconfdir}/sysctl.d install -m 0644 packaging/fedora/libreswan-sysctl.conf \ - %{buildroot}%{_sysconfdir}/sysctl.d/50-libreswan.conf + %{buildroot}%{_sysconfdir}/sysctl.d/50-libreswan.conf echo "include %{_sysconfdir}/ipsec.d/*.secrets" \ - > %{buildroot}%{_sysconfdir}/ipsec.secrets + > %{buildroot}%{_sysconfdir}/ipsec.secrets rm -fr %{buildroot}%{_sysconfdir}/rc.d/rc* %if 0%{with_cavstests} @@ -179,6 +155,7 @@ bunzip2 *.fax.bz2 %{buildroot}%{_libexecdir}/ipsec/cavp -v1psk ikev1_psk.fax | \ diff -u ikev1_psk.fax - > /dev/null : CAVS tests passed +%endif # Some of these tests will show ERROR for negative testing - it will exit on real errors %{buildroot}%{_libexecdir}/ipsec/algparse -tp || { echo prooposal test failed; exit 1; } @@ -191,8 +168,6 @@ certutil -N -d sql:$tmpdir --empty-password %{buildroot}%{_libexecdir}/ipsec/pluto --selftest --nssdir $tmpdir --rundir $tmpdir : pluto self-test passed - verify FIPS algorithms allowed is still compliant with NIST -%endif - %post %systemd_post ipsec.service @@ -212,156 +187,180 @@ certutil -N -d sql:$tmpdir --empty-password %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipsec.d/policies/* %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/sysctl.d/50-libreswan.conf %attr(0755,root,root) %dir %{_rundir}/pluto +%attr(0700,root,root) %dir %{_sharedstatedir}/ipsec +%attr(0700,root,root) %dir %{_sharedstatedir}/ipsec/nss %attr(0644,root,root) %{_tmpfilesdir}/libreswan.conf %attr(0644,root,root) %{_unitdir}/ipsec.service %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/pam.d/pluto %config(noreplace) %{_sysconfdir}/logrotate.d/libreswan %{_sbindir}/ipsec %{_libexecdir}/ipsec -%attr(0644,root,root) %doc %{_mandir}/*/* +%doc %{_mandir}/*/* %changelog -* Thu Jan 20 2022 yangxiaoxuan - 4.4-4.0.1 -- Rebrand to anolis +* Thu May 04 2023 Sahana Prasad - 4.9-4 +- Just bumping up the version as an incorrect 9.3 build was created. +- Related: rhbz#2187171 -* Fri Jan 14 2022 Daiki Ueno - 4.4-4 -- Resolves: rhbz#2036902 rebuild to enable rpminspect +* Thu May 04 2023 Sahana Prasad - 4.9-3 +- Fix CVE-2023-30570:Malicious IKEv1 Aggressive Mode packets can crash + libreswan +- Resolves: rhbz#2187171 -* Wed Jan 12 2022 Daiki Ueno - 4.4-3 -- Resolves: rhbz#2036902: fix patch application +* Tue Apr 4 2023 Daiki Ueno - 4.9-2 +- Fix CVE-2023-23009: remote DoS via crafted TS payload with an + incorrect selector length (rhbz#2173674) -* Fri Jan 7 2022 Daiki Ueno - 4.4-2 -- Resolves: rhbz#2036902 ikev1: disable diagnostics logging on receiving malformed packets +* Wed Jan 4 2023 Daiki Ueno - 4.9-1 +- Update to 4.9. Resolves: rhbz#2128669 +- Switch to using %%autopatch as in Fedora -* Wed May 26 2021 Daiki Ueno - 4.4-1 -- Resolves: rhbz#1958968 Rebase libreswan to 4.4 -- Resolves: rhbz#1954423 Libreswan: TS_UNACCEPTABLE on multiple connections between the same peers +* Wed Feb 2 2022 Daiki Ueno - 4.6-3 +- Drop IKEv1 packets by default, based on the Debian patch + by Daniel Kahn Gillmor (rhbz#2039877) -* Thu Mar 04 2021 Paul Wouters - 4.3-3 -- Resolves: rhbz#1933064 - IKEv2 support for Labeled IPsec -- Resolves: rhbz#1935150 RFE: Support IKE and ESP over TCP: RFC 8229 -- Resolves: rhbz#1935339 virtual_private setting is missing in the default config +* Mon Jan 17 2022 Daiki Ueno - 4.6-2 +- Related: rhbz#2017355 rebuild to reflect gating.yaml change -* Sun Feb 21 2021 Paul Wouters - 4.3-1 -- Resolves: rhbz#1025061 - IKEv2 support for Labeled IPsec [update] +* Mon Jan 17 2022 Daiki Ueno - 4.6-1 +- Update to 4.6. Resolves: rhbz#2017355 -* Thu Feb 04 2021 Paul Wouters - 4.2-1 -- Resolves: rhbz#1891128 [Rebase] rebase libreswan to 4.2 -- Resolves: rhbz#1025061 - IKEv2 support for Labeled IPsec +* Mon Jan 10 2022 Daiki Ueno - 4.5-1 +- Update to 4.5. Resolves: rhbz#2017355 -* Tue Oct 27 22:11:42 EDT 2020 Paul Wouters - 4.1-1 -- Resolves: rhbz#1891128 [Rebase] rebase libreswan to 4.1 -- Resolves: rhbz#1889836 libreswan: add 3.x compat patches for obsoleted/removed keywords of 4.0 and re-port ikev2= patch +* Mon Aug 09 2021 Mohan Boddu - 4.4-3.1 +- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags + Related: rhbz#1991688 -* Wed Jul 29 2020 Paul Wouters - 3.32-6 -- Resolves: rhbz#1861360 authby=rsasig must not imply usage of rsa-pss +* Wed Jul 21 2021 Daiki Ueno - 4.4-3 +- Backport removal gethostbyname2 uses from the upstream +- Fix issues spotted by covscan (rhbz#1938784) -* Wed Jul 22 2020 Paul Wouters - 3.32-5 -- Resolves: rhbz#1820206 Rebase to libreswan 3.32 [rebuild for USE_NSS_PRF] +* Tue Jul 13 2021 Daiki Ueno - 4.4-2 +- Rebuild with newer GCC to fix annocheck failures -* Wed Jul 01 2020 Paul Wouters - 3.32-4 -- Resolves: rhbz#1544463 ipsec service does not work correctly when seccomp filtering is enabled +* Thu Jul 1 2021 Daiki Ueno - 4.4-1 +- Update to 4.4. Resolves: rhbz#1975812 +- Port compiler warning suppression by Paul Wouters: + https://src.fedoraproject.org/rpms/libreswan/c/8d7f98d41444ac77c562f735b4b93038f5346ce2?branch=rawhide -* Wed Jun 17 2020 Paul Wouters - 3.32-3 -- Resolves: rhbz#1842597 regression: libreswan does not send PLUTO_BYTES env variables to updown script -- Resolves: rhbz#1847766 subsequent xfrmi interfaces configured outside of libreswan are not recognised properly -- Resolves: rhbz#1840212 protect libreswan against unannounced nss ABI change +* Thu Jun 24 2021 Daiki Ueno - 4.2-1.3 +- Fix FTBFS with OpenSSL 3.0 (rhbz#1975439) -* Thu Jun 11 2020 Paul Wouters - 3.32-2 -- Resolves: rhbz#1820206 Rebase to libreswan 3.32 [addconn fix] +* Tue Jun 22 2021 Mohan Boddu - 4.2-1.2 +- Rebuilt for RHEL 9 BETA for openssl 3.0 + Related: rhbz#1971065 -* Thu Apr 30 2020 Paul Wouters - 3.32-1 -- Resolves: rhbz#1820206 Rebase to libreswan 3.32 -- Resolves: rhbz#1816265 Use NSS to check whether FIPS mode is enabled -- Resolves: rhbz#1826337 libreswan in FIPS mode rejects ECDSA keys based on faulty RSA key size check being applied +* Fri Apr 16 2021 Mohan Boddu - 4.2-1.1 +- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 -* Tue Aug 13 2019 Paul Wouters - 3.29-6 -- Resolves: rhbz#1714331 support NSS based IKE KDF's [require updated nss for rhbz 1738689, memleak fix] +* Wed Feb 03 2021 Paul Wouters - 4.2-1 +- Update to 4.2 -* Thu Aug 08 2019 Paul Wouters - 3.29-5 -- Resolves: rhbz#1714331 support NSS based IKE KDF's so libreswan does not need FIPS certification +* Tue Jan 26 2021 Fedora Release Engineering - 4.2-0.1.rc1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild -* Thu Aug 01 2019 Paul Wouters - 3.29-4 -- Resolves: rhbz#1699318 'ipsec show' has python3 invalid syntax +* Sat Dec 19 19:59:55 EST 2020 Paul Wouters - 4.2-0.1.rc1 +- Resolves: rhbz#1867580 pluto process frequently dumps core + (disable USE_NSS_KDF until nss fixes have propagated) -* Thu Jul 04 2019 Paul Wouters - 3.29-3 -- Resolves: rhbz#1725205 XFRM policy for OE/32 peer is deleted when shunts for previous half-open state expire +* Sat Dec 19 2020 Adam Williamson - 4.1-4 +- Rebuild for ldns soname bump -* Thu Jun 27 2019 Paul Wouters - 3.29-2 -- Resolves: rhbz#1723957 libreswan is missing linux audit calls for failed IKE SAs and failed IPsec SAs required for Common Criteria +* Mon Nov 23 11:50:41 EST 2020 Paul Wouters - 4.1-3 +- Resolves: rhbz#1894381 Libreswan 4.1-2 breaks l2tp connection to Windows VPN server -* Mon Jun 10 2019 Paul Wouters - 3.29-1 -- Resolves: rhbz#1712555 libreswan rebase to 3.29 +* Mon Oct 26 10:21:57 EDT 2020 Paul Wouters - 4.1-2 +- Resolves: rhbz#1889538 libreswan's /var/lib/ipsec/nss missing -* Tue May 28 2019 Paul Wouters - 3.28-2 -- Resolves: rhbz#1713734: barf: shell syntax error in barf diagnostic tool +* Sun Oct 18 21:49:39 EDT 2020 Paul Wouters - 4.1-1 +- Updated to 4.1 - interop fix for Cisco -* Tue May 21 2019 Paul Wouters - 3.28-1 -- Resolves: rhbz#1712555 libreswan rebase to 3.28 -- Resolves: rhbz#1683706 Libreswan shows incorrect error messages -- Resolves: rhbz#1706180 Remove last usage of old (unused) PF_KEY API -- Resolves: rhbz#1677045 Opportunistic IPsec instances of /32 groups or auto=start that receive delete won't restart -- Resolves: rhbz#1686990 IKEv1 traffic interruption when responder deletes SAs 60 seconds before EVENT_SA_REPLACE -- Resolves: rhbz#1608353 /usr/sbin/ipsec part of the libreswan packages still invokes commands that were deprecated a decade ago -- Resolves: rhbz#1699318 'ipsec show' has python3 invalid syntax -- Resolves: rhbz#1679394 libreswan using NSS IPsec profiles regresses when critical flags are set causing validation failure +* Thu Oct 15 10:27:14 EDT 2020 Paul Wouters - 4.0-1 +- Resolves: rhbz#1888448 libreswan-4.0 is available -* Thu Feb 21 2019 Paul Wouters - 3.27-9 -- Resolves: rhbz#1648776 limit connections to be ikev1only or ikev2only and make ikev2only the default [man page update] +* Wed Sep 30 14:05:58 EDT 2020 Paul Wouters - 4.0-0.2.rc1 +- Rebuild for libevent 2.1.12 with a soname bump -* Fri Feb 15 2019 Paul Wouters - 3.27-8 -- Resolves: rhbz#1664101 system wide crypto policies causing IKE_INIT packet fragmentation +* Sun Sep 27 22:49:40 EDT 2020 Paul Wouters - 4.0-0.1.rc1 +- Updated to 4.0rc1 -* Tue Feb 05 2019 Paul Wouters - 3.27-7 -- Resolves: rhbz#1671793 proessing ISAKMP_NEXT_D with additional payloads causes dangling pointer to deleted state +* Thu Aug 27 2020 Paul Wouters - 3.32-4 +- Resolves: rhbz#1864043 libreswan: FTBFS in Fedora rawhide/f33 -* Fri Feb 01 2019 Paul Wouters - 3.27-6 -- Resolves: rhbz#1668342 SELinux prevents libreswan from using some outbound ports causing DNS resolution failures at connection at load time +* Sat Aug 01 2020 Fedora Release Engineering - 3.32-3.2 +- Second attempt - Rebuilt for + https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild -* Thu Jan 10 2019 Paul Wouters - 3.27-5 -- Resolves: rhbz#1664522 libreswan 3.25 in FIPS mode is incorrectly rejecting X.509 public keys that are >= 3072 bits +* Tue Jul 28 2020 Fedora Release Engineering - 3.32-3.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild -* Mon Dec 10 2018 Paul Wouters - 3.27-4 -- Resolves: rhbz#1657846 libreswan no longer needs to provide openswan in rhel8 -- Resolves: rhbz#1643388 libreswan: Unable to verify certificate with non-empty Extended Key Usage which does not include serverAuth or clientAuth -- Resolves: rhbz#1657854 remove userland support for deprecated KLIPS IPsec stack support +* Tue Jun 30 2020 Jeff Law - 3.32-3 +- Initialize ppk_id_p in ikev2_parent_inR1outI2_tail to avoid uninitialized + object -* Sun Dec 09 2018 Paul Wouters - 3.27-3 -- Resolves: rhbz#1648776 limit connections to be ikev1only or ikev2only and make ikev2only the default +* Tue May 26 2020 Paul Wouters - 3.32-2 +- Backport NSS guarding fix for unannounced changed api in NSS causing segfault -* Thu Nov 08 2018 Paul Wouters - 3.27-2 -- Resolves: rhbz#1645137 Libreswan segfaults when it loads configuration file with more then 5 connections +* Mon May 11 2020 Paul Wouters - 3.32-1 +- Resolves: rhbz#1809770 libreswan-3.32 is available + +* Tue Apr 14 2020 Paul Wouters - 3.31-2 +- Resolves: rhbz#1823823 Please drop the dependency on fipscheck + +* Tue Mar 03 2020 Paul Wouters - 3.31-1 +- Resolves: rhbz#1809770 libreswan-3.31 is available (fixes rekey regression) + +* Fri Feb 14 2020 Paul Wouters - 3.30-1 +- Resolves: rhbz#1802896 libreswan-3.30 is available +- Resolves: rhbz#1799598 libreswan: FTBFS in Fedora rawhide/f32 +- Resolves: rhbz#1760571 [abrt] libreswan: configsetupcheck(): verify:366:configsetupcheck:TypeError: + +* Wed Jan 29 2020 Fedora Release Engineering - 3.29-2.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Thu Jan 09 2020 Paul Wouters - 3.29-2 +- _updown.netkey: fix syntax error in checking routes + +* Thu Jul 25 2019 Fedora Release Engineering - 3.29-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Mon Jun 10 2019 Paul Wouters - 3.29-1 +- Resolves: rhbz#1718986 Updated to 3.29 for CVE-2019-10155 + +* Tue May 21 2019 Paul Wouters - 3.28-1 +- Updated to 3.28 (many imported bugfixes, including CVE-2019-12312) + +* Fri Feb 01 2019 Fedora Release Engineering - 3.27-1.2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Mon Jan 14 2019 Björn Esser - 3.27-1.1 +- Rebuilt for libcrypt.so.2 (#1666033) * Mon Oct 08 2018 Paul Wouters - 3.27-1 -- Resolves: rhbz#1566574 Rebase to libreswan 3.27 +- Updated to 3.27 (various bugfixes) -* Mon Sep 17 2018 Paul Wouters - 3.26-1 -- Resolves: rhbz#1566574 Rebase to libreswan 3.26 -- Resolves: rhbz#1527037 libreswan IPSEC implementation: should follow the policies of system-wide crypto policy -- Resolves: rhbz#1375779 [IKEv2 Conformance] Test IKEv2.EN.R.1.1.6.7: Sending INVALID_KE_PAYLOAD failed -- Resolves: rhbz#1085758 [TAHI][IKEv2] IKEv2.EN.I.1.2.1.1: Can't observe CREATE_CHILD_SA request for rekey -- Resolves: rhbz#1053048 [TAHI][IKEv2] IKEv2.EN.I.1.2.4.1-7: libreswan doesn't sent CREATE_CHILD_SA after IKE_SA Lifetime timeout +* Thu Sep 27 2018 Paul Wouters - 3.26-3 +- Add fedora python fixup for _unbound-hook + +* Mon Sep 17 2018 Paul Wouters - 3.26-2 +- linking against freebl is no longer needed (and wasn't done in 3.25) -* Mon Aug 13 2018 Paul Wouters - 3.25-4 -- Resolves: rhbz#1590823 libreswan: Use Python 3 in RHEL 8 +* Mon Sep 17 2018 Paul Wouters - 3.26-1 +- Updated to 3.26 (CHACHA20POLY1305, ECDSA and RSA-PSS support) -* Wed Aug 01 2018 Charalampos Stratakis - 3.25-3.1 -- Rebuild for platform-python +* Fri Jul 13 2018 Fedora Release Engineering - 3.25-3.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild * Mon Jul 09 2018 Paul Wouters - 3.25-3 -- Cleanup shebangs for python3 -- Use the same options via macro for make programs and make install -- Remove old ifdefs -- Sync up patches to new upstream version -- Add Requires: for unbound-libs >= 1.6.6 -- Enable crypto-policies support -- Make rundir world readable for easier permission granting for socket +- Fix Opportunistic IPsec _unbound-hook argument parsing +- Make rundir readable for all (so we can hand out permissions later) -* Tue Jun 26 2018 Charalampos Stratakis - 3.23-2.2 -- Make python shebangs point to python3 +* Mon Jul 02 2018 Paul Wouters - 3.25-2 +- Relax deleting IKE SA's and IPsec SA's to avoid interop issues with third party VPN vendors -* Fri Jun 22 2018 Troy Dawson - 3.23-2.1 -- Fix python shebangs (#1580773) +* Wed Jun 27 2018 Paul Wouters - 3.25-1 +- Updated to 3.25 * Mon Feb 19 2018 Paul Wouters - 3.23-2 - Support crypto-policies package @@ -415,7 +414,7 @@ certutil -N -d sql:$tmpdir --empty-password - Remove support for /etc/sysconfig/pluto (use native systemd instead) * Thu May 05 2016 Paul Wouters - 3.17-2 -- Resolves: rhbz#1324956 prelink is gone, /etc/prelink.conf.d/* is no longer used +- Resolves: rhbz#1324956 prelink is gone, /etc/prelink.conf.d/* is no longer used * Thu Apr 07 2016 Paul Wouters - 3.17-1 - Updated to 3.17 for CVE-2016-3071