From 267e23ef20b94c10409d4512083691181a503b25 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vladim=C3=ADr=20Bene=C5=A1?= Date: Tue, 21 Oct 2025 10:58:52 +0200 Subject: [PATCH] Add one more patch Resolves: RHEL-119641 Resolves: RHEL-119653 --- ...-sanitize-before-exporting-RHEL-only.patch | 54 +++++++++++++++++++ NetworkManager-libreswan.spec | 6 ++- 2 files changed, 59 insertions(+), 1 deletion(-) create mode 100644 0004-sanitize-before-exporting-RHEL-only.patch diff --git a/0004-sanitize-before-exporting-RHEL-only.patch b/0004-sanitize-before-exporting-RHEL-only.patch new file mode 100644 index 0000000..f396d31 --- /dev/null +++ b/0004-sanitize-before-exporting-RHEL-only.patch @@ -0,0 +1,54 @@ +From 15946667c771ba88d38f82cc467fd52d268e44bb Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?=C3=8D=C3=B1igo=20Huguet?= +Date: Tue, 21 Oct 2025 08:37:35 +0200 +Subject: [PATCH] export: sanitize before exporting (RHEL only) + +The commit referenced below moved the responsibility of sanitizing the +connection from nm_libreswan_get_ipsec_conf to its caller, but it forgot +to sanitize in export_to_file(). Fix it. + +This is a RHEL-only patch, as this is fixed by a later commit that we +didn't want to backport yet. When we rebase, this patch can be dropped. + +Fixes: 50d0fc5a265b ('Fix PSK authentication when leftid starts with `@`') +--- + properties/nm-libreswan-editor-plugin.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +diff --git a/properties/nm-libreswan-editor-plugin.c b/properties/nm-libreswan-editor-plugin.c +index 2b455ba..7a75e09 100644 +--- a/properties/nm-libreswan-editor-plugin.c ++++ b/properties/nm-libreswan-editor-plugin.c +@@ -91,6 +91,7 @@ export_to_file (NMVpnEditorPlugin *self, + GError **error) + { + NMSettingVpn *s_vpn; ++ gs_unref_object NMSettingVpn *s_vpn_sanitized = NULL; + gboolean openswan = FALSE; + gs_free_error GError *local = NULL; + gs_free char *ipsec_conf = NULL; +@@ -98,8 +99,19 @@ export_to_file (NMVpnEditorPlugin *self, + int version; + + s_vpn = nm_connection_get_setting_vpn (connection); +- if (s_vpn) +- openswan = nm_streq (nm_setting_vpn_get_service_type (s_vpn), NM_VPN_SERVICE_TYPE_OPENSWAN); ++ if (!s_vpn) { ++ g_set_error_literal (error, ++ NM_VPN_PLUGIN_ERROR, NM_VPN_PLUGIN_ERROR_INVALID_CONNECTION, ++ _("Empty VPN setting.")); ++ return FALSE; ++ } ++ ++ s_vpn_sanitized = sanitize_setting_vpn (s_vpn, error); ++ if (!s_vpn_sanitized) ++ return FALSE; ++ ++ s_vpn = s_vpn_sanitized; ++ openswan = nm_streq (nm_setting_vpn_get_service_type (s_vpn), NM_VPN_SERVICE_TYPE_OPENSWAN); + + nm_libreswan_detect_version (nm_libreswan_find_helper_bin ("ipsec", NULL), + &is_openswan, &version, NULL); +-- +2.51.0 + diff --git a/NetworkManager-libreswan.spec b/NetworkManager-libreswan.spec index f74bfec..1a58c93 100644 --- a/NetworkManager-libreswan.spec +++ b/NetworkManager-libreswan.spec @@ -15,7 +15,7 @@ Summary: NetworkManager VPN plug-in for IPsec VPN Name: NetworkManager-libreswan Version: 1.2.27 -Release: 2%{?dist} +Release: 3%{?dist} License: GPL-2.0-or-later URL: https://gitlab.gnome.org/GNOME/NetworkManager-libreswan Source0: https://download.gnome.org/sources/NetworkManager-libreswan/1.2/%{name}-%{version}.tar.xz @@ -23,6 +23,7 @@ Source0: https://download.gnome.org/sources/NetworkManager-libreswan/1.2/%{nam Patch0: 0001-Export-esp-option.patch Patch1: 0002-fix-psk-auth-when-leftid-starts-with-at.patch Patch2: 0003-import-export-nm-auto-defaults-no.patch +Patch3: 0004-sanitize-before-exporting-RHEL-only.patch BuildRequires: make BuildRequires: gcc @@ -127,6 +128,9 @@ mv %{buildroot}%{_sysconfdir}/dbus-1 %{buildroot}%{_datadir}/ %changelog +* Tue Oct 21 2025 Vladimír Beneš - 1.2.27-3 +- Fix a regression in nm-auto-defaults=yes + * Mon Oct 20 2025 Vladimír Beneš - 1.2.27-2 * Symetric import/export with nm-auto-default (RHEL-119641) * Esp param properly exported (RHEL-119653)