rpms/NetworkManager-libreswan
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Compare commits

merge into: rpms:c8
Branches Tags
rpms:c8
rpms:c10s
rpms:c9s
rpms:c9-beta
rpms:c9
rpms:c8-beta
rpms:c8s
rpms:a9
rpms:imports/c10s/NetworkManager-libreswan-1.2.24-2.el10
rpms:imports/c8/NetworkManager-libreswan-1.2.10-7.el8_10
rpms:imports/c10s/NetworkManager-libreswan-1.2.24-1.el10
rpms:imports/c9-beta/NetworkManager-libreswan-1.2.22-1.el9
rpms:imports/c10s/NetworkManager-libreswan-1.2.22-3.el10
rpms:imports/c9/NetworkManager-libreswan-1.2.18-3.el9_4
rpms:imports/c10s/NetworkManager-libreswan-1.2.22-2.el10
rpms:imports/c8/NetworkManager-libreswan-1.2.10-5.el8
rpms:imports/c9/NetworkManager-libreswan-1.2.18-2.el9
rpms:changed/a9/NetworkManager-libreswan-1.2.14-3.el9_3.alma.1
rpms:changed/a9/NetworkManager-libreswan-1.2.14-2.el9_3.alma.1
rpms:imports/c8s/NetworkManager-libreswan-1.2.10-4.el8
rpms:imports/c9/NetworkManager-libreswan-1.2.14-1.el9.3
rpms:imports/c9-beta/NetworkManager-libreswan-1.2.14-1.el9.3
rpms:imports/c8-beta/NetworkManager-libreswan-1.2.10-4.el8
rpms:imports/c8-beta/NetworkManager-libreswan-1.2.10-3.el8
rpms:imports/c8/NetworkManager-libreswan-1.2.10-4.el8
rpms:imports/c8/NetworkManager-libreswan-1.2.10-3.el8
...
pull from: rpms:c9
Branches Tags
rpms:c10s
rpms:c8
rpms:c9s
rpms:c9-beta
rpms:c9
rpms:c8-beta
rpms:c8s
rpms:a9
rpms:imports/c10s/NetworkManager-libreswan-1.2.24-2.el10
rpms:imports/c8/NetworkManager-libreswan-1.2.10-7.el8_10
rpms:imports/c10s/NetworkManager-libreswan-1.2.24-1.el10
rpms:imports/c9-beta/NetworkManager-libreswan-1.2.22-1.el9
rpms:imports/c10s/NetworkManager-libreswan-1.2.22-3.el10
rpms:imports/c9/NetworkManager-libreswan-1.2.18-3.el9_4
rpms:imports/c10s/NetworkManager-libreswan-1.2.22-2.el10
rpms:imports/c8/NetworkManager-libreswan-1.2.10-5.el8
rpms:imports/c9/NetworkManager-libreswan-1.2.18-2.el9
rpms:changed/a9/NetworkManager-libreswan-1.2.14-3.el9_3.alma.1
rpms:changed/a9/NetworkManager-libreswan-1.2.14-2.el9_3.alma.1
rpms:imports/c8s/NetworkManager-libreswan-1.2.10-4.el8
rpms:imports/c9/NetworkManager-libreswan-1.2.14-1.el9.3
rpms:imports/c9-beta/NetworkManager-libreswan-1.2.14-1.el9.3
rpms:imports/c8-beta/NetworkManager-libreswan-1.2.10-4.el8
rpms:imports/c8-beta/NetworkManager-libreswan-1.2.10-3.el8
rpms:imports/c8/NetworkManager-libreswan-1.2.10-4.el8
rpms:imports/c8/NetworkManager-libreswan-1.2.10-3.el8

No commits in common. "c8" and "c9" have entirely different histories.
c8 ... c9

13 changed files with 651 additions and 26001 deletions
Show Stats Expand all files Collapse all files

2
.NetworkManager-libreswan.metadata
View File

@ -1 +1 @@
a3ec22a8e76f3358d9f69dc505d22267e936dbae SOURCES/NetworkManager-libreswan-1.2.10.tar.xz
a57014f8a1c360546cb7fed5231efd7cfbf85bf3 SOURCES/NetworkManager-libreswan-1.2.18.tar.xz

2
.gitignore vendored
View File

@ -1 +1 @@
SOURCES/NetworkManager-libreswan-1.2.10.tar.xz
SOURCES/NetworkManager-libreswan-1.2.18.tar.xz

24409
SOURCES/0001-po-import-translations-from-Red-Hat-translators.patch
View File

File diff suppressed because it is too large Load Diff

79
SOURCES/0001-service-properties-add-support-for-leftmodecfgclient.patch Normal file
View File

@ -0,0 +1,79 @@
From 0f0b2d375901e302e8a619e3911321f511b52885 Mon Sep 17 00:00:00 2001
From: Beniamino Galvani <bgalvani@redhat.com>
Date: Tue, 9 Jan 2024 23:30:42 +0100
Subject: [PATCH 1/5] service,properties: add support for leftmodecfgclient
Previously the plugin always set leftmodecfgclient=yes, which is used
for roaming clients to obtain a dynamic IP. In a server-to-server
scenario we don't want that option; allow omitting it by passing
leftmodecfgclient=no. It's somehow confusing that the new option has
the opposite default value than Libreswan, but that's the only way to
keep backwards compatibility for existing configurations.
---
properties/nm-libreswan-dialog.ui | 26 +++++++++++++++++++++++++
properties/nm-libreswan-editor-plugin.c | 2 ++
properties/nm-libreswan-editor.c | 9 +++++++++
shared/nm-service-defines.h | 1 +
shared/utils.c | 8 +++++++-
src/nm-libreswan-service.c | 1 +
6 files changed, 46 insertions(+), 1 deletion(-)
diff --git a/properties/nm-libreswan-editor-plugin.c b/properties/nm-libreswan-editor-plugin.c
index b5c0d9e..89243cc 100644
--- a/properties/nm-libreswan-editor-plugin.c
+++ b/properties/nm-libreswan-editor-plugin.c
@@ -182,6 +182,8 @@ import_from_file (NMVpnEditorPlugin *self,
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTUSERNAME, &str[13]);
else if (g_str_has_prefix (str, "leftcert="))
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTCERT, &str[9]);
+ else if (nm_streq0 (str, "leftmodecfgclient=no"))
+ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT, "no");
else if (g_str_has_prefix (str, "pfs=no"))
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_PFS, "no");
else if (g_str_has_prefix (str, "cisco-unity=yes"))
diff --git a/shared/nm-service-defines.h b/shared/nm-service-defines.h
index 3fdf2ef..14170ad 100644
--- a/shared/nm-service-defines.h
+++ b/shared/nm-service-defines.h
@@ -41,6 +41,7 @@
#define NM_LIBRESWAN_KEY_LEFTID "leftid"
#define NM_LIBRESWAN_KEY_LEFTRSASIGKEY "leftrsasigkey"
#define NM_LIBRESWAN_KEY_LEFTCERT "leftcert"
+#define NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT "leftmodecfgclient"
#define NM_LIBRESWAN_KEY_AUTHBY "authby"
#define NM_LIBRESWAN_KEY_PSK_VALUE "pskvalue"
#define NM_LIBRESWAN_KEY_PSK_INPUT_MODES "pskinputmodes"
diff --git a/shared/utils.c b/shared/utils.c
index cbc117c..0bac9e6 100644
--- a/shared/utils.c
+++ b/shared/utils.c
@@ -191,7 +191,13 @@ nm_libreswan_config_write (gint fd,
else
WRITE_CHECK (fd, debug_write_fcn, error, " left=%%defaultroute");
- WRITE_CHECK (fd, debug_write_fcn, error, " leftmodecfgclient=yes");
+ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT);
+ if (nm_streq0 (item, "no")) {
+ WRITE_CHECK (fd, debug_write_fcn, error, " leftmodecfgclient=no");
+ } else {
+ WRITE_CHECK (fd, debug_write_fcn, error, " leftmodecfgclient=yes");
+ }
+
if (leftupdown_script)
WRITE_CHECK (fd, debug_write_fcn, error, " leftupdown=%s", leftupdown_script);
diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c
index fc470a6..874f767 100644
--- a/src/nm-libreswan-service.c
+++ b/src/nm-libreswan-service.c
@@ -256,6 +256,7 @@ static ValidProperty valid_properties[] = {
{ NM_LIBRESWAN_KEY_LEFTUSERNAME, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_LEFTRSASIGKEY, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_LEFTCERT, G_TYPE_STRING, 0, 0 },
+ { NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_AUTHBY, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_DOMAIN, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_DHGROUP, G_TYPE_STRING, 0, 0 },
--
2.43.0

26
SOURCES/0002-properties-set-advanced-dialog-modal.patch
View File

@ -1,26 +0,0 @@
From eaf501ab7cb732a152097d2af5636b03fd3f029d Mon Sep 17 00:00:00 2001
From: Francesco Giudici <fgiudici@redhat.com>
Date: Mon, 15 Apr 2019 14:51:26 +0200
Subject: [PATCH] properties: set advanced dialog modal
https://bugzilla.redhat.com/show_bug.cgi?id=1697329
---
properties/nm-libreswan-dialog.ui | 2 ++
1 file changed, 2 insertions(+)
diff --git a/properties/nm-libreswan-dialog.ui b/properties/nm-libreswan-dialog.ui
index 73522d4..e355c08 100644
--- a/properties/nm-libreswan-dialog.ui
+++ b/properties/nm-libreswan-dialog.ui
@@ -451,6 +451,8 @@
<property name="can_focus">False</property>
<property name="border_width">12</property>
<property name="title" translatable="yes">IPsec Advanced Options</property>
+ <property name="modal">True</property>
+ <property name="destroy_with_parent">True</property>
<property name="type_hint">dialog</property>
<child internal-child="vbox">
<object class="GtkBox" id="dialog-vbox1">
--
2.20.1

137
SOURCES/0002-service-use-new-API-to-send-configuration-to-NM.patch Normal file
View File

@ -0,0 +1,137 @@
From 09ee8838162cb6ea097375fb7d8b698566bb1c4d Mon Sep 17 00:00:00 2001
From: Beniamino Galvani <bgalvani@redhat.com>
Date: Wed, 10 Jan 2024 09:29:50 +0100
Subject: [PATCH 2/5] service: use new API to send configuration to NM
Instead of emitting the "Ip4Config" signal that contains both generic
and IPv4 configurations, use the more recent API and send two signals:
"Config" for the generic configuration and "Ip4Config" for IPv4
configuration.
In this way, it will be possible in the next commit to return no IPv4
configuration at all.
---
src/nm-libreswan-service.c | 61 +++++++++++++++++++++++++-------------
1 file changed, 40 insertions(+), 21 deletions(-)
diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c
index 874f767..2aca78f 100644
--- a/src/nm-libreswan-service.c
+++ b/src/nm-libreswan-service.c
@@ -1270,16 +1270,14 @@ handle_callback (NMDBusLibreswanHelper *object,
goto out;
}
+ /* First build and send the generic config */
g_variant_builder_init (&config, G_VARIANT_TYPE_VARDICT);
- /* Right peer (or Gateway) */
- val = addr4_to_gvariant (lookup_string (env, "PLUTO_PEER"));
- if (val)
- g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_GATEWAY, val);
- else {
- _LOGW ("IPsec/Pluto Right Peer (VPN Gateway)");
- goto out;
- }
+ /*
+ * Enabled address families
+ */
+ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP4, g_variant_new_boolean (TRUE));
+ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP6, g_variant_new_boolean (FALSE));
/*
* Tunnel device
@@ -1290,15 +1288,43 @@ handle_callback (NMDBusLibreswanHelper *object,
} else {
val = g_variant_new_string (NM_VPN_PLUGIN_IP4_CONFIG_TUNDEV_NONE);
}
+ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_TUNDEV, val);
+
+ /* Banner */
+ val = str_to_gvariant (lookup_string (env, "PLUTO_PEER_BANNER"), TRUE);
+ if (val)
+ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_BANNER, val);
+
+ /* Right peer (or Gateway) */
+ val = addr4_to_gvariant (lookup_string (env, "PLUTO_PEER"));
+ if (val)
+ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_EXT_GATEWAY, val);
+ else {
+ _LOGW ("IPsec/Pluto Right Peer (VPN Gateway) is missing");
+ goto out;
+ }
+
+ nm_vpn_service_plugin_set_config (NM_VPN_SERVICE_PLUGIN (user_data),
+ g_variant_builder_end (&config));
- g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_TUNDEV, val);
+ /* Then build and send the IPv4 config */
+ g_variant_builder_init (&config, G_VARIANT_TYPE_VARDICT);
+
+ /* Right peer (or Gateway) */
+ val = addr4_to_gvariant (lookup_string (env, "PLUTO_PEER"));
+ if (val)
+ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_GATEWAY, val);
+ else {
+ _LOGW ("IPsec/Pluto Right Peer (VPN Gateway) is missing");
+ goto out;
+ }
/* IP address */
val = addr4_to_gvariant (lookup_string (env, "PLUTO_MY_SOURCEIP"));
if (val)
g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_ADDRESS, val);
else {
- _LOGW ("IP4 Address");
+ _LOGW ("IP4 Address is missing");
goto out;
}
@@ -1307,7 +1333,7 @@ handle_callback (NMDBusLibreswanHelper *object,
if (val)
g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_PTP, val);
else {
- _LOGW ("IP4 PTP Address");
+ _LOGW ("IP4 PTP Address is missing");
goto out;
}
@@ -1324,7 +1350,6 @@ handle_callback (NMDBusLibreswanHelper *object,
if (val)
g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_DNS, val);
-
/* Default domain */
val = str_to_gvariant (lookup_string (env, "PLUTO_CISCO_DOMAIN_INFO"), TRUE);
if (!val) {
@@ -1334,11 +1359,6 @@ handle_callback (NMDBusLibreswanHelper *object,
if (val)
g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_DOMAIN, val);
- /* Banner */
- val = str_to_gvariant (lookup_string (env, "PLUTO_PEER_BANNER"), TRUE);
- if (val)
- g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_BANNER, val);
-
/* Indicates whether the VPN is using a XFRM interface (via option ipsec-interface=) */
is_xfrmi = nm_streq0 (lookup_string (env, "PLUTO_XFRMI_ROUTE"), "yes");
@@ -1369,12 +1389,11 @@ handle_callback (NMDBusLibreswanHelper *object,
g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_NEVER_DEFAULT, g_variant_new_boolean (TRUE));
success = TRUE;
+ nm_vpn_service_plugin_set_ip4_config (NM_VPN_SERVICE_PLUGIN (user_data),
+ g_variant_builder_end (&config));
out:
- if (success) {
- nm_vpn_service_plugin_set_ip4_config (NM_VPN_SERVICE_PLUGIN (user_data),
- g_variant_builder_end (&config));
- } else {
+ if (!success) {
connect_failed (NM_LIBRESWAN_PLUGIN (user_data), NULL,
NM_VPN_PLUGIN_FAILURE_CONNECT_FAILED);
}
--
2.43.0

72
SOURCES/0003-service-don-t-send-IPv4-config-if-mode-config-client.patch Normal file
View File

@ -0,0 +1,72 @@
From 74ec0f7dc18939dd4a5992584527ab044b284fc0 Mon Sep 17 00:00:00 2001
From: Beniamino Galvani <bgalvani@redhat.com>
Date: Wed, 10 Jan 2024 09:31:48 +0100
Subject: [PATCH 3/5] service: don't send IPv4 config if mode config client is
disabled
If the mode config client is disabled (i.e. in server-to-server
scenario) we are not going to receive a dynamic IP. The IP address
already configured on the existing interface is enough.
---
src/nm-libreswan-service.c | 20 +++++++++++++++++++-
1 file changed, 19 insertions(+), 1 deletion(-)
diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c
index 2aca78f..12cf6f2 100644
--- a/src/nm-libreswan-service.c
+++ b/src/nm-libreswan-service.c
@@ -1253,6 +1253,7 @@ handle_callback (NMDBusLibreswanHelper *object,
gpointer user_data)
{
NMLibreswanPluginPrivate *priv = NM_LIBRESWAN_PLUGIN_GET_PRIVATE (user_data);
+ NMSettingVpn *s_vpn;
GVariantBuilder config;
GVariantBuilder builder;
GVariant *val;
@@ -1260,7 +1261,9 @@ handle_callback (NMDBusLibreswanHelper *object,
guint i;
const char *verb;
const char *virt_if;
+ const char *str;
gboolean is_xfrmi = FALSE;
+ gboolean has_ip4;
_LOGI ("Configuration from the helper received.");
@@ -1273,10 +1276,21 @@ handle_callback (NMDBusLibreswanHelper *object,
/* First build and send the generic config */
g_variant_builder_init (&config, G_VARIANT_TYPE_VARDICT);
+ if ( priv->connection
+ && (s_vpn = nm_connection_get_setting_vpn (priv->connection))
+ && (str = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT))
+ && nm_streq (str, "no")) {
+ has_ip4 = FALSE;
+ } else {
+ has_ip4 = TRUE;
+ }
+
+ _LOGD ("Configuration has IPv4: %d", has_ip4);
+
/*
* Enabled address families
*/
- g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP4, g_variant_new_boolean (TRUE));
+ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP4, g_variant_new_boolean (has_ip4));
g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP6, g_variant_new_boolean (FALSE));
/*
@@ -1306,6 +1320,10 @@ handle_callback (NMDBusLibreswanHelper *object,
nm_vpn_service_plugin_set_config (NM_VPN_SERVICE_PLUGIN (user_data),
g_variant_builder_end (&config));
+ if (!has_ip4) {
+ success = TRUE;
+ goto out;
+ }
/* Then build and send the IPv4 config */
g_variant_builder_init (&config, G_VARIANT_TYPE_VARDICT);
--
2.43.0

1512
SOURCES/0004-ipsec-conf-escaping-cve-2024-9050.patch
View File

File diff suppressed because it is too large Load Diff

9
SOURCES/0003-service-fix-wrong-refcounting-in-D-Bus-handler-for-C.patch → SOURCES/0004-service-fix-wrong-refcounting-in-D-Bus-handler-for-C.patch
View File

@ -1,7 +1,7 @@
From 4be4c56b4f8a52b1cd5f8aadee273706c28ae332 Mon Sep 17 00:00:00 2001
From 8ceb901719acac3778e1d76779d9c14289185157 Mon Sep 17 00:00:00 2001
From: Beniamino Galvani <bgalvani@redhat.com>
Date: Sat, 13 Jan 2024 18:10:02 +0100
Subject: [PATCH 1/1] service: fix wrong refcounting in D-Bus handler for
Subject: [PATCH 4/5] service: fix wrong refcounting in D-Bus handler for
Callback()
The Callback() D-Bus method is handled via a GDBus-generated skeleton
@ -44,16 +44,15 @@ Since the G_DBUS_METHOD_INVOCATION_HANDLED alias for TRUE is only
available since GLib 2.68 (while we target 2.36), just return TRUE.
Fixes: acb9eb9de50b ('service: process the configuration in the service, not the helper')
(cherry picked from commit 8ceb901719acac3778e1d76779d9c14289185157)
---
src/nm-libreswan-service.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c
index fc470a6..4850729 100644
index 12cf6f2..0d5c4b8 100644
--- a/src/nm-libreswan-service.c
+++ b/src/nm-libreswan-service.c
@@ -1379,7 +1379,8 @@ out:
@@ -1417,7 +1417,8 @@ out:
}
nmdbus_libreswan_helper_complete_callback (object, invocation);

91
SOURCES/0005-service-properties-support-type-hostaddrfamily-clien.patch Normal file
View File

@ -0,0 +1,91 @@
From b4ba2add64bd9d362fe2e66748f23449f072216b Mon Sep 17 00:00:00 2001
From: Beniamino Galvani <bgalvani@redhat.com>
Date: Mon, 15 Jan 2024 13:23:45 +0100
Subject: [PATCH 5/5] service,properties: support type, hostaddrfamily,
clientaddrfamily
Add support for:
- type
- hostaddrfamily
- clientaddrfamily
Since those are very advanced options, don't implement the GUI part
for now.
---
properties/nm-libreswan-editor-plugin.c | 6 ++++++
shared/nm-service-defines.h | 3 +++
shared/utils.c | 12 ++++++++++++
src/nm-libreswan-service.c | 3 +++
4 files changed, 24 insertions(+)
diff --git a/properties/nm-libreswan-editor-plugin.c b/properties/nm-libreswan-editor-plugin.c
index 89243cc..fe85c81 100644
--- a/properties/nm-libreswan-editor-plugin.c
+++ b/properties/nm-libreswan-editor-plugin.c
@@ -206,6 +206,12 @@ import_from_file (NMVpnEditorPlugin *self,
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_IPSEC_INTERFACE, &str[16]);
else if (g_str_has_prefix (str, "authby="))
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_AUTHBY, &str[7]);
+ else if (g_str_has_prefix (str, "type="))
+ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_TYPE, str + NM_STRLEN("type="));
+ else if (g_str_has_prefix (str, "hostaddrfamily="))
+ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_HOSTADDRFAMILY, str + NM_STRLEN("hostaddrfamily="));
+ else if (g_str_has_prefix (str, "clientaddrfamily="))
+ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_CLIENTADDRFAMILY, str + NM_STRLEN("clientaddrfamily="));
else if (g_str_has_prefix (str, "rightsubnet=")) {
if (!g_str_has_prefix (str, "rightsubnet=0.0.0.0/0"))
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_REMOTENETWORK, &str[12]);
diff --git a/shared/nm-service-defines.h b/shared/nm-service-defines.h
index 14170ad..95e19d4 100644
--- a/shared/nm-service-defines.h
+++ b/shared/nm-service-defines.h
@@ -68,6 +68,9 @@
#define NM_LIBRESWAN_KEY_FRAGMENTATION "fragmentation"
#define NM_LIBRESWAN_KEY_MOBIKE "mobike"
#define NM_LIBRESWAN_KEY_IPSEC_INTERFACE "ipsec-interface"
+#define NM_LIBRESWAN_KEY_TYPE "type"
+#define NM_LIBRESWAN_KEY_HOSTADDRFAMILY "hostaddrfamily"
+#define NM_LIBRESWAN_KEY_CLIENTADDRFAMILY "clientaddrfamily"
#define NM_LIBRESWAN_IKEV2_NO "no"
#define NM_LIBRESWAN_IKEV2_NEVER "never"
diff --git a/shared/utils.c b/shared/utils.c
index 0bac9e6..9e616f8 100644
--- a/shared/utils.c
+++ b/shared/utils.c
@@ -325,6 +325,18 @@ nm_libreswan_config_write (gint fd,
if (item && strlen (item))
WRITE_CHECK (fd, debug_write_fcn, error, " ipsec-interface=%s", item);
+ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_TYPE);
+ if (item && strlen (item))
+ WRITE_CHECK (fd, debug_write_fcn, error, " type=%s", item);
+
+ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_HOSTADDRFAMILY);
+ if (item && strlen (item))
+ WRITE_CHECK (fd, debug_write_fcn, error, " hostaddrfamily=%s", item);
+
+ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_CLIENTADDRFAMILY);
+ if (item && strlen (item))
+ WRITE_CHECK (fd, debug_write_fcn, error, " clientaddrfamily=%s", item);
+
WRITE_CHECK (fd, debug_write_fcn, error, " nm-configured=yes");
WRITE_CHECK_NEWLINE (fd, trailing_newline, debug_write_fcn, error, " auto=add");
diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c
index 0d5c4b8..7e96230 100644
--- a/src/nm-libreswan-service.c
+++ b/src/nm-libreswan-service.c
@@ -277,6 +277,9 @@ static ValidProperty valid_properties[] = {
{ NM_LIBRESWAN_KEY_FRAGMENTATION, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_MOBIKE, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_IPSEC_INTERFACE, G_TYPE_STRING, 0, 0 },
+ { NM_LIBRESWAN_KEY_TYPE, G_TYPE_STRING, 0, 0 },
+ { NM_LIBRESWAN_KEY_HOSTADDRFAMILY, G_TYPE_STRING, 0, 0 },
+ { NM_LIBRESWAN_KEY_CLIENTADDRFAMILY, G_TYPE_STRING, 0, 0 },
/* Ignored option for internal use */
{ NM_LIBRESWAN_KEY_PSK_INPUT_MODES, G_TYPE_NONE, 0, 0 },
{ NM_LIBRESWAN_KEY_XAUTH_PASSWORD_INPUT_MODES, G_TYPE_NONE, 0, 0 },
--
2.43.0

71
SOURCES/0006-add-support-leftsubnet.patch Normal file
View File

@ -0,0 +1,71 @@
From 2045cdf3dec79ae7d7b03ca7a081b8c444e242ef Mon Sep 17 00:00:00 2001
From: Beniamino Galvani <bgalvani@redhat.com>
Date: Wed, 10 Apr 2024 13:23:56 +0200
Subject: [PATCH] service,properties: support "leftsubnet"
https://gitlab.gnome.org/GNOME/NetworkManager-libreswan/-/merge_requests/30
---
properties/nm-libreswan-dialog.ui | 42 ++++++++++++++++++++-----
properties/nm-libreswan-editor-plugin.c | 2 ++
properties/nm-libreswan-editor.c | 12 +++++++
shared/nm-service-defines.h | 1 +
shared/utils.c | 5 +++
src/nm-libreswan-service.c | 1 +
6 files changed, 56 insertions(+), 7 deletions(-)
diff --git a/properties/nm-libreswan-editor-plugin.c b/properties/nm-libreswan-editor-plugin.c
index fe85c81..bb1685d 100644
--- a/properties/nm-libreswan-editor-plugin.c
+++ b/properties/nm-libreswan-editor-plugin.c
@@ -215,6 +215,8 @@ import_from_file (NMVpnEditorPlugin *self,
else if (g_str_has_prefix (str, "rightsubnet=")) {
if (!g_str_has_prefix (str, "rightsubnet=0.0.0.0/0"))
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_REMOTENETWORK, &str[12]);
+ } else if (g_str_has_prefix (str, "leftsubnet=")) {
+ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LOCALNETWORK, str + NM_STRLEN("leftsubnet="));
} else if (g_str_has_prefix (str, "leftrsasigkey=")) {
if (str[14] != '%')
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTRSASIGKEY, &str[14]);
diff --git a/shared/nm-service-defines.h b/shared/nm-service-defines.h
index 95e19d4..96e5c71 100644
--- a/shared/nm-service-defines.h
+++ b/shared/nm-service-defines.h
@@ -62,6 +62,7 @@
#define NM_LIBRESWAN_KEY_SALIFETIME "salifetime"
#define NM_LIBRESWAN_KEY_VENDOR "vendor"
#define NM_LIBRESWAN_KEY_REMOTENETWORK "rightsubnet"
+#define NM_LIBRESWAN_KEY_LOCALNETWORK "leftsubnet"
#define NM_LIBRESWAN_KEY_IKEV2 "ikev2"
#define NM_LIBRESWAN_KEY_NARROWING "narrowing"
#define NM_LIBRESWAN_KEY_REKEY "rekey"
diff --git a/shared/utils.c b/shared/utils.c
index 9e616f8..926d12d 100644
--- a/shared/utils.c
+++ b/shared/utils.c
@@ -222,6 +222,11 @@ nm_libreswan_config_write (gint fd,
WRITE_CHECK (fd, debug_write_fcn, error, " rightsubnet=%s",
remote_network);
+ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LOCALNETWORK);
+ if (item) {
+ WRITE_CHECK (fd, debug_write_fcn, error, " leftsubnet=%s", item);
+ }
+
if (!is_ikev2) {
/* When IKEv1 is in place, we enforce XAUTH: so, use IKE version
* also to check if XAUTH conf options should be passed to Libreswan.
diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c
index 7e96230..88c07d7 100644
--- a/src/nm-libreswan-service.c
+++ b/src/nm-libreswan-service.c
@@ -271,6 +271,7 @@ static ValidProperty valid_properties[] = {
{ NM_LIBRESWAN_KEY_SALIFETIME, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_VENDOR, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_REMOTENETWORK, G_TYPE_STRING, 0, 0 },
+ { NM_LIBRESWAN_KEY_LOCALNETWORK, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_IKEV2, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_NARROWING, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_REKEY, G_TYPE_STRING, 0, 0 },
--
2.44.0

107
SOURCES/0007-add-rightcert-property.patch Normal file
View File

@ -0,0 +1,107 @@
0001-properties-service-suppor-rightcert-configuration.patch
0002-properties-add-Remote-certificate-field-to-the-dialo.patch
From a980e399694c0a9887d98f1e0f0f24a201cb29c7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=8D=C3=B1igo=20Huguet?= <ihuguet@redhat.com>
Date: Mon, 15 Apr 2024 10:42:08 +0200
Subject: [PATCH 1/2] properties, service: suppor rightcert configuration
This configuration allows to specify a certificate from the NSS database
to identify the remote, instead of pulling it.
(cherry picked from commit 2684233fd1c65c221d1f18c9d5b779c616c6d091)
---
properties/nm-libreswan-editor-plugin.c | 2 ++
shared/nm-service-defines.h | 1 +
shared/utils.c | 7 +++++++
src/nm-libreswan-service.c | 8 ++++++--
4 files changed, 16 insertions(+), 2 deletions(-)
diff --git a/properties/nm-libreswan-editor-plugin.c b/properties/nm-libreswan-editor-plugin.c
index bb1685d..fe473d1 100644
--- a/properties/nm-libreswan-editor-plugin.c
+++ b/properties/nm-libreswan-editor-plugin.c
@@ -182,6 +182,8 @@ import_from_file (NMVpnEditorPlugin *self,
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTUSERNAME, &str[13]);
else if (g_str_has_prefix (str, "leftcert="))
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTCERT, &str[9]);
+ else if (g_str_has_prefix (str, "rightcert="))
+ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTCERT, &str[10]);
else if (nm_streq0 (str, "leftmodecfgclient=no"))
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT, "no");
else if (g_str_has_prefix (str, "pfs=no"))
diff --git a/shared/nm-service-defines.h b/shared/nm-service-defines.h
index 96e5c71..167b837 100644
--- a/shared/nm-service-defines.h
+++ b/shared/nm-service-defines.h
@@ -37,6 +37,7 @@
#define NM_LIBRESWAN_KEY_RIGHT "right"
#define NM_LIBRESWAN_KEY_RIGHTID "rightid"
#define NM_LIBRESWAN_KEY_RIGHTRSASIGKEY "rightrsasigkey"
+#define NM_LIBRESWAN_KEY_RIGHTCERT "rightcert"
#define NM_LIBRESWAN_KEY_LEFT "left"
#define NM_LIBRESWAN_KEY_LEFTID "leftid"
#define NM_LIBRESWAN_KEY_LEFTRSASIGKEY "leftrsasigkey"
diff --git a/shared/utils.c b/shared/utils.c
index 926d12d..5e19316 100644
--- a/shared/utils.c
+++ b/shared/utils.c
@@ -108,6 +108,7 @@ nm_libreswan_config_write (gint fd,
const char *left;
const char *leftid;
const char *leftcert;
+ const char *rightcert;
const char *leftrsasigkey;
const char *rightrsasigkey;
const char *authby;
@@ -165,7 +166,13 @@ nm_libreswan_config_write (gint fd,
leftrsasigkey = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTRSASIGKEY);
rightrsasigkey = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTRSASIGKEY);
leftcert = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTCERT);
+ rightcert = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTCERT);
authby = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_AUTHBY);
+ if (rightcert && strlen (rightcert)) {
+ WRITE_CHECK (fd, debug_write_fcn, error, " rightcert=%s", rightcert);
+ if (!rightrsasigkey)
+ rightrsasigkey = "%cert";
+ }
if (leftcert && strlen (leftcert)) {
WRITE_CHECK (fd, debug_write_fcn, error, " leftcert=%s", leftcert);
if (!leftrsasigkey)
diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c
index 88c07d7..516eaac 100644
--- a/src/nm-libreswan-service.c
+++ b/src/nm-libreswan-service.c
@@ -250,6 +250,7 @@ static ValidProperty valid_properties[] = {
{ NM_LIBRESWAN_KEY_RIGHT, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_RIGHTID, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_RIGHTRSASIGKEY, G_TYPE_STRING, 0, 0 },
+ { NM_LIBRESWAN_KEY_RIGHTCERT, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_LEFT, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_LEFTID, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_LEFTXAUTHUSER, G_TYPE_STRING, 0, 0 },
@@ -1801,6 +1802,7 @@ real_need_secrets (NMVpnServicePlugin *plugin,
NMSettingVpn *s_vpn;
const char *leftcert;
const char *leftrsasigkey;
+ const char *rightcert;
const char *rightrsasigkey;
const char *pw_type;
@@ -1821,10 +1823,12 @@ real_need_secrets (NMVpnServicePlugin *plugin,
if (leftcert)
goto xauth_check;
- /* If authentication is done through rsasigkeys, only the public keys are required */
+ /* If authentication is done through rsasigkeys, only the public keys are required.
+ * If rightcert is specified, rightrsasigkey is assumed to be '%cert' */
leftrsasigkey = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTRSASIGKEY);
rightrsasigkey = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTRSASIGKEY);
- if (leftrsasigkey && rightrsasigkey)
+ rightcert = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTCERT);
+ if (leftrsasigkey && (rightrsasigkey || rightcert))
goto xauth_check;
pw_type = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_PSK_INPUT_MODES);
--
2.44.0

135
SPECS/NetworkManager-libreswan.spec
View File

@ -1,26 +1,42 @@
%if 0%{?fedora} < 28 && 0%{?rhel} < 8
%bcond_without libnm_glib
%else
# Disable the legacy version by default
%bcond_with libnm_glib
%endif
%if 0%{?fedora} < 36 && 0%{?rhel} < 10
%bcond_with gtk4
%else
%bcond_without gtk4
%endif
%global real_version 1.2.18
%global rpm_version 1.2.18
%global release_version 3
%global real_version_major %(printf '%s' '%{real_version}' | sed -n 's/^\\([1-9][0-9]*\\.[1-9][0-9]*\\)\\.[1-9][0-9]*$/\\1/p')
%global nm_version 1:1.2.0
%global nma_version 1.2.0
%global nm_version 1:1.2.0
%global nma_version 1.2.0
Summary: NetworkManager VPN plug-in for IPsec VPN
Name: NetworkManager-libreswan
Version: 1.2.10
Release: 7%{?dist}
Version: %{rpm_version}
Release: %{release_version}%{?dist}
License: GPLv2+
URL: http://www.gnome.org/projects/NetworkManager/
Group: System Environment/Base
Source0: https://download.gnome.org/sources/NetworkManager-libreswan/1.2/%{name}-%{version}.tar.xz
Patch0: 0001-po-import-translations-from-Red-Hat-translators.patch
Patch1: 0002-properties-set-advanced-dialog-modal.patch
Patch2: 0003-service-fix-wrong-refcounting-in-D-Bus-handler-for-C.patch
Patch3: 0004-ipsec-conf-escaping-cve-2024-9050.patch
Source0: https://download.gnome.org/sources/NetworkManager-libreswan/%{real_version_major}/%{name}-%{real_version}.tar.xz
Patch1: 0001-service-properties-add-support-for-leftmodecfgclient.patch
Patch2: 0002-service-use-new-API-to-send-configuration-to-NM.patch
Patch3: 0003-service-don-t-send-IPv4-config-if-mode-config-client.patch
Patch4: 0004-service-fix-wrong-refcounting-in-D-Bus-handler-for-C.patch
Patch5: 0005-service-properties-support-type-hostaddrfamily-clien.patch
Patch6: 0006-add-support-leftsubnet.patch
Patch7: 0007-add-rightcert-property.patch
BuildRequires: make
BuildRequires: gcc
BuildRequires: gtk3-devel
BuildRequires: libnl3-devel
BuildRequires: NetworkManager-libnm-devel >= %{nm_version}
@ -34,6 +50,10 @@ BuildRequires: NetworkManager-glib-devel >= %{nm_version}
BuildRequires: libnm-gtk-devel >= %{nma_version}
%endif
%if %with gtk4
BuildRequires: libnma-gtk4-devel
%endif
Requires: NetworkManager >= %{nm_version}
Requires: dbus
Requires: /usr/sbin/ipsec
@ -45,13 +65,14 @@ Obsoletes: NetworkManager-openswan < %{version}-%{release}
%global __provides_exclude ^(%{_privatelibs})$
%global __requires_exclude ^(%{_privatelibs})$
%description
This package contains software for integrating the libreswan VPN software
with NetworkManager and the GNOME desktop
%package -n NetworkManager-libreswan-gnome
Summary: NetworkManager VPN plugin for libreswan - GNOME files
Group: System Environment/Base
Requires: %{name}%{?_isa} = %{version}-%{release}
Requires: shared-mime-info
@ -63,12 +84,17 @@ Obsoletes: NetworkManager-openswan-gnome < %{version}-%{release}
This package contains software for integrating VPN capabilities with
the libreswan server with NetworkManager (GNOME files).
%prep
%autosetup -p1 -n %{name}-%{version}
%autosetup -p1 -n "%{name}-%{real_version}"
%build
%configure \
--disable-static \
%if %with gtk4
--with-gtk4 \
%endif
%if %without libnm_glib
--without-libnm-glib \
%endif
@ -76,18 +102,13 @@ the libreswan server with NetworkManager (GNOME files).
--with-dist-version=%{version}-%{release}
make %{?_smp_mflags}
%install
make install DESTDIR=%{buildroot}
rm -f %{buildroot}%{_libdir}/NetworkManager/lib*.la
%find_lang %{name}
%post
update-desktop-database &> /dev/null || :
%postun
update-desktop-database &> /dev/null || :
%files -f %{name}.lang
%{_libdir}/NetworkManager/libnm-vpn-plugin-libreswan.so
%{_sysconfdir}/dbus-1/system.d/nm-libreswan-service.conf
@ -95,55 +116,75 @@ update-desktop-database &> /dev/null || :
%{_libexecdir}/nm-libreswan-service
%{_libexecdir}/nm-libreswan-service-helper
%{_mandir}/man5/nm-settings-libreswan.5.gz
%doc AUTHORS ChangeLog NEWS
%doc AUTHORS NEWS
%license COPYING
%files -n NetworkManager-libreswan-gnome
%{_libexecdir}/nm-libreswan-auth-dialog
%{_libdir}/NetworkManager/libnm-vpn-plugin-libreswan-editor.so
%dir %{_datadir}/gnome-vpn-properties/libreswan
%{_datadir}/gnome-vpn-properties/libreswan/nm-libreswan-dialog.ui
%{_datadir}/appdata/network-manager-libreswan.metainfo.xml
%{_metainfodir}/network-manager-libreswan.metainfo.xml
%if %with libnm_glib
%{_libdir}/NetworkManager/libnm-*-properties.so
%{_sysconfdir}/NetworkManager/VPN/nm-libreswan-service.name
%endif
%if %with gtk4
%{_libdir}/NetworkManager/libnm-gtk4-vpn-plugin-libreswan-editor.so
%endif
%changelog
* Thu Oct 03 2024 Lubomir Rintel <lkundrak@v3.sk> - 1.2.10-7
- Unbreak validation of unknown keys
* Tue May 07 2024 Fernando Fernandez Mancera <ferferna@redhat.com> - 1.2.18-3
- Support leftsubnet property (RHEL-33376)
- Support rightcert property (RHEL-33372)
* Wed Sep 25 2024 Lubomir Rintel <lkundrak@v3.sk> - 1.2.10-6
- Fix improper escaping of Libreswan configuration (CVE-2024-9050)
* Wed Jan 17 2024 Fernando Fernandez Mancera <ferferna@redhat.com> - 1.2.18-2
- Support point-to-point IPSec tunnel (RHEL-20690)
- Fix crash in libreswan_nmstate_iface_dpd_rsa (RHEL-21221)
- Support configuring IPSec mode with 'type' (RHEL-21554)
* Mon Feb 5 2024 Wen Liang <wenliang@redhat.com> - 1.2.10-5
- Fix crash in libreswan_add_profile_wrong_password (RHEL-13123)
* Fri Dec 15 2023 Fernando Fernandez Mancera <ferferna@redhat.com> - 1.2.18-1
- Update to 1.2.18 release
* Tue Jul 9 2019 Francesco Giudici <fgiudici@redhat.com> - 1.2.10-4
- Fix Gnome IPsec advanced options dialog (rh #1697329)
* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 1.2.14-1.3
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
Related: rhbz#1991688
* Mon Dec 10 2018 Lubomir Rintel <lkundrak@v3.sk> - 1.2.10-3
- Update the translations (rh #1608329)
* Thu Apr 15 2021 Mohan Boddu <mboddu@redhat.com> - 1.2.14-1.2
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
* Thu Oct 16 2018 Lubomir Rintel <lkundrak@v3.sk> - 1.2.10-2
- Import the translations (rh #1608329)
* Mon Jan 25 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.14-1.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
* Mon Oct 15 2018 Francesco Giudici <fgiudici@redhat.com> - 1.2.10-1
- Update to 1.2.10 release (rh #1637867)
- Fix import functionality (rh #1633174)
* Tue Jan 12 2021 Beniamino Galvani <bgalvani@redhat.com> - 1.2.14-1
- Update to 1.2.14 release
* Wed Oct 3 2018 Beniamino Galvani <bgalvani@redhat.com> - 1.2.8-2
- Rebuild with updated annobin (rh #1630605)
* Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.12-1.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Mon Sep 17 2018 Francesco Giudici <fgiudici@redhat.com> - 1.2.8-1
- Update to 1.2.8 release
* Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.12-1.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
* Mon Aug 13 2018 Francesco Giudici <fgiudici@redhat.com> - 1.2.8-0.1
- Update to latest development snapshot of NetworkManager-libreswan 1.2.8
- Introduced IKEv2 support (rh #1557035)
- Introduced support to more Libreswan properties (rh #1557035)
- Updated translations
* Wed Jul 31 2019 Francesco Giudici <fgiudici@redhat.com> - 1.2.12-1
- Updated to 1.2.12
* Wed Jul 24 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.10-1.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
* Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.10-1.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
* Thu Oct 18 2018 Francesco Giudici <fgiudici@redhat.com> - 1.2.10-1
- Updated to 1.2.10
- Import latest translations from upstream
* Wed Aug 22 2018 Paul Wouters <pwouters@redhat.com> - 1.2.6-1
- Updated to 1.2.6
- Upstream patches for IKEv2 support
* Thu Jul 12 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.4-7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.4-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild