.NetworkManager-libreswan.metadata

@@ -1 +1 @@
-a3ec22a8e76f3358d9f69dc505d22267e936dbae SOURCES/NetworkManager-libreswan-1.2.10.tar.xz
+a57014f8a1c360546cb7fed5231efd7cfbf85bf3 SOURCES/NetworkManager-libreswan-1.2.18.tar.xz

.gitignore

@@ -1 +1 @@
-SOURCES/NetworkManager-libreswan-1.2.10.tar.xz
+SOURCES/NetworkManager-libreswan-1.2.18.tar.xz

SOURCES/0001-service-properties-add-support-for-leftmodecfgclient.patch

@@ -0,0 +1,79 @@
+From 0f0b2d375901e302e8a619e3911321f511b52885 Mon Sep 17 00:00:00 2001
+From: Beniamino Galvani <bgalvani@redhat.com>
+Date: Tue, 9 Jan 2024 23:30:42 +0100
+Subject: [PATCH 1/5] service,properties: add support for leftmodecfgclient
+
+Previously the plugin always set leftmodecfgclient=yes, which is used
+for roaming clients to obtain a dynamic IP. In a server-to-server
+scenario we don't want that option; allow omitting it by passing
+leftmodecfgclient=no. It's somehow confusing that the new option has
+the opposite default value than Libreswan, but that's the only way to
+keep backwards compatibility for existing configurations.
+---
+ properties/nm-libreswan-dialog.ui       | 26 +++++++++++++++++++++++++
+ properties/nm-libreswan-editor-plugin.c |  2 ++
+ properties/nm-libreswan-editor.c        |  9 +++++++++
+ shared/nm-service-defines.h             |  1 +
+ shared/utils.c                          |  8 +++++++-
+ src/nm-libreswan-service.c              |  1 +
+ 6 files changed, 46 insertions(+), 1 deletion(-)
+
+diff --git a/properties/nm-libreswan-editor-plugin.c b/properties/nm-libreswan-editor-plugin.c
+index b5c0d9e..89243cc 100644
+--- a/properties/nm-libreswan-editor-plugin.c
++++ b/properties/nm-libreswan-editor-plugin.c
+@@ -182,6 +182,8 @@ import_from_file (NMVpnEditorPlugin *self,
+ 			nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTUSERNAME, &str[13]);
+ 		else if (g_str_has_prefix (str, "leftcert="))
+ 			nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTCERT, &str[9]);
++		else if (nm_streq0 (str, "leftmodecfgclient=no"))
++			nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT, "no");
+ 		else if (g_str_has_prefix (str, "pfs=no"))
+ 			nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_PFS, "no");
+ 		else if (g_str_has_prefix (str, "cisco-unity=yes"))
+diff --git a/shared/nm-service-defines.h b/shared/nm-service-defines.h
+index 3fdf2ef..14170ad 100644
+--- a/shared/nm-service-defines.h
++++ b/shared/nm-service-defines.h
+@@ -41,6 +41,7 @@
+ #define NM_LIBRESWAN_KEY_LEFTID                     "leftid"
+ #define NM_LIBRESWAN_KEY_LEFTRSASIGKEY              "leftrsasigkey"
+ #define NM_LIBRESWAN_KEY_LEFTCERT                   "leftcert"
++#define NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT          "leftmodecfgclient"
+ #define NM_LIBRESWAN_KEY_AUTHBY                     "authby"
+ #define NM_LIBRESWAN_KEY_PSK_VALUE                  "pskvalue"
+ #define NM_LIBRESWAN_KEY_PSK_INPUT_MODES            "pskinputmodes"
+diff --git a/shared/utils.c b/shared/utils.c
+index cbc117c..0bac9e6 100644
+--- a/shared/utils.c
++++ b/shared/utils.c
+@@ -191,7 +191,13 @@ nm_libreswan_config_write (gint fd,
+ 	else
+ 		WRITE_CHECK (fd, debug_write_fcn, error, " left=%%defaultroute");
+ 
+-	WRITE_CHECK (fd, debug_write_fcn, error, " leftmodecfgclient=yes");
++	item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT);
++	if (nm_streq0 (item, "no")) {
++		WRITE_CHECK (fd, debug_write_fcn, error, " leftmodecfgclient=no");
++	} else {
++		WRITE_CHECK (fd, debug_write_fcn, error, " leftmodecfgclient=yes");
++	}
++
+ 	if (leftupdown_script)
+ 		WRITE_CHECK (fd, debug_write_fcn, error, " leftupdown=%s", leftupdown_script);
+ 
+diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c
+index fc470a6..874f767 100644
+--- a/src/nm-libreswan-service.c
++++ b/src/nm-libreswan-service.c
+@@ -256,6 +256,7 @@ static ValidProperty valid_properties[] = {
+ 	{ NM_LIBRESWAN_KEY_LEFTUSERNAME,               G_TYPE_STRING, 0, 0 },
+ 	{ NM_LIBRESWAN_KEY_LEFTRSASIGKEY,              G_TYPE_STRING, 0, 0 },
+ 	{ NM_LIBRESWAN_KEY_LEFTCERT,                   G_TYPE_STRING, 0, 0 },
++	{ NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT,          G_TYPE_STRING, 0, 0 },
+ 	{ NM_LIBRESWAN_KEY_AUTHBY,                     G_TYPE_STRING, 0, 0 },
+ 	{ NM_LIBRESWAN_KEY_DOMAIN,                     G_TYPE_STRING, 0, 0 },
+ 	{ NM_LIBRESWAN_KEY_DHGROUP,                    G_TYPE_STRING, 0, 0 },
+-- 
+2.43.0
+

SOURCES/0002-properties-set-advanced-dialog-modal.patch

@@ -1,26 +0,0 @@
-From eaf501ab7cb732a152097d2af5636b03fd3f029d Mon Sep 17 00:00:00 2001
-From: Francesco Giudici <fgiudici@redhat.com>
-Date: Mon, 15 Apr 2019 14:51:26 +0200
-Subject: [PATCH] properties: set advanced dialog modal
-
-https://bugzilla.redhat.com/show_bug.cgi?id=1697329
----
- properties/nm-libreswan-dialog.ui | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/properties/nm-libreswan-dialog.ui b/properties/nm-libreswan-dialog.ui
-index 73522d4..e355c08 100644
---- a/properties/nm-libreswan-dialog.ui
-+++ b/properties/nm-libreswan-dialog.ui
-@@ -451,6 +451,8 @@
-     <property name="can_focus">False</property>
-     <property name="border_width">12</property>
-     <property name="title" translatable="yes">IPsec Advanced Options</property>
-+    <property name="modal">True</property>
-+    <property name="destroy_with_parent">True</property>
-     <property name="type_hint">dialog</property>
-     <child internal-child="vbox">
-       <object class="GtkBox" id="dialog-vbox1">
--- 
-2.20.1
-

SOURCES/0002-service-use-new-API-to-send-configuration-to-NM.patch

@@ -0,0 +1,137 @@
+From 09ee8838162cb6ea097375fb7d8b698566bb1c4d Mon Sep 17 00:00:00 2001
+From: Beniamino Galvani <bgalvani@redhat.com>
+Date: Wed, 10 Jan 2024 09:29:50 +0100
+Subject: [PATCH 2/5] service: use new API to send configuration to NM
+
+Instead of emitting the "Ip4Config" signal that contains both generic
+and IPv4 configurations, use the more recent API and send two signals:
+"Config" for the generic configuration and "Ip4Config" for IPv4
+configuration.
+
+In this way, it will be possible in the next commit to return no IPv4
+configuration at all.
+---
+ src/nm-libreswan-service.c | 61 +++++++++++++++++++++++++-------------
+ 1 file changed, 40 insertions(+), 21 deletions(-)
+
+diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c
+index 874f767..2aca78f 100644
+--- a/src/nm-libreswan-service.c
++++ b/src/nm-libreswan-service.c
+@@ -1270,16 +1270,14 @@ handle_callback (NMDBusLibreswanHelper *object,
+ 		goto out;
+ 	}
+ 
++	/* First build and send the generic config */
+ 	g_variant_builder_init (&config, G_VARIANT_TYPE_VARDICT);
+ 
+-	/* Right peer (or Gateway) */
+-	val = addr4_to_gvariant (lookup_string (env, "PLUTO_PEER"));
+-	if (val)
+-		g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_GATEWAY, val);
+-	else {
+-		_LOGW ("IPsec/Pluto Right Peer (VPN Gateway)");
+-		goto out;
+-	}
++	/*
++	 * Enabled address families
++	 */
++	g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP4, g_variant_new_boolean (TRUE));
++	g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP6, g_variant_new_boolean (FALSE));
+ 
+ 	/*
+ 	 * Tunnel device
+@@ -1290,15 +1288,43 @@ handle_callback (NMDBusLibreswanHelper *object,
+ 	} else {
+ 		val = g_variant_new_string (NM_VPN_PLUGIN_IP4_CONFIG_TUNDEV_NONE);
+ 	}
++	g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_TUNDEV, val);
++
++	/* Banner */
++	val = str_to_gvariant (lookup_string (env, "PLUTO_PEER_BANNER"), TRUE);
++	if (val)
++		g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_BANNER, val);
++
++	/* Right peer (or Gateway) */
++	val = addr4_to_gvariant (lookup_string (env, "PLUTO_PEER"));
++	if (val)
++		g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_EXT_GATEWAY, val);
++	else {
++		_LOGW ("IPsec/Pluto Right Peer (VPN Gateway) is missing");
++		goto out;
++	}
++
++	nm_vpn_service_plugin_set_config (NM_VPN_SERVICE_PLUGIN (user_data),
++	                                  g_variant_builder_end (&config));
+ 
+-	g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_TUNDEV, val);
++	/* Then build and send the IPv4 config */
++	g_variant_builder_init (&config, G_VARIANT_TYPE_VARDICT);
++
++	/* Right peer (or Gateway) */
++	val = addr4_to_gvariant (lookup_string (env, "PLUTO_PEER"));
++	if (val)
++		g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_GATEWAY, val);
++	else {
++		_LOGW ("IPsec/Pluto Right Peer (VPN Gateway) is missing");
++		goto out;
++	}
+ 
+ 	/* IP address */
+ 	val = addr4_to_gvariant (lookup_string (env, "PLUTO_MY_SOURCEIP"));
+ 	if (val)
+ 		g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_ADDRESS, val);
+ 	else {
+-		_LOGW ("IP4 Address");
++		_LOGW ("IP4 Address is missing");
+ 		goto out;
+ 	}
+ 
+@@ -1307,7 +1333,7 @@ handle_callback (NMDBusLibreswanHelper *object,
+ 	if (val)
+ 		g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_PTP, val);
+ 	else {
+-		_LOGW ("IP4 PTP Address");
++		_LOGW ("IP4 PTP Address is missing");
+ 		goto out;
+ 	}
+ 
+@@ -1324,7 +1350,6 @@ handle_callback (NMDBusLibreswanHelper *object,
+ 	if (val)
+ 		g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_DNS, val);
+ 
+-
+ 	/* Default domain */
+ 	val = str_to_gvariant (lookup_string (env, "PLUTO_CISCO_DOMAIN_INFO"), TRUE);
+ 	if (!val) {
+@@ -1334,11 +1359,6 @@ handle_callback (NMDBusLibreswanHelper *object,
+ 	if (val)
+ 		g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_DOMAIN, val);
+ 
+-	/* Banner */
+-	val = str_to_gvariant (lookup_string (env, "PLUTO_PEER_BANNER"), TRUE);
+-	if (val)
+-		g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_BANNER, val);
+-
+ 	/* Indicates whether the VPN is using a XFRM interface (via option ipsec-interface=) */
+ 	is_xfrmi = nm_streq0 (lookup_string (env, "PLUTO_XFRMI_ROUTE"), "yes");
+ 
+@@ -1369,12 +1389,11 @@ handle_callback (NMDBusLibreswanHelper *object,
+ 		g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_NEVER_DEFAULT, g_variant_new_boolean (TRUE));
+ 
+ 	success = TRUE;
++	nm_vpn_service_plugin_set_ip4_config (NM_VPN_SERVICE_PLUGIN (user_data),
++	                                      g_variant_builder_end (&config));
+ 
+ out:
+-	if (success) {
+-		nm_vpn_service_plugin_set_ip4_config (NM_VPN_SERVICE_PLUGIN (user_data),
+-		                                      g_variant_builder_end (&config));
+-	} else {
++	if (!success) {
+ 		connect_failed (NM_LIBRESWAN_PLUGIN (user_data), NULL,
+ 		                NM_VPN_PLUGIN_FAILURE_CONNECT_FAILED);
+ 	}
+-- 
+2.43.0
+

SOURCES/0003-service-don-t-send-IPv4-config-if-mode-config-client.patch

@@ -0,0 +1,72 @@
+From 74ec0f7dc18939dd4a5992584527ab044b284fc0 Mon Sep 17 00:00:00 2001
+From: Beniamino Galvani <bgalvani@redhat.com>
+Date: Wed, 10 Jan 2024 09:31:48 +0100
+Subject: [PATCH 3/5] service: don't send IPv4 config if mode config client is
+ disabled
+
+If the mode config client is disabled (i.e. in server-to-server
+scenario) we are not going to receive a dynamic IP. The IP address
+already configured on the existing interface is enough.
+---
+ src/nm-libreswan-service.c | 20 +++++++++++++++++++-
+ 1 file changed, 19 insertions(+), 1 deletion(-)
+
+diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c
+index 2aca78f..12cf6f2 100644
+--- a/src/nm-libreswan-service.c
++++ b/src/nm-libreswan-service.c
+@@ -1253,6 +1253,7 @@ handle_callback (NMDBusLibreswanHelper *object,
+                  gpointer user_data)
+ {
+ 	NMLibreswanPluginPrivate *priv = NM_LIBRESWAN_PLUGIN_GET_PRIVATE (user_data);
++	NMSettingVpn *s_vpn;
+ 	GVariantBuilder config;
+ 	GVariantBuilder builder;
+ 	GVariant *val;
+@@ -1260,7 +1261,9 @@ handle_callback (NMDBusLibreswanHelper *object,
+ 	guint i;
+ 	const char *verb;
+ 	const char *virt_if;
++	const char *str;
+ 	gboolean is_xfrmi = FALSE;
++	gboolean has_ip4;
+ 
+ 	_LOGI ("Configuration from the helper received.");
+ 
+@@ -1273,10 +1276,21 @@ handle_callback (NMDBusLibreswanHelper *object,
+ 	/* First build and send the generic config */
+ 	g_variant_builder_init (&config, G_VARIANT_TYPE_VARDICT);
+ 
++	if (   priv->connection
++	    && (s_vpn = nm_connection_get_setting_vpn (priv->connection))
++	    && (str = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT))
++	    && nm_streq (str, "no")) {
++		has_ip4 = FALSE;
++	} else {
++		has_ip4 = TRUE;
++	}
++
++	_LOGD ("Configuration has IPv4: %d", has_ip4);
++
+ 	/*
+ 	 * Enabled address families
+ 	 */
+-	g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP4, g_variant_new_boolean (TRUE));
++	g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP4, g_variant_new_boolean (has_ip4));
+ 	g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP6, g_variant_new_boolean (FALSE));
+ 
+ 	/*
+@@ -1306,6 +1320,10 @@ handle_callback (NMDBusLibreswanHelper *object,
+ 
+ 	nm_vpn_service_plugin_set_config (NM_VPN_SERVICE_PLUGIN (user_data),
+ 	                                  g_variant_builder_end (&config));
++	if (!has_ip4) {
++		success = TRUE;
++		goto out;
++	}
+ 
+ 	/* Then build and send the IPv4 config */
+ 	g_variant_builder_init (&config, G_VARIANT_TYPE_VARDICT);
+-- 
+2.43.0
+

SOURCES/0004-service-fix-wrong-refcounting-in-D-Bus-handler-for-C.patch

@@ -0,0 +1,67 @@
+From 8ceb901719acac3778e1d76779d9c14289185157 Mon Sep 17 00:00:00 2001
+From: Beniamino Galvani <bgalvani@redhat.com>
+Date: Sat, 13 Jan 2024 18:10:02 +0100
+Subject: [PATCH 4/5] service: fix wrong refcounting in D-Bus handler for
+ Callback()
+
+The Callback() D-Bus method is handled via a GDBus-generated skeleton
+code in nm-libreswan-helper-service-dbus.c, function
+_nmdbus_libreswan_helper_skeleton_handle_method_call(). The function
+emits signal "handle-callback" to let the program handle the incoming
+method. As documented in the GDoc comments, the signal handler must
+return TRUE if it handles the call.
+
+```
+  /**
+   * NMDBusLibreswanHelper::handle-callback:
+   * @object: A #NMDBusLibreswanHelper.
+   * @invocation: A #GDBusMethodInvocation.
+   * @arg_environment: Argument passed by remote caller.
+
+   * Signal emitted when a remote caller is invoking the Callback()
+     D-Bus method.
+
+   * If a signal handler returns %TRUE, it means the signal handler
+     will handle the invocation (e.g. take a reference to @invocation
+     and eventually call nmdbus_libreswan_helper_complete_callback()
+     or e.g. g_dbus_method_invocation_return_error() on it) and no
+     other signal handlers will run. If no signal handler handles the
+     invocation, the %G_DBUS_ERROR_UNKNOWN_METHOD error is returned.
+
+   * Returns: %G_DBUS_METHOD_INVOCATION_HANDLED or %TRUE if the
+     invocation was handled, %G_DBUS_METHOD_INVOCATION_UNHANDLED or
+     %FALSE to let other signal handlers run.
+   */
+```
+
+At the moment, in case of error the handler first calls
+nmdbus_libreswan_helper_complete_callback() which decreases the
+refcount of "invocation", and then returns FALSE which tells the
+skeleton code to return an error, also unreferencing the
+invocation. This causes a crash.
+
+Since the G_DBUS_METHOD_INVOCATION_HANDLED alias for TRUE is only
+available since GLib 2.68 (while we target 2.36), just return TRUE.
+
+Fixes: acb9eb9de50b ('service: process the configuration in the service, not the helper')
+---
+ src/nm-libreswan-service.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c
+index 12cf6f2..0d5c4b8 100644
+--- a/src/nm-libreswan-service.c
++++ b/src/nm-libreswan-service.c
+@@ -1417,7 +1417,8 @@ out:
+ 	}
+ 
+ 	nmdbus_libreswan_helper_complete_callback (object, invocation);
+-	return success;
++
++	return TRUE;
+ }
+ 
+ /****************************************************************/
+-- 
+2.43.0
+

SOURCES/0005-service-properties-support-type-hostaddrfamily-clien.patch

@@ -0,0 +1,91 @@
+From b4ba2add64bd9d362fe2e66748f23449f072216b Mon Sep 17 00:00:00 2001
+From: Beniamino Galvani <bgalvani@redhat.com>
+Date: Mon, 15 Jan 2024 13:23:45 +0100
+Subject: [PATCH 5/5] service,properties: support type, hostaddrfamily,
+ clientaddrfamily
+
+Add support for:
+ - type
+ - hostaddrfamily
+ - clientaddrfamily
+
+Since those are very advanced options, don't implement the GUI part
+for now.
+---
+ properties/nm-libreswan-editor-plugin.c |  6 ++++++
+ shared/nm-service-defines.h             |  3 +++
+ shared/utils.c                          | 12 ++++++++++++
+ src/nm-libreswan-service.c              |  3 +++
+ 4 files changed, 24 insertions(+)
+
+diff --git a/properties/nm-libreswan-editor-plugin.c b/properties/nm-libreswan-editor-plugin.c
+index 89243cc..fe85c81 100644
+--- a/properties/nm-libreswan-editor-plugin.c
++++ b/properties/nm-libreswan-editor-plugin.c
+@@ -206,6 +206,12 @@ import_from_file (NMVpnEditorPlugin *self,
+ 			nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_IPSEC_INTERFACE, &str[16]);
+ 		else if (g_str_has_prefix (str, "authby="))
+ 			nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_AUTHBY, &str[7]);
++		else if (g_str_has_prefix (str, "type="))
++			nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_TYPE, str + NM_STRLEN("type="));
++		else if (g_str_has_prefix (str, "hostaddrfamily="))
++			nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_HOSTADDRFAMILY, str + NM_STRLEN("hostaddrfamily="));
++		else if (g_str_has_prefix (str, "clientaddrfamily="))
++			nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_CLIENTADDRFAMILY, str + NM_STRLEN("clientaddrfamily="));
+ 		else if (g_str_has_prefix (str, "rightsubnet=")) {
+ 			if (!g_str_has_prefix (str, "rightsubnet=0.0.0.0/0"))
+ 				nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_REMOTENETWORK, &str[12]);
+diff --git a/shared/nm-service-defines.h b/shared/nm-service-defines.h
+index 14170ad..95e19d4 100644
+--- a/shared/nm-service-defines.h
++++ b/shared/nm-service-defines.h
+@@ -68,6 +68,9 @@
+ #define NM_LIBRESWAN_KEY_FRAGMENTATION              "fragmentation"
+ #define NM_LIBRESWAN_KEY_MOBIKE                     "mobike"
+ #define NM_LIBRESWAN_KEY_IPSEC_INTERFACE            "ipsec-interface"
++#define NM_LIBRESWAN_KEY_TYPE                       "type"
++#define NM_LIBRESWAN_KEY_HOSTADDRFAMILY             "hostaddrfamily"
++#define NM_LIBRESWAN_KEY_CLIENTADDRFAMILY           "clientaddrfamily"
+ 
+ #define NM_LIBRESWAN_IKEV2_NO      "no"
+ #define NM_LIBRESWAN_IKEV2_NEVER   "never"
+diff --git a/shared/utils.c b/shared/utils.c
+index 0bac9e6..9e616f8 100644
+--- a/shared/utils.c
++++ b/shared/utils.c
+@@ -325,6 +325,18 @@ nm_libreswan_config_write (gint fd,
+ 	if (item && strlen (item))
+ 		WRITE_CHECK (fd, debug_write_fcn, error, " ipsec-interface=%s", item);
+ 
++	item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_TYPE);
++	if (item && strlen (item))
++		WRITE_CHECK (fd, debug_write_fcn, error, " type=%s", item);
++
++	item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_HOSTADDRFAMILY);
++	if (item && strlen (item))
++		WRITE_CHECK (fd, debug_write_fcn, error, " hostaddrfamily=%s", item);
++
++	item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_CLIENTADDRFAMILY);
++	if (item && strlen (item))
++		WRITE_CHECK (fd, debug_write_fcn, error, " clientaddrfamily=%s", item);
++
+ 	WRITE_CHECK (fd, debug_write_fcn, error, " nm-configured=yes");
+ 
+ 	WRITE_CHECK_NEWLINE (fd, trailing_newline, debug_write_fcn, error, " auto=add");
+diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c
+index 0d5c4b8..7e96230 100644
+--- a/src/nm-libreswan-service.c
++++ b/src/nm-libreswan-service.c
+@@ -277,6 +277,9 @@ static ValidProperty valid_properties[] = {
+ 	{ NM_LIBRESWAN_KEY_FRAGMENTATION,              G_TYPE_STRING, 0, 0 },
+ 	{ NM_LIBRESWAN_KEY_MOBIKE,                     G_TYPE_STRING, 0, 0 },
+ 	{ NM_LIBRESWAN_KEY_IPSEC_INTERFACE,            G_TYPE_STRING, 0, 0 },
++	{ NM_LIBRESWAN_KEY_TYPE,                       G_TYPE_STRING, 0, 0 },
++	{ NM_LIBRESWAN_KEY_HOSTADDRFAMILY,             G_TYPE_STRING, 0, 0 },
++	{ NM_LIBRESWAN_KEY_CLIENTADDRFAMILY,           G_TYPE_STRING, 0, 0 },
+ 	/* Ignored option for internal use */
+ 	{ NM_LIBRESWAN_KEY_PSK_INPUT_MODES,            G_TYPE_NONE, 0, 0 },
+ 	{ NM_LIBRESWAN_KEY_XAUTH_PASSWORD_INPUT_MODES, G_TYPE_NONE, 0, 0 },
+-- 
+2.43.0
+

SPECS/NetworkManager-libreswan.spec

@@ -1,24 +1,40 @@
 %if 0%{?fedora} < 28 && 0%{?rhel} < 8
 %bcond_without libnm_glib
 %else
-# Disable the legacy version by default
 %bcond_with libnm_glib
 %endif
+%if 0%{?fedora} < 36 && 0%{?rhel} < 10
+%bcond_with gtk4
+%else
+%bcond_without gtk4
+%endif 
+
+%global real_version     1.2.18
+%global rpm_version      1.2.18
+%global release_version  2
+
+%global real_version_major %(printf '%s' '%{real_version}' | sed -n 's/^\\([1-9][0-9]*\\.[1-9][0-9]*\\)\\.[1-9][0-9]*$/\\1/p')
+
+%global nm_version       1:1.2.0
+%global nma_version      1.2.0
 
-%global nm_version        1:1.2.0
-%global nma_version       1.2.0
 
 Summary:   NetworkManager VPN plug-in for IPsec VPN
 Name:      NetworkManager-libreswan
-Version:   1.2.10
+Version:   %{rpm_version}
-Release:   4%{?dist}
+Release:   %{release_version}%{?dist}
 License:   GPLv2+
 URL:       http://www.gnome.org/projects/NetworkManager/
-Group:     System Environment/Base
+Source0:   https://download.gnome.org/sources/NetworkManager-libreswan/%{real_version_major}/%{name}-%{real_version}.tar.xz
-Source0:   https://download.gnome.org/sources/NetworkManager-libreswan/1.2/%{name}-%{version}.tar.xz
-Patch0:    0001-po-import-translations-from-Red-Hat-translators.patch
-Patch1:    0002-properties-set-advanced-dialog-modal.patch
 
+Patch1: 0001-service-properties-add-support-for-leftmodecfgclient.patch
+Patch2: 0002-service-use-new-API-to-send-configuration-to-NM.patch
+Patch3: 0003-service-don-t-send-IPv4-config-if-mode-config-client.patch
+Patch4: 0004-service-fix-wrong-refcounting-in-D-Bus-handler-for-C.patch
+Patch5: 0005-service-properties-support-type-hostaddrfamily-clien.patch
+
+BuildRequires: make
+BuildRequires:  gcc
 BuildRequires: gtk3-devel
 BuildRequires: libnl3-devel
 BuildRequires: NetworkManager-libnm-devel >= %{nm_version}
@@ -32,6 +48,10 @@ BuildRequires: NetworkManager-glib-devel >= %{nm_version}
 BuildRequires: libnm-gtk-devel >= %{nma_version}
 %endif
 
+%if %with gtk4
+BuildRequires: libnma-gtk4-devel
+%endif
+
 Requires: NetworkManager >= %{nm_version}
 Requires: dbus
 Requires: /usr/sbin/ipsec
@@ -43,13 +63,14 @@ Obsoletes: NetworkManager-openswan < %{version}-%{release}
 %global __provides_exclude ^(%{_privatelibs})$
 %global __requires_exclude ^(%{_privatelibs})$
 
+
 %description
 This package contains software for integrating the libreswan VPN software
 with NetworkManager and the GNOME desktop
 
+
 %package -n NetworkManager-libreswan-gnome
 Summary: NetworkManager VPN plugin for libreswan - GNOME files
-Group:   System Environment/Base
 
 Requires: %{name}%{?_isa} = %{version}-%{release}
 Requires: shared-mime-info
@@ -61,12 +82,17 @@ Obsoletes: NetworkManager-openswan-gnome < %{version}-%{release}
 This package contains software for integrating VPN capabilities with
 the libreswan server with NetworkManager (GNOME files).
 
+
 %prep
-%autosetup -p1 -n %{name}-%{version}
+%autosetup -p1 -n "%{name}-%{real_version}"
+
 
 %build
 %configure \
         --disable-static \
+%if %with gtk4
+    --with-gtk4 \
+%endif
 %if %without libnm_glib
         --without-libnm-glib \
 %endif
@@ -74,18 +100,13 @@ the libreswan server with NetworkManager (GNOME files).
         --with-dist-version=%{version}-%{release}
 make %{?_smp_mflags}
 
+
 %install
 make install DESTDIR=%{buildroot}
 rm -f %{buildroot}%{_libdir}/NetworkManager/lib*.la
 
 %find_lang %{name}
 
-%post
-update-desktop-database &> /dev/null || :
-
-%postun
-update-desktop-database &> /dev/null || :
-
 %files -f %{name}.lang
 %{_libdir}/NetworkManager/libnm-vpn-plugin-libreswan.so
 %{_sysconfdir}/dbus-1/system.d/nm-libreswan-service.conf
@@ -93,46 +114,71 @@ update-desktop-database &> /dev/null || :
 %{_libexecdir}/nm-libreswan-service
 %{_libexecdir}/nm-libreswan-service-helper
 %{_mandir}/man5/nm-settings-libreswan.5.gz
-%doc AUTHORS ChangeLog NEWS
+%doc AUTHORS NEWS
 %license COPYING
 
+
 %files -n NetworkManager-libreswan-gnome
 %{_libexecdir}/nm-libreswan-auth-dialog
 %{_libdir}/NetworkManager/libnm-vpn-plugin-libreswan-editor.so
-%dir %{_datadir}/gnome-vpn-properties/libreswan
+%{_metainfodir}/network-manager-libreswan.metainfo.xml
-%{_datadir}/gnome-vpn-properties/libreswan/nm-libreswan-dialog.ui
-%{_datadir}/appdata/network-manager-libreswan.metainfo.xml
 
 %if %with libnm_glib
 %{_libdir}/NetworkManager/libnm-*-properties.so
 %{_sysconfdir}/NetworkManager/VPN/nm-libreswan-service.name
 %endif
 
+%if %with gtk4
+%{_libdir}/NetworkManager/libnm-gtk4-vpn-plugin-libreswan-editor.so
+%endif
+
 %changelog
-* Tue Jul  9 2019 Francesco Giudici <fgiudici@redhat.com> - 1.2.10-4
+* Wed Jan 17 2024 Fernando Fernandez Mancera <ferferna@redhat.com> - 1.2.18-2
-- Fix Gnome IPsec advanced options dialog (rh #1697329)
+- Support point-to-point IPSec tunnel (RHEL-20690)
+- Fix crash in libreswan_nmstate_iface_dpd_rsa (RHEL-21221)
+- Support configuring IPSec mode with 'type' (RHEL-21554)
 
-* Mon Dec 10 2018 Lubomir Rintel <lkundrak@v3.sk> - 1.2.10-3
+* Fri Dec 15 2023 Fernando Fernandez Mancera <ferferna@redhat.com> - 1.2.18-1
-- Update the translations (rh #1608329)
+- Update to 1.2.18 release
 
-* Thu Oct 16 2018 Lubomir Rintel <lkundrak@v3.sk> - 1.2.10-2
+* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 1.2.14-1.3
-- Import the translations (rh #1608329)
+- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
+  Related: rhbz#1991688
 
-* Mon Oct 15 2018 Francesco Giudici <fgiudici@redhat.com> - 1.2.10-1
+* Thu Apr 15 2021 Mohan Boddu <mboddu@redhat.com> - 1.2.14-1.2
-- Update to 1.2.10 release (rh #1637867)
+- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
-- Fix import functionality (rh #1633174)
 
-* Wed Oct  3 2018 Beniamino Galvani <bgalvani@redhat.com> - 1.2.8-2
+* Mon Jan 25 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.14-1.1
-- Rebuild with updated annobin (rh #1630605)
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
 
-* Mon Sep 17 2018 Francesco Giudici <fgiudici@redhat.com> - 1.2.8-1
+* Tue Jan 12 2021 Beniamino Galvani <bgalvani@redhat.com> - 1.2.14-1
-- Update to 1.2.8 release
+- Update to 1.2.14 release
 
-* Mon Aug 13 2018 Francesco Giudici <fgiudici@redhat.com> - 1.2.8-0.1
+* Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.12-1.2
-- Update to latest development snapshot of NetworkManager-libreswan 1.2.8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-- Introduced IKEv2 support (rh #1557035)
+
-- Introduced support to more Libreswan properties (rh #1557035)
+* Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.12-1.1
-- Updated translations
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Wed Jul 31 2019 Francesco Giudici <fgiudici@redhat.com> - 1.2.12-1
+- Updated to 1.2.12
+
+* Wed Jul 24 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.10-1.2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.10-1.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Thu Oct 18 2018 Francesco Giudici <fgiudici@redhat.com> - 1.2.10-1
+- Updated to 1.2.10
+- Import latest translations from upstream
+
+* Wed Aug 22 2018 Paul Wouters <pwouters@redhat.com> - 1.2.6-1
+- Updated to 1.2.6
+- Upstream patches for IKEv2 support
+
+* Thu Jul 12 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.4-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
 
 * Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.4-6
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild