.NetworkManager-libreswan.metadata

@@ -1 +1 @@
-a3ec22a8e76f3358d9f69dc505d22267e936dbae SOURCES/NetworkManager-libreswan-1.2.10.tar.xz
+4854976a318a9f8511cd70dd2fb6ac172f64bb54 SOURCES/NetworkManager-libreswan-1.2.26.tar.xz

.gitignore

@@ -1 +1 @@
-SOURCES/NetworkManager-libreswan-1.2.10.tar.xz
+SOURCES/NetworkManager-libreswan-1.2.26.tar.xz

SOURCES/0001-Add-nm-auto-defaults-option.patch

@@ -0,0 +1,165 @@
+From 3ea80883fefc620d1ee60e594b3735fb7be92801 Mon Sep 17 00:00:00 2001
+From: Gris Ge <fge@redhat.com>
+Date: Mon, 23 Sep 2024 20:07:13 +0800
+Subject: [PATCH] Add `nm-auto-defaults` option
+
+The NetworkManager-libreswan add additional values when user undefined
+which is causing incapability `ipsec.conf` and NM-libreswan config.
+
+Instead of breaking existing users, this introduced `nm-auto-defaults`
+option and set default to yes preserving previous behaviour. For other
+user wish NM-libreswan do not add default values, explicit
+`nm-auto-defaults: no` is required in NetworkManager `vpn.data`.
+
+These are for advanced use cases, no GUI access required.
+
+[lkundrak@v3.sk: rebased this on top of reworked ipsec.conf configuration
+writer/serializer, added test cases, wrote docs.]
+---
+ man/nm-settings-libreswan.5.in | 11 +++++++++--
+ shared/nm-service-defines.h    |  1 +
+ shared/test-utils.c            | 34 ++++++++++++++++++++++++++++++++++
+ shared/utils.c                 | 12 +++++++++++-
+ 4 files changed, 55 insertions(+), 3 deletions(-)
+
+diff --git a/man/nm-settings-libreswan.5.in b/man/nm-settings-libreswan.5.in
+index c98fe77..6152590 100644
+--- a/man/nm-settings-libreswan.5.in
++++ b/man/nm-settings-libreswan.5.in
+@@ -19,9 +19,9 @@
+ .\" with this manual; if not, write to the Free Software Foundation, Inc.,
+ .\" 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ .\"
+-.\" Copyright (C) 2018 Red Hat, Inc.
++.\" Copyright (C) 2018,2025 Red Hat, Inc.
+ .\"
+-.TH NM-SETTINGS-LIBRESWAN "5" "9 July 2018"
++.TH NM-SETTINGS-LIBRESWAN "5" "7 Apr 2025"
+ 
+ .SH NAME
+ nm\-setting\-libreswan \- NetworkManager Libreswan plugin supported options
+@@ -167,6 +167,13 @@ parameter of the same name.
+ .I "pskinputmodes"
+ where the 'pskvalue' can be retrieved. Used internally by the plugin. Allowed values are: 'unused', 'save', 'ask'.
+ .TP
++.I "nm-auto-defaults"
++Allowed values are: 'yes' and 'no'.
++This options indicates that the VPN plugin should not substitute default values for keys that are not
++present in \fBvpn.data\fR or alter the values for the keys that are specified. Malformed values will be
++rejected for security reasons, but other than that the user is responsible for ensuring the configuration
++will work. This is mainly useful when connections are created with a management tool like \fBnmstatectl\fR(8).
++.TP
+ .I "xauthpasswordinputmodes"
+ where the 'xauthpassword' can be retrieved. Used internally by the plugin. Allowed values are: 'unused', 'save', 'ask'.
+ .TP
+diff --git a/shared/nm-service-defines.h b/shared/nm-service-defines.h
+index f29923f..736fa56 100644
+--- a/shared/nm-service-defines.h
++++ b/shared/nm-service-defines.h
+@@ -76,6 +76,7 @@
+ #define NM_LIBRESWAN_KEY_HOSTADDRFAMILY             "hostaddrfamily"
+ #define NM_LIBRESWAN_KEY_CLIENTADDRFAMILY           "clientaddrfamily"
+ #define NM_LIBRESWAN_KEY_REQUIRE_ID_ON_CERTIFICATE  "require-id-on-certificate"
++#define NM_LIBRESWAN_KEY_NM_AUTO_DEFAULTS           "nm-auto-defaults"
+ 
+ #define NM_LIBRESWAN_IKEV2_NO      "no"
+ #define NM_LIBRESWAN_IKEV2_NEVER   "never"
+diff --git a/shared/test-utils.c b/shared/test-utils.c
+index c7ad8dd..2dc4532 100644
+--- a/shared/test-utils.c
++++ b/shared/test-utils.c
+@@ -164,6 +164,23 @@ test_config_write (void)
+ 	g_free (str);
+ 	g_object_unref (s_vpn);
+ 
++	s_vpn = NM_SETTING_VPN (nm_setting_vpn_new ());
++	nm_setting_vpn_add_data_item (s_vpn, "ikev2", "insist");
++	nm_setting_vpn_add_data_item (s_vpn, "leftrsasigkey", "hello");
++	nm_setting_vpn_add_data_item (s_vpn, "rightrsasigkey", "world");
++	nm_setting_vpn_add_data_item (s_vpn, "right", "11.12.13.14");
++	nm_setting_vpn_add_data_item (s_vpn, "nm-auto-defaults", "false");
++	str = nm_libreswan_get_ipsec_conf (4, s_vpn, "conn", NULL, FALSE, TRUE, &error);
++	g_assert_no_error (error);
++	g_assert_cmpstr (str, ==,
++                         "conn conn\n"
++                         " ikev2=insist\n"
++                         " right=11.12.13.14\n"
++                         " rightrsasigkey=\"world\"\n"
++                         " leftrsasigkey=\"hello\"\n");
++	g_free (str);
++	g_object_unref (s_vpn);
++
+ 	s_vpn = NM_SETTING_VPN (nm_setting_vpn_new ());
+ 	str = nm_libreswan_get_ipsec_conf (4, s_vpn, "conn", NULL, FALSE, TRUE, &error);
+ 	g_assert_error (error, NM_UTILS_ERROR, NM_UTILS_ERROR_INVALID_ARGUMENT);
+@@ -195,6 +212,23 @@ test_config_write (void)
+ 	g_assert_null (str);
+ 	g_clear_error (&error);
+ 	g_object_unref (s_vpn);
++
++	s_vpn = NM_SETTING_VPN (nm_setting_vpn_new ());
++	nm_setting_vpn_add_data_item (s_vpn, "nm-auto-defaults", "false");
++	nm_setting_vpn_add_data_item (s_vpn, "rightcert", "\"cert\"");
++	str = nm_libreswan_get_ipsec_conf (4, s_vpn, "conn", NULL, FALSE, TRUE, &error);
++	g_assert_error (error, NM_UTILS_ERROR, NM_UTILS_ERROR_INVALID_ARGUMENT);
++	g_assert_null (str);
++	g_clear_error (&error);
++	g_object_unref (s_vpn);
++
++	s_vpn = NM_SETTING_VPN (nm_setting_vpn_new ());
++	nm_setting_vpn_add_data_item (s_vpn, "nm-auto-defaults", "false");
++	str = nm_libreswan_get_ipsec_conf (4, s_vpn, "conn", NULL, FALSE, TRUE, &error);
++	g_assert_error (error, NM_UTILS_ERROR, NM_UTILS_ERROR_INVALID_ARGUMENT);
++	g_assert_null (str);
++	g_clear_error (&error);
++	g_object_unref (s_vpn);
+ }
+ 
+ static void
+diff --git a/shared/utils.c b/shared/utils.c
+index e6dec8a..9c33315 100644
+--- a/shared/utils.c
++++ b/shared/utils.c
+@@ -341,6 +341,7 @@ static const struct LibreswanParam params[] = {
+ 	{ NM_LIBRESWAN_KEY_XAUTH_PASSWORD_INPUT_MODES, add,                   PARAM_IGNORE },
+ 	{ NM_LIBRESWAN_KEY_PSK_VALUE "-flags",         add,                   PARAM_IGNORE },
+ 	{ NM_LIBRESWAN_KEY_XAUTH_PASSWORD "-flags",    add,                   PARAM_IGNORE },
++	{ NM_LIBRESWAN_KEY_NM_AUTO_DEFAULTS,           add,                   PARAM_IGNORE },
+ 
+ 	{ NULL  }
+ };
+@@ -368,6 +369,7 @@ sanitize_setting_vpn (NMSettingVpn *s_vpn,
+                       GError **error)
+ {
+ 	gs_unref_object NMSettingVpn *sanitized = NULL;
++	gboolean auto_defaults = TRUE;
+ 	int handled_items = 0;
+ 	const char *val;
+ 	int i;
+@@ -380,6 +382,10 @@ sanitize_setting_vpn (NMSettingVpn *s_vpn,
+ 	              NM_SETTING_VPN_SERVICE_TYPE, NM_VPN_SERVICE_TYPE_LIBRESWAN,
+ 	              NULL);
+ 
++	auto_defaults = _nm_utils_ascii_str_to_bool (
++		nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_NM_AUTO_DEFAULTS),
++		TRUE);
++
+ 	for (i = 0; params[i].name != NULL; i++) {
+ 		val = nm_setting_vpn_get_data_item (s_vpn, params[i].name);
+ 		if (val != NULL) {
+@@ -393,7 +399,11 @@ sanitize_setting_vpn (NMSettingVpn *s_vpn,
+ 			return NULL;
+ 		}
+ 
+-		params[i].add_sanitized (sanitized, params[i].name, val);
++		if (auto_defaults) {
++			params[i].add_sanitized (sanitized, params[i].name, val);
++		} else {
++			nm_setting_vpn_add_data_item (sanitized, params[i].name, val);
++		}
+ 
+ 		val = nm_setting_vpn_get_data_item (sanitized, params[i].name);
+ 		if (val == NULL)
+-- 
+GitLab
+

SOURCES/0002-Treat-leftmodecfgserver-differently-according-to-nm-.patch

@@ -0,0 +1,62 @@
+From 9b4467bd226d5a6819b9bfa9fc337c64dc61c293 Mon Sep 17 00:00:00 2001
+From: Gris Ge <fge@redhat.com>
+Date: Fri, 25 Apr 2025 16:28:52 +0800
+Subject: [PATCH] Treat leftmodecfgserver differently according to
+ nm-auto-defaults
+
+When `nm-auto-defaults: no` defined, the default value of
+`leftmodecfgserver` should be `no`.
+
+Signed-off-by: Gris Ge <fge@redhat.com>
+---
+ src/nm-libreswan-service.c | 23 +++++++++++++++++++++--
+ 1 file changed, 21 insertions(+), 2 deletions(-)
+
+diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c
+index e58bc9e..7987ada 100644
+--- a/src/nm-libreswan-service.c
++++ b/src/nm-libreswan-service.c
+@@ -65,6 +65,7 @@ typedef NMVpnServicePlugin NMLibreswanPlugin;
+ typedef NMVpnServicePluginClass NMLibreswanPluginClass;
+ 
+ static GType nm_libreswan_plugin_get_type (void);
++static bool is_leftmodecfgserver_enabled(NMSettingVpn *s_vpn);
+ 
+ G_DEFINE_TYPE (NMLibreswanPlugin, nm_libreswan_plugin, NM_TYPE_VPN_SERVICE_PLUGIN)
+ 
+@@ -1296,8 +1297,8 @@ handle_callback (NMDBusLibreswanHelper *object,
+ 
+ 	if (   priv->connection
+ 	    && (s_vpn = nm_connection_get_setting_vpn (priv->connection))
+-	    && (cstr = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT))
+-	    && nm_streq (cstr, "no")) {
++	    && !is_leftmodecfgserver_enabled(s_vpn)
++	    ) {
+ 		/* no dynamic address needed */
+ 	} else {
+ 		/* IP address */
+@@ -2179,3 +2180,21 @@ main (int argc, char *argv[])
+ 
+ 	exit (0);
+ }
++
++static bool
++is_leftmodecfgserver_enabled(NMSettingVpn *s_vpn)
++{
++	const char *auto_value;
++	const char *cstr;
++
++	auto_value = nm_setting_vpn_get_data_item(s_vpn, NM_LIBRESWAN_KEY_NM_AUTO_DEFAULTS);
++	if (auto_value && nm_streq(auto_value, "no")) {
++		// undefined means false when `nm-auto-defaults: no`
++		cstr = nm_setting_vpn_get_data_item(s_vpn, NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT);
++		return (cstr && nm_streq(cstr, "yes"));
++	} else {
++		// undefined means true
++		cstr = nm_setting_vpn_get_data_item(s_vpn, NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT);
++		return !(cstr && nm_streq(cstr, "no"));
++	}
++}
+-- 
+GitLab
+

SOURCES/0002-properties-set-advanced-dialog-modal.patch

@@ -1,26 +0,0 @@
-From eaf501ab7cb732a152097d2af5636b03fd3f029d Mon Sep 17 00:00:00 2001
-From: Francesco Giudici <fgiudici@redhat.com>
-Date: Mon, 15 Apr 2019 14:51:26 +0200
-Subject: [PATCH] properties: set advanced dialog modal
-
-https://bugzilla.redhat.com/show_bug.cgi?id=1697329
----
- properties/nm-libreswan-dialog.ui | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/properties/nm-libreswan-dialog.ui b/properties/nm-libreswan-dialog.ui
-index 73522d4..e355c08 100644
---- a/properties/nm-libreswan-dialog.ui
-+++ b/properties/nm-libreswan-dialog.ui
-@@ -451,6 +451,8 @@
-     <property name="can_focus">False</property>
-     <property name="border_width">12</property>
-     <property name="title" translatable="yes">IPsec Advanced Options</property>
-+    <property name="modal">True</property>
-+    <property name="destroy_with_parent">True</property>
-     <property name="type_hint">dialog</property>
-     <child internal-child="vbox">
-       <object class="GtkBox" id="dialog-vbox1">
--- 
-2.20.1
-

SOURCES/0003-service-fix-wrong-refcounting-in-D-Bus-handler-for-C.patch

@@ -1,68 +0,0 @@
-From 4be4c56b4f8a52b1cd5f8aadee273706c28ae332 Mon Sep 17 00:00:00 2001
-From: Beniamino Galvani <bgalvani@redhat.com>
-Date: Sat, 13 Jan 2024 18:10:02 +0100
-Subject: [PATCH 1/1] service: fix wrong refcounting in D-Bus handler for
- Callback()
-
-The Callback() D-Bus method is handled via a GDBus-generated skeleton
-code in nm-libreswan-helper-service-dbus.c, function
-_nmdbus_libreswan_helper_skeleton_handle_method_call(). The function
-emits signal "handle-callback" to let the program handle the incoming
-method. As documented in the GDoc comments, the signal handler must
-return TRUE if it handles the call.
-
-```
-  /**
-   * NMDBusLibreswanHelper::handle-callback:
-   * @object: A #NMDBusLibreswanHelper.
-   * @invocation: A #GDBusMethodInvocation.
-   * @arg_environment: Argument passed by remote caller.
-
-   * Signal emitted when a remote caller is invoking the Callback()
-     D-Bus method.
-
-   * If a signal handler returns %TRUE, it means the signal handler
-     will handle the invocation (e.g. take a reference to @invocation
-     and eventually call nmdbus_libreswan_helper_complete_callback()
-     or e.g. g_dbus_method_invocation_return_error() on it) and no
-     other signal handlers will run. If no signal handler handles the
-     invocation, the %G_DBUS_ERROR_UNKNOWN_METHOD error is returned.
-
-   * Returns: %G_DBUS_METHOD_INVOCATION_HANDLED or %TRUE if the
-     invocation was handled, %G_DBUS_METHOD_INVOCATION_UNHANDLED or
-     %FALSE to let other signal handlers run.
-   */
-```
-
-At the moment, in case of error the handler first calls
-nmdbus_libreswan_helper_complete_callback() which decreases the
-refcount of "invocation", and then returns FALSE which tells the
-skeleton code to return an error, also unreferencing the
-invocation. This causes a crash.
-
-Since the G_DBUS_METHOD_INVOCATION_HANDLED alias for TRUE is only
-available since GLib 2.68 (while we target 2.36), just return TRUE.
-
-Fixes: acb9eb9de50b ('service: process the configuration in the service, not the helper')
-(cherry picked from commit 8ceb901719acac3778e1d76779d9c14289185157)
----
- src/nm-libreswan-service.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c
-index fc470a6..4850729 100644
---- a/src/nm-libreswan-service.c
-+++ b/src/nm-libreswan-service.c
-@@ -1379,7 +1379,8 @@ out:
- 	}
- 
- 	nmdbus_libreswan_helper_complete_callback (object, invocation);
--	return success;
-+
-+	return TRUE;
- }
- 
- /****************************************************************/
--- 
-2.43.0
-

SOURCES/0003-shared-utils-only-set-phase2alg-esp-for-ikev1-in-agg.patch

@@ -0,0 +1,69 @@
+From 43f3df676e827e343bae9455dc1eb82c5a805574 Mon Sep 17 00:00:00 2001
+From: Beniamino Galvani <bgalvani@redhat.com>
+Date: Fri, 27 Jun 2025 18:21:51 +0200
+Subject: [PATCH] shared/utils: only set phase2alg/esp for ikev1 in aggressive
+ mode
+
+Commit f3c6f38f3be3 ("shared: make ipsec.conf formatting declarative")
+changed the logic to write option phase2alg/esp. Before the commit, it
+was automatically set to NM_LIBRESWAN_AGGRMODE_DEFAULT_ESP only for
+IKEv1 in aggressive mode ("leftid" set). After, the option is set for
+IKEv2.  Restore the old behavior.
+
+Fixes: f3c6f38f3be3 ("shared: make ipsec.conf formatting declarative")
+Signed-off-by: Gris Ge <fge@redhat.com>
+---
+ shared/test-utils.c | 3 ---
+ shared/utils.c      | 5 ++++-
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/shared/test-utils.c b/shared/test-utils.c
+index 2dc4532..ec47fe5 100644
+--- a/shared/test-utils.c
++++ b/shared/test-utils.c
+@@ -103,7 +103,6 @@ test_config_write (void)
+ 	                 " leftmodecfgclient=yes\n"
+ 	                 " rightsubnet=0.0.0.0/0\n"
+ 	                 " rekey=yes\n"
+-	                 " phase2alg=aes256-sha1\n"
+ 	                 " keyingtries=1\n"
+ 	                 " rightmodecfgserver=yes\n"
+ 	                 " modecfgpull=yes\n");
+@@ -127,7 +126,6 @@ test_config_write (void)
+ 	                 " leftmodecfgclient=yes\n"
+ 	                 " rightsubnet=0.0.0.0/0\n"
+ 	                 " rekey=yes\n"
+-	                 " phase2alg=aes256-sha1\n"
+ 	                 " keyingtries=1\n"
+ 	                 " rightmodecfgserver=yes\n"
+ 	                 " modecfgpull=yes\n");
+@@ -372,7 +370,6 @@ test_config_read (void)
+ 		 " leftmodecfgclient=yes\n"
+ 		 " rightsubnet=0.0.0.0/0\n"
+ 		 " rekey=yes\n"
+-		 " phase2alg=aes256-sha1\n"
+ 		 " keyingtries=1\n"
+ 		 " rightmodecfgserver=yes\n"
+ 		 " modecfgpull=yes\n",
+diff --git a/shared/utils.c b/shared/utils.c
+index 9c33315..a2e5b9a 100644
+--- a/shared/utils.c
++++ b/shared/utils.c
+@@ -223,10 +223,13 @@ add_ike (NMSettingVpn *s_vpn, const char *key, const char *val)
+ static void
+ add_phase2alg (NMSettingVpn *s_vpn, const char *key, const char *val)
+ {
++	const char *leftid;
++
+ 	if (val == NULL || val[0] == '\0')
+ 		val = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_ESP);
+ 	if (val == NULL || val[0] == '\0') {
+-		if (nm_libreswan_utils_setting_is_ikev2 (s_vpn))
++		leftid = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTID);
++		if (!nm_libreswan_utils_setting_is_ikev2 (s_vpn) && leftid && leftid[0] != '\0')
+ 			val = NM_LIBRESWAN_AGGRMODE_DEFAULT_ESP;
+ 	}
+ 	nm_setting_vpn_add_data_item (s_vpn, key, val);
+-- 
+2.50.0
+

SPECS/NetworkManager-libreswan.spec

@@ -1,26 +1,38 @@
 %if 0%{?fedora} < 28 && 0%{?rhel} < 8
 %bcond_without libnm_glib
 %else
-# Disable the legacy version by default
 %bcond_with libnm_glib
 %endif
+%if 0%{?fedora} < 36 && 0%{?rhel} < 10
+%bcond_with gtk4
+%else
+%bcond_without gtk4
+%endif 
+
+%global real_version     1.2.26
+%global rpm_version      1.2.26
+%global release_version  3
+
+%global real_version_major %(printf '%s' '%{real_version}' | sed -n 's/^\\([1-9][0-9]*\\.[1-9][0-9]*\\)\\.[1-9][0-9]*$/\\1/p')
 
 %global nm_version       1:1.2.0
 %global nma_version      1.2.0
 
+
 Summary:   NetworkManager VPN plug-in for IPsec VPN
 Name:      NetworkManager-libreswan
-Version:   1.2.10
-Release:   7%{?dist}
+Version:   %{rpm_version}
+Release:   %{release_version}%{?dist}
 License:   GPLv2+
-URL:       http://www.gnome.org/projects/NetworkManager/
-Group:     System Environment/Base
-Source0:   https://download.gnome.org/sources/NetworkManager-libreswan/1.2/%{name}-%{version}.tar.xz
-Patch0:    0001-po-import-translations-from-Red-Hat-translators.patch
-Patch1:    0002-properties-set-advanced-dialog-modal.patch
-Patch2:    0003-service-fix-wrong-refcounting-in-D-Bus-handler-for-C.patch
-Patch3:    0004-ipsec-conf-escaping-cve-2024-9050.patch
+URL:       https://gitlab.gnome.org/GNOME/NetworkManager-libreswan/
+Source0:   https://download.gnome.org/sources/NetworkManager-libreswan/%{real_version_major}/%{name}-%{real_version}.tar.xz
 
+Patch0:    https://gitlab.gnome.org/GNOME/NetworkManager-libreswan/-/commit/3ea80883fefc.patch#/0001-Add-nm-auto-defaults-option.patch
+Patch1:    https://gitlab.gnome.org/GNOME/NetworkManager-libreswan/-/commit/9b4467bd226d.patch#/0002-Treat-leftmodecfgserver-differently-according-to-nm-.patch
+Patch2:    https://gitlab.gnome.org/GNOME/NetworkManager-libreswan/-/commit/43f3df676e82.patch#/0003-shared-utils-only-set-phase2alg-esp-for-ikev1-in-agg.patch
+
+BuildRequires: make
+BuildRequires: gcc
 BuildRequires: gtk3-devel
 BuildRequires: libnl3-devel
 BuildRequires: NetworkManager-libnm-devel >= %{nm_version}
@@ -34,6 +46,10 @@ BuildRequires: NetworkManager-glib-devel >= %{nm_version}
 BuildRequires: libnm-gtk-devel >= %{nma_version}
 %endif
 
+%if %with gtk4
+BuildRequires: libnma-gtk4-devel
+%endif
+
 Requires: NetworkManager >= %{nm_version}
 Requires: dbus
 Requires: /usr/sbin/ipsec
@@ -45,13 +61,14 @@ Obsoletes: NetworkManager-openswan < %{version}-%{release}
 %global __provides_exclude ^(%{_privatelibs})$
 %global __requires_exclude ^(%{_privatelibs})$
 
+
 %description
 This package contains software for integrating the libreswan VPN software
 with NetworkManager and the GNOME desktop
 
+
 %package -n NetworkManager-libreswan-gnome
 Summary: NetworkManager VPN plugin for libreswan - GNOME files
-Group:   System Environment/Base
 
 Requires: %{name}%{?_isa} = %{version}-%{release}
 Requires: shared-mime-info
@@ -63,12 +80,17 @@ Obsoletes: NetworkManager-openswan-gnome < %{version}-%{release}
 This package contains software for integrating VPN capabilities with
 the libreswan server with NetworkManager (GNOME files).
 
+
 %prep
-%autosetup -p1 -n %{name}-%{version}
+%autosetup -p1 -n "%{name}-%{real_version}"
+
 
 %build
 %configure \
         --disable-static \
+%if %with gtk4
+    --with-gtk4 \
+%endif
 %if %without libnm_glib
         --without-libnm-glib \
 %endif
@@ -76,18 +98,13 @@ the libreswan server with NetworkManager (GNOME files).
         --with-dist-version=%{version}-%{release}
 make %{?_smp_mflags}
 
+
 %install
 make install DESTDIR=%{buildroot}
 rm -f %{buildroot}%{_libdir}/NetworkManager/lib*.la
 
 %find_lang %{name}
 
-%post
-update-desktop-database &> /dev/null || :
-
-%postun
-update-desktop-database &> /dev/null || :
-
 %files -f %{name}.lang
 %{_libdir}/NetworkManager/libnm-vpn-plugin-libreswan.so
 %{_sysconfdir}/dbus-1/system.d/nm-libreswan-service.conf
@@ -95,55 +112,95 @@ update-desktop-database &> /dev/null || :
 %{_libexecdir}/nm-libreswan-service
 %{_libexecdir}/nm-libreswan-service-helper
 %{_mandir}/man5/nm-settings-libreswan.5.gz
-%doc AUTHORS ChangeLog NEWS
+%doc AUTHORS NEWS
 %license COPYING
 
+
 %files -n NetworkManager-libreswan-gnome
 %{_libexecdir}/nm-libreswan-auth-dialog
 %{_libdir}/NetworkManager/libnm-vpn-plugin-libreswan-editor.so
-%dir %{_datadir}/gnome-vpn-properties/libreswan
-%{_datadir}/gnome-vpn-properties/libreswan/nm-libreswan-dialog.ui
-%{_datadir}/appdata/network-manager-libreswan.metainfo.xml
+%{_metainfodir}/network-manager-libreswan.metainfo.xml
 
 %if %with libnm_glib
 %{_libdir}/NetworkManager/libnm-*-properties.so
 %{_sysconfdir}/NetworkManager/VPN/nm-libreswan-service.name
 %endif
 
-%changelog
-* Thu Oct 03 2024 Lubomir Rintel <lkundrak@v3.sk> - 1.2.10-7
-- Unbreak validation of unknown keys
+%if %with gtk4
+%{_libdir}/NetworkManager/libnm-gtk4-vpn-plugin-libreswan-editor.so
+%endif
 
-* Wed Sep 25 2024 Lubomir Rintel <lkundrak@v3.sk> - 1.2.10-6
+%changelog
+* Tue Jul 01 2025 Gris Ge <fge@redhat.com> - 1.2.26-3
+- Fix regression on phase2alg/esp for IKEv1 (RHEL-85768)
+
+* Mon May 12 2025 Lubomir Rintel <lkundrak@v3.sk> - 1.2.26-2
+- Add support for nm-auto-defaults (RHEL-85768)
+
+* Tue Jan 28 2025 Lubomir Rintel <lkundrak@v3.sk> - 1.2.26-1
+- Update to 1.2.26 release
+- Add support for leftsubnets/rightsubnets (RHEL-56553)
+
+* Tue Oct 22 2024 Lubomir Rintel <lkundrak@v3.sk> - 1.2.24-1
+- Update to 1.2.24 release
 - Fix improper escaping of Libreswan configuration (CVE-2024-9050)
 
-* Mon Feb  5 2024 Wen Liang <wenliang@redhat.com> - 1.2.10-5
-- Fix crash in libreswan_add_profile_wrong_password (RHEL-13123)
+* Thu Sep 12 2024 Íñigo Huguet <ihuguet@redhat.com> - 1.2.22-2
+- Support require-id-on-certificate (RHEL-58040)
 
-* Tue Jul  9 2019 Francesco Giudici <fgiudici@redhat.com> - 1.2.10-4
-- Fix Gnome IPsec advanced options dialog (rh #1697329)
+* Wed May 22 2024 Beniamino Galvani <bgalvani@redhat.com> - 1.2.22-1
+- Add IPv6 support (RHEL-21875)
 
-* Mon Dec 10 2018 Lubomir Rintel <lkundrak@v3.sk> - 1.2.10-3
-- Update the translations (rh #1608329)
+* Wed Apr 17 2024 Íñigo Huguet <ihuguet@redhat.com> - 1.2.20-1
+- Support "leftsubnet" property (RHEL-26776)
+- Support "rightcert" property (RHEL-30370)
 
-* Thu Oct 16 2018 Lubomir Rintel <lkundrak@v3.sk> - 1.2.10-2
-- Import the translations (rh #1608329)
+* Wed Jan 17 2024 Fernando Fernandez Mancera <ferferna@redhat.com> - 1.2.18-2
+- Support point-to-point IPSec tunnel (RHEL-20690)
+- Fix crash in libreswan_nmstate_iface_dpd_rsa (RHEL-21221)
+- Support configuring IPSec mode with 'type' (RHEL-21554)
 
-* Mon Oct 15 2018 Francesco Giudici <fgiudici@redhat.com> - 1.2.10-1
-- Update to 1.2.10 release (rh #1637867)
-- Fix import functionality (rh #1633174)
+* Fri Dec 15 2023 Fernando Fernandez Mancera <ferferna@redhat.com> - 1.2.18-1
+- Update to 1.2.18 release
 
-* Wed Oct  3 2018 Beniamino Galvani <bgalvani@redhat.com> - 1.2.8-2
-- Rebuild with updated annobin (rh #1630605)
+* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 1.2.14-1.3
+- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
+  Related: rhbz#1991688
 
-* Mon Sep 17 2018 Francesco Giudici <fgiudici@redhat.com> - 1.2.8-1
-- Update to 1.2.8 release
+* Thu Apr 15 2021 Mohan Boddu <mboddu@redhat.com> - 1.2.14-1.2
+- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
 
-* Mon Aug 13 2018 Francesco Giudici <fgiudici@redhat.com> - 1.2.8-0.1
-- Update to latest development snapshot of NetworkManager-libreswan 1.2.8
-- Introduced IKEv2 support (rh #1557035)
-- Introduced support to more Libreswan properties (rh #1557035)
-- Updated translations
+* Mon Jan 25 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.14-1.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Tue Jan 12 2021 Beniamino Galvani <bgalvani@redhat.com> - 1.2.14-1
+- Update to 1.2.14 release
+
+* Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.12-1.2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.12-1.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Wed Jul 31 2019 Francesco Giudici <fgiudici@redhat.com> - 1.2.12-1
+- Updated to 1.2.12
+
+* Wed Jul 24 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.10-1.2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.10-1.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Thu Oct 18 2018 Francesco Giudici <fgiudici@redhat.com> - 1.2.10-1
+- Updated to 1.2.10
+- Import latest translations from upstream
+
+* Wed Aug 22 2018 Paul Wouters <pwouters@redhat.com> - 1.2.6-1
+- Updated to 1.2.6
+- Upstream patches for IKEv2 support
+
+* Thu Jul 12 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.4-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
 
 * Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.4-6
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild