2017-08-10 02:53:01 +00:00
|
|
|
%global _hardened_build 1
|
2018-06-27 18:09:50 +00:00
|
|
|
# These are rpm macros and are 0 or 1
|
|
|
|
|
%global with_efence 0
|
|
|
|
|
%global with_development 0
|
|
|
|
|
%global with_cavstests 1
|
|
|
|
|
# Libreswan config options
|
|
|
|
|
%global libreswan_config \\\
|
|
|
|
|
FINALLIBEXECDIR=%{_libexecdir}/ipsec \\\
|
|
|
|
|
FINALMANDIR=%{_mandir} \\\
|
|
|
|
|
FIPSPRODUCTCHECK=%{_sysconfdir}/system-fips \\\
|
|
|
|
|
INC_RCDEFAULT=%{_initrddir} \\\
|
|
|
|
|
INC_USRLOCAL=%{_prefix} \\\
|
|
|
|
|
INITSYSTEM=systemd \\\
|
|
|
|
|
USE_DNSSEC=true \\\
|
|
|
|
|
USE_FIPSCHECK=true \\\
|
|
|
|
|
USE_LABELED_IPSEC=true \\\
|
|
|
|
|
USE_LDAP=true \\\
|
|
|
|
|
USE_LIBCAP_NG=true \\\
|
|
|
|
|
USE_LIBCURL=true \\\
|
|
|
|
|
USE_LINUX_AUDIT=true \\\
|
|
|
|
|
USE_NM=true \\\
|
|
|
|
|
USE_SECCOMP=true \\\
|
|
|
|
|
USE_XAUTHPAM=true \\\
|
|
|
|
|
%{nil}
|
2013-04-13 20:58:36 +00:00
|
|
|
|
2017-08-10 02:53:01 +00:00
|
|
|
#global prever rc1
|
2013-04-13 20:58:36 +00:00
|
|
|
|
|
|
|
|
Name: libreswan
|
|
|
|
|
Summary: IPsec implementation with IKEv1 and IKEv2 keying protocols
|
2017-08-10 02:53:01 +00:00
|
|
|
# version is generated in the release script
|
2019-06-10 17:30:17 +00:00
|
|
|
Version: 3.29
|
2020-01-29 10:14:05 +00:00
|
|
|
Release: %{?prever:0.}2%{?prever:.%{prever}}%{?dist}.1
|
2013-04-13 20:58:36 +00:00
|
|
|
License: GPLv2
|
2015-12-18 20:41:52 +00:00
|
|
|
Url: https://libreswan.org/
|
|
|
|
|
Source0: https://download.libreswan.org/%{?prever:development/}%{name}-%{version}%{?prever}.tar.gz
|
2018-06-27 18:09:50 +00:00
|
|
|
%if 0%{with_cavstests}
|
2015-08-25 03:23:01 +00:00
|
|
|
Source1: https://download.libreswan.org/cavs/ikev1_dsa.fax.bz2
|
|
|
|
|
Source2: https://download.libreswan.org/cavs/ikev1_psk.fax.bz2
|
|
|
|
|
Source3: https://download.libreswan.org/cavs/ikev2.fax.bz2
|
|
|
|
|
%endif
|
2018-07-02 16:12:34 +00:00
|
|
|
|
2020-01-09 20:55:22 +00:00
|
|
|
Patch1: libreswan-3.29-updown-syntax.patch
|
|
|
|
|
|
2018-06-27 18:09:50 +00:00
|
|
|
Requires(post): bash coreutils systemd
|
2013-04-13 20:58:36 +00:00
|
|
|
Requires(preun): systemd
|
|
|
|
|
Requires(postun): systemd
|
|
|
|
|
|
|
|
|
|
Conflicts: openswan < %{version}-%{release}
|
|
|
|
|
Obsoletes: openswan < %{version}-%{release}
|
|
|
|
|
Provides: openswan = %{version}-%{release}
|
2013-08-19 23:29:49 +00:00
|
|
|
Provides: openswan-doc = %{version}-%{release}
|
2013-04-13 20:58:36 +00:00
|
|
|
|
2018-07-24 14:33:26 +00:00
|
|
|
BuildRequires: gcc
|
2013-04-13 20:58:36 +00:00
|
|
|
BuildRequires: pkgconfig hostname
|
2018-06-27 18:09:50 +00:00
|
|
|
BuildRequires: bison flex
|
|
|
|
|
BuildRequires: systemd-devel
|
|
|
|
|
BuildRequires: nss-devel >= 3.16.1
|
|
|
|
|
BuildRequires: nspr-devel
|
2013-04-13 20:58:36 +00:00
|
|
|
BuildRequires: pam-devel
|
2015-08-25 03:23:01 +00:00
|
|
|
BuildRequires: libevent-devel
|
2018-06-27 18:09:50 +00:00
|
|
|
BuildRequires: unbound-devel >= 1.6.0-6
|
|
|
|
|
BuildRequires: ldns-devel
|
2017-01-15 21:09:10 +00:00
|
|
|
BuildRequires: libseccomp-devel
|
|
|
|
|
BuildRequires: libselinux-devel
|
2017-08-10 02:53:01 +00:00
|
|
|
BuildRequires: fipscheck-devel
|
|
|
|
|
Requires: fipscheck%{_isa}
|
2013-04-13 20:58:36 +00:00
|
|
|
Buildrequires: audit-libs-devel
|
|
|
|
|
BuildRequires: libcap-ng-devel
|
2018-06-27 18:09:50 +00:00
|
|
|
BuildRequires: openldap-devel
|
|
|
|
|
BuildRequires: curl-devel
|
|
|
|
|
%if 0%{with_efence}
|
2013-04-13 20:58:36 +00:00
|
|
|
BuildRequires: ElectricFence
|
|
|
|
|
%endif
|
2015-08-25 03:23:01 +00:00
|
|
|
BuildRequires: xmlto
|
2013-04-13 20:58:36 +00:00
|
|
|
|
2018-06-27 18:09:50 +00:00
|
|
|
Requires: nss-tools
|
|
|
|
|
Requires: nss-softokn
|
2013-10-31 03:17:42 +00:00
|
|
|
Requires: iproute >= 2.6.8
|
2018-06-27 18:09:50 +00:00
|
|
|
Requires: unbound-libs >= 1.6.6
|
2013-04-13 20:58:36 +00:00
|
|
|
|
|
|
|
|
%description
|
2013-05-13 18:34:29 +00:00
|
|
|
Libreswan is a free implementation of IPsec & IKE for Linux. IPsec is
|
2013-04-13 20:58:36 +00:00
|
|
|
the Internet Protocol Security and uses strong cryptography to provide
|
|
|
|
|
both authentication and encryption services. These services allow you
|
|
|
|
|
to build secure tunnels through untrusted networks. Everything passing
|
2013-05-13 18:34:29 +00:00
|
|
|
through the untrusted net is encrypted by the ipsec gateway machine and
|
2013-04-13 20:58:36 +00:00
|
|
|
decrypted by the gateway at the other end of the tunnel. The resulting
|
|
|
|
|
tunnel is a virtual private network or VPN.
|
|
|
|
|
|
|
|
|
|
This package contains the daemons and userland tools for setting up
|
|
|
|
|
Libreswan. To build KLIPS, see the kmod-libreswan.spec file.
|
|
|
|
|
|
|
|
|
|
Libreswan also supports IKEv2 (RFC4309) and Secure Labeling
|
|
|
|
|
|
|
|
|
|
Libreswan is based on Openswan-2.6.38 which in turn is based on FreeS/WAN-2.04
|
|
|
|
|
|
|
|
|
|
%prep
|
|
|
|
|
%setup -q -n libreswan-%{version}%{?prever}
|
2018-02-20 00:28:48 +00:00
|
|
|
# Fedora should really figure this versioning out itself, not burden upstream
|
2015-07-13 19:00:05 +00:00
|
|
|
sed -i "s:/usr/bin/python:/usr/bin/python3:" programs/verify/verify.in
|
2018-02-20 00:28:48 +00:00
|
|
|
sed -i "s:/usr/bin/python:/usr/bin/python3:" programs/show/show.in
|
|
|
|
|
sed -i "s:/usr/bin/python:/usr/bin/python3:" testing/cert_verify/usage_test
|
|
|
|
|
sed -i "s:/usr/bin/python:/usr/bin/python3:" testing/pluto/ikev1-01-fuzzer/cve-2015-3204.py
|
|
|
|
|
sed -i "s:/usr/bin/python:/usr/bin/python3:" testing/pluto/ikev2-15-fuzzer/send_bad_packets.py
|
|
|
|
|
sed -i "s:/usr/bin/python:/usr/bin/python3:" testing/x509/dist_certs.py
|
2018-09-27 02:25:07 +00:00
|
|
|
sed -i "s:/usr/bin/python:/usr/bin/python3:" programs/_unbound-hook/_unbound-hook.in
|
2018-06-27 18:09:50 +00:00
|
|
|
# enable crypto-policies support
|
|
|
|
|
sed -i "s:#[ ]*include \(.*\)\(/crypto-policies/back-ends/libreswan.config\)$:include \1\2:" programs/configs/ipsec.conf.in
|
2018-09-17 15:32:26 +00:00
|
|
|
# linking to freebl is no longer needed
|
|
|
|
|
sed -i "s/-lfreebl //" mk/config.mk
|
2017-02-03 22:51:18 +00:00
|
|
|
|
2020-01-09 20:55:22 +00:00
|
|
|
%patch1 -p1
|
|
|
|
|
|
2013-04-13 20:58:36 +00:00
|
|
|
%build
|
2018-06-27 18:09:50 +00:00
|
|
|
%if 0%{with_efence}
|
|
|
|
|
%global efence "-lefence"
|
2013-04-13 20:58:36 +00:00
|
|
|
%endif
|
|
|
|
|
|
|
|
|
|
#796683: -fno-strict-aliasing
|
2015-08-25 03:23:01 +00:00
|
|
|
make %{?_smp_mflags} \
|
2018-06-27 18:09:50 +00:00
|
|
|
%if 0%{with_development}
|
|
|
|
|
USERCOMPILE="-g -DGCC_LINT %(echo %{optflags} | sed -e s/-O[0-9]*/ /) %{?efence} -fPIE -pie -fno-strict-aliasing -Wformat-nonliteral -Wformat-security" \
|
2017-08-10 02:53:01 +00:00
|
|
|
%else
|
2018-06-27 18:09:50 +00:00
|
|
|
USERCOMPILE="-g -DGCC_LINT %{optflags} %{?efence} -fPIE -pie -fno-strict-aliasing -Wformat-nonliteral -Wformat-security" \
|
2013-04-13 20:58:36 +00:00
|
|
|
%endif
|
2018-06-27 18:09:50 +00:00
|
|
|
USERLINK="-g -pie -Wl,-z,relro,-z,now %{?efence}" \
|
|
|
|
|
%{libreswan_config} \
|
|
|
|
|
programs
|
2013-04-13 20:58:36 +00:00
|
|
|
FS=$(pwd)
|
|
|
|
|
|
|
|
|
|
# Add generation of HMAC checksums of the final stripped binaries
|
|
|
|
|
%define __spec_install_post \
|
|
|
|
|
%{?__debug_package:%{__debug_install_post}} \
|
|
|
|
|
%{__arch_install_post} \
|
|
|
|
|
%{__os_install_post} \
|
2018-06-27 18:09:50 +00:00
|
|
|
fipshmac -d %{buildroot}%{_libdir}/fipscheck %{buildroot}%{_libexecdir}/ipsec/pluto \
|
2013-04-13 20:58:36 +00:00
|
|
|
%{nil}
|
|
|
|
|
|
|
|
|
|
%install
|
2015-08-25 03:23:01 +00:00
|
|
|
make \
|
2018-06-27 18:09:50 +00:00
|
|
|
DESTDIR=%{buildroot} \
|
|
|
|
|
%{libreswan_config} \
|
|
|
|
|
install
|
2013-04-13 20:58:36 +00:00
|
|
|
FS=$(pwd)
|
|
|
|
|
rm -rf %{buildroot}/usr/share/doc/libreswan
|
|
|
|
|
|
2018-06-27 18:09:50 +00:00
|
|
|
install -d -m 0700 %{buildroot}%{_rundir}/pluto
|
2015-08-25 03:23:01 +00:00
|
|
|
# used when setting --perpeerlog without --perpeerlogbase
|
2013-04-13 20:58:36 +00:00
|
|
|
install -d -m 0700 %{buildroot}%{_localstatedir}/log/pluto/peer
|
|
|
|
|
install -d %{buildroot}%{_sbindir}
|
|
|
|
|
|
2015-08-25 03:23:01 +00:00
|
|
|
install -d %{buildroot}%{_sysconfdir}/sysctl.d
|
|
|
|
|
install -m 0644 packaging/fedora/libreswan-sysctl.conf \
|
2018-06-27 18:09:50 +00:00
|
|
|
%{buildroot}%{_sysconfdir}/sysctl.d/50-libreswan.conf
|
2015-08-25 03:23:01 +00:00
|
|
|
|
2013-04-13 20:58:36 +00:00
|
|
|
mkdir -p %{buildroot}%{_libdir}/fipscheck
|
|
|
|
|
|
2017-08-10 02:53:01 +00:00
|
|
|
echo "include %{_sysconfdir}/ipsec.d/*.secrets" \
|
2018-06-27 18:09:50 +00:00
|
|
|
> %{buildroot}%{_sysconfdir}/ipsec.secrets
|
2013-12-11 01:30:56 +00:00
|
|
|
rm -fr %{buildroot}%{_sysconfdir}/rc.d/rc*
|
2013-04-13 20:58:36 +00:00
|
|
|
|
2018-06-27 18:09:50 +00:00
|
|
|
%if 0%{with_cavstests}
|
2015-08-25 03:23:01 +00:00
|
|
|
%check
|
|
|
|
|
# There is an elaborate upstream testing infrastructure which we do not
|
|
|
|
|
# run here - it takes hours and uses kvm
|
|
|
|
|
# We only run the CAVS tests.
|
|
|
|
|
cp %{SOURCE1} %{SOURCE2} %{SOURCE3} .
|
|
|
|
|
bunzip2 *.fax.bz2
|
2017-01-15 21:09:10 +00:00
|
|
|
|
|
|
|
|
# work around for older xen based machines
|
|
|
|
|
export NSS_DISABLE_HW_GCM=1
|
|
|
|
|
|
2015-08-25 03:23:01 +00:00
|
|
|
: starting CAVS test for IKEv2
|
2018-06-27 18:09:50 +00:00
|
|
|
%{buildroot}%{_libexecdir}/ipsec/cavp -v2 ikev2.fax | \
|
2015-08-25 03:23:01 +00:00
|
|
|
diff -u ikev2.fax - > /dev/null
|
|
|
|
|
: starting CAVS test for IKEv1 RSASIG
|
2018-06-27 18:09:50 +00:00
|
|
|
%{buildroot}%{_libexecdir}/ipsec/cavp -v1dsa ikev1_dsa.fax | \
|
2015-08-25 03:23:01 +00:00
|
|
|
diff -u ikev1_dsa.fax - > /dev/null
|
|
|
|
|
: starting CAVS test for IKEv1 PSK
|
2018-06-27 18:09:50 +00:00
|
|
|
%{buildroot}%{_libexecdir}/ipsec/cavp -v1psk ikev1_psk.fax | \
|
2015-08-25 03:23:01 +00:00
|
|
|
diff -u ikev1_psk.fax - > /dev/null
|
|
|
|
|
: CAVS tests passed
|
|
|
|
|
%endif
|
|
|
|
|
|
|
|
|
|
%post
|
|
|
|
|
%systemd_post ipsec.service
|
|
|
|
|
|
|
|
|
|
%preun
|
|
|
|
|
%systemd_preun ipsec.service
|
|
|
|
|
|
|
|
|
|
%postun
|
|
|
|
|
%systemd_postun_with_restart ipsec.service
|
|
|
|
|
|
2013-05-13 18:34:29 +00:00
|
|
|
%files
|
2015-08-25 03:23:01 +00:00
|
|
|
%doc CHANGES COPYING CREDITS README* LICENSE
|
|
|
|
|
%doc docs/*.* docs/examples
|
2013-04-13 20:58:36 +00:00
|
|
|
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipsec.conf
|
|
|
|
|
%attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ipsec.secrets
|
|
|
|
|
%attr(0700,root,root) %dir %{_sysconfdir}/ipsec.d
|
|
|
|
|
%attr(0700,root,root) %dir %{_sysconfdir}/ipsec.d/policies
|
|
|
|
|
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipsec.d/policies/*
|
2015-08-25 03:23:01 +00:00
|
|
|
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/sysctl.d/50-libreswan.conf
|
|
|
|
|
%attr(0700,root,root) %dir %{_localstatedir}/log/pluto
|
2013-04-13 20:58:36 +00:00
|
|
|
%attr(0700,root,root) %dir %{_localstatedir}/log/pluto/peer
|
2018-07-09 02:37:04 +00:00
|
|
|
%attr(0755,root,root) %dir %{_rundir}/pluto
|
2015-08-25 03:23:01 +00:00
|
|
|
%attr(0644,root,root) %{_tmpfilesdir}/libreswan.conf
|
2013-04-13 20:58:36 +00:00
|
|
|
%attr(0644,root,root) %{_unitdir}/ipsec.service
|
|
|
|
|
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/pam.d/pluto
|
|
|
|
|
%{_sbindir}/ipsec
|
|
|
|
|
%{_libexecdir}/ipsec
|
2018-06-27 18:09:50 +00:00
|
|
|
%doc %{_mandir}/*/*
|
2017-01-15 21:09:10 +00:00
|
|
|
%{_libdir}/fipscheck/pluto.hmac
|
2013-04-13 20:58:36 +00:00
|
|
|
|
|
|
|
|
%changelog
|
2020-01-29 10:14:05 +00:00
|
|
|
* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.29-2.1
|
|
|
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
|
|
|
|
|
|
2020-01-09 20:55:22 +00:00
|
|
|
* Thu Jan 09 2020 Paul Wouters <pwouters@redhat.com> - 3.29-2
|
|
|
|
|
- _updown.netkey: fix syntax error in checking routes
|
|
|
|
|
|
2019-07-25 14:17:15 +00:00
|
|
|
* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 3.29-1.1
|
|
|
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
|
|
|
|
|
|
2019-06-10 17:30:17 +00:00
|
|
|
* Mon Jun 10 2019 Paul Wouters <pwouters@redhat.com> - 3.29-1
|
2019-06-10 17:33:41 +00:00
|
|
|
- Resolves: rhbz#1718986 Updated to 3.29 for CVE-2019-10155
|
2019-06-10 17:30:17 +00:00
|
|
|
|
2019-05-21 04:07:35 +00:00
|
|
|
* Tue May 21 2019 Paul Wouters <pwouters@redhat.com> - 3.28-1
|
2019-06-10 17:30:17 +00:00
|
|
|
- Updated to 3.28 (many imported bugfixes, including CVE-2019-12312)
|
2019-05-21 04:07:35 +00:00
|
|
|
|
2019-02-01 08:07:52 +00:00
|
|
|
* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 3.27-1.2
|
|
|
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
|
|
|
|
|
|
2019-01-14 18:07:22 +00:00
|
|
|
* Mon Jan 14 2019 Björn Esser <besser82@fedoraproject.org> - 3.27-1.1
|
|
|
|
|
- Rebuilt for libcrypt.so.2 (#1666033)
|
|
|
|
|
|
2018-10-08 22:28:06 +00:00
|
|
|
* Mon Oct 08 2018 Paul Wouters <pwouters@redhat.com> - 3.27-1
|
|
|
|
|
- Updated to 3.27 (various bugfixes)
|
|
|
|
|
|
2018-09-27 02:25:07 +00:00
|
|
|
* Thu Sep 27 2018 Paul Wouters <pwouters@redhat.com> - 3.26-3
|
|
|
|
|
- Add fedora python fixup for _unbound-hook
|
|
|
|
|
|
2018-09-17 15:32:26 +00:00
|
|
|
* Mon Sep 17 2018 Paul Wouters <pwouters@redhat.com> - 3.26-2
|
|
|
|
|
- linking against freebl is no longer needed (and wasn't done in 3.25)
|
|
|
|
|
|
2018-09-17 03:04:22 +00:00
|
|
|
* Mon Sep 17 2018 Paul Wouters <pwouters@redhat.com> - 3.26-1
|
|
|
|
|
- Updated to 3.26 (CHACHA20POLY1305, ECDSA and RSA-PSS support)
|
|
|
|
|
|
2018-07-13 08:46:22 +00:00
|
|
|
* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 3.25-3.1
|
|
|
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
|
|
|
|
|
|
2018-07-09 02:37:04 +00:00
|
|
|
* Mon Jul 09 2018 Paul Wouters <pwouters@redhat.com> - 3.25-3
|
|
|
|
|
- Fix Opportunistic IPsec _unbound-hook argument parsing
|
|
|
|
|
- Make rundir readable for all (so we can hand out permissions later)
|
|
|
|
|
|
2018-07-02 16:12:34 +00:00
|
|
|
* Mon Jul 02 2018 Paul Wouters <pwouters@redhat.com> - 3.25-2
|
|
|
|
|
- Relax deleting IKE SA's and IPsec SA's to avoid interop issues with third party VPN vendors
|
|
|
|
|
|
2018-06-27 18:09:50 +00:00
|
|
|
* Wed Jun 27 2018 Paul Wouters <pwouters@redhat.com> - 3.25-1
|
|
|
|
|
- Updated to 3.25
|
|
|
|
|
|
2018-02-19 23:13:58 +00:00
|
|
|
* Mon Feb 19 2018 Paul Wouters <pwouters@redhat.com> - 3.23-2
|
|
|
|
|
- Support crypto-policies package
|
|
|
|
|
- Pull in some patches from upstream and IANA registry updates
|
|
|
|
|
- gcc7 format-truncate fixes and workarounds
|
|
|
|
|
|
2018-02-07 23:14:09 +00:00
|
|
|
* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 3.23-1.1
|
|
|
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
|
|
|
|
|
|
2018-01-25 20:43:12 +00:00
|
|
|
* Thu Jan 25 2018 Paul Wouters <pwouters@redhat.com> - 3.23-1
|
|
|
|
|
- Updated to 3.23 - support for MOBIKE, PPK, CMAC, nic offload and performance improvements
|
|
|
|
|
|
2018-01-20 22:07:07 +00:00
|
|
|
* Sat Jan 20 2018 Björn Esser <besser82@fedoraproject.org> - 3.22-1.1
|
|
|
|
|
- Rebuilt for switch to libxcrypt
|
|
|
|
|
|
2017-10-23 02:02:33 +00:00
|
|
|
* Mon Oct 23 2017 Paul Wouters <pwouters@redhat.com> - 3.22-1
|
|
|
|
|
- Updated to 3.22 - many bugfixes, and unbound ipsecmod support
|
|
|
|
|
|
2017-08-10 02:53:01 +00:00
|
|
|
* Wed Aug 9 2017 Paul Wouters <pwouters@redhat.com> - 3.21-1
|
|
|
|
|
- Updated to 3.21
|
|
|
|
|
|
2017-08-03 02:12:11 +00:00
|
|
|
* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 3.20-1.2
|
|
|
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
|
|
|
|
|
|
2017-07-26 19:39:11 +00:00
|
|
|
* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 3.20-1.1
|
|
|
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
|
|
|
|
|
|
2017-03-14 16:16:26 +00:00
|
|
|
* Tue Mar 14 2017 Paul Wouters <pwouters@redhat.com> - 3.20-1
|
|
|
|
|
- Updated to 3.20
|
|
|
|
|
|
2017-03-03 16:55:08 +00:00
|
|
|
* Fri Mar 03 2017 Paul Wouters <pwouters@redhat.com> - 3.20-0.1.dr4
|
|
|
|
|
- Update to 3.20dr4 to test mozbz#1336487 export CERT_CompareAVA
|
|
|
|
|
|
2017-02-10 19:23:41 +00:00
|
|
|
* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 3.19-1.1
|
|
|
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
|
|
|
|
|
|
2017-02-03 22:51:18 +00:00
|
|
|
* Fri Feb 03 2017 Paul Wouters <pwouters@redhat.com> - 3.19-2
|
|
|
|
|
- Resolves: rhbz#1392191 libreswan: crash when OSX client connects
|
|
|
|
|
- Improved uniqueid and session replacing support
|
|
|
|
|
- Test Buffer warning fix on size_t
|
|
|
|
|
- Re-introduce --configdir for backwards compatibility
|
|
|
|
|
|
2017-01-15 21:09:10 +00:00
|
|
|
* Sun Jan 15 2017 Paul Wouters <pwouters@redhat.com> - 3.19-1
|
|
|
|
|
- Updated to 3.19 (see download.libreswan.org/CHANGES)
|
|
|
|
|
|
2016-12-19 17:20:36 +00:00
|
|
|
* Mon Dec 19 2016 Miro Hrončok <mhroncok@redhat.com> - 3.18-1.1
|
|
|
|
|
- Rebuild for Python 3.6
|
|
|
|
|
|
2016-07-29 09:18:17 +00:00
|
|
|
* Fri Jul 29 2016 Paul Wouters <pwouters@redhat.com> - 3.18-1
|
|
|
|
|
- Updated to 3.18 for CVE-2016-5391 rhbz#1361164 and VTI support
|
2016-07-29 11:39:47 +00:00
|
|
|
- Remove support for /etc/sysconfig/pluto (use native systemd instead)
|
2016-07-29 09:18:17 +00:00
|
|
|
|
2016-05-05 19:02:01 +00:00
|
|
|
* Thu May 05 2016 Paul Wouters <pwouters@redhat.com> - 3.17-2
|
2016-05-05 18:56:07 +00:00
|
|
|
- Resolves: rhbz#1324956 prelink is gone, /etc/prelink.conf.d/* is no longer used
|
|
|
|
|
|
2016-04-07 21:57:50 +00:00
|
|
|
* Thu Apr 07 2016 Paul Wouters <pwouters@redhat.com> - 3.17-1
|
2016-04-04 22:10:27 +00:00
|
|
|
- Updated to 3.17 for CVE-2016-3071
|
|
|
|
|
- Disable LIBCAP_NG as it prevents unbound-control from working properly
|
2016-04-07 21:57:50 +00:00
|
|
|
- Temporarilly disable WERROR due to a few minor known issues
|
2016-04-04 22:10:27 +00:00
|
|
|
|
2016-02-04 03:51:24 +00:00
|
|
|
* Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 3.16-1.1
|
|
|
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
|
|
|
|
|
|
2015-12-18 20:36:05 +00:00
|
|
|
* Fri Dec 18 2015 Paul Wouters <pwouters@redhat.com> - 3.16-1
|
|
|
|
|
- Updated to 3.16 (see https://download.libreswan.org/CHANGES)
|
|
|
|
|
|
2015-08-25 03:23:01 +00:00
|
|
|
* Tue Aug 11 2015 Paul Wouters <pwouters@redhat.com> - 3.15-1
|
|
|
|
|
- Updated to 3.15 (see http://download.libreswan.org/CHANGES)
|
|
|
|
|
- Resolves: rhbz#CVE-2015-3240 IKE daemon restart when receiving a bad DH gx
|
|
|
|
|
- NSS database creation moved from spec file to service file
|
|
|
|
|
- Run CAVS tests on package build
|
|
|
|
|
- Added BuildRequire systemd-units and xmlto
|
|
|
|
|
- Bumped minimum required nss to 3.16.1
|
|
|
|
|
- Install tmpfiles
|
|
|
|
|
- Install sysctl file
|
|
|
|
|
- Update doc files to include
|
|
|
|
|
|
2015-07-13 19:00:05 +00:00
|
|
|
* Mon Jul 13 2015 Paul Wouters <pwouters@redhat.com> - 3.13-2
|
|
|
|
|
- Resolves: rhbz#1238967 Switch libreswan to use python3
|
|
|
|
|
|
2015-06-17 16:31:09 +00:00
|
|
|
* Wed Jun 17 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 3.13-1.1
|
|
|
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
|
|
|
|
|
|
2015-06-01 16:48:33 +00:00
|
|
|
* Mon Jun 01 2015 Paul Wouters <pwouters@redhat.com> - 3.13-1
|
|
|
|
|
- Updated to 3.13 for CVE-2015-3204
|
|
|
|
|
|
2014-11-07 04:46:08 +00:00
|
|
|
* Fri Nov 07 2014 Paul Wouters <pwouters@redhat.com> - 3.12-1
|
|
|
|
|
- Updated to 3.12 Various IKEv2 fixes
|
|
|
|
|
|
2014-10-22 20:14:24 +00:00
|
|
|
* Wed Oct 22 2014 Paul Wouters <pwouters@redhat.com> - 3.11-1
|
|
|
|
|
- Updated to 3.11 (many fixes, including startup fixes)
|
2014-10-24 01:37:32 +00:00
|
|
|
- Resolves: rhbz#1144941 libreswan 3.10 upgrade breaks old ipsec.secrets configs
|
|
|
|
|
- Resolves: rhbz#1147072 ikev1 aggr mode connection fails after libreswan upgrade
|
|
|
|
|
- Resolves: rhbz#1144831 Libreswan appears to start with systemd before all the NICs are up and running
|
2014-10-22 20:14:24 +00:00
|
|
|
|
2014-09-09 16:34:29 +00:00
|
|
|
* Tue Sep 09 2014 Paul Wouters <pwouters@redhat.com> - 3.10-3
|
|
|
|
|
- Fix some coverity issues, auto=route on bootup and snprintf on 32bit machines
|
|
|
|
|
|
2014-09-01 22:01:11 +00:00
|
|
|
* Mon Sep 01 2014 Paul Wouters <pwouters@redhat.com> - 3.10-1
|
|
|
|
|
- Updated to 3.10, major bugfix release, new xauth status options
|
|
|
|
|
|
2014-08-17 05:48:38 +00:00
|
|
|
* Sun Aug 17 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 3.9-1.1
|
|
|
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
|
|
|
|
|
|
2014-07-10 15:12:45 +00:00
|
|
|
* Thu Jul 10 2014 Paul Wouters <pwouters@redhat.com> - 3.9-1
|
|
|
|
|
- Updated to 3.9. IKEv2 enhancements, ESP/IKE algo enhancements
|
|
|
|
|
- Mark libreswan-fips.conf as config file
|
2014-07-10 15:21:30 +00:00
|
|
|
- attr modifier for man pages no longer needed
|
2014-07-10 15:32:06 +00:00
|
|
|
- BUGS file no longer exists upstream
|
2014-07-10 15:12:45 +00:00
|
|
|
|
2014-06-07 05:17:50 +00:00
|
|
|
* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 3.8-1.1
|
|
|
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
|
|
|
|
|
|
2014-01-18 01:46:01 +00:00
|
|
|
* Sat Jan 18 2014 Paul Wouters <pwouters@redhat.com> - 3.8-1
|
|
|
|
|
- Updated to 3.8, fixes rhbz#CVE-2013-6467 (rhbz#1054102)
|
|
|
|
|
|
2013-12-11 01:30:56 +00:00
|
|
|
* Wed Dec 11 2013 Paul Wouters <pwouters@redhat.com> - 3.7-1
|
|
|
|
|
- Updated to 3.7, fixes CVE-2013-4564
|
2014-01-18 01:46:01 +00:00
|
|
|
- Fixes creating a bogus NSS db on startup (rhbz#1005410)
|
2013-12-11 01:30:56 +00:00
|
|
|
|
2013-10-31 03:17:42 +00:00
|
|
|
* Thu Oct 31 2013 Paul Wouters <pwouters@redhat.com> - 3.6-1
|
|
|
|
|
- Updated to 3.6 (IKEv2, MODECFG, Cisco interop fixes)
|
|
|
|
|
- Generate empty NSS db if none exists
|
|
|
|
|
|
2013-08-19 23:29:49 +00:00
|
|
|
* Mon Aug 19 2013 Paul Wouters <pwouters@redhat.com> - 3.5-3
|
|
|
|
|
- Add a Provides: for openswan-doc
|
|
|
|
|
|
2013-08-03 06:53:33 +00:00
|
|
|
* Sat Aug 03 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 3.5-1.1
|
|
|
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
|
|
|
|
|
|
2013-07-15 18:41:11 +00:00
|
|
|
* Mon Jul 15 2013 Paul Wouters <pwouters@redhat.com> - 3.5-2
|
|
|
|
|
- Added interop patch for (some?) Cisco VPN clients sending 16 zero
|
|
|
|
|
bytes of extraneous IKE data
|
|
|
|
|
- Removed fipscheck_version
|
|
|
|
|
|
2013-07-13 20:24:07 +00:00
|
|
|
* Sat Jul 13 2013 Paul Wouters <pwouters@redhat.com> - 3.5-1
|
|
|
|
|
- Updated to 3.5
|
|
|
|
|
|
2013-06-06 09:10:06 +00:00
|
|
|
* Thu Jun 06 2013 Paul Wouters <pwouters@redhat.com> - 3.4-1
|
|
|
|
|
- Updated to 3.4, which only contains style changes to kernel coding style
|
|
|
|
|
- IN MEMORIAM: June 3rd, 2013 Hugh Daniel
|
|
|
|
|
|
2013-05-13 18:34:29 +00:00
|
|
|
* Mon May 13 2013 Paul Wouters <pwouters@redhat.com> - 3.3-1
|
|
|
|
|
- Updated to 3.3, which resolves CVE-2013-2052
|
|
|
|
|
|
2013-04-13 20:58:36 +00:00
|
|
|
* Sat Apr 13 2013 Paul Wouters <pwouters@redhat.com> - 3.2-1
|
|
|
|
|
- Initial package for Fedora
|
