rpms/libreswan
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import libreswan-4.9-1.el8

Browse Source
This commit is contained in:
CentOS Sources 2023-05-16 06:11:11 +00:00 committed by Stepan Oksanichenko
parent 6846d84cb5
commit 2f6f01707b
8 changed files with 109 additions and 308 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored
View File

@ -1,4 +1,4 @@
SOURCES/ikev1_dsa.fax.bz2 SOURCES/ikev1_dsa.fax.bz2
SOURCES/ikev1_psk.fax.bz2 SOURCES/ikev1_psk.fax.bz2
SOURCES/ikev2.fax.bz2 SOURCES/ikev2.fax.bz2
SOURCES/libreswan-4.5.tar.gz SOURCES/libreswan-4.9.tar.gz

2
.libreswan.metadata
View File

@ -1,4 +1,4 @@
b35cd50b8bc0a08b9c07713bf19c72d53bfe66bb SOURCES/ikev1_dsa.fax.bz2 b35cd50b8bc0a08b9c07713bf19c72d53bfe66bb SOURCES/ikev1_dsa.fax.bz2
861d97bf488f9e296cad8c43ab72f111a5b1a848 SOURCES/ikev1_psk.fax.bz2 861d97bf488f9e296cad8c43ab72f111a5b1a848 SOURCES/ikev1_psk.fax.bz2
fcaf77f3deae3d8e99cdb3b1f8abea63167a0633 SOURCES/ikev2.fax.bz2 fcaf77f3deae3d8e99cdb3b1f8abea63167a0633 SOURCES/ikev2.fax.bz2
c0f636fbba5da51e9bb85ade1221d7c52ac31e07 SOURCES/libreswan-4.5.tar.gz 12b7351ca7e6ba1ac787239e67027a4d82f02f10 SOURCES/libreswan-4.9.tar.gz

31
SOURCES/libreswan-3.32-1861360-nodefault-rsa-pss.patch
View File

@ -1,10 +1,20 @@
diff -Naur libreswan-3.32-orig/lib/libipsecconf/confread.c libreswan-3.32/lib/libipsecconf/confread.c From 1dddaa3226fe1b71b68ec9665d93864a5ec69801 Mon Sep 17 00:00:00 2001
--- libreswan-3.32-orig/lib/libipsecconf/confread.c 2020-07-28 20:25:54.618261606 -0400 From: rpm-build <rpm-build>
+++ libreswan-3.32/lib/libipsecconf/confread.c 2020-07-28 20:28:03.952421236 -0400 Date: Mon, 9 Jan 2023 23:26:10 +0900
@@ -1498,9 +1498,14 @@ Subject: [PATCH] libreswan-3.32-1861360-nodefault-rsa-pss.patch
} else if (streq(val, "rsasig") || streq(val, "rsa")) {
conn->policy |= POLICY_RSASIG; ---
conn->policy |= POLICY_RSASIG_v1_5; lib/libipsecconf/confread.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/lib/libipsecconf/confread.c b/lib/libipsecconf/confread.c
index 0444118..ec87646 100644
--- a/lib/libipsecconf/confread.c
+++ b/lib/libipsecconf/confread.c
@@ -1501,9 +1501,14 @@ static bool load_conn(struct starter_conn *conn,
hunk_streq(val, "rsa")) {
conn->authby.rsasig = true;
conn->authby.rsasig_v1_5 = true;
+ /* + /*
+ * These cause failure with RSA 1024 bits because it uses RSA-PSS + * These cause failure with RSA 1024 bits because it uses RSA-PSS
+ */ + */
@ -13,6 +23,9 @@ diff -Naur libreswan-3.32-orig/lib/libipsecconf/confread.c libreswan-3.32/lib/li
conn->sighash_policy |= POL_SIGHASH_SHA2_384; conn->sighash_policy |= POL_SIGHASH_SHA2_384;
conn->sighash_policy |= POL_SIGHASH_SHA2_512; conn->sighash_policy |= POL_SIGHASH_SHA2_512;
+#endif +#endif
} else if (streq(val, "never")) { } else if (hunk_streq(val, "never")) {
conn->policy |= POLICY_AUTH_NEVER; conn->authby.never = true;
/* everything else is only supported for IKEv2 */ /* everything else is only supported for IKEv2 */
--
2.39.0

71
SOURCES/libreswan-4.1-maintain-obsolete-keywords.patch
View File

@ -1,16 +1,26 @@
diff -Naur libreswan-4.2-orig/lib/libipsecconf/keywords.c libreswan-4.2/lib/libipsecconf/keywords.c From a2cc5f8c80e8cb9be0b65f8e8544689e8b093c09 Mon Sep 17 00:00:00 2001
--- libreswan-4.2-orig/lib/libipsecconf/keywords.c 2021-02-02 20:36:01.000000000 -0500 From: rpm-build <rpm-build>
+++ libreswan-4.2/lib/libipsecconf/keywords.c 2021-02-04 19:22:05.880228930 -0500 Date: Tue, 10 Jan 2023 00:18:48 +0900
@@ -374,6 +374,8 @@ Subject: [PATCH] libreswan-4.1-maintain-obsolete-keywords.patch
{ "interfaces", kv_config, kt_string, KSF_INTERFACES, NULL, NULL, },
---
lib/libipsecconf/keywords.c | 28 ++++++++++++++++++++++++++++
1 file changed, 28 insertions(+)
diff --git a/lib/libipsecconf/keywords.c b/lib/libipsecconf/keywords.c
index fa8f0e0..03fb863 100644
--- a/lib/libipsecconf/keywords.c
+++ b/lib/libipsecconf/keywords.c
@@ -343,6 +343,8 @@ const struct keyword_def ipsec_conf_keywords[] = {
{ "ikev1-policy", kv_config, kt_enum, KBF_GLOBAL_IKEv1, kw_global_ikev1_list, NULL, },
{ "curl-iface", kv_config, kt_string, KSF_CURLIFACE, NULL, NULL, }, { "curl-iface", kv_config, kt_string, KSF_CURLIFACE, NULL, NULL, },
{ "curl-timeout", kv_config, kt_time, KBF_CURLTIMEOUT, NULL, NULL, }, { "curl-timeout", kv_config, kt_time, KBF_CURLTIMEOUT_MS, NULL, NULL, },
+ { "curl_iface", kv_config | kv_alias, kt_string, KSF_CURLIFACE, NULL, NULL, }, /* obsolete _ */ + { "curl_iface", kv_config | kv_alias, kt_string, KSF_CURLIFACE, NULL, NULL, }, /* obsolete _ */
+ { "curl_timeout", kv_config | kv_alias, kt_time, KBF_CURLTIMEOUT, NULL, NULL, }, /* obsolete _ */ + { "curl_timeout", kv_config | kv_alias, kt_time, KBF_CURLTIMEOUT_MS, NULL, NULL, }, /* obsolete _ */
{ "myvendorid", kv_config, kt_string, KSF_MYVENDORID, NULL, NULL, }, { "myvendorid", kv_config, kt_string, KSF_MYVENDORID, NULL, NULL, },
{ "syslog", kv_config, kt_string, KSF_SYSLOG, NULL, NULL, }, { "syslog", kv_config, kt_string, KSF_SYSLOG, NULL, NULL, },
@@ -381,6 +383,7 @@ @@ -350,6 +352,7 @@ const struct keyword_def ipsec_conf_keywords[] = {
{ "logfile", kv_config, kt_filename, KSF_LOGFILE, NULL, NULL, }, { "logfile", kv_config, kt_filename, KSF_LOGFILE, NULL, NULL, },
{ "plutostderrlog", kv_config, kt_filename, KSF_LOGFILE, NULL, NULL, }, /* obsolete name, but very common :/ */ { "plutostderrlog", kv_config, kt_filename, KSF_LOGFILE, NULL, NULL, }, /* obsolete name, but very common :/ */
{ "logtime", kv_config, kt_bool, KBF_LOGTIME, NULL, NULL, }, { "logtime", kv_config, kt_bool, KBF_LOGTIME, NULL, NULL, },
@ -18,12 +28,12 @@ diff -Naur libreswan-4.2-orig/lib/libipsecconf/keywords.c libreswan-4.2/lib/libi
{ "logappend", kv_config, kt_bool, KBF_LOGAPPEND, NULL, NULL, }, { "logappend", kv_config, kt_bool, KBF_LOGAPPEND, NULL, NULL, },
{ "logip", kv_config, kt_bool, KBF_LOGIP, NULL, NULL, }, { "logip", kv_config, kt_bool, KBF_LOGIP, NULL, NULL, },
{ "audit-log", kv_config, kt_bool, KBF_AUDIT_LOG, NULL, NULL, }, { "audit-log", kv_config, kt_bool, KBF_AUDIT_LOG, NULL, NULL, },
@@ -400,13 +403,20 @@ @@ -369,13 +372,20 @@ const struct keyword_def ipsec_conf_keywords[] = {
{ "global-redirect-to", kv_config, kt_string, KSF_GLOBAL_REDIRECT_TO, NULL, NULL, }, { "global-redirect-to", kv_config, kt_string, KSF_GLOBAL_REDIRECT_TO, NULL, NULL, },
{ "crl-strict", kv_config, kt_bool, KBF_CRL_STRICT, NULL, NULL, }, { "crl-strict", kv_config, kt_bool, KBF_CRL_STRICT, NULL, NULL, },
+ { "crl_strict", kv_config | kv_alias, kt_bool, KBF_CRL_STRICT, NULL, NULL, }, /* obsolete _ */ + { "crl_strict", kv_config | kv_alias, kt_bool, KBF_CRL_STRICT, NULL, NULL, }, /* obsolete _ */
{ "crlcheckinterval", kv_config, kt_time, KBF_CRL_CHECKINTERVAL, NULL, NULL, }, { "crlcheckinterval", kv_config, kt_time, KBF_CRL_CHECKINTERVAL_MS, NULL, NULL, },
+ { "strictcrlpolicy", kv_config | kv_alias, kt_bool, KBF_CRL_STRICT, NULL, NULL, }, /* obsolete; used on openswan */ + { "strictcrlpolicy", kv_config | kv_alias, kt_bool, KBF_CRL_STRICT, NULL, NULL, }, /* obsolete; used on openswan */
{ "ocsp-strict", kv_config, kt_bool, KBF_OCSP_STRICT, NULL, NULL, }, { "ocsp-strict", kv_config, kt_bool, KBF_OCSP_STRICT, NULL, NULL, },
@ -37,9 +47,9 @@ diff -Naur libreswan-4.2-orig/lib/libipsecconf/keywords.c libreswan-4.2/lib/libi
{ "ocsp-trustname", kv_config, kt_string, KSF_OCSP_TRUSTNAME, NULL, NULL, }, { "ocsp-trustname", kv_config, kt_string, KSF_OCSP_TRUSTNAME, NULL, NULL, },
+ { "ocsp_trust_name", kv_config | kv_alias, kt_string, KSF_OCSP_TRUSTNAME, NULL, NULL, }, /* obsolete _ */ + { "ocsp_trust_name", kv_config | kv_alias, kt_string, KSF_OCSP_TRUSTNAME, NULL, NULL, }, /* obsolete _ */
{ "ocsp-cache-size", kv_config, kt_number, KBF_OCSP_CACHE_SIZE, NULL, NULL, }, { "ocsp-cache-size", kv_config, kt_number, KBF_OCSP_CACHE_SIZE, NULL, NULL, },
{ "ocsp-cache-min-age", kv_config, kt_time, KBF_OCSP_CACHE_MIN, NULL, NULL, }, { "ocsp-cache-min-age", kv_config, kt_time, KBF_OCSP_CACHE_MIN_AGE_MS, NULL, NULL, },
{ "ocsp-cache-max-age", kv_config, kt_time, KBF_OCSP_CACHE_MAX, NULL, NULL, }, { "ocsp-cache-max-age", kv_config, kt_time, KBF_OCSP_CACHE_MAX_AGE_MS, NULL, NULL, },
@@ -426,6 +436,7 @@ @@ -399,6 +409,7 @@ const struct keyword_def ipsec_conf_keywords[] = {
{ "virtual_private", kv_config, kt_string, KSF_VIRTUALPRIVATE, NULL, NULL, }, /* obsolete variant, very common */ { "virtual_private", kv_config, kt_string, KSF_VIRTUALPRIVATE, NULL, NULL, }, /* obsolete variant, very common */
{ "seedbits", kv_config, kt_number, KBF_SEEDBITS, NULL, NULL, }, { "seedbits", kv_config, kt_number, KBF_SEEDBITS, NULL, NULL, },
{ "keep-alive", kv_config, kt_number, KBF_KEEPALIVE, NULL, NULL, }, { "keep-alive", kv_config, kt_number, KBF_KEEPALIVE, NULL, NULL, },
@ -47,33 +57,33 @@ diff -Naur libreswan-4.2-orig/lib/libipsecconf/keywords.c libreswan-4.2/lib/libi
{ "listen-tcp", kv_config, kt_bool, KBF_LISTEN_TCP, NULL, NULL }, { "listen-tcp", kv_config, kt_bool, KBF_LISTEN_TCP, NULL, NULL },
{ "listen-udp", kv_config, kt_bool, KBF_LISTEN_UDP, NULL, NULL }, { "listen-udp", kv_config, kt_bool, KBF_LISTEN_UDP, NULL, NULL },
@@ -437,6 +448,8 @@ @@ -410,6 +421,8 @@ const struct keyword_def ipsec_conf_keywords[] = {
#ifdef HAVE_LABELED_IPSEC #ifdef HAVE_LABELED_IPSEC
{ "ikev1-secctx-attr-type", kv_config, kt_number, KBF_SECCTX, NULL, NULL, }, /* obsolete: not a value, a type */ { "ikev1-secctx-attr-type", kv_config, kt_number, KBF_SECCTX, NULL, NULL, }, /* obsolete: not a value, a type */
{ "secctx-attr-type", kv_config | kv_alias, kt_number, KBF_SECCTX, NULL, NULL, }, { "secctx-attr-type", kv_config | kv_alias, kt_number, KBF_SECCTX, NULL, NULL, },
+ { "secctx_attr_value", kv_config | kv_alias, kt_number, KBF_SECCTX, NULL, NULL, }, /* obsolete _ */ + { "secctx_attr_value", kv_config | kv_alias, kt_number, KBF_SECCTX, NULL, NULL, }, /* obsolete _ */
+ { "secctx-attr-value", kv_config, kt_number, KBF_SECCTX, NULL, NULL, }, /* obsolete: not a value, a type */ + { "secctx-attr-value", kv_config, kt_number, KBF_SECCTX, NULL, NULL, }, /* obsolete: not a value, a type */
#endif #endif
{ "interfaces", kv_config, kt_obsolete, KNCF_WARNIGNORE, NULL, NULL, }, /* obsoleted but often present keyword */
/* these options are obsoleted (and not old aliases) */ @@ -446,6 +459,7 @@ const struct keyword_def ipsec_conf_keywords[] = {
@@ -467,6 +480,7 @@
{ "username", kv_conn | kv_leftright, kt_string, KSCF_USERNAME, NULL, NULL, }, { "username", kv_conn | kv_leftright, kt_string, KSCF_USERNAME, NULL, NULL, },
/* xauthusername is still used in NetworkManager-libreswan :/ */ /* xauthusername is still used in NetworkManager-libreswan :/ */
{ "xauthusername", kv_conn | kv_leftright, kt_string, KSCF_USERNAME, NULL, NULL, }, /* old alias */ { "xauthusername", kv_conn | kv_leftright, kt_string, KSCF_USERNAME, NULL, NULL, }, /* old alias */
+ { "xauthname", kv_conn | kv_leftright, kt_string, KSCF_USERNAME, NULL, NULL, }, /* old alias */ + { "xauthname", kv_conn | kv_leftright, kt_string, KSCF_USERNAME, NULL, NULL, }, /* old alias */
{ "addresspool", kv_conn | kv_leftright, kt_range, KSCF_ADDRESSPOOL, NULL, NULL, }, { "addresspool", kv_conn | kv_leftright, kt_range, KSCF_ADDRESSPOOL, NULL, NULL, },
{ "auth", kv_conn | kv_leftright, kt_enum, KNCF_AUTH, &kw_authby_lr_list, NULL, }, { "auth", kv_conn | kv_leftright, kt_enum, KNCF_AUTH, kw_auth_list, NULL, },
{ "cat", kv_conn | kv_leftright, kt_bool, KNCF_CAT, NULL, NULL, }, #ifdef HAVE_IPTABLES
@@ -489,6 +503,8 @@ @@ -471,6 +485,8 @@ const struct keyword_def ipsec_conf_keywords[] = {
{ "esn", kv_conn | kv_processed, kt_enum, KNCF_ESN, &kw_esn_list, NULL, }, { "esn", kv_conn | kv_processed, kt_enum, KNCF_ESN, kw_esn_list, NULL, },
{ "decap-dscp", kv_conn | kv_processed, kt_bool, KNCF_DECAP_DSCP, NULL, NULL, }, { "decap-dscp", kv_conn | kv_processed, kt_bool, KNCF_DECAP_DSCP, NULL, NULL, },
{ "nopmtudisc", kv_conn | kv_processed, kt_bool, KNCF_NOPMTUDISC, NULL, NULL, }, { "nopmtudisc", kv_conn | kv_processed, kt_bool, KNCF_NOPMTUDISC, NULL, NULL, },
+ { "ike_frag", kv_conn | kv_processed | kv_alias, kt_enum, KNCF_IKE_FRAG, &kw_ynf_list, NULL, }, /* obsolete _ */ + { "ike_frag", kv_conn | kv_processed | kv_alias, kt_enum, KNCF_IKE_FRAG, kw_ynf_list, NULL, }, /* obsolete _ */
+ { "ike-frag", kv_conn | kv_processed | kv_alias, kt_enum, KNCF_IKE_FRAG, &kw_ynf_list, NULL, }, /* obsolete name */ + { "ike-frag", kv_conn | kv_processed | kv_alias, kt_enum, KNCF_IKE_FRAG, kw_ynf_list, NULL, }, /* obsolete name */
{ "fragmentation", kv_conn | kv_processed, kt_enum, KNCF_IKE_FRAG, &kw_ynf_list, NULL, }, { "fragmentation", kv_conn | kv_processed, kt_enum, KNCF_IKE_FRAG, kw_ynf_list, NULL, },
{ "mobike", kv_conn, kt_bool, KNCF_MOBIKE, NULL, NULL, }, { "mobike", kv_conn, kt_bool, KNCF_MOBIKE, NULL, NULL, },
{ "narrowing", kv_conn, kt_bool, KNCF_IKEv2_ALLOW_NARROWING, NULL, NULL, }, { "narrowing", kv_conn, kt_bool, KNCF_IKEv2_ALLOW_NARROWING, NULL, NULL, },
@@ -499,13 +515,18 @@ @@ -481,13 +497,18 @@ const struct keyword_def ipsec_conf_keywords[] = {
{ "accept-redirect-to", kv_conn, kt_string, KSCF_ACCEPT_REDIRECT_TO, NULL, NULL, }, { "accept-redirect-to", kv_conn, kt_string, KSCF_ACCEPT_REDIRECT_TO, NULL, NULL, },
{ "pfs", kv_conn, kt_bool, KNCF_PFS, NULL, NULL, }, { "pfs", kv_conn, kt_bool, KNCF_PFS, NULL, NULL, },
@ -92,9 +102,9 @@ diff -Naur libreswan-4.2-orig/lib/libipsecconf/keywords.c libreswan-4.2/lib/libi
{ "sha2-truncbug", kv_conn, kt_bool, KNCF_SHA2_TRUNCBUG, NULL, NULL, }, { "sha2-truncbug", kv_conn, kt_bool, KNCF_SHA2_TRUNCBUG, NULL, NULL, },
{ "ms-dh-downgrade", kv_conn, kt_bool, KNCF_MSDH_DOWNGRADE, NULL, NULL, }, { "ms-dh-downgrade", kv_conn, kt_bool, KNCF_MSDH_DOWNGRADE, NULL, NULL, },
{ "require-id-on-certificate", kv_conn, kt_bool, KNCF_SAN_ON_CERT, NULL, NULL, }, { "require-id-on-certificate", kv_conn, kt_bool, KNCF_SAN_ON_CERT, NULL, NULL, },
@@ -520,7 +541,10 @@ @@ -505,7 +526,10 @@ const struct keyword_def ipsec_conf_keywords[] = {
{"ikepad", kv_conn, kt_bool, KNCF_IKEPAD, NULL, NULL, }, {"ikepad", kv_conn, kt_bool, KNCF_IKEPAD, NULL, NULL, },
{ "nat-ikev1-method", kv_conn | kv_processed, kt_enum, KNCF_IKEV1_NATT, &kw_ikev1natt_list, NULL, }, { "nat-ikev1-method", kv_conn | kv_processed, kt_enum, KNCF_IKEV1_NATT, kw_ikev1natt_list, NULL, },
+ { "labeled_ipsec", kv_conn, kt_obsolete, KNCF_WARNIGNORE, NULL, NULL, }, /* obsolete */ + { "labeled_ipsec", kv_conn, kt_obsolete, KNCF_WARNIGNORE, NULL, NULL, }, /* obsolete */
+ { "labeled-ipsec", kv_conn, kt_obsolete, KNCF_WARNIGNORE, NULL, NULL, }, /* obsolete */ + { "labeled-ipsec", kv_conn, kt_obsolete, KNCF_WARNIGNORE, NULL, NULL, }, /* obsolete */
@ -103,15 +113,15 @@ diff -Naur libreswan-4.2-orig/lib/libipsecconf/keywords.c libreswan-4.2/lib/libi
{ "sec-label", kv_conn, kt_string, KSCF_SA_SEC_LABEL, NULL, NULL, }, /* really stored into struct end */ { "sec-label", kv_conn, kt_string, KSCF_SA_SEC_LABEL, NULL, NULL, }, /* really stored into struct end */
/* Cisco interop: remote peer type */ /* Cisco interop: remote peer type */
@@ -531,13 +555,17 @@ @@ -516,13 +540,17 @@ const struct keyword_def ipsec_conf_keywords[] = {
/* Network Manager support */ /* Network Manager support */
#ifdef HAVE_NM #ifdef HAVE_NM
{ "nm-configured", kv_conn, kt_bool, KNCF_NMCONFIGURED, NULL, NULL, }, { "nm-configured", kv_conn, kt_bool, KNCF_NMCONFIGURED, NULL, NULL, },
+ { "nm_configured", kv_conn, kt_bool, KNCF_NMCONFIGURED, NULL, NULL, }, /* obsolete _ */ + { "nm_configured", kv_conn, kt_bool, KNCF_NMCONFIGURED, NULL, NULL, }, /* obsolete _ */
#endif #endif
{ "xauthby", kv_conn, kt_enum, KNCF_XAUTHBY, &kw_xauthby, NULL, }, { "xauthby", kv_conn, kt_enum, KNCF_XAUTHBY, kw_xauthby_list, NULL, },
{ "xauthfail", kv_conn, kt_enum, KNCF_XAUTHFAIL, &kw_xauthfail, NULL, }, { "xauthfail", kv_conn, kt_enum, KNCF_XAUTHFAIL, kw_xauthfail_list, NULL, },
{ "modecfgpull", kv_conn, kt_invertbool, KNCF_MODECONFIGPULL, NULL, NULL, }, { "modecfgpull", kv_conn, kt_invertbool, KNCF_MODECONFIGPULL, NULL, NULL, },
{ "modecfgdns", kv_conn, kt_string, KSCF_MODECFGDNS, NULL, NULL, }, { "modecfgdns", kv_conn, kt_string, KSCF_MODECFGDNS, NULL, NULL, },
+ { "modecfgdns1", kv_conn | kv_alias, kt_string, KSCF_MODECFGDNS, NULL, NULL, }, /* obsolete */ + { "modecfgdns1", kv_conn | kv_alias, kt_string, KSCF_MODECFGDNS, NULL, NULL, }, /* obsolete */
@ -121,3 +131,6 @@ diff -Naur libreswan-4.2-orig/lib/libipsecconf/keywords.c libreswan-4.2/lib/libi
{ "modecfgbanner", kv_conn, kt_string, KSCF_MODECFGBANNER, NULL, NULL, }, { "modecfgbanner", kv_conn, kt_string, KSCF_MODECFGBANNER, NULL, NULL, },
{ "ignore-peer-dns", kv_conn, kt_bool, KNCF_IGNORE_PEER_DNS, NULL, NULL, }, { "ignore-peer-dns", kv_conn, kt_bool, KNCF_IGNORE_PEER_DNS, NULL, NULL, },
{ "mark", kv_conn, kt_string, KSCF_CONN_MARK_BOTH, NULL, NULL, }, { "mark", kv_conn, kt_string, KSCF_CONN_MARK_BOTH, NULL, NULL, },
--
2.39.0

61
SOURCES/libreswan-4.3-maintain-different-v1v2-split.patch
View File

@ -1,17 +1,27 @@
diff -Naur libreswan-4.3-orig/configs/d.ipsec.conf/ikev2.xml libreswan-4.3/configs/d.ipsec.conf/ikev2.xml From 83487373fdd77437e51cfccd41532e270e279e05 Mon Sep 17 00:00:00 2001
--- libreswan-4.3-orig/configs/d.ipsec.conf/ikev2.xml 2021-02-21 12:03:03.000000000 -0500 From: rpm-build <rpm-build>
+++ libreswan-4.3/configs/d.ipsec.conf/ikev2.xml 2021-02-21 12:33:36.226284499 -0500 Date: Tue, 10 Jan 2023 00:11:26 +0900
@@ -1,15 +1,15 @@ Subject: [PATCH] libreswan-4.3-maintain-different-v1v2-split.patch
<varlistentry>
---
configs/d.ipsec.conf/ikev2.xml | 14 +++++++-------
lib/libipsecconf/confread.c | 8 +++++++-
programs/whack/whack.c | 4 ++--
3 files changed, 16 insertions(+), 10 deletions(-)
diff --git a/configs/d.ipsec.conf/ikev2.xml b/configs/d.ipsec.conf/ikev2.xml
index 3d03825..285db1b 100644
--- a/configs/d.ipsec.conf/ikev2.xml
+++ b/configs/d.ipsec.conf/ikev2.xml
@@ -2,14 +2,14 @@
<term><emphasis remap='B'>ikev2</emphasis></term> <term><emphasis remap='B'>ikev2</emphasis></term>
<listitem> <listitem>
-<para>Whether to use IKEv1 (RFC 4301) or IKEv2 (RFC 7296) settings to be used. <para>Whether to use IKEv2 (RFC 7296) or IKEv1 (RFC 4301).
-Currently the accepted values are <emphasis remap='B'>no</emphasis>(the default), -Currently the accepted values are <emphasis remap='B'>yes</emphasis> (the default),
-signifying only IKEv1 is accepted, or <emphasis remap='B'>yes</emphasis>, -signifying only IKEv2 is accepted, or <emphasis remap='B'>no</emphasis>,
+<para>Wether to use IKEv1 (RFC 4301) or IKEv2 (RFC 7296) as the Internet Key Exchange (IKE) protcol. +Currently the accepted values are <emphasis remap='B'>insist</emphasis> (the default),
+Currently the accepted values are <emphasis remap='B'>no</emphasis> (or <emphasis remap='B'>never</emphasis>) +signifying only IKEv2 is accepted, or <emphasis remap='B'>no</emphasis> (or <emphasis remap='B'>never</emphasis>),
+signifying only IKEv1 is accepted, or <emphasis remap='B'>insist</emphasis>(the default), signifying only IKEv1 is accepted. Previous versions allowed the keywords
signifying only IKEv2 is accepted. Previous versions allowed the keywords
-<emphasis remap='B'>propose</emphasis> or <emphasis remap='B'>permit</emphasis> -<emphasis remap='B'>propose</emphasis> or <emphasis remap='B'>permit</emphasis>
-that would allow either IKEv1 or IKEv2, but this is no longer supported. The -that would allow either IKEv1 or IKEv2, but this is no longer supported. The
-permit option is interpreted as no and the propose option is interpreted as -permit option is interpreted as no and the propose option is interpreted as
@ -25,10 +35,11 @@ diff -Naur libreswan-4.3-orig/configs/d.ipsec.conf/ikev2.xml libreswan-4.3/confi
</para> </para>
</listitem> </listitem>
</varlistentry> </varlistentry>
diff -Naur libreswan-4.3-orig/lib/libipsecconf/confread.c libreswan-4.3/lib/libipsecconf/confread.c diff --git a/lib/libipsecconf/confread.c b/lib/libipsecconf/confread.c
--- libreswan-4.3-orig/lib/libipsecconf/confread.c 2021-02-21 12:03:03.000000000 -0500 index b95c90a..e752441 100644
+++ libreswan-4.3/lib/libipsecconf/confread.c 2021-02-21 12:37:43.138031929 -0500 --- a/lib/libipsecconf/confread.c
@@ -1310,11 +1310,17 @@ +++ b/lib/libipsecconf/confread.c
@@ -1340,11 +1340,17 @@ static bool load_conn(struct starter_conn *conn,
switch (conn->options[KNCF_IKEv2]) { switch (conn->options[KNCF_IKEv2]) {
case fo_never: case fo_never:
@ -38,19 +49,20 @@ diff -Naur libreswan-4.3-orig/lib/libipsecconf/confread.c libreswan-4.3/lib/libi
+ case fo_permit: + case fo_permit:
+ starter_error_append(perrl, "ikev2=permit is no longer accepted. Use ikev2=insist or ikev2=no|never"); + starter_error_append(perrl, "ikev2=permit is no longer accepted. Use ikev2=insist or ikev2=no|never");
+ return TRUE; + return true;
+ +
case fo_propose: case fo_propose:
+ starter_error_append(perrl, "ikev2=propose or ikev2=yes is no longer accepted. Use ikev2=insist or ikev2=no|never"); + starter_error_append(perrl, "ikev2=propose or ikev2=yes is no longer accepted. Use ikev2=insist or ikev2=no|never");
+ return TRUE; + return true;
+ +
case fo_insist: case fo_insist:
conn->ike_version = IKEv2; conn->ike_version = IKEv2;
break; break;
diff -Naur libreswan-4.3-orig/programs/whack/whack.c libreswan-4.3/programs/whack/whack.c diff --git a/programs/whack/whack.c b/programs/whack/whack.c
--- libreswan-4.3-orig/programs/whack/whack.c 2021-02-21 12:03:03.000000000 -0500 index b512b04..3de020e 100644
+++ libreswan-4.3/programs/whack/whack.c 2021-02-21 12:39:27.066188354 -0500 --- a/programs/whack/whack.c
@@ -801,7 +801,7 @@ +++ b/programs/whack/whack.c
@@ -815,7 +815,7 @@ static const struct option long_opts[] = {
{ "ikev1-allow", no_argument, NULL, CD_IKEv1 + OO }, /* obsolete name */ { "ikev1-allow", no_argument, NULL, CD_IKEv1 + OO }, /* obsolete name */
{ "ikev2", no_argument, NULL, CD_IKEv2 +OO }, { "ikev2", no_argument, NULL, CD_IKEv2 +OO },
{ "ikev2-allow", no_argument, NULL, CD_IKEv2 +OO }, /* obsolete name */ { "ikev2-allow", no_argument, NULL, CD_IKEv2 +OO }, /* obsolete name */
@ -59,7 +71,7 @@ diff -Naur libreswan-4.3-orig/programs/whack/whack.c libreswan-4.3/programs/whac
PS("allow-narrowing", IKEV2_ALLOW_NARROWING), PS("allow-narrowing", IKEV2_ALLOW_NARROWING),
#ifdef AUTH_HAVE_PAM #ifdef AUTH_HAVE_PAM
@@ -1762,7 +1762,7 @@ @@ -1802,7 +1802,7 @@ int main(int argc, char **argv)
end_seen = LEMPTY; end_seen = LEMPTY;
continue; continue;
@ -68,3 +80,6 @@ diff -Naur libreswan-4.3-orig/programs/whack/whack.c libreswan-4.3/programs/whac
case CD_IKEv1: case CD_IKEv1:
case CD_IKEv2: case CD_IKEv2:
{ {
--
2.39.0

20
SOURCES/libreswan-4.4-ikev1-disable-diagnostics.patch
View File

@ -1,20 +0,0 @@
Index: libreswan-4.4/programs/pluto/ikev1.c
===================================================================
--- libreswan-4.4.orig/programs/pluto/ikev1.c
+++ libreswan-4.4/programs/pluto/ikev1.c
@@ -2102,7 +2102,6 @@ void process_packet_tail(struct msg_dige
diag_t d = pbs_in_struct(&md->message_pbs, &isakmp_ignore_desc,
&pd->payload, sizeof(pd->payload), &pd->pbs);
if (d != NULL) {
- llog_diag(RC_LOG, st->st_logger, &d, "%s", "");
LOG_PACKET(RC_LOG_SERIOUS,
"%smalformed payload in packet",
excuse);
@@ -2171,7 +2170,6 @@ void process_packet_tail(struct msg_dige
&pd->payload, sizeof(pd->payload),
&pd->pbs);
if (d != NULL) {
- llog_diag(RC_LOG, st->st_logger, &d, "%s", "");
LOG_PACKET(RC_LOG_SERIOUS,
"%smalformed payload in packet",
excuse);

217
SOURCES/libreswan-4.5-ikev1-aggr.patch
View File

@ -1,217 +0,0 @@
From c964eedcefb52eadcc7b30178378ed7d07b3510f Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Tue, 18 Apr 2023 10:43:30 +0900
Subject: [PATCH 1/2] Fix CVE-2023-30570
Signed-off-by: Daiki Ueno <dueno@redhat.com>
---
programs/pluto/ikev1.c | 61 +++++++++++++++++++++++++++++++++++--
programs/pluto/ikev1_aggr.c | 5 +--
2 files changed, 61 insertions(+), 5 deletions(-)
diff --git a/programs/pluto/ikev1.c b/programs/pluto/ikev1.c
index 9f4847874d..fa7adba2ba 100644
--- a/programs/pluto/ikev1.c
+++ b/programs/pluto/ikev1.c
@@ -1250,10 +1250,20 @@ void process_v1_packet(struct msg_digest *md)
struct state *st = NULL;
enum state_kind from_state = STATE_UNDEFINED; /* state we started in */
+ /*
+ * For the initial responses, don't leak the responder's SPI.
+ * Hence the use of send_v1_notification_from_md().
+ *
+ * AGGR mode is a mess in that the R0->R1 transition happens
+ * well before the transition succeeds.
+ */
#define SEND_NOTIFICATION(t) \
{ \
pstats(ikev1_sent_notifies_e, t); \
- if (st != NULL) \
+ if (st != NULL && \
+ st->st_state->kind != STATE_AGGR_R0 && \
+ st->st_state->kind != STATE_AGGR_R1 && \
+ st->st_state->kind != STATE_MAIN_R0) \
send_notification_from_state(st, from_state, t); \
else \
send_notification_from_md(md, t); \
@@ -1323,17 +1333,26 @@ void process_v1_packet(struct msg_digest *md)
from_state = (md->hdr.isa_xchg == ISAKMP_XCHG_IDPROT ?
STATE_MAIN_R0 : STATE_AGGR_R0);
} else {
- /* not an initial message */
+ /*
+ * Possibly not an initial message. Possibly
+ * from initiator. Possibly from responder.
+ *
+ * Possibly. Which is probably hopeless.
+ */
st = find_state_ikev1(&md->hdr.isa_ike_spis,
md->hdr.isa_msgid);
if (st == NULL) {
/*
- * perhaps this is a first message
+ * Perhaps this is a first message
* from the responder and contains a
* responder cookie that we've not yet
* seen.
+ *
+ * Perhaps this is a random message
+ * with a bogus non-zero responder IKE
+ * SPI.
*/
st = find_state_ikev1_init(&md->hdr.isa_ike_initiator_spi,
md->hdr.isa_msgid);
@@ -1344,6 +1363,21 @@ void process_v1_packet(struct msg_digest *md)
/* XXX Could send notification back */
return;
}
+ if (st->st_state->kind == STATE_AGGR_R0) {
+ /*
+ * The only way for this to
+ * happen is for the attacker
+ * to guess the responder's
+ * IKE SPI that hasn't been
+ * sent over the wire?
+ *
+ * Well that or played 1/2^32
+ * odds.
+ */
+ llog_pexpect(md->md_logger, HERE,
+ "phase 1 message matching AGGR_R0 state");
+ return;
+ }
}
from_state = st->st_state->kind;
}
@@ -3052,7 +3086,28 @@ void complete_v1_state_transition(struct state *st, struct msg_digest *md, stf_s
delete_state(st);
/* wipe out dangling pointer to st */
md->v1_st = NULL;
+ } else if (st->st_state->kind == STATE_AGGR_R0 ||
+ st->st_state->kind == STATE_AGGR_R1 ||
+ st->st_state->kind == STATE_MAIN_R0) {
+ /*
+ *
+ * Wipe out the incomplete larval state.
+ *
+ * ARGH! In <=v4.10, the aggr code flipped the
+ * larval state to R1 right at the start of
+ * the transition and not the end, so using
+ * state to figure things out is close to
+ * useless.
+ *
+ * Deleting the state means that pluto has no
+ * way to detect and ignore amplification
+ * attacks.
+ */
+ delete_state(st);
+ /* wipe out dangling pointer to st */
+ md->v1_st = NULL;
}
+
break;
}
}
diff --git a/programs/pluto/ikev1_aggr.c b/programs/pluto/ikev1_aggr.c
index 8ad4678e1f..47a1eda424 100644
--- a/programs/pluto/ikev1_aggr.c
+++ b/programs/pluto/ikev1_aggr.c
@@ -176,7 +176,7 @@ stf_status aggr_inI1_outR1(struct state *unused_st UNUSED,
struct ike_sa *ike = new_v1_rstate(c, md);
struct state *st = &ike->sa;
md->v1_st = st; /* (caller will reset cur_state) */
- change_state(st, STATE_AGGR_R1);
+ change_state(st, STATE_AGGR_R0);
/* warn for especially dangerous Aggressive Mode and PSK */
if (LIN(POLICY_PSK, c->policy) && LIN(POLICY_AGGRESSIVE, c->policy)) {
@@ -193,7 +193,8 @@ stf_status aggr_inI1_outR1(struct state *unused_st UNUSED,
if (!v1_decode_certs(md)) {
log_state(RC_LOG, st, "X509: CERT payload bogus or revoked");
- return false;
+ /* XXX notification is in order! */
+ return STF_FAIL + INVALID_ID_INFORMATION;
}
/*
--
2.39.2
From 1d8b49905b374af294f23dad2e165931ca081d16 Mon Sep 17 00:00:00 2001
From: Andrew Cagney <cagney@gnu.org>
Date: Sat, 25 Mar 2023 19:40:52 -0400
Subject: [PATCH 2/2] ikev1: add --impair
copy_v1_notify_response_SPIs_to_retransmission
---
include/impair.h | 2 ++
lib/libswan/impair.c | 6 ++++++
programs/pluto/ikev1.c | 10 ++++++++++
3 files changed, 18 insertions(+)
diff --git a/include/impair.h b/include/impair.h
index 15fa2a2dc3..26900146e0 100644
--- a/include/impair.h
+++ b/include/impair.h
@@ -153,6 +153,8 @@ struct impair {
bool omit_v2_ike_auth_child;
bool ignore_v2_ike_auth_child;
+ bool copy_v1_notify_response_SPIs_to_retransmission;
+
/*
* add more here
*/
diff --git a/lib/libswan/impair.c b/lib/libswan/impair.c
index 404ca96f1a..5d139410ad 100644
--- a/lib/libswan/impair.c
+++ b/lib/libswan/impair.c
@@ -97,6 +97,8 @@ struct impairment impairments[] = {
#define A(WHAT, ACTION, PARAM, HELP, UNSIGNED_HELP, ...) { .what = WHAT, .action = CALL_##ACTION, .param = PARAM, .help = HELP, .unsigned_help = UNSIGNED_HELP, ##__VA_ARGS__, }
#define V(WHAT, VALUE, HELP, ...) { .what = WHAT, .action = CALL_IMPAIR_UPDATE, .value = &impair.VALUE, .help = HELP, .sizeof_value = sizeof(impair.VALUE), ##__VA_ARGS__, }
+#define B(VALUE, HELP, ...) \
+ { .what = #VALUE, .action = CALL_IMPAIR_UPDATE, .value = &impair.VALUE, .help = HELP, .sizeof_value = sizeof(impair.VALUE), ##__VA_ARGS__, }
V("allow-dns-insecure", allow_dns_insecure, "allow IPSECKEY lookups without DNSSEC protection"),
V("allow-null-none", allow_null_none, "cause pluto to allow esp=null-none and ah=none for testing"),
@@ -198,6 +200,10 @@ struct impairment impairments[] = {
A("event-sa-replace", STATE_EVENT_HANDLER, EVENT_SA_REPLACE,
"trigger the replace event", "SA"),
+ B(copy_v1_notify_response_SPIs_to_retransmission,
+ "copy SPIs in IKEv1 notify response to last sent packet and then retransmit"),
+
+#undef B
#undef V
#undef A
diff --git a/programs/pluto/ikev1.c b/programs/pluto/ikev1.c
index fa7adba2ba..b822995f1f 100644
--- a/programs/pluto/ikev1.c
+++ b/programs/pluto/ikev1.c
@@ -2398,6 +2398,16 @@ void process_packet_tail(struct msg_digest *md)
enum_show(& ikev1_notify_names,
p->payload.notification.isan_type, &b));
} else {
+ if (impair.copy_v1_notify_response_SPIs_to_retransmission) {
+ dbg("IMPAIR: copying notify response SPIs to recorded message and then resending it");
+ /* skip non-ESP marker if needed */
+ size_t skip = (st->st_interface->esp_encapsulation_enabled ? NON_ESP_MARKER_SIZE : 0);
+ size_t spis = sizeof(md->hdr.isa_ike_spis);
+ PASSERT(st->st_logger, st->st_v1_tpacket.len >= skip + spis);
+ memcpy(st->st_v1_tpacket.ptr + skip, &md->hdr.isa_ike_spis, spis);
+ resend_recorded_v1_ike_msg(st, "IMPAIR: retransmitting mangled packet");
+ }
+
esb_buf b;
LOG_PACKET(RC_LOG_SERIOUS,
"ignoring informational payload %s, msgid=%08" PRIx32 ", length=%d",
--
2.39.2

13
SPECS/libreswan.spec
View File

@ -36,8 +36,8 @@
Name: libreswan Name: libreswan
Summary: IPsec implementation with IKEv1 and IKEv2 keying protocols Summary: IPsec implementation with IKEv1 and IKEv2 keying protocols
# version is generated in the release script # version is generated in the release script
Version: 4.5 Version: 4.9
Release: %{?prever:0.}1%{?prever:.%{prever}}%{?dist}.1 Release: %{?prever:0.}1%{?prever:.%{prever}}%{?dist}
License: GPLv2 License: GPLv2
Url: https://libreswan.org/ Url: https://libreswan.org/
@ -52,8 +52,6 @@ Patch1: libreswan-4.3-maintain-different-v1v2-split.patch
Patch2: libreswan-3.32-1861360-nodefault-rsa-pss.patch Patch2: libreswan-3.32-1861360-nodefault-rsa-pss.patch
Patch3: libreswan-4.1-maintain-obsolete-keywords.patch Patch3: libreswan-4.1-maintain-obsolete-keywords.patch
Patch6: libreswan-4.3-1934186-config.patch Patch6: libreswan-4.3-1934186-config.patch
Patch7: libreswan-4.4-ikev1-disable-diagnostics.patch
Patch8: libreswan-4.5-ikev1-aggr.patch
BuildRequires: audit-libs-devel BuildRequires: audit-libs-devel
BuildRequires: bison BuildRequires: bison
@ -112,8 +110,6 @@ Libreswan is based on Openswan-2.6.38 which in turn is based on FreeS/WAN-2.04
%patch2 -p1 %patch2 -p1
%patch3 -p1 %patch3 -p1
%patch6 -p1 %patch6 -p1
%patch7 -p1
%patch8 -p1
# linking to freebl is not needed # linking to freebl is not needed
sed -i "s/-lfreebl //" mk/config.mk sed -i "s/-lfreebl //" mk/config.mk
@ -217,8 +213,9 @@ certutil -N -d sql:$tmpdir --empty-password
%attr(0644,root,root) %doc %{_mandir}/*/* %attr(0644,root,root) %doc %{_mandir}/*/*
%changelog %changelog
* Fri Apr 21 2023 Daiki Ueno <dueno@redhat.com> - 4.5-1.1 * Mon Jan 9 2023 Daiki Ueno <dueno@redhat.com> - 4.9-1
- Resolves: rhbz#2187178 fix handling of IKEv1 aggressive mode packets - Resolves: rhbz#2128672 Rebase libreswan to 4.9
- Remove libreswan-4.4-ikev1-disable-diagnostics.patch no longer necessary
* Thu Jan 13 2022 Daiki Ueno <dueno@redhat.com> - 4.5-1 * Thu Jan 13 2022 Daiki Ueno <dueno@redhat.com> - 4.5-1
- Resolves: rhbz#2017352 Rebase libreswan to 4.5 - Resolves: rhbz#2017352 Rebase libreswan to 4.5