* Tue Aug 11 2015 Paul Wouters <pwouters@redhat.com> - 3.15-1
- Updated to 3.15 (see http://download.libreswan.org/CHANGES) - Resolves: rhbz#CVE-2015-3240 IKE daemon restart when receiving a bad DH gx - NSS database creation moved from spec file to service file - Run CAVS tests on package build - Added BuildRequire systemd-units and xmlto - Bumped minimum required nss to 3.16.1 - Install tmpfiles - Install sysctl file - Update doc files to include
This commit is contained in:
Paul Wouters
parent
15c749115b
commit
43d43de158
5
.gitignore
vendored
5
.gitignore
vendored
@ -10,3 +10,8 @@
|
||||
/libreswan-3.11.tar.gz
|
||||
/libreswan-3.12.tar.gz
|
||||
/libreswan-3.13.tar.gz
|
||||
/libreswan-3.14.tar.gz
|
||||
/ikev1_dsa.fax.bz2
|
||||
/ikev1_psk.fax.bz2
|
||||
/ikev2.fax.bz2
|
||||
/libreswan-3.15.tar.gz
|
||||
|
||||
132
libreswan.spec
132
libreswan.spec
@ -11,19 +11,25 @@
|
||||
%global fipscheck_version 1.3.0
|
||||
%global buildefence 0
|
||||
%global development 0
|
||||
%global cavstests 1
|
||||
|
||||
#global prever rc1
|
||||
|
||||
Name: libreswan
|
||||
Summary: IPsec implementation with IKEv1 and IKEv2 keying protocols
|
||||
Version: 3.13
|
||||
Release: %{?prever:0.}2%{?prever:.%{prever}}%{?dist}
|
||||
Version: 3.15
|
||||
Release: %{?prever:0.}1%{?prever:.%{prever}}%{?dist}
|
||||
License: GPLv2
|
||||
Url: https://www.libreswan.org/
|
||||
Source: https://download.libreswan.org/%{name}-%{version}%{?prever}.tar.gz
|
||||
Source0: https://download.libreswan.org/%{name}-%{version}%{?prever}.tar.gz
|
||||
%if %{cavstests}
|
||||
Source1: https://download.libreswan.org/cavs/ikev1_dsa.fax.bz2
|
||||
Source2: https://download.libreswan.org/cavs/ikev1_psk.fax.bz2
|
||||
Source3: https://download.libreswan.org/cavs/ikev2.fax.bz2
|
||||
%endif
|
||||
Group: System Environment/Daemons
|
||||
BuildRequires: gmp-devel bison flex pkgconfig
|
||||
BuildRequires: systemd
|
||||
BuildRequires: systemd systemd-units
|
||||
Requires(post): coreutils bash systemd
|
||||
Requires(preun): systemd
|
||||
Requires(postun): systemd
|
||||
@ -34,8 +40,9 @@ Provides: openswan = %{version}-%{release}
|
||||
Provides: openswan-doc = %{version}-%{release}
|
||||
|
||||
BuildRequires: pkgconfig hostname
|
||||
BuildRequires: nss-devel >= 3.14.3, nspr-devel
|
||||
BuildRequires: nss-devel >= 3.16.1, nspr-devel
|
||||
BuildRequires: pam-devel
|
||||
BuildRequires: libevent-devel
|
||||
%if %{USE_DNSSEC}
|
||||
BuildRequires: unbound-devel
|
||||
%endif
|
||||
@ -56,8 +63,7 @@ BuildRequires: openldap-devel curl-devel
|
||||
%if %{buildefence}
|
||||
BuildRequires: ElectricFence
|
||||
%endif
|
||||
# Only needed if xml man pages are modified and need regeneration
|
||||
# BuildRequires: xmlto
|
||||
BuildRequires: xmlto
|
||||
|
||||
Requires: nss-tools, nss-softokn
|
||||
Requires: iproute >= 2.6.8
|
||||
@ -84,11 +90,11 @@ sed -i "s:/usr/bin/python:/usr/bin/python3:" programs/verify/verify.in
|
||||
|
||||
%build
|
||||
%if %{buildefence}
|
||||
%define efence "-lefence"
|
||||
%global efence "-lefence"
|
||||
%endif
|
||||
|
||||
#796683: -fno-strict-aliasing
|
||||
%{__make} \
|
||||
make %{?_smp_mflags} \
|
||||
%if %{development}
|
||||
USERCOMPILE="-g -DGCC_LINT %(echo %{optflags} | sed -e s/-O[0-9]*/ /) %{?efence} -fPIE -pie -fno-strict-aliasing -Wformat-nonliteral -Wformat-security" \
|
||||
%else
|
||||
@ -128,8 +134,7 @@ FS=$(pwd)
|
||||
%endif
|
||||
|
||||
%install
|
||||
rm -rf %{buildroot}
|
||||
%{__make} \
|
||||
make \
|
||||
DESTDIR=%{buildroot} \
|
||||
INC_USRLOCAL=%{_prefix} \
|
||||
FINALLIBEXECDIR=%{_libexecdir}/ipsec \
|
||||
@ -142,63 +147,96 @@ FS=$(pwd)
|
||||
rm -rf %{buildroot}/usr/share/doc/libreswan
|
||||
|
||||
install -d -m 0755 %{buildroot}%{_localstatedir}/run/pluto
|
||||
# used when setting --perpeerlog without --perpeerlogbase
|
||||
# used when setting --perpeerlog without --perpeerlogbase
|
||||
install -d -m 0700 %{buildroot}%{_localstatedir}/log/pluto/peer
|
||||
install -d %{buildroot}%{_sbindir}
|
||||
|
||||
install -d %{buildroot}%{_sysconfdir}/sysctl.d
|
||||
install -m 0644 packaging/fedora/libreswan-sysctl.conf \
|
||||
%{buildroot}%{_sysconfdir}/sysctl.d/50-libreswan.conf
|
||||
|
||||
install -d %{buildroot}%{_tmpfilesdir}
|
||||
install -m 0644 packaging/fedora/libreswan-tmpfiles.conf \
|
||||
%{buildroot}%{_tmpfilesdir}/libreswan.conf
|
||||
|
||||
%if %{USE_FIPSCHECK}
|
||||
mkdir -p %{buildroot}%{_libdir}/fipscheck
|
||||
install -d %{buildroot}%{_sysconfdir}/prelink.conf.d/
|
||||
install -m644 packaging/fedora/libreswan-prelink.conf %{buildroot}%{_sysconfdir}/prelink.conf.d/libreswan-fips.conf
|
||||
install -m644 packaging/fedora/libreswan-prelink.conf \
|
||||
%{buildroot}%{_sysconfdir}/prelink.conf.d/libreswan-fips.conf
|
||||
%endif
|
||||
|
||||
echo "include %{_sysconfdir}/ipsec.d/*.secrets" > %{buildroot}%{_sysconfdir}/ipsec.secrets
|
||||
rm -fr %{buildroot}%{_sysconfdir}/rc.d/rc*
|
||||
|
||||
%files
|
||||
%doc CHANGES COPYING CREDITS README LICENSE
|
||||
%doc docs/*.*
|
||||
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipsec.conf
|
||||
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/sysconfig/pluto
|
||||
%attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ipsec.secrets
|
||||
%attr(0700,root,root) %dir %{_sysconfdir}/ipsec.d
|
||||
%attr(0700,root,root) %dir %{_sysconfdir}/ipsec.d/cacerts
|
||||
%attr(0700,root,root) %dir %{_sysconfdir}/ipsec.d/crls
|
||||
%attr(0700,root,root) %dir %{_sysconfdir}/ipsec.d/policies
|
||||
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipsec.d/policies/*
|
||||
%attr(0700,root,root) %dir %{_localstatedir}/log/pluto/peer
|
||||
%attr(0755,root,root) %dir %{_localstatedir}/run/pluto
|
||||
%attr(0644,root,root) %{_unitdir}/ipsec.service
|
||||
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/pam.d/pluto
|
||||
%{_sbindir}/ipsec
|
||||
%{_libexecdir}/ipsec
|
||||
%doc %{_mandir}/*/*
|
||||
|
||||
%if %{USE_FIPSCHECK}
|
||||
%{_libdir}/fipscheck/*.hmac
|
||||
# We own the directory so we don't have to require prelink
|
||||
%attr(0755,root,root) %dir %{_sysconfdir}/prelink.conf.d/
|
||||
%config(noreplace) %{_sysconfdir}/prelink.conf.d/libreswan-fips.conf
|
||||
%if %{cavstests}
|
||||
%check
|
||||
# There is an elaborate upstream testing infrastructure which we do not
|
||||
# run here - it takes hours and uses kvm
|
||||
# We only run the CAVS tests.
|
||||
cp %{SOURCE1} %{SOURCE2} %{SOURCE3} .
|
||||
bunzip2 *.fax.bz2
|
||||
: starting CAVS test for IKEv2
|
||||
OBJ.linux.*/programs/pluto/cavp -v2 ikev2.fax | \
|
||||
diff -u ikev2.fax - > /dev/null
|
||||
: starting CAVS test for IKEv1 RSASIG
|
||||
OBJ.linux.*/programs/pluto/cavp -v1sig ikev1_dsa.fax | \
|
||||
diff -u ikev1_dsa.fax - > /dev/null
|
||||
: starting CAVS test for IKEv1 PSK
|
||||
OBJ.linux.*/programs/pluto/cavp -v1psk ikev1_psk.fax | \
|
||||
diff -u ikev1_psk.fax - > /dev/null
|
||||
: CAVS tests passed
|
||||
%endif
|
||||
|
||||
%post
|
||||
%systemd_post ipsec.service
|
||||
|
||||
%preun
|
||||
%systemd_preun ipsec.service
|
||||
|
||||
%postun
|
||||
%systemd_postun_with_restart ipsec.service
|
||||
|
||||
%post
|
||||
%systemd_post ipsec.service
|
||||
if [ ! -f %{_sysconfdir}/ipsec.d/cert8.db ] ; then
|
||||
TEMPFILE=$(/bin/mktemp %{_sysconfdir}/ipsec.d/nsspw.XXXXXXX)
|
||||
[ $? -gt 0 ] && TEMPFILE=%{_sysconfdir}/ipsec.d/nsspw.$$
|
||||
echo > ${TEMPFILE}
|
||||
certutil -N -f ${TEMPFILE} -d %{_sysconfdir}/ipsec.d
|
||||
restorecon %{_sysconfdir}/ipsec.d/*db 2>/dev/null || :
|
||||
rm -f ${TEMPFILE}
|
||||
fi
|
||||
%files
|
||||
%doc CHANGES COPYING CREDITS README* LICENSE
|
||||
%doc docs/*.* docs/examples
|
||||
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipsec.conf
|
||||
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/sysconfig/pluto
|
||||
%attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ipsec.secrets
|
||||
%attr(0700,root,root) %dir %{_sysconfdir}/ipsec.d
|
||||
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipsec.d/v6neighbor-hole.conf
|
||||
%attr(0700,root,root) %dir %{_sysconfdir}/ipsec.d/policies
|
||||
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipsec.d/policies/*
|
||||
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/sysctl.d/50-libreswan.conf
|
||||
%attr(0700,root,root) %dir %{_localstatedir}/log/pluto
|
||||
%attr(0700,root,root) %dir %{_localstatedir}/log/pluto/peer
|
||||
%attr(0755,root,root) %dir %{_localstatedir}/run/pluto
|
||||
%attr(0644,root,root) %{_tmpfilesdir}/libreswan.conf
|
||||
%attr(0644,root,root) %{_unitdir}/ipsec.service
|
||||
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/pam.d/pluto
|
||||
%{_sbindir}/ipsec
|
||||
%{_libexecdir}/ipsec
|
||||
%attr(0644,root,root) %doc %{_mandir}/*/*
|
||||
|
||||
%if %{USE_FIPSCHECK}
|
||||
%{_libdir}/fipscheck/*.hmac
|
||||
# We own the directory so we don't have to require prelink
|
||||
%attr(0755,root,root) %dir %{_sysconfdir}/prelink.conf.d/
|
||||
%{_sysconfdir}/prelink.conf.d/libreswan-fips.conf
|
||||
%endif
|
||||
|
||||
%changelog
|
||||
* Tue Aug 11 2015 Paul Wouters <pwouters@redhat.com> - 3.15-1
|
||||
- Updated to 3.15 (see http://download.libreswan.org/CHANGES)
|
||||
- Resolves: rhbz#CVE-2015-3240 IKE daemon restart when receiving a bad DH gx
|
||||
- NSS database creation moved from spec file to service file
|
||||
- Run CAVS tests on package build
|
||||
- Added BuildRequire systemd-units and xmlto
|
||||
- Bumped minimum required nss to 3.16.1
|
||||
- Install tmpfiles
|
||||
- Install sysctl file
|
||||
- Update doc files to include
|
||||
|
||||
* Mon Jul 13 2015 Paul Wouters <pwouters@redhat.com> - 3.13-2
|
||||
- Resolves: rhbz#1238967 Switch libreswan to use python3
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user