Update to libreswan-5.4

Resolves: RHEL-139041
Signed-off-by: Daiki Ueno <dueno@redhat.com>

.gitignore

@@ -72,3 +72,5 @@
 /libreswan-5.3.1.tar.gz.sig
 /libreswan-5.3.2.tar.gz
 /libreswan-5.3.2.tar.gz.sig
+/libreswan-5.4.tar.gz
+/libreswan-5.4.tar.gz.asc

libreswan-4.15-ipsec_import.patch

@@ -1,20 +1,31 @@
+From 4129c9d3c56f33039dfe145e05c516a7c0b6e097 Mon Sep 17 00:00:00 2001
+From: rpm-build <rpm-build>
+Date: Fri, 14 Aug 2026 13:05:28 +0900
+Subject: [PATCH] libreswan-4.15-ipsec_import.patch
+
+---
+ programs/ipsec/ipsec.in | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
 diff --git a/programs/ipsec/ipsec.in b/programs/ipsec/ipsec.in
-index 40ff9f4138..41813b5258 100755
+index ca5ce0c..33b448a 100755
 --- a/programs/ipsec/ipsec.in
 +++ b/programs/ipsec/ipsec.in
-@@ -758,7 +758,14 @@ ipsec_import() {
+@@ -755,7 +755,13 @@ ipsec_import() {
  	    exit 1
  	fi
  
--	pk12util -i "${pkcs12bundle}" -d "${IPSEC_NSSDIR_SQL}"
-+	# First try blanc password to avoid uselessly prompting interactively
-+	pk12util -i "${pkcs12bundle}" -d "${IPSEC_NSSDIR_SQL}" -W '' 2>/dev/null
+-	@@PK12UTIL@@ -i "${pkcs12bundle}" -d "${IPSEC_NSSDIR_SQL}"
++	@@PK12UTIL@@ -i "${pkcs12bundle}" -d "${IPSEC_NSSDIR_SQL}" -W '' 2>/dev/null
 +	# check for SEC_ERROR_BAD_PASSWORD
 +	if [ $? -eq 18 ]; then
 +	    # Not the empty password
-+	    pk12util -i "${pkcs12bundle}" -d "${IPSEC_NSSDIR_SQL}"
++	    @@PK12UTIL@@ -i "${pkcs12bundle}" -d "${IPSEC_NSSDIR_SQL}"
 +	fi
 +
  	# check and correct trust bits
  	set_nss_db_trusts
  	exit 0
+-- 
+2.55.0
+

libreswan.spec

@@ -23,6 +23,7 @@
     USE_NSS_IPSEC_PROFILE=true \\\
     USE_SECCOMP=true \\\
     USE_AUTHPAM=true \\\
+    USE_XFRM_HEADER_COPY=true \\\
 %{nil}
 
 #global prever dr1
@@ -30,14 +31,14 @@
 Name: libreswan
 Summary: Internet Key Exchange (IKEv1 and IKEv2) implementation for IPsec
 # version is generated in the release script
-Version: 5.3.2
+Version: 5.4
 Release: %autorelease
 # The code in lib/libswan/nss_copies.c is under MPL-2.0, while the
 # rest is under GPL-2.0-or-later
 License: GPL-2.0-or-later AND MPL-2.0
 Url: https://libreswan.org/
 Source0: https://download.libreswan.org/%{?prever:development/}%{name}-%{version}%{?prever}.tar.gz
-Source1: https://download.libreswan.org/%{?prever:development/}%{name}-%{version}%{?prever}.tar.gz.sig
+Source1: https://download.libreswan.org/%{?prever:development/}%{name}-%{version}%{?prever}.tar.gz.asc
 Source2: https://download.libreswan.org/LIBRESWAN-OpenPGP-KEY.txt
 %if 0%{with_cavstests}
 Source3: https://download.libreswan.org/cavs/ikev1_dsa.fax.bz2
@@ -46,8 +47,6 @@ Source5: https://download.libreswan.org/cavs/ikev2.fax.bz2
 %endif
 
 Patch1: libreswan-4.15-ipsec_import.patch
-Patch2: libreswan-5.3-outstanding-ike-auth-crossing.patch
-Patch3: libreswan-5.3-helper-thread.patch
 
 BuildRequires: audit-libs-devel
 BuildRequires: bison
@@ -195,8 +194,8 @@ bunzip2 *.fax.bz2
 %endif
 
 # Some of these tests will show ERROR for negative testing - it will exit on real errors
-%{buildroot}%{_libexecdir}/ipsec/algparse -tp || { echo prooposal test failed; exit 1; }
-%{buildroot}%{_libexecdir}/ipsec/algparse -ta || { echo algorithm test failed; exit 1; }
+%{buildroot}%{_libexecdir}/ipsec/algparse --tp || { echo prooposal test failed; exit 1; }
+%{buildroot}%{_libexecdir}/ipsec/algparse --ta || { echo algorithm test failed; exit 1; }
 : Algorithm parser tests passed
 
 # self test for pluto daemon - this also shows which algorithms it allows in FIPS mode

sources

@@ -1,5 +1,5 @@
 SHA512 (ikev1_dsa.fax.bz2) = 627cbac14248bd68e8d22fbca247668a7749ef0c2e41df8d776d62df9a21403d3a246c0bd82c3faedce62de90b9f91a87f753e17b056319000bba7d2038461ac
 SHA512 (ikev1_psk.fax.bz2) = 1b2daec32edc56b410c036db2688c92548a9bd9914994bc7e555b301dd6db4497a6b3e89dc12ddf36826ae90b40fcde501a5a45c0d59098e07839073d219d467
 SHA512 (ikev2.fax.bz2) = 0d3748d1bd574f6f1f3e4db847eca126ce649566ea710ef227426f433122752b80d1d6b8acf9d0df07b5597c1e45447e3a2fcb3391756e834e8e75f99df8e51e
-SHA512 (libreswan-5.3.2.tar.gz) = 4dfe71bed06d356c5a33e1874ec934eab8a57a2bdedff8069ebcf65b09dd79490665cbb5b94b691d6e873a0a8e6eb131a4942ffa845a5836a5344436c8efb879
-SHA512 (libreswan-5.3.2.tar.gz.sig) = 55062be3c579316233e63ff44d0c46754517d3a829a9e6b7f2234e10f40eec451696e46695e1f4d4784c89e1b71aabaab8dcf66faa8ddd5e55107ed74f61dd2c
+SHA512 (libreswan-5.4.tar.gz) = 32d8d80e806742a45c30494b847533eb2be2571eccf6faa5ae7714747f02defc1edf6f2800d23116b58f6619a9577de6c0ca2f1b515581ca57d6d6a7a0006f4b
+SHA512 (libreswan-5.4.tar.gz.asc) = 701930223fb3ebf70971d24e18c394c47df47ecb7fc8dc39d077add954db124f6c97a06c97f9e906bc867cbbbf0ffb923de1cc06432cd1b013e61698ccdb7cde