From 5c8edb0756b520c95628837334a471abc35aa5d8 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Fri, 14 Aug 2026 12:56:54 +0900 Subject: [PATCH] Update to libreswan-5.4 Resolves: RHEL-139041 Signed-off-by: Daiki Ueno --- .gitignore | 2 ++ libreswan-4.15-ipsec_import.patch | 23 +++++++++++++++++------ libreswan.spec | 11 +++++------ sources | 4 ++-- 4 files changed, 26 insertions(+), 14 deletions(-) diff --git a/.gitignore b/.gitignore index 4aaf615..9f45786 100644 --- a/.gitignore +++ b/.gitignore @@ -72,3 +72,5 @@ /libreswan-5.3.1.tar.gz.sig /libreswan-5.3.2.tar.gz /libreswan-5.3.2.tar.gz.sig +/libreswan-5.4.tar.gz +/libreswan-5.4.tar.gz.asc diff --git a/libreswan-4.15-ipsec_import.patch b/libreswan-4.15-ipsec_import.patch index 129fbfd..cf36b9c 100644 --- a/libreswan-4.15-ipsec_import.patch +++ b/libreswan-4.15-ipsec_import.patch @@ -1,20 +1,31 @@ +From 4129c9d3c56f33039dfe145e05c516a7c0b6e097 Mon Sep 17 00:00:00 2001 +From: rpm-build +Date: Fri, 14 Aug 2026 13:05:28 +0900 +Subject: [PATCH] libreswan-4.15-ipsec_import.patch + +--- + programs/ipsec/ipsec.in | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + diff --git a/programs/ipsec/ipsec.in b/programs/ipsec/ipsec.in -index 40ff9f4138..41813b5258 100755 +index ca5ce0c..33b448a 100755 --- a/programs/ipsec/ipsec.in +++ b/programs/ipsec/ipsec.in -@@ -758,7 +758,14 @@ ipsec_import() { +@@ -755,7 +755,13 @@ ipsec_import() { exit 1 fi -- pk12util -i "${pkcs12bundle}" -d "${IPSEC_NSSDIR_SQL}" -+ # First try blanc password to avoid uselessly prompting interactively -+ pk12util -i "${pkcs12bundle}" -d "${IPSEC_NSSDIR_SQL}" -W '' 2>/dev/null +- @@PK12UTIL@@ -i "${pkcs12bundle}" -d "${IPSEC_NSSDIR_SQL}" ++ @@PK12UTIL@@ -i "${pkcs12bundle}" -d "${IPSEC_NSSDIR_SQL}" -W '' 2>/dev/null + # check for SEC_ERROR_BAD_PASSWORD + if [ $? -eq 18 ]; then + # Not the empty password -+ pk12util -i "${pkcs12bundle}" -d "${IPSEC_NSSDIR_SQL}" ++ @@PK12UTIL@@ -i "${pkcs12bundle}" -d "${IPSEC_NSSDIR_SQL}" + fi + # check and correct trust bits set_nss_db_trusts exit 0 +-- +2.55.0 + diff --git a/libreswan.spec b/libreswan.spec index 1be3033..0e2a4e0 100644 --- a/libreswan.spec +++ b/libreswan.spec @@ -23,6 +23,7 @@ USE_NSS_IPSEC_PROFILE=true \\\ USE_SECCOMP=true \\\ USE_AUTHPAM=true \\\ + USE_XFRM_HEADER_COPY=true \\\ %{nil} #global prever dr1 @@ -30,14 +31,14 @@ Name: libreswan Summary: Internet Key Exchange (IKEv1 and IKEv2) implementation for IPsec # version is generated in the release script -Version: 5.3.2 +Version: 5.4 Release: %autorelease # The code in lib/libswan/nss_copies.c is under MPL-2.0, while the # rest is under GPL-2.0-or-later License: GPL-2.0-or-later AND MPL-2.0 Url: https://libreswan.org/ Source0: https://download.libreswan.org/%{?prever:development/}%{name}-%{version}%{?prever}.tar.gz -Source1: https://download.libreswan.org/%{?prever:development/}%{name}-%{version}%{?prever}.tar.gz.sig +Source1: https://download.libreswan.org/%{?prever:development/}%{name}-%{version}%{?prever}.tar.gz.asc Source2: https://download.libreswan.org/LIBRESWAN-OpenPGP-KEY.txt %if 0%{with_cavstests} Source3: https://download.libreswan.org/cavs/ikev1_dsa.fax.bz2 @@ -46,8 +47,6 @@ Source5: https://download.libreswan.org/cavs/ikev2.fax.bz2 %endif Patch1: libreswan-4.15-ipsec_import.patch -Patch2: libreswan-5.3-outstanding-ike-auth-crossing.patch -Patch3: libreswan-5.3-helper-thread.patch BuildRequires: audit-libs-devel BuildRequires: bison @@ -195,8 +194,8 @@ bunzip2 *.fax.bz2 %endif # Some of these tests will show ERROR for negative testing - it will exit on real errors -%{buildroot}%{_libexecdir}/ipsec/algparse -tp || { echo prooposal test failed; exit 1; } -%{buildroot}%{_libexecdir}/ipsec/algparse -ta || { echo algorithm test failed; exit 1; } +%{buildroot}%{_libexecdir}/ipsec/algparse --tp || { echo prooposal test failed; exit 1; } +%{buildroot}%{_libexecdir}/ipsec/algparse --ta || { echo algorithm test failed; exit 1; } : Algorithm parser tests passed # self test for pluto daemon - this also shows which algorithms it allows in FIPS mode diff --git a/sources b/sources index 0052027..aa005c0 100644 --- a/sources +++ b/sources @@ -1,5 +1,5 @@ SHA512 (ikev1_dsa.fax.bz2) = 627cbac14248bd68e8d22fbca247668a7749ef0c2e41df8d776d62df9a21403d3a246c0bd82c3faedce62de90b9f91a87f753e17b056319000bba7d2038461ac SHA512 (ikev1_psk.fax.bz2) = 1b2daec32edc56b410c036db2688c92548a9bd9914994bc7e555b301dd6db4497a6b3e89dc12ddf36826ae90b40fcde501a5a45c0d59098e07839073d219d467 SHA512 (ikev2.fax.bz2) = 0d3748d1bd574f6f1f3e4db847eca126ce649566ea710ef227426f433122752b80d1d6b8acf9d0df07b5597c1e45447e3a2fcb3391756e834e8e75f99df8e51e -SHA512 (libreswan-5.3.2.tar.gz) = 4dfe71bed06d356c5a33e1874ec934eab8a57a2bdedff8069ebcf65b09dd79490665cbb5b94b691d6e873a0a8e6eb131a4942ffa845a5836a5344436c8efb879 -SHA512 (libreswan-5.3.2.tar.gz.sig) = 55062be3c579316233e63ff44d0c46754517d3a829a9e6b7f2234e10f40eec451696e46695e1f4d4784c89e1b71aabaab8dcf66faa8ddd5e55107ed74f61dd2c +SHA512 (libreswan-5.4.tar.gz) = 32d8d80e806742a45c30494b847533eb2be2571eccf6faa5ae7714747f02defc1edf6f2800d23116b58f6619a9577de6c0ca2f1b515581ca57d6d6a7a0006f4b +SHA512 (libreswan-5.4.tar.gz.asc) = 701930223fb3ebf70971d24e18c394c47df47ecb7fc8dc39d077add954db124f6c97a06c97f9e906bc867cbbbf0ffb923de1cc06432cd1b013e61698ccdb7cde