import libreswan-4.3-1.el8

2021-02-22 14:10:42 +00:00 · 2021-02-22 14:10:42 +00:00 · 7af0159622
commit 7af0159622
parent 3ecac82f4f
5 changed files with 68 additions and 64 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1,4 +1,4 @@
 SOURCES/ikev1_dsa.fax.bz2
 SOURCES/ikev1_psk.fax.bz2
 SOURCES/ikev2.fax.bz2
-SOURCES/libreswan-4.1.tar.gz
+SOURCES/libreswan-4.3.tar.gz
--- a/.libreswan.metadata
+++ b/.libreswan.metadata
@ -1,4 +1,4 @@
 b35cd50b8bc0a08b9c07713bf19c72d53bfe66bb SOURCES/ikev1_dsa.fax.bz2
 861d97bf488f9e296cad8c43ab72f111a5b1a848 SOURCES/ikev1_psk.fax.bz2
 fcaf77f3deae3d8e99cdb3b1f8abea63167a0633 SOURCES/ikev2.fax.bz2
-ae1bbe86a2223aa008f8bf2768e7320c5a7aae9d SOURCES/libreswan-4.1.tar.gz
+6f86811420df8873f43e8ff98f718f1aee5836f3 SOURCES/libreswan-4.3.tar.gz
--- a/SOURCES/libreswan-4.1-maintain-obsolete-keywords.patch
+++ b/SOURCES/libreswan-4.1-maintain-obsolete-keywords.patch
@ -1,7 +1,7 @@
-diff -Naur libreswan-4.1-orig/lib/libipsecconf/keywords.c libreswan-4.1/lib/libipsecconf/keywords.c
--- libreswan-4.1-orig/lib/libipsecconf/keywords.c	2020-10-18 21:11:05.000000000 -0400
-+++ libreswan-4.1/lib/libipsecconf/keywords.c	2020-10-27 23:47:09.999098076 -0400
-@@ -366,6 +366,8 @@
+diff -Naur libreswan-4.2-orig/lib/libipsecconf/keywords.c libreswan-4.2/lib/libipsecconf/keywords.c
+--- libreswan-4.2-orig/lib/libipsecconf/keywords.c	2021-02-02 20:36:01.000000000 -0500
+++ libreswan-4.2/lib/libipsecconf/keywords.c	2021-02-04 19:22:05.880228930 -0500
+@@ -374,6 +374,8 @@
   { "interfaces",  kv_config,  kt_string,  KSF_INTERFACES, NULL, NULL, },
   { "curl-iface",  kv_config,  kt_string,  KSF_CURLIFACE, NULL, NULL, },
   { "curl-timeout",  kv_config,  kt_time,  KBF_CURLTIMEOUT, NULL, NULL, },
@ -10,7 +10,7 @@ diff -Naur libreswan-4.1-orig/lib/libipsecconf/keywords.c libreswan-4.1/lib/libi
 
   { "myvendorid",  kv_config,  kt_string,  KSF_MYVENDORID, NULL, NULL, },
   { "syslog",  kv_config,  kt_string,  KSF_SYSLOG, NULL, NULL, },
-@@ -373,6 +375,7 @@
+@@ -381,6 +383,7 @@
   { "logfile",  kv_config,  kt_filename,  KSF_LOGFILE, NULL, NULL, },
   { "plutostderrlog",  kv_config,  kt_filename,  KSF_LOGFILE, NULL, NULL, }, /* obsolete name, but very common :/ */
   { "logtime",  kv_config,  kt_bool,  KBF_LOGTIME, NULL, NULL, },
@ -18,7 +18,7 @@ diff -Naur libreswan-4.1-orig/lib/libipsecconf/keywords.c libreswan-4.1/lib/libi
   { "logappend",  kv_config,  kt_bool,  KBF_LOGAPPEND, NULL, NULL, },
   { "logip",  kv_config,  kt_bool,  KBF_LOGIP, NULL, NULL, },
   { "audit-log",  kv_config,  kt_bool,  KBF_AUDIT_LOG, NULL, NULL, },
-@@ -392,13 +395,20 @@
+@@ -400,13 +403,20 @@
   { "global-redirect-to", kv_config, kt_string, KSF_GLOBAL_REDIRECT_TO, NULL, NULL, },
 
   { "crl-strict",  kv_config,  kt_bool,  KBF_CRL_STRICT, NULL, NULL, },
@ -39,7 +39,7 @@ diff -Naur libreswan-4.1-orig/lib/libipsecconf/keywords.c libreswan-4.1/lib/libi
   { "ocsp-cache-size",  kv_config,  kt_number,  KBF_OCSP_CACHE_SIZE, NULL, NULL, },
   { "ocsp-cache-min-age",  kv_config,  kt_time,  KBF_OCSP_CACHE_MIN, NULL, NULL, },
   { "ocsp-cache-max-age",  kv_config,  kt_time,  KBF_OCSP_CACHE_MAX, NULL, NULL, },
-@@ -418,6 +428,7 @@
+@@ -426,6 +436,7 @@
   { "virtual_private",  kv_config,  kt_string,  KSF_VIRTUALPRIVATE, NULL, NULL, }, /* obsolete variant, very common */
   { "seedbits",  kv_config,  kt_number,  KBF_SEEDBITS, NULL, NULL, },
   { "keep-alive",  kv_config,  kt_number,  KBF_KEEPALIVE, NULL, NULL, },
@ -47,7 +47,7 @@ diff -Naur libreswan-4.1-orig/lib/libipsecconf/keywords.c libreswan-4.1/lib/libi
 
   { "listen-tcp", kv_config, kt_bool, KBF_LISTEN_TCP, NULL, NULL },
   { "listen-udp", kv_config, kt_bool, KBF_LISTEN_UDP, NULL, NULL },
-@@ -429,6 +440,8 @@
+@@ -437,6 +448,8 @@
 #ifdef HAVE_LABELED_IPSEC
   { "ikev1-secctx-attr-type",  kv_config,  kt_number,  KBF_SECCTX, NULL, NULL, },  /* obsolete: not a value, a type */
   { "secctx-attr-type",  kv_config | kv_alias,  kt_number,  KBF_SECCTX, NULL, NULL, },
@ -56,16 +56,15 @@ diff -Naur libreswan-4.1-orig/lib/libipsecconf/keywords.c libreswan-4.1/lib/libi
 #endif
 
   /* these options are obsoleted (and not old aliases) */
-@@ -457,6 +470,8 @@
-   { "modecfgserver",  kv_conn | kv_leftright,  kt_bool,  KNCF_MODECONFIGSERVER, NULL, NULL, },
-   { "modecfgclient",  kv_conn | kv_leftright,  kt_bool,  KNCF_MODECONFIGCLIENT, NULL, NULL, },
+@@ -467,6 +480,7 @@
   { "username",  kv_conn | kv_leftright,  kt_string,  KSCF_USERNAME, NULL, NULL, },
-+  { "xauthusername",  kv_conn | kv_leftright | kv_alias,  kt_string,  KSCF_USERNAME, NULL, NULL, },  /* obsolete name */
-+  { "xauthname",  kv_conn | kv_leftright | kv_alias,  kt_string,  KSCF_USERNAME, NULL, NULL, },  /* obsolete name */
+   /* xauthusername is still used in NetworkManager-libreswan :/ */
+   { "xauthusername",  kv_conn | kv_leftright,  kt_string,  KSCF_USERNAME, NULL, NULL, }, /* old alias */
+  { "xauthname",  kv_conn | kv_leftright,  kt_string,  KSCF_USERNAME, NULL, NULL, }, /* old alias */
   { "addresspool",  kv_conn | kv_leftright,  kt_range,  KSCF_ADDRESSPOOL, NULL, NULL, },
   { "auth",  kv_conn | kv_leftright, kt_enum,  KNCF_AUTH,  &kw_authby_lr_list, NULL, },
   { "cat",  kv_conn | kv_leftright,  kt_bool,  KNCF_CAT, NULL, NULL, },
-@@ -479,6 +494,8 @@
+@@ -489,6 +503,8 @@
   { "esn",  kv_conn | kv_processed,  kt_enum,  KNCF_ESN,  &kw_esn_list, NULL, },
   { "decap-dscp",  kv_conn | kv_processed,  kt_bool,  KNCF_DECAP_DSCP,  NULL, NULL, },
   { "nopmtudisc",  kv_conn | kv_processed,  kt_bool,  KNCF_NOPMTUDISC,  NULL, NULL, },
@ -74,7 +73,7 @@ diff -Naur libreswan-4.1-orig/lib/libipsecconf/keywords.c libreswan-4.1/lib/libi
   { "fragmentation",  kv_conn | kv_processed,  kt_enum,  KNCF_IKE_FRAG,  &kw_ynf_list, NULL, },
   { "mobike",  kv_conn,  kt_bool,  KNCF_MOBIKE, NULL, NULL, },
   { "narrowing",  kv_conn,  kt_bool,  KNCF_IKEv2_ALLOW_NARROWING, NULL, NULL, },
-@@ -489,13 +506,18 @@
+@@ -499,13 +515,18 @@
   { "accept-redirect-to",  kv_conn,  kt_string, KSCF_ACCEPT_REDIRECT_TO, NULL, NULL, },
   { "pfs",  kv_conn,  kt_bool,  KNCF_PFS, NULL, NULL, },
 
@ -93,27 +92,25 @@ diff -Naur libreswan-4.1-orig/lib/libipsecconf/keywords.c libreswan-4.1/lib/libi
   { "sha2-truncbug",  kv_conn,  kt_bool,  KNCF_SHA2_TRUNCBUG, NULL, NULL, },
   { "ms-dh-downgrade",  kv_conn,  kt_bool,  KNCF_MSDH_DOWNGRADE, NULL, NULL, },
   { "require-id-on-certificate",  kv_conn,  kt_bool,  KNCF_SAN_ON_CERT, NULL, NULL, },
-@@ -511,14 +533,19 @@
+@@ -520,7 +541,10 @@
+   {"ikepad",  kv_conn,  kt_bool,  KNCF_IKEPAD, NULL, NULL, },
   { "nat-ikev1-method",  kv_conn | kv_processed,  kt_enum,  KNCF_IKEV1_NATT,  &kw_ikev1natt_list, NULL, },
- #ifdef HAVE_LABELED_IPSEC
-   /* only policy label is used, non-zero means wanting labeled IPsec */
+ 
 +  { "labeled_ipsec",  kv_conn, kt_obsolete, KNCF_WARNIGNORE, NULL, NULL, }, /* obsolete */
 +  { "labeled-ipsec",  kv_conn, kt_obsolete, KNCF_WARNIGNORE, NULL, NULL, }, /* obsolete */
-+  { "policy_label",  kv_conn | kv_alias,  kt_string,  KSCF_POLICY_LABEL, NULL, NULL, },  /* obsolete _ */
-   { "policy-label",  kv_conn,  kt_string,  KSCF_POLICY_LABEL, NULL, NULL, },
- #endif
+   { "policy-label",  kv_conn,  kt_string,  KSCF_SA_SEC_LABEL, NULL, NULL, }, /* obsolete variant */
+  { "policy_label",  kv_conn,  kt_string,  KSCF_SA_SEC_LABEL, NULL, NULL, }, /* obsolete variant */
+   { "sec-label",  kv_conn,  kt_string,  KSCF_SA_SEC_LABEL, NULL, NULL, }, /* really stored into struct end */
 
   /* Cisco interop: remote peer type */
-+  { "remote_peer_type",  kv_conn | kv_alias,  kt_enum,  KNCF_REMOTEPEERTYPE,  &kw_remote_peer_type, NULL, },  /* obsolete _ */
-   { "remote-peer-type",  kv_conn,  kt_enum,  KNCF_REMOTEPEERTYPE,  &kw_remote_peer_type, NULL, },
- 
+@@ -531,13 +555,17 @@
   /* Network Manager support */
 #ifdef HAVE_NM
-+  { "nm_configured",  kv_conn | kv_alias,  kt_bool,  KNCF_NMCONFIGURED, NULL, NULL, },  /* obsolete _ */
   { "nm-configured",  kv_conn,  kt_bool,  KNCF_NMCONFIGURED, NULL, NULL, },
+  { "nm_configured",  kv_conn,  kt_bool,  KNCF_NMCONFIGURED, NULL, NULL, }, /* obsolete _ */
 #endif
 
-@@ -526,7 +553,10 @@
+   { "xauthby",  kv_conn,  kt_enum,  KNCF_XAUTHBY,  &kw_xauthby, NULL, },
   { "xauthfail",  kv_conn,  kt_enum,  KNCF_XAUTHFAIL,  &kw_xauthfail, NULL, },
   { "modecfgpull",  kv_conn,  kt_invertbool,  KNCF_MODECONFIGPULL, NULL, NULL, },
   { "modecfgdns",  kv_conn,  kt_string,  KSCF_MODECFGDNS, NULL, NULL, },
@ -122,5 +119,5 @@ diff -Naur libreswan-4.1-orig/lib/libipsecconf/keywords.c libreswan-4.1/lib/libi
   { "modecfgdomains",  kv_conn,  kt_string,  KSCF_MODECFGDOMAINS, NULL, NULL, },
 +  { "modecfgdomain",  kv_conn | kv_alias,  kt_string,  KSCF_MODECFGDOMAINS, NULL, NULL, }, /* obsolete */
   { "modecfgbanner",  kv_conn,  kt_string,  KSCF_MODECFGBANNER, NULL, NULL, },
+   { "ignore-peer-dns",  kv_conn,  kt_bool,  KNCF_IGNORE_PEER_DNS, NULL, NULL, },
   { "mark",  kv_conn,  kt_string,  KSCF_CONN_MARK_BOTH, NULL, NULL, },
-   { "mark-in",  kv_conn,  kt_string,  KSCF_CONN_MARK_IN, NULL, NULL, },
--- a/SOURCES/libreswan-4.3-maintain-different-v1v2-split.patch
+++ b/SOURCES/libreswan-4.3-maintain-different-v1v2-split.patch
@ -1,6 +1,6 @@
-diff -Naur libreswan-4.1-orig/configs/d.ipsec.conf/ikev2.xml libreswan-4.1/configs/d.ipsec.conf/ikev2.xml
--- libreswan-4.1-orig/configs/d.ipsec.conf/ikev2.xml	2020-10-18 21:11:05.000000000 -0400
-+++ libreswan-4.1/configs/d.ipsec.conf/ikev2.xml	2020-10-27 23:31:41.943387992 -0400
+diff -Naur libreswan-4.3-orig/configs/d.ipsec.conf/ikev2.xml libreswan-4.3/configs/d.ipsec.conf/ikev2.xml
+--- libreswan-4.3-orig/configs/d.ipsec.conf/ikev2.xml	2021-02-21 12:03:03.000000000 -0500
+++ libreswan-4.3/configs/d.ipsec.conf/ikev2.xml	2021-02-21 12:33:36.226284499 -0500
@@ -1,15 +1,15 @@
   <varlistentry>
   <term><emphasis remap='B'>ikev2</emphasis></term>
@ -25,46 +25,46 @@ diff -Naur libreswan-4.1-orig/configs/d.ipsec.conf/ikev2.xml libreswan-4.1/confi
 </para>
   </listitem>
   </varlistentry>
-diff -Naur libreswan-4.1-orig/lib/libipsecconf/confread.c libreswan-4.1/lib/libipsecconf/confread.c
--- libreswan-4.1-orig/lib/libipsecconf/confread.c	2020-10-18 21:11:05.000000000 -0400
-+++ libreswan-4.1/lib/libipsecconf/confread.c	2020-10-27 23:28:15.199171781 -0400
-@@ -1299,13 +1299,16 @@
+diff -Naur libreswan-4.3-orig/lib/libipsecconf/confread.c libreswan-4.3/lib/libipsecconf/confread.c
+--- libreswan-4.3-orig/lib/libipsecconf/confread.c	2021-02-21 12:03:03.000000000 -0500
+++ libreswan-4.3/lib/libipsecconf/confread.c	2021-02-21 12:37:43.138031929 -0500
+@@ -1310,11 +1310,17 @@
 
 		switch (conn->options[KNCF_IKEv2]) {
 		case fo_never:
 -		case fo_permit:
- 			conn->policy |= POLICY_IKEV1_ALLOW;
- 			/* clear any inherited default */
- 			conn->policy &= ~POLICY_IKEV2_ALLOW;
+ 			conn->ike_version = IKEv1;
 			break;
-
+ 
 +		case fo_permit:
 +			starter_error_append(perrl, "ikev2=permit is no longer accepted. Use ikev2=insist or ikev2=no|never");
 +			return TRUE;
+
 		case fo_propose:
 +			starter_error_append(perrl, "ikev2=propose or ikev2=yes is no longer accepted. Use ikev2=insist or ikev2=no|never");
 +			return TRUE;
+
 		case fo_insist:
- 			conn->policy |= POLICY_IKEV2_ALLOW;
- 			/* clear any inherited default */
-diff -Naur libreswan-4.1-orig/programs/whack/whack.c libreswan-4.1/programs/whack/whack.c
--- libreswan-4.1-orig/programs/whack/whack.c	2020-10-18 21:11:05.000000000 -0400
-+++ libreswan-4.1/programs/whack/whack.c	2020-10-27 23:33:01.065215832 -0400
-@@ -780,7 +780,7 @@
- 	PS("ikev1-allow", IKEV1_ALLOW), /* obsolete name */
- 	PS("ikev2", IKEV2_ALLOW),
- 	PS("ikev2-allow", IKEV2_ALLOW), /* obsolete name */
-	PS("ikev2-propose", IKEV2_ALLOW), /* obsolete, map onto allow */
-+	/* not in RHEL8 PS("ikev2-propose", IKEV2_ALLOW), */
+ 			conn->ike_version = IKEv2;
+ 			break;
+diff -Naur libreswan-4.3-orig/programs/whack/whack.c libreswan-4.3/programs/whack/whack.c
+--- libreswan-4.3-orig/programs/whack/whack.c	2021-02-21 12:03:03.000000000 -0500
+++ libreswan-4.3/programs/whack/whack.c	2021-02-21 12:39:27.066188354 -0500
+@@ -801,7 +801,7 @@
+ 	{ "ikev1-allow", no_argument, NULL, CD_IKEv1 + OO }, /* obsolete name */
+ 	{ "ikev2", no_argument, NULL, CD_IKEv2 +OO },
+ 	{ "ikev2-allow", no_argument, NULL, CD_IKEv2 +OO }, /* obsolete name */
+-	{ "ikev2-propose", no_argument, NULL, CD_IKEv2 +OO }, /* obsolete, map onto allow */
+	/* not in RHEL8 { "ikev2-propose", no_argument, NULL, CD_IKEv2 +OO }, */
 
 	PS("allow-narrowing", IKEV2_ALLOW_NARROWING),
- #ifdef XAUTH_HAVE_PAM
-@@ -1707,7 +1707,7 @@
+ #ifdef AUTH_HAVE_PAM
+@@ -1762,7 +1762,7 @@
+ 			end_seen = LEMPTY;
+ 			continue;
 
- 		/* --ikev1 */
- 		case CDP_SINGLETON + POLICY_IKEV1_ALLOW_IX:
-		/* --ikev2 (now also --ikev2-propose) */
-+		/* --ikev2 */
- 		case CDP_SINGLETON + POLICY_IKEV2_ALLOW_IX:
- 
- 		/* --allow-narrowing */
+-		/* --ikev1 --ikev2 --ikev2-propose */
+		/* --ikev1 --ikev2  */
+ 		case CD_IKEv1:
+ 		case CD_IKEv2:
+ 		{
--- a/SPECS/libreswan.spec
+++ b/SPECS/libreswan.spec
@ -28,7 +28,6 @@
    USE_NSS_KDF=true \\\
    USE_SECCOMP=true \\\
    USE_AUTHPAM=true \\\
-    USE_PRF_AES_XCBC=true \\\
    USE_DH2=true \\\
 %{nil}

@ -37,7 +36,7 @@
 Name: libreswan
 Summary: IPsec implementation with IKEv1 and IKEv2 keying protocols
 # version is generated in the release script
-Version: 4.1
+Version: 4.3
 Release: %{?prever:0.}1%{?prever:.%{prever}}%{?dist}
 License: GPLv2
 Url: https://libreswan.org/
@ -49,7 +48,7 @@ Source2: https://download.libreswan.org/cavs/ikev1_psk.fax.bz2
 Source3: https://download.libreswan.org/cavs/ikev2.fax.bz2
 %endif

-Patch1: libreswan-4.1-maintain-different-v1v2-split.patch
+Patch1: libreswan-4.3-maintain-different-v1v2-split.patch
 Patch2: libreswan-3.32-1861360-nodefault-rsa-pss.patch
 Patch3: libreswan-4.1-maintain-obsolete-keywords.patch

@ -65,7 +64,7 @@ BuildRequires: libseccomp-devel
 BuildRequires: libselinux-devel
 BuildRequires: nspr-devel
 BuildRequires: nss-devel >= %{nss_version}
-buildRequires: nss-tools
+BuildRequires: nss-tools
 BuildRequires: openldap-devel
 BuildRequires: pam-devel
 BuildRequires: pkgconfig
@ -206,11 +205,19 @@ certutil -N -d sql:$tmpdir --empty-password
 %attr(0644,root,root) %{_tmpfilesdir}/libreswan.conf
 %attr(0644,root,root) %{_unitdir}/ipsec.service
 %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/pam.d/pluto
+%config(noreplace) %{_sysconfdir}/logrotate.d/libreswan
 %{_sbindir}/ipsec
 %{_libexecdir}/ipsec
 %attr(0644,root,root) %doc %{_mandir}/*/*

 %changelog
+* Sun Feb 21 2021 Paul Wouters <pwouters@redhat.com> - 4.3-1
+- Resolves: rhbz#1025061 - IKEv2 support for Labeled IPsec [update]
+
+* Thu Feb 04 2021 Paul Wouters <pwouters@redhat.com> - 4.2-1
+- Resolves: rhbz#1891128 [Rebase] rebase libreswan to 4.2
+- Resolves: rhbz#1025061 - IKEv2 support for Labeled IPsec
+
 * Tue Oct 27 22:11:42 EDT 2020 Paul Wouters <pwouters@redhat.com> - 4.1-1
 - Resolves: rhbz#1891128 [Rebase] rebase libreswan to 4.1
 - Resolves: rhbz#1889836 libreswan: add 3.x compat patches for obsoleted/removed keywords of 4.0 and re-port ikev2= patch