import UBI libreswan-4.12-3.el9
This commit is contained in:
parent
1f8351d7ee
commit
e20b7f550c
92
SOURCES/libreswan-4.12-ikev1-compute-keymat-default.patch
Normal file
92
SOURCES/libreswan-4.12-ikev1-compute-keymat-default.patch
Normal file
@ -0,0 +1,92 @@
|
|||||||
|
From 5101913b1e623121a9222f11eefa18f0a2708b00 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Andrew Cagney <cagney@gnu.org>
|
||||||
|
Date: Wed, 27 Mar 2024 10:43:19 -0400
|
||||||
|
Subject: [PATCH] ikev1: in compute_proto_keymat() only allow explicitly
|
||||||
|
handled ESP algorithms
|
||||||
|
|
||||||
|
---
|
||||||
|
programs/pluto/ikev1_quick.c | 41 ++++++++++++++----------------------
|
||||||
|
1 file changed, 16 insertions(+), 25 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/programs/pluto/ikev1_quick.c b/programs/pluto/ikev1_quick.c
|
||||||
|
index 81c522c148..22c346afb4 100644
|
||||||
|
--- a/programs/pluto/ikev1_quick.c
|
||||||
|
+++ b/programs/pluto/ikev1_quick.c
|
||||||
|
@@ -203,7 +203,7 @@ static bool emit_subnet_id(enum perspective perspective,
|
||||||
|
* RFC 2409 "IKE" section 5.5
|
||||||
|
* specifies how this is to be done.
|
||||||
|
*/
|
||||||
|
-static void compute_proto_keymat(struct state *st,
|
||||||
|
+static bool compute_proto_keymat(struct state *st,
|
||||||
|
uint8_t protoid,
|
||||||
|
struct ipsec_proto_info *pi,
|
||||||
|
const char *satypename)
|
||||||
|
@@ -297,27 +297,13 @@ static void compute_proto_keymat(struct state *st,
|
||||||
|
}
|
||||||
|
break;
|
||||||
|
|
||||||
|
- case ESP_CAST:
|
||||||
|
- case ESP_TWOFISH:
|
||||||
|
- case ESP_SERPENT:
|
||||||
|
- /* ESP_SEED is for IKEv1 only and not supported. Its number in IKEv2 has been re-used */
|
||||||
|
- bad_case(pi->attrs.transattrs.ta_ikev1_encrypt);
|
||||||
|
-
|
||||||
|
default:
|
||||||
|
- /* bytes */
|
||||||
|
- needed_len = encrypt_max_key_bit_length(pi->attrs.transattrs.ta_encrypt) / BITS_PER_BYTE;
|
||||||
|
- if (needed_len > 0) {
|
||||||
|
- /* XXX: check key_len coupling with kernel.c's */
|
||||||
|
- if (pi->attrs.transattrs.enckeylen) {
|
||||||
|
- needed_len =
|
||||||
|
- pi->attrs.transattrs.enckeylen
|
||||||
|
- / BITS_PER_BYTE;
|
||||||
|
- dbg("compute_proto_keymat: key_len=%d from peer",
|
||||||
|
- (int)needed_len);
|
||||||
|
- }
|
||||||
|
- break;
|
||||||
|
- }
|
||||||
|
- bad_case(pi->attrs.transattrs.ta_ikev1_encrypt);
|
||||||
|
+ {
|
||||||
|
+ enum_buf eb;
|
||||||
|
+ llog(RC_LOG, st->st_logger, "rejecting request for keymat for %s",
|
||||||
|
+ str_enum(&esp_transformid_names, protoid, &eb));
|
||||||
|
+ return false;
|
||||||
|
+ }
|
||||||
|
}
|
||||||
|
dbg("compute_proto_keymat: needed_len (after ESP enc)=%d", (int)needed_len);
|
||||||
|
needed_len += pi->attrs.transattrs.ta_integ->integ_keymat_size;
|
||||||
|
@@ -359,14 +345,17 @@ static void compute_proto_keymat(struct state *st,
|
||||||
|
DBG_dump_hunk(" inbound:", pi->inbound.keymat);
|
||||||
|
DBG_dump_hunk(" outbound:", pi->outbound.keymat);
|
||||||
|
}
|
||||||
|
+
|
||||||
|
+ return true;
|
||||||
|
}
|
||||||
|
|
||||||
|
-static void compute_keymats(struct state *st)
|
||||||
|
+static bool compute_keymats(struct state *st)
|
||||||
|
{
|
||||||
|
if (st->st_ah.present)
|
||||||
|
- compute_proto_keymat(st, PROTO_IPSEC_AH, &st->st_ah, "AH");
|
||||||
|
+ return compute_proto_keymat(st, PROTO_IPSEC_AH, &st->st_ah, "AH");
|
||||||
|
if (st->st_esp.present)
|
||||||
|
- compute_proto_keymat(st, PROTO_IPSEC_ESP, &st->st_esp, "ESP");
|
||||||
|
+ return compute_proto_keymat(st, PROTO_IPSEC_ESP, &st->st_esp, "ESP");
|
||||||
|
+ return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
@@ -1460,7 +1449,9 @@ static stf_status quick_inI1_outR1_continue12_tail(struct state *st, struct msg_
|
||||||
|
fixup_v1_HASH(st, &hash_fixup, st->st_v1_msgid.id, rbody.cur);
|
||||||
|
|
||||||
|
/* Derive new keying material */
|
||||||
|
- compute_keymats(st);
|
||||||
|
+ if (!compute_keymats(st)) {
|
||||||
|
+ return STF_FATAL;
|
||||||
|
+ }
|
||||||
|
|
||||||
|
/* Tell the kernel to establish the new inbound SA
|
||||||
|
* (unless the commit bit is set -- which we don't support).
|
||||||
|
--
|
||||||
|
2.45.0
|
||||||
|
|
||||||
54
SOURCES/libreswan-4.12-ikev2-auth-delete-state.patch
Normal file
54
SOURCES/libreswan-4.12-ikev2-auth-delete-state.patch
Normal file
@ -0,0 +1,54 @@
|
|||||||
|
From 2ec448884a7467743699803f8a36ee28d237666c Mon Sep 17 00:00:00 2001
|
||||||
|
From: Andrew Cagney <cagney@gnu.org>
|
||||||
|
Date: Wed, 28 Feb 2024 08:29:53 -0500
|
||||||
|
Subject: [PATCH] ikev2: return STF_FATAL when initiator fails to emit AUTH
|
||||||
|
packet
|
||||||
|
|
||||||
|
---
|
||||||
|
programs/pluto/ikev2_ike_auth.c | 2 +-
|
||||||
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/programs/pluto/ikev2_ike_auth.c b/programs/pluto/ikev2_ike_auth.c
|
||||||
|
index 192eb1b3b6..a54a109699 100644
|
||||||
|
--- a/programs/pluto/ikev2_ike_auth.c
|
||||||
|
+++ b/programs/pluto/ikev2_ike_auth.c
|
||||||
|
@@ -1267,7 +1267,7 @@ static stf_status process_v2_IKE_AUTH_request_auth_signature_continue(struct ike
|
||||||
|
/* now send AUTH payload */
|
||||||
|
|
||||||
|
if (!emit_local_v2AUTH(ike, auth_sig, &ike->sa.st_v2_id_payload.mac, response.pbs)) {
|
||||||
|
- return STF_INTERNAL_ERROR;
|
||||||
|
+ return STF_FATAL;
|
||||||
|
}
|
||||||
|
ike->sa.st_v2_ike_intermediate.used = false;
|
||||||
|
|
||||||
|
--
|
||||||
|
2.44.0
|
||||||
|
|
||||||
|
From 16272f2475d25baab58fbed2af7c67cfb459137f Mon Sep 17 00:00:00 2001
|
||||||
|
From: Andrew Cagney <cagney@gnu.org>
|
||||||
|
Date: Thu, 29 Feb 2024 12:19:20 -0500
|
||||||
|
Subject: [PATCH] ikev2: always return STF_FATAL if emitting AUTH fails
|
||||||
|
|
||||||
|
Fix:
|
||||||
|
ikev2: return STF_FATAL when initiator fails to emit AUTH packet
|
||||||
|
which really fixed the responder.
|
||||||
|
---
|
||||||
|
programs/pluto/ikev2_ike_auth.c | 2 +-
|
||||||
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/programs/pluto/ikev2_ike_auth.c b/programs/pluto/ikev2_ike_auth.c
|
||||||
|
index a54a109699..491053fb10 100644
|
||||||
|
--- a/programs/pluto/ikev2_ike_auth.c
|
||||||
|
+++ b/programs/pluto/ikev2_ike_auth.c
|
||||||
|
@@ -397,7 +397,7 @@ stf_status initiate_v2_IKE_AUTH_request_signature_continue(struct ike_sa *ike,
|
||||||
|
/* send out the AUTH payload */
|
||||||
|
|
||||||
|
if (!emit_local_v2AUTH(ike, auth_sig, &ike->sa.st_v2_id_payload.mac, request.pbs)) {
|
||||||
|
- return STF_INTERNAL_ERROR;
|
||||||
|
+ return STF_FATAL;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (LIN(POLICY_MOBIKE, ike->sa.st_connection->policy)) {
|
||||||
|
--
|
||||||
|
2.44.0
|
||||||
|
|
||||||
198
SOURCES/libreswan-4.12-ipv6-san.patch
Normal file
198
SOURCES/libreswan-4.12-ipv6-san.patch
Normal file
@ -0,0 +1,198 @@
|
|||||||
|
From 474d75be074799efa9e38f346d3fdb76dec3eead Mon Sep 17 00:00:00 2001
|
||||||
|
From: Andrew Cagney <cagney@gnu.org>
|
||||||
|
Date: Tue, 5 Dec 2023 13:55:37 -0500
|
||||||
|
Subject: [PATCH] x509: unpack IPv6 general names based on length
|
||||||
|
|
||||||
|
fix #1321
|
||||||
|
---
|
||||||
|
programs/pluto/x509.c | 35 +++++++++++++++++++++++++++++------
|
||||||
|
1 file changed, 29 insertions(+), 6 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/programs/pluto/x509.c b/programs/pluto/x509.c
|
||||||
|
index fbbf5a553e..f7e97b9979 100644
|
||||||
|
--- a/programs/pluto/x509.c
|
||||||
|
+++ b/programs/pluto/x509.c
|
||||||
|
@@ -336,7 +336,7 @@ generalName_t *collect_rw_ca_candidates(struct msg_digest *md)
|
||||||
|
*/
|
||||||
|
static void gntoid(struct id *id, const generalName_t *gn, struct logger *logger)
|
||||||
|
{
|
||||||
|
- *id = empty_id;
|
||||||
|
+ *id = empty_id; /* aka ID_NONE */
|
||||||
|
|
||||||
|
switch (gn->kind) {
|
||||||
|
case GN_DNS_NAME: /* ID type: ID_FQDN */
|
||||||
|
@@ -345,18 +345,37 @@ static void gntoid(struct id *id, const generalName_t *gn, struct logger *logger
|
||||||
|
break;
|
||||||
|
case GN_IP_ADDRESS: /* ID type: ID_IPV4_ADDR */
|
||||||
|
{
|
||||||
|
+ const struct ip_info *afi = NULL;
|
||||||
|
+ for (enum ip_index i = 0; i < IP_INDEX_ROOF; i++) {
|
||||||
|
+ if (ip_families[i].ip_size == gn->name.len) {
|
||||||
|
+ afi = &ip_families[i];
|
||||||
|
+ break;
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+ if (afi == NULL) {
|
||||||
|
+ llog(RC_LOG, logger,
|
||||||
|
+ "warning: invalid IP_ADDRESS general name: %zu byte length is not valid",
|
||||||
|
+ gn->name.len);
|
||||||
|
+ PEXPECT(logger, id->kind == ID_NONE);
|
||||||
|
+ return;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
/*
|
||||||
|
* XXX: why could this fail; and what happens when it
|
||||||
|
* is ignored?
|
||||||
|
*/
|
||||||
|
- const struct ip_info *afi = &ipv4_info;
|
||||||
|
- id->kind = afi->id_ip_addr;
|
||||||
|
- err_t ugh = hunk_to_address(gn->name, afi, &id->ip_addr);
|
||||||
|
+ ip_address addr;
|
||||||
|
+ err_t ugh = hunk_to_address(gn->name, afi, &addr);
|
||||||
|
if (ugh != NULL) {
|
||||||
|
llog(RC_LOG, logger,
|
||||||
|
- "warning: gntoid() failed to initaddr(): %s",
|
||||||
|
- ugh);
|
||||||
|
+ "warning: invalid IP_ADDRESS general name: %s",
|
||||||
|
+ ugh);
|
||||||
|
+ PEXPECT(logger, id->kind == ID_NONE);
|
||||||
|
+ return;
|
||||||
|
}
|
||||||
|
+
|
||||||
|
+ id->kind = afi->id_ip_addr;
|
||||||
|
+ id->ip_addr = addr;
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
case GN_RFC822_NAME: /* ID type: ID_USER_FQDN */
|
||||||
|
@@ -464,14 +483,18 @@ bool add_pubkey_from_nss_cert(struct pubkey_list **pubkey_db,
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
+ ldbg(logger, "adding cert using subject name");
|
||||||
|
replace_public_key(pubkey_db, &pk);
|
||||||
|
passert(pk == NULL); /*stolen*/
|
||||||
|
|
||||||
|
+ ldbg(logger, "adding cert using general names");
|
||||||
|
add_cert_san_pubkeys(pubkey_db, cert, logger);
|
||||||
|
|
||||||
|
if (keyid != NULL && keyid->kind != ID_DER_ASN1_DN &&
|
||||||
|
keyid->kind != ID_NONE &&
|
||||||
|
keyid->kind != ID_FROMCERT) {
|
||||||
|
+ id_buf idb;
|
||||||
|
+ ldbg(logger, "adding cert using keyid %s", str_id(keyid, &idb));
|
||||||
|
struct pubkey *pk2 = NULL;
|
||||||
|
diag_t d = create_pubkey_from_cert(keyid, cert, &pk2, logger);
|
||||||
|
if (d != NULL) {
|
||||||
|
--
|
||||||
|
2.44.0
|
||||||
|
|
||||||
|
From 1e27be95cd710a840681d1a51913e6a32ce75a2a Mon Sep 17 00:00:00 2001
|
||||||
|
From: Andrew Cagney <cagney@gnu.org>
|
||||||
|
Date: Mon, 11 Mar 2024 17:18:51 -0400
|
||||||
|
Subject: [PATCH] building: back-port ip_families[] and ip_index
|
||||||
|
|
||||||
|
---
|
||||||
|
include/ip_index.h | 27 +++++++++++++++++++++++++++
|
||||||
|
include/ip_info.h | 7 +++++--
|
||||||
|
lib/libswan/ip_info.c | 9 ++++++---
|
||||||
|
3 files changed, 38 insertions(+), 5 deletions(-)
|
||||||
|
create mode 100644 include/ip_index.h
|
||||||
|
|
||||||
|
diff --git a/include/ip_index.h b/include/ip_index.h
|
||||||
|
new file mode 100644
|
||||||
|
index 0000000000..508589b05e
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/include/ip_index.h
|
||||||
|
@@ -0,0 +1,27 @@
|
||||||
|
+/* ip address type index, for libreswan
|
||||||
|
+ *
|
||||||
|
+ * Copyright (C) 2022 Andrew Cagney
|
||||||
|
+ *
|
||||||
|
+ * This library is free software; you can redistribute it and/or modify it
|
||||||
|
+ * under the terms of the GNU Library General Public License as published by
|
||||||
|
+ * the Free Software Foundation; either version 2 of the License, or (at your
|
||||||
|
+ * option) any later version. See <https://www.gnu.org/licenses/lgpl-2.1.txt>.
|
||||||
|
+ *
|
||||||
|
+ * This library is distributed in the hope that it will be useful, but
|
||||||
|
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||||
|
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public
|
||||||
|
+ * License for more details.
|
||||||
|
+ *
|
||||||
|
+ */
|
||||||
|
+
|
||||||
|
+#ifndef IP_INDEX_H
|
||||||
|
+#define IP_INDEX_H
|
||||||
|
+
|
||||||
|
+enum ip_index {
|
||||||
|
+ IPv4_INDEX,
|
||||||
|
+ IPv6_INDEX,
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+#define IP_INDEX_ROOF (IPv6_INDEX+1)
|
||||||
|
+
|
||||||
|
+#endif
|
||||||
|
diff --git a/include/ip_info.h b/include/ip_info.h
|
||||||
|
index 40e99ef687..c1329a8569 100644
|
||||||
|
--- a/include/ip_info.h
|
||||||
|
+++ b/include/ip_info.h
|
||||||
|
@@ -9,6 +9,7 @@
|
||||||
|
#include "ip_subnet.h"
|
||||||
|
#include "ip_selector.h"
|
||||||
|
#include "ip_sockaddr.h"
|
||||||
|
+#include "ip_index.h"
|
||||||
|
|
||||||
|
struct ip_info {
|
||||||
|
/*
|
||||||
|
@@ -113,8 +114,10 @@ struct ip_info {
|
||||||
|
|
||||||
|
};
|
||||||
|
|
||||||
|
-extern const struct ip_info ipv4_info;
|
||||||
|
-extern const struct ip_info ipv6_info;
|
||||||
|
+extern const struct ip_info ip_families[IP_INDEX_ROOF];
|
||||||
|
+
|
||||||
|
+#define ipv4_info ip_families[IPv4_INDEX]
|
||||||
|
+#define ipv6_info ip_families[IPv6_INDEX]
|
||||||
|
|
||||||
|
extern const struct ip_info *aftoinfo(int af);
|
||||||
|
|
||||||
|
diff --git a/lib/libswan/ip_info.c b/lib/libswan/ip_info.c
|
||||||
|
index 70cd6a368f..97296d3a11 100644
|
||||||
|
--- a/lib/libswan/ip_info.c
|
||||||
|
+++ b/lib/libswan/ip_info.c
|
||||||
|
@@ -158,7 +158,9 @@ static ip_port port_from_ipv6_sockaddr(const ip_sockaddr sa)
|
||||||
|
|
||||||
|
#define IPv4_FF { { 255, 255, 255, 255, }, }
|
||||||
|
|
||||||
|
-const struct ip_info ipv4_info = {
|
||||||
|
+const struct ip_info ip_families[IP_INDEX_ROOF] = {
|
||||||
|
+
|
||||||
|
+ [IPv4_INDEX] = {
|
||||||
|
|
||||||
|
.ip_version = IPv4,
|
||||||
|
.ip_size = sizeof(struct in_addr),
|
||||||
|
@@ -210,11 +212,11 @@ const struct ip_info ipv4_info = {
|
||||||
|
.id_ip_addr = ID_IPV4_ADDR,
|
||||||
|
.id_ip_addr_subnet = ID_IPV4_ADDR_SUBNET,
|
||||||
|
.id_ip_addr_range = ID_IPV4_ADDR_RANGE,
|
||||||
|
-};
|
||||||
|
+ },
|
||||||
|
|
||||||
|
#define IPv6_FF { { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, }, }
|
||||||
|
|
||||||
|
-const struct ip_info ipv6_info = {
|
||||||
|
+ [IPv6_INDEX] = {
|
||||||
|
|
||||||
|
.ip_version = IPv6,
|
||||||
|
.ip_size = sizeof(struct in6_addr),
|
||||||
|
@@ -266,6 +268,7 @@ const struct ip_info ipv6_info = {
|
||||||
|
.id_ip_addr = ID_IPV6_ADDR,
|
||||||
|
.id_ip_addr_subnet = ID_IPV6_ADDR_SUBNET,
|
||||||
|
.id_ip_addr_range = ID_IPV6_ADDR_RANGE,
|
||||||
|
+ }
|
||||||
|
};
|
||||||
|
|
||||||
|
const struct ip_info *aftoinfo(int af)
|
||||||
|
--
|
||||||
|
2.44.0
|
||||||
|
|
||||||
@ -31,7 +31,7 @@ Name: libreswan
|
|||||||
Summary: Internet Key Exchange (IKEv1 and IKEv2) implementation for IPsec
|
Summary: Internet Key Exchange (IKEv1 and IKEv2) implementation for IPsec
|
||||||
# version is generated in the release script
|
# version is generated in the release script
|
||||||
Version: 4.12
|
Version: 4.12
|
||||||
Release: %{?prever:0.}1%{?prever:.%{prever}}%{?dist}
|
Release: %{?prever:0.}3%{?prever:.%{prever}}%{?dist}
|
||||||
License: GPLv2
|
License: GPLv2
|
||||||
Url: https://libreswan.org/
|
Url: https://libreswan.org/
|
||||||
Source0: https://download.libreswan.org/%{?prever:development/}%{name}-%{version}%{?prever}.tar.gz
|
Source0: https://download.libreswan.org/%{?prever:development/}%{name}-%{version}%{?prever}.tar.gz
|
||||||
@ -41,6 +41,9 @@ Source2: https://download.libreswan.org/cavs/ikev1_psk.fax.bz2
|
|||||||
Source3: https://download.libreswan.org/cavs/ikev2.fax.bz2
|
Source3: https://download.libreswan.org/cavs/ikev2.fax.bz2
|
||||||
%endif
|
%endif
|
||||||
Patch: libreswan-4.6-ikev1-policy-defaults-to-drop.patch
|
Patch: libreswan-4.6-ikev1-policy-defaults-to-drop.patch
|
||||||
|
Patch: libreswan-4.12-ikev2-auth-delete-state.patch
|
||||||
|
Patch: libreswan-4.12-ipv6-san.patch
|
||||||
|
Patch: libreswan-4.12-ikev1-compute-keymat-default.patch
|
||||||
|
|
||||||
BuildRequires: audit-libs-devel
|
BuildRequires: audit-libs-devel
|
||||||
BuildRequires: bison
|
BuildRequires: bison
|
||||||
@ -196,6 +199,13 @@ certutil -N -d sql:$tmpdir --empty-password
|
|||||||
%doc %{_mandir}/*/*
|
%doc %{_mandir}/*/*
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Wed Jun 5 2024 Daiki Ueno <dueno@redhat.com> - 4.12-3
|
||||||
|
- Fix CVE-2024-3652 (RHEL-32483)
|
||||||
|
|
||||||
|
* Thu Apr 11 2024 Daiki Ueno <dueno@redhat.com> - 4.12-2
|
||||||
|
- Fix CVE-2024-2357 (RHEL-28743)
|
||||||
|
- x509: unpack IPv6 general names based on length (RHEL-32720)
|
||||||
|
|
||||||
* Wed Aug 9 2023 Daiki Ueno <dueno@redhat.com> - 4.12-1
|
* Wed Aug 9 2023 Daiki Ueno <dueno@redhat.com> - 4.12-1
|
||||||
- Update to 4.12 to fix CVE-2023-38710, CVE-2023-38711, CVE-2023-38712
|
- Update to 4.12 to fix CVE-2023-38710, CVE-2023-38711, CVE-2023-38712
|
||||||
- Resolves: rhbz#2215956
|
- Resolves: rhbz#2215956
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user