27 changed files with 2721 additions and 997 deletions
--- a/.fmf/version
+++ b/.fmf/version
@ -0,0 +1 @@
+1
--- a/.gitignore
+++ b/.gitignore
@ -1,4 +1,66 @@
-SOURCES/ikev1_dsa.fax.bz2
-SOURCES/ikev1_psk.fax.bz2
-SOURCES/ikev2.fax.bz2
-SOURCES/libreswan-4.12.tar.gz
+/libreswan-3.2.tar.gz
+/libreswan-3.3.tar.gz
+/libreswan-3.4.tar.gz
+/libreswan-3.5.tar.gz
+/libreswan-3.6.tar.gz
+/libreswan-3.7.tar.gz
+/libreswan-3.8.tar.gz
+/libreswan-3.9.tar.gz
+/libreswan-3.10.tar.gz
+/libreswan-3.11.tar.gz
+/libreswan-3.12.tar.gz
+/libreswan-3.13.tar.gz
+/libreswan-3.14.tar.gz
+/ikev1_dsa.fax.bz2
+/ikev1_psk.fax.bz2
+/ikev2.fax.bz2
+/libreswan-3.15.tar.gz
+/libreswan-3.16.tar.gz
+/libreswan-3.17.tar.gz
+/libreswan-3.18.tar.gz
+/libreswan-3.19.tar.gz
+/libreswan-3.20dr4.tar.gz
+/libreswan-3.20.tar.gz
+/libreswan-3.21.tar.gz
+/libreswan-3.22.tar.gz
+/libreswan-3.23.tar.gz
+/libreswan-3.24.tar.gz
+/libreswan-3.25.tar.gz
+/libreswan-3.26.tar.gz
+/libreswan-3.27.tar.gz
+/libreswan-3.28.tar.gz
+/libreswan-3.29.tar.gz
+/libreswan-3.30.tar.gz
+/libreswan-3.31.tar.gz
+/libreswan-3.32.tar.gz
+/libreswan-4.0rc1.tar.gz
+/libreswan-4.0.tar.gz
+/libreswan-4.1.tar.gz
+/libreswan-4.2rc1.tar.gz
+/libreswan-4.2.tar.gz
+/libreswan-4.3.tar.gz
+/libreswan-4.4.tar.gz
+/libreswan-4.5.tar.gz
+/libreswan-4.6.tar.gz
+/libreswan-4.6.tar.gz.asc
+/LIBRESWAN-GPG-KEY.txt
+/libreswan-4.7.tar.gz
+/libreswan-4.7.tar.gz.asc
+/libreswan-4.8.tar.gz
+/libreswan-4.8.tar.gz.asc
+/libreswan-4.9.tar.gz
+/libreswan-4.9.tar.gz.asc
+/libreswan-4.10.tar.gz.asc
+/libreswan-4.10.tar.gz
+/libreswan-4.11.tar.gz
+/libreswan-4.11.tar.gz.asc
+/libreswan-4.12.tar.gz
+/libreswan-4.12.tar.gz.asc
+/libreswan-4.13.tar.gz
+/libreswan-4.13.tar.gz.asc
+/libreswan-4.14.tar.gz
+/libreswan-4.14.tar.gz.asc
+/libreswan-4.15.tar.gz
+/libreswan-4.15.tar.gz.asc
+/libreswan-5.1.tar.gz
+/libreswan-5.1.tar.gz.asc
--- a/.libreswan.metadata
+++ b/.libreswan.metadata
@ -1,4 +0,0 @@
-b35cd50b8bc0a08b9c07713bf19c72d53bfe66bb SOURCES/ikev1_dsa.fax.bz2
-861d97bf488f9e296cad8c43ab72f111a5b1a848 SOURCES/ikev1_psk.fax.bz2
-fcaf77f3deae3d8e99cdb3b1f8abea63167a0633 SOURCES/ikev2.fax.bz2
-786c14a4755311ea3103683a3294e1536b1e44a6 SOURCES/libreswan-4.12.tar.gz
--- a/LIBRESWAN-OpenPGP-KEY.txt
+++ b/LIBRESWAN-OpenPGP-KEY.txt
@ -0,0 +1,51 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBFDjilcBEAChkfasfBKTzGys9DwgBsmDVsPConW60uyKnu16+wO1kIKMFWi6
+wGllwKUJmCBY2FSQHbOBy5eHPPT1ijJhYt4j7WU+YJVh5Ca5RE3trFt31FX0vzp+
+KMqdQ8HOofA7jO6bgyHUwOJ539YkqYj1jHKfrdRqOnzB9fFyEb7485sq1F8j/rHk
+cSar1Hd9QfGAZHxXqgncgHFobB/xXEGRJIi+4kNL5SYasbw9tfYUGPrUXVol1+pn
+tsG92736O5Qe5K+wH2nAS4hwPJ1Xr4XIKeNNwxQW25wWqn4mLa4Vly+PA2uSE7ZP
+RcxE3yBCaLFMlw4rLhFAzd6TeslQONZ+9K51yfBYm7m0vWM3Ixq8yuD8E49OkKr8
+QRMaA2g89NW3AuNLExiTE0zQzAs/g6eX8WZdeWCvKxhRTAUYkw0QTimFgv6LXIeS
+//5DOAAO9WwzlseTGmUgek3BbnnJJiGHVLBgnLaqWLOZ1Y8ON1uC8lQnbIeYbTQq
+EE5R0cbVLVXBJoKakBF8gwHF51HC2pSBYmHNZsSbjMuHpJWJM4fVldNWPNaqriKC
+OkL8QgvNoapgk20k1ajLl/ibv32k7QBKy3cTMtbQYPdreXcoZuMw38ysQcgFxPCs
+Zh92aaWW0ceWowkJ7CFnes2jdPcMSOYE37wodmV3/VV7cusmTD8wikyUdQARAQAB
+tCxMaWJyZXN3YW4gKFNpZ25pbmcgS2V5KSA8dGVhbUBsaWJyZXN3YW4ub3JnPokC
+TgQTAQoAOBYhBJB+eQ8lwejlYc1ztYX/S0OzD8b5BQJi4cg4AhsDBQsJCAcDBRUK
+CQgLBRYCAwEAAh4FAheAAAoJEIX/S0OzD8b5zNcP/RuDb05Xr+IpuGWtJ38yGMWG
+mZglLHrzCAOXNAr/QXt6Kz3sThJoZFIh2E4Ab5yW59iFLFpW3VuZIGVCyh7vsuVw
+MuKoJtrZtdbHSdLbE+FHpY7osQDrcuodTv5b7STfG2Wje18iG/dCATVIDDgbPmuJ
+FpNLcR3scuoIlgxmP3Y1AFgufLR5MiN60PKnS2Husyj0f5Gqc3USLofWKgEQ4wFa
+gT1iIjkf4zkFcVlJ5K0SE1ULn8K7umkOUvLcKg6ji+1sEwEM1kCNmxI8HkiNt296
+9Z/TLK1h8McFGwG7x1p8fZ7Kjmzwnv1TSxAt1wHMoa0m9LntQOXnn3hVJaC74AzX
+heFtqDHmATpcGtQLR0zutrZ+ohUb6AEt+hAPfyDDYIR5y3oNdSLozJkJ1wlrhsYh
+SR1Hv4b3fdD6XgyUPggituOYm+yv1PuHrSEaoznnlX2z0MaVJyJIN0zUHlPBmWKC
+LmzQX2A7l9bHhkXYgHoSdeBHdwvcQQGWwkVmN2WUwsM/m9Abk8OdLdE13nI8824R
+0+b6XzJ2g4L+RIsVseerX2WIMHSMvkbFuLpEE4ILOrL+9Lq5bdx9MvZPtsZ/ZutY
+QVVvJ+nJtmPp0HpybnJdXzB7Za02A0r2gXIUrund32K97qe8XblCwxkZbZCeLcSL
+5+mb8O1XPGD39S6CCZbRuQINBFDjilcBEADXDN9o3icyDy+ity45CsQfo1f84xL6
+oJIgCLGGwm3RFPgOzdgxaE7TiLzW2NBui+yHyw48WRTxZ9XC6HtGKjH6XPvP5nF4
+8wss7tjzRNzmNgTp7G47HkW3lD0VYX4NqfCmxQK9gTXob1+JFmWkEXkXmZYg2dbn
+1REtHb03x370Z547rjvdpopQW6jaSw0C556DOxb9weJqLqAd2uZO4nwhuDs/VM+Q
+yy+/MlHTbnsmnYIMozDLMmHZ1PMeJlTFPMfapaux9UDTgQ5dwLj2FiQ/uEMzvfVv
+W23hxlpWVHsccwZR77PMDt4Nbj/7QlOIKpgid2r8SyBmhjET2u/USSzFYzK8J2Wj
+oLcxiuMTwrnM6b3bqiuSDUMAEoNN814Cbpz6yLB2wyKs5N7ZA/lVLNE8MV7to8OD
+ww1nS2bDDf5/JMNt5aWu/iO2bBrYE30LqHR3bSV6QP57JnzunM9Y4V1BnEKYW14A
+9+rRH1k1e5CuS5tqxpSubniF80AdUyPjF8rXOY0URD6zY0s4843Nf9TNr8ke/1ma
+qLEkUAF03AwBR8oz247ylu75q94ytpYUFJAkNeqpk8XypqKJMVcl4NfEP930JR82
+sGjNylVu/b4EsqKfmkoU8VFM1lfuaqX1u2ZDoUpG2Io/zpeV07RQ0KTHdKBejzix
+2IN0T7W4G0JXcwARAQABiQIfBBgBAgAJBQJQ44pXAhsMAAoJEIX/S0OzD8b5KR8P
+/jdWNVVw74/oCPtt79V1r0XN4I0ZBTQZgKp3JmZdcZlS2Uzx4u1VhxcevDQ7fh/Z
+5Y1xDBh+IKwF83hJKXy56+PJBlYIGjc2GTEmU1yo4E9iudPq56FFb6eelX1qBfxI
+0ZHdWgzWmrtnCF65zGTmeYMpck4ZuKdJAX2AM6kWcBikt4jT/SqrcS8t/duWRSSV
+iikwXD8aPexAz9XuezI+y3Exupt/lqUyVtCV3t0/gWRAMuwrMH/RABEPTaQdmxKz
+i0OkMDlHhweXZWg0/t32XLhhmy4f/30NhKYnntN6/pdNDb8vin5OP2MRyJDHIykA
+2HZcYvjdZS43+PbiuqDCTILMvxUDYjxHszgEheLariRvmRwE1HRjZWNTzGTjUgyv
+83XUhrIoAlgMVy2tQAatKbNVYAn5dmA0NCDKnSszas43gApSSjh2UXmq/owwpVj6
+zYHcoV0gdCuLJ1BPLstN0ZGO+g+eRpTI97+/04sgz/hImDsm7G3Diners/FDaebt
+pMRzVshh5lIgVBnCT36hdHW8buyiAgRQtjq7bX8JLN4Ermxlq4a33OYc7TGNC3jF
+Rm4XSY6RUDMd6uhRD5hKZB2N8az079603K7nc93x32CualHCJD+M7Z2/j9r3T3Tc
+y69oM+pgP48wySo+XEGHCM5OG7YNNiJ8xQ/J+CKCyLQV
+=ZaKB
+-----END PGP PUBLIC KEY BLOCK-----
--- a/SOURCES/libreswan-3.32-1861360-nodefault-rsa-pss.patch
+++ b/SOURCES/libreswan-3.32-1861360-nodefault-rsa-pss.patch
@ -1,31 +0,0 @@
-From 1dddaa3226fe1b71b68ec9665d93864a5ec69801 Mon Sep 17 00:00:00 2001
-From: rpm-build <rpm-build>
-Date: Mon, 9 Jan 2023 23:26:10 +0900
-Subject: [PATCH] libreswan-3.32-1861360-nodefault-rsa-pss.patch
-
---
- lib/libipsecconf/confread.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/lib/libipsecconf/confread.c b/lib/libipsecconf/confread.c
-index 0444118..ec87646 100644
--- a/lib/libipsecconf/confread.c
-+++ b/lib/libipsecconf/confread.c
-@@ -1501,9 +1501,14 @@ static bool load_conn(struct starter_conn *conn,
- 				   hunk_streq(val, "rsa")) {
- 				conn->authby.rsasig = true;
- 				conn->authby.rsasig_v1_5 = true;
-+				/*
-+				 * These cause failure with RSA 1024 bits because it uses RSA-PSS
-+				 */
-+#if 0
- 				conn->sighash_policy |= POL_SIGHASH_SHA2_256;
- 				conn->sighash_policy |= POL_SIGHASH_SHA2_384;
- 				conn->sighash_policy |= POL_SIGHASH_SHA2_512;
-+#endif
- 			} else if (hunk_streq(val, "never")) {
- 				conn->authby.never = true;
- 			/* everything else is only supported for IKEv2 */
-- 
-2.39.0
-
--- a/SOURCES/libreswan-4.1-maintain-obsolete-keywords.patch
+++ b/SOURCES/libreswan-4.1-maintain-obsolete-keywords.patch
@ -1,136 +0,0 @@
-From a2cc5f8c80e8cb9be0b65f8e8544689e8b093c09 Mon Sep 17 00:00:00 2001
-From: rpm-build <rpm-build>
-Date: Tue, 10 Jan 2023 00:18:48 +0900
-Subject: [PATCH] libreswan-4.1-maintain-obsolete-keywords.patch
-
---
- lib/libipsecconf/keywords.c | 28 ++++++++++++++++++++++++++++
- 1 file changed, 28 insertions(+)
-
-diff --git a/lib/libipsecconf/keywords.c b/lib/libipsecconf/keywords.c
-index fa8f0e0..03fb863 100644
--- a/lib/libipsecconf/keywords.c
-+++ b/lib/libipsecconf/keywords.c
-@@ -343,6 +343,8 @@ const struct keyword_def ipsec_conf_keywords[] = {
-   { "ikev1-policy",  kv_config,  kt_enum,  KBF_GLOBAL_IKEv1,  kw_global_ikev1_list, NULL, },
-   { "curl-iface",  kv_config,  kt_string,  KSF_CURLIFACE, NULL, NULL, },
-   { "curl-timeout",  kv_config,  kt_time,  KBF_CURLTIMEOUT_MS, NULL, NULL, },
-+  { "curl_iface",  kv_config | kv_alias,  kt_string,  KSF_CURLIFACE, NULL, NULL, },  /* obsolete _ */
-+  { "curl_timeout",  kv_config | kv_alias,  kt_time,  KBF_CURLTIMEOUT_MS, NULL, NULL, },  /* obsolete _ */
- 
-   { "myvendorid",  kv_config,  kt_string,  KSF_MYVENDORID, NULL, NULL, },
-   { "syslog",  kv_config,  kt_string,  KSF_SYSLOG, NULL, NULL, },
-@@ -350,6 +352,7 @@ const struct keyword_def ipsec_conf_keywords[] = {
-   { "logfile",  kv_config,  kt_filename,  KSF_LOGFILE, NULL, NULL, },
-   { "plutostderrlog",  kv_config,  kt_filename,  KSF_LOGFILE, NULL, NULL, }, /* obsolete name, but very common :/ */
-   { "logtime",  kv_config,  kt_bool,  KBF_LOGTIME, NULL, NULL, },
-+  { "plutostderrlogtime",  kv_config | kv_alias,  kt_bool,  KBF_LOGTIME, NULL, NULL, },  /* obsolete */
-   { "logappend",  kv_config,  kt_bool,  KBF_LOGAPPEND, NULL, NULL, },
-   { "logip",  kv_config,  kt_bool,  KBF_LOGIP, NULL, NULL, },
-   { "audit-log",  kv_config,  kt_bool,  KBF_AUDIT_LOG, NULL, NULL, },
-@@ -369,13 +372,20 @@ const struct keyword_def ipsec_conf_keywords[] = {
-   { "global-redirect-to", kv_config, kt_string, KSF_GLOBAL_REDIRECT_TO, NULL, NULL, },
- 
-   { "crl-strict",  kv_config,  kt_bool,  KBF_CRL_STRICT, NULL, NULL, },
-+  { "crl_strict",  kv_config | kv_alias,  kt_bool,  KBF_CRL_STRICT, NULL, NULL, },  /* obsolete _ */
-   { "crlcheckinterval",  kv_config,  kt_time,  KBF_CRL_CHECKINTERVAL_MS, NULL, NULL, },
-+  { "strictcrlpolicy",  kv_config | kv_alias,  kt_bool,  KBF_CRL_STRICT, NULL, NULL, },  /* obsolete; used on openswan */
- 
-   { "ocsp-strict",  kv_config,  kt_bool,  KBF_OCSP_STRICT, NULL, NULL, },
-+  { "ocsp_strict",  kv_config | kv_alias,  kt_bool,  KBF_OCSP_STRICT, NULL, NULL, },  /* obsolete _ */
-   { "ocsp-enable",  kv_config,  kt_bool,  KBF_OCSP_ENABLE, NULL, NULL, },
-+  { "ocsp_enable",  kv_config | kv_alias,  kt_bool,  KBF_OCSP_ENABLE, NULL, NULL, },  /* obsolete _ */
-   { "ocsp-uri",  kv_config,  kt_string,  KSF_OCSP_URI, NULL, NULL, },
-+  { "ocsp_uri",  kv_config | kv_alias,  kt_string,  KSF_OCSP_URI, NULL, NULL, },  /* obsolete _ */
-   { "ocsp-timeout",  kv_config,  kt_number,  KBF_OCSP_TIMEOUT, NULL, NULL, },
-+  { "ocsp_timeout",  kv_config | kv_alias,  kt_number,  KBF_OCSP_TIMEOUT, NULL, NULL, },  /* obsolete _ */
-   { "ocsp-trustname",  kv_config,  kt_string,  KSF_OCSP_TRUSTNAME, NULL, NULL, },
-+  { "ocsp_trust_name",  kv_config | kv_alias,  kt_string,  KSF_OCSP_TRUSTNAME, NULL, NULL, },  /* obsolete _ */
-   { "ocsp-cache-size",  kv_config,  kt_number,  KBF_OCSP_CACHE_SIZE, NULL, NULL, },
-   { "ocsp-cache-min-age",  kv_config,  kt_time,  KBF_OCSP_CACHE_MIN_AGE_MS, NULL, NULL, },
-   { "ocsp-cache-max-age",  kv_config,  kt_time,  KBF_OCSP_CACHE_MAX_AGE_MS, NULL, NULL, },
-@@ -399,6 +409,7 @@ const struct keyword_def ipsec_conf_keywords[] = {
-   { "virtual_private",  kv_config,  kt_string,  KSF_VIRTUALPRIVATE, NULL, NULL, }, /* obsolete variant, very common */
-   { "seedbits",  kv_config,  kt_number,  KBF_SEEDBITS, NULL, NULL, },
-   { "keep-alive",  kv_config,  kt_number,  KBF_KEEPALIVE, NULL, NULL, },
-+  { "keep_alive",  kv_config | kv_alias,  kt_number,  KBF_KEEPALIVE, NULL, NULL, },  /* obsolete _ */
- 
-   { "listen-tcp", kv_config, kt_bool, KBF_LISTEN_TCP, NULL, NULL },
-   { "listen-udp", kv_config, kt_bool, KBF_LISTEN_UDP, NULL, NULL },
-@@ -410,6 +421,8 @@ const struct keyword_def ipsec_conf_keywords[] = {
- #ifdef HAVE_LABELED_IPSEC
-   { "ikev1-secctx-attr-type",  kv_config,  kt_number,  KBF_SECCTX, NULL, NULL, },  /* obsolete: not a value, a type */
-   { "secctx-attr-type",  kv_config | kv_alias,  kt_number,  KBF_SECCTX, NULL, NULL, },
-+  { "secctx_attr_value",  kv_config | kv_alias,  kt_number,  KBF_SECCTX, NULL, NULL, },  /* obsolete _ */
-+  { "secctx-attr-value",  kv_config,  kt_number,  KBF_SECCTX, NULL, NULL, },  /* obsolete: not a value, a type */
- #endif
-   { "interfaces",  kv_config, kt_obsolete, KNCF_WARNIGNORE, NULL, NULL, }, /* obsoleted but often present keyword */
- 
-@@ -446,6 +459,7 @@ const struct keyword_def ipsec_conf_keywords[] = {
-   { "username",  kv_conn | kv_leftright,  kt_string,  KSCF_USERNAME, NULL, NULL, },
-   /* xauthusername is still used in NetworkManager-libreswan :/ */
-   { "xauthusername",  kv_conn | kv_leftright,  kt_string,  KSCF_USERNAME, NULL, NULL, }, /* old alias */
-+  { "xauthname",  kv_conn | kv_leftright,  kt_string,  KSCF_USERNAME, NULL, NULL, }, /* old alias */
-   { "addresspool",  kv_conn | kv_leftright,  kt_range,  KSCF_ADDRESSPOOL, NULL, NULL, },
-   { "auth",  kv_conn | kv_leftright, kt_enum,  KNCF_AUTH,  kw_auth_list, NULL, },
- #ifdef HAVE_IPTABLES
-@@ -471,6 +485,8 @@ const struct keyword_def ipsec_conf_keywords[] = {
-   { "esn",  kv_conn | kv_processed,  kt_enum,  KNCF_ESN,  kw_esn_list, NULL, },
-   { "decap-dscp",  kv_conn | kv_processed,  kt_bool,  KNCF_DECAP_DSCP,  NULL, NULL, },
-   { "nopmtudisc",  kv_conn | kv_processed,  kt_bool,  KNCF_NOPMTUDISC,  NULL, NULL, },
-+  { "ike_frag",  kv_conn | kv_processed | kv_alias,  kt_enum,  KNCF_IKE_FRAG,  kw_ynf_list, NULL, },  /* obsolete _ */
-+  { "ike-frag",  kv_conn | kv_processed | kv_alias,  kt_enum,  KNCF_IKE_FRAG,  kw_ynf_list, NULL, },  /* obsolete name */
-   { "fragmentation",  kv_conn | kv_processed,  kt_enum,  KNCF_IKE_FRAG,  kw_ynf_list, NULL, },
-   { "mobike",  kv_conn,  kt_bool,  KNCF_MOBIKE, NULL, NULL, },
-   { "narrowing",  kv_conn,  kt_bool,  KNCF_IKEv2_ALLOW_NARROWING, NULL, NULL, },
-@@ -481,13 +497,18 @@ const struct keyword_def ipsec_conf_keywords[] = {
-   { "accept-redirect-to",  kv_conn,  kt_string, KSCF_ACCEPT_REDIRECT_TO, NULL, NULL, },
-   { "pfs",  kv_conn,  kt_bool,  KNCF_PFS, NULL, NULL, },
- 
-+  { "nat_keepalive",  kv_conn | kv_alias,  kt_bool,  KNCF_NAT_KEEPALIVE, NULL, NULL, },  /* obsolete _ */
-   { "nat-keepalive",  kv_conn,  kt_bool,  KNCF_NAT_KEEPALIVE, NULL, NULL, },
- 
-+  { "initial_contact",  kv_conn | kv_alias,  kt_bool,  KNCF_INITIAL_CONTACT, NULL, NULL, },  /* obsolete _ */
-   { "initial-contact",  kv_conn,  kt_bool,  KNCF_INITIAL_CONTACT, NULL, NULL, },
-+  { "cisco_unity",  kv_conn | kv_alias,  kt_bool,  KNCF_CISCO_UNITY, NULL, NULL, },  /* obsolete _ */
-   { "cisco-unity",  kv_conn,  kt_bool,  KNCF_CISCO_UNITY, NULL, NULL, },
-   { "send-no-esp-tfc",  kv_conn,  kt_bool,  KNCF_NO_ESP_TFC, NULL, NULL, },
-   { "fake-strongswan",  kv_conn,  kt_bool,  KNCF_VID_STRONGSWAN, NULL, NULL, },
-+  { "send_vendorid",  kv_conn | kv_alias,  kt_bool,  KNCF_SEND_VENDORID, NULL, NULL, },  /* obsolete _ */
-   { "send-vendorid",  kv_conn,  kt_bool,  KNCF_SEND_VENDORID, NULL, NULL, },
-+  { "sha2_truncbug",  kv_conn | kv_alias,  kt_bool,  KNCF_SHA2_TRUNCBUG, NULL, NULL, },  /* obsolete _ */
-   { "sha2-truncbug",  kv_conn,  kt_bool,  KNCF_SHA2_TRUNCBUG, NULL, NULL, },
-   { "ms-dh-downgrade",  kv_conn,  kt_bool,  KNCF_MSDH_DOWNGRADE, NULL, NULL, },
-   { "require-id-on-certificate",  kv_conn,  kt_bool,  KNCF_SAN_ON_CERT, NULL, NULL, },
-@@ -505,7 +526,10 @@ const struct keyword_def ipsec_conf_keywords[] = {
-   {"ikepad",  kv_conn,  kt_bool,  KNCF_IKEPAD, NULL, NULL, },
-   { "nat-ikev1-method",  kv_conn | kv_processed,  kt_enum,  KNCF_IKEV1_NATT,  kw_ikev1natt_list, NULL, },
- 
-+  { "labeled_ipsec",  kv_conn, kt_obsolete, KNCF_WARNIGNORE, NULL, NULL, }, /* obsolete */
-+  { "labeled-ipsec",  kv_conn, kt_obsolete, KNCF_WARNIGNORE, NULL, NULL, }, /* obsolete */
-   { "policy-label",  kv_conn,  kt_string,  KSCF_SA_SEC_LABEL, NULL, NULL, }, /* obsolete variant */
-+  { "policy_label",  kv_conn,  kt_string,  KSCF_SA_SEC_LABEL, NULL, NULL, }, /* obsolete variant */
-   { "sec-label",  kv_conn,  kt_string,  KSCF_SA_SEC_LABEL, NULL, NULL, }, /* really stored into struct end */
- 
-   /* Cisco interop: remote peer type */
-@@ -516,13 +540,17 @@ const struct keyword_def ipsec_conf_keywords[] = {
-   /* Network Manager support */
- #ifdef HAVE_NM
-   { "nm-configured",  kv_conn,  kt_bool,  KNCF_NMCONFIGURED, NULL, NULL, },
-+  { "nm_configured",  kv_conn,  kt_bool,  KNCF_NMCONFIGURED, NULL, NULL, }, /* obsolete _ */
- #endif
- 
-   { "xauthby",  kv_conn,  kt_enum,  KNCF_XAUTHBY,  kw_xauthby_list, NULL, },
-   { "xauthfail",  kv_conn,  kt_enum,  KNCF_XAUTHFAIL,  kw_xauthfail_list, NULL, },
-   { "modecfgpull",  kv_conn,  kt_invertbool,  KNCF_MODECONFIGPULL, NULL, NULL, },
-   { "modecfgdns",  kv_conn,  kt_string,  KSCF_MODECFGDNS, NULL, NULL, },
-+  { "modecfgdns1",  kv_conn | kv_alias, kt_string, KSCF_MODECFGDNS, NULL, NULL, }, /* obsolete */
-+  { "modecfgdns2",  kv_conn, kt_obsolete, KNCF_WARNIGNORE, NULL, NULL, }, /* obsolete */
-   { "modecfgdomains",  kv_conn,  kt_string,  KSCF_MODECFGDOMAINS, NULL, NULL, },
-+  { "modecfgdomain",  kv_conn | kv_alias,  kt_string,  KSCF_MODECFGDOMAINS, NULL, NULL, }, /* obsolete */
-   { "modecfgbanner",  kv_conn,  kt_string,  KSCF_MODECFGBANNER, NULL, NULL, },
-   { "ignore-peer-dns",  kv_conn,  kt_bool,  KNCF_IGNORE_PEER_DNS, NULL, NULL, },
-   { "mark",  kv_conn,  kt_string,  KSCF_CONN_MARK_BOTH, NULL, NULL, },
-- 
-2.39.0
-
--- a/SOURCES/libreswan-4.12-ikev1-compute-keymat-default.patch
+++ b/SOURCES/libreswan-4.12-ikev1-compute-keymat-default.patch
@ -1,92 +0,0 @@
-From 5101913b1e623121a9222f11eefa18f0a2708b00 Mon Sep 17 00:00:00 2001
-From: Andrew Cagney <cagney@gnu.org>
-Date: Wed, 27 Mar 2024 10:43:19 -0400
-Subject: [PATCH] ikev1: in compute_proto_keymat() only allow explicitly
- handled ESP algorithms
-
---
- programs/pluto/ikev1_quick.c | 41 ++++++++++++++----------------------
- 1 file changed, 16 insertions(+), 25 deletions(-)
-
-diff --git a/programs/pluto/ikev1_quick.c b/programs/pluto/ikev1_quick.c
-index 81c522c148..22c346afb4 100644
--- a/programs/pluto/ikev1_quick.c
-+++ b/programs/pluto/ikev1_quick.c
-@@ -203,7 +203,7 @@ static bool emit_subnet_id(enum perspective perspective,
-  * RFC 2409 "IKE" section 5.5
-  * specifies how this is to be done.
-  */
-static void compute_proto_keymat(struct state *st,
-+static bool compute_proto_keymat(struct state *st,
- 				 uint8_t protoid,
- 				 struct ipsec_proto_info *pi,
- 				 const char *satypename)
-@@ -297,27 +297,13 @@ static void compute_proto_keymat(struct state *st,
- 			}
- 			break;
- 
-		case ESP_CAST:
-		case ESP_TWOFISH:
-		case ESP_SERPENT:
-		/* ESP_SEED is for IKEv1 only and not supported. Its number in IKEv2 has been re-used */
-			bad_case(pi->attrs.transattrs.ta_ikev1_encrypt);
-
- 		default:
-			/* bytes */
-			needed_len = encrypt_max_key_bit_length(pi->attrs.transattrs.ta_encrypt) / BITS_PER_BYTE;
-			if (needed_len > 0) {
-				/* XXX: check key_len coupling with kernel.c's */
-				if (pi->attrs.transattrs.enckeylen) {
-					needed_len =
-						pi->attrs.transattrs.enckeylen
-						/ BITS_PER_BYTE;
-					dbg("compute_proto_keymat: key_len=%d from peer",
-					    (int)needed_len);
-				}
-				break;
-			}
-			bad_case(pi->attrs.transattrs.ta_ikev1_encrypt);
-+		{
-+			enum_buf eb;
-+			llog(RC_LOG, st->st_logger, "rejecting request for keymat for %s",
-+			     str_enum(&esp_transformid_names, protoid, &eb));
-+			return false;
-+		}
- 		}
- 		dbg("compute_proto_keymat: needed_len (after ESP enc)=%d", (int)needed_len);
- 		needed_len += pi->attrs.transattrs.ta_integ->integ_keymat_size;
-@@ -359,14 +345,17 @@ static void compute_proto_keymat(struct state *st,
- 		DBG_dump_hunk("  inbound:", pi->inbound.keymat);
- 		DBG_dump_hunk("  outbound:", pi->outbound.keymat);
- 	}
-+
-+	return true;
- }
- 
-static void compute_keymats(struct state *st)
-+static bool compute_keymats(struct state *st)
- {
- 	if (st->st_ah.present)
-		compute_proto_keymat(st, PROTO_IPSEC_AH, &st->st_ah, "AH");
-+		return compute_proto_keymat(st, PROTO_IPSEC_AH, &st->st_ah, "AH");
- 	if (st->st_esp.present)
-		compute_proto_keymat(st, PROTO_IPSEC_ESP, &st->st_esp, "ESP");
-+		return compute_proto_keymat(st, PROTO_IPSEC_ESP, &st->st_esp, "ESP");
-+	return false;
- }
- 
- /*
-@@ -1460,7 +1449,9 @@ static stf_status quick_inI1_outR1_continue12_tail(struct state *st, struct msg_
- 	fixup_v1_HASH(st, &hash_fixup, st->st_v1_msgid.id, rbody.cur);
- 
- 	/* Derive new keying material */
-	compute_keymats(st);
-+	if (!compute_keymats(st)) {
-+		return STF_FATAL;
-+	}
- 
- 	/* Tell the kernel to establish the new inbound SA
- 	 * (unless the commit bit is set -- which we don't support).
-- 
-2.45.0
-
--- a/SOURCES/libreswan-4.12-ikev2-auth-delete-state.patch
+++ b/SOURCES/libreswan-4.12-ikev2-auth-delete-state.patch
@ -1,54 +0,0 @@
-From 2ec448884a7467743699803f8a36ee28d237666c Mon Sep 17 00:00:00 2001
-From: Andrew Cagney <cagney@gnu.org>
-Date: Wed, 28 Feb 2024 08:29:53 -0500
-Subject: [PATCH] ikev2: return STF_FATAL when initiator fails to emit AUTH
- packet
-
---
- programs/pluto/ikev2_ike_auth.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/programs/pluto/ikev2_ike_auth.c b/programs/pluto/ikev2_ike_auth.c
-index 192eb1b3b6..a54a109699 100644
--- a/programs/pluto/ikev2_ike_auth.c
-+++ b/programs/pluto/ikev2_ike_auth.c
-@@ -1267,7 +1267,7 @@ static stf_status process_v2_IKE_AUTH_request_auth_signature_continue(struct ike
- 	/* now send AUTH payload */
- 
- 	if (!emit_local_v2AUTH(ike, auth_sig, &ike->sa.st_v2_id_payload.mac, response.pbs)) {
-		return STF_INTERNAL_ERROR;
-+		return STF_FATAL;
- 	}
- 	ike->sa.st_v2_ike_intermediate.used = false;
- 
-- 
-2.44.0
-
-From 16272f2475d25baab58fbed2af7c67cfb459137f Mon Sep 17 00:00:00 2001
-From: Andrew Cagney <cagney@gnu.org>
-Date: Thu, 29 Feb 2024 12:19:20 -0500
-Subject: [PATCH] ikev2: always return STF_FATAL if emitting AUTH fails
-
-Fix:
-  ikev2: return STF_FATAL when initiator fails to emit AUTH packet
-which really fixed the responder.
---
- programs/pluto/ikev2_ike_auth.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/programs/pluto/ikev2_ike_auth.c b/programs/pluto/ikev2_ike_auth.c
-index a54a109699..491053fb10 100644
--- a/programs/pluto/ikev2_ike_auth.c
-+++ b/programs/pluto/ikev2_ike_auth.c
-@@ -397,7 +397,7 @@ stf_status initiate_v2_IKE_AUTH_request_signature_continue(struct ike_sa *ike,
- 	/* send out the AUTH payload */
- 
- 	if (!emit_local_v2AUTH(ike, auth_sig, &ike->sa.st_v2_id_payload.mac, request.pbs)) {
-		return STF_INTERNAL_ERROR;
-+		return STF_FATAL;
- 	}
- 
- 	if (LIN(POLICY_MOBIKE, ike->sa.st_connection->policy)) {
-- 
-2.44.0
-
--- a/SOURCES/libreswan-4.3-1934186-config.patch
+++ b/SOURCES/libreswan-4.3-1934186-config.patch
@ -1,11 +0,0 @@
-diff -Naur libreswan-4.3-orig/configs/ipsec.conf.in libreswan-4.3/configs/ipsec.conf.in
--- libreswan-4.3-orig/configs/ipsec.conf.in	2021-03-04 14:29:50.591912834 -0500
-+++ libreswan-4.3/configs/ipsec.conf.in	2021-03-04 14:30:27.227389433 -0500
-@@ -32,6 +32,7 @@
- 	# listen-tcp=yes
- 	# To enable IKE and IPsec over TCP for VPN client, also specify
- 	# tcp-remote-port=4500 in the client's conn section.
-+	virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v4:100.64.0.0/10,%v6:fd00::/8,%v6:fe80::/10
- 
- # if it exists, include system wide crypto-policy defaults
- # include /etc/crypto-policies/back-ends/libreswan.config
--- a/SOURCES/libreswan-4.3-maintain-different-v1v2-split.patch
+++ b/SOURCES/libreswan-4.3-maintain-different-v1v2-split.patch
@ -1,85 +0,0 @@
-From 83487373fdd77437e51cfccd41532e270e279e05 Mon Sep 17 00:00:00 2001
-From: rpm-build <rpm-build>
-Date: Tue, 10 Jan 2023 00:11:26 +0900
-Subject: [PATCH] libreswan-4.3-maintain-different-v1v2-split.patch
-
---
- configs/d.ipsec.conf/ikev2.xml | 14 +++++++-------
- lib/libipsecconf/confread.c    |  8 +++++++-
- programs/whack/whack.c         |  4 ++--
- 3 files changed, 16 insertions(+), 10 deletions(-)
-
-diff --git a/configs/d.ipsec.conf/ikev2.xml b/configs/d.ipsec.conf/ikev2.xml
-index 3d03825..285db1b 100644
--- a/configs/d.ipsec.conf/ikev2.xml
-+++ b/configs/d.ipsec.conf/ikev2.xml
-@@ -2,14 +2,14 @@
-   <term><emphasis remap='B'>ikev2</emphasis></term>
-   <listitem>
- <para>Whether to use IKEv2 (RFC 7296) or IKEv1 (RFC 4301).
-Currently the accepted values are <emphasis remap='B'>yes</emphasis> (the default),
-signifying only IKEv2 is accepted, or <emphasis remap='B'>no</emphasis>,
-+Currently the accepted values are <emphasis remap='B'>insist</emphasis> (the default),
-+signifying only IKEv2 is accepted, or <emphasis remap='B'>no</emphasis> (or <emphasis remap='B'>never</emphasis>),
- signifying only IKEv1 is accepted. Previous versions allowed the keywords
-<emphasis remap='B'>propose</emphasis> or <emphasis remap='B'>permit</emphasis>
-that would allow either IKEv1 or IKEv2, but this is no longer supported. The
-permit option is interpreted as no and the propose option is interpreted as
-yes. Older versions also supported keyword
-<emphasis remap='B'>insist</emphasis> which is now interpreted as yes.
-+<emphasis remap='B'>propose</emphasis>, <emphasis remap='B'>yes</emphasis> or <emphasis remap='B'>permit</emphasis>
-+that would allow either IKEv1 or IKEv2, but this is no longer supported and both options
-+now cause the connection to fail to load. <emphasis remap='B'>WARNING:</emphasis> This behaviour differs from upstream
-+libreswan, which only accepts <emphasis remap='B'>yes</emphasis> or <emphasis remap='B'>no</emphasis> where yes means
-+the same as insist.
- </para>
-   </listitem>
-   </varlistentry>
-diff --git a/lib/libipsecconf/confread.c b/lib/libipsecconf/confread.c
-index b95c90a..e752441 100644
--- a/lib/libipsecconf/confread.c
-+++ b/lib/libipsecconf/confread.c
-@@ -1340,11 +1340,17 @@ static bool load_conn(struct starter_conn *conn,
- 
- 		switch (conn->options[KNCF_IKEv2]) {
- 		case fo_never:
-		case fo_permit:
- 			conn->ike_version = IKEv1;
- 			break;
- 
-+		case fo_permit:
-+			starter_error_append(perrl, "ikev2=permit is no longer accepted. Use ikev2=insist or ikev2=no|never");
-+			return true;
-+
- 		case fo_propose:
-+			starter_error_append(perrl, "ikev2=propose or ikev2=yes is no longer accepted. Use ikev2=insist or ikev2=no|never");
-+			return true;
-+
- 		case fo_insist:
- 			conn->ike_version = IKEv2;
- 			break;
-diff --git a/programs/whack/whack.c b/programs/whack/whack.c
-index b512b04..3de020e 100644
--- a/programs/whack/whack.c
-+++ b/programs/whack/whack.c
-@@ -815,7 +815,7 @@ static const struct option long_opts[] = {
- 	{ "ikev1-allow", no_argument, NULL, CD_IKEv1 + OO }, /* obsolete name */
- 	{ "ikev2", no_argument, NULL, CD_IKEv2 +OO },
- 	{ "ikev2-allow", no_argument, NULL, CD_IKEv2 +OO }, /* obsolete name */
-	{ "ikev2-propose", no_argument, NULL, CD_IKEv2 +OO }, /* obsolete, map onto allow */
-+	/* not in RHEL8 { "ikev2-propose", no_argument, NULL, CD_IKEv2 +OO }, */
- 
- 	PS("allow-narrowing", IKEV2_ALLOW_NARROWING),
- #ifdef AUTH_HAVE_PAM
-@@ -1802,7 +1802,7 @@ int main(int argc, char **argv)
- 			end_seen = LEMPTY;
- 			continue;
- 
-		/* --ikev1 --ikev2 --ikev2-propose */
-+		/* --ikev1 --ikev2  */
- 		case CD_IKEv1:
- 		case CD_IKEv2:
- 		{
-- 
-2.39.0
-
--- a/SOURCES/libreswan-4.9-2176248-authby-rsasig.patch
+++ b/SOURCES/libreswan-4.9-2176248-authby-rsasig.patch
@ -1,52 +0,0 @@
-From 000b230258dd272ab15b384c330c31f996d0ba18 Mon Sep 17 00:00:00 2001
-From: Daiki Ueno <dueno@redhat.com>
-Date: Fri, 14 Apr 2023 14:10:47 +0900
-Subject: [PATCH] Ignore system crypto-policies for SHA-1 for legacy
- authby=rsa-sha1
-
-Signed-off-by: Daiki Ueno <dueno@redhat.com>
---
- lib/libswan/pubkey_rsa.c | 24 ++++++++++++++++++++++++
- 1 file changed, 24 insertions(+)
-
-diff --git a/lib/libswan/pubkey_rsa.c b/lib/libswan/pubkey_rsa.c
-index 38b44ab61d..9a7c0bc6a8 100644
--- a/lib/libswan/pubkey_rsa.c
-+++ b/lib/libswan/pubkey_rsa.c
-@@ -501,9 +501,33 @@ static struct hash_signature RSA_sign_hash_pkcs1_1_5_rsa(const struct secret_stu
- 	 * used to generate the signature.
- 	 */
- 	SECItem signature_result = {0};
-+
-+	/* ignore system crypto-policies for the hash algorithm */
-+	PRUint32 saved_policy;
-+
-+	if (NSS_GetAlgorithmPolicy(hash_algo->nss.oid_tag, &saved_policy) != SECSuccess) {
-+		/* PR_GetError() returns the thread-local error */
-+		enum_buf tb;
-+		llog_nss_error(RC_LOG_SERIOUS, logger,
-+			       "NSS_SetAlgorithmPolicy(%s) function failed",
-+			       str_nss_oid(hash_algo->nss.oid_tag, &tb));
-+		return (struct hash_signature) { .len = 0, };
-+	}
-+
-+	if (!(saved_policy & NSS_USE_ALG_IN_SIGNATURE)) {
-+		(void)NSS_SetAlgorithmPolicy(hash_algo->nss.oid_tag,
-+					     NSS_USE_ALG_IN_SIGNATURE, 0);
-+	}
-+
- 	SECStatus s = SGN_Digest(pks->u.pubkey.private_key,
- 				 hash_algo->nss.oid_tag,
- 				 &signature_result, &digest);
-+
-+	if (!(saved_policy & NSS_USE_ALG_IN_SIGNATURE)) {
-+		(void)NSS_SetAlgorithmPolicy(hash_algo->nss.oid_tag,
-+					     saved_policy, ~saved_policy);
-+	}
-+
- 	if (s != SECSuccess) {
- 		/* PR_GetError() returns the thread-local error */
- 		enum_buf tb;
-- 
-2.40.0
-
--- a/SPECS/libreswan.spec
+++ b/SPECS/libreswan.spec
@ -1,528 +0,0 @@
-%global _hardened_build 1
-# These are rpm macros and are 0 or 1
-%global with_efence 0
-%global with_development 0
-%global with_cavstests 1
-# minimum version for support for rhbz#1651314
-# should prob update for nss with IKEv1 quick mode support
-%global nss_version 3.53.1
-%global unbound_version 1.6.6
-%global libreswan_config \\\
-    FINALLIBEXECDIR=%{_libexecdir}/ipsec \\\
-    FINALMANDIR=%{_mandir} \\\
-    FINALNSSDIR=%{_sysconfdir}/ipsec.d \\\
-    INITSYSTEM=systemd \\\
-    NSS_HAS_IPSEC_PROFILE=true \\\
-    NSS_REQ_AVA_COPY=false \\\
-    PREFIX=%{_prefix} \\\
-    PYTHON_BINARY=%{__python3} \\\
-    SHELL_BINARY=%{_bindir}/sh \\\
-    USE_DNSSEC=true \\\
-    USE_FIPSCHECK=false \\\
-    USE_LABELED_IPSEC=true \\\
-    USE_LDAP=true \\\
-    USE_LIBCAP_NG=true \\\
-    USE_LIBCURL=true \\\
-    USE_LINUX_AUDIT=true \\\
-    USE_NM=true \\\
-    USE_NSS_KDF=true \\\
-    USE_SECCOMP=true \\\
-    USE_AUTHPAM=true \\\
-    USE_DH2=true \\\
-%{nil}
-
-#global prever rc1
-
-Name: libreswan
-Summary: IPsec implementation with IKEv1 and IKEv2 keying protocols
-# version is generated in the release script
-Version: 4.12
-Release: %{?prever:0.}2%{?prever:.%{prever}}%{?dist}.4
-License: GPLv2
-Url: https://libreswan.org/
-
-Source0: https://download.libreswan.org/%{?prever:with_development/}%{name}-%{version}%{?prever}.tar.gz
-%if 0%{with_cavstests}
-Source1: https://download.libreswan.org/cavs/ikev1_dsa.fax.bz2
-Source2: https://download.libreswan.org/cavs/ikev1_psk.fax.bz2
-Source3: https://download.libreswan.org/cavs/ikev2.fax.bz2
-%endif
-
-Patch1: libreswan-4.3-maintain-different-v1v2-split.patch
-Patch2: libreswan-3.32-1861360-nodefault-rsa-pss.patch
-Patch3: libreswan-4.1-maintain-obsolete-keywords.patch
-Patch6: libreswan-4.3-1934186-config.patch
-Patch7: libreswan-4.9-2176248-authby-rsasig.patch
-Patch8: libreswan-4.12-ikev2-auth-delete-state.patch
-Patch9: libreswan-4.12-ikev1-compute-keymat-default.patch
-
-BuildRequires: audit-libs-devel
-BuildRequires: bison
-BuildRequires: curl-devel
-BuildRequires: flex
-BuildRequires: gcc make
-BuildRequires: ldns-devel
-BuildRequires: libcap-ng-devel
-BuildRequires: libevent-devel
-BuildRequires: libseccomp-devel
-BuildRequires: libselinux-devel
-BuildRequires: nspr-devel
-BuildRequires: nss-devel >= %{nss_version}
-BuildRequires: nss-tools
-BuildRequires: openldap-devel
-BuildRequires: pam-devel
-BuildRequires: pkgconfig
-BuildRequires: hostname
-BuildRequires: redhat-rpm-config
-BuildRequires: systemd-devel
-BuildRequires: unbound-devel >= %{unbound_version}
-BuildRequires: xmlto
-%if 0%{with_efence}
-BuildRequires: ElectricFence
-%endif
-Requires: iproute >= 2.6.8
-Requires: nss >= %{nss_version}
-Requires: nss-softokn
-Requires: nss-tools
-Requires: unbound-libs >= %{unbound_version}
-Requires(post): bash
-Requires(post): coreutils
-Requires(post): systemd
-Requires(preun): systemd
-Requires(postun): systemd
-
-%description
-Libreswan is a free implementation of IKE/IPsec for Linux.  IPsec is
-the Internet Protocol Security and uses strong cryptography to provide
-both authentication and encryption services.  These services allow you
-to build secure tunnels through untrusted networks.  Everything passing
-through the untrusted net is encrypted by the ipsec gateway machine and
-decrypted by the gateway at the other end of the tunnel.  The resulting
-tunnel is a virtual private network or VPN.
-
-This package contains the daemons and userland tools for setting up
-Libreswan.
-
-Libreswan also supports IKEv2 (RFC7296) and Secure Labeling
-
-Libreswan is based on Openswan-2.6.38 which in turn is based on FreeS/WAN-2.04
-
-%prep
-%setup -q -n libreswan-%{version}%{?prever}
-%patch1 -p1
-%patch2 -p1
-%patch3 -p1
-%patch6 -p1
-%patch7 -p1
-%patch8 -p1
-%patch9 -p1
-
-# linking to freebl is not needed
-sed -i "s/-lfreebl //" mk/config.mk
-
-# enable crypto-policies support
-sed -i "s:#[ ]*include \(.*\)\(/crypto-policies/back-ends/libreswan.config\)$:include \1\2:" configs/ipsec.conf.in
-
-%build
-make %{?_smp_mflags} \
-%if 0%{with_development}
-    OPTIMIZE_CFLAGS="%{?_hardened_cflags}" \
-%else
-    OPTIMIZE_CFLAGS="%{optflags}" \
-%endif
-%if 0%{with_efence}
-    USE_EFENCE=true \
-%endif
-    WERROR_CFLAGS="-Werror -Wno-missing-field-initializers" \
-    USERLINK="%{?__global_ldflags}" \
-    %{libreswan_config} \
-    programs
-FS=$(pwd)
-
-%install
-make \
-  DESTDIR=%{buildroot} \
-  %{libreswan_config} \
-  install
-FS=$(pwd)
-rm -rf %{buildroot}/usr/share/doc/libreswan
-rm -rf %{buildroot}%{_libexecdir}/ipsec/*check
-
-install -d -m 0755 %{buildroot}%{_rundir}/pluto
-install -d %{buildroot}%{_sbindir}
-
-install -d %{buildroot}%{_sysconfdir}/sysctl.d
-install -m 0644 packaging/fedora/libreswan-sysctl.conf \
-  %{buildroot}%{_sysconfdir}/sysctl.d/50-libreswan.conf
-
-echo "include %{_sysconfdir}/ipsec.d/*.secrets" \
-     > %{buildroot}%{_sysconfdir}/ipsec.secrets
-rm -fr %{buildroot}%{_sysconfdir}/rc.d/rc*
-
-%if 0%{with_cavstests}
-%check
-# There is an elaborate upstream testing infrastructure which we do not
-# run here - it takes hours and uses kvm
-# We only run the CAVS tests.
-cp %{SOURCE1} %{SOURCE2} %{SOURCE3} .
-bunzip2 *.fax.bz2
-
-: starting CAVS test for IKEv2
-%{buildroot}%{_libexecdir}/ipsec/cavp -v2 ikev2.fax | \
-    diff -u ikev2.fax - > /dev/null
-: starting CAVS test for IKEv1 RSASIG
-%{buildroot}%{_libexecdir}/ipsec/cavp -v1dsa ikev1_dsa.fax | \
-    diff -u ikev1_dsa.fax - > /dev/null
-: starting CAVS test for IKEv1 PSK
-%{buildroot}%{_libexecdir}/ipsec/cavp -v1psk ikev1_psk.fax | \
-    diff -u ikev1_psk.fax - > /dev/null
-: CAVS tests passed
-
-# Some of these tests will show ERROR for negative testing - it will exit on real errors
-%{buildroot}%{_libexecdir}/ipsec/algparse -tp || { echo prooposal test failed; exit 1; }
-%{buildroot}%{_libexecdir}/ipsec/algparse -ta || { echo algorithm test failed; exit 1; }
-: Algorithm parser tests passed
-
-# self test for pluto daemon - this also shows which algorithms it allows in FIPS mode
-tmpdir=$(mktemp -d /tmp/libreswan-XXXXX)
-certutil -N -d sql:$tmpdir --empty-password
-%{buildroot}%{_libexecdir}/ipsec/pluto --selftest --nssdir $tmpdir --rundir $tmpdir
-: pluto self-test passed - verify FIPS algorithms allowed is still compliant with NIST
-
-%endif
-
-%post
-%systemd_post ipsec.service
-
-%preun
-%systemd_preun ipsec.service
-
-%postun
-%systemd_postun_with_restart ipsec.service
-
-%files
-%doc CHANGES COPYING CREDITS README* LICENSE
-%doc docs/*.* docs/examples
-%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipsec.conf
-%attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ipsec.secrets
-%attr(0700,root,root) %dir %{_sysconfdir}/ipsec.d
-%attr(0700,root,root) %dir %{_sysconfdir}/ipsec.d/policies
-%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipsec.d/policies/*
-%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/sysctl.d/50-libreswan.conf
-%attr(0755,root,root) %dir %{_rundir}/pluto
-%attr(0644,root,root) %{_tmpfilesdir}/libreswan.conf
-%attr(0644,root,root) %{_unitdir}/ipsec.service
-%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/pam.d/pluto
-%config(noreplace) %{_sysconfdir}/logrotate.d/libreswan
-%{_sbindir}/ipsec
-%{_libexecdir}/ipsec
-%attr(0644,root,root) %doc %{_mandir}/*/*
-
-%changelog
-* Thu Jun  6 2024 Daiki Ueno <dueno@redhat.com> - 4.12-2.4
- Fix CVE-2024-3652 (RHEL-32482)
-
-* Wed Apr 17 2024 Daiki Ueno <dueno@redhat.com> - 4.12-2.3
- Bump release to ensure el8 package is greater than el8_* packages
-
-* Tue Apr 16 2024 Daiki Ueno <dueno@redhat.com> - 4.12-2.2
- Fix patch application in the previous change
-
-* Mon Apr 15 2024 Daiki Ueno <dueno@redhat.com> - 4.12-2.1
- Fix CVE-2024-2357 (RHEL-28742)
-
-* Fri Aug 25 2023 Daiki Ueno <dueno@redhat.com> - 4.12-2
- Resolves: rhbz#2234731 authby=rsasig fails in FIPS policy
-
-* Wed Aug  9 2023 Daiki Ueno <dueno@redhat.com> - 4.12-1
- Update to 4.12 to fix CVE-2023-38710, CVE-2023-38711, CVE-2023-38712
- Resolves: rhbz#2215955
-
-* Thu May 04 2023 Sahana Prasad <sahana@redhat.com> - 4.9-2
- Fix CVE-2023-30570 Malicious IKEv1 Aggressive Mode packets can crash libreswan
- Resolves: rhbz#2187179
-
-* Mon Jan  9 2023 Daiki Ueno <dueno@redhat.com> - 4.9-1
- Resolves: rhbz#2128672 Rebase libreswan to 4.9
- Remove libreswan-4.4-ikev1-disable-diagnostics.patch no longer necessary
-
-* Thu Jan 13 2022 Daiki Ueno <dueno@redhat.com> - 4.5-1
- Resolves: rhbz#2017352 Rebase libreswan to 4.5
- Resolves: rhbz#2036903 ikev1: disable diagnostics logging on receiving malformed packets
-
-* Wed May 26 2021 Daiki Ueno <dueno@redhat.com> - 4.4-1
- Resolves: rhbz#1958968 Rebase libreswan to 4.4
- Resolves: rhbz#1954423 Libreswan: TS_UNACCEPTABLE on multiple connections between the same peers
-
-* Thu Mar 04 2021 Paul Wouters <pwouters@redhat.com> - 4.3-3
- Resolves: rhbz#1933064 - IKEv2 support for Labeled IPsec
- Resolves: rhbz#1935150 RFE: Support IKE and ESP over TCP: RFC 8229
- Resolves: rhbz#1935339 virtual_private setting is missing in the default config
-
-* Sun Feb 21 2021 Paul Wouters <pwouters@redhat.com> - 4.3-1
- Resolves: rhbz#1025061 - IKEv2 support for Labeled IPsec [update]
-
-* Thu Feb 04 2021 Paul Wouters <pwouters@redhat.com> - 4.2-1
- Resolves: rhbz#1891128 [Rebase] rebase libreswan to 4.2
- Resolves: rhbz#1025061 - IKEv2 support for Labeled IPsec
-
-* Tue Oct 27 22:11:42 EDT 2020 Paul Wouters <pwouters@redhat.com> - 4.1-1
- Resolves: rhbz#1891128 [Rebase] rebase libreswan to 4.1
- Resolves: rhbz#1889836 libreswan: add 3.x compat patches for obsoleted/removed keywords of 4.0 and re-port ikev2= patch
-
-* Wed Jul 29 2020 Paul Wouters <pwouters@redhat.com> - 3.32-6
- Resolves: rhbz#1861360 authby=rsasig must not imply usage of rsa-pss
-
-* Wed Jul 22 2020 Paul Wouters <pwouters@redhat.com> - 3.32-5
- Resolves: rhbz#1820206 Rebase to libreswan 3.32 [rebuild for USE_NSS_PRF]
-
-* Wed Jul 01 2020 Paul Wouters <pwouters@redhat.com> - 3.32-4
- Resolves: rhbz#1544463 ipsec service does not work correctly when seccomp filtering is enabled
-
-* Wed Jun 17 2020 Paul Wouters <pwouters@redhat.com> - 3.32-3
- Resolves: rhbz#1842597 regression: libreswan does not send PLUTO_BYTES env variables to updown script
- Resolves: rhbz#1847766 subsequent xfrmi interfaces configured outside of libreswan are not recognised properly
- Resolves: rhbz#1840212 protect libreswan against unannounced nss ABI change
-
-* Thu Jun 11 2020 Paul Wouters <pwouters@redhat.com> - 3.32-2
- Resolves: rhbz#1820206 Rebase to libreswan 3.32 [addconn fix]
-
-* Thu Apr 30 2020 Paul Wouters <pwouters@redhat.com> - 3.32-1
- Resolves: rhbz#1820206 Rebase to libreswan 3.32
- Resolves: rhbz#1816265 Use NSS to check whether FIPS mode is enabled
- Resolves: rhbz#1826337 libreswan in FIPS mode rejects ECDSA keys based on faulty RSA key size check being applied
-
-* Tue Aug 13 2019 Paul Wouters <pwouters@redhat.com> - 3.29-6
- Resolves: rhbz#1714331 support NSS based IKE KDF's [require updated nss for rhbz 1738689, memleak fix]
-
-* Thu Aug 08 2019 Paul Wouters <pwouters@redhat.com> - 3.29-5
- Resolves: rhbz#1714331 support NSS based IKE KDF's so libreswan does not need FIPS certification
-
-* Thu Aug 01 2019 Paul Wouters <pwouters@redhat.com> - 3.29-4
- Resolves: rhbz#1699318 'ipsec show' has python3 invalid syntax
-
-* Thu Jul 04 2019 Paul Wouters <pwouters@redhat.com> - 3.29-3
- Resolves: rhbz#1725205 XFRM policy for OE/32 peer is deleted when shunts for previous half-open state expire
-
-* Thu Jun 27 2019 Paul Wouters <pwouters@redhat.com> - 3.29-2
- Resolves: rhbz#1723957 libreswan is missing linux audit calls for failed IKE SAs and failed IPsec SAs required for Common Criteria
-
-* Mon Jun 10 2019 Paul Wouters <pwouters@redhat.com> - 3.29-1
- Resolves: rhbz#1712555 libreswan rebase to 3.29
-
-* Tue May 28 2019 Paul Wouters <pwouters@redhat.com> - 3.28-2
- Resolves: rhbz#1713734: barf: shell syntax error in barf diagnostic tool
-
-* Tue May 21 2019 Paul Wouters <pwouters@redhat.com> - 3.28-1
- Resolves: rhbz#1712555 libreswan rebase to 3.28
- Resolves: rhbz#1683706 Libreswan shows incorrect error messages
- Resolves: rhbz#1706180 Remove last usage of old (unused) PF_KEY API
- Resolves: rhbz#1677045 Opportunistic IPsec instances of /32 groups or auto=start that receive delete won't restart
- Resolves: rhbz#1686990 IKEv1 traffic interruption when responder deletes SAs 60 seconds before EVENT_SA_REPLACE
- Resolves: rhbz#1608353 /usr/sbin/ipsec part of the libreswan packages still invokes commands that were deprecated a decade ago
- Resolves: rhbz#1699318 'ipsec show' has python3 invalid syntax
- Resolves: rhbz#1679394 libreswan using NSS IPsec profiles regresses when critical flags are set causing validation failure
-
-* Thu Feb 21 2019 Paul Wouters <pwouters@redhat.com> - 3.27-9
- Resolves: rhbz#1648776 limit connections to be ikev1only or ikev2only and make ikev2only the default [man page update]
-
-* Fri Feb 15 2019 Paul Wouters <pwouters@redhat.com> - 3.27-8
- Resolves: rhbz#1664101 system wide crypto policies causing IKE_INIT packet fragmentation
-
-* Tue Feb 05 2019 Paul Wouters <pwouters@redhat.com> - 3.27-7
- Resolves: rhbz#1671793 proessing ISAKMP_NEXT_D with additional payloads causes dangling pointer to deleted state
-
-* Fri Feb 01 2019 Paul Wouters <pwouters@redhat.com> - 3.27-6
- Resolves: rhbz#1668342 SELinux prevents libreswan from using some outbound ports causing DNS resolution failures at connection at load time
-
-* Thu Jan 10 2019 Paul Wouters <pwouters@redhat.com> - 3.27-5
- Resolves: rhbz#1664522 libreswan 3.25 in FIPS mode is incorrectly rejecting X.509 public keys that are >= 3072 bits
-
-* Mon Dec 10 2018 Paul Wouters <pwouters@redhat.com> - 3.27-4
- Resolves: rhbz#1657846 libreswan no longer needs to provide openswan in rhel8
- Resolves: rhbz#1643388 libreswan: Unable to verify certificate with non-empty Extended Key Usage which does not include serverAuth or clientAuth
- Resolves: rhbz#1657854 remove userland support for deprecated KLIPS IPsec stack support
-
-* Sun Dec 09 2018 Paul Wouters <pwouters@redhat.com> - 3.27-3
- Resolves: rhbz#1648776 limit connections to be ikev1only or ikev2only and make ikev2only the default
-
-* Thu Nov 08 2018 Paul Wouters <pwouters@redhat.com> - 3.27-2
- Resolves: rhbz#1645137 Libreswan segfaults when it loads configuration file with more then 5 connections
-
-* Mon Oct 08 2018 Paul Wouters <pwouters@redhat.com> - 3.27-1
- Resolves: rhbz#1566574 Rebase to libreswan 3.27
-
-* Mon Sep 17 2018 Paul Wouters <pwouters@redhat.com> - 3.26-1
- Resolves: rhbz#1566574 Rebase to libreswan 3.26
- Resolves: rhbz#1527037 libreswan IPSEC implementation: should follow the policies of system-wide crypto policy
- Resolves: rhbz#1375779 [IKEv2 Conformance] Test IKEv2.EN.R.1.1.6.7: Sending INVALID_KE_PAYLOAD failed
- Resolves: rhbz#1085758 [TAHI][IKEv2] IKEv2.EN.I.1.2.1.1: Can't observe CREATE_CHILD_SA request for rekey
- Resolves: rhbz#1053048 [TAHI][IKEv2] IKEv2.EN.I.1.2.4.1-7: libreswan doesn't sent CREATE_CHILD_SA after IKE_SA Lifetime timeout
-
-* Mon Aug 13 2018 Paul Wouters <pwouters@redhat.com> - 3.25-4
- Resolves: rhbz#1590823 libreswan: Use Python 3 in RHEL 8
-
-* Wed Aug 01 2018 Charalampos Stratakis <cstratak@redhat.com> - 3.25-3.1
- Rebuild for platform-python
-
-* Mon Jul 09 2018 Paul Wouters <pwouters@redhat.com> - 3.25-3
- Cleanup shebangs for python3
- Use the same options via macro for make programs and make install
- Remove old ifdefs
- Sync up patches to new upstream version
- Add Requires: for unbound-libs >= 1.6.6
- Enable crypto-policies support
- Make rundir world readable for easier permission granting for socket
-
-* Tue Jun 26 2018 Charalampos Stratakis <cstratak@redhat.com> - 3.23-2.2
- Make python shebangs point to python3
-
-* Fri Jun 22 2018 Troy Dawson <tdawson@redhat.com> - 3.23-2.1
- Fix python shebangs (#1580773)
-
-* Mon Feb 19 2018 Paul Wouters <pwouters@redhat.com> - 3.23-2
- Support crypto-policies package
- Pull in some patches from upstream and IANA registry updates
- gcc7 format-truncate fixes and workarounds
-
-* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 3.23-1.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
-
-* Thu Jan 25 2018 Paul Wouters <pwouters@redhat.com> - 3.23-1
- Updated to 3.23 - support for MOBIKE, PPK, CMAC, nic offload and performance improvements
-
-* Sat Jan 20 2018 Björn Esser <besser82@fedoraproject.org> - 3.22-1.1
- Rebuilt for switch to libxcrypt
-
-* Mon Oct 23 2017 Paul Wouters <pwouters@redhat.com> - 3.22-1
- Updated to 3.22 - many bugfixes, and unbound ipsecmod support
-
-* Wed Aug  9 2017 Paul Wouters <pwouters@redhat.com> - 3.21-1
- Updated to 3.21
-
-* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 3.20-1.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
-
-* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 3.20-1.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
-
-* Tue Mar 14 2017 Paul Wouters <pwouters@redhat.com> - 3.20-1
- Updated to 3.20
-
-* Fri Mar 03 2017 Paul Wouters <pwouters@redhat.com> - 3.20-0.1.dr4
- Update to 3.20dr4 to test mozbz#1336487 export CERT_CompareAVA
-
-* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 3.19-1.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
-
-* Fri Feb 03 2017 Paul Wouters <pwouters@redhat.com> - 3.19-2
- Resolves: rhbz#1392191 libreswan: crash when OSX client connects
- Improved uniqueid and session replacing support
- Test Buffer warning fix on size_t
- Re-introduce --configdir for backwards compatibility
-
-* Sun Jan 15 2017 Paul Wouters <pwouters@redhat.com> - 3.19-1
- Updated to 3.19 (see download.libreswan.org/CHANGES)
-
-* Mon Dec 19 2016 Miro Hrončok <mhroncok@redhat.com> - 3.18-1.1
- Rebuild for Python 3.6
-
-* Fri Jul 29 2016 Paul Wouters <pwouters@redhat.com> - 3.18-1
- Updated to 3.18 for CVE-2016-5391 rhbz#1361164 and VTI support
- Remove support for /etc/sysconfig/pluto (use native systemd instead)
-
-* Thu May 05 2016 Paul Wouters <pwouters@redhat.com> - 3.17-2
- Resolves: rhbz#1324956 prelink is gone, /etc/prelink.conf.d/* is no longer used 
-
-* Thu Apr 07 2016 Paul Wouters <pwouters@redhat.com> - 3.17-1
- Updated to 3.17 for CVE-2016-3071
- Disable LIBCAP_NG as it prevents unbound-control from working properly
- Temporarilly disable WERROR due to a few minor known issues
-
-* Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 3.16-1.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
-
-* Fri Dec 18 2015 Paul Wouters <pwouters@redhat.com> - 3.16-1
- Updated to 3.16 (see https://download.libreswan.org/CHANGES)
-
-* Tue Aug 11 2015 Paul Wouters <pwouters@redhat.com> - 3.15-1
- Updated to 3.15 (see http://download.libreswan.org/CHANGES)
- Resolves: rhbz#CVE-2015-3240 IKE daemon restart when receiving a bad DH gx
- NSS database creation moved from spec file to service file
- Run CAVS tests on package build
- Added BuildRequire systemd-units and xmlto
- Bumped minimum required nss to 3.16.1
- Install tmpfiles
- Install sysctl file
- Update doc files to include
-
-* Mon Jul 13 2015 Paul Wouters <pwouters@redhat.com> - 3.13-2
- Resolves: rhbz#1238967 Switch libreswan to use python3
-
-* Wed Jun 17 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 3.13-1.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
-
-* Mon Jun 01 2015 Paul Wouters <pwouters@redhat.com> - 3.13-1
- Updated to 3.13 for CVE-2015-3204
-
-* Fri Nov 07 2014 Paul Wouters <pwouters@redhat.com> - 3.12-1
- Updated to 3.12 Various IKEv2 fixes
-
-* Wed Oct 22 2014 Paul Wouters <pwouters@redhat.com> - 3.11-1
- Updated to 3.11 (many fixes, including startup fixes)
- Resolves: rhbz#1144941 libreswan 3.10 upgrade breaks old ipsec.secrets configs
- Resolves: rhbz#1147072 ikev1 aggr mode connection fails after libreswan upgrade
- Resolves: rhbz#1144831 Libreswan appears to start with systemd before all the NICs are up and running
-
-* Tue Sep 09 2014 Paul Wouters <pwouters@redhat.com> - 3.10-3
- Fix some coverity issues, auto=route on bootup and snprintf on 32bit machines
-
-* Mon Sep 01 2014 Paul Wouters <pwouters@redhat.com> - 3.10-1
- Updated to 3.10, major bugfix release, new xauth status options
-
-* Sun Aug 17 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 3.9-1.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
-
-* Thu Jul 10 2014 Paul Wouters <pwouters@redhat.com> - 3.9-1
- Updated to 3.9. IKEv2 enhancements, ESP/IKE algo enhancements
- Mark libreswan-fips.conf as config file
- attr modifier for man pages no longer needed
- BUGS file no longer exists upstream
-
-* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 3.8-1.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
-
-* Sat Jan 18 2014 Paul Wouters <pwouters@redhat.com> - 3.8-1
- Updated to 3.8, fixes rhbz#CVE-2013-6467 (rhbz#1054102)
-
-* Wed Dec 11 2013 Paul Wouters <pwouters@redhat.com> - 3.7-1
- Updated to 3.7, fixes CVE-2013-4564
- Fixes creating a bogus NSS db on startup (rhbz#1005410)
-
-* Thu Oct 31 2013 Paul Wouters <pwouters@redhat.com> - 3.6-1
- Updated to 3.6 (IKEv2, MODECFG, Cisco interop fixes)
- Generate empty NSS db if none exists
-
-* Mon Aug 19 2013 Paul Wouters <pwouters@redhat.com> - 3.5-3
- Add a Provides: for openswan-doc
-
-* Sat Aug 03 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 3.5-1.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
-
-* Mon Jul 15 2013 Paul Wouters <pwouters@redhat.com> - 3.5-2
- Added interop patch for (some?) Cisco VPN clients sending 16 zero
-  bytes of extraneous IKE data
- Removed fipscheck_version
-
-* Sat Jul 13 2013 Paul Wouters <pwouters@redhat.com> - 3.5-1
- Updated to 3.5
-
-* Thu Jun 06 2013 Paul Wouters <pwouters@redhat.com> - 3.4-1
- Updated to 3.4, which only contains style changes to kernel coding style
- IN MEMORIAM: June 3rd, 2013 Hugh Daniel
-
-* Mon May 13 2013 Paul Wouters <pwouters@redhat.com> - 3.3-1
- Updated to 3.3, which resolves CVE-2013-2052
-
-* Sat Apr 13 2013 Paul Wouters <pwouters@redhat.com> - 3.2-1
- Initial package for Fedora
--- a/332
+++ b/332
@ -0,0 +1,332 @@
+* Mon Jun 24 2024 Troy Dawson <tdawson@redhat.com> - 4.12-3.3
+- Bump release for June 2024 mass rebuild
+
+* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 4.12-3.2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 4.12-3.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Fri Sep 08 2023 Paul Wouters <paul.wouters@aiven.io> - 4.12-3
+- Update libcap-ng patch, fix email addresses in changelog
+
+* Tue Sep 05 2023 Paul Wouters <paul.wouters@aiven.io> - 4.12-2
+- Remove ipsec show and ipsec verify sub commands (not very useful, causes python requirement)
+- Patch for handling libcap-ng return values and fix capng_apply() call
+
+* Fri Aug 11 2023 Paul Wouters <paul.wouters@aiven.io> - 4.12-1
+- Update to 4.12 for CVE-2023-38710, CVE-2023-38711 and CVE-2023-38712
+- Resolves: rhbz#2230225 libreswan-4.12 is available
+
+* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 4.11-1.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Thu May 04 2023 Paul Wouters <paul.wouters@aiven.io> - 4.11-1
+- Update to 4.11 for CVE-2023-30570
+
+* Wed Mar 01 2023 Paul Wouters <paul.wouters@aiven.io> - 4.10-1
+- Update to 4.10 for CVE-2023-23009
+
+* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 4.9-2.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Tue Jan 10 2023 Paul Wouters <paul.wouters@aiven.io> - 4.9-2
+- Use new GPG key location.
+
+* Thu Oct 13 2022 Paul Wouters <paul.wouters@aiven.io> - 4.9-1
+- Update to 4.9 (maxbytes/maxpackets support, raw ECDSA support, misc fixes)
+
+* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 4.7-1.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Tue May 24 2022 Paul Wouters <paul.wouters@aiven.io> - 4.7-1
+- Updated to 4.7 (EAPTLS support, bugfixes)
+
+* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 4.6-2.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Thu Jan 13 2022 Paul Wouters <paul.wouters@aiven.io> - 4.6-2
+- Re-enable USE_DNSSEC again with patch to resolve header conflicts
+
+* Wed Jan 12 2022 Paul Wouters <paul.wouters@aiven.io> - 4.6-1
+- Resolves: CVE-2022-23094
+- Resolves: rhbz#2039604 libreswan-4.6 is available
+- Add gpg key and signature check for build
+- Temporarilly disable USE_DNSSEC in rawhide while we figure out openssl vs nss include clash
+
+* Thu Aug 26 2021 Paul Wouters <paul.wouters@aiven.io> - 4.5-1
+- Resolves rhbz#1996250 libreswan-4.5 is available
+
+* Tue Aug 03 2021 Paul Wouters <paul.wouters@aiven.io> - 4.4-3
+- Resolves rhbz#1989198 libreswan should depend on procps-ng or pidof
+
+* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 4.4-2.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Mon Jun 07 2021 Paul Wouters <paul.wouters@aiven.io> - 4.4-2
+- Properly handle rpm sysctl config
+
+* Wed May 12 2021 Paul Wouters <paul.wouters@aiven.io> - 4.4-1
+- Resolves: rhbz#1952602 libreswan-4.4 is available
+
+* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 4.3-1.1
+- Rebuilt for updated systemd-rpm-macros
+  See https://pagure.io/fesco/issue/2583.
+
+* Sun Feb 21 2021 Paul Wouters <pwouters@redhat.com> - 4.3-1
+- update to 4.3 (minor bugfix release)
+
+* Wed Feb 03 2021 Paul Wouters <pwouters@redhat.com> - 4.2-1
+- Update to 4.2
+
+* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 4.2-0.1.rc1.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Sat Dec 19 19:59:55 EST 2020 Paul Wouters <pwouters@redhat.com> - 4.2-0.1.rc1
+- Resolves: rhbz#1867580 pluto process frequently dumps core
+  (disable USE_NSS_KDF until nss fixes have propagated)
+
+* Sat Dec 19 2020 Adam Williamson <awilliam@redhat.com> - 4.1-4
+- Rebuild for ldns soname bump
+
+* Mon Nov 23 11:50:41 EST 2020 Paul Wouters <pwouters@redhat.com> - 4.1-3
+- Resolves: rhbz#1894381 Libreswan 4.1-2 breaks l2tp connection to Windows VPN server
+
+* Mon Oct 26 10:21:57 EDT 2020 Paul Wouters <pwouters@redhat.com> - 4.1-2
+- Resolves: rhbz#1889538 libreswan's /var/lib/ipsec/nss missing
+
+* Sun Oct 18 21:49:39 EDT 2020 Paul Wouters <pwouters@redhat.com> - 4.1-1
+- Updated to 4.1 - interop fix for Cisco
+
+* Thu Oct 15 10:27:14 EDT 2020 Paul Wouters <pwouters@redhat.com> - 4.0-1
+- Resolves: rhbz#1888448 libreswan-4.0 is available
+
+* Wed Sep 30 14:05:58 EDT 2020 Paul Wouters <pwouters@redhat.com> - 4.0-0.2.rc1
+- Rebuild for libevent 2.1.12 with a soname bump
+
+* Sun Sep 27 22:49:40 EDT 2020 Paul Wouters <pwouters@redhat.com> - 4.0-0.1.rc1
+- Updated to 4.0rc1
+
+* Thu Aug 27 2020 Paul Wouters <pwouters@redhat.com> - 3.32-4
+- Resolves: rhbz#1864043 libreswan: FTBFS in Fedora rawhide/f33
+
+* Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.32-3.2
+- Second attempt - Rebuilt for
+  https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.32-3.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Tue Jun 30 2020 Jeff Law <law@redhat.com> - 3.32-3
+- Initialize ppk_id_p in ikev2_parent_inR1outI2_tail to avoid uninitialized
+  object
+
+* Tue May 26 2020 Paul Wouters <pwouters@redhat.com> - 3.32-2
+- Backport NSS guarding fix for unannounced changed api in NSS causing segfault
+
+* Mon May 11 2020 Paul Wouters <pwouters@redhat.com> - 3.32-1
+- Resolves: rhbz#1809770 libreswan-3.32 is available
+
+* Tue Apr 14 2020 Paul Wouters <pwouters@redhat.com> - 3.31-2
+- Resolves: rhbz#1823823 Please drop the dependency on fipscheck
+
+* Tue Mar 03 2020 Paul Wouters <pwouters@redhat.com> - 3.31-1
+- Resolves: rhbz#1809770 libreswan-3.31 is available (fixes rekey regression)
+
+* Fri Feb 14 2020 Paul Wouters <pwouters@redhat.com> - 3.30-1
+- Resolves: rhbz#1802896 libreswan-3.30 is available
+- Resolves: rhbz#1799598 libreswan: FTBFS in Fedora rawhide/f32
+- Resolves: rhbz#1760571 [abrt] libreswan: configsetupcheck(): verify:366:configsetupcheck:TypeError:
+
+* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.29-2.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Thu Jan 09 2020 Paul Wouters <pwouters@redhat.com> - 3.29-2
+- _updown.netkey: fix syntax error in checking routes
+
+* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 3.29-1.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Mon Jun 10 2019 Paul Wouters <pwouters@redhat.com> - 3.29-1
+- Resolves: rhbz#1718986 Updated to 3.29 for CVE-2019-10155
+
+* Tue May 21 2019 Paul Wouters <pwouters@redhat.com> - 3.28-1
+- Updated to 3.28 (many imported bugfixes, including CVE-2019-12312)
+
+* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 3.27-1.2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Mon Jan 14 2019 Björn Esser <besser82@fedoraproject.org> - 3.27-1.1
+- Rebuilt for libcrypt.so.2 (#1666033)
+
+* Mon Oct 08 2018 Paul Wouters <pwouters@redhat.com> - 3.27-1
+- Updated to 3.27 (various bugfixes)
+
+* Thu Sep 27 2018 Paul Wouters <pwouters@redhat.com> - 3.26-3
+- Add fedora python fixup for _unbound-hook
+
+* Mon Sep 17 2018 Paul Wouters <pwouters@redhat.com> - 3.26-2
+- linking against freebl is no longer needed (and wasn't done in 3.25)
+
+* Mon Sep 17 2018 Paul Wouters <pwouters@redhat.com> - 3.26-1
+- Updated to 3.26 (CHACHA20POLY1305, ECDSA and RSA-PSS support)
+
+* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 3.25-3.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
+* Mon Jul 09 2018 Paul Wouters <pwouters@redhat.com> - 3.25-3
+- Fix Opportunistic IPsec _unbound-hook argument parsing
+- Make rundir readable for all (so we can hand out permissions later)
+
+* Mon Jul 02 2018 Paul Wouters <pwouters@redhat.com> - 3.25-2
+- Relax deleting IKE SA's and IPsec SA's to avoid interop issues with third party VPN vendors
+
+* Wed Jun 27 2018 Paul Wouters <pwouters@redhat.com> - 3.25-1
+- Updated to 3.25
+
+* Mon Feb 19 2018 Paul Wouters <pwouters@redhat.com> - 3.23-2
+- Support crypto-policies package
+- Pull in some patches from upstream and IANA registry updates
+- gcc7 format-truncate fixes and workarounds
+
+* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 3.23-1.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
+
+* Thu Jan 25 2018 Paul Wouters <pwouters@redhat.com> - 3.23-1
+- Updated to 3.23 - support for MOBIKE, PPK, CMAC, nic offload and performance improvements
+
+* Sat Jan 20 2018 Björn Esser <besser82@fedoraproject.org> - 3.22-1.1
+- Rebuilt for switch to libxcrypt
+
+* Mon Oct 23 2017 Paul Wouters <pwouters@redhat.com> - 3.22-1
+- Updated to 3.22 - many bugfixes, and unbound ipsecmod support
+
+* Wed Aug  9 2017 Paul Wouters <pwouters@redhat.com> - 3.21-1
+- Updated to 3.21
+
+* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 3.20-1.2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
+
+* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 3.20-1.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
+
+* Tue Mar 14 2017 Paul Wouters <pwouters@redhat.com> - 3.20-1
+- Updated to 3.20
+
+* Fri Mar 03 2017 Paul Wouters <pwouters@redhat.com> - 3.20-0.1.dr4
+- Update to 3.20dr4 to test mozbz#1336487 export CERT_CompareAVA
+
+* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 3.19-1.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
+
+* Fri Feb 03 2017 Paul Wouters <pwouters@redhat.com> - 3.19-2
+- Resolves: rhbz#1392191 libreswan: crash when OSX client connects
+- Improved uniqueid and session replacing support
+- Test Buffer warning fix on size_t
+- Re-introduce --configdir for backwards compatibility
+
+* Sun Jan 15 2017 Paul Wouters <pwouters@redhat.com> - 3.19-1
+- Updated to 3.19 (see download.libreswan.org/CHANGES)
+
+* Mon Dec 19 2016 Miro Hrončok <mhroncok@redhat.com> - 3.18-1.1
+- Rebuild for Python 3.6
+
+* Fri Jul 29 2016 Paul Wouters <pwouters@redhat.com> - 3.18-1
+- Updated to 3.18 for CVE-2016-5391 rhbz#1361164 and VTI support
+- Remove support for /etc/sysconfig/pluto (use native systemd instead)
+
+* Thu May 05 2016 Paul Wouters <pwouters@redhat.com> - 3.17-2
+- Resolves: rhbz#1324956 prelink is gone, /etc/prelink.conf.d/* is no longer used
+
+* Thu Apr 07 2016 Paul Wouters <pwouters@redhat.com> - 3.17-1
+- Updated to 3.17 for CVE-2016-3071
+- Disable LIBCAP_NG as it prevents unbound-control from working properly
+- Temporarilly disable WERROR due to a few minor known issues
+
+* Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 3.16-1.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
+
+* Fri Dec 18 2015 Paul Wouters <pwouters@redhat.com> - 3.16-1
+- Updated to 3.16 (see https://download.libreswan.org/CHANGES)
+
+* Tue Aug 11 2015 Paul Wouters <pwouters@redhat.com> - 3.15-1
+- Updated to 3.15 (see http://download.libreswan.org/CHANGES)
+- Resolves: rhbz#CVE-2015-3240 IKE daemon restart when receiving a bad DH gx
+- NSS database creation moved from spec file to service file
+- Run CAVS tests on package build
+- Added BuildRequire systemd-units and xmlto
+- Bumped minimum required nss to 3.16.1
+- Install tmpfiles
+- Install sysctl file
+- Update doc files to include
+
+* Mon Jul 13 2015 Paul Wouters <pwouters@redhat.com> - 3.13-2
+- Resolves: rhbz#1238967 Switch libreswan to use python3
+
+* Wed Jun 17 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 3.13-1.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
+
+* Mon Jun 01 2015 Paul Wouters <pwouters@redhat.com> - 3.13-1
+- Updated to 3.13 for CVE-2015-3204
+
+* Fri Nov 07 2014 Paul Wouters <pwouters@redhat.com> - 3.12-1
+- Updated to 3.12 Various IKEv2 fixes
+
+* Wed Oct 22 2014 Paul Wouters <pwouters@redhat.com> - 3.11-1
+- Updated to 3.11 (many fixes, including startup fixes)
+- Resolves: rhbz#1144941 libreswan 3.10 upgrade breaks old ipsec.secrets configs
+- Resolves: rhbz#1147072 ikev1 aggr mode connection fails after libreswan upgrade
+- Resolves: rhbz#1144831 Libreswan appears to start with systemd before all the NICs are up and running
+
+* Tue Sep 09 2014 Paul Wouters <pwouters@redhat.com> - 3.10-3
+- Fix some coverity issues, auto=route on bootup and snprintf on 32bit machines
+
+* Mon Sep 01 2014 Paul Wouters <pwouters@redhat.com> - 3.10-1
+- Updated to 3.10, major bugfix release, new xauth status options
+
+* Sun Aug 17 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 3.9-1.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
+
+* Thu Jul 10 2014 Paul Wouters <pwouters@redhat.com> - 3.9-1
+- Updated to 3.9. IKEv2 enhancements, ESP/IKE algo enhancements
+- Mark libreswan-fips.conf as config file
+- attr modifier for man pages no longer needed
+- BUGS file no longer exists upstream
+
+* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 3.8-1.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
+
+* Sat Jan 18 2014 Paul Wouters <pwouters@redhat.com> - 3.8-1
+- Updated to 3.8, fixes rhbz#CVE-2013-6467 (rhbz#1054102)
+
+* Wed Dec 11 2013 Paul Wouters <pwouters@redhat.com> - 3.7-1
+- Updated to 3.7, fixes CVE-2013-4564
+- Fixes creating a bogus NSS db on startup (rhbz#1005410)
+
+* Thu Oct 31 2013 Paul Wouters <pwouters@redhat.com> - 3.6-1
+- Updated to 3.6 (IKEv2, MODECFG, Cisco interop fixes)
+- Generate empty NSS db if none exists
+
+* Mon Aug 19 2013 Paul Wouters <pwouters@redhat.com> - 3.5-3
+- Add a Provides: for openswan-doc
+
+* Sat Aug 03 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 3.5-1.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
+
+* Mon Jul 15 2013 Paul Wouters <pwouters@redhat.com> - 3.5-2
+- Added interop patch for (some?) Cisco VPN clients sending 16 zero
+  bytes of extraneous IKE data
+- Removed fipscheck_version
+
+* Sat Jul 13 2013 Paul Wouters <pwouters@redhat.com> - 3.5-1
+- Updated to 3.5
+
+* Thu Jun 06 2013 Paul Wouters <pwouters@redhat.com> - 3.4-1
+- Updated to 3.4, which only contains style changes to kernel coding style
+- IN MEMORIAM: June 3rd, 2013 Hugh Daniel
+
+* Mon May 13 2013 Paul Wouters <pwouters@redhat.com> - 3.3-1
+- Updated to 3.3, which resolves CVE-2013-2052
+
+* Sat Apr 13 2013 Paul Wouters <pwouters@redhat.com> - 3.2-1
+- Initial package for Fedora
--- a/ci.fmf
+++ b/ci.fmf
@ -0,0 +1,2 @@
+resultsdb-testcase: separate
+
--- a/gating.yaml
+++ b/gating.yaml
@ -0,0 +1,7 @@
+--- !Policy
+product_versions:
+  - rhel-10
+decision_context: osci_compose_gate
+rules:
+  - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/ci/fips-disabled-buildroot-enabled.functional}
+  - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/ci/fips-disabled-buildroot-disabled.functional}
--- a/libreswan-4.12-libcap-ng.patch
+++ b/libreswan-4.12-libcap-ng.patch
@ -0,0 +1,175 @@
+diff --git a/programs/pluto/plutomain.c b/programs/pluto/plutomain.c
+index 953937ec02..4fc67d3b14 100644
+--- a/programs/pluto/plutomain.c
+++ b/programs/pluto/plutomain.c
+@@ -1676,32 +1676,56 @@ int main(int argc, char **argv)
+ 
+ #ifdef HAVE_LIBCAP_NG
+ 	/*
+	 * If we don't have the capability to drop capailities, do nothing.
+	 *
+ 	 * Drop capabilities - this generates a false positive valgrind warning
+ 	 * See: http://marc.info/?l=linux-security-module&m=125895232029657
+ 	 *
+ 	 * We drop these after creating the pluto socket or else we can't
+ 	 * create a socket if the parent dir is non-root (eg openstack)
+-	 */
+-	capng_clear(CAPNG_SELECT_BOTH);
+-
+-	capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE | CAPNG_PERMITTED,
+-		CAP_NET_BIND_SERVICE, CAP_NET_ADMIN, CAP_NET_RAW,
+-		CAP_IPC_LOCK, CAP_AUDIT_WRITE,
+-		/* for google authenticator pam */
+-		CAP_SETGID, CAP_SETUID,
+-		CAP_DAC_READ_SEARCH,
+-		-1);
+-	/*
+	 *
+ 	 * We need to retain some capabilities for our children (updown):
+ 	 * CAP_NET_ADMIN to change routes
+ 	 * (we also need it for some setsockopt() calls in main process)
+ 	 * CAP_NET_RAW for iptables -t mangle
+ 	 * CAP_DAC_READ_SEARCH for pam / google authenticator
+-	 *
+	 * CAP_SETGID, CAP_SETUID for pam / google authenticator
+ 	 */
+-	capng_updatev(CAPNG_ADD, CAPNG_BOUNDING_SET, CAP_NET_ADMIN, CAP_NET_RAW,
+-			CAP_DAC_READ_SEARCH, -1);
+-	capng_apply(CAPNG_SELECT_BOTH);
+	if (capng_get_caps_process() == -1) {
+		llog(RC_LOG_SERIOUS, logger, "failed to query pluto process for capng capabilities");
+	} else {
+		/* If we don't have CAP_SETPCAP, we cannot update the bounding set */
+		capng_select_t set = CAPNG_SELECT_CAPS;
+		if (capng_have_capability (CAPNG_EFFECTIVE, CAP_SETPCAP)) {
+			set = CAPNG_SELECT_BOTH;
+		}
+
+		capng_clear(CAPNG_SELECT_BOTH);
+		if (capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE | CAPNG_PERMITTED,
+			CAP_NET_BIND_SERVICE, CAP_NET_ADMIN, CAP_NET_RAW,
+			CAP_IPC_LOCK, CAP_AUDIT_WRITE,
+			CAP_SETGID, CAP_SETUID,
+			CAP_DAC_READ_SEARCH,
+			-1) != 0) {
+				llog(RC_LOG_SERIOUS, logger,
+					"libcap-ng capng_updatev() failed for CAPNG_EFFECTIVE | CAPNG_PERMITTED");
+		}
+
+		if (capng_updatev(CAPNG_ADD, CAPNG_BOUNDING_SET, CAP_NET_ADMIN,
+			CAP_NET_RAW, CAP_DAC_READ_SEARCH, CAP_SETPCAP,
+			-1) != 0) {
+				llog(RC_LOG_SERIOUS, logger,
+					"libcap-ng capng_updatev() failed for CAPNG_BOUNDING_SET");
+		}
+
+		int ret = capng_apply(set);
+		if (ret != CAPNG_NONE) {
+			llog(RC_LOG_SERIOUS, logger,
+				"libcap-ng capng_apply failed to apply changes, err=%d. see: man capng_apply",
+				ret);
+		}
+	}
+
+ 	llog(RC_LOG, logger, "libcap-ng support [enabled]");
+ #else
+ 	llog(RC_LOG, logger, "libcap-ng support [disabled]");
+diff --git a/testing/pluto/TESTLIST b/testing/pluto/TESTLIST
+index 75f5fcbdca..7826dc9100 100644
+--- a/testing/pluto/TESTLIST
+++ b/testing/pluto/TESTLIST
+@@ -842,7 +842,8 @@ kvmplutotest	algo-ikev2-aes-md5-esp-3des-sha1	good
+ 
+ # CAP_DAC_OVERRIDE
+ kvmplutotest	basic-pluto-06		good
+-
+# libcab-ng test
+kvmplutotest	capabilities-01		good
+ 
+ #
+ # a test case of PSK with aggressive mode
+diff --git a/testing/pluto/capabilities-01/description.txt b/testing/pluto/capabilities-01/description.txt
+new file mode 100644
+index 0000000000..abc1d6e90e
+--- /dev/null
+++ b/testing/pluto/capabilities-01/description.txt
+@@ -0,0 +1 @@
+Basic test to see if pluto dropped capabilities
+diff --git a/testing/pluto/capabilities-01/west.conf b/testing/pluto/capabilities-01/west.conf
+new file mode 100644
+index 0000000000..c7b108eae7
+--- /dev/null
+++ b/testing/pluto/capabilities-01/west.conf
+@@ -0,0 +1,19 @@
+# /etc/ipsec.conf - Libreswan IPsec configuration file
+
+version 2.0
+
+config setup
+	# put the logs in /tmp for the UMLs, so that we can operate
+	# without syslogd, which seems to break on UMLs
+	logfile=/tmp/pluto.log
+	logtime=no
+	logappend=no
+	plutodebug=all
+	dumpdir=/tmp
+	virtual-private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:!192.0.1.0/24,%v6:!2001:db8:0:1::/64
+
+conn westnet-eastnet-ipv4-psk-ikev2
+	also=westnet-eastnet-ipv4-psk
+
+include	/testing/baseconfigs/all/etc/ipsec.d/ipsec.conf.common
+
+diff --git a/testing/pluto/capabilities-01/west.console.txt b/testing/pluto/capabilities-01/west.console.txt
+new file mode 100644
+index 0000000000..6f98855ad9
+--- /dev/null
+++ b/testing/pluto/capabilities-01/west.console.txt
+@@ -0,0 +1,22 @@
+/testing/guestbin/swan-prep
+west #
+ ipsec start
+Redirecting to: [initsystem]
+west #
+ ../../guestbin/wait-until-pluto-started
+west #
+ echo "initdone"
+initdone
+west #
+ netcap | grep pluto | sed "s/^.*pluto/pluto/"
+pluto            udp      500    dac_read_search, setgid, setuid, net_bind_service, net_admin, net_raw, ipc_lock, audit_write +
+pluto            udp      500    dac_read_search, setgid, setuid, net_bind_service, net_admin, net_raw, ipc_lock, audit_write +
+pluto            udp      500    dac_read_search, setgid, setuid, net_bind_service, net_admin, net_raw, ipc_lock, audit_write +
+pluto            udp      4500   dac_read_search, setgid, setuid, net_bind_service, net_admin, net_raw, ipc_lock, audit_write +
+pluto            udp      4500   dac_read_search, setgid, setuid, net_bind_service, net_admin, net_raw, ipc_lock, audit_write +
+pluto            udp      4500   dac_read_search, setgid, setuid, net_bind_service, net_admin, net_raw, ipc_lock, audit_write +
+west #
+ echo done
+done
+west #
+ 
+diff --git a/testing/pluto/capabilities-01/west.secrets b/testing/pluto/capabilities-01/west.secrets
+new file mode 100644
+index 0000000000..d3ed5698d0
+--- /dev/null
+++ b/testing/pluto/capabilities-01/west.secrets
+@@ -0,0 +1 @@
+@west @east : PSK "ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890"
+diff --git a/testing/pluto/capabilities-01/westinit.sh b/testing/pluto/capabilities-01/westinit.sh
+new file mode 100755
+index 0000000000..f803fcf070
+--- /dev/null
+++ b/testing/pluto/capabilities-01/westinit.sh
+@@ -0,0 +1,4 @@
+/testing/guestbin/swan-prep
+ipsec start
+../../guestbin/wait-until-pluto-started
+echo "initdone"
+diff --git a/testing/pluto/capabilities-01/westrun.sh b/testing/pluto/capabilities-01/westrun.sh
+new file mode 100755
+index 0000000000..379da39994
+--- /dev/null
+++ b/testing/pluto/capabilities-01/westrun.sh
+@@ -0,0 +1,2 @@
+netcap | grep pluto | sed "s/^.*pluto/pluto/"
+echo done
--- a/libreswan-4.15-ipsec_import.patch
+++ b/libreswan-4.15-ipsec_import.patch
@ -0,0 +1,20 @@
+diff --git a/programs/ipsec/ipsec.in b/programs/ipsec/ipsec.in
+index 40ff9f4138..41813b5258 100755
+--- a/programs/ipsec/ipsec.in
+++ b/programs/ipsec/ipsec.in
+@@ -758,7 +758,14 @@ ipsec_import() {
+ 	    exit 1
+ 	fi
+ 
+-	pk12util -i "${pkcs12bundle}" -d "${IPSEC_NSSDIR_SQL}"
+	# First try blanc password to avoid uselessly prompting interactively
+	pk12util -i "${pkcs12bundle}" -d "${IPSEC_NSSDIR_SQL}" -W '' 2>/dev/null
+	# check for SEC_ERROR_BAD_PASSWORD
+	if [ $? -eq 18 ]; then
+	    # Not the empty password
+	    pk12util -i "${pkcs12bundle}" -d "${IPSEC_NSSDIR_SQL}"
+	fi
+
+ 	# check and correct trust bits
+ 	set_nss_db_trusts
+ 	exit 0
--- a/libreswan-4.15-netlink-extack.patch
+++ b/libreswan-4.15-netlink-extack.patch
@ -0,0 +1,153 @@
+From 4f2af7c8c3afaaa63e8e16467de3441622a5314d Mon Sep 17 00:00:00 2001
+From: Daiki Ueno <dueno@redhat.com>
+Date: Tue, 21 May 2024 20:12:17 +0900
+Subject: [PATCH] kernel_xfrm: record extended ack from netlink response
+
+This enables pluto to log any error message reported through extended
+ACK attributes[1] in a netlink response, to make diagnostic easier
+when an error occurs.  Suggested by Sabrina Dubroca.
+
+1. https://docs.kernel.org/userspace-api/netlink/intro.html#ext-ack
+
+Signed-off-by: Daiki Ueno <dueno@redhat.com>
+Signed-off-by: Andrew Cagney <cagney@gnu.org>
+---
+ include/netlink_attrib.h     |  4 +++
+ lib/libswan/netlink_attrib.c | 29 +++++++++++++++++++++
+ programs/pluto/kernel_xfrm.c | 49 ++++++++++++++++++++++++++++++++++++
+ 3 files changed, 82 insertions(+)
+
+diff --git a/include/netlink_attrib.h b/include/netlink_attrib.h
+index 4c952ae3e9..fff35d83f1 100644
+--- a/include/netlink_attrib.h
+++ b/include/netlink_attrib.h
+@@ -46,4 +46,8 @@ void nl_addattrstrz(struct nlmsghdr *n, int maxlen, int type,
+ 		const char *str);
+ void nl_addattr32(struct nlmsghdr *n, int maxlen, int type, const uint32_t data);
+ 
+const struct nlattr *nl_getattr(const struct nlmsghdr *n, size_t *offset);
+const char *nl_getattrvalstrz(const struct nlmsghdr *n,
+			      const struct nlattr *attr);
+
+ #endif
+diff --git a/lib/libswan/netlink_attrib.c b/lib/libswan/netlink_attrib.c
+index 34bb4bec83..ccc08cba8f 100644
+--- a/lib/libswan/netlink_attrib.c
+++ b/lib/libswan/netlink_attrib.c
+@@ -66,3 +66,32 @@ void nl_addattr32(struct nlmsghdr *n, int maxlen, int type, const uint32_t data)
+ {
+ 	nl_addattr_l(n, maxlen, type, &data, sizeof(uint32_t));
+ }
+
+const struct nlattr *nl_getattr(const struct nlmsghdr *n, size_t *offset)
+{
+	struct nlattr *attr = (void *)n + NLMSG_HDRLEN + NLMSG_ALIGN(*offset);
+	struct nlattr *tail = (void *)n + NLMSG_ALIGN(n->nlmsg_len);
+
+	if (attr == tail) {
+		return NULL;
+	}
+
+	*offset += NLA_ALIGN(attr->nla_len);
+	return attr;
+}
+
+const char *nl_getattrvalstrz(const struct nlmsghdr *n,
+			      const struct nlattr *attr)
+{
+	struct nlattr *tail = (void *)n + NLMSG_ALIGN(n->nlmsg_len);
+
+	ptrdiff_t len = (void *)tail - (void *)attr;
+	if (len < (ptrdiff_t)sizeof(struct nlattr) ||
+	    attr->nla_len <= sizeof(struct nlattr) ||
+	    attr->nla_len > len ||
+	    !memchr(attr + NLA_HDRLEN, '\0', attr->nla_len - NLA_HDRLEN)) {
+		return NULL;
+	}
+
+	return (void *)attr + NLA_HDRLEN;
+}
+diff --git a/programs/pluto/kernel_xfrm.c b/programs/pluto/kernel_xfrm.c
+index eed307f42b..25d1b16bc9 100644
+--- a/programs/pluto/kernel_xfrm.c
+++ b/programs/pluto/kernel_xfrm.c
+@@ -260,6 +260,22 @@ static void init_netlink(struct logger *logger)
+ 			    "socket() in init_netlink()");
+ 	}
+ 
+#ifdef SOL_NETLINK
+	const int on = true;
+	if (setsockopt(nl_send_fd, SOL_NETLINK, NETLINK_CAP_ACK,
+		       (const void *)&on, sizeof(on)) < 0) {
+		llog_errno(RC_LOG, logger, errno, "xfrm: setsockopt(NETLINK_CAP_ACK) failed: ");
+	} else {
+		ldbg(logger, "xfrm: setsockopt(NETLINK_CAP_ACK) ok");
+	}
+	if (setsockopt(nl_send_fd, SOL_NETLINK, NETLINK_EXT_ACK,
+		       (const void *)&on, sizeof(on)) < 0) {
+		llog_errno(RC_LOG, logger, errno, "xfrm: setsockopt(NETLINK_EXT_ACK) failed: ");
+	} else {
+		ldbg(logger, "xfrm: setsockopt(NETLINK_EXT_ACK) ok");
+	}
+#endif
+
+ 	nl_xfrm_fd = cloexec_socket(AF_NETLINK, SOCK_DGRAM|SOCK_NONBLOCK, NETLINK_XFRM);
+ 	if (nl_xfrm_fd < 0) {
+ 		fatal_errno(PLUTO_EXIT_FAIL, logger, errno,
+@@ -301,6 +317,37 @@ static void init_netlink(struct logger *logger)
+ 	}
+ }
+ 
+static void llog_ext_ack(lset_t rc_flags, struct logger *logger,
+			 const struct nlmsghdr *n)
+{
+#ifdef SOL_NETLINK
+	if (n->nlmsg_type != NLMSG_ERROR ||
+	    !(n->nlmsg_flags & NLM_F_ACK_TLVS)) {
+		return;
+	}
+
+	struct nlmsgerr *err = (void *)n + NLMSG_HDRLEN;
+	size_t offset = sizeof(*err);
+	if (!(n->nlmsg_flags & NLM_F_CAPPED)) {
+		offset += err->msg.nlmsg_len - NLMSG_HDRLEN;
+	}
+
+	for (const struct nlattr *attr = nl_getattr(n, &offset);
+	     attr != NULL; attr = nl_getattr(n, &offset)) {
+		if ((attr->nla_type & NLA_TYPE_MASK) == NLMSGERR_ATTR_MSG) {
+			const char *msg = nl_getattrvalstrz(n, attr);
+			if (msg) {
+				llog(rc_flags, logger, "netlink ext_ack: %s",
+				     msg);
+			}
+		}
+	}
+#else
+	/* use the arguments */
+	ldbg(logger, "ignoring "PRI_LSET" %p", rc_flags, n);
+#endif
+}
+
+ /*
+  * sendrecv_xfrm_msg()
+  *
+@@ -403,6 +450,7 @@ static bool sendrecv_xfrm_msg(struct nlmsghdr *hdr,
+ 		if (rsp.u.e.error != 0) {
+ 			llog_error(logger, -rsp.u.e.error,
+ 				   "netlink response for %s %s", description, story);
+			llog_ext_ack(RC_LOG, logger, &rsp.n);
+ 			return false;
+ 		}
+ 		/*
+@@ -413,6 +461,7 @@ static bool sendrecv_xfrm_msg(struct nlmsghdr *hdr,
+ 		 */
+ 		dbg("netlink response for %s %s included non-error error",
+ 		    description, story);
+		llog_ext_ack(DEBUG_STREAM, logger, &rsp.n);
+ 		/* ignore */
+ 	}
+ 	if (rbuf == NULL) {
+-- 
+2.45.2
+
--- a/libreswan-4.15-ondemand-tcp.patch
+++ b/libreswan-4.15-ondemand-tcp.patch
@ -0,0 +1,52 @@
+From 0b91406427cf7292d61900991fd665f076b6d43f Mon Sep 17 00:00:00 2001
+From: Daiki Ueno <dueno@redhat.com>
+Date: Tue, 2 Jul 2024 20:37:07 +0900
+Subject: [PATCH] tcp: call kernel_ops->poke_ipsec_policy_hole before connect
+
+This fixes ondemand initiation with TCP.  Without the policy hole, a
+TCP handshake will not complete, as it cannot receive SYN-ACK packet
+in plaintext and thus connect blocks until timeout.
+
+Signed-off-by: Daiki Ueno <dueno@redhat.com>
+Signed-off-by: Andrew Cagney <cagney@gnu.org>
+---
+ programs/pluto/iface_tcp.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/programs/pluto/iface_tcp.c b/programs/pluto/iface_tcp.c
+index c63e8bfe4d..55fe639174 100644
+--- a/programs/pluto/iface_tcp.c
+++ b/programs/pluto/iface_tcp.c
+@@ -473,6 +473,15 @@ struct iface_endpoint *connect_to_tcp_endpoint(struct iface_dev *local_dev,
+ 		return NULL;
+ 	}
+ 
+	/* This needs to be called before connect, so TCP handshake
+	 * (in plaintext) completes. */
+	if (kernel_ops->poke_ipsec_policy_hole != NULL &&
+	    !kernel_ops->poke_ipsec_policy_hole(fd, afi, logger)) {
+		/* already logged */
+		close(fd);
+		return NULL;
+	}
+
+ 	/*
+ 	 * Connect
+ 	 *
+@@ -551,13 +560,6 @@ struct iface_endpoint *connect_to_tcp_endpoint(struct iface_dev *local_dev,
+ 		}
+ 	}
+ 
+-	if (kernel_ops->poke_ipsec_policy_hole != NULL &&
+-	    !kernel_ops->poke_ipsec_policy_hole(fd, afi, logger)) {
+-		/* already logged */
+-		close(fd);
+-		return NULL;
+-	}
+-
+ 	struct iface_endpoint *ifp =
+ 		alloc_iface_endpoint(fd, local_dev, &iketcp_iface_io,
+ 				     /*esp_encapsulation_enabled*/true,
+-- 
+2.45.2
+
--- a/libreswan-4.6-ikev1-policy-defaults-to-drop.patch
+++ b/libreswan-4.6-ikev1-policy-defaults-to-drop.patch
@ -0,0 +1,63 @@
+From 13720e0dedcab1eaf3334a73a42b68581acd9f3b Mon Sep 17 00:00:00 2001
+From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+Date: Fri, 7 Jan 2022 18:36:47 -0500
+Subject: [PATCH] ikev1-policy defaults to drop
+
+IKEv2 has been available for 16 years (RFC 4306 was published December
+2005).  At some point, we should be discouraging IKEv1 adoption.
+
+To the extent that a user needs IKEv1, they can manually add
+ikev1-policy=accept to /etc/ipsec.conf.
+---
+ configs/d.ipsec.conf/ikev1-policy.xml | 7 ++++---
+ include/ipsecconf/keywords.h          | 2 +-
+ lib/libipsecconf/confread.c           | 1 +
+ programs/pluto/server.c               | 5 -----
+ 4 files changed, 6 insertions(+), 9 deletions(-)
+
+diff --git a/configs/d.ipsec.conf/ikev1-policy.xml b/configs/d.ipsec.conf/ikev1-policy.xml
+index 17d1747e3b..3bd6702564 100644
+--- a/configs/d.ipsec.conf/ikev1-policy.xml
+++ b/configs/d.ipsec.conf/ikev1-policy.xml
+@@ -3,9 +3,10 @@
+   <listitem>
+ <para>
+ What to do with received IKEv1 packets. Valid options are
+-<emphasis remap='B'>accept</emphasis> (default), <emphasis remap='B'>reject</emphasis> which
+-will reply with an error, and <emphasis remap='B'>drop</emphasis> which will silently drop
+-any received IKEv1 packet. If this option is set to drop or reject, an attempt to load an
+<emphasis remap='B'>drop</emphasis> (default) which will silently drop
+any received IKEv1 packet, <emphasis remap='B'>accept</emphasis>, and
+<emphasis remap='B'>reject</emphasis> which will reply with an error.
+If this option is set to drop or reject, an attempt to load an
+ IKEv1 connection will fail, as these connections would never be able to receive a packet
+ for processing.
+ </para>
+diff --git a/include/ipsecconf/keywords.h b/include/ipsecconf/keywords.h
+index 660847733c..31b519242a 100644
+--- a/include/ipsecconf/keywords.h
+++ b/include/ipsecconf/keywords.h
+@@ -111,7 +111,7 @@ enum keyword_numeric_config_field {
+ 
+ 	KBF_LISTEN_TCP,		/* listen on TCP port 4500 - default no */
+ 	KBF_LISTEN_UDP,		/* listen on UDP port 500/4500 - default yes */
+-	KBF_GLOBAL_IKEv1,	/* global ikev1 policy - default accept */
+	KBF_GLOBAL_IKEv1,	/* global ikev1 policy - default drop */
+ 	KBF_ROOF
+ };
+ 
+diff --git a/lib/libipsecconf/confread.c b/lib/libipsecconf/confread.c
+index 5b5aba723f..68fbccf442 100644
+--- a/lib/libipsecconf/confread.c
+++ b/lib/libipsecconf/confread.c
+@@ -95,6 +95,7 @@ static void ipsecconf_default_values(struct starter_config *cfg)
+ 	/* Don't inflict BSI requirements on everyone */
+ 	SOPT(KBF_SEEDBITS, 0);
+ 	SOPT(KBF_DROP_OPPO_NULL, false);
+	SOPT(KBF_GLOBAL_IKEv1, GLOBAL_IKEv1_DROP);
+ 
+ #ifdef HAVE_LABELED_IPSEC
+ 	SOPT(KBF_SECCTX, SECCTX);
+-- 
+2.34.1
+
--- a/libreswan-5.1-opt-protoport.patch
+++ b/libreswan-5.1-opt-protoport.patch
@ -0,0 +1,214 @@
+From b24a5b718303683420d37d0b88e7f52999195e48 Mon Sep 17 00:00:00 2001
+From: Ilya Maximets <i.maximets@ovn.org>
+Date: Thu, 2 Jan 2025 12:50:38 +0100
+Subject: [PATCH 1/2] ttoport: check numbers before the service name lookup
+
+getservbyname() is a very slow function.  It seems to linearly scan all
+the values in /etc/services (11473 lines on my system) and compare the
+provided string to each and every one of them.  One such lookup takes
+around 1.8 milliseconds.  Which is huge in CPU time.
+
+If the ipsec.conf contains a lot of connections, the time multiplies.
+For example, a single 'addconn --checkconfig' with an ipsec.conf
+containing 1000 connections takes 1.8 seconds.  Most of that time is
+just getservbyname() calls.
+
+Let's first check if the port string is a number before looking up the
+service.  This brings the total time of parsing a large config from
+1.8 seconds down to 40-ish milliseconds in case the port is actually
+just a number.
+
+Tested with an ipsec.conf containing 1000 connections with the left
+protoport=udp and the right protoport=udp/6081 or udp/geneve.  The
+table below shows how much time it takes to execute the
+'addconn --checkconfig'.
+
+    protoport      Before     After     SpeedUp
+    -------------------------------------------
+    udp/6081      1.77 sec   0.04 sec     44x
+    udp/geneve    1.37 sec   1.37 sec     --
+
+Times for 'geneve' are very similar before and after, so the change
+doesn't affect performance in cases where getservbyname() is needed.
+
+This change allows to save extra 8-10% on 'ipsec add <conn>' calls as
+well.  Below are the times for 1000 consequent calls:
+
+    protoport      Before     After     SpeedUp
+    -------------------------------------------
+    udp/6081      24.5 sec   22.5 sec     8.2%
+    udp/geneve    23.9 sec   23.9 sec      --
+
+Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
+Signed-off-by: Andrew Cagney <cagney@gnu.org>
+---
+ lib/libswan/ttoport.c | 45 ++++++++++++++++++++++---------------------
+ 1 file changed, 23 insertions(+), 22 deletions(-)
+
+diff --git a/lib/libswan/ttoport.c b/lib/libswan/ttoport.c
+index b1e38a4cd2..7a7083b5d2 100644
+--- a/lib/libswan/ttoport.c
+++ b/lib/libswan/ttoport.c
+@@ -28,7 +28,27 @@ err_t ttoport(shunk_t service_name, ip_port *port)
+ 	*port = unset_port;
+ 
+ 	/*
+-	 * Extract port by trying to resolve it by name.
+	 * Try converting it to a number; use SHUNK's variant of strtoul()
+	 * as it is more strict around using the full string.
+	 *
+	 * Number conversion should be checked first, because the service
+	 * name lookup is very expensive in comparision.
+	 */
+	uintmax_t l;
+	err_t e = shunk_to_uintmax(service_name,
+				   NULL/*trailing-chars-not-allowed*/,
+				   0/*any-base*/, &l);
+	if (e == NULL) {
+		if (l > 0xffff)
+			return "must be between 0 and 65535";
+
+		/* success */
+		*port = ip_hport(l);
+		return NULL;
+	}
+
+	/*
+	 * It's not a number, so trying to resolve it by name.
+ 	 *
+ 	 * XXX: the getservbyname() call requires a NUL terminated
+ 	 * string but SERVICE_NAME, being a shunk_t may not include
+@@ -43,25 +63,6 @@ err_t ttoport(shunk_t service_name, ip_port *port)
+ 		return NULL;
+ 	}
+ 
+-	/*
+-	 * Now try converting it to a number; use SHUNK's variant of
+-	 * strtoul() as it is more strict around using the full
+-	 * string.
+-	 */
+-	uintmax_t l;
+-	err_t e = shunk_to_uintmax(service_name,
+-				   NULL/*trailing-chars-not-allowed*/,
+-				   0/*any-base*/, &l);
+-	if (e != NULL) {
+-		*port = unset_port;
+-		return e;
+-	}
+-
+-	if (l > 0xffff) {
+-		*port = unset_port;
+-		return "must be between 0 and 65535";
+-	}
+-
+-	*port = ip_hport(l);
+-	return NULL;
+	/* 'e' still holds a number conversion error. */
+	return e;
+ }
+-- 
+2.48.1
+
+
+From 8a7043f497e8ea2fb8d066d04ac85a51c99e8056 Mon Sep 17 00:00:00 2001
+From: Ilya Maximets <i.maximets@ovn.org>
+Date: Wed, 15 Jan 2025 14:17:53 -0500
+Subject: [PATCH 2/2] ipsecconf: move protoport parsing to set_whack_end
+
+ttoprotoport() is using a very heavy getservbyname() underneath to
+convert protocol names to port numbers.  And this is done for every
+connection being loaded.  Move the logic down to set_whack_end(), so
+the full validation is only done for connections we're about to add.
+This significantly reduces the time required to load large config
+files.  For example, running 'addconn --cehckcinfig' on a file with
+a 1000 connections with udp/geneve protoport takes 1.4 seconds without
+this change and just 0.04 seconds with this change applied.
+
+The downside is that addconn --checkconfig will no longer fully
+validate the protocols, but it's already not validating many other
+things, and it seems to be a general direction for moving validation
+to a single centralized place, which is pluto.
+
+Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
+Signed-off-by: Andrew Cagney <cagney@gnu.org>
+---
+ include/ipsecconf/confread.h    |  1 -
+ lib/libipsecconf/confread.c     | 10 ----------
+ lib/libipsecconf/confwrite.c    |  6 ++----
+ lib/libipsecconf/starterwhack.c |  9 ++++++++-
+ 4 files changed, 10 insertions(+), 16 deletions(-)
+
+diff --git a/include/ipsecconf/confread.h b/include/ipsecconf/confread.h
+index 6e4fcb6136..d290d847ab 100644
+--- a/include/ipsecconf/confread.h
+++ b/include/ipsecconf/confread.h
+@@ -65,7 +65,6 @@ struct starter_end {
+ 	ip_address addr;
+ 	ip_address nexthop;
+ 	ip_cidr vti_ip;
+-	ip_protoport protoport;
+ 
+ 	ksf strings;
+ 	knf options;
+diff --git a/lib/libipsecconf/confread.c b/lib/libipsecconf/confread.c
+index df8ca3d456..8e681fc2df 100644
+--- a/lib/libipsecconf/confread.c
+++ b/lib/libipsecconf/confread.c
+@@ -383,16 +383,6 @@ static bool validate_end(struct starter_conn *conn_st,
+ 		}
+ 	}
+ 
+-	/* copy certificate path name */
+-
+-	if (end->set[KSCF_PROTOPORT]) {
+-		char *value = end->strings[KSCF_PROTOPORT];
+-		err_t ugh = ttoprotoport(value, &end->protoport);
+-		if (ugh != NULL)
+-			ERR_FOUND("bad %sprotoport=%s [%s]", leftright, value,
+-				  ugh);
+-	}
+-
+ 	return err;
+ #  undef ERR_FOUND
+ }
+diff --git a/lib/libipsecconf/confwrite.c b/lib/libipsecconf/confwrite.c
+index 698091ac2e..354e318e77 100644
+--- a/lib/libipsecconf/confwrite.c
+++ b/lib/libipsecconf/confwrite.c
+@@ -302,11 +302,9 @@ static void confwrite_side(FILE *out, struct starter_end *end)
+ 			str_cidr(&end->vti_ip, &as));
+ 	}
+ 
+-	if (end->protoport.is_set) {
+-		protoport_buf buf;
+	if (end->set[KSCF_PROTOPORT])
+ 		fprintf(out, "\t%sprotoport=%s\n", side,
+-			str_protoport(&end->protoport, &buf));
+-	}
+			end->strings[KSCF_PROTOPORT]);
+ 
+ 	confwrite_int(out, side,
+ 		      kv_conn | kv_leftright,
+diff --git a/lib/libipsecconf/starterwhack.c b/lib/libipsecconf/starterwhack.c
+index 3ec055bcb5..365494b7e8 100644
+--- a/lib/libipsecconf/starterwhack.c
+++ b/lib/libipsecconf/starterwhack.c
+@@ -148,7 +148,14 @@ static bool set_whack_end(struct whack_end *w,
+ 
+ 	w->subnets = l->strings[KSCF_SUBNETS];
+ 	w->host_ikeport = l->options[KNCF_IKEPORT];
+-	w->protoport = l->protoport;
+
+	if (l->set[KSCF_PROTOPORT]) {
+		char *value = l->strings[KSCF_PROTOPORT];
+		err_t ugh = ttoprotoport(value, &w->protoport);
+		if (ugh != NULL)
+			llog(RC_LOG, logger, "bad %sprotoport=%s [%s]",
+			     lr, value, ugh);
+	}
+ 
+ 	w->cert = l->strings[KSCF_CERT];
+ 	w->ckaid = l->strings[KSCF_CKAID];
+-- 
+2.48.1
+
--- a/libreswan-5.1-pexpect-negotiating-ike-sa.patch
+++ b/libreswan-5.1-pexpect-negotiating-ike-sa.patch
@ -0,0 +1,737 @@
+From d421aeb263d81bacb92e392c65910054f71f9843 Mon Sep 17 00:00:00 2001
+From: Andrew Cagney <cagney@gnu.org>
+Date: Thu, 16 Jan 2025 19:28:00 -0500
+Subject: [PATCH 1/4] revival: move state specific pexpects to
+ scheduled_{ike,child}_revival()
+
+---
+ programs/pluto/revival.c | 101 +++++++++++++++++++--------------------
+ programs/pluto/revival.h |   4 +-
+ programs/pluto/routing.c |  21 ++++++--
+ 3 files changed, 66 insertions(+), 60 deletions(-)
+
+diff --git a/programs/pluto/revival.c b/programs/pluto/revival.c
+index 0da0d7e4d2..8a2c779c18 100644
+--- a/programs/pluto/revival.c
+++ b/programs/pluto/revival.c
+@@ -191,58 +191,9 @@ static void schedule_revival_event(struct connection *c, struct logger *logger,
+ 				  (impair.revival ? "revival" : NULL), logger);
+ }
+ 
+-bool scheduled_revival(struct connection *c, struct state *st/*can be NULL*/,
+-		       const char *subplot, struct logger *logger)
+static bool scheduled_revival(struct connection *c, struct state *st/*can be NULL*/,
+			      const char *subplot, struct logger *logger)
+ {
+-	if (st != NULL) {
+-		/*
+-		 * pexpect() ST is the owner.  Routing should never
+-		 * call when it isn't.
+-		 */
+-		if (IS_CHILD_SA(st)) {
+-			if (c->negotiating_child_sa != SOS_NOBODY &&
+-			    c->negotiating_child_sa != st->st_serialno) {
+-				/*
+-				 * There's a newer SA playing with the routing.
+-				 * Presumably this is an old Child SA that is in the
+-				 * process of being rekeyed or replaced.
+-				 */
+-				llog_pexpect(st->logger, HERE,
+-					     "revival: skipping, .negotiating_child_sa "PRI_SO" is not us",
+-					     pri_so(c->negotiating_child_sa));
+-				return false;
+-			}
+-
+-			if (c->established_child_sa != SOS_NOBODY &&
+-			    c->established_child_sa != st->st_serialno) {
+-				/* should be covered by above */
+-				llog_pexpect(st->logger, HERE,
+-					     "revival: skipping, .established_child_sa "PRI_SO" is not us",
+-					     pri_so(c->established_child_sa));
+-				return false;
+-			}
+-		}
+-
+-		if (IS_IKE_SA(st)) {
+-			if (c->negotiating_ike_sa != SOS_NOBODY &&
+-			    c->negotiating_ike_sa != st->st_serialno) {
+-				/* should be covered by above */
+-				llog_pexpect(st->logger, HERE,
+-					     "revival: skipping, .negotiating_ike_sa "PRI_SO" is is not us",
+-					     pri_so(c->negotiating_ike_sa));
+-				return false;
+-			}
+-			if (c->established_ike_sa != SOS_NOBODY &&
+-			    c->established_ike_sa != st->st_serialno) {
+-				/* should be covered by above */
+-				llog_pexpect(st->logger, HERE,
+-					     "revival: skipping, .established_ike_sa "PRI_SO" is is not us",
+-					     pri_so(c->established_ike_sa));
+-				return false;
+-			}
+-		}
+-	}
+-
+ 	if (!revival_plausable(c, logger)) {
+ 		return false;
+ 	}
+@@ -275,14 +226,58 @@ bool scheduled_revival(struct connection *c, struct state *st/*can be NULL*/,
+ 
+ }
+ 
+bool scheduled_connection_revival(struct connection *c, const char *subplot)
+{
+	return scheduled_revival(c, NULL, subplot, c->logger);
+}
+
+ bool scheduled_child_revival(struct child_sa *child, const char *subplot)
+ {
+-	return scheduled_revival(child->sa.st_connection, &child->sa, subplot, child->sa.logger);
+	struct connection *c = child->sa.st_connection;
+	if (c->negotiating_child_sa != SOS_NOBODY &&
+	    c->negotiating_child_sa != child->sa.st_serialno) {
+		/*
+		 * There's a newer SA playing with the routing.
+		 * Presumably this is an old Child SA that is in the
+		 * process of being rekeyed or replaced.
+		 */
+		llog_pexpect(child->sa.logger, HERE,
+			     "revival: skipping, .negotiating_child_sa "PRI_SO" is not us",
+			     pri_so(c->negotiating_child_sa));
+		return false;
+	}
+
+	if (c->established_child_sa != SOS_NOBODY &&
+	    c->established_child_sa != child->sa.st_serialno) {
+		/* should be covered by above */
+		llog_pexpect(child->sa.logger, HERE,
+			     "revival: skipping, .established_child_sa "PRI_SO" is not us",
+			     pri_so(c->established_child_sa));
+		return false;
+	}
+	return scheduled_revival(c, &child->sa, subplot, child->sa.logger);
+ }
+ 
+ bool scheduled_ike_revival(struct ike_sa *ike, const char *subplot)
+ {
+-	return scheduled_revival(ike->sa.st_connection, &ike->sa, subplot, ike->sa.logger);
+	struct connection *c = ike->sa.st_connection;
+	if (c->negotiating_ike_sa != SOS_NOBODY &&
+	    c->negotiating_ike_sa != ike->sa.st_serialno) {
+		/* should be covered by above */
+		llog_pexpect(ike->sa.logger, HERE,
+			     "revival: skipping, .negotiating_ike_sa "PRI_SO" is is not us",
+			     pri_so(c->negotiating_ike_sa));
+		return false;
+	}
+	if (c->established_ike_sa != SOS_NOBODY &&
+	    c->established_ike_sa != ike->sa.st_serialno) {
+		/* should be covered by above */
+		llog_pexpect(ike->sa.logger, HERE,
+			     "revival: skipping, .established_ike_sa "PRI_SO" is is not us",
+			     pri_so(c->established_ike_sa));
+		return false;
+	}
+	return scheduled_revival(c, &ike->sa, subplot, ike->sa.logger);
+ }
+ 
+ void revive_connection(struct connection *c, const char *subplot,
+diff --git a/programs/pluto/revival.h b/programs/pluto/revival.h
+index dad6705301..13b00980dd 100644
+--- a/programs/pluto/revival.h
+++ b/programs/pluto/revival.h
+@@ -25,14 +25,12 @@ struct timer_event;
+ void revive_connection(struct connection *c, const char *subplot,
+ 		       const threadtime_t *inception);
+ 
+-bool scheduled_revival(struct connection *c, struct state *st, /*could-be-NULL*/
+-		       const char *subplot, struct logger *logger);
+-
+ /*
+  * As in the SA's connection should be kept up so the call scheduled a
+  * revival.  Caller should adjust routing accordingly.
+  */
+ 
+bool scheduled_connection_revival(struct connection *c, const char *subplot);
+ bool scheduled_child_revival(struct child_sa *child, const char *subplot);
+ bool scheduled_ike_revival(struct ike_sa *ike, const char *subplot);
+ 
+diff --git a/programs/pluto/routing.c b/programs/pluto/routing.c
+index 91115ab081..dd9b39721c 100644
+--- a/programs/pluto/routing.c
+++ b/programs/pluto/routing.c
+@@ -104,14 +104,27 @@ static bool connection_cannot_die(enum routing_event event,
+ 				  struct logger *logger,
+ 				  const struct routing_annex *e)
+ {
+-	struct state *st = (e->child != NULL && (*e->child) != NULL ? &(*e->child)->sa :
+-			    e->ike != NULL && (*e->ike) != NULL ? &(*e->ike)->sa :
+-			    NULL);
+ 	const char *subplot = (event == CONNECTION_TEARDOWN_IKE ? e->story :
+ 			       event == CONNECTION_TEARDOWN_CHILD ? e->story :
+ 			       event == CONNECTION_RESCHEDULE ? e->story :
+ 			       "???");
+-	return scheduled_revival(c, st, subplot, logger);
+	if (e->child != NULL) {
+		struct child_sa *child = (*e->child);
+		if (child != NULL) {
+			PEXPECT(logger, child->sa.st_connection == c);
+			return scheduled_child_revival(child, subplot);
+		}
+	}
+
+	if (e->ike != NULL) {
+		struct ike_sa *ike = (*e->ike);
+		if (ike != NULL) {
+			PEXPECT(logger, ike->sa.st_connection == c);
+			return scheduled_ike_revival(ike, subplot);
+		}
+	}
+
+	return scheduled_connection_revival(c, subplot);
+ }
+ 
+ static void jam_sa(struct jambuf *buf, struct state *st, const char **sep)
+-- 
+2.48.1
+
+
+From e474d36c43798898fa89d28ba302868399329f95 Mon Sep 17 00:00:00 2001
+From: Andrew Cagney <cagney@gnu.org>
+Date: Thu, 16 Jan 2025 20:20:24 -0500
+Subject: [PATCH 2/4] revival: don't expect the IKE SA have
+ .{established,negotiating}_ike_sa
+
+A crossing stream where this end initiated the connection's
+IKE SA but is then crossed by the peer establishing the
+connection's IKE SA only to connswitch to another
+connection for the Child SA - leaves .negotiating_sa
+but nothing else.
+
+see #1989 EXPECTATION FAILED: revival: skipping, .negotiating_ike_sa is not us
+---
+ programs/pluto/revival.c | 25 +++++++++++++++----------
+ 1 file changed, 15 insertions(+), 10 deletions(-)
+
+diff --git a/programs/pluto/revival.c b/programs/pluto/revival.c
+index 8a2c779c18..fe76d1039e 100644
+--- a/programs/pluto/revival.c
+++ b/programs/pluto/revival.c
+@@ -261,21 +261,26 @@ bool scheduled_child_revival(struct child_sa *child, const char *subplot)
+ bool scheduled_ike_revival(struct ike_sa *ike, const char *subplot)
+ {
+ 	struct connection *c = ike->sa.st_connection;
+-	if (c->negotiating_ike_sa != SOS_NOBODY &&
+-	    c->negotiating_ike_sa != ike->sa.st_serialno) {
+-		/* should be covered by above */
+	if (c->routing_sa != ike->sa.st_serialno) {
+ 		llog_pexpect(ike->sa.logger, HERE,
+-			     "revival: skipping, .negotiating_ike_sa "PRI_SO" is is not us",
+-			     pri_so(c->negotiating_ike_sa));
+			     "revival: skipping, .routing_sa "PRI_SO" is is not us",
+			     pri_so(c->routing_sa));
+ 		return false;
+ 	}
+	if (c->negotiating_ike_sa != SOS_NOBODY &&
+	    c->negotiating_ike_sa != ike->sa.st_serialno) {
+		/*
+		 * For instance, crossing stream establishes IKE SA,
+		 * but some other Child SA, leaving .routing_sa
+		 * hanging.
+		 */
+		ldbg(ike->sa.logger, "revival: .negotiating_ike_sa "PRI_SO" is is not us",
+		     pri_so(c->negotiating_ike_sa));
+	}
+ 	if (c->established_ike_sa != SOS_NOBODY &&
+ 	    c->established_ike_sa != ike->sa.st_serialno) {
+-		/* should be covered by above */
+-		llog_pexpect(ike->sa.logger, HERE,
+-			     "revival: skipping, .established_ike_sa "PRI_SO" is is not us",
+-			     pri_so(c->established_ike_sa));
+-		return false;
+		ldbg(ike->sa.logger, "revival: .established_ike_sa "PRI_SO" is is not us",
+		     pri_so(c->established_ike_sa));
+ 	}
+ 	return scheduled_revival(c, &ike->sa, subplot, ike->sa.logger);
+ }
+-- 
+2.48.1
+
+
+From c70b4bf00dee27d35a438bdac9ed78ea76127384 Mon Sep 17 00:00:00 2001
+From: Andrew Cagney <cagney@gnu.org>
+Date: Thu, 16 Jan 2025 17:22:09 -0500
+Subject: [PATCH 3/4] testing: add WIP
+ crossing-streams-23-conswitch-ike-sa-init-ikev2, see #1989
+
+---
+ testing/pluto/TESTLIST                        |   1 +
+ .../01-east-init.sh                           |  11 ++
+ .../02-west-init.sh                           |   9 ++
+ .../03-west-ike-sa-init.sh                    |  13 +++
+ .../04-east-establish.sh                      |   6 ++
+ .../05-west-crossing-stream.sh                |   9 ++
+ .../description.txt                           |  34 ++++++
+ .../east.console.txt                          |  74 +++++++++++++
+ .../final.sh                                  |   6 ++
+ .../ipsec.conf                                |  32 ++++++
+ .../ipsec.secrets                             |   1 +
+ .../west.console.txt                          | 101 ++++++++++++++++++
+ 12 files changed, 297 insertions(+)
+ create mode 100755 testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/01-east-init.sh
+ create mode 100755 testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/02-west-init.sh
+ create mode 100644 testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/03-west-ike-sa-init.sh
+ create mode 100644 testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/04-east-establish.sh
+ create mode 100644 testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/05-west-crossing-stream.sh
+ create mode 100644 testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/description.txt
+ create mode 100644 testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/east.console.txt
+ create mode 100755 testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/final.sh
+ create mode 100644 testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/ipsec.conf
+ create mode 100644 testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/ipsec.secrets
+ create mode 100644 testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/west.console.txt
+
+diff --git a/testing/pluto/TESTLIST b/testing/pluto/TESTLIST
+index 49d65fb534..24697f3786 100644
+--- a/testing/pluto/TESTLIST
+++ b/testing/pluto/TESTLIST
+@@ -1562,6 +1562,7 @@ kvmplutotest	crossing-streams-20-peer-restarts-ondemand-ike-auth	good	github/163
+ 
+ kvmplutotest	crossing-streams-21-second-child-crypto-ikev2	good
+ kvmplutotest	crossing-streams-22-ikev2-ipsec-interface	wip	github:557
+kvmplutotest	crossing-streams-23-conswitch-ike-sa-init-ikev2	wip	github/1989
+ 
+ # uses the kernel-pfkeyv2.c code
+ 
+diff --git a/testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/01-east-init.sh b/testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/01-east-init.sh
+new file mode 100755
+index 0000000000..5eac31179d
+--- /dev/null
+++ b/testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/01-east-init.sh
+@@ -0,0 +1,11 @@
+/testing/guestbin/swan-prep --nokey
+
+../../guestbin/ifconfig.sh eth0 add 192.0.20.254/24
+
+ipsec start
+../../guestbin/wait-until-pluto-started
+
+ipsec whack --impair suppress_retransmits
+
+ipsec add a
+ipsec add b
+diff --git a/testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/02-west-init.sh b/testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/02-west-init.sh
+new file mode 100755
+index 0000000000..3690498351
+--- /dev/null
+++ b/testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/02-west-init.sh
+@@ -0,0 +1,9 @@
+/testing/guestbin/swan-prep --nokey
+ipsec start
+../../guestbin/wait-until-pluto-started
+
+ipsec whack --impair suppress_retransmits
+
+# note order
+ipsec add a
+ipsec add b
+diff --git a/testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/03-west-ike-sa-init.sh b/testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/03-west-ike-sa-init.sh
+new file mode 100644
+index 0000000000..65837088f5
+--- /dev/null
+++ b/testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/03-west-ike-sa-init.sh
+@@ -0,0 +1,13 @@
+# Initiate "a" with all packets blocked.
+#
+# This will create the negotiating IKE SA #1, and then hang.
+
+ipsec whack --impair block_outbound:yes
+ipsec up a --asynchronous
+../../guestbin/wait-for-pluto.sh --match '"a" #1: IMPAIR: blocking outbound message 1'
+../../guestbin/wait-for-pluto.sh --match '"a" #1: sent IKE_SA_INIT request'
+
+# With connection "a"'s IKE SA #1 stuck, unblock so that the peer's
+# IKE SA #2, which will cross "a", can establish
+
+ipsec whack --impair block_outbound:no
+diff --git a/testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/04-east-establish.sh b/testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/04-east-establish.sh
+new file mode 100644
+index 0000000000..668613881b
+--- /dev/null
+++ b/testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/04-east-establish.sh
+@@ -0,0 +1,6 @@
+# Initiate "b" from EAST.
+#
+# On WEST this is will match and establish connection "a" with IKE SA
+# #2, and then switch to connection "b" for Child SA #3.
+
+ipsec up b
+diff --git a/testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/05-west-crossing-stream.sh b/testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/05-west-crossing-stream.sh
+new file mode 100644
+index 0000000000..dc8387a82f
+--- /dev/null
+++ b/testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/05-west-crossing-stream.sh
+@@ -0,0 +1,9 @@
+# confirm that the peer's IKE SA established "a", and then the peer's
+# Child SA needed to switch to "b" before establishing.
+
+../../guestbin/wait-for-pluto.sh --match '"a" #2: responder established IKE SA'
+../../guestbin/wait-for-pluto.sh --match '"a" #3: switched to "b"'
+../../guestbin/wait-for-pluto.sh --match '"b" #3: responder established Child SA using #2'
+
+# this is where pluto realises that the stream crossed
+../../guestbin/wait-for-pluto.sh --match '#1: dropping negotiation'
+diff --git a/testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/description.txt b/testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/description.txt
+new file mode 100644
+index 0000000000..52806b90d5
+--- /dev/null
+++ b/testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/description.txt
+@@ -0,0 +1,34 @@
+IKE exchange crosses, initiator conswitches peer's child leaving local ike hanging
+
+each end has two connections that can share their IKE SA
+
+- WEST sends "a":IKE_SA_INIT to EAST
+  - creates IKE SA #1
+  - initiator sets "a".{routing,negotiating}_ike_sa to #1
+
+- EAST sends "b":IKE_SA_INIT to WEST
+
+- WEST responds to EAST'S "b":IKE_SA_INIT
+  - creates IKE_SA #2 using connection "a"
+  - responder leaves "a".{routing,negotiating}_ike_sa et.al. untouched
+
+- EAST sends "b":IKE_AUTH to WEST
+
+- WEST responds to EAST's "b":IKE_AUTH
+  IKE
+  - establishes IKE SA #2
+  - sets "a".{established,negotiating}_ike_sa #2
+  - leaves "a".routing_sa set to #1
+  Child:
+  - creates Child SA #3
+  - connswitches Child SA #3 to "b"
+  - establishes Child SA #3
+  - sets "b".{routing,negotiating,established}_child_sa to #3
+
+- WEST retransmits "a":IKE_SA_INIT #1 to EAST
+  - sees .established_ike_sa(?) is #2 stops negotiation
+    "tun-out-1" #1: suppressing retransmit because IKE SA was superseded #2; drop this negotiation
+  - tries to revive:
+    EXPECTATION FAILED: "a" #1: revival: skipping, .negotiating_ike_sa #2 is is not us
+
+ref github #1989
+diff --git a/testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/east.console.txt b/testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/east.console.txt
+new file mode 100644
+index 0000000000..d386cabf02
+--- /dev/null
+++ b/testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/east.console.txt
+@@ -0,0 +1,74 @@
+/testing/guestbin/swan-prep --nokey
+Creating empty NSS database
+east #
+ ../../guestbin/ifconfig.sh eth0 add 192.0.20.254/24
+    inet 192.0.20.254/24 scope global eth0
+east #
+ ipsec start
+Redirecting to: [initsystem]
+east #
+ ../../guestbin/wait-until-pluto-started
+east #
+ ipsec whack --impair suppress_retransmits
+east #
+ ipsec add a
+"a": added IKEv2 connection
+east #
+ ipsec add b
+"b": added IKEv2 connection
+east #
+ # Initiate "b" from EAST.
+east #
+ #
+east #
+ # On WEST this is will match and establish connection "a" with IKE SA
+east #
+ # #2, and then switch to connection "b" for Child SA #3.
+east #
+ ipsec up b
+"b" #1: initiating IKEv2 connection to 192.1.2.45 using UDP
+"b" #1: sent IKE_SA_INIT request to 192.1.2.45:UDP/500
+"b" #1: processed IKE_SA_INIT response from 192.1.2.45:UDP/500 {cipher=AES_GCM_16_256 integ=n/a prf=HMAC_SHA2_512 group=DH19}, initiating IKE_AUTH
+"b" #1: sent IKE_AUTH request to 192.1.2.45:UDP/500
+"b" #1: initiator established IKE SA; authenticated peer using authby=secret and ID_FQDN '@west'
+"b" #2: initiator established Child SA using #1; IPsec tunnel [192.0.20.0/24===192.0.3.0/24] {ESP/ESN=>0xESPESP <0xESPESP xfrm=AES_GCM_16_256-NONE DPD=passive}
+east #
+ # non-zero counts confirm encrypted traffic flowing
+east #
+ ipsec trafficstatus
+#2: "b", type=ESP, add_time=1234567890, inBytes=0, outBytes=0, maxBytes=2^63B, id='@west'
+east #
+ # do things line up?
+east #
+ ../../guestbin/ipsec-kernel-state.sh
+src 192.1.2.23 dst 192.1.2.45
+	proto esp spi 0xSPISPI reqid REQID mode tunnel
+	replay-window 0 flag af-unspec esn
+	aead rfc4106(gcm(aes)) 0xENCAUTHKEY 128
+	anti-replay esn context:
+	 seq-hi 0x0, seq 0xXX, oseq-hi 0x0, oseq 0xXX
+	 replay_window 0, bitmap-length 0
+src 192.1.2.45 dst 192.1.2.23
+	proto esp spi 0xSPISPI reqid REQID mode tunnel
+	replay-window 0 flag af-unspec esn
+	aead rfc4106(gcm(aes)) 0xENCAUTHKEY 128
+	anti-replay esn context:
+	 seq-hi 0x0, seq 0xXX, oseq-hi 0x0, oseq 0xXX
+	 replay_window 128, bitmap-length 4
+	 00000000 00000000 00000000 XXXXXXXX 
+east #
+ ../../guestbin/ipsec-kernel-policy.sh
+src 192.0.3.0/24 dst 192.0.20.0/24
+	dir fwd priority PRIORITY ptype main
+	tmpl src 192.1.2.45 dst 192.1.2.23
+		proto esp reqid REQID mode tunnel
+src 192.0.3.0/24 dst 192.0.20.0/24
+	dir in priority PRIORITY ptype main
+	tmpl src 192.1.2.45 dst 192.1.2.23
+		proto esp reqid REQID mode tunnel
+src 192.0.20.0/24 dst 192.0.3.0/24
+	dir out priority PRIORITY ptype main
+	tmpl src 192.1.2.23 dst 192.1.2.45
+		proto esp reqid REQID mode tunnel
+east #
+ 
+diff --git a/testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/final.sh b/testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/final.sh
+new file mode 100755
+index 0000000000..c84a482b6a
+--- /dev/null
+++ b/testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/final.sh
+@@ -0,0 +1,6 @@
+# non-zero counts confirm encrypted traffic flowing
+ipsec trafficstatus
+
+# do things line up?
+../../guestbin/ipsec-kernel-state.sh
+../../guestbin/ipsec-kernel-policy.sh
+diff --git a/testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/ipsec.conf b/testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/ipsec.conf
+new file mode 100644
+index 0000000000..cb3d584bc2
+--- /dev/null
+++ b/testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/ipsec.conf
+@@ -0,0 +1,32 @@
+config setup
+	logfile=/tmp/pluto.log
+	logtime=no
+	logappend=no
+	dumpdir=/var/tmp
+	plutodebug=all
+	nhelpers=0
+
+conn base
+	keyexchange=ikev2
+	auto=ignore
+	# host
+	left=192.1.2.45
+	right=192.1.2.23
+	# auth
+	leftid=@west
+	rightid=@east
+	authby=secret
+	leftsubnet=192.0.3.0/24
+	retransmit-timeout=10s
+
+conn a
+	also=base
+	# client
+	leftsourceip=192.0.3.253
+	rightsubnet=192.0.2.0/24
+
+conn b
+	also=base
+	# client
+	leftsourceip=192.0.3.254
+	rightsubnet=192.0.20.0/24
+diff --git a/testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/ipsec.secrets b/testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/ipsec.secrets
+new file mode 100644
+index 0000000000..d3ed5698d0
+--- /dev/null
+++ b/testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/ipsec.secrets
+@@ -0,0 +1 @@
+@west @east : PSK "ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890"
+diff --git a/testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/west.console.txt b/testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/west.console.txt
+new file mode 100644
+index 0000000000..00c98494e5
+--- /dev/null
+++ b/testing/pluto/crossing-streams-23-conswitch-ike-sa-init-ikev2/west.console.txt
+@@ -0,0 +1,101 @@
+/testing/guestbin/swan-prep --nokey
+Creating empty NSS database
+west #
+ ipsec start
+Redirecting to: [initsystem]
+west #
+ ../../guestbin/wait-until-pluto-started
+west #
+ ipsec whack --impair suppress_retransmits
+west #
+ # note order
+west #
+ ipsec add a
+"a": added IKEv2 connection
+west #
+ ipsec add b
+"b": added IKEv2 connection
+west #
+ # Initiate "a" with all packets blocked.
+west #
+ #
+west #
+ # This will create the negotiating IKE SA #1, and then hang.
+west #
+ ipsec whack --impair block_outbound:yes
+IMPAIR: recording all outbound messages
+IMPAIR: block all outbound messages: no -> yes
+west #
+ ipsec up a --asynchronous
+"a" #1: initiating IKEv2 connection to 192.1.2.23 using UDP
+west #
+ ../../guestbin/wait-for-pluto.sh --match '"a" #1: IMPAIR: blocking outbound message 1'
+"a" #1: IMPAIR: blocking outbound message 1
+west #
+ ../../guestbin/wait-for-pluto.sh --match '"a" #1: sent IKE_SA_INIT request'
+"a" #1: sent IKE_SA_INIT request to 192.1.2.23:UDP/500
+west #
+ # With connection "a"'s IKE SA #1 stuck, unblock so that the peer's
+west #
+ # IKE SA #2, which will cross "a", can establish
+west #
+ ipsec whack --impair block_outbound:no
+IMPAIR: block all outbound messages: yes -> no
+west #
+ # confirm that the peer's IKE SA established "a", and then the peer's
+west #
+ # Child SA needed to switch to "b" before establishing.
+west #
+ ../../guestbin/wait-for-pluto.sh --match '"a" #2: responder established IKE SA'
+"a" #2: responder established IKE SA; authenticated peer using authby=secret and ID_FQDN '@east'
+west #
+ ../../guestbin/wait-for-pluto.sh --match '"a" #3: switched to "b"'
+"a" #3: switched to "b"
+west #
+ ../../guestbin/wait-for-pluto.sh --match '"b" #3: responder established Child SA using #2'
+"b" #3: responder established Child SA using #2; IPsec tunnel [192.0.3.0/24===192.0.20.0/24] {ESP/ESN=>0xESPESP <0xESPESP xfrm=AES_GCM_16_256-NONE DPD=passive}
+west #
+ # this is where pluto realises that the stream crossed
+west #
+ ../../guestbin/wait-for-pluto.sh --match '#1: dropping negotiation'
+"a" #1: dropping negotiation as superseeded by established IKE SA #2
+west #
+ # non-zero counts confirm encrypted traffic flowing
+west #
+ ipsec trafficstatus
+#3: "b", type=ESP, add_time=1234567890, inBytes=0, outBytes=0, maxBytes=2^63B, id='@east'
+west #
+ # do things line up?
+west #
+ ../../guestbin/ipsec-kernel-state.sh
+src 192.1.2.45 dst 192.1.2.23
+	proto esp spi 0xSPISPI reqid REQID mode tunnel
+	replay-window 0 flag af-unspec esn
+	aead rfc4106(gcm(aes)) 0xENCAUTHKEY 128
+	anti-replay esn context:
+	 seq-hi 0x0, seq 0xXX, oseq-hi 0x0, oseq 0xXX
+	 replay_window 0, bitmap-length 0
+src 192.1.2.23 dst 192.1.2.45
+	proto esp spi 0xSPISPI reqid REQID mode tunnel
+	replay-window 0 flag af-unspec esn
+	aead rfc4106(gcm(aes)) 0xENCAUTHKEY 128
+	anti-replay esn context:
+	 seq-hi 0x0, seq 0xXX, oseq-hi 0x0, oseq 0xXX
+	 replay_window 128, bitmap-length 4
+	 00000000 00000000 00000000 XXXXXXXX 
+west #
+ ../../guestbin/ipsec-kernel-policy.sh
+src 192.0.3.0/24 dst 192.0.20.0/24
+	dir out priority PRIORITY ptype main
+	tmpl src 192.1.2.45 dst 192.1.2.23
+		proto esp reqid REQID mode tunnel
+src 192.0.20.0/24 dst 192.0.3.0/24
+	dir fwd priority PRIORITY ptype main
+	tmpl src 192.1.2.23 dst 192.1.2.45
+		proto esp reqid REQID mode tunnel
+src 192.0.20.0/24 dst 192.0.3.0/24
+	dir in priority PRIORITY ptype main
+	tmpl src 192.1.2.23 dst 192.1.2.45
+		proto esp reqid REQID mode tunnel
+west #
+ 
+-- 
+2.48.1
+
+
+From ee7a62dc7f400f4b830e64e0385a6d16fda234b3 Mon Sep 17 00:00:00 2001
+From: Andrew Cagney <cagney@gnu.org>
+Date: Mon, 6 Jan 2025 15:38:03 -0500
+Subject: [PATCH 4/4] ikev2: in event_v2_retransmit() check .established_ike_sa
+ != SOS_NOBODY
+
+That is:
+   !IS_IKE_SA_ESTABLISHED(&ike->sa) && c->established_ike_sa != SOS_NOBODY
+when the streams cross, the etablished IKE SA may be older.
+---
+ programs/pluto/ikev2_retransmit.c | 32 ++++++++++++++++++++-----------
+ 1 file changed, 21 insertions(+), 11 deletions(-)
+
+diff --git a/programs/pluto/ikev2_retransmit.c b/programs/pluto/ikev2_retransmit.c
+index df6ab99e63..7b0197445c 100644
+--- a/programs/pluto/ikev2_retransmit.c
+++ b/programs/pluto/ikev2_retransmit.c
+@@ -49,25 +49,35 @@ void event_v2_retransmit(struct state *ike_sa, monotime_t now UNUSED)
+ 		return;
+ 	}
+ 
+-	/* if this connection has a newer Child SA than this state
+-	 * this negotiation is not relevant any more.  would this
+-	 * cover if there are multiple CREATE_CHILD_SA pending on this
+-	 * IKE negotiation ???
+-	 *
+	/*
+ 	 * XXX: Suspect this is to handle a race where the other end
+ 	 * brings up the connection first?  For that case, shouldn't
+ 	 * this state have been deleted?
+ 	 *
+-	 * NOTE: a larger serialno does not mean superseded. crossed
+	 * NOTE: a larger serialno does not mean superseded.  Crossed
+ 	 * streams could mean the lower serial established later and
+-	 * is the "newest". Should > be replaced with != ?
+	 * is the "newest".  Hence the equality check (and not >).
+ 	 */
+ 
+ 	struct connection *c = ike->sa.st_connection;
+-	if (!IS_IKE_SA_ESTABLISHED(&ike->sa) && c->established_ike_sa > ike->sa.st_serialno) {
+-		llog_sa(RC_LOG, ike,
+-			  "suppressing retransmit because IKE SA was superseded #%lu; drop this negotiation",
+-			  c->established_ike_sa);
+	if (!IS_IKE_SA_ESTABLISHED(&ike->sa) && c->established_ike_sa != SOS_NOBODY) {
+		/*
+		 * The connection is established, yet this IKE SA is
+		 * not.  Presumably this means that the peer also
+		 * initiated and established an IKE SA leaving this
+		 * IKE SA in limbo.
+		 *
+		 * Note: since it isn't established it can't be the
+		 * connection's established IKE SA.
+		 *
+		 * Note: this may also leave the Child SA for the
+		 * connection in limbo.  Hopefully revival code will
+		 * pick that up.
+		 */
+		PEXPECT(ike->sa.logger, c->established_ike_sa != ike->sa.st_serialno);
+		llog(RC_LOG, ike->sa.logger,
+		     "suppressing retransmit because IKE SA was superseded by #%lu; drop this negotiation",
+		     c->established_ike_sa);
+ 		pstat_sa_failed(&ike->sa, REASON_SUPERSEDED_BY_NEW_SA);
+ 		connection_delete_ike_family(&ike, HERE);
+ 		return;
+-- 
+2.48.1
+
--- a/libreswan-5.1-rereadsecrets.patch
+++ b/libreswan-5.1-rereadsecrets.patch
@ -0,0 +1,583 @@
+From dfb8a1244c7c902e0daa6ae19fe4b4171297ad95 Mon Sep 17 00:00:00 2001
+From: Daiki Ueno <dueno@redhat.com>
+Date: Sat, 23 Nov 2024 10:18:03 +0900
+Subject: [PATCH 1/2] secrets: allocate secret_pubkey_stuff separately from
+ heap
+
+Signed-off-by: Daiki Ueno <dueno@redhat.com>
+---
+ include/secrets.h                             |  2 +-
+ lib/libswan/pubkey_ecdsa.c                    | 10 +++---
+ lib/libswan/pubkey_rsa.c                      | 18 +++++------
+ .../secret_pubkey_stuff_to_pubkey_der.c       |  2 +-
+ lib/libswan/secrets.c                         | 32 ++++++++++---------
+ programs/pluto/ikev2_eap.c                    |  2 +-
+ programs/pluto/keys.c                         |  6 ++--
+ programs/showhostkey/showhostkey.c            | 32 +++++++++++--------
+ 8 files changed, 55 insertions(+), 49 deletions(-)
+
+diff --git a/include/secrets.h b/include/secrets.h
+index 8f9f990c10..c9272d71e0 100644
+--- a/include/secrets.h
+++ b/include/secrets.h
+@@ -88,7 +88,7 @@ struct secret_stuff {
+ 	int line;
+ 	union {
+ 		chunk_t preshared_secret;
+-		struct secret_pubkey_stuff pubkey;
+		struct secret_pubkey_stuff *pubkey;
+ 	} u;
+ 
+ 	chunk_t ppk;
+diff --git a/lib/libswan/pubkey_ecdsa.c b/lib/libswan/pubkey_ecdsa.c
+index f8d0fe5dae..a4250d9356 100644
+--- a/lib/libswan/pubkey_ecdsa.c
+++ b/lib/libswan/pubkey_ecdsa.c
+@@ -288,7 +288,7 @@ static struct hash_signature ECDSA_raw_sign_hash(const struct secret_stuff *pks,
+ {
+ 	ldbgf(DBG_CRYPT, logger, "%s: started using NSS", __func__);
+ 
+-	if (!pexpect(pks->u.pubkey.private_key != NULL)) {
+	if (!pexpect(pks->u.pubkey->private_key != NULL)) {
+ 		dbg("no private key!");
+ 		return (struct hash_signature) { .len = 0, };
+ 	}
+@@ -304,7 +304,7 @@ static struct hash_signature ECDSA_raw_sign_hash(const struct secret_stuff *pks,
+ 	/* point signature at the SIG_VAL buffer */
+ 	struct hash_signature signature = {0};
+ 	SECItem raw_signature;
+-	SECStatus s = SGN_Digest(pks->u.pubkey.private_key,
+	SECStatus s = SGN_Digest(pks->u.pubkey->private_key,
+ 				 hash_alg->nss.oid_tag,
+ 				 &raw_signature, &hash_to_sign);
+ 	if (s != SECSuccess) {
+@@ -411,7 +411,7 @@ static struct hash_signature ECDSA_digsig_sign_hash(const struct secret_stuff *p
+ 						    struct logger *logger)
+ {
+ 
+-	if (!pexpect(pks->u.pubkey.private_key != NULL)) {
+	if (!pexpect(pks->u.pubkey->private_key != NULL)) {
+ 		dbg("no private key!");
+ 		return (struct hash_signature) { .len = 0, };
+ 	}
+@@ -429,14 +429,14 @@ static struct hash_signature ECDSA_digsig_sign_hash(const struct secret_stuff *p
+ 	uint8_t raw_signature_data[sizeof(struct hash_signature)];
+ 	SECItem raw_signature = {
+ 		.type = siBuffer,
+-		.len = PK11_SignatureLen(pks->u.pubkey.private_key),
+		.len = PK11_SignatureLen(pks->u.pubkey->private_key),
+ 		.data = raw_signature_data,
+ 	};
+ 	passert(raw_signature.len <= sizeof(raw_signature_data));
+ 	dbg("ECDSA signature.len %d", raw_signature.len);
+ 
+ 	/* create the raw signature */
+-	SECStatus s = PK11_Sign(pks->u.pubkey.private_key, &raw_signature, &hash_to_sign);
+	SECStatus s = PK11_Sign(pks->u.pubkey->private_key, &raw_signature, &hash_to_sign);
+ 	if (DBGP(DBG_CRYPT)) {
+ 		DBG_dump("sig_from_nss", raw_signature.data, raw_signature.len);
+ 	}
+diff --git a/lib/libswan/pubkey_rsa.c b/lib/libswan/pubkey_rsa.c
+index 78620620d6..796748bdaa 100644
+--- a/lib/libswan/pubkey_rsa.c
+++ b/lib/libswan/pubkey_rsa.c
+@@ -350,7 +350,7 @@ static struct hash_signature RSA_sign_hash_raw_rsa(const struct secret_stuff *pk
+ 		return (struct hash_signature) { .len = 0, };
+ 	}
+ 
+-	if (!pexpect(pks->u.pubkey.private_key != NULL)) {
+	if (!pexpect(pks->u.pubkey->private_key != NULL)) {
+ 		dbg("no private key!");
+ 		return (struct hash_signature) { .len = 0, };
+ 	}
+@@ -361,7 +361,7 @@ static struct hash_signature RSA_sign_hash_raw_rsa(const struct secret_stuff *pk
+ 		.data = DISCARD_CONST(uint8_t *, hash_val),
+ 	};
+ 
+-	struct hash_signature sig = { .len = PK11_SignatureLen(pks->u.pubkey.private_key), };
+	struct hash_signature sig = { .len = PK11_SignatureLen(pks->u.pubkey->private_key), };
+ 	passert(sig.len <= sizeof(sig.ptr/*array*/));
+ 	SECItem signature = {
+ 		.type = siBuffer,
+@@ -369,7 +369,7 @@ static struct hash_signature RSA_sign_hash_raw_rsa(const struct secret_stuff *pk
+ 		.data = sig.ptr,
+ 	};
+ 
+-	SECStatus s = PK11_Sign(pks->u.pubkey.private_key, &signature, &data);
+	SECStatus s = PK11_Sign(pks->u.pubkey->private_key, &signature, &data);
+ 	if (s != SECSuccess) {
+ 		/* PR_GetError() returns the thread-local error */
+ 		llog_nss_error(RC_LOG, logger,
+@@ -485,7 +485,7 @@ static struct hash_signature RSA_sign_hash_pkcs1_1_5_rsa(const struct secret_stu
+ {
+ 	dbg("%s: started using NSS", __func__);
+ 
+-	if (!pexpect(pks->u.pubkey.private_key != NULL)) {
+	if (!pexpect(pks->u.pubkey->private_key != NULL)) {
+ 		dbg("no private key!");
+ 		return (struct hash_signature) { .len = 0, };
+ 	}
+@@ -501,7 +501,7 @@ static struct hash_signature RSA_sign_hash_pkcs1_1_5_rsa(const struct secret_stu
+ 	 * used to generate the signature.
+ 	 */
+ 	SECItem signature_result = {0};
+-	SECStatus s = SGN_Digest(pks->u.pubkey.private_key,
+	SECStatus s = SGN_Digest(pks->u.pubkey->private_key,
+ 				 hash_algo->nss.oid_tag,
+ 				 &signature_result, &digest);
+ 	if (s != SECSuccess) {
+@@ -516,7 +516,7 @@ static struct hash_signature RSA_sign_hash_pkcs1_1_5_rsa(const struct secret_stu
+ 	/* save the signature, free the returned pointer */
+ 
+ 	struct hash_signature signature = {
+-		.len = PK11_SignatureLen(pks->u.pubkey.private_key),
+		.len = PK11_SignatureLen(pks->u.pubkey->private_key),
+ 	};
+ 	passert(signature.len <= sizeof(signature.ptr/*array*/));
+ 	memcpy(signature.ptr, signature_result.data, signature.len);
+@@ -629,7 +629,7 @@ static struct hash_signature RSA_sign_hash_rsassa_pss(const struct secret_stuff
+ {
+ 	dbg("%s: started using NSS", __func__);
+ 
+-	if (!pexpect(pks->u.pubkey.private_key != NULL)) {
+	if (!pexpect(pks->u.pubkey->private_key != NULL)) {
+ 		dbg("no private key!");
+ 		return (struct hash_signature) { .len = 0, };
+ 	}
+@@ -640,7 +640,7 @@ static struct hash_signature RSA_sign_hash_rsassa_pss(const struct secret_stuff
+ 		.data = DISCARD_CONST(uint8_t *, hash_val),
+ 	};
+ 
+-	struct hash_signature sig = { .len = PK11_SignatureLen(pks->u.pubkey.private_key), };
+	struct hash_signature sig = { .len = PK11_SignatureLen(pks->u.pubkey->private_key), };
+ 	passert(sig.len <= sizeof(sig.ptr/*array*/));
+ 	SECItem signature = {
+ 		.type = siBuffer,
+@@ -661,7 +661,7 @@ static struct hash_signature RSA_sign_hash_rsassa_pss(const struct secret_stuff
+ 		.data = (void*)mech, /* strip const */
+ 		.len = sizeof(*mech),
+ 	};
+-	SECStatus s = PK11_SignWithMechanism(pks->u.pubkey.private_key, CKM_RSA_PKCS_PSS,
+	SECStatus s = PK11_SignWithMechanism(pks->u.pubkey->private_key, CKM_RSA_PKCS_PSS,
+ 					     &mech_item, &signature, &data);
+ 	if (s != SECSuccess) {
+ 		/* PR_GetError() returns the thread-local error */
+diff --git a/lib/libswan/secret_pubkey_stuff_to_pubkey_der.c b/lib/libswan/secret_pubkey_stuff_to_pubkey_der.c
+index 1b5de6917e..3f28cbd765 100644
+--- a/lib/libswan/secret_pubkey_stuff_to_pubkey_der.c
+++ b/lib/libswan/secret_pubkey_stuff_to_pubkey_der.c
+@@ -32,7 +32,7 @@ static diag_t seckey_pubkey_to_der(SECKEYPublicKey *seckey_pubkey, chunk_t *der)
+ 
+ diag_t secret_pubkey_stuff_to_pubkey_der(struct secret_stuff *pks, chunk_t *der)
+ {
+-	SECKEYPublicKey *seckey_pubkey = SECKEY_ConvertToPublicKey(pks->u.pubkey.private_key);
+	SECKEYPublicKey *seckey_pubkey = SECKEY_ConvertToPublicKey(pks->u.pubkey->private_key);
+ 	if (seckey_pubkey == NULL) {
+ 		return diag_nss_error("extracting Public Key from Private Key");
+ 	}
+diff --git a/lib/libswan/secrets.c b/lib/libswan/secrets.c
+index 01cf90e4f3..1088f914af 100644
+--- a/lib/libswan/secrets.c
+++ b/lib/libswan/secrets.c
+@@ -186,7 +186,7 @@ const ckaid_t *secret_ckaid(const struct secret *secret)
+ 	case SECRET_RSA:
+ 	case SECRET_ECDSA:
+ 		/* some sort of PKI */
+-		return &secret->stuff.u.pubkey.content.ckaid;
+		return &secret->stuff.u.pubkey->content.ckaid;
+ 	default:
+ 		return NULL;
+ 	}
+@@ -198,7 +198,7 @@ const keyid_t *secret_keyid(const struct secret *secret)
+ 	case SECRET_RSA:
+ 	case SECRET_ECDSA:
+ 		/* some sort of PKI */
+-		return &secret->stuff.u.pubkey.content.keyid;
+		return &secret->stuff.u.pubkey->content.keyid;
+ 	default:
+ 		return NULL;
+ 	}
+@@ -241,12 +241,12 @@ static struct secret *find_secret_by_pubkey_ckaid_1(struct secret *secrets,
+ 			dbg("  not PKI");
+ 			continue;
+ 		}
+-		if (type != NULL && pks->u.pubkey.content.type != type) {
+		if (type != NULL && pks->u.pubkey->content.type != type) {
+ 			/* need exact or wildcard */
+ 			dbg("  not %s", type->name);
+ 			continue;
+ 		}
+-		if (!ckaid_eq_nss(&pks->u.pubkey.content.ckaid, pubkey_ckaid)) {
+		if (!ckaid_eq_nss(&pks->u.pubkey->content.ckaid, pubkey_ckaid)) {
+ 			dbg("  wrong ckaid");
+ 			continue;
+ 		}
+@@ -276,12 +276,12 @@ bool secret_pubkey_same(struct secret *lhs, struct secret *rhs)
+ 		return false;
+ 	}
+ 
+-	if (lhs->stuff.u.pubkey.content.type != rhs->stuff.u.pubkey.content.type) {
+	if (lhs->stuff.u.pubkey->content.type != rhs->stuff.u.pubkey->content.type) {
+ 		return false;
+ 	}
+ 
+-	return lhs->stuff.u.pubkey.content.type->pubkey_same(&lhs->stuff.u.pubkey.content,
+-							    &rhs->stuff.u.pubkey.content);
+	return lhs->stuff.u.pubkey->content.type->pubkey_same(&lhs->stuff.u.pubkey->content,
+							    &rhs->stuff.u.pubkey->content);
+ }
+ 
+ struct secret *lsw_find_secret_by_id(struct secret *secrets,
+@@ -954,8 +954,9 @@ void lsw_free_preshared_secrets(struct secret **psecrets, struct logger *logger)
+ 			case SECRET_RSA:
+ 			case SECRET_ECDSA:
+ 				/* Note: pub is all there is */
+-				SECKEY_DestroyPrivateKey(s->stuff.u.pubkey.private_key);
+-				s->stuff.u.pubkey.content.type->free_pubkey_content(&s->stuff.u.pubkey.content);
+				SECKEY_DestroyPrivateKey(s->stuff.u.pubkey->private_key);
+				s->stuff.u.pubkey->content.type->free_pubkey_content(&s->stuff.u.pubkey->content);
+				pfree(s->stuff.u.pubkey);
+ 				break;
+ 			default:
+ 				bad_case(s->stuff.kind);
+@@ -1180,19 +1181,20 @@ static err_t add_private_key(struct secret **secrets, const struct secret_stuff
+ 	s->stuff.kind = type->private_key_kind;
+ 	s->stuff.line = 0;
+ 	/* make an unpacked copy of the private key */
+-	s->stuff.u.pubkey.private_key = copy_private_key(private_key);
+-	err_t err = type->extract_pubkey_content(&s->stuff.u.pubkey.content,
+	s->stuff.u.pubkey = alloc_thing(struct secret_pubkey_stuff, "secret_pubkey_stuff");
+	s->stuff.u.pubkey->private_key = copy_private_key(private_key);
+	err_t err = type->extract_pubkey_content(&s->stuff.u.pubkey->content,
+ 						 pubk, ckaid_nss);
+ 	if (err != NULL) {
+ 		/* extract should leave pubkey_content clean */
+-		SECKEY_DestroyPrivateKey(s->stuff.u.pubkey.private_key); /* allocated above */
+		SECKEY_DestroyPrivateKey(s->stuff.u.pubkey->private_key); /* allocated above */
+ 		pfree(s);
+ 		return err;
+ 	}
+ 
+-	passert(s->stuff.u.pubkey.content.type == type);
+-	pexpect(s->stuff.u.pubkey.content.ckaid.len > 0);
+-	pexpect(s->stuff.u.pubkey.content.keyid.keyid[0] != '\0');
+	passert(s->stuff.u.pubkey->content.type == type);
+	pexpect(s->stuff.u.pubkey->content.ckaid.len > 0);
+	pexpect(s->stuff.u.pubkey->content.keyid.keyid[0] != '\0');
+ 
+ 	add_secret(secrets, s, "lsw_add_rsa_secret");
+ 	*pks = &s->stuff;
+diff --git a/programs/pluto/ikev2_eap.c b/programs/pluto/ikev2_eap.c
+index c43bd59b6d..118c4c484e 100644
+--- a/programs/pluto/ikev2_eap.c
+++ b/programs/pluto/ikev2_eap.c
+@@ -282,7 +282,7 @@ static bool start_eap(struct ike_sa *ike, struct pbs_out *pbs)
+ 	    SSL_OptionSet(pr, SSL_ENABLE_SSL3, PR_FALSE) != SECSuccess ||
+ 	    SSL_BadCertHook(pr, eaptls_bad_cert_cb, eap) != SECSuccess ||
+ 	    SSL_HandshakeCallback(pr, eaptls_handshake_cb, eap) != SECSuccess ||
+-	    SSL_ConfigServerCert(pr, mycert->nss_cert, pks->u.pubkey.private_key, 0, 0) != SECSuccess) {
+	    SSL_ConfigServerCert(pr, mycert->nss_cert, pks->u.pubkey->private_key, 0, 0) != SECSuccess) {
+ 		llog_nss_error(RC_LOG, logger, "Failed to start configure TLS options");
+ 		return false;
+ 	}
+diff --git a/programs/pluto/keys.c b/programs/pluto/keys.c
+index 359ed87f75..e71fccb825 100644
+--- a/programs/pluto/keys.c
+++ b/programs/pluto/keys.c
+@@ -697,7 +697,7 @@ const struct secret_stuff *get_local_private_key(const struct connection *c,
+ 		 * etc) then best will end up as NULL
+ 		 */
+ 		pexpect(pks->kind == type->private_key_kind);
+-		pexpect(pks->u.pubkey.content.type == type);
+		pexpect(pks->u.pubkey->content.type == type);
+ 		dbg("connection %s's %s private key found in NSS DB using cert",
+ 		    c->name, type->name);
+ 		return pks;
+@@ -745,7 +745,7 @@ const struct secret_stuff *get_local_private_key(const struct connection *c,
+ 		 * etc) then best will end up as NULL
+ 		 */
+ 		pexpect(pks->kind == type->private_key_kind);
+-		pexpect(pks->u.pubkey.content.type == type);
+		pexpect(pks->u.pubkey->content.type == type);
+ 		dbg("connection %s's %s private key found in NSS DB using CKAID",
+ 		    c->name, type->name);
+ 		return pks;
+@@ -764,7 +764,7 @@ const struct secret_stuff *get_local_private_key(const struct connection *c,
+ 	passert(pks != NULL);
+ 
+ 	pexpect(pks->kind == type->private_key_kind);
+-	pexpect(pks->u.pubkey.content.type == type);
+	pexpect(pks->u.pubkey->content.type == type);
+ 	dbg("connection %s's %s private key found",
+ 	    c->name, type->name);
+ 	return pks;
+diff --git a/programs/showhostkey/showhostkey.c b/programs/showhostkey/showhostkey.c
+index aaef793914..da4e40d135 100644
+--- a/programs/showhostkey/showhostkey.c
+++ b/programs/showhostkey/showhostkey.c
+@@ -172,14 +172,14 @@ static void print(struct secret_stuff *pks,
+ 	case SECRET_RSA:
+ 	case SECRET_ECDSA:
+ 	{
+-		printf("%s", pks->u.pubkey.content.type->name);
+-		keyid_t keyid = pks->u.pubkey.content.keyid;
+		printf("%s", pks->u.pubkey->content.type->name);
+		keyid_t keyid = pks->u.pubkey->content.keyid;
+ 		printf(" keyid: %s", str_keyid(keyid)[0] ? str_keyid(keyid) : "<missing-pubkey>");
+ 		if (id) {
+ 			printf(" id: %s", idb);
+ 		}
+ 		ckaid_buf cb;
+-		const ckaid_t *ckaid = &pks->u.pubkey.content.ckaid;
+		const ckaid_t *ckaid = &pks->u.pubkey->content.ckaid;
+ 		printf(" ckaid: %s\n", str_ckaid(ckaid, &cb));
+ 		break;
+ 	}
+@@ -237,7 +237,7 @@ static int pick_by_rsaid(struct secret *secret UNUSED,
+ {
+ 	char *rsaid = (char *)uservoid;
+ 
+-	if (pks->kind == SECRET_RSA && streq(pks->u.pubkey.content.keyid.keyid, rsaid)) {
+	if (pks->kind == SECRET_RSA && streq(pks->u.pubkey->content.keyid.keyid, rsaid)) {
+ 		/* stop */
+ 		return 0;
+ 	} else {
+@@ -254,7 +254,7 @@ static int pick_by_ckaid(struct secret *secret UNUSED,
+ 	switch (pks->kind) {
+ 	case SECRET_RSA:
+ 	case SECRET_ECDSA:
+-		if (ckaid_starts_with(&pks->u.pubkey.content.ckaid, start)) {
+		if (ckaid_starts_with(&pks->u.pubkey->content.ckaid, start)) {
+ 			/* stop */
+ 			return 0;
+ 		}
+@@ -283,7 +283,7 @@ static char *base64_ipseckey_rdata_from_pubkey_secret(struct secret_stuff *pks,
+ 						      enum ipseckey_algorithm_type *ipseckey_algorithm)
+ {
+ 	chunk_t ipseckey_pubkey = empty_chunk; /* must free */
+-	err_t e = pks->u.pubkey.content.type->pubkey_content_to_ipseckey_rdata(&pks->u.pubkey.content,
+	err_t e = pks->u.pubkey->content.type->pubkey_content_to_ipseckey_rdata(&pks->u.pubkey->content,
+ 									       &ipseckey_pubkey,
+ 									       ipseckey_algorithm);
+ 	if (e != NULL) {
+@@ -390,7 +390,7 @@ static int show_leftright(struct secret_stuff *pks,
+ 	}
+ 	}
+ 
+-	passert(pks->u.pubkey.content.type != NULL);
+	passert(pks->u.pubkey->content.type != NULL);
+ 
+ 	char *base64 = NULL;
+ 	if (pubkey_flg) {
+@@ -408,11 +408,11 @@ static int show_leftright(struct secret_stuff *pks,
+ 	} else {
+ 		switch (pks->kind) {
+ 		case SECRET_RSA:
+-			printf("\t# rsakey %s\n", pks->u.pubkey.content.keyid.keyid);
+			printf("\t# rsakey %s\n", pks->u.pubkey->content.keyid.keyid);
+ 			printf("\t%srsasigkey=0s", side);
+ 			break;
+ 		case SECRET_ECDSA:
+-			printf("\t# ecdsakey %s\n", pks->u.pubkey.content.keyid.keyid);
+			printf("\t# ecdsakey %s\n", pks->u.pubkey->content.keyid.keyid);
+ 			printf("\t%secdsakey=0s", side);
+ 			break;
+ 		default:
+@@ -481,14 +481,17 @@ static struct secret_stuff *foreach_nss_private_key(secret_eval func,
+ 			continue;
+ 		}
+ 
+		struct secret_pubkey_stuff pubkey = {
+			.private_key = SECKEY_CopyPrivateKey(private_key), /* add reference */
+		};
+		type->extract_pubkey_content(&pubkey.content, pubk, ckaid_nss);
+
+ 		struct secret_stuff pks = {
+ 			.kind = type->private_key_kind,
+ 			.line = 0,
+-			.u.pubkey.private_key = SECKEY_CopyPrivateKey(private_key), /* add reference */
+			.u.pubkey = clone_thing(pubkey, "pubkey"),
+ 		};
+ 
+-		type->extract_pubkey_content(&pks.u.pubkey.content, pubk, ckaid_nss);
+-
+ 		/*
+ 		 * Only count private keys that get processed.
+ 		 */
+@@ -513,8 +516,9 @@ static struct secret_stuff *foreach_nss_private_key(secret_eval func,
+ 			break;
+ 		}
+ 
+-		SECKEY_DestroyPrivateKey(pks.u.pubkey.private_key); /* destroy reference */
+-		type->free_pubkey_content(&pks.u.pubkey.content);
+		SECKEY_DestroyPrivateKey(pks.u.pubkey->private_key); /* destroy reference */
+		type->free_pubkey_content(&pks.u.pubkey->content);
+		pfreeany(pks.u.pubkey);
+ 
+ 		if (ret < 0) {
+ 			break;
+-- 
+2.48.1
+
+
+From c346964929e12e6fe7ea901cfb6d6b899e06fd74 Mon Sep 17 00:00:00 2001
+From: Andrew Cagney <cagney@gnu.org>
+Date: Fri, 8 Nov 2024 17:45:53 -0500
+Subject: [PATCH 2/2] crypto: refcnt struct secret_pubkey_stuff when passing to
+ helper thread
+
+fix problem where a thread was trying to use a key when which
+was being deleted by reloadsecrets.
+
+close #1894 Segmentation fault in PK11_SignatureLen (key=0xa5a5a5a5a5a5a5a5)
+
+Modified-by: Daiki Ueno <dueno@redhat.com>
+---
+ include/secrets.h                  |  4 ++++
+ lib/libswan/secrets.c              | 23 ++++++++++++++++++-----
+ programs/pluto/ikev2_auth_helper.c | 27 ++++++++++++++++++---------
+ 3 files changed, 40 insertions(+), 14 deletions(-)
+
+diff --git a/include/secrets.h b/include/secrets.h
+index c9272d71e0..488d12e8c5 100644
+--- a/include/secrets.h
+++ b/include/secrets.h
+@@ -74,10 +74,14 @@ enum secret_kind {
+ };
+ 
+ struct secret_pubkey_stuff {
+	struct refcnt refcnt;
+ 	SECKEYPrivateKey *private_key;
+ 	struct pubkey_content content;
+ };
+ 
+struct secret_pubkey_stuff *secret_pubkey_stuff_addref(struct secret_pubkey_stuff *, where_t where);
+void secret_pubkey_stuff_delref(struct secret_pubkey_stuff **, where_t where);
+
+ struct secret_stuff {
+ 	enum secret_kind kind;
+ 	/*
+diff --git a/lib/libswan/secrets.c b/lib/libswan/secrets.c
+index 1088f914af..3fed6a55da 100644
+--- a/lib/libswan/secrets.c
+++ b/lib/libswan/secrets.c
+@@ -953,10 +953,7 @@ void lsw_free_preshared_secrets(struct secret **psecrets, struct logger *logger)
+ 				break;
+ 			case SECRET_RSA:
+ 			case SECRET_ECDSA:
+-				/* Note: pub is all there is */
+-				SECKEY_DestroyPrivateKey(s->stuff.u.pubkey->private_key);
+-				s->stuff.u.pubkey->content.type->free_pubkey_content(&s->stuff.u.pubkey->content);
+-				pfree(s->stuff.u.pubkey);
+				secret_pubkey_stuff_delref(&s->stuff.u.pubkey, HERE);
+ 				break;
+ 			default:
+ 				bad_case(s->stuff.kind);
+@@ -1173,6 +1170,22 @@ static const struct pubkey_type *private_key_type_nss(SECKEYPrivateKey *private_
+ 	}
+ }
+ 
+struct secret_pubkey_stuff *secret_pubkey_stuff_addref(struct secret_pubkey_stuff *pks,
+						       where_t where)
+{
+	return addref_where(pks, where);
+}
+
+void secret_pubkey_stuff_delref(struct secret_pubkey_stuff **pks, where_t where)
+{
+	struct secret_pubkey_stuff *last = delref_where(pks, &global_logger, where);
+	if (last != NULL) {
+		SECKEY_DestroyPrivateKey(last->private_key);
+		last->content.type->free_pubkey_content(&last->content);
+		pfree(last);
+	}
+}
+
+ static err_t add_private_key(struct secret **secrets, const struct secret_stuff **pks,
+ 			     SECKEYPublicKey *pubk, SECItem *ckaid_nss,
+ 			     const struct pubkey_type *type, SECKEYPrivateKey *private_key)
+@@ -1181,7 +1194,7 @@ static err_t add_private_key(struct secret **secrets, const struct secret_stuff
+ 	s->stuff.kind = type->private_key_kind;
+ 	s->stuff.line = 0;
+ 	/* make an unpacked copy of the private key */
+-	s->stuff.u.pubkey = alloc_thing(struct secret_pubkey_stuff, "secret_pubkey_stuff");
+	s->stuff.u.pubkey = refcnt_alloc(struct secret_pubkey_stuff, HERE);
+ 	s->stuff.u.pubkey->private_key = copy_private_key(private_key);
+ 	err_t err = type->extract_pubkey_content(&s->stuff.u.pubkey->content,
+ 						 pubk, ckaid_nss);
+diff --git a/programs/pluto/ikev2_auth_helper.c b/programs/pluto/ikev2_auth_helper.c
+index 4fe661b559..2973569a90 100644
+--- a/programs/pluto/ikev2_auth_helper.c
+++ b/programs/pluto/ikev2_auth_helper.c
+@@ -38,7 +38,7 @@ struct task {
+ 	const struct crypt_mac hash_to_sign;
+ 	const struct hash_desc *hash_algo;
+ 	v2_auth_signature_cb *cb;
+-	const struct secret_stuff *pks;
+	struct secret_pubkey_stuff *pks;
+ 	const struct pubkey_signer *signer;
+ 	/* out */
+ 	struct hash_signature signature;
+@@ -63,19 +63,21 @@ bool submit_v2_auth_signature(struct ike_sa *ike, struct msg_digest *md,
+ 			      where_t where)
+ {
+ 	const struct connection *c = ike->sa.st_connection;
+	const struct secret_stuff *s = get_local_private_key(c, signer->type,
+							     ike->sa.logger);
+	if (s == NULL) {
+		/* failure: no key to use */
+		return false;
+	}
+
+ 	struct task task = {
+ 		.cb = cb,
+ 		.hash_algo = hash_algo,
+ 		.hash_to_sign = *hash_to_sign,
+ 		.signer = signer,
+-		.pks = get_local_private_key(c, signer->type,
+-					     ike->sa.logger),
+		.pks = secret_pubkey_stuff_addref(s->u.pubkey, HERE),
+ 	};
+ 
+-	if (task.pks == NULL)
+-		/* failure: no key to use */
+-		return false;
+-
+ 	submit_task(/*callback*/&ike->sa, /*task*/&ike->sa, md,
+ 		    /*detach_whack*/false,
+ 		    clone_thing(task, "signature task"),
+@@ -86,7 +88,7 @@ bool submit_v2_auth_signature(struct ike_sa *ike, struct msg_digest *md,
+ static struct hash_signature v2_auth_signature(struct logger *logger,
+ 					       const struct crypt_mac *hash_to_sign,
+ 					       const struct hash_desc *hash_algo,
+-					       const struct secret_stuff *pks,
+					       const struct secret_pubkey_stuff *pks,
+ 					       const struct pubkey_signer *signer)
+ {
+ 	passert(hash_to_sign->len <= sizeof(hash_to_sign->ptr/*array*/)); /*hint to coverity*/
+@@ -96,8 +98,14 @@ static struct hash_signature v2_auth_signature(struct logger *logger,
+ 		DBG_dump_hunk("hash to sign", *hash_to_sign);
+ 	}
+ 
+	struct secret_stuff s = {
+		.kind = pks->content.type->private_key_kind,
+		.line = 0,
+		.u.pubkey = (struct secret_pubkey_stuff *)pks,
+	};
+
+ 	logtime_t sign_time = logtime_start(logger);
+-	struct hash_signature sig = signer->sign_hash(pks,
+	struct hash_signature sig = signer->sign_hash(&s,
+ 						      hash_to_sign->ptr,
+ 						      hash_to_sign->len,
+ 						      hash_algo,
+@@ -125,5 +133,6 @@ static stf_status v2_auth_signature_completed(struct state *st,
+ 
+ static void v2_auth_signature_cleanup(struct task **task)
+ {
+	secret_pubkey_stuff_delref(&(*task)->pks, HERE);
+ 	pfreeany(*task);
+ }
+-- 
+2.48.1
+
--- a/libreswan-5.1-whack-ctlsocket.patch
+++ b/libreswan-5.1-whack-ctlsocket.patch
@ -0,0 +1,26 @@
+From 43e5255728845f9314049a20644fc19a745cde81 Mon Sep 17 00:00:00 2001
+From: Tuomo Soini <tis@foobar.fi>
+Date: Fri, 11 Oct 2024 18:28:24 +0300
+Subject: [PATCH] ipsec: fix duplicate --ctlsocket option for whack
+
+github issue: whack error: duplicated flag ctlsocket #1840
+---
+ programs/ipsec/ipsec.in | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/programs/ipsec/ipsec.in b/programs/ipsec/ipsec.in
+index 1510d238d0..fbceac682b 100755
+--- a/programs/ipsec/ipsec.in
+++ b/programs/ipsec/ipsec.in
+@@ -1203,7 +1203,7 @@ while [ ${#} -gt 0 ]; do
+ 	    # We need to make sure we don't give it twice
+ 	    shift
+ 	    case " ${@} " in
+-		--ctlsocket)
+		*" --ctlsocket "*)
+ 		    exec ${dry_run} "${IPSEC_EXECDIR}/whack" "${@}"
+ 		    ;;
+ 		*)
+-- 
+2.48.1
+
--- a/libreswan.spec
+++ b/libreswan.spec
@ -0,0 +1,223 @@
+%global _hardened_build 1
+# These are rpm macros and are 0 or 1
+%global with_efence 0
+%global with_development 0
+%global with_cavstests 1
+%global nss_version 3.52
+%global unbound_version 1.6.6
+# Libreswan config options
+%global libreswan_config \\\
+    LIBEXECDIR=%{_libexecdir}/ipsec \\\
+    MANDIR=%{_mandir} \\\
+    PREFIX=%{_prefix} \\\
+    INITSYSTEM=systemd \\\
+    SHELL_BINARY=%{_bindir}/sh \\\
+    USE_DNSSEC=true \\\
+    USE_LABELED_IPSEC=true \\\
+    USE_LDAP=true \\\
+    USE_LIBCAP_NG=true \\\
+    USE_LIBCURL=true \\\
+    USE_LINUX_AUDIT=true \\\
+    USE_NM=true \\\
+    USE_NSS_IPSEC_PROFILE=true \\\
+    USE_SECCOMP=true \\\
+    USE_AUTHPAM=true \\\
+%{nil}
+
+#global prever dr1
+
+Name: libreswan
+Summary: Internet Key Exchange (IKEv1 and IKEv2) implementation for IPsec
+# version is generated in the release script
+Version: 5.1
+Release: %autorelease
+# The code in lib/libswan/nss_copies.c is under MPL-2.0, while the
+# rest is under GPL-2.0-or-later
+License: GPL-2.0-or-later AND MPL-2.0
+Url: https://libreswan.org/
+Source0: https://download.libreswan.org/%{?prever:development/}%{name}-%{version}%{?prever}.tar.gz
+Source1: https://download.libreswan.org/%{?prever:development/}%{name}-%{version}%{?prever}.tar.gz.asc
+Source2: https://download.libreswan.org/LIBRESWAN-OpenPGP-KEY.txt
+%if 0%{with_cavstests}
+Source3: https://download.libreswan.org/cavs/ikev1_dsa.fax.bz2
+Source4: https://download.libreswan.org/cavs/ikev1_psk.fax.bz2
+Source5: https://download.libreswan.org/cavs/ikev2.fax.bz2
+%endif
+
+Patch1: libreswan-4.15-ipsec_import.patch
+Patch2: libreswan-5.1-rereadsecrets.patch
+Patch3: libreswan-5.1-opt-protoport.patch
+Patch4: libreswan-5.1-pexpect-negotiating-ike-sa.patch
+Patch5: libreswan-5.1-whack-ctlsocket.patch
+
+BuildRequires: audit-libs-devel
+BuildRequires: bison
+BuildRequires: curl-devel
+BuildRequires: flex
+BuildRequires: gcc
+BuildRequires: gnupg2
+BuildRequires: hostname
+BuildRequires: ldns-devel
+BuildRequires: libcap-ng-devel
+BuildRequires: libevent-devel
+BuildRequires: libseccomp-devel
+BuildRequires: libselinux-devel
+BuildRequires: make
+BuildRequires: nspr-devel
+BuildRequires: nss-devel >= %{nss_version}
+BuildRequires: nss-tools >= %{nss_version}
+BuildRequires: openldap-devel
+BuildRequires: pam-devel
+BuildRequires: pkgconfig
+BuildRequires: systemd
+BuildRequires: systemd-devel
+BuildRequires: systemd-rpm-macros
+BuildRequires: unbound-devel >= %{unbound_version}
+BuildRequires: xmlto
+%if 0%{with_efence}
+BuildRequires: ElectricFence
+%endif
+Requires: iproute >= 2.6.8
+Requires: nss >= %{nss_version}
+Requires: nss-softokn
+Requires: nss-tools
+Requires: unbound-libs >= %{unbound_version}
+Requires: logrotate
+# for pidof
+Requires: procps-ng
+
+
+Requires(post): bash
+Requires(post): coreutils
+Requires(post): systemd
+Requires(preun): systemd
+Requires(postun): systemd
+
+%description
+Libreswan is a free implementation of IPsec & IKE for Linux.  IPsec is
+the Internet Protocol Security and uses strong cryptography to provide
+both authentication and encryption services.  These services allow you
+to build secure tunnels through untrusted networks.  Everything passing
+through the untrusted net is encrypted by the ipsec gateway machine and
+decrypted by the gateway at the other end of the tunnel.  The resulting
+tunnel is a virtual private network or VPN.
+
+This package contains the daemons and userland tools for setting up
+Libreswan.
+
+Libreswan also supports IKEv2 (RFC7296) and Secure Labeling
+
+Libreswan is based on Openswan-2.6.38 which in turn is based on FreeS/WAN-2.04
+
+%prep
+%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
+%setup -q -n libreswan-%{version}%{?prever}
+# enable crypto-policies support
+sed -i "s:#[ ]*include \(.*\)\(/crypto-policies/back-ends/libreswan.config\)$:include \1\2:" configs/ipsec.conf.in
+%ifarch s390x
+# throws error on s390x
+sed -i "s/SUBDIRS += hunkcheck/#SUBDIRS += hunkcheck/" testing/programs/Makefile
+%endif
+%autopatch -p1
+
+%build
+%make_build \
+%if 0%{with_development}
+    OPTIMIZE_CFLAGS="%{?_hardened_cflags}" \
+%else
+    OPTIMIZE_CFLAGS="%{optflags}" \
+%endif
+    WERROR_CFLAGS="-Werror -Wno-missing-field-initializers -Wno-lto-type-mismatch -Wno-maybe-uninitialized" \
+%if 0%{with_efence}
+    USE_EFENCE=true \
+%endif
+    USERLINK="%{?__global_ldflags} -Wl,-z,relro -Wl,--as-needed  -Wl,-z,now -flto --no-lto" \
+    %{libreswan_config} \
+    programs
+FS=$(pwd)
+
+
+%install
+%make_install \
+    %{libreswan_config} \
+FS=$(pwd)
+rm -rf %{buildroot}/usr/share/doc/libreswan
+rm -rf %{buildroot}%{_libexecdir}/ipsec/*check
+# avoids python depency and are old / aging tools that are not very useful
+rm -rf %{buildroot}%{_libexecdir}/ipsec/show
+rm -rf %{buildroot}%{_libexecdir}/ipsec/verify
+
+install -d -m 0755 %{buildroot}%{_rundir}/pluto
+install -d %{buildroot}%{_sbindir}
+
+install -d %{buildroot}%{_sysctldir}
+install -m 0644 packaging/fedora/libreswan-sysctl.conf \
+    %{buildroot}%{_sysctldir}/50-libreswan.conf
+
+echo "include %{_sysconfdir}/ipsec.d/*.secrets" \
+    > %{buildroot}%{_sysconfdir}/ipsec.secrets
+rm -fr %{buildroot}%{_sysconfdir}/rc.d/rc*
+
+%if 0%{with_cavstests}
+%check
+# There is an elaborate upstream testing infrastructure which we do not
+# run here - it takes hours and uses kvm
+# We only run the CAVS tests and startup selftest
+cp %{SOURCE3} %{SOURCE4} %{SOURCE5} .
+bunzip2 *.fax.bz2
+
+: starting CAVS test for IKEv2
+%{buildroot}%{_libexecdir}/ipsec/cavp -v2 ikev2.fax | \
+    diff -u ikev2.fax - > /dev/null
+: starting CAVS test for IKEv1 RSASIG
+%{buildroot}%{_libexecdir}/ipsec/cavp -v1dsa ikev1_dsa.fax | \
+    diff -u ikev1_dsa.fax - > /dev/null
+: starting CAVS test for IKEv1 PSK
+%{buildroot}%{_libexecdir}/ipsec/cavp -v1psk ikev1_psk.fax | \
+    diff -u ikev1_psk.fax - > /dev/null
+: CAVS tests passed
+%endif
+
+# Some of these tests will show ERROR for negative testing - it will exit on real errors
+%{buildroot}%{_libexecdir}/ipsec/algparse -tp || { echo prooposal test failed; exit 1; }
+%{buildroot}%{_libexecdir}/ipsec/algparse -ta || { echo algorithm test failed; exit 1; }
+: Algorithm parser tests passed
+
+# self test for pluto daemon - this also shows which algorithms it allows in FIPS mode
+tmpdir=$(mktemp -d /tmp/libreswan-XXXXX)
+certutil -N -d sql:$tmpdir --empty-password
+%{buildroot}%{_libexecdir}/ipsec/pluto --selftest --nssdir $tmpdir --rundir $tmpdir
+: pluto self-test passed - verify FIPS algorithms allowed is still compliant with NIST
+
+%post
+%systemd_post ipsec.service
+%sysctl_apply 50-libreswan.conf
+
+%preun
+%systemd_preun ipsec.service
+
+%postun
+%systemd_postun_with_restart ipsec.service
+
+%files
+%doc CHANGES COPYING CREDITS README* LICENSE
+%doc docs/*.* docs/examples
+%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipsec.conf
+%attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ipsec.secrets
+%attr(0700,root,root) %dir %{_sysconfdir}/ipsec.d
+%attr(0700,root,root) %dir %{_sysconfdir}/ipsec.d/policies
+%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipsec.d/policies/*
+%attr(0644,root,root) %config(noreplace) %{_sysctldir}/50-libreswan.conf
+%attr(0755,root,root) %dir %{_rundir}/pluto
+%attr(0700,root,root) %dir %{_sharedstatedir}/ipsec
+%attr(0700,root,root) %dir %{_sharedstatedir}/ipsec/nss
+%attr(0644,root,root) %{_tmpfilesdir}/libreswan.conf
+%attr(0644,root,root) %{_unitdir}/ipsec.service
+%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/pam.d/pluto
+%config(noreplace) %{_sysconfdir}/logrotate.d/libreswan
+%{_sbindir}/ipsec
+%{_libexecdir}/ipsec
+%doc %{_mandir}/*/*
+
+%changelog
+%autochangelog
--- a/plans/ci.fmf
+++ b/plans/ci.fmf
@ -0,0 +1,11 @@
+/fips-disabled-buildroot-disabled:
+  plan:
+    import:
+      url: https://gitlab.cee.redhat.com/rhel-tests/libreswan.git
+      name: /plans/ci/fips-disabled-buildroot-disabled
+
+/fips-disabled-buildroot-enabled:
+  plan:
+    import:
+      url: https://gitlab.cee.redhat.com/rhel-tests/libreswan.git
+      name: /plans/ci/fips-disabled-buildroot-enabled
--- a/5
+++ b/5
@ -0,0 +1,5 @@
+SHA512 (ikev1_dsa.fax.bz2) = 627cbac14248bd68e8d22fbca247668a7749ef0c2e41df8d776d62df9a21403d3a246c0bd82c3faedce62de90b9f91a87f753e17b056319000bba7d2038461ac
+SHA512 (ikev1_psk.fax.bz2) = 1b2daec32edc56b410c036db2688c92548a9bd9914994bc7e555b301dd6db4497a6b3e89dc12ddf36826ae90b40fcde501a5a45c0d59098e07839073d219d467
+SHA512 (ikev2.fax.bz2) = 0d3748d1bd574f6f1f3e4db847eca126ce649566ea710ef227426f433122752b80d1d6b8acf9d0df07b5597c1e45447e3a2fcb3391756e834e8e75f99df8e51e
+SHA512 (libreswan-5.1.tar.gz) = 9ee8b071be414737c61529420af22b789d8968e99e376250afe42e1a5890d864dc2697ecfeb33a6c50de38a361bddf125852a8eb86318e544fc2f162f8ff6522
+SHA512 (libreswan-5.1.tar.gz.asc) = 18cb6853c2b6c7c413291b861efc91d266fba2ac14c207e879b261ac2d67b6544a9dcaedabfd99156a652ef2cd6855f5b6e74dcf5bbd1ae7b347acdb32842f7d