rpms
/
libreswan
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Compare commits

base: rpms:imports/c9/libreswan-4.9-4.el9_2
Branches Tags
rpms:c8
rpms:c9s
rpms:c8s
rpms:a9
rpms:a8
rpms:c9
rpms:c10s
rpms:c8-beta
rpms:c9-beta
rpms:imports/c8/libreswan-4.12-2.el8_10.3
rpms:changed/a9/libreswan-4.12-2.el9_4.alma.1
rpms:changed/a8/libreswan-4.12-2.el8_9.2.alma.1
rpms:changed/a9/libreswan-4.12-1.el9_3.1.alma.1
rpms:imports/c8-beta/libreswan-4.12-2.el8
rpms:imports/c9-beta/libreswan-4.12-1.el9
rpms:imports/c9/libreswan-4.9-4.el9_2
rpms:imports/c8/libreswan-4.9-3.el8_8
rpms:imports/c8/libreswan-4.9-2.el8_8.2
rpms:imports/c8/libreswan-4.9-1.el8
rpms:imports/c9/libreswan-4.9-2.el9_2
rpms:imports/c9/libreswan-4.9-1.el9
rpms:imports/c8/libreswan-4.5-1.el8_7.1
rpms:imports/c9-beta/libreswan-4.9-1.el9
rpms:imports/c8-beta/libreswan-4.9-1.el8
rpms:imports/c8s/libreswan-4.9-1.el8
rpms:imports/c9/libreswan-4.6-3.el9
rpms:imports/c8/libreswan-4.5-1.el8
rpms:imports/c8-beta/libreswan-4.5-1.el8
rpms:imports/c9-beta/libreswan-4.6-3.el9
rpms:imports/c8s/libreswan-4.5-1.el8
rpms:imports/c8/libreswan-4.4-4.el8_5
rpms:imports/c9-beta/libreswan-4.4-3.el9.1
rpms:imports/c8/libreswan-4.4-1.el8
rpms:imports/c8-beta/libreswan-4.4-1.el8
rpms:imports/c8-beta/libreswan-4.3-1.el8
rpms:imports/c8-beta/libreswan-3.32-3.el8
rpms:imports/c8-beta/libreswan-3.29-6.el8
rpms:imports/c8-beta/libreswan-3.29-1.el8
rpms:imports/c8s/libreswan-4.4-1.el8
rpms:imports/c8s/libreswan-4.3-3.el8
rpms:imports/c8s/libreswan-4.3-2.el8
rpms:imports/c8s/libreswan-4.3-1.el8
rpms:imports/c8s/libreswan-4.1-1.el8
rpms:imports/c8/libreswan-4.3-3.el8
rpms:imports/c8/libreswan-3.32-7.el8_3
rpms:imports/c8/libreswan-3.32-6.el8
rpms:imports/c8/libreswan-3.29-7.el8_2
rpms:imports/c8/libreswan-3.29-6.el8
...
compare: rpms:c8
Branches Tags
rpms:c9s
rpms:c8s
rpms:c8
rpms:a9
rpms:a8
rpms:c9
rpms:c10s
rpms:c8-beta
rpms:c9-beta
rpms:imports/c8/libreswan-4.12-2.el8_10.3
rpms:changed/a9/libreswan-4.12-2.el9_4.alma.1
rpms:changed/a8/libreswan-4.12-2.el8_9.2.alma.1
rpms:changed/a9/libreswan-4.12-1.el9_3.1.alma.1
rpms:imports/c8-beta/libreswan-4.12-2.el8
rpms:imports/c9-beta/libreswan-4.12-1.el9
rpms:imports/c9/libreswan-4.9-4.el9_2
rpms:imports/c8/libreswan-4.9-3.el8_8
rpms:imports/c8/libreswan-4.9-2.el8_8.2
rpms:imports/c8/libreswan-4.9-1.el8
rpms:imports/c9/libreswan-4.9-2.el9_2
rpms:imports/c9/libreswan-4.9-1.el9
rpms:imports/c8/libreswan-4.5-1.el8_7.1
rpms:imports/c9-beta/libreswan-4.9-1.el9
rpms:imports/c8-beta/libreswan-4.9-1.el8
rpms:imports/c8s/libreswan-4.9-1.el8
rpms:imports/c9/libreswan-4.6-3.el9
rpms:imports/c8/libreswan-4.5-1.el8
rpms:imports/c8-beta/libreswan-4.5-1.el8
rpms:imports/c9-beta/libreswan-4.6-3.el9
rpms:imports/c8s/libreswan-4.5-1.el8
rpms:imports/c8/libreswan-4.4-4.el8_5
rpms:imports/c9-beta/libreswan-4.4-3.el9.1
rpms:imports/c8/libreswan-4.4-1.el8
rpms:imports/c8-beta/libreswan-4.4-1.el8
rpms:imports/c8-beta/libreswan-4.3-1.el8
rpms:imports/c8-beta/libreswan-3.32-3.el8
rpms:imports/c8-beta/libreswan-3.29-6.el8
rpms:imports/c8-beta/libreswan-3.29-1.el8
rpms:imports/c8s/libreswan-4.4-1.el8
rpms:imports/c8s/libreswan-4.3-3.el8
rpms:imports/c8s/libreswan-4.3-2.el8
rpms:imports/c8s/libreswan-4.3-1.el8
rpms:imports/c8s/libreswan-4.1-1.el8
rpms:imports/c8/libreswan-4.3-3.el8
rpms:imports/c8/libreswan-3.32-7.el8_3
rpms:imports/c8/libreswan-3.32-6.el8
rpms:imports/c8/libreswan-3.29-7.el8_2
rpms:imports/c8/libreswan-3.29-6.el8

No commits in common. "imports/c9/libreswan-4.9-4.el9_2" and "c8" have entirely different histories.
imports/c9 ... c8

12 changed files with 538 additions and 432 deletions
Show Stats Expand all files Collapse all files

2
.gitignore vendored
View File

@ -1,4 +1,4 @@
SOURCES/ikev1_dsa.fax.bz2
SOURCES/ikev1_psk.fax.bz2
SOURCES/ikev2.fax.bz2
SOURCES/libreswan-4.9.tar.gz
SOURCES/libreswan-4.12.tar.gz

2
.libreswan.metadata
View File

@ -1,4 +1,4 @@
b35cd50b8bc0a08b9c07713bf19c72d53bfe66bb SOURCES/ikev1_dsa.fax.bz2
861d97bf488f9e296cad8c43ab72f111a5b1a848 SOURCES/ikev1_psk.fax.bz2
fcaf77f3deae3d8e99cdb3b1f8abea63167a0633 SOURCES/ikev2.fax.bz2
12b7351ca7e6ba1ac787239e67027a4d82f02f10 SOURCES/libreswan-4.9.tar.gz
786c14a4755311ea3103683a3294e1536b1e44a6 SOURCES/libreswan-4.12.tar.gz

31
SOURCES/libreswan-3.32-1861360-nodefault-rsa-pss.patch Normal file
View File

@ -0,0 +1,31 @@
From 1dddaa3226fe1b71b68ec9665d93864a5ec69801 Mon Sep 17 00:00:00 2001
From: rpm-build <rpm-build>
Date: Mon, 9 Jan 2023 23:26:10 +0900
Subject: [PATCH] libreswan-3.32-1861360-nodefault-rsa-pss.patch
---
lib/libipsecconf/confread.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/lib/libipsecconf/confread.c b/lib/libipsecconf/confread.c
index 0444118..ec87646 100644
--- a/lib/libipsecconf/confread.c
+++ b/lib/libipsecconf/confread.c
@@ -1501,9 +1501,14 @@ static bool load_conn(struct starter_conn *conn,
hunk_streq(val, "rsa")) {
conn->authby.rsasig = true;
conn->authby.rsasig_v1_5 = true;
+ /*
+ * These cause failure with RSA 1024 bits because it uses RSA-PSS
+ */
+#if 0
conn->sighash_policy |= POL_SIGHASH_SHA2_256;
conn->sighash_policy |= POL_SIGHASH_SHA2_384;
conn->sighash_policy |= POL_SIGHASH_SHA2_512;
+#endif
} else if (hunk_streq(val, "never")) {
conn->authby.never = true;
/* everything else is only supported for IKEv2 */
--
2.39.0

136
SOURCES/libreswan-4.1-maintain-obsolete-keywords.patch Normal file
View File

@ -0,0 +1,136 @@
From a2cc5f8c80e8cb9be0b65f8e8544689e8b093c09 Mon Sep 17 00:00:00 2001
From: rpm-build <rpm-build>
Date: Tue, 10 Jan 2023 00:18:48 +0900
Subject: [PATCH] libreswan-4.1-maintain-obsolete-keywords.patch
---
lib/libipsecconf/keywords.c | 28 ++++++++++++++++++++++++++++
1 file changed, 28 insertions(+)
diff --git a/lib/libipsecconf/keywords.c b/lib/libipsecconf/keywords.c
index fa8f0e0..03fb863 100644
--- a/lib/libipsecconf/keywords.c
+++ b/lib/libipsecconf/keywords.c
@@ -343,6 +343,8 @@ const struct keyword_def ipsec_conf_keywords[] = {
{ "ikev1-policy", kv_config, kt_enum, KBF_GLOBAL_IKEv1, kw_global_ikev1_list, NULL, },
{ "curl-iface", kv_config, kt_string, KSF_CURLIFACE, NULL, NULL, },
{ "curl-timeout", kv_config, kt_time, KBF_CURLTIMEOUT_MS, NULL, NULL, },
+ { "curl_iface", kv_config | kv_alias, kt_string, KSF_CURLIFACE, NULL, NULL, }, /* obsolete _ */
+ { "curl_timeout", kv_config | kv_alias, kt_time, KBF_CURLTIMEOUT_MS, NULL, NULL, }, /* obsolete _ */
{ "myvendorid", kv_config, kt_string, KSF_MYVENDORID, NULL, NULL, },
{ "syslog", kv_config, kt_string, KSF_SYSLOG, NULL, NULL, },
@@ -350,6 +352,7 @@ const struct keyword_def ipsec_conf_keywords[] = {
{ "logfile", kv_config, kt_filename, KSF_LOGFILE, NULL, NULL, },
{ "plutostderrlog", kv_config, kt_filename, KSF_LOGFILE, NULL, NULL, }, /* obsolete name, but very common :/ */
{ "logtime", kv_config, kt_bool, KBF_LOGTIME, NULL, NULL, },
+ { "plutostderrlogtime", kv_config | kv_alias, kt_bool, KBF_LOGTIME, NULL, NULL, }, /* obsolete */
{ "logappend", kv_config, kt_bool, KBF_LOGAPPEND, NULL, NULL, },
{ "logip", kv_config, kt_bool, KBF_LOGIP, NULL, NULL, },
{ "audit-log", kv_config, kt_bool, KBF_AUDIT_LOG, NULL, NULL, },
@@ -369,13 +372,20 @@ const struct keyword_def ipsec_conf_keywords[] = {
{ "global-redirect-to", kv_config, kt_string, KSF_GLOBAL_REDIRECT_TO, NULL, NULL, },
{ "crl-strict", kv_config, kt_bool, KBF_CRL_STRICT, NULL, NULL, },
+ { "crl_strict", kv_config | kv_alias, kt_bool, KBF_CRL_STRICT, NULL, NULL, }, /* obsolete _ */
{ "crlcheckinterval", kv_config, kt_time, KBF_CRL_CHECKINTERVAL_MS, NULL, NULL, },
+ { "strictcrlpolicy", kv_config | kv_alias, kt_bool, KBF_CRL_STRICT, NULL, NULL, }, /* obsolete; used on openswan */
{ "ocsp-strict", kv_config, kt_bool, KBF_OCSP_STRICT, NULL, NULL, },
+ { "ocsp_strict", kv_config | kv_alias, kt_bool, KBF_OCSP_STRICT, NULL, NULL, }, /* obsolete _ */
{ "ocsp-enable", kv_config, kt_bool, KBF_OCSP_ENABLE, NULL, NULL, },
+ { "ocsp_enable", kv_config | kv_alias, kt_bool, KBF_OCSP_ENABLE, NULL, NULL, }, /* obsolete _ */
{ "ocsp-uri", kv_config, kt_string, KSF_OCSP_URI, NULL, NULL, },
+ { "ocsp_uri", kv_config | kv_alias, kt_string, KSF_OCSP_URI, NULL, NULL, }, /* obsolete _ */
{ "ocsp-timeout", kv_config, kt_number, KBF_OCSP_TIMEOUT, NULL, NULL, },
+ { "ocsp_timeout", kv_config | kv_alias, kt_number, KBF_OCSP_TIMEOUT, NULL, NULL, }, /* obsolete _ */
{ "ocsp-trustname", kv_config, kt_string, KSF_OCSP_TRUSTNAME, NULL, NULL, },
+ { "ocsp_trust_name", kv_config | kv_alias, kt_string, KSF_OCSP_TRUSTNAME, NULL, NULL, }, /* obsolete _ */
{ "ocsp-cache-size", kv_config, kt_number, KBF_OCSP_CACHE_SIZE, NULL, NULL, },
{ "ocsp-cache-min-age", kv_config, kt_time, KBF_OCSP_CACHE_MIN_AGE_MS, NULL, NULL, },
{ "ocsp-cache-max-age", kv_config, kt_time, KBF_OCSP_CACHE_MAX_AGE_MS, NULL, NULL, },
@@ -399,6 +409,7 @@ const struct keyword_def ipsec_conf_keywords[] = {
{ "virtual_private", kv_config, kt_string, KSF_VIRTUALPRIVATE, NULL, NULL, }, /* obsolete variant, very common */
{ "seedbits", kv_config, kt_number, KBF_SEEDBITS, NULL, NULL, },
{ "keep-alive", kv_config, kt_number, KBF_KEEPALIVE, NULL, NULL, },
+ { "keep_alive", kv_config | kv_alias, kt_number, KBF_KEEPALIVE, NULL, NULL, }, /* obsolete _ */
{ "listen-tcp", kv_config, kt_bool, KBF_LISTEN_TCP, NULL, NULL },
{ "listen-udp", kv_config, kt_bool, KBF_LISTEN_UDP, NULL, NULL },
@@ -410,6 +421,8 @@ const struct keyword_def ipsec_conf_keywords[] = {
#ifdef HAVE_LABELED_IPSEC
{ "ikev1-secctx-attr-type", kv_config, kt_number, KBF_SECCTX, NULL, NULL, }, /* obsolete: not a value, a type */
{ "secctx-attr-type", kv_config | kv_alias, kt_number, KBF_SECCTX, NULL, NULL, },
+ { "secctx_attr_value", kv_config | kv_alias, kt_number, KBF_SECCTX, NULL, NULL, }, /* obsolete _ */
+ { "secctx-attr-value", kv_config, kt_number, KBF_SECCTX, NULL, NULL, }, /* obsolete: not a value, a type */
#endif
{ "interfaces", kv_config, kt_obsolete, KNCF_WARNIGNORE, NULL, NULL, }, /* obsoleted but often present keyword */
@@ -446,6 +459,7 @@ const struct keyword_def ipsec_conf_keywords[] = {
{ "username", kv_conn | kv_leftright, kt_string, KSCF_USERNAME, NULL, NULL, },
/* xauthusername is still used in NetworkManager-libreswan :/ */
{ "xauthusername", kv_conn | kv_leftright, kt_string, KSCF_USERNAME, NULL, NULL, }, /* old alias */
+ { "xauthname", kv_conn | kv_leftright, kt_string, KSCF_USERNAME, NULL, NULL, }, /* old alias */
{ "addresspool", kv_conn | kv_leftright, kt_range, KSCF_ADDRESSPOOL, NULL, NULL, },
{ "auth", kv_conn | kv_leftright, kt_enum, KNCF_AUTH, kw_auth_list, NULL, },
#ifdef HAVE_IPTABLES
@@ -471,6 +485,8 @@ const struct keyword_def ipsec_conf_keywords[] = {
{ "esn", kv_conn | kv_processed, kt_enum, KNCF_ESN, kw_esn_list, NULL, },
{ "decap-dscp", kv_conn | kv_processed, kt_bool, KNCF_DECAP_DSCP, NULL, NULL, },
{ "nopmtudisc", kv_conn | kv_processed, kt_bool, KNCF_NOPMTUDISC, NULL, NULL, },
+ { "ike_frag", kv_conn | kv_processed | kv_alias, kt_enum, KNCF_IKE_FRAG, kw_ynf_list, NULL, }, /* obsolete _ */
+ { "ike-frag", kv_conn | kv_processed | kv_alias, kt_enum, KNCF_IKE_FRAG, kw_ynf_list, NULL, }, /* obsolete name */
{ "fragmentation", kv_conn | kv_processed, kt_enum, KNCF_IKE_FRAG, kw_ynf_list, NULL, },
{ "mobike", kv_conn, kt_bool, KNCF_MOBIKE, NULL, NULL, },
{ "narrowing", kv_conn, kt_bool, KNCF_IKEv2_ALLOW_NARROWING, NULL, NULL, },
@@ -481,13 +497,18 @@ const struct keyword_def ipsec_conf_keywords[] = {
{ "accept-redirect-to", kv_conn, kt_string, KSCF_ACCEPT_REDIRECT_TO, NULL, NULL, },
{ "pfs", kv_conn, kt_bool, KNCF_PFS, NULL, NULL, },
+ { "nat_keepalive", kv_conn | kv_alias, kt_bool, KNCF_NAT_KEEPALIVE, NULL, NULL, }, /* obsolete _ */
{ "nat-keepalive", kv_conn, kt_bool, KNCF_NAT_KEEPALIVE, NULL, NULL, },
+ { "initial_contact", kv_conn | kv_alias, kt_bool, KNCF_INITIAL_CONTACT, NULL, NULL, }, /* obsolete _ */
{ "initial-contact", kv_conn, kt_bool, KNCF_INITIAL_CONTACT, NULL, NULL, },
+ { "cisco_unity", kv_conn | kv_alias, kt_bool, KNCF_CISCO_UNITY, NULL, NULL, }, /* obsolete _ */
{ "cisco-unity", kv_conn, kt_bool, KNCF_CISCO_UNITY, NULL, NULL, },
{ "send-no-esp-tfc", kv_conn, kt_bool, KNCF_NO_ESP_TFC, NULL, NULL, },
{ "fake-strongswan", kv_conn, kt_bool, KNCF_VID_STRONGSWAN, NULL, NULL, },
+ { "send_vendorid", kv_conn | kv_alias, kt_bool, KNCF_SEND_VENDORID, NULL, NULL, }, /* obsolete _ */
{ "send-vendorid", kv_conn, kt_bool, KNCF_SEND_VENDORID, NULL, NULL, },
+ { "sha2_truncbug", kv_conn | kv_alias, kt_bool, KNCF_SHA2_TRUNCBUG, NULL, NULL, }, /* obsolete _ */
{ "sha2-truncbug", kv_conn, kt_bool, KNCF_SHA2_TRUNCBUG, NULL, NULL, },
{ "ms-dh-downgrade", kv_conn, kt_bool, KNCF_MSDH_DOWNGRADE, NULL, NULL, },
{ "require-id-on-certificate", kv_conn, kt_bool, KNCF_SAN_ON_CERT, NULL, NULL, },
@@ -505,7 +526,10 @@ const struct keyword_def ipsec_conf_keywords[] = {
{"ikepad", kv_conn, kt_bool, KNCF_IKEPAD, NULL, NULL, },
{ "nat-ikev1-method", kv_conn | kv_processed, kt_enum, KNCF_IKEV1_NATT, kw_ikev1natt_list, NULL, },
+ { "labeled_ipsec", kv_conn, kt_obsolete, KNCF_WARNIGNORE, NULL, NULL, }, /* obsolete */
+ { "labeled-ipsec", kv_conn, kt_obsolete, KNCF_WARNIGNORE, NULL, NULL, }, /* obsolete */
{ "policy-label", kv_conn, kt_string, KSCF_SA_SEC_LABEL, NULL, NULL, }, /* obsolete variant */
+ { "policy_label", kv_conn, kt_string, KSCF_SA_SEC_LABEL, NULL, NULL, }, /* obsolete variant */
{ "sec-label", kv_conn, kt_string, KSCF_SA_SEC_LABEL, NULL, NULL, }, /* really stored into struct end */
/* Cisco interop: remote peer type */
@@ -516,13 +540,17 @@ const struct keyword_def ipsec_conf_keywords[] = {
/* Network Manager support */
#ifdef HAVE_NM
{ "nm-configured", kv_conn, kt_bool, KNCF_NMCONFIGURED, NULL, NULL, },
+ { "nm_configured", kv_conn, kt_bool, KNCF_NMCONFIGURED, NULL, NULL, }, /* obsolete _ */
#endif
{ "xauthby", kv_conn, kt_enum, KNCF_XAUTHBY, kw_xauthby_list, NULL, },
{ "xauthfail", kv_conn, kt_enum, KNCF_XAUTHFAIL, kw_xauthfail_list, NULL, },
{ "modecfgpull", kv_conn, kt_invertbool, KNCF_MODECONFIGPULL, NULL, NULL, },
{ "modecfgdns", kv_conn, kt_string, KSCF_MODECFGDNS, NULL, NULL, },
+ { "modecfgdns1", kv_conn | kv_alias, kt_string, KSCF_MODECFGDNS, NULL, NULL, }, /* obsolete */
+ { "modecfgdns2", kv_conn, kt_obsolete, KNCF_WARNIGNORE, NULL, NULL, }, /* obsolete */
{ "modecfgdomains", kv_conn, kt_string, KSCF_MODECFGDOMAINS, NULL, NULL, },
+ { "modecfgdomain", kv_conn | kv_alias, kt_string, KSCF_MODECFGDOMAINS, NULL, NULL, }, /* obsolete */
{ "modecfgbanner", kv_conn, kt_string, KSCF_MODECFGBANNER, NULL, NULL, },
{ "ignore-peer-dns", kv_conn, kt_bool, KNCF_IGNORE_PEER_DNS, NULL, NULL, },
{ "mark", kv_conn, kt_string, KSCF_CONN_MARK_BOTH, NULL, NULL, },
--
2.39.0

54
SOURCES/libreswan-4.12-ikev2-auth-delete-state.patch Normal file
View File

@ -0,0 +1,54 @@
From 2ec448884a7467743699803f8a36ee28d237666c Mon Sep 17 00:00:00 2001
From: Andrew Cagney <cagney@gnu.org>
Date: Wed, 28 Feb 2024 08:29:53 -0500
Subject: [PATCH] ikev2: return STF_FATAL when initiator fails to emit AUTH
packet
---
programs/pluto/ikev2_ike_auth.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/programs/pluto/ikev2_ike_auth.c b/programs/pluto/ikev2_ike_auth.c
index 192eb1b3b6..a54a109699 100644
--- a/programs/pluto/ikev2_ike_auth.c
+++ b/programs/pluto/ikev2_ike_auth.c
@@ -1267,7 +1267,7 @@ static stf_status process_v2_IKE_AUTH_request_auth_signature_continue(struct ike
/* now send AUTH payload */
if (!emit_local_v2AUTH(ike, auth_sig, &ike->sa.st_v2_id_payload.mac, response.pbs)) {
- return STF_INTERNAL_ERROR;
+ return STF_FATAL;
}
ike->sa.st_v2_ike_intermediate.used = false;
--
2.44.0
From 16272f2475d25baab58fbed2af7c67cfb459137f Mon Sep 17 00:00:00 2001
From: Andrew Cagney <cagney@gnu.org>
Date: Thu, 29 Feb 2024 12:19:20 -0500
Subject: [PATCH] ikev2: always return STF_FATAL if emitting AUTH fails
Fix:
ikev2: return STF_FATAL when initiator fails to emit AUTH packet
which really fixed the responder.
---
programs/pluto/ikev2_ike_auth.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/programs/pluto/ikev2_ike_auth.c b/programs/pluto/ikev2_ike_auth.c
index a54a109699..491053fb10 100644
--- a/programs/pluto/ikev2_ike_auth.c
+++ b/programs/pluto/ikev2_ike_auth.c
@@ -397,7 +397,7 @@ stf_status initiate_v2_IKE_AUTH_request_signature_continue(struct ike_sa *ike,
/* send out the AUTH payload */
if (!emit_local_v2AUTH(ike, auth_sig, &ike->sa.st_v2_id_payload.mac, request.pbs)) {
- return STF_INTERNAL_ERROR;
+ return STF_FATAL;
}
if (LIN(POLICY_MOBIKE, ike->sa.st_connection->policy)) {
--
2.44.0

11
SOURCES/libreswan-4.3-1934186-config.patch Normal file
View File

@ -0,0 +1,11 @@
diff -Naur libreswan-4.3-orig/configs/ipsec.conf.in libreswan-4.3/configs/ipsec.conf.in
--- libreswan-4.3-orig/configs/ipsec.conf.in 2021-03-04 14:29:50.591912834 -0500
+++ libreswan-4.3/configs/ipsec.conf.in 2021-03-04 14:30:27.227389433 -0500
@@ -32,6 +32,7 @@
# listen-tcp=yes
# To enable IKE and IPsec over TCP for VPN client, also specify
# tcp-remote-port=4500 in the client's conn section.
+ virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v4:100.64.0.0/10,%v6:fd00::/8,%v6:fe80::/10
# if it exists, include system wide crypto-policy defaults
# include /etc/crypto-policies/back-ends/libreswan.config

85
SOURCES/libreswan-4.3-maintain-different-v1v2-split.patch Normal file
View File

@ -0,0 +1,85 @@
From 83487373fdd77437e51cfccd41532e270e279e05 Mon Sep 17 00:00:00 2001
From: rpm-build <rpm-build>
Date: Tue, 10 Jan 2023 00:11:26 +0900
Subject: [PATCH] libreswan-4.3-maintain-different-v1v2-split.patch
---
configs/d.ipsec.conf/ikev2.xml | 14 +++++++-------
lib/libipsecconf/confread.c | 8 +++++++-
programs/whack/whack.c | 4 ++--
3 files changed, 16 insertions(+), 10 deletions(-)
diff --git a/configs/d.ipsec.conf/ikev2.xml b/configs/d.ipsec.conf/ikev2.xml
index 3d03825..285db1b 100644
--- a/configs/d.ipsec.conf/ikev2.xml
+++ b/configs/d.ipsec.conf/ikev2.xml
@@ -2,14 +2,14 @@
<term><emphasis remap='B'>ikev2</emphasis></term>
<listitem>
<para>Whether to use IKEv2 (RFC 7296) or IKEv1 (RFC 4301).
-Currently the accepted values are <emphasis remap='B'>yes</emphasis> (the default),
-signifying only IKEv2 is accepted, or <emphasis remap='B'>no</emphasis>,
+Currently the accepted values are <emphasis remap='B'>insist</emphasis> (the default),
+signifying only IKEv2 is accepted, or <emphasis remap='B'>no</emphasis> (or <emphasis remap='B'>never</emphasis>),
signifying only IKEv1 is accepted. Previous versions allowed the keywords
-<emphasis remap='B'>propose</emphasis> or <emphasis remap='B'>permit</emphasis>
-that would allow either IKEv1 or IKEv2, but this is no longer supported. The
-permit option is interpreted as no and the propose option is interpreted as
-yes. Older versions also supported keyword
-<emphasis remap='B'>insist</emphasis> which is now interpreted as yes.
+<emphasis remap='B'>propose</emphasis>, <emphasis remap='B'>yes</emphasis> or <emphasis remap='B'>permit</emphasis>
+that would allow either IKEv1 or IKEv2, but this is no longer supported and both options
+now cause the connection to fail to load. <emphasis remap='B'>WARNING:</emphasis> This behaviour differs from upstream
+libreswan, which only accepts <emphasis remap='B'>yes</emphasis> or <emphasis remap='B'>no</emphasis> where yes means
+the same as insist.
</para>
</listitem>
</varlistentry>
diff --git a/lib/libipsecconf/confread.c b/lib/libipsecconf/confread.c
index b95c90a..e752441 100644
--- a/lib/libipsecconf/confread.c
+++ b/lib/libipsecconf/confread.c
@@ -1340,11 +1340,17 @@ static bool load_conn(struct starter_conn *conn,
switch (conn->options[KNCF_IKEv2]) {
case fo_never:
- case fo_permit:
conn->ike_version = IKEv1;
break;
+ case fo_permit:
+ starter_error_append(perrl, "ikev2=permit is no longer accepted. Use ikev2=insist or ikev2=no|never");
+ return true;
+
case fo_propose:
+ starter_error_append(perrl, "ikev2=propose or ikev2=yes is no longer accepted. Use ikev2=insist or ikev2=no|never");
+ return true;
+
case fo_insist:
conn->ike_version = IKEv2;
break;
diff --git a/programs/whack/whack.c b/programs/whack/whack.c
index b512b04..3de020e 100644
--- a/programs/whack/whack.c
+++ b/programs/whack/whack.c
@@ -815,7 +815,7 @@ static const struct option long_opts[] = {
{ "ikev1-allow", no_argument, NULL, CD_IKEv1 + OO }, /* obsolete name */
{ "ikev2", no_argument, NULL, CD_IKEv2 +OO },
{ "ikev2-allow", no_argument, NULL, CD_IKEv2 +OO }, /* obsolete name */
- { "ikev2-propose", no_argument, NULL, CD_IKEv2 +OO }, /* obsolete, map onto allow */
+ /* not in RHEL8 { "ikev2-propose", no_argument, NULL, CD_IKEv2 +OO }, */
PS("allow-narrowing", IKEV2_ALLOW_NARROWING),
#ifdef AUTH_HAVE_PAM
@@ -1802,7 +1802,7 @@ int main(int argc, char **argv)
end_seen = LEMPTY;
continue;
- /* --ikev1 --ikev2 --ikev2-propose */
+ /* --ikev1 --ikev2 */
case CD_IKEv1:
case CD_IKEv2:
{
--
2.39.0

63
SOURCES/libreswan-4.6-ikev1-policy-defaults-to-drop.patch
View File

@ -1,63 +0,0 @@
From 13720e0dedcab1eaf3334a73a42b68581acd9f3b Mon Sep 17 00:00:00 2001
From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Date: Fri, 7 Jan 2022 18:36:47 -0500
Subject: [PATCH] ikev1-policy defaults to drop
IKEv2 has been available for 16 years (RFC 4306 was published December
2005). At some point, we should be discouraging IKEv1 adoption.
To the extent that a user needs IKEv1, they can manually add
ikev1-policy=accept to /etc/ipsec.conf.
---
configs/d.ipsec.conf/ikev1-policy.xml | 7 ++++---
include/ipsecconf/keywords.h | 2 +-
lib/libipsecconf/confread.c | 1 +
programs/pluto/server.c | 5 -----
4 files changed, 6 insertions(+), 9 deletions(-)
diff --git a/configs/d.ipsec.conf/ikev1-policy.xml b/configs/d.ipsec.conf/ikev1-policy.xml
index 17d1747e3b..3bd6702564 100644
--- a/configs/d.ipsec.conf/ikev1-policy.xml
+++ b/configs/d.ipsec.conf/ikev1-policy.xml
@@ -3,9 +3,10 @@
<listitem>
<para>
What to do with received IKEv1 packets. Valid options are
-<emphasis remap='B'>accept</emphasis> (default), <emphasis remap='B'>reject</emphasis> which
-will reply with an error, and <emphasis remap='B'>drop</emphasis> which will silently drop
-any received IKEv1 packet. If this option is set to drop or reject, an attempt to load an
+<emphasis remap='B'>drop</emphasis> (default) which will silently drop
+any received IKEv1 packet, <emphasis remap='B'>accept</emphasis>, and
+<emphasis remap='B'>reject</emphasis> which will reply with an error.
+If this option is set to drop or reject, an attempt to load an
IKEv1 connection will fail, as these connections would never be able to receive a packet
for processing.
</para>
diff --git a/include/ipsecconf/keywords.h b/include/ipsecconf/keywords.h
index 660847733c..31b519242a 100644
--- a/include/ipsecconf/keywords.h
+++ b/include/ipsecconf/keywords.h
@@ -111,7 +111,7 @@ enum keyword_numeric_config_field {
KBF_LISTEN_TCP, /* listen on TCP port 4500 - default no */
KBF_LISTEN_UDP, /* listen on UDP port 500/4500 - default yes */
- KBF_GLOBAL_IKEv1, /* global ikev1 policy - default accept */
+ KBF_GLOBAL_IKEv1, /* global ikev1 policy - default drop */
KBF_ROOF
};
diff --git a/lib/libipsecconf/confread.c b/lib/libipsecconf/confread.c
index 5b5aba723f..68fbccf442 100644
--- a/lib/libipsecconf/confread.c
+++ b/lib/libipsecconf/confread.c
@@ -95,6 +95,7 @@ static void ipsecconf_default_values(struct starter_config *cfg)
/* Don't inflict BSI requirements on everyone */
SOPT(KBF_SEEDBITS, 0);
SOPT(KBF_DROP_OPPO_NULL, false);
+ SOPT(KBF_GLOBAL_IKEv1, GLOBAL_IKEv1_DROP);
#ifdef HAVE_LABELED_IPSEC
SOPT(KBF_SECCTX, SECCTX);
--
2.34.1

52
SOURCES/libreswan-4.9-2176248-authby-rsasig.patch Normal file
View File

@ -0,0 +1,52 @@
From 000b230258dd272ab15b384c330c31f996d0ba18 Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Fri, 14 Apr 2023 14:10:47 +0900
Subject: [PATCH] Ignore system crypto-policies for SHA-1 for legacy
authby=rsa-sha1
Signed-off-by: Daiki Ueno <dueno@redhat.com>
---
lib/libswan/pubkey_rsa.c | 24 ++++++++++++++++++++++++
1 file changed, 24 insertions(+)
diff --git a/lib/libswan/pubkey_rsa.c b/lib/libswan/pubkey_rsa.c
index 38b44ab61d..9a7c0bc6a8 100644
--- a/lib/libswan/pubkey_rsa.c
+++ b/lib/libswan/pubkey_rsa.c
@@ -501,9 +501,33 @@ static struct hash_signature RSA_sign_hash_pkcs1_1_5_rsa(const struct secret_stu
* used to generate the signature.
*/
SECItem signature_result = {0};
+
+ /* ignore system crypto-policies for the hash algorithm */
+ PRUint32 saved_policy;
+
+ if (NSS_GetAlgorithmPolicy(hash_algo->nss.oid_tag, &saved_policy) != SECSuccess) {
+ /* PR_GetError() returns the thread-local error */
+ enum_buf tb;
+ llog_nss_error(RC_LOG_SERIOUS, logger,
+ "NSS_SetAlgorithmPolicy(%s) function failed",
+ str_nss_oid(hash_algo->nss.oid_tag, &tb));
+ return (struct hash_signature) { .len = 0, };
+ }
+
+ if (!(saved_policy & NSS_USE_ALG_IN_SIGNATURE)) {
+ (void)NSS_SetAlgorithmPolicy(hash_algo->nss.oid_tag,
+ NSS_USE_ALG_IN_SIGNATURE, 0);
+ }
+
SECStatus s = SGN_Digest(pks->u.pubkey.private_key,
hash_algo->nss.oid_tag,
&signature_result, &digest);
+
+ if (!(saved_policy & NSS_USE_ALG_IN_SIGNATURE)) {
+ (void)NSS_SetAlgorithmPolicy(hash_algo->nss.oid_tag,
+ saved_policy, ~saved_policy);
+ }
+
if (s != SECSuccess) {
/* PR_GetError() returns the thread-local error */
enum_buf tb;
--
2.40.0

84
SOURCES/libreswan-4.9-cve-2023-23009.patch
View File

@ -1,84 +0,0 @@
From 7a6c217f47b1ae37e32b173dc6d3ea7fdb86d532 Mon Sep 17 00:00:00 2001
From: Paul Wouters <paul.wouters@aiven.io>
Date: Tue, 28 Feb 2023 11:24:22 -0500
Subject: [PATCH 1/2] pluto: abort processing corrupt TS payloads
CVE-2023-23009
Latest updates on this issue at https://libreswan.org/security/CVE-2023-23009
---
programs/pluto/ikev2_ts.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/programs/pluto/ikev2_ts.c b/programs/pluto/ikev2_ts.c
index 3f7519ca38..f06c40ba46 100644
--- a/programs/pluto/ikev2_ts.c
+++ b/programs/pluto/ikev2_ts.c
@@ -437,6 +437,11 @@ static bool v2_parse_tss(struct payload_digest *const ts_pd,
d = pbs_in_struct(&ts_pd->pbs, &ikev2_ts_header_desc,
&ts_h, sizeof(ts_h), &ts_body_pbs);
+ if (d != NULL) {
+ llog_diag(RC_LOG, logger, &d, "%s", "");
+ return false;
+ }
+
switch (ts_h.isath_type) {
case IKEv2_TS_IPV4_ADDR_RANGE:
case IKEv2_TS_IPV6_ADDR_RANGE:
--
2.39.2
From 52c19ccc9455ccd91fa4946b09f8e11222f1c923 Mon Sep 17 00:00:00 2001
From: Andrew Cagney <cagney@gnu.org>
Date: Tue, 28 Feb 2023 14:10:44 -0500
Subject: [PATCH 2/2] ikev1: only clean up a connection when it isn't deleted
fix #1018 reported by Wolfgang.
see also ecb9c88910df1fb070488835bf3180096f3ccba3:
IKEv1: Remove all IPsec SA's of a connection when newest SA is removed.
---
programs/pluto/ikev1_main.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/programs/pluto/ikev1_main.c b/programs/pluto/ikev1_main.c
index a616c5ccf3..21765d4002 100644
--- a/programs/pluto/ikev1_main.c
+++ b/programs/pluto/ikev1_main.c
@@ -2130,15 +2130,16 @@ bool accept_delete(struct msg_digest *md,
ntohl(spi));
}
- struct connection *rc = dst->st_connection;
+ /* save for post delete_state() code */
+ co_serial_t rc_serialno = dst->st_connection->serialno;
if (nat_traversal_enabled && dst->st_connection->ikev1_natt != NATT_NONE) {
nat_traversal_change_port_lookup(md, dst);
v1_maybe_natify_initiator_endpoints(st, HERE);
}
- if (rc->newest_ipsec_sa == dst->st_serialno &&
- (rc->policy & POLICY_UP)) {
+ if (dst->st_connection->newest_ipsec_sa == dst->st_serialno &&
+ (dst->st_connection->policy & POLICY_UP)) {
/*
* Last IPsec SA for a permanent
* connection that we have initiated.
@@ -2162,7 +2163,12 @@ bool accept_delete(struct msg_digest *md,
md->v1_st = NULL;
}
- if (rc->newest_ipsec_sa == SOS_NOBODY) {
+ /*
+ * Either .newest_ipsec_sa matches DST
+ * and is cleared, or was never set.
+ */
+ struct connection *rc = connection_by_serialno(rc_serialno);
+ if (rc != NULL && rc->newest_ipsec_sa == SOS_NOBODY) {
dbg("%s() connection '%s' -POLICY_UP", __func__, rc->name);
rc->policy &= ~POLICY_UP;
if (!shared_phase1_connection(rc)) {
--
2.39.2

129
SOURCES/libreswan-4.9-cve-2023-30570.patch
View File

@ -1,129 +0,0 @@
diff --git a/programs/pluto/ikev1.c b/programs/pluto/ikev1.c
index e0615323ed..401618b6dd 100644
--- a/programs/pluto/ikev1.c
+++ b/programs/pluto/ikev1.c
@@ -1101,10 +1101,20 @@ void process_v1_packet(struct msg_digest *md)
struct state *st = NULL;
enum state_kind from_state = STATE_UNDEFINED; /* state we started in */
+ /*
+ * For the initial responses, don't leak the responder's SPI.
+ * Hence the use of send_v1_notification_from_md().
+ *
+ * AGGR mode is a mess in that the R0->R1 transition happens
+ * well before the transition succeeds.
+ */
#define SEND_NOTIFICATION(t) \
{ \
pstats(ikev1_sent_notifies_e, t); \
- if (st != NULL) \
+ if (st != NULL && \
+ st->st_state->kind != STATE_AGGR_R0 && \
+ st->st_state->kind != STATE_AGGR_R1 && \
+ st->st_state->kind != STATE_MAIN_R0) \
send_v1_notification_from_state(st, from_state, t); \
else \
send_v1_notification_from_md(md, t); \
@@ -1168,17 +1178,26 @@ void process_v1_packet(struct msg_digest *md)
from_state = (md->hdr.isa_xchg == ISAKMP_XCHG_IDPROT ?
STATE_MAIN_R0 : STATE_AGGR_R0);
} else {
- /* not an initial message */
+ /*
+ * Possibly not an initial message. Possibly
+ * from initiator. Possibly from responder.
+ *
+ * Possibly. Which is probably hopeless.
+ */
st = find_state_ikev1(&md->hdr.isa_ike_spis,
md->hdr.isa_msgid);
if (st == NULL) {
/*
- * perhaps this is a first message
+ * Perhaps this is a first message
* from the responder and contains a
* responder cookie that we've not yet
* seen.
+ *
+ * Perhaps this is a random message
+ * with a bogus non-zero responder IKE
+ * SPI.
*/
st = find_state_ikev1_init(&md->hdr.isa_ike_initiator_spi,
md->hdr.isa_msgid);
@@ -1189,6 +1208,21 @@ void process_v1_packet(struct msg_digest *md)
/* XXX Could send notification back */
return;
}
+ if (st->st_state->kind == STATE_AGGR_R0) {
+ /*
+ * The only way for this to
+ * happen is for the attacker
+ * to guess the responder's
+ * IKE SPI that hasn't been
+ * sent over the wire?
+ *
+ * Well that or played 1/2^32
+ * odds.
+ */
+ llog_pexpect(md->md_logger, HERE,
+ "phase 1 message matching AGGR_R0 state");
+ return;
+ }
}
from_state = st->st_state->kind;
}
@@ -2870,7 +2904,28 @@ void complete_v1_state_transition(struct state *st, struct msg_digest *md, stf_s
delete_state(st);
/* wipe out dangling pointer to st */
md->v1_st = NULL;
+ } else if (st->st_state->kind == STATE_AGGR_R0 ||
+ st->st_state->kind == STATE_AGGR_R1 ||
+ st->st_state->kind == STATE_MAIN_R0) {
+ /*
+ *
+ * Wipe out the incomplete larval state.
+ *
+ * ARGH! In <=v4.10, the aggr code flipped the
+ * larval state to R1 right at the start of
+ * the transition and not the end, so using
+ * state to figure things out is close to
+ * useless.
+ *
+ * Deleting the state means that pluto has no
+ * way to detect and ignore amplification
+ * attacks.
+ */
+ delete_state(st);
+ /* wipe out dangling pointer to st */
+ md->v1_st = NULL;
}
+
break;
}
}
diff --git a/programs/pluto/ikev1_aggr.c b/programs/pluto/ikev1_aggr.c
index 2732951beb..87be80cb6c 100644
--- a/programs/pluto/ikev1_aggr.c
+++ b/programs/pluto/ikev1_aggr.c
@@ -169,7 +169,7 @@ stf_status aggr_inI1_outR1(struct state *null_st UNUSED,
/* Set up state */
struct ike_sa *ike = new_v1_rstate(c, md);
md->v1_st = &ike->sa; /* (caller will reset cur_state) */
- change_v1_state(&ike->sa, STATE_AGGR_R1);
+ change_v1_state(&ike->sa, STATE_AGGR_R0);
/*
* Warn when peer is expected to use especially dangerous
@@ -197,7 +197,8 @@ stf_status aggr_inI1_outR1(struct state *null_st UNUSED,
if (!v1_decode_certs(md)) {
llog_sa(RC_LOG, ike, "X509: CERT payload bogus or revoked");
- return false;
+ /* XXX notification is in order! */
+ return STF_FAIL_v1N + v1N_INVALID_ID_INFORMATION;
}
/*

321
SPECS/libreswan.spec
View File

@ -3,53 +3,63 @@
%global with_efence 0
%global with_development 0
%global with_cavstests 1
%global nss_version 3.52
# minimum version for support for rhbz#1651314
# should prob update for nss with IKEv1 quick mode support
%global nss_version 3.53.1
%global unbound_version 1.6.6
# Libreswan config options
%global libreswan_config \\\
FINALLIBEXECDIR=%{_libexecdir}/ipsec \\\
FINALMANDIR=%{_mandir} \\\
PREFIX=%{_prefix} \\\
FINALNSSDIR=%{_sysconfdir}/ipsec.d \\\
INITSYSTEM=systemd \\\
NSS_HAS_IPSEC_PROFILE=true \\\
NSS_REQ_AVA_COPY=false \\\
PREFIX=%{_prefix} \\\
PYTHON_BINARY=%{__python3} \\\
SHELL_BINARY=%{_bindir}/sh \\\
USE_DNSSEC=true \\\
USE_FIPSCHECK=false \\\
USE_LABELED_IPSEC=true \\\
USE_LDAP=true \\\
USE_LIBCAP_NG=true \\\
USE_LIBCURL=true \\\
USE_LINUX_AUDIT=true \\\
USE_NM=true \\\
USE_NSS_IPSEC_PROFILE=true \\\
USE_NSS_KDF=true \\\
USE_SECCOMP=true \\\
USE_AUTHPAM=true \\\
USE_DH2=true \\\
%{nil}
#global prever dr1
#global prever rc1
Name: libreswan
Summary: Internet Key Exchange (IKEv1 and IKEv2) implementation for IPsec
Summary: IPsec implementation with IKEv1 and IKEv2 keying protocols
# version is generated in the release script
Version: 4.9
Release: %{?prever:0.}4%{?prever:.%{prever}}%{?dist}
Version: 4.12
Release: %{?prever:0.}2%{?prever:.%{prever}}%{?dist}.3
License: GPLv2
Url: https://libreswan.org/
Source0: https://download.libreswan.org/%{?prever:development/}%{name}-%{version}%{?prever}.tar.gz
Source0: https://download.libreswan.org/%{?prever:with_development/}%{name}-%{version}%{?prever}.tar.gz
%if 0%{with_cavstests}
Source1: https://download.libreswan.org/cavs/ikev1_dsa.fax.bz2
Source2: https://download.libreswan.org/cavs/ikev1_psk.fax.bz2
Source3: https://download.libreswan.org/cavs/ikev2.fax.bz2
%endif
Patch: libreswan-4.6-ikev1-policy-defaults-to-drop.patch
Patch: libreswan-4.9-cve-2023-23009.patch
Patch: libreswan-4.9-cve-2023-30570.patch
Patch1: libreswan-4.3-maintain-different-v1v2-split.patch
Patch2: libreswan-3.32-1861360-nodefault-rsa-pss.patch
Patch3: libreswan-4.1-maintain-obsolete-keywords.patch
Patch6: libreswan-4.3-1934186-config.patch
Patch7: libreswan-4.9-2176248-authby-rsasig.patch
Patch8: libreswan-4.12-ikev2-auth-delete-state.patch
BuildRequires: audit-libs-devel
BuildRequires: bison
BuildRequires: curl-devel
BuildRequires: flex
BuildRequires: gcc make
BuildRequires: hostname
BuildRequires: ldns-devel
BuildRequires: libcap-ng-devel
BuildRequires: libevent-devel
@ -57,10 +67,12 @@ BuildRequires: libseccomp-devel
BuildRequires: libselinux-devel
BuildRequires: nspr-devel
BuildRequires: nss-devel >= %{nss_version}
BuildRequires: nss-tools >= %{nss_version}
BuildRequires: nss-tools
BuildRequires: openldap-devel
BuildRequires: pam-devel
BuildRequires: pkgconfig
BuildRequires: hostname
BuildRequires: redhat-rpm-config
BuildRequires: systemd-devel
BuildRequires: unbound-devel >= %{unbound_version}
BuildRequires: xmlto
@ -79,7 +91,7 @@ Requires(preun): systemd
Requires(postun): systemd
%description
Libreswan is a free implementation of IPsec & IKE for Linux. IPsec is
Libreswan is a free implementation of IKE/IPsec for Linux. IPsec is
the Internet Protocol Security and uses strong cryptography to provide
both authentication and encryption services. These services allow you
to build secure tunnels through untrusted networks. Everything passing
@ -96,9 +108,18 @@ Libreswan is based on Openswan-2.6.38 which in turn is based on FreeS/WAN-2.04
%prep
%setup -q -n libreswan-%{version}%{?prever}
%patch1 -p1
%patch2 -p1
%patch3 -p1
%patch6 -p1
%patch7 -p1
%patch8 -p1
# linking to freebl is not needed
sed -i "s/-lfreebl //" mk/config.mk
# enable crypto-policies support
sed -i "s:#[ ]*include \(.*\)\(/crypto-policies/back-ends/libreswan.config\)$:include \1\2:" configs/ipsec.conf.in
%autopatch -p1
%build
make %{?_smp_mflags} \
@ -107,21 +128,20 @@ make %{?_smp_mflags} \
%else
OPTIMIZE_CFLAGS="%{optflags}" \
%endif
WERROR_CFLAGS="-Werror -Wno-missing-field-initializers -Wno-lto-type-mismatch -Wno-maybe-uninitialized" \
%if 0%{with_efence}
USE_EFENCE=true \
%endif
USERLINK="%{?__global_ldflags} -Wl,-z,relro -Wl,--as-needed -Wl,-z,now -flto --no-lto" \
WERROR_CFLAGS="-Werror -Wno-missing-field-initializers" \
USERLINK="%{?__global_ldflags}" \
%{libreswan_config} \
programs
FS=$(pwd)
%install
make \
DESTDIR=%{buildroot} \
%{libreswan_config} \
install
DESTDIR=%{buildroot} \
%{libreswan_config} \
install
FS=$(pwd)
rm -rf %{buildroot}/usr/share/doc/libreswan
rm -rf %{buildroot}%{_libexecdir}/ipsec/*check
@ -131,10 +151,10 @@ install -d %{buildroot}%{_sbindir}
install -d %{buildroot}%{_sysconfdir}/sysctl.d
install -m 0644 packaging/fedora/libreswan-sysctl.conf \
%{buildroot}%{_sysconfdir}/sysctl.d/50-libreswan.conf
%{buildroot}%{_sysconfdir}/sysctl.d/50-libreswan.conf
echo "include %{_sysconfdir}/ipsec.d/*.secrets" \
> %{buildroot}%{_sysconfdir}/ipsec.secrets
> %{buildroot}%{_sysconfdir}/ipsec.secrets
rm -fr %{buildroot}%{_sysconfdir}/rc.d/rc*
%if 0%{with_cavstests}
@ -155,7 +175,6 @@ bunzip2 *.fax.bz2
%{buildroot}%{_libexecdir}/ipsec/cavp -v1psk ikev1_psk.fax | \
diff -u ikev1_psk.fax - > /dev/null
: CAVS tests passed
%endif
# Some of these tests will show ERROR for negative testing - it will exit on real errors
%{buildroot}%{_libexecdir}/ipsec/algparse -tp || { echo prooposal test failed; exit 1; }
@ -168,6 +187,8 @@ certutil -N -d sql:$tmpdir --empty-password
%{buildroot}%{_libexecdir}/ipsec/pluto --selftest --nssdir $tmpdir --rundir $tmpdir
: pluto self-test passed - verify FIPS algorithms allowed is still compliant with NIST
%endif
%post
%systemd_post ipsec.service
@ -187,180 +208,172 @@ certutil -N -d sql:$tmpdir --empty-password
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipsec.d/policies/*
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/sysctl.d/50-libreswan.conf
%attr(0755,root,root) %dir %{_rundir}/pluto
%attr(0700,root,root) %dir %{_sharedstatedir}/ipsec
%attr(0700,root,root) %dir %{_sharedstatedir}/ipsec/nss
%attr(0644,root,root) %{_tmpfilesdir}/libreswan.conf
%attr(0644,root,root) %{_unitdir}/ipsec.service
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/pam.d/pluto
%config(noreplace) %{_sysconfdir}/logrotate.d/libreswan
%{_sbindir}/ipsec
%{_libexecdir}/ipsec
%doc %{_mandir}/*/*
%attr(0644,root,root) %doc %{_mandir}/*/*
%changelog
* Thu May 04 2023 Sahana Prasad <sahana@redhat.com> - 4.9-4
- Just bumping up the version as an incorrect 9.3 build was created.
- Related: rhbz#2187171
* Wed Apr 17 2024 Daiki Ueno <dueno@redhat.com> - 4.12-2.3
- Bump release to ensure el8 package is greater than el8_* packages
* Thu May 04 2023 Sahana Prasad <sahana@redhat.com> - 4.9-3
- Fix CVE-2023-30570:Malicious IKEv1 Aggressive Mode packets can crash
libreswan
- Resolves: rhbz#2187171
* Tue Apr 16 2024 Daiki Ueno <dueno@redhat.com> - 4.12-2.2
- Fix patch application in the previous change
* Tue Apr 4 2023 Daiki Ueno <dueno@redhat.com> - 4.9-2
- Fix CVE-2023-23009: remote DoS via crafted TS payload with an
incorrect selector length (rhbz#2173674)
* Mon Apr 15 2024 Daiki Ueno <dueno@redhat.com> - 4.12-2.1
- Fix CVE-2024-2357 (RHEL-28742)
* Wed Jan 4 2023 Daiki Ueno <dueno@redhat.com> - 4.9-1
- Update to 4.9. Resolves: rhbz#2128669
- Switch to using %%autopatch as in Fedora
* Fri Aug 25 2023 Daiki Ueno <dueno@redhat.com> - 4.12-2
- Resolves: rhbz#2234731 authby=rsasig fails in FIPS policy
* Wed Feb 2 2022 Daiki Ueno <dueno@redhat.com> - 4.6-3
- Drop IKEv1 packets by default, based on the Debian patch
by Daniel Kahn Gillmor (rhbz#2039877)
* Wed Aug 9 2023 Daiki Ueno <dueno@redhat.com> - 4.12-1
- Update to 4.12 to fix CVE-2023-38710, CVE-2023-38711, CVE-2023-38712
- Resolves: rhbz#2215955
* Mon Jan 17 2022 Daiki Ueno <dueno@redhat.com> - 4.6-2
- Related: rhbz#2017355 rebuild to reflect gating.yaml change
* Thu May 04 2023 Sahana Prasad <sahana@redhat.com> - 4.9-2
- Fix CVE-2023-30570 Malicious IKEv1 Aggressive Mode packets can crash libreswan
- Resolves: rhbz#2187179
* Mon Jan 17 2022 Daiki Ueno <dueno@redhat.com> - 4.6-1
- Update to 4.6. Resolves: rhbz#2017355
* Mon Jan 9 2023 Daiki Ueno <dueno@redhat.com> - 4.9-1
- Resolves: rhbz#2128672 Rebase libreswan to 4.9
- Remove libreswan-4.4-ikev1-disable-diagnostics.patch no longer necessary
* Mon Jan 10 2022 Daiki Ueno <dueno@redhat.com> - 4.5-1
- Update to 4.5. Resolves: rhbz#2017355
* Thu Jan 13 2022 Daiki Ueno <dueno@redhat.com> - 4.5-1
- Resolves: rhbz#2017352 Rebase libreswan to 4.5
- Resolves: rhbz#2036903 ikev1: disable diagnostics logging on receiving malformed packets
* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 4.4-3.1
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
Related: rhbz#1991688
* Wed May 26 2021 Daiki Ueno <dueno@redhat.com> - 4.4-1
- Resolves: rhbz#1958968 Rebase libreswan to 4.4
- Resolves: rhbz#1954423 Libreswan: TS_UNACCEPTABLE on multiple connections between the same peers
* Wed Jul 21 2021 Daiki Ueno <dueno@redhat.com> - 4.4-3
- Backport removal gethostbyname2 uses from the upstream
- Fix issues spotted by covscan (rhbz#1938784)
* Thu Mar 04 2021 Paul Wouters <pwouters@redhat.com> - 4.3-3
- Resolves: rhbz#1933064 - IKEv2 support for Labeled IPsec
- Resolves: rhbz#1935150 RFE: Support IKE and ESP over TCP: RFC 8229
- Resolves: rhbz#1935339 virtual_private setting is missing in the default config
* Tue Jul 13 2021 Daiki Ueno <dueno@redhat.com> - 4.4-2
- Rebuild with newer GCC to fix annocheck failures
* Sun Feb 21 2021 Paul Wouters <pwouters@redhat.com> - 4.3-1
- Resolves: rhbz#1025061 - IKEv2 support for Labeled IPsec [update]
* Thu Jul 1 2021 Daiki Ueno <dueno@redhat.com> - 4.4-1
- Update to 4.4. Resolves: rhbz#1975812
- Port compiler warning suppression by Paul Wouters:
https://src.fedoraproject.org/rpms/libreswan/c/8d7f98d41444ac77c562f735b4b93038f5346ce2?branch=rawhide
* Thu Feb 04 2021 Paul Wouters <pwouters@redhat.com> - 4.2-1
- Resolves: rhbz#1891128 [Rebase] rebase libreswan to 4.2
- Resolves: rhbz#1025061 - IKEv2 support for Labeled IPsec
* Thu Jun 24 2021 Daiki Ueno <dueno@redhat.com> - 4.2-1.3
- Fix FTBFS with OpenSSL 3.0 (rhbz#1975439)
* Tue Oct 27 22:11:42 EDT 2020 Paul Wouters <pwouters@redhat.com> - 4.1-1
- Resolves: rhbz#1891128 [Rebase] rebase libreswan to 4.1
- Resolves: rhbz#1889836 libreswan: add 3.x compat patches for obsoleted/removed keywords of 4.0 and re-port ikev2= patch
* Tue Jun 22 2021 Mohan Boddu <mboddu@redhat.com> - 4.2-1.2
- Rebuilt for RHEL 9 BETA for openssl 3.0
Related: rhbz#1971065
* Wed Jul 29 2020 Paul Wouters <pwouters@redhat.com> - 3.32-6
- Resolves: rhbz#1861360 authby=rsasig must not imply usage of rsa-pss
* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 4.2-1.1
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
* Wed Jul 22 2020 Paul Wouters <pwouters@redhat.com> - 3.32-5
- Resolves: rhbz#1820206 Rebase to libreswan 3.32 [rebuild for USE_NSS_PRF]
* Wed Feb 03 2021 Paul Wouters <pwouters@redhat.com> - 4.2-1
- Update to 4.2
* Wed Jul 01 2020 Paul Wouters <pwouters@redhat.com> - 3.32-4
- Resolves: rhbz#1544463 ipsec service does not work correctly when seccomp filtering is enabled
* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 4.2-0.1.rc1.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
* Wed Jun 17 2020 Paul Wouters <pwouters@redhat.com> - 3.32-3
- Resolves: rhbz#1842597 regression: libreswan does not send PLUTO_BYTES env variables to updown script
- Resolves: rhbz#1847766 subsequent xfrmi interfaces configured outside of libreswan are not recognised properly
- Resolves: rhbz#1840212 protect libreswan against unannounced nss ABI change
* Sat Dec 19 19:59:55 EST 2020 Paul Wouters <pwouters@redhat.com> - 4.2-0.1.rc1
- Resolves: rhbz#1867580 pluto process frequently dumps core
(disable USE_NSS_KDF until nss fixes have propagated)
* Thu Jun 11 2020 Paul Wouters <pwouters@redhat.com> - 3.32-2
- Resolves: rhbz#1820206 Rebase to libreswan 3.32 [addconn fix]
* Sat Dec 19 2020 Adam Williamson <awilliam@redhat.com> - 4.1-4
- Rebuild for ldns soname bump
* Thu Apr 30 2020 Paul Wouters <pwouters@redhat.com> - 3.32-1
- Resolves: rhbz#1820206 Rebase to libreswan 3.32
- Resolves: rhbz#1816265 Use NSS to check whether FIPS mode is enabled
- Resolves: rhbz#1826337 libreswan in FIPS mode rejects ECDSA keys based on faulty RSA key size check being applied
* Mon Nov 23 11:50:41 EST 2020 Paul Wouters <pwouters@redhat.com> - 4.1-3
- Resolves: rhbz#1894381 Libreswan 4.1-2 breaks l2tp connection to Windows VPN server
* Tue Aug 13 2019 Paul Wouters <pwouters@redhat.com> - 3.29-6
- Resolves: rhbz#1714331 support NSS based IKE KDF's [require updated nss for rhbz 1738689, memleak fix]
* Mon Oct 26 10:21:57 EDT 2020 Paul Wouters <pwouters@redhat.com> - 4.1-2
- Resolves: rhbz#1889538 libreswan's /var/lib/ipsec/nss missing
* Thu Aug 08 2019 Paul Wouters <pwouters@redhat.com> - 3.29-5
- Resolves: rhbz#1714331 support NSS based IKE KDF's so libreswan does not need FIPS certification
* Sun Oct 18 21:49:39 EDT 2020 Paul Wouters <pwouters@redhat.com> - 4.1-1
- Updated to 4.1 - interop fix for Cisco
* Thu Aug 01 2019 Paul Wouters <pwouters@redhat.com> - 3.29-4
- Resolves: rhbz#1699318 'ipsec show' has python3 invalid syntax
* Thu Oct 15 10:27:14 EDT 2020 Paul Wouters <pwouters@redhat.com> - 4.0-1
- Resolves: rhbz#1888448 libreswan-4.0 is available
* Thu Jul 04 2019 Paul Wouters <pwouters@redhat.com> - 3.29-3
- Resolves: rhbz#1725205 XFRM policy for OE/32 peer is deleted when shunts for previous half-open state expire
* Wed Sep 30 14:05:58 EDT 2020 Paul Wouters <pwouters@redhat.com> - 4.0-0.2.rc1
- Rebuild for libevent 2.1.12 with a soname bump
* Sun Sep 27 22:49:40 EDT 2020 Paul Wouters <pwouters@redhat.com> - 4.0-0.1.rc1
- Updated to 4.0rc1
* Thu Aug 27 2020 Paul Wouters <pwouters@redhat.com> - 3.32-4
- Resolves: rhbz#1864043 libreswan: FTBFS in Fedora rawhide/f33
* Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.32-3.2
- Second attempt - Rebuilt for
https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.32-3.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Tue Jun 30 2020 Jeff Law <law@redhat.com> - 3.32-3
- Initialize ppk_id_p in ikev2_parent_inR1outI2_tail to avoid uninitialized
object
* Tue May 26 2020 Paul Wouters <pwouters@redhat.com> - 3.32-2
- Backport NSS guarding fix for unannounced changed api in NSS causing segfault
* Mon May 11 2020 Paul Wouters <pwouters@redhat.com> - 3.32-1
- Resolves: rhbz#1809770 libreswan-3.32 is available
* Tue Apr 14 2020 Paul Wouters <pwouters@redhat.com> - 3.31-2
- Resolves: rhbz#1823823 Please drop the dependency on fipscheck
* Tue Mar 03 2020 Paul Wouters <pwouters@redhat.com> - 3.31-1
- Resolves: rhbz#1809770 libreswan-3.31 is available (fixes rekey regression)
* Fri Feb 14 2020 Paul Wouters <pwouters@redhat.com> - 3.30-1
- Resolves: rhbz#1802896 libreswan-3.30 is available
- Resolves: rhbz#1799598 libreswan: FTBFS in Fedora rawhide/f32
- Resolves: rhbz#1760571 [abrt] libreswan: configsetupcheck(): verify:366:configsetupcheck:TypeError:
* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.29-2.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
* Thu Jan 09 2020 Paul Wouters <pwouters@redhat.com> - 3.29-2
- _updown.netkey: fix syntax error in checking routes
* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 3.29-1.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
* Thu Jun 27 2019 Paul Wouters <pwouters@redhat.com> - 3.29-2
- Resolves: rhbz#1723957 libreswan is missing linux audit calls for failed IKE SAs and failed IPsec SAs required for Common Criteria
* Mon Jun 10 2019 Paul Wouters <pwouters@redhat.com> - 3.29-1
- Resolves: rhbz#1718986 Updated to 3.29 for CVE-2019-10155
- Resolves: rhbz#1712555 libreswan rebase to 3.29
* Tue May 28 2019 Paul Wouters <pwouters@redhat.com> - 3.28-2
- Resolves: rhbz#1713734: barf: shell syntax error in barf diagnostic tool
* Tue May 21 2019 Paul Wouters <pwouters@redhat.com> - 3.28-1
- Updated to 3.28 (many imported bugfixes, including CVE-2019-12312)
- Resolves: rhbz#1712555 libreswan rebase to 3.28
- Resolves: rhbz#1683706 Libreswan shows incorrect error messages
- Resolves: rhbz#1706180 Remove last usage of old (unused) PF_KEY API
- Resolves: rhbz#1677045 Opportunistic IPsec instances of /32 groups or auto=start that receive delete won't restart
- Resolves: rhbz#1686990 IKEv1 traffic interruption when responder deletes SAs 60 seconds before EVENT_SA_REPLACE
- Resolves: rhbz#1608353 /usr/sbin/ipsec part of the libreswan packages still invokes commands that were deprecated a decade ago
- Resolves: rhbz#1699318 'ipsec show' has python3 invalid syntax
- Resolves: rhbz#1679394 libreswan using NSS IPsec profiles regresses when critical flags are set causing validation failure
* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 3.27-1.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
* Thu Feb 21 2019 Paul Wouters <pwouters@redhat.com> - 3.27-9
- Resolves: rhbz#1648776 limit connections to be ikev1only or ikev2only and make ikev2only the default [man page update]
* Mon Jan 14 2019 Björn Esser <besser82@fedoraproject.org> - 3.27-1.1
- Rebuilt for libcrypt.so.2 (#1666033)
* Fri Feb 15 2019 Paul Wouters <pwouters@redhat.com> - 3.27-8
- Resolves: rhbz#1664101 system wide crypto policies causing IKE_INIT packet fragmentation
* Tue Feb 05 2019 Paul Wouters <pwouters@redhat.com> - 3.27-7
- Resolves: rhbz#1671793 proessing ISAKMP_NEXT_D with additional payloads causes dangling pointer to deleted state
* Fri Feb 01 2019 Paul Wouters <pwouters@redhat.com> - 3.27-6
- Resolves: rhbz#1668342 SELinux prevents libreswan from using some outbound ports causing DNS resolution failures at connection at load time
* Thu Jan 10 2019 Paul Wouters <pwouters@redhat.com> - 3.27-5
- Resolves: rhbz#1664522 libreswan 3.25 in FIPS mode is incorrectly rejecting X.509 public keys that are >= 3072 bits
* Mon Dec 10 2018 Paul Wouters <pwouters@redhat.com> - 3.27-4
- Resolves: rhbz#1657846 libreswan no longer needs to provide openswan in rhel8
- Resolves: rhbz#1643388 libreswan: Unable to verify certificate with non-empty Extended Key Usage which does not include serverAuth or clientAuth
- Resolves: rhbz#1657854 remove userland support for deprecated KLIPS IPsec stack support
* Sun Dec 09 2018 Paul Wouters <pwouters@redhat.com> - 3.27-3
- Resolves: rhbz#1648776 limit connections to be ikev1only or ikev2only and make ikev2only the default
* Thu Nov 08 2018 Paul Wouters <pwouters@redhat.com> - 3.27-2
- Resolves: rhbz#1645137 Libreswan segfaults when it loads configuration file with more then 5 connections
* Mon Oct 08 2018 Paul Wouters <pwouters@redhat.com> - 3.27-1
- Updated to 3.27 (various bugfixes)
* Thu Sep 27 2018 Paul Wouters <pwouters@redhat.com> - 3.26-3
- Add fedora python fixup for _unbound-hook
* Mon Sep 17 2018 Paul Wouters <pwouters@redhat.com> - 3.26-2
- linking against freebl is no longer needed (and wasn't done in 3.25)
- Resolves: rhbz#1566574 Rebase to libreswan 3.27
* Mon Sep 17 2018 Paul Wouters <pwouters@redhat.com> - 3.26-1
- Updated to 3.26 (CHACHA20POLY1305, ECDSA and RSA-PSS support)
- Resolves: rhbz#1566574 Rebase to libreswan 3.26
- Resolves: rhbz#1527037 libreswan IPSEC implementation: should follow the policies of system-wide crypto policy
- Resolves: rhbz#1375779 [IKEv2 Conformance] Test IKEv2.EN.R.1.1.6.7: Sending INVALID_KE_PAYLOAD failed
- Resolves: rhbz#1085758 [TAHI][IKEv2] IKEv2.EN.I.1.2.1.1: Can't observe CREATE_CHILD_SA request for rekey
- Resolves: rhbz#1053048 [TAHI][IKEv2] IKEv2.EN.I.1.2.4.1-7: libreswan doesn't sent CREATE_CHILD_SA after IKE_SA Lifetime timeout
* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 3.25-3.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Mon Aug 13 2018 Paul Wouters <pwouters@redhat.com> - 3.25-4
- Resolves: rhbz#1590823 libreswan: Use Python 3 in RHEL 8
* Wed Aug 01 2018 Charalampos Stratakis <cstratak@redhat.com> - 3.25-3.1
- Rebuild for platform-python
* Mon Jul 09 2018 Paul Wouters <pwouters@redhat.com> - 3.25-3
- Fix Opportunistic IPsec _unbound-hook argument parsing
- Make rundir readable for all (so we can hand out permissions later)
- Cleanup shebangs for python3
- Use the same options via macro for make programs and make install
- Remove old ifdefs
- Sync up patches to new upstream version
- Add Requires: for unbound-libs >= 1.6.6
- Enable crypto-policies support
- Make rundir world readable for easier permission granting for socket
* Mon Jul 02 2018 Paul Wouters <pwouters@redhat.com> - 3.25-2
- Relax deleting IKE SA's and IPsec SA's to avoid interop issues with third party VPN vendors
* Tue Jun 26 2018 Charalampos Stratakis <cstratak@redhat.com> - 3.23-2.2
- Make python shebangs point to python3
* Wed Jun 27 2018 Paul Wouters <pwouters@redhat.com> - 3.25-1
- Updated to 3.25
* Fri Jun 22 2018 Troy Dawson <tdawson@redhat.com> - 3.23-2.1
- Fix python shebangs (#1580773)
* Mon Feb 19 2018 Paul Wouters <pwouters@redhat.com> - 3.23-2
- Support crypto-policies package
@ -414,7 +427,7 @@ certutil -N -d sql:$tmpdir --empty-password
- Remove support for /etc/sysconfig/pluto (use native systemd instead)
* Thu May 05 2016 Paul Wouters <pwouters@redhat.com> - 3.17-2
- Resolves: rhbz#1324956 prelink is gone, /etc/prelink.conf.d/* is no longer used
- Resolves: rhbz#1324956 prelink is gone, /etc/prelink.conf.d/* is no longer used
* Thu Apr 07 2016 Paul Wouters <pwouters@redhat.com> - 3.17-1
- Updated to 3.17 for CVE-2016-3071