86 lines
3.5 KiB
Diff
86 lines
3.5 KiB
Diff
From 83487373fdd77437e51cfccd41532e270e279e05 Mon Sep 17 00:00:00 2001
|
|
From: rpm-build <rpm-build>
|
|
Date: Tue, 10 Jan 2023 00:11:26 +0900
|
|
Subject: [PATCH] libreswan-4.3-maintain-different-v1v2-split.patch
|
|
|
|
---
|
|
configs/d.ipsec.conf/ikev2.xml | 14 +++++++-------
|
|
lib/libipsecconf/confread.c | 8 +++++++-
|
|
programs/whack/whack.c | 4 ++--
|
|
3 files changed, 16 insertions(+), 10 deletions(-)
|
|
|
|
diff --git a/configs/d.ipsec.conf/ikev2.xml b/configs/d.ipsec.conf/ikev2.xml
|
|
index 3d03825..285db1b 100644
|
|
--- a/configs/d.ipsec.conf/ikev2.xml
|
|
+++ b/configs/d.ipsec.conf/ikev2.xml
|
|
@@ -2,14 +2,14 @@
|
|
<term><emphasis remap='B'>ikev2</emphasis></term>
|
|
<listitem>
|
|
<para>Whether to use IKEv2 (RFC 7296) or IKEv1 (RFC 4301).
|
|
-Currently the accepted values are <emphasis remap='B'>yes</emphasis> (the default),
|
|
-signifying only IKEv2 is accepted, or <emphasis remap='B'>no</emphasis>,
|
|
+Currently the accepted values are <emphasis remap='B'>insist</emphasis> (the default),
|
|
+signifying only IKEv2 is accepted, or <emphasis remap='B'>no</emphasis> (or <emphasis remap='B'>never</emphasis>),
|
|
signifying only IKEv1 is accepted. Previous versions allowed the keywords
|
|
-<emphasis remap='B'>propose</emphasis> or <emphasis remap='B'>permit</emphasis>
|
|
-that would allow either IKEv1 or IKEv2, but this is no longer supported. The
|
|
-permit option is interpreted as no and the propose option is interpreted as
|
|
-yes. Older versions also supported keyword
|
|
-<emphasis remap='B'>insist</emphasis> which is now interpreted as yes.
|
|
+<emphasis remap='B'>propose</emphasis>, <emphasis remap='B'>yes</emphasis> or <emphasis remap='B'>permit</emphasis>
|
|
+that would allow either IKEv1 or IKEv2, but this is no longer supported and both options
|
|
+now cause the connection to fail to load. <emphasis remap='B'>WARNING:</emphasis> This behaviour differs from upstream
|
|
+libreswan, which only accepts <emphasis remap='B'>yes</emphasis> or <emphasis remap='B'>no</emphasis> where yes means
|
|
+the same as insist.
|
|
</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
diff --git a/lib/libipsecconf/confread.c b/lib/libipsecconf/confread.c
|
|
index b95c90a..e752441 100644
|
|
--- a/lib/libipsecconf/confread.c
|
|
+++ b/lib/libipsecconf/confread.c
|
|
@@ -1340,11 +1340,17 @@ static bool load_conn(struct starter_conn *conn,
|
|
|
|
switch (conn->options[KNCF_IKEv2]) {
|
|
case fo_never:
|
|
- case fo_permit:
|
|
conn->ike_version = IKEv1;
|
|
break;
|
|
|
|
+ case fo_permit:
|
|
+ starter_error_append(perrl, "ikev2=permit is no longer accepted. Use ikev2=insist or ikev2=no|never");
|
|
+ return true;
|
|
+
|
|
case fo_propose:
|
|
+ starter_error_append(perrl, "ikev2=propose or ikev2=yes is no longer accepted. Use ikev2=insist or ikev2=no|never");
|
|
+ return true;
|
|
+
|
|
case fo_insist:
|
|
conn->ike_version = IKEv2;
|
|
break;
|
|
diff --git a/programs/whack/whack.c b/programs/whack/whack.c
|
|
index b512b04..3de020e 100644
|
|
--- a/programs/whack/whack.c
|
|
+++ b/programs/whack/whack.c
|
|
@@ -815,7 +815,7 @@ static const struct option long_opts[] = {
|
|
{ "ikev1-allow", no_argument, NULL, CD_IKEv1 + OO }, /* obsolete name */
|
|
{ "ikev2", no_argument, NULL, CD_IKEv2 +OO },
|
|
{ "ikev2-allow", no_argument, NULL, CD_IKEv2 +OO }, /* obsolete name */
|
|
- { "ikev2-propose", no_argument, NULL, CD_IKEv2 +OO }, /* obsolete, map onto allow */
|
|
+ /* not in RHEL8 { "ikev2-propose", no_argument, NULL, CD_IKEv2 +OO }, */
|
|
|
|
PS("allow-narrowing", IKEV2_ALLOW_NARROWING),
|
|
#ifdef AUTH_HAVE_PAM
|
|
@@ -1802,7 +1802,7 @@ int main(int argc, char **argv)
|
|
end_seen = LEMPTY;
|
|
continue;
|
|
|
|
- /* --ikev1 --ikev2 --ikev2-propose */
|
|
+ /* --ikev1 --ikev2 */
|
|
case CD_IKEv1:
|
|
case CD_IKEv2:
|
|
{
|
|
--
|
|
2.39.0
|
|
|