|
 |
8008c3 |
diff -Naur libreswan-3.28-orig/lib/libipsecconf/confread.c libreswan-3.28/lib/libipsecconf/confread.c
|
|
|
8008c3 |
--- libreswan-3.28-orig/lib/libipsecconf/confread.c 2019-05-20 23:01:54.000000000 -0400
|
|
|
8008c3 |
+++ libreswan-3.28/lib/libipsecconf/confread.c 2019-05-21 16:59:20.861415770 -0400
|
|
|
8008c3 |
@@ -1273,13 +1273,16 @@
|
|
|
8008c3 |
|
|
|
8008c3 |
switch (conn->options[KNCF_IKEv2]) {
|
|
|
8008c3 |
case fo_never:
|
|
|
8008c3 |
- case fo_permit:
|
|
|
8008c3 |
conn->policy |= POLICY_IKEV1_ALLOW;
|
|
|
8008c3 |
/* clear any inherited default */
|
|
|
8008c3 |
conn->policy &= ~POLICY_IKEV2_ALLOW;
|
|
|
8008c3 |
break;
|
|
|
8008c3 |
-
|
|
|
8008c3 |
+ case fo_permit:
|
|
|
8008c3 |
+ starter_error_append(perrl, "ikev2=permit is no longer accepted. Use ikev2=insist or ikev2=no|never");
|
|
|
8008c3 |
+ return TRUE;
|
|
|
8008c3 |
case fo_propose:
|
|
|
8008c3 |
+ starter_error_append(perrl, "ikev2=propose or ikev2=yes is no longer accepted. Use ikev2=insist or ikev2=no|never");
|
|
|
8008c3 |
+ return TRUE;
|
|
|
8008c3 |
case fo_insist:
|
|
|
8008c3 |
conn->policy |= POLICY_IKEV2_ALLOW;
|
|
|
8008c3 |
/* clear any inherited default */
|
|
|
8008c3 |
diff -Naur libreswan-3.28-orig/programs/configs/d.ipsec.conf/ikev2.xml libreswan-3.28/programs/configs/d.ipsec.conf/ikev2.xml
|
|
|
8008c3 |
--- libreswan-3.28-orig/programs/configs/d.ipsec.conf/ikev2.xml 2019-05-20 23:01:54.000000000 -0400
|
|
|
8008c3 |
+++ libreswan-3.28/programs/configs/d.ipsec.conf/ikev2.xml 2019-05-21 16:54:07.584141191 -0400
|
|
|
8008c3 |
@@ -1,13 +1,15 @@
|
|
|
8008c3 |
<varlistentry>
|
|
|
8008c3 |
<term><emphasis remap='B'>ikev2</emphasis></term>
|
|
|
8008c3 |
<listitem>
|
|
|
8008c3 |
-<para>Whether to use IKEv1 (RFC 4301) or IKEv2 (RFC 7296) settings to be used.
|
|
|
8008c3 |
-Currently the accepted values are <emphasis remap='B'>no</emphasis>(the default),
|
|
|
8008c3 |
-signifying only IKEv1 is accepted, or <emphasis remap='B'>yes</emphasis>,
|
|
|
8008c3 |
+<para>Wether to use IKEv1 (RFC 4301) or IKEv2 (RFC 7296) as the Internet Key Exchange (IKE) protcol.
|
|
|
8008c3 |
+Currently the accepted values are <emphasis remap='B'>no</emphasis> (or <emphasis remap='B'>never</emphasis>)
|
|
|
8008c3 |
+signifying only IKEv1 is accepted, or <emphasis remap='B'>insist</emphasis>(the default),
|
|
|
8008c3 |
signifying only IKEv2 is accepted. Previous versions allowed the keywords
|
|
|
8008c3 |
-<emphasis remap='B'>propose</emphasis> or <emphasis remap='B'>permit</emphasis>
|
|
|
8008c3 |
-that would allow either IKEv1 or IKEv2, but this is no longer supported. The
|
|
|
8008c3 |
-permit option is interpreted as no and the propose option is interpreted as yes.
|
|
|
8008c3 |
+<emphasis remap='B'>propose</emphasis>, <emphasis remap='B'>yes</emphasis> or <emphasis remap='B'>permit</emphasis>
|
|
|
8008c3 |
+that would allow either IKEv1 or IKEv2, but this is no longer supported and both options
|
|
|
8008c3 |
+now cause the connection to fail to load. <emphasis remap='B'>WARNING:</emphasis> This behaviour differs from upstream
|
|
|
8008c3 |
+libreswan, which only accepts <emphasis remap='B'>yes</emphasis> or <emphasis remap='B'>no</emphasis> where yes means
|
|
|
8008c3 |
+the same as insist.
|
|
|
8008c3 |
</para>
|
|
|
8008c3 |
</listitem>
|
|
|
8008c3 |
</varlistentry>
|
|
|
8008c3 |
diff -Naur libreswan-3.28-orig/programs/whack/whack.c libreswan-3.28/programs/whack/whack.c
|
|
|
8008c3 |
--- libreswan-3.28-orig/programs/whack/whack.c 2019-05-20 23:01:54.000000000 -0400
|
|
|
8008c3 |
+++ libreswan-3.28/programs/whack/whack.c 2019-05-21 17:01:37.868865569 -0400
|
|
|
8008c3 |
@@ -741,7 +741,7 @@
|
|
|
8008c3 |
|
|
|
8008c3 |
PS("ikev1-allow", IKEV1_ALLOW),
|
|
|
8008c3 |
PS("ikev2-allow", IKEV2_ALLOW),
|
|
|
8008c3 |
- PS("ikev2-propose", IKEV2_ALLOW), /* map onto allow */
|
|
|
8008c3 |
+ /* not in RHEL8 PS("ikev2-propose", IKEV2_ALLOW),*/
|
|
|
8008c3 |
|
|
|
8008c3 |
PS("allow-narrowing", IKEV2_ALLOW_NARROWING),
|
|
|
8008c3 |
#ifdef XAUTH_HAVE_PAM
|
|
|
8008c3 |
@@ -1683,7 +1683,7 @@
|
|
|
8008c3 |
|
|
|
8008c3 |
/* --ikev1-allow */
|
|
|
8008c3 |
case CDP_SINGLETON + POLICY_IKEV1_ALLOW_IX:
|
|
|
8008c3 |
- /* --ikev2-allow (now also --ikev2-propose) */
|
|
|
8008c3 |
+ /* --ikev2-allow */
|
|
|
8008c3 |
case CDP_SINGLETON + POLICY_IKEV2_ALLOW_IX:
|
|
|
8008c3 |
|
|
|
8008c3 |
/* --allow-narrowing */
|