Blame SOURCES/libreswan-4.3-maintain-different-v1v2-split.patch

7aef00
diff -Naur libreswan-4.3-orig/configs/d.ipsec.conf/ikev2.xml libreswan-4.3/configs/d.ipsec.conf/ikev2.xml
7aef00
--- libreswan-4.3-orig/configs/d.ipsec.conf/ikev2.xml	2021-02-21 12:03:03.000000000 -0500
7aef00
+++ libreswan-4.3/configs/d.ipsec.conf/ikev2.xml	2021-02-21 12:33:36.226284499 -0500
e84ee2
@@ -1,15 +1,15 @@
8008c3
   <varlistentry>
8008c3
   <term><emphasis remap='B'>ikev2</emphasis></term>
8008c3
   <listitem>
8008c3
-<para>Whether to use IKEv1 (RFC 4301) or IKEv2 (RFC 7296) settings to be used.
8008c3
-Currently the accepted values are <emphasis remap='B'>no</emphasis>(the default),
8008c3
-signifying only IKEv1 is accepted, or <emphasis remap='B'>yes</emphasis>,
8008c3
+<para>Wether to use IKEv1 (RFC 4301) or IKEv2 (RFC 7296) as the Internet Key Exchange (IKE) protcol.
8008c3
+Currently the accepted values are <emphasis remap='B'>no</emphasis> (or <emphasis remap='B'>never</emphasis>)
8008c3
+signifying only IKEv1 is accepted, or <emphasis remap='B'>insist</emphasis>(the default),
8008c3
 signifying only IKEv2 is accepted. Previous versions allowed the keywords
8008c3
-<emphasis remap='B'>propose</emphasis> or <emphasis remap='B'>permit</emphasis>
8008c3
-that would allow either IKEv1 or IKEv2, but this is no longer supported. The
e84ee2
-permit option is interpreted as no and the propose option is interpreted as
e84ee2
-yes. Older versions also supported keyword
e84ee2
-<emphasis remap='B'>insist</emphasis> which is now interpreted as yes.
8008c3
+<emphasis remap='B'>propose</emphasis>, <emphasis remap='B'>yes</emphasis> or <emphasis remap='B'>permit</emphasis>
8008c3
+that would allow either IKEv1 or IKEv2, but this is no longer supported and both options
8008c3
+now cause the connection to fail to load. <emphasis remap='B'>WARNING:</emphasis> This behaviour differs from upstream
8008c3
+libreswan, which only accepts <emphasis remap='B'>yes</emphasis> or <emphasis remap='B'>no</emphasis> where yes means
8008c3
+the same as insist.
8008c3
 </para>
8008c3
   </listitem>
8008c3
   </varlistentry>
7aef00
diff -Naur libreswan-4.3-orig/lib/libipsecconf/confread.c libreswan-4.3/lib/libipsecconf/confread.c
7aef00
--- libreswan-4.3-orig/lib/libipsecconf/confread.c	2021-02-21 12:03:03.000000000 -0500
7aef00
+++ libreswan-4.3/lib/libipsecconf/confread.c	2021-02-21 12:37:43.138031929 -0500
7aef00
@@ -1310,11 +1310,17 @@
7aef00
 
7aef00
 		switch (conn->options[KNCF_IKEv2]) {
7aef00
 		case fo_never:
7aef00
-		case fo_permit:
7aef00
 			conn->ike_version = IKEv1;
7aef00
 			break;
8008c3
 
7aef00
+		case fo_permit:
7aef00
+			starter_error_append(perrl, "ikev2=permit is no longer accepted. Use ikev2=insist or ikev2=no|never");
7aef00
+			return TRUE;
7aef00
+
7aef00
 		case fo_propose:
7aef00
+			starter_error_append(perrl, "ikev2=propose or ikev2=yes is no longer accepted. Use ikev2=insist or ikev2=no|never");
7aef00
+			return TRUE;
7aef00
+
7aef00
 		case fo_insist:
7aef00
 			conn->ike_version = IKEv2;
7aef00
 			break;
7aef00
diff -Naur libreswan-4.3-orig/programs/whack/whack.c libreswan-4.3/programs/whack/whack.c
7aef00
--- libreswan-4.3-orig/programs/whack/whack.c	2021-02-21 12:03:03.000000000 -0500
7aef00
+++ libreswan-4.3/programs/whack/whack.c	2021-02-21 12:39:27.066188354 -0500
7aef00
@@ -801,7 +801,7 @@
7aef00
 	{ "ikev1-allow", no_argument, NULL, CD_IKEv1 + OO }, /* obsolete name */
7aef00
 	{ "ikev2", no_argument, NULL, CD_IKEv2 +OO },
7aef00
 	{ "ikev2-allow", no_argument, NULL, CD_IKEv2 +OO }, /* obsolete name */
7aef00
-	{ "ikev2-propose", no_argument, NULL, CD_IKEv2 +OO }, /* obsolete, map onto allow */
7aef00
+	/* not in RHEL8 { "ikev2-propose", no_argument, NULL, CD_IKEv2 +OO }, */
8008c3
 
8008c3
 	PS("allow-narrowing", IKEV2_ALLOW_NARROWING),
7aef00
 #ifdef AUTH_HAVE_PAM
7aef00
@@ -1762,7 +1762,7 @@
7aef00
 			end_seen = LEMPTY;
7aef00
 			continue;
8008c3
 
7aef00
-		/* --ikev1 --ikev2 --ikev2-propose */
7aef00
+		/* --ikev1 --ikev2  */
7aef00
 		case CD_IKEv1:
7aef00
 		case CD_IKEv2:
7aef00
 		{