From 221bf67b2344b296fac9e37af8807f0996f8689c Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Nov 02 2019 18:57:13 +0000 Subject: import libreswan-3.25-5.el7_6 --- diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..1312b66 --- /dev/null +++ b/.gitignore @@ -0,0 +1,4 @@ +SOURCES/ikev1_dsa.fax.bz2 +SOURCES/ikev1_psk.fax.bz2 +SOURCES/ikev2.fax.bz2 +SOURCES/libreswan-3.25.tar.gz diff --git a/.libreswan.metadata b/.libreswan.metadata new file mode 100644 index 0000000..ed2101e --- /dev/null +++ b/.libreswan.metadata @@ -0,0 +1,4 @@ +b35cd50b8bc0a08b9c07713bf19c72d53bfe66bb SOURCES/ikev1_dsa.fax.bz2 +861d97bf488f9e296cad8c43ab72f111a5b1a848 SOURCES/ikev1_psk.fax.bz2 +fcaf77f3deae3d8e99cdb3b1f8abea63167a0633 SOURCES/ikev2.fax.bz2 +5a83fbde704576cd5c2b6357af400d49a033e274 SOURCES/libreswan-3.25.tar.gz diff --git a/SOURCES/libreswan-3.23-del-with-notify-1630355.patch b/SOURCES/libreswan-3.23-del-with-notify-1630355.patch new file mode 100644 index 0000000..cefecfa --- /dev/null +++ b/SOURCES/libreswan-3.23-del-with-notify-1630355.patch @@ -0,0 +1,33 @@ +diff -Naur libreswan-3.25-orig/programs/pluto/ikev1.c libreswan-3.25/programs/pluto/ikev1.c +--- libreswan-3.25-orig/programs/pluto/ikev1.c 2018-06-27 22:42:26.000000000 +0700 ++++ libreswan-3.25/programs/pluto/ikev1.c 2018-11-22 20:04:44.961824151 +0700 +@@ -727,28 +727,7 @@ + return dpd_inR(st, n, n_pbs); + + case PAYLOAD_MALFORMED: +- if (st != NULL) { +- st->hidden_variables.st_malformed_received++; +- +- libreswan_log( +- "received %u malformed payload notifies", +- st->hidden_variables.st_malformed_received); +- +- if (st->hidden_variables.st_malformed_sent > +- MAXIMUM_MALFORMED_NOTIFY / 2 && +- ((st->hidden_variables.st_malformed_sent + +- st->hidden_variables. +- st_malformed_received) > +- MAXIMUM_MALFORMED_NOTIFY)) { +- libreswan_log( +- "too many malformed payloads (we sent %u and received %u", +- st->hidden_variables.st_malformed_sent, +- st->hidden_variables.st_malformed_received); +- delete_state(st); +- md->st = st = NULL; +- } +- } +- ++ libreswan_log("received PAYLOAD_MALFORMED"); + return STF_IGNORE; + + case ISAKMP_N_CISCO_LOAD_BALANCE: diff --git a/SOURCES/libreswan-3.23-zerolengthkey.patch b/SOURCES/libreswan-3.23-zerolengthkey.patch new file mode 100644 index 0000000..5daebae --- /dev/null +++ b/SOURCES/libreswan-3.23-zerolengthkey.patch @@ -0,0 +1,18 @@ +diff -Naur libreswan-3.25-orig/programs/pluto/ikev1_spdb_struct.c libreswan-3.25/programs/pluto/ikev1_spdb_struct.c +--- libreswan-3.25-orig/programs/pluto/ikev1_spdb_struct.c 2018-06-27 22:42:26.000000000 +0700 ++++ libreswan-3.25/programs/pluto/ikev1_spdb_struct.c 2018-11-22 20:29:34.034626926 +0700 +@@ -1053,10 +1053,11 @@ + loglog(RC_LOG_SERIOUS, + "You should NOT use insecure/broken IKE algorithms (%s)!", + ta->ta_encrypt->common.fqn); ++ } else { ++ DBG(DBG_CONTROL, ++ DBG_log("OAKLEY proposal verified; matching alg_info found")); ++ return true; + } +- DBG(DBG_CONTROL, +- DBG_log("OAKLEY proposal verified; matching alg_info found")); +- return true; + } + } + libreswan_log("Oakley Transform [%s (%d), %s, %s] refused%s", diff --git a/SOURCES/libreswan-3.25-1625303-recursive-incl.patch b/SOURCES/libreswan-3.25-1625303-recursive-incl.patch new file mode 100644 index 0000000..bd68345 --- /dev/null +++ b/SOURCES/libreswan-3.25-1625303-recursive-incl.patch @@ -0,0 +1,19 @@ +commit b257545675ae4564d866758eb3ef4230d7c1ede2 +Author: D. Hugh Redelmeier +Date: Tue Sep 25 17:14:36 2018 -0400 + + libipsecconf: fix off-by-one in config file "include" handling + +diff --git a/lib/libipsecconf/parser.l b/lib/libipsecconf/parser.l +index cc2faf5c9..aad2fc9b2 100644 +--- a/lib/libipsecconf/parser.l ++++ b/lib/libipsecconf/parser.l +@@ -260,7 +260,7 @@ int parser_y_include (const char *filename) + case 0: + /* success */ + +- if (ic_private.stack_ptr >= MAX_INCLUDE_DEPTH) { ++ if (ic_private.stack_ptr >= MAX_INCLUDE_DEPTH - 1) { + yyerror("max inclusion depth reached"); + return 1; + } diff --git a/SOURCES/libreswan-3.25-1664244-xauth-null-pwd.patch b/SOURCES/libreswan-3.25-1664244-xauth-null-pwd.patch new file mode 100644 index 0000000..b9b3598 --- /dev/null +++ b/SOURCES/libreswan-3.25-1664244-xauth-null-pwd.patch @@ -0,0 +1,47 @@ +diff -Naur libreswan-3.25-orig/include/chunk.h libreswan-3.25/include/chunk.h +--- libreswan-3.25-orig/include/chunk.h 2018-06-27 11:42:26.000000000 -0400 ++++ libreswan-3.25/include/chunk.h 2018-12-14 13:30:29.269684194 -0500 +@@ -55,6 +55,9 @@ + + chunk_t clone_chunk(chunk_t old, const char *name); + ++/* always NUL terminated; NULL is NULL */ ++char *clone_chunk_as_string(chunk_t chunk, const char *name); ++ + /* note: the caller must free the result */ + char *str_from_chunk(chunk_t c, const char *name); + +diff -Naur libreswan-3.25-orig/lib/libswan/chunk.c libreswan-3.25/lib/libswan/chunk.c +--- libreswan-3.25-orig/lib/libswan/chunk.c 2018-06-27 11:42:26.000000000 -0400 ++++ libreswan-3.25/lib/libswan/chunk.c 2018-12-14 13:29:24.077050581 -0500 +@@ -49,3 +49,16 @@ + s[c.len] = '\0'; /* redundant */ + return s; + } ++ ++char *clone_chunk_as_string(chunk_t chunk, const char *name) ++{ ++ if (chunk.ptr == NULL) { ++ return NULL; ++ } else if (chunk.len > 0 && chunk.ptr[chunk.len - 1] == '\0') { ++ return clone_bytes(chunk.ptr, chunk.len, name); ++ } else { ++ char *string = alloc_things(char, chunk.len + 1, name); ++ memcpy(string, chunk.ptr, chunk.len); ++ return string; ++ } ++} +diff -Naur libreswan-3.25-orig/programs/pluto/ikev1_xauth.c libreswan-3.25/programs/pluto/ikev1_xauth.c +--- libreswan-3.25-orig/programs/pluto/ikev1_xauth.c 2018-06-27 11:42:26.000000000 -0400 ++++ libreswan-3.25/programs/pluto/ikev1_xauth.c 2018-12-14 13:29:24.078050590 -0500 +@@ -1214,8 +1214,8 @@ + return 0; + #endif + +- char *arg_name = str_from_chunk(*name, "XAUTH Name"); +- char *arg_password = str_from_chunk(*password, "XAUTH Name"); ++ char *arg_name = clone_chunk_as_string(*name, "XAUTH Name"); ++ char *arg_password = clone_chunk_as_string(*password, "XAUTH Name"); + + /* + * For XAUTH, we're flipping between retransmitting the packet diff --git a/SOURCES/libreswan-3.25-1664521-fips-keysize.patch b/SOURCES/libreswan-3.25-1664521-fips-keysize.patch new file mode 100644 index 0000000..e382f8c --- /dev/null +++ b/SOURCES/libreswan-3.25-1664521-fips-keysize.patch @@ -0,0 +1,35 @@ +diff --git a/programs/pluto/connections.c b/programs/pluto/connections.c +index 45e5bee1f..db1ac5303 100644 +--- a/programs/pluto/connections.c ++++ b/programs/pluto/connections.c +@@ -846,9 +846,10 @@ static void load_end_nss_certificate(const char *which, CERTCertificate *cert, + if (libreswan_fipsmode()) { + SECKEYPublicKey *pk = CERT_ExtractPublicKey(cert); + passert(pk != NULL); +- if (pk->u.rsa.modulus.len < FIPS_MIN_RSA_KEY_SIZE) { ++ if (pk->u.rsa.modulus.len * BITS_PER_BYTE < FIPS_MIN_RSA_KEY_SIZE) { + whack_log(RC_FATAL, +- "FIPS: Rejecting cert with key size under %d", ++ "FIPS: Rejecting cert with key size %d which is under %d", ++ pk->u.rsa.modulus.len * BITS_PER_BYTE, + FIPS_MIN_RSA_KEY_SIZE); + SECKEY_DestroyPublicKey(pk); + return; +diff --git a/programs/pluto/nss_cert_verify.c b/programs/pluto/nss_cert_verify.c +index b4de167bb..9b031354b 100644 +--- a/programs/pluto/nss_cert_verify.c ++++ b/programs/pluto/nss_cert_verify.c +@@ -460,9 +460,10 @@ static bool import_der_cert(CERTCertDBHandle *handle, + if (libreswan_fipsmode()) { + SECKEYPublicKey *pk = CERT_ExtractPublicKey(cert); + passert(pk != NULL); +- if (pk->u.rsa.modulus.len < FIPS_MIN_RSA_KEY_SIZE) { +- libreswan_log("FIPS: Rejecting cert with key size under %d", +- FIPS_MIN_RSA_KEY_SIZE); ++ if ((pk->u.rsa.modulus.len * BITS_PER_BYTE) < FIPS_MIN_RSA_KEY_SIZE) { ++ libreswan_log("FIPS: Rejecting peer cert with key size %d under %d", ++ pk->u.rsa.modulus.len * BITS_PER_BYTE, ++ FIPS_MIN_RSA_KEY_SIZE); + SECKEY_DestroyPublicKey(pk); + /* + * XXX: Since the certificate isn't added to diff --git a/SOURCES/libreswan-3.25-1673105-down-restart.patch b/SOURCES/libreswan-3.25-1673105-down-restart.patch new file mode 100644 index 0000000..1aa295b --- /dev/null +++ b/SOURCES/libreswan-3.25-1673105-down-restart.patch @@ -0,0 +1,455 @@ +diff -Naur libreswan-3.25-orig/include/pluto_constants.h libreswan-3.25/include/pluto_constants.h +--- libreswan-3.25-orig/include/pluto_constants.h 2019-05-02 10:54:07.265614654 -0400 ++++ libreswan-3.25/include/pluto_constants.h 2019-05-02 10:55:42.634626504 -0400 +@@ -152,6 +152,7 @@ + EVENT_SD_WATCHDOG, /* update systemd's watchdog interval */ + EVENT_PENDING_PHASE2, /* do not make pending phase2 wait forever */ + EVENT_CHECK_CRLS, /* check/update CRLS */ ++ EVENT_REVIVE_CONNS, + + /* events associated with states */ + +@@ -203,6 +204,9 @@ + #define EVENT_CRYPTO_TIMEOUT_DELAY RETRANSMIT_TIMEOUT_DEFAULT /* wait till the other side give up on us */ + #define EVENT_PAM_TIMEOUT_DELAY RETRANSMIT_TIMEOUT_DEFAULT /* wait until this side give up on PAM */ + ++#define REVIVE_CONN_DELAY 5 /* seconds */ ++#define REVIVE_CONN_DELAY_MAX 300 /* Do not delay more than 5 minutes per attempt */ ++ + /* + * operational importance of this cryptographic operation. + * this determines if the operation will be dropped (because the other +diff -Naur libreswan-3.25-orig/programs/pluto/connections.c libreswan-3.25/programs/pluto/connections.c +--- libreswan-3.25-orig/programs/pluto/connections.c 2019-05-02 10:54:07.265614654 -0400 ++++ libreswan-3.25/programs/pluto/connections.c 2019-05-02 10:55:42.635626515 -0400 +@@ -4629,3 +4629,28 @@ + c->name, prio)); + return prio; + } ++ ++/* ++ * If the connection contains a newer SA, return it. ++ */ ++so_serial_t get_newer_sa_from_connection(struct state *st) ++{ ++ struct connection *c = st->st_connection; ++ so_serial_t newest; ++ ++ if (IS_IKE_SA(st)) { ++ newest = c->newest_isakmp_sa; ++ DBG(DBG_CONTROL, DBG_log("picked newest_isakmp_sa #%lu for #%lu", ++ newest, st->st_serialno)); ++ } else { ++ newest = c->newest_ipsec_sa; ++ DBG(DBG_CONTROL, DBG_log("picked newest_ipsec_sa #%lu for #%lu", ++ newest, st->st_serialno)); ++ } ++ ++ if (newest != SOS_NOBODY && newest > st->st_serialno) { ++ return newest; ++ } else { ++ return SOS_NOBODY; ++ } ++} +diff -Naur libreswan-3.25-orig/programs/pluto/connections.h libreswan-3.25/programs/pluto/connections.h +--- libreswan-3.25-orig/programs/pluto/connections.h 2018-06-27 11:42:26.000000000 -0400 ++++ libreswan-3.25/programs/pluto/connections.h 2019-05-02 10:57:22.626689082 -0400 +@@ -343,6 +343,7 @@ + u_int32_t statsval; /* track what we have told statsd */ + u_int16_t nflog_group; /* NFLOG group - 0 means disabled */ + msgid_t ike_window; /* IKE v2 window size 7296#section-2.3 */ ++ int revive_delay; + }; + + extern void parse_mark_mask(const struct connection* c,int * mark, int * mask); +@@ -385,7 +386,7 @@ + struct xfrm_user_sec_ctx_ike *uctx, + #endif + err_t why); +-extern void terminate_connection(const char *name); ++extern void terminate_connection(const char *name, bool quiet); + extern void release_connection(struct connection *c, bool relations); + extern void delete_connection(struct connection *c, bool relations); + extern void suppress_delete(struct connection *c); +@@ -539,3 +540,8 @@ + extern bool idr_wildmatch(const struct connection *c, const struct id *b); + + extern uint32_t calculate_sa_prio(const struct connection *c); ++ ++so_serial_t get_newer_sa_from_connection(struct state *st); ++ ++extern void flush_revival(const struct connection *c); ++ +diff -Naur libreswan-3.25-orig/programs/pluto/hostpair.c libreswan-3.25/programs/pluto/hostpair.c +--- libreswan-3.25-orig/programs/pluto/hostpair.c 2018-06-27 11:42:26.000000000 -0400 ++++ libreswan-3.25/programs/pluto/hostpair.c 2019-05-02 10:55:42.635626515 -0400 +@@ -274,7 +274,7 @@ + */ + passert(p == *pp); + +- terminate_connection(p->name); ++ terminate_connection(p->name, FALSE); + p->interface = NULL; /* withdraw orientation */ + + *pp = p->hp_next; /* advance *pp */ +diff -Naur libreswan-3.25-orig/programs/pluto/initiate.c libreswan-3.25/programs/pluto/initiate.c +--- libreswan-3.25-orig/programs/pluto/initiate.c 2018-06-27 11:42:26.000000000 -0400 ++++ libreswan-3.25/programs/pluto/initiate.c 2019-05-02 10:55:42.640626568 -0400 +@@ -148,7 +148,7 @@ + c->interface->ip_dev->id_rname, + p->ip_dev->id_rname); + } +- terminate_connection(c->name); ++ terminate_connection(c->name, FALSE); + c->interface = NULL; /* withdraw orientation */ + return FALSE; + } +@@ -401,7 +401,7 @@ + { + /* This might delete c if CK_INSTANCE */ + /* ??? is there a chance hp becomes dangling? */ +- terminate_connection(d->name); ++ terminate_connection(d->name, FALSE); + } + d = next; + } +@@ -750,6 +750,12 @@ + fmt_conn_instance(c, cib)); + }); + ++ if (sr->routing == RT_ROUTED_PROSPECTIVE && eclipsable(sr)) { ++ DBG(DBG_CONTROL, DBG_log("route is eclipsed")); ++ sr->routing = RT_ROUTED_ECLIPSED; ++ eclipse_count++; ++ } ++ + idtoa(&sr->this.id, mycredentialstr, sizeof(mycredentialstr)); + + passert(c->policy & POLICY_OPPORTUNISTIC); /* can't initiate Road Warrior connections */ +diff -Naur libreswan-3.25-orig/programs/pluto/kernel.c libreswan-3.25/programs/pluto/kernel.c +--- libreswan-3.25-orig/programs/pluto/kernel.c 2018-06-27 11:42:26.000000000 -0400 ++++ libreswan-3.25/programs/pluto/kernel.c 2019-05-02 10:55:42.640626568 -0400 +@@ -982,22 +982,11 @@ + if (ro != NULL && !routes_agree(ro, c)) { + char cib[CONN_INST_BUF]; + loglog(RC_LOG_SERIOUS, +- "cannot route -- route already in use for \"%s\"%s", ++ "cannot route -- route already in use for \"%s\"%s - but allowing anyway", + ro->name, fmt_conn_instance(ro, cib)); +- /* +- * We ignore this if the stack supports overlapping, and this +- * connection was marked that overlapping is OK. Below we will +- * check the other eroute, ero. +- */ +- if (!compatible_overlapping_connections(c, ero)) { +- /* +- * Another connection is already using the eroute. +- * TODO: NETKEY can do this? +- */ +- return route_impossible; +- } + } + ++ + /* if there is an eroute for another connection, there is a problem */ + if (ero != NULL && ero != c) { + /* +@@ -3080,7 +3069,8 @@ + /* record unrouting */ + if (route_installed) { + do { +- passert(!erouted(rosr->routing)); ++ DBG(DBG_CONTROL, ++ DBG_log("ro name=%s, rosr->routing=%d", ro->name, rosr->routing)); + rosr->routing = RT_UNROUTED; + + /* no need to keep old value */ +@@ -3292,6 +3282,14 @@ + DBG(DBG_KERNEL, + DBG_log("set up incoming SA, ref=%u/%u", st->st_ref, + st->st_refhim)); ++ ++ /* ++ * We successfully installed an IPsec SA, meaning it is safe ++ * to clear our revival back-off delay. This is based on the ++ * assumption that an unwilling partner might complete an IKE ++ * SA to us, but won't complete an IPsec SA to us. ++ */ ++ st->st_connection->revive_delay = 0; + } + + if (rb == route_unnecessary) +diff -Naur libreswan-3.25-orig/programs/pluto/kernel.h libreswan-3.25/programs/pluto/kernel.h +--- libreswan-3.25-orig/programs/pluto/kernel.h 2018-06-27 11:42:26.000000000 -0400 ++++ libreswan-3.25/programs/pluto/kernel.h 2019-05-02 10:55:42.640626568 -0400 +@@ -421,14 +421,6 @@ + #endif + ); + +-static inline bool compatible_overlapping_connections(const struct connection *a, +- const struct connection *b) +-{ +- return kernel_ops->overlap_supported && +- a != NULL && b != NULL && +- a != b && +- LIN(POLICY_OVERLAPIP, a->policy & b->policy); +-} + + #ifdef KLIPS + extern const struct kernel_ops klips_kernel_ops; +diff -Naur libreswan-3.25-orig/programs/pluto/pluto_constants.c libreswan-3.25/programs/pluto/pluto_constants.c +--- libreswan-3.25-orig/programs/pluto/pluto_constants.c 2018-06-27 11:42:26.000000000 -0400 ++++ libreswan-3.25/programs/pluto/pluto_constants.c 2019-05-02 10:55:42.636626526 -0400 +@@ -121,6 +121,7 @@ + "EVENT_SD_WATCHDOG", + "EVENT_PENDING_PHASE2", + "EVENT_CHECK_CRLS", ++ "EVENT_REVIVE_CONNS", + + "EVENT_SO_DISCARD", + "EVENT_v1_RETRANSMIT", +diff -Naur libreswan-3.25-orig/programs/pluto/rcv_whack.c libreswan-3.25/programs/pluto/rcv_whack.c +--- libreswan-3.25-orig/programs/pluto/rcv_whack.c 2018-06-27 11:42:26.000000000 -0400 ++++ libreswan-3.25/programs/pluto/rcv_whack.c 2019-05-02 10:55:42.636626526 -0400 +@@ -380,8 +380,14 @@ + * To make this more useful, in only this combination, + * delete will silently ignore the lack of the connection. + */ +- if (m->whack_delete) +- delete_connections_by_name(m->name, !m->whack_connection); ++ if (m->whack_delete) { ++ if (m->name == NULL) { ++ whack_log(RC_FATAL, "received whack command to delete a connection, but did not receive the connection name - ignored"); ++ } else { ++ terminate_connection(m->name, TRUE); ++ delete_connections_by_name(m->name, !m->whack_connection); ++ } ++ } + + if (m->whack_deleteuser) { + DBG_log("received whack to delete connection by user %s", +@@ -573,7 +579,7 @@ + } + + if (m->whack_terminate) +- terminate_connection(m->name); ++ terminate_connection(m->name, TRUE); + + if (m->whack_status) + show_status(); +diff -Naur libreswan-3.25-orig/programs/pluto/state.c libreswan-3.25/programs/pluto/state.c +--- libreswan-3.25-orig/programs/pluto/state.c 2019-05-02 10:54:07.252614517 -0400 ++++ libreswan-3.25/programs/pluto/state.c 2019-05-02 10:56:28.447113336 -0400 +@@ -77,6 +77,8 @@ + #include "crypt_dh.h" + #include "hostpair.h" + ++#include "kernel.h" ++ + #include + #include + #include +@@ -128,6 +130,115 @@ + [STATE_UNDEFINED] = &state_undefined, + }; + ++/* ++ * Revival mechanism: keep track of connections ++ * that should be kept up, even though all their ++ * states have been deleted. ++ * ++ * We record the connection names. ++ * Each name is recorded only once. ++ * ++ * XXX: This functionality totally overlaps both "initiate" and ++ * "pending" and should be merged (howerver, this simple code might ++ * prove to be a better starting point). ++ */ ++ ++struct revival { ++ char *name; ++ struct revival *next; ++}; ++ ++static struct revival *revivals = NULL; ++ ++/* ++ * XXX: Return connection C's revival object's link, if found. If the ++ * connection C can't be found, then the address of the revival list's ++ * tail is returned. Perhaps, exiting the loop and returning NULL ++ * would be more obvious. ++ */ ++static struct revival **find_revival(const struct connection *c) ++{ ++ for (struct revival **rp = &revivals; ; rp = &(*rp)->next) { ++ if (*rp == NULL || streq((*rp)->name, c->name)) { ++ return rp; ++ } ++ } ++} ++ ++/* ++ * XXX: In addition to freeing RP (and killing the pointer), this ++ * "free" function has the side effect of unlinks RP from the revival ++ * list. Perhaps free*() isn't the best name. ++ */ ++static void free_revival(struct revival **rp) ++{ ++ struct revival *r = *rp; ++ *rp = r->next; ++ pfree(r->name); ++ pfree(r); ++} ++ ++void flush_revival(const struct connection *c) ++{ ++ struct revival **rp = find_revival(c); ++ ++ if (*rp == NULL) { ++ DBG(DBG_CONTROL, DBG_log("flush revival: connection '%s' wasn't on the list", ++ c->name)); ++ } else { ++ DBG(DBG_CONTROL, DBG_log("flush revival: connection '%s' revival flushed", ++ c->name)); ++ free_revival(rp); ++ } ++} ++ ++static void add_revival(struct connection *c) ++{ ++ if (*find_revival(c) == NULL) { ++ struct revival *r = alloc_thing(struct revival, ++ "revival struct"); ++ ++ r->name = clone_str(c->name, "revival conn name"); ++ r->next = revivals; ++ revivals = r; ++ int delay = c->revive_delay; ++ DBG(DBG_CONTROL, DBG_log("add revival: connection '%s' added to the list and scheduled for %d seconds", ++ c->name, delay)); ++ c->revive_delay = min(delay + REVIVE_CONN_DELAY, ++ REVIVE_CONN_DELAY_MAX); ++ /* ++ * XXX: Schedule the next revival using this ++ * connection's revival delay and not the most urgent ++ * connection's revival delay. Trying to fix this ++ * here just is annoying and probably of marginal ++ * benefit: it is something better handled with a ++ * proper connection event so that the event loop deal ++ * with all the math (this code would then be ++ * deleted); and would encroach even further on ++ * "initiate" and "pending" functionality. ++ */ ++ event_schedule(EVENT_REVIVE_CONNS, deltatime(delay), NULL); ++ } ++} ++ ++void revive_conns(void) ++{ ++ /* ++ * XXX: Revive all listed connections regardless of their ++ * DELAY. See note above in add_revival(). ++ */ ++ while (revivals != NULL) { ++ libreswan_log("Initiating connection %s which received a Delete/Notify but must remain up per local policy", ++ revivals->name); ++ initiate_connection(revivals->name, NULL_FD, empty_lmod, empty_lmod, pcim_demand_crypto, NULL); ++ free_revival(&revivals); ++ } ++} ++ ++/* end of revival mechanism */ ++ ++ ++ + void lswlog_finite_state(struct lswlog *buf, const struct finite_state *fs) + { + if (fs == NULL) { +@@ -1156,6 +1267,23 @@ + if (c->newest_isakmp_sa == st->st_serialno) + c->newest_isakmp_sa = SOS_NOBODY; + ++ if ((c->policy & POLICY_UP) && IS_IKE_SA(st)) { ++ so_serial_t newer_sa = get_newer_sa_from_connection(st); ++ ++ if (state_by_serialno(newer_sa) != NULL) { ++ /* ++ * Presumably this is an old state that has ++ * either been rekeyed or replaced. ++ */ ++ DBG(DBG_CONTROL, DBG_log("IKE delete_state() for #%lu and connection '%s' that is supposed to remain up; not a problem - have newer #%lu", ++ st->st_serialno, c->name, newer_sa)); ++ } else { ++ libreswan_log("deleting IKE SA for connection '%s' but connection is supposed to remain up; schedule EVENT_REVIVE_CONNS", ++ c->name); ++ add_revival(c); ++ } ++ } ++ + /* + * fake a state change here while we are still associated with a + * connection. Without this the state logging (when enabled) cannot +diff -Naur libreswan-3.25-orig/programs/pluto/state.h libreswan-3.25/programs/pluto/state.h +--- libreswan-3.25-orig/programs/pluto/state.h 2018-06-27 11:42:26.000000000 -0400 ++++ libreswan-3.25/programs/pluto/state.h 2019-05-02 10:55:42.638626547 -0400 +@@ -809,5 +809,5 @@ + + extern bool uniqueIDs; /* --uniqueids? */ + extern void ISAKMP_SA_established(const struct state *pst); +- ++extern void revive_conns(void); + #endif /* _STATE_H */ +diff -Naur libreswan-3.25-orig/programs/pluto/terminate.c libreswan-3.25/programs/pluto/terminate.c +--- libreswan-3.25-orig/programs/pluto/terminate.c 2018-06-27 11:42:26.000000000 -0400 ++++ libreswan-3.25/programs/pluto/terminate.c 2019-05-02 10:55:42.638626547 -0400 +@@ -90,7 +90,7 @@ + return 1; + } + +-void terminate_connection(const char *name) ++void terminate_connection(const char *name, bool quiet) + { + /* + * Loop because more than one may match (master and instances) +@@ -112,7 +112,8 @@ + } else { + int count = foreach_connection_by_alias(name, terminate_a_connection, NULL); + if (count == 0) { +- loglog(RC_UNKNOWN_NAME, ++ if (!quiet) ++ loglog(RC_UNKNOWN_NAME, + "no such connection or aliased connection named \"%s\"", name); + } else { + loglog(RC_COMMENT, "terminated %d connections from aliased connection \"%s\"", +diff -Naur libreswan-3.25-orig/programs/pluto/timer.c libreswan-3.25/programs/pluto/timer.c +--- libreswan-3.25-orig/programs/pluto/timer.c 2018-06-27 11:42:26.000000000 -0400 ++++ libreswan-3.25/programs/pluto/timer.c 2019-05-02 10:55:42.638626547 -0400 +@@ -334,6 +334,7 @@ + case EVENT_SD_WATCHDOG: + case EVENT_NAT_T_KEEPALIVE: + case EVENT_CHECK_CRLS: ++ case EVENT_REVIVE_CONNS: + passert(st == NULL); + break; + +@@ -435,6 +436,10 @@ + check_crls(); + break; + ++ case EVENT_REVIVE_CONNS: ++ revive_conns(); ++ break; ++ + case EVENT_v2_RELEASE_WHACK: + DBG(DBG_CONTROL, DBG_log("%s releasing whack for #%lu %s (sock=%d)", + enum_show(&timer_event_names, type), +diff -Naur libreswan-3.25-orig/programs/pluto/timer.h libreswan-3.25/programs/pluto/timer.h +--- libreswan-3.25-orig/programs/pluto/timer.h 2018-06-27 11:42:26.000000000 -0400 ++++ libreswan-3.25/programs/pluto/timer.h 2019-05-02 10:55:42.638626547 -0400 +@@ -47,4 +47,6 @@ + #define delete_dpd_event(ST) delete_state_event((ST), &(ST)->st_dpd_event) + + extern void timer_list(void); ++extern char *revive_conn; ++ + #endif /* _TIMER_H */ diff --git a/SOURCES/libreswan-3.25-1679735-critical_flag.patch b/SOURCES/libreswan-3.25-1679735-critical_flag.patch new file mode 100644 index 0000000..9371c31 --- /dev/null +++ b/SOURCES/libreswan-3.25-1679735-critical_flag.patch @@ -0,0 +1,86 @@ +diff -Naur libreswan-3.25-orig/programs/pluto/nss_cert_verify.c libreswan-3.25/programs/pluto/nss_cert_verify.c +--- libreswan-3.25-orig/programs/pluto/nss_cert_verify.c 2019-04-11 12:50:35.423733161 +0200 ++++ libreswan-3.25/programs/pluto/nss_cert_verify.c 2019-04-11 12:51:58.832735953 +0200 +@@ -121,7 +121,7 @@ + return FALSE; + } + +-static int nss_err_to_revfail(CERTVerifyLogNode *node) ++static int nss_err_to_revfail(char *prefix, CERTVerifyLogNode *node) + { + int ret = VERIFY_RET_FAIL; + +@@ -131,7 +131,7 @@ + + loglog(RC_LOG_SERIOUS, "Certificate %s failed verification", + node->cert->subjectName); +- loglog(RC_LOG_SERIOUS, "ERROR: %s", ++ loglog(RC_LOG_SERIOUS, "%s: %s", prefix, + nss_err_str(node->error)); + + if (node->error == SEC_ERROR_REVOKED_CERTIFICATE) { +@@ -298,18 +298,18 @@ + cvout[1].value.pointer.chain = NULL; + cvout[2].type = cert_po_end; + +- int fin; ++ int fin = VERIFY_RET_FAIL; + + #ifdef NSS_IPSEC_PROFILE + SECStatus rv = CERT_PKIXVerifyCert(end_cert, certificateUsageIPsec, + cvin, cvout, NULL); + if (rv != SECSuccess || cur_log->count > 0) { + if (cur_log->count > 0 && cur_log->head != NULL) { +- fin = nss_err_to_revfail(cur_log->head); ++ fin = nss_err_to_revfail("warning", cur_log->head); + } else { + /* + * An rv != SECSuccess without CERTVerifyLog +- * results should not * happen, but catch it anyway ++ * results should not happen, but catch it anyway + */ + loglog(RC_LOG_SERIOUS, "X509: unspecified NSS verification failure"); + fin = VERIFY_RET_FAIL; +@@ -319,7 +319,11 @@ + *end_out = end_cert; + fin = VERIFY_RET_OK; + } +-#else ++#endif ++ ++ if (fin != VERIFY_RET_OK) ++ { ++ + /* kludge alert!! + * verification may be performed twice: once with the + * 'client' usage and once with 'server', which is an NSS +@@ -332,7 +336,7 @@ + + for (usage = certificateUsageSSLClient; ; usage = certificateUsageSSLServer) { + SECStatus rv = CERT_PKIXVerifyCert(end_cert, usage, cvin, cvout, NULL); +- if (rv != SECSuccess || cur_log->count > 0) { ++ if (rv != SECSuccess) { + if (cur_log->count > 0 && cur_log->head != NULL) { + if (usage == certificateUsageSSLClient && + RETRYABLE_TYPE(cur_log->head->error)) { +@@ -348,7 +352,8 @@ + cvout[1].value.pointer.chain = NULL; + continue; + } else { +- fin = nss_err_to_revfail(cur_log->head); ++ fin = nss_err_to_revfail("ERROR", cur_log->head); ++ loglog(RC_LOG_SERIOUS, "X509: verification failure using NSS TLS profile validation"); + } + } else { + /* +@@ -365,7 +370,9 @@ + } + break; + } +-#endif ++ ++ } ++ + pexpect(fin != 0); + + CERT_DestroyCertList(trustcl); diff --git a/SOURCES/libreswan-3.25-1686991-ikev1-del.patch b/SOURCES/libreswan-3.25-1686991-ikev1-del.patch new file mode 100644 index 0000000..d8d8933 --- /dev/null +++ b/SOURCES/libreswan-3.25-1686991-ikev1-del.patch @@ -0,0 +1,39 @@ +diff -Naur libreswan-3.25-orig/programs/pluto/ikev1_main.c libreswan-3.25/programs/pluto/ikev1_main.c +--- libreswan-3.25-orig/programs/pluto/ikev1_main.c 2019-05-07 15:41:26.366181612 -0400 ++++ libreswan-3.25/programs/pluto/ikev1_main.c 2019-05-07 15:45:41.780183599 -0400 +@@ -2727,30 +2727,11 @@ + * Useful if the other peer is + * rebooting. + */ +- if (dst->st_event != NULL && +- dst->st_event->ev_type == +- EVENT_SA_REPLACE && +- !monobefore(monotimesum(mononow(), +- deltatime(DELETE_SA_DELAY)), +- dst->st_event->ev_time)) { +- /* +- * Patch from Angus Lees to +- * ignore retransmitted +- * Delete SA. +- */ +- loglog(RC_LOG_SERIOUS, +- "received Delete SA payload: already replacing IPSEC State #%lu in %ld seconds", +- dst->st_serialno, +- (long)deltasecs(monotimediff( +- dst->st_event->ev_time, +- mononow()))); +- } else { +- loglog(RC_LOG_SERIOUS, +- "received Delete SA payload: replace IPSEC State #%lu now", +- dst->st_serialno); +- dst->st_margin = deltatime(0); +- event_force(EVENT_SA_REPLACE, dst); +- } ++ loglog(RC_LOG_SERIOUS, ++ "received Delete SA payload: replace IPSEC State #%lu now", ++ dst->st_serialno); ++ dst->st_margin = deltatime(0); ++ event_force(EVENT_SA_REPLACE, dst); + } else { + loglog(RC_LOG_SERIOUS, + "received Delete SA(0x%08" PRIx32 ") payload: deleting IPSEC State #%lu", diff --git a/SOURCES/libreswan-3.25-1724200-halfopen-shunt.patch b/SOURCES/libreswan-3.25-1724200-halfopen-shunt.patch new file mode 100644 index 0000000..839b7c3 --- /dev/null +++ b/SOURCES/libreswan-3.25-1724200-halfopen-shunt.patch @@ -0,0 +1,13 @@ +diff -Naur libreswan-3.25-orig/programs/pluto/state.c libreswan-3.25/programs/pluto/state.c +--- libreswan-3.25-orig/programs/pluto/state.c 2019-07-03 15:52:47.246474906 -0400 ++++ libreswan-3.25/programs/pluto/state.c 2019-07-03 15:54:37.671850020 -0400 +@@ -1101,7 +1101,8 @@ + #endif + + /* If we are failed OE initiator, make shunt bare */ +- if (IS_IKE_SA(st) && (c->policy & POLICY_OPPORTUNISTIC) && ++ if (IS_IKE_SA(st) && c->newest_isakmp_sa == st->st_serialno && ++ (c->policy & POLICY_OPPORTUNISTIC) && + (st->st_state == STATE_PARENT_I1 || st->st_state == STATE_PARENT_I2)) { + ipsec_spi_t failure_shunt = shunt_policy_spi(c, FALSE /* failure_shunt */); + ipsec_spi_t nego_shunt = shunt_policy_spi(c, TRUE /* negotiation shunt */); diff --git a/SOURCES/libreswan-3.25-EKU-1639404.patch b/SOURCES/libreswan-3.25-EKU-1639404.patch new file mode 100644 index 0000000..7249f6c --- /dev/null +++ b/SOURCES/libreswan-3.25-EKU-1639404.patch @@ -0,0 +1,108 @@ +diff --git a/lib/libswan/Makefile b/lib/libswan/Makefile +index 510148ad1..0f5c26228 100644 +--- a/lib/libswan/Makefile ++++ b/lib/libswan/Makefile +@@ -200,10 +200,6 @@ CFLAGS+=-I${LIBRESWANSRCDIR}/include ${PORTINCLUDE} + CFLAGS+=$(USERLAND_CFLAGS) + CFLAGS+=${CROSSFLAGS} + +-ifeq ($(NSS_REQ_AVA_COPY),true) +-CFLAGS+=-DNSS_REQ_AVA_COPY +-endif +- + OBJS += $(abs_builddir)/version.o + + include $(top_srcdir)/mk/library.mk +diff --git a/mk/config.mk b/mk/config.mk +index 3f2bd55c1..fcdabd1fb 100644 +--- a/mk/config.mk ++++ b/mk/config.mk +@@ -242,6 +242,17 @@ NSPR_LDFLAGS ?= -lnspr4 + # Use nss copy for CERT_CompareAVA + # See https://bugzilla.mozilla.org/show_bug.cgi?id=1336487 + NSS_REQ_AVA_COPY?=true ++ifeq ($(NSS_REQ_AVA_COPY),true) ++NSSFLAGS+=-DNSS_REQ_AVA_COPY ++endif ++ ++# Use nss IPsec profile for X509 validation. This is less restrictive ++# ok EKU's. This is not yet in upstream nss. ++# See https://bugzilla.mozilla.org/show_bug.cgi?id=1252891 ++NSS_HAS_IPSEC_PROFILE?=false ++ifeq ($(NSS_HAS_IPSEC_PROFILE),true) ++NSSFLAGS+=-DNSS_IPSEC_PROFILE ++endif + + # Use a local copy of xfrm.h. This can be needed on older systems + # that do not ship linux/xfrm.h, or when the shipped version is too +diff --git a/programs/pluto/nss_cert_verify.c b/programs/pluto/nss_cert_verify.c +index 95c637f53..7d458ac2a 100644 +--- a/programs/pluto/nss_cert_verify.c ++++ b/programs/pluto/nss_cert_verify.c +@@ -299,6 +299,28 @@ static int vfy_chain_pkix(CERTCertificate **chain, int chain_len, + cvout[1].value.pointer.chain = NULL; + cvout[2].type = cert_po_end; + ++ int fin; ++ ++#ifdef NSS_IPSEC_PROFILE ++ SECStatus rv = CERT_PKIXVerifyCert(end_cert, certificateUsageIPsec, ++ cvin, cvout, NULL); ++ if (rv != SECSuccess || cur_log->count > 0) { ++ if (cur_log->count > 0 && cur_log->head != NULL) { ++ fin = nss_err_to_revfail(cur_log->head); ++ } else { ++ /* ++ * An rv != SECSuccess without CERTVerifyLog ++ * results should not * happen, but catch it anyway ++ */ ++ loglog(RC_LOG_SERIOUS, "X509: unspecified NSS verification failure"); ++ fin = VERIFY_RET_FAIL; ++ } ++ } else { ++ DBG(DBG_X509, DBG_log("certificate is valid")); ++ *end_out = end_cert; ++ fin = VERIFY_RET_OK; ++ } ++#else + /* kludge alert!! + * verification may be performed twice: once with the + * 'client' usage and once with 'server', which is an NSS +@@ -307,12 +329,10 @@ static int vfy_chain_pkix(CERTCertificate **chain, int chain_len, + * KU/EKU combinations + */ + +- int fin; + SECCertificateUsage usage; + + for (usage = certificateUsageSSLClient; ; usage = certificateUsageSSLServer) { + SECStatus rv = CERT_PKIXVerifyCert(end_cert, usage, cvin, cvout, NULL); +- + if (rv != SECSuccess || cur_log->count > 0) { + if (cur_log->count > 0 && cur_log->head != NULL) { + if (usage == certificateUsageSSLClient && +@@ -346,6 +366,7 @@ static int vfy_chain_pkix(CERTCertificate **chain, int chain_len, + } + break; + } ++#endif + pexpect(fin != 0); + + CERT_DestroyCertList(trustcl); +diff --git a/programs/pluto/plutomain.c b/programs/pluto/plutomain.c +index 50582822d..007d73f45 100644 +--- a/programs/pluto/plutomain.c ++++ b/programs/pluto/plutomain.c +@@ -180,6 +180,12 @@ static const char compile_time_interop_options[] = "" + " BROKEN_POPEN" + #endif + " NSS" ++#ifdef NSS_REQ_AVA_COPY ++ " (AVA copy)" ++#endif ++#ifdef NSS_IPSEC_PROFILE ++ " (IPsec profile)" ++#endif + #ifdef USE_DNSSEC + " DNSSEC" + #endif diff --git a/SOURCES/libreswan-3.25-alg_info.patch b/SOURCES/libreswan-3.25-alg_info.patch new file mode 100644 index 0000000..3e47c47 --- /dev/null +++ b/SOURCES/libreswan-3.25-alg_info.patch @@ -0,0 +1,13 @@ +diff --git a/lib/libswan/alg_info.c b/lib/libswan/alg_info.c +index fd45e4991..ade54db06 100644 +--- a/lib/libswan/alg_info.c ++++ b/lib/libswan/alg_info.c +@@ -426,7 +426,7 @@ static bool parser_alg_info_add(const struct proposal_parser *parser, + LSWDBGP(DBG_PROPOSAL_PARSER, buf) { + lswlogs(buf, "algs:"); + for (struct token *token = tokens; token->alg.ptr != NULL; token++) { +- lswlogf(buf, " algs[%zu] = '"PRISHUNK"'", ++ lswlogf(buf, " algs[%tu] = '"PRISHUNK"'", + token - tokens, SHUNKF(token->alg)); + } + } diff --git a/SOURCES/libreswan-3.25-relax-delete.patch b/SOURCES/libreswan-3.25-relax-delete.patch new file mode 100644 index 0000000..e5a0280 --- /dev/null +++ b/SOURCES/libreswan-3.25-relax-delete.patch @@ -0,0 +1,62 @@ +diff --git a/programs/pluto/state.c b/programs/pluto/state.c +index 7b33145..a3bcc3c 100644 +--- a/programs/pluto/state.c ++++ b/programs/pluto/state.c +@@ -3155,27 +3155,40 @@ void ISAKMP_SA_established(const struct state *pst) + d = next; + } + +- if (c->newest_isakmp_sa != SOS_NOBODY && +- c->newest_isakmp_sa != pst->st_serialno) { +- struct state *old_p1 = state_by_serialno(c->newest_isakmp_sa); ++ /* ++ * This only affects IKEv2, since we don't store any ++ * received INITIAL_CONTACT for IKEv1. ++ * We don't do this on IKEv1, because it seems to ++ * confuse various third parties (Windows, Cisco VPN 300, ++ * and juniper ++ * likely because this would be called before the IPsec SA ++ * of QuickMode is installed, so the remote endpoints view ++ * this IKE SA still as the active one? ++ */ ++ if (pst->st_seen_initialc) { + +- DBG(DBG_CONTROL, DBG_log("deleting replaced IKE state for %s", +- old_p1->st_connection->name)); +- old_p1->st_suppress_del_notify = TRUE; +- event_force(EVENT_SA_EXPIRE, old_p1); +- } ++ if (c->newest_isakmp_sa != SOS_NOBODY && ++ c->newest_isakmp_sa != pst->st_serialno) { ++ struct state *old_p1 = state_by_serialno(c->newest_isakmp_sa); + +- if (pst->st_seen_initialc && (c->newest_ipsec_sa != SOS_NOBODY)) +- { +- struct state *old_p2 = state_by_serialno(c->newest_ipsec_sa); +- struct connection *d = old_p2 == NULL ? NULL : old_p2->st_connection; ++ DBG(DBG_CONTROL, DBG_log("deleting replaced IKE state for %s", ++ old_p1->st_connection->name)); ++ old_p1->st_suppress_del_notify = TRUE; ++ event_force(EVENT_SA_EXPIRE, old_p1); ++ } + +- if (c == d && same_id(&c->spd.that.id, &d->spd.that.id)) ++ if (c->newest_ipsec_sa != SOS_NOBODY) + { +- DBG(DBG_CONTROL, DBG_log("Initial Contact received, deleting old state #%lu from connection '%s'", +- c->newest_ipsec_sa, c->name)); +- old_p2->st_suppress_del_notify = TRUE; +- event_force(EVENT_SA_EXPIRE, old_p2); ++ struct state *old_p2 = state_by_serialno(c->newest_ipsec_sa); ++ struct connection *d = old_p2 == NULL ? NULL : old_p2->st_connection; ++ ++ if (c == d && same_id(&c->spd.that.id, &d->spd.that.id)) ++ { ++ DBG(DBG_CONTROL, DBG_log("Initial Contact received, deleting old state #%lu from connection '%s'", ++ c->newest_ipsec_sa, c->name)); ++ old_p2->st_suppress_del_notify = TRUE; ++ event_force(EVENT_SA_EXPIRE, old_p2); ++ } + } + } + diff --git a/SOURCES/libreswan-3.27-1672921-delete.patch b/SOURCES/libreswan-3.27-1672921-delete.patch new file mode 100644 index 0000000..87447ad --- /dev/null +++ b/SOURCES/libreswan-3.27-1672921-delete.patch @@ -0,0 +1,82 @@ +diff -Naur libreswan-3.25-orig/include/pluto_constants.h libreswan-3.25/include/pluto_constants.h +--- libreswan-3.25-orig/include/pluto_constants.h 2018-06-27 11:42:26.000000000 -0400 ++++ libreswan-3.25/include/pluto_constants.h 2019-02-15 17:41:06.954865678 -0500 +@@ -436,6 +436,8 @@ + + IMPAIR_SEND_PKCS7_THINGIE_IX, /* send certificates as a PKCS7 thingie */ + ++ IMPAIR_IKEv1_DEL_WITH_NOTIFY_IX, ++ + IMPAIR_roof_IX /* first unassigned IMPAIR */ + }; + +@@ -495,6 +497,7 @@ + + #define IMPAIR_SEND_PKCS7_THINGIE LELEM(IMPAIR_SEND_PKCS7_THINGIE_IX) + ++#define IMPAIR_IKEv1_DEL_WITH_NOTIFY LELEM(IMPAIR_IKEv1_DEL_WITH_NOTIFY_IX) + /* State of exchanges + * + * The name of the state describes the last message sent, not the +diff -Naur libreswan-3.25-orig/lib/libswan/impair.c libreswan-3.25/lib/libswan/impair.c +--- libreswan-3.25-orig/lib/libswan/impair.c 2018-06-27 11:42:26.000000000 -0400 ++++ libreswan-3.25/lib/libswan/impair.c 2019-02-15 17:41:06.954865678 -0500 +@@ -75,6 +75,8 @@ + I(IMPAIR_ALLOW_DNS_INSECURE, "impair-allow-dns-insecure"), + + I(IMPAIR_SEND_PKCS7_THINGIE, "impair-send-pkcs7-thingie"), ++ ++ I(IMPAIR_IKEv1_DEL_WITH_NOTIFY, "impair-ikev1-del-with-notify"), + }; + + const enum_names impair_names = { +diff -Naur libreswan-3.25-orig/programs/pluto/ikev1_main.c libreswan-3.25/programs/pluto/ikev1_main.c +--- libreswan-3.25-orig/programs/pluto/ikev1_main.c 2018-06-27 11:42:26.000000000 -0400 ++++ libreswan-3.25/programs/pluto/ikev1_main.c 2019-02-15 17:42:50.876885416 -0500 +@@ -2491,12 +2491,36 @@ + isad.isad_protoid = ns->proto; + + isad.isad_nospi = 1; ++ ++ if (DBGP(IMPAIR_IKEv1_DEL_WITH_NOTIFY)) ++ isad.isad_np = ISAKMP_NEXT_N; /* Notify */ ++ + passert(out_struct(&isad, &isakmp_delete_desc, &r_hdr_pbs, + &del_pbs)); + passert(out_raw(&ns->spi, sizeof(ipsec_spi_t), + &del_pbs, + "delete payload")); + close_output_pbs(&del_pbs); ++ ++ if (DBGP(IMPAIR_IKEv1_DEL_WITH_NOTIFY)) { ++ pb_stream cruft_pbs; ++ ++ libreswan_log("IMPAIR: adding bogus Notify payload after IKE Delete payload"); ++ struct isakmp_notification isan = { ++ .isan_np = ISAKMP_NEXT_NONE, ++ .isan_doi = ISAKMP_DOI_IPSEC, ++ .isan_protoid = PROTO_ISAKMP, ++ .isan_spisize = COOKIE_SIZE * 2, ++ .isan_type = INVALID_PAYLOAD_TYPE, ++ }; ++ ++ passert(out_struct(&isan, &isakmp_notification_desc, &r_hdr_pbs, ++ &cruft_pbs)); ++ passert(out_raw(&ns->spi, sizeof(ipsec_spi_t), &cruft_pbs, ++ "notify payload")); ++ close_output_pbs(&cruft_pbs); ++ } ++ + } + } + +@@ -2743,7 +2767,9 @@ + rc->policy &= ~POLICY_UP; + if (!shared_phase1_connection(rc)) { + flush_pending_by_connection(rc); ++ /* This also deletes the IKE SA, clear pointer */ + delete_states_by_connection(rc, FALSE); ++ md->st = NULL; + } + reset_cur_connection(); + } diff --git a/SPECS/libreswan.spec b/SPECS/libreswan.spec new file mode 100644 index 0000000..b1bf760 --- /dev/null +++ b/SPECS/libreswan.spec @@ -0,0 +1,625 @@ +# These are rpm macros and are 0 or 1 +%global crl_fetching 1 +%global _hardened_build 1 +%global buildefence 0 +%global development 0 +%global cavstests 1 + +# These are libreswan/make macros and are false or true +%global USE_FIPSCHECK true +%global USE_LIBCAP_NG true +%global USE_LABELED_IPSEC true +%global USE_DNSSEC true +%global USE_NM true +%global USE_LINUX_AUDIT true +%global USE_SECCOMP true +%global NSS_HAS_IPSEC_PROFILE true + +%if 0%{?fedora} +%global rhel 7 +%endif + +#global prever dr1 + +Name: libreswan +Summary: IPsec implementation with IKEv1 and IKEv2 keying protocols +Version: 3.25 +Release: %{?prever:0.}5%{?prever:.%{prever}}%{?dist} +License: GPLv2 +Group: System Environment/Daemons +Url: https://libreswan.org/ +Source: https://download.libreswan.org/%{?prever:development/}%{name}-%{version}%{?prever}.tar.gz +Source1: ikev1_dsa.fax.bz2 +Source2: ikev1_psk.fax.bz2 +Source3: ikev2.fax.bz2 + +Patch1: libreswan-3.25-alg_info.patch +Patch2: libreswan-3.25-relax-delete.patch +Patch3: libreswan-3.25-EKU-1639404.patch +Patch4: libreswan-3.23-zerolengthkey.patch +Patch5: libreswan-3.25-1625303-recursive-incl.patch +Patch6: libreswan-3.23-del-with-notify-1630355.patch +Patch7: libreswan-3.25-1664244-xauth-null-pwd.patch +Patch8: libreswan-3.25-1664521-fips-keysize.patch +Patch9: libreswan-3.27-1672921-delete.patch +Patch10: libreswan-3.25-1679735-critical_flag.patch +Patch11: libreswan-3.25-1673105-down-restart.patch +Patch12: libreswan-3.25-1686991-ikev1-del.patch +Patch13: libreswan-3.25-1724200-halfopen-shunt.patch + +Requires: iproute >= 2.6.8 +Requires: nss-tools nss-softokn + +BuildRequires: bison flex redhat-rpm-config pkgconfig +BuildRequires: nspr-devel +BuildRequires: pam-devel +BuildRequires: xmlto +# minimum nss version for IPsec profile support, see rhbz#1212132 +Requires: nss >= 3.36.0-7.1 +BuildRequires: nss-devel >= 3.36.0-7.1 + +%if %{?rhel} <= 6 +BuildRequires: libevent2-devel net-tools + +Requires(post): coreutils bash +Requires(preun): initscripts chkconfig +Requires(post): /sbin/chkconfig +Requires(preun): /sbin/chkconfig +Requires(preun): /sbin/service +%else +BuildRequires: libevent-devel hostname + +BuildRequires: systemd-devel +Requires(post): coreutils bash systemd +Requires(preun): systemd +Requires(postun): systemd +%endif + +%if %{USE_DNSSEC} +BuildRequires: ldns-devel +Requires: unbound-libs >= 1.6.6 +BuildRequires: unbound-devel >= 1.6.6 +%endif + +%if %{USE_SECCOMP} +BuildRequires: libseccomp-devel +%endif + +%if %{USE_LABELED_IPSEC} +BuildRequires: libselinux-devel +%endif + +%if %{USE_FIPSCHECK} +BuildRequires: fipscheck-devel +# we need fipshmac +Requires: fipscheck%{_isa} +%endif + +%if %{USE_LINUX_AUDIT} +Buildrequires: audit-libs-devel +%endif + +%if %{USE_LIBCAP_NG} +BuildRequires: libcap-ng-devel +%endif + +%if %{crl_fetching} +BuildRequires: openldap-devel curl-devel +%endif + +%if %{buildefence} +BuildRequires: ElectricFence +%endif + +Conflicts: openswan < %{version}-%{release} +Provides: openswan = %{version}-%{release} +Provides: openswan-doc = %{version}-%{release} +Obsoletes: openswan < %{version}-%{release} + +%description +Libreswan is a free implementation of IPsec & IKE for Linux. IPsec is +the Internet Protocol Security and uses strong cryptography to provide +both authentication and encryption services. These services allow you +to build secure tunnels through untrusted networks. Everything passing +through the untrusted net is encrypted by the ipsec gateway machine and +decrypted by the gateway at the other end of the tunnel. The resulting +tunnel is a virtual private network or VPN. + +This package contains the daemons and userland tools for setting up +Libreswan. It supports the NETKEY/XFRM IPsec kernel stack that exists +in the default Linux kernel. + +Libreswan also supports IKEv2 (RFC-7296) and Secure Labeling + +Libreswan is based on Openswan-2.6.38 which in turn is based on FreeS/WAN-2.04 + +%prep +%setup -q -n libreswan-%{version}%{?prever} +%patch1 -p1 +%patch2 -p1 +%patch3 -p1 +%patch4 -p1 +%patch5 -p1 +%patch6 -p1 +%patch7 -p1 +%patch8 -p1 +%patch9 -p1 +%patch10 -p1 +%patch11 -p1 +%patch12 -p1 +%patch13 -p1 + +%build +%if %{buildefence} + %define efence "-lefence" +%endif + +make %{?_smp_mflags} \ +%if %{development} + USERCOMPILE="-g -DGCC_LINT %(echo %{optflags} | sed -e s/-O[0-9]*/ /) %{?efence} -fPIE -pie -fno-strict-aliasing -Wformat-nonliteral -Wformat-security" \ +%else + USERCOMPILE="-g -DGCC_LINT %{optflags} %{?efence} -fPIE -pie -fno-strict-aliasing -Wformat-nonliteral -Wformat-security" \ +%endif + USERLINK="-g -pie -Wl,-z,relro,-z,now %{?efence}" \ + INC_USRLOCAL=%{_prefix} \ + FINALLIBDIR=%{_libexecdir}/ipsec \ + FINALLIBEXECDIR=%{_libexecdir}/ipsec \ + FINALRUNDIR=%{_rundir}/pluto \ + MANTREE=%{buildroot}%{_mandir} \ + INC_RCDEFAULT=%{_initrddir} \ +%if %{?rhel} <= 6 + INITSYSTEM=sysvinit \ +%else + INITSYSTEM=systemd \ +%endif + USE_NM=%{USE_NM} \ + USE_XAUTHPAM=true \ + USE_FIPSCHECK="%{USE_FIPSCHECK}" \ + USE_LIBCAP_NG="%{USE_LIBCAP_NG}" \ + USE_LABELED_IPSEC="%{USE_LABELED_IPSEC}" \ + USE_LINUX_AUDIT="%{USE_LINUX_AUDIT}" \ +%if %{crl_fetching} + USE_LDAP=true \ + USE_LIBCURL=true \ +%else + USE_LDAP=false \ + USE_LIBCURL=false \ +%endif + USE_DNSSEC="%{USE_DNSSEC}" \ + USE_SECCOMP="%{USE_SECCOMP}" \ + NSS_HAS_IPSEC_PROFILE="%{NSS_HAS_IPSEC_PROFILE}" \ + USE_DH22=true \ + programs +FS=$(pwd) + +%if %{USE_FIPSCHECK} +# Add generation of HMAC checksums of the final stripped binaries +%if %{?rhel} <= 6 +%define __spec_install_post \ + %{?__debug_package:%{__debug_install_post}} \ + %{__arch_install_post} \ + %{__os_install_post} \ + fipshmac %{buildroot}%{_libexecdir}/ipsec/pluto \ +%{nil} +%else +%define __spec_install_post \ + %{?__debug_package:%{__debug_install_post}} \ + %{__arch_install_post} \ + %{__os_install_post} \ + mkdir -p %{buildroot}%{_libdir}/fipscheck/ \ + fipshmac -d %{buildroot}%{_libdir}/fipscheck %{buildroot}%{_libexecdir}/ipsec/pluto +%{nil} +%endif +%endif + +%install +make \ + DESTDIR=%{buildroot} \ + INC_USRLOCAL=%{_prefix} \ + FINALLIBDIR=%{_libexecdir}/ipsec \ + FINALLIBEXECDIR=%{_libexecdir}/ipsec \ + FINALRUNDIR=%{_rundir}/pluto \ + MANTREE=%{buildroot}%{_mandir} \ + INC_RCDEFAULT=%{_initrddir} \ +%if %{?rhel} <= 6 + INITSYSTEM=sysvinit \ +%else + INITSYSTEM=systemd \ +%endif + USE_NM=%{USE_NM} \ + USE_XAUTHPAM=true \ + USE_FIPSCHECK="%{USE_FIPSCHECK}" \ + USE_LIBCAP_NG="%{USE_LIBCAP_NG}" \ + USE_LABELED_IPSEC="%{USE_LABELED_IPSEC}" \ + USE_LINUX_AUDIT="%{USE_LINUX_AUDIT}" \ +%if %{crl_fetching} + USE_LDAP=true \ + USE_LIBCURL=true \ +%else + USE_LDAP=false \ + USE_LIBCURL=false \ +%endif + USE_DNSSEC="%{USE_DNSSEC}" \ + USE_SECCOMP="%{USE_SECCOMP}" \ + NSS_HAS_IPSEC_PROFILE="%{NSS_HAS_IPSEC_PROFILE}" \ + USE_DH22=true \ + install +FS=$(pwd) +rm -rf %{buildroot}/usr/share/doc/libreswan +sed -i "s:^#include /etc/ipsec.d/\*.conf$:include /etc/ipsec.d/*.conf:" %{buildroot}%{_sysconfdir}/ipsec.conf + +install -d -m 0755 %{buildroot}%{_localstatedir}/run/pluto +# used when setting --perpeerlog without --perpeerlogbase +install -d -m 0700 %{buildroot}%{_localstatedir}/log/pluto/peer +install -d %{buildroot}%{_sbindir} +%if %{?rhel} <= 6 +# replace with rhel6 specific version +install -m 0755 initsystems/sysvinit/init.rhel %{buildroot}%{_initrddir}/ipsec +rm -fr %{buildroot}/etc/rc.d/rc* +%endif + +%if %{USE_FIPSCHECK} +%if %{?rhel} == 7 +mkdir -p %{buildroot}%{_libdir}/fipscheck +%endif +install -d %{buildroot}%{_sysconfdir}/prelink.conf.d/ +install -m644 packaging/fedora/libreswan-prelink.conf %{buildroot}%{_sysconfdir}/prelink.conf.d/libreswan-fips.conf +%endif + +echo "include /etc/ipsec.d/*.secrets" > %{buildroot}%{_sysconfdir}/ipsec.secrets + +%if %{cavstests} +%check +# There is an elaborate upstream testing infrastructure which we do not run here +# We only run the CAVS tests here +cp %{SOURCE1} %{SOURCE2} %{SOURCE3} . +bunzip2 *.fax.bz2 + +# work around for rhel6 builders on xen +export NSS_DISABLE_HW_GCM=1 + +: "starting CAVS test for IKEv2" +%{buildroot}%{_libexecdir}/ipsec/cavp -v2 ikev2.fax | diff -u ikev2.fax - > /dev/null +: "starting CAVS test for IKEv1 RSASIG" +%{buildroot}%{_libexecdir}/ipsec/cavp -v1dsa ikev1_dsa.fax | diff -u ikev1_dsa.fax - > /dev/null +: "starting CAVS test for IKEv1 PSK" +%{buildroot}%{_libexecdir}/ipsec/cavp -v1psk ikev1_psk.fax | diff -u ikev1_psk.fax - > /dev/null +: "CAVS tests passed" +%endif + +%if %{?rhel} <= 6 +%post +/sbin/chkconfig --add ipsec || : +%if %{USE_FIPSCHECK} +prelink -u %{_libexecdir}/ipsec/* 2>/dev/null || : +%endif + +%preun +if [ $1 -eq 0 ]; then + /sbin/service ipsec stop > /dev/null 2>&1 || : + /sbin/chkconfig --del ipsec +fi + +%postun +if [ $1 -ge 1 ] ; then + /sbin/service ipsec condrestart 2>&1 >/dev/null || : +fi +%else +%preun +%systemd_preun ipsec.service + +%postun +%systemd_postun_with_restart ipsec.service + +%post +%systemd_post ipsec.service +%endif + +%files +%doc CHANGES COPYING CREDITS README* LICENSE +%doc docs/*.* docs/examples packaging/rhel/libreswan-sysctl.conf + +%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipsec.conf +%attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ipsec.secrets +%attr(0700,root,root) %dir %{_sysconfdir}/ipsec.d +%attr(0700,root,root) %dir %{_sysconfdir}/ipsec.d/policies +%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipsec.d/policies/* +%attr(0700,root,root) %dir %{_localstatedir}/log/pluto/peer +%attr(0755,root,root) %dir %{_localstatedir}/run/pluto +%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/pam.d/pluto +%{_sbindir}/ipsec +%attr(0755,root,root) %dir %{_libexecdir}/ipsec +%{_libexecdir}/ipsec/* +%attr(0644,root,root) %{_mandir}/*/*.gz +%if %{?rhel} <= 6 +%{_initrddir}/ipsec +%else +%attr(0644,root,root) %{_unitdir}/ipsec.service +%endif + +%if %{USE_FIPSCHECK} +%if %{?rhel} <= 6 +%{_sbindir}/.ipsec.hmac +%{_libexecdir}/ipsec/.*.hmac +%else +%{_libdir}/fipscheck/*.hmac +%endif + +# We own the directory so we don't have to require prelink +%attr(0755,root,root) %dir %{_sysconfdir}/prelink.conf.d/ +%{_sysconfdir}/prelink.conf.d/libreswan-fips.conf +%endif + +%changelog +* Wed Jul 03 2019 Paul Wouters - 3.25-5 +- Resolves: rhbz#1728175 XFRM policy for OE/32 peer is deleted when shunts for previous half-open state expire [rhel-7.6.z] + +* Thu May 09 2019 Paul Wouters - 3.25-4.8 +- Resolves: rhbz#1708060 IKEv1 traffic interruption when responder deletes SAs 60 seconds before EVENT_SA_REPLACE [rhel-7.6.z] + +* Thu May 02 2019 Paul Wouters - 3.25-4.7 +- Resolves: rhbz#1683577 Opportunistic IPsec instances of /32 groups or auto=start [updated for eclipsed handling] + +* Thu Apr 11 2019 Paul Wouters - 3.25-4.6 +- Resolves: rhbz#1680483 libreswan using NSS IPsec profiles regresses when critical flags are set causing validation failure [rhel-7.6.z] [updated] + +* Sun Mar 31 2019 Paul Wouters - 3.25-4.5 +- Resolves: rhbz#1683577 Opportunistic IPsec instances of /32 groups or auto=start that receive delete won't restart [rhel-7.6.z] [updated] + +* Tue Feb 26 2019 Paul Wouters - 3.25-4.4 +- Resolves: rhbz#1683577 Opportunistic IPsec instances of /32 groups or auto=start that receive delete won't restart [rhel-7.6.z] + +* Mon Feb 25 2019 Paul Wouters - 3.25-4.3 +- Resolves: rhbz#1680483 libreswan using NSS IPsec profiles regresses when critical flags are set causing validation failure [rhel-7.6.z] + +* Fri Feb 15 2019 Paul Wouters - 3.25-4.2 +- Resolves: rhbz#1672921 - Libreswan crash upon receiving ISAKMP_NEXT_D with appended ISAKMP_NEXT_N [updated bugfix] + +* Fri Jan 11 2019 Paul Wouters - 3.25-4.1 +- Resolves: rhbz#1665369 libreswan 3.25 in FIPS mode is incorrectly rejecting X.509 public keys that are >= 3072 bits [rhel-7.6.z] + +* Tue Jan 08 2019 Paul Wouters - 3.25-4 +- Resolves: rhbz#1660536 libreswan assertion failed when OAKLEY_KEY_LENGTH is zero for IKE using AES_CBC +- Resolves: rhbz#1660544 config: recursive include check doesn't work +- Resolves: rhbz#1660542 Libreswan crash upon receiving ISAKMP_NEXT_D with appended ISAKMP_NEXT_N +- Resolves: rhbz#1664244 [abrt] [faf] libreswan: strncpy(): /usr/libexec/ipsec/pluto killed by 11 + +* Mon Dec 03 2018 Paul Wouters - 3.25-3 +- Resolves: rhbz#1655440 Unable to verify certificate with non-empty Extended Key Usage which does not include serverAuth or clientAuth + +* Mon Jul 02 2018 Paul Wouters - 3.25-2 +- Resolves: rhbz#1597322 Relax deleting IKE SA's and IPsec SA's to avoid interop issues with third party VPN vendors + +* Wed Jun 27 2018 Paul Wouters - 3.25-1 +- Resolves: rhbz#1591817 rebase libreswan to 3.25 +- Resolves: rhbz#1536404 CERT_PKCS7_WRAPPED_X509 error +- Resolves: rhbz#1544143 ipsec newhostkey fails in FIPS mode when RSA key is generated +- Resolves: rhbz#1574011 libreswan is missing a Requires: unbound-libs >= 1.6.6 + +* Fri Apr 27 2018 Paul Wouters - 3.23-4 +- Resolves: rhbz#1544143 ipsec newhostkey fails in FIPS mode when RSA key is generated +- Resolves: rhbz#1553406 IKEv2 liveness false positive on IKEv2 idle connections causes tunnel to be restarted +- Resolves: rhbz#1572425 shared IKE SA leads to rekey interop issues + +* Wed Feb 07 2018 Paul Wouters - 3.23-3 +- Resolves: rhbz#1471553 libreswan postquantum preshared key (PPK) support [IANA update] + +* Tue Feb 06 2018 Paul Wouters - 3.23-2 +- Resolves: rhbz#1457904 rebase libreswan to 3.23 [updated] +- Resolves: rhbz#1375750 SECCOMP support for libreswan [updated] + +* Thu Jan 25 2018 Paul Wouters - 3.23-1 +- Resolves: rhbz#1457904 rebase libreswan to 3.23 [updated] + +* Thu Jan 11 2018 Paul Wouters - 3.23-0.1.rc4 +- Resolves: rhbz#1471763 RFE: libreswan MOBIKE support (RFC-4555) [client support] +- Resolves: rhbz#1457904 rebase libreswan to 3.23 [updated] +- Resolves: rhbz#1471553 libreswan postquantum preshared key (PPK) support +- Resolves: rhbz#1492501 Reboot or 'systemctl stop ipsec' brings down _ethernet_ interfaces on _both_ ends of ipv4 ipsec tunnel +- Resolves: rhbz#1324421 libreswan works not well when setting leftid field to be email address +- Resolves: rhbz#1136076 After IKE rekeying Pluto sends DPD even if there is active SA + +* Tue Dec 12 2017 Paul Wouters - 3.22-5 +- Resolves: rhbz#1471763 RFE: libreswan MOBIKE support (RFC-4555) [updated] +- Resolves: rhbz#1471553 libreswan postquantum preshared key (PPK) support +- Resolves: rhbz#1375776 [IKEv2 Conformance] Test IKEv2.EN.R.1.2.2.1: Receipt of retransmitted CREATE_CHILD_SA reques failed +- Resolves: rhbz#1375750 SECCOMP support for libreswan [updated for libunbound syscalls] +- Resolves: rhbz#1300763 Implement draft-ietf-ipsecme-split-dns for libreswan + +* Thu Nov 30 2017 Paul Wouters - 3.22-4 +- Resolves: rhbz#1463062 NIC-card hardware offload support backport + +* Thu Nov 16 2017 Paul Wouters - 3.22-3 +- Resolves: rhbz#1475434 Add support for AES-GMAC for ESP (RFC-4543) to libreswan +- Resolves: rhbz#1300759 Implement RFC-7427 Digital Signature authentication + +* Tue Oct 31 2017 Paul Wouters - 3.22-2 +- Resolves: rhbz#1471763 RFE: libreswan MOBIKE support (RFC-4555) +- Resolves: rhbz#1372050 RFE: Support IKE and ESP over TCP: RFC 8229 + +* Mon Oct 23 2017 Paul Wouters - 3.22-1 +- Resolves: rhbz#1457904 rebase libreswan to 3.22 [updated] + +* Mon Oct 16 2017 Paul Wouters - 3.21-2 +- Resolves: rhbz#1499845 libreswan does not establish IKE with xauth enabled but modecfg disabled +- Resolves: rhbz#1497158 xauth password length limited to 64 bytes while XAUTH_MAX_PASS_LENGTH (128) + +* Wed Sep 20 2017 Paul Wouters - 3.21-1 +- Resolves: rhbz#1457904 rebase libreswan to 3.22 + +* Mon Jun 12 2017 Paul Wouters - 3.20-3 +- Resolves: rhbz#1372279 ipsec auto --down CONNECTION returns error for tunnels [updated] +- Resolves: rhbz#1458227 CAVS test driver does not work in FIPS mode +- Resolves: rhbz#1452672 (new-ksk-libreswan-el7) DNSSEC trust anchor cannot be updated without recompilation + +* Thu Apr 13 2017 Paul Wouters - 3.20-2 +- Resolves: rhbz#1372279 ipsec auto --down CONNECTION returns error for tunnels +- Resolves: rhbz#1444115 FIPS: libreswan must generate RSA keys with a minimal exponent of F4, nor E=3 +- Resolves: rhbz#1341353 Allow Preshared Key authentication in FIPS mode for libreswan + +* Tue Mar 14 2017 Paul Wouters - 3.20-1 +- Resolves: rhbz#1399883 rebase libreswan to 3.20 (full release) + +* Mon Feb 20 2017 Paul Wouters - 3.20-0.1.dr3 +- Resolves: rhbz#1399883 rebase libreswan to 3.20 + +* Wed Sep 07 2016 Paul Wouters - 3.15-8 +- Resolves: rhbz#1361721 libreswan pluto segfault [UPDATED] +- Resolves: rhbz#1276524 [USGv6] IKEv2.EN.R.1.1.3.2 case failed due to response to bad INFORMATIONAL request [UPDATED] +- Resolves: rhbz#1309764 ipsec barf [additional man page update and --no-pager] + +* Mon Aug 08 2016 Paul Wouters - 3.15-7 +- Resolves: rhbz#1311360 When IKE rekeys, if on a different tunnel, all subsequent attempts to rekey fail +- Resolves: rhbz#1361721 libreswan pluto segfault + +* Tue Jul 05 2016 Paul Wouters - 3.15-6 +- Resolves: rhbz#1283468 keyingtries=0 is broken +- Resolves: rhbz#1297816 When using SHA2 as PRF algorithm, nonce payload is below the RFC minimum size +- Resolves: rhbz#1344567 CVE-2016-5361 libreswan: IKEv1 protocol is vulnerable to DoS amplification attack +- Resolves: rhbz#1313747 ipsec pluto returns zero even if it fails +- Resolves: rhbz#1302778 fips does not check hash of some files (like _import_crl) +- Resolves: rhbz#1278063 Unable to authenticate with PAM for IKEv1 XAUTH +- Resolves: rhbz#1257079 Libreswan doesn't call NetworkManager helper in case of a connection error +- Resolves: rhbz#1272112 ipsec whack man page discrepancies +- Resolves: rhbz#1280449 PAM xauth method does not work with pam_sss +- Resolves: rhbz#1290907 ipsec initnss/checknss custom directory not recognized +- Resolves: rhbz#1309764 ipsec barf does not show pluto log correctly in the output +- Resolves: rhbz#1347735 libreswan needs to check additional CRLs after LDAP CRL distributionpoint fails +- Resolves: rhbz#1219049 Pluto does not handle delete message from responder site in ikev1 +- Resolves: rhbz#1276524 [USGv6] IKEv2.EN.R.1.1.3.2 case failed due to response to bad INFORMATIONAL request +- Resolves: rhbz#1315412 ipsec.conf manpage does not contain any mention about crl-strict option +- Resolves: rhbz#1229766 Pluto crashes after stop when I use floating ip address + +* Wed Oct 21 2015 Paul Wouters - 3.15-5 +- Resolves: rhbz#1271811 libreswan FIPS test mistakenly looks for non-existent file hashes + +* Wed Sep 30 2015 Paul Wouters - 3.15-4 +- Resolves: rhbz#1267370 libreswan should support strictcrlpolicy alias +- Resolves: rhbz#1229766 Pluto crashes after stop when I use floating ip address +- Resolves: rhbz#1166146 Pluto crashes on INITIATOR site during 'service ipsec stop' +- Resolves: rhbz#1259209 CVE-2015-3240 +- Resolves: rhbz#1199374 libreswan does not enforce all FIPS or IPsec Suite B restrictions +- Resolves: rhbz#1207689 libreswan ignores module blacklist rules +- Merge rhel6 and rhel7 spec into one +- Be lenient for racoon padding behaviour +- Fix seedev option to /dev/random +- Some IKEv1 PAM methods always gave 'Permission denied' +- Parser workarounds for differences in gcc/flex/bison on rhel6/rhel7 +- Parser fix to allow specifying time without unit (openswan compat) +- Fix Labeled IPsec on rekeyed IPsec SA's +- Workaround for wrong padding by racoon2 +- Disable NSS HW GCM to workaround rhel6 xen builers bug + +* Fri May 29 2015 Paul Wouters - 3.12-12 +- Resolves: rhbz#1212121 Support CAVS [updated bogus fips mode fix] + +* Fri May 29 2015 Paul Wouters - 3.12-11 +- Resolves: rhbz#1226408 CVE-2015-3204 libreswan: crafted IKE packet causes daemon restart + +* Tue May 05 2015 Paul Wouters - 3.12-10 +- Resolves: rhbz#1212121 Support CAVS testing of the PRF/PRF+ functions +- Resolves: rhbz#1127313 Libreswan with IPv6 [updated patch by Jaroslav Aster] +- Resolves: rhbz#1207689 libreswan ignores module blacklist [updated modprobe handling] +- Resolves: rhbz#1218358 pluto crashes in fips mode without dracut-fips package + +* Sat Feb 21 2015 Paul Wouters - 3.12-6 +- Resolves: rhbz#1056559 loopback support deprecated +- Resolves: rhbz#1182224 Add new option for BSI random requirement +- Resolves: rhbz#1170018 [increase] SELinux context string size limit +- Resolves: rhbz#1127313 Libreswan with IPv6 in RHEL7 fails after reboot +- Resolves: rhbz#1207689 libreswan ignores module blacklist rules +- Resolves: rhbz#1203794 pluto crashes in fips mode + +* Tue Jan 20 2015 Paul Wouters - 3.12-5 +- Resolves: rhbz#826264 aes-gcm implementation support (for IKEv2) +- Resolves: rhbz#1074018 Audit key agreement (integ gcm fixup) + +* Tue Dec 30 2014 Paul Wouters - 3.12-4 +- Resolves: rhbz#1134297 aes-ctr cipher is not supported +- Resolves: rhbz#1131503 non-zero rSPI on INVALID_KE (and proper INVALID_KE handling) + +* Thu Dec 04 2014 Paul Wouters - 3.12-2 +- Resolves: rhbz#1105171 (Update man page entry) +- Resolves: rhbz#1144120 (Update for ESP CAMELLIA with IKEv2) +- Resolves: rhbz#1074018 Audit key agreement + +* Fri Nov 07 2014 Paul Wouters - 3.12-1 +- Resolves: rhbz#1136124 rebase to libreswan 3.12 +- Resolves: rhbz#1052811 [TAHI] (also clear reserved flags for isakmp_sa header) +- Resolves: rhbz#1157379 [TAHI][IKEv2] IKEv2.EN.R.1.3.3.1: Non RESERVED fields in INFORMATIONAL request + +* Mon Oct 27 2014 Paul Wouters - 3.11-2 +- Resolves: rhbz#1136124 rebase to libreswan 3.11 (coverity fixup, dpdaction=clear fix) + +* Wed Oct 22 2014 Paul Wouters - 3.11-1 +- Resolves: rhbz#1136124 rebase to libreswan 3.11 +- Resolves: rhbz#1099905 ikev2 delete payloads are not delivered to peer +- Resolves: rhbz#1147693 NetworkManger-libreswan can not connect to Red Hat IPSec Xauth VPN +- Resolves: rhbz#1055865 [TAHI][IKEv2] libreswan do not ignore the content of version bit +- Resolves: rhbz#1146106 Pluto crashes after start when some ah algorithms are used +- Resolves: rhbz#1108256 addconn compatibility with openswan +- Resolves: rhbz#1152625 [TAHI][IKEv2] IKEv2.EN.I.1.1.6.2 Part D: Integrity Algorithm AUTH_AES_XCBC_96 fail +- Resolves: rhbz#1119704 [TAHI][IKEv2]IKEv2Interop.1.13a test fail +- Resolves: rhbz#1100261 libreswan does not send response when when it receives Delete Payload for a CHILD_SA +- Resolves: rhbz#1100239 ikev2 IKE SA responder does not send delete request to IKE SA initiator +- Resolves: rhbz#1052811 [TAHI][IKEv2]IKEv2.EN.I.1.1.11.1: Non zero RESERVED fields in IKE_SA_INIT response +- Resolves: rhbz#1126868 ikev2 sequence numbers are implemented incorrectly +- Resolves: rhbz#1145245 Libreswan appears to start with systemd before all the NICs are up and running. +- Resolves: rhbz#1145231 libreswan 3.10 upgrade breaks old ipsec.secrets configs +- Resolves: rhbz#1144123 Add ESP support for AES_XCBC hash for USGv6 and IPsec-v3 compliance +- Resolves: rhbz#1144120 Add ESP support for CAMELLIA for USGv6 and IPsec-v3 compliance +- Resolves: rhbz#1099877 Missing man-pages ipsec_whack, ipsec_manual +- Resolves: rhbz#1100255 libreswan Ikev2 implementation does not send an INFORMATIONAL response when it receives an INFORMATIONAL request with a Delete Payload for an IKE_SA + +* Tue Sep 09 2014 Paul Wouters - 3.10-3 +- Resolves: rhbz#1136124 rebase to 3.10 (auto=route bug on startup) + +* Mon Sep 08 2014 Paul Wouters - 3.10-2 +- Resolves: rhbz#1136124 rebase to libreswan 3.10 + +* Mon Jul 14 2014 Paul Wouters - 3.8-6 +- Resolves: rhbz#1092047 pluto cannot write to directories not owned by root + +* Thu Apr 10 2014 Paul Wouters - 3.8-5 +- Resolves: rhbz#1052834 create_child_sa message ID handling + + +* Tue Mar 18 2014 Paul Wouters - 3.8-4 +- Resolves: rhbz#1052834 create_child_sa response + +* Wed Mar 05 2014 Paul Wouters - 3.8-3 +- Resolves: rhbz#1069024 erroneous debug line with mixture [...] +- Resolves: rhbz#1030939 update nss/x509 documents, don't load acerts +- Resolves: rhbz#1058813 newhostkey returns zero value when it fails + +* Fri Jan 24 2014 Daniel Mach - 3.8-2 +- Mass rebuild 2014-01-24 + +* Thu Jan 16 2014 Paul Wouters - 3.8-1 +- Resolves: rhbz#CVE-2013-6467 +- Resolves: rhbz#1043642 rebase to version 3.8 +- Resolves: rhbz#1029912 ipsec force-reload doesn't work +- Resolves: rhbz#826261 Implement SHA384/512 support for Openswan +- Resolves: rhbz#1039655 ipsec newhostkey generates false configuration + +* Fri Dec 27 2013 Daniel Mach - 3.6-3 +- Mass rebuild 2013-12-27 + +* Fri Nov 08 2013 Paul Wouters - 3.6-2 +- Fix race condition in post for creating nss db + +* Thu Oct 31 2013 Paul Wouters - 3.6-1 +- Updated to version 3.6 (IKEv2, MODECFG, Cisco interop fixes) +- Generate empty NSS db if none exists +- FIPS update using /etc/system-fips +- Provide: openswan-doc + +* Fri Aug 09 2013 Paul Wouters - 3.5-2 +- rebuilt and bumped EVR to avoid confusion of import->delete->import +- require iproute + +* Mon Jul 15 2013 Paul Wouters - 3.5-1 +- Initial package for RHEL7 +- Added interop patch for (some?) Cisco VPN clients sending 16 zero + bytes of extraneous IKE data +- Removed fipscheck_version