diff --git a/.gitignore b/.gitignore index 82e40e4..222eb50 100644 --- a/.gitignore +++ b/.gitignore @@ -1,4 +1,4 @@ SOURCES/ikev1_dsa.fax.bz2 SOURCES/ikev1_psk.fax.bz2 SOURCES/ikev2.fax.bz2 -SOURCES/libreswan-4.5.tar.gz +SOURCES/libreswan-4.9.tar.gz diff --git a/.libreswan.metadata b/.libreswan.metadata index 81aaecb..e5c173b 100644 --- a/.libreswan.metadata +++ b/.libreswan.metadata @@ -1,4 +1,4 @@ b35cd50b8bc0a08b9c07713bf19c72d53bfe66bb SOURCES/ikev1_dsa.fax.bz2 861d97bf488f9e296cad8c43ab72f111a5b1a848 SOURCES/ikev1_psk.fax.bz2 fcaf77f3deae3d8e99cdb3b1f8abea63167a0633 SOURCES/ikev2.fax.bz2 -c0f636fbba5da51e9bb85ade1221d7c52ac31e07 SOURCES/libreswan-4.5.tar.gz +12b7351ca7e6ba1ac787239e67027a4d82f02f10 SOURCES/libreswan-4.9.tar.gz diff --git a/SOURCES/libreswan-3.32-1861360-nodefault-rsa-pss.patch b/SOURCES/libreswan-3.32-1861360-nodefault-rsa-pss.patch index e9d50e0..631bfee 100644 --- a/SOURCES/libreswan-3.32-1861360-nodefault-rsa-pss.patch +++ b/SOURCES/libreswan-3.32-1861360-nodefault-rsa-pss.patch @@ -1,10 +1,20 @@ -diff -Naur libreswan-3.32-orig/lib/libipsecconf/confread.c libreswan-3.32/lib/libipsecconf/confread.c ---- libreswan-3.32-orig/lib/libipsecconf/confread.c 2020-07-28 20:25:54.618261606 -0400 -+++ libreswan-3.32/lib/libipsecconf/confread.c 2020-07-28 20:28:03.952421236 -0400 -@@ -1498,9 +1498,14 @@ - } else if (streq(val, "rsasig") || streq(val, "rsa")) { - conn->policy |= POLICY_RSASIG; - conn->policy |= POLICY_RSASIG_v1_5; +From 1dddaa3226fe1b71b68ec9665d93864a5ec69801 Mon Sep 17 00:00:00 2001 +From: rpm-build +Date: Mon, 9 Jan 2023 23:26:10 +0900 +Subject: [PATCH] libreswan-3.32-1861360-nodefault-rsa-pss.patch + +--- + lib/libipsecconf/confread.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/lib/libipsecconf/confread.c b/lib/libipsecconf/confread.c +index 0444118..ec87646 100644 +--- a/lib/libipsecconf/confread.c ++++ b/lib/libipsecconf/confread.c +@@ -1501,9 +1501,14 @@ static bool load_conn(struct starter_conn *conn, + hunk_streq(val, "rsa")) { + conn->authby.rsasig = true; + conn->authby.rsasig_v1_5 = true; + /* + * These cause failure with RSA 1024 bits because it uses RSA-PSS + */ @@ -13,6 +23,9 @@ diff -Naur libreswan-3.32-orig/lib/libipsecconf/confread.c libreswan-3.32/lib/li conn->sighash_policy |= POL_SIGHASH_SHA2_384; conn->sighash_policy |= POL_SIGHASH_SHA2_512; +#endif - } else if (streq(val, "never")) { - conn->policy |= POLICY_AUTH_NEVER; + } else if (hunk_streq(val, "never")) { + conn->authby.never = true; /* everything else is only supported for IKEv2 */ +-- +2.39.0 + diff --git a/SOURCES/libreswan-4.1-maintain-obsolete-keywords.patch b/SOURCES/libreswan-4.1-maintain-obsolete-keywords.patch index 539dcd1..497dd3e 100644 --- a/SOURCES/libreswan-4.1-maintain-obsolete-keywords.patch +++ b/SOURCES/libreswan-4.1-maintain-obsolete-keywords.patch @@ -1,16 +1,26 @@ -diff -Naur libreswan-4.2-orig/lib/libipsecconf/keywords.c libreswan-4.2/lib/libipsecconf/keywords.c ---- libreswan-4.2-orig/lib/libipsecconf/keywords.c 2021-02-02 20:36:01.000000000 -0500 -+++ libreswan-4.2/lib/libipsecconf/keywords.c 2021-02-04 19:22:05.880228930 -0500 -@@ -374,6 +374,8 @@ - { "interfaces", kv_config, kt_string, KSF_INTERFACES, NULL, NULL, }, +From a2cc5f8c80e8cb9be0b65f8e8544689e8b093c09 Mon Sep 17 00:00:00 2001 +From: rpm-build +Date: Tue, 10 Jan 2023 00:18:48 +0900 +Subject: [PATCH] libreswan-4.1-maintain-obsolete-keywords.patch + +--- + lib/libipsecconf/keywords.c | 28 ++++++++++++++++++++++++++++ + 1 file changed, 28 insertions(+) + +diff --git a/lib/libipsecconf/keywords.c b/lib/libipsecconf/keywords.c +index fa8f0e0..03fb863 100644 +--- a/lib/libipsecconf/keywords.c ++++ b/lib/libipsecconf/keywords.c +@@ -343,6 +343,8 @@ const struct keyword_def ipsec_conf_keywords[] = { + { "ikev1-policy", kv_config, kt_enum, KBF_GLOBAL_IKEv1, kw_global_ikev1_list, NULL, }, { "curl-iface", kv_config, kt_string, KSF_CURLIFACE, NULL, NULL, }, - { "curl-timeout", kv_config, kt_time, KBF_CURLTIMEOUT, NULL, NULL, }, + { "curl-timeout", kv_config, kt_time, KBF_CURLTIMEOUT_MS, NULL, NULL, }, + { "curl_iface", kv_config | kv_alias, kt_string, KSF_CURLIFACE, NULL, NULL, }, /* obsolete _ */ -+ { "curl_timeout", kv_config | kv_alias, kt_time, KBF_CURLTIMEOUT, NULL, NULL, }, /* obsolete _ */ ++ { "curl_timeout", kv_config | kv_alias, kt_time, KBF_CURLTIMEOUT_MS, NULL, NULL, }, /* obsolete _ */ { "myvendorid", kv_config, kt_string, KSF_MYVENDORID, NULL, NULL, }, { "syslog", kv_config, kt_string, KSF_SYSLOG, NULL, NULL, }, -@@ -381,6 +383,7 @@ +@@ -350,6 +352,7 @@ const struct keyword_def ipsec_conf_keywords[] = { { "logfile", kv_config, kt_filename, KSF_LOGFILE, NULL, NULL, }, { "plutostderrlog", kv_config, kt_filename, KSF_LOGFILE, NULL, NULL, }, /* obsolete name, but very common :/ */ { "logtime", kv_config, kt_bool, KBF_LOGTIME, NULL, NULL, }, @@ -18,12 +28,12 @@ diff -Naur libreswan-4.2-orig/lib/libipsecconf/keywords.c libreswan-4.2/lib/libi { "logappend", kv_config, kt_bool, KBF_LOGAPPEND, NULL, NULL, }, { "logip", kv_config, kt_bool, KBF_LOGIP, NULL, NULL, }, { "audit-log", kv_config, kt_bool, KBF_AUDIT_LOG, NULL, NULL, }, -@@ -400,13 +403,20 @@ +@@ -369,13 +372,20 @@ const struct keyword_def ipsec_conf_keywords[] = { { "global-redirect-to", kv_config, kt_string, KSF_GLOBAL_REDIRECT_TO, NULL, NULL, }, { "crl-strict", kv_config, kt_bool, KBF_CRL_STRICT, NULL, NULL, }, + { "crl_strict", kv_config | kv_alias, kt_bool, KBF_CRL_STRICT, NULL, NULL, }, /* obsolete _ */ - { "crlcheckinterval", kv_config, kt_time, KBF_CRL_CHECKINTERVAL, NULL, NULL, }, + { "crlcheckinterval", kv_config, kt_time, KBF_CRL_CHECKINTERVAL_MS, NULL, NULL, }, + { "strictcrlpolicy", kv_config | kv_alias, kt_bool, KBF_CRL_STRICT, NULL, NULL, }, /* obsolete; used on openswan */ { "ocsp-strict", kv_config, kt_bool, KBF_OCSP_STRICT, NULL, NULL, }, @@ -37,9 +47,9 @@ diff -Naur libreswan-4.2-orig/lib/libipsecconf/keywords.c libreswan-4.2/lib/libi { "ocsp-trustname", kv_config, kt_string, KSF_OCSP_TRUSTNAME, NULL, NULL, }, + { "ocsp_trust_name", kv_config | kv_alias, kt_string, KSF_OCSP_TRUSTNAME, NULL, NULL, }, /* obsolete _ */ { "ocsp-cache-size", kv_config, kt_number, KBF_OCSP_CACHE_SIZE, NULL, NULL, }, - { "ocsp-cache-min-age", kv_config, kt_time, KBF_OCSP_CACHE_MIN, NULL, NULL, }, - { "ocsp-cache-max-age", kv_config, kt_time, KBF_OCSP_CACHE_MAX, NULL, NULL, }, -@@ -426,6 +436,7 @@ + { "ocsp-cache-min-age", kv_config, kt_time, KBF_OCSP_CACHE_MIN_AGE_MS, NULL, NULL, }, + { "ocsp-cache-max-age", kv_config, kt_time, KBF_OCSP_CACHE_MAX_AGE_MS, NULL, NULL, }, +@@ -399,6 +409,7 @@ const struct keyword_def ipsec_conf_keywords[] = { { "virtual_private", kv_config, kt_string, KSF_VIRTUALPRIVATE, NULL, NULL, }, /* obsolete variant, very common */ { "seedbits", kv_config, kt_number, KBF_SEEDBITS, NULL, NULL, }, { "keep-alive", kv_config, kt_number, KBF_KEEPALIVE, NULL, NULL, }, @@ -47,33 +57,33 @@ diff -Naur libreswan-4.2-orig/lib/libipsecconf/keywords.c libreswan-4.2/lib/libi { "listen-tcp", kv_config, kt_bool, KBF_LISTEN_TCP, NULL, NULL }, { "listen-udp", kv_config, kt_bool, KBF_LISTEN_UDP, NULL, NULL }, -@@ -437,6 +448,8 @@ +@@ -410,6 +421,8 @@ const struct keyword_def ipsec_conf_keywords[] = { #ifdef HAVE_LABELED_IPSEC { "ikev1-secctx-attr-type", kv_config, kt_number, KBF_SECCTX, NULL, NULL, }, /* obsolete: not a value, a type */ { "secctx-attr-type", kv_config | kv_alias, kt_number, KBF_SECCTX, NULL, NULL, }, + { "secctx_attr_value", kv_config | kv_alias, kt_number, KBF_SECCTX, NULL, NULL, }, /* obsolete _ */ + { "secctx-attr-value", kv_config, kt_number, KBF_SECCTX, NULL, NULL, }, /* obsolete: not a value, a type */ #endif + { "interfaces", kv_config, kt_obsolete, KNCF_WARNIGNORE, NULL, NULL, }, /* obsoleted but often present keyword */ - /* these options are obsoleted (and not old aliases) */ -@@ -467,6 +480,7 @@ +@@ -446,6 +459,7 @@ const struct keyword_def ipsec_conf_keywords[] = { { "username", kv_conn | kv_leftright, kt_string, KSCF_USERNAME, NULL, NULL, }, /* xauthusername is still used in NetworkManager-libreswan :/ */ { "xauthusername", kv_conn | kv_leftright, kt_string, KSCF_USERNAME, NULL, NULL, }, /* old alias */ + { "xauthname", kv_conn | kv_leftright, kt_string, KSCF_USERNAME, NULL, NULL, }, /* old alias */ { "addresspool", kv_conn | kv_leftright, kt_range, KSCF_ADDRESSPOOL, NULL, NULL, }, - { "auth", kv_conn | kv_leftright, kt_enum, KNCF_AUTH, &kw_authby_lr_list, NULL, }, - { "cat", kv_conn | kv_leftright, kt_bool, KNCF_CAT, NULL, NULL, }, -@@ -489,6 +503,8 @@ - { "esn", kv_conn | kv_processed, kt_enum, KNCF_ESN, &kw_esn_list, NULL, }, + { "auth", kv_conn | kv_leftright, kt_enum, KNCF_AUTH, kw_auth_list, NULL, }, + #ifdef HAVE_IPTABLES +@@ -471,6 +485,8 @@ const struct keyword_def ipsec_conf_keywords[] = { + { "esn", kv_conn | kv_processed, kt_enum, KNCF_ESN, kw_esn_list, NULL, }, { "decap-dscp", kv_conn | kv_processed, kt_bool, KNCF_DECAP_DSCP, NULL, NULL, }, { "nopmtudisc", kv_conn | kv_processed, kt_bool, KNCF_NOPMTUDISC, NULL, NULL, }, -+ { "ike_frag", kv_conn | kv_processed | kv_alias, kt_enum, KNCF_IKE_FRAG, &kw_ynf_list, NULL, }, /* obsolete _ */ -+ { "ike-frag", kv_conn | kv_processed | kv_alias, kt_enum, KNCF_IKE_FRAG, &kw_ynf_list, NULL, }, /* obsolete name */ - { "fragmentation", kv_conn | kv_processed, kt_enum, KNCF_IKE_FRAG, &kw_ynf_list, NULL, }, ++ { "ike_frag", kv_conn | kv_processed | kv_alias, kt_enum, KNCF_IKE_FRAG, kw_ynf_list, NULL, }, /* obsolete _ */ ++ { "ike-frag", kv_conn | kv_processed | kv_alias, kt_enum, KNCF_IKE_FRAG, kw_ynf_list, NULL, }, /* obsolete name */ + { "fragmentation", kv_conn | kv_processed, kt_enum, KNCF_IKE_FRAG, kw_ynf_list, NULL, }, { "mobike", kv_conn, kt_bool, KNCF_MOBIKE, NULL, NULL, }, { "narrowing", kv_conn, kt_bool, KNCF_IKEv2_ALLOW_NARROWING, NULL, NULL, }, -@@ -499,13 +515,18 @@ +@@ -481,13 +497,18 @@ const struct keyword_def ipsec_conf_keywords[] = { { "accept-redirect-to", kv_conn, kt_string, KSCF_ACCEPT_REDIRECT_TO, NULL, NULL, }, { "pfs", kv_conn, kt_bool, KNCF_PFS, NULL, NULL, }, @@ -92,9 +102,9 @@ diff -Naur libreswan-4.2-orig/lib/libipsecconf/keywords.c libreswan-4.2/lib/libi { "sha2-truncbug", kv_conn, kt_bool, KNCF_SHA2_TRUNCBUG, NULL, NULL, }, { "ms-dh-downgrade", kv_conn, kt_bool, KNCF_MSDH_DOWNGRADE, NULL, NULL, }, { "require-id-on-certificate", kv_conn, kt_bool, KNCF_SAN_ON_CERT, NULL, NULL, }, -@@ -520,7 +541,10 @@ +@@ -505,7 +526,10 @@ const struct keyword_def ipsec_conf_keywords[] = { {"ikepad", kv_conn, kt_bool, KNCF_IKEPAD, NULL, NULL, }, - { "nat-ikev1-method", kv_conn | kv_processed, kt_enum, KNCF_IKEV1_NATT, &kw_ikev1natt_list, NULL, }, + { "nat-ikev1-method", kv_conn | kv_processed, kt_enum, KNCF_IKEV1_NATT, kw_ikev1natt_list, NULL, }, + { "labeled_ipsec", kv_conn, kt_obsolete, KNCF_WARNIGNORE, NULL, NULL, }, /* obsolete */ + { "labeled-ipsec", kv_conn, kt_obsolete, KNCF_WARNIGNORE, NULL, NULL, }, /* obsolete */ @@ -103,15 +113,15 @@ diff -Naur libreswan-4.2-orig/lib/libipsecconf/keywords.c libreswan-4.2/lib/libi { "sec-label", kv_conn, kt_string, KSCF_SA_SEC_LABEL, NULL, NULL, }, /* really stored into struct end */ /* Cisco interop: remote peer type */ -@@ -531,13 +555,17 @@ +@@ -516,13 +540,17 @@ const struct keyword_def ipsec_conf_keywords[] = { /* Network Manager support */ #ifdef HAVE_NM { "nm-configured", kv_conn, kt_bool, KNCF_NMCONFIGURED, NULL, NULL, }, + { "nm_configured", kv_conn, kt_bool, KNCF_NMCONFIGURED, NULL, NULL, }, /* obsolete _ */ #endif - { "xauthby", kv_conn, kt_enum, KNCF_XAUTHBY, &kw_xauthby, NULL, }, - { "xauthfail", kv_conn, kt_enum, KNCF_XAUTHFAIL, &kw_xauthfail, NULL, }, + { "xauthby", kv_conn, kt_enum, KNCF_XAUTHBY, kw_xauthby_list, NULL, }, + { "xauthfail", kv_conn, kt_enum, KNCF_XAUTHFAIL, kw_xauthfail_list, NULL, }, { "modecfgpull", kv_conn, kt_invertbool, KNCF_MODECONFIGPULL, NULL, NULL, }, { "modecfgdns", kv_conn, kt_string, KSCF_MODECFGDNS, NULL, NULL, }, + { "modecfgdns1", kv_conn | kv_alias, kt_string, KSCF_MODECFGDNS, NULL, NULL, }, /* obsolete */ @@ -121,3 +131,6 @@ diff -Naur libreswan-4.2-orig/lib/libipsecconf/keywords.c libreswan-4.2/lib/libi { "modecfgbanner", kv_conn, kt_string, KSCF_MODECFGBANNER, NULL, NULL, }, { "ignore-peer-dns", kv_conn, kt_bool, KNCF_IGNORE_PEER_DNS, NULL, NULL, }, { "mark", kv_conn, kt_string, KSCF_CONN_MARK_BOTH, NULL, NULL, }, +-- +2.39.0 + diff --git a/SOURCES/libreswan-4.3-maintain-different-v1v2-split.patch b/SOURCES/libreswan-4.3-maintain-different-v1v2-split.patch index 33bf0fb..68c94eb 100644 --- a/SOURCES/libreswan-4.3-maintain-different-v1v2-split.patch +++ b/SOURCES/libreswan-4.3-maintain-different-v1v2-split.patch @@ -1,17 +1,27 @@ -diff -Naur libreswan-4.3-orig/configs/d.ipsec.conf/ikev2.xml libreswan-4.3/configs/d.ipsec.conf/ikev2.xml ---- libreswan-4.3-orig/configs/d.ipsec.conf/ikev2.xml 2021-02-21 12:03:03.000000000 -0500 -+++ libreswan-4.3/configs/d.ipsec.conf/ikev2.xml 2021-02-21 12:33:36.226284499 -0500 -@@ -1,15 +1,15 @@ - +From 83487373fdd77437e51cfccd41532e270e279e05 Mon Sep 17 00:00:00 2001 +From: rpm-build +Date: Tue, 10 Jan 2023 00:11:26 +0900 +Subject: [PATCH] libreswan-4.3-maintain-different-v1v2-split.patch + +--- + configs/d.ipsec.conf/ikev2.xml | 14 +++++++------- + lib/libipsecconf/confread.c | 8 +++++++- + programs/whack/whack.c | 4 ++-- + 3 files changed, 16 insertions(+), 10 deletions(-) + +diff --git a/configs/d.ipsec.conf/ikev2.xml b/configs/d.ipsec.conf/ikev2.xml +index 3d03825..285db1b 100644 +--- a/configs/d.ipsec.conf/ikev2.xml ++++ b/configs/d.ipsec.conf/ikev2.xml +@@ -2,14 +2,14 @@ ikev2 --Whether to use IKEv1 (RFC 4301) or IKEv2 (RFC 7296) settings to be used. --Currently the accepted values are no(the default), --signifying only IKEv1 is accepted, or yes, -+Wether to use IKEv1 (RFC 4301) or IKEv2 (RFC 7296) as the Internet Key Exchange (IKE) protcol. -+Currently the accepted values are no (or never) -+signifying only IKEv1 is accepted, or insist(the default), - signifying only IKEv2 is accepted. Previous versions allowed the keywords + Whether to use IKEv2 (RFC 7296) or IKEv1 (RFC 4301). +-Currently the accepted values are yes (the default), +-signifying only IKEv2 is accepted, or no, ++Currently the accepted values are insist (the default), ++signifying only IKEv2 is accepted, or no (or never), + signifying only IKEv1 is accepted. Previous versions allowed the keywords -propose or permit -that would allow either IKEv1 or IKEv2, but this is no longer supported. The -permit option is interpreted as no and the propose option is interpreted as @@ -25,10 +35,11 @@ diff -Naur libreswan-4.3-orig/configs/d.ipsec.conf/ikev2.xml libreswan-4.3/confi -diff -Naur libreswan-4.3-orig/lib/libipsecconf/confread.c libreswan-4.3/lib/libipsecconf/confread.c ---- libreswan-4.3-orig/lib/libipsecconf/confread.c 2021-02-21 12:03:03.000000000 -0500 -+++ libreswan-4.3/lib/libipsecconf/confread.c 2021-02-21 12:37:43.138031929 -0500 -@@ -1310,11 +1310,17 @@ +diff --git a/lib/libipsecconf/confread.c b/lib/libipsecconf/confread.c +index b95c90a..e752441 100644 +--- a/lib/libipsecconf/confread.c ++++ b/lib/libipsecconf/confread.c +@@ -1340,11 +1340,17 @@ static bool load_conn(struct starter_conn *conn, switch (conn->options[KNCF_IKEv2]) { case fo_never: @@ -38,19 +49,20 @@ diff -Naur libreswan-4.3-orig/lib/libipsecconf/confread.c libreswan-4.3/lib/libi + case fo_permit: + starter_error_append(perrl, "ikev2=permit is no longer accepted. Use ikev2=insist or ikev2=no|never"); -+ return TRUE; ++ return true; + case fo_propose: + starter_error_append(perrl, "ikev2=propose or ikev2=yes is no longer accepted. Use ikev2=insist or ikev2=no|never"); -+ return TRUE; ++ return true; + case fo_insist: conn->ike_version = IKEv2; break; -diff -Naur libreswan-4.3-orig/programs/whack/whack.c libreswan-4.3/programs/whack/whack.c ---- libreswan-4.3-orig/programs/whack/whack.c 2021-02-21 12:03:03.000000000 -0500 -+++ libreswan-4.3/programs/whack/whack.c 2021-02-21 12:39:27.066188354 -0500 -@@ -801,7 +801,7 @@ +diff --git a/programs/whack/whack.c b/programs/whack/whack.c +index b512b04..3de020e 100644 +--- a/programs/whack/whack.c ++++ b/programs/whack/whack.c +@@ -815,7 +815,7 @@ static const struct option long_opts[] = { { "ikev1-allow", no_argument, NULL, CD_IKEv1 + OO }, /* obsolete name */ { "ikev2", no_argument, NULL, CD_IKEv2 +OO }, { "ikev2-allow", no_argument, NULL, CD_IKEv2 +OO }, /* obsolete name */ @@ -59,7 +71,7 @@ diff -Naur libreswan-4.3-orig/programs/whack/whack.c libreswan-4.3/programs/whac PS("allow-narrowing", IKEV2_ALLOW_NARROWING), #ifdef AUTH_HAVE_PAM -@@ -1762,7 +1762,7 @@ +@@ -1802,7 +1802,7 @@ int main(int argc, char **argv) end_seen = LEMPTY; continue; @@ -68,3 +80,6 @@ diff -Naur libreswan-4.3-orig/programs/whack/whack.c libreswan-4.3/programs/whac case CD_IKEv1: case CD_IKEv2: { +-- +2.39.0 + diff --git a/SOURCES/libreswan-4.4-ikev1-disable-diagnostics.patch b/SOURCES/libreswan-4.4-ikev1-disable-diagnostics.patch deleted file mode 100644 index 0f5bc47..0000000 --- a/SOURCES/libreswan-4.4-ikev1-disable-diagnostics.patch +++ /dev/null @@ -1,20 +0,0 @@ -Index: libreswan-4.4/programs/pluto/ikev1.c -=================================================================== ---- libreswan-4.4.orig/programs/pluto/ikev1.c -+++ libreswan-4.4/programs/pluto/ikev1.c -@@ -2102,7 +2102,6 @@ void process_packet_tail(struct msg_dige - diag_t d = pbs_in_struct(&md->message_pbs, &isakmp_ignore_desc, - &pd->payload, sizeof(pd->payload), &pd->pbs); - if (d != NULL) { -- llog_diag(RC_LOG, st->st_logger, &d, "%s", ""); - LOG_PACKET(RC_LOG_SERIOUS, - "%smalformed payload in packet", - excuse); -@@ -2171,7 +2170,6 @@ void process_packet_tail(struct msg_dige - &pd->payload, sizeof(pd->payload), - &pd->pbs); - if (d != NULL) { -- llog_diag(RC_LOG, st->st_logger, &d, "%s", ""); - LOG_PACKET(RC_LOG_SERIOUS, - "%smalformed payload in packet", - excuse); diff --git a/SPECS/libreswan.spec b/SPECS/libreswan.spec index dac2503..5fb72dd 100644 --- a/SPECS/libreswan.spec +++ b/SPECS/libreswan.spec @@ -36,7 +36,7 @@ Name: libreswan Summary: IPsec implementation with IKEv1 and IKEv2 keying protocols # version is generated in the release script -Version: 4.5 +Version: 4.9 Release: %{?prever:0.}1%{?prever:.%{prever}}%{?dist} License: GPLv2 Url: https://libreswan.org/ @@ -52,7 +52,6 @@ Patch1: libreswan-4.3-maintain-different-v1v2-split.patch Patch2: libreswan-3.32-1861360-nodefault-rsa-pss.patch Patch3: libreswan-4.1-maintain-obsolete-keywords.patch Patch6: libreswan-4.3-1934186-config.patch -Patch7: libreswan-4.4-ikev1-disable-diagnostics.patch BuildRequires: audit-libs-devel BuildRequires: bison @@ -111,7 +110,6 @@ Libreswan is based on Openswan-2.6.38 which in turn is based on FreeS/WAN-2.04 %patch2 -p1 %patch3 -p1 %patch6 -p1 -%patch7 -p1 # linking to freebl is not needed sed -i "s/-lfreebl //" mk/config.mk @@ -215,6 +213,10 @@ certutil -N -d sql:$tmpdir --empty-password %attr(0644,root,root) %doc %{_mandir}/*/* %changelog +* Mon Jan 9 2023 Daiki Ueno - 4.9-1 +- Resolves: rhbz#2128672 Rebase libreswan to 4.9 +- Remove libreswan-4.4-ikev1-disable-diagnostics.patch no longer necessary + * Thu Jan 13 2022 Daiki Ueno - 4.5-1 - Resolves: rhbz#2017352 Rebase libreswan to 4.5 - Resolves: rhbz#2036903 ikev1: disable diagnostics logging on receiving malformed packets