| 1 |
%global USE_FIPSCHECK true |
| 2 |
%global USE_LIBCAP_NG true |
| 3 |
%global USE_LABELED_IPSEC true |
| 4 |
%global USE_CRL_FETCHING true |
| 5 |
%global USE_DNSSEC true |
| 6 |
%global USE_NM true |
| 7 |
%global USE_LINUX_AUDIT true |
| 8 |
|
| 9 |
%global _hardened_build 1 |
| 10 |
%global buildefence 0 |
| 11 |
%global development 0 |
| 12 |
%global cavstests 1 |
| 13 |
|
| 14 |
%if 0%{?fedora} |
| 15 |
%global rhel 7 |
| 16 |
%endif |
| 17 |
|
| 18 |
#global prever rc1 |
| 19 |
|
| 20 |
Name: libreswan |
| 21 |
Summary: IPsec implementation with IKEv1 and IKEv2 keying protocols |
| 22 |
Version: 3.16 |
| 23 |
Release: %{?prever:0.}1%{?prever:.%{prever}}%{?dist} |
| 24 |
License: GPLv2 |
| 25 |
Group: System Environment/Daemons |
| 26 |
Url: https://libreswan.org/ |
| 27 |
Source: https://download.libreswan.org/%{?prever:development/}%{name}-%{version}%{?prever}.tar.gz |
| 28 |
Source1: ikev1_dsa.fax.bz2 |
| 29 |
Source2: ikev1_psk.fax.bz2 |
| 30 |
Source3: ikev2.fax.bz2 |
| 31 |
|
| 32 |
Requires: iproute >= 2.6.8 nss-tools nss-softokn |
| 33 |
|
| 34 |
BuildRequires: gmp-devel bison flex redhat-rpm-config pkgconfig |
| 35 |
BuildRequires: nss-devel >= 3.16.1 nspr-devel |
| 36 |
BuildRequires: pam-devel |
| 37 |
BuildRequires: xmlto |
| 38 |
|
| 39 |
%if %{?rhel} <= 6 |
| 40 |
BuildRequires: libevent2-devel net-tools |
| 41 |
|
| 42 |
Requires(post): coreutils bash |
| 43 |
Requires(preun): initscripts chkconfig |
| 44 |
Requires(post): /sbin/chkconfig |
| 45 |
Requires(preun): /sbin/chkconfig |
| 46 |
Requires(preun): /sbin/service |
| 47 |
%else |
| 48 |
BuildRequires: libevent-devel hostname |
| 49 |
|
| 50 |
BuildRequires: systemd |
| 51 |
Requires(post): coreutils bash systemd |
| 52 |
Requires(preun): systemd |
| 53 |
Requires(postun): systemd |
| 54 |
%endif |
| 55 |
|
| 56 |
%if %{USE_DNSSEC} |
| 57 |
BuildRequires: unbound-devel |
| 58 |
%endif |
| 59 |
|
| 60 |
%if %{USE_FIPSCHECK} |
| 61 |
BuildRequires: fipscheck-devel |
| 62 |
# we need fipshmac |
| 63 |
Requires: fipscheck%{_isa} |
| 64 |
%endif |
| 65 |
|
| 66 |
%if %{USE_LINUX_AUDIT} |
| 67 |
Buildrequires: audit-libs-devel |
| 68 |
%endif |
| 69 |
|
| 70 |
%if %{USE_LIBCAP_NG} |
| 71 |
BuildRequires: libcap-ng-devel |
| 72 |
%endif |
| 73 |
|
| 74 |
%if %{USE_CRL_FETCHING} |
| 75 |
BuildRequires: openldap-devel curl-devel |
| 76 |
%endif |
| 77 |
|
| 78 |
%if %{buildefence} |
| 79 |
BuildRequires: ElectricFence |
| 80 |
%endif |
| 81 |
|
| 82 |
Conflicts: openswan < %{version}-%{release} |
| 83 |
Provides: openswan = %{version}-%{release} |
| 84 |
Provides: openswan-doc = %{version}-%{release} |
| 85 |
Obsoletes: openswan < %{version}-%{release} |
| 86 |
|
| 87 |
%description |
| 88 |
Libreswan is a free implementation of IPsec & IKE for Linux. IPsec is |
| 89 |
the Internet Protocol Security and uses strong cryptography to provide |
| 90 |
both authentication and encryption services. These services allow you |
| 91 |
to build secure tunnels through untrusted networks. Everything passing |
| 92 |
through the untrusted net is encrypted by the ipsec gateway machine and |
| 93 |
decrypted by the gateway at the other end of the tunnel. The resulting |
| 94 |
tunnel is a virtual private network or VPN. |
| 95 |
|
| 96 |
This package contains the daemons and userland tools for setting up |
| 97 |
Libreswan. It supports the NETKEY/XFRM IPsec kernel stack that exists |
| 98 |
in the default Linux kernel. |
| 99 |
|
| 100 |
Libreswan also supports IKEv2 (RFC-7296) and Secure Labeling |
| 101 |
|
| 102 |
Libreswan is based on Openswan-2.6.38 which in turn is based on FreeS/WAN-2.04 |
| 103 |
|
| 104 |
%prep |
| 105 |
%setup -q -n libreswan-%{version}%{?prever} |
| 106 |
|
| 107 |
%build |
| 108 |
%if %{buildefence} |
| 109 |
%define efence "-lefence" |
| 110 |
%endif |
| 111 |
|
| 112 |
make %{?_smp_mflags} \ |
| 113 |
%if %{development} |
| 114 |
USERCOMPILE="-g -DGCC_LINT %(echo %{optflags} | sed -e s/-O[0-9]*/ /) %{?efence} -fPIE -pie " \ |
| 115 |
%else |
| 116 |
USERCOMPILE="-g -DGCC_LINT %{optflags} %{?efence} -fPIE -pie " \ |
| 117 |
%endif |
| 118 |
USERLINK="-g -pie -Wl,-z,relro,-z,now %{?efence}" \ |
| 119 |
%if %{?rhel} <= 6 |
| 120 |
INITSYSTEM=sysvinit \ |
| 121 |
%else |
| 122 |
INITSYSTEM=systemd \ |
| 123 |
%endif |
| 124 |
USE_NM=%{USE_NM} \ |
| 125 |
USE_XAUTHPAM=true \ |
| 126 |
%if %{USE_FIPSCHECK} |
| 127 |
USE_FIPSCHECK="%{USE_FIPSCHECK}" \ |
| 128 |
FIPSPRODUCTCHECK=/etc/system-fips \ |
| 129 |
%endif |
| 130 |
USE_LIBCAP_NG="%{USE_LIBCAP_NG}" \ |
| 131 |
USE_LABELED_IPSEC="%{USE_LABELED_IPSEC}" \ |
| 132 |
USE_LINUX_AUDIT="%{USE_LINUX_AUDIT}" \ |
| 133 |
%if %{USE_CRL_FETCHING} |
| 134 |
USE_LDAP=true \ |
| 135 |
USE_LIBCURL=true \ |
| 136 |
%endif |
| 137 |
USE_DNSSEC="%{USE_DNSSEC}" \ |
| 138 |
INC_USRLOCAL=%{_prefix} \ |
| 139 |
FINALLIBDIR=%{_libexecdir}/ipsec \ |
| 140 |
FINALLIBEXECDIR=%{_libexecdir}/ipsec \ |
| 141 |
MANTREE=%{_mandir} \ |
| 142 |
INC_RCDEFAULT=%{_initrddir} \ |
| 143 |
MODPROBE="modprobe -q -b" \ |
| 144 |
programs |
| 145 |
FS=$(pwd) |
| 146 |
|
| 147 |
%if %{USE_FIPSCHECK} |
| 148 |
# Add generation of HMAC checksums of the final stripped binaries |
| 149 |
%if %{?rhel} <= 6 |
| 150 |
%define __spec_install_post \ |
| 151 |
%{?__debug_package:%{__debug_install_post}} \ |
| 152 |
%{__arch_install_post} \ |
| 153 |
%{__os_install_post} \ |
| 154 |
fipshmac %{buildroot}%{_libexecdir}/ipsec/* \ |
| 155 |
fipshmac %{buildroot}%{_sbindir}/ipsec \ |
| 156 |
%{nil} |
| 157 |
|
| 158 |
%else |
| 159 |
%define __spec_install_post \ |
| 160 |
%{?__debug_package:%{__debug_install_post}} \ |
| 161 |
%{__arch_install_post} \ |
| 162 |
%{__os_install_post} \ |
| 163 |
mkdir -p %{buildroot}%{_libdir}/fipscheck/ \ |
| 164 |
fipshmac -d %{buildroot}%{_libdir}/fipscheck %{buildroot}%{_libexecdir}/ipsec/* \ |
| 165 |
fipshmac -d %{buildroot}%{_libdir}/fipscheck %{buildroot}%{_sbindir}/ipsec \ |
| 166 |
%{nil} |
| 167 |
%endif |
| 168 |
%endif |
| 169 |
|
| 170 |
%install |
| 171 |
rm -rf ${RPM_BUILD_ROOT} |
| 172 |
make \ |
| 173 |
DESTDIR=%{buildroot} \ |
| 174 |
INC_USRLOCAL=%{_prefix} \ |
| 175 |
FINALLIBDIR=%{_libexecdir}/ipsec \ |
| 176 |
FINALLIBEXECDIR=%{_libexecdir}/ipsec \ |
| 177 |
MANTREE=%{buildroot}%{_mandir} \ |
| 178 |
INC_RCDEFAULT=%{_initrddir} \ |
| 179 |
INSTMANFLAGS="-m 644" \ |
| 180 |
%if %{?rhel} <= 6 |
| 181 |
INITSYSTEM=sysvinit \ |
| 182 |
%else |
| 183 |
INITSYSTEM=systemd \ |
| 184 |
%endif |
| 185 |
install |
| 186 |
FS=$(pwd) |
| 187 |
rm -rf %{buildroot}/usr/share/doc/libreswan |
| 188 |
# needed to activate v6neighbor-hole.conf |
| 189 |
sed -i "s:^#include /etc/ipsec.d/\*.conf$:include /etc/ipsec.d/*.conf:" %{buildroot}%{_sysconfdir}/ipsec.conf |
| 190 |
|
| 191 |
install -d -m 0755 %{buildroot}%{_localstatedir}/run/pluto |
| 192 |
# used when setting --perpeerlog without --perpeerlogbase |
| 193 |
install -d -m 0700 %{buildroot}%{_localstatedir}/log/pluto/peer |
| 194 |
install -d %{buildroot}%{_sbindir} |
| 195 |
%if %{?rhel} <= 6 |
| 196 |
# replace with rhel6 specific version |
| 197 |
install -m 0755 initsystems/sysvinit/init.rhel %{buildroot}%{_initrddir}/ipsec |
| 198 |
rm -fr %{buildroot}/etc/rc.d/rc* |
| 199 |
%endif |
| 200 |
|
| 201 |
%if %{USE_FIPSCHECK} |
| 202 |
%if %{?rhel} == 7 |
| 203 |
mkdir -p %{buildroot}%{_libdir}/fipscheck |
| 204 |
%endif |
| 205 |
install -d %{buildroot}%{_sysconfdir}/prelink.conf.d/ |
| 206 |
install -m644 packaging/fedora/libreswan-prelink.conf %{buildroot}%{_sysconfdir}/prelink.conf.d/libreswan-fips.conf |
| 207 |
%endif |
| 208 |
|
| 209 |
echo "include /etc/ipsec.d/*.secrets" > %{buildroot}%{_sysconfdir}/ipsec.secrets |
| 210 |
|
| 211 |
# cavs testing |
| 212 |
cp -a OBJ.linux.*/programs/pluto/cavp %{buildroot}%{_libexecdir}/ipsec |
| 213 |
|
| 214 |
%if %{cavstests} |
| 215 |
%check |
| 216 |
# There is an elaborate upstream testing infrastructure which we do not run here |
| 217 |
# We only run the CAVS tests here |
| 218 |
cp %{SOURCE1} %{SOURCE2} %{SOURCE3} . |
| 219 |
bunzip2 *.fax.bz2 |
| 220 |
|
| 221 |
# work around for rhel6 builders on xen |
| 222 |
export NSS_DISABLE_HW_GCM=1 |
| 223 |
|
| 224 |
: "starting CAVS test for IKEv2" |
| 225 |
OBJ.linux.*/programs/pluto/cavp -v2 ikev2.fax | diff -u ikev2.fax - > /dev/null |
| 226 |
: "starting CAVS test for IKEv1 RSASIG" |
| 227 |
OBJ.linux.*/programs/pluto/cavp -v1sig ikev1_dsa.fax | diff -u ikev1_dsa.fax - > /dev/null |
| 228 |
: "starting CAVS test for IKEv1 PSK" |
| 229 |
OBJ.linux.*/programs/pluto/cavp -v1psk ikev1_psk.fax | diff -u ikev1_psk.fax - > /dev/null |
| 230 |
: "CAVS tests passed" |
| 231 |
%endif |
| 232 |
|
| 233 |
%if %{?rhel} <= 6 |
| 234 |
%post |
| 235 |
/sbin/chkconfig --add ipsec || : |
| 236 |
%if %{USE_FIPSCHECK} |
| 237 |
prelink -u %{_libexecdir}/ipsec/* 2>/dev/null || : |
| 238 |
%endif |
| 239 |
|
| 240 |
%preun |
| 241 |
if [ $1 -eq 0 ]; then |
| 242 |
/sbin/service ipsec stop > /dev/null 2>&1 || : |
| 243 |
/sbin/chkconfig --del ipsec |
| 244 |
fi |
| 245 |
|
| 246 |
%postun |
| 247 |
if [ $1 -ge 1 ] ; then |
| 248 |
/sbin/service ipsec condrestart 2>&1 >/dev/null || : |
| 249 |
fi |
| 250 |
%else |
| 251 |
%preun |
| 252 |
%systemd_preun ipsec.service |
| 253 |
|
| 254 |
%postun |
| 255 |
%systemd_postun_with_restart ipsec.service |
| 256 |
|
| 257 |
%post |
| 258 |
%systemd_post ipsec.service |
| 259 |
%endif |
| 260 |
|
| 261 |
%files |
| 262 |
%doc CHANGES COPYING CREDITS README* LICENSE |
| 263 |
%doc docs/*.* docs/examples packaging/rhel/libreswan-sysctl.conf |
| 264 |
|
| 265 |
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipsec.conf |
| 266 |
%attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ipsec.secrets |
| 267 |
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/sysconfig/pluto |
| 268 |
%attr(0700,root,root) %dir %{_sysconfdir}/ipsec.d |
| 269 |
%attr(0644,root,root) %{_sysconfdir}/ipsec.d/v6neighbor-hole.conf |
| 270 |
%attr(0700,root,root) %dir %{_sysconfdir}/ipsec.d/policies |
| 271 |
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipsec.d/policies/* |
| 272 |
%attr(0700,root,root) %dir %{_localstatedir}/log/pluto/peer |
| 273 |
%attr(0755,root,root) %dir %{_localstatedir}/run/pluto |
| 274 |
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/pam.d/pluto |
| 275 |
%{_sbindir}/ipsec |
| 276 |
%attr(0755,root,root) %dir %{_libexecdir}/ipsec |
| 277 |
%{_libexecdir}/ipsec/* |
| 278 |
%attr(0644,root,root) %{_mandir}/*/*.gz |
| 279 |
%if %{?rhel} <= 6 |
| 280 |
%{_initrddir}/ipsec |
| 281 |
%else |
| 282 |
%attr(0644,root,root) %{_unitdir}/ipsec.service |
| 283 |
%endif |
| 284 |
|
| 285 |
%if %{USE_FIPSCHECK} |
| 286 |
%if %{?rhel} <= 6 |
| 287 |
%{_sbindir}/.ipsec.hmac |
| 288 |
%{_libexecdir}/ipsec/.*.hmac |
| 289 |
%else |
| 290 |
%{_libdir}/fipscheck/*.hmac |
| 291 |
%endif |
| 292 |
|
| 293 |
# We own the directory so we don't have to require prelink |
| 294 |
%attr(0755,root,root) %dir %{_sysconfdir}/prelink.conf.d/ |
| 295 |
%{_sysconfdir}/prelink.conf.d/libreswan-fips.conf |
| 296 |
%endif |
| 297 |
|
| 298 |
%changelog |
| 299 |
* Sat Dec 19 2015 Paul Wouters <pwouters@redhat.com> - 3.16-1 |
| 300 |
- Updated to libreswan-3.16 |
| 301 |
|
| 302 |
* Thu Oct 15 2015 Paul Wouters <pwouters@redhat.com> - 3.15-5 |
| 303 |
- Resolves: rhbz#1272317 libreswan FIPS test mistakenly looks for non-existent file hashes |
| 304 |
- Resolves: rhbz#1271778 ipsec whack man page discrepancies |
| 305 |
|
| 306 |
* Tue Sep 29 2015 Paul Wouters <pwouters@redhat.com> - 3.15-4 |
| 307 |
- Updates: rhbz#1233303 add libreswan to RHEL6 (fix source confusion) |
| 308 |
|
| 309 |
* Mon Sep 28 2015 Paul Wouters <pwouters@redhat.com> - 3.15-3 |
| 310 |
- Updates: rhbz#1233303 add libreswan to RHEL6 |
| 311 |
|
| 312 |
* Tue Sep 15 2015 Paul Wouters <pwouters@redhat.com> - 3.15-2 |
| 313 |
- Resolves: rhbz#1259208 CVE-2015-3240 |
| 314 |
- Merge rhel6 and rhel7 spec into one |
| 315 |
- Be lenient for racoon padding behaviour |
| 316 |
- Fix seedev option to /dev/random |
| 317 |
- Some IKEv1 PAM methods always gave 'Permission denied' |
| 318 |
- Parser workarounds for differences in gcc/flex/bison on rhel6/rhel7 |
| 319 |
- Parser fix to allow specifying time without unit (openswan compat) |
| 320 |
- Fix Labeled IPsec on rekeyed IPsec SA's |
| 321 |
- Workaround for wrong padding by racoon2 |
| 322 |
- Disable NSS HW GCM to workaround rhel6 xen builers bug |
| 323 |
|
| 324 |
* Wed Aug 19 2015 Paul Wouters <pwouters@redhat.com> - 3.14-1 |
| 325 |
- Resolves: rhbz#1233303 add libreswan to RHEL6 |
| 326 |
- Resolves: CVE-2015-3240 denial of service via IKE daemon restart when receiving a bad DH gx |
| 327 |
|
| 328 |
* Fri May 29 2015 Paul Wouters <pwouters@redhat.com> - 3.12-10.1 |
| 329 |
- Resolves: rhbz#1226407 CVE-2015-3204 libreswan: crafted IKE packet causes daemon restart |
| 330 |
|
| 331 |
* Tue May 05 2015 Paul Wouters <pwouters@redhat.com> - 3.12-10 |
| 332 |
- Resolves: rhbz#1213652 Support CAVS [updated another prf() free symkey, bogus fips mode fix] |
| 333 |
|
| 334 |
* Tue Apr 28 2015 Paul Wouters <pwouters@redhat.com> - 3.12-9 |
| 335 |
- Resolves: rhbz#1213652 Support CAVS [updated to kill another copy of prf()] |
| 336 |
- Resolves: rhbz#1208023 Libreswan with IPv6 [updated patch by Jaroslav Aster] |
| 337 |
- Resolves: rhbz#1208022 libreswan ignores module blacklist [updated modprobe handling] |
| 338 |
|
| 339 |
* Mon Apr 20 2015 Paul Wouters <pwouters@redhat.com> - 3.12-8 |
| 340 |
- Resolves: rhbz#1213652 Support CAVS testing of the PRF/PRF+ functions |
| 341 |
|
| 342 |
* Mon Apr 13 2015 Paul Wouters <pwouters@redhat.com> - 3.12-7 |
| 343 |
- Resolves: rhbz#1208022 libreswan ignores module blacklist rules |
| 344 |
- Resolves: rhbz#1208023 Libreswan with IPv6 in RHEL7 fails after reboot |
| 345 |
- Resolves: rhbz#1211146 pluto crashes in fips mode |
| 346 |
|
| 347 |
* Tue Mar 17 2015 Paul Wouters <pwouters@redhat.com> - 3.12-6 |
| 348 |
- Resolves: rhbz#1198650 SELinux context string size limit |
| 349 |
- Resolves: rhbz#1198649 Add new option for BSI random requirement |
| 350 |
|
| 351 |
* Tue Jan 20 2015 Paul Wouters <pwouters@redhat.com> - 3.12-5 |
| 352 |
- Resolves: rhbz#826264 aes-gcm implementation support (for IKEv2) |
| 353 |
- Resolves: rhbz#1074018 Audit key agreement (integ gcm fixup) |
| 354 |
|
| 355 |
* Tue Dec 30 2014 Paul Wouters <pwouters@redhat.com> - 3.12-4 |
| 356 |
- Resolves: rhbz#1134297 aes-ctr cipher is not supported |
| 357 |
- Resolves: rhbz#1131503 non-zero rSPI on INVALID_KE (and proper INVALID_KE handling) |
| 358 |
|
| 359 |
* Thu Dec 04 2014 Paul Wouters <pwouters@redhat.com> - 3.12-2 |
| 360 |
- Resolves: rhbz#1105171 (Update man page entry) |
| 361 |
- Resolves: rhbz#1144120 (Update for ESP CAMELLIA with IKEv2) |
| 362 |
- Resolves: rhbz#1074018 Audit key agreement |
| 363 |
|
| 364 |
* Fri Nov 07 2014 Paul Wouters <pwouters@redhat.com> - 3.12-1 |
| 365 |
- Resolves: rhbz#1136124 rebase to libreswan 3.12 |
| 366 |
- Resolves: rhbz#1052811 [TAHI] (also clear reserved flags for isakmp_sa header) |
| 367 |
- Resolves: rhbz#1157379 [TAHI][IKEv2] IKEv2.EN.R.1.3.3.1: Non RESERVED fields in INFORMATIONAL request |
| 368 |
|
| 369 |
* Mon Oct 27 2014 Paul Wouters <pwouters@redhat.com> - 3.11-2 |
| 370 |
- Resolves: rhbz#1136124 rebase to libreswan 3.11 (coverity fixup, dpdaction=clear fix) |
| 371 |
|
| 372 |
* Wed Oct 22 2014 Paul Wouters <pwouters@redhat.com> - 3.11-1 |
| 373 |
- Resolves: rhbz#1136124 rebase to libreswan 3.11 |
| 374 |
- Resolves: rhbz#1099905 ikev2 delete payloads are not delivered to peer |
| 375 |
- Resolves: rhbz#1147693 NetworkManger-libreswan can not connect to Red Hat IPSec Xauth VPN |
| 376 |
- Resolves: rhbz#1055865 [TAHI][IKEv2] libreswan do not ignore the content of version bit |
| 377 |
- Resolves: rhbz#1146106 Pluto crashes after start when some ah algorithms are used |
| 378 |
- Resolves: rhbz#1108256 addconn compatibility with openswan |
| 379 |
- Resolves: rhbz#1152625 [TAHI][IKEv2] IKEv2.EN.I.1.1.6.2 Part D: Integrity Algorithm AUTH_AES_XCBC_96 fail |
| 380 |
- Resolves: rhbz#1119704 [TAHI][IKEv2]IKEv2Interop.1.13a test fail |
| 381 |
- Resolves: rhbz#1100261 libreswan does not send response when when it receives Delete Payload for a CHILD_SA |
| 382 |
- Resolves: rhbz#1100239 ikev2 IKE SA responder does not send delete request to IKE SA initiator |
| 383 |
- Resolves: rhbz#1052811 [TAHI][IKEv2]IKEv2.EN.I.1.1.11.1: Non zero RESERVED fields in IKE_SA_INIT response |
| 384 |
- Resolves: rhbz#1126868 ikev2 sequence numbers are implemented incorrectly |
| 385 |
- Resolves: rhbz#1145245 Libreswan appears to start with systemd before all the NICs are up and running. |
| 386 |
- Resolves: rhbz#1145231 libreswan 3.10 upgrade breaks old ipsec.secrets configs |
| 387 |
- Resolves: rhbz#1144123 Add ESP support for AES_XCBC hash for USGv6 and IPsec-v3 compliance |
| 388 |
- Resolves: rhbz#1144120 Add ESP support for CAMELLIA for USGv6 and IPsec-v3 compliance |
| 389 |
- Resolves: rhbz#1099877 Missing man-pages ipsec_whack, ipsec_manual |
| 390 |
- Resolves: rhbz#1100255 libreswan Ikev2 implementation does not send an INFORMATIONAL response when it receives an INFORMATIONAL request with a Delete Payload for an IKE_SA |
| 391 |
|
| 392 |
* Tue Sep 09 2014 Paul Wouters <pwouters@redhat.com> - 3.10-3 |
| 393 |
- Resolves: rhbz#1136124 rebase to 3.10 (auto=route bug on startup) |
| 394 |
|
| 395 |
* Mon Sep 08 2014 Paul Wouters <pwouters@redhat.com> - 3.10-2 |
| 396 |
- Resolves: rhbz#1136124 rebase to libreswan 3.10 |
| 397 |
|
| 398 |
* Mon Jul 14 2014 Paul Wouters <pwouters@redhat.com> - 3.8-6 |
| 399 |
- Resolves: rhbz#1092047 pluto cannot write to directories not owned by root |
| 400 |
|
| 401 |
* Thu Apr 10 2014 Paul Wouters <pwouters@redhat.com> - 3.8-5 |
| 402 |
- Resolves: rhbz#1052834 create_child_sa message ID handling |
| 403 |
|
| 404 |
|
| 405 |
* Tue Mar 18 2014 Paul Wouters <pwouters@redhat.com> - 3.8-4 |
| 406 |
- Resolves: rhbz#1052834 create_child_sa response |
| 407 |
|
| 408 |
* Wed Mar 05 2014 Paul Wouters <pwouters@redhat.com> - 3.8-3 |
| 409 |
- Resolves: rhbz#1069024 erroneous debug line with mixture [...] |
| 410 |
- Resolves: rhbz#1030939 update nss/x509 documents, don't load acerts |
| 411 |
- Resolves: rhbz#1058813 newhostkey returns zero value when it fails |
| 412 |
|
| 413 |
* Fri Jan 24 2014 Daniel Mach <dmach@redhat.com> - 3.8-2 |
| 414 |
- Mass rebuild 2014-01-24 |
| 415 |
|
| 416 |
* Thu Jan 16 2014 Paul Wouters <pwouters@redhat.com> - 3.8-1 |
| 417 |
- Resolves: rhbz#CVE-2013-6467 |
| 418 |
- Resolves: rhbz#1043642 rebase to version 3.8 |
| 419 |
- Resolves: rhbz#1029912 ipsec force-reload doesn't work |
| 420 |
- Resolves: rhbz#826261 Implement SHA384/512 support for Openswan |
| 421 |
- Resolves: rhbz#1039655 ipsec newhostkey generates false configuration |
| 422 |
|
| 423 |
* Fri Dec 27 2013 Daniel Mach <dmach@redhat.com> - 3.6-3 |
| 424 |
- Mass rebuild 2013-12-27 |
| 425 |
|
| 426 |
* Fri Nov 08 2013 Paul Wouters <pwouters@redhat.com> - 3.6-2 |
| 427 |
- Fix race condition in post for creating nss db |
| 428 |
|
| 429 |
* Thu Oct 31 2013 Paul Wouters <pwouters@redhat.com> - 3.6-1 |
| 430 |
- Updated to version 3.6 (IKEv2, MODECFG, Cisco interop fixes) |
| 431 |
- Generate empty NSS db if none exists |
| 432 |
- FIPS update using /etc/system-fips |
| 433 |
- Provide: openswan-doc |
| 434 |
|
| 435 |
* Fri Aug 09 2013 Paul Wouters <pwouters@redhat.com> - 3.5-2 |
| 436 |
- rebuilt and bumped EVR to avoid confusion of import->delete->import |
| 437 |
- require iproute |
| 438 |
|
| 439 |
* Mon Jul 15 2013 Paul Wouters <pwouters@redhat.com> - 3.5-1 |
| 440 |
- Initial package for RHEL7 |
| 441 |
- Added interop patch for (some?) Cisco VPN clients sending 16 zero |
| 442 |
bytes of extraneous IKE data |
| 443 |
- Removed fipscheck_version |
Parent Directory
| 
Revision Log
| 
Revision Graph
