Compare commits
3 Commits
5.9.2-test
...
strongswan
| Author | SHA1 | Date | |
|---|---|---|---|
| 8335f95de0 | |||
| 4829f5fbf5 | |||
| 2d52f2ea3b |
6
.gitignore
vendored
6
.gitignore
vendored
@@ -1,3 +1,3 @@
|
||||
/strongswan-5.8.4.tar.bz2
|
||||
/strongswan-5.9.0.tar.bz2
|
||||
/strongswan-5.9.1.tar.bz2
|
||||
/strongswan-5.7.2.tar.bz2
|
||||
/strongswan-5.8.1.tar.bz2
|
||||
/strongswan-5.8.2.tar.bz2
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
From 2ac05d5d77446a518d808a41ed628fbe66966335 Mon Sep 17 00:00:00 2001
|
||||
From 27de580084d02f6ef92c048ea60a3861fba03e4b Mon Sep 17 00:00:00 2001
|
||||
From: Tobias Brunner <tobias@strongswan.org>
|
||||
Date: Fri, 17 Jul 2015 11:53:58 +0200
|
||||
Subject: [PATCH 1/7] ike: Adhere to IKE_SA limit when checking out by config
|
||||
@@ -6,11 +6,11 @@ Subject: [PATCH 1/7] ike: Adhere to IKE_SA limit when checking out by config
|
||||
This prevents new SAs from getting created if we hit the global IKE_SA
|
||||
limit (we still allow checkout_new(), which is used for rekeying).
|
||||
---
|
||||
src/libcharon/sa/ike_sa_manager.c | 73 ++++++++++++++++---------------
|
||||
1 file changed, 38 insertions(+), 35 deletions(-)
|
||||
src/libcharon/sa/ike_sa_manager.c | 71 ++++++++++++++++---------------
|
||||
1 file changed, 37 insertions(+), 34 deletions(-)
|
||||
|
||||
diff --git a/src/libcharon/sa/ike_sa_manager.c b/src/libcharon/sa/ike_sa_manager.c
|
||||
index f95ff19af..1e0ae42fe 100644
|
||||
index 1de410d6c..440894e9b 100644
|
||||
--- a/src/libcharon/sa/ike_sa_manager.c
|
||||
+++ b/src/libcharon/sa/ike_sa_manager.c
|
||||
@@ -1434,48 +1434,51 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
|
||||
@@ -37,10 +37,25 @@ index f95ff19af..1e0ae42fe 100644
|
||||
- if (entry->ike_sa->get_state(entry->ike_sa) == IKE_DELETING ||
|
||||
- entry->ike_sa->get_state(entry->ike_sa) == IKE_REKEYED)
|
||||
- { /* skip IKE_SAs which are not usable, wake other waiting threads */
|
||||
- entry->condvar->signal(entry->condvar);
|
||||
- continue;
|
||||
- }
|
||||
-
|
||||
- current_peer = entry->ike_sa->get_peer_cfg(entry->ike_sa);
|
||||
- if (current_peer && current_peer->equals(current_peer, peer_cfg))
|
||||
- {
|
||||
- current_ike = current_peer->get_ike_cfg(current_peer);
|
||||
- if (current_ike->equals(current_ike, peer_cfg->get_ike_cfg(peer_cfg)))
|
||||
+ if (!wait_for_entry(this, entry, segment))
|
||||
+ {
|
||||
{
|
||||
- entry->checked_out = thread_current();
|
||||
- ike_sa = entry->ike_sa;
|
||||
- DBG2(DBG_MGR, "found existing IKE_SA %u with a '%s' config",
|
||||
- ike_sa->get_unique_id(ike_sa),
|
||||
- current_peer->get_name(current_peer));
|
||||
- break;
|
||||
+ continue;
|
||||
+ }
|
||||
}
|
||||
+ if (entry->ike_sa->get_state(entry->ike_sa) == IKE_DELETING ||
|
||||
+ entry->ike_sa->get_state(entry->ike_sa) == IKE_REKEYED)
|
||||
+ { /* skip IKE_SAs which are not usable, wake other waiting threads */
|
||||
@@ -63,24 +78,8 @@ index f95ff19af..1e0ae42fe 100644
|
||||
+ }
|
||||
+ }
|
||||
+ /* other threads might be waiting for this entry */
|
||||
entry->condvar->signal(entry->condvar);
|
||||
- continue;
|
||||
+ entry->condvar->signal(entry->condvar);
|
||||
}
|
||||
-
|
||||
- current_peer = entry->ike_sa->get_peer_cfg(entry->ike_sa);
|
||||
- if (current_peer && current_peer->equals(current_peer, peer_cfg))
|
||||
- {
|
||||
- current_ike = current_peer->get_ike_cfg(current_peer);
|
||||
- if (current_ike->equals(current_ike, peer_cfg->get_ike_cfg(peer_cfg)))
|
||||
- {
|
||||
- entry->checked_out = thread_current();
|
||||
- ike_sa = entry->ike_sa;
|
||||
- DBG2(DBG_MGR, "found existing IKE_SA %u with a '%s' config",
|
||||
- ike_sa->get_unique_id(ike_sa),
|
||||
- current_peer->get_name(current_peer));
|
||||
- break;
|
||||
- }
|
||||
- }
|
||||
- /* other threads might be waiting for this entry */
|
||||
- entry->condvar->signal(entry->condvar);
|
||||
+ enumerator->destroy(enumerator);
|
||||
@@ -101,5 +100,5 @@ index f95ff19af..1e0ae42fe 100644
|
||||
}
|
||||
charon->bus->set_sa(charon->bus, ike_sa);
|
||||
--
|
||||
2.25.4
|
||||
2.24.1
|
||||
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
From caa6f2744717e3c3bd9b0e0fa4feff449a780ccf Mon Sep 17 00:00:00 2001
|
||||
From 59aad0f83614fb7ade337e853947b4f43b3e9ef3 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
|
||||
Date: Mon, 21 Sep 2015 13:41:58 +0300
|
||||
Subject: [PATCH 2/7] charon: add optional source and remote overrides for
|
||||
@@ -26,9 +26,9 @@ Signed-off-by: Timo Teräs <timo.teras@iki.fi>
|
||||
.../processing/jobs/start_action_job.c | 2 +-
|
||||
src/libcharon/sa/ike_sa_manager.c | 51 +++++++++++++++-
|
||||
src/libcharon/sa/ike_sa_manager.h | 8 ++-
|
||||
src/libcharon/sa/trap_manager.c | 49 +++++++--------
|
||||
src/libcharon/sa/trap_manager.c | 45 ++++++--------
|
||||
src/swanctl/commands/initiate.c | 40 ++++++++++++-
|
||||
12 files changed, 219 insertions(+), 47 deletions(-)
|
||||
12 files changed, 217 insertions(+), 45 deletions(-)
|
||||
|
||||
diff --git a/src/charon-cmd/cmd/cmd_connection.c b/src/charon-cmd/cmd/cmd_connection.c
|
||||
index b91c89830..55f8d224f 100644
|
||||
@@ -44,10 +44,10 @@ index b91c89830..55f8d224f 100644
|
||||
terminate(pid);
|
||||
}
|
||||
diff --git a/src/charon-nm/nm/nm_service.c b/src/charon-nm/nm/nm_service.c
|
||||
index dba12764d..8b27e61e4 100644
|
||||
index 1b07230fd..e4379e612 100644
|
||||
--- a/src/charon-nm/nm/nm_service.c
|
||||
+++ b/src/charon-nm/nm/nm_service.c
|
||||
@@ -849,7 +849,7 @@ static gboolean connect_(NMVpnServicePlugin *plugin, NMConnection *connection,
|
||||
@@ -735,7 +735,7 @@ static gboolean connect_(NMVpnServicePlugin *plugin, NMConnection *connection,
|
||||
* Prepare IKE_SA
|
||||
*/
|
||||
ike_sa = charon->ike_sa_manager->checkout_by_config(charon->ike_sa_manager,
|
||||
@@ -325,7 +325,7 @@ index 3a0ed879f..e3399007b 100644
|
||||
case ACTION_ROUTE:
|
||||
DBG1(DBG_JOB, "start action: route '%s'", name);
|
||||
diff --git a/src/libcharon/sa/ike_sa_manager.c b/src/libcharon/sa/ike_sa_manager.c
|
||||
index 1e0ae42fe..52a18e3c2 100644
|
||||
index 440894e9b..493599413 100644
|
||||
--- a/src/libcharon/sa/ike_sa_manager.c
|
||||
+++ b/src/libcharon/sa/ike_sa_manager.c
|
||||
@@ -17,6 +17,28 @@
|
||||
@@ -471,34 +471,32 @@ index 2bc531b38..7220ea597 100644
|
||||
-
|
||||
- ike_sa->set_peer_cfg(ike_sa, peer);
|
||||
- ike_cfg = ike_sa->get_ike_cfg(ike_sa);
|
||||
-
|
||||
+ {
|
||||
+ ike_cfg_t *ike_cfg;
|
||||
+ uint16_t port;
|
||||
+ uint8_t mask;
|
||||
|
||||
- port = ike_cfg->get_other_port(ike_cfg);
|
||||
- dst->to_subnet(dst, &host, &mask);
|
||||
- host->set_port(host, port);
|
||||
- ike_sa->set_other_host(ike_sa, host);
|
||||
-
|
||||
+ ike_cfg = peer->get_ike_cfg(peer);
|
||||
|
||||
- port = ike_cfg->get_my_port(ike_cfg);
|
||||
- src->to_subnet(src, &host, &mask);
|
||||
- host->set_port(host, port);
|
||||
- ike_sa->set_my_host(ike_sa, host);
|
||||
-
|
||||
+ port = ike_cfg->get_other_port(ike_cfg);
|
||||
+ dst->to_subnet(dst, &other_host, &mask);
|
||||
+ other_host->set_port(other_host, port);
|
||||
|
||||
- charon->bus->set_sa(charon->bus, ike_sa);
|
||||
- }
|
||||
- }
|
||||
- else
|
||||
{
|
||||
- {
|
||||
- ike_sa = charon->ike_sa_manager->checkout_by_config(
|
||||
- charon->ike_sa_manager, peer);
|
||||
+ ike_cfg_t *ike_cfg;
|
||||
+ uint16_t port;
|
||||
+ uint8_t mask;
|
||||
+
|
||||
+ ike_cfg = peer->get_ike_cfg(peer);
|
||||
+
|
||||
+ port = ike_cfg->get_other_port(ike_cfg);
|
||||
+ dst->to_subnet(dst, &other_host, &mask);
|
||||
+ other_host->set_port(other_host, port);
|
||||
+
|
||||
+ port = ike_cfg->get_my_port(ike_cfg);
|
||||
+ src->to_subnet(src, &my_host, &mask);
|
||||
+ my_host->set_port(my_host, port);
|
||||
@@ -592,5 +590,5 @@ index 8ade8bf41..03b2cb0f4 100644
|
||||
{"raw", 'r', 0, "dump raw response message"},
|
||||
{"pretty", 'P', 0, "dump raw response message in pretty print"},
|
||||
--
|
||||
2.25.4
|
||||
2.24.1
|
||||
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
From 82293ee990d4c640bd5e33e894d44b70ad50ef79 Mon Sep 17 00:00:00 2001
|
||||
From 871c5f7158b13d847156ced924a82c8ef25a9b28 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
|
||||
Date: Mon, 21 Sep 2015 13:42:05 +0300
|
||||
Subject: [PATCH 3/7] vici: send certificates for ike-sa events
|
||||
@@ -127,5 +127,5 @@ index ad07ff12d..e3f6a0d26 100644
|
||||
|
||||
b->begin_section(b, old->get_name(old));
|
||||
--
|
||||
2.25.4
|
||||
2.24.1
|
||||
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
From 7df0e439a339286991dda5cc14f0eb078885401b Mon Sep 17 00:00:00 2001
|
||||
From 50501301f9b4749916778082a176d9932ea8b32b Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
|
||||
Date: Mon, 21 Sep 2015 13:42:11 +0300
|
||||
Subject: [PATCH 4/7] vici: add support for individual sa state changes
|
||||
@@ -155,5 +155,5 @@ index e3f6a0d26..9968cdd3c 100644
|
||||
.destroy = _destroy,
|
||||
},
|
||||
--
|
||||
2.25.4
|
||||
2.24.1
|
||||
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
From 467ba7f78ef3d09c27ac410f147cca66a6591a1e Mon Sep 17 00:00:00 2001
|
||||
From c48f8ff36eca91f652ae3bdd88b93a7a2b879d54 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
|
||||
Date: Mon, 21 Sep 2015 13:42:15 +0300
|
||||
Subject: [PATCH 5/7] vici: add (deprecated) async parameter
|
||||
@@ -45,5 +45,5 @@ index 1e8e788c3..12ef92334 100644
|
||||
log_cb = (controller_cb_t)log_vici;
|
||||
}
|
||||
--
|
||||
2.25.4
|
||||
2.24.1
|
||||
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
From dffd2c31828ec4d9bf9a299952a1559675816241 Mon Sep 17 00:00:00 2001
|
||||
From 3385fb7d3fd2dff73f22d2e51c9e7454b723f2ef Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
|
||||
Date: Mon, 21 Sep 2015 13:42:18 +0300
|
||||
Subject: [PATCH 6/7] support gre key in ikev1
|
||||
@@ -179,7 +179,7 @@ index b2f1adbbc..6b44d0cf6 100644
|
||||
|
||||
return &this->public;
|
||||
diff --git a/src/libcharon/encoding/payloads/id_payload.h b/src/libcharon/encoding/payloads/id_payload.h
|
||||
index 044268180..1e2306b16 100644
|
||||
index 283780624..fafeca8bc 100644
|
||||
--- a/src/libcharon/encoding/payloads/id_payload.h
|
||||
+++ b/src/libcharon/encoding/payloads/id_payload.h
|
||||
@@ -48,11 +48,11 @@ struct id_payload_t {
|
||||
@@ -198,17 +198,17 @@ index 044268180..1e2306b16 100644
|
||||
* Get encoded payload without fixed payload header (used for IKEv1).
|
||||
@@ -91,6 +91,6 @@ id_payload_t *id_payload_create_from_identification(payload_type_t type,
|
||||
* @param ts traffic selector
|
||||
* @return PLV1_ID id_payload_t object.
|
||||
* @return PLV1_ID id_paylad_t object.
|
||||
*/
|
||||
-id_payload_t *id_payload_create_from_ts(traffic_selector_t *ts);
|
||||
+id_payload_t *id_payload_create_from_ts(traffic_selector_t *ts, bool initiator);
|
||||
|
||||
#endif /** ID_PAYLOAD_H_ @}*/
|
||||
diff --git a/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c b/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c
|
||||
index ef0d424bd..a0948f7c0 100644
|
||||
index 327854ff4..2b204c273 100644
|
||||
--- a/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c
|
||||
+++ b/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c
|
||||
@@ -814,7 +814,18 @@ static struct xfrm_selector ts2selector(traffic_selector_t *src,
|
||||
@@ -863,7 +863,18 @@ static struct xfrm_selector ts2selector(traffic_selector_t *src,
|
||||
ts2subnet(src, &sel.saddr, &sel.prefixlen_s);
|
||||
ts2ports(dst, &sel.dport, &sel.dport_mask);
|
||||
ts2ports(src, &sel.sport, &sel.sport_mask);
|
||||
@@ -228,7 +228,7 @@ index ef0d424bd..a0948f7c0 100644
|
||||
(sel.dport || sel.sport))
|
||||
{
|
||||
/* the kernel expects the ICMP type and code in the source and
|
||||
@@ -838,7 +849,7 @@ static traffic_selector_t* selector2ts(struct xfrm_selector *sel, bool src)
|
||||
@@ -887,7 +898,7 @@ static traffic_selector_t* selector2ts(struct xfrm_selector *sel, bool src)
|
||||
{
|
||||
u_char *addr;
|
||||
uint8_t prefixlen;
|
||||
@@ -237,7 +237,7 @@ index ef0d424bd..a0948f7c0 100644
|
||||
host_t *host = NULL;
|
||||
|
||||
if (src)
|
||||
@@ -847,7 +858,7 @@ static traffic_selector_t* selector2ts(struct xfrm_selector *sel, bool src)
|
||||
@@ -896,7 +907,7 @@ static traffic_selector_t* selector2ts(struct xfrm_selector *sel, bool src)
|
||||
prefixlen = sel->prefixlen_s;
|
||||
if (sel->sport_mask)
|
||||
{
|
||||
@@ -246,15 +246,14 @@ index ef0d424bd..a0948f7c0 100644
|
||||
}
|
||||
}
|
||||
else
|
||||
@@ -856,14 +867,27 @@ static traffic_selector_t* selector2ts(struct xfrm_selector *sel, bool src)
|
||||
@@ -905,14 +916,27 @@ static traffic_selector_t* selector2ts(struct xfrm_selector *sel, bool src)
|
||||
prefixlen = sel->prefixlen_d;
|
||||
if (sel->dport_mask)
|
||||
{
|
||||
- port = ntohs(sel->dport);
|
||||
+ from_port = to_port = ntohs(sel->dport);
|
||||
}
|
||||
}
|
||||
- if (sel->proto == IPPROTO_ICMP || sel->proto == IPPROTO_ICMPV6)
|
||||
+ }
|
||||
+ }
|
||||
+ if (sel->proto == IPPROTO_GRE)
|
||||
+ {
|
||||
+ if (sel->sport_mask)
|
||||
@@ -266,8 +265,9 @@ index ef0d424bd..a0948f7c0 100644
|
||||
+ {
|
||||
+ from_port = 0;
|
||||
+ to_port = 0xffff;
|
||||
+ }
|
||||
+ }
|
||||
}
|
||||
}
|
||||
- if (sel->proto == IPPROTO_ICMP || sel->proto == IPPROTO_ICMPV6)
|
||||
+ else if (sel->proto == IPPROTO_ICMP || sel->proto == IPPROTO_ICMPV6)
|
||||
{ /* convert ICMP[v6] message type and code as supplied by the kernel in
|
||||
* source and destination ports (both in network order) */
|
||||
@@ -278,7 +278,7 @@ index ef0d424bd..a0948f7c0 100644
|
||||
}
|
||||
/* The Linux 2.6 kernel does not set the selector's family field,
|
||||
* so as a kludge we additionally test the prefix length.
|
||||
@@ -880,7 +904,7 @@ static traffic_selector_t* selector2ts(struct xfrm_selector *sel, bool src)
|
||||
@@ -929,7 +953,7 @@ static traffic_selector_t* selector2ts(struct xfrm_selector *sel, bool src)
|
||||
if (host)
|
||||
{
|
||||
return traffic_selector_create_from_subnet(host, prefixlen,
|
||||
@@ -288,7 +288,7 @@ index ef0d424bd..a0948f7c0 100644
|
||||
return NULL;
|
||||
}
|
||||
diff --git a/src/libcharon/plugins/stroke/stroke_config.c b/src/libcharon/plugins/stroke/stroke_config.c
|
||||
index 175b6b549..db3e558f6 100644
|
||||
index fe5c1a542..775fa0565 100644
|
||||
--- a/src/libcharon/plugins/stroke/stroke_config.c
|
||||
+++ b/src/libcharon/plugins/stroke/stroke_config.c
|
||||
@@ -936,6 +936,11 @@ static bool parse_protoport(char *token, uint16_t *from_port,
|
||||
@@ -337,7 +337,7 @@ index 81f2970ae..92ab77a00 100644
|
||||
from = to = ntohs(svc->s_port);
|
||||
}
|
||||
diff --git a/src/libcharon/sa/ikev1/tasks/quick_mode.c b/src/libcharon/sa/ikev1/tasks/quick_mode.c
|
||||
index 50c280fe5..049da8847 100644
|
||||
index 9ded2dd53..8a5351001 100644
|
||||
--- a/src/libcharon/sa/ikev1/tasks/quick_mode.c
|
||||
+++ b/src/libcharon/sa/ikev1/tasks/quick_mode.c
|
||||
@@ -552,9 +552,9 @@ static void add_ts(private_quick_mode_t *this, message_t *message)
|
||||
@@ -503,5 +503,5 @@ index 03f7a6d8c..b27ca4ad1 100644
|
||||
* Create a new traffic selector using human readable params.
|
||||
*
|
||||
--
|
||||
2.25.4
|
||||
2.24.1
|
||||
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
From a0dedc6cae5828d048bcbb16392d17b7a168a260 Mon Sep 17 00:00:00 2001
|
||||
From a73ae5cce094eaab9ac01482fbea320bfa4eed16 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Zoran=20Peri=C4=8Di=C4=87?= <zpericic@netst.org>
|
||||
Date: Wed, 22 Jan 2020 13:12:39 +0100
|
||||
Subject: [PATCH 7/7] vyos-terminate-connections-source-dest
|
||||
@@ -120,5 +120,5 @@ index 2309843b2..37d0bde3f 100644
|
||||
{"child-id", 'C', 1, "terminate by CHILD_SA reqid"},
|
||||
{"ike-id", 'I', 1, "terminate by IKE_SA unique identifier"},
|
||||
--
|
||||
2.25.4
|
||||
2.24.1
|
||||
|
||||
|
||||
2
sources
2
sources
@@ -1 +1 @@
|
||||
SHA512 (strongswan-5.9.1.tar.bz2) = 222625e77bd86959da6dd7346cfa9f92569fc396a494bb95ddf2c8e0680b7e8041541e8a14320517a0c735d713ae0fdc0d0c4694215e812817814b0b4efc3497
|
||||
SHA512 (strongswan-5.8.2.tar.bz2) = 423e7924acfe8a03ad7d4359ae9086fd516798fcf5eb948a27b52ea719f4d8954b83ea30ce94191ea1647616611df8a1215cb4d5c7ec48676624df6c41853e1d
|
||||
|
||||
@@ -1,24 +0,0 @@
|
||||
diff -ur strongswan-5.8.4.orig/init/systemd/strongswan.service.in strongswan-5.8.4/init/systemd/strongswan.service.in
|
||||
--- strongswan-5.8.4.orig/init/systemd/strongswan.service.in 2019-08-27 16:26:53.000000000 +0300
|
||||
+++ strongswan-5.8.4/init/systemd/strongswan.service.in 2020-04-12 12:05:57.383596844 +0300
|
||||
@@ -9,6 +9,8 @@
|
||||
ExecReload=@SBINDIR@/swanctl --reload
|
||||
ExecReload=@SBINDIR@/swanctl --load-all --noprompt
|
||||
Restart=on-abnormal
|
||||
+RuntimeDirectory=strongswan
|
||||
+RuntimeDirectoryMode=0755
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
diff -ur strongswan-5.8.4.orig/init/systemd-starter/strongswan-starter.service.in strongswan-5.8.4/init/systemd-starter/strongswan-starter.service.in
|
||||
--- strongswan-5.8.4.orig/init/systemd-starter/strongswan-starter.service.in 2019-08-27 16:26:53.000000000 +0300
|
||||
+++ strongswan-5.8.4/init/systemd-starter/strongswan-starter.service.in 2020-04-12 12:05:51.810559482 +0300
|
||||
@@ -6,6 +6,8 @@
|
||||
ExecStart=@SBINDIR@/@IPSEC_SCRIPT@ start --nofork
|
||||
StandardOutput=syslog
|
||||
Restart=on-abnormal
|
||||
+RuntimeDirectory=strongswan
|
||||
+RuntimeDirectoryMode=0755
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -1,12 +0,0 @@
|
||||
diff -Naur strongswan-5.9.1-orig/init/systemd-starter/strongswan-starter.service.in strongswan-5.9.1/init/systemd-starter/strongswan-starter.service.in
|
||||
--- strongswan-5.9.1-orig/init/systemd-starter/strongswan-starter.service.in 2020-10-16 08:36:37.000000000 -0400
|
||||
+++ strongswan-5.9.1/init/systemd-starter/strongswan-starter.service.in 2021-02-12 14:06:09.985042362 -0500
|
||||
@@ -5,6 +5,8 @@
|
||||
[Service]
|
||||
ExecStart=@SBINDIR@/@IPSEC_SCRIPT@ start --nofork
|
||||
Restart=on-abnormal
|
||||
+RuntimeDirectory=strongswan
|
||||
+RuntimeDirectoryMode=0755
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -1,16 +1,18 @@
|
||||
%global _hardened_build 1
|
||||
#%%define prerelease dr1
|
||||
%global dist .nhrp.3%{?dist}
|
||||
%global dist nhrp.3%{?dist}
|
||||
|
||||
Name: strongswan
|
||||
Version: 5.9.1
|
||||
Release: 1%{?dist}
|
||||
Version: 5.8.2
|
||||
Release: 2%{?dist}
|
||||
Summary: An OpenSource IPsec-based VPN and TNC solution
|
||||
License: GPLv2+
|
||||
URL: http://www.strongswan.org/
|
||||
Source0: http://download.strongswan.org/%{name}-%{version}%{?prerelease}.tar.bz2
|
||||
Source1: tmpfiles-strongswan.conf
|
||||
Patch0: strongswan-5.9.1-runtime-dir.patch
|
||||
|
||||
# tmpfiles.d configuration for the /run directory
|
||||
Source1: %{name}-tmpfiles.conf
|
||||
|
||||
Patch1: strongswan-5.6.0-uintptr_t.patch
|
||||
Patch3: strongswan-5.6.2-CVE-2018-5388.patch
|
||||
|
||||
@@ -25,7 +27,6 @@ Patch16: 0007-vyos-terminate-connections-source-dest.patch
|
||||
# only needed for pre-release versions
|
||||
#BuildRequires: autoconf automake
|
||||
|
||||
BuildRequires: make
|
||||
BuildRequires: gcc
|
||||
BuildRequires: systemd-devel
|
||||
BuildRequires: gmp-devel
|
||||
@@ -41,7 +42,6 @@ BuildRequires: json-c-devel
|
||||
BuildRequires: libgcrypt-devel
|
||||
BuildRequires: systemd-devel
|
||||
BuildRequires: iptables-devel
|
||||
BuildRequires: libcap-devel
|
||||
|
||||
BuildRequires: NetworkManager-libnm-devel
|
||||
Requires(post): systemd
|
||||
@@ -91,7 +91,6 @@ PT-TLS to support TNC over TLS.
|
||||
|
||||
%prep
|
||||
%setup -q -n %{name}-%{version}%{?prerelease}
|
||||
%patch0 -p1
|
||||
%patch1 -p1
|
||||
%patch3 -p1
|
||||
|
||||
@@ -118,7 +117,7 @@ PT-TLS to support TNC over TLS.
|
||||
--bindir=%{_libexecdir}/strongswan \
|
||||
--with-ipseclibdir=%{_libdir}/strongswan \
|
||||
--with-piddir=%{_rundir}/strongswan \
|
||||
--with-nm-ca-dir=%{_sysconfdir}/strongswan/ipsec.d/cacerts/ \
|
||||
--with-fips-mode=2 \
|
||||
--enable-bypass-lan \
|
||||
--enable-tss-trousers \
|
||||
--enable-nm \
|
||||
@@ -191,9 +190,7 @@ PT-TLS to support TNC over TLS.
|
||||
%ifarch x86_64 %{ix86}
|
||||
--enable-aesni \
|
||||
%endif
|
||||
--enable-kernel-libipsec \
|
||||
--with-capabilities=libcap \
|
||||
CPPFLAGS="-DSTARTER_ALLOW_NON_ROOT"
|
||||
--enable-kernel-libipsec
|
||||
|
||||
# disable certain plugins in the daemon configuration by default
|
||||
for p in bypass-lan; do
|
||||
@@ -222,7 +219,9 @@ for i in aacerts acerts certs cacerts crls ocspcerts private reqs; do
|
||||
install -d -m 700 %{buildroot}%{_sysconfdir}/strongswan/ipsec.d/${i}
|
||||
done
|
||||
install -d -m 0700 %{buildroot}%{_rundir}/strongswan
|
||||
install -D -m 0644 %{SOURCE1} %{buildroot}/%{_tmpfilesdir}/strongswan.conf
|
||||
|
||||
mkdir -p %{buildroot}%{_tmpfilesdir}
|
||||
install -m 0644 %{SOURCE1} %{buildroot}%{_tmpfilesdir}/%{name}.conf
|
||||
|
||||
%post
|
||||
%systemd_post %{name}.service
|
||||
@@ -265,7 +264,8 @@ install -D -m 0644 %{SOURCE1} %{buildroot}/%{_tmpfilesdir}/strongswan.conf
|
||||
%{_datadir}/strongswan/templates/config/
|
||||
%{_datadir}/strongswan/templates/database/
|
||||
%attr(0755,root,root) %dir %{_rundir}/strongswan
|
||||
%attr(0644,root,root) %{_tmpfilesdir}/strongswan.conf
|
||||
|
||||
%{_tmpfilesdir}/%{name}.conf
|
||||
|
||||
%files sqlite
|
||||
%{_libdir}/strongswan/plugins/libstrongswan-sqlite.so
|
||||
@@ -293,50 +293,6 @@ install -D -m 0644 %{SOURCE1} %{buildroot}/%{_tmpfilesdir}/strongswan.conf
|
||||
%{_libexecdir}/strongswan/charon-nm
|
||||
|
||||
%changelog
|
||||
* Fri Feb 12 2021 Paul Wouters <pwouters@redhat.com> - 5.9.1-1
|
||||
- Resolves: rhbz# 1896545 strongswan-5.9.1 is available
|
||||
|
||||
* Thu Feb 11 2021 Davide Cavalca <dcavalca@fedoraproject.org> - 5.9.0-4
|
||||
- Build with with capabilities support
|
||||
- Resolves: rhbz#1911572 StrongSwan not configured with libcap support
|
||||
|
||||
* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 5.9.0-3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
|
||||
|
||||
* Thu Oct 22 12:43:48 EDT 2020 Paul Wouters <pwouters@redhat.com> - 5.9.0-2
|
||||
- Resolves: rhbz#1886759 charon looking for certificates in the wrong place
|
||||
|
||||
* Mon Sep 28 12:36:45 EDT 2020 Paul Wouters <pwouters@redhat.com> - 5.9.0-1
|
||||
- Resolves: rhbz#1861747 strongswan-5.9.0 is available
|
||||
- Remove --enable-fips-mode=2, which defaults strongswan to FIPS only.
|
||||
(use fips_mode = 2 in plugins {} openssl {} in strongswan.conf to enable FIPS)
|
||||
|
||||
* Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 5.8.4-5
|
||||
- Second attempt - Rebuilt for
|
||||
https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
|
||||
|
||||
* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 5.8.4-4
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
|
||||
|
||||
* Tue Apr 21 2020 Björn Esser <besser82@fedoraproject.org> - 5.8.4-3
|
||||
- Rebuild (json-c)
|
||||
|
||||
* Sun Apr 12 2020 Mikhail Zabaluev <mikhail.zabaluev@gmail.com> - 5.8.4-2
|
||||
- Patch0: Add RuntimeDirectory options to service files (#1789263)
|
||||
|
||||
* Sun Apr 12 2020 Mikhail Zabaluev <mikhail.zabaluev@gmail.com> - 5.8.4-1
|
||||
- Updated to 5.8.4
|
||||
- Patch4 has been applied upstream
|
||||
|
||||
* Sat Feb 22 2020 Mikhail Zabaluev <mikhail.zabaluev@gmail.com> - 5.8.2-5
|
||||
- Patch to declare a global variable with extern (#1800117)
|
||||
|
||||
* Mon Feb 10 2020 Paul Wouters <pwouters@redhat.com> - 5.8.2-4
|
||||
- use tmpfile to ensure rundir is present
|
||||
|
||||
* Fri Jan 31 2020 Fedora Release Engineering <releng@fedoraproject.org> - 5.8.2-3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
|
||||
|
||||
* Sat Dec 28 2019 Paul Wouters <pwouters@redhat.com> - 5.8.2-2
|
||||
- Use /run/strongswan as rundir to support strongswans in namespaces
|
||||
|
||||
|
||||
@@ -1 +0,0 @@
|
||||
D /run/strongswan 0755 root root -
|
||||
Reference in New Issue
Block a user