Patch vici for NHRP

.gitignore

@@ -1,6 +1,3 @@
 /strongswan-5.8.4.tar.bz2
 /strongswan-5.9.0.tar.bz2
 /strongswan-5.9.1.tar.bz2
-/strongswan-5.9.2.tar.bz2
-/strongswan-5.9.3.tar.bz2
-/strongswan-5.9.4.tar.bz2

0001-charon-add-optional-source-and-remote-overrides-for-.patch

@@ -1,4 +1,4 @@
-From c2e02e7aa1aead5f5c9c6ceef7f3569d90deb20f Mon Sep 17 00:00:00 2001
+From a83557d6cef7334b95d8f9be2a2d7af319010497 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
 Date: Mon, 21 Sep 2015 13:41:58 +0300
 Subject: [PATCH 1/4] charon: add optional source and remote overrides for
@@ -35,9 +35,9 @@ Signed-off-by: Timo Teräs <timo.teras@iki.fi>
  .../processing/jobs/start_action_job.c        |  2 +-
  src/libcharon/sa/ike_sa_manager.c             | 49 ++++++++++++++-
  src/libcharon/sa/ike_sa_manager.h             |  8 ++-
- src/libcharon/sa/trap_manager.c               | 44 ++++++-------
+ src/libcharon/sa/trap_manager.c               | 45 ++++++--------
  src/swanctl/commands/initiate.c               | 40 +++++++++++-
- 21 files changed, 227 insertions(+), 50 deletions(-)
+ 21 files changed, 228 insertions(+), 50 deletions(-)
 
 diff --git a/src/charon-cmd/cmd/cmd_connection.c b/src/charon-cmd/cmd/cmd_connection.c
 index 0481d78d4..805d6f198 100644
@@ -53,18 +53,18 @@ index 0481d78d4..805d6f198 100644
  		terminate(pid);
  	}
 diff --git a/src/charon-nm/nm/nm_service.c b/src/charon-nm/nm/nm_service.c
-index 2d93b2fae..482170d76 100644
+index 83fcaf898..187953b29 100644
 --- a/src/charon-nm/nm/nm_service.c
 +++ b/src/charon-nm/nm/nm_service.c
-@@ -883,7 +883,7 @@ static gboolean connect_(NMVpnServicePlugin *plugin, NMConnection *connection,
+@@ -864,7 +864,7 @@ static gboolean connect_(NMVpnServicePlugin *plugin, NMConnection *connection,
  	 * Prepare IKE_SA
  	 */
  	ike_sa = charon->ike_sa_manager->checkout_by_config(charon->ike_sa_manager,
 -														peer_cfg);
 +														peer_cfg, NULL, NULL);
- 	peer_cfg->destroy(peer_cfg);
  	if (!ike_sa)
  	{
+ 		peer_cfg->destroy(peer_cfg);
 diff --git a/src/conftest/actions.c b/src/conftest/actions.c
 index 66e41f743..64ef8e9ee 100644
 --- a/src/conftest/actions.c
@@ -79,7 +79,7 @@ index 66e41f743..64ef8e9ee 100644
  	else
  	{
 diff --git a/src/libcharon/control/controller.c b/src/libcharon/control/controller.c
-index 46b065e3f..fbaff8730 100644
+index 3baa9342a..d545a4b63 100644
 --- a/src/libcharon/control/controller.c
 +++ b/src/libcharon/control/controller.c
 @@ -15,6 +15,28 @@
@@ -128,7 +128,7 @@ index 46b065e3f..fbaff8730 100644
  	/**
  	 * unique ID, used for various methods
  	 */
-@@ -414,10 +446,16 @@ METHOD(job_t, initiate_execute, job_requeue_t,
+@@ -414,9 +446,15 @@ METHOD(job_t, initiate_execute, job_requeue_t,
  	ike_sa_t *ike_sa;
  	interface_listener_t *listener = &job->listener;
  	peer_cfg_t *peer_cfg = listener->peer_cfg;
@@ -138,7 +138,6 @@ index 46b065e3f..fbaff8730 100644
  	ike_sa = charon->ike_sa_manager->checkout_by_config(charon->ike_sa_manager,
 -														peer_cfg);
 +														peer_cfg, my_host, other_host);
- 	peer_cfg->destroy(peer_cfg);
 +
 +	if (my_host) my_host->destroy(my_host);
 +	if (other_host) other_host->destroy(other_host);
@@ -154,7 +153,7 @@ index 46b065e3f..fbaff8730 100644
  	listener->lock->lock(listener->lock);
  	listener->ike_sa = ike_sa;
  	listener->lock->unlock(listener->lock);
-@@ -492,6 +531,7 @@ METHOD(job_t, initiate_execute, job_requeue_t,
+@@ -497,6 +536,7 @@ METHOD(job_t, initiate_execute, job_requeue_t,
  
  METHOD(controller_t, initiate, status_t,
  	private_controller_t *this, peer_cfg_t *peer_cfg, child_cfg_t *child_cfg,
@@ -162,7 +161,7 @@ index 46b065e3f..fbaff8730 100644
  	controller_cb_t callback, void *param, u_int timeout, bool limits)
  {
  	interface_job_t *job;
-@@ -514,6 +554,8 @@ METHOD(controller_t, initiate, status_t,
+@@ -519,6 +559,8 @@ METHOD(controller_t, initiate, status_t,
  			.status = FAILED,
  			.child_cfg = child_cfg,
  			.peer_cfg = peer_cfg,
@@ -429,7 +428,7 @@ index 3a0ed879f..e3399007b 100644
  				case ACTION_ROUTE:
  					DBG1(DBG_JOB, "start action: route '%s'", name);
 diff --git a/src/libcharon/sa/ike_sa_manager.c b/src/libcharon/sa/ike_sa_manager.c
-index b6321cf16..a889b90ab 100644
+index f95ff19af..82cae6e4b 100644
 --- a/src/libcharon/sa/ike_sa_manager.c
 +++ b/src/libcharon/sa/ike_sa_manager.c
 @@ -17,6 +17,28 @@
@@ -461,8 +460,8 @@ index b6321cf16..a889b90ab 100644
  #include <string.h>
  #include <inttypes.h>
  
-@@ -1485,7 +1507,8 @@ typedef struct {
- } config_entry_t;
+@@ -1423,7 +1445,8 @@ out:
+ }
  
  METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
 -	private_ike_sa_manager_t *this, peer_cfg_t *peer_cfg)
@@ -471,9 +470,9 @@ index b6321cf16..a889b90ab 100644
  {
  	enumerator_t *enumerator;
  	entry_t *entry;
-@@ -1496,7 +1519,16 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
+@@ -1432,7 +1455,16 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
+ 	ike_cfg_t *current_ike;
  	u_int segment;
- 	int i;
  
 -	DBG2(DBG_MGR, "checkout IKE_SA by config");
 +	if (my_host && my_host->get_port(my_host) == 0)
@@ -489,7 +488,7 @@ index b6321cf16..a889b90ab 100644
  
  	if (!this->reuse_ikesa && peer_cfg->get_ike_version(peer_cfg) != IKEV1)
  	{	/* IKE_SA reuse disabled by config (not possible for IKEv1) */
-@@ -1554,6 +1586,15 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
+@@ -1455,6 +1487,15 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
  			continue;
  		}
  
@@ -505,22 +504,22 @@ index b6321cf16..a889b90ab 100644
  		current_peer = entry->ike_sa->get_peer_cfg(entry->ike_sa);
  		if (current_peer && current_peer->equals(current_peer, peer_cfg))
  		{
-@@ -1580,6 +1621,10 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
- 		{
- 			ike_sa->set_peer_cfg(ike_sa, peer_cfg);
- 			checkout_new(this, ike_sa);
-+			if (my_host || other_host)
-+			{
-+				ike_sa->update_hosts(ike_sa, my_host, other_host, TRUE);
-+			}
- 		}
+@@ -1477,6 +1518,10 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
+ 	if (!ike_sa)
+ 	{	/* no IKE_SA using such a config, hand out a new */
+ 		ike_sa = checkout_new(this, peer_cfg->get_ike_version(peer_cfg), TRUE);
++		if (my_host || other_host)
++		{
++			ike_sa->update_hosts(ike_sa, my_host, other_host, TRUE);
++		}
  	}
  	charon->bus->set_sa(charon->bus, ike_sa);
+ 
 diff --git a/src/libcharon/sa/ike_sa_manager.h b/src/libcharon/sa/ike_sa_manager.h
-index 318620be0..f40eeb74e 100644
+index efad2e4d6..c43edabbb 100644
 --- a/src/libcharon/sa/ike_sa_manager.h
 +++ b/src/libcharon/sa/ike_sa_manager.h
-@@ -109,7 +109,8 @@ struct ike_sa_manager_t {
+@@ -93,7 +93,8 @@ struct ike_sa_manager_t {
  	ike_sa_t* (*checkout_by_message) (ike_sa_manager_t* this, message_t *message);
  
  	/**
@@ -530,22 +529,23 @@ index 318620be0..f40eeb74e 100644
  	 *
  	 * To initiate, a CHILD_SA may be established within an existing IKE_SA.
  	 * This call checks for an existing IKE_SA by comparing the configuration.
-@@ -122,9 +123,12 @@ struct ike_sa_manager_t {
- 	 * @note The peer_config is always set on the returned IKE_SA.
+@@ -103,10 +104,13 @@ struct ike_sa_manager_t {
+ 	 * the found IKE_SA is in the DELETING state.
  	 *
  	 * @param peer_cfg			configuration used to find an existing IKE_SA
 +	 * @param my_host			source host address for wildcard peer_cfg
 +	 * @param other_host		remote host address for wildcard peer_cfg
  	 * @return					checked out/created IKE_SA
  	 */
--	ike_sa_t *(*checkout_by_config)(ike_sa_manager_t* this, peer_cfg_t *peer_cfg);
-+	ike_sa_t *(*checkout_by_config)(ike_sa_manager_t* this, peer_cfg_t *peer_cfg,
+ 	ike_sa_t* (*checkout_by_config) (ike_sa_manager_t* this,
+-									 peer_cfg_t *peer_cfg);
++									 peer_cfg_t *peer_cfg,
 +									 host_t *my_host, host_t *other_host);
  
  	/**
  	 * Reset initiator SPI.
 diff --git a/src/libcharon/sa/trap_manager.c b/src/libcharon/sa/trap_manager.c
-index f9f78acab..555e28ab6 100644
+index 2bc531b38..ca4855811 100644
 --- a/src/libcharon/sa/trap_manager.c
 +++ b/src/libcharon/sa/trap_manager.c
 @@ -432,7 +432,7 @@ METHOD(trap_manager_t, acquire, void,
@@ -557,12 +557,12 @@ index f9f78acab..555e28ab6 100644
  	bool wildcard, ignore = FALSE;
  
  	this->lock->read_lock(this->lock);
-@@ -508,36 +508,26 @@ METHOD(trap_manager_t, acquire, void,
+@@ -508,36 +508,27 @@ METHOD(trap_manager_t, acquire, void,
  	this->lock->unlock(this->lock);
  
  	if (wildcard)
 -	{	/* the peer config would match IKE_SAs with other peers */
--		ike_sa = charon->ike_sa_manager->create_new(charon->ike_sa_manager,
+-		ike_sa = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager,
 -											peer->get_ike_version(peer), TRUE);
 -		if (ike_sa)
 -		{
@@ -607,9 +607,10 @@ index f9f78acab..555e28ab6 100644
 +											my_host, other_host);
 +	if (my_host) my_host->destroy(my_host);
 +	if (other_host) other_host->destroy(other_host);
- 	peer->destroy(peer);
- 
++
  	if (ike_sa)
+ 	{
+ 		if (ike_sa->get_peer_cfg(ike_sa) == NULL)
 diff --git a/src/swanctl/commands/initiate.c b/src/swanctl/commands/initiate.c
 index 8ade8bf41..03b2cb0f4 100644
 --- a/src/swanctl/commands/initiate.c
@@ -690,5 +691,5 @@ index 8ade8bf41..03b2cb0f4 100644
  			{"raw",			'r', 0, "dump raw response message"},
  			{"pretty",		'P', 0, "dump raw response message in pretty print"},
 -- 
-2.31.1
+2.30.2
 

0002-vici-send-certificates-for-ike-sa-events.patch

@@ -1,4 +1,4 @@
-From e5589f7a7ddeac0de425783275d38327279eff4f Mon Sep 17 00:00:00 2001
+From 767392d01da960ec8c6b3b14e67eee2111864630 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
 Date: Mon, 21 Sep 2015 13:42:05 +0300
 Subject: [PATCH 2/4] vici: send certificates for ike-sa events
@@ -8,11 +8,11 @@ Content-Transfer-Encoding: 8bit
 
 Signed-off-by: Timo Teräs <timo.teras@iki.fi>
 ---
- src/libcharon/plugins/vici/vici_query.c | 50 +++++++++++++++++++++----
- 1 file changed, 42 insertions(+), 8 deletions(-)
+ src/libcharon/plugins/vici/vici_query.c | 48 +++++++++++++++++++++----
+ 1 file changed, 41 insertions(+), 7 deletions(-)
 
 diff --git a/src/libcharon/plugins/vici/vici_query.c b/src/libcharon/plugins/vici/vici_query.c
-index fb65b1447..9a0dc1c8b 100644
+index ad07ff12d..e3f6a0d26 100644
 --- a/src/libcharon/plugins/vici/vici_query.c
 +++ b/src/libcharon/plugins/vici/vici_query.c
 @@ -379,7 +379,7 @@ static void list_vips(private_vici_query_t *this, vici_builder_t *b,
@@ -77,7 +77,7 @@ index fb65b1447..9a0dc1c8b 100644
  
  	eap = ike_sa->get_other_eap_id(ike_sa);
  
-@@ -532,7 +566,7 @@ CALLBACK(list_sas, vici_message_t*,
+@@ -531,7 +565,7 @@ CALLBACK(list_sas, vici_message_t*,
  		b = vici_builder_create();
  		b->begin_section(b, ike_sa->get_name(ike_sa));
  
@@ -86,7 +86,7 @@ index fb65b1447..9a0dc1c8b 100644
  
  		b->begin_section(b, "child-sas");
  		csas = ike_sa->create_child_sa_enumerator(ike_sa);
-@@ -1719,7 +1753,7 @@ METHOD(listener_t, ike_updown, bool,
+@@ -1717,7 +1751,7 @@ METHOD(listener_t, ike_updown, bool,
  	}
  
  	b->begin_section(b, ike_sa->get_name(ike_sa));
@@ -95,7 +95,7 @@ index fb65b1447..9a0dc1c8b 100644
  	b->end_section(b);
  
  	this->dispatcher->raise_event(this->dispatcher,
-@@ -1744,10 +1778,10 @@ METHOD(listener_t, ike_rekey, bool,
+@@ -1742,10 +1776,10 @@ METHOD(listener_t, ike_rekey, bool,
  	b = vici_builder_create();
  	b->begin_section(b, old->get_name(old));
  	b->begin_section(b, "old");
@@ -108,16 +108,7 @@ index fb65b1447..9a0dc1c8b 100644
  	b->end_section(b);
  	b->end_section(b);
  
-@@ -1778,7 +1812,7 @@ METHOD(listener_t, ike_update, bool,
- 	b->add_kv(b, "remote-port", "%d", remote->get_port(remote));
- 
- 	b->begin_section(b, ike_sa->get_name(ike_sa));
--	list_ike(this, b, ike_sa, now);
-+	list_ike(this, b, ike_sa, now, TRUE);
- 	b->end_section(b);
- 
- 	this->dispatcher->raise_event(this->dispatcher,
-@@ -1808,7 +1842,7 @@ METHOD(listener_t, child_updown, bool,
+@@ -1776,7 +1810,7 @@ METHOD(listener_t, child_updown, bool,
  	}
  
  	b->begin_section(b, ike_sa->get_name(ike_sa));
@@ -126,7 +117,7 @@ index fb65b1447..9a0dc1c8b 100644
  	b->begin_section(b, "child-sas");
  
  	snprintf(buf, sizeof(buf), "%s-%u", child_sa->get_name(child_sa),
-@@ -1843,7 +1877,7 @@ METHOD(listener_t, child_rekey, bool,
+@@ -1811,7 +1845,7 @@ METHOD(listener_t, child_rekey, bool,
  	b = vici_builder_create();
  
  	b->begin_section(b, ike_sa->get_name(ike_sa));
@@ -136,5 +127,5 @@ index fb65b1447..9a0dc1c8b 100644
  
  	b->begin_section(b, old->get_name(old));
 -- 
-2.31.1
+2.30.2
 

0003-vici-add-support-for-individual-sa-state-changes.patch

@@ -1,4 +1,4 @@
-From faa75e58ec73dc70ba296a2ec534f2f87550c960 Mon Sep 17 00:00:00 2001
+From 668264e3159ba8143a30fde32beba7a39774942c Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
 Date: Mon, 21 Sep 2015 13:42:11 +0300
 Subject: [PATCH 3/4] vici: add support for individual sa state changes
@@ -10,17 +10,17 @@ Useful for monitoring and tracking full SA.
 
 Signed-off-by: Timo Teräs <timo.teras@iki.fi>
 ---
- src/libcharon/plugins/vici/vici_query.c | 106 ++++++++++++++++++++++++
- 1 file changed, 106 insertions(+)
+ src/libcharon/plugins/vici/vici_query.c | 105 ++++++++++++++++++++++++
+ 1 file changed, 105 insertions(+)
 
 diff --git a/src/libcharon/plugins/vici/vici_query.c b/src/libcharon/plugins/vici/vici_query.c
-index 9a0dc1c8b..b213ba432 100644
+index e3f6a0d26..9968cdd3c 100644
 --- a/src/libcharon/plugins/vici/vici_query.c
 +++ b/src/libcharon/plugins/vici/vici_query.c
-@@ -1719,8 +1719,16 @@ static void manage_commands(private_vici_query_t *this, bool reg)
+@@ -1717,8 +1717,16 @@ static void manage_commands(private_vici_query_t *this, bool reg)
+ 	this->dispatcher->manage_event(this->dispatcher, "list-cert", reg);
  	this->dispatcher->manage_event(this->dispatcher, "ike-updown", reg);
  	this->dispatcher->manage_event(this->dispatcher, "ike-rekey", reg);
- 	this->dispatcher->manage_event(this->dispatcher, "ike-update", reg);
 +	this->dispatcher->manage_event(this->dispatcher, "ike-state-established", reg);
 +	this->dispatcher->manage_event(this->dispatcher, "ike-state-destroying", reg);
  	this->dispatcher->manage_event(this->dispatcher, "child-updown", reg);
@@ -34,11 +34,10 @@ index 9a0dc1c8b..b213ba432 100644
  	manage_command(this, "list-sas", list_sas, reg);
  	manage_command(this, "list-policies", list_policies, reg);
  	manage_command(this, "list-conns", list_conns, reg);
-@@ -1821,6 +1829,46 @@ METHOD(listener_t, ike_update, bool,
+@@ -1789,6 +1797,45 @@ METHOD(listener_t, ike_rekey, bool,
  	return TRUE;
  }
  
-+
 +METHOD(listener_t, ike_state_change, bool,
 +	private_vici_query_t *this, ike_sa_t *ike_sa, ike_sa_state_t state)
 +{
@@ -81,7 +80,7 @@ index 9a0dc1c8b..b213ba432 100644
  METHOD(listener_t, child_updown, bool,
  	private_vici_query_t *this, ike_sa_t *ike_sa, child_sa_t *child_sa, bool up)
  {
-@@ -1900,6 +1948,62 @@ METHOD(listener_t, child_rekey, bool,
+@@ -1868,6 +1915,62 @@ METHOD(listener_t, child_rekey, bool,
  	return TRUE;
  }
  
@@ -144,10 +143,10 @@ index 9a0dc1c8b..b213ba432 100644
  METHOD(vici_query_t, destroy, void,
  	private_vici_query_t *this)
  {
-@@ -1920,8 +2024,10 @@ vici_query_t *vici_query_create(vici_dispatcher_t *dispatcher)
+@@ -1887,8 +1990,10 @@ vici_query_t *vici_query_create(vici_dispatcher_t *dispatcher)
+ 			.listener = {
  				.ike_updown = _ike_updown,
  				.ike_rekey = _ike_rekey,
- 				.ike_update = _ike_update,
 +				.ike_state_change = _ike_state_change,
  				.child_updown = _child_updown,
  				.child_rekey = _child_rekey,
@@ -156,5 +155,5 @@ index 9a0dc1c8b..b213ba432 100644
  			.destroy = _destroy,
  		},
 -- 
-2.31.1
+2.30.2
 

0004-vyos-terminate-connections-source-dest.patch

@@ -1,4 +1,4 @@
-From 1057ecaa416c81b0e3fd4b26e1c8c301d1749ecb Mon Sep 17 00:00:00 2001
+From d22bf07af4bd67862ebe9bdaf315dc0a63676084 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Zoran=20Peri=C4=8Di=C4=87?= <zpericic@netst.org>
 Date: Wed, 22 Jan 2020 13:12:39 +0100
 Subject: [PATCH 4/4] vyos-terminate-connections-source-dest
@@ -120,5 +120,5 @@ index 2309843b2..37d0bde3f 100644
  			{"child-id",	'C', 1, "terminate by CHILD_SA reqid"},
  			{"ike-id",		'I', 1, "terminate by IKE_SA unique identifier"},
 -- 
-2.31.1
+2.30.2
 

sources

@@ -1 +1 @@
-SHA512 (strongswan-5.9.4.tar.bz2) = 796356c1d5c1ad410f0ed944ab4a131076d26f120ec6fa57796fe4060b0741201199625883ddc9ebd8a7ad299495f073cec76a6780ebd8f375605aae16750cf3
+SHA512 (strongswan-5.9.1.tar.bz2) = 222625e77bd86959da6dd7346cfa9f92569fc396a494bb95ddf2c8e0680b7e8041541e8a14320517a0c735d713ae0fdc0d0c4694215e812817814b0b4efc3497

strongswan.spec

@@ -1,9 +1,9 @@
 %global _hardened_build 1
 #%%define prerelease dr1
-%global dist .nhrp.9%{?dist}
+%global dist .nhrp.8%{?dist}
 
 Name:           strongswan
-Version:        5.9.4
+Version:        5.9.1
 Release:        1%{?dist}
 Summary:        An OpenSource IPsec-based VPN and TNC solution
 License:        GPLv2+
@@ -39,8 +39,6 @@ BuildRequires:  libgcrypt-devel
 BuildRequires:  systemd-devel
 BuildRequires:  iptables-devel
 BuildRequires:  libcap-devel
-BuildRequires:  tpm2-tss-devel
-Recommends:     tpm2-tools
 
 BuildRequires:  NetworkManager-libnm-devel
 Requires(post): systemd
@@ -232,7 +230,7 @@ install -D -m 0644 %{SOURCE1} %{buildroot}/%{_tmpfilesdir}/strongswan.conf
 %files
 %doc README NEWS TODO ChangeLog
 %license COPYING
-%dir %attr(0755,root,root) %{_sysconfdir}/strongswan
+%dir %attr(0700,root,root) %{_sysconfdir}/strongswan
 %config(noreplace) %{_sysconfdir}/strongswan/*
 %dir %{_libdir}/strongswan
 %exclude %{_libdir}/strongswan/imcvs
@@ -289,34 +287,8 @@ install -D -m 0644 %{SOURCE1} %{buildroot}/%{_tmpfilesdir}/strongswan.conf
 %{_libexecdir}/strongswan/charon-nm
 
 %changelog
-* Wed Oct 20 2021 Paul Wouters <paul.wouters@aiven.io> - 5.9.4-1
-- Resolves: rhbz#2015165 strongswan-5.9.4 is available
-- Resolves: rhbz#2015611 CVE-2021-41990 strongswan: gmp plugin: integer overflow via a crafted certificate with an RSASSA-PSS signature
-- Resolves: rhbz#2015614 CVE-2021-41991 strongswan: integer overflow when replacing certificates in cache
-- Add BuildRequire for tpm2-tss-devel and weak dependency for tpm2-tools
-
-* Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 5.9.3-4
-- Rebuilt with OpenSSL 3.0.0
-
-* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 5.9.3-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
-
-* Sat Jul 10 2021 Björn Esser <besser82@fedoraproject.org> - 5.9.3-2
-- Rebuild for versioned symbols in json-c
-
-* Tue Jul 06 2021 Paul Wouters <paul.wouters@aiven.io> - 5.9.3-1
-- Resolves: rhbz#1979574 strongswan-5.9.3 is available
-- Make strongswan main dir world readable so apps can find strongswan.conf
-
-* Thu Jun 03 2021 Paul Wouters <paul.wouters@aiven.io> - 5.9.2-1
-- Resolves: rhbz#1896545 strongswan-5.9.2 is available
-
-* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 5.9.1-2
-- Rebuilt for updated systemd-rpm-macros
-  See https://pagure.io/fesco/issue/2583.
-
 * Fri Feb 12 2021 Paul Wouters <pwouters@redhat.com> - 5.9.1-1
-- Resolves: rhbz#1896545 strongswan-5.9.1 is available
+- Resolves: rhbz# 1896545 strongswan-5.9.1 is available
 
 * Thu Feb 11 2021 Davide Cavalca <dcavalca@fedoraproject.org> - 5.9.0-4
 - Build with with capabilities support