Patch vici for NHRP

Use configure paths in manual pages (#2106120 )
Switch all URLs to https
2023-01-31 16:16:59 +01:00 · 2023-01-19 00:10:55 +01:00 · 2023-01-19 00:10:55 +01:00 · 2023-01-19 00:10:54 +01:00 · 2022-10-16 22:42:15 -04:00 · 2022-10-16 21:55:29 -04:00
10 changed files with 688 additions and 225 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -4,3 +4,12 @@
 /strongswan-5.9.2.tar.bz2
 /strongswan-5.9.3.tar.bz2
 /strongswan-5.9.4.tar.bz2
+/948F158A4E76A27BF3D07532DF42C170B34DBA77
+/strongswan-5.9.5.tar.bz2
+/strongswan-5.9.5.tar.bz2.sig
+/strongswan-5.9.6.tar.bz2
+/strongswan-5.9.6.tar.bz2.sig
+/strongswan-5.9.8.tar.bz2
+/strongswan-5.9.8.tar.bz2.sig
+/strongswan-5.9.9.tar.bz2
+/strongswan-5.9.9.tar.bz2.sig
--- a/0001-charon-add-optional-source-and-remote-overrides-for-.patch
+++ b/0001-charon-add-optional-source-and-remote-overrides-for-.patch
@@ -1,7 +1,7 @@
-From c2e02e7aa1aead5f5c9c6ceef7f3569d90deb20f Mon Sep 17 00:00:00 2001
+From 84b1ee5c075b731618ff342ba4df94c3f9f2eaef Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
 Date: Mon, 21 Sep 2015 13:41:58 +0300
-Subject: [PATCH 1/4] charon: add optional source and remote overrides for
+Subject: [PATCH 1/3] charon: add optional source and remote overrides for
 initiate
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
@@ -19,9 +19,7 @@ Signed-off-by: Timo Teräs <timo.teras@iki.fi>
 src/charon-cmd/cmd/cmd_connection.c           |  2 +-
 src/charon-nm/nm/nm_service.c                 |  2 +-
 src/conftest/actions.c                        |  2 +-
- .../backend/android_service.c                 |  2 +-
- src/frontends/osx/charon-xpc/xpc_dispatch.c   |  1 +
- src/libcharon/control/controller.c            | 44 ++++++++++++-
+ src/libcharon/control/controller.c            | 43 ++++++++++++-
 src/libcharon/control/controller.h            |  3 +
 .../plugins/load_tester/load_tester_control.c |  1 +
 .../plugins/load_tester/load_tester_plugin.c  |  1 +
@@ -37,13 +35,13 @@ Signed-off-by: Timo Teräs <timo.teras@iki.fi>
 src/libcharon/sa/ike_sa_manager.h             |  8 ++-
 src/libcharon/sa/trap_manager.c               | 44 ++++++-------
 src/swanctl/commands/initiate.c               | 40 +++++++++++-
- 21 files changed, 227 insertions(+), 50 deletions(-)
+ 21 files changed, 226 insertions(+), 50 deletions(-)

 diff --git a/src/charon-cmd/cmd/cmd_connection.c b/src/charon-cmd/cmd/cmd_connection.c
-index 0481d78d4..805d6f198 100644
+index 37d951951..d91eb951c 100644
 --- a/src/charon-cmd/cmd/cmd_connection.c
 +++ b/src/charon-cmd/cmd/cmd_connection.c
-@@ -438,7 +438,7 @@ static job_requeue_t initiate(private_cmd_connection_t *this)
+@@ -440,7 +440,7 @@ static job_requeue_t initiate(private_cmd_connection_t *this)
 	child_cfg = create_child_cfg(this, peer_cfg);
 
 	if (charon->controller->initiate(charon->controller, peer_cfg, child_cfg,
@@ -53,7 +51,7 @@ index 0481d78d4..805d6f198 100644
 		terminate(pid);
 	}
 diff --git a/src/charon-nm/nm/nm_service.c b/src/charon-nm/nm/nm_service.c
-index 2d93b2fae..482170d76 100644
+index 09107a76b..0b15a1835 100644
 --- a/src/charon-nm/nm/nm_service.c
 +++ b/src/charon-nm/nm/nm_service.c
@@ -883,7 +883,7 @@ static gboolean connect_(NMVpnServicePlugin *plugin, NMConnection *connection,
@@ -79,7 +77,7 @@ index 66e41f743..64ef8e9ee 100644
 	else
 	{
 diff --git a/src/libcharon/control/controller.c b/src/libcharon/control/controller.c
-index 46b065e3f..fbaff8730 100644
+index cd25b28fe..36d6cd7be 100644
 --- a/src/libcharon/control/controller.c
 +++ b/src/libcharon/control/controller.c
@@ -15,6 +15,28 @@
@@ -146,15 +144,7 @@ index 46b065e3f..fbaff8730 100644
 	if (!ike_sa)
 	{
 		DESTROY_IF(listener->child_cfg);
-@@ -425,6 +463,7 @@ METHOD(job_t, initiate_execute, job_requeue_t,
- 		listener_done(listener);
- 		return JOB_REQUEUE_NONE;
- 	}
-+
- 	listener->lock->lock(listener->lock);
- 	listener->ike_sa = ike_sa;
- 	listener->lock->unlock(listener->lock);
-@@ -492,6 +531,7 @@ METHOD(job_t, initiate_execute, job_requeue_t,
+@@ -492,6 +530,7 @@ METHOD(job_t, initiate_execute, job_requeue_t,
 
 METHOD(controller_t, initiate, status_t,
 	private_controller_t *this, peer_cfg_t *peer_cfg, child_cfg_t *child_cfg,
@@ -162,7 +152,7 @@ index 46b065e3f..fbaff8730 100644
 	controller_cb_t callback, void *param, u_int timeout, bool limits)
 {
 	interface_job_t *job;
-@@ -514,6 +554,8 @@ METHOD(controller_t, initiate, status_t,
+@@ -514,6 +553,8 @@ METHOD(controller_t, initiate, status_t,
 			.status = FAILED,
 			.child_cfg = child_cfg,
 			.peer_cfg = peer_cfg,
@@ -280,18 +270,18 @@ index b6cfda082..115e0a82e 100644
 		{
 			write_fifo(this, "connection '%s' established\n", name);
 diff --git a/src/libcharon/plugins/vici/vici_config.c b/src/libcharon/plugins/vici/vici_config.c
-index 2a4d58eab..0e9d24d11 100644
+index 3a783b822..ea9a5c6b2 100644
 --- a/src/libcharon/plugins/vici/vici_config.c
 +++ b/src/libcharon/plugins/vici/vici_config.c
-@@ -2149,7 +2149,7 @@ static void run_start_action(private_vici_config_t *this, peer_cfg_t *peer_cfg,
- 			DBG1(DBG_CFG, "initiating '%s'", child_cfg->get_name(child_cfg));
- 			charon->controller->initiate(charon->controller,
+@@ -2216,7 +2216,7 @@ static void run_start_action(private_vici_config_t *this, peer_cfg_t *peer_cfg,
+ 		DBG1(DBG_CFG, "initiating '%s'", child_cfg->get_name(child_cfg));
+ 		charon->controller->initiate(charon->controller,
 					peer_cfg->get_ref(peer_cfg), child_cfg->get_ref(child_cfg),
 -					NULL, NULL, 0, FALSE);
 +					NULL, NULL, NULL, NULL, 0, FALSE);
- 			break;
- 		case ACTION_ROUTE:
- 			DBG1(DBG_CFG, "installing '%s'", child_cfg->get_name(child_cfg));
+ 	}
+ }
+ 
 diff --git a/src/libcharon/plugins/vici/vici_control.c b/src/libcharon/plugins/vici/vici_control.c
 index 4c09b578d..4c00c2be5 100644
 --- a/src/libcharon/plugins/vici/vici_control.c
@@ -416,20 +406,20 @@ index 6a72499d3..eb0ad3846 100644
 		{
 			mediation_cfg->destroy(mediation_cfg);
 diff --git a/src/libcharon/processing/jobs/start_action_job.c b/src/libcharon/processing/jobs/start_action_job.c
-index 3a0ed879f..e3399007b 100644
+index 31e154a77..0371293b1 100644
 --- a/src/libcharon/processing/jobs/start_action_job.c
 +++ b/src/libcharon/processing/jobs/start_action_job.c
-@@ -61,7 +61,7 @@ METHOD(job_t, execute, job_requeue_t,
- 					charon->controller->initiate(charon->controller,
- 												 peer_cfg->get_ref(peer_cfg),
- 												 child_cfg->get_ref(child_cfg),
-												 NULL, NULL, 0, FALSE);
-+												 NULL, NULL, NULL, NULL, 0, FALSE);
- 					break;
- 				case ACTION_ROUTE:
- 					DBG1(DBG_JOB, "start action: route '%s'", name);
+@@ -83,7 +83,7 @@ METHOD(job_t, execute, job_requeue_t,
+ 				charon->controller->initiate(charon->controller,
+ 											 peer_cfg->get_ref(peer_cfg),
+ 											 child_cfg->get_ref(child_cfg),
+-											 NULL, NULL, 0, FALSE);
+											 NULL, NULL, NULL, NULL, 0, FALSE);
+ 			}
+ 		}
+ 		children->destroy(children);
 diff --git a/src/libcharon/sa/ike_sa_manager.c b/src/libcharon/sa/ike_sa_manager.c
-index b6321cf16..a889b90ab 100644
+index fe615a6bc..5839f8827 100644
 --- a/src/libcharon/sa/ike_sa_manager.c
 +++ b/src/libcharon/sa/ike_sa_manager.c
@@ -17,6 +17,28 @@
@@ -461,7 +451,7 @@ index b6321cf16..a889b90ab 100644
 #include <string.h>
 #include <inttypes.h>
 
-@@ -1485,7 +1507,8 @@ typedef struct {
+@@ -1495,7 +1517,8 @@ typedef struct {
 } config_entry_t;
 
 METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
@@ -471,7 +461,7 @@ index b6321cf16..a889b90ab 100644
 {
 	enumerator_t *enumerator;
 	entry_t *entry;
-@@ -1496,7 +1519,16 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
+@@ -1506,7 +1529,16 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
 	u_int segment;
 	int i;
 
@@ -489,7 +479,7 @@ index b6321cf16..a889b90ab 100644
 
 	if (!this->reuse_ikesa && peer_cfg->get_ike_version(peer_cfg) != IKEV1)
 	{	/* IKE_SA reuse disabled by config (not possible for IKEv1) */
-@@ -1554,6 +1586,15 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
+@@ -1564,6 +1596,15 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
 			continue;
 		}
 
@@ -505,7 +495,7 @@ index b6321cf16..a889b90ab 100644
 		current_peer = entry->ike_sa->get_peer_cfg(entry->ike_sa);
 		if (current_peer && current_peer->equals(current_peer, peer_cfg))
 		{
-@@ -1580,6 +1621,10 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
+@@ -1590,6 +1631,10 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
 		{
 			ike_sa->set_peer_cfg(ike_sa, peer_cfg);
 			checkout_new(this, ike_sa);
@@ -517,10 +507,10 @@ index b6321cf16..a889b90ab 100644
 	}
 	charon->bus->set_sa(charon->bus, ike_sa);
 diff --git a/src/libcharon/sa/ike_sa_manager.h b/src/libcharon/sa/ike_sa_manager.h
-index 318620be0..f40eeb74e 100644
+index d87ba2d68..ba4f2c7e7 100644
 --- a/src/libcharon/sa/ike_sa_manager.h
 +++ b/src/libcharon/sa/ike_sa_manager.h
-@@ -109,7 +109,8 @@ struct ike_sa_manager_t {
+@@ -122,7 +122,8 @@ struct ike_sa_manager_t {
 	ike_sa_t* (*checkout_by_message) (ike_sa_manager_t* this, message_t *message);
 
 	/**
@@ -530,7 +520,7 @@ index 318620be0..f40eeb74e 100644
 	 *
 	 * To initiate, a CHILD_SA may be established within an existing IKE_SA.
 	 * This call checks for an existing IKE_SA by comparing the configuration.
-@@ -122,9 +123,12 @@ struct ike_sa_manager_t {
+@@ -135,9 +136,12 @@ struct ike_sa_manager_t {
 	 * @note The peer_config is always set on the returned IKE_SA.
 	 *
 	 * @param peer_cfg			configuration used to find an existing IKE_SA
@@ -545,10 +535,10 @@ index 318620be0..f40eeb74e 100644
 	/**
 	 * Reset initiator SPI.
 diff --git a/src/libcharon/sa/trap_manager.c b/src/libcharon/sa/trap_manager.c
-index f9f78acab..555e28ab6 100644
+index e45c8ff3f..58a956a78 100644
 --- a/src/libcharon/sa/trap_manager.c
 +++ b/src/libcharon/sa/trap_manager.c
-@@ -432,7 +432,7 @@ METHOD(trap_manager_t, acquire, void,
+@@ -522,7 +522,7 @@ METHOD(trap_manager_t, acquire, void,
 	peer_cfg_t *peer;
 	child_cfg_t *child;
 	ike_sa_t *ike_sa;
@@ -557,7 +547,7 @@ index f9f78acab..555e28ab6 100644
 	bool wildcard, ignore = FALSE;
 
 	this->lock->read_lock(this->lock);
-@@ -508,36 +508,26 @@ METHOD(trap_manager_t, acquire, void,
+@@ -599,36 +599,26 @@ METHOD(trap_manager_t, acquire, void,
 	this->lock->unlock(this->lock);
 
 	if (wildcard)
@@ -578,17 +568,17 @@ index f9f78acab..555e28ab6 100644
 +		uint8_t mask;
 
 -			port = ike_cfg->get_other_port(ike_cfg);
-			dst->to_subnet(dst, &host, &mask);
+-			data->dst->to_subnet(data->dst, &host, &mask);
 -			host->set_port(host, port);
 -			ike_sa->set_other_host(ike_sa, host);
 +		ike_cfg = peer->get_ike_cfg(peer);
 
 -			port = ike_cfg->get_my_port(ike_cfg);
-			src->to_subnet(src, &host, &mask);
+-			data->src->to_subnet(data->src, &host, &mask);
 -			host->set_port(host, port);
 -			ike_sa->set_my_host(ike_sa, host);
 +		port = ike_cfg->get_other_port(ike_cfg);
-+		dst->to_subnet(dst, &other_host, &mask);
+		data->dst->to_subnet(data->dst, &other_host, &mask);
 +		other_host->set_port(other_host, port);
 
 -			charon->bus->set_sa(charon->bus, ike_sa);
@@ -599,7 +589,7 @@ index f9f78acab..555e28ab6 100644
 -		ike_sa = charon->ike_sa_manager->checkout_by_config(
 -											charon->ike_sa_manager, peer);
 +		port = ike_cfg->get_my_port(ike_cfg);
-+		src->to_subnet(src, &my_host, &mask);
+		data->src->to_subnet(data->src, &my_host, &mask);
 +		my_host->set_port(my_host, port);
 	}
 +	ike_sa = charon->ike_sa_manager->checkout_by_config(
@@ -690,5 +680,5 @@ index 8ade8bf41..03b2cb0f4 100644
 			{"raw",			'r', 0, "dump raw response message"},
 			{"pretty",		'P', 0, "dump raw response message in pretty print"},
 -- 
-2.31.1
+2.36.1

--- a/0002-vici-send-certificates-for-ike-sa-events.patch
+++ b/0002-vici-send-certificates-for-ike-sa-events.patch
@@ -1,7 +1,7 @@
-From e5589f7a7ddeac0de425783275d38327279eff4f Mon Sep 17 00:00:00 2001
+From d357d62bf0661294e063cec94d48ca929f119351 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
 Date: Mon, 21 Sep 2015 13:42:05 +0300
-Subject: [PATCH 2/4] vici: send certificates for ike-sa events
+Subject: [PATCH 2/3] vici: send certificates for ike-sa events
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -12,10 +12,10 @@ Signed-off-by: Timo Teräs <timo.teras@iki.fi>
 1 file changed, 42 insertions(+), 8 deletions(-)

 diff --git a/src/libcharon/plugins/vici/vici_query.c b/src/libcharon/plugins/vici/vici_query.c
-index fb65b1447..9a0dc1c8b 100644
+index c35f4e1a9..001631e99 100644
 --- a/src/libcharon/plugins/vici/vici_query.c
 +++ b/src/libcharon/plugins/vici/vici_query.c
-@@ -379,7 +379,7 @@ static void list_vips(private_vici_query_t *this, vici_builder_t *b,
+@@ -403,7 +403,7 @@ static void list_vips(private_vici_query_t *this, vici_builder_t *b,
  * List details of an IKE_SA
  */
 static void list_ike(private_vici_query_t *this, vici_builder_t *b,
@@ -24,7 +24,7 @@ index fb65b1447..9a0dc1c8b 100644
 {
 	time_t t;
 	ike_sa_id_t *id;
-@@ -388,6 +388,8 @@ static void list_ike(private_vici_query_t *this, vici_builder_t *b,
+@@ -412,6 +412,8 @@ static void list_ike(private_vici_query_t *this, vici_builder_t *b,
 	uint32_t if_id;
 	uint16_t alg, ks;
 	host_t *host;
@@ -33,7 +33,7 @@ index fb65b1447..9a0dc1c8b 100644
 
 	b->add_kv(b, "uniqueid", "%u", ike_sa->get_unique_id(ike_sa));
 	b->add_kv(b, "version", "%u", ike_sa->get_version(ike_sa));
-@@ -397,11 +399,43 @@ static void list_ike(private_vici_query_t *this, vici_builder_t *b,
+@@ -421,11 +423,43 @@ static void list_ike(private_vici_query_t *this, vici_builder_t *b,
 	b->add_kv(b, "local-host", "%H", host);
 	b->add_kv(b, "local-port", "%d", host->get_port(host));
 	b->add_kv(b, "local-id", "%Y", ike_sa->get_my_id(ike_sa));
@@ -77,7 +77,7 @@ index fb65b1447..9a0dc1c8b 100644
 
 	eap = ike_sa->get_other_eap_id(ike_sa);
 
-@@ -532,7 +566,7 @@ CALLBACK(list_sas, vici_message_t*,
+@@ -557,7 +591,7 @@ CALLBACK(list_sas, vici_message_t*,
 		b = vici_builder_create();
 		b->begin_section(b, ike_sa->get_name(ike_sa));
 
@@ -86,7 +86,7 @@ index fb65b1447..9a0dc1c8b 100644
 
 		b->begin_section(b, "child-sas");
 		csas = ike_sa->create_child_sa_enumerator(ike_sa);
-@@ -1719,7 +1753,7 @@ METHOD(listener_t, ike_updown, bool,
+@@ -1775,7 +1809,7 @@ METHOD(listener_t, ike_updown, bool,
 	}
 
 	b->begin_section(b, ike_sa->get_name(ike_sa));
@@ -95,7 +95,7 @@ index fb65b1447..9a0dc1c8b 100644
 	b->end_section(b);
 
 	this->dispatcher->raise_event(this->dispatcher,
-@@ -1744,10 +1778,10 @@ METHOD(listener_t, ike_rekey, bool,
+@@ -1800,10 +1834,10 @@ METHOD(listener_t, ike_rekey, bool,
 	b = vici_builder_create();
 	b->begin_section(b, old->get_name(old));
 	b->begin_section(b, "old");
@@ -108,7 +108,7 @@ index fb65b1447..9a0dc1c8b 100644
 	b->end_section(b);
 	b->end_section(b);
 
-@@ -1778,7 +1812,7 @@ METHOD(listener_t, ike_update, bool,
+@@ -1834,7 +1868,7 @@ METHOD(listener_t, ike_update, bool,
 	b->add_kv(b, "remote-port", "%d", remote->get_port(remote));
 
 	b->begin_section(b, ike_sa->get_name(ike_sa));
@@ -117,7 +117,7 @@ index fb65b1447..9a0dc1c8b 100644
 	b->end_section(b);
 
 	this->dispatcher->raise_event(this->dispatcher,
-@@ -1808,7 +1842,7 @@ METHOD(listener_t, child_updown, bool,
+@@ -1864,7 +1898,7 @@ METHOD(listener_t, child_updown, bool,
 	}
 
 	b->begin_section(b, ike_sa->get_name(ike_sa));
@@ -126,7 +126,7 @@ index fb65b1447..9a0dc1c8b 100644
 	b->begin_section(b, "child-sas");
 
 	snprintf(buf, sizeof(buf), "%s-%u", child_sa->get_name(child_sa),
-@@ -1843,7 +1877,7 @@ METHOD(listener_t, child_rekey, bool,
+@@ -1899,7 +1933,7 @@ METHOD(listener_t, child_rekey, bool,
 	b = vici_builder_create();
 
 	b->begin_section(b, ike_sa->get_name(ike_sa));
@@ -136,5 +136,5 @@ index fb65b1447..9a0dc1c8b 100644
 
 	b->begin_section(b, old->get_name(old));
 -- 
-2.31.1
+2.36.1

--- a/0003-vici-add-support-for-individual-sa-state-changes.patch
+++ b/0003-vici-add-support-for-individual-sa-state-changes.patch
@@ -1,7 +1,7 @@
-From faa75e58ec73dc70ba296a2ec534f2f87550c960 Mon Sep 17 00:00:00 2001
+From 0a5809a8807c5160ee86da2c1c1586b23d98f04e Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
 Date: Mon, 21 Sep 2015 13:42:11 +0300
-Subject: [PATCH 3/4] vici: add support for individual sa state changes
+Subject: [PATCH 3/3] vici: add support for individual sa state changes
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -14,10 +14,10 @@ Signed-off-by: Timo Teräs <timo.teras@iki.fi>
 1 file changed, 106 insertions(+)

 diff --git a/src/libcharon/plugins/vici/vici_query.c b/src/libcharon/plugins/vici/vici_query.c
-index 9a0dc1c8b..b213ba432 100644
+index 001631e99..8010d8da8 100644
 --- a/src/libcharon/plugins/vici/vici_query.c
 +++ b/src/libcharon/plugins/vici/vici_query.c
-@@ -1719,8 +1719,16 @@ static void manage_commands(private_vici_query_t *this, bool reg)
+@@ -1775,8 +1775,16 @@ static void manage_commands(private_vici_query_t *this, bool reg)
 	this->dispatcher->manage_event(this->dispatcher, "ike-updown", reg);
 	this->dispatcher->manage_event(this->dispatcher, "ike-rekey", reg);
 	this->dispatcher->manage_event(this->dispatcher, "ike-update", reg);
@@ -34,7 +34,7 @@ index 9a0dc1c8b..b213ba432 100644
 	manage_command(this, "list-sas", list_sas, reg);
 	manage_command(this, "list-policies", list_policies, reg);
 	manage_command(this, "list-conns", list_conns, reg);
-@@ -1821,6 +1829,46 @@ METHOD(listener_t, ike_update, bool,
+@@ -1877,6 +1885,46 @@ METHOD(listener_t, ike_update, bool,
 	return TRUE;
 }
 
@@ -81,7 +81,7 @@ index 9a0dc1c8b..b213ba432 100644
 METHOD(listener_t, child_updown, bool,
 	private_vici_query_t *this, ike_sa_t *ike_sa, child_sa_t *child_sa, bool up)
 {
-@@ -1900,6 +1948,62 @@ METHOD(listener_t, child_rekey, bool,
+@@ -1956,6 +2004,62 @@ METHOD(listener_t, child_rekey, bool,
 	return TRUE;
 }
 
@@ -144,7 +144,7 @@ index 9a0dc1c8b..b213ba432 100644
 METHOD(vici_query_t, destroy, void,
 	private_vici_query_t *this)
 {
-@@ -1920,8 +2024,10 @@ vici_query_t *vici_query_create(vici_dispatcher_t *dispatcher)
+@@ -1976,8 +2080,10 @@ vici_query_t *vici_query_create(vici_dispatcher_t *dispatcher)
 				.ike_updown = _ike_updown,
 				.ike_rekey = _ike_rekey,
 				.ike_update = _ike_update,
@@ -156,5 +156,5 @@ index 9a0dc1c8b..b213ba432 100644
 			.destroy = _destroy,
 		},
 -- 
-2.31.1
+2.36.1

--- a/0004-vyos-terminate-connections-source-dest.patch
+++ b/0004-vyos-terminate-connections-source-dest.patch
@@ -1,124 +0,0 @@
-From 1057ecaa416c81b0e3fd4b26e1c8c301d1749ecb Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Zoran=20Peri=C4=8Di=C4=87?= <zpericic@netst.org>
-Date: Wed, 22 Jan 2020 13:12:39 +0100
-Subject: [PATCH 4/4] vyos-terminate-connections-source-dest
-
---
- src/libcharon/plugins/vici/vici_control.c | 27 ++++++++++++++++++++---
- src/swanctl/commands/terminate.c          | 18 ++++++++++++++-
- 2 files changed, 41 insertions(+), 4 deletions(-)
-
-diff --git a/src/libcharon/plugins/vici/vici_control.c b/src/libcharon/plugins/vici/vici_control.c
-index 4c00c2be5..8936e93ae 100644
--- a/src/libcharon/plugins/vici/vici_control.c
-+++ b/src/libcharon/plugins/vici/vici_control.c
-@@ -278,12 +278,13 @@ CALLBACK(terminate, vici_message_t*,
- 	private_vici_control_t *this, char *name, u_int id, vici_message_t *request)
- {
- 	enumerator_t *enumerator, *isas, *csas;
-	char *child, *ike, *errmsg = NULL;
-+	char *child, *ike, *errmsg = NULL, *my_host_str, *other_host_str;
- 	u_int child_id, ike_id, current, *del, done = 0;
- 	bool force;
- 	int timeout;
- 	ike_sa_t *ike_sa;
- 	child_sa_t *child_sa;
-+	host_t *my_host = NULL, *other_host = NULL;
- 	array_t *ids;
- 	vici_builder_t *builder;
- 	controller_cb_t log_cb = NULL;
-@@ -299,12 +300,23 @@ CALLBACK(terminate, vici_message_t*,
- 	force = request->get_bool(request, FALSE, "force");
- 	timeout = request->get_int(request, 0, "timeout");
- 	log.level = request->get_int(request, 1, "loglevel");
-+	my_host_str = request->get_str(request, NULL, "my-host");
-+	other_host_str = request->get_str(request, NULL, "other-host");
- 
-	if (!child && !ike && !ike_id && !child_id)
-+	if (!child && !ike && !ike_id && !child_id && !my_host_str &&!other_host_str)
- 	{
- 		return send_reply(this, "missing terminate selector");
- 	}
-
-+	if (my_host_str && !other_host_str || other_host_str && !my_host_str)
-+	{
-+		return send_reply(this, "missing source or remote");
-+	}
-+	else
-+	{
-+		my_host = host_create_from_string(my_host_str, 0);
-+		other_host = host_create_from_string(other_host_str, 0);
-+		DBG1(DBG_CFG, "vici terminate with source me %H and other %H", my_host, other_host);
-+	}
- 	if (ike_id)
- 	{
- 		DBG1(DBG_CFG, "vici terminate IKE_SA #%d", ike_id);
-@@ -367,6 +379,15 @@ CALLBACK(terminate, vici_message_t*,
- 		{
- 			array_insert(ids, ARRAY_TAIL, &ike_id);
- 		}
-+		else if (my_host && other_host)
-+		{
-+			if (!my_host->ip_equals(my_host, ike_sa->get_my_host(ike_sa)) || !other_host->ip_equals(other_host, ike_sa->get_other_host(ike_sa)))
-+			{
-+				continue;
-+			}
-+			current = ike_sa->get_unique_id(ike_sa);
-+			array_insert(ids, ARRAY_TAIL, &current);
-+		}
- 	}
- 	isas->destroy(isas);
- 
-diff --git a/src/swanctl/commands/terminate.c b/src/swanctl/commands/terminate.c
-index 2309843b2..37d0bde3f 100644
--- a/src/swanctl/commands/terminate.c
-+++ b/src/swanctl/commands/terminate.c
-@@ -37,7 +37,7 @@ static int terminate(vici_conn_t *conn)
- 	vici_req_t *req;
- 	vici_res_t *res;
- 	command_format_options_t format = COMMAND_FORMAT_NONE;
-	char *arg, *child = NULL, *ike = NULL;
-+	char *arg, *child = NULL, *ike = NULL, *my_host = NULL, *other_host = NULL;
- 	int ret = 0, timeout = 0, level = 1, child_id = 0, ike_id = 0;
- 	bool force = FALSE;
- 
-@@ -74,6 +74,12 @@ static int terminate(vici_conn_t *conn)
- 			case 'l':
- 				level = atoi(arg);
- 				continue;
-+			case 'S':
-+				my_host = arg;
-+				continue;
-+			case 'R':
-+				other_host = arg;
-+				continue;
- 			case EOF:
- 				break;
- 			default:
-@@ -109,6 +115,14 @@ static int terminate(vici_conn_t *conn)
- 	{
- 		vici_add_key_valuef(req, "force", "yes");
- 	}
-+	if (my_host)
-+	{
-+		vici_add_key_valuef(req, "my-host", "%s", my_host);
-+	}
-+	if (other_host)
-+	{
-+		vici_add_key_valuef(req, "other-host", "%s", other_host);
-+	}
- 	if (timeout)
- 	{
- 		vici_add_key_valuef(req, "timeout", "%d", timeout * 1000);
-@@ -155,6 +169,8 @@ static void __attribute__ ((constructor))reg()
- 		{
- 			{"help",		'h', 0, "show usage information"},
- 			{"child",		'c', 1, "terminate by CHILD_SA name"},
-+			{"source",		'S', 1, "override source address"},
-+			{"remote",		'R', 1, "override remote address"},
- 			{"ike",			'i', 1, "terminate by IKE_SA name"},
- 			{"child-id",	'C', 1, "terminate by CHILD_SA reqid"},
- 			{"ike-id",		'I', 1, "terminate by IKE_SA unique identifier"},
-- 
-2.31.1
-
--- a/48
+++ b/48
@@ -0,0 +1,48 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQGNBEoycP0BDACzL8ymURD7gnaNbGx2VGieNQr/gNISWhqgHaeUxuSkrInxl89A
+ClvN7DoF2cD7slEqIMQh/8t6xVzmh9teu5uyeV1eyG/CuFMUqawXqpn/sYa2SkgX
+C/qHB2hIbFg2K4k5LJHxzqHb1OdtOcU6lHg9yrvYcoO+FTVR+rYaVgYbbbziTB/v
+hAAzvdTdgwMgoQMSXA7FsJ0mALny4IeiCoi6S6qRVDm4zcu11UFT9g1VmhmeHqtU
+SQso72bPKKhYvu7ZaQrLhkvY9inWr6m9dxV8Zgb1ivZGhzsNzrhGAsz9jmiB5POF
+Mfph0hREMiS33ph/YMJducGQHYGEza9mKBdUaaAAEL3fCpde7vRa+c5Gc/Y5RUB7
+iUsb2KQY+7xTiSUnCHbsMwhndG0dJspVXcz6X+2S3Ty4GaiqkvxI9KLiwiECNl0I
+oLX5s/FIW6KW+GnxJTp/3h6vvqm8i0+yIwk+ETM4XfhHMwuPkDyf6km1ag3nIUw6
+pSSfnQMPhj5rXIMAEQEAAbQwQW5kcmVhcyBTdGVmZmVuIDxhbmRyZWFzLnN0ZWZm
+ZW5Ac3Ryb25nc3dhbi5vcmc+iQG3BBMBAgAhBQJKMnD9AhsDBwsJCAcDAgEEFQII
+AwQWAgMBAh4BAheAAAoJEN9CwXCzTbp3t5AL/jrXnnGIHLn8M9rmyoeNe7JQUE5A
+GSV3UFaZHgHmjbvIHA+dRvh1MPlHuWbaZkHVPtRFvFtEgksc944+XcKoNoExKGKr
+wLQcUExUiQ0IyNwH70u7f1uFNcbY85Oue5ASzm+wAntnmIlNsN+MHewRWC6f6gYn
+1aHwsvh09fz0A34v9wdtim2ek/Voxe3AIDIw2MTNmwF61pXEsrH0wqYnGhYLZ7Qb
+thnDnHQaUd3IPSa6uAgOOiCoCbKCvP4u/iVm0rmXN9uzmm/i4Y0cE3DopGsqrR5D
+fWYJjgP4KBCln0LgWtYI8pcYcmA5E+l+fijNcMidtzWHMW2Mj0oZZsO+wlRUYLGh
+/jRASgq7rXuxV+oGKcBn4RqSHlZ5/BYlvowUxnNFC4tLLlneHidS8TurjacM3fwR
+MP5NMmcS5d9sVLG1uxl+/g2cRMtphHiziz+79jDc+tSxqRO5lhqyItAD6LC2GxB3
+iC5afnMx49+YWzhUTeL/KfkrD9w3/n7O00kLtLkDDQRKjOHDEAwAxdh8W7j/QhE3
+KZNmJGsK/QtJ72zZRGRcdUPH6GG//GaAG5hSCjM8q+0MR/G+31uk32RbzRIj1sHQ
+8fY0znxPmaeD1wow0hCbDTq+Ep3K8ouaqoqjlP4rd+I94OtxNfXgmllf7BDOZ6lI
+wUY8ba8cFCPYsv8ZvRXo82XfwFYevQ9kTLqkJT52mMyPZLwYx4DNwuqFtQQEBLKg
+IVXVgpK6SE72MFP8vyFsdrL0ORgxoWI6PIHbnIRY1KiWUzOSrqirZUHH9MPuzFuB
+R0+jEAajeKoxycn0ILLM5PBAEFXFgBdtNNCtshe1fR5aPsXcGZsZRjc7mbAHLRqa
+pVhk7oX31WrGqGHkSM/GAnf3aAzsnCkO5+Tje2iyuoG5OhQbHsvMBOtdvQrwnorl
+56EguzuK1mGDsczNsuAYRcKiasCWpsjoytDH+dGEQmKXydD9r06cxPx+mWmWKLo4
+w+k4mMC0lFRYKi83cwTpaMpHOeW4+3d1tJfkCQy+vjUz4aZJ/WSXAAMFDACqmeXA
+Al7WssHkjVZ/vwQfHLHNMZsGEEucvV7KNqMF4Fe6nRbbE6GJOuz6taeFkJIppBqV
+xhSNOsf5soOXfGp0IgYoC37GPI6AAb4UnG5GVcaAMQAXUYcwfDGGuV/EO5pPrEyP
+jy++GvjhxcKV3HmUuAfcgyhTGhDOVPxU28Roz3+8Eig085v+lyqAsgFduBrf+ZV+
+lHjIOSXSWmTiT8EVSA3fpN14/qhltudhdGIZ/pCW303H9Bd9c4Uc9OzYhRr1VpO6
+lpYfTFNey8KQL4z9Kjt0RPscz2hYDOJ1cTFWs/4Z+9mBJODwrnIiORLlgV2NlP5E
+ZY4MccVFd9K7E/OPQdt3Uv6+6BjYRntY7wsX617T5Rmj8n6AhbpngmWg2D6wRfm7
+TyI0Wtz5icCoJIEHQwB/3EhBzQl7tBc0cClwCYm7nTYRt+SL2tfylWy9Leail+ay
+M6zwMW0klV42E4u8DCy/aJrwmEiVwuwGbXL6z46M9EZguof38MTEmLsHls+JAZ8E
+GAECAAkFAkqM4cMCGwwACgkQ30LBcLNNunffBgv/b/v3eQoZTWgOB5MnXhIrg/Ki
+kYTYbnEG9wWM7XIST8bpP7f/UKyD44CCVJH7SVTGAXeyjglnuYXy4FwaTdFmm6al
+W0sCp4rnmADi5BLLzQlCUa5J0iZ+oAZnAH60BezUM+CYz/QBW3NJmP3323PeM4H4
+MZ0vLv3wgaLkFlaK/eASBoC7KuZWAnvsNOdLQ29L4BYgW2Jwk1+PxszjT369DsMU
+Y3iY6gM9rM71Ajd8x98hd1r26LILGntAEEXxs+13Kka7J4GCqf8/J9ZR01dDp8QM
+M9EHFLnthpAyUuSXm5Qlglavnf7tU6AA0SFuA0pP5CXVLG1DLT1fJvNOqjdzPsf
+u/48AM2Lpxj0gKt1yDQc890GxwnOL1iZ6+XMh9/ujWy7Q7dI4M2mthwYFXldWrPS
+CmMToWfl62BxPdY5FIECXeRwTIO9sI0LQVc2eAG8lDsge05q1nJFxo9WKr7ewAdF
+b/fMIr7XMwoMj2SQSy/tZVCBnDXR5Gw5HSxRnIAS
+=ze82
+-----END PGP PUBLIC KEY BLOCK-----
--- a/3
+++ b/3
@@ -1 +1,2 @@
-SHA512 (strongswan-5.9.4.tar.bz2) = 796356c1d5c1ad410f0ed944ab4a131076d26f120ec6fa57796fe4060b0741201199625883ddc9ebd8a7ad299495f073cec76a6780ebd8f375605aae16750cf3
+SHA512 (strongswan-5.9.9.tar.bz2) = 7f5d94527193ce7716292f30db75303a0594169647e41e8c9530a7dedd914ad7fecf94885356738fd54d3781a066fa591c621d531923b20780b1fca76ad7bd46
+SHA512 (strongswan-5.9.9.tar.bz2.sig) = b2aba6e7cf1add4cf1c891dbd77e658d338c80abb2a1c6efcf5a23c65ff71d6b63857daa6613fae21b4d23adc0ef0df9d6e245198cd799bdf5534da097050d0e
--- a/strongswan-5.9.7-error-no-format.patch
+++ b/strongswan-5.9.7-error-no-format.patch
@@ -0,0 +1,12 @@
+diff --git a/configure.ac b/configure.ac
+index f9e6e55c2..247d055d8 100644
+--- a/configure.ac
+++ b/configure.ac
+@@ -1480,7 +1480,6 @@ else
+ fi
+ # disable some warnings, whether explicitly enabled above or by default
+ # these are not compatible with our custom printf specifiers
+-WARN_CFLAGS="$WARN_CFLAGS -Wno-format"
+ WARN_CFLAGS="$WARN_CFLAGS -Wno-format-security"
+ # we generally use comments, but GCC doesn't seem to recognize many of them
+ WARN_CFLAGS="$WARN_CFLAGS -Wno-implicit-fallthrough"
--- a/strongswan-5.9.9-man-paths.patch
+++ b/strongswan-5.9.9-man-paths.patch
@@ -0,0 +1,348 @@
+From 111cbd3d2ca4385d326db333ee86843ada652663 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Mon, 16 Jan 2023 19:38:17 +0100
+Subject: [PATCH] Make manual paths follow build configuration
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Use build-configured paths in manual pages instead of default values.
+Makes easier customization to non-default values as done on Fedora for
+example.
+
+Squashed commit of the following:
+
+commit e99de2aee9f26e3ab97d88902308107d9f048acd
+Merge: 8effb06d6 29e324709
+Author: Tobias Brunner <tobias@strongswan.org>
+Date:   Mon Jan 16 11:41:17 2023 +0100
+
+    Merge branch 'man-sysconfdir'
+
+    Closes strongswan/strongswan#1511
+
+commit 29e32470974aea614c2486c2982767bd62670063
+Author: Tobias Brunner <tobias@strongswan.org>
+Date:   Mon Jan 16 11:39:29 2023 +0100
+
+    swanctl: Don't use hard-coded path to sysconfdir
+
+commit 1c0b14baa3c04606ad9357dfc658d11f0f96ca65
+Author: Tobias Brunner <tobias@strongswan.org>
+Date:   Mon Jan 16 11:37:27 2023 +0100
+
+    conf: Add swanctl.conf and swanctl man pages to SEE ALSO
+
+commit 7e43a5f3d28424abfb648b7afd24e25a042efd24
+Author: Tobias Brunner <tobias@strongswan.org>
+Date:   Mon Jan 16 11:35:42 2023 +0100
+
+    conf: Replace hard-coded /etc where appropriate
+
+    Also document the actual value of ${sysconfdir}.
+
+commit ee046552bb1f3c98d89837d58f7da7d83c8fbb82
+Author: Petr Menšík <pemensik@redhat.com>
+Date:   Sun Jan 15 16:55:45 2023 +0100
+
+    man: Use configured path for config files in man pages
+
+commit ab4ed21b5cb28eafbc29b09523b062bee159a0d0
+Author: Petr Menšík <pemensik@redhat.com>
+Date:   Sun Jan 15 16:17:07 2023 +0100
+
+    ipsec: Include IPSEC_CONFDIR variable replacement in man page
+
+    Fedora has chosena different default directory to avoid conflicts with
+    libreswan. Use ${sysconfdir} variable to provide the correct location.
+---
+ conf/options/charon.opt            |  4 ++--
+ conf/plugins/unbound.opt           |  2 +-
+ conf/strongswan.conf.5.tail.in     | 10 ++++++----
+ man/ipsec.conf.5.in                | 22 +++++++++++-----------
+ man/ipsec.secrets.5.in             |  8 ++++----
+ src/ipsec/Makefile.am              |  1 +
+ src/ipsec/_ipsec.8.in              | 20 ++++++++++----------
+ src/swanctl/swanctl.conf.5.tail.in |  2 +-
+ 8 files changed, 36 insertions(+), 33 deletions(-)
+
+diff --git a/conf/options/charon.opt b/conf/options/charon.opt
+index 00949222a..72efd17de 100644
+--- a/conf/options/charon.opt
+++ b/conf/options/charon.opt
+@@ -38,8 +38,8 @@ charon.cert_cache = yes
+ charon.cache_crls = no
+ 	Whether Certificate Revocation Lists (CRLs) fetched via HTTP or LDAP should
+ 	be saved under a unique file name derived from the public key of the
+-	Certification Authority (CA) to **/etc/ipsec.d/crls** (stroke) or
+-	**/etc/swanctl/x509crl** (vici), respectively.
+	Certification Authority (CA) to **${sysconfdir}/ipsec.d/crls** (stroke) or
+	**${sysconfdir}/swanctl/x509crl** (vici), respectively.
+ 
+ charon.check_current_path = no
+ 	Whether to use DPD to check if the current path still works after any
+diff --git a/conf/plugins/unbound.opt b/conf/plugins/unbound.opt
+index f8ca9ca12..007797310 100644
+--- a/conf/plugins/unbound.opt
+++ b/conf/plugins/unbound.opt
+@@ -1,7 +1,7 @@
+ charon.plugins.unbound.resolv_conf = /etc/resolv.conf
+ 	File to read DNS resolver configuration from.
+ 
+-charon.plugins.unbound.trust_anchors = /etc/ipsec.d/dnssec.keys
+charon.plugins.unbound.trust_anchors = ${sysconfdir}/ipsec.d/dnssec.keys
+ 	File to read DNSSEC trust anchors from (usually root zone KSK).
+ 
+ 	File to read DNSSEC trust anchors from (usually root zone KSK). The format
+diff --git a/conf/strongswan.conf.5.tail.in b/conf/strongswan.conf.5.tail.in
+index baad476d1..74bbd8eec 100644
+--- a/conf/strongswan.conf.5.tail.in
+++ b/conf/strongswan.conf.5.tail.in
+@@ -458,6 +458,7 @@ The variables used above are configured as follows:
+ .na
+ ${piddir}               @piddir@
+ ${prefix}               @prefix@
+${sysconfdir}           @sysconfdir@
+ ${random_device}        @random_device@
+ ${urandom_device}       @urandom_device@
+ .ad
+@@ -467,18 +468,19 @@ ${urandom_device}       @urandom_device@
+ .
+ .nf
+ .na
+-/etc/strongswan.conf       configuration file
+-/etc/strongswan.d/         directory containing included config snippets
+-/etc/strongswan.d/charon/  plugin specific config snippets
+@sysconfdir@/strongswan.conf       configuration file
+@sysconfdir@/strongswan.d/         directory containing included config snippets
+@sysconfdir@/strongswan.d/charon/  plugin specific config snippets
+ .ad
+ .fi
+ .
+ .SH SEE ALSO
+\fBswanctl.conf\fR(5), \fBswanctl\fR(8),
+ \fBipsec.conf\fR(5), \fBipsec.secrets\fR(5), \fBipsec\fR(8), \fBcharon-cmd\fR(8)
+ 
+ .SH HISTORY
+ Written for the
+-.UR http://www.strongswan.org
+.UR https://www.strongswan.org
+ strongSwan project
+ .UE
+ by Tobias Brunner, Andreas Steffen and Martin Willi.
+diff --git a/man/ipsec.conf.5.in b/man/ipsec.conf.5.in
+index ced12680f..4e256538e 100644
+--- a/man/ipsec.conf.5.in
+++ b/man/ipsec.conf.5.in
+@@ -690,7 +690,7 @@ but for the second authentication round (IKEv2 only).
+ .BR leftcert " = <path>"
+ the path to the left participant's X.509 certificate. The file can be encoded
+ either in PEM or DER format. OpenPGP certificates are supported as well.
+-Both absolute paths or paths relative to \fI/etc/ipsec.d/certs\fP
+Both absolute paths or paths relative to \fI@sysconfdir@/ipsec.d/certs\fP
+ are accepted. By default
+ .B leftcert
+ sets
+@@ -871,7 +871,7 @@ prefix in front of 0x or 0s, the public key is expected to be in either
+ the RFC 3110 (not the full RR, only RSA key part) or RFC 4253 public key format,
+ respectively.
+ Also accepted is the path to a file containing the public key in PEM, DER or SSH
+-encoding. Both absolute paths or paths relative to \fI/etc/ipsec.d/certs\fP
+encoding. Both absolute paths or paths relative to \fI@sysconfdir@/ipsec.d/certs\fP
+ are accepted.
+ .TP
+ .BR leftsendcert " = never | no | " ifasked " | always | yes"
+@@ -1219,7 +1219,7 @@ of this connection will be used as peer ID.
+ .SH "CA SECTIONS"
+ These are optional sections that can be used to assign special
+ parameters to a Certification Authority (CA). Because the daemons
+-automatically import CA certificates from \fI/etc/ipsec.d/cacerts\fP,
+automatically import CA certificates from \fI@sysconfdir@/ipsec.d/cacerts\fP,
+ there is no need to explicitly add them with a CA section, unless you
+ want to assign special parameters (like a CRL) to a CA.
+ .TP
+@@ -1235,7 +1235,7 @@ currently can have either the value
+ .TP
+ .BR cacert " = <path>"
+ defines a path to the CA certificate either relative to
+-\fI/etc/ipsec.d/cacerts\fP or as an absolute path.
+\fI@sysconfdir@/ipsec.d/cacerts\fP or as an absolute path.
+ .br
+ A value in the form
+ .B %smartcard[<slot nr>[@<module>]]:<keyid>
+@@ -1284,7 +1284,7 @@ section are:
+ .BR cachecrls " = yes | " no
+ if enabled, certificate revocation lists (CRLs) fetched via HTTP or LDAP will
+ be cached in
+-.I /etc/ipsec.d/crls/
+.I @sysconfdir@/ipsec.d/crls/
+ under a unique file name derived from the certification authority's public key.
+ .TP
+ .BR charondebug " = <debug list>"
+@@ -1463,12 +1463,12 @@ time equals zero and, thus, rekeying gets disabled.
+ 
+ .SH FILES
+ .nf
+-/etc/ipsec.conf
+-/etc/ipsec.d/aacerts
+-/etc/ipsec.d/acerts
+-/etc/ipsec.d/cacerts
+-/etc/ipsec.d/certs
+-/etc/ipsec.d/crls
+@sysconfdir@/ipsec.conf
+@sysconfdir@/ipsec.d/aacerts
+@sysconfdir@/ipsec.d/acerts
+@sysconfdir@/ipsec.d/cacerts
+@sysconfdir@/ipsec.d/certs
+@sysconfdir@/ipsec.d/crls
+ 
+ .SH SEE ALSO
+ strongswan.conf(5), ipsec.secrets(5), ipsec(8)
+diff --git a/man/ipsec.secrets.5.in b/man/ipsec.secrets.5.in
+index 15e36faff..c54e1a18b 100644
+--- a/man/ipsec.secrets.5.in
+++ b/man/ipsec.secrets.5.in
+@@ -15,7 +15,7 @@ Here is an example.
+ .LP
+ .RS
+ .nf
+-# /etc/ipsec.secrets - strongSwan IPsec secrets file
+# @sysconfdir@/ipsec.secrets - strongSwan IPsec secrets file
+ 192.168.0.1 %any : PSK "v+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL"
+ 
+ : RSA moonKey.pem
+@@ -140,7 +140,7 @@ is interpreted as Base64 encoded binary data.
+ .TQ
+ .B : ECDSA <private key file> [ <passphrase> | %prompt ]
+ For the private key file both absolute paths or paths relative to
+-\fI/etc/ipsec.d/private\fP are accepted. If the private key file is
+\fI@sysconfdir@/ipsec.d/private\fP are accepted. If the private key file is
+ encrypted, the \fIpassphrase\fP must be defined. Instead of a passphrase
+ .B %prompt
+ can be used which then causes the daemon to ask the user for the password
+@@ -148,7 +148,7 @@ whenever it is required to decrypt the key.
+ .TP
+ .B : P12 <PKCS#12 file> [ <passphrase> | %prompt ]
+ For the PKCS#12 file both absolute paths or paths relative to
+-\fI/etc/ipsec.d/private\fP are accepted. If the container is
+\fI@sysconfdir@/ipsec.d/private\fP are accepted. If the container is
+ encrypted, the \fIpassphrase\fP must be defined. Instead of a passphrase
+ .B %prompt
+ can be used which then causes the daemon to ask the user for the password
+@@ -182,7 +182,7 @@ can be specified, which causes the daemon to ask the user for the pin code.
+ .LP
+ 
+ .SH FILES
+-/etc/ipsec.secrets
+@sysconfdir@/ipsec.secrets
+ .SH SEE ALSO
+ ipsec.conf(5), strongswan.conf(5), ipsec(8)
+ .br
+diff --git a/src/ipsec/Makefile.am b/src/ipsec/Makefile.am
+index 0ab9ab27c..656eba49b 100644
+--- a/src/ipsec/Makefile.am
+++ b/src/ipsec/Makefile.am
+@@ -10,6 +10,7 @@ _ipsec.8 : _ipsec.8.in
+ 	-e "s:@IPSEC_SCRIPT@:$(ipsec_script):g" \
+ 	-e "s:@IPSEC_SCRIPT_UPPER@:$(ipsec_script_upper):g" \
+ 	-e "s:@IPSEC_DIR@:$(ipsecdir):" \
+	-e "s:@IPSEC_CONFDIR@:$(sysconfdir):" \
+ 	$(srcdir)/$@.in > $@
+ 
+ _ipsec : _ipsec.in
+diff --git a/src/ipsec/_ipsec.8.in b/src/ipsec/_ipsec.8.in
+index bfc4d50c2..de00d3075 100644
+--- a/src/ipsec/_ipsec.8.in
+++ b/src/ipsec/_ipsec.8.in
+@@ -145,25 +145,25 @@ locally by the IKE daemon or received via the IKE protocol.
+ .TP
+ .BI "listcacerts [" --utc ]
+ returns a list of X.509 Certification Authority (CA) certificates that were
+-loaded locally by the IKE daemon from the \fI/etc/ipsec.d/cacerts/\fP
+loaded locally by the IKE daemon from the \fI@IPSEC_CONFDIR@/ipsec.d/cacerts/\fP
+ directory or received via the IKE protocol.
+ .
+ .TP
+ .BI "listaacerts [" --utc ]
+ returns a list of X.509 Authorization Authority (AA) certificates that were
+-loaded locally by the IKE daemon from the \fI/etc/ipsec.d/aacerts/\fP
+loaded locally by the IKE daemon from the \fI@IPSEC_CONFDIR@/ipsec.d/aacerts/\fP
+ directory.
+ .
+ .TP
+ .BI "listocspcerts [" --utc ]
+ returns a list of X.509 OCSP Signer certificates that were either loaded
+-locally by the IKE daemon from the \fI/etc/ipsec.d/ocspcerts/\fP
+locally by the IKE daemon from the \fI@IPSEC_CONFDIR@/ipsec.d/ocspcerts/\fP
+ directory or were sent by an OCSP server.
+ .
+ .TP
+ .BI "listacerts [" --utc ]
+ returns a list of X.509 Attribute certificates that were loaded locally by
+-the IKE daemon from the \fI/etc/ipsec.d/acerts/\fP directory.
+the IKE daemon from the \fI@IPSEC_CONFDIR@/ipsec.d/acerts/\fP directory.
+ .
+ .TP
+ .BI "listgroups [" --utc ]
+@@ -179,7 +179,7 @@ sections in \fIipsec.conf\fP.
+ .TP
+ .BI "listcrls [" --utc ]
+ returns a list of Certificate Revocation Lists (CRLs) that were either loaded
+-by the IKE daemon from the \fI/etc/ipsec.d/crls\fP directory or fetched from
+by the IKE daemon from the \fI@IPSEC_CONFDIR@/ipsec.d/crls\fP directory or fetched from
+ an HTTP- or LDAP-based CRL distribution point.
+ .
+ .TP
+@@ -211,7 +211,7 @@ flushes and rereads all secrets defined in \fIipsec.secrets\fP.
+ .TP
+ .B "rereadcacerts"
+ removes previously loaded CA certificates, reads all certificate files
+-contained in the \fI/etc/ipsec.d/cacerts\fP directory and adds them to the list
+contained in the \fI@IPSEC_CONFDIR@/ipsec.d/cacerts\fP directory and adds them to the list
+ of Certification Authority (CA) certificates. This does not affect certificates
+ explicitly defined in a
+ .BR ipsec.conf (5)
+@@ -220,23 +220,23 @@ ca section, which may be separately updated using the \fBupdate\fP command.
+ .TP
+ .B "rereadaacerts"
+ removes previously loaded AA certificates, reads all certificate files
+-contained in the \fI/etc/ipsec.d/aacerts\fP directory and adds them to the list
+contained in the \fI@IPSEC_CONFDIR@/ipsec.d/aacerts\fP directory and adds them to the list
+ of Authorization Authority (AA) certificates.
+ .
+ .TP
+ .B "rereadocspcerts"
+-reads all certificate files contained in the \fI/etc/ipsec.d/ocspcerts/\fP
+reads all certificate files contained in the \fI@IPSEC_CONFDIR@/ipsec.d/ocspcerts/\fP
+ directory and adds them to the list of OCSP signer certificates.
+ .
+ .TP
+ .B "rereadacerts"
+-reads all certificate files contained in the  \fI/etc/ipsec.d/acerts/\fP
+reads all certificate files contained in the  \fI@IPSEC_CONFDIR@/ipsec.d/acerts/\fP
+ directory and adds them to the list of attribute certificates.
+ .
+ .TP
+ .B "rereadcrls"
+ reads  all Certificate  Revocation Lists (CRLs) contained in the
+-\fI/etc/ipsec.d/crls/\fP directory and adds them to the list of CRLs.
+\fI@IPSEC_CONFDIR@/ipsec.d/crls/\fP directory and adds them to the list of CRLs.
+ .
+ .TP
+ .B "rereadall"
+diff --git a/src/swanctl/swanctl.conf.5.tail.in b/src/swanctl/swanctl.conf.5.tail.in
+index 4d24608da..036443843 100644
+--- a/src/swanctl/swanctl.conf.5.tail.in
+++ b/src/swanctl/swanctl.conf.5.tail.in
+@@ -2,7 +2,7 @@
+ .
+ .nf
+ .na
+-/etc/swanctl/swanctl.conf       configuration file
+@sysconfdir@/swanctl/swanctl.conf       configuration file
+ .ad
+ .fi
+ .
+-- 
+2.39.0
+
--- a/strongswan.spec
+++ b/strongswan.spec
@@ -2,44 +2,79 @@
 #%%define prerelease dr1
 %global dist .nhrp.9%{?dist}

+%bcond_without python3
+%bcond_without perl
+%bcond_with    check
+
+%if (0%{?fedora} && 0%{?fedora} < 36) || (0%{?rhel} && 0%{?rhel} < 9)
+# trousers was retired for F36+ and no longer available in RHEL with 9+
+%bcond_without tss_trousers
+%else
+%bcond_with tss_trousers
+%endif
+
+%global forgeurl0 https://github.com/strongswan/strongswan
+
 Name:           strongswan
-Version:        5.9.4
+Version:        5.9.9
 Release:        2%{?dist}
 Summary:        An OpenSource IPsec-based VPN and TNC solution
 License:        GPLv2+
-URL:            http://www.strongswan.org/
-Source0:        http://download.strongswan.org/strongswan-%{version}%{?prerelease}.tar.bz2
-Source1:        tmpfiles-strongswan.conf
+URL:            https://www.strongswan.org/
+VCS:            git:%{forgeurl0}
+Source0:        https://download.strongswan.org/strongswan-%{version}%{?prerelease}.tar.bz2
+Source1:        https://download.strongswan.org/strongswan-%{version}%{?prerelease}.tar.bz2.sig
+Source2:        https://download.strongswan.org/STRONGSWAN-RELEASE-PGP-KEY
+Source3:        tmpfiles-strongswan.conf
 Patch0:         strongswan-5.6.0-uintptr_t.patch
+# https://github.com/strongswan/strongswan/issues/1198
+Patch1:         strongswan-5.9.7-error-no-format.patch
+# https://github.com/strongswan/strongswan/pull/1511
+# https://github.com/strongswan/strongswan/commit/e99de2aee9f26e3ab97d88902308107d9f048acd
+Patch2:         strongswan-5.9.9-man-paths.patch

 Patch10:        0001-charon-add-optional-source-and-remote-overrides-for-.patch
 Patch11:        0002-vici-send-certificates-for-ike-sa-events.patch
 Patch12:        0003-vici-add-support-for-individual-sa-state-changes.patch
-Patch13:        0004-vyos-terminate-connections-source-dest.patch

-# only needed for pre-release versions
-#BuildRequires:  autoconf automake
-
-BuildRequires: make
+BuildRequires:  autoconf
+BuildRequires:  automake
+BuildRequires:  gnupg2
+BuildRequires:  make
 BuildRequires:  gcc
+BuildRequires:  systemd
 BuildRequires:  systemd-devel
+BuildRequires:  systemd-rpm-macros
 BuildRequires:  gmp-devel
 BuildRequires:  libcurl-devel
 BuildRequires:  openldap-devel
 BuildRequires:  openssl-devel
 BuildRequires:  sqlite-devel
 BuildRequires:  gettext-devel
-BuildRequires:  trousers-devel
 BuildRequires:  libxml2-devel
 BuildRequires:  pam-devel
 BuildRequires:  json-c-devel
 BuildRequires:  libgcrypt-devel
-BuildRequires:  systemd-devel
 BuildRequires:  iptables-devel
 BuildRequires:  libcap-devel
 BuildRequires:  tpm2-tss-devel
 Recommends:     tpm2-tools

+%if %{with python3}
+BuildRequires:  python3-devel
+BuildRequires:  python3-setuptools
+BuildRequires:  python3-pytest
+%endif
+
+%if %{with perl}
+BuildRequires:  perl-devel perl-macros
+BuildRequires:  perl(ExtUtils::MakeMaker)
+%endif
+
+%if %{with tss_trousers}
+BuildRequires:  trousers-devel
+%endif
+
 BuildRequires:  NetworkManager-libnm-devel
 Requires(post): systemd
 Requires(preun): systemd
@@ -86,14 +121,39 @@ modules can be used by any third party TNC Client/Server implementation
 possessing a standard IF-IMC/IMV interface. In addition, it implements
 PT-TLS to support TNC over TLS.

-%prep
-%setup -q -n %{name}-%{version}%{?prerelease}
-%patch0 -p1
+%if %{with python3}
+%package -n python3-vici
+Summary: Strongswan Versatile IKE Configuration Interface python bindings
+BuildArch: noarch
+%description -n python3-vici
+VICI is an attempt to improve the situation for system integrators by providing
+a stable IPC interface, allowing external tools to query, configure
+and control the IKE daemon.

-%patch10 -p1
-%patch11 -p1
-%patch12 -p1
-%patch13 -p1
+The Versatile IKE Configuration Interface (VICI) python bindings provides module
+for Strongswan runtime configuration from python applications.
+
+%endif
+
+%if %{with perl}
+%package -n perl-vici
+Summary: Strongswan Versatile IKE Configuration Interface perl bindings
+BuildArch: noarch
+%description -n perl-vici
+VICI is an attempt to improve the situation for system integrators by providing
+a stable IPC interface, allowing external tools to query, configure
+and control the IKE daemon.
+
+The Versatile IKE Configuration Interface (VICI) perl bindings provides module
+for Strongswan runtime configuration from perl applications.
+%endif
+
+# TODO: make also ruby-vici
+
+
+%prep
+%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
+%autosetup -n %{name}-%{version}%{?prerelease} -p1

 %build
 # only for snapshots
@@ -112,7 +172,7 @@ PT-TLS to support TNC over TLS.
    --with-piddir=%{_rundir}/strongswan \
    --with-nm-ca-dir=%{_sysconfdir}/strongswan/ipsec.d/cacerts/ \
    --enable-bypass-lan \
-    --enable-tss-trousers \
+    --enable-tss-tss2 \
    --enable-nm \
    --enable-systemd \
    --enable-openssl \
@@ -167,8 +227,6 @@ PT-TLS to support TNC over TLS.
    --enable-imv-attestation \
    --enable-imv-os \
    --enable-imc-os \
-    --enable-imc-swid \
-    --enable-imv-swid \
    --enable-imc-swima \
    --enable-imv-swima \
    --enable-imc-hcd \
@@ -176,26 +234,77 @@ PT-TLS to support TNC over TLS.
    --enable-curl \
    --enable-cmd \
    --enable-acert \
-    --enable-aikgen \
    --enable-vici \
    --enable-swanctl \
    --enable-duplicheck \
 %ifarch x86_64 %{ix86}
    --enable-aesni \
+%endif
+%if %{with python3}
+    PYTHON=%{python3} --enable-python-eggs \
+%endif
+%if %{with perl}
+    --enable-perl-cpan \
+%endif
+%if %{with check}
+    --enable-test-vectors \
+%endif
+%if %{with tss_trousers}
+    --enable-tss-trousers \
+    --enable-aikgen \
 %endif
    --enable-kernel-libipsec \
    --with-capabilities=libcap \
    CPPFLAGS="-DSTARTER_ALLOW_NON_ROOT"
+# TODO: --enable-python-eggs-install not python3 ready

 # disable certain plugins in the daemon configuration by default
 for p in bypass-lan; do
    echo -e "\ncharon.plugins.${p}.load := no" >> conf/plugins/${p}.opt
 done

-make %{?_smp_mflags}
+# ensure manual page is regenerated with local configuration
+rm -f src/ipsec/_ipsec.8
+
+%make_build
+
+pushd src/libcharon/plugins/vici
+
+%if %{with python3}
+  pushd python
+    %make_build
+    sed -e "s,/var/run/charon.vici,%{_rundir}/strongswan/charon.vici," -i vici/session.py
+    #py3_build
+  popd
+%endif
+
+%if %{with perl}
+  pushd perl/Vici-Session/
+    perl Makefile.PL INSTALLDIRS=vendor
+    %make_build
+  popd
+%endif
+
+popd

 %install
-make install DESTDIR=%{buildroot}
+%make_install
+
+
+pushd src/libcharon/plugins/vici
+%if %{with python3}
+  pushd python
+    # TODO: --enable-python-eggs breaks our previous build. Do it now
+    # propose better way to upstream
+    %py3_build
+    %py3_install
+  popd
+%endif
+%if %{with perl}
+  %make_install -C perl/Vici-Session
+  rm -f %{buildroot}{%{perl_archlib}/perllocal.pod,%{perl_vendorarch}/auto/Vici/Session/.packlist}
+%endif
+popd
 # prefix man pages
 for i in %{buildroot}%{_mandir}/*/*; do
    if echo "$i" | grep -vq '/strongswan[^\/]*$'; then
@@ -214,8 +323,22 @@ for i in aacerts acerts certs cacerts crls ocspcerts private reqs; do
    install -d -m 700 %{buildroot}%{_sysconfdir}/strongswan/ipsec.d/${i}
 done
 install -d -m 0700 %{buildroot}%{_rundir}/strongswan
-install -D -m 0644 %{SOURCE1} %{buildroot}/%{_tmpfilesdir}/strongswan.conf
-install -D -m 0644 %{SOURCE1} %{buildroot}/%{_tmpfilesdir}/strongswan-starter.conf
+install -D -m 0644 %{SOURCE3} %{buildroot}/%{_tmpfilesdir}/strongswan.conf
+install -D -m 0644 %{SOURCE3} %{buildroot}/%{_tmpfilesdir}/strongswan-starter.conf
+
+
+%check
+%if %{with check}
+  # Seen some tests hang. Ensure we do not block builder forever
+  export TESTS_VERBOSITY=1
+  timeout 600 %make_build check
+%endif
+%if %{with python}
+  pushd src/libcharon/plugins/vici
+    %pytest
+  popd
+%endif
+:

 %post
 %systemd_post strongswan.service strongswan-starter.service
@@ -286,7 +409,63 @@ install -D -m 0644 %{SOURCE1} %{buildroot}/%{_tmpfilesdir}/strongswan-starter.co
 %{_datadir}/dbus-1/system.d/nm-strongswan-service.conf
 %{_libexecdir}/strongswan/charon-nm

+%if %{with python3}
+%files -n python3-vici
+%license COPYING
+%doc src/libcharon/plugins/vici/python/README.rst
+%{python3_sitelib}/vici
+%{python3_sitelib}/vici-%{version}-py*.egg-info
+%endif
+
+%if %{with perl}
+%license COPYING
+%files -n perl-vici
+%{perl_vendorlib}/Vici
+%endif
+
 %changelog
+* Mon Jan 16 2023 Petr Menšík <pemensik@redhat.com> - 5.9.9-2
+- Use configure paths in manual pages (#2106120)
+
+* Sun Jan 15 2023 Petr Menšík <pemensik@redhat.com> - 5.9.9-1
+- Update to 5.9.9 (#2157850)
+
+* Sun Oct 16 2022 Arne Reiter <redhat@arnereiter.de> - 5.9.8-1
+- Resolves rhbz#2112274 strongswan-5.9.8 is available
+- Patch1 removes CFLAGS -Wno-format which interferes with -Werror=format-security
+- Add BuildRequire for autoconf and automake, now required for release
+- Remove obsolete patches
+
+* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 5.9.6-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Wed Jun 22 2022 Arne Reiter <redhat@arnereiter.de> - 5.9.6-1
+- Resolves rhbz#2080070 strongswan-5.9.6 is available
+- Fixed missing format string in enum_flags_to_string()
+
+* Mon Jun 13 2022 Python Maint <python-maint@redhat.com> - 5.9.5-4
+- Rebuilt for Python 3.11
+
+* Fri Feb 25 2022 Arne Reiter <redhat@arnereiter.de> - 5.9.5-3
+- Resolves: rhbz#2048108 - segfault at 18 ip 00007f4c7c0d841c sp 00007ffe49f61b70 error 4 in libc.so.6
+
+* Tue Jan 25 2022 Paul Wouters <paul.wouters@aiven.io> - 5.9.5-2
+- Use newly published/cleaned strongswan gpg key
+
+* Mon Jan 24 2022 Paul Wouters <paul.wouters@aiven.io> - 5.9.5-1
+- Resolves rhbz#2044361 strongswan-5.9.5 is available (CVE-2021-45079)
+
+* Sat Jan 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 5.9.4-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Thu Dec 16 2021 Neal Gompa <ngompa@datto.com> - 5.9.4-4
+- Disable TPM/TSS 1.2 support for F36+ / RHEL9+
+- Resolves: rhbz#2033299 Drop TPM/TSS 1.2 support (trousers)
+
+* Thu Nov 11 2021 Petr Menšík <pemensik@redhat.com> - 5.9.4-3
+- Resolves rhbz#1419441 Add python and perl vici bindings
+- Adds optional tests run
+
 * Tue Nov 09 2021 Paul Wouters <paul.wouters@aiven.io> - 5.9.4-2
 - Resolves rhbz#2018547 'strongswan restart' breaks ipsec started with strongswan-starter
 - Return to using tmpfiles, but extend to cover strongswan-starter service too
Author	SHA1	Message	Date
Zoran Peričić	6a14b5f18e	Patch vici for NHRP	2023-01-31 16:16:59 +01:00
Petr Menšík	1551e393ef	Use configure paths in manual pages (#2106120 )	2023-01-19 00:10:55 +01:00
Petr Menšík	aa8fa4c842	Switch all URLs to https Include also github repository link in package to simplify upstream changes tracking.	2023-01-19 00:10:55 +01:00
Petr Menšík	ca77654663	Update to 5.9.9 (#2157850 )	2023-01-19 00:10:54 +01:00
Paul Wouters	199f1d8708	fixup systemd build requires	2022-10-16 22:42:15 -04:00
Paul Wouters	243ac7aa4a	remove obsoleted --enable-imc-swid, --enable-imv-swid	2022-10-16 21:55:29 -04:00
Arne Reiter	d8e91f4aa4	Resolves rhbz#2112274 strongswan-5.9.8 is available Patch1 removes CFLAGS -Wno-format which interferes with -Werror=format-security Add BuildRequire for autoconf and automake, now required for release Remove obsolete patches	2022-10-16 11:47:16 +02:00
Fedora Release Engineering	27a4aa8167	Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>	2022-07-23 09:32:45 +00:00
Petr Menšík	ea8baece11	fixup! Remove signature key from a cache, include it inside git	2022-06-23 19:41:55 +02:00
Petr Menšík	de70bbe3c5	Remove signature key from a cache, include it inside git Key should be tracked by git. It is small and should not change very often. Ensure signature has trust anchor.	2022-06-23 17:15:48 +02:00
Arne Reiter	271d4eca54	Resolves rhbz#2080070 strongswan-5.9.6 is available	2022-06-23 08:54:21 +02:00
Arne Reiter	9f5e4942d3	Resolves rhbz#2080070 strongswan-5.9.6 is available	2022-06-22 18:02:45 +02:00
Python Maint	15e47bc297	Rebuilt for Python 3.11	2022-06-13 17:17:06 +02:00
Davide Cavalca	c164f65462	Fix changelog entry	2022-03-04 20:49:42 -08:00
reitear	29f8c752f8	Resolves: rhbz#048108 - segfault at 18 ip 00007f4c7c0d841c sp 00007ffe49f61b70 error 4 in libc.so.6	2022-03-04 23:44:00 +01:00
Paul Wouters	e2ccbbed7e	- Use newly published/cleaned strongswan gpg key	2022-01-25 09:14:37 -05:00
Paul Wouters	3f12242eea	- Resolves rhbz#2044361 strongswan-5.9.5 is available (CVE-2021-45079)	2022-01-24 22:05:17 -05:00
Fedora Release Engineering	3067ecdcc7	- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>	2022-01-22 01:46:58 +00:00
Neal Gompa	2f04e6389f	Disable TPM/TSS 1.2 support for F36+ / RHEL9+ TPM/TSS 1.2 has long since been superseded by TPM/TSS 2.0, and trousers is more or less dead and replaced by the tpm-tss toolkit for TPM/TSS 2.0. Resolves: rhbz#2033299	2021-12-16 08:22:26 -05:00
Petr Menšík	b7c6e022d4	Add timeout and verbosity to tests In case any test hangs, ensure it would release builder. Increase verbosity to know more about possible failures. Interactive debugging is not possible on builders.	2021-11-12 21:12:04 +01:00
Petr Menšík	0e9ffbc66d	Enable additional module for testing	2021-11-12 21:12:04 +01:00
Petr Menšík	f751d41f23	Add quirks needed for python install --enable-python-eggs is required to provide correct version. But otherwise does different thing than is required for python bindings package. Rebuild python after installation of main package, because it changed destination directory used later by install. Related: rhbz#1419441	2021-11-12 21:12:04 +01:00
Petr Menšík	3d925e79dd	Add optional support for tests running Now my tests did not finish successfully even on local build. Not enabling them by default.	2021-11-12 21:12:02 +01:00
Petr Menšík	b097119cff	Add pytest	2021-11-12 21:10:01 +01:00
Petr Menšík	a894518822	Add python3 and perl vici bindings Work in progress to enable vici bindings. It seems they are not under active support, because changes required for python3 are not in upstream code.	2021-11-12 21:09:58 +01:00