automatic import of libreswanopeneuler24.03_LTS

6 files changed, 794 insertions, 0 deletions

diff --git a/.gitignore b/.gitignore
index e69de29..91fd1db 100644
--- a/.gitignore
+++ b/.gitignore
@@ -0,0 +1,4 @@
+/ikev1_dsa.fax.bz2
+/ikev1_psk.fax.bz2
+/ikev2.fax.bz2
+/libreswan-4.9.tar.gz
diff --git a/libreswan-4.6-ikev1-policy-defaults-to-drop.patch b/libreswan-4.6-ikev1-policy-defaults-to-drop.patch
new file mode 100644
index 0000000..40073d5
--- /dev/null
+++ b/libreswan-4.6-ikev1-policy-defaults-to-drop.patch
@@ -0,0 +1,63 @@
+From 13720e0dedcab1eaf3334a73a42b68581acd9f3b Mon Sep 17 00:00:00 2001
+From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+Date: Fri, 7 Jan 2022 18:36:47 -0500
+Subject: [PATCH] ikev1-policy defaults to drop
+
+IKEv2 has been available for 16 years (RFC 4306 was published December
+2005).  At some point, we should be discouraging IKEv1 adoption.
+
+To the extent that a user needs IKEv1, they can manually add
+ikev1-policy=accept to /etc/ipsec.conf.
+---
+ configs/d.ipsec.conf/ikev1-policy.xml | 7 ++++---
+ include/ipsecconf/keywords.h          | 2 +-
+ lib/libipsecconf/confread.c           | 1 +
+ programs/pluto/server.c               | 5 -----
+ 4 files changed, 6 insertions(+), 9 deletions(-)
+
+diff --git a/configs/d.ipsec.conf/ikev1-policy.xml b/configs/d.ipsec.conf/ikev1-policy.xml
+index 17d1747e3b..3bd6702564 100644
+--- a/configs/d.ipsec.conf/ikev1-policy.xml
++++ b/configs/d.ipsec.conf/ikev1-policy.xml
+@@ -3,9 +3,10 @@
+   <listitem>
+ <para>
+ What to do with received IKEv1 packets. Valid options are
+-<emphasis remap='B'>accept</emphasis> (default), <emphasis remap='B'>reject</emphasis> which
+-will reply with an error, and <emphasis remap='B'>drop</emphasis> which will silently drop
+-any received IKEv1 packet. If this option is set to drop or reject, an attempt to load an
++<emphasis remap='B'>drop</emphasis> (default) which will silently drop
++any received IKEv1 packet, <emphasis remap='B'>accept</emphasis>, and
++<emphasis remap='B'>reject</emphasis> which will reply with an error.
++If this option is set to drop or reject, an attempt to load an
+ IKEv1 connection will fail, as these connections would never be able to receive a packet
+ for processing.
+ </para>
+diff --git a/include/ipsecconf/keywords.h b/include/ipsecconf/keywords.h
+index 660847733c..31b519242a 100644
+--- a/include/ipsecconf/keywords.h
++++ b/include/ipsecconf/keywords.h
+@@ -111,7 +111,7 @@ enum keyword_numeric_config_field {
+ 
+ 	KBF_LISTEN_TCP,		/* listen on TCP port 4500 - default no */
+ 	KBF_LISTEN_UDP,		/* listen on UDP port 500/4500 - default yes */
+-	KBF_GLOBAL_IKEv1,	/* global ikev1 policy - default accept */
++	KBF_GLOBAL_IKEv1,	/* global ikev1 policy - default drop */
+ 	KBF_ROOF
+ };
+ 
+diff --git a/lib/libipsecconf/confread.c b/lib/libipsecconf/confread.c
+index 5b5aba723f..68fbccf442 100644
+--- a/lib/libipsecconf/confread.c
++++ b/lib/libipsecconf/confread.c
+@@ -95,6 +95,7 @@ static void ipsecconf_default_values(struct starter_config *cfg)
+ 	/* Don't inflict BSI requirements on everyone */
+ 	SOPT(KBF_SEEDBITS, 0);
+ 	SOPT(KBF_DROP_OPPO_NULL, false);
++	SOPT(KBF_GLOBAL_IKEv1, GLOBAL_IKEv1_DROP);
+ 
+ #ifdef HAVE_LABELED_IPSEC
+ 	SOPT(KBF_SECCTX, SECCTX);
+-- 
+2.34.1
+
diff --git a/libreswan-4.9-cve-2023-23009.patch b/libreswan-4.9-cve-2023-23009.patch
new file mode 100644
index 0000000..bbcf25e
--- /dev/null
+++ b/libreswan-4.9-cve-2023-23009.patch
@@ -0,0 +1,84 @@
+From 7a6c217f47b1ae37e32b173dc6d3ea7fdb86d532 Mon Sep 17 00:00:00 2001
+From: Paul Wouters <paul.wouters@aiven.io>
+Date: Tue, 28 Feb 2023 11:24:22 -0500
+Subject: [PATCH 1/2] pluto: abort processing corrupt TS payloads
+ CVE-2023-23009
+
+Latest updates on this issue at https://libreswan.org/security/CVE-2023-23009
+---
+ programs/pluto/ikev2_ts.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/programs/pluto/ikev2_ts.c b/programs/pluto/ikev2_ts.c
+index 3f7519ca38..f06c40ba46 100644
+--- a/programs/pluto/ikev2_ts.c
++++ b/programs/pluto/ikev2_ts.c
+@@ -437,6 +437,11 @@ static bool v2_parse_tss(struct payload_digest *const ts_pd,
+ 		d = pbs_in_struct(&ts_pd->pbs, &ikev2_ts_header_desc,
+ 			  &ts_h, sizeof(ts_h), &ts_body_pbs);
+ 
++		if (d != NULL) {
++			llog_diag(RC_LOG, logger, &d, "%s", "");
++			return false;
++		}
++
+ 		switch (ts_h.isath_type) {
+ 		case IKEv2_TS_IPV4_ADDR_RANGE:
+ 		case IKEv2_TS_IPV6_ADDR_RANGE:
+-- 
+2.39.2
+
+
+From 52c19ccc9455ccd91fa4946b09f8e11222f1c923 Mon Sep 17 00:00:00 2001
+From: Andrew Cagney <cagney@gnu.org>
+Date: Tue, 28 Feb 2023 14:10:44 -0500
+Subject: [PATCH 2/2] ikev1: only clean up a connection when it isn't deleted
+
+fix #1018 reported by Wolfgang.
+see also ecb9c88910df1fb070488835bf3180096f3ccba3:
+IKEv1: Remove all IPsec SA's of a connection when newest SA is removed.
+---
+ programs/pluto/ikev1_main.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/programs/pluto/ikev1_main.c b/programs/pluto/ikev1_main.c
+index a616c5ccf3..21765d4002 100644
+--- a/programs/pluto/ikev1_main.c
++++ b/programs/pluto/ikev1_main.c
+@@ -2130,15 +2130,16 @@ bool accept_delete(struct msg_digest *md,
+ 						  ntohl(spi));
+ 				}
+ 
+-				struct connection *rc = dst->st_connection;
++				/* save for post delete_state() code */
++				co_serial_t rc_serialno = dst->st_connection->serialno;
+ 
+ 				if (nat_traversal_enabled && dst->st_connection->ikev1_natt != NATT_NONE) {
+ 					nat_traversal_change_port_lookup(md, dst);
+ 					v1_maybe_natify_initiator_endpoints(st, HERE);
+ 				}
+ 
+-				if (rc->newest_ipsec_sa == dst->st_serialno &&
+-					(rc->policy & POLICY_UP)) {
++				if (dst->st_connection->newest_ipsec_sa == dst->st_serialno &&
++				    (dst->st_connection->policy & POLICY_UP)) {
+ 					/*
+ 					 * Last IPsec SA for a permanent
+ 					 * connection that we have initiated.
+@@ -2162,7 +2163,12 @@ bool accept_delete(struct msg_digest *md,
+ 						md->v1_st = NULL;
+ 				}
+ 
+-				if (rc->newest_ipsec_sa == SOS_NOBODY) {
++				/*
++				 * Either .newest_ipsec_sa matches DST
++				 * and is cleared, or was never set.
++				 */
++				struct connection *rc = connection_by_serialno(rc_serialno);
++				if (rc != NULL && rc->newest_ipsec_sa == SOS_NOBODY) {
+ 					dbg("%s() connection '%s' -POLICY_UP", __func__, rc->name);
+ 					rc->policy &= ~POLICY_UP;
+ 					if (!shared_phase1_connection(rc)) {
+-- 
+2.39.2
+
diff --git a/libreswan-4.9-cve-2023-30570.patch b/libreswan-4.9-cve-2023-30570.patch
new file mode 100644
index 0000000..d175506
--- /dev/null
+++ b/libreswan-4.9-cve-2023-30570.patch
@@ -0,0 +1,129 @@
+diff --git a/programs/pluto/ikev1.c b/programs/pluto/ikev1.c
+index e0615323ed..401618b6dd 100644
+--- a/programs/pluto/ikev1.c
++++ b/programs/pluto/ikev1.c
+@@ -1101,10 +1101,20 @@ void process_v1_packet(struct msg_digest *md)
+ 	struct state *st = NULL;
+ 	enum state_kind from_state = STATE_UNDEFINED;   /* state we started in */
+ 
++	/*
++	 * For the initial responses, don't leak the responder's SPI.
++	 * Hence the use of send_v1_notification_from_md().
++	 *
++	 * AGGR mode is a mess in that the R0->R1 transition happens
++	 * well before the transition succeeds.
++	 */
+ #define SEND_NOTIFICATION(t)						\
+ 	{								\
+ 		pstats(ikev1_sent_notifies_e, t);			\
+-		if (st != NULL)						\
++		if (st != NULL &&					\
++		    st->st_state->kind != STATE_AGGR_R0 &&		\
++		    st->st_state->kind != STATE_AGGR_R1 &&		\
++		    st->st_state->kind != STATE_MAIN_R0)		\
+ 			send_v1_notification_from_state(st, from_state, t); \
+ 		else							\
+ 			send_v1_notification_from_md(md, t);		\
+@@ -1168,17 +1178,26 @@ void process_v1_packet(struct msg_digest *md)
+ 			from_state = (md->hdr.isa_xchg == ISAKMP_XCHG_IDPROT ?
+ 				      STATE_MAIN_R0 : STATE_AGGR_R0);
+ 		} else {
+-			/* not an initial message */
++			/*
++			 * Possibly not an initial message.  Possibly
++			 * from initiator.  Possibly from responder.
++			 *
++			 * Possibly.  Which is probably hopeless.
++			 */
+ 
+ 			st = find_state_ikev1(&md->hdr.isa_ike_spis,
+ 					      md->hdr.isa_msgid);
+ 
+ 			if (st == NULL) {
+ 				/*
+-				 * perhaps this is a first message
++				 * Perhaps this is a first message
+ 				 * from the responder and contains a
+ 				 * responder cookie that we've not yet
+ 				 * seen.
++				 *
++				 * Perhaps this is a random message
++				 * with a bogus non-zero responder IKE
++				 * SPI.
+ 				 */
+ 				st = find_state_ikev1_init(&md->hdr.isa_ike_initiator_spi,
+ 							   md->hdr.isa_msgid);
+@@ -1189,6 +1208,21 @@ void process_v1_packet(struct msg_digest *md)
+ 					/* XXX Could send notification back */
+ 					return;
+ 				}
++				if (st->st_state->kind == STATE_AGGR_R0) {
++					/*
++					 * The only way for this to
++					 * happen is for the attacker
++					 * to guess the responder's
++					 * IKE SPI that hasn't been
++					 * sent over the wire?
++					 *
++					 * Well that or played 1/2^32
++					 * odds.
++					 */
++					llog_pexpect(md->md_logger, HERE,
++						     "phase 1 message matching AGGR_R0 state");
++					return;
++				}
+ 			}
+ 			from_state = st->st_state->kind;
+ 		}
+@@ -2870,7 +2904,28 @@ void complete_v1_state_transition(struct state *st, struct msg_digest *md, stf_s
+ 			delete_state(st);
+ 			/* wipe out dangling pointer to st */
+ 			md->v1_st = NULL;
++		} else if  (st->st_state->kind == STATE_AGGR_R0 ||
++			    st->st_state->kind == STATE_AGGR_R1 ||
++			    st->st_state->kind == STATE_MAIN_R0) {
++			/*
++			 *
++			 * Wipe out the incomplete larval state.
++			 *
++			 * ARGH! In <=v4.10, the aggr code flipped the
++			 * larval state to R1 right at the start of
++			 * the transition and not the end, so using
++			 * state to figure things out is close to
++			 * useless.
++			 *
++			 * Deleting the state means that pluto has no
++			 * way to detect and ignore amplification
++			 * attacks.
++			 */
++			delete_state(st);
++			/* wipe out dangling pointer to st */
++			md->v1_st = NULL;
+ 		}
++
+ 		break;
+ 	}
+ 	}
+diff --git a/programs/pluto/ikev1_aggr.c b/programs/pluto/ikev1_aggr.c
+index 2732951beb..87be80cb6c 100644
+--- a/programs/pluto/ikev1_aggr.c
++++ b/programs/pluto/ikev1_aggr.c
+@@ -169,7 +169,7 @@ stf_status aggr_inI1_outR1(struct state *null_st UNUSED,
+ 	/* Set up state */
+ 	struct ike_sa *ike = new_v1_rstate(c, md);
+ 	md->v1_st = &ike->sa;  /* (caller will reset cur_state) */
+-	change_v1_state(&ike->sa, STATE_AGGR_R1);
++	change_v1_state(&ike->sa, STATE_AGGR_R0);
+ 
+ 	/*
+ 	 * Warn when peer is expected to use especially dangerous
+@@ -197,7 +197,8 @@ stf_status aggr_inI1_outR1(struct state *null_st UNUSED,
+ 
+ 	if (!v1_decode_certs(md)) {
+ 		llog_sa(RC_LOG, ike, "X509: CERT payload bogus or revoked");
+-		return false;
++		/* XXX notification is in order! */
++		return STF_FAIL_v1N + v1N_INVALID_ID_INFORMATION;
+ 	}
+ 
+ 	/*
diff --git a/libreswan.spec b/libreswan.spec
new file mode 100644
index 0000000..5dd129f
--- /dev/null
+++ b/libreswan.spec
@@ -0,0 +1,510 @@
+%global _hardened_build 1
+# These are rpm macros and are 0 or 1
+%global with_efence 0
+%global with_development 0
+%global with_cavstests 1
+%global nss_version 3.52
+%global unbound_version 1.6.6
+# Libreswan config options
+%global libreswan_config \\\
+    FINALLIBEXECDIR=%{_libexecdir}/ipsec \\\
+    FINALMANDIR=%{_mandir} \\\
+    PREFIX=%{_prefix} \\\
+    INITSYSTEM=systemd \\\
+    PYTHON_BINARY=%{__python3} \\\
+    SHELL_BINARY=%{_bindir}/sh \\\
+    USE_DNSSEC=true \\\
+    USE_LABELED_IPSEC=true \\\
+    USE_LDAP=true \\\
+    USE_LIBCAP_NG=true \\\
+    USE_LIBCURL=true \\\
+    USE_LINUX_AUDIT=true \\\
+    USE_NM=true \\\
+    USE_NSS_IPSEC_PROFILE=true \\\
+    USE_SECCOMP=true \\\
+    USE_AUTHPAM=true \\\
+%{nil}
+
+#global prever dr1
+
+Name: libreswan
+Summary: Internet Key Exchange (IKEv1 and IKEv2) implementation for IPsec
+# version is generated in the release script
+Version: 4.9
+Release: %{?prever:0.}4%{?prever:.%{prever}}%{?dist}
+License: GPLv2
+Url: https://libreswan.org/
+Source0: https://download.libreswan.org/%{?prever:development/}%{name}-%{version}%{?prever}.tar.gz
+%if 0%{with_cavstests}
+Source1: https://download.libreswan.org/cavs/ikev1_dsa.fax.bz2
+Source2: https://download.libreswan.org/cavs/ikev1_psk.fax.bz2
+Source3: https://download.libreswan.org/cavs/ikev2.fax.bz2
+%endif
+Patch: libreswan-4.6-ikev1-policy-defaults-to-drop.patch
+Patch: libreswan-4.9-cve-2023-23009.patch
+Patch: libreswan-4.9-cve-2023-30570.patch
+
+BuildRequires: audit-libs-devel
+BuildRequires: bison
+BuildRequires: curl-devel
+BuildRequires: flex
+BuildRequires: gcc make
+BuildRequires: hostname
+BuildRequires: ldns-devel
+BuildRequires: libcap-ng-devel
+BuildRequires: libevent-devel
+BuildRequires: libseccomp-devel
+BuildRequires: libselinux-devel
+BuildRequires: nspr-devel
+BuildRequires: nss-devel >= %{nss_version}
+BuildRequires: nss-tools >= %{nss_version}
+BuildRequires: openldap-devel
+BuildRequires: pam-devel
+BuildRequires: pkgconfig
+BuildRequires: systemd-devel
+BuildRequires: unbound-devel >= %{unbound_version}
+BuildRequires: xmlto
+%if 0%{with_efence}
+BuildRequires: ElectricFence
+%endif
+Requires: iproute >= 2.6.8
+Requires: nss >= %{nss_version}
+Requires: nss-softokn
+Requires: nss-tools
+Requires: unbound-libs >= %{unbound_version}
+Requires(post): bash
+Requires(post): coreutils
+Requires(post): systemd
+Requires(preun): systemd
+Requires(postun): systemd
+
+%description
+Libreswan is a free implementation of IPsec & IKE for Linux.  IPsec is
+the Internet Protocol Security and uses strong cryptography to provide
+both authentication and encryption services.  These services allow you
+to build secure tunnels through untrusted networks.  Everything passing
+through the untrusted net is encrypted by the ipsec gateway machine and
+decrypted by the gateway at the other end of the tunnel.  The resulting
+tunnel is a virtual private network or VPN.
+
+This package contains the daemons and userland tools for setting up
+Libreswan.
+
+Libreswan also supports IKEv2 (RFC7296) and Secure Labeling
+
+Libreswan is based on Openswan-2.6.38 which in turn is based on FreeS/WAN-2.04
+
+%prep
+%setup -q -n libreswan-%{version}%{?prever}
+# enable crypto-policies support
+sed -i "s:#[ ]*include \(.*\)\(/crypto-policies/back-ends/libreswan.config\)$:include \1\2:" configs/ipsec.conf.in
+%autopatch -p1
+
+%build
+make %{?_smp_mflags} \
+%if 0%{with_development}
+    OPTIMIZE_CFLAGS="%{?_hardened_cflags}" \
+%else
+    OPTIMIZE_CFLAGS="%{optflags}" \
+%endif
+    WERROR_CFLAGS="-Werror -Wno-missing-field-initializers -Wno-lto-type-mismatch -Wno-maybe-uninitialized" \
+%if 0%{with_efence}
+    USE_EFENCE=true \
+%endif
+    USERLINK="%{?__global_ldflags} -Wl,-z,relro -Wl,--as-needed  -Wl,-z,now -flto --no-lto" \
+    %{libreswan_config} \
+    programs
+FS=$(pwd)
+
+
+%install
+make \
+    DESTDIR=%{buildroot} \
+    %{libreswan_config} \
+    install
+FS=$(pwd)
+rm -rf %{buildroot}/usr/share/doc/libreswan
+rm -rf %{buildroot}%{_libexecdir}/ipsec/*check
+
+install -d -m 0755 %{buildroot}%{_rundir}/pluto
+install -d %{buildroot}%{_sbindir}
+
+install -d %{buildroot}%{_sysconfdir}/sysctl.d
+install -m 0644 packaging/fedora/libreswan-sysctl.conf \
+    %{buildroot}%{_sysconfdir}/sysctl.d/50-libreswan.conf
+
+echo "include %{_sysconfdir}/ipsec.d/*.secrets" \
+    > %{buildroot}%{_sysconfdir}/ipsec.secrets
+rm -fr %{buildroot}%{_sysconfdir}/rc.d/rc*
+
+%if 0%{with_cavstests}
+%check
+# There is an elaborate upstream testing infrastructure which we do not
+# run here - it takes hours and uses kvm
+# We only run the CAVS tests.
+cp %{SOURCE1} %{SOURCE2} %{SOURCE3} .
+bunzip2 *.fax.bz2
+
+: starting CAVS test for IKEv2
+%{buildroot}%{_libexecdir}/ipsec/cavp -v2 ikev2.fax | \
+    diff -u ikev2.fax - > /dev/null
+: starting CAVS test for IKEv1 RSASIG
+%{buildroot}%{_libexecdir}/ipsec/cavp -v1dsa ikev1_dsa.fax | \
+    diff -u ikev1_dsa.fax - > /dev/null
+: starting CAVS test for IKEv1 PSK
+%{buildroot}%{_libexecdir}/ipsec/cavp -v1psk ikev1_psk.fax | \
+    diff -u ikev1_psk.fax - > /dev/null
+: CAVS tests passed
+%endif
+
+# Some of these tests will show ERROR for negative testing - it will exit on real errors
+%{buildroot}%{_libexecdir}/ipsec/algparse -tp || { echo prooposal test failed; exit 1; }
+%{buildroot}%{_libexecdir}/ipsec/algparse -ta || { echo algorithm test failed; exit 1; }
+: Algorithm parser tests passed
+
+# self test for pluto daemon - this also shows which algorithms it allows in FIPS mode
+tmpdir=$(mktemp -d /tmp/libreswan-XXXXX)
+certutil -N -d sql:$tmpdir --empty-password
+%{buildroot}%{_libexecdir}/ipsec/pluto --selftest --nssdir $tmpdir --rundir $tmpdir
+: pluto self-test passed - verify FIPS algorithms allowed is still compliant with NIST
+
+%post
+%systemd_post ipsec.service
+
+%preun
+%systemd_preun ipsec.service
+
+%postun
+%systemd_postun_with_restart ipsec.service
+
+%files
+%doc CHANGES COPYING CREDITS README* LICENSE
+%doc docs/*.* docs/examples
+%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipsec.conf
+%attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ipsec.secrets
+%attr(0700,root,root) %dir %{_sysconfdir}/ipsec.d
+%attr(0700,root,root) %dir %{_sysconfdir}/ipsec.d/policies
+%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipsec.d/policies/*
+%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/sysctl.d/50-libreswan.conf
+%attr(0755,root,root) %dir %{_rundir}/pluto
+%attr(0700,root,root) %dir %{_sharedstatedir}/ipsec
+%attr(0700,root,root) %dir %{_sharedstatedir}/ipsec/nss
+%attr(0644,root,root) %{_tmpfilesdir}/libreswan.conf
+%attr(0644,root,root) %{_unitdir}/ipsec.service
+%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/pam.d/pluto
+%config(noreplace) %{_sysconfdir}/logrotate.d/libreswan
+%{_sbindir}/ipsec
+%{_libexecdir}/ipsec
+%doc %{_mandir}/*/*
+
+%changelog
+* Thu May 04 2023 Sahana Prasad <sahana@redhat.com> - 4.9-4
+- Just bumping up the version as an incorrect 9.3 build was created.
+- Related: rhbz#2187171
+
+* Thu May 04 2023 Sahana Prasad <sahana@redhat.com> - 4.9-3
+- Fix CVE-2023-30570:Malicious IKEv1 Aggressive Mode packets can crash
+  libreswan
+- Resolves: rhbz#2187171
+
+* Tue Apr  4 2023 Daiki Ueno <dueno@redhat.com> - 4.9-2
+- Fix CVE-2023-23009: remote DoS via crafted TS payload with an
+  incorrect selector length (rhbz#2173674)
+
+* Wed Jan  4 2023 Daiki Ueno <dueno@redhat.com> - 4.9-1
+- Update to 4.9. Resolves: rhbz#2128669
+- Switch to using %%autopatch as in Fedora
+
+* Wed Feb  2 2022 Daiki Ueno <dueno@redhat.com> - 4.6-3
+- Drop IKEv1 packets by default, based on the Debian patch
+  by Daniel Kahn Gillmor (rhbz#2039877)
+
+* Mon Jan 17 2022 Daiki Ueno <dueno@redhat.com> - 4.6-2
+- Related: rhbz#2017355 rebuild to reflect gating.yaml change
+
+* Mon Jan 17 2022 Daiki Ueno <dueno@redhat.com> - 4.6-1
+- Update to 4.6. Resolves: rhbz#2017355
+
+* Mon Jan 10 2022 Daiki Ueno <dueno@redhat.com> - 4.5-1
+- Update to 4.5. Resolves: rhbz#2017355
+
+* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 4.4-3.1
+- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
+  Related: rhbz#1991688
+
+* Wed Jul 21 2021 Daiki Ueno <dueno@redhat.com> - 4.4-3
+- Backport removal gethostbyname2 uses from the upstream
+- Fix issues spotted by covscan (rhbz#1938784)
+
+* Tue Jul 13 2021 Daiki Ueno <dueno@redhat.com> - 4.4-2
+- Rebuild with newer GCC to fix annocheck failures
+
+* Thu Jul  1 2021 Daiki Ueno <dueno@redhat.com> - 4.4-1
+- Update to 4.4. Resolves: rhbz#1975812
+- Port compiler warning suppression by Paul Wouters:
+  https://src.fedoraproject.org/rpms/libreswan/c/8d7f98d41444ac77c562f735b4b93038f5346ce2?branch=rawhide
+
+* Thu Jun 24 2021 Daiki Ueno <dueno@redhat.com> - 4.2-1.3
+- Fix FTBFS with OpenSSL 3.0 (rhbz#1975439)
+
+* Tue Jun 22 2021 Mohan Boddu <mboddu@redhat.com> - 4.2-1.2
+- Rebuilt for RHEL 9 BETA for openssl 3.0
+  Related: rhbz#1971065
+
+* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 4.2-1.1
+- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
+
+* Wed Feb 03 2021 Paul Wouters <pwouters@redhat.com> - 4.2-1
+- Update to 4.2
+
+* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 4.2-0.1.rc1.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Sat Dec 19 19:59:55 EST 2020 Paul Wouters <pwouters@redhat.com> - 4.2-0.1.rc1
+- Resolves: rhbz#1867580 pluto process frequently dumps core
+  (disable USE_NSS_KDF until nss fixes have propagated)
+
+* Sat Dec 19 2020 Adam Williamson <awilliam@redhat.com> - 4.1-4
+- Rebuild for ldns soname bump
+
+* Mon Nov 23 11:50:41 EST 2020 Paul Wouters <pwouters@redhat.com> - 4.1-3
+- Resolves: rhbz#1894381 Libreswan 4.1-2 breaks l2tp connection to Windows VPN server
+
+* Mon Oct 26 10:21:57 EDT 2020 Paul Wouters <pwouters@redhat.com> - 4.1-2
+- Resolves: rhbz#1889538 libreswan's /var/lib/ipsec/nss missing
+
+* Sun Oct 18 21:49:39 EDT 2020 Paul Wouters <pwouters@redhat.com> - 4.1-1
+- Updated to 4.1 - interop fix for Cisco
+
+* Thu Oct 15 10:27:14 EDT 2020 Paul Wouters <pwouters@redhat.com> - 4.0-1
+- Resolves: rhbz#1888448 libreswan-4.0 is available
+
+* Wed Sep 30 14:05:58 EDT 2020 Paul Wouters <pwouters@redhat.com> - 4.0-0.2.rc1
+- Rebuild for libevent 2.1.12 with a soname bump
+
+* Sun Sep 27 22:49:40 EDT 2020 Paul Wouters <pwouters@redhat.com> - 4.0-0.1.rc1
+- Updated to 4.0rc1
+
+* Thu Aug 27 2020 Paul Wouters <pwouters@redhat.com> - 3.32-4
+- Resolves: rhbz#1864043 libreswan: FTBFS in Fedora rawhide/f33
+
+* Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.32-3.2
+- Second attempt - Rebuilt for
+  https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.32-3.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Tue Jun 30 2020 Jeff Law <law@redhat.com> - 3.32-3
+- Initialize ppk_id_p in ikev2_parent_inR1outI2_tail to avoid uninitialized
+  object
+
+* Tue May 26 2020 Paul Wouters <pwouters@redhat.com> - 3.32-2
+- Backport NSS guarding fix for unannounced changed api in NSS causing segfault
+
+* Mon May 11 2020 Paul Wouters <pwouters@redhat.com> - 3.32-1
+- Resolves: rhbz#1809770 libreswan-3.32 is available
+
+* Tue Apr 14 2020 Paul Wouters <pwouters@redhat.com> - 3.31-2
+- Resolves: rhbz#1823823 Please drop the dependency on fipscheck
+
+* Tue Mar 03 2020 Paul Wouters <pwouters@redhat.com> - 3.31-1
+- Resolves: rhbz#1809770 libreswan-3.31 is available (fixes rekey regression)
+
+* Fri Feb 14 2020 Paul Wouters <pwouters@redhat.com> - 3.30-1
+- Resolves: rhbz#1802896 libreswan-3.30 is available
+- Resolves: rhbz#1799598 libreswan: FTBFS in Fedora rawhide/f32
+- Resolves: rhbz#1760571 [abrt] libreswan: configsetupcheck(): verify:366:configsetupcheck:TypeError:
+
+* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.29-2.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Thu Jan 09 2020 Paul Wouters <pwouters@redhat.com> - 3.29-2
+- _updown.netkey: fix syntax error in checking routes
+
+* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 3.29-1.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Mon Jun 10 2019 Paul Wouters <pwouters@redhat.com> - 3.29-1
+- Resolves: rhbz#1718986 Updated to 3.29 for CVE-2019-10155
+
+* Tue May 21 2019 Paul Wouters <pwouters@redhat.com> - 3.28-1
+- Updated to 3.28 (many imported bugfixes, including CVE-2019-12312)
+
+* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 3.27-1.2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Mon Jan 14 2019 Björn Esser <besser82@fedoraproject.org> - 3.27-1.1
+- Rebuilt for libcrypt.so.2 (#1666033)
+
+* Mon Oct 08 2018 Paul Wouters <pwouters@redhat.com> - 3.27-1
+- Updated to 3.27 (various bugfixes)
+
+* Thu Sep 27 2018 Paul Wouters <pwouters@redhat.com> - 3.26-3
+- Add fedora python fixup for _unbound-hook
+
+* Mon Sep 17 2018 Paul Wouters <pwouters@redhat.com> - 3.26-2
+- linking against freebl is no longer needed (and wasn't done in 3.25)
+
+* Mon Sep 17 2018 Paul Wouters <pwouters@redhat.com> - 3.26-1
+- Updated to 3.26 (CHACHA20POLY1305, ECDSA and RSA-PSS support)
+
+* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 3.25-3.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
+* Mon Jul 09 2018 Paul Wouters <pwouters@redhat.com> - 3.25-3
+- Fix Opportunistic IPsec _unbound-hook argument parsing
+- Make rundir readable for all (so we can hand out permissions later)
+
+* Mon Jul 02 2018 Paul Wouters <pwouters@redhat.com> - 3.25-2
+- Relax deleting IKE SA's and IPsec SA's to avoid interop issues with third party VPN vendors
+
+* Wed Jun 27 2018 Paul Wouters <pwouters@redhat.com> - 3.25-1
+- Updated to 3.25
+
+* Mon Feb 19 2018 Paul Wouters <pwouters@redhat.com> - 3.23-2
+- Support crypto-policies package
+- Pull in some patches from upstream and IANA registry updates
+- gcc7 format-truncate fixes and workarounds
+
+* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 3.23-1.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
+
+* Thu Jan 25 2018 Paul Wouters <pwouters@redhat.com> - 3.23-1
+- Updated to 3.23 - support for MOBIKE, PPK, CMAC, nic offload and performance improvements
+
+* Sat Jan 20 2018 Björn Esser <besser82@fedoraproject.org> - 3.22-1.1
+- Rebuilt for switch to libxcrypt
+
+* Mon Oct 23 2017 Paul Wouters <pwouters@redhat.com> - 3.22-1
+- Updated to 3.22 - many bugfixes, and unbound ipsecmod support
+
+* Wed Aug  9 2017 Paul Wouters <pwouters@redhat.com> - 3.21-1
+- Updated to 3.21
+
+* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 3.20-1.2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
+
+* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 3.20-1.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
+
+* Tue Mar 14 2017 Paul Wouters <pwouters@redhat.com> - 3.20-1
+- Updated to 3.20
+
+* Fri Mar 03 2017 Paul Wouters <pwouters@redhat.com> - 3.20-0.1.dr4
+- Update to 3.20dr4 to test mozbz#1336487 export CERT_CompareAVA
+
+* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 3.19-1.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
+
+* Fri Feb 03 2017 Paul Wouters <pwouters@redhat.com> - 3.19-2
+- Resolves: rhbz#1392191 libreswan: crash when OSX client connects
+- Improved uniqueid and session replacing support
+- Test Buffer warning fix on size_t
+- Re-introduce --configdir for backwards compatibility
+
+* Sun Jan 15 2017 Paul Wouters <pwouters@redhat.com> - 3.19-1
+- Updated to 3.19 (see download.libreswan.org/CHANGES)
+
+* Mon Dec 19 2016 Miro Hrončok <mhroncok@redhat.com> - 3.18-1.1
+- Rebuild for Python 3.6
+
+* Fri Jul 29 2016 Paul Wouters <pwouters@redhat.com> - 3.18-1
+- Updated to 3.18 for CVE-2016-5391 rhbz#1361164 and VTI support
+- Remove support for /etc/sysconfig/pluto (use native systemd instead)
+
+* Thu May 05 2016 Paul Wouters <pwouters@redhat.com> - 3.17-2
+- Resolves: rhbz#1324956 prelink is gone, /etc/prelink.conf.d/* is no longer used
+
+* Thu Apr 07 2016 Paul Wouters <pwouters@redhat.com> - 3.17-1
+- Updated to 3.17 for CVE-2016-3071
+- Disable LIBCAP_NG as it prevents unbound-control from working properly
+- Temporarilly disable WERROR due to a few minor known issues
+
+* Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 3.16-1.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
+
+* Fri Dec 18 2015 Paul Wouters <pwouters@redhat.com> - 3.16-1
+- Updated to 3.16 (see https://download.libreswan.org/CHANGES)
+
+* Tue Aug 11 2015 Paul Wouters <pwouters@redhat.com> - 3.15-1
+- Updated to 3.15 (see http://download.libreswan.org/CHANGES)
+- Resolves: rhbz#CVE-2015-3240 IKE daemon restart when receiving a bad DH gx
+- NSS database creation moved from spec file to service file
+- Run CAVS tests on package build
+- Added BuildRequire systemd-units and xmlto
+- Bumped minimum required nss to 3.16.1
+- Install tmpfiles
+- Install sysctl file
+- Update doc files to include
+
+* Mon Jul 13 2015 Paul Wouters <pwouters@redhat.com> - 3.13-2
+- Resolves: rhbz#1238967 Switch libreswan to use python3
+
+* Wed Jun 17 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 3.13-1.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
+
+* Mon Jun 01 2015 Paul Wouters <pwouters@redhat.com> - 3.13-1
+- Updated to 3.13 for CVE-2015-3204
+
+* Fri Nov 07 2014 Paul Wouters <pwouters@redhat.com> - 3.12-1
+- Updated to 3.12 Various IKEv2 fixes
+
+* Wed Oct 22 2014 Paul Wouters <pwouters@redhat.com> - 3.11-1
+- Updated to 3.11 (many fixes, including startup fixes)
+- Resolves: rhbz#1144941 libreswan 3.10 upgrade breaks old ipsec.secrets configs
+- Resolves: rhbz#1147072 ikev1 aggr mode connection fails after libreswan upgrade
+- Resolves: rhbz#1144831 Libreswan appears to start with systemd before all the NICs are up and running
+
+* Tue Sep 09 2014 Paul Wouters <pwouters@redhat.com> - 3.10-3
+- Fix some coverity issues, auto=route on bootup and snprintf on 32bit machines
+
+* Mon Sep 01 2014 Paul Wouters <pwouters@redhat.com> - 3.10-1
+- Updated to 3.10, major bugfix release, new xauth status options
+
+* Sun Aug 17 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 3.9-1.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
+
+* Thu Jul 10 2014 Paul Wouters <pwouters@redhat.com> - 3.9-1
+- Updated to 3.9. IKEv2 enhancements, ESP/IKE algo enhancements
+- Mark libreswan-fips.conf as config file
+- attr modifier for man pages no longer needed
+- BUGS file no longer exists upstream
+
+* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 3.8-1.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
+
+* Sat Jan 18 2014 Paul Wouters <pwouters@redhat.com> - 3.8-1
+- Updated to 3.8, fixes rhbz#CVE-2013-6467 (rhbz#1054102)
+
+* Wed Dec 11 2013 Paul Wouters <pwouters@redhat.com> - 3.7-1
+- Updated to 3.7, fixes CVE-2013-4564
+- Fixes creating a bogus NSS db on startup (rhbz#1005410)
+
+* Thu Oct 31 2013 Paul Wouters <pwouters@redhat.com> - 3.6-1
+- Updated to 3.6 (IKEv2, MODECFG, Cisco interop fixes)
+- Generate empty NSS db if none exists
+
+* Mon Aug 19 2013 Paul Wouters <pwouters@redhat.com> - 3.5-3
+- Add a Provides: for openswan-doc
+
+* Sat Aug 03 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 3.5-1.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
+
+* Mon Jul 15 2013 Paul Wouters <pwouters@redhat.com> - 3.5-2
+- Added interop patch for (some?) Cisco VPN clients sending 16 zero
+  bytes of extraneous IKE data
+- Removed fipscheck_version
+
+* Sat Jul 13 2013 Paul Wouters <pwouters@redhat.com> - 3.5-1
+- Updated to 3.5
+
+* Thu Jun 06 2013 Paul Wouters <pwouters@redhat.com> - 3.4-1
+- Updated to 3.4, which only contains style changes to kernel coding style
+- IN MEMORIAM: June 3rd, 2013 Hugh Daniel
+
+* Mon May 13 2013 Paul Wouters <pwouters@redhat.com> - 3.3-1
+- Updated to 3.3, which resolves CVE-2013-2052
+
+* Sat Apr 13 2013 Paul Wouters <pwouters@redhat.com> - 3.2-1
+- Initial package for Fedora
diff --git a/sources b/sources
new file mode 100644
index 0000000..af745fd
--- /dev/null
+++ b/sources
@@ -0,0 +1,4 @@
+d8b493de7179635a6ed2a4d0e1b35282  ikev1_dsa.fax.bz2
+c4fe7041300e6c21f4561ce818b5002f  ikev1_psk.fax.bz2
+7716c48a1a2b17ba25e89b79889d4004  ikev2.fax.bz2
+584ee91ace5208db1a517b4c8e7a3971  libreswan-4.9.tar.gz