diff --git a/.gitignore b/.gitignore index 29f4d31..00bca54 100644 --- a/.gitignore +++ b/.gitignore @@ -14,3 +14,4 @@ /NetworkManager-l2tp-1.2.14.tar.xz /NetworkManager-l2tp-1.2.16.tar.xz /NetworkManager-l2tp-1.8.0.tar.xz +/NetworkManager-l2tp-1.8.2.tar.xz diff --git a/NetworkManager-l2tp-1.8.0-libreswan-3.30.patch b/NetworkManager-l2tp-1.8.0-libreswan-3.30.patch deleted file mode 100644 index d95d8d7..0000000 --- a/NetworkManager-l2tp-1.8.0-libreswan-3.30.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/src/nm-l2tp-service.c b/src/nm-l2tp-service.c -index c80135f..1c6cbb4 100644 ---- a/src/nm-l2tp-service.c -+++ b/src/nm-l2tp-service.c -@@ -98,7 +98,7 @@ typedef struct { - #define STRONGSWAN_IKEV1_ALGORITHMS_PHASE1 "aes256-sha2_256-modp2048,aes256-sha2_256-modp1536,aes256-sha2_256-modp1024,aes256-sha1-modp2048,aes256-sha1-modp1536,aes256-sha1-modp1024,aes256-sha1-ecp384,aes128-sha1-modp1024,aes128-sha1-ecp256,3des-sha1-modp2048,3des-sha1-modp1024!" - #define STRONGSWAN_IKEV1_ALGORITHMS_PHASE2 "aes256-sha1,aes128-sha1,3des-sha1!" - --#define LIBRESWAN_IKEV1_ALGORITHMS_PHASE1 "aes256-sha2_256-modp2048,aes256-sha2_256-modp1536,aes256-sha2_256-modp1024,aes256-sha1-modp2048,aes256-sha1-modp1536,aes256-sha1-modp1024,aes256-sha1-ecp_384,aes128-sha1-modp1024,aes128-sha1-ecp_256,3des-sha1-modp2048,3des-sha1-modp1024" -+#define LIBRESWAN_IKEV1_ALGORITHMS_PHASE1 "aes256-sha2_256-modp2048,aes256-sha2_256-modp1536,aes256-sha1-modp2048,aes256-sha1-modp1536,aes256-sha1-ecp_384,aes128-sha1-ecp_256,3des-sha1-modp2048" - #define LIBRESWAN_IKEV1_ALGORITHMS_PHASE2 "aes256-sha1,aes128-sha1,3des-sha1" - - /*****************************************************************************/ diff --git a/NetworkManager-l2tp-1.8.0-usercert.patch b/NetworkManager-l2tp-1.8.0-usercert.patch deleted file mode 100644 index 4fd5f21..0000000 --- a/NetworkManager-l2tp-1.8.0-usercert.patch +++ /dev/null @@ -1,121 +0,0 @@ -diff --git a/src/nm-l2tp-service.c b/src/nm-l2tp-service.c -index 660bbe0..5ca8617 100644 ---- a/src/nm-l2tp-service.c -+++ b/src/nm-l2tp-service.c -@@ -1117,13 +1117,16 @@ nm_l2tp_config_write (NML2tpPlugin *plugin, - return FALSE; - } - if (tls_need_password) -- value = nm_setting_vpn_get_secret (s_vpn, NM_L2TP_KEY_MACHINE_CERTPASS); -+ value = nm_setting_vpn_get_secret (s_vpn, NM_L2TP_KEY_USER_CERTPASS); - else - value = NULL; - - tls_key_out_filename = g_strdup_printf ("%s/key.pem", rundir); - tls_cert_out_filename = g_strdup_printf ("%s/cert.pem", rundir); -- tls_ca_out_filename = g_strdup_printf ("%s/ca.pem", rundir);; -+ tls_ca_out_filename = g_strdup_printf ("%s/ca.pem", rundir); -+ unlink (tls_key_out_filename); -+ unlink (tls_cert_out_filename); -+ unlink (tls_ca_out_filename); - if (tls_key_fileformat == NM_L2TP_CRYPTO_FILE_FORMAT_PKCS12) { - crypto_pkcs12_to_pem_files (tls_cert_filename, - value, -@@ -1198,20 +1201,29 @@ nm_l2tp_config_write (NML2tpPlugin *plugin, - } - - write_config_option (fd, "need-peer-eap\n"); -- if (tls_key_out_filename) -- write_config_option (fd, "key \"%s\"\n", tls_key_out_filename); -- else -+ if (tls_key_out_filename) { -+ if (g_file_test (tls_key_out_filename, G_FILE_TEST_EXISTS)) { -+ write_config_option (fd, "key \"%s\"\n", tls_key_out_filename); -+ } -+ } else { - write_config_option (fd, "key \"%s\"\n", tls_key_filename); -+ } - -- if (tls_cert_out_filename) -- write_config_option (fd, "cert \"%s\"\n", tls_cert_out_filename); -- else -+ if (tls_cert_out_filename) { -+ if (g_file_test (tls_cert_out_filename, G_FILE_TEST_EXISTS)) { -+ write_config_option (fd, "cert \"%s\"\n", tls_cert_out_filename); -+ } -+ } else { - write_config_option (fd, "cert \"%s\"\n", tls_cert_filename); -+ } - -- if (tls_ca_out_filename) -- write_config_option (fd, "ca \"%s\"\n", tls_ca_filename); -- else if (tls_ca_filename) -+ if (tls_ca_out_filename) { -+ if (g_file_test (tls_ca_out_filename, G_FILE_TEST_EXISTS)) { -+ write_config_option (fd, "ca \"%s\"\n", tls_ca_out_filename); -+ } -+ } else if (tls_ca_filename) { - write_config_option (fd, "ca \"%s\"\n", tls_ca_filename); -+ } - } else { - /* Username; try L2TP specific username first, then generic username */ - value = nm_setting_vpn_get_data_item (s_vpn, NM_L2TP_KEY_USER); -@@ -1529,8 +1541,10 @@ handle_need_secrets (NMDBusL2tpPpp *object, - NML2tpPlugin *self = NM_L2TP_PLUGIN (user_data); - NML2tpPluginPrivate *priv = NM_L2TP_PLUGIN_GET_PRIVATE (self); - NMSettingVpn *s_vpn; -+ NML2tpCryptoFileFormat tls_key_fileformat; - const char *user, *password, *domain, *auth_type, *tls_key_filename; - gchar *username; -+ gchar *key_filename; - gboolean tls_need_password = FALSE; - - remove_timeout_handler (NM_L2TP_PLUGIN (user_data)); -@@ -1541,20 +1555,36 @@ handle_need_secrets (NMDBusL2tpPpp *object, - auth_type = nm_setting_vpn_get_data_item (s_vpn, NM_L2TP_KEY_USER_AUTH_TYPE); - if (nm_streq0 (auth_type, NM_L2TP_AUTHTYPE_TLS)) { - tls_key_filename = nm_setting_vpn_get_data_item (s_vpn, NM_L2TP_KEY_USER_KEY); -- crypto_file_format (tls_key_filename, &tls_need_password, NULL); -+ tls_key_fileformat = crypto_file_format (tls_key_filename, &tls_need_password, NULL); -+ -+ switch (tls_key_fileformat) { -+ case NM_L2TP_CRYPTO_FILE_FORMAT_PKCS12 : -+ case NM_L2TP_CRYPTO_FILE_FORMAT_PKCS8_DER : -+ case NM_L2TP_CRYPTO_FILE_FORMAT_RSA_PKEY_DER : -+ case NM_L2TP_CRYPTO_FILE_FORMAT_DSA_PKEY_DER : -+ case NM_L2TP_CRYPTO_FILE_FORMAT_ECDSA_PKEY_DER : -+ key_filename = g_strdup_printf (RUNSTATEDIR"/nm-l2tp-%s/key.pem", priv->uuid); -+ break; - -- if (!tls_need_password) -- return FALSE; -+ default : -+ key_filename = g_strdup (tls_key_filename); -+ } - -- password = nm_setting_vpn_get_secret (s_vpn, NM_L2TP_KEY_USER_CERTPASS); -- if (!password || !strlen (password)) { -- g_dbus_method_invocation_return_error_literal (invocation, -- NM_VPN_PLUGIN_ERROR, -- NM_VPN_PLUGIN_ERROR_INVALID_CONNECTION, -- _("Missing or invalid VPN user certificate password.")); -- return FALSE;; -+ if (!tls_need_password) { -+ nmdbus_l2tp_ppp_complete_need_secrets (object, invocation, key_filename, ""); -+ } else { -+ password = nm_setting_vpn_get_secret (s_vpn, NM_L2TP_KEY_USER_CERTPASS); -+ if (!password || !strlen (password)) { -+ g_dbus_method_invocation_return_error_literal (invocation, -+ NM_VPN_PLUGIN_ERROR, -+ NM_VPN_PLUGIN_ERROR_INVALID_CONNECTION, -+ _("Missing or invalid VPN user certificate password.")); -+ g_free (key_filename); -+ return FALSE;; -+ } -+ nmdbus_l2tp_ppp_complete_need_secrets (object, invocation, key_filename, password); - } -- nmdbus_l2tp_ppp_complete_need_secrets (object, invocation, tls_key_filename, password); -+ g_free (key_filename); - - } else { - /* Username; try L2TP specific username first, then generic username */ diff --git a/NetworkManager-l2tp.spec b/NetworkManager-l2tp.spec index 46fed91..f10a6df 100644 --- a/NetworkManager-l2tp.spec +++ b/NetworkManager-l2tp.spec @@ -6,13 +6,11 @@ Summary: NetworkManager VPN plugin for L2TP and L2TP/IPsec Name: NetworkManager-l2tp -Version: 1.8.0 -Release: 5%{?dist} +Version: 1.8.2 +Release: 1%{?dist} License: GPLv2+ URL: https://github.com/nm-l2tp/NetworkManager-l2tp Source: https://github.com/nm-l2tp/NetworkManager-l2tp/releases/download/%{version}/%{name}-%{version}.tar.xz -Patch1: NetworkManager-l2tp-1.8.0-libreswan-3.30.patch -Patch2: NetworkManager-l2tp-1.8.0-usercert.patch %global ppp_version %(sed -n 's/^#define\\s*VERSION\\s*"\\([^\\s]*\\)"$/\\1/p' %{_includedir}/pppd/patchlevel.h 2>/dev/null | grep . || echo bad) @@ -37,7 +35,7 @@ Requires: xl2tpd %if 0%{?fedora} < 24 && 0%{?rhel} < 8 Requires: libreswan %else -Recommends: libreswan +Recommends: (libreswan or strongswan) %endif %global __provides_exclude ^libnm-.*\\.so @@ -56,8 +54,6 @@ IPsec VPN support with the NetworkManager (GNOME files). %prep %setup -q -%patch1 -p1 -b .modp1024 -%patch2 -p1 -b .usercert %build if [ ! -f configure ]; then @@ -117,6 +113,11 @@ exit 0 %endif %changelog +* Thu Mar 26 2020 Douglas Kosovic - 1.8.2-1 +- Updated to 1.8.2 release +- Remove redundant patches +- Recommends (libreswan or strongswan) instead of just libreswan + * Thu Feb 27 2020 Douglas Kosovic - 1.8.0-5 - Patch for user certificate support fix diff --git a/sources b/sources index e2d4cb8..4088c20 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (NetworkManager-l2tp-1.8.0.tar.xz) = 8ef6732dbef2d24a51c6f70bcd98b272244dfc4d89e888e0d2c6c12b0042c1bcc750b73cdfda3489f4987af4fe85df4fc54976c48151996aa205939671d250da +SHA512 (NetworkManager-l2tp-1.8.2.tar.xz) = fc7f4037a4e2d442231f3c72692b7d405f13507625828dc4b975fab3717c7c0daaeaa757ef2ed875f347a87ac4ccaf5a0df1834235d8879f3d1e0d1b450531b8