rpms
/
NetworkManager-libreswan
21
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

import NetworkManager-libreswan-1.2.18-2.el9

Browse Source
i9c-beta changed/i9c-beta/NetworkManager-libreswan-1.2.18-2.el9
MSVSphere Packaging Team 9 months ago
commit 5d57419580
8 changed files with 838 additions and 0 deletions
Show Stats Download Patch File Download Diff File

1
.NetworkManager-libreswan.metadata
Unescape View File

@ -0,0 +1 @@
a57014f8a1c360546cb7fed5231efd7cfbf85bf3 SOURCES/NetworkManager-libreswan-1.2.18.tar.xz

1
.gitignore vendored
Unescape View File

@ -0,0 +1 @@
SOURCES/NetworkManager-libreswan-1.2.18.tar.xz

79
SOURCES/0001-service-properties-add-support-for-leftmodecfgclient.patch
Unescape View File

@ -0,0 +1,79 @@
From 0f0b2d375901e302e8a619e3911321f511b52885 Mon Sep 17 00:00:00 2001
From: Beniamino Galvani <bgalvani@redhat.com>
Date: Tue, 9 Jan 2024 23:30:42 +0100
Subject: [PATCH 1/5] service,properties: add support for leftmodecfgclient
Previously the plugin always set leftmodecfgclient=yes, which is used
for roaming clients to obtain a dynamic IP. In a server-to-server
scenario we don't want that option; allow omitting it by passing
leftmodecfgclient=no. It's somehow confusing that the new option has
the opposite default value than Libreswan, but that's the only way to
keep backwards compatibility for existing configurations.
---
properties/nm-libreswan-dialog.ui | 26 +++++++++++++++++++++++++
properties/nm-libreswan-editor-plugin.c | 2 ++
properties/nm-libreswan-editor.c | 9 +++++++++
shared/nm-service-defines.h | 1 +
shared/utils.c | 8 +++++++-
src/nm-libreswan-service.c | 1 +
6 files changed, 46 insertions(+), 1 deletion(-)
diff --git a/properties/nm-libreswan-editor-plugin.c b/properties/nm-libreswan-editor-plugin.c
index b5c0d9e..89243cc 100644
--- a/properties/nm-libreswan-editor-plugin.c
+++ b/properties/nm-libreswan-editor-plugin.c
@@ -182,6 +182,8 @@ import_from_file (NMVpnEditorPlugin *self,
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTUSERNAME, &str[13]);
else if (g_str_has_prefix (str, "leftcert="))
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTCERT, &str[9]);
+ else if (nm_streq0 (str, "leftmodecfgclient=no"))
+ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT, "no");
else if (g_str_has_prefix (str, "pfs=no"))
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_PFS, "no");
else if (g_str_has_prefix (str, "cisco-unity=yes"))
diff --git a/shared/nm-service-defines.h b/shared/nm-service-defines.h
index 3fdf2ef..14170ad 100644
--- a/shared/nm-service-defines.h
+++ b/shared/nm-service-defines.h
@@ -41,6 +41,7 @@
#define NM_LIBRESWAN_KEY_LEFTID "leftid"
#define NM_LIBRESWAN_KEY_LEFTRSASIGKEY "leftrsasigkey"
#define NM_LIBRESWAN_KEY_LEFTCERT "leftcert"
+#define NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT "leftmodecfgclient"
#define NM_LIBRESWAN_KEY_AUTHBY "authby"
#define NM_LIBRESWAN_KEY_PSK_VALUE "pskvalue"
#define NM_LIBRESWAN_KEY_PSK_INPUT_MODES "pskinputmodes"
diff --git a/shared/utils.c b/shared/utils.c
index cbc117c..0bac9e6 100644
--- a/shared/utils.c
+++ b/shared/utils.c
@@ -191,7 +191,13 @@ nm_libreswan_config_write (gint fd,
else
WRITE_CHECK (fd, debug_write_fcn, error, " left=%%defaultroute");
- WRITE_CHECK (fd, debug_write_fcn, error, " leftmodecfgclient=yes");
+ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT);
+ if (nm_streq0 (item, "no")) {
+ WRITE_CHECK (fd, debug_write_fcn, error, " leftmodecfgclient=no");
+ } else {
+ WRITE_CHECK (fd, debug_write_fcn, error, " leftmodecfgclient=yes");
+ }
+
if (leftupdown_script)
WRITE_CHECK (fd, debug_write_fcn, error, " leftupdown=%s", leftupdown_script);
diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c
index fc470a6..874f767 100644
--- a/src/nm-libreswan-service.c
+++ b/src/nm-libreswan-service.c
@@ -256,6 +256,7 @@ static ValidProperty valid_properties[] = {
{ NM_LIBRESWAN_KEY_LEFTUSERNAME, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_LEFTRSASIGKEY, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_LEFTCERT, G_TYPE_STRING, 0, 0 },
+ { NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_AUTHBY, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_DOMAIN, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_DHGROUP, G_TYPE_STRING, 0, 0 },
--
2.43.0

137
SOURCES/0002-service-use-new-API-to-send-configuration-to-NM.patch
Unescape View File

@ -0,0 +1,137 @@
From 09ee8838162cb6ea097375fb7d8b698566bb1c4d Mon Sep 17 00:00:00 2001
From: Beniamino Galvani <bgalvani@redhat.com>
Date: Wed, 10 Jan 2024 09:29:50 +0100
Subject: [PATCH 2/5] service: use new API to send configuration to NM
Instead of emitting the "Ip4Config" signal that contains both generic
and IPv4 configurations, use the more recent API and send two signals:
"Config" for the generic configuration and "Ip4Config" for IPv4
configuration.
In this way, it will be possible in the next commit to return no IPv4
configuration at all.
---
src/nm-libreswan-service.c | 61 +++++++++++++++++++++++++-------------
1 file changed, 40 insertions(+), 21 deletions(-)
diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c
index 874f767..2aca78f 100644
--- a/src/nm-libreswan-service.c
+++ b/src/nm-libreswan-service.c
@@ -1270,16 +1270,14 @@ handle_callback (NMDBusLibreswanHelper *object,
goto out;
}
+ /* First build and send the generic config */
g_variant_builder_init (&config, G_VARIANT_TYPE_VARDICT);
- /* Right peer (or Gateway) */
- val = addr4_to_gvariant (lookup_string (env, "PLUTO_PEER"));
- if (val)
- g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_GATEWAY, val);
- else {
- _LOGW ("IPsec/Pluto Right Peer (VPN Gateway)");
- goto out;
- }
+ /*
+ * Enabled address families
+ */
+ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP4, g_variant_new_boolean (TRUE));
+ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP6, g_variant_new_boolean (FALSE));
/*
* Tunnel device
@@ -1290,15 +1288,43 @@ handle_callback (NMDBusLibreswanHelper *object,
} else {
val = g_variant_new_string (NM_VPN_PLUGIN_IP4_CONFIG_TUNDEV_NONE);
}
+ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_TUNDEV, val);
+
+ /* Banner */
+ val = str_to_gvariant (lookup_string (env, "PLUTO_PEER_BANNER"), TRUE);
+ if (val)
+ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_BANNER, val);
+
+ /* Right peer (or Gateway) */
+ val = addr4_to_gvariant (lookup_string (env, "PLUTO_PEER"));
+ if (val)
+ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_EXT_GATEWAY, val);
+ else {
+ _LOGW ("IPsec/Pluto Right Peer (VPN Gateway) is missing");
+ goto out;
+ }
+
+ nm_vpn_service_plugin_set_config (NM_VPN_SERVICE_PLUGIN (user_data),
+ g_variant_builder_end (&config));
- g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_TUNDEV, val);
+ /* Then build and send the IPv4 config */
+ g_variant_builder_init (&config, G_VARIANT_TYPE_VARDICT);
+
+ /* Right peer (or Gateway) */
+ val = addr4_to_gvariant (lookup_string (env, "PLUTO_PEER"));
+ if (val)
+ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_GATEWAY, val);
+ else {
+ _LOGW ("IPsec/Pluto Right Peer (VPN Gateway) is missing");
+ goto out;
+ }
/* IP address */
val = addr4_to_gvariant (lookup_string (env, "PLUTO_MY_SOURCEIP"));
if (val)
g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_ADDRESS, val);
else {
- _LOGW ("IP4 Address");
+ _LOGW ("IP4 Address is missing");
goto out;
}
@@ -1307,7 +1333,7 @@ handle_callback (NMDBusLibreswanHelper *object,
if (val)
g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_PTP, val);
else {
- _LOGW ("IP4 PTP Address");
+ _LOGW ("IP4 PTP Address is missing");
goto out;
}
@@ -1324,7 +1350,6 @@ handle_callback (NMDBusLibreswanHelper *object,
if (val)
g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_DNS, val);
-
/* Default domain */
val = str_to_gvariant (lookup_string (env, "PLUTO_CISCO_DOMAIN_INFO"), TRUE);
if (!val) {
@@ -1334,11 +1359,6 @@ handle_callback (NMDBusLibreswanHelper *object,
if (val)
g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_DOMAIN, val);
- /* Banner */
- val = str_to_gvariant (lookup_string (env, "PLUTO_PEER_BANNER"), TRUE);
- if (val)
- g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_BANNER, val);
-
/* Indicates whether the VPN is using a XFRM interface (via option ipsec-interface=) */
is_xfrmi = nm_streq0 (lookup_string (env, "PLUTO_XFRMI_ROUTE"), "yes");
@@ -1369,12 +1389,11 @@ handle_callback (NMDBusLibreswanHelper *object,
g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_NEVER_DEFAULT, g_variant_new_boolean (TRUE));
success = TRUE;
+ nm_vpn_service_plugin_set_ip4_config (NM_VPN_SERVICE_PLUGIN (user_data),
+ g_variant_builder_end (&config));
out:
- if (success) {
- nm_vpn_service_plugin_set_ip4_config (NM_VPN_SERVICE_PLUGIN (user_data),
- g_variant_builder_end (&config));
- } else {
+ if (!success) {
connect_failed (NM_LIBRESWAN_PLUGIN (user_data), NULL,
NM_VPN_PLUGIN_FAILURE_CONNECT_FAILED);
}
--
2.43.0

72
SOURCES/0003-service-don-t-send-IPv4-config-if-mode-config-client.patch
Unescape View File

@ -0,0 +1,72 @@
From 74ec0f7dc18939dd4a5992584527ab044b284fc0 Mon Sep 17 00:00:00 2001
From: Beniamino Galvani <bgalvani@redhat.com>
Date: Wed, 10 Jan 2024 09:31:48 +0100
Subject: [PATCH 3/5] service: don't send IPv4 config if mode config client is
disabled
If the mode config client is disabled (i.e. in server-to-server
scenario) we are not going to receive a dynamic IP. The IP address
already configured on the existing interface is enough.
---
src/nm-libreswan-service.c | 20 +++++++++++++++++++-
1 file changed, 19 insertions(+), 1 deletion(-)
diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c
index 2aca78f..12cf6f2 100644
--- a/src/nm-libreswan-service.c
+++ b/src/nm-libreswan-service.c
@@ -1253,6 +1253,7 @@ handle_callback (NMDBusLibreswanHelper *object,
gpointer user_data)
{
NMLibreswanPluginPrivate *priv = NM_LIBRESWAN_PLUGIN_GET_PRIVATE (user_data);
+ NMSettingVpn *s_vpn;
GVariantBuilder config;
GVariantBuilder builder;
GVariant *val;
@@ -1260,7 +1261,9 @@ handle_callback (NMDBusLibreswanHelper *object,
guint i;
const char *verb;
const char *virt_if;
+ const char *str;
gboolean is_xfrmi = FALSE;
+ gboolean has_ip4;
_LOGI ("Configuration from the helper received.");
@@ -1273,10 +1276,21 @@ handle_callback (NMDBusLibreswanHelper *object,
/* First build and send the generic config */
g_variant_builder_init (&config, G_VARIANT_TYPE_VARDICT);
+ if ( priv->connection
+ && (s_vpn = nm_connection_get_setting_vpn (priv->connection))
+ && (str = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT))
+ && nm_streq (str, "no")) {
+ has_ip4 = FALSE;
+ } else {
+ has_ip4 = TRUE;
+ }
+
+ _LOGD ("Configuration has IPv4: %d", has_ip4);
+
/*
* Enabled address families
*/
- g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP4, g_variant_new_boolean (TRUE));
+ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP4, g_variant_new_boolean (has_ip4));
g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP6, g_variant_new_boolean (FALSE));
/*
@@ -1306,6 +1320,10 @@ handle_callback (NMDBusLibreswanHelper *object,
nm_vpn_service_plugin_set_config (NM_VPN_SERVICE_PLUGIN (user_data),
g_variant_builder_end (&config));
+ if (!has_ip4) {
+ success = TRUE;
+ goto out;
+ }
/* Then build and send the IPv4 config */
g_variant_builder_init (&config, G_VARIANT_TYPE_VARDICT);
--
2.43.0

67
SOURCES/0004-service-fix-wrong-refcounting-in-D-Bus-handler-for-C.patch
Unescape View File

@ -0,0 +1,67 @@
From 8ceb901719acac3778e1d76779d9c14289185157 Mon Sep 17 00:00:00 2001
From: Beniamino Galvani <bgalvani@redhat.com>
Date: Sat, 13 Jan 2024 18:10:02 +0100
Subject: [PATCH 4/5] service: fix wrong refcounting in D-Bus handler for
Callback()
The Callback() D-Bus method is handled via a GDBus-generated skeleton
code in nm-libreswan-helper-service-dbus.c, function
_nmdbus_libreswan_helper_skeleton_handle_method_call(). The function
emits signal "handle-callback" to let the program handle the incoming
method. As documented in the GDoc comments, the signal handler must
return TRUE if it handles the call.
```
/**
* NMDBusLibreswanHelper::handle-callback:
* @object: A #NMDBusLibreswanHelper.
* @invocation: A #GDBusMethodInvocation.
* @arg_environment: Argument passed by remote caller.
* Signal emitted when a remote caller is invoking the Callback()
D-Bus method.
* If a signal handler returns %TRUE, it means the signal handler
will handle the invocation (e.g. take a reference to @invocation
and eventually call nmdbus_libreswan_helper_complete_callback()
or e.g. g_dbus_method_invocation_return_error() on it) and no
other signal handlers will run. If no signal handler handles the
invocation, the %G_DBUS_ERROR_UNKNOWN_METHOD error is returned.
* Returns: %G_DBUS_METHOD_INVOCATION_HANDLED or %TRUE if the
invocation was handled, %G_DBUS_METHOD_INVOCATION_UNHANDLED or
%FALSE to let other signal handlers run.
*/
```
At the moment, in case of error the handler first calls
nmdbus_libreswan_helper_complete_callback() which decreases the
refcount of "invocation", and then returns FALSE which tells the
skeleton code to return an error, also unreferencing the
invocation. This causes a crash.
Since the G_DBUS_METHOD_INVOCATION_HANDLED alias for TRUE is only
available since GLib 2.68 (while we target 2.36), just return TRUE.
Fixes: acb9eb9de50b ('service: process the configuration in the service, not the helper')
---
src/nm-libreswan-service.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c
index 12cf6f2..0d5c4b8 100644
--- a/src/nm-libreswan-service.c
+++ b/src/nm-libreswan-service.c
@@ -1417,7 +1417,8 @@ out:
}
nmdbus_libreswan_helper_complete_callback (object, invocation);
- return success;
+
+ return TRUE;
}
/****************************************************************/
--
2.43.0

91
SOURCES/0005-service-properties-support-type-hostaddrfamily-clien.patch
Unescape View File

@ -0,0 +1,91 @@
From b4ba2add64bd9d362fe2e66748f23449f072216b Mon Sep 17 00:00:00 2001
From: Beniamino Galvani <bgalvani@redhat.com>
Date: Mon, 15 Jan 2024 13:23:45 +0100
Subject: [PATCH 5/5] service,properties: support type, hostaddrfamily,
clientaddrfamily
Add support for:
- type
- hostaddrfamily
- clientaddrfamily
Since those are very advanced options, don't implement the GUI part
for now.
---
properties/nm-libreswan-editor-plugin.c | 6 ++++++
shared/nm-service-defines.h | 3 +++
shared/utils.c | 12 ++++++++++++
src/nm-libreswan-service.c | 3 +++
4 files changed, 24 insertions(+)
diff --git a/properties/nm-libreswan-editor-plugin.c b/properties/nm-libreswan-editor-plugin.c
index 89243cc..fe85c81 100644
--- a/properties/nm-libreswan-editor-plugin.c
+++ b/properties/nm-libreswan-editor-plugin.c
@@ -206,6 +206,12 @@ import_from_file (NMVpnEditorPlugin *self,
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_IPSEC_INTERFACE, &str[16]);
else if (g_str_has_prefix (str, "authby="))
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_AUTHBY, &str[7]);
+ else if (g_str_has_prefix (str, "type="))
+ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_TYPE, str + NM_STRLEN("type="));
+ else if (g_str_has_prefix (str, "hostaddrfamily="))
+ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_HOSTADDRFAMILY, str + NM_STRLEN("hostaddrfamily="));
+ else if (g_str_has_prefix (str, "clientaddrfamily="))
+ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_CLIENTADDRFAMILY, str + NM_STRLEN("clientaddrfamily="));
else if (g_str_has_prefix (str, "rightsubnet=")) {
if (!g_str_has_prefix (str, "rightsubnet=0.0.0.0/0"))
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_REMOTENETWORK, &str[12]);
diff --git a/shared/nm-service-defines.h b/shared/nm-service-defines.h
index 14170ad..95e19d4 100644
--- a/shared/nm-service-defines.h
+++ b/shared/nm-service-defines.h
@@ -68,6 +68,9 @@
#define NM_LIBRESWAN_KEY_FRAGMENTATION "fragmentation"
#define NM_LIBRESWAN_KEY_MOBIKE "mobike"
#define NM_LIBRESWAN_KEY_IPSEC_INTERFACE "ipsec-interface"
+#define NM_LIBRESWAN_KEY_TYPE "type"
+#define NM_LIBRESWAN_KEY_HOSTADDRFAMILY "hostaddrfamily"
+#define NM_LIBRESWAN_KEY_CLIENTADDRFAMILY "clientaddrfamily"
#define NM_LIBRESWAN_IKEV2_NO "no"
#define NM_LIBRESWAN_IKEV2_NEVER "never"
diff --git a/shared/utils.c b/shared/utils.c
index 0bac9e6..9e616f8 100644
--- a/shared/utils.c
+++ b/shared/utils.c
@@ -325,6 +325,18 @@ nm_libreswan_config_write (gint fd,
if (item && strlen (item))
WRITE_CHECK (fd, debug_write_fcn, error, " ipsec-interface=%s", item);
+ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_TYPE);
+ if (item && strlen (item))
+ WRITE_CHECK (fd, debug_write_fcn, error, " type=%s", item);
+
+ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_HOSTADDRFAMILY);
+ if (item && strlen (item))
+ WRITE_CHECK (fd, debug_write_fcn, error, " hostaddrfamily=%s", item);
+
+ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_CLIENTADDRFAMILY);
+ if (item && strlen (item))
+ WRITE_CHECK (fd, debug_write_fcn, error, " clientaddrfamily=%s", item);
+
WRITE_CHECK (fd, debug_write_fcn, error, " nm-configured=yes");
WRITE_CHECK_NEWLINE (fd, trailing_newline, debug_write_fcn, error, " auto=add");
diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c
index 0d5c4b8..7e96230 100644
--- a/src/nm-libreswan-service.c
+++ b/src/nm-libreswan-service.c
@@ -277,6 +277,9 @@ static ValidProperty valid_properties[] = {
{ NM_LIBRESWAN_KEY_FRAGMENTATION, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_MOBIKE, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_IPSEC_INTERFACE, G_TYPE_STRING, 0, 0 },
+ { NM_LIBRESWAN_KEY_TYPE, G_TYPE_STRING, 0, 0 },
+ { NM_LIBRESWAN_KEY_HOSTADDRFAMILY, G_TYPE_STRING, 0, 0 },
+ { NM_LIBRESWAN_KEY_CLIENTADDRFAMILY, G_TYPE_STRING, 0, 0 },
/* Ignored option for internal use */
{ NM_LIBRESWAN_KEY_PSK_INPUT_MODES, G_TYPE_NONE, 0, 0 },
{ NM_LIBRESWAN_KEY_XAUTH_PASSWORD_INPUT_MODES, G_TYPE_NONE, 0, 0 },
--
2.43.0

390
SPECS/NetworkManager-libreswan.spec
Unescape View File

@ -0,0 +1,390 @@
%if 0%{?fedora} < 28 && 0%{?rhel} < 8
%bcond_without libnm_glib
%else
%bcond_with libnm_glib
%endif
%if 0%{?fedora} < 36 && 0%{?rhel} < 10
%bcond_with gtk4
%else
%bcond_without gtk4
%endif
%global real_version 1.2.18
%global rpm_version 1.2.18
%global release_version 2
%global real_version_major %(printf '%s' '%{real_version}' | sed -n 's/^\\([1-9][0-9]*\\.[1-9][0-9]*\\)\\.[1-9][0-9]*$/\\1/p')
%global nm_version 1:1.2.0
%global nma_version 1.2.0
Summary: NetworkManager VPN plug-in for IPsec VPN
Name: NetworkManager-libreswan
Version: %{rpm_version}
Release: %{release_version}%{?dist}
License: GPLv2+
URL: http://www.gnome.org/projects/NetworkManager/
Source0: https://download.gnome.org/sources/NetworkManager-libreswan/%{real_version_major}/%{name}-%{real_version}.tar.xz
Patch1: 0001-service-properties-add-support-for-leftmodecfgclient.patch
Patch2: 0002-service-use-new-API-to-send-configuration-to-NM.patch
Patch3: 0003-service-don-t-send-IPv4-config-if-mode-config-client.patch
Patch4: 0004-service-fix-wrong-refcounting-in-D-Bus-handler-for-C.patch
Patch5: 0005-service-properties-support-type-hostaddrfamily-clien.patch
BuildRequires: make
BuildRequires: gcc
BuildRequires: gtk3-devel
BuildRequires: libnl3-devel
BuildRequires: NetworkManager-libnm-devel >= %{nm_version}
BuildRequires: libnma-devel >= %{nma_version}
BuildRequires: libsecret-devel
BuildRequires: intltool gettext
%if %with libnm_glib
BuildRequires: NetworkManager-devel >= %{nm_version}
BuildRequires: NetworkManager-glib-devel >= %{nm_version}
BuildRequires: libnm-gtk-devel >= %{nma_version}
%endif
%if %with gtk4
BuildRequires: libnma-gtk4-devel
%endif
Requires: NetworkManager >= %{nm_version}
Requires: dbus
Requires: /usr/sbin/ipsec
Provides: NetworkManager-openswan = %{version}-%{release}
Obsoletes: NetworkManager-openswan < %{version}-%{release}
%global _privatelibs libnm-libreswan-properties[.]so.*
%global __provides_exclude ^(%{_privatelibs})$
%global __requires_exclude ^(%{_privatelibs})$
%description
This package contains software for integrating the libreswan VPN software
with NetworkManager and the GNOME desktop
%package -n NetworkManager-libreswan-gnome
Summary: NetworkManager VPN plugin for libreswan - GNOME files
Requires: %{name}%{?_isa} = %{version}-%{release}
Requires: shared-mime-info
Provides: NetworkManager-openswan-gnome = %{version}-%{release}
Obsoletes: NetworkManager-openswan-gnome < %{version}-%{release}
%description -n NetworkManager-libreswan-gnome
This package contains software for integrating VPN capabilities with
the libreswan server with NetworkManager (GNOME files).
%prep
%autosetup -p1 -n "%{name}-%{real_version}"
%build
%configure \
--disable-static \
%if %with gtk4
--with-gtk4 \
%endif
%if %without libnm_glib
--without-libnm-glib \
%endif
--enable-more-warnings=yes \
--with-dist-version=%{version}-%{release}
make %{?_smp_mflags}
%install
make install DESTDIR=%{buildroot}
rm -f %{buildroot}%{_libdir}/NetworkManager/lib*.la
%find_lang %{name}
%files -f %{name}.lang
%{_libdir}/NetworkManager/libnm-vpn-plugin-libreswan.so
%{_sysconfdir}/dbus-1/system.d/nm-libreswan-service.conf
%{_prefix}/lib/NetworkManager/VPN/nm-libreswan-service.name
%{_libexecdir}/nm-libreswan-service
%{_libexecdir}/nm-libreswan-service-helper
%{_mandir}/man5/nm-settings-libreswan.5.gz
%doc AUTHORS NEWS
%license COPYING
%files -n NetworkManager-libreswan-gnome
%{_libexecdir}/nm-libreswan-auth-dialog
%{_libdir}/NetworkManager/libnm-vpn-plugin-libreswan-editor.so
%{_metainfodir}/network-manager-libreswan.metainfo.xml
%if %with libnm_glib
%{_libdir}/NetworkManager/libnm-*-properties.so
%{_sysconfdir}/NetworkManager/VPN/nm-libreswan-service.name
%endif
%if %with gtk4
%{_libdir}/NetworkManager/libnm-gtk4-vpn-plugin-libreswan-editor.so
%endif
%changelog
* Thu Mar 28 2024 MSVSphere Packaging Team <packager@msvsphere-os.ru> - 1.2.18-2
- Rebuilt for MSVSphere 9.4 beta
* Wed Jan 17 2024 Fernando Fernandez Mancera <ferferna@redhat.com> - 1.2.18-2
- Support point-to-point IPSec tunnel (RHEL-20690)
- Fix crash in libreswan_nmstate_iface_dpd_rsa (RHEL-21221)
- Support configuring IPSec mode with 'type' (RHEL-21554)
* Fri Dec 15 2023 Fernando Fernandez Mancera <ferferna@redhat.com> - 1.2.18-1
- Update to 1.2.18 release
* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 1.2.14-1.3
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
Related: rhbz#1991688
* Thu Apr 15 2021 Mohan Boddu <mboddu@redhat.com> - 1.2.14-1.2
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
* Mon Jan 25 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.14-1.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
* Tue Jan 12 2021 Beniamino Galvani <bgalvani@redhat.com> - 1.2.14-1
- Update to 1.2.14 release
* Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.12-1.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.12-1.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
* Wed Jul 31 2019 Francesco Giudici <fgiudici@redhat.com> - 1.2.12-1
- Updated to 1.2.12
* Wed Jul 24 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.10-1.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
* Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.10-1.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
* Thu Oct 18 2018 Francesco Giudici <fgiudici@redhat.com> - 1.2.10-1
- Updated to 1.2.10
- Import latest translations from upstream
* Wed Aug 22 2018 Paul Wouters <pwouters@redhat.com> - 1.2.6-1
- Updated to 1.2.6
- Upstream patches for IKEv2 support
* Thu Jul 12 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.4-7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.4-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
* Thu Nov 30 2017 Lubomir Rintel <lkundrak@v3.sk> - 1.2.4-4
- Drop libnm-glib for Fedora 28
* Wed Aug 02 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.4-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.4-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.4-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
* Thu Jun 30 2016 Thomas Haller <thaller@redhat.com> - 1.2.4-1
- Update to 1.2.4 release
- Move base VPN plugin library to base libreswan package
- Don't require nm-connection-editor anymore
* Wed May 11 2016 Lubomir Rintel <lkundrak@v3.sk> - 1.2.2-1
- Update to 1.2.2 release
* Wed Apr 20 2016 Lubomir Rintel <lkundrak@v3.sk> - 1.2.0-1
- Update to 1.2.0 release
* Tue Apr 5 2016 Lubomir Rintel <lkundrak@v3.sk> - 1.2.0-0.4.rc1
- Update to NetworkManager-libreswan 1.2-rc1
* Tue Mar 1 2016 Lubomir Rintel <lkundrak@v3.sk> - 1.2.0-0.4.beta2
- Update to NetworkManager-libreswan 1.2-beta2
* Wed Feb 03 2016 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.0-0.4.beta1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
* Mon Feb 1 2016 Lubomir Rintel <lkundrak@v3.sk> - 1.2.0-0.3.beta1
- Update to support Main mode & better Libreswan integration
* Tue Jan 19 2016 Lubomir Rintel <lkundrak@v3.sk> - 1.2.0-0.2.beta1
- Update to NetworkManager-libreswan 1.2-beta1
* Wed Dec 16 2015 Lubomir Rintel <lkundrak@v3.sk> - 1.2.0-0.1.20151216gite52aff0
- A newer git snapshot with import/export support
* Mon Nov 16 2015 Lubomir Rintel <lkundrak@v3.sk> - 1.2.0-0.1.20151116git15db395
- Rename to NetworkManager-libreswan
- A newer git snapshot with multiple connection support
* Fri Oct 23 2015 Lubomir Rintel <lkundrak@v3.sk> - 1.2.0-0.1.20151023git8a39c0f
- Update to a newer git snapshot
* Tue Sep 1 2015 Lubomir Rintel <lkundrak@v3.sk> - 1.2.0-0.1.20150901git92f1611
- Update to 1.2 git snapshot with libnm-based properties plugin
* Fri Aug 28 2015 Lubomir Rintel <lkundrak@v3.sk> - 1.0.6-2
- Don't unconditionally set cisco-unity=yes
* Thu Aug 27 2015 Lubomir Rintel <lkundrak@v3.sk> - 1.0.6-1
- Update to 1.0.6 release
* Tue Jun 16 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.0.2-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
* Tue May 5 2015 Lubomir Rintel <lkundrak@v3.sk> - 1.0.2-1
- Update to 1.0.2 release
* Mon Dec 22 2014 Dan Williams <dcbw@redhat.com> - 1.0.0-1
- Update to 1.0
* Fri Aug 15 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.9.8.4-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
* Fri Jun 06 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.9.8.4-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
* Thu Dec 12 2013 Avesh Agarwal <avagarwa@redhat.com> - 0.9.8.4-2
- Fixes 1035786 (and its duplicate 1040924)
* Tue Dec 10 2013 Avesh Agarwal <avagarwa@redhat.com> - 0.9.8.4-1
- New upstream release 0.9.8.4
- Fixed 926225
- Fixed dependency to libreswan.
- Created a new sub package NetworkManager-openswan-gnome
- Various other spec file fixes.
- Additional code changes are as follows:
- Fixed an issue where proper network stack is not loaded unless
_stackmanager is run before starting pluto daemon service.
- Fixed the termination operation of pluto daemon to comply with
libreswan changes.
- Fixed various debug messages.
- Fixed initiation of pluto daemon by this plugin to reflect the
changes in libreaswan.
- Fixed defaults values for more parameters to help the VPN
connection stay more reliable.
- Rewrote pluto watch API which watches the pluto process for its status.
Fixed memory leak issues as not all child processes were reaped correctly.
Also g_spwan_close_pid was not being called after children were reaped.
Also modified debugs and added more to help with debugging in the future.
- Fixed an issue where nm-openswan service is searching for ipsec binary in
both /sbin and /usr/sbin leading to same operation twice, as /sbin is just
symlink to /usr/sbin, so removed /sbin from the search paths.
- Fixed some libreswan related macro changes.
- Fixed netmask issue when sending IP information to the nm openswan
plugin service.
- Fixed the current code as it does not set the default route field
NM_VPN_PLUGIN_IP4_CONFIG_NEVER_DEFAULT when sending VPN information
to nm-openswan plugin. This fix sets the field to TRUE.
- Fixed some issues found by coverity scan.
- Fixed an issue where writing configuration on stdin should not end with
\n as it gives error. It used to work previously, but not with latest
NetworkManager versions.
- libreswan related fixes, as some macros have been modified after forking
to libreswan from openswan.
- openswan/libreswan does not provide tun0 interface, so fixed the code
where it sends tun0 interface.
- Fix prcoessing of nm-openswan-dialog.ui file and added more error notifications.
- Fixed dead code based on coverity scan.
- Fixed gnomekeyring lib dependencies.
- Fixed Networkmanager and related lib dependencies.
- Fixed gtk label max width issue by setting it to 35.
- NM-openswan was missing support for nm-openswan-auth-dialog.desktop.in.in.
So added a new nm-openswan-auth-dialog.desktop.in.in, and modified related
Makefile and configure.ac files.
* Mon Aug 5 2013 Avesh Agarwal <avagarwa@redhat.com> - 0.9.8.0-1
- Rebase to latest upstream version 0.9.8.0
- Fixed several issues with the packaging
* Fri Aug 02 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.9.3.995-6.git20120302
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
* Wed Feb 13 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.9.3.995-5.git20120302
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
* Thu Dec 13 2012 Avesh Agarwal <avagarwa@redhat.com> - 0.9.3.995-4
Resolves: #845599, #865883
* Wed Jul 18 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.9.3.995-3.git20120302
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
* Fri Apr 27 2012 Avesh Agarwal <avagarwa@redhat.com> - 0.9.3.995-2
- Ported changes from rhel to fedora
* Fri Mar 2 2012 Dan Williams <dcbw@redhat.com> - 0.9.3.995-1
- Update to 0.9.3.995 (0.9.4-beta1)
- ui: add support for external UI mode, eg GNOME Shell
* Thu Jan 12 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.9.0-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
* Tue Dec 06 2011 Adam Jackson <ajax@redhat.com> - 0.9.0-2
- Rebuild for new libpng
* Fri Aug 26 2011 Dan Williams <dcbw@redhat.com> - 0.9.0-1
- Update to 0.9.0
- ui: translation fixes
* Thu Jul 21 2011 Dan Williams <dcbw@redhat.com> - 0.8.999-2.git20110721
- Update to git snapshot
- Fixes for secrets handling and saving
* Tue May 03 2011 Dan Williams <dcbw@redhat.com> - 0.8.999-1
- Update to 0.8.999 (0.9-rc2)
- Port to GTK 3.0 and GtkBuilder
- Fix some issues with secrets storage
* Sun Mar 27 2011 Christopher Aillon <caillon@redhat.com> - 0.8.0-9.20100411git
- Rebuild against NetworkManager 0.9
* Wed Feb 16 2011 Avesh Agarwal <avagarwa@redhat.com> - 0.8.0-8.20100411git
- fixes for compile time errors
* Mon Feb 07 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.8.0-7.20100411git
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
* Tue Sep 7 2010 Avesh Agarwal <avagarwa@redhat.com> - 0.8.0-6.20100411git
- Modified import and export interfaces to import_from_file and export_to_file, respectively,
due to changes in NMVpnPluginUiInterface struct in NM (bz 631159).
* Mon Jul 26 2010 Avesh Agarwal <avagarwa@redhat.com> - 0.8.0-5.20100411git
Resolves: #616910
- Support for reading phase1 and phase2 algorithms through GUI
* Tue Jul 13 2010 Avesh Agarwal <avagarwa@redhat.com> - 0.8.0-4.20100411git
- Modified fix for the bz 607352
- Fix to read connection configuration from stdin
- Fix to read Xauth user password from stdin
- Fix to delete the secret file as soon as read by Openswan
* Thu Jul 8 2010 Avesh Agarwal <avagarwa@redhat.com> - 0.8.0-3.20100411git
- Modified the patch so that it does not pass user password to
"ipsec whack" command.
* Thu Jul 8 2010 Avesh Agarwal <avagarwa@redhat.com> - 0.8.0-2.20100411git
- Modified to initiate VPN connections with openswan whack interface
- Fixed the issue of world readable conf and secret files
- Cleaned conf and secret files after VPN connection is stopped
- Fixed the issue of storing sensitive information like user
password in a file (rhbz# 607352)
- Changed PLUTO_SERVERBANNER to PLUTO_PEER_BANNER due
to the same change in Openswan
- Modifed GUI to remove unused configuration boxes
* Tue Jun 15 2010 Avesh Agarwal <avagarwa@redhat.com> - 0.8.0-1.20100%{version}t
- Initial build
Write Preview
Loading…
Cancel
Save