From 5d57419580df5370f7bf7fa52adb107d4e2cd152 Mon Sep 17 00:00:00 2001 From: MSVSphere Packaging Team Date: Thu, 28 Mar 2024 15:44:40 +0300 Subject: [PATCH] import NetworkManager-libreswan-1.2.18-2.el9 --- .NetworkManager-libreswan.metadata | 1 + .gitignore | 1 + ...es-add-support-for-leftmodecfgclient.patch | 79 ++++ ...-new-API-to-send-configuration-to-NM.patch | 137 ++++++ ...nd-IPv4-config-if-mode-config-client.patch | 72 ++++ ...g-refcounting-in-D-Bus-handler-for-C.patch | 67 +++ ...es-support-type-hostaddrfamily-clien.patch | 91 ++++ SPECS/NetworkManager-libreswan.spec | 390 ++++++++++++++++++ 8 files changed, 838 insertions(+) create mode 100644 .NetworkManager-libreswan.metadata create mode 100644 .gitignore create mode 100644 SOURCES/0001-service-properties-add-support-for-leftmodecfgclient.patch create mode 100644 SOURCES/0002-service-use-new-API-to-send-configuration-to-NM.patch create mode 100644 SOURCES/0003-service-don-t-send-IPv4-config-if-mode-config-client.patch create mode 100644 SOURCES/0004-service-fix-wrong-refcounting-in-D-Bus-handler-for-C.patch create mode 100644 SOURCES/0005-service-properties-support-type-hostaddrfamily-clien.patch create mode 100644 SPECS/NetworkManager-libreswan.spec diff --git a/.NetworkManager-libreswan.metadata b/.NetworkManager-libreswan.metadata new file mode 100644 index 0000000..5f9e2f2 --- /dev/null +++ b/.NetworkManager-libreswan.metadata @@ -0,0 +1 @@ +a57014f8a1c360546cb7fed5231efd7cfbf85bf3 SOURCES/NetworkManager-libreswan-1.2.18.tar.xz diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..ccdf14f --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +SOURCES/NetworkManager-libreswan-1.2.18.tar.xz diff --git a/SOURCES/0001-service-properties-add-support-for-leftmodecfgclient.patch b/SOURCES/0001-service-properties-add-support-for-leftmodecfgclient.patch new file mode 100644 index 0000000..f66bf0f --- /dev/null +++ b/SOURCES/0001-service-properties-add-support-for-leftmodecfgclient.patch @@ -0,0 +1,79 @@ +From 0f0b2d375901e302e8a619e3911321f511b52885 Mon Sep 17 00:00:00 2001 +From: Beniamino Galvani +Date: Tue, 9 Jan 2024 23:30:42 +0100 +Subject: [PATCH 1/5] service,properties: add support for leftmodecfgclient + +Previously the plugin always set leftmodecfgclient=yes, which is used +for roaming clients to obtain a dynamic IP. In a server-to-server +scenario we don't want that option; allow omitting it by passing +leftmodecfgclient=no. It's somehow confusing that the new option has +the opposite default value than Libreswan, but that's the only way to +keep backwards compatibility for existing configurations. +--- + properties/nm-libreswan-dialog.ui | 26 +++++++++++++++++++++++++ + properties/nm-libreswan-editor-plugin.c | 2 ++ + properties/nm-libreswan-editor.c | 9 +++++++++ + shared/nm-service-defines.h | 1 + + shared/utils.c | 8 +++++++- + src/nm-libreswan-service.c | 1 + + 6 files changed, 46 insertions(+), 1 deletion(-) + +diff --git a/properties/nm-libreswan-editor-plugin.c b/properties/nm-libreswan-editor-plugin.c +index b5c0d9e..89243cc 100644 +--- a/properties/nm-libreswan-editor-plugin.c ++++ b/properties/nm-libreswan-editor-plugin.c +@@ -182,6 +182,8 @@ import_from_file (NMVpnEditorPlugin *self, + nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTUSERNAME, &str[13]); + else if (g_str_has_prefix (str, "leftcert=")) + nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTCERT, &str[9]); ++ else if (nm_streq0 (str, "leftmodecfgclient=no")) ++ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT, "no"); + else if (g_str_has_prefix (str, "pfs=no")) + nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_PFS, "no"); + else if (g_str_has_prefix (str, "cisco-unity=yes")) +diff --git a/shared/nm-service-defines.h b/shared/nm-service-defines.h +index 3fdf2ef..14170ad 100644 +--- a/shared/nm-service-defines.h ++++ b/shared/nm-service-defines.h +@@ -41,6 +41,7 @@ + #define NM_LIBRESWAN_KEY_LEFTID "leftid" + #define NM_LIBRESWAN_KEY_LEFTRSASIGKEY "leftrsasigkey" + #define NM_LIBRESWAN_KEY_LEFTCERT "leftcert" ++#define NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT "leftmodecfgclient" + #define NM_LIBRESWAN_KEY_AUTHBY "authby" + #define NM_LIBRESWAN_KEY_PSK_VALUE "pskvalue" + #define NM_LIBRESWAN_KEY_PSK_INPUT_MODES "pskinputmodes" +diff --git a/shared/utils.c b/shared/utils.c +index cbc117c..0bac9e6 100644 +--- a/shared/utils.c ++++ b/shared/utils.c +@@ -191,7 +191,13 @@ nm_libreswan_config_write (gint fd, + else + WRITE_CHECK (fd, debug_write_fcn, error, " left=%%defaultroute"); + +- WRITE_CHECK (fd, debug_write_fcn, error, " leftmodecfgclient=yes"); ++ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT); ++ if (nm_streq0 (item, "no")) { ++ WRITE_CHECK (fd, debug_write_fcn, error, " leftmodecfgclient=no"); ++ } else { ++ WRITE_CHECK (fd, debug_write_fcn, error, " leftmodecfgclient=yes"); ++ } ++ + if (leftupdown_script) + WRITE_CHECK (fd, debug_write_fcn, error, " leftupdown=%s", leftupdown_script); + +diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c +index fc470a6..874f767 100644 +--- a/src/nm-libreswan-service.c ++++ b/src/nm-libreswan-service.c +@@ -256,6 +256,7 @@ static ValidProperty valid_properties[] = { + { NM_LIBRESWAN_KEY_LEFTUSERNAME, G_TYPE_STRING, 0, 0 }, + { NM_LIBRESWAN_KEY_LEFTRSASIGKEY, G_TYPE_STRING, 0, 0 }, + { NM_LIBRESWAN_KEY_LEFTCERT, G_TYPE_STRING, 0, 0 }, ++ { NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT, G_TYPE_STRING, 0, 0 }, + { NM_LIBRESWAN_KEY_AUTHBY, G_TYPE_STRING, 0, 0 }, + { NM_LIBRESWAN_KEY_DOMAIN, G_TYPE_STRING, 0, 0 }, + { NM_LIBRESWAN_KEY_DHGROUP, G_TYPE_STRING, 0, 0 }, +-- +2.43.0 + diff --git a/SOURCES/0002-service-use-new-API-to-send-configuration-to-NM.patch b/SOURCES/0002-service-use-new-API-to-send-configuration-to-NM.patch new file mode 100644 index 0000000..6c4d2d9 --- /dev/null +++ b/SOURCES/0002-service-use-new-API-to-send-configuration-to-NM.patch @@ -0,0 +1,137 @@ +From 09ee8838162cb6ea097375fb7d8b698566bb1c4d Mon Sep 17 00:00:00 2001 +From: Beniamino Galvani +Date: Wed, 10 Jan 2024 09:29:50 +0100 +Subject: [PATCH 2/5] service: use new API to send configuration to NM + +Instead of emitting the "Ip4Config" signal that contains both generic +and IPv4 configurations, use the more recent API and send two signals: +"Config" for the generic configuration and "Ip4Config" for IPv4 +configuration. + +In this way, it will be possible in the next commit to return no IPv4 +configuration at all. +--- + src/nm-libreswan-service.c | 61 +++++++++++++++++++++++++------------- + 1 file changed, 40 insertions(+), 21 deletions(-) + +diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c +index 874f767..2aca78f 100644 +--- a/src/nm-libreswan-service.c ++++ b/src/nm-libreswan-service.c +@@ -1270,16 +1270,14 @@ handle_callback (NMDBusLibreswanHelper *object, + goto out; + } + ++ /* First build and send the generic config */ + g_variant_builder_init (&config, G_VARIANT_TYPE_VARDICT); + +- /* Right peer (or Gateway) */ +- val = addr4_to_gvariant (lookup_string (env, "PLUTO_PEER")); +- if (val) +- g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_GATEWAY, val); +- else { +- _LOGW ("IPsec/Pluto Right Peer (VPN Gateway)"); +- goto out; +- } ++ /* ++ * Enabled address families ++ */ ++ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP4, g_variant_new_boolean (TRUE)); ++ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP6, g_variant_new_boolean (FALSE)); + + /* + * Tunnel device +@@ -1290,15 +1288,43 @@ handle_callback (NMDBusLibreswanHelper *object, + } else { + val = g_variant_new_string (NM_VPN_PLUGIN_IP4_CONFIG_TUNDEV_NONE); + } ++ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_TUNDEV, val); ++ ++ /* Banner */ ++ val = str_to_gvariant (lookup_string (env, "PLUTO_PEER_BANNER"), TRUE); ++ if (val) ++ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_BANNER, val); ++ ++ /* Right peer (or Gateway) */ ++ val = addr4_to_gvariant (lookup_string (env, "PLUTO_PEER")); ++ if (val) ++ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_EXT_GATEWAY, val); ++ else { ++ _LOGW ("IPsec/Pluto Right Peer (VPN Gateway) is missing"); ++ goto out; ++ } ++ ++ nm_vpn_service_plugin_set_config (NM_VPN_SERVICE_PLUGIN (user_data), ++ g_variant_builder_end (&config)); + +- g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_TUNDEV, val); ++ /* Then build and send the IPv4 config */ ++ g_variant_builder_init (&config, G_VARIANT_TYPE_VARDICT); ++ ++ /* Right peer (or Gateway) */ ++ val = addr4_to_gvariant (lookup_string (env, "PLUTO_PEER")); ++ if (val) ++ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_GATEWAY, val); ++ else { ++ _LOGW ("IPsec/Pluto Right Peer (VPN Gateway) is missing"); ++ goto out; ++ } + + /* IP address */ + val = addr4_to_gvariant (lookup_string (env, "PLUTO_MY_SOURCEIP")); + if (val) + g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_ADDRESS, val); + else { +- _LOGW ("IP4 Address"); ++ _LOGW ("IP4 Address is missing"); + goto out; + } + +@@ -1307,7 +1333,7 @@ handle_callback (NMDBusLibreswanHelper *object, + if (val) + g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_PTP, val); + else { +- _LOGW ("IP4 PTP Address"); ++ _LOGW ("IP4 PTP Address is missing"); + goto out; + } + +@@ -1324,7 +1350,6 @@ handle_callback (NMDBusLibreswanHelper *object, + if (val) + g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_DNS, val); + +- + /* Default domain */ + val = str_to_gvariant (lookup_string (env, "PLUTO_CISCO_DOMAIN_INFO"), TRUE); + if (!val) { +@@ -1334,11 +1359,6 @@ handle_callback (NMDBusLibreswanHelper *object, + if (val) + g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_DOMAIN, val); + +- /* Banner */ +- val = str_to_gvariant (lookup_string (env, "PLUTO_PEER_BANNER"), TRUE); +- if (val) +- g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_BANNER, val); +- + /* Indicates whether the VPN is using a XFRM interface (via option ipsec-interface=) */ + is_xfrmi = nm_streq0 (lookup_string (env, "PLUTO_XFRMI_ROUTE"), "yes"); + +@@ -1369,12 +1389,11 @@ handle_callback (NMDBusLibreswanHelper *object, + g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_NEVER_DEFAULT, g_variant_new_boolean (TRUE)); + + success = TRUE; ++ nm_vpn_service_plugin_set_ip4_config (NM_VPN_SERVICE_PLUGIN (user_data), ++ g_variant_builder_end (&config)); + + out: +- if (success) { +- nm_vpn_service_plugin_set_ip4_config (NM_VPN_SERVICE_PLUGIN (user_data), +- g_variant_builder_end (&config)); +- } else { ++ if (!success) { + connect_failed (NM_LIBRESWAN_PLUGIN (user_data), NULL, + NM_VPN_PLUGIN_FAILURE_CONNECT_FAILED); + } +-- +2.43.0 + diff --git a/SOURCES/0003-service-don-t-send-IPv4-config-if-mode-config-client.patch b/SOURCES/0003-service-don-t-send-IPv4-config-if-mode-config-client.patch new file mode 100644 index 0000000..11d8fcc --- /dev/null +++ b/SOURCES/0003-service-don-t-send-IPv4-config-if-mode-config-client.patch @@ -0,0 +1,72 @@ +From 74ec0f7dc18939dd4a5992584527ab044b284fc0 Mon Sep 17 00:00:00 2001 +From: Beniamino Galvani +Date: Wed, 10 Jan 2024 09:31:48 +0100 +Subject: [PATCH 3/5] service: don't send IPv4 config if mode config client is + disabled + +If the mode config client is disabled (i.e. in server-to-server +scenario) we are not going to receive a dynamic IP. The IP address +already configured on the existing interface is enough. +--- + src/nm-libreswan-service.c | 20 +++++++++++++++++++- + 1 file changed, 19 insertions(+), 1 deletion(-) + +diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c +index 2aca78f..12cf6f2 100644 +--- a/src/nm-libreswan-service.c ++++ b/src/nm-libreswan-service.c +@@ -1253,6 +1253,7 @@ handle_callback (NMDBusLibreswanHelper *object, + gpointer user_data) + { + NMLibreswanPluginPrivate *priv = NM_LIBRESWAN_PLUGIN_GET_PRIVATE (user_data); ++ NMSettingVpn *s_vpn; + GVariantBuilder config; + GVariantBuilder builder; + GVariant *val; +@@ -1260,7 +1261,9 @@ handle_callback (NMDBusLibreswanHelper *object, + guint i; + const char *verb; + const char *virt_if; ++ const char *str; + gboolean is_xfrmi = FALSE; ++ gboolean has_ip4; + + _LOGI ("Configuration from the helper received."); + +@@ -1273,10 +1276,21 @@ handle_callback (NMDBusLibreswanHelper *object, + /* First build and send the generic config */ + g_variant_builder_init (&config, G_VARIANT_TYPE_VARDICT); + ++ if ( priv->connection ++ && (s_vpn = nm_connection_get_setting_vpn (priv->connection)) ++ && (str = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT)) ++ && nm_streq (str, "no")) { ++ has_ip4 = FALSE; ++ } else { ++ has_ip4 = TRUE; ++ } ++ ++ _LOGD ("Configuration has IPv4: %d", has_ip4); ++ + /* + * Enabled address families + */ +- g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP4, g_variant_new_boolean (TRUE)); ++ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP4, g_variant_new_boolean (has_ip4)); + g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP6, g_variant_new_boolean (FALSE)); + + /* +@@ -1306,6 +1320,10 @@ handle_callback (NMDBusLibreswanHelper *object, + + nm_vpn_service_plugin_set_config (NM_VPN_SERVICE_PLUGIN (user_data), + g_variant_builder_end (&config)); ++ if (!has_ip4) { ++ success = TRUE; ++ goto out; ++ } + + /* Then build and send the IPv4 config */ + g_variant_builder_init (&config, G_VARIANT_TYPE_VARDICT); +-- +2.43.0 + diff --git a/SOURCES/0004-service-fix-wrong-refcounting-in-D-Bus-handler-for-C.patch b/SOURCES/0004-service-fix-wrong-refcounting-in-D-Bus-handler-for-C.patch new file mode 100644 index 0000000..d0a3624 --- /dev/null +++ b/SOURCES/0004-service-fix-wrong-refcounting-in-D-Bus-handler-for-C.patch @@ -0,0 +1,67 @@ +From 8ceb901719acac3778e1d76779d9c14289185157 Mon Sep 17 00:00:00 2001 +From: Beniamino Galvani +Date: Sat, 13 Jan 2024 18:10:02 +0100 +Subject: [PATCH 4/5] service: fix wrong refcounting in D-Bus handler for + Callback() + +The Callback() D-Bus method is handled via a GDBus-generated skeleton +code in nm-libreswan-helper-service-dbus.c, function +_nmdbus_libreswan_helper_skeleton_handle_method_call(). The function +emits signal "handle-callback" to let the program handle the incoming +method. As documented in the GDoc comments, the signal handler must +return TRUE if it handles the call. + +``` + /** + * NMDBusLibreswanHelper::handle-callback: + * @object: A #NMDBusLibreswanHelper. + * @invocation: A #GDBusMethodInvocation. + * @arg_environment: Argument passed by remote caller. + + * Signal emitted when a remote caller is invoking the Callback() + D-Bus method. + + * If a signal handler returns %TRUE, it means the signal handler + will handle the invocation (e.g. take a reference to @invocation + and eventually call nmdbus_libreswan_helper_complete_callback() + or e.g. g_dbus_method_invocation_return_error() on it) and no + other signal handlers will run. If no signal handler handles the + invocation, the %G_DBUS_ERROR_UNKNOWN_METHOD error is returned. + + * Returns: %G_DBUS_METHOD_INVOCATION_HANDLED or %TRUE if the + invocation was handled, %G_DBUS_METHOD_INVOCATION_UNHANDLED or + %FALSE to let other signal handlers run. + */ +``` + +At the moment, in case of error the handler first calls +nmdbus_libreswan_helper_complete_callback() which decreases the +refcount of "invocation", and then returns FALSE which tells the +skeleton code to return an error, also unreferencing the +invocation. This causes a crash. + +Since the G_DBUS_METHOD_INVOCATION_HANDLED alias for TRUE is only +available since GLib 2.68 (while we target 2.36), just return TRUE. + +Fixes: acb9eb9de50b ('service: process the configuration in the service, not the helper') +--- + src/nm-libreswan-service.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c +index 12cf6f2..0d5c4b8 100644 +--- a/src/nm-libreswan-service.c ++++ b/src/nm-libreswan-service.c +@@ -1417,7 +1417,8 @@ out: + } + + nmdbus_libreswan_helper_complete_callback (object, invocation); +- return success; ++ ++ return TRUE; + } + + /****************************************************************/ +-- +2.43.0 + diff --git a/SOURCES/0005-service-properties-support-type-hostaddrfamily-clien.patch b/SOURCES/0005-service-properties-support-type-hostaddrfamily-clien.patch new file mode 100644 index 0000000..d54e26b --- /dev/null +++ b/SOURCES/0005-service-properties-support-type-hostaddrfamily-clien.patch @@ -0,0 +1,91 @@ +From b4ba2add64bd9d362fe2e66748f23449f072216b Mon Sep 17 00:00:00 2001 +From: Beniamino Galvani +Date: Mon, 15 Jan 2024 13:23:45 +0100 +Subject: [PATCH 5/5] service,properties: support type, hostaddrfamily, + clientaddrfamily + +Add support for: + - type + - hostaddrfamily + - clientaddrfamily + +Since those are very advanced options, don't implement the GUI part +for now. +--- + properties/nm-libreswan-editor-plugin.c | 6 ++++++ + shared/nm-service-defines.h | 3 +++ + shared/utils.c | 12 ++++++++++++ + src/nm-libreswan-service.c | 3 +++ + 4 files changed, 24 insertions(+) + +diff --git a/properties/nm-libreswan-editor-plugin.c b/properties/nm-libreswan-editor-plugin.c +index 89243cc..fe85c81 100644 +--- a/properties/nm-libreswan-editor-plugin.c ++++ b/properties/nm-libreswan-editor-plugin.c +@@ -206,6 +206,12 @@ import_from_file (NMVpnEditorPlugin *self, + nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_IPSEC_INTERFACE, &str[16]); + else if (g_str_has_prefix (str, "authby=")) + nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_AUTHBY, &str[7]); ++ else if (g_str_has_prefix (str, "type=")) ++ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_TYPE, str + NM_STRLEN("type=")); ++ else if (g_str_has_prefix (str, "hostaddrfamily=")) ++ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_HOSTADDRFAMILY, str + NM_STRLEN("hostaddrfamily=")); ++ else if (g_str_has_prefix (str, "clientaddrfamily=")) ++ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_CLIENTADDRFAMILY, str + NM_STRLEN("clientaddrfamily=")); + else if (g_str_has_prefix (str, "rightsubnet=")) { + if (!g_str_has_prefix (str, "rightsubnet=0.0.0.0/0")) + nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_REMOTENETWORK, &str[12]); +diff --git a/shared/nm-service-defines.h b/shared/nm-service-defines.h +index 14170ad..95e19d4 100644 +--- a/shared/nm-service-defines.h ++++ b/shared/nm-service-defines.h +@@ -68,6 +68,9 @@ + #define NM_LIBRESWAN_KEY_FRAGMENTATION "fragmentation" + #define NM_LIBRESWAN_KEY_MOBIKE "mobike" + #define NM_LIBRESWAN_KEY_IPSEC_INTERFACE "ipsec-interface" ++#define NM_LIBRESWAN_KEY_TYPE "type" ++#define NM_LIBRESWAN_KEY_HOSTADDRFAMILY "hostaddrfamily" ++#define NM_LIBRESWAN_KEY_CLIENTADDRFAMILY "clientaddrfamily" + + #define NM_LIBRESWAN_IKEV2_NO "no" + #define NM_LIBRESWAN_IKEV2_NEVER "never" +diff --git a/shared/utils.c b/shared/utils.c +index 0bac9e6..9e616f8 100644 +--- a/shared/utils.c ++++ b/shared/utils.c +@@ -325,6 +325,18 @@ nm_libreswan_config_write (gint fd, + if (item && strlen (item)) + WRITE_CHECK (fd, debug_write_fcn, error, " ipsec-interface=%s", item); + ++ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_TYPE); ++ if (item && strlen (item)) ++ WRITE_CHECK (fd, debug_write_fcn, error, " type=%s", item); ++ ++ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_HOSTADDRFAMILY); ++ if (item && strlen (item)) ++ WRITE_CHECK (fd, debug_write_fcn, error, " hostaddrfamily=%s", item); ++ ++ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_CLIENTADDRFAMILY); ++ if (item && strlen (item)) ++ WRITE_CHECK (fd, debug_write_fcn, error, " clientaddrfamily=%s", item); ++ + WRITE_CHECK (fd, debug_write_fcn, error, " nm-configured=yes"); + + WRITE_CHECK_NEWLINE (fd, trailing_newline, debug_write_fcn, error, " auto=add"); +diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c +index 0d5c4b8..7e96230 100644 +--- a/src/nm-libreswan-service.c ++++ b/src/nm-libreswan-service.c +@@ -277,6 +277,9 @@ static ValidProperty valid_properties[] = { + { NM_LIBRESWAN_KEY_FRAGMENTATION, G_TYPE_STRING, 0, 0 }, + { NM_LIBRESWAN_KEY_MOBIKE, G_TYPE_STRING, 0, 0 }, + { NM_LIBRESWAN_KEY_IPSEC_INTERFACE, G_TYPE_STRING, 0, 0 }, ++ { NM_LIBRESWAN_KEY_TYPE, G_TYPE_STRING, 0, 0 }, ++ { NM_LIBRESWAN_KEY_HOSTADDRFAMILY, G_TYPE_STRING, 0, 0 }, ++ { NM_LIBRESWAN_KEY_CLIENTADDRFAMILY, G_TYPE_STRING, 0, 0 }, + /* Ignored option for internal use */ + { NM_LIBRESWAN_KEY_PSK_INPUT_MODES, G_TYPE_NONE, 0, 0 }, + { NM_LIBRESWAN_KEY_XAUTH_PASSWORD_INPUT_MODES, G_TYPE_NONE, 0, 0 }, +-- +2.43.0 + diff --git a/SPECS/NetworkManager-libreswan.spec b/SPECS/NetworkManager-libreswan.spec new file mode 100644 index 0000000..dad8bf3 --- /dev/null +++ b/SPECS/NetworkManager-libreswan.spec @@ -0,0 +1,390 @@ +%if 0%{?fedora} < 28 && 0%{?rhel} < 8 +%bcond_without libnm_glib +%else +%bcond_with libnm_glib +%endif +%if 0%{?fedora} < 36 && 0%{?rhel} < 10 +%bcond_with gtk4 +%else +%bcond_without gtk4 +%endif + +%global real_version 1.2.18 +%global rpm_version 1.2.18 +%global release_version 2 + +%global real_version_major %(printf '%s' '%{real_version}' | sed -n 's/^\\([1-9][0-9]*\\.[1-9][0-9]*\\)\\.[1-9][0-9]*$/\\1/p') + +%global nm_version 1:1.2.0 +%global nma_version 1.2.0 + + +Summary: NetworkManager VPN plug-in for IPsec VPN +Name: NetworkManager-libreswan +Version: %{rpm_version} +Release: %{release_version}%{?dist} +License: GPLv2+ +URL: http://www.gnome.org/projects/NetworkManager/ +Source0: https://download.gnome.org/sources/NetworkManager-libreswan/%{real_version_major}/%{name}-%{real_version}.tar.xz + +Patch1: 0001-service-properties-add-support-for-leftmodecfgclient.patch +Patch2: 0002-service-use-new-API-to-send-configuration-to-NM.patch +Patch3: 0003-service-don-t-send-IPv4-config-if-mode-config-client.patch +Patch4: 0004-service-fix-wrong-refcounting-in-D-Bus-handler-for-C.patch +Patch5: 0005-service-properties-support-type-hostaddrfamily-clien.patch + +BuildRequires: make +BuildRequires: gcc +BuildRequires: gtk3-devel +BuildRequires: libnl3-devel +BuildRequires: NetworkManager-libnm-devel >= %{nm_version} +BuildRequires: libnma-devel >= %{nma_version} +BuildRequires: libsecret-devel +BuildRequires: intltool gettext + +%if %with libnm_glib +BuildRequires: NetworkManager-devel >= %{nm_version} +BuildRequires: NetworkManager-glib-devel >= %{nm_version} +BuildRequires: libnm-gtk-devel >= %{nma_version} +%endif + +%if %with gtk4 +BuildRequires: libnma-gtk4-devel +%endif + +Requires: NetworkManager >= %{nm_version} +Requires: dbus +Requires: /usr/sbin/ipsec + +Provides: NetworkManager-openswan = %{version}-%{release} +Obsoletes: NetworkManager-openswan < %{version}-%{release} + +%global _privatelibs libnm-libreswan-properties[.]so.* +%global __provides_exclude ^(%{_privatelibs})$ +%global __requires_exclude ^(%{_privatelibs})$ + + +%description +This package contains software for integrating the libreswan VPN software +with NetworkManager and the GNOME desktop + + +%package -n NetworkManager-libreswan-gnome +Summary: NetworkManager VPN plugin for libreswan - GNOME files + +Requires: %{name}%{?_isa} = %{version}-%{release} +Requires: shared-mime-info + +Provides: NetworkManager-openswan-gnome = %{version}-%{release} +Obsoletes: NetworkManager-openswan-gnome < %{version}-%{release} + +%description -n NetworkManager-libreswan-gnome +This package contains software for integrating VPN capabilities with +the libreswan server with NetworkManager (GNOME files). + + +%prep +%autosetup -p1 -n "%{name}-%{real_version}" + + +%build +%configure \ + --disable-static \ +%if %with gtk4 + --with-gtk4 \ +%endif +%if %without libnm_glib + --without-libnm-glib \ +%endif + --enable-more-warnings=yes \ + --with-dist-version=%{version}-%{release} +make %{?_smp_mflags} + + +%install +make install DESTDIR=%{buildroot} +rm -f %{buildroot}%{_libdir}/NetworkManager/lib*.la + +%find_lang %{name} + +%files -f %{name}.lang +%{_libdir}/NetworkManager/libnm-vpn-plugin-libreswan.so +%{_sysconfdir}/dbus-1/system.d/nm-libreswan-service.conf +%{_prefix}/lib/NetworkManager/VPN/nm-libreswan-service.name +%{_libexecdir}/nm-libreswan-service +%{_libexecdir}/nm-libreswan-service-helper +%{_mandir}/man5/nm-settings-libreswan.5.gz +%doc AUTHORS NEWS +%license COPYING + + +%files -n NetworkManager-libreswan-gnome +%{_libexecdir}/nm-libreswan-auth-dialog +%{_libdir}/NetworkManager/libnm-vpn-plugin-libreswan-editor.so +%{_metainfodir}/network-manager-libreswan.metainfo.xml + +%if %with libnm_glib +%{_libdir}/NetworkManager/libnm-*-properties.so +%{_sysconfdir}/NetworkManager/VPN/nm-libreswan-service.name +%endif + +%if %with gtk4 +%{_libdir}/NetworkManager/libnm-gtk4-vpn-plugin-libreswan-editor.so +%endif + +%changelog +* Thu Mar 28 2024 MSVSphere Packaging Team - 1.2.18-2 +- Rebuilt for MSVSphere 9.4 beta + +* Wed Jan 17 2024 Fernando Fernandez Mancera - 1.2.18-2 +- Support point-to-point IPSec tunnel (RHEL-20690) +- Fix crash in libreswan_nmstate_iface_dpd_rsa (RHEL-21221) +- Support configuring IPSec mode with 'type' (RHEL-21554) + +* Fri Dec 15 2023 Fernando Fernandez Mancera - 1.2.18-1 +- Update to 1.2.18 release + +* Mon Aug 09 2021 Mohan Boddu - 1.2.14-1.3 +- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags + Related: rhbz#1991688 + +* Thu Apr 15 2021 Mohan Boddu - 1.2.14-1.2 +- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 + +* Mon Jan 25 2021 Fedora Release Engineering - 1.2.14-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Tue Jan 12 2021 Beniamino Galvani - 1.2.14-1 +- Update to 1.2.14 release + +* Mon Jul 27 2020 Fedora Release Engineering - 1.2.12-1.2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Tue Jan 28 2020 Fedora Release Engineering - 1.2.12-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Wed Jul 31 2019 Francesco Giudici - 1.2.12-1 +- Updated to 1.2.12 + +* Wed Jul 24 2019 Fedora Release Engineering - 1.2.10-1.2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Thu Jan 31 2019 Fedora Release Engineering - 1.2.10-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Thu Oct 18 2018 Francesco Giudici - 1.2.10-1 +- Updated to 1.2.10 +- Import latest translations from upstream + +* Wed Aug 22 2018 Paul Wouters - 1.2.6-1 +- Updated to 1.2.6 +- Upstream patches for IKEv2 support + +* Thu Jul 12 2018 Fedora Release Engineering - 1.2.4-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Wed Feb 07 2018 Fedora Release Engineering - 1.2.4-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + +* Thu Nov 30 2017 Lubomir Rintel - 1.2.4-4 +- Drop libnm-glib for Fedora 28 + +* Wed Aug 02 2017 Fedora Release Engineering - 1.2.4-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild + +* Wed Jul 26 2017 Fedora Release Engineering - 1.2.4-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + +* Fri Feb 10 2017 Fedora Release Engineering - 1.2.4-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild + +* Thu Jun 30 2016 Thomas Haller - 1.2.4-1 +- Update to 1.2.4 release +- Move base VPN plugin library to base libreswan package +- Don't require nm-connection-editor anymore + +* Wed May 11 2016 Lubomir Rintel - 1.2.2-1 +- Update to 1.2.2 release + +* Wed Apr 20 2016 Lubomir Rintel - 1.2.0-1 +- Update to 1.2.0 release + +* Tue Apr 5 2016 Lubomir Rintel - 1.2.0-0.4.rc1 +- Update to NetworkManager-libreswan 1.2-rc1 + +* Tue Mar 1 2016 Lubomir Rintel - 1.2.0-0.4.beta2 +- Update to NetworkManager-libreswan 1.2-beta2 + +* Wed Feb 03 2016 Fedora Release Engineering - 1.2.0-0.4.beta1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild + +* Mon Feb 1 2016 Lubomir Rintel - 1.2.0-0.3.beta1 +- Update to support Main mode & better Libreswan integration + +* Tue Jan 19 2016 Lubomir Rintel - 1.2.0-0.2.beta1 +- Update to NetworkManager-libreswan 1.2-beta1 + +* Wed Dec 16 2015 Lubomir Rintel - 1.2.0-0.1.20151216gite52aff0 +- A newer git snapshot with import/export support + +* Mon Nov 16 2015 Lubomir Rintel - 1.2.0-0.1.20151116git15db395 +- Rename to NetworkManager-libreswan +- A newer git snapshot with multiple connection support + +* Fri Oct 23 2015 Lubomir Rintel - 1.2.0-0.1.20151023git8a39c0f +- Update to a newer git snapshot + +* Tue Sep 1 2015 Lubomir Rintel - 1.2.0-0.1.20150901git92f1611 +- Update to 1.2 git snapshot with libnm-based properties plugin + +* Fri Aug 28 2015 Lubomir Rintel - 1.0.6-2 +- Don't unconditionally set cisco-unity=yes + +* Thu Aug 27 2015 Lubomir Rintel - 1.0.6-1 +- Update to 1.0.6 release + +* Tue Jun 16 2015 Fedora Release Engineering - 1.0.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild + +* Tue May 5 2015 Lubomir Rintel - 1.0.2-1 +- Update to 1.0.2 release + +* Mon Dec 22 2014 Dan Williams - 1.0.0-1 +- Update to 1.0 + +* Fri Aug 15 2014 Fedora Release Engineering - 0.9.8.4-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild + +* Fri Jun 06 2014 Fedora Release Engineering - 0.9.8.4-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild + +* Thu Dec 12 2013 Avesh Agarwal - 0.9.8.4-2 +- Fixes 1035786 (and its duplicate 1040924) + +* Tue Dec 10 2013 Avesh Agarwal - 0.9.8.4-1 +- New upstream release 0.9.8.4 +- Fixed 926225 +- Fixed dependency to libreswan. +- Created a new sub package NetworkManager-openswan-gnome +- Various other spec file fixes. +- Additional code changes are as follows: +- Fixed an issue where proper network stack is not loaded unless + _stackmanager is run before starting pluto daemon service. +- Fixed the termination operation of pluto daemon to comply with + libreswan changes. +- Fixed various debug messages. +- Fixed initiation of pluto daemon by this plugin to reflect the + changes in libreaswan. +- Fixed defaults values for more parameters to help the VPN + connection stay more reliable. +- Rewrote pluto watch API which watches the pluto process for its status. + Fixed memory leak issues as not all child processes were reaped correctly. + Also g_spwan_close_pid was not being called after children were reaped. + Also modified debugs and added more to help with debugging in the future. +- Fixed an issue where nm-openswan service is searching for ipsec binary in + both /sbin and /usr/sbin leading to same operation twice, as /sbin is just + symlink to /usr/sbin, so removed /sbin from the search paths. +- Fixed some libreswan related macro changes. +- Fixed netmask issue when sending IP information to the nm openswan + plugin service. +- Fixed the current code as it does not set the default route field + NM_VPN_PLUGIN_IP4_CONFIG_NEVER_DEFAULT when sending VPN information + to nm-openswan plugin. This fix sets the field to TRUE. +- Fixed some issues found by coverity scan. +- Fixed an issue where writing configuration on stdin should not end with + \n as it gives error. It used to work previously, but not with latest + NetworkManager versions. +- libreswan related fixes, as some macros have been modified after forking + to libreswan from openswan. +- openswan/libreswan does not provide tun0 interface, so fixed the code + where it sends tun0 interface. +- Fix prcoessing of nm-openswan-dialog.ui file and added more error notifications. +- Fixed dead code based on coverity scan. +- Fixed gnomekeyring lib dependencies. +- Fixed Networkmanager and related lib dependencies. +- Fixed gtk label max width issue by setting it to 35. +- NM-openswan was missing support for nm-openswan-auth-dialog.desktop.in.in. + So added a new nm-openswan-auth-dialog.desktop.in.in, and modified related + Makefile and configure.ac files. + +* Mon Aug 5 2013 Avesh Agarwal - 0.9.8.0-1 +- Rebase to latest upstream version 0.9.8.0 +- Fixed several issues with the packaging + +* Fri Aug 02 2013 Fedora Release Engineering - 0.9.3.995-6.git20120302 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild + +* Wed Feb 13 2013 Fedora Release Engineering - 0.9.3.995-5.git20120302 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild + +* Thu Dec 13 2012 Avesh Agarwal - 0.9.3.995-4 +Resolves: #845599, #865883 + +* Wed Jul 18 2012 Fedora Release Engineering - 0.9.3.995-3.git20120302 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild + +* Fri Apr 27 2012 Avesh Agarwal - 0.9.3.995-2 +- Ported changes from rhel to fedora + +* Fri Mar 2 2012 Dan Williams - 0.9.3.995-1 +- Update to 0.9.3.995 (0.9.4-beta1) +- ui: add support for external UI mode, eg GNOME Shell + +* Thu Jan 12 2012 Fedora Release Engineering - 0.9.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild + +* Tue Dec 06 2011 Adam Jackson - 0.9.0-2 +- Rebuild for new libpng + +* Fri Aug 26 2011 Dan Williams - 0.9.0-1 +- Update to 0.9.0 +- ui: translation fixes + +* Thu Jul 21 2011 Dan Williams - 0.8.999-2.git20110721 +- Update to git snapshot +- Fixes for secrets handling and saving + +* Tue May 03 2011 Dan Williams - 0.8.999-1 +- Update to 0.8.999 (0.9-rc2) +- Port to GTK 3.0 and GtkBuilder +- Fix some issues with secrets storage + +* Sun Mar 27 2011 Christopher Aillon - 0.8.0-9.20100411git +- Rebuild against NetworkManager 0.9 + +* Wed Feb 16 2011 Avesh Agarwal - 0.8.0-8.20100411git +- fixes for compile time errors + +* Mon Feb 07 2011 Fedora Release Engineering - 0.8.0-7.20100411git +- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild + +* Tue Sep 7 2010 Avesh Agarwal - 0.8.0-6.20100411git +- Modified import and export interfaces to import_from_file and export_to_file, respectively, + due to changes in NMVpnPluginUiInterface struct in NM (bz 631159). + +* Mon Jul 26 2010 Avesh Agarwal - 0.8.0-5.20100411git +Resolves: #616910 +- Support for reading phase1 and phase2 algorithms through GUI + +* Tue Jul 13 2010 Avesh Agarwal - 0.8.0-4.20100411git +- Modified fix for the bz 607352 +- Fix to read connection configuration from stdin +- Fix to read Xauth user password from stdin +- Fix to delete the secret file as soon as read by Openswan + +* Thu Jul 8 2010 Avesh Agarwal - 0.8.0-3.20100411git +- Modified the patch so that it does not pass user password to + "ipsec whack" command. + +* Thu Jul 8 2010 Avesh Agarwal - 0.8.0-2.20100411git +- Modified to initiate VPN connections with openswan whack interface +- Fixed the issue of world readable conf and secret files +- Cleaned conf and secret files after VPN connection is stopped +- Fixed the issue of storing sensitive information like user + password in a file (rhbz# 607352) +- Changed PLUTO_SERVERBANNER to PLUTO_PEER_BANNER due + to the same change in Openswan +- Modifed GUI to remove unused configuration boxes + +* Tue Jun 15 2010 Avesh Agarwal - 0.8.0-1.20100%{version}t +- Initial build