From 15fefd10a2be46adb2ce589146036fd54559cee2 Mon Sep 17 00:00:00 2001 From: MSVSphere Packaging Team Date: Thu, 25 Apr 2024 03:30:27 +0300 Subject: [PATCH] import libreswan-4.12-1.el9_3.1 --- ...breswan-4.12-ikev2-auth-delete-state.patch | 54 +++++ SOURCES/libreswan-4.12-ipv6-san.patch | 198 ++++++++++++++++++ SPECS/libreswan.spec | 8 +- 3 files changed, 259 insertions(+), 1 deletion(-) create mode 100644 SOURCES/libreswan-4.12-ikev2-auth-delete-state.patch create mode 100644 SOURCES/libreswan-4.12-ipv6-san.patch diff --git a/SOURCES/libreswan-4.12-ikev2-auth-delete-state.patch b/SOURCES/libreswan-4.12-ikev2-auth-delete-state.patch new file mode 100644 index 0000000..c17b457 --- /dev/null +++ b/SOURCES/libreswan-4.12-ikev2-auth-delete-state.patch @@ -0,0 +1,54 @@ +From 2ec448884a7467743699803f8a36ee28d237666c Mon Sep 17 00:00:00 2001 +From: Andrew Cagney +Date: Wed, 28 Feb 2024 08:29:53 -0500 +Subject: [PATCH] ikev2: return STF_FATAL when initiator fails to emit AUTH + packet + +--- + programs/pluto/ikev2_ike_auth.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/programs/pluto/ikev2_ike_auth.c b/programs/pluto/ikev2_ike_auth.c +index 192eb1b3b6..a54a109699 100644 +--- a/programs/pluto/ikev2_ike_auth.c ++++ b/programs/pluto/ikev2_ike_auth.c +@@ -1267,7 +1267,7 @@ static stf_status process_v2_IKE_AUTH_request_auth_signature_continue(struct ike + /* now send AUTH payload */ + + if (!emit_local_v2AUTH(ike, auth_sig, &ike->sa.st_v2_id_payload.mac, response.pbs)) { +- return STF_INTERNAL_ERROR; ++ return STF_FATAL; + } + ike->sa.st_v2_ike_intermediate.used = false; + +-- +2.44.0 + +From 16272f2475d25baab58fbed2af7c67cfb459137f Mon Sep 17 00:00:00 2001 +From: Andrew Cagney +Date: Thu, 29 Feb 2024 12:19:20 -0500 +Subject: [PATCH] ikev2: always return STF_FATAL if emitting AUTH fails + +Fix: + ikev2: return STF_FATAL when initiator fails to emit AUTH packet +which really fixed the responder. +--- + programs/pluto/ikev2_ike_auth.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/programs/pluto/ikev2_ike_auth.c b/programs/pluto/ikev2_ike_auth.c +index a54a109699..491053fb10 100644 +--- a/programs/pluto/ikev2_ike_auth.c ++++ b/programs/pluto/ikev2_ike_auth.c +@@ -397,7 +397,7 @@ stf_status initiate_v2_IKE_AUTH_request_signature_continue(struct ike_sa *ike, + /* send out the AUTH payload */ + + if (!emit_local_v2AUTH(ike, auth_sig, &ike->sa.st_v2_id_payload.mac, request.pbs)) { +- return STF_INTERNAL_ERROR; ++ return STF_FATAL; + } + + if (LIN(POLICY_MOBIKE, ike->sa.st_connection->policy)) { +-- +2.44.0 + diff --git a/SOURCES/libreswan-4.12-ipv6-san.patch b/SOURCES/libreswan-4.12-ipv6-san.patch new file mode 100644 index 0000000..6eb0b58 --- /dev/null +++ b/SOURCES/libreswan-4.12-ipv6-san.patch @@ -0,0 +1,198 @@ +From 474d75be074799efa9e38f346d3fdb76dec3eead Mon Sep 17 00:00:00 2001 +From: Andrew Cagney +Date: Tue, 5 Dec 2023 13:55:37 -0500 +Subject: [PATCH] x509: unpack IPv6 general names based on length + +fix #1321 +--- + programs/pluto/x509.c | 35 +++++++++++++++++++++++++++++------ + 1 file changed, 29 insertions(+), 6 deletions(-) + +diff --git a/programs/pluto/x509.c b/programs/pluto/x509.c +index fbbf5a553e..f7e97b9979 100644 +--- a/programs/pluto/x509.c ++++ b/programs/pluto/x509.c +@@ -336,7 +336,7 @@ generalName_t *collect_rw_ca_candidates(struct msg_digest *md) + */ + static void gntoid(struct id *id, const generalName_t *gn, struct logger *logger) + { +- *id = empty_id; ++ *id = empty_id; /* aka ID_NONE */ + + switch (gn->kind) { + case GN_DNS_NAME: /* ID type: ID_FQDN */ +@@ -345,18 +345,37 @@ static void gntoid(struct id *id, const generalName_t *gn, struct logger *logger + break; + case GN_IP_ADDRESS: /* ID type: ID_IPV4_ADDR */ + { ++ const struct ip_info *afi = NULL; ++ for (enum ip_index i = 0; i < IP_INDEX_ROOF; i++) { ++ if (ip_families[i].ip_size == gn->name.len) { ++ afi = &ip_families[i]; ++ break; ++ } ++ } ++ if (afi == NULL) { ++ llog(RC_LOG, logger, ++ "warning: invalid IP_ADDRESS general name: %zu byte length is not valid", ++ gn->name.len); ++ PEXPECT(logger, id->kind == ID_NONE); ++ return; ++ } ++ + /* + * XXX: why could this fail; and what happens when it + * is ignored? + */ +- const struct ip_info *afi = &ipv4_info; +- id->kind = afi->id_ip_addr; +- err_t ugh = hunk_to_address(gn->name, afi, &id->ip_addr); ++ ip_address addr; ++ err_t ugh = hunk_to_address(gn->name, afi, &addr); + if (ugh != NULL) { + llog(RC_LOG, logger, +- "warning: gntoid() failed to initaddr(): %s", +- ugh); ++ "warning: invalid IP_ADDRESS general name: %s", ++ ugh); ++ PEXPECT(logger, id->kind == ID_NONE); ++ return; + } ++ ++ id->kind = afi->id_ip_addr; ++ id->ip_addr = addr; + break; + } + case GN_RFC822_NAME: /* ID type: ID_USER_FQDN */ +@@ -464,14 +483,18 @@ bool add_pubkey_from_nss_cert(struct pubkey_list **pubkey_db, + return false; + } + ++ ldbg(logger, "adding cert using subject name"); + replace_public_key(pubkey_db, &pk); + passert(pk == NULL); /*stolen*/ + ++ ldbg(logger, "adding cert using general names"); + add_cert_san_pubkeys(pubkey_db, cert, logger); + + if (keyid != NULL && keyid->kind != ID_DER_ASN1_DN && + keyid->kind != ID_NONE && + keyid->kind != ID_FROMCERT) { ++ id_buf idb; ++ ldbg(logger, "adding cert using keyid %s", str_id(keyid, &idb)); + struct pubkey *pk2 = NULL; + diag_t d = create_pubkey_from_cert(keyid, cert, &pk2, logger); + if (d != NULL) { +-- +2.44.0 + +From 1e27be95cd710a840681d1a51913e6a32ce75a2a Mon Sep 17 00:00:00 2001 +From: Andrew Cagney +Date: Mon, 11 Mar 2024 17:18:51 -0400 +Subject: [PATCH] building: back-port ip_families[] and ip_index + +--- + include/ip_index.h | 27 +++++++++++++++++++++++++++ + include/ip_info.h | 7 +++++-- + lib/libswan/ip_info.c | 9 ++++++--- + 3 files changed, 38 insertions(+), 5 deletions(-) + create mode 100644 include/ip_index.h + +diff --git a/include/ip_index.h b/include/ip_index.h +new file mode 100644 +index 0000000000..508589b05e +--- /dev/null ++++ b/include/ip_index.h +@@ -0,0 +1,27 @@ ++/* ip address type index, for libreswan ++ * ++ * Copyright (C) 2022 Andrew Cagney ++ * ++ * This library is free software; you can redistribute it and/or modify it ++ * under the terms of the GNU Library General Public License as published by ++ * the Free Software Foundation; either version 2 of the License, or (at your ++ * option) any later version. See . ++ * ++ * This library is distributed in the hope that it will be useful, but ++ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY ++ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public ++ * License for more details. ++ * ++ */ ++ ++#ifndef IP_INDEX_H ++#define IP_INDEX_H ++ ++enum ip_index { ++ IPv4_INDEX, ++ IPv6_INDEX, ++}; ++ ++#define IP_INDEX_ROOF (IPv6_INDEX+1) ++ ++#endif +diff --git a/include/ip_info.h b/include/ip_info.h +index 40e99ef687..c1329a8569 100644 +--- a/include/ip_info.h ++++ b/include/ip_info.h +@@ -9,6 +9,7 @@ + #include "ip_subnet.h" + #include "ip_selector.h" + #include "ip_sockaddr.h" ++#include "ip_index.h" + + struct ip_info { + /* +@@ -113,8 +114,10 @@ struct ip_info { + + }; + +-extern const struct ip_info ipv4_info; +-extern const struct ip_info ipv6_info; ++extern const struct ip_info ip_families[IP_INDEX_ROOF]; ++ ++#define ipv4_info ip_families[IPv4_INDEX] ++#define ipv6_info ip_families[IPv6_INDEX] + + extern const struct ip_info *aftoinfo(int af); + +diff --git a/lib/libswan/ip_info.c b/lib/libswan/ip_info.c +index 70cd6a368f..97296d3a11 100644 +--- a/lib/libswan/ip_info.c ++++ b/lib/libswan/ip_info.c +@@ -158,7 +158,9 @@ static ip_port port_from_ipv6_sockaddr(const ip_sockaddr sa) + + #define IPv4_FF { { 255, 255, 255, 255, }, } + +-const struct ip_info ipv4_info = { ++const struct ip_info ip_families[IP_INDEX_ROOF] = { ++ ++ [IPv4_INDEX] = { + + .ip_version = IPv4, + .ip_size = sizeof(struct in_addr), +@@ -210,11 +212,11 @@ const struct ip_info ipv4_info = { + .id_ip_addr = ID_IPV4_ADDR, + .id_ip_addr_subnet = ID_IPV4_ADDR_SUBNET, + .id_ip_addr_range = ID_IPV4_ADDR_RANGE, +-}; ++ }, + + #define IPv6_FF { { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, }, } + +-const struct ip_info ipv6_info = { ++ [IPv6_INDEX] = { + + .ip_version = IPv6, + .ip_size = sizeof(struct in6_addr), +@@ -266,6 +268,7 @@ const struct ip_info ipv6_info = { + .id_ip_addr = ID_IPV6_ADDR, + .id_ip_addr_subnet = ID_IPV6_ADDR_SUBNET, + .id_ip_addr_range = ID_IPV6_ADDR_RANGE, ++ } + }; + + const struct ip_info *aftoinfo(int af) +-- +2.44.0 + diff --git a/SPECS/libreswan.spec b/SPECS/libreswan.spec index c30f466..7cf76ee 100644 --- a/SPECS/libreswan.spec +++ b/SPECS/libreswan.spec @@ -31,7 +31,7 @@ Name: libreswan Summary: Internet Key Exchange (IKEv1 and IKEv2) implementation for IPsec # version is generated in the release script Version: 4.12 -Release: %{?prever:0.}1%{?prever:.%{prever}}%{?dist} +Release: %{?prever:0.}1%{?prever:.%{prever}}%{?dist}.1 License: GPLv2 Url: https://libreswan.org/ Source0: https://download.libreswan.org/%{?prever:development/}%{name}-%{version}%{?prever}.tar.gz @@ -41,6 +41,8 @@ Source2: https://download.libreswan.org/cavs/ikev1_psk.fax.bz2 Source3: https://download.libreswan.org/cavs/ikev2.fax.bz2 %endif Patch: libreswan-4.6-ikev1-policy-defaults-to-drop.patch +Patch: libreswan-4.12-ikev2-auth-delete-state.patch +Patch: libreswan-4.12-ipv6-san.patch BuildRequires: audit-libs-devel BuildRequires: bison @@ -196,6 +198,10 @@ certutil -N -d sql:$tmpdir --empty-password %doc %{_mandir}/*/* %changelog +* Fri Apr 12 2024 Daiki Ueno - 4.12-1.1 +- Fix CVE-2024-2357 (RHEL-29734) +- x509: unpack IPv6 general names based on length (RHEL-32719) + * Wed Aug 9 2023 Daiki Ueno - 4.12-1 - Update to 4.12 to fix CVE-2023-38710, CVE-2023-38711, CVE-2023-38712 - Resolves: rhbz#2215956