.gitignore

@@ -1,4 +1,4 @@
 SOURCES/ikev1_dsa.fax.bz2
 SOURCES/ikev1_psk.fax.bz2
 SOURCES/ikev2.fax.bz2
-SOURCES/libreswan-4.12.tar.gz
+SOURCES/libreswan-4.15.tar.gz

.libreswan.metadata

@@ -1,4 +1,4 @@
 b35cd50b8bc0a08b9c07713bf19c72d53bfe66bb SOURCES/ikev1_dsa.fax.bz2
 861d97bf488f9e296cad8c43ab72f111a5b1a848 SOURCES/ikev1_psk.fax.bz2
 fcaf77f3deae3d8e99cdb3b1f8abea63167a0633 SOURCES/ikev2.fax.bz2
-786c14a4755311ea3103683a3294e1536b1e44a6 SOURCES/libreswan-4.12.tar.gz
+861eaeefff1c2f3862a8bfe0295b3e307f8e3055 SOURCES/libreswan-4.15.tar.gz

SOURCES/libreswan-4.12-ikev1-compute-keymat-default.patch

@@ -1,92 +0,0 @@
-From 5101913b1e623121a9222f11eefa18f0a2708b00 Mon Sep 17 00:00:00 2001
-From: Andrew Cagney <cagney@gnu.org>
-Date: Wed, 27 Mar 2024 10:43:19 -0400
-Subject: [PATCH] ikev1: in compute_proto_keymat() only allow explicitly
- handled ESP algorithms
-
----
- programs/pluto/ikev1_quick.c | 41 ++++++++++++++----------------------
- 1 file changed, 16 insertions(+), 25 deletions(-)
-
-diff --git a/programs/pluto/ikev1_quick.c b/programs/pluto/ikev1_quick.c
-index 81c522c148..22c346afb4 100644
---- a/programs/pluto/ikev1_quick.c
-+++ b/programs/pluto/ikev1_quick.c
-@@ -203,7 +203,7 @@ static bool emit_subnet_id(enum perspective perspective,
-  * RFC 2409 "IKE" section 5.5
-  * specifies how this is to be done.
-  */
--static void compute_proto_keymat(struct state *st,
-+static bool compute_proto_keymat(struct state *st,
- 				 uint8_t protoid,
- 				 struct ipsec_proto_info *pi,
- 				 const char *satypename)
-@@ -297,27 +297,13 @@ static void compute_proto_keymat(struct state *st,
- 			}
- 			break;
- 
--		case ESP_CAST:
--		case ESP_TWOFISH:
--		case ESP_SERPENT:
--		/* ESP_SEED is for IKEv1 only and not supported. Its number in IKEv2 has been re-used */
--			bad_case(pi->attrs.transattrs.ta_ikev1_encrypt);
--
- 		default:
--			/* bytes */
--			needed_len = encrypt_max_key_bit_length(pi->attrs.transattrs.ta_encrypt) / BITS_PER_BYTE;
--			if (needed_len > 0) {
--				/* XXX: check key_len coupling with kernel.c's */
--				if (pi->attrs.transattrs.enckeylen) {
--					needed_len =
--						pi->attrs.transattrs.enckeylen
--						/ BITS_PER_BYTE;
--					dbg("compute_proto_keymat: key_len=%d from peer",
--					    (int)needed_len);
--				}
--				break;
--			}
--			bad_case(pi->attrs.transattrs.ta_ikev1_encrypt);
-+		{
-+			enum_buf eb;
-+			llog(RC_LOG, st->st_logger, "rejecting request for keymat for %s",
-+			     str_enum(&esp_transformid_names, protoid, &eb));
-+			return false;
-+		}
- 		}
- 		dbg("compute_proto_keymat: needed_len (after ESP enc)=%d", (int)needed_len);
- 		needed_len += pi->attrs.transattrs.ta_integ->integ_keymat_size;
-@@ -359,14 +345,17 @@ static void compute_proto_keymat(struct state *st,
- 		DBG_dump_hunk("  inbound:", pi->inbound.keymat);
- 		DBG_dump_hunk("  outbound:", pi->outbound.keymat);
- 	}
-+
-+	return true;
- }
- 
--static void compute_keymats(struct state *st)
-+static bool compute_keymats(struct state *st)
- {
- 	if (st->st_ah.present)
--		compute_proto_keymat(st, PROTO_IPSEC_AH, &st->st_ah, "AH");
-+		return compute_proto_keymat(st, PROTO_IPSEC_AH, &st->st_ah, "AH");
- 	if (st->st_esp.present)
--		compute_proto_keymat(st, PROTO_IPSEC_ESP, &st->st_esp, "ESP");
-+		return compute_proto_keymat(st, PROTO_IPSEC_ESP, &st->st_esp, "ESP");
-+	return false;
- }
- 
- /*
-@@ -1460,7 +1449,9 @@ static stf_status quick_inI1_outR1_continue12_tail(struct state *st, struct msg_
- 	fixup_v1_HASH(st, &hash_fixup, st->st_v1_msgid.id, rbody.cur);
- 
- 	/* Derive new keying material */
--	compute_keymats(st);
-+	if (!compute_keymats(st)) {
-+		return STF_FATAL;
-+	}
- 
- 	/* Tell the kernel to establish the new inbound SA
- 	 * (unless the commit bit is set -- which we don't support).
--- 
-2.45.0
-

SOURCES/libreswan-4.12-ikev2-auth-delete-state.patch

@@ -1,54 +0,0 @@
-From 2ec448884a7467743699803f8a36ee28d237666c Mon Sep 17 00:00:00 2001
-From: Andrew Cagney <cagney@gnu.org>
-Date: Wed, 28 Feb 2024 08:29:53 -0500
-Subject: [PATCH] ikev2: return STF_FATAL when initiator fails to emit AUTH
- packet
-
----
- programs/pluto/ikev2_ike_auth.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/programs/pluto/ikev2_ike_auth.c b/programs/pluto/ikev2_ike_auth.c
-index 192eb1b3b6..a54a109699 100644
---- a/programs/pluto/ikev2_ike_auth.c
-+++ b/programs/pluto/ikev2_ike_auth.c
-@@ -1267,7 +1267,7 @@ static stf_status process_v2_IKE_AUTH_request_auth_signature_continue(struct ike
- 	/* now send AUTH payload */
- 
- 	if (!emit_local_v2AUTH(ike, auth_sig, &ike->sa.st_v2_id_payload.mac, response.pbs)) {
--		return STF_INTERNAL_ERROR;
-+		return STF_FATAL;
- 	}
- 	ike->sa.st_v2_ike_intermediate.used = false;
- 
--- 
-2.44.0
-
-From 16272f2475d25baab58fbed2af7c67cfb459137f Mon Sep 17 00:00:00 2001
-From: Andrew Cagney <cagney@gnu.org>
-Date: Thu, 29 Feb 2024 12:19:20 -0500
-Subject: [PATCH] ikev2: always return STF_FATAL if emitting AUTH fails
-
-Fix:
-  ikev2: return STF_FATAL when initiator fails to emit AUTH packet
-which really fixed the responder.
----
- programs/pluto/ikev2_ike_auth.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/programs/pluto/ikev2_ike_auth.c b/programs/pluto/ikev2_ike_auth.c
-index a54a109699..491053fb10 100644
---- a/programs/pluto/ikev2_ike_auth.c
-+++ b/programs/pluto/ikev2_ike_auth.c
-@@ -397,7 +397,7 @@ stf_status initiate_v2_IKE_AUTH_request_signature_continue(struct ike_sa *ike,
- 	/* send out the AUTH payload */
- 
- 	if (!emit_local_v2AUTH(ike, auth_sig, &ike->sa.st_v2_id_payload.mac, request.pbs)) {
--		return STF_INTERNAL_ERROR;
-+		return STF_FATAL;
- 	}
- 
- 	if (LIN(POLICY_MOBIKE, ike->sa.st_connection->policy)) {
--- 
-2.44.0
-

SOURCES/libreswan-4.12-ipv6-san.patch

@@ -1,198 +0,0 @@
-From 474d75be074799efa9e38f346d3fdb76dec3eead Mon Sep 17 00:00:00 2001
-From: Andrew Cagney <cagney@gnu.org>
-Date: Tue, 5 Dec 2023 13:55:37 -0500
-Subject: [PATCH] x509: unpack IPv6 general names based on length
-
-fix #1321
----
- programs/pluto/x509.c | 35 +++++++++++++++++++++++++++++------
- 1 file changed, 29 insertions(+), 6 deletions(-)
-
-diff --git a/programs/pluto/x509.c b/programs/pluto/x509.c
-index fbbf5a553e..f7e97b9979 100644
---- a/programs/pluto/x509.c
-+++ b/programs/pluto/x509.c
-@@ -336,7 +336,7 @@ generalName_t *collect_rw_ca_candidates(struct msg_digest *md)
-  */
- static void gntoid(struct id *id, const generalName_t *gn, struct logger *logger)
- {
--	*id = empty_id;
-+	*id = empty_id; /* aka ID_NONE */
- 
- 	switch (gn->kind) {
- 	case GN_DNS_NAME:	/* ID type: ID_FQDN */
-@@ -345,18 +345,37 @@ static void gntoid(struct id *id, const generalName_t *gn, struct logger *logger
- 		break;
- 	case GN_IP_ADDRESS:	/* ID type: ID_IPV4_ADDR */
- 	{
-+		const struct ip_info *afi = NULL;
-+		for (enum ip_index i = 0; i < IP_INDEX_ROOF; i++) {
-+			if (ip_families[i].ip_size == gn->name.len) {
-+				afi = &ip_families[i];
-+				break;
-+			}
-+		}
-+		if (afi == NULL) {
-+			llog(RC_LOG, logger,
-+			     "warning: invalid IP_ADDRESS general name: %zu byte length is not valid",
-+			     gn->name.len);
-+			PEXPECT(logger, id->kind == ID_NONE);
-+			return;
-+		}
-+
- 		/*
- 		 * XXX: why could this fail; and what happens when it
- 		 * is ignored?
- 		 */
--		const struct ip_info *afi = &ipv4_info;
--		id->kind = afi->id_ip_addr;
--		err_t ugh = hunk_to_address(gn->name, afi, &id->ip_addr);
-+		ip_address addr;
-+		err_t ugh = hunk_to_address(gn->name, afi, &addr);
- 		if (ugh != NULL) {
- 			llog(RC_LOG, logger,
--				    "warning: gntoid() failed to initaddr(): %s",
--				    ugh);
-+			     "warning: invalid IP_ADDRESS general name: %s",
-+			     ugh);
-+			PEXPECT(logger, id->kind == ID_NONE);
-+			return;
- 		}
-+
-+		id->kind = afi->id_ip_addr;
-+		id->ip_addr = addr;
- 		break;
- 	}
- 	case GN_RFC822_NAME:	/* ID type: ID_USER_FQDN */
-@@ -464,14 +483,18 @@ bool add_pubkey_from_nss_cert(struct pubkey_list **pubkey_db,
- 		return false;
- 	}
- 
-+	ldbg(logger, "adding cert using subject name");
- 	replace_public_key(pubkey_db, &pk);
- 	passert(pk == NULL); /*stolen*/
- 
-+	ldbg(logger, "adding cert using general names");
- 	add_cert_san_pubkeys(pubkey_db, cert, logger);
- 
- 	if (keyid != NULL && keyid->kind != ID_DER_ASN1_DN &&
- 			     keyid->kind != ID_NONE &&
- 			     keyid->kind != ID_FROMCERT) {
-+		id_buf idb;
-+		ldbg(logger, "adding cert using keyid %s", str_id(keyid, &idb));
- 		struct pubkey *pk2 = NULL;
- 		diag_t d = create_pubkey_from_cert(keyid, cert, &pk2, logger);
- 		if (d != NULL) {
--- 
-2.44.0
-
-From 1e27be95cd710a840681d1a51913e6a32ce75a2a Mon Sep 17 00:00:00 2001
-From: Andrew Cagney <cagney@gnu.org>
-Date: Mon, 11 Mar 2024 17:18:51 -0400
-Subject: [PATCH] building: back-port ip_families[] and ip_index
-
----
- include/ip_index.h    | 27 +++++++++++++++++++++++++++
- include/ip_info.h     |  7 +++++--
- lib/libswan/ip_info.c |  9 ++++++---
- 3 files changed, 38 insertions(+), 5 deletions(-)
- create mode 100644 include/ip_index.h
-
-diff --git a/include/ip_index.h b/include/ip_index.h
-new file mode 100644
-index 0000000000..508589b05e
---- /dev/null
-+++ b/include/ip_index.h
-@@ -0,0 +1,27 @@
-+/* ip address type index, for libreswan
-+ *
-+ * Copyright (C) 2022 Andrew Cagney
-+ *
-+ * This library is free software; you can redistribute it and/or modify it
-+ * under the terms of the GNU Library General Public License as published by
-+ * the Free Software Foundation; either version 2 of the License, or (at your
-+ * option) any later version.  See <https://www.gnu.org/licenses/lgpl-2.1.txt>.
-+ *
-+ * This library is distributed in the hope that it will be useful, but
-+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
-+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Library General Public
-+ * License for more details.
-+ *
-+ */
-+
-+#ifndef IP_INDEX_H
-+#define IP_INDEX_H
-+
-+enum ip_index {
-+	IPv4_INDEX,
-+	IPv6_INDEX,
-+};
-+
-+#define IP_INDEX_ROOF (IPv6_INDEX+1)
-+
-+#endif
-diff --git a/include/ip_info.h b/include/ip_info.h
-index 40e99ef687..c1329a8569 100644
---- a/include/ip_info.h
-+++ b/include/ip_info.h
-@@ -9,6 +9,7 @@
- #include "ip_subnet.h"
- #include "ip_selector.h"
- #include "ip_sockaddr.h"
-+#include "ip_index.h"
- 
- struct ip_info {
- 	/*
-@@ -113,8 +114,10 @@ struct ip_info {
- 
- };
- 
--extern const struct ip_info ipv4_info;
--extern const struct ip_info ipv6_info;
-+extern const struct ip_info ip_families[IP_INDEX_ROOF];
-+
-+#define ipv4_info ip_families[IPv4_INDEX]
-+#define ipv6_info ip_families[IPv6_INDEX]
- 
- extern const struct ip_info *aftoinfo(int af);
- 
-diff --git a/lib/libswan/ip_info.c b/lib/libswan/ip_info.c
-index 70cd6a368f..97296d3a11 100644
---- a/lib/libswan/ip_info.c
-+++ b/lib/libswan/ip_info.c
-@@ -158,7 +158,9 @@ static ip_port port_from_ipv6_sockaddr(const ip_sockaddr sa)
- 
- #define IPv4_FF { { 255, 255, 255, 255, }, }
- 
--const struct ip_info ipv4_info = {
-+const struct ip_info ip_families[IP_INDEX_ROOF] = {
-+
-+	[IPv4_INDEX] = {
- 
- 	.ip_version = IPv4,
- 	.ip_size = sizeof(struct in_addr),
-@@ -210,11 +212,11 @@ const struct ip_info ipv4_info = {
- 	.id_ip_addr = ID_IPV4_ADDR,
- 	.id_ip_addr_subnet = ID_IPV4_ADDR_SUBNET,
- 	.id_ip_addr_range = ID_IPV4_ADDR_RANGE,
--};
-+	},
- 
- #define IPv6_FF { { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, }, }
- 
--const struct ip_info ipv6_info = {
-+	[IPv6_INDEX] = {
- 
- 	.ip_version = IPv6,
- 	.ip_size = sizeof(struct in6_addr),
-@@ -266,6 +268,7 @@ const struct ip_info ipv6_info = {
- 	.id_ip_addr = ID_IPV6_ADDR,
- 	.id_ip_addr_subnet = ID_IPV6_ADDR_SUBNET,
- 	.id_ip_addr_range = ID_IPV6_ADDR_RANGE,
-+	}
- };
- 
- const struct ip_info *aftoinfo(int af)
--- 
-2.44.0
-

SOURCES/libreswan-4.15-netlink-extack.patch

@@ -0,0 +1,153 @@
+From 4f2af7c8c3afaaa63e8e16467de3441622a5314d Mon Sep 17 00:00:00 2001
+From: Daiki Ueno <dueno@redhat.com>
+Date: Tue, 21 May 2024 20:12:17 +0900
+Subject: [PATCH] kernel_xfrm: record extended ack from netlink response
+
+This enables pluto to log any error message reported through extended
+ACK attributes[1] in a netlink response, to make diagnostic easier
+when an error occurs.  Suggested by Sabrina Dubroca.
+
+1. https://docs.kernel.org/userspace-api/netlink/intro.html#ext-ack
+
+Signed-off-by: Daiki Ueno <dueno@redhat.com>
+Signed-off-by: Andrew Cagney <cagney@gnu.org>
+---
+ include/netlink_attrib.h     |  4 +++
+ lib/libswan/netlink_attrib.c | 29 +++++++++++++++++++++
+ programs/pluto/kernel_xfrm.c | 49 ++++++++++++++++++++++++++++++++++++
+ 3 files changed, 82 insertions(+)
+
+diff --git a/include/netlink_attrib.h b/include/netlink_attrib.h
+index 4c952ae3e9..fff35d83f1 100644
+--- a/include/netlink_attrib.h
++++ b/include/netlink_attrib.h
+@@ -46,4 +46,8 @@ void nl_addattrstrz(struct nlmsghdr *n, int maxlen, int type,
+ 		const char *str);
+ void nl_addattr32(struct nlmsghdr *n, int maxlen, int type, const uint32_t data);
+ 
++const struct nlattr *nl_getattr(const struct nlmsghdr *n, size_t *offset);
++const char *nl_getattrvalstrz(const struct nlmsghdr *n,
++			      const struct nlattr *attr);
++
+ #endif
+diff --git a/lib/libswan/netlink_attrib.c b/lib/libswan/netlink_attrib.c
+index 34bb4bec83..ccc08cba8f 100644
+--- a/lib/libswan/netlink_attrib.c
++++ b/lib/libswan/netlink_attrib.c
+@@ -66,3 +66,32 @@ void nl_addattr32(struct nlmsghdr *n, int maxlen, int type, const uint32_t data)
+ {
+ 	nl_addattr_l(n, maxlen, type, &data, sizeof(uint32_t));
+ }
++
++const struct nlattr *nl_getattr(const struct nlmsghdr *n, size_t *offset)
++{
++	struct nlattr *attr = (void *)n + NLMSG_HDRLEN + NLMSG_ALIGN(*offset);
++	struct nlattr *tail = (void *)n + NLMSG_ALIGN(n->nlmsg_len);
++
++	if (attr == tail) {
++		return NULL;
++	}
++
++	*offset += NLA_ALIGN(attr->nla_len);
++	return attr;
++}
++
++const char *nl_getattrvalstrz(const struct nlmsghdr *n,
++			      const struct nlattr *attr)
++{
++	struct nlattr *tail = (void *)n + NLMSG_ALIGN(n->nlmsg_len);
++
++	ptrdiff_t len = (void *)tail - (void *)attr;
++	if (len < (ptrdiff_t)sizeof(struct nlattr) ||
++	    attr->nla_len <= sizeof(struct nlattr) ||
++	    attr->nla_len > len ||
++	    !memchr(attr + NLA_HDRLEN, '\0', attr->nla_len - NLA_HDRLEN)) {
++		return NULL;
++	}
++
++	return (void *)attr + NLA_HDRLEN;
++}
+diff --git a/programs/pluto/kernel_xfrm.c b/programs/pluto/kernel_xfrm.c
+index eed307f42b..25d1b16bc9 100644
+--- a/programs/pluto/kernel_xfrm.c
++++ b/programs/pluto/kernel_xfrm.c
+@@ -260,6 +260,22 @@ static void init_netlink(struct logger *logger)
+ 			    "socket() in init_netlink()");
+ 	}
+ 
++#ifdef SOL_NETLINK
++	const int on = true;
++	if (setsockopt(nl_send_fd, SOL_NETLINK, NETLINK_CAP_ACK,
++		       (const void *)&on, sizeof(on)) < 0) {
++		llog_errno(RC_LOG, logger, errno, "xfrm: setsockopt(NETLINK_CAP_ACK) failed: ");
++	} else {
++		ldbg(logger, "xfrm: setsockopt(NETLINK_CAP_ACK) ok");
++	}
++	if (setsockopt(nl_send_fd, SOL_NETLINK, NETLINK_EXT_ACK,
++		       (const void *)&on, sizeof(on)) < 0) {
++		llog_errno(RC_LOG, logger, errno, "xfrm: setsockopt(NETLINK_EXT_ACK) failed: ");
++	} else {
++		ldbg(logger, "xfrm: setsockopt(NETLINK_EXT_ACK) ok");
++	}
++#endif
++
+ 	nl_xfrm_fd = cloexec_socket(AF_NETLINK, SOCK_DGRAM|SOCK_NONBLOCK, NETLINK_XFRM);
+ 	if (nl_xfrm_fd < 0) {
+ 		fatal_errno(PLUTO_EXIT_FAIL, logger, errno,
+@@ -301,6 +317,37 @@ static void init_netlink(struct logger *logger)
+ 	}
+ }
+ 
++static void llog_ext_ack(lset_t rc_flags, struct logger *logger,
++			 const struct nlmsghdr *n)
++{
++#ifdef SOL_NETLINK
++	if (n->nlmsg_type != NLMSG_ERROR ||
++	    !(n->nlmsg_flags & NLM_F_ACK_TLVS)) {
++		return;
++	}
++
++	struct nlmsgerr *err = (void *)n + NLMSG_HDRLEN;
++	size_t offset = sizeof(*err);
++	if (!(n->nlmsg_flags & NLM_F_CAPPED)) {
++		offset += err->msg.nlmsg_len - NLMSG_HDRLEN;
++	}
++
++	for (const struct nlattr *attr = nl_getattr(n, &offset);
++	     attr != NULL; attr = nl_getattr(n, &offset)) {
++		if ((attr->nla_type & NLA_TYPE_MASK) == NLMSGERR_ATTR_MSG) {
++			const char *msg = nl_getattrvalstrz(n, attr);
++			if (msg) {
++				llog(rc_flags, logger, "netlink ext_ack: %s",
++				     msg);
++			}
++		}
++	}
++#else
++	/* use the arguments */
++	ldbg(logger, "ignoring "PRI_LSET" %p", rc_flags, n);
++#endif
++}
++
+ /*
+  * sendrecv_xfrm_msg()
+  *
+@@ -403,6 +450,7 @@ static bool sendrecv_xfrm_msg(struct nlmsghdr *hdr,
+ 		if (rsp.u.e.error != 0) {
+ 			llog_error(logger, -rsp.u.e.error,
+ 				   "netlink response for %s %s", description, story);
++			llog_ext_ack(RC_LOG, logger, &rsp.n);
+ 			return false;
+ 		}
+ 		/*
+@@ -413,6 +461,7 @@ static bool sendrecv_xfrm_msg(struct nlmsghdr *hdr,
+ 		 */
+ 		dbg("netlink response for %s %s included non-error error",
+ 		    description, story);
++		llog_ext_ack(DEBUG_STREAM, logger, &rsp.n);
+ 		/* ignore */
+ 	}
+ 	if (rbuf == NULL) {
+-- 
+2.45.2
+

SOURCES/libreswan-4.15-ondemand-tcp.patch

@@ -0,0 +1,52 @@
+From 0b91406427cf7292d61900991fd665f076b6d43f Mon Sep 17 00:00:00 2001
+From: Daiki Ueno <dueno@redhat.com>
+Date: Tue, 2 Jul 2024 20:37:07 +0900
+Subject: [PATCH] tcp: call kernel_ops->poke_ipsec_policy_hole before connect
+
+This fixes ondemand initiation with TCP.  Without the policy hole, a
+TCP handshake will not complete, as it cannot receive SYN-ACK packet
+in plaintext and thus connect blocks until timeout.
+
+Signed-off-by: Daiki Ueno <dueno@redhat.com>
+Signed-off-by: Andrew Cagney <cagney@gnu.org>
+---
+ programs/pluto/iface_tcp.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/programs/pluto/iface_tcp.c b/programs/pluto/iface_tcp.c
+index c63e8bfe4d..55fe639174 100644
+--- a/programs/pluto/iface_tcp.c
++++ b/programs/pluto/iface_tcp.c
+@@ -473,6 +473,15 @@ struct iface_endpoint *connect_to_tcp_endpoint(struct iface_dev *local_dev,
+ 		return NULL;
+ 	}
+ 
++	/* This needs to be called before connect, so TCP handshake
++	 * (in plaintext) completes. */
++	if (kernel_ops->poke_ipsec_policy_hole != NULL &&
++	    !kernel_ops->poke_ipsec_policy_hole(fd, afi, logger)) {
++		/* already logged */
++		close(fd);
++		return NULL;
++	}
++
+ 	/*
+ 	 * Connect
+ 	 *
+@@ -551,13 +560,6 @@ struct iface_endpoint *connect_to_tcp_endpoint(struct iface_dev *local_dev,
+ 		}
+ 	}
+ 
+-	if (kernel_ops->poke_ipsec_policy_hole != NULL &&
+-	    !kernel_ops->poke_ipsec_policy_hole(fd, afi, logger)) {
+-		/* already logged */
+-		close(fd);
+-		return NULL;
+-	}
+-
+ 	struct iface_endpoint *ifp =
+ 		alloc_iface_endpoint(fd, local_dev, &iketcp_iface_io,
+ 				     /*esp_encapsulation_enabled*/true,
+-- 
+2.45.2
+

SPECS/libreswan.spec

@@ -30,8 +30,8 @@
 Name: libreswan
 Summary: Internet Key Exchange (IKEv1 and IKEv2) implementation for IPsec
 # version is generated in the release script
-Version: 4.12
+Version: 4.15
-Release: %{?prever:0.}2%{?prever:.%{prever}}%{?dist}.1
+Release: %{?prever:0.}3%{?prever:.%{prever}}%{?dist}
 License: GPLv2
 Url: https://libreswan.org/
 Source0: https://download.libreswan.org/%{?prever:development/}%{name}-%{version}%{?prever}.tar.gz
@@ -41,9 +41,8 @@ Source2: https://download.libreswan.org/cavs/ikev1_psk.fax.bz2
 Source3: https://download.libreswan.org/cavs/ikev2.fax.bz2
 %endif
 Patch: libreswan-4.6-ikev1-policy-defaults-to-drop.patch
-Patch: libreswan-4.12-ikev2-auth-delete-state.patch
+Patch: libreswan-4.15-ondemand-tcp.patch
-Patch: libreswan-4.12-ipv6-san.patch
+Patch: libreswan-4.15-netlink-extack.patch
-Patch: libreswan-4.12-ikev1-compute-keymat-default.patch
 
 BuildRequires: audit-libs-devel
 BuildRequires: bison
@@ -199,12 +198,25 @@ certutil -N -d sql:$tmpdir --empty-password
 %doc %{_mandir}/*/*
 
 %changelog
-* Wed Jun  5 2024 Daiki Ueno <dueno@redhat.com> - 4.12-2.1
+* Tue Aug  6 2024 Daiki Ueno <dueno@redhat.com> - 4.15-3
-- Fix CVE-2024-3652 (RHEL-40102)
+- Fix release number
+
+* Tue Aug  6 2024 Daiki Ueno <dueno@redhat.com> - 4.15-2
+- Fix auto=ondemand connection initialization with TCP (RHEL-51879)
+- Make use of Netlink extack for additional error reporting (RHEL-51881)
+
+* Tue Jul 30 2024 Daiki Ueno <dueno@redhat.com> - 4.15-1
+- Update to 4.15 (RHEL-50006)
+
+* Thu Jul 11 2024 Daiki Ueno <dueno@redhat.com> - 4.12-4
+- Bump release to synchronize with el9_5 package
+
+* Wed Jun  5 2024 Daiki Ueno <dueno@redhat.com> - 4.12-3
+- Fix CVE-2024-3652 (RHEL-32483)
 
 * Thu Apr 11 2024 Daiki Ueno <dueno@redhat.com> - 4.12-2
-- Fix CVE-2024-2357 (RHEL-32761)
+- Fix CVE-2024-2357 (RHEL-28743)
-- x509: unpack IPv6 general names based on length (RHEL-32718)
+- x509: unpack IPv6 general names based on length (RHEL-32720)
 
 * Wed Aug  9 2023 Daiki Ueno <dueno@redhat.com> - 4.12-1
 - Update to 4.12 to fix CVE-2023-38710, CVE-2023-38711, CVE-2023-38712