.gitignore

@@ -1,4 +1,4 @@
 SOURCES/ikev1_dsa.fax.bz2
 SOURCES/ikev1_psk.fax.bz2
 SOURCES/ikev2.fax.bz2
-SOURCES/libreswan-4.15.tar.gz
+SOURCES/libreswan-4.12.tar.gz

.libreswan.metadata

@@ -1,4 +1,4 @@
 b35cd50b8bc0a08b9c07713bf19c72d53bfe66bb SOURCES/ikev1_dsa.fax.bz2
 861d97bf488f9e296cad8c43ab72f111a5b1a848 SOURCES/ikev1_psk.fax.bz2
 fcaf77f3deae3d8e99cdb3b1f8abea63167a0633 SOURCES/ikev2.fax.bz2
-861eaeefff1c2f3862a8bfe0295b3e307f8e3055 SOURCES/libreswan-4.15.tar.gz
+786c14a4755311ea3103683a3294e1536b1e44a6 SOURCES/libreswan-4.12.tar.gz

SOURCES/libreswan-4.12-ikev1-compute-keymat-default.patch

@@ -0,0 +1,92 @@
+From 5101913b1e623121a9222f11eefa18f0a2708b00 Mon Sep 17 00:00:00 2001
+From: Andrew Cagney <cagney@gnu.org>
+Date: Wed, 27 Mar 2024 10:43:19 -0400
+Subject: [PATCH] ikev1: in compute_proto_keymat() only allow explicitly
+ handled ESP algorithms
+
+---
+ programs/pluto/ikev1_quick.c | 41 ++++++++++++++----------------------
+ 1 file changed, 16 insertions(+), 25 deletions(-)
+
+diff --git a/programs/pluto/ikev1_quick.c b/programs/pluto/ikev1_quick.c
+index 81c522c148..22c346afb4 100644
+--- a/programs/pluto/ikev1_quick.c
++++ b/programs/pluto/ikev1_quick.c
+@@ -203,7 +203,7 @@ static bool emit_subnet_id(enum perspective perspective,
+  * RFC 2409 "IKE" section 5.5
+  * specifies how this is to be done.
+  */
+-static void compute_proto_keymat(struct state *st,
++static bool compute_proto_keymat(struct state *st,
+ 				 uint8_t protoid,
+ 				 struct ipsec_proto_info *pi,
+ 				 const char *satypename)
+@@ -297,27 +297,13 @@ static void compute_proto_keymat(struct state *st,
+ 			}
+ 			break;
+ 
+-		case ESP_CAST:
+-		case ESP_TWOFISH:
+-		case ESP_SERPENT:
+-		/* ESP_SEED is for IKEv1 only and not supported. Its number in IKEv2 has been re-used */
+-			bad_case(pi->attrs.transattrs.ta_ikev1_encrypt);
+-
+ 		default:
+-			/* bytes */
+-			needed_len = encrypt_max_key_bit_length(pi->attrs.transattrs.ta_encrypt) / BITS_PER_BYTE;
+-			if (needed_len > 0) {
+-				/* XXX: check key_len coupling with kernel.c's */
+-				if (pi->attrs.transattrs.enckeylen) {
+-					needed_len =
+-						pi->attrs.transattrs.enckeylen
+-						/ BITS_PER_BYTE;
+-					dbg("compute_proto_keymat: key_len=%d from peer",
+-					    (int)needed_len);
+-				}
+-				break;
+-			}
+-			bad_case(pi->attrs.transattrs.ta_ikev1_encrypt);
++		{
++			enum_buf eb;
++			llog(RC_LOG, st->st_logger, "rejecting request for keymat for %s",
++			     str_enum(&esp_transformid_names, protoid, &eb));
++			return false;
++		}
+ 		}
+ 		dbg("compute_proto_keymat: needed_len (after ESP enc)=%d", (int)needed_len);
+ 		needed_len += pi->attrs.transattrs.ta_integ->integ_keymat_size;
+@@ -359,14 +345,17 @@ static void compute_proto_keymat(struct state *st,
+ 		DBG_dump_hunk("  inbound:", pi->inbound.keymat);
+ 		DBG_dump_hunk("  outbound:", pi->outbound.keymat);
+ 	}
++
++	return true;
+ }
+ 
+-static void compute_keymats(struct state *st)
++static bool compute_keymats(struct state *st)
+ {
+ 	if (st->st_ah.present)
+-		compute_proto_keymat(st, PROTO_IPSEC_AH, &st->st_ah, "AH");
++		return compute_proto_keymat(st, PROTO_IPSEC_AH, &st->st_ah, "AH");
+ 	if (st->st_esp.present)
+-		compute_proto_keymat(st, PROTO_IPSEC_ESP, &st->st_esp, "ESP");
++		return compute_proto_keymat(st, PROTO_IPSEC_ESP, &st->st_esp, "ESP");
++	return false;
+ }
+ 
+ /*
+@@ -1460,7 +1449,9 @@ static stf_status quick_inI1_outR1_continue12_tail(struct state *st, struct msg_
+ 	fixup_v1_HASH(st, &hash_fixup, st->st_v1_msgid.id, rbody.cur);
+ 
+ 	/* Derive new keying material */
+-	compute_keymats(st);
++	if (!compute_keymats(st)) {
++		return STF_FATAL;
++	}
+ 
+ 	/* Tell the kernel to establish the new inbound SA
+ 	 * (unless the commit bit is set -- which we don't support).
+-- 
+2.45.0
+

SOURCES/libreswan-4.12-ikev2-auth-delete-state.patch

@@ -0,0 +1,54 @@
+From 2ec448884a7467743699803f8a36ee28d237666c Mon Sep 17 00:00:00 2001
+From: Andrew Cagney <cagney@gnu.org>
+Date: Wed, 28 Feb 2024 08:29:53 -0500
+Subject: [PATCH] ikev2: return STF_FATAL when initiator fails to emit AUTH
+ packet
+
+---
+ programs/pluto/ikev2_ike_auth.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/programs/pluto/ikev2_ike_auth.c b/programs/pluto/ikev2_ike_auth.c
+index 192eb1b3b6..a54a109699 100644
+--- a/programs/pluto/ikev2_ike_auth.c
++++ b/programs/pluto/ikev2_ike_auth.c
+@@ -1267,7 +1267,7 @@ static stf_status process_v2_IKE_AUTH_request_auth_signature_continue(struct ike
+ 	/* now send AUTH payload */
+ 
+ 	if (!emit_local_v2AUTH(ike, auth_sig, &ike->sa.st_v2_id_payload.mac, response.pbs)) {
+-		return STF_INTERNAL_ERROR;
++		return STF_FATAL;
+ 	}
+ 	ike->sa.st_v2_ike_intermediate.used = false;
+ 
+-- 
+2.44.0
+
+From 16272f2475d25baab58fbed2af7c67cfb459137f Mon Sep 17 00:00:00 2001
+From: Andrew Cagney <cagney@gnu.org>
+Date: Thu, 29 Feb 2024 12:19:20 -0500
+Subject: [PATCH] ikev2: always return STF_FATAL if emitting AUTH fails
+
+Fix:
+  ikev2: return STF_FATAL when initiator fails to emit AUTH packet
+which really fixed the responder.
+---
+ programs/pluto/ikev2_ike_auth.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/programs/pluto/ikev2_ike_auth.c b/programs/pluto/ikev2_ike_auth.c
+index a54a109699..491053fb10 100644
+--- a/programs/pluto/ikev2_ike_auth.c
++++ b/programs/pluto/ikev2_ike_auth.c
+@@ -397,7 +397,7 @@ stf_status initiate_v2_IKE_AUTH_request_signature_continue(struct ike_sa *ike,
+ 	/* send out the AUTH payload */
+ 
+ 	if (!emit_local_v2AUTH(ike, auth_sig, &ike->sa.st_v2_id_payload.mac, request.pbs)) {
+-		return STF_INTERNAL_ERROR;
++		return STF_FATAL;
+ 	}
+ 
+ 	if (LIN(POLICY_MOBIKE, ike->sa.st_connection->policy)) {
+-- 
+2.44.0
+

SOURCES/libreswan-4.12-ipv6-san.patch

@@ -0,0 +1,198 @@
+From 474d75be074799efa9e38f346d3fdb76dec3eead Mon Sep 17 00:00:00 2001
+From: Andrew Cagney <cagney@gnu.org>
+Date: Tue, 5 Dec 2023 13:55:37 -0500
+Subject: [PATCH] x509: unpack IPv6 general names based on length
+
+fix #1321
+---
+ programs/pluto/x509.c | 35 +++++++++++++++++++++++++++++------
+ 1 file changed, 29 insertions(+), 6 deletions(-)
+
+diff --git a/programs/pluto/x509.c b/programs/pluto/x509.c
+index fbbf5a553e..f7e97b9979 100644
+--- a/programs/pluto/x509.c
++++ b/programs/pluto/x509.c
+@@ -336,7 +336,7 @@ generalName_t *collect_rw_ca_candidates(struct msg_digest *md)
+  */
+ static void gntoid(struct id *id, const generalName_t *gn, struct logger *logger)
+ {
+-	*id = empty_id;
++	*id = empty_id; /* aka ID_NONE */
+ 
+ 	switch (gn->kind) {
+ 	case GN_DNS_NAME:	/* ID type: ID_FQDN */
+@@ -345,18 +345,37 @@ static void gntoid(struct id *id, const generalName_t *gn, struct logger *logger
+ 		break;
+ 	case GN_IP_ADDRESS:	/* ID type: ID_IPV4_ADDR */
+ 	{
++		const struct ip_info *afi = NULL;
++		for (enum ip_index i = 0; i < IP_INDEX_ROOF; i++) {
++			if (ip_families[i].ip_size == gn->name.len) {
++				afi = &ip_families[i];
++				break;
++			}
++		}
++		if (afi == NULL) {
++			llog(RC_LOG, logger,
++			     "warning: invalid IP_ADDRESS general name: %zu byte length is not valid",
++			     gn->name.len);
++			PEXPECT(logger, id->kind == ID_NONE);
++			return;
++		}
++
+ 		/*
+ 		 * XXX: why could this fail; and what happens when it
+ 		 * is ignored?
+ 		 */
+-		const struct ip_info *afi = &ipv4_info;
+-		id->kind = afi->id_ip_addr;
+-		err_t ugh = hunk_to_address(gn->name, afi, &id->ip_addr);
++		ip_address addr;
++		err_t ugh = hunk_to_address(gn->name, afi, &addr);
+ 		if (ugh != NULL) {
+ 			llog(RC_LOG, logger,
+-				    "warning: gntoid() failed to initaddr(): %s",
+-				    ugh);
++			     "warning: invalid IP_ADDRESS general name: %s",
++			     ugh);
++			PEXPECT(logger, id->kind == ID_NONE);
++			return;
+ 		}
++
++		id->kind = afi->id_ip_addr;
++		id->ip_addr = addr;
+ 		break;
+ 	}
+ 	case GN_RFC822_NAME:	/* ID type: ID_USER_FQDN */
+@@ -464,14 +483,18 @@ bool add_pubkey_from_nss_cert(struct pubkey_list **pubkey_db,
+ 		return false;
+ 	}
+ 
++	ldbg(logger, "adding cert using subject name");
+ 	replace_public_key(pubkey_db, &pk);
+ 	passert(pk == NULL); /*stolen*/
+ 
++	ldbg(logger, "adding cert using general names");
+ 	add_cert_san_pubkeys(pubkey_db, cert, logger);
+ 
+ 	if (keyid != NULL && keyid->kind != ID_DER_ASN1_DN &&
+ 			     keyid->kind != ID_NONE &&
+ 			     keyid->kind != ID_FROMCERT) {
++		id_buf idb;
++		ldbg(logger, "adding cert using keyid %s", str_id(keyid, &idb));
+ 		struct pubkey *pk2 = NULL;
+ 		diag_t d = create_pubkey_from_cert(keyid, cert, &pk2, logger);
+ 		if (d != NULL) {
+-- 
+2.44.0
+
+From 1e27be95cd710a840681d1a51913e6a32ce75a2a Mon Sep 17 00:00:00 2001
+From: Andrew Cagney <cagney@gnu.org>
+Date: Mon, 11 Mar 2024 17:18:51 -0400
+Subject: [PATCH] building: back-port ip_families[] and ip_index
+
+---
+ include/ip_index.h    | 27 +++++++++++++++++++++++++++
+ include/ip_info.h     |  7 +++++--
+ lib/libswan/ip_info.c |  9 ++++++---
+ 3 files changed, 38 insertions(+), 5 deletions(-)
+ create mode 100644 include/ip_index.h
+
+diff --git a/include/ip_index.h b/include/ip_index.h
+new file mode 100644
+index 0000000000..508589b05e
+--- /dev/null
++++ b/include/ip_index.h
+@@ -0,0 +1,27 @@
++/* ip address type index, for libreswan
++ *
++ * Copyright (C) 2022 Andrew Cagney
++ *
++ * This library is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU Library General Public License as published by
++ * the Free Software Foundation; either version 2 of the License, or (at your
++ * option) any later version.  See <https://www.gnu.org/licenses/lgpl-2.1.txt>.
++ *
++ * This library is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
++ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Library General Public
++ * License for more details.
++ *
++ */
++
++#ifndef IP_INDEX_H
++#define IP_INDEX_H
++
++enum ip_index {
++	IPv4_INDEX,
++	IPv6_INDEX,
++};
++
++#define IP_INDEX_ROOF (IPv6_INDEX+1)
++
++#endif
+diff --git a/include/ip_info.h b/include/ip_info.h
+index 40e99ef687..c1329a8569 100644
+--- a/include/ip_info.h
++++ b/include/ip_info.h
+@@ -9,6 +9,7 @@
+ #include "ip_subnet.h"
+ #include "ip_selector.h"
+ #include "ip_sockaddr.h"
++#include "ip_index.h"
+ 
+ struct ip_info {
+ 	/*
+@@ -113,8 +114,10 @@ struct ip_info {
+ 
+ };
+ 
+-extern const struct ip_info ipv4_info;
+-extern const struct ip_info ipv6_info;
++extern const struct ip_info ip_families[IP_INDEX_ROOF];
++
++#define ipv4_info ip_families[IPv4_INDEX]
++#define ipv6_info ip_families[IPv6_INDEX]
+ 
+ extern const struct ip_info *aftoinfo(int af);
+ 
+diff --git a/lib/libswan/ip_info.c b/lib/libswan/ip_info.c
+index 70cd6a368f..97296d3a11 100644
+--- a/lib/libswan/ip_info.c
++++ b/lib/libswan/ip_info.c
+@@ -158,7 +158,9 @@ static ip_port port_from_ipv6_sockaddr(const ip_sockaddr sa)
+ 
+ #define IPv4_FF { { 255, 255, 255, 255, }, }
+ 
+-const struct ip_info ipv4_info = {
++const struct ip_info ip_families[IP_INDEX_ROOF] = {
++
++	[IPv4_INDEX] = {
+ 
+ 	.ip_version = IPv4,
+ 	.ip_size = sizeof(struct in_addr),
+@@ -210,11 +212,11 @@ const struct ip_info ipv4_info = {
+ 	.id_ip_addr = ID_IPV4_ADDR,
+ 	.id_ip_addr_subnet = ID_IPV4_ADDR_SUBNET,
+ 	.id_ip_addr_range = ID_IPV4_ADDR_RANGE,
+-};
++	},
+ 
+ #define IPv6_FF { { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, }, }
+ 
+-const struct ip_info ipv6_info = {
++	[IPv6_INDEX] = {
+ 
+ 	.ip_version = IPv6,
+ 	.ip_size = sizeof(struct in6_addr),
+@@ -266,6 +268,7 @@ const struct ip_info ipv6_info = {
+ 	.id_ip_addr = ID_IPV6_ADDR,
+ 	.id_ip_addr_subnet = ID_IPV6_ADDR_SUBNET,
+ 	.id_ip_addr_range = ID_IPV6_ADDR_RANGE,
++	}
+ };
+ 
+ const struct ip_info *aftoinfo(int af)
+-- 
+2.44.0
+

SOURCES/libreswan-4.15-netlink-extack.patch

@@ -1,153 +0,0 @@
-From 4f2af7c8c3afaaa63e8e16467de3441622a5314d Mon Sep 17 00:00:00 2001
-From: Daiki Ueno <dueno@redhat.com>
-Date: Tue, 21 May 2024 20:12:17 +0900
-Subject: [PATCH] kernel_xfrm: record extended ack from netlink response
-
-This enables pluto to log any error message reported through extended
-ACK attributes[1] in a netlink response, to make diagnostic easier
-when an error occurs.  Suggested by Sabrina Dubroca.
-
-1. https://docs.kernel.org/userspace-api/netlink/intro.html#ext-ack
-
-Signed-off-by: Daiki Ueno <dueno@redhat.com>
-Signed-off-by: Andrew Cagney <cagney@gnu.org>
----
- include/netlink_attrib.h     |  4 +++
- lib/libswan/netlink_attrib.c | 29 +++++++++++++++++++++
- programs/pluto/kernel_xfrm.c | 49 ++++++++++++++++++++++++++++++++++++
- 3 files changed, 82 insertions(+)
-
-diff --git a/include/netlink_attrib.h b/include/netlink_attrib.h
-index 4c952ae3e9..fff35d83f1 100644
---- a/include/netlink_attrib.h
-+++ b/include/netlink_attrib.h
-@@ -46,4 +46,8 @@ void nl_addattrstrz(struct nlmsghdr *n, int maxlen, int type,
- 		const char *str);
- void nl_addattr32(struct nlmsghdr *n, int maxlen, int type, const uint32_t data);
- 
-+const struct nlattr *nl_getattr(const struct nlmsghdr *n, size_t *offset);
-+const char *nl_getattrvalstrz(const struct nlmsghdr *n,
-+			      const struct nlattr *attr);
-+
- #endif
-diff --git a/lib/libswan/netlink_attrib.c b/lib/libswan/netlink_attrib.c
-index 34bb4bec83..ccc08cba8f 100644
---- a/lib/libswan/netlink_attrib.c
-+++ b/lib/libswan/netlink_attrib.c
-@@ -66,3 +66,32 @@ void nl_addattr32(struct nlmsghdr *n, int maxlen, int type, const uint32_t data)
- {
- 	nl_addattr_l(n, maxlen, type, &data, sizeof(uint32_t));
- }
-+
-+const struct nlattr *nl_getattr(const struct nlmsghdr *n, size_t *offset)
-+{
-+	struct nlattr *attr = (void *)n + NLMSG_HDRLEN + NLMSG_ALIGN(*offset);
-+	struct nlattr *tail = (void *)n + NLMSG_ALIGN(n->nlmsg_len);
-+
-+	if (attr == tail) {
-+		return NULL;
-+	}
-+
-+	*offset += NLA_ALIGN(attr->nla_len);
-+	return attr;
-+}
-+
-+const char *nl_getattrvalstrz(const struct nlmsghdr *n,
-+			      const struct nlattr *attr)
-+{
-+	struct nlattr *tail = (void *)n + NLMSG_ALIGN(n->nlmsg_len);
-+
-+	ptrdiff_t len = (void *)tail - (void *)attr;
-+	if (len < (ptrdiff_t)sizeof(struct nlattr) ||
-+	    attr->nla_len <= sizeof(struct nlattr) ||
-+	    attr->nla_len > len ||
-+	    !memchr(attr + NLA_HDRLEN, '\0', attr->nla_len - NLA_HDRLEN)) {
-+		return NULL;
-+	}
-+
-+	return (void *)attr + NLA_HDRLEN;
-+}
-diff --git a/programs/pluto/kernel_xfrm.c b/programs/pluto/kernel_xfrm.c
-index eed307f42b..25d1b16bc9 100644
---- a/programs/pluto/kernel_xfrm.c
-+++ b/programs/pluto/kernel_xfrm.c
-@@ -260,6 +260,22 @@ static void init_netlink(struct logger *logger)
- 			    "socket() in init_netlink()");
- 	}
- 
-+#ifdef SOL_NETLINK
-+	const int on = true;
-+	if (setsockopt(nl_send_fd, SOL_NETLINK, NETLINK_CAP_ACK,
-+		       (const void *)&on, sizeof(on)) < 0) {
-+		llog_errno(RC_LOG, logger, errno, "xfrm: setsockopt(NETLINK_CAP_ACK) failed: ");
-+	} else {
-+		ldbg(logger, "xfrm: setsockopt(NETLINK_CAP_ACK) ok");
-+	}
-+	if (setsockopt(nl_send_fd, SOL_NETLINK, NETLINK_EXT_ACK,
-+		       (const void *)&on, sizeof(on)) < 0) {
-+		llog_errno(RC_LOG, logger, errno, "xfrm: setsockopt(NETLINK_EXT_ACK) failed: ");
-+	} else {
-+		ldbg(logger, "xfrm: setsockopt(NETLINK_EXT_ACK) ok");
-+	}
-+#endif
-+
- 	nl_xfrm_fd = cloexec_socket(AF_NETLINK, SOCK_DGRAM|SOCK_NONBLOCK, NETLINK_XFRM);
- 	if (nl_xfrm_fd < 0) {
- 		fatal_errno(PLUTO_EXIT_FAIL, logger, errno,
-@@ -301,6 +317,37 @@ static void init_netlink(struct logger *logger)
- 	}
- }
- 
-+static void llog_ext_ack(lset_t rc_flags, struct logger *logger,
-+			 const struct nlmsghdr *n)
-+{
-+#ifdef SOL_NETLINK
-+	if (n->nlmsg_type != NLMSG_ERROR ||
-+	    !(n->nlmsg_flags & NLM_F_ACK_TLVS)) {
-+		return;
-+	}
-+
-+	struct nlmsgerr *err = (void *)n + NLMSG_HDRLEN;
-+	size_t offset = sizeof(*err);
-+	if (!(n->nlmsg_flags & NLM_F_CAPPED)) {
-+		offset += err->msg.nlmsg_len - NLMSG_HDRLEN;
-+	}
-+
-+	for (const struct nlattr *attr = nl_getattr(n, &offset);
-+	     attr != NULL; attr = nl_getattr(n, &offset)) {
-+		if ((attr->nla_type & NLA_TYPE_MASK) == NLMSGERR_ATTR_MSG) {
-+			const char *msg = nl_getattrvalstrz(n, attr);
-+			if (msg) {
-+				llog(rc_flags, logger, "netlink ext_ack: %s",
-+				     msg);
-+			}
-+		}
-+	}
-+#else
-+	/* use the arguments */
-+	ldbg(logger, "ignoring "PRI_LSET" %p", rc_flags, n);
-+#endif
-+}
-+
- /*
-  * sendrecv_xfrm_msg()
-  *
-@@ -403,6 +450,7 @@ static bool sendrecv_xfrm_msg(struct nlmsghdr *hdr,
- 		if (rsp.u.e.error != 0) {
- 			llog_error(logger, -rsp.u.e.error,
- 				   "netlink response for %s %s", description, story);
-+			llog_ext_ack(RC_LOG, logger, &rsp.n);
- 			return false;
- 		}
- 		/*
-@@ -413,6 +461,7 @@ static bool sendrecv_xfrm_msg(struct nlmsghdr *hdr,
- 		 */
- 		dbg("netlink response for %s %s included non-error error",
- 		    description, story);
-+		llog_ext_ack(DEBUG_STREAM, logger, &rsp.n);
- 		/* ignore */
- 	}
- 	if (rbuf == NULL) {
--- 
-2.45.2
-

SOURCES/libreswan-4.15-ondemand-tcp.patch

@@ -1,52 +0,0 @@
-From 0b91406427cf7292d61900991fd665f076b6d43f Mon Sep 17 00:00:00 2001
-From: Daiki Ueno <dueno@redhat.com>
-Date: Tue, 2 Jul 2024 20:37:07 +0900
-Subject: [PATCH] tcp: call kernel_ops->poke_ipsec_policy_hole before connect
-
-This fixes ondemand initiation with TCP.  Without the policy hole, a
-TCP handshake will not complete, as it cannot receive SYN-ACK packet
-in plaintext and thus connect blocks until timeout.
-
-Signed-off-by: Daiki Ueno <dueno@redhat.com>
-Signed-off-by: Andrew Cagney <cagney@gnu.org>
----
- programs/pluto/iface_tcp.c | 16 +++++++++-------
- 1 file changed, 9 insertions(+), 7 deletions(-)
-
-diff --git a/programs/pluto/iface_tcp.c b/programs/pluto/iface_tcp.c
-index c63e8bfe4d..55fe639174 100644
---- a/programs/pluto/iface_tcp.c
-+++ b/programs/pluto/iface_tcp.c
-@@ -473,6 +473,15 @@ struct iface_endpoint *connect_to_tcp_endpoint(struct iface_dev *local_dev,
- 		return NULL;
- 	}
- 
-+	/* This needs to be called before connect, so TCP handshake
-+	 * (in plaintext) completes. */
-+	if (kernel_ops->poke_ipsec_policy_hole != NULL &&
-+	    !kernel_ops->poke_ipsec_policy_hole(fd, afi, logger)) {
-+		/* already logged */
-+		close(fd);
-+		return NULL;
-+	}
-+
- 	/*
- 	 * Connect
- 	 *
-@@ -551,13 +560,6 @@ struct iface_endpoint *connect_to_tcp_endpoint(struct iface_dev *local_dev,
- 		}
- 	}
- 
--	if (kernel_ops->poke_ipsec_policy_hole != NULL &&
--	    !kernel_ops->poke_ipsec_policy_hole(fd, afi, logger)) {
--		/* already logged */
--		close(fd);
--		return NULL;
--	}
--
- 	struct iface_endpoint *ifp =
- 		alloc_iface_endpoint(fd, local_dev, &iketcp_iface_io,
- 				     /*esp_encapsulation_enabled*/true,
--- 
-2.45.2
-

SPECS/libreswan.spec

@@ -30,8 +30,8 @@
 Name: libreswan
 Summary: Internet Key Exchange (IKEv1 and IKEv2) implementation for IPsec
 # version is generated in the release script
-Version: 4.15
+Version: 4.12
-Release: %{?prever:0.}3%{?prever:.%{prever}}%{?dist}
+Release: %{?prever:0.}2%{?prever:.%{prever}}%{?dist}.1
 License: GPLv2
 Url: https://libreswan.org/
 Source0: https://download.libreswan.org/%{?prever:development/}%{name}-%{version}%{?prever}.tar.gz
@@ -41,8 +41,9 @@ Source2: https://download.libreswan.org/cavs/ikev1_psk.fax.bz2
 Source3: https://download.libreswan.org/cavs/ikev2.fax.bz2
 %endif
 Patch: libreswan-4.6-ikev1-policy-defaults-to-drop.patch
-Patch: libreswan-4.15-ondemand-tcp.patch
+Patch: libreswan-4.12-ikev2-auth-delete-state.patch
-Patch: libreswan-4.15-netlink-extack.patch
+Patch: libreswan-4.12-ipv6-san.patch
+Patch: libreswan-4.12-ikev1-compute-keymat-default.patch
 
 BuildRequires: audit-libs-devel
 BuildRequires: bison
@@ -198,25 +199,12 @@ certutil -N -d sql:$tmpdir --empty-password
 %doc %{_mandir}/*/*
 
 %changelog
-* Tue Aug  6 2024 Daiki Ueno <dueno@redhat.com> - 4.15-3
+* Wed Jun  5 2024 Daiki Ueno <dueno@redhat.com> - 4.12-2.1
-- Fix release number
+- Fix CVE-2024-3652 (RHEL-40102)
-
-* Tue Aug  6 2024 Daiki Ueno <dueno@redhat.com> - 4.15-2
-- Fix auto=ondemand connection initialization with TCP (RHEL-51879)
-- Make use of Netlink extack for additional error reporting (RHEL-51881)
-
-* Tue Jul 30 2024 Daiki Ueno <dueno@redhat.com> - 4.15-1
-- Update to 4.15 (RHEL-50006)
-
-* Thu Jul 11 2024 Daiki Ueno <dueno@redhat.com> - 4.12-4
-- Bump release to synchronize with el9_5 package
-
-* Wed Jun  5 2024 Daiki Ueno <dueno@redhat.com> - 4.12-3
-- Fix CVE-2024-3652 (RHEL-32483)
 
 * Thu Apr 11 2024 Daiki Ueno <dueno@redhat.com> - 4.12-2
-- Fix CVE-2024-2357 (RHEL-28743)
+- Fix CVE-2024-2357 (RHEL-32761)
-- x509: unpack IPv6 general names based on length (RHEL-32720)
+- x509: unpack IPv6 general names based on length (RHEL-32718)
 
 * Wed Aug  9 2023 Daiki Ueno <dueno@redhat.com> - 4.12-1
 - Update to 4.12 to fix CVE-2023-38710, CVE-2023-38711, CVE-2023-38712
@@ -238,9 +226,6 @@ certutil -N -d sql:$tmpdir --empty-password
   libreswan
 - Resolves: rhbz#2187171
 
-* Fri Apr 14 2023 MSVSphere Packaging Team <packager@msvsphere.ru> - 4.9-2
-- Rebuilt for MSVSphere 9.2 beta
-
 * Tue Apr  4 2023 Daiki Ueno <dueno@redhat.com> - 4.9-2
 - Fix CVE-2023-23009: remote DoS via crafted TS payload with an
   incorrect selector length (rhbz#2173674)