Accepting request 800173 from home:iznogood:branches:network:vpn

- Update to version 5.8.4:
  * In IKEv1 Quick Mode make sure that a proposal exists before
    determining lifetimes (fixes a crash due to a null-pointer
    dereference in 5.8.3).
  * OpenSSL currently doesn't support squeezing bytes out of a
    SHAKE128/256 XOF (support was added with 5.8.3) multiple times.
    Unfortunately, EVP_DigestFinalXOF() completely resets the
    context and later calls not simply fail, they cause a
    null-pointer dereference in libcrypto. c5c1898d73 fixes the
    crash at the cost of repeating initializing the whole state and
    allocating too much data for subsequent calls (hopefully, once
    the OpenSSL issue 7894 is resolved we can implement this more
    efficiently).
  * On 32-bit platforms, reading arbitrary 32-bit integers from
    config files (e.g. for charon.spi_min/max) has been fixed.
  * charon-nm now allows using fixed source ports.
- Changes from version 5.8.3:
  * Updates for the NM plugin (and backend, which has to be updated
    to be compatible):
    + EAP-TLS authentication (#2097)
    + Certificate source (file, agent, smartcard) is selectable
      independently
    + Add support to configure local and remote identities (#2581)
    + Support configuring a custom server port (#625)
    + Show hint regarding password storage policy
    + Replaced the term "gateway" with "server"
    + Fixes build issues due to use of deprecated GLib
      macros/functions
    + Updated Glade file to GTK 3.2
  * The NM backend now supports reauthentication and redirection.
  * Previously used reqids are now reallocated, which works around
    an issue on FreeBSD where the kernel doesn't allow the daemon
    to use reqids > 16383 (#2315).
  * On Linux, throw type routes are installed in table 220 for
    passthrough policies. The kernel will then fall back on routes
    in routing tables with lower priorities for matching traffic.
    This way, they require less information (e.g. no interface or
    source IP) and can be installed earlier and are not affected by
    updates.
  * For IKEv1, the lifetimes of the actually selected transform are
    returned to the initiator, which is an issue if the peer uses
    different lifetimes for different transforms (#3329). We now
    also return the correct transform and proposal IDs (proposal ID
    was always 0, transform ID 1). IKE_SAs are now not
    re-established anymore (e.g. after several retransmits) if a
    deletion has been queued (#3335).
  * Added support for Ed448 keys and certificates via openssl
    plugin and pki tool.
  * Added support for SHA-3 and SHAKE128/256 in the openssl plugin.
  * The use of algorithm IDs from the private use range can now be
    enabled globally, to use them even if no strongSwan vendor ID
    was exchanged (05e373aeb0).
  * Fixed a compiler issue that may have caused invalid keyUsage
    extensions in certificates (#3249).
  * A lot of spelling fixes.
  * Fixed several reported issues.
- Drop 0006-Resolve-multiple-definition-of-swanctl_dir.patch: Fixed
  upstream.

OBS-URL: https://build.opensuse.org/request/show/800173
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=122

0006-Resolve-multiple-definition-of-swanctl_dir.patch

@@ -1,12 +0,0 @@
-diff -Naur strongswan-5.8.2.orig/src/swanctl/swanctl.h strongswan-5.8.2/src/swanctl/swanctl.h
---- strongswan-5.8.2.orig/src/swanctl/swanctl.h	2018-12-14 16:48:24.000000000 +0100
-+++ strongswan-5.8.2/src/swanctl/swanctl.h	2020-03-26 07:54:21.876224209 +0100
-@@ -30,7 +30,7 @@
- /**
-  * Base directory for credentials and config
-  */
--char *swanctl_dir;
-+extern char *swanctl_dir;
- 
- /**
-  * Configuration file for connections, etc.

strongswan-5.8.2.tar.bz2

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:86900ddbe7337c923dadf2c8339ae8ed2b9158e3691745884d08ae534677430e
-size 4533402

strongswan-5.8.2.tar.bz2.sig

@@ -1,14 +0,0 @@
------BEGIN PGP SIGNATURE-----
-Version: GnuPG v1
-
-iQGcBAABAgAGBQJd+MscAAoJEN9CwXCzTbp3f6ML/0y5DGj7CytdIWcT7ODbZ5Dt
-S8MS2BHxUJ4cgzB8InCK4wNQFpyzRhR2goPly1B8RVNSVSfdyvqfSC/A++esZe3m
-wwjsjzjWYVaNnkj1lrl/8azOiDkD/uA/NaaUcASp6hoJIJQALYW5HfPjL/S/hC+v
-iVio5Fy9c/9HGJEeeZxqRMp/gTNjvh05hbP9ukLADk6klphwaNFg5o0YNgf1NJFE
-CBo/rGJNVfvEUUlJMLiBlFCBaPMOIjoIXODpjootRioDpnF6IonfcoIGiR6TuRQC
-zR3u3Zhgpe4tJfkKCpCCSPGwMCcwreMAUwzRf/U/HDUSPZX+c4sBOIl8eedwVA77
-DjNlktwmPta8x4YOh6NB3ghAwwztEkPvvaAIcwH0gh1DkjIicFr2VkoXIS5jqaVN
-bK2YvTQ7StZa35VaEYnlu5JzIchPlqhXND6sWLWJolnwrNWskZyojVYioyIv3KJJ
-tXphbN0HHCfLPs5vX8/X97IAa06tsnEOZEZg5Sk3Jw==
-=VHUc
------END PGP SIGNATURE-----

strongswan-5.8.4.tar.bz2

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:2d9a57e33813b62d58cba07531c4d5a35c6b823dfe9b8ff7c623b6571f02553c
+size 4546240

strongswan-5.8.4.tar.bz2.sig

@@ -0,0 +1,14 @@
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v1
+
+iQGcBAABAgAGBQJegIHmAAoJEN9CwXCzTbp3onEL/iwMScWYL6KgjQCJp2acqFZf
+R+aVc18W/Pb4z6Qc8YghcVPlXG1L9cyfHTCHV3jNPXAX3qB+EMSG+DVfY7INdOfg
+3It6rVLwMLMYiPmmsMUoZpOfM4Fpw5rM6fjWPI3KogUpjF814TN1JJNIXC0e5jA0
+AxzLczzhhNbG+YnSdSDd/XhjG816QDYAv1WdoFvgP65QSVBKmQPzZz+ons6Ivjl5
+Il3Tly5IJnOeDfe/K0bsnNBXomjIWnQDtlwG4wfAFJV6YwTtJEvwMErQg9W9iVHY
+tndOdn/C8CfPXVnaBAbnkX3Vk9MWhLP+pFMF56Xojga8gPkqTD15zLubVlx8Gzal
+dW3s7qi0bmca10JwzOpuDePhzziemcqpsexdlhOuffaz+GZ2wHfupeixVXuFoV+F
+b3/htxfibnU8IqQl0YCdYh4vwKYwr6cz07TphmQBhrsLy8SjVr/EngPreDVDCgJ4
+tip0FJvV6yU7RTyNHqJOvKfwz9AEbo1ZRsfEEi6Qxw==
+=Xj8F
+-----END PGP SIGNATURE-----

strongswan.changes

@@ -1,3 +1,65 @@
+-------------------------------------------------------------------
+Fri May  1 09:39:42 UTC 2020 - Bjørn Lie <bjorn.lie@gmail.com>
+
+- Update to version 5.8.4:
+  * In IKEv1 Quick Mode make sure that a proposal exists before
+    determining lifetimes (fixes a crash due to a null-pointer
+    dereference in 5.8.3).
+  * OpenSSL currently doesn't support squeezing bytes out of a
+    SHAKE128/256 XOF (support was added with 5.8.3) multiple times.
+    Unfortunately, EVP_DigestFinalXOF() completely resets the
+    context and later calls not simply fail, they cause a
+    null-pointer dereference in libcrypto. c5c1898d73 fixes the
+    crash at the cost of repeating initializing the whole state and
+    allocating too much data for subsequent calls (hopefully, once
+    the OpenSSL issue 7894 is resolved we can implement this more
+    efficiently).
+  * On 32-bit platforms, reading arbitrary 32-bit integers from
+    config files (e.g. for charon.spi_min/max) has been fixed.
+  * charon-nm now allows using fixed source ports.
+- Changes from version 5.8.3:
+  * Updates for the NM plugin (and backend, which has to be updated
+    to be compatible):
+    + EAP-TLS authentication (#2097)
+    + Certificate source (file, agent, smartcard) is selectable
+      independently
+    + Add support to configure local and remote identities (#2581)
+    + Support configuring a custom server port (#625)
+    + Show hint regarding password storage policy
+    + Replaced the term "gateway" with "server"
+    + Fixes build issues due to use of deprecated GLib
+      macros/functions
+    + Updated Glade file to GTK 3.2
+  * The NM backend now supports reauthentication and redirection.
+  * Previously used reqids are now reallocated, which works around
+    an issue on FreeBSD where the kernel doesn't allow the daemon
+    to use reqids > 16383 (#2315).
+  * On Linux, throw type routes are installed in table 220 for
+    passthrough policies. The kernel will then fall back on routes
+    in routing tables with lower priorities for matching traffic.
+    This way, they require less information (e.g. no interface or
+    source IP) and can be installed earlier and are not affected by
+    updates.
+  * For IKEv1, the lifetimes of the actually selected transform are
+    returned to the initiator, which is an issue if the peer uses
+    different lifetimes for different transforms (#3329). We now
+    also return the correct transform and proposal IDs (proposal ID
+    was always 0, transform ID 1). IKE_SAs are now not
+    re-established anymore (e.g. after several retransmits) if a
+    deletion has been queued (#3335).
+  * Added support for Ed448 keys and certificates via openssl
+    plugin and pki tool.
+  * Added support for SHA-3 and SHAKE128/256 in the openssl plugin.
+  * The use of algorithm IDs from the private use range can now be
+    enabled globally, to use them even if no strongSwan vendor ID
+    was exchanged (05e373aeb0).
+  * Fixed a compiler issue that may have caused invalid keyUsage
+    extensions in certificates (#3249).
+  * A lot of spelling fixes.
+  * Fixed several reported issues.
+- Drop 0006-Resolve-multiple-definition-of-swanctl_dir.patch: Fixed
+  upstream.
+
 -------------------------------------------------------------------
 Tue Mar 31 16:42:23 UTC 2020 - Madhu Mohan Nelemane <mmnelemane@suse.com>
 

strongswan.spec

@@ -17,7 +17,7 @@
 
 
 Name:           strongswan
-Version:        5.8.2
+Version:        5.8.4
 Release:        0
 %define         upstream_version     %{version}
 %define         strongswan_docdir    %{_docdir}/%{name}
@@ -80,7 +80,6 @@ Patch2:         %{name}_ipsec_service.patch
 Patch3:         %{name}_fipscheck.patch
 %endif
 Patch5:         0005-ikev1-Don-t-retransmit-Aggressive-Mode-response.patch
-Patch6:         0006-Resolve-multiple-definition-of-swanctl_dir.patch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 BuildRequires:  bison
 BuildRequires:  curl-devel
@@ -257,7 +256,6 @@ and the load testing plugin for IKEv2 daemon.
 %patch3 -p1
 %endif
 %patch5 -p1
-%patch6 -p1
 sed -e 's|@libexecdir@|%_libexecdir|g'    \
      < %{_sourcedir}/strongswan.init.in \
      > strongswan.init