SHA256
1
0
forked from pool/strongswan
Commit Graph

90 Commits

Author SHA256 Message Date
2a35cd6ca5 - Update to release 5.9.0
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=126
2020-09-07 08:40:36 +00:00
f54d9f5083 Accepting request 831323 from home:monosoul:branches:network:vpn
Disable bypass-lan strongswan plugin by default, so update to the new version would not change existing strongswan behavior

OBS-URL: https://build.opensuse.org/request/show/831323
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=125
2020-09-01 22:39:10 +00:00
3babeff858 Accepting request 831234 from home:monosoul:branches:network:vpn
Enable bypass-lan strongswan plugin 
https://wiki.strongswan.org/projects/strongswan/wiki/Bypass-lan

OBS-URL: https://build.opensuse.org/request/show/831234
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=123
2020-09-01 15:38:16 +00:00
29d549ad98 Accepting request 800173 from home:iznogood:branches:network:vpn
- Update to version 5.8.4:
  * In IKEv1 Quick Mode make sure that a proposal exists before
    determining lifetimes (fixes a crash due to a null-pointer
    dereference in 5.8.3).
  * OpenSSL currently doesn't support squeezing bytes out of a
    SHAKE128/256 XOF (support was added with 5.8.3) multiple times.
    Unfortunately, EVP_DigestFinalXOF() completely resets the
    context and later calls not simply fail, they cause a
    null-pointer dereference in libcrypto. c5c1898d73 fixes the
    crash at the cost of repeating initializing the whole state and
    allocating too much data for subsequent calls (hopefully, once
    the OpenSSL issue 7894 is resolved we can implement this more
    efficiently).
  * On 32-bit platforms, reading arbitrary 32-bit integers from
    config files (e.g. for charon.spi_min/max) has been fixed.
  * charon-nm now allows using fixed source ports.
- Changes from version 5.8.3:
  * Updates for the NM plugin (and backend, which has to be updated
    to be compatible):
    + EAP-TLS authentication (#2097)
    + Certificate source (file, agent, smartcard) is selectable
      independently
    + Add support to configure local and remote identities (#2581)
    + Support configuring a custom server port (#625)
    + Show hint regarding password storage policy
    + Replaced the term "gateway" with "server"
    + Fixes build issues due to use of deprecated GLib
      macros/functions
    + Updated Glade file to GTK 3.2
  * The NM backend now supports reauthentication and redirection.
  * Previously used reqids are now reallocated, which works around
    an issue on FreeBSD where the kernel doesn't allow the daemon
    to use reqids > 16383 (#2315).
  * On Linux, throw type routes are installed in table 220 for
    passthrough policies. The kernel will then fall back on routes
    in routing tables with lower priorities for matching traffic.
    This way, they require less information (e.g. no interface or
    source IP) and can be installed earlier and are not affected by
    updates.
  * For IKEv1, the lifetimes of the actually selected transform are
    returned to the initiator, which is an issue if the peer uses
    different lifetimes for different transforms (#3329). We now
    also return the correct transform and proposal IDs (proposal ID
    was always 0, transform ID 1). IKE_SAs are now not
    re-established anymore (e.g. after several retransmits) if a
    deletion has been queued (#3335).
  * Added support for Ed448 keys and certificates via openssl
    plugin and pki tool.
  * Added support for SHA-3 and SHAKE128/256 in the openssl plugin.
  * The use of algorithm IDs from the private use range can now be
    enabled globally, to use them even if no strongSwan vendor ID
    was exchanged (05e373aeb0).
  * Fixed a compiler issue that may have caused invalid keyUsage
    extensions in certificates (#3249).
  * A lot of spelling fixes.
  * Fixed several reported issues.
- Drop 0006-Resolve-multiple-definition-of-swanctl_dir.patch: Fixed
  upstream.

OBS-URL: https://build.opensuse.org/request/show/800173
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=122
2020-05-04 22:37:00 +00:00
8b73a0ccc0 Accepting request 790268 from home:mmnelemane:branches:network:vpn
Fix for multiple definitions of swanctl_dir (bsc#1164493)

OBS-URL: https://build.opensuse.org/request/show/790268
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=121
2020-03-31 16:48:51 +00:00
faa4319798 Accepting request 774999 from home:ojkastl_buildservice:branches:network:vpn
move file %{_datadir}/dbus-1/system.d/nm-strongswan-service.conf to strongswan-nm subpackage, as it is needed for the NetworkManager plugin that uses strongswan-nm, not strongswan-ipsec (upstream issue https://wiki.strongswan.org/issues/3339)

OBS-URL: https://build.opensuse.org/request/show/774999
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=120
2020-02-17 20:41:20 +00:00
2811ed33c6 Accepting request 768830 from home:iznogood:branches:network:vpn
- Drop upstream fixed patches:
  * strongswan_modprobe_syslog.patch
  * strongswan_fipsfilter.patch
  * 0006-fix-compilation-error-by-adding-stdint.h.patch

OBS-URL: https://build.opensuse.org/request/show/768830
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=119
2020-02-03 14:33:45 +00:00
Madhu Mohan Nelemane
152d7b558c osc copypac from project:openSUSE:Factory package:strongswan revision:70
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=118
2020-01-30 15:50:32 +00:00
Madhu Mohan Nelemane
b84f3a369a osc copypac from project:openSUSE:Leap:15.2 package:strongswan revision:16
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=117
2020-01-30 09:34:36 +00:00
f51dbccc77 Add note about service name change
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=115
2020-01-26 09:22:43 +00:00
509c30e68d Accepting request 761676 from home:iznogood:branches:network:vpn
- Update to version 5.8.2:
  * Fix CVE-2018-17540, CVE-2018-16151 and CVE-2018-16152.
  * boo#1109845 and boo#1107874.
- Please check included NEWS file for info on what other changes
  that have been done in versions 5.8.2, 5.8.1 5.8.0, 5.7.2, 5.7.1
  and 5.7.0.
- Rebase strongswan_ipsec_service.patch.
- Disable patches that need rebase or dropping:
  * strongswan_modprobe_syslog.patch
  * 0006-fix-compilation-error-by-adding-stdint.h.patch
- Add conditional pkgconfig(libsystemd) BuildRequires: New
  dependency.

OBS-URL: https://build.opensuse.org/request/show/761676
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=114
2020-01-26 08:50:51 +00:00
Madhu Mohan Nelemane
876d8e4544 Accepting request 614748 from home:iznogood:branches:network:vpn
New stable rel, fix CVS's

OBS-URL: https://build.opensuse.org/request/show/614748
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=112
2018-07-19 15:17:25 +00:00
Madhu Mohan Nelemane
6fe1f53373 Accepting request 597862 from GNOME:Next
New upstream release.

OBS-URL: https://build.opensuse.org/request/show/597862
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=110
2018-06-02 09:22:27 +00:00
Madhu Mohan Nelemane
1857167427 Accepting request 587821 from home:mmnelemane:branches:network:vpn
Removed unused requires and macro calls(bsc#1083261)

OBS-URL: https://build.opensuse.org/request/show/587821
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=108
2018-03-22 11:11:56 +00:00
Dominique Leuenberger
4ee9977c46 Accepting request 534431 from home:jengelh:branches:network:vpn
- Update summaries and descriptions. Trim filler words and
  author list.
- Drop %if..%endif guards that are idempotent and do not affect
  the build result.
- Replace old $RPM_ shell variables.

OBS-URL: https://build.opensuse.org/request/show/534431
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=106
2018-02-06 17:07:40 +00:00
Nirmoy Das
062c69a06d Accepting request 521273 from home:ndas:branches:network:vpn
- Updated to strongSwan 5.6.0 providing the following changes:
    *Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input validation
    when verifying RSA signatures, which requires decryption with the operation m^e mod n,
    where m is the signature, and e and n are the exponent and modulus of the public key.
    The value m is an integer between 0 and n-1, however, the gmp plugin did not verify this.
    So if m equals n the calculation results in 0, in which case mpz_export() returns NULL.
    This result wasn't handled properly causing a null-pointer dereference.
    This vulnerability has been registered as CVE-2017-11185. (bsc#1051222)
    *New SWIMA IMC/IMV pair implements the draft-ietf-sacm-nea-swima-patnc Internet
    Draft and has been demonstrated at the IETF 99 Prague Hackathon.
    *The IMV database template has been adapted to achieve full compliance with the
    ISO 19770-2:2015 SWID tag standard.
    *The pt-tls-client can attach and use TPM 2.0 protected private keys via the --keyid parameter.
    *By default the /etc/swanctl/conf.d directory is created and *.conf files in it are included in the default
    swanctl.conf file.
    
    *The curl plugin now follows HTTP redirects (configurable via strongswan.conf).
    *The CHILD_SA rekeying was fixed in charon-tkm and the behavior is refined a bit more since 5.5.3
    *libtpmtss supports Intel's TSS2 Architecture Broker and Resource Manager interface (tcti-tabrmd).
    * more on https://wiki.strongswan.org/versions/66

OBS-URL: https://build.opensuse.org/request/show/521273
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=104
2017-09-05 15:38:01 +00:00
Nirmoy Das
5ffb8e04a6 Accepting request 521071 from home:ndas:branches:network:vpn
- fix "uintptr_t’ undeclared" compilation error.
  [+0006-fix-compilation-error-by-adding-stdint.h.patch]

OBS-URL: https://build.opensuse.org/request/show/521071
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=102
2017-09-05 09:57:57 +00:00
Nirmoy Das
339326d8bc Accepting request 514548 from home:ndas:branches:network:vpn
OBS-URL: https://build.opensuse.org/request/show/514548
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=100
2017-08-04 11:47:37 +00:00
Nirmoy Das
8cfc35877a Accepting request 513652 from home:ndas:branches:network:vpn
- Updated to strongSwan 5.3.5 providing the following changes:
    *Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input
    validation when verifying RSA signatures. More specifically, mpz_powm_sec() has two
    requirements regarding the passed exponent and modulus that the plugin did not
    enforce, if these are not met the calculation will result in a floating point exception
    that crashes the whole process.
    This vulnerability has been registered as CVE-2017-9022.
    Please refer to our blog for details.
    *Fixed a DoS vulnerability in the x509 plugin that was caused because the ASN.1 parser
    didn't handle ASN.1 CHOICE types properly, which could result in an infinite loop when
    parsing X.509 extensions that use such types.
    This vulnerability has been registered as CVE-2017-9023.
    Please refer to our blog for details.
    *The behavior during IKEv2 CHILD_SA rekeying has been changed in order to avoid
    traffic loss. When responding to a CREATE_CHILD_SA request to rekey a CHILD_SA
    the responder already has everything available to install and use the new CHILD_SA.
    However, this could lead to lost traffic as the initiator won't be able to process
    inbound packets until it processed the CREATE_CHILD_SA response and updated the
    inbound SA. To avoid this the responder now only installs the new inbound SA and
    delays installing the outbound SA until it receives the DELETE for the replaced CHILD_SA.
    *The messages transporting these DELETEs could reach the peer before packets sent
    with the deleted outbound SAs reach it. To reduce the chance of traffic loss due
    to this the inbound SA of the replaced CHILD_SA is not removed for a configurable
    amount of seconds (charon.delete_rekeyed_delay) after the DELETE has been processed.
    *The code base has been ported to Apple's ARM64 iOS platform, which required several
    changes regarding the use of variadic functions. This was necessary because the calling
    conventions for variadic and regular functions are different there.
    This means that assigning a non-variadic function to a variadic function pointer, as we
    did with our enumerator_t::enumerate() implementations and several callbacks, will
    result in crashes as the called function accesses the arguments differently than the

OBS-URL: https://build.opensuse.org/request/show/513652
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=99
2017-08-01 07:21:05 +00:00
d3507c65d4 Accepting request 406438 from home:dkosovic:branches:network:vpn
NetowrkManager-l2tp-1.0.4 is broken with strongswan-5.2.2. The 'ipsec up {connection-name}' command never connects and goes into an infinite loop of failing and trying to re-connect.

NetowrkManager-l2tp works fine with earlier and later versions of strongswan, just not with strongswan-5.2.2.

OBS-URL: https://build.opensuse.org/request/show/406438
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=97
2016-11-29 08:32:29 +00:00
406171b31d - Applied upstream fix for a authentication bypass vulnerability
in the eap-mschapv2 plugin (CVE-2015-8023,bsc#953817).
  [+ 0007-strongswan-4.4.0-5.3.3_eap_mschapv2_state.patch]

OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=95
2015-11-16 15:23:01 +00:00
cfde0c0ea7 - Applied upstream fix for a rogue servers vulnerability, that may
enable rogue servers able to authenticate itself with certificate
  issued by any CA the client trusts, to gain user credentials from
  a client in certain IKEv2 setups (bsc#933591,CVE-2015-4171).
  [+ 0006-strongswan-5.1.0-5.3.1_enforce_remote_auth.patch]
- Fix to apply unknown_payload patch if fips is disabled (<= 13.1)
  and renamed it to use number prefix corresponding with patch nr.
  [- strongswan-5.2.2-5.3.0_unknown_payload.patch,
   + 0005-strongswan-5.2.2-5.3.0_unknown_payload.patch]

OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=93
2015-06-08 13:41:42 +00:00
288621ec30 - Applied upstream fix for a DoS and potential remote code execution
vulnerability through payload type (bsc#931272,CVE-2015-3991)
  [+ strongswan-5.2.2-5.3.0_unknown_payload.patch]

OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=90
2015-06-01 16:25:25 +00:00
4a7fa03a80 - reverted last commit, not needed here
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=89
2015-03-09 09:28:29 +00:00
b401bc1d51 - Applied a fix by Marcus Meissner for a loop check in ipsec pki
causing a segfault on attempt to create certificates when fips
  is enabled (bsc#918474,https://wiki.strongswan.org/issues/881)
  [+ 0006-strongswan-pkifix.918474.patch]

OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=88
2015-03-09 09:02:18 +00:00
055879bc1c - Updated to strongSwan 5.2.2 providing the following changes:
Changes in version 5.2.2:
  * Fixed a denial-of-service vulnerability triggered by an IKEv2 Key Exchange
    payload that contains the Diffie-Hellman group 1025. This identifier was
    used internally for DH groups with custom generator and prime. Because
    these arguments are missing when creating DH objects based on the KE
    payload an invalid pointer dereference occurred.  This allowed an attacker
    to crash the IKE daemon with a single IKE_SA_INIT message containing such
    a KE payload. The vulnerability has been registered as CVE-2014-9221.
  * The left/rightid options in ipsec.conf, or any other identity in
    strongSwan, now accept prefixes to enforce an explicit type, such as
    email: or fqdn:. Note that no conversion is done for the remaining string,
    refer to ipsec.conf(5) for details.
  * The post-quantum Bimodal Lattice Signature Scheme (BLISS) can be used as
    an IKEv2 public key authentication method. The pki tool offers full
    support for the generation of BLISS key pairs and certificates.
  * Fixed mapping of integrity algorithms negotiated for AH via IKEv1.
    This could cause interoperability issues when connecting to older versions
    of charon.
  Changes in version 5.2.1:
  * The new charon-systemd IKE daemon implements an IKE daemon tailored for
    use with systemd. It avoids the dependency on ipsec starter and uses
    swanctl as configuration backend, building a simple and lightweight
    solution. It supports native systemd journal logging.
  * Support for IKEv2 fragmentation as per RFC 7383 has been added. Like IKEv1
    fragmentation it can be enabled by setting fragmentation=yes in ipsec.conf.
  * Support of the TCG TNC IF-M Attribute Segmentation specification proposal.
    All attributes can be segmented. Additionally TCG/SWID Tag, TCG/SWID Tag ID
    and IETF/Installed Packages attributes can be processed incrementally on a
    per segment basis.

OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=85
2015-01-05 14:41:37 +00:00
fadffa6d60 - Disallow brainpool elliptic curve groups in fips mode (bnc#856322).
[* strongswan_fipsfilter.patch]

- Applied an upstream fix for a denial-of-service vulnerability,
  which can be triggered by an IKEv2 Key Exchange payload, that
  contains the Diffie-Hellman group 1025 (bsc#910491,CVE-2014-9221).
  [+ 0006-strongswan-5.1.2-5.2.1_modp_custom.CVE-2014-9221.patch]
- Adjusted whilelist of approved algorithms in fips mode (bsc#856322).
  [* strongswan_fipsfilter.patch]
- Renamed patch file to match it's patch number:
  [- 0001-restore-registration-algorithm-order.bug897512.patch,
   + 0005-restore-registration-algorithm-order.bug897512.patch]

OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=84
2015-01-05 13:04:19 +00:00
e05aebd3de - Updated strongswan-hmac package description (bsc#856322).
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=81
2014-11-25 11:25:10 +00:00
f8e5433fa6 guard also patches
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=80
2014-11-21 15:26:23 +00:00
c104e3b9c7 - Guarded fipscheck and hmac package in the spec file for >13.1.
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=79
2014-11-21 15:23:47 +00:00
e33043a5bd - Disabled explicit gpg validation; osc source_validator does it.
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=78
2014-11-21 12:04:54 +00:00
9463c65a84 - Added generation of fips hmac hash files using fipshmac utility
and a _fipscheck script to verify binaries/libraries/plugings
  shipped in the strongswan-hmac package.
  With enabled fips in the kernel, the ipsec script will call it
  before any action or in a enforced/manual "ipsec _fipscheck" call.
  Added config file to load openssl and kernel af-alg plugins, but
  not all the other modules which provide further/alternative algs.
  Applied a filter disallowing non-approved algorithms in fips mode.
  (fate#316931,bnc#856322).
  [+ strongswan_fipscheck.patch, strongswan_fipsfilter.patch]
- Fixed file list in the optional (disabled) strongswan-test package.
- Fixed build of the strongswan built-in integrity checksum library
  and enabled building it only on architectures tested to work.
- Fix to use bug number 897048 instead 856322 in last changes entry.
- Applied an upstream patch reverting to store algorithms in the
  registration order again as ordering them by identifier caused
  weaker algorithms to be proposed first by default (bsc#897512).
  [+0001-restore-registration-algorithm-order.bug897512.patch]

OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=77
2014-11-21 12:01:59 +00:00
94db999eee handle missed tmpfiles_create macro
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=75
2014-09-26 17:17:56 +00:00
ce4e2bdd61 disabled mysql,sqlite,gcrypt on sle11 again
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=74
2014-09-26 16:35:26 +00:00
809353c19b - Re-enabled gcrypt plugin and reverted to not enforce fips again
as this breaks gcrypt and openssl plugins when the fips pattern
  option is not installed (fate#316931,bnc#856322).
- Added empty strongswan-hmac package supposed to provide fips hmac
  files and enforce fips compliant operation later (bnc#856322).
- Cleaned up conditional build flags in the rpm spec file.

OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=73
2014-09-26 16:21:04 +00:00
Tomáš Chvátal
3645b48ec5 Accepting request 239460 from home:msmeissn:branches:network:vpn
- disable gcrypt plugin by default, so it will only use openssl
  FATE#316931
- enable fips mode 2

OBS-URL: https://build.opensuse.org/request/show/239460
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=70
2014-07-10 12:59:35 +00:00
Tomáš Chvátal
ff86b72d5b Accepting request 238193 from home:elvigia:branches:network:vpn
- Fix build in factory 
* Do not include var/run directories in package
* Move runtime data to /run and provide tmpfiles.d snippet
* Add proper systemd macros to rpm scriptlets.
* Do not buildRequire library package libnl1, it is not used.

OBS-URL: https://build.opensuse.org/request/show/238193
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=68
2014-06-27 08:04:24 +00:00
84759843df - Updated to strongSwan 5.1.3 providing the following changes:
- Fixed an authentication bypass vulnerability triggered by rekeying
    an unestablished IKEv2 SA while it gets actively initiated. This
    allowed an attacker to trick a peer's IKE_SA state to established,
    without the need to provide any valid authentication credentials.
    (CVE-2014-2338, bnc#870572).
  - The acert plugin evaluates X.509 Attribute Certificates. Group
    membership information encoded as strings can be used to fulfill
    authorization checks defined with the rightgroups option.
    Attribute Certificates can be loaded locally or get exchanged in
    IKEv2 certificate payloads.
  - The pki command gained support to generate X.509 Attribute
    Certificates using the --acert subcommand, while the --print
    command supports the ac type. The openac utility has been removed
    in favor of the new pki functionality.
  - The libtls TLS 1.2 implementation as used by EAP-(T)TLS and other
    protocols has been extended by AEAD mode support, currently limited
    to AES-GCM.
  - Fixed an issue where CRL/OCSP trustchain validation broke enforcing
    CA constraints
  - Limited OCSP signing to specific certificates to improve performance
  - authKeyIdentifier is not added to self-signed certificates anymore
  - Fixed the comparison of IKE configs if only the cipher suites were
    different

OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=65
2014-04-15 06:12:43 +00:00
1caa59fb4f - Updated to strongSwan 5.1.2 providing the following changes:
- A new default configuration file layout is introduced. The new
    default strongswan.conf file mainly includes config snippets from
    the strongswan.d and strongswan.d/charon directories (the latter
    containing snippets for all plugins). The snippets, with commented
    defaults, are automatically generated and installed, if they don't
    exist yet. Also installed in $prefix/share/strongswan/templates so
    existing files can be compared to the current defaults.
  - As an alternative to the non-extensible charon.load setting, the
    plugins to load in charon (and optionally other applications) can
    now be determined via the charon.plugins.<name>.load setting for
    each plugin (enabled in the new default strongswan.conf file via the
    charon.load_modular option). The load setting optionally takes a
    numeric priority value that allows reordering the plugins (otherwise
    the default plugin order is preserved).
  - All strongswan.conf settings that were formerly defined in library
    specific "global" sections are now application specific (e.g.
    settings for plugins in libstrongswan.plugins can now be set only
    for charon in charon.plugins). The old options are still supported,
    which now allows to define defaults for all applications in the
    libstrongswan section.
  - The ntru libstrongswan plugin supports NTRUEncrypt as a post-quantum
    computer IKE key exchange mechanism. The implementation is based on
    the ntru-crypto library from the NTRUOpenSourceProject.
    The supported security strengths are ntru112, ntru128, ntru192, and
    ntru256. Since the private DH group IDs 1030..1033 have been
    assigned, the strongSwan Vendor ID must be sent in order to use NTRU
    (charon.send_vendor_id = yes).
  - Defined a TPMRA remote attestation workitem and added support for it
    to the Attestation IMV.

OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=64
2014-04-14 07:44:26 +00:00
2f4b26b633 - Updated to strongSwan 5.1.1 minor release addressing two security
fixes (bnc#847506,CVE-2013-6075, bnc#847509,CVE-2013-6076):
  - Fixed a denial-of-service vulnerability and potential authorization
    bypass triggered by a crafted ID_DER_ASN1_DN ID payload. The cause
    is an insufficient length check when comparing such identities. The
    vulnerability has been registered as CVE-2013-6075.
  - Fixed a denial-of-service vulnerability triggered by a crafted IKEv1
    fragmentation payload. The cause is a NULL pointer dereference. The
    vulnerability has been registered as CVE-2013-6076.
  - The lean stand-alone pt-tls-client can set up a RFC 6876 PT-TLS
    session with a strongSwan policy enforcement point which uses the
    tnc-pdp charon plugin.
  - The new TCG TNC SWID IMC/IMV pair supports targeted SWID requests
    for either full SWID Tag or concise SWID Tag ID inventories.
  - The XAuth backend in eap-radius now supports multiple XAuth
    exchanges for different credential types and display messages.
    All user input gets concatenated and verified with a single
    User-Password RADIUS attribute on the AAA. With an AAA supporting
    it, one for example can implement Password+Token authentication with
    proper dialogs on iOS and OS X clients.  - charon supports IKEv1 Mode
    Config exchange in push mode. The ipsec.conf modeconfig=push option
    enables it for both client and server, the same way as pluto used it.
  - Using the "ah" ipsec.conf keyword on both IKEv1 and IKEv2
    connections, charon can negotiate and install Security Associations
    integrity-protected by the Authentication Header protocol. Supported
    are plain AH(+IPComp) SAs only, but not the deprecated RFC2401 style
    ESP+AH bundles.
  [...]

OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=62
2013-11-01 12:47:59 +00:00
edd96c4f8d - Updated to strongSwan 5.1.0 release (bnc#833278, CVE-2013-5018)
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=60
2013-08-05 14:58:33 +00:00
2fa10a3109 - Updated to strongSwan 5.0.4 release (bnc#815236, CVE-2013-2944):
- Fixed a security vulnerability in the openssl plugin which was
    reported by Kevin Wojtysiak.  The vulnerability has been registered
    as CVE-2013-2944. Before the fix, if the openssl plugin's ECDSA
    signature verification was used, due to a misinterpretation of the
    error code returned by the OpenSSL ECDSA_verify() function, an empty
    or zeroed signature was accepted as a legitimate one. Refer to our
    blog for details.
  - The handling of a couple of other non-security relevant OpenSSL
    return codes was fixed as well.
  - The tnc_ifmap plugin now publishes virtual IPv4 and IPv6 addresses
    via its TCG TNC IF-MAP 2.1 interface.
  - The charon.initiator_only strongswan.conf option causes charon to
    ignore IKE initiation requests.
  - The openssl plugin can now use the openssl-fips library.
  The version 5.0.3 provides new ipseckey plugin, enabling authentication
  based on trustworthy public keys stored as IPSECKEY resource records in
  the DNS and protected by DNSSEC and new openssl plugin using the AES-NI
  accelerated version of AES-GCM if the hardware supports it.
  See http://wiki.strongswan.org/projects/strongswan/wiki/Changelog50
  for a list of all changes since the 5.0.1 release.

OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=58
2013-04-30 13:10:58 +00:00
f2cf7cb837 Accepting request 143934 from home:sbrabec:gpg-offline-verify
Verify GPG signature: Perform build-time offline GPG verification.
Please verify that included keyring matches your needs.
For manipulation with the offline keyring, please use gpg-offline tool from openSUSE:Factory, devel-tools-building or Base:System.
See the man page and/or /usr/share/doc/packages/gpg-offline/PACKAGING.HOWTO.

If you need to build your package for older products and don't want to mess spec file with ifs, please follow PACKAGING.HOWTO:
you can link or aggregate gpg-offline from
devel:tools:building or use following trick with "osc meta prjconf":

--- Cut here ----
%if 0%{?suse_version} <= 1220
Substitute: gpg-offline
%endif

Macros:
%gpg_verify(dnf) \
%if 0%{?suse_version} > 1220\
echo "WARNING: Using %%gpg_verify macro from prjconf, not from gpg-offline package."\
gpg-offline --directory="%{-d:%{-d*}}%{!-d:%{_sourcedir}}" --package="%{-n:%{-n*}}%{!-n:%{name}}""%{-f: %{-f*}}" --verify %{**}\
%else\
echo "WARNING: Dummy prjconf macro. gpg-offline is not available, skipping %{**} GPG signature verification!"\
%endif\
%nil
-----------------

OBS-URL: https://build.opensuse.org/request/show/143934
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=56
2012-12-04 10:25:06 +00:00
Andreas Jaeger
309d3aab0b Accepting request 141529 from home:elvigia:branches:network:vpn
- Fix systemd unit dir

OBS-URL: https://build.opensuse.org/request/show/141529
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=54
2012-11-17 10:53:37 +00:00
f013a86fad - Updated to strongSwan 5.0.1 release. Changes digest:
- Introduced the sending of the standard IETF Assessment Result
    PA-TNC attribute by all strongSwan Integrity Measurement Verifiers.
  - Extended PTS Attestation IMC/IMV pair to provide full evidence of
    the Linux IMA measurement process. All pertinent file information
    of a Linux OS can be collected and stored in an SQL database.
  - The PA-TNC and PB-TNC protocols can now process huge data payloads.
  - The xauth-pam backend can authenticate IKEv1 XAuth and Hybrid
    authenticated clients against any PAM service.
  - The new unity plugin brings support for some parts of the IKEv1
    Cisco Unity Extensions.
  - The kernel-netlink plugin supports the new strongswan.conf option
    charon.install_virtual_ip_on.
  - Job handling in controller_t was fixed, which occasionally caused
    crashes on ipsec up/down.
  - Fixed transmission EAP-MSCHAPv2 user name if it contains a domain
    part.
  Changes digest from strongSwan 5.0.0 version:
  * The charon IKE daemon gained experimental support for the IKEv1
    protocol. Pluto has been removed from the 5.x series.
  * The NetworkManager charon plugin of previous releases is now
    provided by a separate executable (charon-nm) and it should work
    again with NM 0.9.
  * scepclient was updated and it now works fine with Windows Server
    2008 R2.
  For full list of the changes, please read the NEWS file shipped
  in the strongswan-doc package or online:
  http://wiki.strongswan.org/projects/strongswan/wiki/Changelog50
- Adopted spec file, enabled several plugins.
- Changed to install strongswan.service with alias to ipsec.service

OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=51
2012-10-31 16:08:08 +00:00
eb5621d87b - WORK-IN-PROGRESS snapshot: Update to strongSwan 5.0.1
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=50
2012-10-30 17:16:52 +00:00
4a8b8bd95f - Applied upstream patch adjusting an internal thread id causing
charon keying daemon start failure (bnc#779038,strongswan#198):
    openssl: Ensure the thread ID is never zero
    This might otherwise cause problems because OpenSSL tries to
    lock mutexes recursively if it assumes the lock is held by a
    different thread e.g. during FIPS initialization.
  See http://wiki.strongswan.org/issues/198 for more informations.

OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=48
2012-09-07 12:53:09 +00:00
2645720915 - Updated to strongSwan 4.6.4 release:
- Fixed a security vulnerability in the gmp plugin. If this
    plugin was used for RSA signature verification an empty or
    zeroed signature was handled as a legitimate one
    (bnc#761325, CVE-2012-2388).
  - Fixed several issues with reauthentication and address updates.

OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=46
2012-05-31 16:11:42 +00:00
cf29eb7ccf - Updated to strongSwan 4.6.3 release:
- The tnc-pdp plugin implements a RADIUS server interface allowing
    a strongSwan TNC server to act as a Policy Decision Point.
  - The eap-radius authentication backend enforces Session-Timeout
    attributes using RFC4478 repeated authentication and acts upon
    RADIUS Dynamic Authorization extensions, RFC 5176. Currently
    supported are disconnect requests and CoA messages containing
    a Session-Timeout.
  - The eap-radius plugin can forward arbitrary RADIUS attributes
    from and to clients using custom IKEv2 notify payloads. The new
    radattr plugin reads attributes to include from files and prints
    received attributes to the console.
  - Added support for untruncated MD5 and SHA1 HMACs in ESP as used
    in RFC 4595.
  - The cmac plugin implements the AES-CMAC-96 and AES-CMAC-PRF-128
    algorithms as defined in RFC 4494 and RFC 4615, respectively.
  - The resolve plugin automatically installs nameservers via
    resolvconf(8), if it is installed, instead of modifying
    /etc/resolv.conf directly.
  - The IKEv2 charon daemon supports now raw RSA public keys in RFC
    3110 DNSKEY and PKCS#1 file format.
  - The farp plugin sends ARP responses for any tunneled address,
    not only virtual IPs.
  - Charon resolves hosts again during additional keying tries.
  - Fixed switching back to original address pair during MOBIKE.
  - When resending IKE_SA_INIT with a COOKIE charon reuses the previous
    DH value, as specified in RFC 5996.
    This has an effect on the lifecycle of diffie_hellman_t, see
    source:src/libcharon/sa/keymat.h#39 for details.
  - COOKIEs are now kept enabled a bit longer to avoid certain race

OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=44
2012-05-10 10:02:51 +00:00
2298bd91e0 Accepting request 107821 from home:tabraham1:branches:network:vpn
update to 4.6.2

OBS-URL: https://build.opensuse.org/request/show/107821
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=42
2012-03-13 11:32:40 +00:00