strongswan-vl.spec 27 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805
  1. %bcond_with systemd
  2. %bcond_with fips2
  3. %bcond_without tss
  4. %global _unpackaged_files_terminate_build 1
  5. %global _hardened_build 0
  6. #%%define prerelease dr1
  7. Name: strongswan
  8. Version: 5.9.1
  9. Release: 1%{?_dist_release}%{?with_systemd:.systemd}
  10. Summary: An OpenSource IPsec-based VPN and TNC solution
  11. Summary(ja): オープンソースのIPsec VPN/TNCソリューション
  12. Group: servers,security
  13. Vendor: Project Vine
  14. Distribution: Vine Linux
  15. License: GPLv2+
  16. URL: https://www.strongswan.org/
  17. Source0: https://download.strongswan.org/%{name}-%{version}%{?prerelease}.tar.bz2
  18. Source1: tmpfiles-strongswan.conf
  19. Source1000: strongswan.init
  20. Patch0: strongswan-5.8.4-runtime-dir.patch
  21. Patch1: strongswan-5.6.0-uintptr_t.patch
  22. Patch3: strongswan-5.6.2-CVE-2018-5388.patch
  23. # only needed for pre-release versions
  24. #BuildRequires: autoconf automake
  25. BuildRequires: gmp-devel
  26. BuildRequires: curl-devel
  27. BuildRequires: openldap-devel
  28. BuildRequires: openssl-devel
  29. BuildRequires: sqlite3-devel
  30. BuildRequires: gettext-devel
  31. BuildRequires: libxml2-devel
  32. BuildRequires: pam-devel
  33. BuildRequires: libgcrypt-devel
  34. BuildRequires: iptables-devel
  35. %if %{with tss}
  36. BuildRequires: trousers-devel
  37. BuildRequires: json-c-devel >= 0.14
  38. %endif
  39. %if "%{?_dist_release}" != "vl6"
  40. BuildRequires: NetworkManager-libnm-devel
  41. %endif
  42. %if %{with systemd}
  43. BuildRequires: systemd-devel
  44. Requires(post): systemd
  45. Requires(preun): systemd
  46. Requires(postun): systemd
  47. %else
  48. Requires(post): /sbin/chkconfig
  49. Requires(preun): /sbin/chkconfig
  50. Requires(postun): /sbin/chkconfig
  51. %endif
  52. %description
  53. The strongSwan IPsec implementation supports both the IKEv1 and IKEv2 key
  54. exchange protocols in conjunction with the native NETKEY IPsec stack of the
  55. Linux kernel.
  56. %package libipsec
  57. Summary: Strongswan's libipsec backend
  58. Group: servers,security
  59. %description libipsec
  60. The kernel-libipsec plugin provides an IPsec backend that works entirely
  61. in userland, using TUN devices and its own IPsec implementation libipsec.
  62. %package charon-nm
  63. Summary: NetworkManager plugin for Strongswan
  64. Group: servers,security
  65. Requires: dbus
  66. Obsoletes: %{name}-NetworkManager < 0:5.0.4-5
  67. Conflicts: %{name}-NetworkManger < 0:5.0.4-5
  68. %description charon-nm
  69. NetworkManager plugin integrates a subset of Strongswan capabilities
  70. to NetworkManager.
  71. %if %{with tss}
  72. %package tnc-imcvs
  73. Summary: Trusted network connect (TNC)'s IMC/IMV functionality
  74. Group: servers,security
  75. Requires: %{name} = %{version}
  76. %description tnc-imcvs
  77. This package provides Trusted Network Connect's (TNC) architecture support.
  78. It includes support for TNC client and server (IF-TNCCS), IMC and IMV message
  79. exchange (IF-M), interface between IMC/IMV and TNC client/server (IF-IMC
  80. and IF-IMV). It also includes PTS based IMC/IMV for TPM based remote
  81. attestation, SWID IMC/IMV, and OS IMC/IMV. It's IMC/IMV dynamic libraries
  82. modules can be used by any third party TNC Client/Server implementation
  83. possessing a standard IF-IMC/IMV interface. In addition, it implements
  84. PT-TLS to support TNC over TLS.
  85. %endif
  86. %debug_package
  87. %prep
  88. %setup -q -n %{name}-%{version}%{?prerelease}
  89. %patch0 -p1
  90. %patch1 -p1
  91. %patch3 -p1
  92. %build
  93. # only for snapshots
  94. #autoreconf
  95. # --with-ipsecdir moves internal commands to /usr/libexec/strongswan
  96. # --bindir moves 'pki' command to /usr/libexec/strongswan
  97. # See: http://wiki.strongswan.org/issues/552
  98. # too broken to enable: --enable-sha3 --enable-rdrand --enable-connmark --enable-forecast
  99. %configure --disable-static \
  100. --with-ipsec-script=strongswan \
  101. --sysconfdir=%{_sysconfdir}/strongswan \
  102. --with-ipsecdir=%{_libexecdir}/strongswan \
  103. --bindir=%{_libexecdir}/strongswan \
  104. --with-ipseclibdir=%{_libdir}/strongswan \
  105. %if %{with fips2}
  106. --with-fips-mode=2 \
  107. %endif
  108. %if "%{?_dist_release}" != "vl6"
  109. --enable-nm \
  110. %endif
  111. --enable-openssl \
  112. --enable-unity \
  113. --enable-ctr \
  114. --enable-ccm \
  115. --enable-gcm \
  116. --enable-chapoly \
  117. --enable-md4 \
  118. --enable-gcrypt \
  119. --enable-newhope \
  120. --enable-xauth-eap \
  121. --enable-xauth-pam \
  122. --enable-xauth-noauth \
  123. --enable-eap-identity \
  124. --enable-eap-md5 \
  125. --enable-eap-gtc \
  126. --enable-eap-tls \
  127. --enable-eap-ttls \
  128. --enable-eap-peap \
  129. --enable-eap-mschapv2 \
  130. --enable-eap-tnc \
  131. --enable-eap-sim \
  132. --enable-eap-sim-file \
  133. --enable-eap-aka \
  134. --enable-eap-aka-3gpp \
  135. --enable-eap-aka-3gpp2 \
  136. --enable-eap-dynamic \
  137. --enable-eap-radius \
  138. --enable-ext-auth \
  139. --enable-ipseckey \
  140. --enable-pkcs11 \
  141. --enable-farp \
  142. --enable-dhcp \
  143. --enable-ha \
  144. --enable-led \
  145. --enable-sqlite \
  146. --enable-tnc-ifmap \
  147. --enable-tnc-pdp \
  148. --enable-tnc-imc \
  149. --enable-tnc-imv \
  150. --enable-tnccs-20 \
  151. --enable-tnccs-11 \
  152. --enable-tnccs-dynamic \
  153. --enable-curl \
  154. --enable-cmd \
  155. --enable-acert \
  156. --enable-vici \
  157. --enable-swanctl \
  158. --enable-duplicheck \
  159. %if %{with tss}
  160. --enable-tss-trousers \
  161. --enable-aikgen \
  162. --enable-tpm \
  163. --enable-imc-test \
  164. --enable-imv-test \
  165. --enable-imc-scanner \
  166. --enable-imv-scanner \
  167. --enable-imc-attestation \
  168. --enable-imv-attestation \
  169. --enable-imv-os \
  170. --enable-imc-os \
  171. --enable-imc-swid \
  172. --enable-imv-swid \
  173. --enable-imc-swima \
  174. --enable-imv-swima \
  175. --enable-imc-hcd \
  176. --enable-imv-hcd \
  177. %endif
  178. %ifarch x86_64 %{ix86}
  179. --enable-aesni \
  180. %endif
  181. %if %{with systemd}
  182. --enable-systemd \
  183. %endif
  184. --enable-kernel-libipsec
  185. make %{?_smp_mflags}
  186. %install
  187. rm -rf %{buildroot}
  188. make install DESTDIR=%{buildroot}
  189. # prefix man pages
  190. for i in %{buildroot}%{_mandir}/*/*; do
  191. if echo "$i" | grep -vq '/strongswan[^\/]*$'; then
  192. mv "$i" "`echo "$i" | sed -re 's|/([^/]+)$|/strongswan_\1|'`"
  193. fi
  194. done
  195. find %{buildroot} -type f -name '*.la' -delete
  196. # delete unwanted library files - no consumers, so no -devel package
  197. rm %{buildroot}%{_libdir}/strongswan/*.so
  198. # fix config permissions
  199. chmod 644 %{buildroot}%{_sysconfdir}/%{name}/%{name}.conf
  200. # Create ipsec.d directory tree.
  201. install -d -m 700 %{buildroot}%{_sysconfdir}/%{name}/ipsec.d
  202. for i in aacerts acerts certs cacerts crls ocspcerts private reqs; do
  203. install -d -m 700 %{buildroot}%{_sysconfdir}/%{name}/ipsec.d/${i}
  204. done
  205. %if %{with systemd}
  206. install -D -p -m 0644 %{SOURCE1} %{buildroot}/%{_tmpfilesdir}/strongswan.conf
  207. %else
  208. mkdir -p %{buildroot}%{_initdir}
  209. install -m755 %{SOURCE1000} %{buildroot}%{_initdir}/ipsec
  210. %endif
  211. %post
  212. %if %{with systemd}
  213. %systemd_post %{name}.service
  214. %else
  215. /sbin/chkconfig --add ipsec
  216. %endif
  217. %preun
  218. %if %{with systemd}
  219. %systemd_preun %{name}.service
  220. %else
  221. if [ $1 -eq 0 -o -x /bin/systemctl ]; then
  222. /sbin/service ipsec stop
  223. /sbin/chkconfig --del ipsec
  224. fi
  225. %endif
  226. %postun
  227. %if %{with systemd}
  228. %systemd_postun_with_restart %{name}.service
  229. %else
  230. if [ $1 -gt 0 ]; then
  231. /sbin/service ipsec condrestart
  232. fi
  233. %endif
  234. %files
  235. %doc README NEWS TODO ChangeLog
  236. %{!?_licensedir:%global license %%doc}
  237. %license COPYING
  238. %dir %attr(0700,root,root) %{_sysconfdir}/strongswan
  239. %config(noreplace) %{_sysconfdir}/strongswan/*
  240. %dir %{_libdir}/strongswan
  241. %dir %{_libdir}/strongswan/plugins
  242. %dir %{_libexecdir}/strongswan
  243. %{_sbindir}/charon-cmd
  244. %{_sbindir}/strongswan
  245. %{_sbindir}/swanctl
  246. %{_libdir}/strongswan/*.so.*
  247. %exclude %{_libdir}/strongswan/libipsec.so.*
  248. %{_libdir}/strongswan/plugins/*.so
  249. %exclude %{_libdir}/strongswan/plugins/libstrongswan-kernel-libipsec.so
  250. %{_libexecdir}/strongswan/*
  251. %if "%{?_dist_release}" != "vl6"
  252. %exclude %{_libexecdir}/strongswan/charon-nm
  253. %endif
  254. %{_mandir}/man?/*.gz
  255. %{_datadir}/strongswan/templates/config/
  256. %if %{with tss}
  257. %exclude %{_libdir}/strongswan/imcvs
  258. %exclude %{_libdir}/strongswan/libimcv.so.*
  259. %exclude %{_libdir}/strongswan/libtnccs.so.*
  260. %exclude %{_libdir}/strongswan/libradius.so.*
  261. %exclude %{_libdir}/strongswan/plugins/libstrongswan-pkcs7.so
  262. %exclude %{_libdir}/strongswan/plugins/libstrongswan-sqlite.so
  263. %exclude %{_libdir}/strongswan/plugins/libstrongswan-*tnc*.so
  264. %exclude %{_libdir}/strongswan/plugins/libstrongswan-eap-radius.so
  265. %exclude %{_libexecdir}/strongswan/attest
  266. %exclude %{_libexecdir}/strongswan/pt-tls-client
  267. %{_datadir}/strongswan/templates/database/
  268. %exclude %dir %{_datadir}/strongswan/swidtag
  269. %endif
  270. %if %{with systemd}
  271. %{_sbindir}/charon-systemd
  272. %{_unitdir}/strongswan.service
  273. %{_unitdir}/strongswan-starter.service
  274. %{_tmpfilesdir}/strongswan.conf
  275. %else
  276. %{_initdir}/ipsec
  277. %endif
  278. %if %{with tss}
  279. %files tnc-imcvs
  280. %{_sbindir}/sw-collector
  281. %{_sbindir}/sec-updater
  282. %dir %{_libdir}/strongswan/imcvs
  283. %dir %{_libdir}/strongswan/plugins
  284. %{_libdir}/strongswan/libimcv.so.*
  285. %{_libdir}/strongswan/libtnccs.so.*
  286. %{_libdir}/strongswan/libradius.so.*
  287. %{_libdir}/strongswan/plugins/libstrongswan-pkcs7.so
  288. %{_libdir}/strongswan/plugins/libstrongswan-sqlite.so
  289. %{_libdir}/strongswan/plugins/libstrongswan-*tnc*.so
  290. %{_libdir}/strongswan/plugins/libstrongswan-eap-radius.so
  291. %{_libexecdir}/strongswan/attest
  292. %{_libexecdir}/strongswan/pt-tls-client
  293. %dir %{_datadir}/strongswan/swidtag
  294. %{_datadir}/strongswan/swidtag/*.swidtag
  295. %endif
  296. %files libipsec
  297. %{_libdir}/strongswan/libipsec.so.*
  298. %{_libdir}/strongswan/plugins/libstrongswan-kernel-libipsec.so
  299. %if "%{?_dist_release}" != "vl6"
  300. %files charon-nm
  301. %license COPYING
  302. %{_datadir}/dbus-1/system.d/nm-strongswan-service.conf
  303. %{_libexecdir}/strongswan/charon-nm
  304. %endif
  305. %changelog
  306. * Mon Feb 22 2021 Tomohiro "Tomo-p" KATO <tomop@teamgedoh.net> - 5.9.1-1
  307. - new upstream release.
  308. * Tue Aug 18 2020 Tomohiro "Tomo-p" KATO <tomop@teamgedoh.net> - 5.9.0-1
  309. - new upstream release.
  310. * Sat May 16 2020 Tomohiro "Tomo-p" KATO <tomop@teamgedoh.net> - 5.8.4-1
  311. - new upstream release.
  312. - imported Patch0 from rawhide.
  313. - fixed systemd stuff.
  314. * Sun Mar 15 2020 Tomohiro "Tomo-p" KATO <tomop@teamgedoh.net> - 5.8.2-1
  315. - new upstream release.
  316. * Wed Nov 20 2019 Tomohiro "Tomo-p" KATO <tomop@teamgedoh.net> - 5.8.1-1
  317. - new upstream release.
  318. * Tue Jan 01 2019 Tomohiro "Tomo-p" KATO <tomop@teamgedoh.net> - 5.7.2-1
  319. - new upstream release.
  320. * Wed Nov 07 2018 Tomohiro "Tomo-p" KATO <tomop@teamgedoh.net> - 5.7.1-1
  321. - new upstream release.
  322. - imported Patch3 from rawhide.
  323. * Mon Mar 05 2018 Tomohiro "Tomo-p" KATO <tomop@teamgedoh.net> - 5.6.2-2
  324. - initial build for Vine Linux.
  325. * Wed Feb 21 2018 Lubomir Rintel <lkundrak@v3.sk> - 5.6.2-1
  326. - Updated to 5.6.2 (Dropped libnm-glib use in charon-nm)
  327. * Fri Feb 09 2018 Fedora Release Engineering <releng@fedoraproject.org> - 5.6.1-2
  328. - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
  329. * Fri Dec 22 2017 Paul Wouters <pwouters@redhat.com> - 5.6.1-1
  330. - Updated to 5.6.1 (RSA-PSS support)
  331. * Sun Dec 10 2017 Björn Esser <besser82@fedoraproject.org> - 5.6.0-3
  332. - Rebuilt for libjson-c.so.3
  333. * Fri Dec 01 2017 Lubomir Rintel <lkundrak@v3.sk> - 5.6.0-2
  334. - Fix the placement of charon-nm D-Bus policy
  335. * Sat Sep 09 2017 Paul Wouters <pwouters@redhat.com> - 5.6.0-1
  336. - Updated to 5.6.0
  337. - Fixup configure arguments, enabled a bunch of new features
  338. - Added new BuildRequires:
  339. - Fixup Obsolete/Conflicts, use license macro
  340. - Don't require autoconf/autotools for non-snapshots
  341. - Remove macro overuse, remove fedora/rhel checks and sysvinit support
  342. - Make listings/grouping of all plugins/libs to reduce file listing
  343. * Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 5.5.3-3
  344. - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
  345. * Thu Jul 27 2017 Fedora Release Engineering <releng@fedoraproject.org> - 5.5.3-2
  346. - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
  347. * Mon Jun 12 2017 Paul Wouters <pwouters@redhat.com> - 5.5.3-1
  348. - Updated to 5.5.3
  349. * Sat May 27 2017 Paul Wouters <pwouters@redhat.com> - 5.5.2-1
  350. - Updated to 5.5.2
  351. * Sat Feb 11 2017 Fedora Release Engineering <releng@fedoraproject.org> - 5.5.0-3
  352. - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
  353. * Thu Sep 15 2016 Pavel Šimerda <psimerda@redhat.com> - 5.5.0-2
  354. - Resolves: #1367796 - Enable the unity plugin
  355. * Mon Aug 08 2016 Pavel Šimerda <psimerda@redhat.com> - 5.5.0-1
  356. - New version 5.5.0
  357. * Wed Jun 22 2016 Pavel Šimerda <psimerda@redhat.com>
  358. - Enable IKEv2 GCM (requires gcrypt module as well) - merged from f22 by Paul Wouters
  359. * Wed Jun 22 2016 Pavel Šimerda <psimerda@redhat.com> - 5.4.0-1
  360. - New version 5.4.0
  361. * Thu Mar 03 2016 Pavel Šimerda <psimerda@redhat.com> - 5.3.5-1
  362. - New version 5.3.5
  363. * Fri Feb 05 2016 Fedora Release Engineering <releng@fedoraproject.org> - 5.3.3-3
  364. - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
  365. * Fri Jan 15 2016 Paul Wouters <pwouters@redhat.com> - 5.3.3-2
  366. - Enable IKEv2 GCM (requires gcrypt module as well)
  367. * Tue Sep 29 2015 Pavel Šimerda <psimerda@redhat.com> - 5.3.3-1
  368. - new version 5.3.3
  369. * Thu Sep 24 2015 Pavel Šimerda <psimerda@redhat.com> - 5.3.2-3
  370. - Resolves: #1264598 - strongswan: many configuration files are not protected
  371. * Fri Jun 19 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 5.3.2-2
  372. - Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
  373. * Tue Jun 09 2015 Pavel Šimerda <psimerda@redhat.com>
  374. - new version 5.3.2
  375. * Fri Jun 05 2015 Pavel Šimerda <psimerda@redhat.com> - 5.3.1-1
  376. - new version 5.3.1
  377. * Tue Mar 31 2015 Pavel Šimerda <psimerda@redhat.com> - 5.3.0-1
  378. - new version 5.3.0
  379. * Fri Feb 20 2015 Avesh Agarwal <avagarwa@redhat.com> - 5.2.2-2
  380. - Fixes strongswan swanctl service issue rhbz#1193106
  381. * Tue Jan 06 2015 Pavel Šimerda <psimerda@redhat.com> - 5.2.2-1
  382. - new version 5.2.2
  383. * Thu Dec 18 2014 Avesh Agarwal <avagarwa@redhat.com> - 5.2.2-0.2.dr1
  384. - Enabled ccm, and ctr plugins as it seems enabling just openssl does
  385. not work for using ccm and ctr algos.
  386. * Mon Dec 8 2014 Avesh Agarwal <avagarwa@redhat.com> - 5.2.2-0.1.dr1
  387. - New strongswan developer release 5.2.2dr1
  388. * Mon Nov 24 2014 Avesh Agarwal <avagarwa@redhat.com> - 5.2.1-2
  389. - 1167331: Enabled native systemd support.
  390. - Does not disable old systemd, starter, ipsec.conf support yet.
  391. * Thu Oct 30 2014 Avesh Agarwal <avagarwa@redhat.com> - 5.2.1-1
  392. - New upstream release 5.2.1
  393. * Thu Oct 16 2014 Avesh Agarwal <avagarwa@redhat.com> - 5.2.1-0.2.rc1
  394. - New upstream release candidate 5.2.1rc1
  395. * Fri Oct 10 2014 Pavel Šimerda <psimerda@redhat.com> - 5.2.1-1
  396. - new version 5.2.1dr1
  397. * Thu Sep 25 2014 Pavel Šimerda <psimerda@redhat.com> - 5.2.0-7
  398. - use upstream patch for json/json-c dependency
  399. * Thu Sep 25 2014 Pavel Šimerda <psimerda@redhat.com> - 5.2.0-6
  400. - Resolves: #1146145 - Strongswan is compiled without xauth-noauth plugin
  401. * Mon Aug 18 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 5.2.0-5
  402. - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
  403. * Tue Aug 05 2014 Pavel Šimerda <psimerda@redhat.com> - 5.2.0-4
  404. - Resolves: #1081804 - enable Kernel IPSec support
  405. * Wed Jul 30 2014 Pavel Šimerda <psimerda@redhat.com> - 5.2.0-3
  406. - rebuilt
  407. * Tue Jul 29 2014 Pavel Šimerda <psimerda@redhat.com> - 5.2.0-2
  408. - fix json-c dependency
  409. * Tue Jul 15 2014 Avesh Agarwal <avagarwa@redhat.com> - 5.2.0-1
  410. - New upstream release 5.2.0
  411. - The Attestation IMC/IMV pair supports the IMA-NG
  412. measurement format
  413. - Aikgen tool to generate an Attestation Identity Key bound
  414. to a TPM
  415. - Swanctl tool to provide a portable, complete IKE
  416. configuration and control interface for the command
  417. line using vici interface with libvici library
  418. - PT-EAP transport protocol (RFC 7171) for TNC
  419. - Enabled support for acert for checking X509 attribute certificate
  420. - Updated patches, removed selinux patch as upstream has fixed it
  421. in this release.
  422. - Updated spec file with minor cleanups
  423. * Thu Jun 26 2014 Pavel Šimerda <psimerda@redhat.com> - 5.2.0-0.4.dr6
  424. - improve prerelease macro
  425. * Thu Jun 26 2014 Pavel Šimerda <psimerda@redhat.com> - 5.2.0-0.3
  426. - Resolves: #1111895 - bump to 5.2.0dr6
  427. * Thu Jun 12 2014 Pavel Šimerda <psimerda@redhat.com> - 5.2.0-0.2
  428. - Related: #1087437 - remove or upstream all patches not specific to fedora/epel
  429. * Thu Jun 12 2014 Pavel Šimerda <psimerda@redhat.com> - 5.2.0-0.1.dr5
  430. - fix the pre-release version according to guidelines before it gets branched
  431. * Fri Jun 06 2014 Pavel Šimerda <psimerda@redhat.com> - 5.2.0dr5-1
  432. - new version 5.2.0dr5
  433. - add json-c-devel to build deps
  434. * Mon May 26 2014 Pavel Šimerda <psimerda@redhat.com> - 5.2.0dr4-3
  435. - merge two related patches
  436. * Mon May 26 2014 Pavel Šimerda <psimerda@redhat.com> - 5.2.0dr4-2
  437. - clean up the patches a bit
  438. * Thu May 22 2014 Avesh Agarwal <avagarwa@redhat.com> - 5.2.0dr4-1
  439. - New upstream developer release 5.2.0dr4
  440. - Attestation IMV/IMC supports IMA-NG measurement format now
  441. - Aikgen tool to generate an Attestation Identity Key bound
  442. to a TPM
  443. - PT-EAP transport protocol (RFC 7171) for TNC
  444. - vici plugin provides IKE Configuration Interface for charon
  445. - Enabled support for acert for checking X509 attribute certificate
  446. - Updated patches
  447. - Updated spec file with minor cleanups
  448. * Tue Apr 15 2014 Pavel Šimerda <psimerda@redhat.com> - 5.1.3-1
  449. - new version 5.1.3
  450. * Mon Apr 14 2014 Pavel Šimerda <psimerda@redhat.com> - 5.1.3rc1-1
  451. - new version 5.1.3rc1
  452. * Mon Mar 24 2014 Pavel Šimerda <psimerda@redhat.com> - 5.1.2-4
  453. - #1069928 - updated libexec patch.
  454. * Tue Mar 18 2014 Pavel Šimerda <psimerda@redhat.com> - 5.1.2-3
  455. - fixed el6 initscript
  456. - fixed pki directory location
  457. * Fri Mar 14 2014 Pavel Šimerda <psimerda@redhat.com> - 5.1.2-2
  458. - clean up the specfile a bit
  459. - replace the initscript patch with an individual initscript
  460. - patch to build for epel6
  461. * Mon Mar 03 2014 Pavel Šimerda <psimerda@redhat.com> - 5.1.2-1
  462. - #1071353 - bump to 5.1.2
  463. - #1071338 - strongswan is compiled without xauth-pam plugin
  464. - remove obsolete patches
  465. - sent all patches upstream
  466. - added comments to all patches
  467. - don't touch the config with sed
  468. * Thu Feb 20 2014 Avesh Agarwal <avagarwa@redhat.com> - 5.1.1-6
  469. - Fixed full hardening for strongswan (full relro and PIE).
  470. The previous macros had a typo and did not work
  471. (see bz#1067119).
  472. - Fixed tnc package description to reflect the current state of
  473. the package.
  474. - Fixed pki binary and moved it to /usr/libexece/strongswan as
  475. others binaries are there too.
  476. * Wed Feb 19 2014 Pavel Šimerda <psimerda@redhat.com> - 5.1.1-5
  477. - #903638 - SELinux is preventing /usr/sbin/xtables-multi from 'read' accesses on the chr_file /dev/random
  478. * Thu Jan 09 2014 Pavel Šimerda <psimerda@redhat.com> - 5.1.1-4
  479. - Removed redundant patches and *.spec commands caused by branch merging
  480. * Wed Jan 08 2014 Pavel Šimerda <psimerda@redhat.com> - 5.1.1-3
  481. - rebuilt
  482. * Mon Dec 2 2013 Avesh Agarwal <avagarwa@redhat.com> - 5.1.1-2
  483. - Resolves: 973315
  484. - Resolves: 1036844
  485. * Fri Nov 1 2013 Avesh Agarwal <avagarwa@redhat.com> - 5.1.1-1
  486. - Support for PT-TLS (RFC 6876)
  487. - Support for SWID IMC/IMV
  488. - Support for command line IKE client charon-cmd
  489. - Changed location of pki to /usr/bin
  490. - Added swid tags files
  491. - Added man pages for pki and charon-cmd
  492. - Renamed pki to strongswan-pki to avoid conflict with
  493. pki-core/pki-tools package.
  494. - Update local patches
  495. - Fixes CVE-2013-6075
  496. - Fixes CVE-2013-6076
  497. - Fixed autoconf/automake issue as configure.ac got changed
  498. and it required running autoreconf during the build process.
  499. - added strongswan signature file to the sources.
  500. * Thu Sep 12 2013 Avesh Agarwal <avagarwa@redhat.com> - 5.1.0-3
  501. - Fixed initialization crash of IMV and IMC particularly
  502. attestation imv/imc as libstrongswas was not getting
  503. initialized.
  504. * Fri Aug 30 2013 Avesh Agarwal <avagarwa@redhat.com> - 5.1.0-2
  505. - Enabled fips support
  506. - Enabled TNC's ifmap support
  507. - Enabled TNC's pdp support
  508. - Fixed hardocded package name in this spec file
  509. * Wed Aug 7 2013 Avesh Agarwal <avagarwa@redhat.com> - 5.1.0-1
  510. - rhbz#981429: New upstream release
  511. - Fixes CVE-2013-5018: rhbz#991216, rhbz#991215
  512. - Fixes rhbz#991859 failed to build in rawhide
  513. - Updated local patches and removed which are not needed
  514. - Fixed errors around charon-nm
  515. - Added plugins libstrongswan-pkcs12.so, libstrongswan-rc2.so,
  516. libstrongswan-sshkey.so
  517. - Added utility imv_policy_manager
  518. * Thu Jul 25 2013 Jamie Nguyen <jamielinux@fedoraproject.org> - 5.0.4-5
  519. - rename strongswan-NetworkManager to strongswan-charon-nm
  520. - fix enable_nm macro
  521. * Mon Jul 15 2013 Jamie Nguyen <jamielinux@fedoraproject.org> - 5.0.4-4
  522. - %%files tries to package some of the shared objects as directories (#984437)
  523. - fix broken systemd unit file (#984300)
  524. - fix rpmlint error: description-line-too-long
  525. - fix rpmlint error: macro-in-comment
  526. - fix rpmlint error: spelling-error Summary(en_US) fuctionality
  527. - depend on 'systemd' instead of 'systemd-units'
  528. - use new systemd scriptlet macros
  529. - NetworkManager subpackage should have a copy of the license (#984490)
  530. - enable hardened_build as this package meets the PIE criteria (#984429)
  531. - invocation of "ipsec _updown iptables" is broken as ipsec is renamed
  532. to strongswan in this package (#948306)
  533. - invocation of "ipsec scepclient" is broken as ipsec is renamed
  534. to strongswan in this package
  535. - add /etc/strongswan/ipsec.d and missing subdirectories
  536. - conditionalize building of strongswan-NetworkManager subpackage as the
  537. version of NetworkManager in EL6 is too old (#984497)
  538. * Fri Jun 28 2013 Avesh Agarwal <avagarwa@redhat.com> - 5.0.4-3
  539. - Patch to fix a major crash issue when Freeradius loads
  540. attestatiom-imv and does not initialize libstrongswan which
  541. causes crash due to calls to PTS algorithms probing APIs.
  542. So this patch fixes the order of initialization. This issues
  543. does not occur with charon because libstrongswan gets
  544. initialized earlier.
  545. - Patch that allows to outputs errors when there are permission
  546. issues when accessing strongswan.conf.
  547. - Patch to make loading of modules configurable when libimcv
  548. is used in stand alone mode without charon with freeradius
  549. and wpa_supplicant.
  550. * Tue Jun 11 2013 Avesh Agarwal <avagarwa@redhat.com> - 5.0.4-2
  551. - Enabled TNCCS 1.1 protocol
  552. - Fixed libxm2-devel build dependency
  553. - Patch to fix the issue with loading of plugins
  554. * Wed May 1 2013 Avesh Agarwal <avagarwa@redhat.com> - 5.0.4-1
  555. - New upstream release
  556. - Fixes for CVE-2013-2944
  557. - Enabled support for OS IMV/IMC
  558. - Created and applied a patch to disable ECP in fedora, because
  559. Openssl in Fedora does not allow ECP_256 and ECP_384. It makes
  560. it non-compliant to TCG's PTS standard, but there is no choice
  561. right now. see redhat bz # 319901.
  562. - Enabled Trousers support for TPM based operations.
  563. * Sat Apr 20 2013 Pavel Šimerda <psimerda@redhat.com> - 5.0.3-2
  564. - Rebuilt for a single specfile for rawhide/f19/f18/el6
  565. * Fri Apr 19 2013 Avesh Agarwal <avagarwa@redhat.com> - 5.0.3-1
  566. - New upstream release
  567. - Enabled curl and eap-identity plugins
  568. - Enabled support for eap-radius plugin.
  569. * Thu Apr 18 2013 Pavel Šimerda <psimerda@redhat.com> - 5.0.2-3
  570. - Add gettext-devel to BuildRequires because of epel6
  571. - Remove unnecessary comments
  572. * Tue Mar 19 2013 Avesh Agarwal <avagarwa@redhat.com> - 5.0.2-2
  573. - Enabled support for eap-radius plugin.
  574. * Mon Mar 11 2013 Avesh Agarwal <avagarwa@redhat.com> - 5.0.2-1
  575. - Update to upstream release 5.0.2
  576. - Created sub package strongswan-tnc-imcvs that provides trusted network
  577. connect's IMC and IMV funtionality. Specifically it includes PTS
  578. based IMC/IMV for TPM based remote attestation and scanner and test
  579. IMCs and IMVs. The Strongswan's IMC/IMV dynamic libraries can be used
  580. by any third party TNC Client/Server implementation possessing a
  581. standard IF-IMC/IMV interface.
  582. * Fri Feb 15 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 5.0.1-2
  583. - Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
  584. * Thu Oct 04 2012 Pavel Šimerda <psimerda@redhat.com> - 5.0.1-1
  585. - Update to release 5.0.1
  586. * Thu Oct 04 2012 Pavel Šimerda <psimerda@redhat.com> - 5.0.0-4.git20120619
  587. - Add plugins to interoperate with Windows 7 and Android (#862472)
  588. (contributed by Haim Gelfenbeyn)
  589. * Sat Jul 21 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 5.0.0-3.git20120619
  590. - Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
  591. * Sun Jul 08 2012 Pavel Šimerda <pavlix@pavlix.net> - 5.0.0-2.git20120619
  592. - Fix configure substitutions in initscripts
  593. * Wed Jul 04 2012 Pavel Šimerda <psimerda@redhat.com> - 5.0.0-1.git20120619
  594. - Update to current upstream release
  595. - Comment out all stuff that is only needed for git builds
  596. - Remove renaming patch from git
  597. - Improve init patch used for EPEL
  598. * Thu Jun 21 2012 Pavel Šimerda <psimerda@redhat.com> - 5.0.0-0.3.git20120619
  599. - Build with openssl plugin enabled
  600. * Wed Jun 20 2012 Pavel Šimerda <psimerda@redhat.com> - 5.0.0-0.2.git20120619
  601. - Add README.Fedora with link to 4.6 to 5.0 migration information
  602. * Tue Jun 19 2012 Pavel Šimerda - 5.0.0-0.1.git20120619
  603. - Snapshot of upcoming major release
  604. - Move patches and renaming upstream
  605. http://wiki.strongswan.org/issues/194
  606. http://wiki.strongswan.org/issues/195
  607. - Notified upstream about manpage issues
  608. * Tue Jun 19 2012 Pavel Šimerda - 4.6.4-2
  609. - Make initscript patch more distro-neutral
  610. - Add links to bugreports for patches
  611. * Fri Jun 01 2012 Pavel Šimerda <pavlix@pavlix.net> - 4.6.4-1
  612. - New upstream version (CVE-2012-2388)
  613. * Sat May 26 2012 Pavel Šimerda <pavlix@pavlix.net> - 4.6.3-2
  614. - Add --enable-nm to configure
  615. - Add NetworkManager-devel to BuildRequires
  616. - Add NetworkManager-glib-devel to BuildRequires
  617. - Add strongswan-NetworkManager package
  618. * Sat May 26 2012 Pavel Šimerda <pavlix@pavlix.net> - 4.6.3-1
  619. - New version of Strongswan
  620. - Support for RFC 3110 DNSKEY (see upstream changelog)
  621. - Fix corrupt scriptlets
  622. * Fri Mar 30 2012 Pavel Šimerda <pavlix@pavlix.net> - 4.6.2-2
  623. - #808612 - strongswan binary renaming side-effect
  624. * Sun Feb 26 2012 Pavel Šimerda <pavlix@pavlix.net> - 4.6.2-1
  625. - New upstream version
  626. - Changed from .tar.gz to .tar.bz2
  627. - Added libstrongswan-pkcs8.so
  628. * Wed Feb 15 2012 Pavel Šimerda <pavlix@pavlix.net> - 4.6.1-8
  629. - Fix initscript's status function
  630. * Wed Feb 15 2012 Pavel Šimerda <pavlix@pavlix.net> - 4.6.1-7
  631. - Expand tabs in config files for better readability
  632. - Add sysvinit script for epel6
  633. * Wed Feb 15 2012 Pavel Šimerda <pavlix@pavlix.net> - 4.6.1-6
  634. - Fix program name in systemd unit file
  635. * Tue Feb 14 2012 Pavel Šimerda <pavlix@pavlix.net> - 4.6.1-5
  636. - Improve fedora/epel conditionals
  637. * Sat Jan 21 2012 Pavel Šimerda <pavlix@pavlix.net> - 4.6.1-4
  638. - Protect configuration directory from ordinary users
  639. - Add still missing directory /etc/strongswan
  640. * Fri Jan 20 2012 Pavel Šimerda <pavlix@pavlix.net> - 4.6.1-3
  641. - Change directory structure to avoid clashes with Openswan
  642. - Prefixed all manpages with 'strongswan_'
  643. - Every file now includes 'strongswan' somewhere in its path
  644. - Removed conflict with Openswan
  645. - Finally fix permissions on strongswan.conf
  646. * Fri Jan 20 2012 Pavel Šimerda <pavlix@pavlix.net> - 4.6.1-2
  647. - Change license tag from GPL to GPLv2+
  648. - Change permissions on /etc/strongswan.conf to 644
  649. - Rename ipsec.8 manpage to strongswan.8
  650. - Fix empty scriptlets for non-fedora builds
  651. - Add ldconfig scriptlet
  652. - Add missing directories and files
  653. * Sun Jan 01 2012 Pavel Šimerda <pavlix@pavlix.net - 4.6.1-1
  654. - Bump to version 4.6.1
  655. * Sun Jan 01 2012 Pavel Šimerda <pavlix@pavlix.net - 4.6.0-3
  656. - Add systemd scriptlets
  657. - Add conditions to also support EPEL6
  658. * Sat Dec 10 2011 Pavel Šimerda <pavlix@pavlix.net> - 4.6.0-2
  659. - Experimental build for development