auto commit by copy to link target

• Files Changed
• Browse Source

...

• Files Changed
• Browse Source

- Updated to strongSwan 5.1.3 providing the following changes:
  - Fixed an authentication bypass vulnerability triggered by rekeying
    an unestablished IKEv2 SA while it gets actively initiated. This
    allowed an attacker to trick a peer's IKE_SA state to established,
    without the need to provide any valid authentication credentials.
    (CVE-2014-2338, bnc#870572).
  - The acert plugin evaluates X.509 Attribute Certificates. Group
    membership information encoded as strings can be used to fulfill
    authorization checks defined with the rightgroups option.
    Attribute Certificates can be loaded locally or get exchanged in
    IKEv2 certificate payloads.
  - The pki command gained support to generate X.509 Attribute
    Certificates using the --acert subcommand, while the --print
    command supports the ac type. The openac utility has been removed
    in favor of the new pki functionality.
  - The libtls TLS 1.2 implementation as used by EAP-(T)TLS and other
    protocols has been extended by AEAD mode support, currently limited
    to AES-GCM.
  - Fixed an issue where CRL/OCSP trustchain validation broke enforcing
    CA constraints
  - Limited OCSP signing to specific certificates to improve performance
  - authKeyIdentifier is not added to self-signed certificates anymore
  - Fixed the comparison of IKE configs if only the cipher suites were
    different

• Files Changed
• Browse Source

- Updated to strongSwan 5.1.2 providing the following changes:
  - A new default configuration file layout is introduced. The new
    default strongswan.conf file mainly includes config snippets from
    the strongswan.d and strongswan.d/charon directories (the latter
    containing snippets for all plugins). The snippets, with commented
    defaults, are automatically generated and installed, if they don't
    exist yet. Also installed in $prefix/share/strongswan/templates so
    existing files can be compared to the current defaults.
  - As an alternative to the non-extensible charon.load setting, the
    plugins to load in charon (and optionally other applications) can
    now be determined via the charon.plugins.<name>.load setting for
    each plugin (enabled in the new default strongswan.conf file via the
    charon.load_modular option). The load setting optionally takes a
    numeric priority value that allows reordering the plugins (otherwise
    the default plugin order is preserved).
  - All strongswan.conf settings that were formerly defined in library
    specific "global" sections are now application specific (e.g.
    settings for plugins in libstrongswan.plugins can now be set only
    for charon in charon.plugins). The old options are still supported,
    which now allows to define defaults for all applications in the
    libstrongswan section.
  - The ntru libstrongswan plugin supports NTRUEncrypt as a post-quantum
    computer IKE key exchange mechanism. The implementation is based on
    the ntru-crypto library from the NTRUOpenSourceProject.
    The supported security strengths are ntru112, ntru128, ntru192, and
    ntru256. Since the private DH group IDs 1030..1033 have been
    assigned, the strongSwan Vendor ID must be sent in order to use NTRU
    (charon.send_vendor_id = yes).
  - Defined a TPMRA remote attestation workitem and added support for it
    to the Attestation IMV.

• Files Changed
• Browse Source

auto commit by copy to link target

• Files Changed
• Browse Source

- Updated to strongSwan 5.1.1 minor release addressing two security
  fixes (bnc#847506,CVE-2013-6075, bnc#847509,CVE-2013-6076):
  - Fixed a denial-of-service vulnerability and potential authorization
    bypass triggered by a crafted ID_DER_ASN1_DN ID payload. The cause
    is an insufficient length check when comparing such identities. The
    vulnerability has been registered as CVE-2013-6075.
  - Fixed a denial-of-service vulnerability triggered by a crafted IKEv1
    fragmentation payload. The cause is a NULL pointer dereference. The
    vulnerability has been registered as CVE-2013-6076.
  - The lean stand-alone pt-tls-client can set up a RFC 6876 PT-TLS
    session with a strongSwan policy enforcement point which uses the
    tnc-pdp charon plugin.
  - The new TCG TNC SWID IMC/IMV pair supports targeted SWID requests
    for either full SWID Tag or concise SWID Tag ID inventories.
  - The XAuth backend in eap-radius now supports multiple XAuth
    exchanges for different credential types and display messages.
    All user input gets concatenated and verified with a single
    User-Password RADIUS attribute on the AAA. With an AAA supporting
    it, one for example can implement Password+Token authentication with
    proper dialogs on iOS and OS X clients.  - charon supports IKEv1 Mode
    Config exchange in push mode. The ipsec.conf modeconfig=push option
    enables it for both client and server, the same way as pluto used it.
  - Using the "ah" ipsec.conf keyword on both IKEv1 and IKEv2
    connections, charon can negotiate and install Security Associations
    integrity-protected by the Authentication Header protocol. Supported
    are plain AH(+IPComp) SAs only, but not the deprecated RFC2401 style
    ESP+AH bundles.
  [...]

• Files Changed
• Browse Source

auto commit by copy to link target

• Files Changed
• Browse Source

- Updated to strongSwan 5.1.0 release (bnc#833278, CVE-2013-5018)

• Files Changed
• Browse Source

auto commit by copy to link target

• Files Changed
• Browse Source

- Updated to strongSwan 5.0.4 release (bnc#815236, CVE-2013-2944):
  - Fixed a security vulnerability in the openssl plugin which was
    reported by Kevin Wojtysiak.  The vulnerability has been registered
    as CVE-2013-2944. Before the fix, if the openssl plugin's ECDSA
    signature verification was used, due to a misinterpretation of the
    error code returned by the OpenSSL ECDSA_verify() function, an empty
    or zeroed signature was accepted as a legitimate one. Refer to our
    blog for details.
  - The handling of a couple of other non-security relevant OpenSSL
    return codes was fixed as well.
  - The tnc_ifmap plugin now publishes virtual IPv4 and IPv6 addresses
    via its TCG TNC IF-MAP 2.1 interface.
  - The charon.initiator_only strongswan.conf option causes charon to
    ignore IKE initiation requests.
  - The openssl plugin can now use the openssl-fips library.
  The version 5.0.3 provides new ipseckey plugin, enabling authentication
  based on trustworthy public keys stored as IPSECKEY resource records in
  the DNS and protected by DNSSEC and new openssl plugin using the AES-NI
  accelerated version of AES-GCM if the hardware supports it.
  See http://wiki.strongswan.org/projects/strongswan/wiki/Changelog50
  for a list of all changes since the 5.0.1 release.

• Files Changed
• Browse Source

auto commit by copy to link target

• Files Changed
• Browse Source

Verify GPG signature: Perform build-time offline GPG verification.
Please verify that included keyring matches your needs.
For manipulation with the offline keyring, please use gpg-offline tool from openSUSE:Factory, devel-tools-building or Base:System.
See the man page and/or /usr/share/doc/packages/gpg-offline/PACKAGING.HOWTO.

If you need to build your package for older products and don't want to mess spec file with ifs, please follow PACKAGING.HOWTO:
you can link or aggregate gpg-offline from
devel:tools:building or use following trick with "osc meta prjconf":

--- Cut here ----
%if 0%{?suse_version} <= 1220
Substitute: gpg-offline
%endif

Macros:
%gpg_verify(dnf) \
%if 0%{?suse_version} > 1220\
echo "WARNING: Using %%gpg_verify macro from prjconf, not from gpg-offline package."\
gpg-offline --directory="%{-d:%{-d*}}%{!-d:%{_sourcedir}}" --package="%{-n:%{-n*}}%{!-n:%{name}}""%{-f: %{-f*}}" --verify %{**}\
%else\
echo "WARNING: Dummy prjconf macro. gpg-offline is not available, skipping %{**} GPG signature verification!"\
%endif\
%nil
-----------------

• Files Changed
• Browse Source

auto commit by copy to link target

• Files Changed
• Browse Source

- Fix systemd unit dir

• Files Changed
• Browse Source

auto commit by copy to link target

• Files Changed
• Browse Source

- Adopted spec file, enabled several plugins, e.g.: ccm, certexpire,
  coupling, ctr, duplicheck, eap-dynamic, eap-peap, eap-tls, eap-tnc,
  eap-ttls, gcm, nonce, radattr, tnc, tnccs, unity, xauth-eap and pam.

• Files Changed
• Browse Source

- Updated to strongSwan 5.0.1 release. Changes digest:
  - Introduced the sending of the standard IETF Assessment Result
    PA-TNC attribute by all strongSwan Integrity Measurement Verifiers.
  - Extended PTS Attestation IMC/IMV pair to provide full evidence of
    the Linux IMA measurement process. All pertinent file information
    of a Linux OS can be collected and stored in an SQL database.
  - The PA-TNC and PB-TNC protocols can now process huge data payloads.
  - The xauth-pam backend can authenticate IKEv1 XAuth and Hybrid
    authenticated clients against any PAM service.
  - The new unity plugin brings support for some parts of the IKEv1
    Cisco Unity Extensions.
  - The kernel-netlink plugin supports the new strongswan.conf option
    charon.install_virtual_ip_on.
  - Job handling in controller_t was fixed, which occasionally caused
    crashes on ipsec up/down.
  - Fixed transmission EAP-MSCHAPv2 user name if it contains a domain
    part.
  Changes digest from strongSwan 5.0.0 version:
  * The charon IKE daemon gained experimental support for the IKEv1
    protocol. Pluto has been removed from the 5.x series.
  * The NetworkManager charon plugin of previous releases is now
    provided by a separate executable (charon-nm) and it should work
    again with NM 0.9.
  * scepclient was updated and it now works fine with Windows Server
    2008 R2.
  For full list of the changes, please read the NEWS file shipped
  in the strongswan-doc package or online:
  http://wiki.strongswan.org/projects/strongswan/wiki/Changelog50
- Adopted spec file, enabled several plugins.
- Changed to install strongswan.service with alias to ipsec.service

• Files Changed
• Browse Source

- WORK-IN-PROGRESS snapshot: Update to strongSwan 5.0.1

• Files Changed
• Browse Source

auto commit by copy to link target

• Files Changed
• Browse Source

- Applied upstream patch adjusting an internal thread id causing
  charon keying daemon start failure (bnc#779038,strongswan#198):
    openssl: Ensure the thread ID is never zero
    This might otherwise cause problems because OpenSSL tries to
    lock mutexes recursively if it assumes the lock is held by a
    different thread e.g. during FIPS initialization.
  See http://wiki.strongswan.org/issues/198 for more informations.

• Files Changed
• Browse Source