Update to 1.4.0 upstream release

- Resolves: rhbz#2427015

Upstream tag: 1.4.0
Upstream commit: 5f5ac6fe

Commit authored by Packit automation (https://packit.dev/)

.gitignore

@@ -237,9 +237,17 @@
 /ocserv-1.1.4.tar.xz.sig
 /ocserv-1.1.6.tar.xz.sig
 /ocserv-1.1.6.tar.xz
+/ocserv-1.1.7.tar.xz
+/ocserv-1.1.7.tar.xz.sig
+/ocserv-1.2.0.tar.xz
+/ocserv-1.2.0.tar.xz.sig
 /ocserv-1.2.1.tar.xz
 /ocserv-1.2.1.tar.xz.sig
 /ocserv-1.2.2.tar.xz
 /ocserv-1.2.2.tar.xz.sig
 /ocserv-1.2.4.tar.xz
 /ocserv-1.2.4.tar.xz.sig
+/ocserv-1.3.0.tar.xz
+/ocserv-1.3.0.tar.xz.sig
+/ocserv-1.4.0.tar.xz
+/ocserv-1.4.0.tar.xz.sig

README.packit

@@ -1,3 +1,3 @@
 This repository is maintained by packit.
 https://packit.dev/
-The file was generated using packit 0.89.0.post1.dev4+gabf90471.
+The file was generated using packit 1.13.0.post1.dev2+g84134016c.

ocserv-genkey

@@ -1,9 +1,25 @@
 #!/bin/sh
+#default key type:rsa
+KEY_TYPE="rsa"
+
+#check key type 'rsa', 'rsa-pss', 'dsa', 'ecdsa', 'ed25519, 'ed448', 'x25519', and 'x448'
+if [ $# -gt 0 ]; then
+    case "$1" in
+        rsa|rsa-pss|dsa|ecdsa|ed25519|ed448|x25519|x448)
+            KEY_TYPE="$1"
+            ;;
+        *)
+            echo "Usage: $0 [rsa|rsa-pss|dsa|ecdsa|ed25519|ed448|x25519|x448]"
+            echo "Default key type: rsa"
+            exit 1
+            ;;
+    esac
+fi
 
 #generate CA certificate/key
 if test ! -f /etc/pki/ocserv/private/ca.key;then
 mkdir -p /etc/pki/ocserv/private
-certtool --generate-privkey --outfile /etc/pki/ocserv/private/ca.key >/dev/null 2>&1
+certtool --generate-privkey --key-type=$KEY_TYPE --outfile /etc/pki/ocserv/private/ca.key >/dev/null 2>&1
 echo "cn=`hostname -f` CA" >/etc/pki/ocserv/ca.tmpl
 echo "expiration_days=-1" >>/etc/pki/ocserv/ca.tmpl
 echo "serial=1" >>/etc/pki/ocserv/ca.tmpl
@@ -17,7 +33,7 @@ fi
 
 #generate server certificate/key
 if test ! -f /etc/pki/ocserv/private/server.key;then
-certtool --generate-privkey --outfile /etc/pki/ocserv/private/server.key >/dev/null 2>&1
+certtool --generate-privkey --key-type=$KEY_TYPE --outfile /etc/pki/ocserv/private/server.key >/dev/null 2>&1
 echo "cn=`hostname -f`" >/etc/pki/ocserv/server.tmpl
 echo "serial=2" >>/etc/pki/ocserv/server.tmpl
 echo "expiration_days=-1" >>/etc/pki/ocserv/server.tmpl

ocserv.conf

@@ -301,7 +301,7 @@ cert-user-oid = 0.9.2342.19200300.100.1.1
 # difference with AES_128_CBC_SHA1 (the default for anyconnect clients)
 # in your system.
 
-# Note that in RHEL gnutls follows crypto policies so insecure options
+# Note that in Fedora gnutls follows crypto policies so insecure options
 # are disabled within it.
 tls-priorities = "NORMAL:%SERVER_PRECEDENCE"
 
@@ -438,7 +438,7 @@ pid-file = /var/run/ocserv.pid
 #   4 http
 #   8 sensitive
 #   9 TLS
-log-level = 1
+log-level = 3
 
 # Set the protocol-defined priority (SO_PRIORITY) for packets to
 # be sent. That is a number from 0 to 6 with 0 being the lowest

ocserv.spec

@@ -1,4 +1,4 @@
-Version:	1.2.4
+Version:	1.4.0
 Release: %autorelease
 %global _hardened_build 1
 
@@ -25,8 +25,8 @@ Summary:	OpenConnect SSL VPN server
 
 # For a breakdown of the licensing, see PACKAGE-LICENSING 
 # To simplify licenses LGPLv2+ files have been promoted to GPLv2+.
-License:	GPLv2+ and BSD and MIT and CC0
-URL:		http://www.infradead.org/ocserv/
+License:	GPL-2.0-or-later AND BSD-3-Clause AND MIT AND CC0-1.0
+URL:		https://ocserv.openconnect-vpn.net/
 Source0:	https://www.infradead.org/ocserv/download/%{name}-%{version}.tar.xz
 Source1:	https://www.infradead.org/ocserv/download/%{name}-%{version}.tar.xz.sig
 Source2:	gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg
@@ -43,6 +43,7 @@ Source11:	ocserv.init
 # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09
 
 BuildRequires: make
+BuildRequires: libxcrypt-devel
 BuildRequires:	gcc
 %if 0%{?rhel} && 0%{?rhel} <= 6
 BuildRequires:	gnutls30-devel
@@ -56,7 +57,7 @@ BuildRequires:	protobuf-c-devel
 %endif
 
 BuildRequires:	libnl3-devel, krb5-devel, libtasn1-devel, gperf, libtalloc-devel
-BuildRequires:	libev-devel, http-parser-devel, radcli-devel, lz4-devel, readline-devel
+BuildRequires:	libev-devel, llhttp-devel, radcli-devel, lz4-devel, readline-devel
 BuildRequires:	automake, autoconf
 
 %if %{use_libwrap}
@@ -100,7 +101,6 @@ BuildRequires:	rubygem-ronn-ng
 Recommends:		gnutls-utils
 Recommends:		iproute
 Recommends:		pam
-Requires(pre):		shadow-utils
 %if %{use_systemd}
 Requires(post):		systemd
 Requires(preun):	systemd
@@ -129,7 +129,6 @@ gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} || gpgv2 --keyring %{SOURCE10}
 
 %autosetup -p1
 
-rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h
 %if (0%{?use_local_protobuf} == 0)
 rm -rf src/protobuf/protobuf-c/
 touch src/*.proto
@@ -142,6 +141,11 @@ sed -i 's/run-as-group = nogroup/run-as-group = nobody/g' tests/data/*.config
 echo "int main() { return 77; }" > tests/valid-hostname.c
 %endif
 
+# Create a sysusers.d config file
+cat >ocserv.sysusers.conf <<EOF
+u ocserv - 'ocserv' %{_localstatedir}/lib/ocserv -
+EOF
+
 %build
 
 %if 0%{?rhel} && 0%{?rhel} <= 6
@@ -172,10 +176,6 @@ autoreconf -fvi
 make %{?_smp_mflags}
 
 %pre
-getent group ocserv &>/dev/null || groupadd -r ocserv
-getent passwd ocserv &>/dev/null || \
-	/usr/sbin/useradd -r -g ocserv -s /sbin/nologin -c ocserv \
-		-d %{_localstatedir}/lib/ocserv ocserv
 mkdir -p %{_sysconfdir}/pki/ocserv/public
 mkdir -p -m 700 %{_sysconfdir}/pki/ocserv/private
 mkdir -p %{_sysconfdir}/pki/ocserv/cacerts
@@ -191,7 +191,7 @@ make check %{?_smp_mflags} VERBOSE=1
 %systemd_preun ocserv.service
 
 %postun
-%systemd_postun ocserv.service
+%systemd_postun_with_restart ocserv.service
 %endif
 
 %install
@@ -226,6 +226,8 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name}
 
 %make_install
 
+install -m0644 -D ocserv.sysusers.conf %{buildroot}%{_sysusersdir}/ocserv.conf
+
 %files
 %defattr(-,root,root,-)
 
@@ -256,6 +258,7 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name}
 %else
 %{_initrddir}/%{name}
 %endif
+%{_sysusersdir}/ocserv.conf
 
 %changelog
 %autochangelog

sources

@@ -1,2 +1,2 @@
-SHA512 (ocserv-1.2.4.tar.xz) = 202c7045bea1b7a10bd711d9b1b23f5437da9ff71fde0577137c8059ea68956c8cc294f3d23f041bda7b0fb0ae292577a99101554a12206177f5a1f5ca16ea3b
-SHA512 (ocserv-1.2.4.tar.xz.sig) = b2c287e0398eb55571a04e0b0ae16f2b5636c136f467b41872c9bdfd8bd8b25aa541022a6c8b337b0d160f4f673076d03358c7c0259ec4554d604cf31e7f36d3
+SHA512 (ocserv-1.4.0.tar.xz) = cef771c6ee43925d743b7a21fed1cd7d54c10e39c0966fbc7062df9b7691c9a3a73c1c4589382592668f81809edea0fe0b947c7ddf86a6cdc1a144cf059526b0
+SHA512 (ocserv-1.4.0.tar.xz.sig) = a73ce14e8e355f747e40241056c2bb734d6dae4e1d6aed0f24aaa6d1a469f6d86a077af4a38e6376846fd5520ee33c7be8ce7b3830bcb0faa5e32b12ed7483cd