commit 0212bc6a7c0ac3aa5d8da82bf22132993d339ffc
Author: Paul Wouters <paul.wouters@aiven.io>
Date:   Thu Jan 13 15:31:50 2022 -0500

    building: fix fedora rawhide build
    
    Avoid clashing openssl/nss headers
    
    Patch based on work by Daiki Ueno <dueno@redhat.com>
    
    Resolves: https://github.com/libreswan/libreswan/pull/611

diff --git a/programs/pluto/ikev2_ipseckey.h b/programs/pluto/ikev2_ipseckey.h
index 243e5b1776..5ef3f966ec 100644
--- a/programs/pluto/ikev2_ipseckey.h
+++ b/programs/pluto/ikev2_ipseckey.h
@@ -1,5 +1,3 @@
-#include "state.h"
-
 #ifndef _IKEV2_IPSECKEY_H
 #define _IKEV2_IPSECKEY_H
 
@@ -11,6 +9,8 @@
 
 #define IS_LIBUNBOUND LSW_LIBUNBOUND_ENABLED
 
+struct ike_sa;
+
 typedef enum {
 	DNS_OK = STF_OK,
 	DNS_FATAL = STF_FATAL,
diff --git a/programs/pluto/ikev2_ipseckey_dnsr.c b/programs/pluto/ikev2_ipseckey_dnsr.c
index b07ed72f2b..09767bf65d 100644
--- a/programs/pluto/ikev2_ipseckey_dnsr.c
+++ b/programs/pluto/ikev2_ipseckey_dnsr.c
@@ -32,7 +32,9 @@
 #include "dnssec.h"    /* includes unbound.h */
 #include "ikev2_ipseckey.h" /* for dns_status */
 #include "ikev2_ipseckey_dnsr.h"
-#include "secrets.h"
+
+/* Do not include secrets.h as it will cause conflicts via NSS/OPENSSL headers */
+extern const struct pubkey_type pubkey_type_rsa;
 
 struct p_dns_req *pluto_dns_list = NULL; /* DNS queries linked list */