* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2017-06-02 12:23 Bjarke Istrup Pedersen
0 siblings, 0 replies; 112+ messages in thread
From: Bjarke Istrup Pedersen @ 2017-06-02 12:23 UTC (permalink / raw
To: gentoo-commits
commit: 18b128481fff8cf1425d51ed71713bd50c40a943
Author: Bjarke Istrup Pedersen <gurligebis <AT> gentoo <DOT> org>
AuthorDate: Fri Jun 2 12:23:03 2017 +0000
Commit: Bjarke Istrup Pedersen <gurligebis <AT> gentoo <DOT> org>
CommitDate: Fri Jun 2 12:23:34 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=18b12848
net-vpn/strongswan: Bumping to 5.5.2, fixing security bug #620256
Package-Manager: Portage-2.3.6, Repoman-2.3.2
net-vpn/strongswan/Manifest | 2 +-
net-vpn/strongswan/{strongswan-5.5.1.ebuild => strongswan-5.5.2.ebuild} | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/net-vpn/strongswan/Manifest b/net-vpn/strongswan/Manifest
index a5dbdc5ac99..231c46ba21b 100644
--- a/net-vpn/strongswan/Manifest
+++ b/net-vpn/strongswan/Manifest
@@ -1,2 +1,2 @@
DIST strongswan-5.3.4.tar.bz2 4418300 SHA256 938ad1f7b612e039f1d32333f4865160be70f9fb3c207a31127d0168116459aa SHA512 2ab1c9a5d285c7f85b130a827b9525dd238a6d2b4c0c0e15a38a5e09dbb58228bfe4a6ab6c57ba6781f5d0d7f565cbb82e0ee2feac758c8033894c969acb8155 WHIRLPOOL f7ffbefd62cc8eb4325b38392dbf84ea17b5e27b0917f75a31517ee9e864820faf6b30de4beb28ff17fb88fa16d4f042f698e2304542d01cba3e2392f63bb26f
-DIST strongswan-5.5.1.tar.bz2 4636854 SHA256 720b301991f77bdedd8d551a956f52e2d11686a0ec18e832094f86cf2b842ab7 SHA512 051352a941a02ae227f3a7d4ee9d6d5651daa0fb4d01b7086c3bb18815ea94f63b5f94f29e6ef46ef3360666f7c95936cbfde9393d6a0c677de64850056519b9 WHIRLPOOL 9a95a12964ba9c17b9e2e61800932e9b7d7fb6810680ffdee8f20f14fc2cc376bd27e103491a0911e7d127734e29d5a471f6fd5c68884ce95a829c797273b6bf
+DIST strongswan-5.5.2.tar.bz2 4759802 SHA256 da976fca836f05fc7b7a38baab299745f960cb7640319969d239d8aa4ace9f6a SHA512 dc5fec71e40d1366214c4b2a73ee3f2927edc3b768109f760b6993236a282ac376a66199aa4768d0ba26750a64f940953a92b2600ca1b1d8330d18df9486549d WHIRLPOOL 5a7b3430722e4e2b5354bee2734ee06562f2ee9cffe59f70450b987420e225f7fef71266b36c3679e78276a7993b13faeb0712b10486da8e5af72f0d8e9fec1d
diff --git a/net-vpn/strongswan/strongswan-5.5.1.ebuild b/net-vpn/strongswan/strongswan-5.5.2.ebuild
similarity index 99%
rename from net-vpn/strongswan/strongswan-5.5.1.ebuild
rename to net-vpn/strongswan/strongswan-5.5.2.ebuild
index 0b27b2034d3..d7477edc168 100644
--- a/net-vpn/strongswan/strongswan-5.5.1.ebuild
+++ b/net-vpn/strongswan/strongswan-5.5.2.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2016 Gentoo Foundation
+# Copyright 1999-2017 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
EAPI=5
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2017-06-02 15:36 Bjarke Istrup Pedersen
0 siblings, 0 replies; 112+ messages in thread
From: Bjarke Istrup Pedersen @ 2017-06-02 15:36 UTC (permalink / raw
To: gentoo-commits
commit: fffdd17d859d3bb15afbe16894b2d671a0ee1ab3
Author: Bjarke Istrup Pedersen <gurligebis <AT> gentoo <DOT> org>
AuthorDate: Fri Jun 2 15:35:34 2017 +0000
Commit: Bjarke Istrup Pedersen <gurligebis <AT> gentoo <DOT> org>
CommitDate: Fri Jun 2 15:36:11 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=fffdd17d
net-vpn/strongswan: Bumping to 5.5.3
Package-Manager: Portage-2.3.6, Repoman-2.3.2
net-vpn/strongswan/Manifest | 2 +-
net-vpn/strongswan/{strongswan-5.5.2.ebuild => strongswan-5.5.3.ebuild} | 0
2 files changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/Manifest b/net-vpn/strongswan/Manifest
index 231c46ba21b..57e8fe057bc 100644
--- a/net-vpn/strongswan/Manifest
+++ b/net-vpn/strongswan/Manifest
@@ -1,2 +1,2 @@
DIST strongswan-5.3.4.tar.bz2 4418300 SHA256 938ad1f7b612e039f1d32333f4865160be70f9fb3c207a31127d0168116459aa SHA512 2ab1c9a5d285c7f85b130a827b9525dd238a6d2b4c0c0e15a38a5e09dbb58228bfe4a6ab6c57ba6781f5d0d7f565cbb82e0ee2feac758c8033894c969acb8155 WHIRLPOOL f7ffbefd62cc8eb4325b38392dbf84ea17b5e27b0917f75a31517ee9e864820faf6b30de4beb28ff17fb88fa16d4f042f698e2304542d01cba3e2392f63bb26f
-DIST strongswan-5.5.2.tar.bz2 4759802 SHA256 da976fca836f05fc7b7a38baab299745f960cb7640319969d239d8aa4ace9f6a SHA512 dc5fec71e40d1366214c4b2a73ee3f2927edc3b768109f760b6993236a282ac376a66199aa4768d0ba26750a64f940953a92b2600ca1b1d8330d18df9486549d WHIRLPOOL 5a7b3430722e4e2b5354bee2734ee06562f2ee9cffe59f70450b987420e225f7fef71266b36c3679e78276a7993b13faeb0712b10486da8e5af72f0d8e9fec1d
+DIST strongswan-5.5.3.tar.bz2 4768820 SHA256 c5ea54b199174708de11af9b8f4ecf28b5b0743d4bc0e380e741f25b28c0f8d4 SHA512 0b0b25d2102c98cda54300dc8c3c3a49a55e64f7c695dda65a24f2194f19bce0b7aab9e4f7486c243b552f9d1a94867d6a8782ee504aad1c9973809706d599ac WHIRLPOOL 80bc68ed5afc46fa7585c806cc52713d47495664ea0c37746198918bad9814d14d261be921158b6c7a9cd5e8c84733b0b23b80b7c6338005adca38974241d7f1
diff --git a/net-vpn/strongswan/strongswan-5.5.2.ebuild b/net-vpn/strongswan/strongswan-5.5.3.ebuild
similarity index 100%
rename from net-vpn/strongswan/strongswan-5.5.2.ebuild
rename to net-vpn/strongswan/strongswan-5.5.3.ebuild
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2017-06-18 14:01 Agostino Sarubbo
0 siblings, 0 replies; 112+ messages in thread
From: Agostino Sarubbo @ 2017-06-18 14:01 UTC (permalink / raw
To: gentoo-commits
commit: 1c85cde966bf4cda807e6f71d481b6a7cad9b3c4
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Sun Jun 18 14:00:15 2017 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Sun Jun 18 14:00:15 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=1c85cde9
net-vpn/strongswan: amd64 stable wrt bug #620256
Package-Manager: Portage-2.3.5, Repoman-2.3.1
RepoMan-Options: --include-arches="amd64"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.5.3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.5.3.ebuild b/net-vpn/strongswan/strongswan-5.5.3.ebuild
index 02a431050dc..5b0557684d8 100644
--- a/net-vpn/strongswan/strongswan-5.5.3.ebuild
+++ b/net-vpn/strongswan/strongswan-5.5.3.ebuild
@@ -10,7 +10,7 @@ SRC_URI="http://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="~amd64 ~arm ~ppc ~ppc64 x86"
+KEYWORDS="amd64 ~arm ~ppc ~ppc64 x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2017-06-23 4:38 Markus Meier
0 siblings, 0 replies; 112+ messages in thread
From: Markus Meier @ 2017-06-23 4:38 UTC (permalink / raw
To: gentoo-commits
commit: 541d13ecd01ad6fa644fc0d58a79a0857b08732d
Author: Markus Meier <maekke <AT> gentoo <DOT> org>
AuthorDate: Fri Jun 23 04:38:43 2017 +0000
Commit: Markus Meier <maekke <AT> gentoo <DOT> org>
CommitDate: Fri Jun 23 04:38:43 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=541d13ec
net-vpn/strongswan: arm stable, bug #620256
Package-Manager: Portage-2.3.6, Repoman-2.3.1
RepoMan-Options: --include-arches="arm"
net-vpn/strongswan/strongswan-5.5.3.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.5.3.ebuild b/net-vpn/strongswan/strongswan-5.5.3.ebuild
index 64c766aa40d..7ec9a3ae14f 100644
--- a/net-vpn/strongswan/strongswan-5.5.3.ebuild
+++ b/net-vpn/strongswan/strongswan-5.5.3.ebuild
@@ -10,7 +10,7 @@ SRC_URI="http://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="amd64 ~arm ppc ~ppc64 x86"
+KEYWORDS="amd64 arm ppc ~ppc64 x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2017-07-16 0:19 Aaron Bauman
0 siblings, 0 replies; 112+ messages in thread
From: Aaron Bauman @ 2017-07-16 0:19 UTC (permalink / raw
To: gentoo-commits
commit: 9bea4795e774fd839e1d0b27784c34cbf00f7631
Author: Aaron Bauman <bman <AT> gentoo <DOT> org>
AuthorDate: Sun Jul 16 00:18:52 2017 +0000
Commit: Aaron Bauman <bman <AT> gentoo <DOT> org>
CommitDate: Sun Jul 16 00:18:52 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9bea4795
net-vpn/strongswan: drop vulnerable wrt sec bug #620256
net-vpn/strongswan/Manifest | 1 -
net-vpn/strongswan/strongswan-5.3.4.ebuild | 302 -----------------------------
2 files changed, 303 deletions(-)
diff --git a/net-vpn/strongswan/Manifest b/net-vpn/strongswan/Manifest
index 57e8fe057bc..b3e0c053c88 100644
--- a/net-vpn/strongswan/Manifest
+++ b/net-vpn/strongswan/Manifest
@@ -1,2 +1 @@
-DIST strongswan-5.3.4.tar.bz2 4418300 SHA256 938ad1f7b612e039f1d32333f4865160be70f9fb3c207a31127d0168116459aa SHA512 2ab1c9a5d285c7f85b130a827b9525dd238a6d2b4c0c0e15a38a5e09dbb58228bfe4a6ab6c57ba6781f5d0d7f565cbb82e0ee2feac758c8033894c969acb8155 WHIRLPOOL f7ffbefd62cc8eb4325b38392dbf84ea17b5e27b0917f75a31517ee9e864820faf6b30de4beb28ff17fb88fa16d4f042f698e2304542d01cba3e2392f63bb26f
DIST strongswan-5.5.3.tar.bz2 4768820 SHA256 c5ea54b199174708de11af9b8f4ecf28b5b0743d4bc0e380e741f25b28c0f8d4 SHA512 0b0b25d2102c98cda54300dc8c3c3a49a55e64f7c695dda65a24f2194f19bce0b7aab9e4f7486c243b552f9d1a94867d6a8782ee504aad1c9973809706d599ac WHIRLPOOL 80bc68ed5afc46fa7585c806cc52713d47495664ea0c37746198918bad9814d14d261be921158b6c7a9cd5e8c84733b0b23b80b7c6338005adca38974241d7f1
diff --git a/net-vpn/strongswan/strongswan-5.3.4.ebuild b/net-vpn/strongswan/strongswan-5.3.4.ebuild
deleted file mode 100644
index 0007796d7eb..00000000000
--- a/net-vpn/strongswan/strongswan-5.3.4.ebuild
+++ /dev/null
@@ -1,302 +0,0 @@
-# Copyright 1999-2016 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=5
-inherit eutils linux-info systemd user
-
-DESCRIPTION="IPsec-based VPN solution focused on security and ease of use, supporting IKEv1/IKEv2 and MOBIKE"
-HOMEPAGE="http://www.strongswan.org/"
-SRC_URI="http://download.strongswan.org/${P}.tar.bz2"
-
-LICENSE="GPL-2 RSA DES"
-SLOT="0"
-KEYWORDS="amd64 arm ppc ~ppc64 x86"
-IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite pam pkcs11"
-
-STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
-STRONGSWAN_PLUGINS_OPT="blowfish ccm ctr gcm ha ipseckey ntru padlock rdrand unbound whitelist"
-for mod in $STRONGSWAN_PLUGINS_STD; do
- IUSE="${IUSE} +strongswan_plugins_${mod}"
-done
-
-for mod in $STRONGSWAN_PLUGINS_OPT; do
- IUSE="${IUSE} strongswan_plugins_${mod}"
-done
-
-COMMON_DEPEND="!net-misc/openswan
- gmp? ( >=dev-libs/gmp-4.1.5:= )
- gcrypt? ( dev-libs/libgcrypt:0 )
- caps? ( sys-libs/libcap )
- curl? ( net-misc/curl )
- ldap? ( net-nds/openldap )
- openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist] )
- mysql? ( virtual/mysql )
- sqlite? ( >=dev-db/sqlite-3.3.1 )
- networkmanager? ( net-misc/networkmanager )
- pam? ( sys-libs/pam )
- strongswan_plugins_unbound? ( net-dns/unbound )"
-DEPEND="${COMMON_DEPEND}
- virtual/linux-sources
- sys-kernel/linux-headers"
-RDEPEND="${COMMON_DEPEND}
- virtual/logger
- sys-apps/iproute2
- !net-vpn/libreswan
- selinux? ( sec-policy/selinux-ipsec )"
-
-UGID="ipsec"
-
-pkg_setup() {
- linux-info_pkg_setup
- elog "Linux kernel version: ${KV_FULL}"
-
- if ! kernel_is -ge 2 6 16; then
- eerror
- eerror "This ebuild currently only supports ${PN} with the"
- eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
- eerror
- fi
-
- if kernel_is -lt 2 6 34; then
- ewarn
- ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
- ewarn
-
- if kernel_is -lt 2 6 29; then
- ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
- ewarn "include all required IPv6 modules even if you just intend"
- ewarn "to run on IPv4 only."
- ewarn
- ewarn "This has been fixed with kernels >= 2.6.29."
- ewarn
- fi
-
- if kernel_is -lt 2 6 33; then
- ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
- ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
- ewarn "miss SHA384 and SHA512 HMAC support altogether."
- ewarn
- ewarn "If you need any of those features, please use kernel >= 2.6.33."
- ewarn
- fi
-
- if kernel_is -lt 2 6 34; then
- ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
- ewarn "ESP cipher is only included in kernels >= 2.6.34."
- ewarn
- ewarn "If you need it, please use kernel >= 2.6.34."
- ewarn
- fi
- fi
-
- if use non-root; then
- enewgroup ${UGID}
- enewuser ${UGID} -1 -1 -1 ${UGID}
- fi
-}
-
-src_prepare() {
- epatch_user
-}
-
-src_configure() {
- local myconf=""
-
- if use non-root; then
- myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
- fi
-
- # If a user has already enabled db support, those plugins will
- # most likely be desired as well. Besides they don't impose new
- # dependencies and come at no cost (except for space).
- if use mysql || use sqlite; then
- myconf="${myconf} --enable-attr-sql --enable-sql"
- fi
-
- # strongSwan builds and installs static libs by default which are
- # useless to the user (and to strongSwan for that matter) because no
- # header files or alike get installed... so disabling them is safe.
- if use pam && use eap; then
- myconf="${myconf} --enable-eap-gtc"
- else
- myconf="${myconf} --disable-eap-gtc"
- fi
-
- for mod in $STRONGSWAN_PLUGINS_STD; do
- if use strongswan_plugins_${mod}; then
- myconf+=" --enable-${mod}"
- fi
- done
-
- for mod in $STRONGSWAN_PLUGINS_OPT; do
- if use strongswan_plugins_${mod}; then
- myconf+=" --enable-${mod}"
- fi
- done
-
- econf \
- --disable-static \
- --enable-ikev1 \
- --enable-ikev2 \
- --enable-swanctl \
- --enable-socket-dynamic \
- $(use_with caps capabilities libcap) \
- $(use_enable curl) \
- $(use_enable constraints) \
- $(use_enable ldap) \
- $(use_enable debug leak-detective) \
- $(use_enable dhcp) \
- $(use_enable eap eap-sim) \
- $(use_enable eap eap-sim-file) \
- $(use_enable eap eap-simaka-sql) \
- $(use_enable eap eap-simaka-pseudonym) \
- $(use_enable eap eap-simaka-reauth) \
- $(use_enable eap eap-identity) \
- $(use_enable eap eap-md5) \
- $(use_enable eap eap-aka) \
- $(use_enable eap eap-aka-3gpp2) \
- $(use_enable eap md4) \
- $(use_enable eap eap-mschapv2) \
- $(use_enable eap eap-radius) \
- $(use_enable eap eap-tls) \
- $(use_enable eap xauth-eap) \
- $(use_enable farp) \
- $(use_enable gmp) \
- $(use_enable gcrypt) \
- $(use_enable mysql) \
- $(use_enable networkmanager nm) \
- $(use_enable openssl) \
- $(use_enable pam xauth-pam) \
- $(use_enable pkcs11) \
- $(use_enable sqlite) \
- "$(systemd_with_unitdir)" \
- ${myconf}
-}
-
-src_install() {
- emake DESTDIR="${D}" install
-
- doinitd "${FILESDIR}"/ipsec
-
- local dir_ugid
- if use non-root; then
- fowners ${UGID}:${UGID} \
- /etc/ipsec.conf \
- /etc/strongswan.conf
-
- dir_ugid="${UGID}"
- else
- dir_ugid="root"
- fi
-
- diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
- dodir /etc/ipsec.d \
- /etc/ipsec.d/aacerts \
- /etc/ipsec.d/acerts \
- /etc/ipsec.d/cacerts \
- /etc/ipsec.d/certs \
- /etc/ipsec.d/crls \
- /etc/ipsec.d/ocspcerts \
- /etc/ipsec.d/private \
- /etc/ipsec.d/reqs
-
- dodoc NEWS README TODO || die
-
- # shared libs are used only internally and there are no static libs,
- # so it's safe to get rid of the .la files
- find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
-}
-
-pkg_preinst() {
- has_version "<net-vpn/strongswan-4.3.6-r1"
- upgrade_from_leq_4_3_6=$(( !$? ))
-
- has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
- previous_4_3_6_with_caps=$(( !$? ))
-}
-
-pkg_postinst() {
- if ! use openssl && ! use gcrypt; then
- elog
- elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
- elog "Please note that this might effect availability and speed of some"
- elog "cryptographic features. You are advised to enable the OpenSSL plugin."
- elif ! use openssl; then
- elog
- elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
- elog "availability and speed of some cryptographic features. There will be"
- elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
- elog "25, 26) and ECDSA."
- fi
-
- if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
- chmod 0750 "${ROOT}"/etc/ipsec.d \
- "${ROOT}"/etc/ipsec.d/aacerts \
- "${ROOT}"/etc/ipsec.d/acerts \
- "${ROOT}"/etc/ipsec.d/cacerts \
- "${ROOT}"/etc/ipsec.d/certs \
- "${ROOT}"/etc/ipsec.d/crls \
- "${ROOT}"/etc/ipsec.d/ocspcerts \
- "${ROOT}"/etc/ipsec.d/private \
- "${ROOT}"/etc/ipsec.d/reqs
-
- ewarn
- ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
- ewarn "security reasons. Your system installed directories have been"
- ewarn "updated accordingly. Please check if necessary."
- ewarn
-
- if [[ $previous_4_3_6_with_caps == 1 ]]; then
- if ! use non-root; then
- ewarn
- ewarn "IMPORTANT: You previously had ${PN} installed without root"
- ewarn "privileges because it was implied by the 'caps' USE flag."
- ewarn "This has been changed. If you want ${PN} with user privileges,"
- ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
- ewarn
- fi
- fi
- fi
- if ! use caps && ! use non-root; then
- ewarn
- ewarn "You have decided to run ${PN} with root privileges and built it"
- ewarn "without support for POSIX capability dropping. It is generally"
- ewarn "strongly suggested that you reconsider- especially if you intend"
- ewarn "to run ${PN} as server with a public ip address."
- ewarn
- ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
- ewarn
- fi
- if use non-root; then
- elog
- elog "${PN} has been installed without superuser privileges (USE=non-root)."
- elog "This imposes several limitations mainly to the IKEv1 daemon 'pluto'"
- elog "but also a few to the IKEv2 daemon 'charon'."
- elog
- elog "Please carefully read: http://wiki.strongswan.org/wiki/nonRoot"
- elog
- elog "pluto uses a helper script by default to insert/remove routing and"
- elog "policy rules upon connection start/stop which requires superuser"
- elog "privileges. charon in contrast does this internally and can do so"
- elog "even with reduced (user) privileges."
- elog
- elog "Thus if you require IKEv1 (pluto) or need to specify a custom updown"
- elog "script to pluto or charon which requires superuser privileges, you"
- elog "can work around this limitation by using sudo to grant the"
- elog "user \"ipsec\" the appropriate rights."
- elog "For example (the default case):"
- elog "/etc/sudoers:"
- elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
- elog "Under the specific connection block in /etc/ipsec.conf:"
- elog " leftupdown=\"sudo -E ipsec _updown iptables\""
- elog
- fi
- elog
- elog "Make sure you have _all_ required kernel modules available including"
- elog "the appropriate cryptographic algorithms. A list is available at:"
- elog " http://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
- elog
- elog "The up-to-date manual is available online at:"
- elog " http://wiki.strongswan.org/"
- elog
-}
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2017-09-24 17:31 Patrick Lauer
0 siblings, 0 replies; 112+ messages in thread
From: Patrick Lauer @ 2017-09-24 17:31 UTC (permalink / raw
To: gentoo-commits
commit: 4a46b9ce178543306ede835036cf6116e4b70fc5
Author: Patrick Lauer <patrick <AT> gentoo <DOT> org>
AuthorDate: Sun Sep 24 17:30:10 2017 +0000
Commit: Patrick Lauer <patrick <AT> gentoo <DOT> org>
CommitDate: Sun Sep 24 17:31:18 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4a46b9ce
net-vpn/strongswan: Bump
Package-Manager: Portage-2.3.10, Repoman-2.3.3
net-vpn/strongswan/Manifest | 1 +
net-vpn/strongswan/strongswan-5.6.0.ebuild | 302 +++++++++++++++++++++++++++++
2 files changed, 303 insertions(+)
diff --git a/net-vpn/strongswan/Manifest b/net-vpn/strongswan/Manifest
index b3e0c053c88..a413933a7cd 100644
--- a/net-vpn/strongswan/Manifest
+++ b/net-vpn/strongswan/Manifest
@@ -1 +1,2 @@
DIST strongswan-5.5.3.tar.bz2 4768820 SHA256 c5ea54b199174708de11af9b8f4ecf28b5b0743d4bc0e380e741f25b28c0f8d4 SHA512 0b0b25d2102c98cda54300dc8c3c3a49a55e64f7c695dda65a24f2194f19bce0b7aab9e4f7486c243b552f9d1a94867d6a8782ee504aad1c9973809706d599ac WHIRLPOOL 80bc68ed5afc46fa7585c806cc52713d47495664ea0c37746198918bad9814d14d261be921158b6c7a9cd5e8c84733b0b23b80b7c6338005adca38974241d7f1
+DIST strongswan-5.6.0.tar.bz2 4850722 SHA256 a14dc0d92634ed52730bfc76a76db30943a28ed3c65a560066e1e9f785827b13 SHA512 9362069a01c3642e62864d88fdb409a3c7514bf7c92cbe36e552c6a80915119cf5bb91c39592aab2d15b562684a0628a764e4fa7636d3b5fd2ebaf165c0ce649 WHIRLPOOL 5aeb256c254aae7d5923984355bcdb106d8cae6e7780df2c7849aa1fd8d5a27d6ad9a47c6d926c7dee2dff605f56bd2697034d4055dacdde1aea57168d8672af
diff --git a/net-vpn/strongswan/strongswan-5.6.0.ebuild b/net-vpn/strongswan/strongswan-5.6.0.ebuild
new file mode 100644
index 00000000000..d7477edc168
--- /dev/null
+++ b/net-vpn/strongswan/strongswan-5.6.0.ebuild
@@ -0,0 +1,302 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+inherit eutils linux-info systemd user
+
+DESCRIPTION="IPsec-based VPN solution focused on security and ease of use, supporting IKEv1/IKEv2 and MOBIKE"
+HOMEPAGE="http://www.strongswan.org/"
+SRC_URI="http://download.strongswan.org/${P}.tar.bz2"
+
+LICENSE="GPL-2 RSA DES"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~ppc ~ppc64 ~x86"
+IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite pam pkcs11"
+
+STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
+STRONGSWAN_PLUGINS_OPT="blowfish ccm ctr gcm ha ipseckey ntru padlock rdrand unbound whitelist"
+for mod in $STRONGSWAN_PLUGINS_STD; do
+ IUSE="${IUSE} +strongswan_plugins_${mod}"
+done
+
+for mod in $STRONGSWAN_PLUGINS_OPT; do
+ IUSE="${IUSE} strongswan_plugins_${mod}"
+done
+
+COMMON_DEPEND="!net-misc/openswan
+ gmp? ( >=dev-libs/gmp-4.1.5:= )
+ gcrypt? ( dev-libs/libgcrypt:0 )
+ caps? ( sys-libs/libcap )
+ curl? ( net-misc/curl )
+ ldap? ( net-nds/openldap )
+ openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist] )
+ mysql? ( virtual/mysql )
+ sqlite? ( >=dev-db/sqlite-3.3.1 )
+ networkmanager? ( net-misc/networkmanager )
+ pam? ( sys-libs/pam )
+ strongswan_plugins_unbound? ( net-dns/unbound net-libs/ldns )"
+DEPEND="${COMMON_DEPEND}
+ virtual/linux-sources
+ sys-kernel/linux-headers"
+RDEPEND="${COMMON_DEPEND}
+ virtual/logger
+ sys-apps/iproute2
+ !net-vpn/libreswan
+ selinux? ( sec-policy/selinux-ipsec )"
+
+UGID="ipsec"
+
+pkg_setup() {
+ linux-info_pkg_setup
+ elog "Linux kernel version: ${KV_FULL}"
+
+ if ! kernel_is -ge 2 6 16; then
+ eerror
+ eerror "This ebuild currently only supports ${PN} with the"
+ eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
+ eerror
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn
+ ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
+ ewarn
+
+ if kernel_is -lt 2 6 29; then
+ ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
+ ewarn "include all required IPv6 modules even if you just intend"
+ ewarn "to run on IPv4 only."
+ ewarn
+ ewarn "This has been fixed with kernels >= 2.6.29."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 33; then
+ ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
+ ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
+ ewarn "miss SHA384 and SHA512 HMAC support altogether."
+ ewarn
+ ewarn "If you need any of those features, please use kernel >= 2.6.33."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
+ ewarn "ESP cipher is only included in kernels >= 2.6.34."
+ ewarn
+ ewarn "If you need it, please use kernel >= 2.6.34."
+ ewarn
+ fi
+ fi
+
+ if use non-root; then
+ enewgroup ${UGID}
+ enewuser ${UGID} -1 -1 -1 ${UGID}
+ fi
+}
+
+src_prepare() {
+ epatch_user
+}
+
+src_configure() {
+ local myconf=""
+
+ if use non-root; then
+ myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
+ fi
+
+ # If a user has already enabled db support, those plugins will
+ # most likely be desired as well. Besides they don't impose new
+ # dependencies and come at no cost (except for space).
+ if use mysql || use sqlite; then
+ myconf="${myconf} --enable-attr-sql --enable-sql"
+ fi
+
+ # strongSwan builds and installs static libs by default which are
+ # useless to the user (and to strongSwan for that matter) because no
+ # header files or alike get installed... so disabling them is safe.
+ if use pam && use eap; then
+ myconf="${myconf} --enable-eap-gtc"
+ else
+ myconf="${myconf} --disable-eap-gtc"
+ fi
+
+ for mod in $STRONGSWAN_PLUGINS_STD; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ for mod in $STRONGSWAN_PLUGINS_OPT; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ econf \
+ --disable-static \
+ --enable-ikev1 \
+ --enable-ikev2 \
+ --enable-swanctl \
+ --enable-socket-dynamic \
+ $(use_with caps capabilities libcap) \
+ $(use_enable curl) \
+ $(use_enable constraints) \
+ $(use_enable ldap) \
+ $(use_enable debug leak-detective) \
+ $(use_enable dhcp) \
+ $(use_enable eap eap-sim) \
+ $(use_enable eap eap-sim-file) \
+ $(use_enable eap eap-simaka-sql) \
+ $(use_enable eap eap-simaka-pseudonym) \
+ $(use_enable eap eap-simaka-reauth) \
+ $(use_enable eap eap-identity) \
+ $(use_enable eap eap-md5) \
+ $(use_enable eap eap-aka) \
+ $(use_enable eap eap-aka-3gpp2) \
+ $(use_enable eap md4) \
+ $(use_enable eap eap-mschapv2) \
+ $(use_enable eap eap-radius) \
+ $(use_enable eap eap-tls) \
+ $(use_enable eap xauth-eap) \
+ $(use_enable farp) \
+ $(use_enable gmp) \
+ $(use_enable gcrypt) \
+ $(use_enable mysql) \
+ $(use_enable networkmanager nm) \
+ $(use_enable openssl) \
+ $(use_enable pam xauth-pam) \
+ $(use_enable pkcs11) \
+ $(use_enable sqlite) \
+ "$(systemd_with_unitdir)" \
+ ${myconf}
+}
+
+src_install() {
+ emake DESTDIR="${D}" install
+
+ doinitd "${FILESDIR}"/ipsec
+
+ local dir_ugid
+ if use non-root; then
+ fowners ${UGID}:${UGID} \
+ /etc/ipsec.conf \
+ /etc/strongswan.conf
+
+ dir_ugid="${UGID}"
+ else
+ dir_ugid="root"
+ fi
+
+ diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
+ dodir /etc/ipsec.d \
+ /etc/ipsec.d/aacerts \
+ /etc/ipsec.d/acerts \
+ /etc/ipsec.d/cacerts \
+ /etc/ipsec.d/certs \
+ /etc/ipsec.d/crls \
+ /etc/ipsec.d/ocspcerts \
+ /etc/ipsec.d/private \
+ /etc/ipsec.d/reqs
+
+ dodoc NEWS README TODO || die
+
+ # shared libs are used only internally and there are no static libs,
+ # so it's safe to get rid of the .la files
+ find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
+}
+
+pkg_preinst() {
+ has_version "<net-vpn/strongswan-4.3.6-r1"
+ upgrade_from_leq_4_3_6=$(( !$? ))
+
+ has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
+ previous_4_3_6_with_caps=$(( !$? ))
+}
+
+pkg_postinst() {
+ if ! use openssl && ! use gcrypt; then
+ elog
+ elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
+ elog "Please note that this might effect availability and speed of some"
+ elog "cryptographic features. You are advised to enable the OpenSSL plugin."
+ elif ! use openssl; then
+ elog
+ elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
+ elog "availability and speed of some cryptographic features. There will be"
+ elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
+ elog "25, 26) and ECDSA."
+ fi
+
+ if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
+ chmod 0750 "${ROOT}"/etc/ipsec.d \
+ "${ROOT}"/etc/ipsec.d/aacerts \
+ "${ROOT}"/etc/ipsec.d/acerts \
+ "${ROOT}"/etc/ipsec.d/cacerts \
+ "${ROOT}"/etc/ipsec.d/certs \
+ "${ROOT}"/etc/ipsec.d/crls \
+ "${ROOT}"/etc/ipsec.d/ocspcerts \
+ "${ROOT}"/etc/ipsec.d/private \
+ "${ROOT}"/etc/ipsec.d/reqs
+
+ ewarn
+ ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
+ ewarn "security reasons. Your system installed directories have been"
+ ewarn "updated accordingly. Please check if necessary."
+ ewarn
+
+ if [[ $previous_4_3_6_with_caps == 1 ]]; then
+ if ! use non-root; then
+ ewarn
+ ewarn "IMPORTANT: You previously had ${PN} installed without root"
+ ewarn "privileges because it was implied by the 'caps' USE flag."
+ ewarn "This has been changed. If you want ${PN} with user privileges,"
+ ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
+ ewarn
+ fi
+ fi
+ fi
+ if ! use caps && ! use non-root; then
+ ewarn
+ ewarn "You have decided to run ${PN} with root privileges and built it"
+ ewarn "without support for POSIX capability dropping. It is generally"
+ ewarn "strongly suggested that you reconsider- especially if you intend"
+ ewarn "to run ${PN} as server with a public ip address."
+ ewarn
+ ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
+ ewarn
+ fi
+ if use non-root; then
+ elog
+ elog "${PN} has been installed without superuser privileges (USE=non-root)."
+ elog "This imposes several limitations mainly to the IKEv1 daemon 'pluto'"
+ elog "but also a few to the IKEv2 daemon 'charon'."
+ elog
+ elog "Please carefully read: http://wiki.strongswan.org/wiki/nonRoot"
+ elog
+ elog "pluto uses a helper script by default to insert/remove routing and"
+ elog "policy rules upon connection start/stop which requires superuser"
+ elog "privileges. charon in contrast does this internally and can do so"
+ elog "even with reduced (user) privileges."
+ elog
+ elog "Thus if you require IKEv1 (pluto) or need to specify a custom updown"
+ elog "script to pluto or charon which requires superuser privileges, you"
+ elog "can work around this limitation by using sudo to grant the"
+ elog "user \"ipsec\" the appropriate rights."
+ elog "For example (the default case):"
+ elog "/etc/sudoers:"
+ elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
+ elog "Under the specific connection block in /etc/ipsec.conf:"
+ elog " leftupdown=\"sudo -E ipsec _updown iptables\""
+ elog
+ fi
+ elog
+ elog "Make sure you have _all_ required kernel modules available including"
+ elog "the appropriate cryptographic algorithms. A list is available at:"
+ elog " http://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
+ elog
+ elog "The up-to-date manual is available online at:"
+ elog " http://wiki.strongswan.org/"
+ elog
+}
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2017-09-25 13:22 Patrick Lauer
0 siblings, 0 replies; 112+ messages in thread
From: Patrick Lauer @ 2017-09-25 13:22 UTC (permalink / raw
To: gentoo-commits
commit: 38874faf03364d3ddbd10a14a316f46f3d3f829d
Author: Patrick Lauer <patrick <AT> gentoo <DOT> org>
AuthorDate: Mon Sep 25 13:22:24 2017 +0000
Commit: Patrick Lauer <patrick <AT> gentoo <DOT> org>
CommitDate: Mon Sep 25 13:22:38 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=38874faf
net-vpn/strongswan: Add eap-dynamic feature #631944
Package-Manager: Portage-2.3.10, Repoman-2.3.3
net-vpn/strongswan/strongswan-5.6.0-r1.ebuild | 303 ++++++++++++++++++++++++++
1 file changed, 303 insertions(+)
diff --git a/net-vpn/strongswan/strongswan-5.6.0-r1.ebuild b/net-vpn/strongswan/strongswan-5.6.0-r1.ebuild
new file mode 100644
index 00000000000..dc0518eb40a
--- /dev/null
+++ b/net-vpn/strongswan/strongswan-5.6.0-r1.ebuild
@@ -0,0 +1,303 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+inherit eutils linux-info systemd user
+
+DESCRIPTION="IPsec-based VPN solution focused on security and ease of use, supporting IKEv1/IKEv2 and MOBIKE"
+HOMEPAGE="http://www.strongswan.org/"
+SRC_URI="http://download.strongswan.org/${P}.tar.bz2"
+
+LICENSE="GPL-2 RSA DES"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~ppc ~ppc64 ~x86"
+IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite pam pkcs11"
+
+STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
+STRONGSWAN_PLUGINS_OPT="blowfish ccm ctr gcm ha ipseckey ntru padlock rdrand unbound whitelist"
+for mod in $STRONGSWAN_PLUGINS_STD; do
+ IUSE="${IUSE} +strongswan_plugins_${mod}"
+done
+
+for mod in $STRONGSWAN_PLUGINS_OPT; do
+ IUSE="${IUSE} strongswan_plugins_${mod}"
+done
+
+COMMON_DEPEND="!net-misc/openswan
+ gmp? ( >=dev-libs/gmp-4.1.5:= )
+ gcrypt? ( dev-libs/libgcrypt:0 )
+ caps? ( sys-libs/libcap )
+ curl? ( net-misc/curl )
+ ldap? ( net-nds/openldap )
+ openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist] )
+ mysql? ( virtual/mysql )
+ sqlite? ( >=dev-db/sqlite-3.3.1 )
+ networkmanager? ( net-misc/networkmanager )
+ pam? ( sys-libs/pam )
+ strongswan_plugins_unbound? ( net-dns/unbound net-libs/ldns )"
+DEPEND="${COMMON_DEPEND}
+ virtual/linux-sources
+ sys-kernel/linux-headers"
+RDEPEND="${COMMON_DEPEND}
+ virtual/logger
+ sys-apps/iproute2
+ !net-vpn/libreswan
+ selinux? ( sec-policy/selinux-ipsec )"
+
+UGID="ipsec"
+
+pkg_setup() {
+ linux-info_pkg_setup
+ elog "Linux kernel version: ${KV_FULL}"
+
+ if ! kernel_is -ge 2 6 16; then
+ eerror
+ eerror "This ebuild currently only supports ${PN} with the"
+ eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
+ eerror
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn
+ ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
+ ewarn
+
+ if kernel_is -lt 2 6 29; then
+ ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
+ ewarn "include all required IPv6 modules even if you just intend"
+ ewarn "to run on IPv4 only."
+ ewarn
+ ewarn "This has been fixed with kernels >= 2.6.29."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 33; then
+ ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
+ ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
+ ewarn "miss SHA384 and SHA512 HMAC support altogether."
+ ewarn
+ ewarn "If you need any of those features, please use kernel >= 2.6.33."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
+ ewarn "ESP cipher is only included in kernels >= 2.6.34."
+ ewarn
+ ewarn "If you need it, please use kernel >= 2.6.34."
+ ewarn
+ fi
+ fi
+
+ if use non-root; then
+ enewgroup ${UGID}
+ enewuser ${UGID} -1 -1 -1 ${UGID}
+ fi
+}
+
+src_prepare() {
+ epatch_user
+}
+
+src_configure() {
+ local myconf=""
+
+ if use non-root; then
+ myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
+ fi
+
+ # If a user has already enabled db support, those plugins will
+ # most likely be desired as well. Besides they don't impose new
+ # dependencies and come at no cost (except for space).
+ if use mysql || use sqlite; then
+ myconf="${myconf} --enable-attr-sql --enable-sql"
+ fi
+
+ # strongSwan builds and installs static libs by default which are
+ # useless to the user (and to strongSwan for that matter) because no
+ # header files or alike get installed... so disabling them is safe.
+ if use pam && use eap; then
+ myconf="${myconf} --enable-eap-gtc"
+ else
+ myconf="${myconf} --disable-eap-gtc"
+ fi
+
+ for mod in $STRONGSWAN_PLUGINS_STD; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ for mod in $STRONGSWAN_PLUGINS_OPT; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ econf \
+ --disable-static \
+ --enable-ikev1 \
+ --enable-ikev2 \
+ --enable-swanctl \
+ --enable-socket-dynamic \
+ $(use_with caps capabilities libcap) \
+ $(use_enable curl) \
+ $(use_enable constraints) \
+ $(use_enable ldap) \
+ $(use_enable debug leak-detective) \
+ $(use_enable dhcp) \
+ $(use_enable eap eap-sim) \
+ $(use_enable eap eap-sim-file) \
+ $(use_enable eap eap-simaka-sql) \
+ $(use_enable eap eap-simaka-pseudonym) \
+ $(use_enable eap eap-simaka-reauth) \
+ $(use_enable eap eap-identity) \
+ $(use_enable eap eap-md5) \
+ $(use_enable eap eap-aka) \
+ $(use_enable eap eap-aka-3gpp2) \
+ $(use_enable eap md4) \
+ $(use_enable eap eap-mschapv2) \
+ $(use_enable eap eap-radius) \
+ $(use_enable eap eap-tls) \
+ $(use_enable eap xauth-eap) \
+ $(use_enable eap eap-dynamic) \
+ $(use_enable farp) \
+ $(use_enable gmp) \
+ $(use_enable gcrypt) \
+ $(use_enable mysql) \
+ $(use_enable networkmanager nm) \
+ $(use_enable openssl) \
+ $(use_enable pam xauth-pam) \
+ $(use_enable pkcs11) \
+ $(use_enable sqlite) \
+ "$(systemd_with_unitdir)" \
+ ${myconf}
+}
+
+src_install() {
+ emake DESTDIR="${D}" install
+
+ doinitd "${FILESDIR}"/ipsec
+
+ local dir_ugid
+ if use non-root; then
+ fowners ${UGID}:${UGID} \
+ /etc/ipsec.conf \
+ /etc/strongswan.conf
+
+ dir_ugid="${UGID}"
+ else
+ dir_ugid="root"
+ fi
+
+ diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
+ dodir /etc/ipsec.d \
+ /etc/ipsec.d/aacerts \
+ /etc/ipsec.d/acerts \
+ /etc/ipsec.d/cacerts \
+ /etc/ipsec.d/certs \
+ /etc/ipsec.d/crls \
+ /etc/ipsec.d/ocspcerts \
+ /etc/ipsec.d/private \
+ /etc/ipsec.d/reqs
+
+ dodoc NEWS README TODO || die
+
+ # shared libs are used only internally and there are no static libs,
+ # so it's safe to get rid of the .la files
+ find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
+}
+
+pkg_preinst() {
+ has_version "<net-vpn/strongswan-4.3.6-r1"
+ upgrade_from_leq_4_3_6=$(( !$? ))
+
+ has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
+ previous_4_3_6_with_caps=$(( !$? ))
+}
+
+pkg_postinst() {
+ if ! use openssl && ! use gcrypt; then
+ elog
+ elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
+ elog "Please note that this might effect availability and speed of some"
+ elog "cryptographic features. You are advised to enable the OpenSSL plugin."
+ elif ! use openssl; then
+ elog
+ elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
+ elog "availability and speed of some cryptographic features. There will be"
+ elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
+ elog "25, 26) and ECDSA."
+ fi
+
+ if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
+ chmod 0750 "${ROOT}"/etc/ipsec.d \
+ "${ROOT}"/etc/ipsec.d/aacerts \
+ "${ROOT}"/etc/ipsec.d/acerts \
+ "${ROOT}"/etc/ipsec.d/cacerts \
+ "${ROOT}"/etc/ipsec.d/certs \
+ "${ROOT}"/etc/ipsec.d/crls \
+ "${ROOT}"/etc/ipsec.d/ocspcerts \
+ "${ROOT}"/etc/ipsec.d/private \
+ "${ROOT}"/etc/ipsec.d/reqs
+
+ ewarn
+ ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
+ ewarn "security reasons. Your system installed directories have been"
+ ewarn "updated accordingly. Please check if necessary."
+ ewarn
+
+ if [[ $previous_4_3_6_with_caps == 1 ]]; then
+ if ! use non-root; then
+ ewarn
+ ewarn "IMPORTANT: You previously had ${PN} installed without root"
+ ewarn "privileges because it was implied by the 'caps' USE flag."
+ ewarn "This has been changed. If you want ${PN} with user privileges,"
+ ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
+ ewarn
+ fi
+ fi
+ fi
+ if ! use caps && ! use non-root; then
+ ewarn
+ ewarn "You have decided to run ${PN} with root privileges and built it"
+ ewarn "without support for POSIX capability dropping. It is generally"
+ ewarn "strongly suggested that you reconsider- especially if you intend"
+ ewarn "to run ${PN} as server with a public ip address."
+ ewarn
+ ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
+ ewarn
+ fi
+ if use non-root; then
+ elog
+ elog "${PN} has been installed without superuser privileges (USE=non-root)."
+ elog "This imposes several limitations mainly to the IKEv1 daemon 'pluto'"
+ elog "but also a few to the IKEv2 daemon 'charon'."
+ elog
+ elog "Please carefully read: http://wiki.strongswan.org/wiki/nonRoot"
+ elog
+ elog "pluto uses a helper script by default to insert/remove routing and"
+ elog "policy rules upon connection start/stop which requires superuser"
+ elog "privileges. charon in contrast does this internally and can do so"
+ elog "even with reduced (user) privileges."
+ elog
+ elog "Thus if you require IKEv1 (pluto) or need to specify a custom updown"
+ elog "script to pluto or charon which requires superuser privileges, you"
+ elog "can work around this limitation by using sudo to grant the"
+ elog "user \"ipsec\" the appropriate rights."
+ elog "For example (the default case):"
+ elog "/etc/sudoers:"
+ elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
+ elog "Under the specific connection block in /etc/ipsec.conf:"
+ elog " leftupdown=\"sudo -E ipsec _updown iptables\""
+ elog
+ fi
+ elog
+ elog "Make sure you have _all_ required kernel modules available including"
+ elog "the appropriate cryptographic algorithms. A list is available at:"
+ elog " http://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
+ elog
+ elog "The up-to-date manual is available online at:"
+ elog " http://wiki.strongswan.org/"
+ elog
+}
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2017-11-26 23:23 David Seifert
0 siblings, 0 replies; 112+ messages in thread
From: David Seifert @ 2017-11-26 23:23 UTC (permalink / raw
To: gentoo-commits
commit: 37d00ff294791ad520ba5fa1f97f5a3f03a8b978
Author: David Seifert <soap <AT> gentoo <DOT> org>
AuthorDate: Sun Nov 26 12:55:32 2017 +0000
Commit: David Seifert <soap <AT> gentoo <DOT> org>
CommitDate: Sun Nov 26 23:23:11 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=37d00ff2
net-vpn/strongswan: [QA] Consistent whitespace in metadata.xml
net-vpn/strongswan/metadata.xml | 150 ++++++++++++----------------------------
1 file changed, 45 insertions(+), 105 deletions(-)
diff --git a/net-vpn/strongswan/metadata.xml b/net-vpn/strongswan/metadata.xml
index 9e6793b9791..72eecce94d3 100644
--- a/net-vpn/strongswan/metadata.xml
+++ b/net-vpn/strongswan/metadata.xml
@@ -1,109 +1,49 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
<pkgmetadata>
- <maintainer type="person">
- <email>patrick@gentoo.org</email>
- <name>Patrick Lauer</name>
- </maintainer>
- <maintainer type="person">
- <email>gurligebis@gentoo.org</email>
- <name>Bjarke Istrup Pedersen</name>
- </maintainer>
- <longdescription lang="en">
- StrongSwan is direct descendant of the discontinued FreeS/WAN project.
- As an IPsec based VPN solution which is focused on security and ease of
- use, it fully implements the IKEv1/IKEv2 protocols, MOBIKE, NAT-Traversal
- via UDP encapsulation (incl. port floating) and Dead Peer Detection. It
- also fully supports the Linux 2.6 IPsec stack, IPv6, certificates/keys on
- Smartcards and virtual IP address pools.
- </longdescription>
- <use>
- <flag name="constraints">
- Enable advanced X.509 constraint checking plugin.
- </flag>
- <flag name="dhcp">
- Enable server support for querying virtual IP addresses for clients
- from a DHCP server. (IKEv2 only)
- </flag>
- <flag name="eap">
- Enable support for the different EAP modules that is supported.
- </flag>
- <flag name="farp">
- Enable faking of ARP responses for virtual IP addresses assigned to
- clients. (IKEv2 only)
- </flag>
- <flag name="gcrypt">
- Enable <pkg>dev-libs/libgcrypt</pkg> plugin which provides 3DES, AES,
- Blowfish, Camellia, CAST, DES, Serpent and Twofish ciphers along with
- MD4, MD5 and SHA1/2 hash algorithms, RSA and DH groups 1,2,5,14-18 and
- 22-24(4.4+). Also includes a software random number generator.
- </flag>
- <flag name="non-root">
- Force IKEv1/IKEv2 daemons to normal user privileges. This might impose
- some restrictions mainly to the IKEv1 daemon. Disable only if you really
- require superuser privileges.
- </flag>
- <flag name="openssl">
- Enable <pkg>dev-libs/openssl</pkg> plugin which is required for Elliptic
- Curve Cryptography (DH groups 19-21,25,26) and ECDSA. Also provides 3DES,
- AES, Blowfish, Camellia, CAST, DES, IDEA and RC5 ciphers along with MD2,
- MD4, MD5 and SHA1/2 hash algorithms, RSA and DH groups 1,2,5,14-18 and
- 22-24(4.4+)
- <pkg>dev-libs/openssl</pkg> has to be compiled with USE="-bindist".
- </flag>
- <flag name="pkcs11">
- Enable pkcs11 support.
- </flag>
- <flag name="strongswan_plugins_led">
- Enable support for the led plugin.
- </flag>
- <flag name="strongswan_plugins_lookip">
- Enable support for the lookip plugin.
- </flag>
- <flag name="strongswan_plugins_systime-fix">
- Enable support for the systime-fix plugin.
- </flag>
- <flag name="strongswan_plugins_unity">
- Enable support for the unity plugin.
- </flag>
- <flag name="strongswan_plugins_vici">
- Enable support for the vici plugin.
- </flag>
- <flag name="strongswan_plugins_blowfish">
- Enable support for the blowfish plugin.
- </flag>
- <flag name="strongswan_plugins_ccm">
- Enable support for the ccm plugin.
- </flag>
- <flag name="strongswan_plugins_ctr">
- Enable support for the ctr plugin.
- </flag>
- <flag name="strongswan_plugins_gcm">
- Enable support for the gcm plugin.
- </flag>
- <flag name="strongswan_plugins_ha">
- Enable support for the ha plugin.
- </flag>
- <flag name="strongswan_plugins_ipseckey">
- Enable support for the ipseckey plugin.
- </flag>
- <flag name="strongswan_plugins_ntru">
- Enable support for the ntru plugin.
- </flag>
- <flag name="strongswan_plugins_padlock">
- Enable support for the padlock plugin.
- </flag>
- <flag name="strongswan_plugins_rdrand">
- Enable support for the rdrand plugin.
- </flag>
- <flag name="strongswan_plugins_unbound">
- Enable support for the unbound plugin.
- </flag>
- <flag name="strongswan_plugins_whitelist">
- Enable support for the whitelist plugin.
- </flag>
- </use>
- <upstream>
- <remote-id type="cpe">cpe:/a:strongswan:strongswan</remote-id>
- </upstream>
+ <maintainer type="person">
+ <email>patrick@gentoo.org</email>
+ <name>Patrick Lauer</name>
+ </maintainer>
+ <maintainer type="person">
+ <email>gurligebis@gentoo.org</email>
+ <name>Bjarke Istrup Pedersen</name>
+ </maintainer>
+ <longdescription lang="en">
+ StrongSwan is direct descendant of the discontinued FreeS/WAN project.
+ As an IPsec based VPN solution which is focused on security and ease of
+ use, it fully implements the IKEv1/IKEv2 protocols, MOBIKE, NAT-Traversal
+ via UDP encapsulation (incl. port floating) and Dead Peer Detection. It
+ also fully supports the Linux 2.6 IPsec stack, IPv6, certificates/keys on
+ Smartcards and virtual IP address pools.
+ </longdescription>
+ <use>
+ <flag name="constraints">Enable advanced X.509 constraint checking plugin</flag>
+ <flag name="dhcp">Enable server support for querying virtual IP addresses for clients from a DHCP server. (IKEv2 only)</flag>
+ <flag name="eap">Enable support for the different EAP modules that are supported</flag>
+ <flag name="farp">Enable faking of ARP responses for virtual IP addresses assigned to clients (IKEv2 only)</flag>
+ <flag name="gcrypt">Enable <pkg>dev-libs/libgcrypt</pkg> plugin which provides 3DES, AES, Blowfish, Camellia, CAST, DES, Serpent and Twofish ciphers along with MD4, MD5 and SHA1/2 hash algorithms, RSA and DH groups 1,2,5,14-18 and 22-24(4.4+). Also includes a software random number generator.</flag>
+ <flag name="non-root">Force IKEv1/IKEv2 daemons to normal user privileges. This might impose some restrictions mainly to the IKEv1 daemon. Disable only if you really require superuser privileges.</flag>
+ <flag name="openssl">Enable <pkg>dev-libs/openssl</pkg> plugin which is required for Elliptic Curve Cryptography (DH groups 19-21,25,26) and ECDSA. Also provides 3DES, AES, Blowfish, Camellia, CAST, DES, IDEA and RC5 ciphers along with MD2, MD4, MD5 and SHA1/2 hash algorithms, RSA and DH groups 1,2,5,14-18 and 22-24(4.4+) <pkg>dev-libs/openssl</pkg> has to be compiled with USE="-bindist".</flag>
+ <flag name="pkcs11">Enable pkcs11 support</flag>
+ <flag name="strongswan_plugins_led">Enable support for the led plugin</flag>
+ <flag name="strongswan_plugins_lookip">Enable support for the lookip plugin</flag>
+ <flag name="strongswan_plugins_systime-fix">Enable support for the systime-fix plugin</flag>
+ <flag name="strongswan_plugins_unity">Enable support for the unity plugin</flag>
+ <flag name="strongswan_plugins_vici">Enable support for the vici plugin</flag>
+ <flag name="strongswan_plugins_blowfish">Enable support for the blowfish plugin</flag>
+ <flag name="strongswan_plugins_ccm">Enable support for the ccm plugin</flag>
+ <flag name="strongswan_plugins_ctr">Enable support for the ctr plugin</flag>
+ <flag name="strongswan_plugins_gcm">Enable support for the gcm plugin</flag>
+ <flag name="strongswan_plugins_ha">Enable support for the ha plugin</flag>
+ <flag name="strongswan_plugins_ipseckey">Enable support for the ipseckey plugin</flag>
+ <flag name="strongswan_plugins_ntru">Enable support for the ntru plugin</flag>
+ <flag name="strongswan_plugins_padlock">Enable support for the padlock plugin</flag>
+ <flag name="strongswan_plugins_rdrand">Enable support for the rdrand plugin</flag>
+ <flag name="strongswan_plugins_unbound">Enable support for the unbound plugin</flag>
+ <flag name="strongswan_plugins_whitelist">Enable support for the whitelist plugin</flag>
+ </use>
+ <upstream>
+ <remote-id type="cpe">cpe:/a:strongswan:strongswan</remote-id>
+ </upstream>
</pkgmetadata>
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2018-01-23 16:41 Agostino Sarubbo
0 siblings, 0 replies; 112+ messages in thread
From: Agostino Sarubbo @ 2018-01-23 16:41 UTC (permalink / raw
To: gentoo-commits
commit: 4cddca171c10e4cc4c4cd8bd946ba143c70c9368
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Tue Jan 23 16:41:48 2018 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Tue Jan 23 16:41:48 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4cddca17
net-vpn/strongswan: amd64 stable wrt bug #628606
Package-Manager: Portage-2.3.13, Repoman-2.3.3
RepoMan-Options: --include-arches="amd64"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.6.0-r1.ebuild | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net-vpn/strongswan/strongswan-5.6.0-r1.ebuild b/net-vpn/strongswan/strongswan-5.6.0-r1.ebuild
index dc0518eb40a..f6c8a771da5 100644
--- a/net-vpn/strongswan/strongswan-5.6.0-r1.ebuild
+++ b/net-vpn/strongswan/strongswan-5.6.0-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2017 Gentoo Foundation
+# Copyright 1999-2018 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
EAPI=5
@@ -10,7 +10,7 @@ SRC_URI="http://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="~amd64 ~arm ~ppc ~ppc64 ~x86"
+KEYWORDS="amd64 ~arm ~ppc ~ppc64 ~x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2018-01-26 18:21 Thomas Deutschmann
0 siblings, 0 replies; 112+ messages in thread
From: Thomas Deutschmann @ 2018-01-26 18:21 UTC (permalink / raw
To: gentoo-commits
commit: e47dfdf669fa48210e63a709b88c4e15948ac2c7
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Fri Jan 26 18:19:50 2018 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Fri Jan 26 18:19:50 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e47dfdf6
net-vpn/strongswan: x86 stable (bug #628606)
Package-Manager: Portage-2.3.20, Repoman-2.3.6
net-vpn/strongswan/strongswan-5.6.0-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.6.0-r1.ebuild b/net-vpn/strongswan/strongswan-5.6.0-r1.ebuild
index f6c8a771da5..7d50b595dfe 100644
--- a/net-vpn/strongswan/strongswan-5.6.0-r1.ebuild
+++ b/net-vpn/strongswan/strongswan-5.6.0-r1.ebuild
@@ -10,7 +10,7 @@ SRC_URI="http://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="amd64 ~arm ~ppc ~ppc64 ~x86"
+KEYWORDS="amd64 ~arm ~ppc ~ppc64 x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2018-02-05 21:27 Markus Meier
0 siblings, 0 replies; 112+ messages in thread
From: Markus Meier @ 2018-02-05 21:27 UTC (permalink / raw
To: gentoo-commits
commit: 75b36e20d6ecf30881142b76966f0f001fb42183
Author: Markus Meier <maekke <AT> gentoo <DOT> org>
AuthorDate: Mon Feb 5 21:18:52 2018 +0000
Commit: Markus Meier <maekke <AT> gentoo <DOT> org>
CommitDate: Mon Feb 5 21:18:52 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=75b36e20
net-vpn/strongswan: arm stable, bug #628606
Package-Manager: Portage-2.3.19, Repoman-2.3.6
RepoMan-Options: --include-arches="arm"
net-vpn/strongswan/strongswan-5.6.0-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.6.0-r1.ebuild b/net-vpn/strongswan/strongswan-5.6.0-r1.ebuild
index 7d50b595dfe..5959172eaf3 100644
--- a/net-vpn/strongswan/strongswan-5.6.0-r1.ebuild
+++ b/net-vpn/strongswan/strongswan-5.6.0-r1.ebuild
@@ -10,7 +10,7 @@ SRC_URI="http://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="amd64 ~arm ~ppc ~ppc64 x86"
+KEYWORDS="amd64 arm ~ppc ~ppc64 x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2018-02-24 15:17 Patrick Lauer
0 siblings, 0 replies; 112+ messages in thread
From: Patrick Lauer @ 2018-02-24 15:17 UTC (permalink / raw
To: gentoo-commits
commit: e7b41c04b284c4bfa14cee9d60777cb39da3d6db
Author: Patrick Lauer <patrick <AT> gentoo <DOT> org>
AuthorDate: Sat Feb 24 08:07:05 2018 +0000
Commit: Patrick Lauer <patrick <AT> gentoo <DOT> org>
CommitDate: Sat Feb 24 15:17:37 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e7b41c04
net-vpn/strongswan: Bump
Package-Manager: Portage-2.3.24, Repoman-2.3.6
net-vpn/strongswan/Manifest | 1 +
net-vpn/strongswan/strongswan-5.6.2.ebuild | 303 +++++++++++++++++++++++++++++
2 files changed, 304 insertions(+)
diff --git a/net-vpn/strongswan/Manifest b/net-vpn/strongswan/Manifest
index b8e0ee71e94..053972a54ef 100644
--- a/net-vpn/strongswan/Manifest
+++ b/net-vpn/strongswan/Manifest
@@ -1,2 +1,3 @@
DIST strongswan-5.5.3.tar.bz2 4768820 BLAKE2B 9f9da6c2ef27cec7f6a07f1cd5a7ecc8a92576fad2a5c6379b93d8a2e9d3b0804fe26dc0bc7b303754ef499ee938549c7cafbdf9a3f8f818d14cf88f613fe0fd SHA512 0b0b25d2102c98cda54300dc8c3c3a49a55e64f7c695dda65a24f2194f19bce0b7aab9e4f7486c243b552f9d1a94867d6a8782ee504aad1c9973809706d599ac
DIST strongswan-5.6.0.tar.bz2 4850722 BLAKE2B edb9f2b277cd8bccf886a824e4b3fb3c06af7510d9e21283fcb8d8ba9cf234f38182fcd1ca0c350b4039945ab10888406986d9a0b8edac24fe09faf0b8967fb2 SHA512 9362069a01c3642e62864d88fdb409a3c7514bf7c92cbe36e552c6a80915119cf5bb91c39592aab2d15b562684a0628a764e4fa7636d3b5fd2ebaf165c0ce649
+DIST strongswan-5.6.2.tar.bz2 4977859 BLAKE2B 83943ec95e6b95724e9fc130a09f7c7364147d0ce50528ac8b64452db53516b143e92c7dcb746c0c25aaac9182dda14d55e5c267fbdcd5bb9a63cbf48801274b SHA512 cf2d5cb6c45d991fe0ad8eed4ea8628f95a1871e9728ddf0985aa26e78d1e6da1c92c961772aafd3e55cfcfa84516204a15561389d373f78140f05607b248c52
diff --git a/net-vpn/strongswan/strongswan-5.6.2.ebuild b/net-vpn/strongswan/strongswan-5.6.2.ebuild
new file mode 100644
index 00000000000..a4895259f77
--- /dev/null
+++ b/net-vpn/strongswan/strongswan-5.6.2.ebuild
@@ -0,0 +1,303 @@
+# Copyright 1999-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+inherit eutils linux-info systemd user
+
+DESCRIPTION="IPsec-based VPN solution focused on security and ease of use, supporting IKEv1/IKEv2 and MOBIKE"
+HOMEPAGE="http://www.strongswan.org/"
+SRC_URI="http://download.strongswan.org/${P}.tar.bz2"
+
+LICENSE="GPL-2 RSA DES"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~ppc ~ppc64 ~x86"
+IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite pam pkcs11"
+
+STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
+STRONGSWAN_PLUGINS_OPT="blowfish ccm ctr gcm ha ipseckey ntru padlock rdrand unbound whitelist"
+for mod in $STRONGSWAN_PLUGINS_STD; do
+ IUSE="${IUSE} +strongswan_plugins_${mod}"
+done
+
+for mod in $STRONGSWAN_PLUGINS_OPT; do
+ IUSE="${IUSE} strongswan_plugins_${mod}"
+done
+
+COMMON_DEPEND="!net-misc/openswan
+ gmp? ( >=dev-libs/gmp-4.1.5:= )
+ gcrypt? ( dev-libs/libgcrypt:0 )
+ caps? ( sys-libs/libcap )
+ curl? ( net-misc/curl )
+ ldap? ( net-nds/openldap )
+ openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist] )
+ mysql? ( virtual/mysql )
+ sqlite? ( >=dev-db/sqlite-3.3.1 )
+ networkmanager? ( net-misc/networkmanager )
+ pam? ( sys-libs/pam )
+ strongswan_plugins_unbound? ( net-dns/unbound net-libs/ldns )"
+DEPEND="${COMMON_DEPEND}
+ virtual/linux-sources
+ sys-kernel/linux-headers"
+RDEPEND="${COMMON_DEPEND}
+ virtual/logger
+ sys-apps/iproute2
+ !net-vpn/libreswan
+ selinux? ( sec-policy/selinux-ipsec )"
+
+UGID="ipsec"
+
+pkg_setup() {
+ linux-info_pkg_setup
+ elog "Linux kernel version: ${KV_FULL}"
+
+ if ! kernel_is -ge 2 6 16; then
+ eerror
+ eerror "This ebuild currently only supports ${PN} with the"
+ eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
+ eerror
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn
+ ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
+ ewarn
+
+ if kernel_is -lt 2 6 29; then
+ ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
+ ewarn "include all required IPv6 modules even if you just intend"
+ ewarn "to run on IPv4 only."
+ ewarn
+ ewarn "This has been fixed with kernels >= 2.6.29."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 33; then
+ ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
+ ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
+ ewarn "miss SHA384 and SHA512 HMAC support altogether."
+ ewarn
+ ewarn "If you need any of those features, please use kernel >= 2.6.33."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
+ ewarn "ESP cipher is only included in kernels >= 2.6.34."
+ ewarn
+ ewarn "If you need it, please use kernel >= 2.6.34."
+ ewarn
+ fi
+ fi
+
+ if use non-root; then
+ enewgroup ${UGID}
+ enewuser ${UGID} -1 -1 -1 ${UGID}
+ fi
+}
+
+src_prepare() {
+ epatch_user
+}
+
+src_configure() {
+ local myconf=""
+
+ if use non-root; then
+ myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
+ fi
+
+ # If a user has already enabled db support, those plugins will
+ # most likely be desired as well. Besides they don't impose new
+ # dependencies and come at no cost (except for space).
+ if use mysql || use sqlite; then
+ myconf="${myconf} --enable-attr-sql --enable-sql"
+ fi
+
+ # strongSwan builds and installs static libs by default which are
+ # useless to the user (and to strongSwan for that matter) because no
+ # header files or alike get installed... so disabling them is safe.
+ if use pam && use eap; then
+ myconf="${myconf} --enable-eap-gtc"
+ else
+ myconf="${myconf} --disable-eap-gtc"
+ fi
+
+ for mod in $STRONGSWAN_PLUGINS_STD; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ for mod in $STRONGSWAN_PLUGINS_OPT; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ econf \
+ --disable-static \
+ --enable-ikev1 \
+ --enable-ikev2 \
+ --enable-swanctl \
+ --enable-socket-dynamic \
+ $(use_with caps capabilities libcap) \
+ $(use_enable curl) \
+ $(use_enable constraints) \
+ $(use_enable ldap) \
+ $(use_enable debug leak-detective) \
+ $(use_enable dhcp) \
+ $(use_enable eap eap-sim) \
+ $(use_enable eap eap-sim-file) \
+ $(use_enable eap eap-simaka-sql) \
+ $(use_enable eap eap-simaka-pseudonym) \
+ $(use_enable eap eap-simaka-reauth) \
+ $(use_enable eap eap-identity) \
+ $(use_enable eap eap-md5) \
+ $(use_enable eap eap-aka) \
+ $(use_enable eap eap-aka-3gpp2) \
+ $(use_enable eap md4) \
+ $(use_enable eap eap-mschapv2) \
+ $(use_enable eap eap-radius) \
+ $(use_enable eap eap-tls) \
+ $(use_enable eap xauth-eap) \
+ $(use_enable eap eap-dynamic) \
+ $(use_enable farp) \
+ $(use_enable gmp) \
+ $(use_enable gcrypt) \
+ $(use_enable mysql) \
+ $(use_enable networkmanager nm) \
+ $(use_enable openssl) \
+ $(use_enable pam xauth-pam) \
+ $(use_enable pkcs11) \
+ $(use_enable sqlite) \
+ "$(systemd_with_unitdir)" \
+ ${myconf}
+}
+
+src_install() {
+ emake DESTDIR="${D}" install
+
+ doinitd "${FILESDIR}"/ipsec
+
+ local dir_ugid
+ if use non-root; then
+ fowners ${UGID}:${UGID} \
+ /etc/ipsec.conf \
+ /etc/strongswan.conf
+
+ dir_ugid="${UGID}"
+ else
+ dir_ugid="root"
+ fi
+
+ diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
+ dodir /etc/ipsec.d \
+ /etc/ipsec.d/aacerts \
+ /etc/ipsec.d/acerts \
+ /etc/ipsec.d/cacerts \
+ /etc/ipsec.d/certs \
+ /etc/ipsec.d/crls \
+ /etc/ipsec.d/ocspcerts \
+ /etc/ipsec.d/private \
+ /etc/ipsec.d/reqs
+
+ dodoc NEWS README TODO || die
+
+ # shared libs are used only internally and there are no static libs,
+ # so it's safe to get rid of the .la files
+ find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
+}
+
+pkg_preinst() {
+ has_version "<net-vpn/strongswan-4.3.6-r1"
+ upgrade_from_leq_4_3_6=$(( !$? ))
+
+ has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
+ previous_4_3_6_with_caps=$(( !$? ))
+}
+
+pkg_postinst() {
+ if ! use openssl && ! use gcrypt; then
+ elog
+ elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
+ elog "Please note that this might effect availability and speed of some"
+ elog "cryptographic features. You are advised to enable the OpenSSL plugin."
+ elif ! use openssl; then
+ elog
+ elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
+ elog "availability and speed of some cryptographic features. There will be"
+ elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
+ elog "25, 26) and ECDSA."
+ fi
+
+ if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
+ chmod 0750 "${ROOT}"/etc/ipsec.d \
+ "${ROOT}"/etc/ipsec.d/aacerts \
+ "${ROOT}"/etc/ipsec.d/acerts \
+ "${ROOT}"/etc/ipsec.d/cacerts \
+ "${ROOT}"/etc/ipsec.d/certs \
+ "${ROOT}"/etc/ipsec.d/crls \
+ "${ROOT}"/etc/ipsec.d/ocspcerts \
+ "${ROOT}"/etc/ipsec.d/private \
+ "${ROOT}"/etc/ipsec.d/reqs
+
+ ewarn
+ ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
+ ewarn "security reasons. Your system installed directories have been"
+ ewarn "updated accordingly. Please check if necessary."
+ ewarn
+
+ if [[ $previous_4_3_6_with_caps == 1 ]]; then
+ if ! use non-root; then
+ ewarn
+ ewarn "IMPORTANT: You previously had ${PN} installed without root"
+ ewarn "privileges because it was implied by the 'caps' USE flag."
+ ewarn "This has been changed. If you want ${PN} with user privileges,"
+ ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
+ ewarn
+ fi
+ fi
+ fi
+ if ! use caps && ! use non-root; then
+ ewarn
+ ewarn "You have decided to run ${PN} with root privileges and built it"
+ ewarn "without support for POSIX capability dropping. It is generally"
+ ewarn "strongly suggested that you reconsider- especially if you intend"
+ ewarn "to run ${PN} as server with a public ip address."
+ ewarn
+ ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
+ ewarn
+ fi
+ if use non-root; then
+ elog
+ elog "${PN} has been installed without superuser privileges (USE=non-root)."
+ elog "This imposes several limitations mainly to the IKEv1 daemon 'pluto'"
+ elog "but also a few to the IKEv2 daemon 'charon'."
+ elog
+ elog "Please carefully read: http://wiki.strongswan.org/wiki/nonRoot"
+ elog
+ elog "pluto uses a helper script by default to insert/remove routing and"
+ elog "policy rules upon connection start/stop which requires superuser"
+ elog "privileges. charon in contrast does this internally and can do so"
+ elog "even with reduced (user) privileges."
+ elog
+ elog "Thus if you require IKEv1 (pluto) or need to specify a custom updown"
+ elog "script to pluto or charon which requires superuser privileges, you"
+ elog "can work around this limitation by using sudo to grant the"
+ elog "user \"ipsec\" the appropriate rights."
+ elog "For example (the default case):"
+ elog "/etc/sudoers:"
+ elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
+ elog "Under the specific connection block in /etc/ipsec.conf:"
+ elog " leftupdown=\"sudo -E ipsec _updown iptables\""
+ elog
+ fi
+ elog
+ elog "Make sure you have _all_ required kernel modules available including"
+ elog "the appropriate cryptographic algorithms. A list is available at:"
+ elog " http://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
+ elog
+ elog "The up-to-date manual is available online at:"
+ elog " http://wiki.strongswan.org/"
+ elog
+}
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2018-03-03 22:16 Sergei Trofimovich
0 siblings, 0 replies; 112+ messages in thread
From: Sergei Trofimovich @ 2018-03-03 22:16 UTC (permalink / raw
To: gentoo-commits
commit: 5c7b25fe7bf343e8dfe32080453da1416d90059c
Author: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
AuthorDate: Sat Mar 3 22:13:48 2018 +0000
Commit: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
CommitDate: Sat Mar 3 22:16:39 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5c7b25fe
net-vpn/strongswan: stable 5.6.0-r1 for ppc, bug #628606
Package-Manager: Portage-2.3.24, Repoman-2.3.6
RepoMan-Options: --include-arches="ppc"
net-vpn/strongswan/strongswan-5.6.0-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.6.0-r1.ebuild b/net-vpn/strongswan/strongswan-5.6.0-r1.ebuild
index 5959172eaf3..9b671947ef2 100644
--- a/net-vpn/strongswan/strongswan-5.6.0-r1.ebuild
+++ b/net-vpn/strongswan/strongswan-5.6.0-r1.ebuild
@@ -10,7 +10,7 @@ SRC_URI="http://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="amd64 arm ~ppc ~ppc64 x86"
+KEYWORDS="amd64 arm ppc ~ppc64 x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2018-03-13 11:59 Pacho Ramos
0 siblings, 0 replies; 112+ messages in thread
From: Pacho Ramos @ 2018-03-13 11:59 UTC (permalink / raw
To: gentoo-commits
commit: 2fc4033e570f229d177517cfdf4f0716b739666e
Author: Pacho Ramos <pacho <AT> gentoo <DOT> org>
AuthorDate: Tue Mar 13 11:57:02 2018 +0000
Commit: Pacho Ramos <pacho <AT> gentoo <DOT> org>
CommitDate: Tue Mar 13 11:59:09 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2fc4033e
net-vpn/strongswan: Update maintainer due to bug #96159
Package-Manager: Portage-2.3.24, Repoman-2.3.6
net-vpn/strongswan/metadata.xml | 4 ----
1 file changed, 4 deletions(-)
diff --git a/net-vpn/strongswan/metadata.xml b/net-vpn/strongswan/metadata.xml
index 72eecce94d3..0e0b41e2fb4 100644
--- a/net-vpn/strongswan/metadata.xml
+++ b/net-vpn/strongswan/metadata.xml
@@ -5,10 +5,6 @@
<email>patrick@gentoo.org</email>
<name>Patrick Lauer</name>
</maintainer>
- <maintainer type="person">
- <email>gurligebis@gentoo.org</email>
- <name>Bjarke Istrup Pedersen</name>
- </maintainer>
<longdescription lang="en">
StrongSwan is direct descendant of the discontinued FreeS/WAN project.
As an IPsec based VPN solution which is focused on security and ease of
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2018-09-02 19:24 Thomas Deutschmann
0 siblings, 0 replies; 112+ messages in thread
From: Thomas Deutschmann @ 2018-09-02 19:24 UTC (permalink / raw
To: gentoo-commits
commit: 04bad22fe2e92f90cf9800043c1d68f80679b3a9
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Sun Sep 2 18:56:05 2018 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Sun Sep 2 19:23:50 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=04bad22f
net-vpn/strongswan: bump to v5.6.3
- EAPI bumped to EAPI=7.
- Enable "eap-ttls" when USE=eap is set. [Bug 548212]
- USE=strongswan_plugins_forecast added. [Bug 582444]
- USE=systemd added to allow building of charon-systemd. [Bug 631748]
- USE=strongswan_plugins_chapoly and USE=strongswan_plugins_newhope added.
[Bug 643978]
Closes: https://bugs.gentoo.org/548212
Closes: https://bugs.gentoo.org/582444
Closes: https://bugs.gentoo.org/631748
Closes: https://bugs.gentoo.org/643978
Package-Manager: Portage-2.3.48, Repoman-2.3.10
net-vpn/strongswan/Manifest | 1 +
net-vpn/strongswan/metadata.xml | 5 +
net-vpn/strongswan/strongswan-5.6.3.ebuild | 303 +++++++++++++++++++++++++++++
3 files changed, 309 insertions(+)
diff --git a/net-vpn/strongswan/Manifest b/net-vpn/strongswan/Manifest
index 053972a54ef..b0bda31db3f 100644
--- a/net-vpn/strongswan/Manifest
+++ b/net-vpn/strongswan/Manifest
@@ -1,3 +1,4 @@
DIST strongswan-5.5.3.tar.bz2 4768820 BLAKE2B 9f9da6c2ef27cec7f6a07f1cd5a7ecc8a92576fad2a5c6379b93d8a2e9d3b0804fe26dc0bc7b303754ef499ee938549c7cafbdf9a3f8f818d14cf88f613fe0fd SHA512 0b0b25d2102c98cda54300dc8c3c3a49a55e64f7c695dda65a24f2194f19bce0b7aab9e4f7486c243b552f9d1a94867d6a8782ee504aad1c9973809706d599ac
DIST strongswan-5.6.0.tar.bz2 4850722 BLAKE2B edb9f2b277cd8bccf886a824e4b3fb3c06af7510d9e21283fcb8d8ba9cf234f38182fcd1ca0c350b4039945ab10888406986d9a0b8edac24fe09faf0b8967fb2 SHA512 9362069a01c3642e62864d88fdb409a3c7514bf7c92cbe36e552c6a80915119cf5bb91c39592aab2d15b562684a0628a764e4fa7636d3b5fd2ebaf165c0ce649
DIST strongswan-5.6.2.tar.bz2 4977859 BLAKE2B 83943ec95e6b95724e9fc130a09f7c7364147d0ce50528ac8b64452db53516b143e92c7dcb746c0c25aaac9182dda14d55e5c267fbdcd5bb9a63cbf48801274b SHA512 cf2d5cb6c45d991fe0ad8eed4ea8628f95a1871e9728ddf0985aa26e78d1e6da1c92c961772aafd3e55cfcfa84516204a15561389d373f78140f05607b248c52
+DIST strongswan-5.6.3.tar.bz2 4961579 BLAKE2B 177d9ca9a730c8ccb3293c9f1c1397429879177aef60c90a3561fffed64cd4fe18cdf1c74bd52956c576e061ce33935b7dc34864576edeac7d4824841b0ee3e0 SHA512 080402640952b1a08e95bfe9c7f33c6a7dd01ac401b5e7e2e78257c0f2bf0a4d6078141232ac62abfacef892c493f6824948b3165d54d72b4e436ed564fd2609
diff --git a/net-vpn/strongswan/metadata.xml b/net-vpn/strongswan/metadata.xml
index 0e0b41e2fb4..7b897174224 100644
--- a/net-vpn/strongswan/metadata.xml
+++ b/net-vpn/strongswan/metadata.xml
@@ -22,6 +22,9 @@
<flag name="non-root">Force IKEv1/IKEv2 daemons to normal user privileges. This might impose some restrictions mainly to the IKEv1 daemon. Disable only if you really require superuser privileges.</flag>
<flag name="openssl">Enable <pkg>dev-libs/openssl</pkg> plugin which is required for Elliptic Curve Cryptography (DH groups 19-21,25,26) and ECDSA. Also provides 3DES, AES, Blowfish, Camellia, CAST, DES, IDEA and RC5 ciphers along with MD2, MD4, MD5 and SHA1/2 hash algorithms, RSA and DH groups 1,2,5,14-18 and 22-24(4.4+) <pkg>dev-libs/openssl</pkg> has to be compiled with USE="-bindist".</flag>
<flag name="pkcs11">Enable pkcs11 support</flag>
+ <flag name="strongswan_plugins_aesni">Enable support for Intel AES-NI crypto plugin</flag>
+ <flag name="strongswan_plugins_chapoly">Enable ChaCha20/Poly1305 AEAD implementation and ChaCha20 XOF plugin</flag>
+ <flag name="strongswan_plugins_forecast">Enable multicast and broadcast forwarding plugin</flag>
<flag name="strongswan_plugins_led">Enable support for the led plugin</flag>
<flag name="strongswan_plugins_lookip">Enable support for the lookip plugin</flag>
<flag name="strongswan_plugins_systime-fix">Enable support for the systime-fix plugin</flag>
@@ -33,9 +36,11 @@
<flag name="strongswan_plugins_gcm">Enable support for the gcm plugin</flag>
<flag name="strongswan_plugins_ha">Enable support for the ha plugin</flag>
<flag name="strongswan_plugins_ipseckey">Enable support for the ipseckey plugin</flag>
+ <flag name="strongswan_plugins_newhope">Enable plugin that allows key exchange based on post-quantum computer New Hope algorithm</flag>
<flag name="strongswan_plugins_ntru">Enable support for the ntru plugin</flag>
<flag name="strongswan_plugins_padlock">Enable support for the padlock plugin</flag>
<flag name="strongswan_plugins_rdrand">Enable support for the rdrand plugin</flag>
+ <flag name="strongswan_plugins_save-keys">Enable plugin that saves IKE and/or ESP keys to files compatible with Wireshark (for debugging)</flag>
<flag name="strongswan_plugins_unbound">Enable support for the unbound plugin</flag>
<flag name="strongswan_plugins_whitelist">Enable support for the whitelist plugin</flag>
</use>
diff --git a/net-vpn/strongswan/strongswan-5.6.3.ebuild b/net-vpn/strongswan/strongswan-5.6.3.ebuild
new file mode 100644
index 00000000000..906869df80c
--- /dev/null
+++ b/net-vpn/strongswan/strongswan-5.6.3.ebuild
@@ -0,0 +1,303 @@
+# Copyright 1999-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+inherit linux-info systemd user
+
+DESCRIPTION="IPsec-based VPN solution, supporting IKEv1/IKEv2 and MOBIKE"
+HOMEPAGE="https://www.strongswan.org/"
+SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
+
+LICENSE="GPL-2 RSA DES"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~ppc ~ppc64 ~x86"
+IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
+
+STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
+STRONGSWAN_PLUGINS_OPT="aesni blowfish ccm chapoly ctr forecast gcm ha ipseckey newhope ntru padlock rdrand save-keys unbound whitelist"
+for mod in $STRONGSWAN_PLUGINS_STD; do
+ IUSE="${IUSE} +strongswan_plugins_${mod}"
+done
+
+for mod in $STRONGSWAN_PLUGINS_OPT; do
+ IUSE="${IUSE} strongswan_plugins_${mod}"
+done
+
+COMMON_DEPEND="!net-misc/openswan
+ gmp? ( >=dev-libs/gmp-4.1.5:= )
+ gcrypt? ( dev-libs/libgcrypt:0 )
+ caps? ( sys-libs/libcap )
+ curl? ( net-misc/curl )
+ ldap? ( net-nds/openldap )
+ openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist] )
+ mysql? ( virtual/mysql )
+ sqlite? ( >=dev-db/sqlite-3.3.1 )
+ systemd? ( sys-apps/systemd )
+ networkmanager? ( net-misc/networkmanager )
+ pam? ( sys-libs/pam )
+ strongswan_plugins_unbound? ( net-dns/unbound net-libs/ldns )"
+DEPEND="${COMMON_DEPEND}
+ virtual/linux-sources
+ sys-kernel/linux-headers"
+RDEPEND="${COMMON_DEPEND}
+ virtual/logger
+ sys-apps/iproute2
+ !net-vpn/libreswan
+ selinux? ( sec-policy/selinux-ipsec )"
+
+UGID="ipsec"
+
+pkg_setup() {
+ linux-info_pkg_setup
+
+ elog "Linux kernel version: ${KV_FULL}"
+
+ if ! kernel_is -ge 2 6 16; then
+ eerror
+ eerror "This ebuild currently only supports ${PN} with the"
+ eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
+ eerror
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn
+ ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
+ ewarn
+
+ if kernel_is -lt 2 6 29; then
+ ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
+ ewarn "include all required IPv6 modules even if you just intend"
+ ewarn "to run on IPv4 only."
+ ewarn
+ ewarn "This has been fixed with kernels >= 2.6.29."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 33; then
+ ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
+ ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
+ ewarn "miss SHA384 and SHA512 HMAC support altogether."
+ ewarn
+ ewarn "If you need any of those features, please use kernel >= 2.6.33."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
+ ewarn "ESP cipher is only included in kernels >= 2.6.34."
+ ewarn
+ ewarn "If you need it, please use kernel >= 2.6.34."
+ ewarn
+ fi
+ fi
+
+ if use non-root; then
+ enewgroup ${UGID}
+ enewuser ${UGID} -1 -1 -1 ${UGID}
+ fi
+}
+
+src_configure() {
+ local myconf=""
+
+ if use non-root; then
+ myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
+ fi
+
+ # If a user has already enabled db support, those plugins will
+ # most likely be desired as well. Besides they don't impose new
+ # dependencies and come at no cost (except for space).
+ if use mysql || use sqlite; then
+ myconf="${myconf} --enable-attr-sql --enable-sql"
+ fi
+
+ # strongSwan builds and installs static libs by default which are
+ # useless to the user (and to strongSwan for that matter) because no
+ # header files or alike get installed... so disabling them is safe.
+ if use pam && use eap; then
+ myconf="${myconf} --enable-eap-gtc"
+ else
+ myconf="${myconf} --disable-eap-gtc"
+ fi
+
+ for mod in $STRONGSWAN_PLUGINS_STD; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ for mod in $STRONGSWAN_PLUGINS_OPT; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ econf \
+ --disable-static \
+ --enable-ikev1 \
+ --enable-ikev2 \
+ --enable-swanctl \
+ --enable-socket-dynamic \
+ $(use_enable curl) \
+ $(use_enable constraints) \
+ $(use_enable ldap) \
+ $(use_enable debug leak-detective) \
+ $(use_enable dhcp) \
+ $(use_enable eap eap-sim) \
+ $(use_enable eap eap-sim-file) \
+ $(use_enable eap eap-simaka-sql) \
+ $(use_enable eap eap-simaka-pseudonym) \
+ $(use_enable eap eap-simaka-reauth) \
+ $(use_enable eap eap-identity) \
+ $(use_enable eap eap-md5) \
+ $(use_enable eap eap-aka) \
+ $(use_enable eap eap-aka-3gpp2) \
+ $(use_enable eap md4) \
+ $(use_enable eap eap-mschapv2) \
+ $(use_enable eap eap-radius) \
+ $(use_enable eap eap-tls) \
+ $(use_enable eap eap-ttls) \
+ $(use_enable eap xauth-eap) \
+ $(use_enable eap eap-dynamic) \
+ $(use_enable farp) \
+ $(use_enable gmp) \
+ $(use_enable gcrypt) \
+ $(use_enable mysql) \
+ $(use_enable networkmanager nm) \
+ $(use_enable openssl) \
+ $(use_enable pam xauth-pam) \
+ $(use_enable pkcs11) \
+ $(use_enable sqlite) \
+ $(use_enable systemd) \
+ $(use_with caps capabilities libcap) \
+ --with-systemdsystemunitdir="$(systemd_get_systemunitdir)" \
+ ${myconf}
+}
+
+src_install() {
+ emake DESTDIR="${D}" install
+
+ doinitd "${FILESDIR}"/ipsec
+
+ local dir_ugid
+ if use non-root; then
+ fowners ${UGID}:${UGID} \
+ /etc/ipsec.conf \
+ /etc/strongswan.conf
+
+ dir_ugid="${UGID}"
+ else
+ dir_ugid="root"
+ fi
+
+ diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
+ dodir /etc/ipsec.d \
+ /etc/ipsec.d/aacerts \
+ /etc/ipsec.d/acerts \
+ /etc/ipsec.d/cacerts \
+ /etc/ipsec.d/certs \
+ /etc/ipsec.d/crls \
+ /etc/ipsec.d/ocspcerts \
+ /etc/ipsec.d/private \
+ /etc/ipsec.d/reqs
+
+ dodoc NEWS README TODO || die
+
+ # shared libs are used only internally and there are no static libs,
+ # so it's safe to get rid of the .la files
+ find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
+}
+
+pkg_preinst() {
+ has_version "<net-vpn/strongswan-4.3.6-r1"
+ upgrade_from_leq_4_3_6=$(( !$? ))
+
+ has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
+ previous_4_3_6_with_caps=$(( !$? ))
+}
+
+pkg_postinst() {
+ if ! use openssl && ! use gcrypt; then
+ elog
+ elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
+ elog "Please note that this might effect availability and speed of some"
+ elog "cryptographic features. You are advised to enable the OpenSSL plugin."
+ elif ! use openssl; then
+ elog
+ elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
+ elog "availability and speed of some cryptographic features. There will be"
+ elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
+ elog "25, 26) and ECDSA."
+ fi
+
+ if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
+ chmod 0750 "${ROOT}"/etc/ipsec.d \
+ "${ROOT}"/etc/ipsec.d/aacerts \
+ "${ROOT}"/etc/ipsec.d/acerts \
+ "${ROOT}"/etc/ipsec.d/cacerts \
+ "${ROOT}"/etc/ipsec.d/certs \
+ "${ROOT}"/etc/ipsec.d/crls \
+ "${ROOT}"/etc/ipsec.d/ocspcerts \
+ "${ROOT}"/etc/ipsec.d/private \
+ "${ROOT}"/etc/ipsec.d/reqs
+
+ ewarn
+ ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
+ ewarn "security reasons. Your system installed directories have been"
+ ewarn "updated accordingly. Please check if necessary."
+ ewarn
+
+ if [[ $previous_4_3_6_with_caps == 1 ]]; then
+ if ! use non-root; then
+ ewarn
+ ewarn "IMPORTANT: You previously had ${PN} installed without root"
+ ewarn "privileges because it was implied by the 'caps' USE flag."
+ ewarn "This has been changed. If you want ${PN} with user privileges,"
+ ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
+ ewarn
+ fi
+ fi
+ fi
+ if ! use caps && ! use non-root; then
+ ewarn
+ ewarn "You have decided to run ${PN} with root privileges and built it"
+ ewarn "without support for POSIX capability dropping. It is generally"
+ ewarn "strongly suggested that you reconsider- especially if you intend"
+ ewarn "to run ${PN} as server with a public ip address."
+ ewarn
+ ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
+ ewarn
+ fi
+ if use non-root; then
+ elog
+ elog "${PN} has been installed without superuser privileges (USE=non-root)."
+ elog "This imposes several limitations mainly to the IKEv1 daemon 'pluto'"
+ elog "but also a few to the IKEv2 daemon 'charon'."
+ elog
+ elog "Please carefully read: http://wiki.strongswan.org/wiki/nonRoot"
+ elog
+ elog "pluto uses a helper script by default to insert/remove routing and"
+ elog "policy rules upon connection start/stop which requires superuser"
+ elog "privileges. charon in contrast does this internally and can do so"
+ elog "even with reduced (user) privileges."
+ elog
+ elog "Thus if you require IKEv1 (pluto) or need to specify a custom updown"
+ elog "script to pluto or charon which requires superuser privileges, you"
+ elog "can work around this limitation by using sudo to grant the"
+ elog "user \"ipsec\" the appropriate rights."
+ elog "For example (the default case):"
+ elog "/etc/sudoers:"
+ elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
+ elog "Under the specific connection block in /etc/ipsec.conf:"
+ elog " leftupdown=\"sudo -E ipsec _updown iptables\""
+ elog
+ fi
+ elog
+ elog "Make sure you have _all_ required kernel modules available including"
+ elog "the appropriate cryptographic algorithms. A list is available at:"
+ elog " http://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
+ elog
+ elog "The up-to-date manual is available online at:"
+ elog " http://wiki.strongswan.org/"
+ elog
+}
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2018-09-14 22:13 Thomas Deutschmann
0 siblings, 0 replies; 112+ messages in thread
From: Thomas Deutschmann @ 2018-09-14 22:13 UTC (permalink / raw
To: gentoo-commits
commit: c27f924902d342c02d5d678ff0f3fe09a14fc600
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Fri Sep 14 22:13:20 2018 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Fri Sep 14 22:13:20 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c27f9249
net-vpn/strongswan: add sub slot operator on net-dns/unbound atom
Package-Manager: Portage-2.3.49, Repoman-2.3.10
net-vpn/strongswan/strongswan-5.5.3.ebuild | 4 ++--
net-vpn/strongswan/strongswan-5.6.0-r1.ebuild | 2 +-
net-vpn/strongswan/strongswan-5.6.0.ebuild | 4 ++--
net-vpn/strongswan/strongswan-5.6.2.ebuild | 2 +-
net-vpn/strongswan/strongswan-5.6.3.ebuild | 2 +-
5 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/net-vpn/strongswan/strongswan-5.5.3.ebuild b/net-vpn/strongswan/strongswan-5.5.3.ebuild
index 7ec9a3ae14f..7cf43b5ece0 100644
--- a/net-vpn/strongswan/strongswan-5.5.3.ebuild
+++ b/net-vpn/strongswan/strongswan-5.5.3.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2017 Gentoo Foundation
+# Copyright 1999-2018 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
EAPI=5
@@ -34,7 +34,7 @@ COMMON_DEPEND="!net-misc/openswan
sqlite? ( >=dev-db/sqlite-3.3.1 )
networkmanager? ( net-misc/networkmanager )
pam? ( sys-libs/pam )
- strongswan_plugins_unbound? ( net-dns/unbound net-libs/ldns )"
+ strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns )"
DEPEND="${COMMON_DEPEND}
virtual/linux-sources
sys-kernel/linux-headers"
diff --git a/net-vpn/strongswan/strongswan-5.6.0-r1.ebuild b/net-vpn/strongswan/strongswan-5.6.0-r1.ebuild
index 9b671947ef2..7682afd92ad 100644
--- a/net-vpn/strongswan/strongswan-5.6.0-r1.ebuild
+++ b/net-vpn/strongswan/strongswan-5.6.0-r1.ebuild
@@ -34,7 +34,7 @@ COMMON_DEPEND="!net-misc/openswan
sqlite? ( >=dev-db/sqlite-3.3.1 )
networkmanager? ( net-misc/networkmanager )
pam? ( sys-libs/pam )
- strongswan_plugins_unbound? ( net-dns/unbound net-libs/ldns )"
+ strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns )"
DEPEND="${COMMON_DEPEND}
virtual/linux-sources
sys-kernel/linux-headers"
diff --git a/net-vpn/strongswan/strongswan-5.6.0.ebuild b/net-vpn/strongswan/strongswan-5.6.0.ebuild
index d7477edc168..c4736a96230 100644
--- a/net-vpn/strongswan/strongswan-5.6.0.ebuild
+++ b/net-vpn/strongswan/strongswan-5.6.0.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2017 Gentoo Foundation
+# Copyright 1999-2018 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
EAPI=5
@@ -34,7 +34,7 @@ COMMON_DEPEND="!net-misc/openswan
sqlite? ( >=dev-db/sqlite-3.3.1 )
networkmanager? ( net-misc/networkmanager )
pam? ( sys-libs/pam )
- strongswan_plugins_unbound? ( net-dns/unbound net-libs/ldns )"
+ strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns )"
DEPEND="${COMMON_DEPEND}
virtual/linux-sources
sys-kernel/linux-headers"
diff --git a/net-vpn/strongswan/strongswan-5.6.2.ebuild b/net-vpn/strongswan/strongswan-5.6.2.ebuild
index a4895259f77..c7dbeeac3be 100644
--- a/net-vpn/strongswan/strongswan-5.6.2.ebuild
+++ b/net-vpn/strongswan/strongswan-5.6.2.ebuild
@@ -34,7 +34,7 @@ COMMON_DEPEND="!net-misc/openswan
sqlite? ( >=dev-db/sqlite-3.3.1 )
networkmanager? ( net-misc/networkmanager )
pam? ( sys-libs/pam )
- strongswan_plugins_unbound? ( net-dns/unbound net-libs/ldns )"
+ strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns )"
DEPEND="${COMMON_DEPEND}
virtual/linux-sources
sys-kernel/linux-headers"
diff --git a/net-vpn/strongswan/strongswan-5.6.3.ebuild b/net-vpn/strongswan/strongswan-5.6.3.ebuild
index 906869df80c..a9486f5cba7 100644
--- a/net-vpn/strongswan/strongswan-5.6.3.ebuild
+++ b/net-vpn/strongswan/strongswan-5.6.3.ebuild
@@ -35,7 +35,7 @@ COMMON_DEPEND="!net-misc/openswan
systemd? ( sys-apps/systemd )
networkmanager? ( net-misc/networkmanager )
pam? ( sys-libs/pam )
- strongswan_plugins_unbound? ( net-dns/unbound net-libs/ldns )"
+ strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns )"
DEPEND="${COMMON_DEPEND}
virtual/linux-sources
sys-kernel/linux-headers"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2018-10-17 10:05 Thomas Deutschmann
0 siblings, 0 replies; 112+ messages in thread
From: Thomas Deutschmann @ 2018-10-17 10:05 UTC (permalink / raw
To: gentoo-commits
commit: cd0b22894f6e7e2efaee62316991816f2a459040
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Wed Oct 17 10:03:47 2018 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Wed Oct 17 10:05:09 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=cd0b2289
net-vpn/strongswan: bump to v5.7.1
Closes: https://bugs.gentoo.org/667696
Closes: https://bugs.gentoo.org/666014
Package-Manager: Portage-2.3.51, Repoman-2.3.11
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
net-vpn/strongswan/Manifest | 1 +
net-vpn/strongswan/strongswan-5.7.1.ebuild | 303 +++++++++++++++++++++++++++++
2 files changed, 304 insertions(+)
diff --git a/net-vpn/strongswan/Manifest b/net-vpn/strongswan/Manifest
index b0bda31db3f..dbe0b5b6b3d 100644
--- a/net-vpn/strongswan/Manifest
+++ b/net-vpn/strongswan/Manifest
@@ -2,3 +2,4 @@ DIST strongswan-5.5.3.tar.bz2 4768820 BLAKE2B 9f9da6c2ef27cec7f6a07f1cd5a7ecc8a9
DIST strongswan-5.6.0.tar.bz2 4850722 BLAKE2B edb9f2b277cd8bccf886a824e4b3fb3c06af7510d9e21283fcb8d8ba9cf234f38182fcd1ca0c350b4039945ab10888406986d9a0b8edac24fe09faf0b8967fb2 SHA512 9362069a01c3642e62864d88fdb409a3c7514bf7c92cbe36e552c6a80915119cf5bb91c39592aab2d15b562684a0628a764e4fa7636d3b5fd2ebaf165c0ce649
DIST strongswan-5.6.2.tar.bz2 4977859 BLAKE2B 83943ec95e6b95724e9fc130a09f7c7364147d0ce50528ac8b64452db53516b143e92c7dcb746c0c25aaac9182dda14d55e5c267fbdcd5bb9a63cbf48801274b SHA512 cf2d5cb6c45d991fe0ad8eed4ea8628f95a1871e9728ddf0985aa26e78d1e6da1c92c961772aafd3e55cfcfa84516204a15561389d373f78140f05607b248c52
DIST strongswan-5.6.3.tar.bz2 4961579 BLAKE2B 177d9ca9a730c8ccb3293c9f1c1397429879177aef60c90a3561fffed64cd4fe18cdf1c74bd52956c576e061ce33935b7dc34864576edeac7d4824841b0ee3e0 SHA512 080402640952b1a08e95bfe9c7f33c6a7dd01ac401b5e7e2e78257c0f2bf0a4d6078141232ac62abfacef892c493f6824948b3165d54d72b4e436ed564fd2609
+DIST strongswan-5.7.1.tar.bz2 4967533 BLAKE2B e438d1b44a997eb0e012586b18604bd35ac6f53cce1c34ff89192a760bbd0d6a9aaa7b90b389ff1a5e7c6d2356ff5cc74b40daad1d6579fa5026f4878489bf66 SHA512 43102814434bee7c27a5956be59099cc4ffb9bb5b0d6382ce4c6a80d1d82ed6639f698f5f5544b9ca563554a344638c953525b0e2d39bc6b71b19055c80e07fc
diff --git a/net-vpn/strongswan/strongswan-5.7.1.ebuild b/net-vpn/strongswan/strongswan-5.7.1.ebuild
new file mode 100644
index 00000000000..17e1233b4cd
--- /dev/null
+++ b/net-vpn/strongswan/strongswan-5.7.1.ebuild
@@ -0,0 +1,303 @@
+# Copyright 1999-2018 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+inherit linux-info systemd user
+
+DESCRIPTION="IPsec-based VPN solution, supporting IKEv1/IKEv2 and MOBIKE"
+HOMEPAGE="https://www.strongswan.org/"
+SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
+
+LICENSE="GPL-2 RSA DES"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~ppc ~ppc64 ~x86"
+IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
+
+STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
+STRONGSWAN_PLUGINS_OPT="aesni blowfish ccm chapoly ctr forecast gcm ha ipseckey newhope ntru padlock rdrand save-keys unbound whitelist"
+for mod in $STRONGSWAN_PLUGINS_STD; do
+ IUSE="${IUSE} +strongswan_plugins_${mod}"
+done
+
+for mod in $STRONGSWAN_PLUGINS_OPT; do
+ IUSE="${IUSE} strongswan_plugins_${mod}"
+done
+
+COMMON_DEPEND="!net-misc/openswan
+ gmp? ( >=dev-libs/gmp-4.1.5:= )
+ gcrypt? ( dev-libs/libgcrypt:0 )
+ caps? ( sys-libs/libcap )
+ curl? ( net-misc/curl )
+ ldap? ( net-nds/openldap )
+ openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist] )
+ mysql? ( dev-db/mysql-connector-c:= )
+ sqlite? ( >=dev-db/sqlite-3.3.1 )
+ systemd? ( sys-apps/systemd )
+ networkmanager? ( net-misc/networkmanager )
+ pam? ( sys-libs/pam )
+ strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns )"
+DEPEND="${COMMON_DEPEND}
+ virtual/linux-sources
+ sys-kernel/linux-headers"
+RDEPEND="${COMMON_DEPEND}
+ virtual/logger
+ sys-apps/iproute2
+ !net-vpn/libreswan
+ selinux? ( sec-policy/selinux-ipsec )"
+
+UGID="ipsec"
+
+pkg_setup() {
+ linux-info_pkg_setup
+
+ elog "Linux kernel version: ${KV_FULL}"
+
+ if ! kernel_is -ge 2 6 16; then
+ eerror
+ eerror "This ebuild currently only supports ${PN} with the"
+ eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
+ eerror
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn
+ ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
+ ewarn
+
+ if kernel_is -lt 2 6 29; then
+ ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
+ ewarn "include all required IPv6 modules even if you just intend"
+ ewarn "to run on IPv4 only."
+ ewarn
+ ewarn "This has been fixed with kernels >= 2.6.29."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 33; then
+ ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
+ ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
+ ewarn "miss SHA384 and SHA512 HMAC support altogether."
+ ewarn
+ ewarn "If you need any of those features, please use kernel >= 2.6.33."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
+ ewarn "ESP cipher is only included in kernels >= 2.6.34."
+ ewarn
+ ewarn "If you need it, please use kernel >= 2.6.34."
+ ewarn
+ fi
+ fi
+
+ if use non-root; then
+ enewgroup ${UGID}
+ enewuser ${UGID} -1 -1 -1 ${UGID}
+ fi
+}
+
+src_configure() {
+ local myconf=""
+
+ if use non-root; then
+ myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
+ fi
+
+ # If a user has already enabled db support, those plugins will
+ # most likely be desired as well. Besides they don't impose new
+ # dependencies and come at no cost (except for space).
+ if use mysql || use sqlite; then
+ myconf="${myconf} --enable-attr-sql --enable-sql"
+ fi
+
+ # strongSwan builds and installs static libs by default which are
+ # useless to the user (and to strongSwan for that matter) because no
+ # header files or alike get installed... so disabling them is safe.
+ if use pam && use eap; then
+ myconf="${myconf} --enable-eap-gtc"
+ else
+ myconf="${myconf} --disable-eap-gtc"
+ fi
+
+ for mod in $STRONGSWAN_PLUGINS_STD; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ for mod in $STRONGSWAN_PLUGINS_OPT; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ econf \
+ --disable-static \
+ --enable-ikev1 \
+ --enable-ikev2 \
+ --enable-swanctl \
+ --enable-socket-dynamic \
+ $(use_enable curl) \
+ $(use_enable constraints) \
+ $(use_enable ldap) \
+ $(use_enable debug leak-detective) \
+ $(use_enable dhcp) \
+ $(use_enable eap eap-sim) \
+ $(use_enable eap eap-sim-file) \
+ $(use_enable eap eap-simaka-sql) \
+ $(use_enable eap eap-simaka-pseudonym) \
+ $(use_enable eap eap-simaka-reauth) \
+ $(use_enable eap eap-identity) \
+ $(use_enable eap eap-md5) \
+ $(use_enable eap eap-aka) \
+ $(use_enable eap eap-aka-3gpp2) \
+ $(use_enable eap md4) \
+ $(use_enable eap eap-mschapv2) \
+ $(use_enable eap eap-radius) \
+ $(use_enable eap eap-tls) \
+ $(use_enable eap eap-ttls) \
+ $(use_enable eap xauth-eap) \
+ $(use_enable eap eap-dynamic) \
+ $(use_enable farp) \
+ $(use_enable gmp) \
+ $(use_enable gcrypt) \
+ $(use_enable mysql) \
+ $(use_enable networkmanager nm) \
+ $(use_enable openssl) \
+ $(use_enable pam xauth-pam) \
+ $(use_enable pkcs11) \
+ $(use_enable sqlite) \
+ $(use_enable systemd) \
+ $(use_with caps capabilities libcap) \
+ --with-systemdsystemunitdir="$(systemd_get_systemunitdir)" \
+ ${myconf}
+}
+
+src_install() {
+ emake DESTDIR="${D}" install
+
+ doinitd "${FILESDIR}"/ipsec
+
+ local dir_ugid
+ if use non-root; then
+ fowners ${UGID}:${UGID} \
+ /etc/ipsec.conf \
+ /etc/strongswan.conf
+
+ dir_ugid="${UGID}"
+ else
+ dir_ugid="root"
+ fi
+
+ diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
+ dodir /etc/ipsec.d \
+ /etc/ipsec.d/aacerts \
+ /etc/ipsec.d/acerts \
+ /etc/ipsec.d/cacerts \
+ /etc/ipsec.d/certs \
+ /etc/ipsec.d/crls \
+ /etc/ipsec.d/ocspcerts \
+ /etc/ipsec.d/private \
+ /etc/ipsec.d/reqs
+
+ dodoc NEWS README TODO || die
+
+ # shared libs are used only internally and there are no static libs,
+ # so it's safe to get rid of the .la files
+ find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
+}
+
+pkg_preinst() {
+ has_version "<net-vpn/strongswan-4.3.6-r1"
+ upgrade_from_leq_4_3_6=$(( !$? ))
+
+ has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
+ previous_4_3_6_with_caps=$(( !$? ))
+}
+
+pkg_postinst() {
+ if ! use openssl && ! use gcrypt; then
+ elog
+ elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
+ elog "Please note that this might effect availability and speed of some"
+ elog "cryptographic features. You are advised to enable the OpenSSL plugin."
+ elif ! use openssl; then
+ elog
+ elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
+ elog "availability and speed of some cryptographic features. There will be"
+ elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
+ elog "25, 26) and ECDSA."
+ fi
+
+ if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
+ chmod 0750 "${ROOT}"/etc/ipsec.d \
+ "${ROOT}"/etc/ipsec.d/aacerts \
+ "${ROOT}"/etc/ipsec.d/acerts \
+ "${ROOT}"/etc/ipsec.d/cacerts \
+ "${ROOT}"/etc/ipsec.d/certs \
+ "${ROOT}"/etc/ipsec.d/crls \
+ "${ROOT}"/etc/ipsec.d/ocspcerts \
+ "${ROOT}"/etc/ipsec.d/private \
+ "${ROOT}"/etc/ipsec.d/reqs
+
+ ewarn
+ ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
+ ewarn "security reasons. Your system installed directories have been"
+ ewarn "updated accordingly. Please check if necessary."
+ ewarn
+
+ if [[ $previous_4_3_6_with_caps == 1 ]]; then
+ if ! use non-root; then
+ ewarn
+ ewarn "IMPORTANT: You previously had ${PN} installed without root"
+ ewarn "privileges because it was implied by the 'caps' USE flag."
+ ewarn "This has been changed. If you want ${PN} with user privileges,"
+ ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
+ ewarn
+ fi
+ fi
+ fi
+ if ! use caps && ! use non-root; then
+ ewarn
+ ewarn "You have decided to run ${PN} with root privileges and built it"
+ ewarn "without support for POSIX capability dropping. It is generally"
+ ewarn "strongly suggested that you reconsider- especially if you intend"
+ ewarn "to run ${PN} as server with a public ip address."
+ ewarn
+ ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
+ ewarn
+ fi
+ if use non-root; then
+ elog
+ elog "${PN} has been installed without superuser privileges (USE=non-root)."
+ elog "This imposes several limitations mainly to the IKEv1 daemon 'pluto'"
+ elog "but also a few to the IKEv2 daemon 'charon'."
+ elog
+ elog "Please carefully read: http://wiki.strongswan.org/wiki/nonRoot"
+ elog
+ elog "pluto uses a helper script by default to insert/remove routing and"
+ elog "policy rules upon connection start/stop which requires superuser"
+ elog "privileges. charon in contrast does this internally and can do so"
+ elog "even with reduced (user) privileges."
+ elog
+ elog "Thus if you require IKEv1 (pluto) or need to specify a custom updown"
+ elog "script to pluto or charon which requires superuser privileges, you"
+ elog "can work around this limitation by using sudo to grant the"
+ elog "user \"ipsec\" the appropriate rights."
+ elog "For example (the default case):"
+ elog "/etc/sudoers:"
+ elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
+ elog "Under the specific connection block in /etc/ipsec.conf:"
+ elog " leftupdown=\"sudo -E ipsec _updown iptables\""
+ elog
+ fi
+ elog
+ elog "Make sure you have _all_ required kernel modules available including"
+ elog "the appropriate cryptographic algorithms. A list is available at:"
+ elog " http://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
+ elog
+ elog "The up-to-date manual is available online at:"
+ elog " http://wiki.strongswan.org/"
+ elog
+}
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2018-10-17 10:19 Thomas Deutschmann
0 siblings, 0 replies; 112+ messages in thread
From: Thomas Deutschmann @ 2018-10-17 10:19 UTC (permalink / raw
To: gentoo-commits
commit: 75954cf504602db95aafcb1e80fe1e01b1f3ec22
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Wed Oct 17 10:19:31 2018 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Wed Oct 17 10:19:46 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=75954cf5
net-vpn/strongswan: security cleanup (bug #628606)
Package-Manager: Portage-2.3.51, Repoman-2.3.11
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
net-vpn/strongswan/Manifest | 1 -
net-vpn/strongswan/strongswan-5.5.3.ebuild | 302 -----------------------------
net-vpn/strongswan/strongswan-5.6.0.ebuild | 302 -----------------------------
3 files changed, 605 deletions(-)
diff --git a/net-vpn/strongswan/Manifest b/net-vpn/strongswan/Manifest
index dbe0b5b6b3d..b35b74232d7 100644
--- a/net-vpn/strongswan/Manifest
+++ b/net-vpn/strongswan/Manifest
@@ -1,4 +1,3 @@
-DIST strongswan-5.5.3.tar.bz2 4768820 BLAKE2B 9f9da6c2ef27cec7f6a07f1cd5a7ecc8a92576fad2a5c6379b93d8a2e9d3b0804fe26dc0bc7b303754ef499ee938549c7cafbdf9a3f8f818d14cf88f613fe0fd SHA512 0b0b25d2102c98cda54300dc8c3c3a49a55e64f7c695dda65a24f2194f19bce0b7aab9e4f7486c243b552f9d1a94867d6a8782ee504aad1c9973809706d599ac
DIST strongswan-5.6.0.tar.bz2 4850722 BLAKE2B edb9f2b277cd8bccf886a824e4b3fb3c06af7510d9e21283fcb8d8ba9cf234f38182fcd1ca0c350b4039945ab10888406986d9a0b8edac24fe09faf0b8967fb2 SHA512 9362069a01c3642e62864d88fdb409a3c7514bf7c92cbe36e552c6a80915119cf5bb91c39592aab2d15b562684a0628a764e4fa7636d3b5fd2ebaf165c0ce649
DIST strongswan-5.6.2.tar.bz2 4977859 BLAKE2B 83943ec95e6b95724e9fc130a09f7c7364147d0ce50528ac8b64452db53516b143e92c7dcb746c0c25aaac9182dda14d55e5c267fbdcd5bb9a63cbf48801274b SHA512 cf2d5cb6c45d991fe0ad8eed4ea8628f95a1871e9728ddf0985aa26e78d1e6da1c92c961772aafd3e55cfcfa84516204a15561389d373f78140f05607b248c52
DIST strongswan-5.6.3.tar.bz2 4961579 BLAKE2B 177d9ca9a730c8ccb3293c9f1c1397429879177aef60c90a3561fffed64cd4fe18cdf1c74bd52956c576e061ce33935b7dc34864576edeac7d4824841b0ee3e0 SHA512 080402640952b1a08e95bfe9c7f33c6a7dd01ac401b5e7e2e78257c0f2bf0a4d6078141232ac62abfacef892c493f6824948b3165d54d72b4e436ed564fd2609
diff --git a/net-vpn/strongswan/strongswan-5.5.3.ebuild b/net-vpn/strongswan/strongswan-5.5.3.ebuild
deleted file mode 100644
index 7cf43b5ece0..00000000000
--- a/net-vpn/strongswan/strongswan-5.5.3.ebuild
+++ /dev/null
@@ -1,302 +0,0 @@
-# Copyright 1999-2018 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=5
-inherit eutils linux-info systemd user
-
-DESCRIPTION="IPsec-based VPN solution focused on security and ease of use, supporting IKEv1/IKEv2 and MOBIKE"
-HOMEPAGE="http://www.strongswan.org/"
-SRC_URI="http://download.strongswan.org/${P}.tar.bz2"
-
-LICENSE="GPL-2 RSA DES"
-SLOT="0"
-KEYWORDS="amd64 arm ppc ~ppc64 x86"
-IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite pam pkcs11"
-
-STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
-STRONGSWAN_PLUGINS_OPT="blowfish ccm ctr gcm ha ipseckey ntru padlock rdrand unbound whitelist"
-for mod in $STRONGSWAN_PLUGINS_STD; do
- IUSE="${IUSE} +strongswan_plugins_${mod}"
-done
-
-for mod in $STRONGSWAN_PLUGINS_OPT; do
- IUSE="${IUSE} strongswan_plugins_${mod}"
-done
-
-COMMON_DEPEND="!net-misc/openswan
- gmp? ( >=dev-libs/gmp-4.1.5:= )
- gcrypt? ( dev-libs/libgcrypt:0 )
- caps? ( sys-libs/libcap )
- curl? ( net-misc/curl )
- ldap? ( net-nds/openldap )
- openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist] )
- mysql? ( virtual/mysql )
- sqlite? ( >=dev-db/sqlite-3.3.1 )
- networkmanager? ( net-misc/networkmanager )
- pam? ( sys-libs/pam )
- strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns )"
-DEPEND="${COMMON_DEPEND}
- virtual/linux-sources
- sys-kernel/linux-headers"
-RDEPEND="${COMMON_DEPEND}
- virtual/logger
- sys-apps/iproute2
- !net-vpn/libreswan
- selinux? ( sec-policy/selinux-ipsec )"
-
-UGID="ipsec"
-
-pkg_setup() {
- linux-info_pkg_setup
- elog "Linux kernel version: ${KV_FULL}"
-
- if ! kernel_is -ge 2 6 16; then
- eerror
- eerror "This ebuild currently only supports ${PN} with the"
- eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
- eerror
- fi
-
- if kernel_is -lt 2 6 34; then
- ewarn
- ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
- ewarn
-
- if kernel_is -lt 2 6 29; then
- ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
- ewarn "include all required IPv6 modules even if you just intend"
- ewarn "to run on IPv4 only."
- ewarn
- ewarn "This has been fixed with kernels >= 2.6.29."
- ewarn
- fi
-
- if kernel_is -lt 2 6 33; then
- ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
- ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
- ewarn "miss SHA384 and SHA512 HMAC support altogether."
- ewarn
- ewarn "If you need any of those features, please use kernel >= 2.6.33."
- ewarn
- fi
-
- if kernel_is -lt 2 6 34; then
- ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
- ewarn "ESP cipher is only included in kernels >= 2.6.34."
- ewarn
- ewarn "If you need it, please use kernel >= 2.6.34."
- ewarn
- fi
- fi
-
- if use non-root; then
- enewgroup ${UGID}
- enewuser ${UGID} -1 -1 -1 ${UGID}
- fi
-}
-
-src_prepare() {
- epatch_user
-}
-
-src_configure() {
- local myconf=""
-
- if use non-root; then
- myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
- fi
-
- # If a user has already enabled db support, those plugins will
- # most likely be desired as well. Besides they don't impose new
- # dependencies and come at no cost (except for space).
- if use mysql || use sqlite; then
- myconf="${myconf} --enable-attr-sql --enable-sql"
- fi
-
- # strongSwan builds and installs static libs by default which are
- # useless to the user (and to strongSwan for that matter) because no
- # header files or alike get installed... so disabling them is safe.
- if use pam && use eap; then
- myconf="${myconf} --enable-eap-gtc"
- else
- myconf="${myconf} --disable-eap-gtc"
- fi
-
- for mod in $STRONGSWAN_PLUGINS_STD; do
- if use strongswan_plugins_${mod}; then
- myconf+=" --enable-${mod}"
- fi
- done
-
- for mod in $STRONGSWAN_PLUGINS_OPT; do
- if use strongswan_plugins_${mod}; then
- myconf+=" --enable-${mod}"
- fi
- done
-
- econf \
- --disable-static \
- --enable-ikev1 \
- --enable-ikev2 \
- --enable-swanctl \
- --enable-socket-dynamic \
- $(use_with caps capabilities libcap) \
- $(use_enable curl) \
- $(use_enable constraints) \
- $(use_enable ldap) \
- $(use_enable debug leak-detective) \
- $(use_enable dhcp) \
- $(use_enable eap eap-sim) \
- $(use_enable eap eap-sim-file) \
- $(use_enable eap eap-simaka-sql) \
- $(use_enable eap eap-simaka-pseudonym) \
- $(use_enable eap eap-simaka-reauth) \
- $(use_enable eap eap-identity) \
- $(use_enable eap eap-md5) \
- $(use_enable eap eap-aka) \
- $(use_enable eap eap-aka-3gpp2) \
- $(use_enable eap md4) \
- $(use_enable eap eap-mschapv2) \
- $(use_enable eap eap-radius) \
- $(use_enable eap eap-tls) \
- $(use_enable eap xauth-eap) \
- $(use_enable farp) \
- $(use_enable gmp) \
- $(use_enable gcrypt) \
- $(use_enable mysql) \
- $(use_enable networkmanager nm) \
- $(use_enable openssl) \
- $(use_enable pam xauth-pam) \
- $(use_enable pkcs11) \
- $(use_enable sqlite) \
- "$(systemd_with_unitdir)" \
- ${myconf}
-}
-
-src_install() {
- emake DESTDIR="${D}" install
-
- doinitd "${FILESDIR}"/ipsec
-
- local dir_ugid
- if use non-root; then
- fowners ${UGID}:${UGID} \
- /etc/ipsec.conf \
- /etc/strongswan.conf
-
- dir_ugid="${UGID}"
- else
- dir_ugid="root"
- fi
-
- diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
- dodir /etc/ipsec.d \
- /etc/ipsec.d/aacerts \
- /etc/ipsec.d/acerts \
- /etc/ipsec.d/cacerts \
- /etc/ipsec.d/certs \
- /etc/ipsec.d/crls \
- /etc/ipsec.d/ocspcerts \
- /etc/ipsec.d/private \
- /etc/ipsec.d/reqs
-
- dodoc NEWS README TODO || die
-
- # shared libs are used only internally and there are no static libs,
- # so it's safe to get rid of the .la files
- find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
-}
-
-pkg_preinst() {
- has_version "<net-vpn/strongswan-4.3.6-r1"
- upgrade_from_leq_4_3_6=$(( !$? ))
-
- has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
- previous_4_3_6_with_caps=$(( !$? ))
-}
-
-pkg_postinst() {
- if ! use openssl && ! use gcrypt; then
- elog
- elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
- elog "Please note that this might effect availability and speed of some"
- elog "cryptographic features. You are advised to enable the OpenSSL plugin."
- elif ! use openssl; then
- elog
- elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
- elog "availability and speed of some cryptographic features. There will be"
- elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
- elog "25, 26) and ECDSA."
- fi
-
- if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
- chmod 0750 "${ROOT}"/etc/ipsec.d \
- "${ROOT}"/etc/ipsec.d/aacerts \
- "${ROOT}"/etc/ipsec.d/acerts \
- "${ROOT}"/etc/ipsec.d/cacerts \
- "${ROOT}"/etc/ipsec.d/certs \
- "${ROOT}"/etc/ipsec.d/crls \
- "${ROOT}"/etc/ipsec.d/ocspcerts \
- "${ROOT}"/etc/ipsec.d/private \
- "${ROOT}"/etc/ipsec.d/reqs
-
- ewarn
- ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
- ewarn "security reasons. Your system installed directories have been"
- ewarn "updated accordingly. Please check if necessary."
- ewarn
-
- if [[ $previous_4_3_6_with_caps == 1 ]]; then
- if ! use non-root; then
- ewarn
- ewarn "IMPORTANT: You previously had ${PN} installed without root"
- ewarn "privileges because it was implied by the 'caps' USE flag."
- ewarn "This has been changed. If you want ${PN} with user privileges,"
- ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
- ewarn
- fi
- fi
- fi
- if ! use caps && ! use non-root; then
- ewarn
- ewarn "You have decided to run ${PN} with root privileges and built it"
- ewarn "without support for POSIX capability dropping. It is generally"
- ewarn "strongly suggested that you reconsider- especially if you intend"
- ewarn "to run ${PN} as server with a public ip address."
- ewarn
- ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
- ewarn
- fi
- if use non-root; then
- elog
- elog "${PN} has been installed without superuser privileges (USE=non-root)."
- elog "This imposes several limitations mainly to the IKEv1 daemon 'pluto'"
- elog "but also a few to the IKEv2 daemon 'charon'."
- elog
- elog "Please carefully read: http://wiki.strongswan.org/wiki/nonRoot"
- elog
- elog "pluto uses a helper script by default to insert/remove routing and"
- elog "policy rules upon connection start/stop which requires superuser"
- elog "privileges. charon in contrast does this internally and can do so"
- elog "even with reduced (user) privileges."
- elog
- elog "Thus if you require IKEv1 (pluto) or need to specify a custom updown"
- elog "script to pluto or charon which requires superuser privileges, you"
- elog "can work around this limitation by using sudo to grant the"
- elog "user \"ipsec\" the appropriate rights."
- elog "For example (the default case):"
- elog "/etc/sudoers:"
- elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
- elog "Under the specific connection block in /etc/ipsec.conf:"
- elog " leftupdown=\"sudo -E ipsec _updown iptables\""
- elog
- fi
- elog
- elog "Make sure you have _all_ required kernel modules available including"
- elog "the appropriate cryptographic algorithms. A list is available at:"
- elog " http://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
- elog
- elog "The up-to-date manual is available online at:"
- elog " http://wiki.strongswan.org/"
- elog
-}
diff --git a/net-vpn/strongswan/strongswan-5.6.0.ebuild b/net-vpn/strongswan/strongswan-5.6.0.ebuild
deleted file mode 100644
index c4736a96230..00000000000
--- a/net-vpn/strongswan/strongswan-5.6.0.ebuild
+++ /dev/null
@@ -1,302 +0,0 @@
-# Copyright 1999-2018 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=5
-inherit eutils linux-info systemd user
-
-DESCRIPTION="IPsec-based VPN solution focused on security and ease of use, supporting IKEv1/IKEv2 and MOBIKE"
-HOMEPAGE="http://www.strongswan.org/"
-SRC_URI="http://download.strongswan.org/${P}.tar.bz2"
-
-LICENSE="GPL-2 RSA DES"
-SLOT="0"
-KEYWORDS="~amd64 ~arm ~ppc ~ppc64 ~x86"
-IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite pam pkcs11"
-
-STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
-STRONGSWAN_PLUGINS_OPT="blowfish ccm ctr gcm ha ipseckey ntru padlock rdrand unbound whitelist"
-for mod in $STRONGSWAN_PLUGINS_STD; do
- IUSE="${IUSE} +strongswan_plugins_${mod}"
-done
-
-for mod in $STRONGSWAN_PLUGINS_OPT; do
- IUSE="${IUSE} strongswan_plugins_${mod}"
-done
-
-COMMON_DEPEND="!net-misc/openswan
- gmp? ( >=dev-libs/gmp-4.1.5:= )
- gcrypt? ( dev-libs/libgcrypt:0 )
- caps? ( sys-libs/libcap )
- curl? ( net-misc/curl )
- ldap? ( net-nds/openldap )
- openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist] )
- mysql? ( virtual/mysql )
- sqlite? ( >=dev-db/sqlite-3.3.1 )
- networkmanager? ( net-misc/networkmanager )
- pam? ( sys-libs/pam )
- strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns )"
-DEPEND="${COMMON_DEPEND}
- virtual/linux-sources
- sys-kernel/linux-headers"
-RDEPEND="${COMMON_DEPEND}
- virtual/logger
- sys-apps/iproute2
- !net-vpn/libreswan
- selinux? ( sec-policy/selinux-ipsec )"
-
-UGID="ipsec"
-
-pkg_setup() {
- linux-info_pkg_setup
- elog "Linux kernel version: ${KV_FULL}"
-
- if ! kernel_is -ge 2 6 16; then
- eerror
- eerror "This ebuild currently only supports ${PN} with the"
- eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
- eerror
- fi
-
- if kernel_is -lt 2 6 34; then
- ewarn
- ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
- ewarn
-
- if kernel_is -lt 2 6 29; then
- ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
- ewarn "include all required IPv6 modules even if you just intend"
- ewarn "to run on IPv4 only."
- ewarn
- ewarn "This has been fixed with kernels >= 2.6.29."
- ewarn
- fi
-
- if kernel_is -lt 2 6 33; then
- ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
- ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
- ewarn "miss SHA384 and SHA512 HMAC support altogether."
- ewarn
- ewarn "If you need any of those features, please use kernel >= 2.6.33."
- ewarn
- fi
-
- if kernel_is -lt 2 6 34; then
- ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
- ewarn "ESP cipher is only included in kernels >= 2.6.34."
- ewarn
- ewarn "If you need it, please use kernel >= 2.6.34."
- ewarn
- fi
- fi
-
- if use non-root; then
- enewgroup ${UGID}
- enewuser ${UGID} -1 -1 -1 ${UGID}
- fi
-}
-
-src_prepare() {
- epatch_user
-}
-
-src_configure() {
- local myconf=""
-
- if use non-root; then
- myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
- fi
-
- # If a user has already enabled db support, those plugins will
- # most likely be desired as well. Besides they don't impose new
- # dependencies and come at no cost (except for space).
- if use mysql || use sqlite; then
- myconf="${myconf} --enable-attr-sql --enable-sql"
- fi
-
- # strongSwan builds and installs static libs by default which are
- # useless to the user (and to strongSwan for that matter) because no
- # header files or alike get installed... so disabling them is safe.
- if use pam && use eap; then
- myconf="${myconf} --enable-eap-gtc"
- else
- myconf="${myconf} --disable-eap-gtc"
- fi
-
- for mod in $STRONGSWAN_PLUGINS_STD; do
- if use strongswan_plugins_${mod}; then
- myconf+=" --enable-${mod}"
- fi
- done
-
- for mod in $STRONGSWAN_PLUGINS_OPT; do
- if use strongswan_plugins_${mod}; then
- myconf+=" --enable-${mod}"
- fi
- done
-
- econf \
- --disable-static \
- --enable-ikev1 \
- --enable-ikev2 \
- --enable-swanctl \
- --enable-socket-dynamic \
- $(use_with caps capabilities libcap) \
- $(use_enable curl) \
- $(use_enable constraints) \
- $(use_enable ldap) \
- $(use_enable debug leak-detective) \
- $(use_enable dhcp) \
- $(use_enable eap eap-sim) \
- $(use_enable eap eap-sim-file) \
- $(use_enable eap eap-simaka-sql) \
- $(use_enable eap eap-simaka-pseudonym) \
- $(use_enable eap eap-simaka-reauth) \
- $(use_enable eap eap-identity) \
- $(use_enable eap eap-md5) \
- $(use_enable eap eap-aka) \
- $(use_enable eap eap-aka-3gpp2) \
- $(use_enable eap md4) \
- $(use_enable eap eap-mschapv2) \
- $(use_enable eap eap-radius) \
- $(use_enable eap eap-tls) \
- $(use_enable eap xauth-eap) \
- $(use_enable farp) \
- $(use_enable gmp) \
- $(use_enable gcrypt) \
- $(use_enable mysql) \
- $(use_enable networkmanager nm) \
- $(use_enable openssl) \
- $(use_enable pam xauth-pam) \
- $(use_enable pkcs11) \
- $(use_enable sqlite) \
- "$(systemd_with_unitdir)" \
- ${myconf}
-}
-
-src_install() {
- emake DESTDIR="${D}" install
-
- doinitd "${FILESDIR}"/ipsec
-
- local dir_ugid
- if use non-root; then
- fowners ${UGID}:${UGID} \
- /etc/ipsec.conf \
- /etc/strongswan.conf
-
- dir_ugid="${UGID}"
- else
- dir_ugid="root"
- fi
-
- diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
- dodir /etc/ipsec.d \
- /etc/ipsec.d/aacerts \
- /etc/ipsec.d/acerts \
- /etc/ipsec.d/cacerts \
- /etc/ipsec.d/certs \
- /etc/ipsec.d/crls \
- /etc/ipsec.d/ocspcerts \
- /etc/ipsec.d/private \
- /etc/ipsec.d/reqs
-
- dodoc NEWS README TODO || die
-
- # shared libs are used only internally and there are no static libs,
- # so it's safe to get rid of the .la files
- find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
-}
-
-pkg_preinst() {
- has_version "<net-vpn/strongswan-4.3.6-r1"
- upgrade_from_leq_4_3_6=$(( !$? ))
-
- has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
- previous_4_3_6_with_caps=$(( !$? ))
-}
-
-pkg_postinst() {
- if ! use openssl && ! use gcrypt; then
- elog
- elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
- elog "Please note that this might effect availability and speed of some"
- elog "cryptographic features. You are advised to enable the OpenSSL plugin."
- elif ! use openssl; then
- elog
- elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
- elog "availability and speed of some cryptographic features. There will be"
- elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
- elog "25, 26) and ECDSA."
- fi
-
- if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
- chmod 0750 "${ROOT}"/etc/ipsec.d \
- "${ROOT}"/etc/ipsec.d/aacerts \
- "${ROOT}"/etc/ipsec.d/acerts \
- "${ROOT}"/etc/ipsec.d/cacerts \
- "${ROOT}"/etc/ipsec.d/certs \
- "${ROOT}"/etc/ipsec.d/crls \
- "${ROOT}"/etc/ipsec.d/ocspcerts \
- "${ROOT}"/etc/ipsec.d/private \
- "${ROOT}"/etc/ipsec.d/reqs
-
- ewarn
- ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
- ewarn "security reasons. Your system installed directories have been"
- ewarn "updated accordingly. Please check if necessary."
- ewarn
-
- if [[ $previous_4_3_6_with_caps == 1 ]]; then
- if ! use non-root; then
- ewarn
- ewarn "IMPORTANT: You previously had ${PN} installed without root"
- ewarn "privileges because it was implied by the 'caps' USE flag."
- ewarn "This has been changed. If you want ${PN} with user privileges,"
- ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
- ewarn
- fi
- fi
- fi
- if ! use caps && ! use non-root; then
- ewarn
- ewarn "You have decided to run ${PN} with root privileges and built it"
- ewarn "without support for POSIX capability dropping. It is generally"
- ewarn "strongly suggested that you reconsider- especially if you intend"
- ewarn "to run ${PN} as server with a public ip address."
- ewarn
- ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
- ewarn
- fi
- if use non-root; then
- elog
- elog "${PN} has been installed without superuser privileges (USE=non-root)."
- elog "This imposes several limitations mainly to the IKEv1 daemon 'pluto'"
- elog "but also a few to the IKEv2 daemon 'charon'."
- elog
- elog "Please carefully read: http://wiki.strongswan.org/wiki/nonRoot"
- elog
- elog "pluto uses a helper script by default to insert/remove routing and"
- elog "policy rules upon connection start/stop which requires superuser"
- elog "privileges. charon in contrast does this internally and can do so"
- elog "even with reduced (user) privileges."
- elog
- elog "Thus if you require IKEv1 (pluto) or need to specify a custom updown"
- elog "script to pluto or charon which requires superuser privileges, you"
- elog "can work around this limitation by using sudo to grant the"
- elog "user \"ipsec\" the appropriate rights."
- elog "For example (the default case):"
- elog "/etc/sudoers:"
- elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
- elog "Under the specific connection block in /etc/ipsec.conf:"
- elog " leftupdown=\"sudo -E ipsec _updown iptables\""
- elog
- fi
- elog
- elog "Make sure you have _all_ required kernel modules available including"
- elog "the appropriate cryptographic algorithms. A list is available at:"
- elog " http://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
- elog
- elog "The up-to-date manual is available online at:"
- elog " http://wiki.strongswan.org/"
- elog
-}
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2018-10-17 16:10 Agostino Sarubbo
0 siblings, 0 replies; 112+ messages in thread
From: Agostino Sarubbo @ 2018-10-17 16:10 UTC (permalink / raw
To: gentoo-commits
commit: e4abb4431eb0a1bfdacd87cb0ba4094bd749fb50
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Wed Oct 17 16:10:05 2018 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Wed Oct 17 16:10:05 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e4abb443
net-vpn/strongswan: amd64 stable wrt bug #668862
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
Package-Manager: Portage-2.3.49, Repoman-2.3.10
RepoMan-Options: --include-arches="amd64"
net-vpn/strongswan/strongswan-5.7.1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.7.1.ebuild b/net-vpn/strongswan/strongswan-5.7.1.ebuild
index 17e1233b4cd..f13b65d0faa 100644
--- a/net-vpn/strongswan/strongswan-5.7.1.ebuild
+++ b/net-vpn/strongswan/strongswan-5.7.1.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="~amd64 ~arm ~ppc ~ppc64 ~x86"
+KEYWORDS="amd64 ~arm ~ppc ~ppc64 ~x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2018-10-18 11:31 Thomas Deutschmann
0 siblings, 0 replies; 112+ messages in thread
From: Thomas Deutschmann @ 2018-10-18 11:31 UTC (permalink / raw
To: gentoo-commits
commit: 1ac3072d1f7c011e7f72f597eadc172d7e912249
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Thu Oct 18 11:29:10 2018 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Thu Oct 18 11:29:10 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=1ac3072d
net-vpn/strongswan: x86 stable (bug #668862)
Package-Manager: Portage-2.3.51, Repoman-2.3.11
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.7.1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.7.1.ebuild b/net-vpn/strongswan/strongswan-5.7.1.ebuild
index f13b65d0faa..c787179ae1e 100644
--- a/net-vpn/strongswan/strongswan-5.7.1.ebuild
+++ b/net-vpn/strongswan/strongswan-5.7.1.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="amd64 ~arm ~ppc ~ppc64 ~x86"
+KEYWORDS="amd64 ~arm ~ppc ~ppc64 x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2018-10-31 17:17 Markus Meier
0 siblings, 0 replies; 112+ messages in thread
From: Markus Meier @ 2018-10-31 17:17 UTC (permalink / raw
To: gentoo-commits
commit: eaf11597cf6c6a10da536840220d6a9afcc7783c
Author: Markus Meier <maekke <AT> gentoo <DOT> org>
AuthorDate: Wed Oct 31 17:17:07 2018 +0000
Commit: Markus Meier <maekke <AT> gentoo <DOT> org>
CommitDate: Wed Oct 31 17:17:07 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=eaf11597
net-vpn/strongswan: arm stable, bug #668862
Signed-off-by: Markus Meier <maekke <AT> gentoo.org>
Package-Manager: Portage-2.3.49, Repoman-2.3.11
RepoMan-Options: --include-arches="arm"
net-vpn/strongswan/strongswan-5.7.1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.7.1.ebuild b/net-vpn/strongswan/strongswan-5.7.1.ebuild
index c787179ae1e..66abae1e8a4 100644
--- a/net-vpn/strongswan/strongswan-5.7.1.ebuild
+++ b/net-vpn/strongswan/strongswan-5.7.1.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="amd64 ~arm ~ppc ~ppc64 x86"
+KEYWORDS="amd64 arm ~ppc ~ppc64 x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2018-11-07 22:59 Sergei Trofimovich
0 siblings, 0 replies; 112+ messages in thread
From: Sergei Trofimovich @ 2018-11-07 22:59 UTC (permalink / raw
To: gentoo-commits
commit: 7bf1f2120dfcd692bf1a823ce33d9272771c7dd1
Author: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
AuthorDate: Wed Nov 7 22:51:01 2018 +0000
Commit: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
CommitDate: Wed Nov 7 22:59:16 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7bf1f212
net-vpn/strongswan: stable 5.7.1 for ppc, bug #668862
Package-Manager: Portage-2.3.51, Repoman-2.3.12
RepoMan-Options: --include-arches="ppc"
Signed-off-by: Sergei Trofimovich <slyfox <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.7.1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.7.1.ebuild b/net-vpn/strongswan/strongswan-5.7.1.ebuild
index 66abae1e8a4..b536b1a8534 100644
--- a/net-vpn/strongswan/strongswan-5.7.1.ebuild
+++ b/net-vpn/strongswan/strongswan-5.7.1.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="amd64 arm ~ppc ~ppc64 x86"
+KEYWORDS="amd64 arm ppc ~ppc64 x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2018-11-15 12:35 Thomas Deutschmann
0 siblings, 0 replies; 112+ messages in thread
From: Thomas Deutschmann @ 2018-11-15 12:35 UTC (permalink / raw
To: gentoo-commits
commit: c0ff4971ff0d25924489c8c968ee96d7d7759d8f
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Thu Nov 15 12:35:20 2018 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Thu Nov 15 12:35:20 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c0ff4971
net-vpn/strongswan: security cleanup
Bug: https://bugs.gentoo.org/668862
Package-Manager: Portage-2.3.51, Repoman-2.3.12
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
net-vpn/strongswan/Manifest | 3 -
net-vpn/strongswan/strongswan-5.6.0-r1.ebuild | 303 --------------------------
net-vpn/strongswan/strongswan-5.6.2.ebuild | 303 --------------------------
net-vpn/strongswan/strongswan-5.6.3.ebuild | 303 --------------------------
4 files changed, 912 deletions(-)
diff --git a/net-vpn/strongswan/Manifest b/net-vpn/strongswan/Manifest
index b35b74232d7..29fdc73b496 100644
--- a/net-vpn/strongswan/Manifest
+++ b/net-vpn/strongswan/Manifest
@@ -1,4 +1 @@
-DIST strongswan-5.6.0.tar.bz2 4850722 BLAKE2B edb9f2b277cd8bccf886a824e4b3fb3c06af7510d9e21283fcb8d8ba9cf234f38182fcd1ca0c350b4039945ab10888406986d9a0b8edac24fe09faf0b8967fb2 SHA512 9362069a01c3642e62864d88fdb409a3c7514bf7c92cbe36e552c6a80915119cf5bb91c39592aab2d15b562684a0628a764e4fa7636d3b5fd2ebaf165c0ce649
-DIST strongswan-5.6.2.tar.bz2 4977859 BLAKE2B 83943ec95e6b95724e9fc130a09f7c7364147d0ce50528ac8b64452db53516b143e92c7dcb746c0c25aaac9182dda14d55e5c267fbdcd5bb9a63cbf48801274b SHA512 cf2d5cb6c45d991fe0ad8eed4ea8628f95a1871e9728ddf0985aa26e78d1e6da1c92c961772aafd3e55cfcfa84516204a15561389d373f78140f05607b248c52
-DIST strongswan-5.6.3.tar.bz2 4961579 BLAKE2B 177d9ca9a730c8ccb3293c9f1c1397429879177aef60c90a3561fffed64cd4fe18cdf1c74bd52956c576e061ce33935b7dc34864576edeac7d4824841b0ee3e0 SHA512 080402640952b1a08e95bfe9c7f33c6a7dd01ac401b5e7e2e78257c0f2bf0a4d6078141232ac62abfacef892c493f6824948b3165d54d72b4e436ed564fd2609
DIST strongswan-5.7.1.tar.bz2 4967533 BLAKE2B e438d1b44a997eb0e012586b18604bd35ac6f53cce1c34ff89192a760bbd0d6a9aaa7b90b389ff1a5e7c6d2356ff5cc74b40daad1d6579fa5026f4878489bf66 SHA512 43102814434bee7c27a5956be59099cc4ffb9bb5b0d6382ce4c6a80d1d82ed6639f698f5f5544b9ca563554a344638c953525b0e2d39bc6b71b19055c80e07fc
diff --git a/net-vpn/strongswan/strongswan-5.6.0-r1.ebuild b/net-vpn/strongswan/strongswan-5.6.0-r1.ebuild
deleted file mode 100644
index 7682afd92ad..00000000000
--- a/net-vpn/strongswan/strongswan-5.6.0-r1.ebuild
+++ /dev/null
@@ -1,303 +0,0 @@
-# Copyright 1999-2018 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=5
-inherit eutils linux-info systemd user
-
-DESCRIPTION="IPsec-based VPN solution focused on security and ease of use, supporting IKEv1/IKEv2 and MOBIKE"
-HOMEPAGE="http://www.strongswan.org/"
-SRC_URI="http://download.strongswan.org/${P}.tar.bz2"
-
-LICENSE="GPL-2 RSA DES"
-SLOT="0"
-KEYWORDS="amd64 arm ppc ~ppc64 x86"
-IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite pam pkcs11"
-
-STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
-STRONGSWAN_PLUGINS_OPT="blowfish ccm ctr gcm ha ipseckey ntru padlock rdrand unbound whitelist"
-for mod in $STRONGSWAN_PLUGINS_STD; do
- IUSE="${IUSE} +strongswan_plugins_${mod}"
-done
-
-for mod in $STRONGSWAN_PLUGINS_OPT; do
- IUSE="${IUSE} strongswan_plugins_${mod}"
-done
-
-COMMON_DEPEND="!net-misc/openswan
- gmp? ( >=dev-libs/gmp-4.1.5:= )
- gcrypt? ( dev-libs/libgcrypt:0 )
- caps? ( sys-libs/libcap )
- curl? ( net-misc/curl )
- ldap? ( net-nds/openldap )
- openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist] )
- mysql? ( virtual/mysql )
- sqlite? ( >=dev-db/sqlite-3.3.1 )
- networkmanager? ( net-misc/networkmanager )
- pam? ( sys-libs/pam )
- strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns )"
-DEPEND="${COMMON_DEPEND}
- virtual/linux-sources
- sys-kernel/linux-headers"
-RDEPEND="${COMMON_DEPEND}
- virtual/logger
- sys-apps/iproute2
- !net-vpn/libreswan
- selinux? ( sec-policy/selinux-ipsec )"
-
-UGID="ipsec"
-
-pkg_setup() {
- linux-info_pkg_setup
- elog "Linux kernel version: ${KV_FULL}"
-
- if ! kernel_is -ge 2 6 16; then
- eerror
- eerror "This ebuild currently only supports ${PN} with the"
- eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
- eerror
- fi
-
- if kernel_is -lt 2 6 34; then
- ewarn
- ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
- ewarn
-
- if kernel_is -lt 2 6 29; then
- ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
- ewarn "include all required IPv6 modules even if you just intend"
- ewarn "to run on IPv4 only."
- ewarn
- ewarn "This has been fixed with kernels >= 2.6.29."
- ewarn
- fi
-
- if kernel_is -lt 2 6 33; then
- ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
- ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
- ewarn "miss SHA384 and SHA512 HMAC support altogether."
- ewarn
- ewarn "If you need any of those features, please use kernel >= 2.6.33."
- ewarn
- fi
-
- if kernel_is -lt 2 6 34; then
- ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
- ewarn "ESP cipher is only included in kernels >= 2.6.34."
- ewarn
- ewarn "If you need it, please use kernel >= 2.6.34."
- ewarn
- fi
- fi
-
- if use non-root; then
- enewgroup ${UGID}
- enewuser ${UGID} -1 -1 -1 ${UGID}
- fi
-}
-
-src_prepare() {
- epatch_user
-}
-
-src_configure() {
- local myconf=""
-
- if use non-root; then
- myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
- fi
-
- # If a user has already enabled db support, those plugins will
- # most likely be desired as well. Besides they don't impose new
- # dependencies and come at no cost (except for space).
- if use mysql || use sqlite; then
- myconf="${myconf} --enable-attr-sql --enable-sql"
- fi
-
- # strongSwan builds and installs static libs by default which are
- # useless to the user (and to strongSwan for that matter) because no
- # header files or alike get installed... so disabling them is safe.
- if use pam && use eap; then
- myconf="${myconf} --enable-eap-gtc"
- else
- myconf="${myconf} --disable-eap-gtc"
- fi
-
- for mod in $STRONGSWAN_PLUGINS_STD; do
- if use strongswan_plugins_${mod}; then
- myconf+=" --enable-${mod}"
- fi
- done
-
- for mod in $STRONGSWAN_PLUGINS_OPT; do
- if use strongswan_plugins_${mod}; then
- myconf+=" --enable-${mod}"
- fi
- done
-
- econf \
- --disable-static \
- --enable-ikev1 \
- --enable-ikev2 \
- --enable-swanctl \
- --enable-socket-dynamic \
- $(use_with caps capabilities libcap) \
- $(use_enable curl) \
- $(use_enable constraints) \
- $(use_enable ldap) \
- $(use_enable debug leak-detective) \
- $(use_enable dhcp) \
- $(use_enable eap eap-sim) \
- $(use_enable eap eap-sim-file) \
- $(use_enable eap eap-simaka-sql) \
- $(use_enable eap eap-simaka-pseudonym) \
- $(use_enable eap eap-simaka-reauth) \
- $(use_enable eap eap-identity) \
- $(use_enable eap eap-md5) \
- $(use_enable eap eap-aka) \
- $(use_enable eap eap-aka-3gpp2) \
- $(use_enable eap md4) \
- $(use_enable eap eap-mschapv2) \
- $(use_enable eap eap-radius) \
- $(use_enable eap eap-tls) \
- $(use_enable eap xauth-eap) \
- $(use_enable eap eap-dynamic) \
- $(use_enable farp) \
- $(use_enable gmp) \
- $(use_enable gcrypt) \
- $(use_enable mysql) \
- $(use_enable networkmanager nm) \
- $(use_enable openssl) \
- $(use_enable pam xauth-pam) \
- $(use_enable pkcs11) \
- $(use_enable sqlite) \
- "$(systemd_with_unitdir)" \
- ${myconf}
-}
-
-src_install() {
- emake DESTDIR="${D}" install
-
- doinitd "${FILESDIR}"/ipsec
-
- local dir_ugid
- if use non-root; then
- fowners ${UGID}:${UGID} \
- /etc/ipsec.conf \
- /etc/strongswan.conf
-
- dir_ugid="${UGID}"
- else
- dir_ugid="root"
- fi
-
- diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
- dodir /etc/ipsec.d \
- /etc/ipsec.d/aacerts \
- /etc/ipsec.d/acerts \
- /etc/ipsec.d/cacerts \
- /etc/ipsec.d/certs \
- /etc/ipsec.d/crls \
- /etc/ipsec.d/ocspcerts \
- /etc/ipsec.d/private \
- /etc/ipsec.d/reqs
-
- dodoc NEWS README TODO || die
-
- # shared libs are used only internally and there are no static libs,
- # so it's safe to get rid of the .la files
- find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
-}
-
-pkg_preinst() {
- has_version "<net-vpn/strongswan-4.3.6-r1"
- upgrade_from_leq_4_3_6=$(( !$? ))
-
- has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
- previous_4_3_6_with_caps=$(( !$? ))
-}
-
-pkg_postinst() {
- if ! use openssl && ! use gcrypt; then
- elog
- elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
- elog "Please note that this might effect availability and speed of some"
- elog "cryptographic features. You are advised to enable the OpenSSL plugin."
- elif ! use openssl; then
- elog
- elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
- elog "availability and speed of some cryptographic features. There will be"
- elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
- elog "25, 26) and ECDSA."
- fi
-
- if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
- chmod 0750 "${ROOT}"/etc/ipsec.d \
- "${ROOT}"/etc/ipsec.d/aacerts \
- "${ROOT}"/etc/ipsec.d/acerts \
- "${ROOT}"/etc/ipsec.d/cacerts \
- "${ROOT}"/etc/ipsec.d/certs \
- "${ROOT}"/etc/ipsec.d/crls \
- "${ROOT}"/etc/ipsec.d/ocspcerts \
- "${ROOT}"/etc/ipsec.d/private \
- "${ROOT}"/etc/ipsec.d/reqs
-
- ewarn
- ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
- ewarn "security reasons. Your system installed directories have been"
- ewarn "updated accordingly. Please check if necessary."
- ewarn
-
- if [[ $previous_4_3_6_with_caps == 1 ]]; then
- if ! use non-root; then
- ewarn
- ewarn "IMPORTANT: You previously had ${PN} installed without root"
- ewarn "privileges because it was implied by the 'caps' USE flag."
- ewarn "This has been changed. If you want ${PN} with user privileges,"
- ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
- ewarn
- fi
- fi
- fi
- if ! use caps && ! use non-root; then
- ewarn
- ewarn "You have decided to run ${PN} with root privileges and built it"
- ewarn "without support for POSIX capability dropping. It is generally"
- ewarn "strongly suggested that you reconsider- especially if you intend"
- ewarn "to run ${PN} as server with a public ip address."
- ewarn
- ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
- ewarn
- fi
- if use non-root; then
- elog
- elog "${PN} has been installed without superuser privileges (USE=non-root)."
- elog "This imposes several limitations mainly to the IKEv1 daemon 'pluto'"
- elog "but also a few to the IKEv2 daemon 'charon'."
- elog
- elog "Please carefully read: http://wiki.strongswan.org/wiki/nonRoot"
- elog
- elog "pluto uses a helper script by default to insert/remove routing and"
- elog "policy rules upon connection start/stop which requires superuser"
- elog "privileges. charon in contrast does this internally and can do so"
- elog "even with reduced (user) privileges."
- elog
- elog "Thus if you require IKEv1 (pluto) or need to specify a custom updown"
- elog "script to pluto or charon which requires superuser privileges, you"
- elog "can work around this limitation by using sudo to grant the"
- elog "user \"ipsec\" the appropriate rights."
- elog "For example (the default case):"
- elog "/etc/sudoers:"
- elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
- elog "Under the specific connection block in /etc/ipsec.conf:"
- elog " leftupdown=\"sudo -E ipsec _updown iptables\""
- elog
- fi
- elog
- elog "Make sure you have _all_ required kernel modules available including"
- elog "the appropriate cryptographic algorithms. A list is available at:"
- elog " http://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
- elog
- elog "The up-to-date manual is available online at:"
- elog " http://wiki.strongswan.org/"
- elog
-}
diff --git a/net-vpn/strongswan/strongswan-5.6.2.ebuild b/net-vpn/strongswan/strongswan-5.6.2.ebuild
deleted file mode 100644
index c7dbeeac3be..00000000000
--- a/net-vpn/strongswan/strongswan-5.6.2.ebuild
+++ /dev/null
@@ -1,303 +0,0 @@
-# Copyright 1999-2018 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=5
-inherit eutils linux-info systemd user
-
-DESCRIPTION="IPsec-based VPN solution focused on security and ease of use, supporting IKEv1/IKEv2 and MOBIKE"
-HOMEPAGE="http://www.strongswan.org/"
-SRC_URI="http://download.strongswan.org/${P}.tar.bz2"
-
-LICENSE="GPL-2 RSA DES"
-SLOT="0"
-KEYWORDS="~amd64 ~arm ~ppc ~ppc64 ~x86"
-IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite pam pkcs11"
-
-STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
-STRONGSWAN_PLUGINS_OPT="blowfish ccm ctr gcm ha ipseckey ntru padlock rdrand unbound whitelist"
-for mod in $STRONGSWAN_PLUGINS_STD; do
- IUSE="${IUSE} +strongswan_plugins_${mod}"
-done
-
-for mod in $STRONGSWAN_PLUGINS_OPT; do
- IUSE="${IUSE} strongswan_plugins_${mod}"
-done
-
-COMMON_DEPEND="!net-misc/openswan
- gmp? ( >=dev-libs/gmp-4.1.5:= )
- gcrypt? ( dev-libs/libgcrypt:0 )
- caps? ( sys-libs/libcap )
- curl? ( net-misc/curl )
- ldap? ( net-nds/openldap )
- openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist] )
- mysql? ( virtual/mysql )
- sqlite? ( >=dev-db/sqlite-3.3.1 )
- networkmanager? ( net-misc/networkmanager )
- pam? ( sys-libs/pam )
- strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns )"
-DEPEND="${COMMON_DEPEND}
- virtual/linux-sources
- sys-kernel/linux-headers"
-RDEPEND="${COMMON_DEPEND}
- virtual/logger
- sys-apps/iproute2
- !net-vpn/libreswan
- selinux? ( sec-policy/selinux-ipsec )"
-
-UGID="ipsec"
-
-pkg_setup() {
- linux-info_pkg_setup
- elog "Linux kernel version: ${KV_FULL}"
-
- if ! kernel_is -ge 2 6 16; then
- eerror
- eerror "This ebuild currently only supports ${PN} with the"
- eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
- eerror
- fi
-
- if kernel_is -lt 2 6 34; then
- ewarn
- ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
- ewarn
-
- if kernel_is -lt 2 6 29; then
- ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
- ewarn "include all required IPv6 modules even if you just intend"
- ewarn "to run on IPv4 only."
- ewarn
- ewarn "This has been fixed with kernels >= 2.6.29."
- ewarn
- fi
-
- if kernel_is -lt 2 6 33; then
- ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
- ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
- ewarn "miss SHA384 and SHA512 HMAC support altogether."
- ewarn
- ewarn "If you need any of those features, please use kernel >= 2.6.33."
- ewarn
- fi
-
- if kernel_is -lt 2 6 34; then
- ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
- ewarn "ESP cipher is only included in kernels >= 2.6.34."
- ewarn
- ewarn "If you need it, please use kernel >= 2.6.34."
- ewarn
- fi
- fi
-
- if use non-root; then
- enewgroup ${UGID}
- enewuser ${UGID} -1 -1 -1 ${UGID}
- fi
-}
-
-src_prepare() {
- epatch_user
-}
-
-src_configure() {
- local myconf=""
-
- if use non-root; then
- myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
- fi
-
- # If a user has already enabled db support, those plugins will
- # most likely be desired as well. Besides they don't impose new
- # dependencies and come at no cost (except for space).
- if use mysql || use sqlite; then
- myconf="${myconf} --enable-attr-sql --enable-sql"
- fi
-
- # strongSwan builds and installs static libs by default which are
- # useless to the user (and to strongSwan for that matter) because no
- # header files or alike get installed... so disabling them is safe.
- if use pam && use eap; then
- myconf="${myconf} --enable-eap-gtc"
- else
- myconf="${myconf} --disable-eap-gtc"
- fi
-
- for mod in $STRONGSWAN_PLUGINS_STD; do
- if use strongswan_plugins_${mod}; then
- myconf+=" --enable-${mod}"
- fi
- done
-
- for mod in $STRONGSWAN_PLUGINS_OPT; do
- if use strongswan_plugins_${mod}; then
- myconf+=" --enable-${mod}"
- fi
- done
-
- econf \
- --disable-static \
- --enable-ikev1 \
- --enable-ikev2 \
- --enable-swanctl \
- --enable-socket-dynamic \
- $(use_with caps capabilities libcap) \
- $(use_enable curl) \
- $(use_enable constraints) \
- $(use_enable ldap) \
- $(use_enable debug leak-detective) \
- $(use_enable dhcp) \
- $(use_enable eap eap-sim) \
- $(use_enable eap eap-sim-file) \
- $(use_enable eap eap-simaka-sql) \
- $(use_enable eap eap-simaka-pseudonym) \
- $(use_enable eap eap-simaka-reauth) \
- $(use_enable eap eap-identity) \
- $(use_enable eap eap-md5) \
- $(use_enable eap eap-aka) \
- $(use_enable eap eap-aka-3gpp2) \
- $(use_enable eap md4) \
- $(use_enable eap eap-mschapv2) \
- $(use_enable eap eap-radius) \
- $(use_enable eap eap-tls) \
- $(use_enable eap xauth-eap) \
- $(use_enable eap eap-dynamic) \
- $(use_enable farp) \
- $(use_enable gmp) \
- $(use_enable gcrypt) \
- $(use_enable mysql) \
- $(use_enable networkmanager nm) \
- $(use_enable openssl) \
- $(use_enable pam xauth-pam) \
- $(use_enable pkcs11) \
- $(use_enable sqlite) \
- "$(systemd_with_unitdir)" \
- ${myconf}
-}
-
-src_install() {
- emake DESTDIR="${D}" install
-
- doinitd "${FILESDIR}"/ipsec
-
- local dir_ugid
- if use non-root; then
- fowners ${UGID}:${UGID} \
- /etc/ipsec.conf \
- /etc/strongswan.conf
-
- dir_ugid="${UGID}"
- else
- dir_ugid="root"
- fi
-
- diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
- dodir /etc/ipsec.d \
- /etc/ipsec.d/aacerts \
- /etc/ipsec.d/acerts \
- /etc/ipsec.d/cacerts \
- /etc/ipsec.d/certs \
- /etc/ipsec.d/crls \
- /etc/ipsec.d/ocspcerts \
- /etc/ipsec.d/private \
- /etc/ipsec.d/reqs
-
- dodoc NEWS README TODO || die
-
- # shared libs are used only internally and there are no static libs,
- # so it's safe to get rid of the .la files
- find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
-}
-
-pkg_preinst() {
- has_version "<net-vpn/strongswan-4.3.6-r1"
- upgrade_from_leq_4_3_6=$(( !$? ))
-
- has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
- previous_4_3_6_with_caps=$(( !$? ))
-}
-
-pkg_postinst() {
- if ! use openssl && ! use gcrypt; then
- elog
- elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
- elog "Please note that this might effect availability and speed of some"
- elog "cryptographic features. You are advised to enable the OpenSSL plugin."
- elif ! use openssl; then
- elog
- elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
- elog "availability and speed of some cryptographic features. There will be"
- elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
- elog "25, 26) and ECDSA."
- fi
-
- if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
- chmod 0750 "${ROOT}"/etc/ipsec.d \
- "${ROOT}"/etc/ipsec.d/aacerts \
- "${ROOT}"/etc/ipsec.d/acerts \
- "${ROOT}"/etc/ipsec.d/cacerts \
- "${ROOT}"/etc/ipsec.d/certs \
- "${ROOT}"/etc/ipsec.d/crls \
- "${ROOT}"/etc/ipsec.d/ocspcerts \
- "${ROOT}"/etc/ipsec.d/private \
- "${ROOT}"/etc/ipsec.d/reqs
-
- ewarn
- ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
- ewarn "security reasons. Your system installed directories have been"
- ewarn "updated accordingly. Please check if necessary."
- ewarn
-
- if [[ $previous_4_3_6_with_caps == 1 ]]; then
- if ! use non-root; then
- ewarn
- ewarn "IMPORTANT: You previously had ${PN} installed without root"
- ewarn "privileges because it was implied by the 'caps' USE flag."
- ewarn "This has been changed. If you want ${PN} with user privileges,"
- ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
- ewarn
- fi
- fi
- fi
- if ! use caps && ! use non-root; then
- ewarn
- ewarn "You have decided to run ${PN} with root privileges and built it"
- ewarn "without support for POSIX capability dropping. It is generally"
- ewarn "strongly suggested that you reconsider- especially if you intend"
- ewarn "to run ${PN} as server with a public ip address."
- ewarn
- ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
- ewarn
- fi
- if use non-root; then
- elog
- elog "${PN} has been installed without superuser privileges (USE=non-root)."
- elog "This imposes several limitations mainly to the IKEv1 daemon 'pluto'"
- elog "but also a few to the IKEv2 daemon 'charon'."
- elog
- elog "Please carefully read: http://wiki.strongswan.org/wiki/nonRoot"
- elog
- elog "pluto uses a helper script by default to insert/remove routing and"
- elog "policy rules upon connection start/stop which requires superuser"
- elog "privileges. charon in contrast does this internally and can do so"
- elog "even with reduced (user) privileges."
- elog
- elog "Thus if you require IKEv1 (pluto) or need to specify a custom updown"
- elog "script to pluto or charon which requires superuser privileges, you"
- elog "can work around this limitation by using sudo to grant the"
- elog "user \"ipsec\" the appropriate rights."
- elog "For example (the default case):"
- elog "/etc/sudoers:"
- elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
- elog "Under the specific connection block in /etc/ipsec.conf:"
- elog " leftupdown=\"sudo -E ipsec _updown iptables\""
- elog
- fi
- elog
- elog "Make sure you have _all_ required kernel modules available including"
- elog "the appropriate cryptographic algorithms. A list is available at:"
- elog " http://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
- elog
- elog "The up-to-date manual is available online at:"
- elog " http://wiki.strongswan.org/"
- elog
-}
diff --git a/net-vpn/strongswan/strongswan-5.6.3.ebuild b/net-vpn/strongswan/strongswan-5.6.3.ebuild
deleted file mode 100644
index a9486f5cba7..00000000000
--- a/net-vpn/strongswan/strongswan-5.6.3.ebuild
+++ /dev/null
@@ -1,303 +0,0 @@
-# Copyright 1999-2018 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="7"
-inherit linux-info systemd user
-
-DESCRIPTION="IPsec-based VPN solution, supporting IKEv1/IKEv2 and MOBIKE"
-HOMEPAGE="https://www.strongswan.org/"
-SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
-
-LICENSE="GPL-2 RSA DES"
-SLOT="0"
-KEYWORDS="~amd64 ~arm ~ppc ~ppc64 ~x86"
-IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
-
-STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
-STRONGSWAN_PLUGINS_OPT="aesni blowfish ccm chapoly ctr forecast gcm ha ipseckey newhope ntru padlock rdrand save-keys unbound whitelist"
-for mod in $STRONGSWAN_PLUGINS_STD; do
- IUSE="${IUSE} +strongswan_plugins_${mod}"
-done
-
-for mod in $STRONGSWAN_PLUGINS_OPT; do
- IUSE="${IUSE} strongswan_plugins_${mod}"
-done
-
-COMMON_DEPEND="!net-misc/openswan
- gmp? ( >=dev-libs/gmp-4.1.5:= )
- gcrypt? ( dev-libs/libgcrypt:0 )
- caps? ( sys-libs/libcap )
- curl? ( net-misc/curl )
- ldap? ( net-nds/openldap )
- openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist] )
- mysql? ( virtual/mysql )
- sqlite? ( >=dev-db/sqlite-3.3.1 )
- systemd? ( sys-apps/systemd )
- networkmanager? ( net-misc/networkmanager )
- pam? ( sys-libs/pam )
- strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns )"
-DEPEND="${COMMON_DEPEND}
- virtual/linux-sources
- sys-kernel/linux-headers"
-RDEPEND="${COMMON_DEPEND}
- virtual/logger
- sys-apps/iproute2
- !net-vpn/libreswan
- selinux? ( sec-policy/selinux-ipsec )"
-
-UGID="ipsec"
-
-pkg_setup() {
- linux-info_pkg_setup
-
- elog "Linux kernel version: ${KV_FULL}"
-
- if ! kernel_is -ge 2 6 16; then
- eerror
- eerror "This ebuild currently only supports ${PN} with the"
- eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
- eerror
- fi
-
- if kernel_is -lt 2 6 34; then
- ewarn
- ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
- ewarn
-
- if kernel_is -lt 2 6 29; then
- ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
- ewarn "include all required IPv6 modules even if you just intend"
- ewarn "to run on IPv4 only."
- ewarn
- ewarn "This has been fixed with kernels >= 2.6.29."
- ewarn
- fi
-
- if kernel_is -lt 2 6 33; then
- ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
- ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
- ewarn "miss SHA384 and SHA512 HMAC support altogether."
- ewarn
- ewarn "If you need any of those features, please use kernel >= 2.6.33."
- ewarn
- fi
-
- if kernel_is -lt 2 6 34; then
- ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
- ewarn "ESP cipher is only included in kernels >= 2.6.34."
- ewarn
- ewarn "If you need it, please use kernel >= 2.6.34."
- ewarn
- fi
- fi
-
- if use non-root; then
- enewgroup ${UGID}
- enewuser ${UGID} -1 -1 -1 ${UGID}
- fi
-}
-
-src_configure() {
- local myconf=""
-
- if use non-root; then
- myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
- fi
-
- # If a user has already enabled db support, those plugins will
- # most likely be desired as well. Besides they don't impose new
- # dependencies and come at no cost (except for space).
- if use mysql || use sqlite; then
- myconf="${myconf} --enable-attr-sql --enable-sql"
- fi
-
- # strongSwan builds and installs static libs by default which are
- # useless to the user (and to strongSwan for that matter) because no
- # header files or alike get installed... so disabling them is safe.
- if use pam && use eap; then
- myconf="${myconf} --enable-eap-gtc"
- else
- myconf="${myconf} --disable-eap-gtc"
- fi
-
- for mod in $STRONGSWAN_PLUGINS_STD; do
- if use strongswan_plugins_${mod}; then
- myconf+=" --enable-${mod}"
- fi
- done
-
- for mod in $STRONGSWAN_PLUGINS_OPT; do
- if use strongswan_plugins_${mod}; then
- myconf+=" --enable-${mod}"
- fi
- done
-
- econf \
- --disable-static \
- --enable-ikev1 \
- --enable-ikev2 \
- --enable-swanctl \
- --enable-socket-dynamic \
- $(use_enable curl) \
- $(use_enable constraints) \
- $(use_enable ldap) \
- $(use_enable debug leak-detective) \
- $(use_enable dhcp) \
- $(use_enable eap eap-sim) \
- $(use_enable eap eap-sim-file) \
- $(use_enable eap eap-simaka-sql) \
- $(use_enable eap eap-simaka-pseudonym) \
- $(use_enable eap eap-simaka-reauth) \
- $(use_enable eap eap-identity) \
- $(use_enable eap eap-md5) \
- $(use_enable eap eap-aka) \
- $(use_enable eap eap-aka-3gpp2) \
- $(use_enable eap md4) \
- $(use_enable eap eap-mschapv2) \
- $(use_enable eap eap-radius) \
- $(use_enable eap eap-tls) \
- $(use_enable eap eap-ttls) \
- $(use_enable eap xauth-eap) \
- $(use_enable eap eap-dynamic) \
- $(use_enable farp) \
- $(use_enable gmp) \
- $(use_enable gcrypt) \
- $(use_enable mysql) \
- $(use_enable networkmanager nm) \
- $(use_enable openssl) \
- $(use_enable pam xauth-pam) \
- $(use_enable pkcs11) \
- $(use_enable sqlite) \
- $(use_enable systemd) \
- $(use_with caps capabilities libcap) \
- --with-systemdsystemunitdir="$(systemd_get_systemunitdir)" \
- ${myconf}
-}
-
-src_install() {
- emake DESTDIR="${D}" install
-
- doinitd "${FILESDIR}"/ipsec
-
- local dir_ugid
- if use non-root; then
- fowners ${UGID}:${UGID} \
- /etc/ipsec.conf \
- /etc/strongswan.conf
-
- dir_ugid="${UGID}"
- else
- dir_ugid="root"
- fi
-
- diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
- dodir /etc/ipsec.d \
- /etc/ipsec.d/aacerts \
- /etc/ipsec.d/acerts \
- /etc/ipsec.d/cacerts \
- /etc/ipsec.d/certs \
- /etc/ipsec.d/crls \
- /etc/ipsec.d/ocspcerts \
- /etc/ipsec.d/private \
- /etc/ipsec.d/reqs
-
- dodoc NEWS README TODO || die
-
- # shared libs are used only internally and there are no static libs,
- # so it's safe to get rid of the .la files
- find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
-}
-
-pkg_preinst() {
- has_version "<net-vpn/strongswan-4.3.6-r1"
- upgrade_from_leq_4_3_6=$(( !$? ))
-
- has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
- previous_4_3_6_with_caps=$(( !$? ))
-}
-
-pkg_postinst() {
- if ! use openssl && ! use gcrypt; then
- elog
- elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
- elog "Please note that this might effect availability and speed of some"
- elog "cryptographic features. You are advised to enable the OpenSSL plugin."
- elif ! use openssl; then
- elog
- elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
- elog "availability and speed of some cryptographic features. There will be"
- elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
- elog "25, 26) and ECDSA."
- fi
-
- if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
- chmod 0750 "${ROOT}"/etc/ipsec.d \
- "${ROOT}"/etc/ipsec.d/aacerts \
- "${ROOT}"/etc/ipsec.d/acerts \
- "${ROOT}"/etc/ipsec.d/cacerts \
- "${ROOT}"/etc/ipsec.d/certs \
- "${ROOT}"/etc/ipsec.d/crls \
- "${ROOT}"/etc/ipsec.d/ocspcerts \
- "${ROOT}"/etc/ipsec.d/private \
- "${ROOT}"/etc/ipsec.d/reqs
-
- ewarn
- ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
- ewarn "security reasons. Your system installed directories have been"
- ewarn "updated accordingly. Please check if necessary."
- ewarn
-
- if [[ $previous_4_3_6_with_caps == 1 ]]; then
- if ! use non-root; then
- ewarn
- ewarn "IMPORTANT: You previously had ${PN} installed without root"
- ewarn "privileges because it was implied by the 'caps' USE flag."
- ewarn "This has been changed. If you want ${PN} with user privileges,"
- ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
- ewarn
- fi
- fi
- fi
- if ! use caps && ! use non-root; then
- ewarn
- ewarn "You have decided to run ${PN} with root privileges and built it"
- ewarn "without support for POSIX capability dropping. It is generally"
- ewarn "strongly suggested that you reconsider- especially if you intend"
- ewarn "to run ${PN} as server with a public ip address."
- ewarn
- ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
- ewarn
- fi
- if use non-root; then
- elog
- elog "${PN} has been installed without superuser privileges (USE=non-root)."
- elog "This imposes several limitations mainly to the IKEv1 daemon 'pluto'"
- elog "but also a few to the IKEv2 daemon 'charon'."
- elog
- elog "Please carefully read: http://wiki.strongswan.org/wiki/nonRoot"
- elog
- elog "pluto uses a helper script by default to insert/remove routing and"
- elog "policy rules upon connection start/stop which requires superuser"
- elog "privileges. charon in contrast does this internally and can do so"
- elog "even with reduced (user) privileges."
- elog
- elog "Thus if you require IKEv1 (pluto) or need to specify a custom updown"
- elog "script to pluto or charon which requires superuser privileges, you"
- elog "can work around this limitation by using sudo to grant the"
- elog "user \"ipsec\" the appropriate rights."
- elog "For example (the default case):"
- elog "/etc/sudoers:"
- elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
- elog "Under the specific connection block in /etc/ipsec.conf:"
- elog " leftupdown=\"sudo -E ipsec _updown iptables\""
- elog
- fi
- elog
- elog "Make sure you have _all_ required kernel modules available including"
- elog "the appropriate cryptographic algorithms. A list is available at:"
- elog " http://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
- elog
- elog "The up-to-date manual is available online at:"
- elog " http://wiki.strongswan.org/"
- elog
-}
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2019-01-06 21:57 Thomas Deutschmann
0 siblings, 0 replies; 112+ messages in thread
From: Thomas Deutschmann @ 2019-01-06 21:57 UTC (permalink / raw
To: gentoo-commits
commit: ad14f55a7186180241f2ed1b89a117fceee04e05
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Sun Jan 6 21:09:00 2019 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Sun Jan 6 21:57:00 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ad14f55a
net-vpn/strongswan: bump to v5.7.2
- Use /run instead of /var/run for PID dir
Closes: https://bugs.gentoo.org/538102
Package-Manager: Portage-2.3.53, Repoman-2.3.12
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
net-vpn/strongswan/Manifest | 1 +
net-vpn/strongswan/strongswan-5.7.2.ebuild | 304 +++++++++++++++++++++++++++++
2 files changed, 305 insertions(+)
diff --git a/net-vpn/strongswan/Manifest b/net-vpn/strongswan/Manifest
index 29fdc73b496..d47eeafcabf 100644
--- a/net-vpn/strongswan/Manifest
+++ b/net-vpn/strongswan/Manifest
@@ -1 +1,2 @@
DIST strongswan-5.7.1.tar.bz2 4967533 BLAKE2B e438d1b44a997eb0e012586b18604bd35ac6f53cce1c34ff89192a760bbd0d6a9aaa7b90b389ff1a5e7c6d2356ff5cc74b40daad1d6579fa5026f4878489bf66 SHA512 43102814434bee7c27a5956be59099cc4ffb9bb5b0d6382ce4c6a80d1d82ed6639f698f5f5544b9ca563554a344638c953525b0e2d39bc6b71b19055c80e07fc
+DIST strongswan-5.7.2.tar.bz2 4997818 BLAKE2B e5a160ea8d31ae14c9731e414e42653ecb12f259fbe76ec7289f44afe5687f4123d89750a8f57c9ea006aec7f0be28e0f0c56d6c0a4bc96f0e1ba69c29da904f SHA512 e2169dbbc0c03737e34af90d7bc07e444408c5e2ac1f81764eeccbac8b142b984ce9ed512a89071075a930e0997632267f6912aa5b352eee2edbd551b5a64e7e
diff --git a/net-vpn/strongswan/strongswan-5.7.2.ebuild b/net-vpn/strongswan/strongswan-5.7.2.ebuild
new file mode 100644
index 00000000000..39fbb0f18ef
--- /dev/null
+++ b/net-vpn/strongswan/strongswan-5.7.2.ebuild
@@ -0,0 +1,304 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+inherit linux-info systemd user
+
+DESCRIPTION="IPsec-based VPN solution, supporting IKEv1/IKEv2 and MOBIKE"
+HOMEPAGE="https://www.strongswan.org/"
+SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
+
+LICENSE="GPL-2 RSA DES"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~ppc ~ppc64 ~x86"
+IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
+
+STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
+STRONGSWAN_PLUGINS_OPT="aesni blowfish ccm chapoly ctr forecast gcm ha ipseckey newhope ntru padlock rdrand save-keys unbound whitelist"
+for mod in $STRONGSWAN_PLUGINS_STD; do
+ IUSE="${IUSE} +strongswan_plugins_${mod}"
+done
+
+for mod in $STRONGSWAN_PLUGINS_OPT; do
+ IUSE="${IUSE} strongswan_plugins_${mod}"
+done
+
+COMMON_DEPEND="!net-misc/openswan
+ gmp? ( >=dev-libs/gmp-4.1.5:= )
+ gcrypt? ( dev-libs/libgcrypt:0 )
+ caps? ( sys-libs/libcap )
+ curl? ( net-misc/curl )
+ ldap? ( net-nds/openldap )
+ openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist] )
+ mysql? ( dev-db/mysql-connector-c:= )
+ sqlite? ( >=dev-db/sqlite-3.3.1 )
+ systemd? ( sys-apps/systemd )
+ networkmanager? ( net-misc/networkmanager )
+ pam? ( sys-libs/pam )
+ strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns )"
+DEPEND="${COMMON_DEPEND}
+ virtual/linux-sources
+ sys-kernel/linux-headers"
+RDEPEND="${COMMON_DEPEND}
+ virtual/logger
+ sys-apps/iproute2
+ !net-vpn/libreswan
+ selinux? ( sec-policy/selinux-ipsec )"
+
+UGID="ipsec"
+
+pkg_setup() {
+ linux-info_pkg_setup
+
+ elog "Linux kernel version: ${KV_FULL}"
+
+ if ! kernel_is -ge 2 6 16; then
+ eerror
+ eerror "This ebuild currently only supports ${PN} with the"
+ eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
+ eerror
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn
+ ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
+ ewarn
+
+ if kernel_is -lt 2 6 29; then
+ ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
+ ewarn "include all required IPv6 modules even if you just intend"
+ ewarn "to run on IPv4 only."
+ ewarn
+ ewarn "This has been fixed with kernels >= 2.6.29."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 33; then
+ ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
+ ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
+ ewarn "miss SHA384 and SHA512 HMAC support altogether."
+ ewarn
+ ewarn "If you need any of those features, please use kernel >= 2.6.33."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
+ ewarn "ESP cipher is only included in kernels >= 2.6.34."
+ ewarn
+ ewarn "If you need it, please use kernel >= 2.6.34."
+ ewarn
+ fi
+ fi
+
+ if use non-root; then
+ enewgroup ${UGID}
+ enewuser ${UGID} -1 -1 -1 ${UGID}
+ fi
+}
+
+src_configure() {
+ local myconf=""
+
+ if use non-root; then
+ myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
+ fi
+
+ # If a user has already enabled db support, those plugins will
+ # most likely be desired as well. Besides they don't impose new
+ # dependencies and come at no cost (except for space).
+ if use mysql || use sqlite; then
+ myconf="${myconf} --enable-attr-sql --enable-sql"
+ fi
+
+ # strongSwan builds and installs static libs by default which are
+ # useless to the user (and to strongSwan for that matter) because no
+ # header files or alike get installed... so disabling them is safe.
+ if use pam && use eap; then
+ myconf="${myconf} --enable-eap-gtc"
+ else
+ myconf="${myconf} --disable-eap-gtc"
+ fi
+
+ for mod in $STRONGSWAN_PLUGINS_STD; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ for mod in $STRONGSWAN_PLUGINS_OPT; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ econf \
+ --disable-static \
+ --enable-ikev1 \
+ --enable-ikev2 \
+ --enable-swanctl \
+ --enable-socket-dynamic \
+ $(use_enable curl) \
+ $(use_enable constraints) \
+ $(use_enable ldap) \
+ $(use_enable debug leak-detective) \
+ $(use_enable dhcp) \
+ $(use_enable eap eap-sim) \
+ $(use_enable eap eap-sim-file) \
+ $(use_enable eap eap-simaka-sql) \
+ $(use_enable eap eap-simaka-pseudonym) \
+ $(use_enable eap eap-simaka-reauth) \
+ $(use_enable eap eap-identity) \
+ $(use_enable eap eap-md5) \
+ $(use_enable eap eap-aka) \
+ $(use_enable eap eap-aka-3gpp2) \
+ $(use_enable eap md4) \
+ $(use_enable eap eap-mschapv2) \
+ $(use_enable eap eap-radius) \
+ $(use_enable eap eap-tls) \
+ $(use_enable eap eap-ttls) \
+ $(use_enable eap xauth-eap) \
+ $(use_enable eap eap-dynamic) \
+ $(use_enable farp) \
+ $(use_enable gmp) \
+ $(use_enable gcrypt) \
+ $(use_enable mysql) \
+ $(use_enable networkmanager nm) \
+ $(use_enable openssl) \
+ $(use_enable pam xauth-pam) \
+ $(use_enable pkcs11) \
+ $(use_enable sqlite) \
+ $(use_enable systemd) \
+ $(use_with caps capabilities libcap) \
+ --with-piddir=/run \
+ --with-systemdsystemunitdir="$(systemd_get_systemunitdir)" \
+ ${myconf}
+}
+
+src_install() {
+ emake DESTDIR="${D}" install
+
+ doinitd "${FILESDIR}"/ipsec
+
+ local dir_ugid
+ if use non-root; then
+ fowners ${UGID}:${UGID} \
+ /etc/ipsec.conf \
+ /etc/strongswan.conf
+
+ dir_ugid="${UGID}"
+ else
+ dir_ugid="root"
+ fi
+
+ diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
+ dodir /etc/ipsec.d \
+ /etc/ipsec.d/aacerts \
+ /etc/ipsec.d/acerts \
+ /etc/ipsec.d/cacerts \
+ /etc/ipsec.d/certs \
+ /etc/ipsec.d/crls \
+ /etc/ipsec.d/ocspcerts \
+ /etc/ipsec.d/private \
+ /etc/ipsec.d/reqs
+
+ dodoc NEWS README TODO || die
+
+ # shared libs are used only internally and there are no static libs,
+ # so it's safe to get rid of the .la files
+ find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
+}
+
+pkg_preinst() {
+ has_version "<net-vpn/strongswan-4.3.6-r1"
+ upgrade_from_leq_4_3_6=$(( !$? ))
+
+ has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
+ previous_4_3_6_with_caps=$(( !$? ))
+}
+
+pkg_postinst() {
+ if ! use openssl && ! use gcrypt; then
+ elog
+ elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
+ elog "Please note that this might effect availability and speed of some"
+ elog "cryptographic features. You are advised to enable the OpenSSL plugin."
+ elif ! use openssl; then
+ elog
+ elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
+ elog "availability and speed of some cryptographic features. There will be"
+ elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
+ elog "25, 26) and ECDSA."
+ fi
+
+ if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
+ chmod 0750 "${ROOT}"/etc/ipsec.d \
+ "${ROOT}"/etc/ipsec.d/aacerts \
+ "${ROOT}"/etc/ipsec.d/acerts \
+ "${ROOT}"/etc/ipsec.d/cacerts \
+ "${ROOT}"/etc/ipsec.d/certs \
+ "${ROOT}"/etc/ipsec.d/crls \
+ "${ROOT}"/etc/ipsec.d/ocspcerts \
+ "${ROOT}"/etc/ipsec.d/private \
+ "${ROOT}"/etc/ipsec.d/reqs
+
+ ewarn
+ ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
+ ewarn "security reasons. Your system installed directories have been"
+ ewarn "updated accordingly. Please check if necessary."
+ ewarn
+
+ if [[ $previous_4_3_6_with_caps == 1 ]]; then
+ if ! use non-root; then
+ ewarn
+ ewarn "IMPORTANT: You previously had ${PN} installed without root"
+ ewarn "privileges because it was implied by the 'caps' USE flag."
+ ewarn "This has been changed. If you want ${PN} with user privileges,"
+ ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
+ ewarn
+ fi
+ fi
+ fi
+ if ! use caps && ! use non-root; then
+ ewarn
+ ewarn "You have decided to run ${PN} with root privileges and built it"
+ ewarn "without support for POSIX capability dropping. It is generally"
+ ewarn "strongly suggested that you reconsider- especially if you intend"
+ ewarn "to run ${PN} as server with a public ip address."
+ ewarn
+ ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
+ ewarn
+ fi
+ if use non-root; then
+ elog
+ elog "${PN} has been installed without superuser privileges (USE=non-root)."
+ elog "This imposes several limitations mainly to the IKEv1 daemon 'pluto'"
+ elog "but also a few to the IKEv2 daemon 'charon'."
+ elog
+ elog "Please carefully read: http://wiki.strongswan.org/wiki/nonRoot"
+ elog
+ elog "pluto uses a helper script by default to insert/remove routing and"
+ elog "policy rules upon connection start/stop which requires superuser"
+ elog "privileges. charon in contrast does this internally and can do so"
+ elog "even with reduced (user) privileges."
+ elog
+ elog "Thus if you require IKEv1 (pluto) or need to specify a custom updown"
+ elog "script to pluto or charon which requires superuser privileges, you"
+ elog "can work around this limitation by using sudo to grant the"
+ elog "user \"ipsec\" the appropriate rights."
+ elog "For example (the default case):"
+ elog "/etc/sudoers:"
+ elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
+ elog "Under the specific connection block in /etc/ipsec.conf:"
+ elog " leftupdown=\"sudo -E ipsec _updown iptables\""
+ elog
+ fi
+ elog
+ elog "Make sure you have _all_ required kernel modules available including"
+ elog "the appropriate cryptographic algorithms. A list is available at:"
+ elog " http://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
+ elog
+ elog "The up-to-date manual is available online at:"
+ elog " http://wiki.strongswan.org/"
+ elog
+}
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2019-03-02 20:02 Sergei Trofimovich
0 siblings, 0 replies; 112+ messages in thread
From: Sergei Trofimovich @ 2019-03-02 20:02 UTC (permalink / raw
To: gentoo-commits
commit: 2def1dcb32114f20732cc31ce9b8f0fd32c1886e
Author: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
AuthorDate: Sat Mar 2 20:01:59 2019 +0000
Commit: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
CommitDate: Sat Mar 2 20:02:18 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2def1dcb
net-vpn/strongswan: stable 5.7.2 for ppc, bug #679176
Package-Manager: Portage-2.3.62, Repoman-2.3.12
RepoMan-Options: --include-arches="ppc"
Signed-off-by: Sergei Trofimovich <slyfox <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.7.2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.7.2.ebuild b/net-vpn/strongswan/strongswan-5.7.2.ebuild
index 39fbb0f18ef..894a7791c9b 100644
--- a/net-vpn/strongswan/strongswan-5.7.2.ebuild
+++ b/net-vpn/strongswan/strongswan-5.7.2.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="~amd64 ~arm ~ppc ~ppc64 ~x86"
+KEYWORDS="~amd64 ~arm ppc ~ppc64 ~x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2019-03-02 20:49 Thomas Deutschmann
0 siblings, 0 replies; 112+ messages in thread
From: Thomas Deutschmann @ 2019-03-02 20:49 UTC (permalink / raw
To: gentoo-commits
commit: 4bd39fd5c18026a83dba278f18464e82401d8c01
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Sat Mar 2 20:47:40 2019 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Sat Mar 2 20:49:27 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4bd39fd5
net-vpn/strongswan: x86 stable (bug #679176)
Package-Manager: Portage-2.3.62, Repoman-2.3.12
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.7.2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.7.2.ebuild b/net-vpn/strongswan/strongswan-5.7.2.ebuild
index 894a7791c9b..925eb6adb26 100644
--- a/net-vpn/strongswan/strongswan-5.7.2.ebuild
+++ b/net-vpn/strongswan/strongswan-5.7.2.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="~amd64 ~arm ppc ~ppc64 ~x86"
+KEYWORDS="~amd64 ~arm ppc ~ppc64 x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2019-03-03 11:59 Mikle Kolyada
0 siblings, 0 replies; 112+ messages in thread
From: Mikle Kolyada @ 2019-03-03 11:59 UTC (permalink / raw
To: gentoo-commits
commit: eb50e035df78a0eacd53f4c49be26b8be9c446db
Author: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
AuthorDate: Sun Mar 3 11:58:19 2019 +0000
Commit: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
CommitDate: Sun Mar 3 11:59:23 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=eb50e035
net-vpn/strongswan: amd64 stable wrt bug #679176
Signed-off-by: Mikle Kolyada <zlogene <AT> gentoo.org>
Package-Manager: Portage-2.3.51, Repoman-2.3.11
RepoMan-Options: --include-arches="amd64"
net-vpn/strongswan/strongswan-5.7.2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.7.2.ebuild b/net-vpn/strongswan/strongswan-5.7.2.ebuild
index 925eb6adb26..8c74af44c99 100644
--- a/net-vpn/strongswan/strongswan-5.7.2.ebuild
+++ b/net-vpn/strongswan/strongswan-5.7.2.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="~amd64 ~arm ppc ~ppc64 x86"
+KEYWORDS="amd64 ~arm ppc ~ppc64 x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2019-03-10 14:19 Mikle Kolyada
0 siblings, 0 replies; 112+ messages in thread
From: Mikle Kolyada @ 2019-03-10 14:19 UTC (permalink / raw
To: gentoo-commits
commit: 7ae2ff41164d48bfa986c2035ebee124310d94dc
Author: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
AuthorDate: Sun Mar 10 14:19:14 2019 +0000
Commit: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
CommitDate: Sun Mar 10 14:19:14 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7ae2ff41
net-vpn/strongswan: arm stable wrt bug #679176
Signed-off-by: Mikle Kolyada <zlogene <AT> gentoo.org>
Package-Manager: Portage-2.3.51, Repoman-2.3.11
RepoMan-Options: --include-arches="arm"
net-vpn/strongswan/strongswan-5.7.2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.7.2.ebuild b/net-vpn/strongswan/strongswan-5.7.2.ebuild
index 8c74af44c99..4bf09e5d4a8 100644
--- a/net-vpn/strongswan/strongswan-5.7.2.ebuild
+++ b/net-vpn/strongswan/strongswan-5.7.2.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="amd64 ~arm ppc ~ppc64 x86"
+KEYWORDS="amd64 arm ppc ~ppc64 x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2019-04-30 10:26 Thomas Deutschmann
0 siblings, 0 replies; 112+ messages in thread
From: Thomas Deutschmann @ 2019-04-30 10:26 UTC (permalink / raw
To: gentoo-commits
commit: e23e780822627ac39cf9a293906ac9f42e1d8436
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Tue Apr 30 10:10:29 2019 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Tue Apr 30 10:26:06 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e23e7808
net-vpn/strongswan: drop old
Package-Manager: Portage-2.3.65, Repoman-2.3.12
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
net-vpn/strongswan/Manifest | 1 -
net-vpn/strongswan/strongswan-5.7.1.ebuild | 303 -----------------------------
2 files changed, 304 deletions(-)
diff --git a/net-vpn/strongswan/Manifest b/net-vpn/strongswan/Manifest
index d47eeafcabf..ab09edc1212 100644
--- a/net-vpn/strongswan/Manifest
+++ b/net-vpn/strongswan/Manifest
@@ -1,2 +1 @@
-DIST strongswan-5.7.1.tar.bz2 4967533 BLAKE2B e438d1b44a997eb0e012586b18604bd35ac6f53cce1c34ff89192a760bbd0d6a9aaa7b90b389ff1a5e7c6d2356ff5cc74b40daad1d6579fa5026f4878489bf66 SHA512 43102814434bee7c27a5956be59099cc4ffb9bb5b0d6382ce4c6a80d1d82ed6639f698f5f5544b9ca563554a344638c953525b0e2d39bc6b71b19055c80e07fc
DIST strongswan-5.7.2.tar.bz2 4997818 BLAKE2B e5a160ea8d31ae14c9731e414e42653ecb12f259fbe76ec7289f44afe5687f4123d89750a8f57c9ea006aec7f0be28e0f0c56d6c0a4bc96f0e1ba69c29da904f SHA512 e2169dbbc0c03737e34af90d7bc07e444408c5e2ac1f81764eeccbac8b142b984ce9ed512a89071075a930e0997632267f6912aa5b352eee2edbd551b5a64e7e
diff --git a/net-vpn/strongswan/strongswan-5.7.1.ebuild b/net-vpn/strongswan/strongswan-5.7.1.ebuild
deleted file mode 100644
index b536b1a8534..00000000000
--- a/net-vpn/strongswan/strongswan-5.7.1.ebuild
+++ /dev/null
@@ -1,303 +0,0 @@
-# Copyright 1999-2018 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="7"
-inherit linux-info systemd user
-
-DESCRIPTION="IPsec-based VPN solution, supporting IKEv1/IKEv2 and MOBIKE"
-HOMEPAGE="https://www.strongswan.org/"
-SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
-
-LICENSE="GPL-2 RSA DES"
-SLOT="0"
-KEYWORDS="amd64 arm ppc ~ppc64 x86"
-IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
-
-STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
-STRONGSWAN_PLUGINS_OPT="aesni blowfish ccm chapoly ctr forecast gcm ha ipseckey newhope ntru padlock rdrand save-keys unbound whitelist"
-for mod in $STRONGSWAN_PLUGINS_STD; do
- IUSE="${IUSE} +strongswan_plugins_${mod}"
-done
-
-for mod in $STRONGSWAN_PLUGINS_OPT; do
- IUSE="${IUSE} strongswan_plugins_${mod}"
-done
-
-COMMON_DEPEND="!net-misc/openswan
- gmp? ( >=dev-libs/gmp-4.1.5:= )
- gcrypt? ( dev-libs/libgcrypt:0 )
- caps? ( sys-libs/libcap )
- curl? ( net-misc/curl )
- ldap? ( net-nds/openldap )
- openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist] )
- mysql? ( dev-db/mysql-connector-c:= )
- sqlite? ( >=dev-db/sqlite-3.3.1 )
- systemd? ( sys-apps/systemd )
- networkmanager? ( net-misc/networkmanager )
- pam? ( sys-libs/pam )
- strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns )"
-DEPEND="${COMMON_DEPEND}
- virtual/linux-sources
- sys-kernel/linux-headers"
-RDEPEND="${COMMON_DEPEND}
- virtual/logger
- sys-apps/iproute2
- !net-vpn/libreswan
- selinux? ( sec-policy/selinux-ipsec )"
-
-UGID="ipsec"
-
-pkg_setup() {
- linux-info_pkg_setup
-
- elog "Linux kernel version: ${KV_FULL}"
-
- if ! kernel_is -ge 2 6 16; then
- eerror
- eerror "This ebuild currently only supports ${PN} with the"
- eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
- eerror
- fi
-
- if kernel_is -lt 2 6 34; then
- ewarn
- ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
- ewarn
-
- if kernel_is -lt 2 6 29; then
- ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
- ewarn "include all required IPv6 modules even if you just intend"
- ewarn "to run on IPv4 only."
- ewarn
- ewarn "This has been fixed with kernels >= 2.6.29."
- ewarn
- fi
-
- if kernel_is -lt 2 6 33; then
- ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
- ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
- ewarn "miss SHA384 and SHA512 HMAC support altogether."
- ewarn
- ewarn "If you need any of those features, please use kernel >= 2.6.33."
- ewarn
- fi
-
- if kernel_is -lt 2 6 34; then
- ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
- ewarn "ESP cipher is only included in kernels >= 2.6.34."
- ewarn
- ewarn "If you need it, please use kernel >= 2.6.34."
- ewarn
- fi
- fi
-
- if use non-root; then
- enewgroup ${UGID}
- enewuser ${UGID} -1 -1 -1 ${UGID}
- fi
-}
-
-src_configure() {
- local myconf=""
-
- if use non-root; then
- myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
- fi
-
- # If a user has already enabled db support, those plugins will
- # most likely be desired as well. Besides they don't impose new
- # dependencies and come at no cost (except for space).
- if use mysql || use sqlite; then
- myconf="${myconf} --enable-attr-sql --enable-sql"
- fi
-
- # strongSwan builds and installs static libs by default which are
- # useless to the user (and to strongSwan for that matter) because no
- # header files or alike get installed... so disabling them is safe.
- if use pam && use eap; then
- myconf="${myconf} --enable-eap-gtc"
- else
- myconf="${myconf} --disable-eap-gtc"
- fi
-
- for mod in $STRONGSWAN_PLUGINS_STD; do
- if use strongswan_plugins_${mod}; then
- myconf+=" --enable-${mod}"
- fi
- done
-
- for mod in $STRONGSWAN_PLUGINS_OPT; do
- if use strongswan_plugins_${mod}; then
- myconf+=" --enable-${mod}"
- fi
- done
-
- econf \
- --disable-static \
- --enable-ikev1 \
- --enable-ikev2 \
- --enable-swanctl \
- --enable-socket-dynamic \
- $(use_enable curl) \
- $(use_enable constraints) \
- $(use_enable ldap) \
- $(use_enable debug leak-detective) \
- $(use_enable dhcp) \
- $(use_enable eap eap-sim) \
- $(use_enable eap eap-sim-file) \
- $(use_enable eap eap-simaka-sql) \
- $(use_enable eap eap-simaka-pseudonym) \
- $(use_enable eap eap-simaka-reauth) \
- $(use_enable eap eap-identity) \
- $(use_enable eap eap-md5) \
- $(use_enable eap eap-aka) \
- $(use_enable eap eap-aka-3gpp2) \
- $(use_enable eap md4) \
- $(use_enable eap eap-mschapv2) \
- $(use_enable eap eap-radius) \
- $(use_enable eap eap-tls) \
- $(use_enable eap eap-ttls) \
- $(use_enable eap xauth-eap) \
- $(use_enable eap eap-dynamic) \
- $(use_enable farp) \
- $(use_enable gmp) \
- $(use_enable gcrypt) \
- $(use_enable mysql) \
- $(use_enable networkmanager nm) \
- $(use_enable openssl) \
- $(use_enable pam xauth-pam) \
- $(use_enable pkcs11) \
- $(use_enable sqlite) \
- $(use_enable systemd) \
- $(use_with caps capabilities libcap) \
- --with-systemdsystemunitdir="$(systemd_get_systemunitdir)" \
- ${myconf}
-}
-
-src_install() {
- emake DESTDIR="${D}" install
-
- doinitd "${FILESDIR}"/ipsec
-
- local dir_ugid
- if use non-root; then
- fowners ${UGID}:${UGID} \
- /etc/ipsec.conf \
- /etc/strongswan.conf
-
- dir_ugid="${UGID}"
- else
- dir_ugid="root"
- fi
-
- diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
- dodir /etc/ipsec.d \
- /etc/ipsec.d/aacerts \
- /etc/ipsec.d/acerts \
- /etc/ipsec.d/cacerts \
- /etc/ipsec.d/certs \
- /etc/ipsec.d/crls \
- /etc/ipsec.d/ocspcerts \
- /etc/ipsec.d/private \
- /etc/ipsec.d/reqs
-
- dodoc NEWS README TODO || die
-
- # shared libs are used only internally and there are no static libs,
- # so it's safe to get rid of the .la files
- find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
-}
-
-pkg_preinst() {
- has_version "<net-vpn/strongswan-4.3.6-r1"
- upgrade_from_leq_4_3_6=$(( !$? ))
-
- has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
- previous_4_3_6_with_caps=$(( !$? ))
-}
-
-pkg_postinst() {
- if ! use openssl && ! use gcrypt; then
- elog
- elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
- elog "Please note that this might effect availability and speed of some"
- elog "cryptographic features. You are advised to enable the OpenSSL plugin."
- elif ! use openssl; then
- elog
- elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
- elog "availability and speed of some cryptographic features. There will be"
- elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
- elog "25, 26) and ECDSA."
- fi
-
- if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
- chmod 0750 "${ROOT}"/etc/ipsec.d \
- "${ROOT}"/etc/ipsec.d/aacerts \
- "${ROOT}"/etc/ipsec.d/acerts \
- "${ROOT}"/etc/ipsec.d/cacerts \
- "${ROOT}"/etc/ipsec.d/certs \
- "${ROOT}"/etc/ipsec.d/crls \
- "${ROOT}"/etc/ipsec.d/ocspcerts \
- "${ROOT}"/etc/ipsec.d/private \
- "${ROOT}"/etc/ipsec.d/reqs
-
- ewarn
- ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
- ewarn "security reasons. Your system installed directories have been"
- ewarn "updated accordingly. Please check if necessary."
- ewarn
-
- if [[ $previous_4_3_6_with_caps == 1 ]]; then
- if ! use non-root; then
- ewarn
- ewarn "IMPORTANT: You previously had ${PN} installed without root"
- ewarn "privileges because it was implied by the 'caps' USE flag."
- ewarn "This has been changed. If you want ${PN} with user privileges,"
- ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
- ewarn
- fi
- fi
- fi
- if ! use caps && ! use non-root; then
- ewarn
- ewarn "You have decided to run ${PN} with root privileges and built it"
- ewarn "without support for POSIX capability dropping. It is generally"
- ewarn "strongly suggested that you reconsider- especially if you intend"
- ewarn "to run ${PN} as server with a public ip address."
- ewarn
- ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
- ewarn
- fi
- if use non-root; then
- elog
- elog "${PN} has been installed without superuser privileges (USE=non-root)."
- elog "This imposes several limitations mainly to the IKEv1 daemon 'pluto'"
- elog "but also a few to the IKEv2 daemon 'charon'."
- elog
- elog "Please carefully read: http://wiki.strongswan.org/wiki/nonRoot"
- elog
- elog "pluto uses a helper script by default to insert/remove routing and"
- elog "policy rules upon connection start/stop which requires superuser"
- elog "privileges. charon in contrast does this internally and can do so"
- elog "even with reduced (user) privileges."
- elog
- elog "Thus if you require IKEv1 (pluto) or need to specify a custom updown"
- elog "script to pluto or charon which requires superuser privileges, you"
- elog "can work around this limitation by using sudo to grant the"
- elog "user \"ipsec\" the appropriate rights."
- elog "For example (the default case):"
- elog "/etc/sudoers:"
- elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
- elog "Under the specific connection block in /etc/ipsec.conf:"
- elog " leftupdown=\"sudo -E ipsec _updown iptables\""
- elog
- fi
- elog
- elog "Make sure you have _all_ required kernel modules available including"
- elog "the appropriate cryptographic algorithms. A list is available at:"
- elog " http://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
- elog
- elog "The up-to-date manual is available online at:"
- elog " http://wiki.strongswan.org/"
- elog
-}
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2019-10-20 20:20 Thomas Deutschmann
0 siblings, 0 replies; 112+ messages in thread
From: Thomas Deutschmann @ 2019-10-20 20:20 UTC (permalink / raw
To: gentoo-commits
commit: feee12c78443442b06b0489c1075b502af2c6849
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Sun Oct 20 20:20:25 2019 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Sun Oct 20 20:20:40 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=feee12c7
net-vpn/strongswan: bump to v5.8.1
Closes: https://bugs.gentoo.org/697898
Package-Manager: Portage-2.3.77, Repoman-2.3.17
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
net-vpn/strongswan/Manifest | 1 +
net-vpn/strongswan/strongswan-5.8.1.ebuild | 308 +++++++++++++++++++++++++++++
2 files changed, 309 insertions(+)
diff --git a/net-vpn/strongswan/Manifest b/net-vpn/strongswan/Manifest
index ab09edc1212..a4d64485f65 100644
--- a/net-vpn/strongswan/Manifest
+++ b/net-vpn/strongswan/Manifest
@@ -1 +1,2 @@
DIST strongswan-5.7.2.tar.bz2 4997818 BLAKE2B e5a160ea8d31ae14c9731e414e42653ecb12f259fbe76ec7289f44afe5687f4123d89750a8f57c9ea006aec7f0be28e0f0c56d6c0a4bc96f0e1ba69c29da904f SHA512 e2169dbbc0c03737e34af90d7bc07e444408c5e2ac1f81764eeccbac8b142b984ce9ed512a89071075a930e0997632267f6912aa5b352eee2edbd551b5a64e7e
+DIST strongswan-5.8.1.tar.bz2 4517921 BLAKE2B 07a82309515a054b267a063fc0e2f49fd03d16b221b1ee26a33c8d367df140797320e1ef7007a39074e40c472022d941656b3ae93d2eb860152cdc5a5d3dbc8a SHA512 630d24643b3d61e931bb25cdd083ad3c55f92fe41f3fcd3198012eee486fb3b1a16dc3f80936162afb7da9e471d45d92b7d183a00153a558babb2a79e5f6813f
diff --git a/net-vpn/strongswan/strongswan-5.8.1.ebuild b/net-vpn/strongswan/strongswan-5.8.1.ebuild
new file mode 100644
index 00000000000..58ef88965e7
--- /dev/null
+++ b/net-vpn/strongswan/strongswan-5.8.1.ebuild
@@ -0,0 +1,308 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+inherit linux-info systemd user
+
+DESCRIPTION="IPsec-based VPN solution, supporting IKEv1/IKEv2 and MOBIKE"
+HOMEPAGE="https://www.strongswan.org/"
+SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
+
+LICENSE="GPL-2 RSA DES"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~ppc ~ppc64 ~x86"
+IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
+
+STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
+STRONGSWAN_PLUGINS_OPT="aesni blowfish ccm chapoly ctr forecast gcm ha ipseckey newhope ntru padlock rdrand save-keys unbound whitelist"
+for mod in $STRONGSWAN_PLUGINS_STD; do
+ IUSE="${IUSE} +strongswan_plugins_${mod}"
+done
+
+for mod in $STRONGSWAN_PLUGINS_OPT; do
+ IUSE="${IUSE} strongswan_plugins_${mod}"
+done
+
+COMMON_DEPEND="!net-misc/openswan
+ gmp? ( >=dev-libs/gmp-4.1.5:= )
+ gcrypt? ( dev-libs/libgcrypt:0 )
+ caps? ( sys-libs/libcap )
+ curl? ( net-misc/curl )
+ ldap? ( net-nds/openldap )
+ openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist] )
+ mysql? ( dev-db/mysql-connector-c:= )
+ sqlite? ( >=dev-db/sqlite-3.3.1 )
+ systemd? ( sys-apps/systemd )
+ networkmanager? ( net-misc/networkmanager )
+ pam? ( sys-libs/pam )
+ strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns )"
+DEPEND="${COMMON_DEPEND}
+ virtual/linux-sources
+ sys-kernel/linux-headers"
+RDEPEND="${COMMON_DEPEND}
+ virtual/logger
+ sys-apps/iproute2
+ !net-vpn/libreswan
+ selinux? ( sec-policy/selinux-ipsec )"
+
+UGID="ipsec"
+
+pkg_setup() {
+ linux-info_pkg_setup
+
+ elog "Linux kernel version: ${KV_FULL}"
+
+ if ! kernel_is -ge 2 6 16; then
+ eerror
+ eerror "This ebuild currently only supports ${PN} with the"
+ eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
+ eerror
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn
+ ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
+ ewarn
+
+ if kernel_is -lt 2 6 29; then
+ ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
+ ewarn "include all required IPv6 modules even if you just intend"
+ ewarn "to run on IPv4 only."
+ ewarn
+ ewarn "This has been fixed with kernels >= 2.6.29."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 33; then
+ ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
+ ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
+ ewarn "miss SHA384 and SHA512 HMAC support altogether."
+ ewarn
+ ewarn "If you need any of those features, please use kernel >= 2.6.33."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
+ ewarn "ESP cipher is only included in kernels >= 2.6.34."
+ ewarn
+ ewarn "If you need it, please use kernel >= 2.6.34."
+ ewarn
+ fi
+ fi
+
+ if use non-root; then
+ enewgroup ${UGID}
+ enewuser ${UGID} -1 -1 -1 ${UGID}
+ fi
+}
+
+src_configure() {
+ local myconf=""
+
+ if use non-root; then
+ myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
+ fi
+
+ # If a user has already enabled db support, those plugins will
+ # most likely be desired as well. Besides they don't impose new
+ # dependencies and come at no cost (except for space).
+ if use mysql || use sqlite; then
+ myconf="${myconf} --enable-attr-sql --enable-sql"
+ fi
+
+ # strongSwan builds and installs static libs by default which are
+ # useless to the user (and to strongSwan for that matter) because no
+ # header files or alike get installed... so disabling them is safe.
+ if use pam && use eap; then
+ myconf="${myconf} --enable-eap-gtc"
+ else
+ myconf="${myconf} --disable-eap-gtc"
+ fi
+
+ for mod in $STRONGSWAN_PLUGINS_STD; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ for mod in $STRONGSWAN_PLUGINS_OPT; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ econf \
+ --disable-static \
+ --enable-ikev1 \
+ --enable-ikev2 \
+ --enable-swanctl \
+ --enable-socket-dynamic \
+ $(use_enable curl) \
+ $(use_enable constraints) \
+ $(use_enable ldap) \
+ $(use_enable debug leak-detective) \
+ $(use_enable dhcp) \
+ $(use_enable eap eap-sim) \
+ $(use_enable eap eap-sim-file) \
+ $(use_enable eap eap-simaka-sql) \
+ $(use_enable eap eap-simaka-pseudonym) \
+ $(use_enable eap eap-simaka-reauth) \
+ $(use_enable eap eap-identity) \
+ $(use_enable eap eap-md5) \
+ $(use_enable eap eap-aka) \
+ $(use_enable eap eap-aka-3gpp2) \
+ $(use_enable eap md4) \
+ $(use_enable eap eap-mschapv2) \
+ $(use_enable eap eap-radius) \
+ $(use_enable eap eap-tls) \
+ $(use_enable eap eap-ttls) \
+ $(use_enable eap xauth-eap) \
+ $(use_enable eap eap-dynamic) \
+ $(use_enable farp) \
+ $(use_enable gmp) \
+ $(use_enable gcrypt) \
+ $(use_enable mysql) \
+ $(use_enable networkmanager nm) \
+ $(use_enable openssl) \
+ $(use_enable pam xauth-pam) \
+ $(use_enable pkcs11) \
+ $(use_enable sqlite) \
+ $(use_enable systemd) \
+ $(use_with caps capabilities libcap) \
+ --with-piddir=/run \
+ --with-systemdsystemunitdir="$(systemd_get_systemunitdir)" \
+ ${myconf}
+}
+
+src_install() {
+ emake DESTDIR="${D}" install
+
+ if ! use systemd; then
+ rm -rf "${ED}"/lib/systemd || die
+ fi
+
+ doinitd "${FILESDIR}"/ipsec
+
+ local dir_ugid
+ if use non-root; then
+ fowners ${UGID}:${UGID} \
+ /etc/ipsec.conf \
+ /etc/strongswan.conf
+
+ dir_ugid="${UGID}"
+ else
+ dir_ugid="root"
+ fi
+
+ diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
+ dodir /etc/ipsec.d \
+ /etc/ipsec.d/aacerts \
+ /etc/ipsec.d/acerts \
+ /etc/ipsec.d/cacerts \
+ /etc/ipsec.d/certs \
+ /etc/ipsec.d/crls \
+ /etc/ipsec.d/ocspcerts \
+ /etc/ipsec.d/private \
+ /etc/ipsec.d/reqs
+
+ dodoc NEWS README TODO || die
+
+ # shared libs are used only internally and there are no static libs,
+ # so it's safe to get rid of the .la files
+ find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
+}
+
+pkg_preinst() {
+ has_version "<net-vpn/strongswan-4.3.6-r1"
+ upgrade_from_leq_4_3_6=$(( !$? ))
+
+ has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
+ previous_4_3_6_with_caps=$(( !$? ))
+}
+
+pkg_postinst() {
+ if ! use openssl && ! use gcrypt; then
+ elog
+ elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
+ elog "Please note that this might effect availability and speed of some"
+ elog "cryptographic features. You are advised to enable the OpenSSL plugin."
+ elif ! use openssl; then
+ elog
+ elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
+ elog "availability and speed of some cryptographic features. There will be"
+ elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
+ elog "25, 26) and ECDSA."
+ fi
+
+ if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
+ chmod 0750 "${ROOT}"/etc/ipsec.d \
+ "${ROOT}"/etc/ipsec.d/aacerts \
+ "${ROOT}"/etc/ipsec.d/acerts \
+ "${ROOT}"/etc/ipsec.d/cacerts \
+ "${ROOT}"/etc/ipsec.d/certs \
+ "${ROOT}"/etc/ipsec.d/crls \
+ "${ROOT}"/etc/ipsec.d/ocspcerts \
+ "${ROOT}"/etc/ipsec.d/private \
+ "${ROOT}"/etc/ipsec.d/reqs
+
+ ewarn
+ ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
+ ewarn "security reasons. Your system installed directories have been"
+ ewarn "updated accordingly. Please check if necessary."
+ ewarn
+
+ if [[ $previous_4_3_6_with_caps == 1 ]]; then
+ if ! use non-root; then
+ ewarn
+ ewarn "IMPORTANT: You previously had ${PN} installed without root"
+ ewarn "privileges because it was implied by the 'caps' USE flag."
+ ewarn "This has been changed. If you want ${PN} with user privileges,"
+ ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
+ ewarn
+ fi
+ fi
+ fi
+ if ! use caps && ! use non-root; then
+ ewarn
+ ewarn "You have decided to run ${PN} with root privileges and built it"
+ ewarn "without support for POSIX capability dropping. It is generally"
+ ewarn "strongly suggested that you reconsider- especially if you intend"
+ ewarn "to run ${PN} as server with a public ip address."
+ ewarn
+ ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
+ ewarn
+ fi
+ if use non-root; then
+ elog
+ elog "${PN} has been installed without superuser privileges (USE=non-root)."
+ elog "This imposes several limitations mainly to the IKEv1 daemon 'pluto'"
+ elog "but also a few to the IKEv2 daemon 'charon'."
+ elog
+ elog "Please carefully read: http://wiki.strongswan.org/wiki/nonRoot"
+ elog
+ elog "pluto uses a helper script by default to insert/remove routing and"
+ elog "policy rules upon connection start/stop which requires superuser"
+ elog "privileges. charon in contrast does this internally and can do so"
+ elog "even with reduced (user) privileges."
+ elog
+ elog "Thus if you require IKEv1 (pluto) or need to specify a custom updown"
+ elog "script to pluto or charon which requires superuser privileges, you"
+ elog "can work around this limitation by using sudo to grant the"
+ elog "user \"ipsec\" the appropriate rights."
+ elog "For example (the default case):"
+ elog "/etc/sudoers:"
+ elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
+ elog "Under the specific connection block in /etc/ipsec.conf:"
+ elog " leftupdown=\"sudo -E ipsec _updown iptables\""
+ elog
+ fi
+ elog
+ elog "Make sure you have _all_ required kernel modules available including"
+ elog "the appropriate cryptographic algorithms. A list is available at:"
+ elog " http://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
+ elog
+ elog "The up-to-date manual is available online at:"
+ elog " http://wiki.strongswan.org/"
+ elog
+}
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2019-12-15 13:43 Agostino Sarubbo
0 siblings, 0 replies; 112+ messages in thread
From: Agostino Sarubbo @ 2019-12-15 13:43 UTC (permalink / raw
To: gentoo-commits
commit: 7d953810c52a81ca5e066d6e47ed1b9df4425baa
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Sun Dec 15 13:41:51 2019 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Sun Dec 15 13:41:51 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7d953810
net-vpn/strongswan: amd64 stable wrt bug #702932
Package-Manager: Portage-2.3.79, Repoman-2.3.16
RepoMan-Options: --include-arches="amd64"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.8.1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.8.1.ebuild b/net-vpn/strongswan/strongswan-5.8.1.ebuild
index 2ab3a0ed5d3..6d4b03776c2 100644
--- a/net-vpn/strongswan/strongswan-5.8.1.ebuild
+++ b/net-vpn/strongswan/strongswan-5.8.1.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="~amd64 ~arm ~ppc ~ppc64 ~x86"
+KEYWORDS="amd64 ~arm ~ppc ~ppc64 ~x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2019-12-15 14:07 Agostino Sarubbo
0 siblings, 0 replies; 112+ messages in thread
From: Agostino Sarubbo @ 2019-12-15 14:07 UTC (permalink / raw
To: gentoo-commits
commit: 2f1b2706de2474bdb6e488859291f7d8418ecda0
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Sun Dec 15 14:06:18 2019 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Sun Dec 15 14:07:19 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2f1b2706
net-vpn/strongswan: ppc stable wrt bug #702932
Package-Manager: Portage-2.3.79, Repoman-2.3.16
RepoMan-Options: --include-arches="ppc"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.8.1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.8.1.ebuild b/net-vpn/strongswan/strongswan-5.8.1.ebuild
index 6d4b03776c2..ba14f7ef8a2 100644
--- a/net-vpn/strongswan/strongswan-5.8.1.ebuild
+++ b/net-vpn/strongswan/strongswan-5.8.1.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="amd64 ~arm ~ppc ~ppc64 ~x86"
+KEYWORDS="amd64 ~arm ppc ~ppc64 ~x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2019-12-15 18:03 Agostino Sarubbo
0 siblings, 0 replies; 112+ messages in thread
From: Agostino Sarubbo @ 2019-12-15 18:03 UTC (permalink / raw
To: gentoo-commits
commit: 9d3cb543fbeaeb2d17885d83ade9a5e237f1839f
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Sun Dec 15 18:03:21 2019 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Sun Dec 15 18:03:21 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9d3cb543
net-vpn/strongswan: x86 stable wrt bug #702932
Package-Manager: Portage-2.3.79, Repoman-2.3.16
RepoMan-Options: --include-arches="x86"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.8.1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.8.1.ebuild b/net-vpn/strongswan/strongswan-5.8.1.ebuild
index ba14f7ef8a2..bbc7987d187 100644
--- a/net-vpn/strongswan/strongswan-5.8.1.ebuild
+++ b/net-vpn/strongswan/strongswan-5.8.1.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="amd64 ~arm ppc ~ppc64 ~x86"
+KEYWORDS="amd64 ~arm ppc ~ppc64 x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2019-12-24 14:49 Mikle Kolyada
0 siblings, 0 replies; 112+ messages in thread
From: Mikle Kolyada @ 2019-12-24 14:49 UTC (permalink / raw
To: gentoo-commits
commit: de5b0a89c923344dd600bbb3789f6c2fb6a16008
Author: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
AuthorDate: Tue Dec 24 14:49:33 2019 +0000
Commit: Mikle Kolyada <zlogene <AT> gentoo <DOT> org>
CommitDate: Tue Dec 24 14:49:33 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=de5b0a89
net-vpn/strongswan: arm stable wrt bug #702932
Package-Manager: Portage-2.3.79, Repoman-2.3.16
RepoMan-Options: --include-arches="arm"
Signed-off-by: Mikle Kolyada <zlogene <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.8.1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.8.1.ebuild b/net-vpn/strongswan/strongswan-5.8.1.ebuild
index bbc7987d187..168a76a9f0d 100644
--- a/net-vpn/strongswan/strongswan-5.8.1.ebuild
+++ b/net-vpn/strongswan/strongswan-5.8.1.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="amd64 ~arm ppc ~ppc64 x86"
+KEYWORDS="amd64 arm ppc ~ppc64 x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2019-12-24 15:07 Thomas Deutschmann
0 siblings, 0 replies; 112+ messages in thread
From: Thomas Deutschmann @ 2019-12-24 15:07 UTC (permalink / raw
To: gentoo-commits
commit: a4e0438d97e9c3645b65bbe9618116fe81f64a3b
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Tue Dec 24 15:03:25 2019 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Tue Dec 24 15:07:19 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a4e0438d
net-vpn/strongswan: drop old
Package-Manager: Portage-2.3.82, Repoman-2.3.20
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
net-vpn/strongswan/Manifest | 1 -
net-vpn/strongswan/strongswan-5.7.2.ebuild | 304 -----------------------------
2 files changed, 305 deletions(-)
diff --git a/net-vpn/strongswan/Manifest b/net-vpn/strongswan/Manifest
index a4d64485f65..bfe47d0734f 100644
--- a/net-vpn/strongswan/Manifest
+++ b/net-vpn/strongswan/Manifest
@@ -1,2 +1 @@
-DIST strongswan-5.7.2.tar.bz2 4997818 BLAKE2B e5a160ea8d31ae14c9731e414e42653ecb12f259fbe76ec7289f44afe5687f4123d89750a8f57c9ea006aec7f0be28e0f0c56d6c0a4bc96f0e1ba69c29da904f SHA512 e2169dbbc0c03737e34af90d7bc07e444408c5e2ac1f81764eeccbac8b142b984ce9ed512a89071075a930e0997632267f6912aa5b352eee2edbd551b5a64e7e
DIST strongswan-5.8.1.tar.bz2 4517921 BLAKE2B 07a82309515a054b267a063fc0e2f49fd03d16b221b1ee26a33c8d367df140797320e1ef7007a39074e40c472022d941656b3ae93d2eb860152cdc5a5d3dbc8a SHA512 630d24643b3d61e931bb25cdd083ad3c55f92fe41f3fcd3198012eee486fb3b1a16dc3f80936162afb7da9e471d45d92b7d183a00153a558babb2a79e5f6813f
diff --git a/net-vpn/strongswan/strongswan-5.7.2.ebuild b/net-vpn/strongswan/strongswan-5.7.2.ebuild
deleted file mode 100644
index 2c19bfbd44a..00000000000
--- a/net-vpn/strongswan/strongswan-5.7.2.ebuild
+++ /dev/null
@@ -1,304 +0,0 @@
-# Copyright 1999-2019 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="7"
-inherit linux-info systemd user
-
-DESCRIPTION="IPsec-based VPN solution, supporting IKEv1/IKEv2 and MOBIKE"
-HOMEPAGE="https://www.strongswan.org/"
-SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
-
-LICENSE="GPL-2 RSA DES"
-SLOT="0"
-KEYWORDS="amd64 arm ppc ~ppc64 x86"
-IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
-
-STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
-STRONGSWAN_PLUGINS_OPT="aesni blowfish ccm chapoly ctr forecast gcm ha ipseckey newhope ntru padlock rdrand save-keys unbound whitelist"
-for mod in $STRONGSWAN_PLUGINS_STD; do
- IUSE="${IUSE} +strongswan_plugins_${mod}"
-done
-
-for mod in $STRONGSWAN_PLUGINS_OPT; do
- IUSE="${IUSE} strongswan_plugins_${mod}"
-done
-
-COMMON_DEPEND="!net-misc/openswan
- gmp? ( >=dev-libs/gmp-4.1.5:= )
- gcrypt? ( dev-libs/libgcrypt:0 )
- caps? ( sys-libs/libcap )
- curl? ( net-misc/curl )
- ldap? ( net-nds/openldap )
- openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist] )
- mysql? ( dev-db/mysql-connector-c:= )
- sqlite? ( >=dev-db/sqlite-3.3.1 )
- systemd? ( sys-apps/systemd )
- networkmanager? ( net-misc/networkmanager )
- pam? ( sys-libs/pam )
- strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns )"
-DEPEND="${COMMON_DEPEND}
- virtual/linux-sources
- sys-kernel/linux-headers"
-RDEPEND="${COMMON_DEPEND}
- virtual/logger
- sys-apps/iproute2
- !net-vpn/libreswan
- selinux? ( sec-policy/selinux-ipsec )"
-
-UGID="ipsec"
-
-pkg_setup() {
- linux-info_pkg_setup
-
- elog "Linux kernel version: ${KV_FULL}"
-
- if ! kernel_is -ge 2 6 16; then
- eerror
- eerror "This ebuild currently only supports ${PN} with the"
- eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
- eerror
- fi
-
- if kernel_is -lt 2 6 34; then
- ewarn
- ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
- ewarn
-
- if kernel_is -lt 2 6 29; then
- ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
- ewarn "include all required IPv6 modules even if you just intend"
- ewarn "to run on IPv4 only."
- ewarn
- ewarn "This has been fixed with kernels >= 2.6.29."
- ewarn
- fi
-
- if kernel_is -lt 2 6 33; then
- ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
- ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
- ewarn "miss SHA384 and SHA512 HMAC support altogether."
- ewarn
- ewarn "If you need any of those features, please use kernel >= 2.6.33."
- ewarn
- fi
-
- if kernel_is -lt 2 6 34; then
- ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
- ewarn "ESP cipher is only included in kernels >= 2.6.34."
- ewarn
- ewarn "If you need it, please use kernel >= 2.6.34."
- ewarn
- fi
- fi
-
- if use non-root; then
- enewgroup ${UGID}
- enewuser ${UGID} -1 -1 -1 ${UGID}
- fi
-}
-
-src_configure() {
- local myconf=""
-
- if use non-root; then
- myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
- fi
-
- # If a user has already enabled db support, those plugins will
- # most likely be desired as well. Besides they don't impose new
- # dependencies and come at no cost (except for space).
- if use mysql || use sqlite; then
- myconf="${myconf} --enable-attr-sql --enable-sql"
- fi
-
- # strongSwan builds and installs static libs by default which are
- # useless to the user (and to strongSwan for that matter) because no
- # header files or alike get installed... so disabling them is safe.
- if use pam && use eap; then
- myconf="${myconf} --enable-eap-gtc"
- else
- myconf="${myconf} --disable-eap-gtc"
- fi
-
- for mod in $STRONGSWAN_PLUGINS_STD; do
- if use strongswan_plugins_${mod}; then
- myconf+=" --enable-${mod}"
- fi
- done
-
- for mod in $STRONGSWAN_PLUGINS_OPT; do
- if use strongswan_plugins_${mod}; then
- myconf+=" --enable-${mod}"
- fi
- done
-
- econf \
- --disable-static \
- --enable-ikev1 \
- --enable-ikev2 \
- --enable-swanctl \
- --enable-socket-dynamic \
- $(use_enable curl) \
- $(use_enable constraints) \
- $(use_enable ldap) \
- $(use_enable debug leak-detective) \
- $(use_enable dhcp) \
- $(use_enable eap eap-sim) \
- $(use_enable eap eap-sim-file) \
- $(use_enable eap eap-simaka-sql) \
- $(use_enable eap eap-simaka-pseudonym) \
- $(use_enable eap eap-simaka-reauth) \
- $(use_enable eap eap-identity) \
- $(use_enable eap eap-md5) \
- $(use_enable eap eap-aka) \
- $(use_enable eap eap-aka-3gpp2) \
- $(use_enable eap md4) \
- $(use_enable eap eap-mschapv2) \
- $(use_enable eap eap-radius) \
- $(use_enable eap eap-tls) \
- $(use_enable eap eap-ttls) \
- $(use_enable eap xauth-eap) \
- $(use_enable eap eap-dynamic) \
- $(use_enable farp) \
- $(use_enable gmp) \
- $(use_enable gcrypt) \
- $(use_enable mysql) \
- $(use_enable networkmanager nm) \
- $(use_enable openssl) \
- $(use_enable pam xauth-pam) \
- $(use_enable pkcs11) \
- $(use_enable sqlite) \
- $(use_enable systemd) \
- $(use_with caps capabilities libcap) \
- --with-piddir=/run \
- --with-systemdsystemunitdir="$(systemd_get_systemunitdir)" \
- ${myconf}
-}
-
-src_install() {
- emake DESTDIR="${D}" install
-
- doinitd "${FILESDIR}"/ipsec
-
- local dir_ugid
- if use non-root; then
- fowners ${UGID}:${UGID} \
- /etc/ipsec.conf \
- /etc/strongswan.conf
-
- dir_ugid="${UGID}"
- else
- dir_ugid="root"
- fi
-
- diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
- dodir /etc/ipsec.d \
- /etc/ipsec.d/aacerts \
- /etc/ipsec.d/acerts \
- /etc/ipsec.d/cacerts \
- /etc/ipsec.d/certs \
- /etc/ipsec.d/crls \
- /etc/ipsec.d/ocspcerts \
- /etc/ipsec.d/private \
- /etc/ipsec.d/reqs
-
- dodoc NEWS README TODO
-
- # shared libs are used only internally and there are no static libs,
- # so it's safe to get rid of the .la files
- find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
-}
-
-pkg_preinst() {
- has_version "<net-vpn/strongswan-4.3.6-r1"
- upgrade_from_leq_4_3_6=$(( !$? ))
-
- has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
- previous_4_3_6_with_caps=$(( !$? ))
-}
-
-pkg_postinst() {
- if ! use openssl && ! use gcrypt; then
- elog
- elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
- elog "Please note that this might effect availability and speed of some"
- elog "cryptographic features. You are advised to enable the OpenSSL plugin."
- elif ! use openssl; then
- elog
- elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
- elog "availability and speed of some cryptographic features. There will be"
- elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
- elog "25, 26) and ECDSA."
- fi
-
- if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
- chmod 0750 "${ROOT}"/etc/ipsec.d \
- "${ROOT}"/etc/ipsec.d/aacerts \
- "${ROOT}"/etc/ipsec.d/acerts \
- "${ROOT}"/etc/ipsec.d/cacerts \
- "${ROOT}"/etc/ipsec.d/certs \
- "${ROOT}"/etc/ipsec.d/crls \
- "${ROOT}"/etc/ipsec.d/ocspcerts \
- "${ROOT}"/etc/ipsec.d/private \
- "${ROOT}"/etc/ipsec.d/reqs
-
- ewarn
- ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
- ewarn "security reasons. Your system installed directories have been"
- ewarn "updated accordingly. Please check if necessary."
- ewarn
-
- if [[ $previous_4_3_6_with_caps == 1 ]]; then
- if ! use non-root; then
- ewarn
- ewarn "IMPORTANT: You previously had ${PN} installed without root"
- ewarn "privileges because it was implied by the 'caps' USE flag."
- ewarn "This has been changed. If you want ${PN} with user privileges,"
- ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
- ewarn
- fi
- fi
- fi
- if ! use caps && ! use non-root; then
- ewarn
- ewarn "You have decided to run ${PN} with root privileges and built it"
- ewarn "without support for POSIX capability dropping. It is generally"
- ewarn "strongly suggested that you reconsider- especially if you intend"
- ewarn "to run ${PN} as server with a public ip address."
- ewarn
- ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
- ewarn
- fi
- if use non-root; then
- elog
- elog "${PN} has been installed without superuser privileges (USE=non-root)."
- elog "This imposes several limitations mainly to the IKEv1 daemon 'pluto'"
- elog "but also a few to the IKEv2 daemon 'charon'."
- elog
- elog "Please carefully read: http://wiki.strongswan.org/wiki/nonRoot"
- elog
- elog "pluto uses a helper script by default to insert/remove routing and"
- elog "policy rules upon connection start/stop which requires superuser"
- elog "privileges. charon in contrast does this internally and can do so"
- elog "even with reduced (user) privileges."
- elog
- elog "Thus if you require IKEv1 (pluto) or need to specify a custom updown"
- elog "script to pluto or charon which requires superuser privileges, you"
- elog "can work around this limitation by using sudo to grant the"
- elog "user \"ipsec\" the appropriate rights."
- elog "For example (the default case):"
- elog "/etc/sudoers:"
- elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
- elog "Under the specific connection block in /etc/ipsec.conf:"
- elog " leftupdown=\"sudo -E ipsec _updown iptables\""
- elog
- fi
- elog
- elog "Make sure you have _all_ required kernel modules available including"
- elog "the appropriate cryptographic algorithms. A list is available at:"
- elog " http://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
- elog
- elog "The up-to-date manual is available online at:"
- elog " http://wiki.strongswan.org/"
- elog
-}
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2019-12-24 15:07 Thomas Deutschmann
0 siblings, 0 replies; 112+ messages in thread
From: Thomas Deutschmann @ 2019-12-24 15:07 UTC (permalink / raw
To: gentoo-commits
commit: 8ba3b86125f41e4ad28d8fcc7cbd6c50bb59e3e8
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Tue Dec 24 15:04:21 2019 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Tue Dec 24 15:07:19 2019 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8ba3b861
net-vpn/strongswan: bump to v5.8.2
Package-Manager: Portage-2.3.82, Repoman-2.3.20
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
net-vpn/strongswan/Manifest | 1 +
net-vpn/strongswan/strongswan-5.8.2.ebuild | 308 +++++++++++++++++++++++++++++
2 files changed, 309 insertions(+)
diff --git a/net-vpn/strongswan/Manifest b/net-vpn/strongswan/Manifest
index bfe47d0734f..ea091b71387 100644
--- a/net-vpn/strongswan/Manifest
+++ b/net-vpn/strongswan/Manifest
@@ -1 +1,2 @@
DIST strongswan-5.8.1.tar.bz2 4517921 BLAKE2B 07a82309515a054b267a063fc0e2f49fd03d16b221b1ee26a33c8d367df140797320e1ef7007a39074e40c472022d941656b3ae93d2eb860152cdc5a5d3dbc8a SHA512 630d24643b3d61e931bb25cdd083ad3c55f92fe41f3fcd3198012eee486fb3b1a16dc3f80936162afb7da9e471d45d92b7d183a00153a558babb2a79e5f6813f
+DIST strongswan-5.8.2.tar.bz2 4533402 BLAKE2B edbfa8dbe1ac00c140cfe9e906ac7aa1b6f3ddfd528dec84e7b1799e5ecdd0f6114679168ebcff9185c8abae78b46dfc43ddc4dabecd44f720285bd175d7a249 SHA512 423e7924acfe8a03ad7d4359ae9086fd516798fcf5eb948a27b52ea719f4d8954b83ea30ce94191ea1647616611df8a1215cb4d5c7ec48676624df6c41853e1d
diff --git a/net-vpn/strongswan/strongswan-5.8.2.ebuild b/net-vpn/strongswan/strongswan-5.8.2.ebuild
new file mode 100644
index 00000000000..2ab3a0ed5d3
--- /dev/null
+++ b/net-vpn/strongswan/strongswan-5.8.2.ebuild
@@ -0,0 +1,308 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+inherit linux-info systemd user
+
+DESCRIPTION="IPsec-based VPN solution, supporting IKEv1/IKEv2 and MOBIKE"
+HOMEPAGE="https://www.strongswan.org/"
+SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
+
+LICENSE="GPL-2 RSA DES"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~ppc ~ppc64 ~x86"
+IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
+
+STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
+STRONGSWAN_PLUGINS_OPT="aesni blowfish ccm chapoly ctr forecast gcm ha ipseckey newhope ntru padlock rdrand save-keys unbound whitelist"
+for mod in $STRONGSWAN_PLUGINS_STD; do
+ IUSE="${IUSE} +strongswan_plugins_${mod}"
+done
+
+for mod in $STRONGSWAN_PLUGINS_OPT; do
+ IUSE="${IUSE} strongswan_plugins_${mod}"
+done
+
+COMMON_DEPEND="!net-misc/openswan
+ gmp? ( >=dev-libs/gmp-4.1.5:= )
+ gcrypt? ( dev-libs/libgcrypt:0 )
+ caps? ( sys-libs/libcap )
+ curl? ( net-misc/curl )
+ ldap? ( net-nds/openldap )
+ openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist] )
+ mysql? ( dev-db/mysql-connector-c:= )
+ sqlite? ( >=dev-db/sqlite-3.3.1 )
+ systemd? ( sys-apps/systemd )
+ networkmanager? ( net-misc/networkmanager )
+ pam? ( sys-libs/pam )
+ strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns )"
+DEPEND="${COMMON_DEPEND}
+ virtual/linux-sources
+ sys-kernel/linux-headers"
+RDEPEND="${COMMON_DEPEND}
+ virtual/logger
+ sys-apps/iproute2
+ !net-vpn/libreswan
+ selinux? ( sec-policy/selinux-ipsec )"
+
+UGID="ipsec"
+
+pkg_setup() {
+ linux-info_pkg_setup
+
+ elog "Linux kernel version: ${KV_FULL}"
+
+ if ! kernel_is -ge 2 6 16; then
+ eerror
+ eerror "This ebuild currently only supports ${PN} with the"
+ eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
+ eerror
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn
+ ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
+ ewarn
+
+ if kernel_is -lt 2 6 29; then
+ ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
+ ewarn "include all required IPv6 modules even if you just intend"
+ ewarn "to run on IPv4 only."
+ ewarn
+ ewarn "This has been fixed with kernels >= 2.6.29."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 33; then
+ ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
+ ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
+ ewarn "miss SHA384 and SHA512 HMAC support altogether."
+ ewarn
+ ewarn "If you need any of those features, please use kernel >= 2.6.33."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
+ ewarn "ESP cipher is only included in kernels >= 2.6.34."
+ ewarn
+ ewarn "If you need it, please use kernel >= 2.6.34."
+ ewarn
+ fi
+ fi
+
+ if use non-root; then
+ enewgroup ${UGID}
+ enewuser ${UGID} -1 -1 -1 ${UGID}
+ fi
+}
+
+src_configure() {
+ local myconf=""
+
+ if use non-root; then
+ myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
+ fi
+
+ # If a user has already enabled db support, those plugins will
+ # most likely be desired as well. Besides they don't impose new
+ # dependencies and come at no cost (except for space).
+ if use mysql || use sqlite; then
+ myconf="${myconf} --enable-attr-sql --enable-sql"
+ fi
+
+ # strongSwan builds and installs static libs by default which are
+ # useless to the user (and to strongSwan for that matter) because no
+ # header files or alike get installed... so disabling them is safe.
+ if use pam && use eap; then
+ myconf="${myconf} --enable-eap-gtc"
+ else
+ myconf="${myconf} --disable-eap-gtc"
+ fi
+
+ for mod in $STRONGSWAN_PLUGINS_STD; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ for mod in $STRONGSWAN_PLUGINS_OPT; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ econf \
+ --disable-static \
+ --enable-ikev1 \
+ --enable-ikev2 \
+ --enable-swanctl \
+ --enable-socket-dynamic \
+ $(use_enable curl) \
+ $(use_enable constraints) \
+ $(use_enable ldap) \
+ $(use_enable debug leak-detective) \
+ $(use_enable dhcp) \
+ $(use_enable eap eap-sim) \
+ $(use_enable eap eap-sim-file) \
+ $(use_enable eap eap-simaka-sql) \
+ $(use_enable eap eap-simaka-pseudonym) \
+ $(use_enable eap eap-simaka-reauth) \
+ $(use_enable eap eap-identity) \
+ $(use_enable eap eap-md5) \
+ $(use_enable eap eap-aka) \
+ $(use_enable eap eap-aka-3gpp2) \
+ $(use_enable eap md4) \
+ $(use_enable eap eap-mschapv2) \
+ $(use_enable eap eap-radius) \
+ $(use_enable eap eap-tls) \
+ $(use_enable eap eap-ttls) \
+ $(use_enable eap xauth-eap) \
+ $(use_enable eap eap-dynamic) \
+ $(use_enable farp) \
+ $(use_enable gmp) \
+ $(use_enable gcrypt) \
+ $(use_enable mysql) \
+ $(use_enable networkmanager nm) \
+ $(use_enable openssl) \
+ $(use_enable pam xauth-pam) \
+ $(use_enable pkcs11) \
+ $(use_enable sqlite) \
+ $(use_enable systemd) \
+ $(use_with caps capabilities libcap) \
+ --with-piddir=/run \
+ --with-systemdsystemunitdir="$(systemd_get_systemunitdir)" \
+ ${myconf}
+}
+
+src_install() {
+ emake DESTDIR="${D}" install
+
+ if ! use systemd; then
+ rm -rf "${ED}"/lib/systemd || die
+ fi
+
+ doinitd "${FILESDIR}"/ipsec
+
+ local dir_ugid
+ if use non-root; then
+ fowners ${UGID}:${UGID} \
+ /etc/ipsec.conf \
+ /etc/strongswan.conf
+
+ dir_ugid="${UGID}"
+ else
+ dir_ugid="root"
+ fi
+
+ diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
+ dodir /etc/ipsec.d \
+ /etc/ipsec.d/aacerts \
+ /etc/ipsec.d/acerts \
+ /etc/ipsec.d/cacerts \
+ /etc/ipsec.d/certs \
+ /etc/ipsec.d/crls \
+ /etc/ipsec.d/ocspcerts \
+ /etc/ipsec.d/private \
+ /etc/ipsec.d/reqs
+
+ dodoc NEWS README TODO
+
+ # shared libs are used only internally and there are no static libs,
+ # so it's safe to get rid of the .la files
+ find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
+}
+
+pkg_preinst() {
+ has_version "<net-vpn/strongswan-4.3.6-r1"
+ upgrade_from_leq_4_3_6=$(( !$? ))
+
+ has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
+ previous_4_3_6_with_caps=$(( !$? ))
+}
+
+pkg_postinst() {
+ if ! use openssl && ! use gcrypt; then
+ elog
+ elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
+ elog "Please note that this might effect availability and speed of some"
+ elog "cryptographic features. You are advised to enable the OpenSSL plugin."
+ elif ! use openssl; then
+ elog
+ elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
+ elog "availability and speed of some cryptographic features. There will be"
+ elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
+ elog "25, 26) and ECDSA."
+ fi
+
+ if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
+ chmod 0750 "${ROOT}"/etc/ipsec.d \
+ "${ROOT}"/etc/ipsec.d/aacerts \
+ "${ROOT}"/etc/ipsec.d/acerts \
+ "${ROOT}"/etc/ipsec.d/cacerts \
+ "${ROOT}"/etc/ipsec.d/certs \
+ "${ROOT}"/etc/ipsec.d/crls \
+ "${ROOT}"/etc/ipsec.d/ocspcerts \
+ "${ROOT}"/etc/ipsec.d/private \
+ "${ROOT}"/etc/ipsec.d/reqs
+
+ ewarn
+ ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
+ ewarn "security reasons. Your system installed directories have been"
+ ewarn "updated accordingly. Please check if necessary."
+ ewarn
+
+ if [[ $previous_4_3_6_with_caps == 1 ]]; then
+ if ! use non-root; then
+ ewarn
+ ewarn "IMPORTANT: You previously had ${PN} installed without root"
+ ewarn "privileges because it was implied by the 'caps' USE flag."
+ ewarn "This has been changed. If you want ${PN} with user privileges,"
+ ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
+ ewarn
+ fi
+ fi
+ fi
+ if ! use caps && ! use non-root; then
+ ewarn
+ ewarn "You have decided to run ${PN} with root privileges and built it"
+ ewarn "without support for POSIX capability dropping. It is generally"
+ ewarn "strongly suggested that you reconsider- especially if you intend"
+ ewarn "to run ${PN} as server with a public ip address."
+ ewarn
+ ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
+ ewarn
+ fi
+ if use non-root; then
+ elog
+ elog "${PN} has been installed without superuser privileges (USE=non-root)."
+ elog "This imposes several limitations mainly to the IKEv1 daemon 'pluto'"
+ elog "but also a few to the IKEv2 daemon 'charon'."
+ elog
+ elog "Please carefully read: http://wiki.strongswan.org/wiki/nonRoot"
+ elog
+ elog "pluto uses a helper script by default to insert/remove routing and"
+ elog "policy rules upon connection start/stop which requires superuser"
+ elog "privileges. charon in contrast does this internally and can do so"
+ elog "even with reduced (user) privileges."
+ elog
+ elog "Thus if you require IKEv1 (pluto) or need to specify a custom updown"
+ elog "script to pluto or charon which requires superuser privileges, you"
+ elog "can work around this limitation by using sudo to grant the"
+ elog "user \"ipsec\" the appropriate rights."
+ elog "For example (the default case):"
+ elog "/etc/sudoers:"
+ elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
+ elog "Under the specific connection block in /etc/ipsec.conf:"
+ elog " leftupdown=\"sudo -E ipsec _updown iptables\""
+ elog
+ fi
+ elog
+ elog "Make sure you have _all_ required kernel modules available including"
+ elog "the appropriate cryptographic algorithms. A list is available at:"
+ elog " http://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
+ elog
+ elog "The up-to-date manual is available online at:"
+ elog " http://wiki.strongswan.org/"
+ elog
+}
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2020-05-03 19:01 Thomas Deutschmann
0 siblings, 0 replies; 112+ messages in thread
From: Thomas Deutschmann @ 2020-05-03 19:01 UTC (permalink / raw
To: gentoo-commits
commit: 6eae691e064bd7f51443476331368d92d73e7742
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Sun May 3 18:41:07 2020 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Sun May 3 19:01:08 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6eae691e
net-vpn/strongswan: bump to v5.8.4
Closes: https://bugs.gentoo.org/716910
Package-Manager: Portage-2.3.99, Repoman-2.3.22
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
net-vpn/strongswan/Manifest | 1 +
net-vpn/strongswan/strongswan-5.8.4.ebuild | 308 +++++++++++++++++++++++++++++
2 files changed, 309 insertions(+)
diff --git a/net-vpn/strongswan/Manifest b/net-vpn/strongswan/Manifest
index ea091b71387..ce8f7438ae4 100644
--- a/net-vpn/strongswan/Manifest
+++ b/net-vpn/strongswan/Manifest
@@ -1,2 +1,3 @@
DIST strongswan-5.8.1.tar.bz2 4517921 BLAKE2B 07a82309515a054b267a063fc0e2f49fd03d16b221b1ee26a33c8d367df140797320e1ef7007a39074e40c472022d941656b3ae93d2eb860152cdc5a5d3dbc8a SHA512 630d24643b3d61e931bb25cdd083ad3c55f92fe41f3fcd3198012eee486fb3b1a16dc3f80936162afb7da9e471d45d92b7d183a00153a558babb2a79e5f6813f
DIST strongswan-5.8.2.tar.bz2 4533402 BLAKE2B edbfa8dbe1ac00c140cfe9e906ac7aa1b6f3ddfd528dec84e7b1799e5ecdd0f6114679168ebcff9185c8abae78b46dfc43ddc4dabecd44f720285bd175d7a249 SHA512 423e7924acfe8a03ad7d4359ae9086fd516798fcf5eb948a27b52ea719f4d8954b83ea30ce94191ea1647616611df8a1215cb4d5c7ec48676624df6c41853e1d
+DIST strongswan-5.8.4.tar.bz2 4546240 BLAKE2B f58f53a17c02924a3ad75bfadd5956f62098c41468ec5fe8d51bf0f0465c8936d8ca846a41a0b6ff6ac24ccd2229e726d3ea2b48904abf5743bbe766e5f5f81c SHA512 15e866b0d6cc4ea94f17856b519d926ae08c15d3b62f675f62685d0722ca8fa26b46afb1ad1c866e9d5f347d77a747f57d0c6d7f6bd57762f37d7798f9e28103
diff --git a/net-vpn/strongswan/strongswan-5.8.4.ebuild b/net-vpn/strongswan/strongswan-5.8.4.ebuild
new file mode 100644
index 00000000000..aa83509c3d2
--- /dev/null
+++ b/net-vpn/strongswan/strongswan-5.8.4.ebuild
@@ -0,0 +1,308 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+inherit linux-info systemd user
+
+DESCRIPTION="IPsec-based VPN solution, supporting IKEv1/IKEv2 and MOBIKE"
+HOMEPAGE="https://www.strongswan.org/"
+SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
+
+LICENSE="GPL-2 RSA DES"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~ppc ~ppc64 ~x86"
+IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
+
+STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
+STRONGSWAN_PLUGINS_OPT="aesni blowfish ccm chapoly ctr forecast gcm ha ipseckey newhope ntru padlock rdrand save-keys unbound whitelist"
+for mod in $STRONGSWAN_PLUGINS_STD; do
+ IUSE="${IUSE} +strongswan_plugins_${mod}"
+done
+
+for mod in $STRONGSWAN_PLUGINS_OPT; do
+ IUSE="${IUSE} strongswan_plugins_${mod}"
+done
+
+COMMON_DEPEND="!net-misc/openswan
+ gmp? ( >=dev-libs/gmp-4.1.5:= )
+ gcrypt? ( dev-libs/libgcrypt:0 )
+ caps? ( sys-libs/libcap )
+ curl? ( net-misc/curl )
+ ldap? ( net-nds/openldap )
+ openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist] )
+ mysql? ( dev-db/mysql-connector-c:= )
+ sqlite? ( >=dev-db/sqlite-3.3.1 )
+ systemd? ( sys-apps/systemd )
+ networkmanager? ( net-misc/networkmanager )
+ pam? ( sys-libs/pam )
+ strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns )"
+DEPEND="${COMMON_DEPEND}
+ virtual/linux-sources
+ sys-kernel/linux-headers"
+RDEPEND="${COMMON_DEPEND}
+ virtual/logger
+ sys-apps/iproute2
+ !net-vpn/libreswan
+ selinux? ( sec-policy/selinux-ipsec )"
+
+UGID="ipsec"
+
+pkg_setup() {
+ linux-info_pkg_setup
+
+ elog "Linux kernel version: ${KV_FULL}"
+
+ if ! kernel_is -ge 2 6 16; then
+ eerror
+ eerror "This ebuild currently only supports ${PN} with the"
+ eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
+ eerror
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn
+ ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
+ ewarn
+
+ if kernel_is -lt 2 6 29; then
+ ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
+ ewarn "include all required IPv6 modules even if you just intend"
+ ewarn "to run on IPv4 only."
+ ewarn
+ ewarn "This has been fixed with kernels >= 2.6.29."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 33; then
+ ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
+ ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
+ ewarn "miss SHA384 and SHA512 HMAC support altogether."
+ ewarn
+ ewarn "If you need any of those features, please use kernel >= 2.6.33."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
+ ewarn "ESP cipher is only included in kernels >= 2.6.34."
+ ewarn
+ ewarn "If you need it, please use kernel >= 2.6.34."
+ ewarn
+ fi
+ fi
+
+ if use non-root; then
+ enewgroup ${UGID}
+ enewuser ${UGID} -1 -1 -1 ${UGID}
+ fi
+}
+
+src_configure() {
+ local myconf=""
+
+ if use non-root; then
+ myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
+ fi
+
+ # If a user has already enabled db support, those plugins will
+ # most likely be desired as well. Besides they don't impose new
+ # dependencies and come at no cost (except for space).
+ if use mysql || use sqlite; then
+ myconf="${myconf} --enable-attr-sql --enable-sql"
+ fi
+
+ # strongSwan builds and installs static libs by default which are
+ # useless to the user (and to strongSwan for that matter) because no
+ # header files or alike get installed... so disabling them is safe.
+ if use pam && use eap; then
+ myconf="${myconf} --enable-eap-gtc"
+ else
+ myconf="${myconf} --disable-eap-gtc"
+ fi
+
+ for mod in $STRONGSWAN_PLUGINS_STD; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ for mod in $STRONGSWAN_PLUGINS_OPT; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ econf \
+ --disable-static \
+ --enable-ikev1 \
+ --enable-ikev2 \
+ --enable-swanctl \
+ --enable-socket-dynamic \
+ $(use_enable curl) \
+ $(use_enable constraints) \
+ $(use_enable ldap) \
+ $(use_enable debug leak-detective) \
+ $(use_enable dhcp) \
+ $(use_enable eap eap-sim) \
+ $(use_enable eap eap-sim-file) \
+ $(use_enable eap eap-simaka-sql) \
+ $(use_enable eap eap-simaka-pseudonym) \
+ $(use_enable eap eap-simaka-reauth) \
+ $(use_enable eap eap-identity) \
+ $(use_enable eap eap-md5) \
+ $(use_enable eap eap-aka) \
+ $(use_enable eap eap-aka-3gpp2) \
+ $(use_enable eap md4) \
+ $(use_enable eap eap-mschapv2) \
+ $(use_enable eap eap-radius) \
+ $(use_enable eap eap-tls) \
+ $(use_enable eap eap-ttls) \
+ $(use_enable eap xauth-eap) \
+ $(use_enable eap eap-dynamic) \
+ $(use_enable farp) \
+ $(use_enable gmp) \
+ $(use_enable gcrypt) \
+ $(use_enable mysql) \
+ $(use_enable networkmanager nm) \
+ $(use_enable openssl) \
+ $(use_enable pam xauth-pam) \
+ $(use_enable pkcs11) \
+ $(use_enable sqlite) \
+ $(use_enable systemd) \
+ $(use_with caps capabilities libcap) \
+ --with-piddir=/run \
+ --with-systemdsystemunitdir="$(systemd_get_systemunitdir)" \
+ ${myconf}
+}
+
+src_install() {
+ emake DESTDIR="${D}" install
+
+ if ! use systemd; then
+ rm -rf "${ED}"/lib/systemd || die
+ fi
+
+ doinitd "${FILESDIR}"/ipsec
+
+ local dir_ugid
+ if use non-root; then
+ fowners ${UGID}:${UGID} \
+ /etc/ipsec.conf \
+ /etc/strongswan.conf
+
+ dir_ugid="${UGID}"
+ else
+ dir_ugid="root"
+ fi
+
+ diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
+ dodir /etc/ipsec.d \
+ /etc/ipsec.d/aacerts \
+ /etc/ipsec.d/acerts \
+ /etc/ipsec.d/cacerts \
+ /etc/ipsec.d/certs \
+ /etc/ipsec.d/crls \
+ /etc/ipsec.d/ocspcerts \
+ /etc/ipsec.d/private \
+ /etc/ipsec.d/reqs
+
+ dodoc NEWS README TODO
+
+ # shared libs are used only internally and there are no static libs,
+ # so it's safe to get rid of the .la files
+ find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
+}
+
+pkg_preinst() {
+ has_version "<net-vpn/strongswan-4.3.6-r1"
+ upgrade_from_leq_4_3_6=$(( !$? ))
+
+ has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
+ previous_4_3_6_with_caps=$(( !$? ))
+}
+
+pkg_postinst() {
+ if ! use openssl && ! use gcrypt; then
+ elog
+ elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
+ elog "Please note that this might effect availability and speed of some"
+ elog "cryptographic features. You are advised to enable the OpenSSL plugin."
+ elif ! use openssl; then
+ elog
+ elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
+ elog "availability and speed of some cryptographic features. There will be"
+ elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
+ elog "25, 26) and ECDSA."
+ fi
+
+ if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
+ chmod 0750 "${ROOT}"/etc/ipsec.d \
+ "${ROOT}"/etc/ipsec.d/aacerts \
+ "${ROOT}"/etc/ipsec.d/acerts \
+ "${ROOT}"/etc/ipsec.d/cacerts \
+ "${ROOT}"/etc/ipsec.d/certs \
+ "${ROOT}"/etc/ipsec.d/crls \
+ "${ROOT}"/etc/ipsec.d/ocspcerts \
+ "${ROOT}"/etc/ipsec.d/private \
+ "${ROOT}"/etc/ipsec.d/reqs
+
+ ewarn
+ ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
+ ewarn "security reasons. Your system installed directories have been"
+ ewarn "updated accordingly. Please check if necessary."
+ ewarn
+
+ if [[ $previous_4_3_6_with_caps == 1 ]]; then
+ if ! use non-root; then
+ ewarn
+ ewarn "IMPORTANT: You previously had ${PN} installed without root"
+ ewarn "privileges because it was implied by the 'caps' USE flag."
+ ewarn "This has been changed. If you want ${PN} with user privileges,"
+ ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
+ ewarn
+ fi
+ fi
+ fi
+ if ! use caps && ! use non-root; then
+ ewarn
+ ewarn "You have decided to run ${PN} with root privileges and built it"
+ ewarn "without support for POSIX capability dropping. It is generally"
+ ewarn "strongly suggested that you reconsider- especially if you intend"
+ ewarn "to run ${PN} as server with a public ip address."
+ ewarn
+ ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
+ ewarn
+ fi
+ if use non-root; then
+ elog
+ elog "${PN} has been installed without superuser privileges (USE=non-root)."
+ elog "This imposes several limitations mainly to the IKEv1 daemon 'pluto'"
+ elog "but also a few to the IKEv2 daemon 'charon'."
+ elog
+ elog "Please carefully read: http://wiki.strongswan.org/wiki/nonRoot"
+ elog
+ elog "pluto uses a helper script by default to insert/remove routing and"
+ elog "policy rules upon connection start/stop which requires superuser"
+ elog "privileges. charon in contrast does this internally and can do so"
+ elog "even with reduced (user) privileges."
+ elog
+ elog "Thus if you require IKEv1 (pluto) or need to specify a custom updown"
+ elog "script to pluto or charon which requires superuser privileges, you"
+ elog "can work around this limitation by using sudo to grant the"
+ elog "user \"ipsec\" the appropriate rights."
+ elog "For example (the default case):"
+ elog "/etc/sudoers:"
+ elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
+ elog "Under the specific connection block in /etc/ipsec.conf:"
+ elog " leftupdown=\"sudo -E ipsec _updown iptables\""
+ elog
+ fi
+ elog
+ elog "Make sure you have _all_ required kernel modules available including"
+ elog "the appropriate cryptographic algorithms. A list is available at:"
+ elog " http://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
+ elog
+ elog "The up-to-date manual is available online at:"
+ elog " http://wiki.strongswan.org/"
+ elog
+}
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2020-08-11 8:24 Sam James
0 siblings, 0 replies; 112+ messages in thread
From: Sam James @ 2020-08-11 8:24 UTC (permalink / raw
To: gentoo-commits
commit: 27f16b2014105ede21fb370b57cebd23bc2667a3
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Tue Aug 11 08:23:43 2020 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Tue Aug 11 08:23:43 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=27f16b20
net-vpn/strongswan: arm64 keyworded (bug #735638)
Package-Manager: Portage-3.0.2, Repoman-2.3.23
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.8.4.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.8.4.ebuild b/net-vpn/strongswan/strongswan-5.8.4.ebuild
index aa83509c3d2..dd518f14f8f 100644
--- a/net-vpn/strongswan/strongswan-5.8.4.ebuild
+++ b/net-vpn/strongswan/strongswan-5.8.4.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="~amd64 ~arm ~ppc ~ppc64 ~x86"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2020-08-11 17:33 Thomas Deutschmann
0 siblings, 0 replies; 112+ messages in thread
From: Thomas Deutschmann @ 2020-08-11 17:33 UTC (permalink / raw
To: gentoo-commits
commit: b755804494c87fc2d477cc681e7b3d78caad2b41
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Tue Aug 11 17:32:38 2020 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Tue Aug 11 17:33:00 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b7558044
net-vpn/strongswan: bump to v5.9.0
Closes: https://bugs.gentoo.org/728452
Package-Manager: Portage-3.0.2, Repoman-2.3.23
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
net-vpn/strongswan/Manifest | 1 +
net-vpn/strongswan/metadata.xml | 1 +
net-vpn/strongswan/strongswan-5.9.0.ebuild | 308 +++++++++++++++++++++++++++++
3 files changed, 310 insertions(+)
diff --git a/net-vpn/strongswan/Manifest b/net-vpn/strongswan/Manifest
index ce8f7438ae4..82da10a5e07 100644
--- a/net-vpn/strongswan/Manifest
+++ b/net-vpn/strongswan/Manifest
@@ -1,3 +1,4 @@
DIST strongswan-5.8.1.tar.bz2 4517921 BLAKE2B 07a82309515a054b267a063fc0e2f49fd03d16b221b1ee26a33c8d367df140797320e1ef7007a39074e40c472022d941656b3ae93d2eb860152cdc5a5d3dbc8a SHA512 630d24643b3d61e931bb25cdd083ad3c55f92fe41f3fcd3198012eee486fb3b1a16dc3f80936162afb7da9e471d45d92b7d183a00153a558babb2a79e5f6813f
DIST strongswan-5.8.2.tar.bz2 4533402 BLAKE2B edbfa8dbe1ac00c140cfe9e906ac7aa1b6f3ddfd528dec84e7b1799e5ecdd0f6114679168ebcff9185c8abae78b46dfc43ddc4dabecd44f720285bd175d7a249 SHA512 423e7924acfe8a03ad7d4359ae9086fd516798fcf5eb948a27b52ea719f4d8954b83ea30ce94191ea1647616611df8a1215cb4d5c7ec48676624df6c41853e1d
DIST strongswan-5.8.4.tar.bz2 4546240 BLAKE2B f58f53a17c02924a3ad75bfadd5956f62098c41468ec5fe8d51bf0f0465c8936d8ca846a41a0b6ff6ac24ccd2229e726d3ea2b48904abf5743bbe766e5f5f81c SHA512 15e866b0d6cc4ea94f17856b519d926ae08c15d3b62f675f62685d0722ca8fa26b46afb1ad1c866e9d5f347d77a747f57d0c6d7f6bd57762f37d7798f9e28103
+DIST strongswan-5.9.0.tar.bz2 4568404 BLAKE2B daf5cce5cbe12253f9ad201d89323ab7d54ba7ff466685b84830737689e4d417fbb97d053d8c9f3de5acb6dee9a192ebae48ec0d4aa07ba3c8969ee6d8f06ab3 SHA512 b982ce7c3e940ad75ab71b02ce3e2813b41c6b098cde5b6f3f3513d095f409fe989ae6e38a31eff51c57423bf452c3610cd5cd8cd7f45ff932581d9859df1821
diff --git a/net-vpn/strongswan/metadata.xml b/net-vpn/strongswan/metadata.xml
index 7b897174224..8cb9dd1387b 100644
--- a/net-vpn/strongswan/metadata.xml
+++ b/net-vpn/strongswan/metadata.xml
@@ -23,6 +23,7 @@
<flag name="openssl">Enable <pkg>dev-libs/openssl</pkg> plugin which is required for Elliptic Curve Cryptography (DH groups 19-21,25,26) and ECDSA. Also provides 3DES, AES, Blowfish, Camellia, CAST, DES, IDEA and RC5 ciphers along with MD2, MD4, MD5 and SHA1/2 hash algorithms, RSA and DH groups 1,2,5,14-18 and 22-24(4.4+) <pkg>dev-libs/openssl</pkg> has to be compiled with USE="-bindist".</flag>
<flag name="pkcs11">Enable pkcs11 support</flag>
<flag name="strongswan_plugins_aesni">Enable support for Intel AES-NI crypto plugin</flag>
+ <flag name="strongswan_plugins_bypass-lan">Enable support for the bypass-lan plugin</flag>
<flag name="strongswan_plugins_chapoly">Enable ChaCha20/Poly1305 AEAD implementation and ChaCha20 XOF plugin</flag>
<flag name="strongswan_plugins_forecast">Enable multicast and broadcast forwarding plugin</flag>
<flag name="strongswan_plugins_led">Enable support for the led plugin</flag>
diff --git a/net-vpn/strongswan/strongswan-5.9.0.ebuild b/net-vpn/strongswan/strongswan-5.9.0.ebuild
new file mode 100644
index 00000000000..f38e8cb0333
--- /dev/null
+++ b/net-vpn/strongswan/strongswan-5.9.0.ebuild
@@ -0,0 +1,308 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+inherit linux-info systemd user
+
+DESCRIPTION="IPsec-based VPN solution, supporting IKEv1/IKEv2 and MOBIKE"
+HOMEPAGE="https://www.strongswan.org/"
+SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
+
+LICENSE="GPL-2 RSA DES"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~x86"
+IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
+
+STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
+STRONGSWAN_PLUGINS_OPT="aesni blowfish bypass-lan ccm chapoly ctr forecast gcm ha ipseckey newhope ntru padlock rdrand save-keys unbound whitelist"
+for mod in $STRONGSWAN_PLUGINS_STD; do
+ IUSE="${IUSE} +strongswan_plugins_${mod}"
+done
+
+for mod in $STRONGSWAN_PLUGINS_OPT; do
+ IUSE="${IUSE} strongswan_plugins_${mod}"
+done
+
+COMMON_DEPEND="!net-misc/openswan
+ gmp? ( >=dev-libs/gmp-4.1.5:= )
+ gcrypt? ( dev-libs/libgcrypt:0 )
+ caps? ( sys-libs/libcap )
+ curl? ( net-misc/curl )
+ ldap? ( net-nds/openldap )
+ openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist] )
+ mysql? ( dev-db/mysql-connector-c:= )
+ sqlite? ( >=dev-db/sqlite-3.3.1 )
+ systemd? ( sys-apps/systemd )
+ networkmanager? ( net-misc/networkmanager )
+ pam? ( sys-libs/pam )
+ strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns )"
+DEPEND="${COMMON_DEPEND}
+ virtual/linux-sources
+ sys-kernel/linux-headers"
+RDEPEND="${COMMON_DEPEND}
+ virtual/logger
+ sys-apps/iproute2
+ !net-vpn/libreswan
+ selinux? ( sec-policy/selinux-ipsec )"
+
+UGID="ipsec"
+
+pkg_setup() {
+ linux-info_pkg_setup
+
+ elog "Linux kernel version: ${KV_FULL}"
+
+ if ! kernel_is -ge 2 6 16; then
+ eerror
+ eerror "This ebuild currently only supports ${PN} with the"
+ eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
+ eerror
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn
+ ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
+ ewarn
+
+ if kernel_is -lt 2 6 29; then
+ ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
+ ewarn "include all required IPv6 modules even if you just intend"
+ ewarn "to run on IPv4 only."
+ ewarn
+ ewarn "This has been fixed with kernels >= 2.6.29."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 33; then
+ ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
+ ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
+ ewarn "miss SHA384 and SHA512 HMAC support altogether."
+ ewarn
+ ewarn "If you need any of those features, please use kernel >= 2.6.33."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
+ ewarn "ESP cipher is only included in kernels >= 2.6.34."
+ ewarn
+ ewarn "If you need it, please use kernel >= 2.6.34."
+ ewarn
+ fi
+ fi
+
+ if use non-root; then
+ enewgroup ${UGID}
+ enewuser ${UGID} -1 -1 -1 ${UGID}
+ fi
+}
+
+src_configure() {
+ local myconf=""
+
+ if use non-root; then
+ myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
+ fi
+
+ # If a user has already enabled db support, those plugins will
+ # most likely be desired as well. Besides they don't impose new
+ # dependencies and come at no cost (except for space).
+ if use mysql || use sqlite; then
+ myconf="${myconf} --enable-attr-sql --enable-sql"
+ fi
+
+ # strongSwan builds and installs static libs by default which are
+ # useless to the user (and to strongSwan for that matter) because no
+ # header files or alike get installed... so disabling them is safe.
+ if use pam && use eap; then
+ myconf="${myconf} --enable-eap-gtc"
+ else
+ myconf="${myconf} --disable-eap-gtc"
+ fi
+
+ for mod in $STRONGSWAN_PLUGINS_STD; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ for mod in $STRONGSWAN_PLUGINS_OPT; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ econf \
+ --disable-static \
+ --enable-ikev1 \
+ --enable-ikev2 \
+ --enable-swanctl \
+ --enable-socket-dynamic \
+ $(use_enable curl) \
+ $(use_enable constraints) \
+ $(use_enable ldap) \
+ $(use_enable debug leak-detective) \
+ $(use_enable dhcp) \
+ $(use_enable eap eap-sim) \
+ $(use_enable eap eap-sim-file) \
+ $(use_enable eap eap-simaka-sql) \
+ $(use_enable eap eap-simaka-pseudonym) \
+ $(use_enable eap eap-simaka-reauth) \
+ $(use_enable eap eap-identity) \
+ $(use_enable eap eap-md5) \
+ $(use_enable eap eap-aka) \
+ $(use_enable eap eap-aka-3gpp2) \
+ $(use_enable eap md4) \
+ $(use_enable eap eap-mschapv2) \
+ $(use_enable eap eap-radius) \
+ $(use_enable eap eap-tls) \
+ $(use_enable eap eap-ttls) \
+ $(use_enable eap xauth-eap) \
+ $(use_enable eap eap-dynamic) \
+ $(use_enable farp) \
+ $(use_enable gmp) \
+ $(use_enable gcrypt) \
+ $(use_enable mysql) \
+ $(use_enable networkmanager nm) \
+ $(use_enable openssl) \
+ $(use_enable pam xauth-pam) \
+ $(use_enable pkcs11) \
+ $(use_enable sqlite) \
+ $(use_enable systemd) \
+ $(use_with caps capabilities libcap) \
+ --with-piddir=/run \
+ --with-systemdsystemunitdir="$(systemd_get_systemunitdir)" \
+ ${myconf}
+}
+
+src_install() {
+ emake DESTDIR="${D}" install
+
+ if ! use systemd; then
+ rm -rf "${ED}"/lib/systemd || die
+ fi
+
+ doinitd "${FILESDIR}"/ipsec
+
+ local dir_ugid
+ if use non-root; then
+ fowners ${UGID}:${UGID} \
+ /etc/ipsec.conf \
+ /etc/strongswan.conf
+
+ dir_ugid="${UGID}"
+ else
+ dir_ugid="root"
+ fi
+
+ diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
+ dodir /etc/ipsec.d \
+ /etc/ipsec.d/aacerts \
+ /etc/ipsec.d/acerts \
+ /etc/ipsec.d/cacerts \
+ /etc/ipsec.d/certs \
+ /etc/ipsec.d/crls \
+ /etc/ipsec.d/ocspcerts \
+ /etc/ipsec.d/private \
+ /etc/ipsec.d/reqs
+
+ dodoc NEWS README TODO
+
+ # shared libs are used only internally and there are no static libs,
+ # so it's safe to get rid of the .la files
+ find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
+}
+
+pkg_preinst() {
+ has_version "<net-vpn/strongswan-4.3.6-r1"
+ upgrade_from_leq_4_3_6=$(( !$? ))
+
+ has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
+ previous_4_3_6_with_caps=$(( !$? ))
+}
+
+pkg_postinst() {
+ if ! use openssl && ! use gcrypt; then
+ elog
+ elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
+ elog "Please note that this might effect availability and speed of some"
+ elog "cryptographic features. You are advised to enable the OpenSSL plugin."
+ elif ! use openssl; then
+ elog
+ elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
+ elog "availability and speed of some cryptographic features. There will be"
+ elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
+ elog "25, 26) and ECDSA."
+ fi
+
+ if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
+ chmod 0750 "${ROOT}"/etc/ipsec.d \
+ "${ROOT}"/etc/ipsec.d/aacerts \
+ "${ROOT}"/etc/ipsec.d/acerts \
+ "${ROOT}"/etc/ipsec.d/cacerts \
+ "${ROOT}"/etc/ipsec.d/certs \
+ "${ROOT}"/etc/ipsec.d/crls \
+ "${ROOT}"/etc/ipsec.d/ocspcerts \
+ "${ROOT}"/etc/ipsec.d/private \
+ "${ROOT}"/etc/ipsec.d/reqs
+
+ ewarn
+ ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
+ ewarn "security reasons. Your system installed directories have been"
+ ewarn "updated accordingly. Please check if necessary."
+ ewarn
+
+ if [[ $previous_4_3_6_with_caps == 1 ]]; then
+ if ! use non-root; then
+ ewarn
+ ewarn "IMPORTANT: You previously had ${PN} installed without root"
+ ewarn "privileges because it was implied by the 'caps' USE flag."
+ ewarn "This has been changed. If you want ${PN} with user privileges,"
+ ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
+ ewarn
+ fi
+ fi
+ fi
+ if ! use caps && ! use non-root; then
+ ewarn
+ ewarn "You have decided to run ${PN} with root privileges and built it"
+ ewarn "without support for POSIX capability dropping. It is generally"
+ ewarn "strongly suggested that you reconsider- especially if you intend"
+ ewarn "to run ${PN} as server with a public ip address."
+ ewarn
+ ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
+ ewarn
+ fi
+ if use non-root; then
+ elog
+ elog "${PN} has been installed without superuser privileges (USE=non-root)."
+ elog "This imposes several limitations mainly to the IKEv1 daemon 'pluto'"
+ elog "but also a few to the IKEv2 daemon 'charon'."
+ elog
+ elog "Please carefully read: http://wiki.strongswan.org/wiki/nonRoot"
+ elog
+ elog "pluto uses a helper script by default to insert/remove routing and"
+ elog "policy rules upon connection start/stop which requires superuser"
+ elog "privileges. charon in contrast does this internally and can do so"
+ elog "even with reduced (user) privileges."
+ elog
+ elog "Thus if you require IKEv1 (pluto) or need to specify a custom updown"
+ elog "script to pluto or charon which requires superuser privileges, you"
+ elog "can work around this limitation by using sudo to grant the"
+ elog "user \"ipsec\" the appropriate rights."
+ elog "For example (the default case):"
+ elog "/etc/sudoers:"
+ elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
+ elog "Under the specific connection block in /etc/ipsec.conf:"
+ elog " leftupdown=\"sudo -E ipsec _updown iptables\""
+ elog
+ fi
+ elog
+ elog "Make sure you have _all_ required kernel modules available including"
+ elog "the appropriate cryptographic algorithms. A list is available at:"
+ elog " https://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
+ elog
+ elog "The up-to-date manual is available online at:"
+ elog " https://wiki.strongswan.org/"
+ elog
+}
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2020-08-15 17:48 Sam James
0 siblings, 0 replies; 112+ messages in thread
From: Sam James @ 2020-08-15 17:48 UTC (permalink / raw
To: gentoo-commits
commit: 33260f89d935221cf348fbad5c947179e86222aa
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Sat Aug 15 17:41:23 2020 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Sat Aug 15 17:48:03 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=33260f89
net-vpn/strongswan: Stabilize 5.8.4 arm, #736770
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.8.4.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.8.4.ebuild b/net-vpn/strongswan/strongswan-5.8.4.ebuild
index dd518f14f8f..2998a720348 100644
--- a/net-vpn/strongswan/strongswan-5.8.4.ebuild
+++ b/net-vpn/strongswan/strongswan-5.8.4.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~x86"
+KEYWORDS="~amd64 arm ~arm64 ~ppc ~ppc64 ~x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2020-08-17 7:01 Agostino Sarubbo
0 siblings, 0 replies; 112+ messages in thread
From: Agostino Sarubbo @ 2020-08-17 7:01 UTC (permalink / raw
To: gentoo-commits
commit: a487a230a6b36b39a165ae4e78217107d1b68248
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Mon Aug 17 07:01:03 2020 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Mon Aug 17 07:01:03 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a487a230
net-vpn/strongswan: amd64 stable wrt bug #736770
Package-Manager: Portage-2.3.103, Repoman-2.3.23
RepoMan-Options: --include-arches="amd64"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.8.4.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.8.4.ebuild b/net-vpn/strongswan/strongswan-5.8.4.ebuild
index 2998a720348..48cae52dade 100644
--- a/net-vpn/strongswan/strongswan-5.8.4.ebuild
+++ b/net-vpn/strongswan/strongswan-5.8.4.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="~amd64 arm ~arm64 ~ppc ~ppc64 ~x86"
+KEYWORDS="amd64 arm ~arm64 ~ppc ~ppc64 ~x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2020-08-18 11:22 Agostino Sarubbo
0 siblings, 0 replies; 112+ messages in thread
From: Agostino Sarubbo @ 2020-08-18 11:22 UTC (permalink / raw
To: gentoo-commits
commit: 3932bf5fc34443a1800e7b88dd1de0cdfd3957fb
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Tue Aug 18 11:21:09 2020 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Tue Aug 18 11:21:09 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3932bf5f
net-vpn/strongswan: x86 stable wrt bug #736770
Package-Manager: Portage-2.3.103, Repoman-2.3.23
RepoMan-Options: --include-arches="x86"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.8.4.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.8.4.ebuild b/net-vpn/strongswan/strongswan-5.8.4.ebuild
index 48cae52dade..201d9f38df7 100644
--- a/net-vpn/strongswan/strongswan-5.8.4.ebuild
+++ b/net-vpn/strongswan/strongswan-5.8.4.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="amd64 arm ~arm64 ~ppc ~ppc64 ~x86"
+KEYWORDS="amd64 arm ~arm64 ~ppc ~ppc64 x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2020-08-31 4:07 Sam James
0 siblings, 0 replies; 112+ messages in thread
From: Sam James @ 2020-08-31 4:07 UTC (permalink / raw
To: gentoo-commits
commit: 58e71f741e75388984fa5bf6f431e46dab68f726
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Mon Aug 31 04:07:22 2020 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Mon Aug 31 04:07:22 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=58e71f74
net-vpn/strongswan: Stabilize 5.8.4 ppc, #736770
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.8.4.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.8.4.ebuild b/net-vpn/strongswan/strongswan-5.8.4.ebuild
index 201d9f38df7..38463dfcf54 100644
--- a/net-vpn/strongswan/strongswan-5.8.4.ebuild
+++ b/net-vpn/strongswan/strongswan-5.8.4.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="amd64 arm ~arm64 ~ppc ~ppc64 x86"
+KEYWORDS="amd64 arm ~arm64 ppc ~ppc64 x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2020-10-06 17:26 Sam James
0 siblings, 0 replies; 112+ messages in thread
From: Sam James @ 2020-10-06 17:26 UTC (permalink / raw
To: gentoo-commits
commit: 818bfc9e83551115ca54e098171ed7025bead2b3
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Tue Oct 6 17:26:11 2020 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Tue Oct 6 17:26:11 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=818bfc9e
net-vpn/strongswan: Stabilize 5.9.0 arm, #746608
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.0.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.0.ebuild b/net-vpn/strongswan/strongswan-5.9.0.ebuild
index f38e8cb0333..517468f85ac 100644
--- a/net-vpn/strongswan/strongswan-5.9.0.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.0.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~x86"
+KEYWORDS="~amd64 arm ~arm64 ~ppc ~ppc64 ~x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2020-10-07 6:42 Agostino Sarubbo
0 siblings, 0 replies; 112+ messages in thread
From: Agostino Sarubbo @ 2020-10-07 6:42 UTC (permalink / raw
To: gentoo-commits
commit: d62cf822ce8fa8d84440baa21af4d5ed249927d4
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Wed Oct 7 06:39:00 2020 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Wed Oct 7 06:39:00 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d62cf822
net-vpn/strongswan: amd64 stable wrt bug #746608
Package-Manager: Portage-2.3.103, Repoman-2.3.23
RepoMan-Options: --include-arches="amd64"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.0.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.0.ebuild b/net-vpn/strongswan/strongswan-5.9.0.ebuild
index 517468f85ac..9a317402f51 100644
--- a/net-vpn/strongswan/strongswan-5.9.0.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.0.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="~amd64 arm ~arm64 ~ppc ~ppc64 ~x86"
+KEYWORDS="amd64 arm ~arm64 ~ppc ~ppc64 ~x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2020-10-07 6:50 Agostino Sarubbo
0 siblings, 0 replies; 112+ messages in thread
From: Agostino Sarubbo @ 2020-10-07 6:50 UTC (permalink / raw
To: gentoo-commits
commit: aa5d2fe2fc6b35f65cbfa7a64024e7ff3e944e08
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Wed Oct 7 06:48:30 2020 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Wed Oct 7 06:48:30 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=aa5d2fe2
net-vpn/strongswan: ppc stable wrt bug #746608
Package-Manager: Portage-2.3.103, Repoman-2.3.23
RepoMan-Options: --include-arches="ppc"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.0.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.0.ebuild b/net-vpn/strongswan/strongswan-5.9.0.ebuild
index 9a317402f51..28994a6df4a 100644
--- a/net-vpn/strongswan/strongswan-5.9.0.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.0.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="amd64 arm ~arm64 ~ppc ~ppc64 ~x86"
+KEYWORDS="amd64 arm ~arm64 ppc ~ppc64 ~x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2020-10-07 7:09 Agostino Sarubbo
0 siblings, 0 replies; 112+ messages in thread
From: Agostino Sarubbo @ 2020-10-07 7:09 UTC (permalink / raw
To: gentoo-commits
commit: ca763e487ec0c4e2ce7c0141d45d3b70af15c8d1
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Wed Oct 7 07:07:09 2020 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Wed Oct 7 07:09:17 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ca763e48
net-vpn/strongswan: x86 stable wrt bug #746608
Package-Manager: Portage-2.3.103, Repoman-2.3.23
RepoMan-Options: --include-arches="x86"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.0.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.0.ebuild b/net-vpn/strongswan/strongswan-5.9.0.ebuild
index 28994a6df4a..119c3deceb5 100644
--- a/net-vpn/strongswan/strongswan-5.9.0.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.0.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="amd64 arm ~arm64 ppc ~ppc64 ~x86"
+KEYWORDS="amd64 arm ~arm64 ppc ~ppc64 x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2020-11-15 16:33 Thomas Deutschmann
0 siblings, 0 replies; 112+ messages in thread
From: Thomas Deutschmann @ 2020-11-15 16:33 UTC (permalink / raw
To: gentoo-commits
commit: ead1d6b025fea449d7df3ad64004d13c180eb160
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Sun Nov 15 15:45:58 2020 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Sun Nov 15 16:32:55 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ead1d6b0
net-vpn/strongswan: drop old
Package-Manager: Portage-3.0.9, Repoman-3.0.2
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
net-vpn/strongswan/Manifest | 1 -
net-vpn/strongswan/strongswan-5.8.4.ebuild | 308 -----------------------------
2 files changed, 309 deletions(-)
diff --git a/net-vpn/strongswan/Manifest b/net-vpn/strongswan/Manifest
index d714fba7291..1f883ae765c 100644
--- a/net-vpn/strongswan/Manifest
+++ b/net-vpn/strongswan/Manifest
@@ -1,2 +1 @@
-DIST strongswan-5.8.4.tar.bz2 4546240 BLAKE2B f58f53a17c02924a3ad75bfadd5956f62098c41468ec5fe8d51bf0f0465c8936d8ca846a41a0b6ff6ac24ccd2229e726d3ea2b48904abf5743bbe766e5f5f81c SHA512 15e866b0d6cc4ea94f17856b519d926ae08c15d3b62f675f62685d0722ca8fa26b46afb1ad1c866e9d5f347d77a747f57d0c6d7f6bd57762f37d7798f9e28103
DIST strongswan-5.9.0.tar.bz2 4568404 BLAKE2B daf5cce5cbe12253f9ad201d89323ab7d54ba7ff466685b84830737689e4d417fbb97d053d8c9f3de5acb6dee9a192ebae48ec0d4aa07ba3c8969ee6d8f06ab3 SHA512 b982ce7c3e940ad75ab71b02ce3e2813b41c6b098cde5b6f3f3513d095f409fe989ae6e38a31eff51c57423bf452c3610cd5cd8cd7f45ff932581d9859df1821
diff --git a/net-vpn/strongswan/strongswan-5.8.4.ebuild b/net-vpn/strongswan/strongswan-5.8.4.ebuild
deleted file mode 100644
index 38463dfcf54..00000000000
--- a/net-vpn/strongswan/strongswan-5.8.4.ebuild
+++ /dev/null
@@ -1,308 +0,0 @@
-# Copyright 1999-2020 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="7"
-inherit linux-info systemd user
-
-DESCRIPTION="IPsec-based VPN solution, supporting IKEv1/IKEv2 and MOBIKE"
-HOMEPAGE="https://www.strongswan.org/"
-SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
-
-LICENSE="GPL-2 RSA DES"
-SLOT="0"
-KEYWORDS="amd64 arm ~arm64 ppc ~ppc64 x86"
-IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
-
-STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
-STRONGSWAN_PLUGINS_OPT="aesni blowfish ccm chapoly ctr forecast gcm ha ipseckey newhope ntru padlock rdrand save-keys unbound whitelist"
-for mod in $STRONGSWAN_PLUGINS_STD; do
- IUSE="${IUSE} +strongswan_plugins_${mod}"
-done
-
-for mod in $STRONGSWAN_PLUGINS_OPT; do
- IUSE="${IUSE} strongswan_plugins_${mod}"
-done
-
-COMMON_DEPEND="!net-misc/openswan
- gmp? ( >=dev-libs/gmp-4.1.5:= )
- gcrypt? ( dev-libs/libgcrypt:0 )
- caps? ( sys-libs/libcap )
- curl? ( net-misc/curl )
- ldap? ( net-nds/openldap )
- openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist] )
- mysql? ( dev-db/mysql-connector-c:= )
- sqlite? ( >=dev-db/sqlite-3.3.1 )
- systemd? ( sys-apps/systemd )
- networkmanager? ( net-misc/networkmanager )
- pam? ( sys-libs/pam )
- strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns )"
-DEPEND="${COMMON_DEPEND}
- virtual/linux-sources
- sys-kernel/linux-headers"
-RDEPEND="${COMMON_DEPEND}
- virtual/logger
- sys-apps/iproute2
- !net-vpn/libreswan
- selinux? ( sec-policy/selinux-ipsec )"
-
-UGID="ipsec"
-
-pkg_setup() {
- linux-info_pkg_setup
-
- elog "Linux kernel version: ${KV_FULL}"
-
- if ! kernel_is -ge 2 6 16; then
- eerror
- eerror "This ebuild currently only supports ${PN} with the"
- eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
- eerror
- fi
-
- if kernel_is -lt 2 6 34; then
- ewarn
- ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
- ewarn
-
- if kernel_is -lt 2 6 29; then
- ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
- ewarn "include all required IPv6 modules even if you just intend"
- ewarn "to run on IPv4 only."
- ewarn
- ewarn "This has been fixed with kernels >= 2.6.29."
- ewarn
- fi
-
- if kernel_is -lt 2 6 33; then
- ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
- ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
- ewarn "miss SHA384 and SHA512 HMAC support altogether."
- ewarn
- ewarn "If you need any of those features, please use kernel >= 2.6.33."
- ewarn
- fi
-
- if kernel_is -lt 2 6 34; then
- ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
- ewarn "ESP cipher is only included in kernels >= 2.6.34."
- ewarn
- ewarn "If you need it, please use kernel >= 2.6.34."
- ewarn
- fi
- fi
-
- if use non-root; then
- enewgroup ${UGID}
- enewuser ${UGID} -1 -1 -1 ${UGID}
- fi
-}
-
-src_configure() {
- local myconf=""
-
- if use non-root; then
- myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
- fi
-
- # If a user has already enabled db support, those plugins will
- # most likely be desired as well. Besides they don't impose new
- # dependencies and come at no cost (except for space).
- if use mysql || use sqlite; then
- myconf="${myconf} --enable-attr-sql --enable-sql"
- fi
-
- # strongSwan builds and installs static libs by default which are
- # useless to the user (and to strongSwan for that matter) because no
- # header files or alike get installed... so disabling them is safe.
- if use pam && use eap; then
- myconf="${myconf} --enable-eap-gtc"
- else
- myconf="${myconf} --disable-eap-gtc"
- fi
-
- for mod in $STRONGSWAN_PLUGINS_STD; do
- if use strongswan_plugins_${mod}; then
- myconf+=" --enable-${mod}"
- fi
- done
-
- for mod in $STRONGSWAN_PLUGINS_OPT; do
- if use strongswan_plugins_${mod}; then
- myconf+=" --enable-${mod}"
- fi
- done
-
- econf \
- --disable-static \
- --enable-ikev1 \
- --enable-ikev2 \
- --enable-swanctl \
- --enable-socket-dynamic \
- $(use_enable curl) \
- $(use_enable constraints) \
- $(use_enable ldap) \
- $(use_enable debug leak-detective) \
- $(use_enable dhcp) \
- $(use_enable eap eap-sim) \
- $(use_enable eap eap-sim-file) \
- $(use_enable eap eap-simaka-sql) \
- $(use_enable eap eap-simaka-pseudonym) \
- $(use_enable eap eap-simaka-reauth) \
- $(use_enable eap eap-identity) \
- $(use_enable eap eap-md5) \
- $(use_enable eap eap-aka) \
- $(use_enable eap eap-aka-3gpp2) \
- $(use_enable eap md4) \
- $(use_enable eap eap-mschapv2) \
- $(use_enable eap eap-radius) \
- $(use_enable eap eap-tls) \
- $(use_enable eap eap-ttls) \
- $(use_enable eap xauth-eap) \
- $(use_enable eap eap-dynamic) \
- $(use_enable farp) \
- $(use_enable gmp) \
- $(use_enable gcrypt) \
- $(use_enable mysql) \
- $(use_enable networkmanager nm) \
- $(use_enable openssl) \
- $(use_enable pam xauth-pam) \
- $(use_enable pkcs11) \
- $(use_enable sqlite) \
- $(use_enable systemd) \
- $(use_with caps capabilities libcap) \
- --with-piddir=/run \
- --with-systemdsystemunitdir="$(systemd_get_systemunitdir)" \
- ${myconf}
-}
-
-src_install() {
- emake DESTDIR="${D}" install
-
- if ! use systemd; then
- rm -rf "${ED}"/lib/systemd || die
- fi
-
- doinitd "${FILESDIR}"/ipsec
-
- local dir_ugid
- if use non-root; then
- fowners ${UGID}:${UGID} \
- /etc/ipsec.conf \
- /etc/strongswan.conf
-
- dir_ugid="${UGID}"
- else
- dir_ugid="root"
- fi
-
- diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
- dodir /etc/ipsec.d \
- /etc/ipsec.d/aacerts \
- /etc/ipsec.d/acerts \
- /etc/ipsec.d/cacerts \
- /etc/ipsec.d/certs \
- /etc/ipsec.d/crls \
- /etc/ipsec.d/ocspcerts \
- /etc/ipsec.d/private \
- /etc/ipsec.d/reqs
-
- dodoc NEWS README TODO
-
- # shared libs are used only internally and there are no static libs,
- # so it's safe to get rid of the .la files
- find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
-}
-
-pkg_preinst() {
- has_version "<net-vpn/strongswan-4.3.6-r1"
- upgrade_from_leq_4_3_6=$(( !$? ))
-
- has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
- previous_4_3_6_with_caps=$(( !$? ))
-}
-
-pkg_postinst() {
- if ! use openssl && ! use gcrypt; then
- elog
- elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
- elog "Please note that this might effect availability and speed of some"
- elog "cryptographic features. You are advised to enable the OpenSSL plugin."
- elif ! use openssl; then
- elog
- elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
- elog "availability and speed of some cryptographic features. There will be"
- elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
- elog "25, 26) and ECDSA."
- fi
-
- if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
- chmod 0750 "${ROOT}"/etc/ipsec.d \
- "${ROOT}"/etc/ipsec.d/aacerts \
- "${ROOT}"/etc/ipsec.d/acerts \
- "${ROOT}"/etc/ipsec.d/cacerts \
- "${ROOT}"/etc/ipsec.d/certs \
- "${ROOT}"/etc/ipsec.d/crls \
- "${ROOT}"/etc/ipsec.d/ocspcerts \
- "${ROOT}"/etc/ipsec.d/private \
- "${ROOT}"/etc/ipsec.d/reqs
-
- ewarn
- ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
- ewarn "security reasons. Your system installed directories have been"
- ewarn "updated accordingly. Please check if necessary."
- ewarn
-
- if [[ $previous_4_3_6_with_caps == 1 ]]; then
- if ! use non-root; then
- ewarn
- ewarn "IMPORTANT: You previously had ${PN} installed without root"
- ewarn "privileges because it was implied by the 'caps' USE flag."
- ewarn "This has been changed. If you want ${PN} with user privileges,"
- ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
- ewarn
- fi
- fi
- fi
- if ! use caps && ! use non-root; then
- ewarn
- ewarn "You have decided to run ${PN} with root privileges and built it"
- ewarn "without support for POSIX capability dropping. It is generally"
- ewarn "strongly suggested that you reconsider- especially if you intend"
- ewarn "to run ${PN} as server with a public ip address."
- ewarn
- ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
- ewarn
- fi
- if use non-root; then
- elog
- elog "${PN} has been installed without superuser privileges (USE=non-root)."
- elog "This imposes several limitations mainly to the IKEv1 daemon 'pluto'"
- elog "but also a few to the IKEv2 daemon 'charon'."
- elog
- elog "Please carefully read: http://wiki.strongswan.org/wiki/nonRoot"
- elog
- elog "pluto uses a helper script by default to insert/remove routing and"
- elog "policy rules upon connection start/stop which requires superuser"
- elog "privileges. charon in contrast does this internally and can do so"
- elog "even with reduced (user) privileges."
- elog
- elog "Thus if you require IKEv1 (pluto) or need to specify a custom updown"
- elog "script to pluto or charon which requires superuser privileges, you"
- elog "can work around this limitation by using sudo to grant the"
- elog "user \"ipsec\" the appropriate rights."
- elog "For example (the default case):"
- elog "/etc/sudoers:"
- elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
- elog "Under the specific connection block in /etc/ipsec.conf:"
- elog " leftupdown=\"sudo -E ipsec _updown iptables\""
- elog
- fi
- elog
- elog "Make sure you have _all_ required kernel modules available including"
- elog "the appropriate cryptographic algorithms. A list is available at:"
- elog " http://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
- elog
- elog "The up-to-date manual is available online at:"
- elog " http://wiki.strongswan.org/"
- elog
-}
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2020-11-15 16:33 Thomas Deutschmann
0 siblings, 0 replies; 112+ messages in thread
From: Thomas Deutschmann @ 2020-11-15 16:33 UTC (permalink / raw
To: gentoo-commits
commit: 5b75bbc28e33006510b81602231652b00b9d00b5
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Sun Nov 15 16:09:59 2020 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Sun Nov 15 16:32:57 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5b75bbc2
net-vpn/strongswan: bump to v5.9.1
Package-Manager: Portage-3.0.9, Repoman-3.0.2
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
net-vpn/strongswan/Manifest | 1 +
net-vpn/strongswan/strongswan-5.9.1.ebuild | 308 +++++++++++++++++++++++++++++
2 files changed, 309 insertions(+)
diff --git a/net-vpn/strongswan/Manifest b/net-vpn/strongswan/Manifest
index 1f883ae765c..b725c8f88c2 100644
--- a/net-vpn/strongswan/Manifest
+++ b/net-vpn/strongswan/Manifest
@@ -1 +1,2 @@
DIST strongswan-5.9.0.tar.bz2 4568404 BLAKE2B daf5cce5cbe12253f9ad201d89323ab7d54ba7ff466685b84830737689e4d417fbb97d053d8c9f3de5acb6dee9a192ebae48ec0d4aa07ba3c8969ee6d8f06ab3 SHA512 b982ce7c3e940ad75ab71b02ce3e2813b41c6b098cde5b6f3f3513d095f409fe989ae6e38a31eff51c57423bf452c3610cd5cd8cd7f45ff932581d9859df1821
+DIST strongswan-5.9.1.tar.bz2 4590867 BLAKE2B 1515764352e7473c47f853a5aa68e582d1fd61122ac1e1577bdc7813da77e0213803c69abf41a1667166e32fb9f2a4bfe8c74616d6431e698e31cf51e939ce3e SHA512 222625e77bd86959da6dd7346cfa9f92569fc396a494bb95ddf2c8e0680b7e8041541e8a14320517a0c735d713ae0fdc0d0c4694215e812817814b0b4efc3497
diff --git a/net-vpn/strongswan/strongswan-5.9.1.ebuild b/net-vpn/strongswan/strongswan-5.9.1.ebuild
new file mode 100644
index 00000000000..3ec804ee261
--- /dev/null
+++ b/net-vpn/strongswan/strongswan-5.9.1.ebuild
@@ -0,0 +1,308 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+inherit linux-info systemd
+
+DESCRIPTION="IPsec-based VPN solution, supporting IKEv1/IKEv2 and MOBIKE"
+HOMEPAGE="https://www.strongswan.org/"
+SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
+
+LICENSE="GPL-2 RSA DES"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~x86"
+IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
+
+STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
+STRONGSWAN_PLUGINS_OPT="aesni blowfish bypass-lan ccm chapoly ctr forecast gcm ha ipseckey newhope ntru padlock rdrand save-keys unbound whitelist"
+for mod in $STRONGSWAN_PLUGINS_STD; do
+ IUSE="${IUSE} +strongswan_plugins_${mod}"
+done
+
+for mod in $STRONGSWAN_PLUGINS_OPT; do
+ IUSE="${IUSE} strongswan_plugins_${mod}"
+done
+
+COMMON_DEPEND="non-root? (
+ acct-user/ipsec
+ acct-group/ipsec
+ )
+ gmp? ( >=dev-libs/gmp-4.1.5:= )
+ gcrypt? ( dev-libs/libgcrypt:0 )
+ caps? ( sys-libs/libcap )
+ curl? ( net-misc/curl )
+ ldap? ( net-nds/openldap )
+ openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist] )
+ mysql? ( dev-db/mysql-connector-c:= )
+ sqlite? ( >=dev-db/sqlite-3.3.1 )
+ systemd? ( sys-apps/systemd )
+ networkmanager? ( net-misc/networkmanager )
+ pam? ( sys-libs/pam )
+ strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns )"
+
+DEPEND="${COMMON_DEPEND}
+ virtual/linux-sources
+ sys-kernel/linux-headers"
+
+RDEPEND="${COMMON_DEPEND}
+ virtual/logger
+ sys-apps/iproute2
+ !net-vpn/libreswan
+ selinux? ( sec-policy/selinux-ipsec )"
+
+UGID="ipsec"
+
+pkg_setup() {
+ linux-info_pkg_setup
+
+ elog "Linux kernel version: ${KV_FULL}"
+
+ if ! kernel_is -ge 2 6 16; then
+ eerror
+ eerror "This ebuild currently only supports ${PN} with the"
+ eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
+ eerror
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn
+ ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
+ ewarn
+
+ if kernel_is -lt 2 6 29; then
+ ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
+ ewarn "include all required IPv6 modules even if you just intend"
+ ewarn "to run on IPv4 only."
+ ewarn
+ ewarn "This has been fixed with kernels >= 2.6.29."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 33; then
+ ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
+ ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
+ ewarn "miss SHA384 and SHA512 HMAC support altogether."
+ ewarn
+ ewarn "If you need any of those features, please use kernel >= 2.6.33."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
+ ewarn "ESP cipher is only included in kernels >= 2.6.34."
+ ewarn
+ ewarn "If you need it, please use kernel >= 2.6.34."
+ ewarn
+ fi
+ fi
+}
+
+src_configure() {
+ local myconf=""
+
+ if use non-root; then
+ myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
+ fi
+
+ # If a user has already enabled db support, those plugins will
+ # most likely be desired as well. Besides they don't impose new
+ # dependencies and come at no cost (except for space).
+ if use mysql || use sqlite; then
+ myconf="${myconf} --enable-attr-sql --enable-sql"
+ fi
+
+ # strongSwan builds and installs static libs by default which are
+ # useless to the user (and to strongSwan for that matter) because no
+ # header files or alike get installed... so disabling them is safe.
+ if use pam && use eap; then
+ myconf="${myconf} --enable-eap-gtc"
+ else
+ myconf="${myconf} --disable-eap-gtc"
+ fi
+
+ for mod in $STRONGSWAN_PLUGINS_STD; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ for mod in $STRONGSWAN_PLUGINS_OPT; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ econf \
+ --disable-static \
+ --enable-ikev1 \
+ --enable-ikev2 \
+ --enable-swanctl \
+ --enable-socket-dynamic \
+ $(use_enable curl) \
+ $(use_enable constraints) \
+ $(use_enable ldap) \
+ $(use_enable debug leak-detective) \
+ $(use_enable dhcp) \
+ $(use_enable eap eap-sim) \
+ $(use_enable eap eap-sim-file) \
+ $(use_enable eap eap-simaka-sql) \
+ $(use_enable eap eap-simaka-pseudonym) \
+ $(use_enable eap eap-simaka-reauth) \
+ $(use_enable eap eap-identity) \
+ $(use_enable eap eap-md5) \
+ $(use_enable eap eap-aka) \
+ $(use_enable eap eap-aka-3gpp2) \
+ $(use_enable eap md4) \
+ $(use_enable eap eap-mschapv2) \
+ $(use_enable eap eap-radius) \
+ $(use_enable eap eap-tls) \
+ $(use_enable eap eap-ttls) \
+ $(use_enable eap xauth-eap) \
+ $(use_enable eap eap-dynamic) \
+ $(use_enable farp) \
+ $(use_enable gmp) \
+ $(use_enable gcrypt) \
+ $(use_enable mysql) \
+ $(use_enable networkmanager nm) \
+ $(use_enable openssl) \
+ $(use_enable pam xauth-pam) \
+ $(use_enable pkcs11) \
+ $(use_enable sqlite) \
+ $(use_enable systemd) \
+ $(use_with caps capabilities libcap) \
+ --with-piddir=/run \
+ --with-systemdsystemunitdir="$(systemd_get_systemunitdir)" \
+ ${myconf}
+}
+
+src_install() {
+ emake DESTDIR="${D}" install
+
+ if ! use systemd; then
+ rm -rf "${ED}"/lib/systemd || die
+ fi
+
+ doinitd "${FILESDIR}"/ipsec
+
+ local dir_ugid
+ if use non-root; then
+ fowners ${UGID}:${UGID} \
+ /etc/ipsec.conf \
+ /etc/strongswan.conf
+
+ dir_ugid="${UGID}"
+ else
+ dir_ugid="root"
+ fi
+
+ diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
+ dodir /etc/ipsec.d \
+ /etc/ipsec.d/aacerts \
+ /etc/ipsec.d/acerts \
+ /etc/ipsec.d/cacerts \
+ /etc/ipsec.d/certs \
+ /etc/ipsec.d/crls \
+ /etc/ipsec.d/ocspcerts \
+ /etc/ipsec.d/private \
+ /etc/ipsec.d/reqs
+
+ dodoc NEWS README TODO
+
+ # shared libs are used only internally and there are no static libs,
+ # so it's safe to get rid of the .la files
+ find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
+}
+
+pkg_preinst() {
+ has_version "<net-vpn/strongswan-4.3.6-r1"
+ upgrade_from_leq_4_3_6=$(( !$? ))
+
+ has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
+ previous_4_3_6_with_caps=$(( !$? ))
+}
+
+pkg_postinst() {
+ if ! use openssl && ! use gcrypt; then
+ elog
+ elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
+ elog "Please note that this might effect availability and speed of some"
+ elog "cryptographic features. You are advised to enable the OpenSSL plugin."
+ elif ! use openssl; then
+ elog
+ elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
+ elog "availability and speed of some cryptographic features. There will be"
+ elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
+ elog "25, 26) and ECDSA."
+ fi
+
+ if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
+ chmod 0750 "${ROOT}"/etc/ipsec.d \
+ "${ROOT}"/etc/ipsec.d/aacerts \
+ "${ROOT}"/etc/ipsec.d/acerts \
+ "${ROOT}"/etc/ipsec.d/cacerts \
+ "${ROOT}"/etc/ipsec.d/certs \
+ "${ROOT}"/etc/ipsec.d/crls \
+ "${ROOT}"/etc/ipsec.d/ocspcerts \
+ "${ROOT}"/etc/ipsec.d/private \
+ "${ROOT}"/etc/ipsec.d/reqs
+
+ ewarn
+ ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
+ ewarn "security reasons. Your system installed directories have been"
+ ewarn "updated accordingly. Please check if necessary."
+ ewarn
+
+ if [[ $previous_4_3_6_with_caps == 1 ]]; then
+ if ! use non-root; then
+ ewarn
+ ewarn "IMPORTANT: You previously had ${PN} installed without root"
+ ewarn "privileges because it was implied by the 'caps' USE flag."
+ ewarn "This has been changed. If you want ${PN} with user privileges,"
+ ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
+ ewarn
+ fi
+ fi
+ fi
+ if ! use caps && ! use non-root; then
+ ewarn
+ ewarn "You have decided to run ${PN} with root privileges and built it"
+ ewarn "without support for POSIX capability dropping. It is generally"
+ ewarn "strongly suggested that you reconsider- especially if you intend"
+ ewarn "to run ${PN} as server with a public ip address."
+ ewarn
+ ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
+ ewarn
+ fi
+ if use non-root; then
+ elog
+ elog "${PN} has been installed without superuser privileges (USE=non-root)."
+ elog "This imposes several limitations mainly to the IKEv1 daemon 'pluto'"
+ elog "but also a few to the IKEv2 daemon 'charon'."
+ elog
+ elog "Please carefully read: http://wiki.strongswan.org/wiki/nonRoot"
+ elog
+ elog "pluto uses a helper script by default to insert/remove routing and"
+ elog "policy rules upon connection start/stop which requires superuser"
+ elog "privileges. charon in contrast does this internally and can do so"
+ elog "even with reduced (user) privileges."
+ elog
+ elog "Thus if you require IKEv1 (pluto) or need to specify a custom updown"
+ elog "script to pluto or charon which requires superuser privileges, you"
+ elog "can work around this limitation by using sudo to grant the"
+ elog "user \"ipsec\" the appropriate rights."
+ elog "For example (the default case):"
+ elog "/etc/sudoers:"
+ elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
+ elog "Under the specific connection block in /etc/ipsec.conf:"
+ elog " leftupdown=\"sudo -E ipsec _updown iptables\""
+ elog
+ fi
+ elog
+ elog "Make sure you have _all_ required kernel modules available including"
+ elog "the appropriate cryptographic algorithms. A list is available at:"
+ elog " https://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
+ elog
+ elog "The up-to-date manual is available online at:"
+ elog " https://wiki.strongswan.org/"
+ elog
+}
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2021-02-05 12:31 Sam James
0 siblings, 0 replies; 112+ messages in thread
From: Sam James @ 2021-02-05 12:31 UTC (permalink / raw
To: gentoo-commits
commit: 621de1d245df24171c7e439164cc36b570e5cefc
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Fri Feb 5 12:30:48 2021 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Fri Feb 5 12:30:48 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=621de1d2
net-vpn/strongswan: Stabilize 5.9.1 x86, #768735
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.1.ebuild | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.1.ebuild b/net-vpn/strongswan/strongswan-5.9.1.ebuild
index 3ec804ee261..4176fa33935 100644
--- a/net-vpn/strongswan/strongswan-5.9.1.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2020 Gentoo Authors
+# Copyright 1999-2021 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2
EAPI="7"
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~x86"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2021-02-06 15:39 Sam James
0 siblings, 0 replies; 112+ messages in thread
From: Sam James @ 2021-02-06 15:39 UTC (permalink / raw
To: gentoo-commits
commit: 2329235e27c7ddf8dd258dda059247ff3da18a37
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Sat Feb 6 15:39:21 2021 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Sat Feb 6 15:39:21 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2329235e
net-vpn/strongswan: Stabilize 5.9.1 amd64, #768735
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.1.ebuild b/net-vpn/strongswan/strongswan-5.9.1.ebuild
index 4176fa33935..fd23a641cea 100644
--- a/net-vpn/strongswan/strongswan-5.9.1.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.1.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 x86"
+KEYWORDS="amd64 ~arm ~arm64 ~ppc ~ppc64 x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2021-02-11 9:31 Sam James
0 siblings, 0 replies; 112+ messages in thread
From: Sam James @ 2021-02-11 9:31 UTC (permalink / raw
To: gentoo-commits
commit: 03ca31c24da74c0a10c6002c2cfda2298e1a0fd2
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Thu Feb 11 09:31:16 2021 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Thu Feb 11 09:31:16 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=03ca31c2
net-vpn/strongswan: Stabilize 5.9.1 ppc, #768735
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.1.ebuild b/net-vpn/strongswan/strongswan-5.9.1.ebuild
index fd23a641cea..0dbba9da50c 100644
--- a/net-vpn/strongswan/strongswan-5.9.1.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.1.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="amd64 ~arm ~arm64 ~ppc ~ppc64 x86"
+KEYWORDS="amd64 ~arm ~arm64 ppc ~ppc64 x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2021-02-16 12:34 Sam James
0 siblings, 0 replies; 112+ messages in thread
From: Sam James @ 2021-02-16 12:34 UTC (permalink / raw
To: gentoo-commits
commit: 30d969f904adbcd135382b990fefaf3056d7f591
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Tue Feb 16 12:33:39 2021 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Tue Feb 16 12:33:39 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=30d969f9
net-vpn/strongswan: Stabilize 5.9.1 arm, #768735
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.1.ebuild b/net-vpn/strongswan/strongswan-5.9.1.ebuild
index 0dbba9da50c..b7b28afa8ea 100644
--- a/net-vpn/strongswan/strongswan-5.9.1.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.1.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="amd64 ~arm ~arm64 ppc ~ppc64 x86"
+KEYWORDS="amd64 arm ~arm64 ppc ~ppc64 x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2021-03-27 1:08 Thomas Deutschmann
0 siblings, 0 replies; 112+ messages in thread
From: Thomas Deutschmann @ 2021-03-27 1:08 UTC (permalink / raw
To: gentoo-commits
commit: 892aeb2ea66bb85b75b4aa09f2046b14504e448a
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Sat Mar 27 01:06:47 2021 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Sat Mar 27 01:06:47 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=892aeb2e
net-vpn/strongswan: bump to v5.9.2
Package-Manager: Portage-3.0.17, Repoman-3.0.2
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
net-vpn/strongswan/Manifest | 1 +
net-vpn/strongswan/strongswan-5.9.2.ebuild | 308 +++++++++++++++++++++++++++++
2 files changed, 309 insertions(+)
diff --git a/net-vpn/strongswan/Manifest b/net-vpn/strongswan/Manifest
index b725c8f88c2..269b1eb23f1 100644
--- a/net-vpn/strongswan/Manifest
+++ b/net-vpn/strongswan/Manifest
@@ -1,2 +1,3 @@
DIST strongswan-5.9.0.tar.bz2 4568404 BLAKE2B daf5cce5cbe12253f9ad201d89323ab7d54ba7ff466685b84830737689e4d417fbb97d053d8c9f3de5acb6dee9a192ebae48ec0d4aa07ba3c8969ee6d8f06ab3 SHA512 b982ce7c3e940ad75ab71b02ce3e2813b41c6b098cde5b6f3f3513d095f409fe989ae6e38a31eff51c57423bf452c3610cd5cd8cd7f45ff932581d9859df1821
DIST strongswan-5.9.1.tar.bz2 4590867 BLAKE2B 1515764352e7473c47f853a5aa68e582d1fd61122ac1e1577bdc7813da77e0213803c69abf41a1667166e32fb9f2a4bfe8c74616d6431e698e31cf51e939ce3e SHA512 222625e77bd86959da6dd7346cfa9f92569fc396a494bb95ddf2c8e0680b7e8041541e8a14320517a0c735d713ae0fdc0d0c4694215e812817814b0b4efc3497
+DIST strongswan-5.9.2.tar.bz2 4607281 BLAKE2B 84f5457bc970f49c9bc99d0ef41182d815e39b8a88be349ad0a78b531a983d3b3919d5c9f3b97793b0b2569f2c6b151cc3b5d9b145a8bfd663db6f79d8ff3dd6 SHA512 dca30b9be7847e0af59d1526c2e38d440b6729055cb3f0f0637d50d7381df465c7b59e79662efe63870a7a5a44eef696c02231274d2764f9e3c430ce2fd694f6
diff --git a/net-vpn/strongswan/strongswan-5.9.2.ebuild b/net-vpn/strongswan/strongswan-5.9.2.ebuild
new file mode 100644
index 00000000000..04835d9001d
--- /dev/null
+++ b/net-vpn/strongswan/strongswan-5.9.2.ebuild
@@ -0,0 +1,308 @@
+# Copyright 1999-2021 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+inherit linux-info systemd
+
+DESCRIPTION="IPsec-based VPN solution, supporting IKEv1/IKEv2 and MOBIKE"
+HOMEPAGE="https://www.strongswan.org/"
+SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
+
+LICENSE="GPL-2 RSA DES"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~x86"
+IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
+
+STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
+STRONGSWAN_PLUGINS_OPT="aesni blowfish bypass-lan ccm chapoly ctr forecast gcm ha ipseckey newhope ntru padlock rdrand save-keys unbound whitelist"
+for mod in $STRONGSWAN_PLUGINS_STD; do
+ IUSE="${IUSE} +strongswan_plugins_${mod}"
+done
+
+for mod in $STRONGSWAN_PLUGINS_OPT; do
+ IUSE="${IUSE} strongswan_plugins_${mod}"
+done
+
+COMMON_DEPEND="non-root? (
+ acct-user/ipsec
+ acct-group/ipsec
+ )
+ gmp? ( >=dev-libs/gmp-4.1.5:= )
+ gcrypt? ( dev-libs/libgcrypt:0 )
+ caps? ( sys-libs/libcap )
+ curl? ( net-misc/curl )
+ ldap? ( net-nds/openldap )
+ openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist] )
+ mysql? ( dev-db/mysql-connector-c:= )
+ sqlite? ( >=dev-db/sqlite-3.3.1 )
+ systemd? ( sys-apps/systemd )
+ networkmanager? ( net-misc/networkmanager )
+ pam? ( sys-libs/pam )
+ strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns )"
+
+DEPEND="${COMMON_DEPEND}
+ virtual/linux-sources
+ sys-kernel/linux-headers"
+
+RDEPEND="${COMMON_DEPEND}
+ virtual/logger
+ sys-apps/iproute2
+ !net-vpn/libreswan
+ selinux? ( sec-policy/selinux-ipsec )"
+
+UGID="ipsec"
+
+pkg_setup() {
+ linux-info_pkg_setup
+
+ elog "Linux kernel version: ${KV_FULL}"
+
+ if ! kernel_is -ge 2 6 16; then
+ eerror
+ eerror "This ebuild currently only supports ${PN} with the"
+ eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
+ eerror
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn
+ ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
+ ewarn
+
+ if kernel_is -lt 2 6 29; then
+ ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
+ ewarn "include all required IPv6 modules even if you just intend"
+ ewarn "to run on IPv4 only."
+ ewarn
+ ewarn "This has been fixed with kernels >= 2.6.29."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 33; then
+ ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
+ ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
+ ewarn "miss SHA384 and SHA512 HMAC support altogether."
+ ewarn
+ ewarn "If you need any of those features, please use kernel >= 2.6.33."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
+ ewarn "ESP cipher is only included in kernels >= 2.6.34."
+ ewarn
+ ewarn "If you need it, please use kernel >= 2.6.34."
+ ewarn
+ fi
+ fi
+}
+
+src_configure() {
+ local myconf=""
+
+ if use non-root; then
+ myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
+ fi
+
+ # If a user has already enabled db support, those plugins will
+ # most likely be desired as well. Besides they don't impose new
+ # dependencies and come at no cost (except for space).
+ if use mysql || use sqlite; then
+ myconf="${myconf} --enable-attr-sql --enable-sql"
+ fi
+
+ # strongSwan builds and installs static libs by default which are
+ # useless to the user (and to strongSwan for that matter) because no
+ # header files or alike get installed... so disabling them is safe.
+ if use pam && use eap; then
+ myconf="${myconf} --enable-eap-gtc"
+ else
+ myconf="${myconf} --disable-eap-gtc"
+ fi
+
+ for mod in $STRONGSWAN_PLUGINS_STD; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ for mod in $STRONGSWAN_PLUGINS_OPT; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ econf \
+ --disable-static \
+ --enable-ikev1 \
+ --enable-ikev2 \
+ --enable-swanctl \
+ --enable-socket-dynamic \
+ $(use_enable curl) \
+ $(use_enable constraints) \
+ $(use_enable ldap) \
+ $(use_enable debug leak-detective) \
+ $(use_enable dhcp) \
+ $(use_enable eap eap-sim) \
+ $(use_enable eap eap-sim-file) \
+ $(use_enable eap eap-simaka-sql) \
+ $(use_enable eap eap-simaka-pseudonym) \
+ $(use_enable eap eap-simaka-reauth) \
+ $(use_enable eap eap-identity) \
+ $(use_enable eap eap-md5) \
+ $(use_enable eap eap-aka) \
+ $(use_enable eap eap-aka-3gpp2) \
+ $(use_enable eap md4) \
+ $(use_enable eap eap-mschapv2) \
+ $(use_enable eap eap-radius) \
+ $(use_enable eap eap-tls) \
+ $(use_enable eap eap-ttls) \
+ $(use_enable eap xauth-eap) \
+ $(use_enable eap eap-dynamic) \
+ $(use_enable farp) \
+ $(use_enable gmp) \
+ $(use_enable gcrypt) \
+ $(use_enable mysql) \
+ $(use_enable networkmanager nm) \
+ $(use_enable openssl) \
+ $(use_enable pam xauth-pam) \
+ $(use_enable pkcs11) \
+ $(use_enable sqlite) \
+ $(use_enable systemd) \
+ $(use_with caps capabilities libcap) \
+ --with-piddir=/run \
+ --with-systemdsystemunitdir="$(systemd_get_systemunitdir)" \
+ ${myconf}
+}
+
+src_install() {
+ emake DESTDIR="${D}" install
+
+ if ! use systemd; then
+ rm -rf "${ED}"/lib/systemd || die
+ fi
+
+ doinitd "${FILESDIR}"/ipsec
+
+ local dir_ugid
+ if use non-root; then
+ fowners ${UGID}:${UGID} \
+ /etc/ipsec.conf \
+ /etc/strongswan.conf
+
+ dir_ugid="${UGID}"
+ else
+ dir_ugid="root"
+ fi
+
+ diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
+ dodir /etc/ipsec.d \
+ /etc/ipsec.d/aacerts \
+ /etc/ipsec.d/acerts \
+ /etc/ipsec.d/cacerts \
+ /etc/ipsec.d/certs \
+ /etc/ipsec.d/crls \
+ /etc/ipsec.d/ocspcerts \
+ /etc/ipsec.d/private \
+ /etc/ipsec.d/reqs
+
+ dodoc NEWS README TODO
+
+ # shared libs are used only internally and there are no static libs,
+ # so it's safe to get rid of the .la files
+ find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
+}
+
+pkg_preinst() {
+ has_version "<net-vpn/strongswan-4.3.6-r1"
+ upgrade_from_leq_4_3_6=$(( !$? ))
+
+ has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
+ previous_4_3_6_with_caps=$(( !$? ))
+}
+
+pkg_postinst() {
+ if ! use openssl && ! use gcrypt; then
+ elog
+ elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
+ elog "Please note that this might effect availability and speed of some"
+ elog "cryptographic features. You are advised to enable the OpenSSL plugin."
+ elif ! use openssl; then
+ elog
+ elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
+ elog "availability and speed of some cryptographic features. There will be"
+ elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
+ elog "25, 26) and ECDSA."
+ fi
+
+ if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
+ chmod 0750 "${ROOT}"/etc/ipsec.d \
+ "${ROOT}"/etc/ipsec.d/aacerts \
+ "${ROOT}"/etc/ipsec.d/acerts \
+ "${ROOT}"/etc/ipsec.d/cacerts \
+ "${ROOT}"/etc/ipsec.d/certs \
+ "${ROOT}"/etc/ipsec.d/crls \
+ "${ROOT}"/etc/ipsec.d/ocspcerts \
+ "${ROOT}"/etc/ipsec.d/private \
+ "${ROOT}"/etc/ipsec.d/reqs
+
+ ewarn
+ ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
+ ewarn "security reasons. Your system installed directories have been"
+ ewarn "updated accordingly. Please check if necessary."
+ ewarn
+
+ if [[ $previous_4_3_6_with_caps == 1 ]]; then
+ if ! use non-root; then
+ ewarn
+ ewarn "IMPORTANT: You previously had ${PN} installed without root"
+ ewarn "privileges because it was implied by the 'caps' USE flag."
+ ewarn "This has been changed. If you want ${PN} with user privileges,"
+ ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
+ ewarn
+ fi
+ fi
+ fi
+ if ! use caps && ! use non-root; then
+ ewarn
+ ewarn "You have decided to run ${PN} with root privileges and built it"
+ ewarn "without support for POSIX capability dropping. It is generally"
+ ewarn "strongly suggested that you reconsider- especially if you intend"
+ ewarn "to run ${PN} as server with a public ip address."
+ ewarn
+ ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
+ ewarn
+ fi
+ if use non-root; then
+ elog
+ elog "${PN} has been installed without superuser privileges (USE=non-root)."
+ elog "This imposes several limitations mainly to the IKEv1 daemon 'pluto'"
+ elog "but also a few to the IKEv2 daemon 'charon'."
+ elog
+ elog "Please carefully read: http://wiki.strongswan.org/wiki/nonRoot"
+ elog
+ elog "pluto uses a helper script by default to insert/remove routing and"
+ elog "policy rules upon connection start/stop which requires superuser"
+ elog "privileges. charon in contrast does this internally and can do so"
+ elog "even with reduced (user) privileges."
+ elog
+ elog "Thus if you require IKEv1 (pluto) or need to specify a custom updown"
+ elog "script to pluto or charon which requires superuser privileges, you"
+ elog "can work around this limitation by using sudo to grant the"
+ elog "user \"ipsec\" the appropriate rights."
+ elog "For example (the default case):"
+ elog "/etc/sudoers:"
+ elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
+ elog "Under the specific connection block in /etc/ipsec.conf:"
+ elog " leftupdown=\"sudo -E ipsec _updown iptables\""
+ elog
+ fi
+ elog
+ elog "Make sure you have _all_ required kernel modules available including"
+ elog "the appropriate cryptographic algorithms. A list is available at:"
+ elog " https://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
+ elog
+ elog "The up-to-date manual is available online at:"
+ elog " https://wiki.strongswan.org/"
+ elog
+}
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2021-05-31 20:45 David Seifert
0 siblings, 0 replies; 112+ messages in thread
From: David Seifert @ 2021-05-31 20:45 UTC (permalink / raw
To: gentoo-commits
commit: af8ec45e0f5b9e2f453bc6798dd41276896e7603
Author: David Seifert <soap <AT> gentoo <DOT> org>
AuthorDate: Mon May 31 20:45:12 2021 +0000
Commit: David Seifert <soap <AT> gentoo <DOT> org>
CommitDate: Mon May 31 20:45:12 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=af8ec45e
net-vpn/strongswan: drop inactive maintainer
Package-Manager: Portage-3.0.19, Repoman-3.0.3
Signed-off-by: David Seifert <soap <AT> gentoo.org>
net-vpn/strongswan/metadata.xml | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/net-vpn/strongswan/metadata.xml b/net-vpn/strongswan/metadata.xml
index 8cb9dd1387b..06508eada0b 100644
--- a/net-vpn/strongswan/metadata.xml
+++ b/net-vpn/strongswan/metadata.xml
@@ -1,10 +1,7 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
<pkgmetadata>
- <maintainer type="person">
- <email>patrick@gentoo.org</email>
- <name>Patrick Lauer</name>
- </maintainer>
+ <!-- maintainer-needed -->
<longdescription lang="en">
StrongSwan is direct descendant of the discontinued FreeS/WAN project.
As an IPsec based VPN solution which is focused on security and ease of
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2021-06-01 0:46 Sam James
0 siblings, 0 replies; 112+ messages in thread
From: Sam James @ 2021-06-01 0:46 UTC (permalink / raw
To: gentoo-commits
commit: 6b1cd53c21a61856a3f14cc1fa5f8ffb1a53fbd2
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Tue Jun 1 00:45:35 2021 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Tue Jun 1 00:45:35 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6b1cd53c
net-vpn/strongswan: Stabilize 5.9.2 arm, #793269
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.2.ebuild b/net-vpn/strongswan/strongswan-5.9.2.ebuild
index 04835d9001d..469e870f506 100644
--- a/net-vpn/strongswan/strongswan-5.9.2.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.2.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~x86"
+KEYWORDS="~amd64 arm ~arm64 ~ppc ~ppc64 ~x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2021-06-03 0:45 Sam James
0 siblings, 0 replies; 112+ messages in thread
From: Sam James @ 2021-06-03 0:45 UTC (permalink / raw
To: gentoo-commits
commit: 6071b88d0892c6676c61fc77ddb261b1bf52ea88
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Thu Jun 3 00:44:36 2021 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Thu Jun 3 00:44:59 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6071b88d
net-vpn/strongswan: Stabilize 5.9.2 amd64, #793269
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.2.ebuild b/net-vpn/strongswan/strongswan-5.9.2.ebuild
index 469e870f506..f7a06edaacf 100644
--- a/net-vpn/strongswan/strongswan-5.9.2.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.2.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="~amd64 arm ~arm64 ~ppc ~ppc64 ~x86"
+KEYWORDS="amd64 arm ~arm64 ~ppc ~ppc64 ~x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2021-06-03 8:23 Sam James
0 siblings, 0 replies; 112+ messages in thread
From: Sam James @ 2021-06-03 8:23 UTC (permalink / raw
To: gentoo-commits
commit: a920854a715189cf9488c79c72c16a0e7a6c27f6
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Thu Jun 3 08:19:35 2021 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Thu Jun 3 08:21:54 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a920854a
net-vpn/strongswan: Stabilize 5.9.2 x86, #793269
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.2.ebuild b/net-vpn/strongswan/strongswan-5.9.2.ebuild
index f7a06edaacf..8f197987d17 100644
--- a/net-vpn/strongswan/strongswan-5.9.2.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.2.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="amd64 arm ~arm64 ~ppc ~ppc64 ~x86"
+KEYWORDS="amd64 arm ~arm64 ~ppc ~ppc64 x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2021-06-07 6:25 Sergei Trofimovich
0 siblings, 0 replies; 112+ messages in thread
From: Sergei Trofimovich @ 2021-06-07 6:25 UTC (permalink / raw
To: gentoo-commits
commit: 33f1e86ae2023afe4d8e6a0b3ba8974aae648058
Author: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
AuthorDate: Mon Jun 7 06:22:10 2021 +0000
Commit: Sergei Trofimovich <slyfox <AT> gentoo <DOT> org>
CommitDate: Mon Jun 7 06:25:01 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=33f1e86a
net-vpn/strongswan: stable 5.9.2 for ppc
stable wrt bug #793269
Package-Manager: Portage-3.0.19, Repoman-3.0.3
RepoMan-Options: --include-arches="ppc"
Signed-off-by: Sergei Trofimovich <slyfox <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.2.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.2.ebuild b/net-vpn/strongswan/strongswan-5.9.2.ebuild
index 8f197987d17..b7b28afa8ea 100644
--- a/net-vpn/strongswan/strongswan-5.9.2.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.2.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="amd64 arm ~arm64 ~ppc ~ppc64 x86"
+KEYWORDS="amd64 arm ~arm64 ppc ~ppc64 x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2021-06-17 20:32 Thomas Deutschmann
0 siblings, 0 replies; 112+ messages in thread
From: Thomas Deutschmann @ 2021-06-17 20:32 UTC (permalink / raw
To: gentoo-commits
commit: c6d150c35839cfc96a507bc447ce6929a0452950
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Thu Jun 17 20:16:49 2021 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Thu Jun 17 20:32:05 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c6d150c3
net-vpn/strongswan: Fix MissingUseDepDefault for dev-libs/openssl[bindist]
Package-Manager: Portage-3.0.20, Repoman-3.0.3
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.0.ebuild | 4 ++--
net-vpn/strongswan/strongswan-5.9.1.ebuild | 2 +-
net-vpn/strongswan/strongswan-5.9.2.ebuild | 2 +-
3 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.0.ebuild b/net-vpn/strongswan/strongswan-5.9.0.ebuild
index 119c3deceb5..55030178088 100644
--- a/net-vpn/strongswan/strongswan-5.9.0.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.0.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2020 Gentoo Authors
+# Copyright 1999-2021 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2
EAPI="7"
@@ -29,7 +29,7 @@ COMMON_DEPEND="!net-misc/openswan
caps? ( sys-libs/libcap )
curl? ( net-misc/curl )
ldap? ( net-nds/openldap )
- openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist] )
+ openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist(-)] )
mysql? ( dev-db/mysql-connector-c:= )
sqlite? ( >=dev-db/sqlite-3.3.1 )
systemd? ( sys-apps/systemd )
diff --git a/net-vpn/strongswan/strongswan-5.9.1.ebuild b/net-vpn/strongswan/strongswan-5.9.1.ebuild
index b7b28afa8ea..cd1ecbe44da 100644
--- a/net-vpn/strongswan/strongswan-5.9.1.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.1.ebuild
@@ -32,7 +32,7 @@ COMMON_DEPEND="non-root? (
caps? ( sys-libs/libcap )
curl? ( net-misc/curl )
ldap? ( net-nds/openldap )
- openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist] )
+ openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist(-)] )
mysql? ( dev-db/mysql-connector-c:= )
sqlite? ( >=dev-db/sqlite-3.3.1 )
systemd? ( sys-apps/systemd )
diff --git a/net-vpn/strongswan/strongswan-5.9.2.ebuild b/net-vpn/strongswan/strongswan-5.9.2.ebuild
index b7b28afa8ea..cd1ecbe44da 100644
--- a/net-vpn/strongswan/strongswan-5.9.2.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.2.ebuild
@@ -32,7 +32,7 @@ COMMON_DEPEND="non-root? (
caps? ( sys-libs/libcap )
curl? ( net-misc/curl )
ldap? ( net-nds/openldap )
- openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist] )
+ openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist(-)] )
mysql? ( dev-db/mysql-connector-c:= )
sqlite? ( >=dev-db/sqlite-3.3.1 )
systemd? ( sys-apps/systemd )
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2021-06-17 22:18 Thomas Deutschmann
0 siblings, 0 replies; 112+ messages in thread
From: Thomas Deutschmann @ 2021-06-17 22:18 UTC (permalink / raw
To: gentoo-commits
commit: 3e7c9a738ed0f919586b6fb0ddc80a9ea14f745b
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Thu Jun 17 22:04:30 2021 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Thu Jun 17 22:18:15 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3e7c9a73
net-vpn/strongswan: drop old
Package-Manager: Portage-3.0.20, Repoman-3.0.3
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
net-vpn/strongswan/Manifest | 2 -
net-vpn/strongswan/strongswan-5.9.0.ebuild | 308 -----------------------------
net-vpn/strongswan/strongswan-5.9.1.ebuild | 308 -----------------------------
3 files changed, 618 deletions(-)
diff --git a/net-vpn/strongswan/Manifest b/net-vpn/strongswan/Manifest
index 269b1eb23f1..928680f8c8d 100644
--- a/net-vpn/strongswan/Manifest
+++ b/net-vpn/strongswan/Manifest
@@ -1,3 +1 @@
-DIST strongswan-5.9.0.tar.bz2 4568404 BLAKE2B daf5cce5cbe12253f9ad201d89323ab7d54ba7ff466685b84830737689e4d417fbb97d053d8c9f3de5acb6dee9a192ebae48ec0d4aa07ba3c8969ee6d8f06ab3 SHA512 b982ce7c3e940ad75ab71b02ce3e2813b41c6b098cde5b6f3f3513d095f409fe989ae6e38a31eff51c57423bf452c3610cd5cd8cd7f45ff932581d9859df1821
-DIST strongswan-5.9.1.tar.bz2 4590867 BLAKE2B 1515764352e7473c47f853a5aa68e582d1fd61122ac1e1577bdc7813da77e0213803c69abf41a1667166e32fb9f2a4bfe8c74616d6431e698e31cf51e939ce3e SHA512 222625e77bd86959da6dd7346cfa9f92569fc396a494bb95ddf2c8e0680b7e8041541e8a14320517a0c735d713ae0fdc0d0c4694215e812817814b0b4efc3497
DIST strongswan-5.9.2.tar.bz2 4607281 BLAKE2B 84f5457bc970f49c9bc99d0ef41182d815e39b8a88be349ad0a78b531a983d3b3919d5c9f3b97793b0b2569f2c6b151cc3b5d9b145a8bfd663db6f79d8ff3dd6 SHA512 dca30b9be7847e0af59d1526c2e38d440b6729055cb3f0f0637d50d7381df465c7b59e79662efe63870a7a5a44eef696c02231274d2764f9e3c430ce2fd694f6
diff --git a/net-vpn/strongswan/strongswan-5.9.0.ebuild b/net-vpn/strongswan/strongswan-5.9.0.ebuild
deleted file mode 100644
index 55030178088..00000000000
--- a/net-vpn/strongswan/strongswan-5.9.0.ebuild
+++ /dev/null
@@ -1,308 +0,0 @@
-# Copyright 1999-2021 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="7"
-inherit linux-info systemd user
-
-DESCRIPTION="IPsec-based VPN solution, supporting IKEv1/IKEv2 and MOBIKE"
-HOMEPAGE="https://www.strongswan.org/"
-SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
-
-LICENSE="GPL-2 RSA DES"
-SLOT="0"
-KEYWORDS="amd64 arm ~arm64 ppc ~ppc64 x86"
-IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
-
-STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
-STRONGSWAN_PLUGINS_OPT="aesni blowfish bypass-lan ccm chapoly ctr forecast gcm ha ipseckey newhope ntru padlock rdrand save-keys unbound whitelist"
-for mod in $STRONGSWAN_PLUGINS_STD; do
- IUSE="${IUSE} +strongswan_plugins_${mod}"
-done
-
-for mod in $STRONGSWAN_PLUGINS_OPT; do
- IUSE="${IUSE} strongswan_plugins_${mod}"
-done
-
-COMMON_DEPEND="!net-misc/openswan
- gmp? ( >=dev-libs/gmp-4.1.5:= )
- gcrypt? ( dev-libs/libgcrypt:0 )
- caps? ( sys-libs/libcap )
- curl? ( net-misc/curl )
- ldap? ( net-nds/openldap )
- openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist(-)] )
- mysql? ( dev-db/mysql-connector-c:= )
- sqlite? ( >=dev-db/sqlite-3.3.1 )
- systemd? ( sys-apps/systemd )
- networkmanager? ( net-misc/networkmanager )
- pam? ( sys-libs/pam )
- strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns )"
-DEPEND="${COMMON_DEPEND}
- virtual/linux-sources
- sys-kernel/linux-headers"
-RDEPEND="${COMMON_DEPEND}
- virtual/logger
- sys-apps/iproute2
- !net-vpn/libreswan
- selinux? ( sec-policy/selinux-ipsec )"
-
-UGID="ipsec"
-
-pkg_setup() {
- linux-info_pkg_setup
-
- elog "Linux kernel version: ${KV_FULL}"
-
- if ! kernel_is -ge 2 6 16; then
- eerror
- eerror "This ebuild currently only supports ${PN} with the"
- eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
- eerror
- fi
-
- if kernel_is -lt 2 6 34; then
- ewarn
- ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
- ewarn
-
- if kernel_is -lt 2 6 29; then
- ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
- ewarn "include all required IPv6 modules even if you just intend"
- ewarn "to run on IPv4 only."
- ewarn
- ewarn "This has been fixed with kernels >= 2.6.29."
- ewarn
- fi
-
- if kernel_is -lt 2 6 33; then
- ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
- ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
- ewarn "miss SHA384 and SHA512 HMAC support altogether."
- ewarn
- ewarn "If you need any of those features, please use kernel >= 2.6.33."
- ewarn
- fi
-
- if kernel_is -lt 2 6 34; then
- ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
- ewarn "ESP cipher is only included in kernels >= 2.6.34."
- ewarn
- ewarn "If you need it, please use kernel >= 2.6.34."
- ewarn
- fi
- fi
-
- if use non-root; then
- enewgroup ${UGID}
- enewuser ${UGID} -1 -1 -1 ${UGID}
- fi
-}
-
-src_configure() {
- local myconf=""
-
- if use non-root; then
- myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
- fi
-
- # If a user has already enabled db support, those plugins will
- # most likely be desired as well. Besides they don't impose new
- # dependencies and come at no cost (except for space).
- if use mysql || use sqlite; then
- myconf="${myconf} --enable-attr-sql --enable-sql"
- fi
-
- # strongSwan builds and installs static libs by default which are
- # useless to the user (and to strongSwan for that matter) because no
- # header files or alike get installed... so disabling them is safe.
- if use pam && use eap; then
- myconf="${myconf} --enable-eap-gtc"
- else
- myconf="${myconf} --disable-eap-gtc"
- fi
-
- for mod in $STRONGSWAN_PLUGINS_STD; do
- if use strongswan_plugins_${mod}; then
- myconf+=" --enable-${mod}"
- fi
- done
-
- for mod in $STRONGSWAN_PLUGINS_OPT; do
- if use strongswan_plugins_${mod}; then
- myconf+=" --enable-${mod}"
- fi
- done
-
- econf \
- --disable-static \
- --enable-ikev1 \
- --enable-ikev2 \
- --enable-swanctl \
- --enable-socket-dynamic \
- $(use_enable curl) \
- $(use_enable constraints) \
- $(use_enable ldap) \
- $(use_enable debug leak-detective) \
- $(use_enable dhcp) \
- $(use_enable eap eap-sim) \
- $(use_enable eap eap-sim-file) \
- $(use_enable eap eap-simaka-sql) \
- $(use_enable eap eap-simaka-pseudonym) \
- $(use_enable eap eap-simaka-reauth) \
- $(use_enable eap eap-identity) \
- $(use_enable eap eap-md5) \
- $(use_enable eap eap-aka) \
- $(use_enable eap eap-aka-3gpp2) \
- $(use_enable eap md4) \
- $(use_enable eap eap-mschapv2) \
- $(use_enable eap eap-radius) \
- $(use_enable eap eap-tls) \
- $(use_enable eap eap-ttls) \
- $(use_enable eap xauth-eap) \
- $(use_enable eap eap-dynamic) \
- $(use_enable farp) \
- $(use_enable gmp) \
- $(use_enable gcrypt) \
- $(use_enable mysql) \
- $(use_enable networkmanager nm) \
- $(use_enable openssl) \
- $(use_enable pam xauth-pam) \
- $(use_enable pkcs11) \
- $(use_enable sqlite) \
- $(use_enable systemd) \
- $(use_with caps capabilities libcap) \
- --with-piddir=/run \
- --with-systemdsystemunitdir="$(systemd_get_systemunitdir)" \
- ${myconf}
-}
-
-src_install() {
- emake DESTDIR="${D}" install
-
- if ! use systemd; then
- rm -rf "${ED}"/lib/systemd || die
- fi
-
- doinitd "${FILESDIR}"/ipsec
-
- local dir_ugid
- if use non-root; then
- fowners ${UGID}:${UGID} \
- /etc/ipsec.conf \
- /etc/strongswan.conf
-
- dir_ugid="${UGID}"
- else
- dir_ugid="root"
- fi
-
- diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
- dodir /etc/ipsec.d \
- /etc/ipsec.d/aacerts \
- /etc/ipsec.d/acerts \
- /etc/ipsec.d/cacerts \
- /etc/ipsec.d/certs \
- /etc/ipsec.d/crls \
- /etc/ipsec.d/ocspcerts \
- /etc/ipsec.d/private \
- /etc/ipsec.d/reqs
-
- dodoc NEWS README TODO
-
- # shared libs are used only internally and there are no static libs,
- # so it's safe to get rid of the .la files
- find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
-}
-
-pkg_preinst() {
- has_version "<net-vpn/strongswan-4.3.6-r1"
- upgrade_from_leq_4_3_6=$(( !$? ))
-
- has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
- previous_4_3_6_with_caps=$(( !$? ))
-}
-
-pkg_postinst() {
- if ! use openssl && ! use gcrypt; then
- elog
- elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
- elog "Please note that this might effect availability and speed of some"
- elog "cryptographic features. You are advised to enable the OpenSSL plugin."
- elif ! use openssl; then
- elog
- elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
- elog "availability and speed of some cryptographic features. There will be"
- elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
- elog "25, 26) and ECDSA."
- fi
-
- if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
- chmod 0750 "${ROOT}"/etc/ipsec.d \
- "${ROOT}"/etc/ipsec.d/aacerts \
- "${ROOT}"/etc/ipsec.d/acerts \
- "${ROOT}"/etc/ipsec.d/cacerts \
- "${ROOT}"/etc/ipsec.d/certs \
- "${ROOT}"/etc/ipsec.d/crls \
- "${ROOT}"/etc/ipsec.d/ocspcerts \
- "${ROOT}"/etc/ipsec.d/private \
- "${ROOT}"/etc/ipsec.d/reqs
-
- ewarn
- ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
- ewarn "security reasons. Your system installed directories have been"
- ewarn "updated accordingly. Please check if necessary."
- ewarn
-
- if [[ $previous_4_3_6_with_caps == 1 ]]; then
- if ! use non-root; then
- ewarn
- ewarn "IMPORTANT: You previously had ${PN} installed without root"
- ewarn "privileges because it was implied by the 'caps' USE flag."
- ewarn "This has been changed. If you want ${PN} with user privileges,"
- ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
- ewarn
- fi
- fi
- fi
- if ! use caps && ! use non-root; then
- ewarn
- ewarn "You have decided to run ${PN} with root privileges and built it"
- ewarn "without support for POSIX capability dropping. It is generally"
- ewarn "strongly suggested that you reconsider- especially if you intend"
- ewarn "to run ${PN} as server with a public ip address."
- ewarn
- ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
- ewarn
- fi
- if use non-root; then
- elog
- elog "${PN} has been installed without superuser privileges (USE=non-root)."
- elog "This imposes several limitations mainly to the IKEv1 daemon 'pluto'"
- elog "but also a few to the IKEv2 daemon 'charon'."
- elog
- elog "Please carefully read: http://wiki.strongswan.org/wiki/nonRoot"
- elog
- elog "pluto uses a helper script by default to insert/remove routing and"
- elog "policy rules upon connection start/stop which requires superuser"
- elog "privileges. charon in contrast does this internally and can do so"
- elog "even with reduced (user) privileges."
- elog
- elog "Thus if you require IKEv1 (pluto) or need to specify a custom updown"
- elog "script to pluto or charon which requires superuser privileges, you"
- elog "can work around this limitation by using sudo to grant the"
- elog "user \"ipsec\" the appropriate rights."
- elog "For example (the default case):"
- elog "/etc/sudoers:"
- elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
- elog "Under the specific connection block in /etc/ipsec.conf:"
- elog " leftupdown=\"sudo -E ipsec _updown iptables\""
- elog
- fi
- elog
- elog "Make sure you have _all_ required kernel modules available including"
- elog "the appropriate cryptographic algorithms. A list is available at:"
- elog " https://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
- elog
- elog "The up-to-date manual is available online at:"
- elog " https://wiki.strongswan.org/"
- elog
-}
diff --git a/net-vpn/strongswan/strongswan-5.9.1.ebuild b/net-vpn/strongswan/strongswan-5.9.1.ebuild
deleted file mode 100644
index cd1ecbe44da..00000000000
--- a/net-vpn/strongswan/strongswan-5.9.1.ebuild
+++ /dev/null
@@ -1,308 +0,0 @@
-# Copyright 1999-2021 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="7"
-inherit linux-info systemd
-
-DESCRIPTION="IPsec-based VPN solution, supporting IKEv1/IKEv2 and MOBIKE"
-HOMEPAGE="https://www.strongswan.org/"
-SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
-
-LICENSE="GPL-2 RSA DES"
-SLOT="0"
-KEYWORDS="amd64 arm ~arm64 ppc ~ppc64 x86"
-IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
-
-STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
-STRONGSWAN_PLUGINS_OPT="aesni blowfish bypass-lan ccm chapoly ctr forecast gcm ha ipseckey newhope ntru padlock rdrand save-keys unbound whitelist"
-for mod in $STRONGSWAN_PLUGINS_STD; do
- IUSE="${IUSE} +strongswan_plugins_${mod}"
-done
-
-for mod in $STRONGSWAN_PLUGINS_OPT; do
- IUSE="${IUSE} strongswan_plugins_${mod}"
-done
-
-COMMON_DEPEND="non-root? (
- acct-user/ipsec
- acct-group/ipsec
- )
- gmp? ( >=dev-libs/gmp-4.1.5:= )
- gcrypt? ( dev-libs/libgcrypt:0 )
- caps? ( sys-libs/libcap )
- curl? ( net-misc/curl )
- ldap? ( net-nds/openldap )
- openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist(-)] )
- mysql? ( dev-db/mysql-connector-c:= )
- sqlite? ( >=dev-db/sqlite-3.3.1 )
- systemd? ( sys-apps/systemd )
- networkmanager? ( net-misc/networkmanager )
- pam? ( sys-libs/pam )
- strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns )"
-
-DEPEND="${COMMON_DEPEND}
- virtual/linux-sources
- sys-kernel/linux-headers"
-
-RDEPEND="${COMMON_DEPEND}
- virtual/logger
- sys-apps/iproute2
- !net-vpn/libreswan
- selinux? ( sec-policy/selinux-ipsec )"
-
-UGID="ipsec"
-
-pkg_setup() {
- linux-info_pkg_setup
-
- elog "Linux kernel version: ${KV_FULL}"
-
- if ! kernel_is -ge 2 6 16; then
- eerror
- eerror "This ebuild currently only supports ${PN} with the"
- eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
- eerror
- fi
-
- if kernel_is -lt 2 6 34; then
- ewarn
- ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
- ewarn
-
- if kernel_is -lt 2 6 29; then
- ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
- ewarn "include all required IPv6 modules even if you just intend"
- ewarn "to run on IPv4 only."
- ewarn
- ewarn "This has been fixed with kernels >= 2.6.29."
- ewarn
- fi
-
- if kernel_is -lt 2 6 33; then
- ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
- ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
- ewarn "miss SHA384 and SHA512 HMAC support altogether."
- ewarn
- ewarn "If you need any of those features, please use kernel >= 2.6.33."
- ewarn
- fi
-
- if kernel_is -lt 2 6 34; then
- ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
- ewarn "ESP cipher is only included in kernels >= 2.6.34."
- ewarn
- ewarn "If you need it, please use kernel >= 2.6.34."
- ewarn
- fi
- fi
-}
-
-src_configure() {
- local myconf=""
-
- if use non-root; then
- myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
- fi
-
- # If a user has already enabled db support, those plugins will
- # most likely be desired as well. Besides they don't impose new
- # dependencies and come at no cost (except for space).
- if use mysql || use sqlite; then
- myconf="${myconf} --enable-attr-sql --enable-sql"
- fi
-
- # strongSwan builds and installs static libs by default which are
- # useless to the user (and to strongSwan for that matter) because no
- # header files or alike get installed... so disabling them is safe.
- if use pam && use eap; then
- myconf="${myconf} --enable-eap-gtc"
- else
- myconf="${myconf} --disable-eap-gtc"
- fi
-
- for mod in $STRONGSWAN_PLUGINS_STD; do
- if use strongswan_plugins_${mod}; then
- myconf+=" --enable-${mod}"
- fi
- done
-
- for mod in $STRONGSWAN_PLUGINS_OPT; do
- if use strongswan_plugins_${mod}; then
- myconf+=" --enable-${mod}"
- fi
- done
-
- econf \
- --disable-static \
- --enable-ikev1 \
- --enable-ikev2 \
- --enable-swanctl \
- --enable-socket-dynamic \
- $(use_enable curl) \
- $(use_enable constraints) \
- $(use_enable ldap) \
- $(use_enable debug leak-detective) \
- $(use_enable dhcp) \
- $(use_enable eap eap-sim) \
- $(use_enable eap eap-sim-file) \
- $(use_enable eap eap-simaka-sql) \
- $(use_enable eap eap-simaka-pseudonym) \
- $(use_enable eap eap-simaka-reauth) \
- $(use_enable eap eap-identity) \
- $(use_enable eap eap-md5) \
- $(use_enable eap eap-aka) \
- $(use_enable eap eap-aka-3gpp2) \
- $(use_enable eap md4) \
- $(use_enable eap eap-mschapv2) \
- $(use_enable eap eap-radius) \
- $(use_enable eap eap-tls) \
- $(use_enable eap eap-ttls) \
- $(use_enable eap xauth-eap) \
- $(use_enable eap eap-dynamic) \
- $(use_enable farp) \
- $(use_enable gmp) \
- $(use_enable gcrypt) \
- $(use_enable mysql) \
- $(use_enable networkmanager nm) \
- $(use_enable openssl) \
- $(use_enable pam xauth-pam) \
- $(use_enable pkcs11) \
- $(use_enable sqlite) \
- $(use_enable systemd) \
- $(use_with caps capabilities libcap) \
- --with-piddir=/run \
- --with-systemdsystemunitdir="$(systemd_get_systemunitdir)" \
- ${myconf}
-}
-
-src_install() {
- emake DESTDIR="${D}" install
-
- if ! use systemd; then
- rm -rf "${ED}"/lib/systemd || die
- fi
-
- doinitd "${FILESDIR}"/ipsec
-
- local dir_ugid
- if use non-root; then
- fowners ${UGID}:${UGID} \
- /etc/ipsec.conf \
- /etc/strongswan.conf
-
- dir_ugid="${UGID}"
- else
- dir_ugid="root"
- fi
-
- diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
- dodir /etc/ipsec.d \
- /etc/ipsec.d/aacerts \
- /etc/ipsec.d/acerts \
- /etc/ipsec.d/cacerts \
- /etc/ipsec.d/certs \
- /etc/ipsec.d/crls \
- /etc/ipsec.d/ocspcerts \
- /etc/ipsec.d/private \
- /etc/ipsec.d/reqs
-
- dodoc NEWS README TODO
-
- # shared libs are used only internally and there are no static libs,
- # so it's safe to get rid of the .la files
- find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
-}
-
-pkg_preinst() {
- has_version "<net-vpn/strongswan-4.3.6-r1"
- upgrade_from_leq_4_3_6=$(( !$? ))
-
- has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
- previous_4_3_6_with_caps=$(( !$? ))
-}
-
-pkg_postinst() {
- if ! use openssl && ! use gcrypt; then
- elog
- elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
- elog "Please note that this might effect availability and speed of some"
- elog "cryptographic features. You are advised to enable the OpenSSL plugin."
- elif ! use openssl; then
- elog
- elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
- elog "availability and speed of some cryptographic features. There will be"
- elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
- elog "25, 26) and ECDSA."
- fi
-
- if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
- chmod 0750 "${ROOT}"/etc/ipsec.d \
- "${ROOT}"/etc/ipsec.d/aacerts \
- "${ROOT}"/etc/ipsec.d/acerts \
- "${ROOT}"/etc/ipsec.d/cacerts \
- "${ROOT}"/etc/ipsec.d/certs \
- "${ROOT}"/etc/ipsec.d/crls \
- "${ROOT}"/etc/ipsec.d/ocspcerts \
- "${ROOT}"/etc/ipsec.d/private \
- "${ROOT}"/etc/ipsec.d/reqs
-
- ewarn
- ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
- ewarn "security reasons. Your system installed directories have been"
- ewarn "updated accordingly. Please check if necessary."
- ewarn
-
- if [[ $previous_4_3_6_with_caps == 1 ]]; then
- if ! use non-root; then
- ewarn
- ewarn "IMPORTANT: You previously had ${PN} installed without root"
- ewarn "privileges because it was implied by the 'caps' USE flag."
- ewarn "This has been changed. If you want ${PN} with user privileges,"
- ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
- ewarn
- fi
- fi
- fi
- if ! use caps && ! use non-root; then
- ewarn
- ewarn "You have decided to run ${PN} with root privileges and built it"
- ewarn "without support for POSIX capability dropping. It is generally"
- ewarn "strongly suggested that you reconsider- especially if you intend"
- ewarn "to run ${PN} as server with a public ip address."
- ewarn
- ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
- ewarn
- fi
- if use non-root; then
- elog
- elog "${PN} has been installed without superuser privileges (USE=non-root)."
- elog "This imposes several limitations mainly to the IKEv1 daemon 'pluto'"
- elog "but also a few to the IKEv2 daemon 'charon'."
- elog
- elog "Please carefully read: http://wiki.strongswan.org/wiki/nonRoot"
- elog
- elog "pluto uses a helper script by default to insert/remove routing and"
- elog "policy rules upon connection start/stop which requires superuser"
- elog "privileges. charon in contrast does this internally and can do so"
- elog "even with reduced (user) privileges."
- elog
- elog "Thus if you require IKEv1 (pluto) or need to specify a custom updown"
- elog "script to pluto or charon which requires superuser privileges, you"
- elog "can work around this limitation by using sudo to grant the"
- elog "user \"ipsec\" the appropriate rights."
- elog "For example (the default case):"
- elog "/etc/sudoers:"
- elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
- elog "Under the specific connection block in /etc/ipsec.conf:"
- elog " leftupdown=\"sudo -E ipsec _updown iptables\""
- elog
- fi
- elog
- elog "Make sure you have _all_ required kernel modules available including"
- elog "the appropriate cryptographic algorithms. A list is available at:"
- elog " https://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
- elog
- elog "The up-to-date manual is available online at:"
- elog " https://wiki.strongswan.org/"
- elog
-}
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2021-06-17 22:18 Thomas Deutschmann
0 siblings, 0 replies; 112+ messages in thread
From: Thomas Deutschmann @ 2021-06-17 22:18 UTC (permalink / raw
To: gentoo-commits
commit: bbfa6f5c8db2584633fbcd93db5d01c4a72bb1d9
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Thu Jun 17 22:04:51 2021 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Thu Jun 17 22:18:16 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bbfa6f5c
net-vpn/strongswan: rev bump for commit c6d150c35
Package-Manager: Portage-3.0.20, Repoman-3.0.3
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
.../strongswan/{strongswan-5.9.2.ebuild => strongswan-5.9.2-r1.ebuild} | 0
1 file changed, 0 insertions(+), 0 deletions(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.2.ebuild b/net-vpn/strongswan/strongswan-5.9.2-r1.ebuild
similarity index 100%
rename from net-vpn/strongswan/strongswan-5.9.2.ebuild
rename to net-vpn/strongswan/strongswan-5.9.2-r1.ebuild
^ permalink raw reply [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2022-01-02 14:15 Florian Schmaus
0 siblings, 0 replies; 112+ messages in thread
From: Florian Schmaus @ 2022-01-02 14:15 UTC (permalink / raw
To: gentoo-commits
commit: 7b2be9c86d3a38312e787a30291c46e30b2da3bb
Author: Philipp Rösner <rndxelement <AT> protonmail <DOT> com>
AuthorDate: Wed Dec 29 22:46:06 2021 +0000
Commit: Florian Schmaus <flow <AT> gentoo <DOT> org>
CommitDate: Sun Jan 2 14:15:30 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7b2be9c8
net-vpn/strongswan: bump to 5.9.4
Added an ebuild for strongswan-5.9.4 with support for EAPI 8.
Bug: https://bugs.gentoo.org/818841
Package-Manager: Portage-3.0.30, Repoman-3.0.3
Signed-off-by: Philipp Roesner <rndxelement <AT> protonmail.com>
Signed-off-by: Florian Schmaus <flow <AT> gentoo.org>
net-vpn/strongswan/Manifest | 1 +
net-vpn/strongswan/strongswan-5.9.4.ebuild | 308 +++++++++++++++++++++++++++++
2 files changed, 309 insertions(+)
diff --git a/net-vpn/strongswan/Manifest b/net-vpn/strongswan/Manifest
index 928680f8c8db..20a3b02a5249 100644
--- a/net-vpn/strongswan/Manifest
+++ b/net-vpn/strongswan/Manifest
@@ -1 +1,2 @@
DIST strongswan-5.9.2.tar.bz2 4607281 BLAKE2B 84f5457bc970f49c9bc99d0ef41182d815e39b8a88be349ad0a78b531a983d3b3919d5c9f3b97793b0b2569f2c6b151cc3b5d9b145a8bfd663db6f79d8ff3dd6 SHA512 dca30b9be7847e0af59d1526c2e38d440b6729055cb3f0f0637d50d7381df465c7b59e79662efe63870a7a5a44eef696c02231274d2764f9e3c430ce2fd694f6
+DIST strongswan-5.9.4.tar.bz2 4651000 BLAKE2B 071a0a0a144b369a7e4069d92340cecca9eef0c004949d91993c8f1cc0f39f7868749020d6e135fa59d5899d146f39172f87eb32a26ad788cb8a4c160597e328 SHA512 796356c1d5c1ad410f0ed944ab4a131076d26f120ec6fa57796fe4060b0741201199625883ddc9ebd8a7ad299495f073cec76a6780ebd8f375605aae16750cf3
diff --git a/net-vpn/strongswan/strongswan-5.9.4.ebuild b/net-vpn/strongswan/strongswan-5.9.4.ebuild
new file mode 100644
index 000000000000..133424376b55
--- /dev/null
+++ b/net-vpn/strongswan/strongswan-5.9.4.ebuild
@@ -0,0 +1,308 @@
+# Copyright 1999-2021 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+inherit linux-info systemd
+
+DESCRIPTION="IPsec-based VPN solution, supporting IKEv1/IKEv2 and MOBIKE"
+HOMEPAGE="https://www.strongswan.org/"
+SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
+
+LICENSE="GPL-2 RSA DES"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~x86"
+IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
+
+STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
+STRONGSWAN_PLUGINS_OPT="aesni blowfish bypass-lan ccm chapoly ctr forecast gcm ha ipseckey newhope ntru padlock rdrand save-keys unbound whitelist"
+for mod in $STRONGSWAN_PLUGINS_STD; do
+ IUSE="${IUSE} +strongswan_plugins_${mod}"
+done
+
+for mod in $STRONGSWAN_PLUGINS_OPT; do
+ IUSE="${IUSE} strongswan_plugins_${mod}"
+done
+
+COMMON_DEPEND="non-root? (
+ acct-user/ipsec
+ acct-group/ipsec
+ )
+ gmp? ( >=dev-libs/gmp-4.1.5:= )
+ gcrypt? ( dev-libs/libgcrypt:0 )
+ caps? ( sys-libs/libcap )
+ curl? ( net-misc/curl )
+ ldap? ( net-nds/openldap )
+ openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist(-)] )
+ mysql? ( dev-db/mysql-connector-c:= )
+ sqlite? ( >=dev-db/sqlite-3.3.1 )
+ systemd? ( sys-apps/systemd )
+ networkmanager? ( net-misc/networkmanager )
+ pam? ( sys-libs/pam )
+ strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns )"
+
+DEPEND="${COMMON_DEPEND}
+ virtual/linux-sources
+ sys-kernel/linux-headers"
+
+RDEPEND="${COMMON_DEPEND}
+ virtual/logger
+ sys-apps/iproute2
+ !net-vpn/libreswan
+ selinux? ( sec-policy/selinux-ipsec )"
+
+UGID="ipsec"
+
+pkg_setup() {
+ linux-info_pkg_setup
+
+ elog "Linux kernel version: ${KV_FULL}"
+
+ if ! kernel_is -ge 2 6 16; then
+ eerror
+ eerror "This ebuild currently only supports ${PN} with the"
+ eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
+ eerror
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn
+ ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
+ ewarn
+
+ if kernel_is -lt 2 6 29; then
+ ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
+ ewarn "include all required IPv6 modules even if you just intend"
+ ewarn "to run on IPv4 only."
+ ewarn
+ ewarn "This has been fixed with kernels >= 2.6.29."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 33; then
+ ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
+ ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
+ ewarn "miss SHA384 and SHA512 HMAC support altogether."
+ ewarn
+ ewarn "If you need any of those features, please use kernel >= 2.6.33."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
+ ewarn "ESP cipher is only included in kernels >= 2.6.34."
+ ewarn
+ ewarn "If you need it, please use kernel >= 2.6.34."
+ ewarn
+ fi
+ fi
+}
+
+src_configure() {
+ local myconf=""
+
+ if use non-root; then
+ myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
+ fi
+
+ # If a user has already enabled db support, those plugins will
+ # most likely be desired as well. Besides they don't impose new
+ # dependencies and come at no cost (except for space).
+ if use mysql || use sqlite; then
+ myconf="${myconf} --enable-attr-sql --enable-sql"
+ fi
+
+ # strongSwan builds and installs static libs by default which are
+ # useless to the user (and to strongSwan for that matter) because no
+ # header files or alike get installed... so disabling them is safe.
+ if use pam && use eap; then
+ myconf="${myconf} --enable-eap-gtc"
+ else
+ myconf="${myconf} --disable-eap-gtc"
+ fi
+
+ for mod in $STRONGSWAN_PLUGINS_STD; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ for mod in $STRONGSWAN_PLUGINS_OPT; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ econf \
+ --disable-static \
+ --enable-ikev1 \
+ --enable-ikev2 \
+ --enable-swanctl \
+ --enable-socket-dynamic \
+ $(use_enable curl) \
+ $(use_enable constraints) \
+ $(use_enable ldap) \
+ $(use_enable debug leak-detective) \
+ $(use_enable dhcp) \
+ $(use_enable eap eap-sim) \
+ $(use_enable eap eap-sim-file) \
+ $(use_enable eap eap-simaka-sql) \
+ $(use_enable eap eap-simaka-pseudonym) \
+ $(use_enable eap eap-simaka-reauth) \
+ $(use_enable eap eap-identity) \
+ $(use_enable eap eap-md5) \
+ $(use_enable eap eap-aka) \
+ $(use_enable eap eap-aka-3gpp2) \
+ $(use_enable eap md4) \
+ $(use_enable eap eap-mschapv2) \
+ $(use_enable eap eap-radius) \
+ $(use_enable eap eap-tls) \
+ $(use_enable eap eap-ttls) \
+ $(use_enable eap xauth-eap) \
+ $(use_enable eap eap-dynamic) \
+ $(use_enable farp) \
+ $(use_enable gmp) \
+ $(use_enable gcrypt) \
+ $(use_enable mysql) \
+ $(use_enable networkmanager nm) \
+ $(use_enable openssl) \
+ $(use_enable pam xauth-pam) \
+ $(use_enable pkcs11) \
+ $(use_enable sqlite) \
+ $(use_enable systemd) \
+ $(use_with caps capabilities libcap) \
+ --with-piddir=/run \
+ --with-systemdsystemunitdir="$(systemd_get_systemunitdir)" \
+ ${myconf}
+}
+
+src_install() {
+ emake DESTDIR="${D}" install
+
+ if ! use systemd; then
+ rm -rf "${ED}"/lib/systemd || die "Failed removing systemd lib."
+ fi
+
+ doinitd "${FILESDIR}"/ipsec
+
+ local dir_ugid
+ if use non-root; then
+ fowners ${UGID}:${UGID} \
+ /etc/ipsec.conf \
+ /etc/strongswan.conf
+
+ dir_ugid="${UGID}"
+ else
+ dir_ugid="root"
+ fi
+
+ diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
+ dodir /etc/ipsec.d \
+ /etc/ipsec.d/aacerts \
+ /etc/ipsec.d/acerts \
+ /etc/ipsec.d/cacerts \
+ /etc/ipsec.d/certs \
+ /etc/ipsec.d/crls \
+ /etc/ipsec.d/ocspcerts \
+ /etc/ipsec.d/private \
+ /etc/ipsec.d/reqs
+
+ dodoc NEWS README TODO
+
+ # shared libs are used only internally and there are no static libs,
+ # so it's safe to get rid of the .la files
+ find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
+}
+
+pkg_preinst() {
+ has_version "<net-vpn/strongswan-4.3.6-r1"
+ upgrade_from_leq_4_3_6=$(( !$? ))
+
+ has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
+ previous_4_3_6_with_caps=$(( !$? ))
+}
+
+pkg_postinst() {
+ if ! use openssl && ! use gcrypt; then
+ elog
+ elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
+ elog "Please note that this might effect availability and speed of some"
+ elog "cryptographic features. You are advised to enable the OpenSSL plugin."
+ elif ! use openssl; then
+ elog
+ elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
+ elog "availability and speed of some cryptographic features. There will be"
+ elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
+ elog "25, 26) and ECDSA."
+ fi
+
+ if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
+ chmod 0750 "${ROOT}"/etc/ipsec.d \
+ "${ROOT}"/etc/ipsec.d/aacerts \
+ "${ROOT}"/etc/ipsec.d/acerts \
+ "${ROOT}"/etc/ipsec.d/cacerts \
+ "${ROOT}"/etc/ipsec.d/certs \
+ "${ROOT}"/etc/ipsec.d/crls \
+ "${ROOT}"/etc/ipsec.d/ocspcerts \
+ "${ROOT}"/etc/ipsec.d/private \
+ "${ROOT}"/etc/ipsec.d/reqs
+
+ ewarn
+ ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
+ ewarn "security reasons. Your system installed directories have been"
+ ewarn "updated accordingly. Please check if necessary."
+ ewarn
+
+ if [[ $previous_4_3_6_with_caps == 1 ]]; then
+ if ! use non-root; then
+ ewarn
+ ewarn "IMPORTANT: You previously had ${PN} installed without root"
+ ewarn "privileges because it was implied by the 'caps' USE flag."
+ ewarn "This has been changed. If you want ${PN} with user privileges,"
+ ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
+ ewarn
+ fi
+ fi
+ fi
+ if ! use caps && ! use non-root; then
+ ewarn
+ ewarn "You have decided to run ${PN} with root privileges and built it"
+ ewarn "without support for POSIX capability dropping. It is generally"
+ ewarn "strongly suggested that you reconsider- especially if you intend"
+ ewarn "to run ${PN} as server with a public ip address."
+ ewarn
+ ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
+ ewarn
+ fi
+ if use non-root; then
+ elog
+ elog "${PN} has been installed without superuser privileges (USE=non-root)."
+ elog "This imposes several limitations mainly to the IKEv1 daemon 'pluto'"
+ elog "but also a few to the IKEv2 daemon 'charon'."
+ elog
+ elog "Please carefully read: http://wiki.strongswan.org/wiki/nonRoot"
+ elog
+ elog "pluto uses a helper script by default to insert/remove routing and"
+ elog "policy rules upon connection start/stop which requires superuser"
+ elog "privileges. charon in contrast does this internally and can do so"
+ elog "even with reduced (user) privileges."
+ elog
+ elog "Thus if you require IKEv1 (pluto) or need to specify a custom updown"
+ elog "script to pluto or charon which requires superuser privileges, you"
+ elog "can work around this limitation by using sudo to grant the"
+ elog "user \"ipsec\" the appropriate rights."
+ elog "For example (the default case):"
+ elog "/etc/sudoers:"
+ elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
+ elog "Under the specific connection block in /etc/ipsec.conf:"
+ elog " leftupdown=\"sudo -E ipsec _updown iptables\""
+ elog
+ fi
+ elog
+ elog "Make sure you have _all_ required kernel modules available including"
+ elog "the appropriate cryptographic algorithms. A list is available at:"
+ elog " https://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
+ elog
+ elog "The up-to-date manual is available online at:"
+ elog " https://wiki.strongswan.org/"
+ elog
+}
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2022-01-02 14:15 Florian Schmaus
0 siblings, 0 replies; 112+ messages in thread
From: Florian Schmaus @ 2022-01-02 14:15 UTC (permalink / raw
To: gentoo-commits
commit: 0f8b6bb656080a56a4328a0ac32901ed6df6bb4c
Author: Philipp Rösner <rndxelement <AT> protonmail <DOT> com>
AuthorDate: Sun Jan 2 10:39:19 2022 +0000
Commit: Florian Schmaus <flow <AT> gentoo <DOT> org>
CommitDate: Sun Jan 2 14:15:30 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0f8b6bb6
net-vpn/strongswan: take over maintainership
Added Dennis Eisele and Philipp Rösner as proxied maintainers for
net-vpn/strongswan.
Package-Manager: Portage-3.0.30, Repoman-3.0.3
Signed-off-by: Philipp Roesner <rndxelement <AT> protonmail.com>
Closes: https://github.com/gentoo/gentoo/pull/23573
Signed-off-by: Florian Schmaus <flow <AT> gentoo.org>
net-vpn/strongswan/metadata.xml | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/metadata.xml b/net-vpn/strongswan/metadata.xml
index a55b4e5b7b89..dfd6043700dc 100644
--- a/net-vpn/strongswan/metadata.xml
+++ b/net-vpn/strongswan/metadata.xml
@@ -1,7 +1,18 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
<pkgmetadata>
- <!-- maintainer-needed -->
+ <maintainer type="person" proxied="yes">
+ <email>mail@dennis-eisele.de</email>
+ <name>Dennis Eisele</name>
+ </maintainer>
+ <maintainer type="person" proxied="yes">
+ <email>rndxelement@protonmail.com</email>
+ <name>Philipp Rösner</name>
+ </maintainer>
+ <maintainer type="project" proxied="proxy">
+ <email>proxy-maint@gentoo.org</email>
+ <name>Proxy Maintainers</name>
+ </maintainer>
<longdescription lang="en">
StrongSwan is direct descendant of the discontinued FreeS/WAN project.
As an IPsec based VPN solution which is focused on security and ease of
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2022-01-06 18:33 Florian Schmaus
0 siblings, 0 replies; 112+ messages in thread
From: Florian Schmaus @ 2022-01-06 18:33 UTC (permalink / raw
To: gentoo-commits
commit: 9e69de22a49ae00bb34b4ea987a3d7ab33baeab6
Author: Dennis Eisele <mail <AT> dennis-eisele <DOT> de>
AuthorDate: Wed Jan 5 18:42:29 2022 +0000
Commit: Florian Schmaus <flow <AT> gentoo <DOT> org>
CommitDate: Thu Jan 6 18:33:25 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9e69de22
net-vpn/strongswan: change mail address
Bug: https://bugs.gentoo.org/830451
Signed-off-by: Dennis Eisele <mail <AT> dennis-eisele.de>
Closes: https://github.com/gentoo/gentoo/pull/23666
Signed-off-by: Florian Schmaus <flow <AT> gentoo.org>
net-vpn/strongswan/metadata.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/metadata.xml b/net-vpn/strongswan/metadata.xml
index dfd6043700dc..ff96d513571b 100644
--- a/net-vpn/strongswan/metadata.xml
+++ b/net-vpn/strongswan/metadata.xml
@@ -2,7 +2,7 @@
<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
<pkgmetadata>
<maintainer type="person" proxied="yes">
- <email>mail@dennis-eisele.de</email>
+ <email>kernlpanic@dennis-eisele.de</email>
<name>Dennis Eisele</name>
</maintainer>
<maintainer type="person" proxied="yes">
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2022-01-06 18:33 Florian Schmaus
0 siblings, 0 replies; 112+ messages in thread
From: Florian Schmaus @ 2022-01-06 18:33 UTC (permalink / raw
To: gentoo-commits
commit: 9a21f19e85788b98db74829812e86dba7ac0df21
Author: Dennis Eisele <kernlpanic <AT> dennis-eisele <DOT> de>
AuthorDate: Wed Jan 5 22:47:33 2022 +0000
Commit: Florian Schmaus <flow <AT> gentoo <DOT> org>
CommitDate: Thu Jan 6 18:33:25 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9a21f19e
net-vpn/strongswan: add charon-cmd support
Closes: https://bugs.gentoo.org/524642
Signed-off-by: Dennis Eisele <kernlpanic <AT> dennis-eisele.de>
Closes: https://github.com/gentoo/gentoo/pull/23663
Signed-off-by: Florian Schmaus <flow <AT> gentoo.org>
.../strongswan/{strongswan-5.9.4.ebuild => strongswan-5.9.4-r1.ebuild} | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.4.ebuild b/net-vpn/strongswan/strongswan-5.9.4-r1.ebuild
similarity index 99%
rename from net-vpn/strongswan/strongswan-5.9.4.ebuild
rename to net-vpn/strongswan/strongswan-5.9.4-r1.ebuild
index 133424376b55..62733a563b86 100644
--- a/net-vpn/strongswan/strongswan-5.9.4.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.4-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2
EAPI="8"
@@ -138,6 +138,7 @@ src_configure() {
--enable-ikev2 \
--enable-swanctl \
--enable-socket-dynamic \
+ --enable-cmd \
$(use_enable curl) \
$(use_enable constraints) \
$(use_enable ldap) \
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2022-01-07 15:06 Florian Schmaus
0 siblings, 0 replies; 112+ messages in thread
From: Florian Schmaus @ 2022-01-07 15:06 UTC (permalink / raw
To: gentoo-commits
commit: 37d5f0158443ad4ecfd78c4749f537f3488ef550
Author: Dennis Eisele <kernlpanic <AT> dennis-eisele <DOT> de>
AuthorDate: Fri Jan 7 14:44:01 2022 +0000
Commit: Florian Schmaus <flow <AT> gentoo <DOT> org>
CommitDate: Fri Jan 7 15:05:49 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=37d5f015
net-vpn/strongswan: add xauth-noauth plugin USE Flag
Closes: https://bugs.gentoo.org/465556
Signed-off-by: Dennis Eisele <kernlpanic <AT> dennis-eisele.de>
Closes: https://github.com/gentoo/gentoo/pull/23686
Signed-off-by: Florian Schmaus <flow <AT> gentoo.org>
net-vpn/strongswan/metadata.xml | 1 +
net-vpn/strongswan/strongswan-5.9.4-r1.ebuild | 4 +++-
2 files changed, 4 insertions(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/metadata.xml b/net-vpn/strongswan/metadata.xml
index ff96d513571b..0198dd1c8ac4 100644
--- a/net-vpn/strongswan/metadata.xml
+++ b/net-vpn/strongswan/metadata.xml
@@ -52,6 +52,7 @@
<flag name="strongswan_plugins_save-keys">Enable plugin that saves IKE and/or ESP keys to files compatible with Wireshark (for debugging)</flag>
<flag name="strongswan_plugins_unbound">Enable support for the unbound plugin</flag>
<flag name="strongswan_plugins_whitelist">Enable support for the whitelist plugin</flag>
+ <flag name="strongswan_plugins_xauth-noauth">Enable support for the xauth-noauth plugin</flag>
</use>
<upstream>
<remote-id type="cpe">cpe:/a:strongswan:strongswan</remote-id>
diff --git a/net-vpn/strongswan/strongswan-5.9.4-r1.ebuild b/net-vpn/strongswan/strongswan-5.9.4-r1.ebuild
index 62733a563b86..5d6ceeabdccc 100644
--- a/net-vpn/strongswan/strongswan-5.9.4-r1.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.4-r1.ebuild
@@ -14,7 +14,9 @@ KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
-STRONGSWAN_PLUGINS_OPT="aesni blowfish bypass-lan ccm chapoly ctr forecast gcm ha ipseckey newhope ntru padlock rdrand save-keys unbound whitelist"
+STRONGSWAN_PLUGINS_OPT="aesni blowfish bypass-lan ccm chapoly ctr forecast gcm
+ha ipseckey newhope ntru padlock rdrand save-keys unbound whitelist
+xauth-noauth"
for mod in $STRONGSWAN_PLUGINS_STD; do
IUSE="${IUSE} +strongswan_plugins_${mod}"
done
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2022-01-12 8:25 Florian Schmaus
0 siblings, 0 replies; 112+ messages in thread
From: Florian Schmaus @ 2022-01-12 8:25 UTC (permalink / raw
To: gentoo-commits
commit: 27433e746e662096bcf6b91647307f9640878a22
Author: Dennis Eisele <kernlpanic <AT> dennis-eisele <DOT> de>
AuthorDate: Tue Jan 11 22:57:45 2022 +0000
Commit: Florian Schmaus <flow <AT> gentoo <DOT> org>
CommitDate: Wed Jan 12 08:23:26 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=27433e74
net-vpn/strongswan: change dependencies so openssl3 isn't used
Closes: https://bugs.gentoo.org/806178
Signed-off-by: Dennis Eisele <kernlpanic <AT> dennis-eisele.de>
Closes: https://github.com/gentoo/gentoo/pull/23747
Signed-off-by: Florian Schmaus <flow <AT> gentoo.org>
.../{strongswan-5.9.2-r1.ebuild => strongswan-5.9.2-r2.ebuild} | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.2-r1.ebuild b/net-vpn/strongswan/strongswan-5.9.2-r2.ebuild
similarity index 98%
rename from net-vpn/strongswan/strongswan-5.9.2-r1.ebuild
rename to net-vpn/strongswan/strongswan-5.9.2-r2.ebuild
index cd1ecbe44da2..b537c194e061 100644
--- a/net-vpn/strongswan/strongswan-5.9.2-r1.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.2-r2.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2
EAPI="7"
@@ -32,7 +32,7 @@ COMMON_DEPEND="non-root? (
caps? ( sys-libs/libcap )
curl? ( net-misc/curl )
ldap? ( net-nds/openldap )
- openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist(-)] )
+ openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist(-)] <dev-libs/openssl-3:= )
mysql? ( dev-db/mysql-connector-c:= )
sqlite? ( >=dev-db/sqlite-3.3.1 )
systemd? ( sys-apps/systemd )
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2022-01-27 15:32 Florian Schmaus
0 siblings, 0 replies; 112+ messages in thread
From: Florian Schmaus @ 2022-01-27 15:32 UTC (permalink / raw
To: gentoo-commits
commit: 0dccf910fa8936f6d02499f785f105fe0ec3c3fa
Author: Dennis Eisele <kernlpanic <AT> dennis-eisele <DOT> de>
AuthorDate: Wed Jan 26 22:27:35 2022 +0000
Commit: Florian Schmaus <flow <AT> gentoo <DOT> org>
CommitDate: Thu Jan 27 15:32:12 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0dccf910
net-vpn/strongswan: change postemerge message for non-root
Thanks-to: Ronald <ronald654 <AT> gmail.com>
Closes: 424373,468674
Package-Manager: Portage-3.0.28, Repoman-3.0.3
Signed-off-by: Dennis Eisele <kernlpanic <AT> dennis-eisele.de>
Closes: https://github.com/gentoo/gentoo/pull/23976
Signed-off-by: Florian Schmaus <flow <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.2-r2.ebuild | 15 +++++----------
net-vpn/strongswan/strongswan-5.9.4-r1.ebuild | 11 +++--------
2 files changed, 8 insertions(+), 18 deletions(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.2-r2.ebuild b/net-vpn/strongswan/strongswan-5.9.2-r2.ebuild
index b537c194e061..8d920548b62e 100644
--- a/net-vpn/strongswan/strongswan-5.9.2-r2.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.2-r2.ebuild
@@ -276,18 +276,13 @@ pkg_postinst() {
if use non-root; then
elog
elog "${PN} has been installed without superuser privileges (USE=non-root)."
- elog "This imposes several limitations mainly to the IKEv1 daemon 'pluto'"
- elog "but also a few to the IKEv2 daemon 'charon'."
+ elog "This imposes a few limitations mainly to the daemon 'charon' in"
+ elog "regards of the use of iptables."
elog
- elog "Please carefully read: http://wiki.strongswan.org/wiki/nonRoot"
+ elog "Please carefully read: https://wiki.strongswan.org/projects/strongswan/wiki/ReducedPrivileges"
elog
- elog "pluto uses a helper script by default to insert/remove routing and"
- elog "policy rules upon connection start/stop which requires superuser"
- elog "privileges. charon in contrast does this internally and can do so"
- elog "even with reduced (user) privileges."
- elog
- elog "Thus if you require IKEv1 (pluto) or need to specify a custom updown"
- elog "script to pluto or charon which requires superuser privileges, you"
+ elog "Thus if you require to specify a custom updown"
+ elog "script to charon which requires superuser privileges, you"
elog "can work around this limitation by using sudo to grant the"
elog "user \"ipsec\" the appropriate rights."
elog "For example (the default case):"
diff --git a/net-vpn/strongswan/strongswan-5.9.4-r1.ebuild b/net-vpn/strongswan/strongswan-5.9.4-r1.ebuild
index 5d6ceeabdccc..32650ad0af2b 100644
--- a/net-vpn/strongswan/strongswan-5.9.4-r1.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.4-r1.ebuild
@@ -282,15 +282,10 @@ pkg_postinst() {
elog "This imposes several limitations mainly to the IKEv1 daemon 'pluto'"
elog "but also a few to the IKEv2 daemon 'charon'."
elog
- elog "Please carefully read: http://wiki.strongswan.org/wiki/nonRoot"
+ elog "Please carefully read: http://wiki.strongswan.org/projects/strongswan/wiki/ReducedPrivileges"
elog
- elog "pluto uses a helper script by default to insert/remove routing and"
- elog "policy rules upon connection start/stop which requires superuser"
- elog "privileges. charon in contrast does this internally and can do so"
- elog "even with reduced (user) privileges."
- elog
- elog "Thus if you require IKEv1 (pluto) or need to specify a custom updown"
- elog "script to pluto or charon which requires superuser privileges, you"
+ elog "Thus if you require to specify a custom updown"
+ elog "script to charon which requires superuser privileges, you"
elog "can work around this limitation by using sudo to grant the"
elog "user \"ipsec\" the appropriate rights."
elog "For example (the default case):"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2022-01-28 7:53 Sam James
0 siblings, 0 replies; 112+ messages in thread
From: Sam James @ 2022-01-28 7:53 UTC (permalink / raw
To: gentoo-commits
commit: f28e3cc2e3f1b8c9053116ab7d43f383cf821c9b
Author: Philipp Rösner <rndxelement <AT> protonmail <DOT> com>
AuthorDate: Wed Jan 26 21:47:14 2022 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Fri Jan 28 07:53:20 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f28e3cc2
net-vpn/strongswan: version bump to 5.9.5
Added an ebuild for strongswan-5.9.5.
Package-Manager: Portage-3.0.30, Repoman-3.0.3
Signed-off-by: Philipp Roesner <rndxelement <AT> protonmail.com>
Closes: https://github.com/gentoo/gentoo/pull/23975
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-vpn/strongswan/Manifest | 1 +
net-vpn/strongswan/strongswan-5.9.5.ebuild | 306 +++++++++++++++++++++++++++++
2 files changed, 307 insertions(+)
diff --git a/net-vpn/strongswan/Manifest b/net-vpn/strongswan/Manifest
index 20a3b02a5249..45ddfeb7608e 100644
--- a/net-vpn/strongswan/Manifest
+++ b/net-vpn/strongswan/Manifest
@@ -1,2 +1,3 @@
DIST strongswan-5.9.2.tar.bz2 4607281 BLAKE2B 84f5457bc970f49c9bc99d0ef41182d815e39b8a88be349ad0a78b531a983d3b3919d5c9f3b97793b0b2569f2c6b151cc3b5d9b145a8bfd663db6f79d8ff3dd6 SHA512 dca30b9be7847e0af59d1526c2e38d440b6729055cb3f0f0637d50d7381df465c7b59e79662efe63870a7a5a44eef696c02231274d2764f9e3c430ce2fd694f6
DIST strongswan-5.9.4.tar.bz2 4651000 BLAKE2B 071a0a0a144b369a7e4069d92340cecca9eef0c004949d91993c8f1cc0f39f7868749020d6e135fa59d5899d146f39172f87eb32a26ad788cb8a4c160597e328 SHA512 796356c1d5c1ad410f0ed944ab4a131076d26f120ec6fa57796fe4060b0741201199625883ddc9ebd8a7ad299495f073cec76a6780ebd8f375605aae16750cf3
+DIST strongswan-5.9.5.tar.bz2 4722123 BLAKE2B 8b3adc44d5f5eb3824845ce9eda75e7b75f0f7394fbe84f827f4a8177e5299ca7170103ee6cd76e1e18aef85d7f124a43a505ceaf41ec4ed575eb214ebb6af21 SHA512 3b11c4edb1ffccf0ea5b8b843acfe2eb18dcd3857fc2818b8481c4febe7959261e1b2804c3af29068319df469fa0b784682d3ba4d49a3eb580841ff3c34e33a1
diff --git a/net-vpn/strongswan/strongswan-5.9.5.ebuild b/net-vpn/strongswan/strongswan-5.9.5.ebuild
new file mode 100644
index 000000000000..5acae3b7ab5c
--- /dev/null
+++ b/net-vpn/strongswan/strongswan-5.9.5.ebuild
@@ -0,0 +1,306 @@
+# Copyright 1999-2022 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+inherit linux-info systemd
+
+DESCRIPTION="IPsec-based VPN solution, supporting IKEv1/IKEv2 and MOBIKE"
+HOMEPAGE="https://www.strongswan.org/"
+SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
+
+LICENSE="GPL-2 RSA DES"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~x86"
+IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
+
+STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
+STRONGSWAN_PLUGINS_OPT="aesni blowfish bypass-lan ccm chapoly ctr forecast gcm
+ha ipseckey newhope ntru padlock rdrand save-keys unbound whitelist
+xauth-noauth"
+for mod in $STRONGSWAN_PLUGINS_STD; do
+ IUSE="${IUSE} +strongswan_plugins_${mod}"
+done
+
+for mod in $STRONGSWAN_PLUGINS_OPT; do
+ IUSE="${IUSE} strongswan_plugins_${mod}"
+done
+
+COMMON_DEPEND="non-root? (
+ acct-user/ipsec
+ acct-group/ipsec
+ )
+ gmp? ( >=dev-libs/gmp-4.1.5:= )
+ gcrypt? ( dev-libs/libgcrypt:0 )
+ caps? ( sys-libs/libcap )
+ curl? ( net-misc/curl )
+ ldap? ( net-nds/openldap )
+ openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist(-)] )
+ mysql? ( dev-db/mysql-connector-c:= )
+ sqlite? ( >=dev-db/sqlite-3.3.1 )
+ systemd? ( sys-apps/systemd )
+ networkmanager? ( net-misc/networkmanager )
+ pam? ( sys-libs/pam )
+ strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns )"
+
+DEPEND="${COMMON_DEPEND}
+ virtual/linux-sources
+ sys-kernel/linux-headers"
+
+RDEPEND="${COMMON_DEPEND}
+ virtual/logger
+ sys-apps/iproute2
+ !net-vpn/libreswan
+ selinux? ( sec-policy/selinux-ipsec )"
+
+UGID="ipsec"
+
+pkg_setup() {
+ linux-info_pkg_setup
+
+ elog "Linux kernel version: ${KV_FULL}"
+
+ if ! kernel_is -ge 2 6 16; then
+ eerror
+ eerror "This ebuild currently only supports ${PN} with the"
+ eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
+ eerror
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn
+ ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
+ ewarn
+
+ if kernel_is -lt 2 6 29; then
+ ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
+ ewarn "include all required IPv6 modules even if you just intend"
+ ewarn "to run on IPv4 only."
+ ewarn
+ ewarn "This has been fixed with kernels >= 2.6.29."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 33; then
+ ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
+ ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
+ ewarn "miss SHA384 and SHA512 HMAC support altogether."
+ ewarn
+ ewarn "If you need any of those features, please use kernel >= 2.6.33."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
+ ewarn "ESP cipher is only included in kernels >= 2.6.34."
+ ewarn
+ ewarn "If you need it, please use kernel >= 2.6.34."
+ ewarn
+ fi
+ fi
+}
+
+src_configure() {
+ local myconf=""
+
+ if use non-root; then
+ myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
+ fi
+
+ # If a user has already enabled db support, those plugins will
+ # most likely be desired as well. Besides they don't impose new
+ # dependencies and come at no cost (except for space).
+ if use mysql || use sqlite; then
+ myconf="${myconf} --enable-attr-sql --enable-sql"
+ fi
+
+ # strongSwan builds and installs static libs by default which are
+ # useless to the user (and to strongSwan for that matter) because no
+ # header files or alike get installed... so disabling them is safe.
+ if use pam && use eap; then
+ myconf="${myconf} --enable-eap-gtc"
+ else
+ myconf="${myconf} --disable-eap-gtc"
+ fi
+
+ for mod in $STRONGSWAN_PLUGINS_STD; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ for mod in $STRONGSWAN_PLUGINS_OPT; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ econf \
+ --disable-static \
+ --enable-ikev1 \
+ --enable-ikev2 \
+ --enable-swanctl \
+ --enable-socket-dynamic \
+ --enable-cmd \
+ $(use_enable curl) \
+ $(use_enable constraints) \
+ $(use_enable ldap) \
+ $(use_enable debug leak-detective) \
+ $(use_enable dhcp) \
+ $(use_enable eap eap-sim) \
+ $(use_enable eap eap-sim-file) \
+ $(use_enable eap eap-simaka-sql) \
+ $(use_enable eap eap-simaka-pseudonym) \
+ $(use_enable eap eap-simaka-reauth) \
+ $(use_enable eap eap-identity) \
+ $(use_enable eap eap-md5) \
+ $(use_enable eap eap-aka) \
+ $(use_enable eap eap-aka-3gpp2) \
+ $(use_enable eap md4) \
+ $(use_enable eap eap-mschapv2) \
+ $(use_enable eap eap-radius) \
+ $(use_enable eap eap-tls) \
+ $(use_enable eap eap-ttls) \
+ $(use_enable eap xauth-eap) \
+ $(use_enable eap eap-dynamic) \
+ $(use_enable farp) \
+ $(use_enable gmp) \
+ $(use_enable gcrypt) \
+ $(use_enable mysql) \
+ $(use_enable networkmanager nm) \
+ $(use_enable openssl) \
+ $(use_enable pam xauth-pam) \
+ $(use_enable pkcs11) \
+ $(use_enable sqlite) \
+ $(use_enable systemd) \
+ $(use_with caps capabilities libcap) \
+ --with-piddir=/run \
+ --with-systemdsystemunitdir="$(systemd_get_systemunitdir)" \
+ ${myconf}
+}
+
+src_install() {
+ emake DESTDIR="${D}" install
+
+ if ! use systemd; then
+ rm -rf "${ED}"/lib/systemd || die "Failed removing systemd lib."
+ fi
+
+ doinitd "${FILESDIR}"/ipsec
+
+ local dir_ugid
+ if use non-root; then
+ fowners ${UGID}:${UGID} \
+ /etc/ipsec.conf \
+ /etc/strongswan.conf
+
+ dir_ugid="${UGID}"
+ else
+ dir_ugid="root"
+ fi
+
+ diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
+ dodir /etc/ipsec.d \
+ /etc/ipsec.d/aacerts \
+ /etc/ipsec.d/acerts \
+ /etc/ipsec.d/cacerts \
+ /etc/ipsec.d/certs \
+ /etc/ipsec.d/crls \
+ /etc/ipsec.d/ocspcerts \
+ /etc/ipsec.d/private \
+ /etc/ipsec.d/reqs
+
+ dodoc NEWS README TODO
+
+ # shared libs are used only internally and there are no static libs,
+ # so it's safe to get rid of the .la files
+ find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
+}
+
+pkg_preinst() {
+ has_version "<net-vpn/strongswan-4.3.6-r1"
+ upgrade_from_leq_4_3_6=$(( !$? ))
+
+ has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
+ previous_4_3_6_with_caps=$(( !$? ))
+}
+
+pkg_postinst() {
+ if ! use openssl && ! use gcrypt; then
+ elog
+ elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
+ elog "Please note that this might effect availability and speed of some"
+ elog "cryptographic features. You are advised to enable the OpenSSL plugin."
+ elif ! use openssl; then
+ elog
+ elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
+ elog "availability and speed of some cryptographic features. There will be"
+ elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
+ elog "25, 26) and ECDSA."
+ fi
+
+ if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
+ chmod 0750 "${ROOT}"/etc/ipsec.d \
+ "${ROOT}"/etc/ipsec.d/aacerts \
+ "${ROOT}"/etc/ipsec.d/acerts \
+ "${ROOT}"/etc/ipsec.d/cacerts \
+ "${ROOT}"/etc/ipsec.d/certs \
+ "${ROOT}"/etc/ipsec.d/crls \
+ "${ROOT}"/etc/ipsec.d/ocspcerts \
+ "${ROOT}"/etc/ipsec.d/private \
+ "${ROOT}"/etc/ipsec.d/reqs
+
+ ewarn
+ ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
+ ewarn "security reasons. Your system installed directories have been"
+ ewarn "updated accordingly. Please check if necessary."
+ ewarn
+
+ if [[ $previous_4_3_6_with_caps == 1 ]]; then
+ if ! use non-root; then
+ ewarn
+ ewarn "IMPORTANT: You previously had ${PN} installed without root"
+ ewarn "privileges because it was implied by the 'caps' USE flag."
+ ewarn "This has been changed. If you want ${PN} with user privileges,"
+ ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
+ ewarn
+ fi
+ fi
+ fi
+ if ! use caps && ! use non-root; then
+ ewarn
+ ewarn "You have decided to run ${PN} with root privileges and built it"
+ ewarn "without support for POSIX capability dropping. It is generally"
+ ewarn "strongly suggested that you reconsider- especially if you intend"
+ ewarn "to run ${PN} as server with a public ip address."
+ ewarn
+ ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
+ ewarn
+ fi
+ if use non-root; then
+ elog
+ elog "${PN} has been installed without superuser privileges (USE=non-root)."
+ elog "This imposes a few limitations mainly to the daemon 'charon' in"
+ elog "regards of the use of iptables."
+ elog
+ elog "Please carefully read: http://wiki.strongswan.org/projects/strongswan/wiki/ReducedPrivileges"
+ elog
+ elog "Thus if you require to specify a custom updown"
+ elog "script to charon which requires superuser privileges, you"
+ elog "can work around this limitation by using sudo to grant the"
+ elog "user \"ipsec\" the appropriate rights."
+ elog "For example (the default case):"
+ elog "/etc/sudoers:"
+ elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
+ elog "Under the specific connection block in /etc/ipsec.conf:"
+ elog " leftupdown=\"sudo -E ipsec _updown iptables\""
+ elog
+ fi
+ elog
+ elog "Make sure you have _all_ required kernel modules available including"
+ elog "the appropriate cryptographic algorithms. A list is available at:"
+ elog " https://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
+ elog
+ elog "The up-to-date manual is available online at:"
+ elog " https://wiki.strongswan.org/"
+ elog
+}
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2022-02-02 8:02 Agostino Sarubbo
0 siblings, 0 replies; 112+ messages in thread
From: Agostino Sarubbo @ 2022-02-02 8:02 UTC (permalink / raw
To: gentoo-commits
commit: 6e1d7055d6f4950411a3b29a865d44c975e3b0f7
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Wed Feb 2 08:02:51 2022 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Wed Feb 2 08:02:51 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6e1d7055
net-vpn/strongswan: ppc stable wrt bug #832508
Package-Manager: Portage-3.0.28, Repoman-3.0.3
RepoMan-Options: --include-arches="ppc"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.5.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.5.ebuild b/net-vpn/strongswan/strongswan-5.9.5.ebuild
index 5acae3b7ab5c..8f1e1ce6e578 100644
--- a/net-vpn/strongswan/strongswan-5.9.5.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.5.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~x86"
+KEYWORDS="~amd64 ~arm ~arm64 ppc ~ppc64 ~x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2022-02-02 8:04 Agostino Sarubbo
0 siblings, 0 replies; 112+ messages in thread
From: Agostino Sarubbo @ 2022-02-02 8:04 UTC (permalink / raw
To: gentoo-commits
commit: 07a1f00ae5da889bb0e08b854559680bd2c212c7
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Wed Feb 2 08:04:01 2022 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Wed Feb 2 08:04:01 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=07a1f00a
net-vpn/strongswan: x86 stable wrt bug #832508
Package-Manager: Portage-3.0.28, Repoman-3.0.3
RepoMan-Options: --include-arches="x86"
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.5.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.5.ebuild b/net-vpn/strongswan/strongswan-5.9.5.ebuild
index 8f1e1ce6e578..5943fad5f4ba 100644
--- a/net-vpn/strongswan/strongswan-5.9.5.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.5.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ppc ~ppc64 ~x86"
+KEYWORDS="~amd64 ~arm ~arm64 ppc ~ppc64 x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2022-02-02 9:47 Sam James
0 siblings, 0 replies; 112+ messages in thread
From: Sam James @ 2022-02-02 9:47 UTC (permalink / raw
To: gentoo-commits
commit: 5b32de63c99e650849ead07720ec2aee85d7559a
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Wed Feb 2 09:46:37 2022 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Wed Feb 2 09:46:37 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5b32de63
net-vpn/strongswan: Stabilize 5.9.5 arm, #832508
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.5.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.5.ebuild b/net-vpn/strongswan/strongswan-5.9.5.ebuild
index 5943fad5f4ba..e7a9a3325d4c 100644
--- a/net-vpn/strongswan/strongswan-5.9.5.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.5.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ppc ~ppc64 x86"
+KEYWORDS="~amd64 arm ~arm64 ppc ~ppc64 x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2022-02-02 15:23 Jakov Smolić
0 siblings, 0 replies; 112+ messages in thread
From: Jakov Smolić @ 2022-02-02 15:23 UTC (permalink / raw
To: gentoo-commits
commit: 0bc611caa4ceb9218c27d30031e0ada77ed710de
Author: Jakov Smolić <jsmolic <AT> gentoo <DOT> org>
AuthorDate: Wed Feb 2 15:23:19 2022 +0000
Commit: Jakov Smolić <jsmolic <AT> gentoo <DOT> org>
CommitDate: Wed Feb 2 15:23:19 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0bc611ca
net-vpn/strongswan: Stabilize 5.9.5 amd64, #832508
Signed-off-by: Jakov Smolić <jsmolic <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.5.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.5.ebuild b/net-vpn/strongswan/strongswan-5.9.5.ebuild
index e7a9a3325d4c..fc7094c0bff0 100644
--- a/net-vpn/strongswan/strongswan-5.9.5.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.5.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="~amd64 arm ~arm64 ppc ~ppc64 x86"
+KEYWORDS="amd64 arm ~arm64 ppc ~ppc64 x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2022-05-06 10:04 Florian Schmaus
0 siblings, 0 replies; 112+ messages in thread
From: Florian Schmaus @ 2022-05-06 10:04 UTC (permalink / raw
To: gentoo-commits
commit: 6267dad0302a290cb09e84ffa62f023343362a9b
Author: Philipp Rösner <rndxelement <AT> protonmail <DOT> com>
AuthorDate: Wed May 4 20:50:30 2022 +0000
Commit: Florian Schmaus <flow <AT> gentoo <DOT> org>
CommitDate: Fri May 6 10:04:52 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6267dad0
net-vpn/strongswan: add 5.9.6
Add support for the plugins addrblock, error-notify, kdf and prf-plus.
Signed-off-by: Philipp Rösner <rndxelement <AT> protonmail.com>
Closes: https://github.com/gentoo/gentoo/pull/25329
Signed-off-by: Florian Schmaus <flow <AT> gentoo.org>
net-vpn/strongswan/Manifest | 1 +
net-vpn/strongswan/metadata.xml | 4 +
net-vpn/strongswan/strongswan-5.9.6.ebuild | 306 +++++++++++++++++++++++++++++
3 files changed, 311 insertions(+)
diff --git a/net-vpn/strongswan/Manifest b/net-vpn/strongswan/Manifest
index 45ddfeb7608e..5bf87feeb4b9 100644
--- a/net-vpn/strongswan/Manifest
+++ b/net-vpn/strongswan/Manifest
@@ -1,3 +1,4 @@
DIST strongswan-5.9.2.tar.bz2 4607281 BLAKE2B 84f5457bc970f49c9bc99d0ef41182d815e39b8a88be349ad0a78b531a983d3b3919d5c9f3b97793b0b2569f2c6b151cc3b5d9b145a8bfd663db6f79d8ff3dd6 SHA512 dca30b9be7847e0af59d1526c2e38d440b6729055cb3f0f0637d50d7381df465c7b59e79662efe63870a7a5a44eef696c02231274d2764f9e3c430ce2fd694f6
DIST strongswan-5.9.4.tar.bz2 4651000 BLAKE2B 071a0a0a144b369a7e4069d92340cecca9eef0c004949d91993c8f1cc0f39f7868749020d6e135fa59d5899d146f39172f87eb32a26ad788cb8a4c160597e328 SHA512 796356c1d5c1ad410f0ed944ab4a131076d26f120ec6fa57796fe4060b0741201199625883ddc9ebd8a7ad299495f073cec76a6780ebd8f375605aae16750cf3
DIST strongswan-5.9.5.tar.bz2 4722123 BLAKE2B 8b3adc44d5f5eb3824845ce9eda75e7b75f0f7394fbe84f827f4a8177e5299ca7170103ee6cd76e1e18aef85d7f124a43a505ceaf41ec4ed575eb214ebb6af21 SHA512 3b11c4edb1ffccf0ea5b8b843acfe2eb18dcd3857fc2818b8481c4febe7959261e1b2804c3af29068319df469fa0b784682d3ba4d49a3eb580841ff3c34e33a1
+DIST strongswan-5.9.6.tar.bz2 4750894 BLAKE2B 4021a10611e66f9e2e4e432bdfb9de0f94d27ba1be1b7d4e4b8bf3cd797c123658993e60eb3d49c424b479558e9581bb069a345a70f55850d1faf5abaa401246 SHA512 8efb7a55b074485b874e941e42462e97a404b4f84e2f90ed18ef66274731b22d167a571f6fd028dccc1f199f2e591c82616d0a832a5084e1981c6b867fe5bb6a
diff --git a/net-vpn/strongswan/metadata.xml b/net-vpn/strongswan/metadata.xml
index 0198dd1c8ac4..895902c71494 100644
--- a/net-vpn/strongswan/metadata.xml
+++ b/net-vpn/strongswan/metadata.xml
@@ -30,6 +30,7 @@
<flag name="non-root">Force IKEv1/IKEv2 daemons to normal user privileges. This might impose some restrictions mainly to the IKEv1 daemon. Disable only if you really require superuser privileges.</flag>
<flag name="openssl">Enable <pkg>dev-libs/openssl</pkg> plugin which is required for Elliptic Curve Cryptography (DH groups 19-21,25,26) and ECDSA. Also provides 3DES, AES, Blowfish, Camellia, CAST, DES, IDEA and RC5 ciphers along with MD2, MD4, MD5 and SHA1/2 hash algorithms, RSA and DH groups 1,2,5,14-18 and 22-24(4.4+) <pkg>dev-libs/openssl</pkg> has to be compiled with USE="-bindist".</flag>
<flag name="pkcs11">Enable pkcs11 support</flag>
+ <flag name="strongswan_plugins_addrblock">Enable support for the addrblock crypto plugin</flag>
<flag name="strongswan_plugins_aesni">Enable support for Intel AES-NI crypto plugin</flag>
<flag name="strongswan_plugins_bypass-lan">Enable support for the bypass-lan plugin</flag>
<flag name="strongswan_plugins_chapoly">Enable ChaCha20/Poly1305 AEAD implementation and ChaCha20 XOF plugin</flag>
@@ -42,12 +43,15 @@
<flag name="strongswan_plugins_blowfish">Enable support for the blowfish plugin</flag>
<flag name="strongswan_plugins_ccm">Enable support for the ccm plugin</flag>
<flag name="strongswan_plugins_ctr">Enable support for the ctr plugin</flag>
+ <flag name="strongswan_plugins_error-notify">Enable support for the error-notify plugin</flag>
<flag name="strongswan_plugins_gcm">Enable support for the gcm plugin</flag>
<flag name="strongswan_plugins_ha">Enable support for the ha plugin</flag>
<flag name="strongswan_plugins_ipseckey">Enable support for the ipseckey plugin</flag>
+ <flag name="strongswan_plugins_kdf">Enable support for the kdf plugin</flag>
<flag name="strongswan_plugins_newhope">Enable plugin that allows key exchange based on post-quantum computer New Hope algorithm</flag>
<flag name="strongswan_plugins_ntru">Enable support for the ntru plugin</flag>
<flag name="strongswan_plugins_padlock">Enable support for the padlock plugin</flag>
+ <flag name="strongswan_plugins_prf-plus">Enable support for the prf-plus plugin</flag>
<flag name="strongswan_plugins_rdrand">Enable support for the rdrand plugin</flag>
<flag name="strongswan_plugins_save-keys">Enable plugin that saves IKE and/or ESP keys to files compatible with Wireshark (for debugging)</flag>
<flag name="strongswan_plugins_unbound">Enable support for the unbound plugin</flag>
diff --git a/net-vpn/strongswan/strongswan-5.9.6.ebuild b/net-vpn/strongswan/strongswan-5.9.6.ebuild
new file mode 100644
index 000000000000..62c1b708ab44
--- /dev/null
+++ b/net-vpn/strongswan/strongswan-5.9.6.ebuild
@@ -0,0 +1,306 @@
+# Copyright 1999-2022 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+inherit linux-info systemd
+
+DESCRIPTION="IPsec-based VPN solution, supporting IKEv1/IKEv2 and MOBIKE"
+HOMEPAGE="https://www.strongswan.org/"
+SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
+
+LICENSE="GPL-2 RSA DES"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~x86"
+IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
+
+STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
+STRONGSWAN_PLUGINS_OPT="addrblock aesni blowfish bypass-lan ccm chapoly ctr error-notify forecast gcm
+ha ipseckey kdf newhope ntru padlock prf-plus rdrand save-keys unbound whitelist
+xauth-noauth"
+for mod in $STRONGSWAN_PLUGINS_STD; do
+ IUSE="${IUSE} +strongswan_plugins_${mod}"
+done
+
+for mod in $STRONGSWAN_PLUGINS_OPT; do
+ IUSE="${IUSE} strongswan_plugins_${mod}"
+done
+
+COMMON_DEPEND="non-root? (
+ acct-user/ipsec
+ acct-group/ipsec
+ )
+ gmp? ( >=dev-libs/gmp-4.1.5:= )
+ gcrypt? ( dev-libs/libgcrypt:= )
+ caps? ( sys-libs/libcap )
+ curl? ( net-misc/curl )
+ ldap? ( net-nds/openldap:= )
+ openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist(-)] )
+ mysql? ( dev-db/mysql-connector-c:= )
+ sqlite? ( >=dev-db/sqlite-3.3.1 )
+ systemd? ( sys-apps/systemd )
+ networkmanager? ( net-misc/networkmanager )
+ pam? ( sys-libs/pam )
+ strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns )"
+
+DEPEND="${COMMON_DEPEND}
+ virtual/linux-sources
+ sys-kernel/linux-headers"
+
+RDEPEND="${COMMON_DEPEND}
+ virtual/logger
+ sys-apps/iproute2
+ !net-vpn/libreswan
+ selinux? ( sec-policy/selinux-ipsec )"
+
+UGID="ipsec"
+
+pkg_setup() {
+ linux-info_pkg_setup
+
+ elog "Linux kernel version: ${KV_FULL}"
+
+ if ! kernel_is -ge 2 6 16; then
+ eerror
+ eerror "This ebuild currently only supports ${PN} with the"
+ eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
+ eerror
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn
+ ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
+ ewarn
+
+ if kernel_is -lt 2 6 29; then
+ ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
+ ewarn "include all required IPv6 modules even if you just intend"
+ ewarn "to run on IPv4 only."
+ ewarn
+ ewarn "This has been fixed with kernels >= 2.6.29."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 33; then
+ ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
+ ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
+ ewarn "miss SHA384 and SHA512 HMAC support altogether."
+ ewarn
+ ewarn "If you need any of those features, please use kernel >= 2.6.33."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
+ ewarn "ESP cipher is only included in kernels >= 2.6.34."
+ ewarn
+ ewarn "If you need it, please use kernel >= 2.6.34."
+ ewarn
+ fi
+ fi
+}
+
+src_configure() {
+ local myconf=""
+
+ if use non-root; then
+ myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
+ fi
+
+ # If a user has already enabled db support, those plugins will
+ # most likely be desired as well. Besides they don't impose new
+ # dependencies and come at no cost (except for space).
+ if use mysql || use sqlite; then
+ myconf="${myconf} --enable-attr-sql --enable-sql"
+ fi
+
+ # strongSwan builds and installs static libs by default which are
+ # useless to the user (and to strongSwan for that matter) because no
+ # header files or alike get installed... so disabling them is safe.
+ if use pam && use eap; then
+ myconf="${myconf} --enable-eap-gtc"
+ else
+ myconf="${myconf} --disable-eap-gtc"
+ fi
+
+ for mod in $STRONGSWAN_PLUGINS_STD; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ for mod in $STRONGSWAN_PLUGINS_OPT; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ econf \
+ --disable-static \
+ --enable-ikev1 \
+ --enable-ikev2 \
+ --enable-swanctl \
+ --enable-socket-dynamic \
+ --enable-cmd \
+ $(use_enable curl) \
+ $(use_enable constraints) \
+ $(use_enable ldap) \
+ $(use_enable debug leak-detective) \
+ $(use_enable dhcp) \
+ $(use_enable eap eap-sim) \
+ $(use_enable eap eap-sim-file) \
+ $(use_enable eap eap-simaka-sql) \
+ $(use_enable eap eap-simaka-pseudonym) \
+ $(use_enable eap eap-simaka-reauth) \
+ $(use_enable eap eap-identity) \
+ $(use_enable eap eap-md5) \
+ $(use_enable eap eap-aka) \
+ $(use_enable eap eap-aka-3gpp2) \
+ $(use_enable eap md4) \
+ $(use_enable eap eap-mschapv2) \
+ $(use_enable eap eap-radius) \
+ $(use_enable eap eap-tls) \
+ $(use_enable eap eap-ttls) \
+ $(use_enable eap xauth-eap) \
+ $(use_enable eap eap-dynamic) \
+ $(use_enable farp) \
+ $(use_enable gmp) \
+ $(use_enable gcrypt) \
+ $(use_enable mysql) \
+ $(use_enable networkmanager nm) \
+ $(use_enable openssl) \
+ $(use_enable pam xauth-pam) \
+ $(use_enable pkcs11) \
+ $(use_enable sqlite) \
+ $(use_enable systemd) \
+ $(use_with caps capabilities libcap) \
+ --with-piddir=/run \
+ --with-systemdsystemunitdir="$(systemd_get_systemunitdir)" \
+ ${myconf}
+}
+
+src_install() {
+ emake DESTDIR="${D}" install
+
+ if ! use systemd; then
+ rm -rf "${ED}"/lib/systemd || die "Failed removing systemd lib."
+ fi
+
+ doinitd "${FILESDIR}"/ipsec
+
+ local dir_ugid
+ if use non-root; then
+ fowners ${UGID}:${UGID} \
+ /etc/ipsec.conf \
+ /etc/strongswan.conf
+
+ dir_ugid="${UGID}"
+ else
+ dir_ugid="root"
+ fi
+
+ diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
+ dodir /etc/ipsec.d \
+ /etc/ipsec.d/aacerts \
+ /etc/ipsec.d/acerts \
+ /etc/ipsec.d/cacerts \
+ /etc/ipsec.d/certs \
+ /etc/ipsec.d/crls \
+ /etc/ipsec.d/ocspcerts \
+ /etc/ipsec.d/private \
+ /etc/ipsec.d/reqs
+
+ dodoc NEWS README TODO
+
+ # shared libs are used only internally and there are no static libs,
+ # so it's safe to get rid of the .la files
+ find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
+}
+
+pkg_preinst() {
+ has_version "<net-vpn/strongswan-4.3.6-r1"
+ upgrade_from_leq_4_3_6=$(( !$? ))
+
+ has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
+ previous_4_3_6_with_caps=$(( !$? ))
+}
+
+pkg_postinst() {
+ if ! use openssl && ! use gcrypt; then
+ elog
+ elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
+ elog "Please note that this might effect availability and speed of some"
+ elog "cryptographic features. You are advised to enable the OpenSSL plugin."
+ elif ! use openssl; then
+ elog
+ elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
+ elog "availability and speed of some cryptographic features. There will be"
+ elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
+ elog "25, 26) and ECDSA."
+ fi
+
+ if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
+ chmod 0750 "${ROOT}"/etc/ipsec.d \
+ "${ROOT}"/etc/ipsec.d/aacerts \
+ "${ROOT}"/etc/ipsec.d/acerts \
+ "${ROOT}"/etc/ipsec.d/cacerts \
+ "${ROOT}"/etc/ipsec.d/certs \
+ "${ROOT}"/etc/ipsec.d/crls \
+ "${ROOT}"/etc/ipsec.d/ocspcerts \
+ "${ROOT}"/etc/ipsec.d/private \
+ "${ROOT}"/etc/ipsec.d/reqs
+
+ ewarn
+ ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
+ ewarn "security reasons. Your system installed directories have been"
+ ewarn "updated accordingly. Please check if necessary."
+ ewarn
+
+ if [[ $previous_4_3_6_with_caps == 1 ]]; then
+ if ! use non-root; then
+ ewarn
+ ewarn "IMPORTANT: You previously had ${PN} installed without root"
+ ewarn "privileges because it was implied by the 'caps' USE flag."
+ ewarn "This has been changed. If you want ${PN} with user privileges,"
+ ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
+ ewarn
+ fi
+ fi
+ fi
+ if ! use caps && ! use non-root; then
+ ewarn
+ ewarn "You have decided to run ${PN} with root privileges and built it"
+ ewarn "without support for POSIX capability dropping. It is generally"
+ ewarn "strongly suggested that you reconsider- especially if you intend"
+ ewarn "to run ${PN} as server with a public ip address."
+ ewarn
+ ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
+ ewarn
+ fi
+ if use non-root; then
+ elog
+ elog "${PN} has been installed without superuser privileges (USE=non-root)."
+ elog "This imposes a few limitations mainly to the daemon 'charon' in"
+ elog "regards of the use of iptables."
+ elog
+ elog "Please carefully read: http://wiki.strongswan.org/projects/strongswan/wiki/ReducedPrivileges"
+ elog
+ elog "Thus if you require to specify a custom updown"
+ elog "script to charon which requires superuser privileges, you"
+ elog "can work around this limitation by using sudo to grant the"
+ elog "user \"ipsec\" the appropriate rights."
+ elog "For example (the default case):"
+ elog "/etc/sudoers:"
+ elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
+ elog "Under the specific connection block in /etc/ipsec.conf:"
+ elog " leftupdown=\"sudo -E ipsec _updown iptables\""
+ elog
+ fi
+ elog
+ elog "Make sure you have _all_ required kernel modules available including"
+ elog "the appropriate cryptographic algorithms. A list is available at:"
+ elog " https://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
+ elog
+ elog "The up-to-date manual is available online at:"
+ elog " https://wiki.strongswan.org/"
+ elog
+}
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2022-05-06 10:04 Florian Schmaus
0 siblings, 0 replies; 112+ messages in thread
From: Florian Schmaus @ 2022-05-06 10:04 UTC (permalink / raw
To: gentoo-commits
commit: e78dc294533813538eca5af9b91928c9cc63f187
Author: Florian Schmaus <flow <AT> gentoo <DOT> org>
AuthorDate: Fri May 6 09:59:08 2022 +0000
Commit: Florian Schmaus <flow <AT> gentoo <DOT> org>
CommitDate: Fri May 6 10:04:52 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e78dc294
net-vpn/strongswan: specify slot for sqlite, add dev-libs/glib:2 dep
Signed-off-by: Florian Schmaus <flow <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.6.ebuild | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.6.ebuild b/net-vpn/strongswan/strongswan-5.9.6.ebuild
index 62c1b708ab44..156d0149f594 100644
--- a/net-vpn/strongswan/strongswan-5.9.6.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.6.ebuild
@@ -29,6 +29,7 @@ COMMON_DEPEND="non-root? (
acct-user/ipsec
acct-group/ipsec
)
+ dev-libs/glib:2
gmp? ( >=dev-libs/gmp-4.1.5:= )
gcrypt? ( dev-libs/libgcrypt:= )
caps? ( sys-libs/libcap )
@@ -36,7 +37,7 @@ COMMON_DEPEND="non-root? (
ldap? ( net-nds/openldap:= )
openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist(-)] )
mysql? ( dev-db/mysql-connector-c:= )
- sqlite? ( >=dev-db/sqlite-3.3.1 )
+ sqlite? ( >=dev-db/sqlite-3.3.1:3 )
systemd? ( sys-apps/systemd )
networkmanager? ( net-misc/networkmanager )
pam? ( sys-libs/pam )
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2022-06-29 15:35 Florian Schmaus
0 siblings, 0 replies; 112+ messages in thread
From: Florian Schmaus @ 2022-06-29 15:35 UTC (permalink / raw
To: gentoo-commits
commit: bc6546d744d31dabf2805e4f168df1f97a4b3c48
Author: Dennis Eisele <kernlpanic <AT> dennis-eisele <DOT> de>
AuthorDate: Tue Jun 28 00:16:15 2022 +0000
Commit: Florian Schmaus <flow <AT> gentoo <DOT> org>
CommitDate: Wed Jun 29 15:34:57 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bc6546d7
net-vpn/strongswan: fix prf-plus plugin usage
[ flow: revision bump, because new config option is passed ]
Closes: https://bugs.gentoo.org/853091
Package-Manager: Portage-3.0.30, Repoman-3.0.3
Signed-off-by: Dennis Eisele <kernlpanic <AT> dennis-eisele.de>
Closes: https://github.com/gentoo/gentoo/pull/26103
Signed-off-by: Florian Schmaus <flow <AT> gentoo.org>
net-vpn/strongswan/metadata.xml | 1 -
.../{strongswan-5.9.6.ebuild => strongswan-5.9.6-r1.ebuild} | 13 ++++++++++++-
2 files changed, 12 insertions(+), 2 deletions(-)
diff --git a/net-vpn/strongswan/metadata.xml b/net-vpn/strongswan/metadata.xml
index 895902c71494..e44bbb6b7298 100644
--- a/net-vpn/strongswan/metadata.xml
+++ b/net-vpn/strongswan/metadata.xml
@@ -51,7 +51,6 @@
<flag name="strongswan_plugins_newhope">Enable plugin that allows key exchange based on post-quantum computer New Hope algorithm</flag>
<flag name="strongswan_plugins_ntru">Enable support for the ntru plugin</flag>
<flag name="strongswan_plugins_padlock">Enable support for the padlock plugin</flag>
- <flag name="strongswan_plugins_prf-plus">Enable support for the prf-plus plugin</flag>
<flag name="strongswan_plugins_rdrand">Enable support for the rdrand plugin</flag>
<flag name="strongswan_plugins_save-keys">Enable plugin that saves IKE and/or ESP keys to files compatible with Wireshark (for debugging)</flag>
<flag name="strongswan_plugins_unbound">Enable support for the unbound plugin</flag>
diff --git a/net-vpn/strongswan/strongswan-5.9.6.ebuild b/net-vpn/strongswan/strongswan-5.9.6-r1.ebuild
similarity index 96%
rename from net-vpn/strongswan/strongswan-5.9.6.ebuild
rename to net-vpn/strongswan/strongswan-5.9.6-r1.ebuild
index 9de7b103de17..ed618ee5eb72 100644
--- a/net-vpn/strongswan/strongswan-5.9.6.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.6-r1.ebuild
@@ -14,13 +14,18 @@ KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
+STRONGSWAN_PLUGINS_OPT_DISABLE="kdf"
STRONGSWAN_PLUGINS_OPT="addrblock aesni blowfish bypass-lan ccm chapoly ctr error-notify forecast gcm
-ha ipseckey kdf newhope ntru padlock prf-plus rdrand save-keys unbound whitelist
+ha ipseckey newhope ntru padlock rdrand save-keys unbound whitelist
xauth-noauth"
for mod in $STRONGSWAN_PLUGINS_STD; do
IUSE="${IUSE} +strongswan_plugins_${mod}"
done
+for mod in $STRONGSWAN_PLUGINS_OPT_DISABLE; do
+ IUSE="${IUSE} strongswan_plugins_${mod}"
+done
+
for mod in $STRONGSWAN_PLUGINS_OPT; do
IUSE="${IUSE} strongswan_plugins_${mod}"
done
@@ -133,6 +138,12 @@ src_configure() {
fi
done
+ for mod in $STRONGSWAN_PLUGINS_OPT_DISABLE; do
+ if ! use strongswan_plugins_${mod}; then
+ myconf+=" --disable-${mod}"
+ fi
+ done
+
for mod in $STRONGSWAN_PLUGINS_OPT; do
if use strongswan_plugins_${mod}; then
myconf+=" --enable-${mod}"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2022-08-10 8:20 Florian Schmaus
0 siblings, 0 replies; 112+ messages in thread
From: Florian Schmaus @ 2022-08-10 8:20 UTC (permalink / raw
To: gentoo-commits
commit: 30f6cc5bc855bc3fae7f4e422f3e466e6feb5787
Author: Philipp Rösner <rndxelement <AT> protonmail <DOT> com>
AuthorDate: Thu Aug 4 21:15:20 2022 +0000
Commit: Florian Schmaus <flow <AT> gentoo <DOT> org>
CommitDate: Wed Aug 10 08:20:40 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=30f6cc5b
net-vpn/strongswan: add 5.9.7
Signed-off-by: Philipp Rösner <rndxelement <AT> protonmail.com>
Closes: https://github.com/gentoo/gentoo/pull/26741
Signed-off-by: Florian Schmaus <flow <AT> gentoo.org>
net-vpn/strongswan/Manifest | 1 +
net-vpn/strongswan/strongswan-5.9.7.ebuild | 318 +++++++++++++++++++++++++++++
2 files changed, 319 insertions(+)
diff --git a/net-vpn/strongswan/Manifest b/net-vpn/strongswan/Manifest
index 5bf87feeb4b9..9047e058828e 100644
--- a/net-vpn/strongswan/Manifest
+++ b/net-vpn/strongswan/Manifest
@@ -2,3 +2,4 @@ DIST strongswan-5.9.2.tar.bz2 4607281 BLAKE2B 84f5457bc970f49c9bc99d0ef41182d815
DIST strongswan-5.9.4.tar.bz2 4651000 BLAKE2B 071a0a0a144b369a7e4069d92340cecca9eef0c004949d91993c8f1cc0f39f7868749020d6e135fa59d5899d146f39172f87eb32a26ad788cb8a4c160597e328 SHA512 796356c1d5c1ad410f0ed944ab4a131076d26f120ec6fa57796fe4060b0741201199625883ddc9ebd8a7ad299495f073cec76a6780ebd8f375605aae16750cf3
DIST strongswan-5.9.5.tar.bz2 4722123 BLAKE2B 8b3adc44d5f5eb3824845ce9eda75e7b75f0f7394fbe84f827f4a8177e5299ca7170103ee6cd76e1e18aef85d7f124a43a505ceaf41ec4ed575eb214ebb6af21 SHA512 3b11c4edb1ffccf0ea5b8b843acfe2eb18dcd3857fc2818b8481c4febe7959261e1b2804c3af29068319df469fa0b784682d3ba4d49a3eb580841ff3c34e33a1
DIST strongswan-5.9.6.tar.bz2 4750894 BLAKE2B 4021a10611e66f9e2e4e432bdfb9de0f94d27ba1be1b7d4e4b8bf3cd797c123658993e60eb3d49c424b479558e9581bb069a345a70f55850d1faf5abaa401246 SHA512 8efb7a55b074485b874e941e42462e97a404b4f84e2f90ed18ef66274731b22d167a571f6fd028dccc1f199f2e591c82616d0a832a5084e1981c6b867fe5bb6a
+DIST strongswan-5.9.7.tar.bz2 4741967 BLAKE2B 062f80431aefabfa4ba03454c3ab80e278772ebbd2bdeb69de98796f6e1bd7fc17d161e23b74bb238378eedc005079ff14e64e9a8967e2bf4f159a076e9f6384 SHA512 6e28a8ae0e4606a55661ae63a61d7bca445e8f62e91b37d32c957f03300d27ba05e099891c1160aae477b1f93ef844b66bb46da6cce5553eb03206c87e5e0d9a
diff --git a/net-vpn/strongswan/strongswan-5.9.7.ebuild b/net-vpn/strongswan/strongswan-5.9.7.ebuild
new file mode 100644
index 000000000000..d5b5767e6d03
--- /dev/null
+++ b/net-vpn/strongswan/strongswan-5.9.7.ebuild
@@ -0,0 +1,318 @@
+# Copyright 1999-2022 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+inherit linux-info systemd
+
+DESCRIPTION="IPsec-based VPN solution, supporting IKEv1/IKEv2 and MOBIKE"
+HOMEPAGE="https://www.strongswan.org/"
+SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
+
+LICENSE="GPL-2 RSA DES"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~x86"
+IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
+
+STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
+STRONGSWAN_PLUGINS_OPT_DISABLE="kdf"
+STRONGSWAN_PLUGINS_OPT="addrblock aesni blowfish bypass-lan ccm chapoly ctr error-notify forecast gcm
+ha ipseckey newhope ntru padlock rdrand save-keys unbound whitelist
+xauth-noauth"
+for mod in $STRONGSWAN_PLUGINS_STD; do
+ IUSE="${IUSE} +strongswan_plugins_${mod}"
+done
+
+for mod in $STRONGSWAN_PLUGINS_OPT_DISABLE; do
+ IUSE="${IUSE} strongswan_plugins_${mod}"
+done
+
+for mod in $STRONGSWAN_PLUGINS_OPT; do
+ IUSE="${IUSE} strongswan_plugins_${mod}"
+done
+
+COMMON_DEPEND="non-root? (
+ acct-user/ipsec
+ acct-group/ipsec
+ )
+ dev-libs/glib:2
+ gmp? ( >=dev-libs/gmp-4.1.5:= )
+ gcrypt? ( dev-libs/libgcrypt:= )
+ caps? ( sys-libs/libcap )
+ curl? ( net-misc/curl )
+ ldap? ( net-nds/openldap:= )
+ openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist(-)] )
+ mysql? ( dev-db/mysql-connector-c:= )
+ sqlite? ( >=dev-db/sqlite-3.3.1:3 )
+ systemd? ( sys-apps/systemd )
+ networkmanager? ( net-misc/networkmanager )
+ pam? ( sys-libs/pam )
+ strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns:= )"
+
+DEPEND="${COMMON_DEPEND}
+ virtual/linux-sources
+ sys-kernel/linux-headers"
+
+RDEPEND="${COMMON_DEPEND}
+ virtual/logger
+ sys-apps/iproute2
+ !net-vpn/libreswan
+ selinux? ( sec-policy/selinux-ipsec )"
+
+UGID="ipsec"
+
+pkg_setup() {
+ linux-info_pkg_setup
+
+ elog "Linux kernel version: ${KV_FULL}"
+
+ if ! kernel_is -ge 2 6 16; then
+ eerror
+ eerror "This ebuild currently only supports ${PN} with the"
+ eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
+ eerror
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn
+ ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
+ ewarn
+
+ if kernel_is -lt 2 6 29; then
+ ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
+ ewarn "include all required IPv6 modules even if you just intend"
+ ewarn "to run on IPv4 only."
+ ewarn
+ ewarn "This has been fixed with kernels >= 2.6.29."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 33; then
+ ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
+ ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
+ ewarn "miss SHA384 and SHA512 HMAC support altogether."
+ ewarn
+ ewarn "If you need any of those features, please use kernel >= 2.6.33."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
+ ewarn "ESP cipher is only included in kernels >= 2.6.34."
+ ewarn
+ ewarn "If you need it, please use kernel >= 2.6.34."
+ ewarn
+ fi
+ fi
+}
+
+src_configure() {
+ local myconf=""
+
+ if use non-root; then
+ myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
+ fi
+
+ # If a user has already enabled db support, those plugins will
+ # most likely be desired as well. Besides they don't impose new
+ # dependencies and come at no cost (except for space).
+ if use mysql || use sqlite; then
+ myconf="${myconf} --enable-attr-sql --enable-sql"
+ fi
+
+ # strongSwan builds and installs static libs by default which are
+ # useless to the user (and to strongSwan for that matter) because no
+ # header files or alike get installed... so disabling them is safe.
+ if use pam && use eap; then
+ myconf="${myconf} --enable-eap-gtc"
+ else
+ myconf="${myconf} --disable-eap-gtc"
+ fi
+
+ for mod in $STRONGSWAN_PLUGINS_STD; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ for mod in $STRONGSWAN_PLUGINS_OPT_DISABLE; do
+ if ! use strongswan_plugins_${mod}; then
+ myconf+=" --disable-${mod}"
+ fi
+ done
+
+ for mod in $STRONGSWAN_PLUGINS_OPT; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ econf \
+ --disable-static \
+ --enable-ikev1 \
+ --enable-ikev2 \
+ --enable-swanctl \
+ --enable-socket-dynamic \
+ --enable-cmd \
+ $(use_enable curl) \
+ $(use_enable constraints) \
+ $(use_enable ldap) \
+ $(use_enable debug leak-detective) \
+ $(use_enable dhcp) \
+ $(use_enable eap eap-sim) \
+ $(use_enable eap eap-sim-file) \
+ $(use_enable eap eap-simaka-sql) \
+ $(use_enable eap eap-simaka-pseudonym) \
+ $(use_enable eap eap-simaka-reauth) \
+ $(use_enable eap eap-identity) \
+ $(use_enable eap eap-md5) \
+ $(use_enable eap eap-aka) \
+ $(use_enable eap eap-aka-3gpp2) \
+ $(use_enable eap md4) \
+ $(use_enable eap eap-mschapv2) \
+ $(use_enable eap eap-radius) \
+ $(use_enable eap eap-tls) \
+ $(use_enable eap eap-ttls) \
+ $(use_enable eap xauth-eap) \
+ $(use_enable eap eap-dynamic) \
+ $(use_enable farp) \
+ $(use_enable gmp) \
+ $(use_enable gcrypt) \
+ $(use_enable mysql) \
+ $(use_enable networkmanager nm) \
+ $(use_enable openssl) \
+ $(use_enable pam xauth-pam) \
+ $(use_enable pkcs11) \
+ $(use_enable sqlite) \
+ $(use_enable systemd) \
+ $(use_with caps capabilities libcap) \
+ --with-piddir=/run \
+ --with-systemdsystemunitdir="$(systemd_get_systemunitdir)" \
+ ${myconf}
+}
+
+src_install() {
+ emake DESTDIR="${D}" install
+
+ if ! use systemd; then
+ rm -rf "${ED}"/lib/systemd || die "Failed removing systemd lib."
+ fi
+
+ doinitd "${FILESDIR}"/ipsec
+
+ local dir_ugid
+ if use non-root; then
+ fowners ${UGID}:${UGID} \
+ /etc/ipsec.conf \
+ /etc/strongswan.conf
+
+ dir_ugid="${UGID}"
+ else
+ dir_ugid="root"
+ fi
+
+ diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
+ dodir /etc/ipsec.d \
+ /etc/ipsec.d/aacerts \
+ /etc/ipsec.d/acerts \
+ /etc/ipsec.d/cacerts \
+ /etc/ipsec.d/certs \
+ /etc/ipsec.d/crls \
+ /etc/ipsec.d/ocspcerts \
+ /etc/ipsec.d/private \
+ /etc/ipsec.d/reqs
+
+ dodoc NEWS README TODO
+
+ # shared libs are used only internally and there are no static libs,
+ # so it's safe to get rid of the .la files
+ find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
+}
+
+pkg_preinst() {
+ has_version "<net-vpn/strongswan-4.3.6-r1"
+ upgrade_from_leq_4_3_6=$(( !$? ))
+
+ has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
+ previous_4_3_6_with_caps=$(( !$? ))
+}
+
+pkg_postinst() {
+ if ! use openssl && ! use gcrypt; then
+ elog
+ elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
+ elog "Please note that this might effect availability and speed of some"
+ elog "cryptographic features. You are advised to enable the OpenSSL plugin."
+ elif ! use openssl; then
+ elog
+ elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
+ elog "availability and speed of some cryptographic features. There will be"
+ elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
+ elog "25, 26) and ECDSA."
+ fi
+
+ if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
+ chmod 0750 "${ROOT}"/etc/ipsec.d \
+ "${ROOT}"/etc/ipsec.d/aacerts \
+ "${ROOT}"/etc/ipsec.d/acerts \
+ "${ROOT}"/etc/ipsec.d/cacerts \
+ "${ROOT}"/etc/ipsec.d/certs \
+ "${ROOT}"/etc/ipsec.d/crls \
+ "${ROOT}"/etc/ipsec.d/ocspcerts \
+ "${ROOT}"/etc/ipsec.d/private \
+ "${ROOT}"/etc/ipsec.d/reqs
+
+ ewarn
+ ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
+ ewarn "security reasons. Your system installed directories have been"
+ ewarn "updated accordingly. Please check if necessary."
+ ewarn
+
+ if [[ $previous_4_3_6_with_caps == 1 ]]; then
+ if ! use non-root; then
+ ewarn
+ ewarn "IMPORTANT: You previously had ${PN} installed without root"
+ ewarn "privileges because it was implied by the 'caps' USE flag."
+ ewarn "This has been changed. If you want ${PN} with user privileges,"
+ ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
+ ewarn
+ fi
+ fi
+ fi
+ if ! use caps && ! use non-root; then
+ ewarn
+ ewarn "You have decided to run ${PN} with root privileges and built it"
+ ewarn "without support for POSIX capability dropping. It is generally"
+ ewarn "strongly suggested that you reconsider- especially if you intend"
+ ewarn "to run ${PN} as server with a public ip address."
+ ewarn
+ ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
+ ewarn
+ fi
+ if use non-root; then
+ elog
+ elog "${PN} has been installed without superuser privileges (USE=non-root)."
+ elog "This imposes a few limitations mainly to the daemon 'charon' in"
+ elog "regards of the use of iptables."
+ elog
+ elog "Please carefully read: http://wiki.strongswan.org/projects/strongswan/wiki/ReducedPrivileges"
+ elog
+ elog "Thus if you require to specify a custom updown"
+ elog "script to charon which requires superuser privileges, you"
+ elog "can work around this limitation by using sudo to grant the"
+ elog "user \"ipsec\" the appropriate rights."
+ elog "For example (the default case):"
+ elog "/etc/sudoers:"
+ elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
+ elog "Under the specific connection block in /etc/ipsec.conf:"
+ elog " leftupdown=\"sudo -E ipsec _updown iptables\""
+ elog
+ fi
+ elog
+ elog "Make sure you have _all_ required kernel modules available including"
+ elog "the appropriate cryptographic algorithms. A list is available at:"
+ elog " https://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
+ elog
+ elog "The up-to-date manual is available online at:"
+ elog " https://wiki.strongswan.org/"
+ elog
+}
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2022-08-16 5:50 Joonas Niilola
0 siblings, 0 replies; 112+ messages in thread
From: Joonas Niilola @ 2022-08-16 5:50 UTC (permalink / raw
To: gentoo-commits
commit: 6e6ef311a5a79a9ab528210e0521da626ae73e66
Author: Joonas Niilola <juippis <AT> gentoo <DOT> org>
AuthorDate: Tue Aug 16 05:49:53 2022 +0000
Commit: Joonas Niilola <juippis <AT> gentoo <DOT> org>
CommitDate: Tue Aug 16 05:50:07 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6e6ef311
net-vpn/strongswan: Stabilize 5.9.6-r1 x86, #865309
Signed-off-by: Joonas Niilola <juippis <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.6-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.6-r1.ebuild b/net-vpn/strongswan/strongswan-5.9.6-r1.ebuild
index 8905ac5e2d1d..5991df7ba5ce 100644
--- a/net-vpn/strongswan/strongswan-5.9.6-r1.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.6-r1.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="amd64 ~arm ~arm64 ~ppc ~ppc64 ~x86"
+KEYWORDS="amd64 ~arm ~arm64 ~ppc ~ppc64 x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2022-08-16 5:50 Joonas Niilola
0 siblings, 0 replies; 112+ messages in thread
From: Joonas Niilola @ 2022-08-16 5:50 UTC (permalink / raw
To: gentoo-commits
commit: 83d11233ca256162a2ff059bc2f5110f83936e51
Author: Joonas Niilola <juippis <AT> gentoo <DOT> org>
AuthorDate: Tue Aug 16 05:49:08 2022 +0000
Commit: Joonas Niilola <juippis <AT> gentoo <DOT> org>
CommitDate: Tue Aug 16 05:50:07 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=83d11233
net-vpn/strongswan: Stabilize 5.9.6-r1 amd64, #865309
Signed-off-by: Joonas Niilola <juippis <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.6-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.6-r1.ebuild b/net-vpn/strongswan/strongswan-5.9.6-r1.ebuild
index ed618ee5eb72..8905ac5e2d1d 100644
--- a/net-vpn/strongswan/strongswan-5.9.6-r1.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.6-r1.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~x86"
+KEYWORDS="amd64 ~arm ~arm64 ~ppc ~ppc64 ~x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2022-08-16 7:44 Agostino Sarubbo
0 siblings, 0 replies; 112+ messages in thread
From: Agostino Sarubbo @ 2022-08-16 7:44 UTC (permalink / raw
To: gentoo-commits
commit: 90a64145a11e00e3bf4b38dfdfa565c1ca44690b
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Tue Aug 16 07:43:49 2022 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Tue Aug 16 07:43:49 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=90a64145
net-vpn/strongswan: arm stable wrt bug #865309
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.6-r1.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.6-r1.ebuild b/net-vpn/strongswan/strongswan-5.9.6-r1.ebuild
index 5991df7ba5ce..3667acef406a 100644
--- a/net-vpn/strongswan/strongswan-5.9.6-r1.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.6-r1.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="amd64 ~arm ~arm64 ~ppc ~ppc64 x86"
+KEYWORDS="amd64 arm ~arm64 ~ppc ~ppc64 x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2022-10-05 6:14 Joonas Niilola
0 siblings, 0 replies; 112+ messages in thread
From: Joonas Niilola @ 2022-10-05 6:14 UTC (permalink / raw
To: gentoo-commits
commit: 962cd75eb4249edbed827a38a196a3636902c609
Author: Joonas Niilola <juippis <AT> gentoo <DOT> org>
AuthorDate: Wed Oct 5 06:14:28 2022 +0000
Commit: Joonas Niilola <juippis <AT> gentoo <DOT> org>
CommitDate: Wed Oct 5 06:14:43 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=962cd75e
net-vpn/strongswan: Stabilize 5.9.7 x86, #875173
Signed-off-by: Joonas Niilola <juippis <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.7.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.7.ebuild b/net-vpn/strongswan/strongswan-5.9.7.ebuild
index 6fe77d6768b1..16799569e553 100644
--- a/net-vpn/strongswan/strongswan-5.9.7.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.7.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="amd64 ~arm ~arm64 ~ppc ~ppc64 ~x86"
+KEYWORDS="amd64 ~arm ~arm64 ~ppc ~ppc64 x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2022-10-05 6:14 Joonas Niilola
0 siblings, 0 replies; 112+ messages in thread
From: Joonas Niilola @ 2022-10-05 6:14 UTC (permalink / raw
To: gentoo-commits
commit: 779ede6ce7876c36f0b8fd2b4fd51d9747eacf2d
Author: Joonas Niilola <juippis <AT> gentoo <DOT> org>
AuthorDate: Wed Oct 5 06:13:42 2022 +0000
Commit: Joonas Niilola <juippis <AT> gentoo <DOT> org>
CommitDate: Wed Oct 5 06:14:43 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=779ede6c
net-vpn/strongswan: Stabilize 5.9.7 amd64, #875173
Signed-off-by: Joonas Niilola <juippis <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.7.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.7.ebuild b/net-vpn/strongswan/strongswan-5.9.7.ebuild
index d5b5767e6d03..6fe77d6768b1 100644
--- a/net-vpn/strongswan/strongswan-5.9.7.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.7.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~x86"
+KEYWORDS="amd64 ~arm ~arm64 ~ppc ~ppc64 ~x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2022-10-05 6:46 Agostino Sarubbo
0 siblings, 0 replies; 112+ messages in thread
From: Agostino Sarubbo @ 2022-10-05 6:46 UTC (permalink / raw
To: gentoo-commits
commit: 75bcdfbdf3bcbac86e9d93f114d6ebf04d70c7be
Author: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
AuthorDate: Wed Oct 5 06:44:32 2022 +0000
Commit: Agostino Sarubbo <ago <AT> gentoo <DOT> org>
CommitDate: Wed Oct 5 06:44:32 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=75bcdfbd
net-vpn/strongswan: Stabilize 5.9.7 arm, #875173
Signed-off-by: Agostino Sarubbo <ago <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.7.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.7.ebuild b/net-vpn/strongswan/strongswan-5.9.7.ebuild
index 16799569e553..cb8107a77572 100644
--- a/net-vpn/strongswan/strongswan-5.9.7.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.7.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="amd64 ~arm ~arm64 ~ppc ~ppc64 x86"
+KEYWORDS="amd64 arm ~arm64 ~ppc ~ppc64 x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2022-10-05 7:46 Florian Schmaus
0 siblings, 0 replies; 112+ messages in thread
From: Florian Schmaus @ 2022-10-05 7:46 UTC (permalink / raw
To: gentoo-commits
commit: ce815c2e33bed5cf4a7af88b584bface4ec4f8ea
Author: Philipp Rösner <rndxelement <AT> protonmail <DOT> com>
AuthorDate: Tue Oct 4 09:12:28 2022 +0000
Commit: Florian Schmaus <flow <AT> gentoo <DOT> org>
CommitDate: Wed Oct 5 07:46:08 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ce815c2e
net-vpn/strongswan: add 5.9.8
Signed-off-by: Philipp Rösner <rndxelement <AT> protonmail.com>
Closes: https://github.com/gentoo/gentoo/pull/27605
Signed-off-by: Florian Schmaus <flow <AT> gentoo.org>
net-vpn/strongswan/Manifest | 1 +
net-vpn/strongswan/strongswan-5.9.8.ebuild | 318 +++++++++++++++++++++++++++++
2 files changed, 319 insertions(+)
diff --git a/net-vpn/strongswan/Manifest b/net-vpn/strongswan/Manifest
index 9047e058828e..68239dcb7922 100644
--- a/net-vpn/strongswan/Manifest
+++ b/net-vpn/strongswan/Manifest
@@ -3,3 +3,4 @@ DIST strongswan-5.9.4.tar.bz2 4651000 BLAKE2B 071a0a0a144b369a7e4069d92340cecca9
DIST strongswan-5.9.5.tar.bz2 4722123 BLAKE2B 8b3adc44d5f5eb3824845ce9eda75e7b75f0f7394fbe84f827f4a8177e5299ca7170103ee6cd76e1e18aef85d7f124a43a505ceaf41ec4ed575eb214ebb6af21 SHA512 3b11c4edb1ffccf0ea5b8b843acfe2eb18dcd3857fc2818b8481c4febe7959261e1b2804c3af29068319df469fa0b784682d3ba4d49a3eb580841ff3c34e33a1
DIST strongswan-5.9.6.tar.bz2 4750894 BLAKE2B 4021a10611e66f9e2e4e432bdfb9de0f94d27ba1be1b7d4e4b8bf3cd797c123658993e60eb3d49c424b479558e9581bb069a345a70f55850d1faf5abaa401246 SHA512 8efb7a55b074485b874e941e42462e97a404b4f84e2f90ed18ef66274731b22d167a571f6fd028dccc1f199f2e591c82616d0a832a5084e1981c6b867fe5bb6a
DIST strongswan-5.9.7.tar.bz2 4741967 BLAKE2B 062f80431aefabfa4ba03454c3ab80e278772ebbd2bdeb69de98796f6e1bd7fc17d161e23b74bb238378eedc005079ff14e64e9a8967e2bf4f159a076e9f6384 SHA512 6e28a8ae0e4606a55661ae63a61d7bca445e8f62e91b37d32c957f03300d27ba05e099891c1160aae477b1f93ef844b66bb46da6cce5553eb03206c87e5e0d9a
+DIST strongswan-5.9.8.tar.bz2 4747096 BLAKE2B 2a7e346931f909aefa17a7e2f4a2d5b491979dd21519eaffa5d14ac0e54d86207009526aed903bfadbec2d4d449a23077f391106ed9ac02851a081b563c72eb0 SHA512 16d3afc80704f896f3f97addf452b4bb29fc1911c54e980f76ac48bdbe2340ce3bd4e79024848cb7961bbe9ad5458d93389343878ca042af658d51b11219666b
diff --git a/net-vpn/strongswan/strongswan-5.9.8.ebuild b/net-vpn/strongswan/strongswan-5.9.8.ebuild
new file mode 100644
index 000000000000..208d30671dab
--- /dev/null
+++ b/net-vpn/strongswan/strongswan-5.9.8.ebuild
@@ -0,0 +1,318 @@
+# Copyright 1999-2022 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+inherit linux-info systemd
+
+DESCRIPTION="IPsec-based VPN solution, supporting IKEv1/IKEv2 and MOBIKE"
+HOMEPAGE="https://www.strongswan.org/"
+SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
+
+LICENSE="GPL-2 RSA DES"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~x86"
+IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
+
+STRONGSWAN_PLUGINS_STD="gcm led lookip systime-fix unity vici"
+STRONGSWAN_PLUGINS_OPT_DISABLE="kdf"
+STRONGSWAN_PLUGINS_OPT="addrblock aesni blowfish bypass-lan ccm chapoly ctr error-notify forecast
+ha ipseckey newhope ntru padlock rdrand save-keys unbound whitelist
+xauth-noauth"
+for mod in $STRONGSWAN_PLUGINS_STD; do
+ IUSE="${IUSE} +strongswan_plugins_${mod}"
+done
+
+for mod in $STRONGSWAN_PLUGINS_OPT_DISABLE; do
+ IUSE="${IUSE} strongswan_plugins_${mod}"
+done
+
+for mod in $STRONGSWAN_PLUGINS_OPT; do
+ IUSE="${IUSE} strongswan_plugins_${mod}"
+done
+
+COMMON_DEPEND="non-root? (
+ acct-user/ipsec
+ acct-group/ipsec
+ )
+ dev-libs/glib:2
+ gmp? ( >=dev-libs/gmp-4.1.5:= )
+ gcrypt? ( dev-libs/libgcrypt:= )
+ caps? ( sys-libs/libcap )
+ curl? ( net-misc/curl )
+ ldap? ( net-nds/openldap:= )
+ openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist(-)] )
+ mysql? ( dev-db/mysql-connector-c:= )
+ sqlite? ( >=dev-db/sqlite-3.3.1:3 )
+ systemd? ( sys-apps/systemd )
+ networkmanager? ( net-misc/networkmanager )
+ pam? ( sys-libs/pam )
+ strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns:= )"
+
+DEPEND="${COMMON_DEPEND}
+ virtual/linux-sources
+ sys-kernel/linux-headers"
+
+RDEPEND="${COMMON_DEPEND}
+ virtual/logger
+ sys-apps/iproute2
+ !net-vpn/libreswan
+ selinux? ( sec-policy/selinux-ipsec )"
+
+UGID="ipsec"
+
+pkg_setup() {
+ linux-info_pkg_setup
+
+ elog "Linux kernel version: ${KV_FULL}"
+
+ if ! kernel_is -ge 2 6 16; then
+ eerror
+ eerror "This ebuild currently only supports ${PN} with the"
+ eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
+ eerror
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn
+ ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
+ ewarn
+
+ if kernel_is -lt 2 6 29; then
+ ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
+ ewarn "include all required IPv6 modules even if you just intend"
+ ewarn "to run on IPv4 only."
+ ewarn
+ ewarn "This has been fixed with kernels >= 2.6.29."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 33; then
+ ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
+ ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
+ ewarn "miss SHA384 and SHA512 HMAC support altogether."
+ ewarn
+ ewarn "If you need any of those features, please use kernel >= 2.6.33."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
+ ewarn "ESP cipher is only included in kernels >= 2.6.34."
+ ewarn
+ ewarn "If you need it, please use kernel >= 2.6.34."
+ ewarn
+ fi
+ fi
+}
+
+src_configure() {
+ local myconf=""
+
+ if use non-root; then
+ myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
+ fi
+
+ # If a user has already enabled db support, those plugins will
+ # most likely be desired as well. Besides they don't impose new
+ # dependencies and come at no cost (except for space).
+ if use mysql || use sqlite; then
+ myconf="${myconf} --enable-attr-sql --enable-sql"
+ fi
+
+ # strongSwan builds and installs static libs by default which are
+ # useless to the user (and to strongSwan for that matter) because no
+ # header files or alike get installed... so disabling them is safe.
+ if use pam && use eap; then
+ myconf="${myconf} --enable-eap-gtc"
+ else
+ myconf="${myconf} --disable-eap-gtc"
+ fi
+
+ for mod in $STRONGSWAN_PLUGINS_STD; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ for mod in $STRONGSWAN_PLUGINS_OPT_DISABLE; do
+ if ! use strongswan_plugins_${mod}; then
+ myconf+=" --disable-${mod}"
+ fi
+ done
+
+ for mod in $STRONGSWAN_PLUGINS_OPT; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ econf \
+ --disable-static \
+ --enable-ikev1 \
+ --enable-ikev2 \
+ --enable-swanctl \
+ --enable-socket-dynamic \
+ --enable-cmd \
+ $(use_enable curl) \
+ $(use_enable constraints) \
+ $(use_enable ldap) \
+ $(use_enable debug leak-detective) \
+ $(use_enable dhcp) \
+ $(use_enable eap eap-sim) \
+ $(use_enable eap eap-sim-file) \
+ $(use_enable eap eap-simaka-sql) \
+ $(use_enable eap eap-simaka-pseudonym) \
+ $(use_enable eap eap-simaka-reauth) \
+ $(use_enable eap eap-identity) \
+ $(use_enable eap eap-md5) \
+ $(use_enable eap eap-aka) \
+ $(use_enable eap eap-aka-3gpp2) \
+ $(use_enable eap md4) \
+ $(use_enable eap eap-mschapv2) \
+ $(use_enable eap eap-radius) \
+ $(use_enable eap eap-tls) \
+ $(use_enable eap eap-ttls) \
+ $(use_enable eap xauth-eap) \
+ $(use_enable eap eap-dynamic) \
+ $(use_enable farp) \
+ $(use_enable gmp) \
+ $(use_enable gcrypt) \
+ $(use_enable mysql) \
+ $(use_enable networkmanager nm) \
+ $(use_enable openssl) \
+ $(use_enable pam xauth-pam) \
+ $(use_enable pkcs11) \
+ $(use_enable sqlite) \
+ $(use_enable systemd) \
+ $(use_with caps capabilities libcap) \
+ --with-piddir=/run \
+ --with-systemdsystemunitdir="$(systemd_get_systemunitdir)" \
+ ${myconf}
+}
+
+src_install() {
+ emake DESTDIR="${D}" install
+
+ if ! use systemd; then
+ rm -rf "${ED}"/lib/systemd || die "Failed removing systemd lib."
+ fi
+
+ doinitd "${FILESDIR}"/ipsec
+
+ local dir_ugid
+ if use non-root; then
+ fowners ${UGID}:${UGID} \
+ /etc/ipsec.conf \
+ /etc/strongswan.conf
+
+ dir_ugid="${UGID}"
+ else
+ dir_ugid="root"
+ fi
+
+ diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
+ dodir /etc/ipsec.d \
+ /etc/ipsec.d/aacerts \
+ /etc/ipsec.d/acerts \
+ /etc/ipsec.d/cacerts \
+ /etc/ipsec.d/certs \
+ /etc/ipsec.d/crls \
+ /etc/ipsec.d/ocspcerts \
+ /etc/ipsec.d/private \
+ /etc/ipsec.d/reqs
+
+ dodoc NEWS README TODO
+
+ # shared libs are used only internally and there are no static libs,
+ # so it's safe to get rid of the .la files
+ find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
+}
+
+pkg_preinst() {
+ has_version "<net-vpn/strongswan-4.3.6-r1"
+ upgrade_from_leq_4_3_6=$(( !$? ))
+
+ has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
+ previous_4_3_6_with_caps=$(( !$? ))
+}
+
+pkg_postinst() {
+ if ! use openssl && ! use gcrypt; then
+ elog
+ elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
+ elog "Please note that this might effect availability and speed of some"
+ elog "cryptographic features. You are advised to enable the OpenSSL plugin."
+ elif ! use openssl; then
+ elog
+ elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
+ elog "availability and speed of some cryptographic features. There will be"
+ elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
+ elog "25, 26) and ECDSA."
+ fi
+
+ if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
+ chmod 0750 "${ROOT}"/etc/ipsec.d \
+ "${ROOT}"/etc/ipsec.d/aacerts \
+ "${ROOT}"/etc/ipsec.d/acerts \
+ "${ROOT}"/etc/ipsec.d/cacerts \
+ "${ROOT}"/etc/ipsec.d/certs \
+ "${ROOT}"/etc/ipsec.d/crls \
+ "${ROOT}"/etc/ipsec.d/ocspcerts \
+ "${ROOT}"/etc/ipsec.d/private \
+ "${ROOT}"/etc/ipsec.d/reqs
+
+ ewarn
+ ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
+ ewarn "security reasons. Your system installed directories have been"
+ ewarn "updated accordingly. Please check if necessary."
+ ewarn
+
+ if [[ $previous_4_3_6_with_caps == 1 ]]; then
+ if ! use non-root; then
+ ewarn
+ ewarn "IMPORTANT: You previously had ${PN} installed without root"
+ ewarn "privileges because it was implied by the 'caps' USE flag."
+ ewarn "This has been changed. If you want ${PN} with user privileges,"
+ ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
+ ewarn
+ fi
+ fi
+ fi
+ if ! use caps && ! use non-root; then
+ ewarn
+ ewarn "You have decided to run ${PN} with root privileges and built it"
+ ewarn "without support for POSIX capability dropping. It is generally"
+ ewarn "strongly suggested that you reconsider- especially if you intend"
+ ewarn "to run ${PN} as server with a public ip address."
+ ewarn
+ ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
+ ewarn
+ fi
+ if use non-root; then
+ elog
+ elog "${PN} has been installed without superuser privileges (USE=non-root)."
+ elog "This imposes a few limitations mainly to the daemon 'charon' in"
+ elog "regards of the use of iptables."
+ elog
+ elog "Please carefully read: http://wiki.strongswan.org/projects/strongswan/wiki/ReducedPrivileges"
+ elog
+ elog "Thus if you require to specify a custom updown"
+ elog "script to charon which requires superuser privileges, you"
+ elog "can work around this limitation by using sudo to grant the"
+ elog "user \"ipsec\" the appropriate rights."
+ elog "For example (the default case):"
+ elog "/etc/sudoers:"
+ elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
+ elog "Under the specific connection block in /etc/ipsec.conf:"
+ elog " leftupdown=\"sudo -E ipsec _updown iptables\""
+ elog
+ fi
+ elog
+ elog "Make sure you have _all_ required kernel modules available including"
+ elog "the appropriate cryptographic algorithms. A list is available at:"
+ elog " https://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
+ elog
+ elog "The up-to-date manual is available online at:"
+ elog " https://wiki.strongswan.org/"
+ elog
+}
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2022-10-05 7:46 Florian Schmaus
0 siblings, 0 replies; 112+ messages in thread
From: Florian Schmaus @ 2022-10-05 7:46 UTC (permalink / raw
To: gentoo-commits
commit: b28f9fe4009eaa82f2ef32b6d65d84075a1693c6
Author: Florian Schmaus <flow <AT> gentoo <DOT> org>
AuthorDate: Wed Oct 5 07:35:23 2022 +0000
Commit: Florian Schmaus <flow <AT> gentoo <DOT> org>
CommitDate: Wed Oct 5 07:46:08 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b28f9fe4
net-vpn/strongswan: drop 5.9.2-r3, 5.9.4-r2, 5.9.5-r1
Signed-off-by: Florian Schmaus <flow <AT> gentoo.org>
net-vpn/strongswan/Manifest | 3 -
net-vpn/strongswan/strongswan-5.9.2-r3.ebuild | 303 -------------------------
net-vpn/strongswan/strongswan-5.9.4-r2.ebuild | 306 --------------------------
net-vpn/strongswan/strongswan-5.9.5-r1.ebuild | 306 --------------------------
4 files changed, 918 deletions(-)
diff --git a/net-vpn/strongswan/Manifest b/net-vpn/strongswan/Manifest
index 68239dcb7922..5b546f750e2c 100644
--- a/net-vpn/strongswan/Manifest
+++ b/net-vpn/strongswan/Manifest
@@ -1,6 +1,3 @@
-DIST strongswan-5.9.2.tar.bz2 4607281 BLAKE2B 84f5457bc970f49c9bc99d0ef41182d815e39b8a88be349ad0a78b531a983d3b3919d5c9f3b97793b0b2569f2c6b151cc3b5d9b145a8bfd663db6f79d8ff3dd6 SHA512 dca30b9be7847e0af59d1526c2e38d440b6729055cb3f0f0637d50d7381df465c7b59e79662efe63870a7a5a44eef696c02231274d2764f9e3c430ce2fd694f6
-DIST strongswan-5.9.4.tar.bz2 4651000 BLAKE2B 071a0a0a144b369a7e4069d92340cecca9eef0c004949d91993c8f1cc0f39f7868749020d6e135fa59d5899d146f39172f87eb32a26ad788cb8a4c160597e328 SHA512 796356c1d5c1ad410f0ed944ab4a131076d26f120ec6fa57796fe4060b0741201199625883ddc9ebd8a7ad299495f073cec76a6780ebd8f375605aae16750cf3
-DIST strongswan-5.9.5.tar.bz2 4722123 BLAKE2B 8b3adc44d5f5eb3824845ce9eda75e7b75f0f7394fbe84f827f4a8177e5299ca7170103ee6cd76e1e18aef85d7f124a43a505ceaf41ec4ed575eb214ebb6af21 SHA512 3b11c4edb1ffccf0ea5b8b843acfe2eb18dcd3857fc2818b8481c4febe7959261e1b2804c3af29068319df469fa0b784682d3ba4d49a3eb580841ff3c34e33a1
DIST strongswan-5.9.6.tar.bz2 4750894 BLAKE2B 4021a10611e66f9e2e4e432bdfb9de0f94d27ba1be1b7d4e4b8bf3cd797c123658993e60eb3d49c424b479558e9581bb069a345a70f55850d1faf5abaa401246 SHA512 8efb7a55b074485b874e941e42462e97a404b4f84e2f90ed18ef66274731b22d167a571f6fd028dccc1f199f2e591c82616d0a832a5084e1981c6b867fe5bb6a
DIST strongswan-5.9.7.tar.bz2 4741967 BLAKE2B 062f80431aefabfa4ba03454c3ab80e278772ebbd2bdeb69de98796f6e1bd7fc17d161e23b74bb238378eedc005079ff14e64e9a8967e2bf4f159a076e9f6384 SHA512 6e28a8ae0e4606a55661ae63a61d7bca445e8f62e91b37d32c957f03300d27ba05e099891c1160aae477b1f93ef844b66bb46da6cce5553eb03206c87e5e0d9a
DIST strongswan-5.9.8.tar.bz2 4747096 BLAKE2B 2a7e346931f909aefa17a7e2f4a2d5b491979dd21519eaffa5d14ac0e54d86207009526aed903bfadbec2d4d449a23077f391106ed9ac02851a081b563c72eb0 SHA512 16d3afc80704f896f3f97addf452b4bb29fc1911c54e980f76ac48bdbe2340ce3bd4e79024848cb7961bbe9ad5458d93389343878ca042af658d51b11219666b
diff --git a/net-vpn/strongswan/strongswan-5.9.2-r3.ebuild b/net-vpn/strongswan/strongswan-5.9.2-r3.ebuild
deleted file mode 100644
index 095a964f45a7..000000000000
--- a/net-vpn/strongswan/strongswan-5.9.2-r3.ebuild
+++ /dev/null
@@ -1,303 +0,0 @@
-# Copyright 1999-2022 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="7"
-inherit linux-info systemd
-
-DESCRIPTION="IPsec-based VPN solution, supporting IKEv1/IKEv2 and MOBIKE"
-HOMEPAGE="https://www.strongswan.org/"
-SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
-
-LICENSE="GPL-2 RSA DES"
-SLOT="0"
-KEYWORDS="amd64 arm ~arm64 ~ppc ~ppc64 x86"
-IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
-
-STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
-STRONGSWAN_PLUGINS_OPT="aesni blowfish bypass-lan ccm chapoly ctr forecast gcm ha ipseckey newhope ntru padlock rdrand save-keys unbound whitelist"
-for mod in $STRONGSWAN_PLUGINS_STD; do
- IUSE="${IUSE} +strongswan_plugins_${mod}"
-done
-
-for mod in $STRONGSWAN_PLUGINS_OPT; do
- IUSE="${IUSE} strongswan_plugins_${mod}"
-done
-
-COMMON_DEPEND="non-root? (
- acct-user/ipsec
- acct-group/ipsec
- )
- gmp? ( >=dev-libs/gmp-4.1.5:= )
- gcrypt? ( dev-libs/libgcrypt:= )
- caps? ( sys-libs/libcap )
- curl? ( net-misc/curl )
- ldap? ( net-nds/openldap:= )
- openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist(-)] <dev-libs/openssl-3:= )
- mysql? ( dev-db/mysql-connector-c:= )
- sqlite? ( >=dev-db/sqlite-3.3.1 )
- systemd? ( sys-apps/systemd )
- networkmanager? ( net-misc/networkmanager )
- pam? ( sys-libs/pam )
- strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns )"
-
-DEPEND="${COMMON_DEPEND}
- virtual/linux-sources
- sys-kernel/linux-headers"
-
-RDEPEND="${COMMON_DEPEND}
- virtual/logger
- sys-apps/iproute2
- !net-vpn/libreswan
- selinux? ( sec-policy/selinux-ipsec )"
-
-UGID="ipsec"
-
-pkg_setup() {
- linux-info_pkg_setup
-
- elog "Linux kernel version: ${KV_FULL}"
-
- if ! kernel_is -ge 2 6 16; then
- eerror
- eerror "This ebuild currently only supports ${PN} with the"
- eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
- eerror
- fi
-
- if kernel_is -lt 2 6 34; then
- ewarn
- ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
- ewarn
-
- if kernel_is -lt 2 6 29; then
- ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
- ewarn "include all required IPv6 modules even if you just intend"
- ewarn "to run on IPv4 only."
- ewarn
- ewarn "This has been fixed with kernels >= 2.6.29."
- ewarn
- fi
-
- if kernel_is -lt 2 6 33; then
- ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
- ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
- ewarn "miss SHA384 and SHA512 HMAC support altogether."
- ewarn
- ewarn "If you need any of those features, please use kernel >= 2.6.33."
- ewarn
- fi
-
- if kernel_is -lt 2 6 34; then
- ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
- ewarn "ESP cipher is only included in kernels >= 2.6.34."
- ewarn
- ewarn "If you need it, please use kernel >= 2.6.34."
- ewarn
- fi
- fi
-}
-
-src_configure() {
- local myconf=""
-
- if use non-root; then
- myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
- fi
-
- # If a user has already enabled db support, those plugins will
- # most likely be desired as well. Besides they don't impose new
- # dependencies and come at no cost (except for space).
- if use mysql || use sqlite; then
- myconf="${myconf} --enable-attr-sql --enable-sql"
- fi
-
- # strongSwan builds and installs static libs by default which are
- # useless to the user (and to strongSwan for that matter) because no
- # header files or alike get installed... so disabling them is safe.
- if use pam && use eap; then
- myconf="${myconf} --enable-eap-gtc"
- else
- myconf="${myconf} --disable-eap-gtc"
- fi
-
- for mod in $STRONGSWAN_PLUGINS_STD; do
- if use strongswan_plugins_${mod}; then
- myconf+=" --enable-${mod}"
- fi
- done
-
- for mod in $STRONGSWAN_PLUGINS_OPT; do
- if use strongswan_plugins_${mod}; then
- myconf+=" --enable-${mod}"
- fi
- done
-
- econf \
- --disable-static \
- --enable-ikev1 \
- --enable-ikev2 \
- --enable-swanctl \
- --enable-socket-dynamic \
- $(use_enable curl) \
- $(use_enable constraints) \
- $(use_enable ldap) \
- $(use_enable debug leak-detective) \
- $(use_enable dhcp) \
- $(use_enable eap eap-sim) \
- $(use_enable eap eap-sim-file) \
- $(use_enable eap eap-simaka-sql) \
- $(use_enable eap eap-simaka-pseudonym) \
- $(use_enable eap eap-simaka-reauth) \
- $(use_enable eap eap-identity) \
- $(use_enable eap eap-md5) \
- $(use_enable eap eap-aka) \
- $(use_enable eap eap-aka-3gpp2) \
- $(use_enable eap md4) \
- $(use_enable eap eap-mschapv2) \
- $(use_enable eap eap-radius) \
- $(use_enable eap eap-tls) \
- $(use_enable eap eap-ttls) \
- $(use_enable eap xauth-eap) \
- $(use_enable eap eap-dynamic) \
- $(use_enable farp) \
- $(use_enable gmp) \
- $(use_enable gcrypt) \
- $(use_enable mysql) \
- $(use_enable networkmanager nm) \
- $(use_enable openssl) \
- $(use_enable pam xauth-pam) \
- $(use_enable pkcs11) \
- $(use_enable sqlite) \
- $(use_enable systemd) \
- $(use_with caps capabilities libcap) \
- --with-piddir=/run \
- --with-systemdsystemunitdir="$(systemd_get_systemunitdir)" \
- ${myconf}
-}
-
-src_install() {
- emake DESTDIR="${D}" install
-
- if ! use systemd; then
- rm -rf "${ED}"/lib/systemd || die
- fi
-
- doinitd "${FILESDIR}"/ipsec
-
- local dir_ugid
- if use non-root; then
- fowners ${UGID}:${UGID} \
- /etc/ipsec.conf \
- /etc/strongswan.conf
-
- dir_ugid="${UGID}"
- else
- dir_ugid="root"
- fi
-
- diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
- dodir /etc/ipsec.d \
- /etc/ipsec.d/aacerts \
- /etc/ipsec.d/acerts \
- /etc/ipsec.d/cacerts \
- /etc/ipsec.d/certs \
- /etc/ipsec.d/crls \
- /etc/ipsec.d/ocspcerts \
- /etc/ipsec.d/private \
- /etc/ipsec.d/reqs
-
- dodoc NEWS README TODO
-
- # shared libs are used only internally and there are no static libs,
- # so it's safe to get rid of the .la files
- find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
-}
-
-pkg_preinst() {
- has_version "<net-vpn/strongswan-4.3.6-r1"
- upgrade_from_leq_4_3_6=$(( !$? ))
-
- has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
- previous_4_3_6_with_caps=$(( !$? ))
-}
-
-pkg_postinst() {
- if ! use openssl && ! use gcrypt; then
- elog
- elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
- elog "Please note that this might effect availability and speed of some"
- elog "cryptographic features. You are advised to enable the OpenSSL plugin."
- elif ! use openssl; then
- elog
- elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
- elog "availability and speed of some cryptographic features. There will be"
- elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
- elog "25, 26) and ECDSA."
- fi
-
- if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
- chmod 0750 "${ROOT}"/etc/ipsec.d \
- "${ROOT}"/etc/ipsec.d/aacerts \
- "${ROOT}"/etc/ipsec.d/acerts \
- "${ROOT}"/etc/ipsec.d/cacerts \
- "${ROOT}"/etc/ipsec.d/certs \
- "${ROOT}"/etc/ipsec.d/crls \
- "${ROOT}"/etc/ipsec.d/ocspcerts \
- "${ROOT}"/etc/ipsec.d/private \
- "${ROOT}"/etc/ipsec.d/reqs
-
- ewarn
- ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
- ewarn "security reasons. Your system installed directories have been"
- ewarn "updated accordingly. Please check if necessary."
- ewarn
-
- if [[ $previous_4_3_6_with_caps == 1 ]]; then
- if ! use non-root; then
- ewarn
- ewarn "IMPORTANT: You previously had ${PN} installed without root"
- ewarn "privileges because it was implied by the 'caps' USE flag."
- ewarn "This has been changed. If you want ${PN} with user privileges,"
- ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
- ewarn
- fi
- fi
- fi
- if ! use caps && ! use non-root; then
- ewarn
- ewarn "You have decided to run ${PN} with root privileges and built it"
- ewarn "without support for POSIX capability dropping. It is generally"
- ewarn "strongly suggested that you reconsider- especially if you intend"
- ewarn "to run ${PN} as server with a public ip address."
- ewarn
- ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
- ewarn
- fi
- if use non-root; then
- elog
- elog "${PN} has been installed without superuser privileges (USE=non-root)."
- elog "This imposes a few limitations mainly to the daemon 'charon' in"
- elog "regards of the use of iptables."
- elog
- elog "Please carefully read: https://wiki.strongswan.org/projects/strongswan/wiki/ReducedPrivileges"
- elog
- elog "Thus if you require to specify a custom updown"
- elog "script to charon which requires superuser privileges, you"
- elog "can work around this limitation by using sudo to grant the"
- elog "user \"ipsec\" the appropriate rights."
- elog "For example (the default case):"
- elog "/etc/sudoers:"
- elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
- elog "Under the specific connection block in /etc/ipsec.conf:"
- elog " leftupdown=\"sudo -E ipsec _updown iptables\""
- elog
- fi
- elog
- elog "Make sure you have _all_ required kernel modules available including"
- elog "the appropriate cryptographic algorithms. A list is available at:"
- elog " https://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
- elog
- elog "The up-to-date manual is available online at:"
- elog " https://wiki.strongswan.org/"
- elog
-}
diff --git a/net-vpn/strongswan/strongswan-5.9.4-r2.ebuild b/net-vpn/strongswan/strongswan-5.9.4-r2.ebuild
deleted file mode 100644
index 49d955fb8c2f..000000000000
--- a/net-vpn/strongswan/strongswan-5.9.4-r2.ebuild
+++ /dev/null
@@ -1,306 +0,0 @@
-# Copyright 1999-2022 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-inherit linux-info systemd
-
-DESCRIPTION="IPsec-based VPN solution, supporting IKEv1/IKEv2 and MOBIKE"
-HOMEPAGE="https://www.strongswan.org/"
-SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
-
-LICENSE="GPL-2 RSA DES"
-SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~x86"
-IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
-
-STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
-STRONGSWAN_PLUGINS_OPT="aesni blowfish bypass-lan ccm chapoly ctr forecast gcm
-ha ipseckey newhope ntru padlock rdrand save-keys unbound whitelist
-xauth-noauth"
-for mod in $STRONGSWAN_PLUGINS_STD; do
- IUSE="${IUSE} +strongswan_plugins_${mod}"
-done
-
-for mod in $STRONGSWAN_PLUGINS_OPT; do
- IUSE="${IUSE} strongswan_plugins_${mod}"
-done
-
-COMMON_DEPEND="non-root? (
- acct-user/ipsec
- acct-group/ipsec
- )
- gmp? ( >=dev-libs/gmp-4.1.5:= )
- gcrypt? ( dev-libs/libgcrypt:= )
- caps? ( sys-libs/libcap )
- curl? ( net-misc/curl )
- ldap? ( net-nds/openldap:= )
- openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist(-)] )
- mysql? ( dev-db/mysql-connector-c:= )
- sqlite? ( >=dev-db/sqlite-3.3.1 )
- systemd? ( sys-apps/systemd )
- networkmanager? ( net-misc/networkmanager )
- pam? ( sys-libs/pam )
- strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns )"
-
-DEPEND="${COMMON_DEPEND}
- virtual/linux-sources
- sys-kernel/linux-headers"
-
-RDEPEND="${COMMON_DEPEND}
- virtual/logger
- sys-apps/iproute2
- !net-vpn/libreswan
- selinux? ( sec-policy/selinux-ipsec )"
-
-UGID="ipsec"
-
-pkg_setup() {
- linux-info_pkg_setup
-
- elog "Linux kernel version: ${KV_FULL}"
-
- if ! kernel_is -ge 2 6 16; then
- eerror
- eerror "This ebuild currently only supports ${PN} with the"
- eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
- eerror
- fi
-
- if kernel_is -lt 2 6 34; then
- ewarn
- ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
- ewarn
-
- if kernel_is -lt 2 6 29; then
- ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
- ewarn "include all required IPv6 modules even if you just intend"
- ewarn "to run on IPv4 only."
- ewarn
- ewarn "This has been fixed with kernels >= 2.6.29."
- ewarn
- fi
-
- if kernel_is -lt 2 6 33; then
- ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
- ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
- ewarn "miss SHA384 and SHA512 HMAC support altogether."
- ewarn
- ewarn "If you need any of those features, please use kernel >= 2.6.33."
- ewarn
- fi
-
- if kernel_is -lt 2 6 34; then
- ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
- ewarn "ESP cipher is only included in kernels >= 2.6.34."
- ewarn
- ewarn "If you need it, please use kernel >= 2.6.34."
- ewarn
- fi
- fi
-}
-
-src_configure() {
- local myconf=""
-
- if use non-root; then
- myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
- fi
-
- # If a user has already enabled db support, those plugins will
- # most likely be desired as well. Besides they don't impose new
- # dependencies and come at no cost (except for space).
- if use mysql || use sqlite; then
- myconf="${myconf} --enable-attr-sql --enable-sql"
- fi
-
- # strongSwan builds and installs static libs by default which are
- # useless to the user (and to strongSwan for that matter) because no
- # header files or alike get installed... so disabling them is safe.
- if use pam && use eap; then
- myconf="${myconf} --enable-eap-gtc"
- else
- myconf="${myconf} --disable-eap-gtc"
- fi
-
- for mod in $STRONGSWAN_PLUGINS_STD; do
- if use strongswan_plugins_${mod}; then
- myconf+=" --enable-${mod}"
- fi
- done
-
- for mod in $STRONGSWAN_PLUGINS_OPT; do
- if use strongswan_plugins_${mod}; then
- myconf+=" --enable-${mod}"
- fi
- done
-
- econf \
- --disable-static \
- --enable-ikev1 \
- --enable-ikev2 \
- --enable-swanctl \
- --enable-socket-dynamic \
- --enable-cmd \
- $(use_enable curl) \
- $(use_enable constraints) \
- $(use_enable ldap) \
- $(use_enable debug leak-detective) \
- $(use_enable dhcp) \
- $(use_enable eap eap-sim) \
- $(use_enable eap eap-sim-file) \
- $(use_enable eap eap-simaka-sql) \
- $(use_enable eap eap-simaka-pseudonym) \
- $(use_enable eap eap-simaka-reauth) \
- $(use_enable eap eap-identity) \
- $(use_enable eap eap-md5) \
- $(use_enable eap eap-aka) \
- $(use_enable eap eap-aka-3gpp2) \
- $(use_enable eap md4) \
- $(use_enable eap eap-mschapv2) \
- $(use_enable eap eap-radius) \
- $(use_enable eap eap-tls) \
- $(use_enable eap eap-ttls) \
- $(use_enable eap xauth-eap) \
- $(use_enable eap eap-dynamic) \
- $(use_enable farp) \
- $(use_enable gmp) \
- $(use_enable gcrypt) \
- $(use_enable mysql) \
- $(use_enable networkmanager nm) \
- $(use_enable openssl) \
- $(use_enable pam xauth-pam) \
- $(use_enable pkcs11) \
- $(use_enable sqlite) \
- $(use_enable systemd) \
- $(use_with caps capabilities libcap) \
- --with-piddir=/run \
- --with-systemdsystemunitdir="$(systemd_get_systemunitdir)" \
- ${myconf}
-}
-
-src_install() {
- emake DESTDIR="${D}" install
-
- if ! use systemd; then
- rm -rf "${ED}"/lib/systemd || die "Failed removing systemd lib."
- fi
-
- doinitd "${FILESDIR}"/ipsec
-
- local dir_ugid
- if use non-root; then
- fowners ${UGID}:${UGID} \
- /etc/ipsec.conf \
- /etc/strongswan.conf
-
- dir_ugid="${UGID}"
- else
- dir_ugid="root"
- fi
-
- diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
- dodir /etc/ipsec.d \
- /etc/ipsec.d/aacerts \
- /etc/ipsec.d/acerts \
- /etc/ipsec.d/cacerts \
- /etc/ipsec.d/certs \
- /etc/ipsec.d/crls \
- /etc/ipsec.d/ocspcerts \
- /etc/ipsec.d/private \
- /etc/ipsec.d/reqs
-
- dodoc NEWS README TODO
-
- # shared libs are used only internally and there are no static libs,
- # so it's safe to get rid of the .la files
- find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
-}
-
-pkg_preinst() {
- has_version "<net-vpn/strongswan-4.3.6-r1"
- upgrade_from_leq_4_3_6=$(( !$? ))
-
- has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
- previous_4_3_6_with_caps=$(( !$? ))
-}
-
-pkg_postinst() {
- if ! use openssl && ! use gcrypt; then
- elog
- elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
- elog "Please note that this might effect availability and speed of some"
- elog "cryptographic features. You are advised to enable the OpenSSL plugin."
- elif ! use openssl; then
- elog
- elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
- elog "availability and speed of some cryptographic features. There will be"
- elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
- elog "25, 26) and ECDSA."
- fi
-
- if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
- chmod 0750 "${ROOT}"/etc/ipsec.d \
- "${ROOT}"/etc/ipsec.d/aacerts \
- "${ROOT}"/etc/ipsec.d/acerts \
- "${ROOT}"/etc/ipsec.d/cacerts \
- "${ROOT}"/etc/ipsec.d/certs \
- "${ROOT}"/etc/ipsec.d/crls \
- "${ROOT}"/etc/ipsec.d/ocspcerts \
- "${ROOT}"/etc/ipsec.d/private \
- "${ROOT}"/etc/ipsec.d/reqs
-
- ewarn
- ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
- ewarn "security reasons. Your system installed directories have been"
- ewarn "updated accordingly. Please check if necessary."
- ewarn
-
- if [[ $previous_4_3_6_with_caps == 1 ]]; then
- if ! use non-root; then
- ewarn
- ewarn "IMPORTANT: You previously had ${PN} installed without root"
- ewarn "privileges because it was implied by the 'caps' USE flag."
- ewarn "This has been changed. If you want ${PN} with user privileges,"
- ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
- ewarn
- fi
- fi
- fi
- if ! use caps && ! use non-root; then
- ewarn
- ewarn "You have decided to run ${PN} with root privileges and built it"
- ewarn "without support for POSIX capability dropping. It is generally"
- ewarn "strongly suggested that you reconsider- especially if you intend"
- ewarn "to run ${PN} as server with a public ip address."
- ewarn
- ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
- ewarn
- fi
- if use non-root; then
- elog
- elog "${PN} has been installed without superuser privileges (USE=non-root)."
- elog "This imposes several limitations mainly to the IKEv1 daemon 'pluto'"
- elog "but also a few to the IKEv2 daemon 'charon'."
- elog
- elog "Please carefully read: http://wiki.strongswan.org/projects/strongswan/wiki/ReducedPrivileges"
- elog
- elog "Thus if you require to specify a custom updown"
- elog "script to charon which requires superuser privileges, you"
- elog "can work around this limitation by using sudo to grant the"
- elog "user \"ipsec\" the appropriate rights."
- elog "For example (the default case):"
- elog "/etc/sudoers:"
- elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
- elog "Under the specific connection block in /etc/ipsec.conf:"
- elog " leftupdown=\"sudo -E ipsec _updown iptables\""
- elog
- fi
- elog
- elog "Make sure you have _all_ required kernel modules available including"
- elog "the appropriate cryptographic algorithms. A list is available at:"
- elog " https://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
- elog
- elog "The up-to-date manual is available online at:"
- elog " https://wiki.strongswan.org/"
- elog
-}
diff --git a/net-vpn/strongswan/strongswan-5.9.5-r1.ebuild b/net-vpn/strongswan/strongswan-5.9.5-r1.ebuild
deleted file mode 100644
index 6750a94b8675..000000000000
--- a/net-vpn/strongswan/strongswan-5.9.5-r1.ebuild
+++ /dev/null
@@ -1,306 +0,0 @@
-# Copyright 1999-2022 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-inherit linux-info systemd
-
-DESCRIPTION="IPsec-based VPN solution, supporting IKEv1/IKEv2 and MOBIKE"
-HOMEPAGE="https://www.strongswan.org/"
-SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
-
-LICENSE="GPL-2 RSA DES"
-SLOT="0"
-KEYWORDS="amd64 arm ~arm64 ~ppc ~ppc64 x86"
-IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
-
-STRONGSWAN_PLUGINS_STD="led lookip systime-fix unity vici"
-STRONGSWAN_PLUGINS_OPT="aesni blowfish bypass-lan ccm chapoly ctr forecast gcm
-ha ipseckey newhope ntru padlock rdrand save-keys unbound whitelist
-xauth-noauth"
-for mod in $STRONGSWAN_PLUGINS_STD; do
- IUSE="${IUSE} +strongswan_plugins_${mod}"
-done
-
-for mod in $STRONGSWAN_PLUGINS_OPT; do
- IUSE="${IUSE} strongswan_plugins_${mod}"
-done
-
-COMMON_DEPEND="non-root? (
- acct-user/ipsec
- acct-group/ipsec
- )
- gmp? ( >=dev-libs/gmp-4.1.5:= )
- gcrypt? ( dev-libs/libgcrypt:= )
- caps? ( sys-libs/libcap )
- curl? ( net-misc/curl )
- ldap? ( net-nds/openldap:= )
- openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist(-)] )
- mysql? ( dev-db/mysql-connector-c:= )
- sqlite? ( >=dev-db/sqlite-3.3.1 )
- systemd? ( sys-apps/systemd )
- networkmanager? ( net-misc/networkmanager )
- pam? ( sys-libs/pam )
- strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns )"
-
-DEPEND="${COMMON_DEPEND}
- virtual/linux-sources
- sys-kernel/linux-headers"
-
-RDEPEND="${COMMON_DEPEND}
- virtual/logger
- sys-apps/iproute2
- !net-vpn/libreswan
- selinux? ( sec-policy/selinux-ipsec )"
-
-UGID="ipsec"
-
-pkg_setup() {
- linux-info_pkg_setup
-
- elog "Linux kernel version: ${KV_FULL}"
-
- if ! kernel_is -ge 2 6 16; then
- eerror
- eerror "This ebuild currently only supports ${PN} with the"
- eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
- eerror
- fi
-
- if kernel_is -lt 2 6 34; then
- ewarn
- ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
- ewarn
-
- if kernel_is -lt 2 6 29; then
- ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
- ewarn "include all required IPv6 modules even if you just intend"
- ewarn "to run on IPv4 only."
- ewarn
- ewarn "This has been fixed with kernels >= 2.6.29."
- ewarn
- fi
-
- if kernel_is -lt 2 6 33; then
- ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
- ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
- ewarn "miss SHA384 and SHA512 HMAC support altogether."
- ewarn
- ewarn "If you need any of those features, please use kernel >= 2.6.33."
- ewarn
- fi
-
- if kernel_is -lt 2 6 34; then
- ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
- ewarn "ESP cipher is only included in kernels >= 2.6.34."
- ewarn
- ewarn "If you need it, please use kernel >= 2.6.34."
- ewarn
- fi
- fi
-}
-
-src_configure() {
- local myconf=""
-
- if use non-root; then
- myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
- fi
-
- # If a user has already enabled db support, those plugins will
- # most likely be desired as well. Besides they don't impose new
- # dependencies and come at no cost (except for space).
- if use mysql || use sqlite; then
- myconf="${myconf} --enable-attr-sql --enable-sql"
- fi
-
- # strongSwan builds and installs static libs by default which are
- # useless to the user (and to strongSwan for that matter) because no
- # header files or alike get installed... so disabling them is safe.
- if use pam && use eap; then
- myconf="${myconf} --enable-eap-gtc"
- else
- myconf="${myconf} --disable-eap-gtc"
- fi
-
- for mod in $STRONGSWAN_PLUGINS_STD; do
- if use strongswan_plugins_${mod}; then
- myconf+=" --enable-${mod}"
- fi
- done
-
- for mod in $STRONGSWAN_PLUGINS_OPT; do
- if use strongswan_plugins_${mod}; then
- myconf+=" --enable-${mod}"
- fi
- done
-
- econf \
- --disable-static \
- --enable-ikev1 \
- --enable-ikev2 \
- --enable-swanctl \
- --enable-socket-dynamic \
- --enable-cmd \
- $(use_enable curl) \
- $(use_enable constraints) \
- $(use_enable ldap) \
- $(use_enable debug leak-detective) \
- $(use_enable dhcp) \
- $(use_enable eap eap-sim) \
- $(use_enable eap eap-sim-file) \
- $(use_enable eap eap-simaka-sql) \
- $(use_enable eap eap-simaka-pseudonym) \
- $(use_enable eap eap-simaka-reauth) \
- $(use_enable eap eap-identity) \
- $(use_enable eap eap-md5) \
- $(use_enable eap eap-aka) \
- $(use_enable eap eap-aka-3gpp2) \
- $(use_enable eap md4) \
- $(use_enable eap eap-mschapv2) \
- $(use_enable eap eap-radius) \
- $(use_enable eap eap-tls) \
- $(use_enable eap eap-ttls) \
- $(use_enable eap xauth-eap) \
- $(use_enable eap eap-dynamic) \
- $(use_enable farp) \
- $(use_enable gmp) \
- $(use_enable gcrypt) \
- $(use_enable mysql) \
- $(use_enable networkmanager nm) \
- $(use_enable openssl) \
- $(use_enable pam xauth-pam) \
- $(use_enable pkcs11) \
- $(use_enable sqlite) \
- $(use_enable systemd) \
- $(use_with caps capabilities libcap) \
- --with-piddir=/run \
- --with-systemdsystemunitdir="$(systemd_get_systemunitdir)" \
- ${myconf}
-}
-
-src_install() {
- emake DESTDIR="${D}" install
-
- if ! use systemd; then
- rm -rf "${ED}"/lib/systemd || die "Failed removing systemd lib."
- fi
-
- doinitd "${FILESDIR}"/ipsec
-
- local dir_ugid
- if use non-root; then
- fowners ${UGID}:${UGID} \
- /etc/ipsec.conf \
- /etc/strongswan.conf
-
- dir_ugid="${UGID}"
- else
- dir_ugid="root"
- fi
-
- diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
- dodir /etc/ipsec.d \
- /etc/ipsec.d/aacerts \
- /etc/ipsec.d/acerts \
- /etc/ipsec.d/cacerts \
- /etc/ipsec.d/certs \
- /etc/ipsec.d/crls \
- /etc/ipsec.d/ocspcerts \
- /etc/ipsec.d/private \
- /etc/ipsec.d/reqs
-
- dodoc NEWS README TODO
-
- # shared libs are used only internally and there are no static libs,
- # so it's safe to get rid of the .la files
- find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
-}
-
-pkg_preinst() {
- has_version "<net-vpn/strongswan-4.3.6-r1"
- upgrade_from_leq_4_3_6=$(( !$? ))
-
- has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
- previous_4_3_6_with_caps=$(( !$? ))
-}
-
-pkg_postinst() {
- if ! use openssl && ! use gcrypt; then
- elog
- elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
- elog "Please note that this might effect availability and speed of some"
- elog "cryptographic features. You are advised to enable the OpenSSL plugin."
- elif ! use openssl; then
- elog
- elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
- elog "availability and speed of some cryptographic features. There will be"
- elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
- elog "25, 26) and ECDSA."
- fi
-
- if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
- chmod 0750 "${ROOT}"/etc/ipsec.d \
- "${ROOT}"/etc/ipsec.d/aacerts \
- "${ROOT}"/etc/ipsec.d/acerts \
- "${ROOT}"/etc/ipsec.d/cacerts \
- "${ROOT}"/etc/ipsec.d/certs \
- "${ROOT}"/etc/ipsec.d/crls \
- "${ROOT}"/etc/ipsec.d/ocspcerts \
- "${ROOT}"/etc/ipsec.d/private \
- "${ROOT}"/etc/ipsec.d/reqs
-
- ewarn
- ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
- ewarn "security reasons. Your system installed directories have been"
- ewarn "updated accordingly. Please check if necessary."
- ewarn
-
- if [[ $previous_4_3_6_with_caps == 1 ]]; then
- if ! use non-root; then
- ewarn
- ewarn "IMPORTANT: You previously had ${PN} installed without root"
- ewarn "privileges because it was implied by the 'caps' USE flag."
- ewarn "This has been changed. If you want ${PN} with user privileges,"
- ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
- ewarn
- fi
- fi
- fi
- if ! use caps && ! use non-root; then
- ewarn
- ewarn "You have decided to run ${PN} with root privileges and built it"
- ewarn "without support for POSIX capability dropping. It is generally"
- ewarn "strongly suggested that you reconsider- especially if you intend"
- ewarn "to run ${PN} as server with a public ip address."
- ewarn
- ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
- ewarn
- fi
- if use non-root; then
- elog
- elog "${PN} has been installed without superuser privileges (USE=non-root)."
- elog "This imposes a few limitations mainly to the daemon 'charon' in"
- elog "regards of the use of iptables."
- elog
- elog "Please carefully read: http://wiki.strongswan.org/projects/strongswan/wiki/ReducedPrivileges"
- elog
- elog "Thus if you require to specify a custom updown"
- elog "script to charon which requires superuser privileges, you"
- elog "can work around this limitation by using sudo to grant the"
- elog "user \"ipsec\" the appropriate rights."
- elog "For example (the default case):"
- elog "/etc/sudoers:"
- elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
- elog "Under the specific connection block in /etc/ipsec.conf:"
- elog " leftupdown=\"sudo -E ipsec _updown iptables\""
- elog
- fi
- elog
- elog "Make sure you have _all_ required kernel modules available including"
- elog "the appropriate cryptographic algorithms. A list is available at:"
- elog " https://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
- elog
- elog "The up-to-date manual is available online at:"
- elog " https://wiki.strongswan.org/"
- elog
-}
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2022-11-02 5:11 Jakov Smolić
0 siblings, 0 replies; 112+ messages in thread
From: Jakov Smolić @ 2022-11-02 5:11 UTC (permalink / raw
To: gentoo-commits
commit: 6d5b5b36729a4b4999f724bc67b57181285ea778
Author: Chris Su <chris <AT> lesscrowds <DOT> org>
AuthorDate: Tue Nov 1 15:57:06 2022 +0000
Commit: Jakov Smolić <jsmolic <AT> gentoo <DOT> org>
CommitDate: Wed Nov 2 05:10:51 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6d5b5b36
net-vpn/strongswan: Keyword 5.9.8 riscv, #879023
Signed-off-by: Chris Su <chris <AT> lesscrowds.org>
Closes: https://github.com/gentoo/gentoo/pull/28078
Signed-off-by: Jakov Smolić <jsmolic <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.8.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.8.ebuild b/net-vpn/strongswan/strongswan-5.9.8.ebuild
index 208d30671dab..5cdfe7c002a2 100644
--- a/net-vpn/strongswan/strongswan-5.9.8.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.8.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~x86"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="gcm led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2022-12-04 6:52 Joonas Niilola
0 siblings, 0 replies; 112+ messages in thread
From: Joonas Niilola @ 2022-12-04 6:52 UTC (permalink / raw
To: gentoo-commits
commit: 7cfcdead0ec9b637cd5a2380bd0a0483fb5df86a
Author: Joonas Niilola <juippis <AT> gentoo <DOT> org>
AuthorDate: Sun Dec 4 06:50:59 2022 +0000
Commit: Joonas Niilola <juippis <AT> gentoo <DOT> org>
CommitDate: Sun Dec 4 06:52:24 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7cfcdead
net-vpn/strongswan: Stabilize 5.9.8 amd64, #884213
Signed-off-by: Joonas Niilola <juippis <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.8.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.8.ebuild b/net-vpn/strongswan/strongswan-5.9.8.ebuild
index 5cdfe7c002a2..9a4ab21889d9 100644
--- a/net-vpn/strongswan/strongswan-5.9.8.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.8.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
+KEYWORDS="amd64 ~arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="gcm led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2022-12-04 6:52 Joonas Niilola
0 siblings, 0 replies; 112+ messages in thread
From: Joonas Niilola @ 2022-12-04 6:52 UTC (permalink / raw
To: gentoo-commits
commit: 473fe961a709e7a566a07c4670d3b67a86628ff4
Author: Joonas Niilola <juippis <AT> gentoo <DOT> org>
AuthorDate: Sun Dec 4 06:52:05 2022 +0000
Commit: Joonas Niilola <juippis <AT> gentoo <DOT> org>
CommitDate: Sun Dec 4 06:52:24 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=473fe961
net-vpn/strongswan: Stabilize 5.9.8 x86, #884213
Signed-off-by: Joonas Niilola <juippis <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.8.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.8.ebuild b/net-vpn/strongswan/strongswan-5.9.8.ebuild
index 9a4ab21889d9..665e5c0b126c 100644
--- a/net-vpn/strongswan/strongswan-5.9.8.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.8.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="amd64 ~arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
+KEYWORDS="amd64 ~arm ~arm64 ~ppc ~ppc64 ~riscv x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="gcm led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2022-12-04 18:08 Arthur Zamarin
0 siblings, 0 replies; 112+ messages in thread
From: Arthur Zamarin @ 2022-12-04 18:08 UTC (permalink / raw
To: gentoo-commits
commit: 54db1d1d38bfb48bcd7b06d2fa79e3072a5c72e4
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Sun Dec 4 18:08:31 2022 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Sun Dec 4 18:08:31 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=54db1d1d
net-vpn/strongswan: Stabilize 5.9.8 arm, #884213
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.8.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.8.ebuild b/net-vpn/strongswan/strongswan-5.9.8.ebuild
index 665e5c0b126c..18fe386f8b0e 100644
--- a/net-vpn/strongswan/strongswan-5.9.8.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.8.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="amd64 ~arm ~arm64 ~ppc ~ppc64 ~riscv x86"
+KEYWORDS="amd64 arm ~arm64 ~ppc ~ppc64 ~riscv x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="gcm led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2023-01-09 8:44 Florian Schmaus
0 siblings, 0 replies; 112+ messages in thread
From: Florian Schmaus @ 2023-01-09 8:44 UTC (permalink / raw
To: gentoo-commits
commit: 68fa14d3b448e49e0c827530b4c260b974e9e97f
Author: Philipp Rösner <rndxelement <AT> protonmail <DOT> com>
AuthorDate: Sun Jan 8 21:46:15 2023 +0000
Commit: Florian Schmaus <flow <AT> gentoo <DOT> org>
CommitDate: Mon Jan 9 08:44:42 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=68fa14d3
net-vpn/strongswan: add 5.9.9
Signed-off-by: Philipp Rösner <rndxelement <AT> protonmail.com>
Closes: https://github.com/gentoo/gentoo/pull/29026
Signed-off-by: Florian Schmaus <flow <AT> gentoo.org>
net-vpn/strongswan/Manifest | 1 +
net-vpn/strongswan/strongswan-5.9.9.ebuild | 318 +++++++++++++++++++++++++++++
2 files changed, 319 insertions(+)
diff --git a/net-vpn/strongswan/Manifest b/net-vpn/strongswan/Manifest
index c1f6eec1f665..f85dfcb0feff 100644
--- a/net-vpn/strongswan/Manifest
+++ b/net-vpn/strongswan/Manifest
@@ -1 +1,2 @@
DIST strongswan-5.9.8.tar.bz2 4747096 BLAKE2B 2a7e346931f909aefa17a7e2f4a2d5b491979dd21519eaffa5d14ac0e54d86207009526aed903bfadbec2d4d449a23077f391106ed9ac02851a081b563c72eb0 SHA512 16d3afc80704f896f3f97addf452b4bb29fc1911c54e980f76ac48bdbe2340ce3bd4e79024848cb7961bbe9ad5458d93389343878ca042af658d51b11219666b
+DIST strongswan-5.9.9.tar.bz2 4764675 BLAKE2B 9cbc73192527254a2d20b28295e7583a0d9ec81e4d6eb1b7d78e54b30ba8e5304a33e813145d8a47b2b4319d7b49762cd35cdbdaf1d41161d7746d68d3cef1b5 SHA512 7f5d94527193ce7716292f30db75303a0594169647e41e8c9530a7dedd914ad7fecf94885356738fd54d3781a066fa591c621d531923b20780b1fca76ad7bd46
diff --git a/net-vpn/strongswan/strongswan-5.9.9.ebuild b/net-vpn/strongswan/strongswan-5.9.9.ebuild
new file mode 100644
index 000000000000..057c1e8f3e05
--- /dev/null
+++ b/net-vpn/strongswan/strongswan-5.9.9.ebuild
@@ -0,0 +1,318 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+inherit linux-info systemd
+
+DESCRIPTION="IPsec-based VPN solution, supporting IKEv1/IKEv2 and MOBIKE"
+HOMEPAGE="https://www.strongswan.org/"
+SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
+
+LICENSE="GPL-2 RSA DES"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
+IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
+
+STRONGSWAN_PLUGINS_STD="gcm led lookip systime-fix unity vici"
+STRONGSWAN_PLUGINS_OPT_DISABLE="kdf"
+STRONGSWAN_PLUGINS_OPT="addrblock aesni blowfish bypass-lan ccm chapoly ctr error-notify forecast
+ha ipseckey newhope ntru padlock rdrand save-keys unbound whitelist
+xauth-noauth"
+for mod in $STRONGSWAN_PLUGINS_STD; do
+ IUSE="${IUSE} +strongswan_plugins_${mod}"
+done
+
+for mod in $STRONGSWAN_PLUGINS_OPT_DISABLE; do
+ IUSE="${IUSE} strongswan_plugins_${mod}"
+done
+
+for mod in $STRONGSWAN_PLUGINS_OPT; do
+ IUSE="${IUSE} strongswan_plugins_${mod}"
+done
+
+COMMON_DEPEND="non-root? (
+ acct-user/ipsec
+ acct-group/ipsec
+ )
+ dev-libs/glib:2
+ gmp? ( >=dev-libs/gmp-4.1.5:= )
+ gcrypt? ( dev-libs/libgcrypt:= )
+ caps? ( sys-libs/libcap )
+ curl? ( net-misc/curl )
+ ldap? ( net-nds/openldap:= )
+ openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist(-)] )
+ mysql? ( dev-db/mysql-connector-c:= )
+ sqlite? ( >=dev-db/sqlite-3.3.1:3 )
+ systemd? ( sys-apps/systemd )
+ networkmanager? ( net-misc/networkmanager )
+ pam? ( sys-libs/pam )
+ strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns:= )"
+
+DEPEND="${COMMON_DEPEND}
+ virtual/linux-sources
+ sys-kernel/linux-headers"
+
+RDEPEND="${COMMON_DEPEND}
+ virtual/logger
+ sys-apps/iproute2
+ !net-vpn/libreswan
+ selinux? ( sec-policy/selinux-ipsec )"
+
+UGID="ipsec"
+
+pkg_setup() {
+ linux-info_pkg_setup
+
+ elog "Linux kernel version: ${KV_FULL}"
+
+ if ! kernel_is -ge 2 6 16; then
+ eerror
+ eerror "This ebuild currently only supports ${PN} with the"
+ eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
+ eerror
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn
+ ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
+ ewarn
+
+ if kernel_is -lt 2 6 29; then
+ ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
+ ewarn "include all required IPv6 modules even if you just intend"
+ ewarn "to run on IPv4 only."
+ ewarn
+ ewarn "This has been fixed with kernels >= 2.6.29."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 33; then
+ ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
+ ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
+ ewarn "miss SHA384 and SHA512 HMAC support altogether."
+ ewarn
+ ewarn "If you need any of those features, please use kernel >= 2.6.33."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
+ ewarn "ESP cipher is only included in kernels >= 2.6.34."
+ ewarn
+ ewarn "If you need it, please use kernel >= 2.6.34."
+ ewarn
+ fi
+ fi
+}
+
+src_configure() {
+ local myconf=""
+
+ if use non-root; then
+ myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
+ fi
+
+ # If a user has already enabled db support, those plugins will
+ # most likely be desired as well. Besides they don't impose new
+ # dependencies and come at no cost (except for space).
+ if use mysql || use sqlite; then
+ myconf="${myconf} --enable-attr-sql --enable-sql"
+ fi
+
+ # strongSwan builds and installs static libs by default which are
+ # useless to the user (and to strongSwan for that matter) because no
+ # header files or alike get installed... so disabling them is safe.
+ if use pam && use eap; then
+ myconf="${myconf} --enable-eap-gtc"
+ else
+ myconf="${myconf} --disable-eap-gtc"
+ fi
+
+ for mod in $STRONGSWAN_PLUGINS_STD; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ for mod in $STRONGSWAN_PLUGINS_OPT_DISABLE; do
+ if ! use strongswan_plugins_${mod}; then
+ myconf+=" --disable-${mod}"
+ fi
+ done
+
+ for mod in $STRONGSWAN_PLUGINS_OPT; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ econf \
+ --disable-static \
+ --enable-ikev1 \
+ --enable-ikev2 \
+ --enable-swanctl \
+ --enable-socket-dynamic \
+ --enable-cmd \
+ $(use_enable curl) \
+ $(use_enable constraints) \
+ $(use_enable ldap) \
+ $(use_enable debug leak-detective) \
+ $(use_enable dhcp) \
+ $(use_enable eap eap-sim) \
+ $(use_enable eap eap-sim-file) \
+ $(use_enable eap eap-simaka-sql) \
+ $(use_enable eap eap-simaka-pseudonym) \
+ $(use_enable eap eap-simaka-reauth) \
+ $(use_enable eap eap-identity) \
+ $(use_enable eap eap-md5) \
+ $(use_enable eap eap-aka) \
+ $(use_enable eap eap-aka-3gpp2) \
+ $(use_enable eap md4) \
+ $(use_enable eap eap-mschapv2) \
+ $(use_enable eap eap-radius) \
+ $(use_enable eap eap-tls) \
+ $(use_enable eap eap-ttls) \
+ $(use_enable eap xauth-eap) \
+ $(use_enable eap eap-dynamic) \
+ $(use_enable farp) \
+ $(use_enable gmp) \
+ $(use_enable gcrypt) \
+ $(use_enable mysql) \
+ $(use_enable networkmanager nm) \
+ $(use_enable openssl) \
+ $(use_enable pam xauth-pam) \
+ $(use_enable pkcs11) \
+ $(use_enable sqlite) \
+ $(use_enable systemd) \
+ $(use_with caps capabilities libcap) \
+ --with-piddir=/run \
+ --with-systemdsystemunitdir="$(systemd_get_systemunitdir)" \
+ ${myconf}
+}
+
+src_install() {
+ emake DESTDIR="${D}" install
+
+ if ! use systemd; then
+ rm -rf "${ED}"/lib/systemd || die "Failed removing systemd lib."
+ fi
+
+ doinitd "${FILESDIR}"/ipsec
+
+ local dir_ugid
+ if use non-root; then
+ fowners ${UGID}:${UGID} \
+ /etc/ipsec.conf \
+ /etc/strongswan.conf
+
+ dir_ugid="${UGID}"
+ else
+ dir_ugid="root"
+ fi
+
+ diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
+ dodir /etc/ipsec.d \
+ /etc/ipsec.d/aacerts \
+ /etc/ipsec.d/acerts \
+ /etc/ipsec.d/cacerts \
+ /etc/ipsec.d/certs \
+ /etc/ipsec.d/crls \
+ /etc/ipsec.d/ocspcerts \
+ /etc/ipsec.d/private \
+ /etc/ipsec.d/reqs
+
+ dodoc NEWS README TODO
+
+ # shared libs are used only internally and there are no static libs,
+ # so it's safe to get rid of the .la files
+ find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
+}
+
+pkg_preinst() {
+ has_version "<net-vpn/strongswan-4.3.6-r1"
+ upgrade_from_leq_4_3_6=$(( !$? ))
+
+ has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
+ previous_4_3_6_with_caps=$(( !$? ))
+}
+
+pkg_postinst() {
+ if ! use openssl && ! use gcrypt; then
+ elog
+ elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
+ elog "Please note that this might effect availability and speed of some"
+ elog "cryptographic features. You are advised to enable the OpenSSL plugin."
+ elif ! use openssl; then
+ elog
+ elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
+ elog "availability and speed of some cryptographic features. There will be"
+ elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
+ elog "25, 26) and ECDSA."
+ fi
+
+ if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
+ chmod 0750 "${ROOT}"/etc/ipsec.d \
+ "${ROOT}"/etc/ipsec.d/aacerts \
+ "${ROOT}"/etc/ipsec.d/acerts \
+ "${ROOT}"/etc/ipsec.d/cacerts \
+ "${ROOT}"/etc/ipsec.d/certs \
+ "${ROOT}"/etc/ipsec.d/crls \
+ "${ROOT}"/etc/ipsec.d/ocspcerts \
+ "${ROOT}"/etc/ipsec.d/private \
+ "${ROOT}"/etc/ipsec.d/reqs
+
+ ewarn
+ ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
+ ewarn "security reasons. Your system installed directories have been"
+ ewarn "updated accordingly. Please check if necessary."
+ ewarn
+
+ if [[ $previous_4_3_6_with_caps == 1 ]]; then
+ if ! use non-root; then
+ ewarn
+ ewarn "IMPORTANT: You previously had ${PN} installed without root"
+ ewarn "privileges because it was implied by the 'caps' USE flag."
+ ewarn "This has been changed. If you want ${PN} with user privileges,"
+ ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
+ ewarn
+ fi
+ fi
+ fi
+ if ! use caps && ! use non-root; then
+ ewarn
+ ewarn "You have decided to run ${PN} with root privileges and built it"
+ ewarn "without support for POSIX capability dropping. It is generally"
+ ewarn "strongly suggested that you reconsider- especially if you intend"
+ ewarn "to run ${PN} as server with a public ip address."
+ ewarn
+ ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
+ ewarn
+ fi
+ if use non-root; then
+ elog
+ elog "${PN} has been installed without superuser privileges (USE=non-root)."
+ elog "This imposes a few limitations mainly to the daemon 'charon' in"
+ elog "regards of the use of iptables."
+ elog
+ elog "Please carefully read: http://wiki.strongswan.org/projects/strongswan/wiki/ReducedPrivileges"
+ elog
+ elog "Thus if you require to specify a custom updown"
+ elog "script to charon which requires superuser privileges, you"
+ elog "can work around this limitation by using sudo to grant the"
+ elog "user \"ipsec\" the appropriate rights."
+ elog "For example (the default case):"
+ elog "/etc/sudoers:"
+ elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
+ elog "Under the specific connection block in /etc/ipsec.conf:"
+ elog " leftupdown=\"sudo -E ipsec _updown iptables\""
+ elog
+ fi
+ elog
+ elog "Make sure you have _all_ required kernel modules available including"
+ elog "the appropriate cryptographic algorithms. A list is available at:"
+ elog " https://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
+ elog
+ elog "The up-to-date manual is available online at:"
+ elog " https://wiki.strongswan.org/"
+ elog
+}
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2023-03-14 23:14 Conrad Kostecki
0 siblings, 0 replies; 112+ messages in thread
From: Conrad Kostecki @ 2023-03-14 23:14 UTC (permalink / raw
To: gentoo-commits
commit: e946ce4d76ece04b512661469ce5550e1d505ae5
Author: Dennis Eisele <kernlpanic <AT> dennis-eisele <DOT> de>
AuthorDate: Sat Mar 4 13:33:08 2023 +0000
Commit: Conrad Kostecki <conikost <AT> gentoo <DOT> org>
CommitDate: Tue Mar 14 23:12:01 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e946ce4d
net-vpn/strongswan: version bump to 5.9.10
Bug: https://bugs.gentoo.org/899964
Signed-off-by: Dennis Eisele <kernlpanic <AT> dennis-eisele.de>
Closes: https://github.com/gentoo/gentoo/pull/29924
Signed-off-by: Conrad Kostecki <conikost <AT> gentoo.org>
net-vpn/strongswan/Manifest | 1 +
net-vpn/strongswan/strongswan-5.9.10.ebuild | 318 ++++++++++++++++++++++++++++
2 files changed, 319 insertions(+)
diff --git a/net-vpn/strongswan/Manifest b/net-vpn/strongswan/Manifest
index f85dfcb0feff..0d022dbe3b3f 100644
--- a/net-vpn/strongswan/Manifest
+++ b/net-vpn/strongswan/Manifest
@@ -1,2 +1,3 @@
+DIST strongswan-5.9.10.tar.bz2 4765407 BLAKE2B 757d55aa0c623356c5d8bf0360df63990ec18294d06f50b6dd475273b75a883354ea8723708e4856a8f0acc4d3237ac6bcf5adc40346fded7051d78375b2bcc9 SHA512 cf1d4a79ec02ac0502494ce6bfcab7399ddff151e2bc39bd4fbb9562bae7d0c66cf8d1e387b3c36a35e4387d597889fd7519e7bce07d3a7f764b1b73bd8a4667
DIST strongswan-5.9.8.tar.bz2 4747096 BLAKE2B 2a7e346931f909aefa17a7e2f4a2d5b491979dd21519eaffa5d14ac0e54d86207009526aed903bfadbec2d4d449a23077f391106ed9ac02851a081b563c72eb0 SHA512 16d3afc80704f896f3f97addf452b4bb29fc1911c54e980f76ac48bdbe2340ce3bd4e79024848cb7961bbe9ad5458d93389343878ca042af658d51b11219666b
DIST strongswan-5.9.9.tar.bz2 4764675 BLAKE2B 9cbc73192527254a2d20b28295e7583a0d9ec81e4d6eb1b7d78e54b30ba8e5304a33e813145d8a47b2b4319d7b49762cd35cdbdaf1d41161d7746d68d3cef1b5 SHA512 7f5d94527193ce7716292f30db75303a0594169647e41e8c9530a7dedd914ad7fecf94885356738fd54d3781a066fa591c621d531923b20780b1fca76ad7bd46
diff --git a/net-vpn/strongswan/strongswan-5.9.10.ebuild b/net-vpn/strongswan/strongswan-5.9.10.ebuild
new file mode 100644
index 000000000000..057c1e8f3e05
--- /dev/null
+++ b/net-vpn/strongswan/strongswan-5.9.10.ebuild
@@ -0,0 +1,318 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+inherit linux-info systemd
+
+DESCRIPTION="IPsec-based VPN solution, supporting IKEv1/IKEv2 and MOBIKE"
+HOMEPAGE="https://www.strongswan.org/"
+SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
+
+LICENSE="GPL-2 RSA DES"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
+IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
+
+STRONGSWAN_PLUGINS_STD="gcm led lookip systime-fix unity vici"
+STRONGSWAN_PLUGINS_OPT_DISABLE="kdf"
+STRONGSWAN_PLUGINS_OPT="addrblock aesni blowfish bypass-lan ccm chapoly ctr error-notify forecast
+ha ipseckey newhope ntru padlock rdrand save-keys unbound whitelist
+xauth-noauth"
+for mod in $STRONGSWAN_PLUGINS_STD; do
+ IUSE="${IUSE} +strongswan_plugins_${mod}"
+done
+
+for mod in $STRONGSWAN_PLUGINS_OPT_DISABLE; do
+ IUSE="${IUSE} strongswan_plugins_${mod}"
+done
+
+for mod in $STRONGSWAN_PLUGINS_OPT; do
+ IUSE="${IUSE} strongswan_plugins_${mod}"
+done
+
+COMMON_DEPEND="non-root? (
+ acct-user/ipsec
+ acct-group/ipsec
+ )
+ dev-libs/glib:2
+ gmp? ( >=dev-libs/gmp-4.1.5:= )
+ gcrypt? ( dev-libs/libgcrypt:= )
+ caps? ( sys-libs/libcap )
+ curl? ( net-misc/curl )
+ ldap? ( net-nds/openldap:= )
+ openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist(-)] )
+ mysql? ( dev-db/mysql-connector-c:= )
+ sqlite? ( >=dev-db/sqlite-3.3.1:3 )
+ systemd? ( sys-apps/systemd )
+ networkmanager? ( net-misc/networkmanager )
+ pam? ( sys-libs/pam )
+ strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns:= )"
+
+DEPEND="${COMMON_DEPEND}
+ virtual/linux-sources
+ sys-kernel/linux-headers"
+
+RDEPEND="${COMMON_DEPEND}
+ virtual/logger
+ sys-apps/iproute2
+ !net-vpn/libreswan
+ selinux? ( sec-policy/selinux-ipsec )"
+
+UGID="ipsec"
+
+pkg_setup() {
+ linux-info_pkg_setup
+
+ elog "Linux kernel version: ${KV_FULL}"
+
+ if ! kernel_is -ge 2 6 16; then
+ eerror
+ eerror "This ebuild currently only supports ${PN} with the"
+ eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
+ eerror
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn
+ ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
+ ewarn
+
+ if kernel_is -lt 2 6 29; then
+ ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
+ ewarn "include all required IPv6 modules even if you just intend"
+ ewarn "to run on IPv4 only."
+ ewarn
+ ewarn "This has been fixed with kernels >= 2.6.29."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 33; then
+ ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
+ ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
+ ewarn "miss SHA384 and SHA512 HMAC support altogether."
+ ewarn
+ ewarn "If you need any of those features, please use kernel >= 2.6.33."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
+ ewarn "ESP cipher is only included in kernels >= 2.6.34."
+ ewarn
+ ewarn "If you need it, please use kernel >= 2.6.34."
+ ewarn
+ fi
+ fi
+}
+
+src_configure() {
+ local myconf=""
+
+ if use non-root; then
+ myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
+ fi
+
+ # If a user has already enabled db support, those plugins will
+ # most likely be desired as well. Besides they don't impose new
+ # dependencies and come at no cost (except for space).
+ if use mysql || use sqlite; then
+ myconf="${myconf} --enable-attr-sql --enable-sql"
+ fi
+
+ # strongSwan builds and installs static libs by default which are
+ # useless to the user (and to strongSwan for that matter) because no
+ # header files or alike get installed... so disabling them is safe.
+ if use pam && use eap; then
+ myconf="${myconf} --enable-eap-gtc"
+ else
+ myconf="${myconf} --disable-eap-gtc"
+ fi
+
+ for mod in $STRONGSWAN_PLUGINS_STD; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ for mod in $STRONGSWAN_PLUGINS_OPT_DISABLE; do
+ if ! use strongswan_plugins_${mod}; then
+ myconf+=" --disable-${mod}"
+ fi
+ done
+
+ for mod in $STRONGSWAN_PLUGINS_OPT; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ econf \
+ --disable-static \
+ --enable-ikev1 \
+ --enable-ikev2 \
+ --enable-swanctl \
+ --enable-socket-dynamic \
+ --enable-cmd \
+ $(use_enable curl) \
+ $(use_enable constraints) \
+ $(use_enable ldap) \
+ $(use_enable debug leak-detective) \
+ $(use_enable dhcp) \
+ $(use_enable eap eap-sim) \
+ $(use_enable eap eap-sim-file) \
+ $(use_enable eap eap-simaka-sql) \
+ $(use_enable eap eap-simaka-pseudonym) \
+ $(use_enable eap eap-simaka-reauth) \
+ $(use_enable eap eap-identity) \
+ $(use_enable eap eap-md5) \
+ $(use_enable eap eap-aka) \
+ $(use_enable eap eap-aka-3gpp2) \
+ $(use_enable eap md4) \
+ $(use_enable eap eap-mschapv2) \
+ $(use_enable eap eap-radius) \
+ $(use_enable eap eap-tls) \
+ $(use_enable eap eap-ttls) \
+ $(use_enable eap xauth-eap) \
+ $(use_enable eap eap-dynamic) \
+ $(use_enable farp) \
+ $(use_enable gmp) \
+ $(use_enable gcrypt) \
+ $(use_enable mysql) \
+ $(use_enable networkmanager nm) \
+ $(use_enable openssl) \
+ $(use_enable pam xauth-pam) \
+ $(use_enable pkcs11) \
+ $(use_enable sqlite) \
+ $(use_enable systemd) \
+ $(use_with caps capabilities libcap) \
+ --with-piddir=/run \
+ --with-systemdsystemunitdir="$(systemd_get_systemunitdir)" \
+ ${myconf}
+}
+
+src_install() {
+ emake DESTDIR="${D}" install
+
+ if ! use systemd; then
+ rm -rf "${ED}"/lib/systemd || die "Failed removing systemd lib."
+ fi
+
+ doinitd "${FILESDIR}"/ipsec
+
+ local dir_ugid
+ if use non-root; then
+ fowners ${UGID}:${UGID} \
+ /etc/ipsec.conf \
+ /etc/strongswan.conf
+
+ dir_ugid="${UGID}"
+ else
+ dir_ugid="root"
+ fi
+
+ diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
+ dodir /etc/ipsec.d \
+ /etc/ipsec.d/aacerts \
+ /etc/ipsec.d/acerts \
+ /etc/ipsec.d/cacerts \
+ /etc/ipsec.d/certs \
+ /etc/ipsec.d/crls \
+ /etc/ipsec.d/ocspcerts \
+ /etc/ipsec.d/private \
+ /etc/ipsec.d/reqs
+
+ dodoc NEWS README TODO
+
+ # shared libs are used only internally and there are no static libs,
+ # so it's safe to get rid of the .la files
+ find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
+}
+
+pkg_preinst() {
+ has_version "<net-vpn/strongswan-4.3.6-r1"
+ upgrade_from_leq_4_3_6=$(( !$? ))
+
+ has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
+ previous_4_3_6_with_caps=$(( !$? ))
+}
+
+pkg_postinst() {
+ if ! use openssl && ! use gcrypt; then
+ elog
+ elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
+ elog "Please note that this might effect availability and speed of some"
+ elog "cryptographic features. You are advised to enable the OpenSSL plugin."
+ elif ! use openssl; then
+ elog
+ elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
+ elog "availability and speed of some cryptographic features. There will be"
+ elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
+ elog "25, 26) and ECDSA."
+ fi
+
+ if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
+ chmod 0750 "${ROOT}"/etc/ipsec.d \
+ "${ROOT}"/etc/ipsec.d/aacerts \
+ "${ROOT}"/etc/ipsec.d/acerts \
+ "${ROOT}"/etc/ipsec.d/cacerts \
+ "${ROOT}"/etc/ipsec.d/certs \
+ "${ROOT}"/etc/ipsec.d/crls \
+ "${ROOT}"/etc/ipsec.d/ocspcerts \
+ "${ROOT}"/etc/ipsec.d/private \
+ "${ROOT}"/etc/ipsec.d/reqs
+
+ ewarn
+ ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
+ ewarn "security reasons. Your system installed directories have been"
+ ewarn "updated accordingly. Please check if necessary."
+ ewarn
+
+ if [[ $previous_4_3_6_with_caps == 1 ]]; then
+ if ! use non-root; then
+ ewarn
+ ewarn "IMPORTANT: You previously had ${PN} installed without root"
+ ewarn "privileges because it was implied by the 'caps' USE flag."
+ ewarn "This has been changed. If you want ${PN} with user privileges,"
+ ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
+ ewarn
+ fi
+ fi
+ fi
+ if ! use caps && ! use non-root; then
+ ewarn
+ ewarn "You have decided to run ${PN} with root privileges and built it"
+ ewarn "without support for POSIX capability dropping. It is generally"
+ ewarn "strongly suggested that you reconsider- especially if you intend"
+ ewarn "to run ${PN} as server with a public ip address."
+ ewarn
+ ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
+ ewarn
+ fi
+ if use non-root; then
+ elog
+ elog "${PN} has been installed without superuser privileges (USE=non-root)."
+ elog "This imposes a few limitations mainly to the daemon 'charon' in"
+ elog "regards of the use of iptables."
+ elog
+ elog "Please carefully read: http://wiki.strongswan.org/projects/strongswan/wiki/ReducedPrivileges"
+ elog
+ elog "Thus if you require to specify a custom updown"
+ elog "script to charon which requires superuser privileges, you"
+ elog "can work around this limitation by using sudo to grant the"
+ elog "user \"ipsec\" the appropriate rights."
+ elog "For example (the default case):"
+ elog "/etc/sudoers:"
+ elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
+ elog "Under the specific connection block in /etc/ipsec.conf:"
+ elog " leftupdown=\"sudo -E ipsec _updown iptables\""
+ elog
+ fi
+ elog
+ elog "Make sure you have _all_ required kernel modules available including"
+ elog "the appropriate cryptographic algorithms. A list is available at:"
+ elog " https://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
+ elog
+ elog "The up-to-date manual is available online at:"
+ elog " https://wiki.strongswan.org/"
+ elog
+}
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2023-03-17 18:25 Sam James
0 siblings, 0 replies; 112+ messages in thread
From: Sam James @ 2023-03-17 18:25 UTC (permalink / raw
To: gentoo-commits
commit: df81fff2a650b61e91f19d7027bc7fe95dcf91e1
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Fri Mar 17 18:24:55 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Fri Mar 17 18:25:19 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=df81fff2
net-vpn/strongswan: Stabilize 5.9.9 amd64, #901819
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.9.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.9.ebuild b/net-vpn/strongswan/strongswan-5.9.9.ebuild
index 1fbcbb9907a8..1de15e962bd1 100644
--- a/net-vpn/strongswan/strongswan-5.9.9.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.9.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~riscv x86"
+KEYWORDS="amd64 ~arm ~arm64 ~ppc ~ppc64 ~riscv x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="gcm led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2023-03-30 17:22 Arthur Zamarin
0 siblings, 0 replies; 112+ messages in thread
From: Arthur Zamarin @ 2023-03-30 17:22 UTC (permalink / raw
To: gentoo-commits
commit: b5c021c5fbcb8faeef292e6976e4b7f8a8d9229b
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Thu Mar 30 17:22:20 2023 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Thu Mar 30 17:22:20 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b5c021c5
net-vpn/strongswan: Stabilize 5.9.9 arm, #901819
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.9.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.9.ebuild b/net-vpn/strongswan/strongswan-5.9.9.ebuild
index 1de15e962bd1..7737209cacb8 100644
--- a/net-vpn/strongswan/strongswan-5.9.9.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.9.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="amd64 ~arm ~arm64 ~ppc ~ppc64 ~riscv x86"
+KEYWORDS="amd64 arm ~arm64 ~ppc ~ppc64 ~riscv x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="gcm led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2023-04-19 5:28 Sam James
0 siblings, 0 replies; 112+ messages in thread
From: Sam James @ 2023-04-19 5:28 UTC (permalink / raw
To: gentoo-commits
commit: d7da80b8de19e19f76cdd1846955c1022041aba2
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Wed Apr 19 05:28:29 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Wed Apr 19 05:28:43 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d7da80b8
net-vpn/strongswan: Stabilize 5.9.10 amd64, #904537
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.10.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.10.ebuild b/net-vpn/strongswan/strongswan-5.9.10.ebuild
index 057c1e8f3e05..2ccbb23065bd 100644
--- a/net-vpn/strongswan/strongswan-5.9.10.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.10.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
+KEYWORDS="amd64 ~arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="gcm led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2023-04-19 5:28 Sam James
0 siblings, 0 replies; 112+ messages in thread
From: Sam James @ 2023-04-19 5:28 UTC (permalink / raw
To: gentoo-commits
commit: 297ff1766d3e54f5aa52d9e94037a1a6687f37ed
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Wed Apr 19 05:28:30 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Wed Apr 19 05:28:43 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=297ff176
net-vpn/strongswan: Stabilize 5.9.10 arm, #904537
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.10.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.10.ebuild b/net-vpn/strongswan/strongswan-5.9.10.ebuild
index 2ccbb23065bd..fa1869ef45dd 100644
--- a/net-vpn/strongswan/strongswan-5.9.10.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.10.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="amd64 ~arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
+KEYWORDS="amd64 arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="gcm led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2023-04-19 5:28 Sam James
0 siblings, 0 replies; 112+ messages in thread
From: Sam James @ 2023-04-19 5:28 UTC (permalink / raw
To: gentoo-commits
commit: 440b3c9c9620dd171d3397754f88576688b05db4
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Wed Apr 19 05:28:31 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Wed Apr 19 05:28:44 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=440b3c9c
net-vpn/strongswan: Stabilize 5.9.10 x86, #904537
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.10.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.10.ebuild b/net-vpn/strongswan/strongswan-5.9.10.ebuild
index fa1869ef45dd..7737209cacb8 100644
--- a/net-vpn/strongswan/strongswan-5.9.10.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.10.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="amd64 arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
+KEYWORDS="amd64 arm ~arm64 ~ppc ~ppc64 ~riscv x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="gcm led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2023-06-28 21:11 Sam James
0 siblings, 0 replies; 112+ messages in thread
From: Sam James @ 2023-06-28 21:11 UTC (permalink / raw
To: gentoo-commits
commit: ae055071d7881079db25c7d6f749367c0983abe1
Author: Jaco Kroon <jaco <AT> uls <DOT> co <DOT> za>
AuthorDate: Tue Jun 27 00:50:25 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Wed Jun 28 21:10:28 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ae055071
net-vpn/strongswan: add 5.9.11
Signed-off-by: Jaco Kroon <jaco <AT> uls.co.za>
Closes: https://github.com/gentoo/gentoo/pull/31637
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-vpn/strongswan/Manifest | 1 +
net-vpn/strongswan/strongswan-5.9.11.ebuild | 318 ++++++++++++++++++++++++++++
2 files changed, 319 insertions(+)
diff --git a/net-vpn/strongswan/Manifest b/net-vpn/strongswan/Manifest
index 0d022dbe3b3f..4c4b95eee71a 100644
--- a/net-vpn/strongswan/Manifest
+++ b/net-vpn/strongswan/Manifest
@@ -1,3 +1,4 @@
DIST strongswan-5.9.10.tar.bz2 4765407 BLAKE2B 757d55aa0c623356c5d8bf0360df63990ec18294d06f50b6dd475273b75a883354ea8723708e4856a8f0acc4d3237ac6bcf5adc40346fded7051d78375b2bcc9 SHA512 cf1d4a79ec02ac0502494ce6bfcab7399ddff151e2bc39bd4fbb9562bae7d0c66cf8d1e387b3c36a35e4387d597889fd7519e7bce07d3a7f764b1b73bd8a4667
+DIST strongswan-5.9.11.tar.bz2 4786552 BLAKE2B e8e84d79d1530b9a968ce8429fec0e7b3fcf19b75fdbd4371a38763d8564d5b37d012769006330b5c94cff3e914acb1b1a3e2829749effb8c35f9e5d775be491 SHA512 d500523215f5ec5c5550c4d2c49060b350ae396d8c60170792c46775d04fc7a132aa70a6242145477753668351d26ed957e08903683ecc340aa8d84fb2ae5498
DIST strongswan-5.9.8.tar.bz2 4747096 BLAKE2B 2a7e346931f909aefa17a7e2f4a2d5b491979dd21519eaffa5d14ac0e54d86207009526aed903bfadbec2d4d449a23077f391106ed9ac02851a081b563c72eb0 SHA512 16d3afc80704f896f3f97addf452b4bb29fc1911c54e980f76ac48bdbe2340ce3bd4e79024848cb7961bbe9ad5458d93389343878ca042af658d51b11219666b
DIST strongswan-5.9.9.tar.bz2 4764675 BLAKE2B 9cbc73192527254a2d20b28295e7583a0d9ec81e4d6eb1b7d78e54b30ba8e5304a33e813145d8a47b2b4319d7b49762cd35cdbdaf1d41161d7746d68d3cef1b5 SHA512 7f5d94527193ce7716292f30db75303a0594169647e41e8c9530a7dedd914ad7fecf94885356738fd54d3781a066fa591c621d531923b20780b1fca76ad7bd46
diff --git a/net-vpn/strongswan/strongswan-5.9.11.ebuild b/net-vpn/strongswan/strongswan-5.9.11.ebuild
new file mode 100644
index 000000000000..057c1e8f3e05
--- /dev/null
+++ b/net-vpn/strongswan/strongswan-5.9.11.ebuild
@@ -0,0 +1,318 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+inherit linux-info systemd
+
+DESCRIPTION="IPsec-based VPN solution, supporting IKEv1/IKEv2 and MOBIKE"
+HOMEPAGE="https://www.strongswan.org/"
+SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
+
+LICENSE="GPL-2 RSA DES"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
+IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
+
+STRONGSWAN_PLUGINS_STD="gcm led lookip systime-fix unity vici"
+STRONGSWAN_PLUGINS_OPT_DISABLE="kdf"
+STRONGSWAN_PLUGINS_OPT="addrblock aesni blowfish bypass-lan ccm chapoly ctr error-notify forecast
+ha ipseckey newhope ntru padlock rdrand save-keys unbound whitelist
+xauth-noauth"
+for mod in $STRONGSWAN_PLUGINS_STD; do
+ IUSE="${IUSE} +strongswan_plugins_${mod}"
+done
+
+for mod in $STRONGSWAN_PLUGINS_OPT_DISABLE; do
+ IUSE="${IUSE} strongswan_plugins_${mod}"
+done
+
+for mod in $STRONGSWAN_PLUGINS_OPT; do
+ IUSE="${IUSE} strongswan_plugins_${mod}"
+done
+
+COMMON_DEPEND="non-root? (
+ acct-user/ipsec
+ acct-group/ipsec
+ )
+ dev-libs/glib:2
+ gmp? ( >=dev-libs/gmp-4.1.5:= )
+ gcrypt? ( dev-libs/libgcrypt:= )
+ caps? ( sys-libs/libcap )
+ curl? ( net-misc/curl )
+ ldap? ( net-nds/openldap:= )
+ openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist(-)] )
+ mysql? ( dev-db/mysql-connector-c:= )
+ sqlite? ( >=dev-db/sqlite-3.3.1:3 )
+ systemd? ( sys-apps/systemd )
+ networkmanager? ( net-misc/networkmanager )
+ pam? ( sys-libs/pam )
+ strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns:= )"
+
+DEPEND="${COMMON_DEPEND}
+ virtual/linux-sources
+ sys-kernel/linux-headers"
+
+RDEPEND="${COMMON_DEPEND}
+ virtual/logger
+ sys-apps/iproute2
+ !net-vpn/libreswan
+ selinux? ( sec-policy/selinux-ipsec )"
+
+UGID="ipsec"
+
+pkg_setup() {
+ linux-info_pkg_setup
+
+ elog "Linux kernel version: ${KV_FULL}"
+
+ if ! kernel_is -ge 2 6 16; then
+ eerror
+ eerror "This ebuild currently only supports ${PN} with the"
+ eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
+ eerror
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn
+ ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
+ ewarn
+
+ if kernel_is -lt 2 6 29; then
+ ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
+ ewarn "include all required IPv6 modules even if you just intend"
+ ewarn "to run on IPv4 only."
+ ewarn
+ ewarn "This has been fixed with kernels >= 2.6.29."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 33; then
+ ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
+ ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
+ ewarn "miss SHA384 and SHA512 HMAC support altogether."
+ ewarn
+ ewarn "If you need any of those features, please use kernel >= 2.6.33."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
+ ewarn "ESP cipher is only included in kernels >= 2.6.34."
+ ewarn
+ ewarn "If you need it, please use kernel >= 2.6.34."
+ ewarn
+ fi
+ fi
+}
+
+src_configure() {
+ local myconf=""
+
+ if use non-root; then
+ myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
+ fi
+
+ # If a user has already enabled db support, those plugins will
+ # most likely be desired as well. Besides they don't impose new
+ # dependencies and come at no cost (except for space).
+ if use mysql || use sqlite; then
+ myconf="${myconf} --enable-attr-sql --enable-sql"
+ fi
+
+ # strongSwan builds and installs static libs by default which are
+ # useless to the user (and to strongSwan for that matter) because no
+ # header files or alike get installed... so disabling them is safe.
+ if use pam && use eap; then
+ myconf="${myconf} --enable-eap-gtc"
+ else
+ myconf="${myconf} --disable-eap-gtc"
+ fi
+
+ for mod in $STRONGSWAN_PLUGINS_STD; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ for mod in $STRONGSWAN_PLUGINS_OPT_DISABLE; do
+ if ! use strongswan_plugins_${mod}; then
+ myconf+=" --disable-${mod}"
+ fi
+ done
+
+ for mod in $STRONGSWAN_PLUGINS_OPT; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ econf \
+ --disable-static \
+ --enable-ikev1 \
+ --enable-ikev2 \
+ --enable-swanctl \
+ --enable-socket-dynamic \
+ --enable-cmd \
+ $(use_enable curl) \
+ $(use_enable constraints) \
+ $(use_enable ldap) \
+ $(use_enable debug leak-detective) \
+ $(use_enable dhcp) \
+ $(use_enable eap eap-sim) \
+ $(use_enable eap eap-sim-file) \
+ $(use_enable eap eap-simaka-sql) \
+ $(use_enable eap eap-simaka-pseudonym) \
+ $(use_enable eap eap-simaka-reauth) \
+ $(use_enable eap eap-identity) \
+ $(use_enable eap eap-md5) \
+ $(use_enable eap eap-aka) \
+ $(use_enable eap eap-aka-3gpp2) \
+ $(use_enable eap md4) \
+ $(use_enable eap eap-mschapv2) \
+ $(use_enable eap eap-radius) \
+ $(use_enable eap eap-tls) \
+ $(use_enable eap eap-ttls) \
+ $(use_enable eap xauth-eap) \
+ $(use_enable eap eap-dynamic) \
+ $(use_enable farp) \
+ $(use_enable gmp) \
+ $(use_enable gcrypt) \
+ $(use_enable mysql) \
+ $(use_enable networkmanager nm) \
+ $(use_enable openssl) \
+ $(use_enable pam xauth-pam) \
+ $(use_enable pkcs11) \
+ $(use_enable sqlite) \
+ $(use_enable systemd) \
+ $(use_with caps capabilities libcap) \
+ --with-piddir=/run \
+ --with-systemdsystemunitdir="$(systemd_get_systemunitdir)" \
+ ${myconf}
+}
+
+src_install() {
+ emake DESTDIR="${D}" install
+
+ if ! use systemd; then
+ rm -rf "${ED}"/lib/systemd || die "Failed removing systemd lib."
+ fi
+
+ doinitd "${FILESDIR}"/ipsec
+
+ local dir_ugid
+ if use non-root; then
+ fowners ${UGID}:${UGID} \
+ /etc/ipsec.conf \
+ /etc/strongswan.conf
+
+ dir_ugid="${UGID}"
+ else
+ dir_ugid="root"
+ fi
+
+ diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
+ dodir /etc/ipsec.d \
+ /etc/ipsec.d/aacerts \
+ /etc/ipsec.d/acerts \
+ /etc/ipsec.d/cacerts \
+ /etc/ipsec.d/certs \
+ /etc/ipsec.d/crls \
+ /etc/ipsec.d/ocspcerts \
+ /etc/ipsec.d/private \
+ /etc/ipsec.d/reqs
+
+ dodoc NEWS README TODO
+
+ # shared libs are used only internally and there are no static libs,
+ # so it's safe to get rid of the .la files
+ find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
+}
+
+pkg_preinst() {
+ has_version "<net-vpn/strongswan-4.3.6-r1"
+ upgrade_from_leq_4_3_6=$(( !$? ))
+
+ has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
+ previous_4_3_6_with_caps=$(( !$? ))
+}
+
+pkg_postinst() {
+ if ! use openssl && ! use gcrypt; then
+ elog
+ elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
+ elog "Please note that this might effect availability and speed of some"
+ elog "cryptographic features. You are advised to enable the OpenSSL plugin."
+ elif ! use openssl; then
+ elog
+ elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
+ elog "availability and speed of some cryptographic features. There will be"
+ elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
+ elog "25, 26) and ECDSA."
+ fi
+
+ if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
+ chmod 0750 "${ROOT}"/etc/ipsec.d \
+ "${ROOT}"/etc/ipsec.d/aacerts \
+ "${ROOT}"/etc/ipsec.d/acerts \
+ "${ROOT}"/etc/ipsec.d/cacerts \
+ "${ROOT}"/etc/ipsec.d/certs \
+ "${ROOT}"/etc/ipsec.d/crls \
+ "${ROOT}"/etc/ipsec.d/ocspcerts \
+ "${ROOT}"/etc/ipsec.d/private \
+ "${ROOT}"/etc/ipsec.d/reqs
+
+ ewarn
+ ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
+ ewarn "security reasons. Your system installed directories have been"
+ ewarn "updated accordingly. Please check if necessary."
+ ewarn
+
+ if [[ $previous_4_3_6_with_caps == 1 ]]; then
+ if ! use non-root; then
+ ewarn
+ ewarn "IMPORTANT: You previously had ${PN} installed without root"
+ ewarn "privileges because it was implied by the 'caps' USE flag."
+ ewarn "This has been changed. If you want ${PN} with user privileges,"
+ ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
+ ewarn
+ fi
+ fi
+ fi
+ if ! use caps && ! use non-root; then
+ ewarn
+ ewarn "You have decided to run ${PN} with root privileges and built it"
+ ewarn "without support for POSIX capability dropping. It is generally"
+ ewarn "strongly suggested that you reconsider- especially if you intend"
+ ewarn "to run ${PN} as server with a public ip address."
+ ewarn
+ ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
+ ewarn
+ fi
+ if use non-root; then
+ elog
+ elog "${PN} has been installed without superuser privileges (USE=non-root)."
+ elog "This imposes a few limitations mainly to the daemon 'charon' in"
+ elog "regards of the use of iptables."
+ elog
+ elog "Please carefully read: http://wiki.strongswan.org/projects/strongswan/wiki/ReducedPrivileges"
+ elog
+ elog "Thus if you require to specify a custom updown"
+ elog "script to charon which requires superuser privileges, you"
+ elog "can work around this limitation by using sudo to grant the"
+ elog "user \"ipsec\" the appropriate rights."
+ elog "For example (the default case):"
+ elog "/etc/sudoers:"
+ elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
+ elog "Under the specific connection block in /etc/ipsec.conf:"
+ elog " leftupdown=\"sudo -E ipsec _updown iptables\""
+ elog
+ fi
+ elog
+ elog "Make sure you have _all_ required kernel modules available including"
+ elog "the appropriate cryptographic algorithms. A list is available at:"
+ elog " https://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
+ elog
+ elog "The up-to-date manual is available online at:"
+ elog " https://wiki.strongswan.org/"
+ elog
+}
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2023-10-03 14:15 Sam James
0 siblings, 0 replies; 112+ messages in thread
From: Sam James @ 2023-10-03 14:15 UTC (permalink / raw
To: gentoo-commits
commit: 4694a025438e6dcf61c70e8c267d0cc989ca6f46
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Tue Oct 3 14:14:47 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Tue Oct 3 14:14:47 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4694a025
net-vpn/strongswan: Stabilize 5.9.11 arm, #914852
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.11.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.11.ebuild b/net-vpn/strongswan/strongswan-5.9.11.ebuild
index 057c1e8f3e05..e26b9c48de3e 100644
--- a/net-vpn/strongswan/strongswan-5.9.11.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.11.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
+KEYWORDS="~amd64 arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="gcm led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2023-10-03 14:15 Sam James
0 siblings, 0 replies; 112+ messages in thread
From: Sam James @ 2023-10-03 14:15 UTC (permalink / raw
To: gentoo-commits
commit: e2e798ccffd187c8fc7dd77de89097665c8d7cfd
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Tue Oct 3 14:14:48 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Tue Oct 3 14:14:48 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e2e798cc
net-vpn/strongswan: Stabilize 5.9.11 amd64, #914852
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.11.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.11.ebuild b/net-vpn/strongswan/strongswan-5.9.11.ebuild
index e26b9c48de3e..fa1869ef45dd 100644
--- a/net-vpn/strongswan/strongswan-5.9.11.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.11.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="~amd64 arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
+KEYWORDS="amd64 arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="gcm led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2023-10-04 7:49 Joonas Niilola
0 siblings, 0 replies; 112+ messages in thread
From: Joonas Niilola @ 2023-10-04 7:49 UTC (permalink / raw
To: gentoo-commits
commit: 7b941e2800cec0edaa3aac1fc8ba63fb6c594bc1
Author: Joonas Niilola <juippis <AT> gentoo <DOT> org>
AuthorDate: Wed Oct 4 07:48:53 2023 +0000
Commit: Joonas Niilola <juippis <AT> gentoo <DOT> org>
CommitDate: Wed Oct 4 07:49:08 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7b941e28
net-vpn/strongswan: Stabilize 5.9.11 x86, #914852
Signed-off-by: Joonas Niilola <juippis <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.11.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.11.ebuild b/net-vpn/strongswan/strongswan-5.9.11.ebuild
index fa1869ef45dd..7737209cacb8 100644
--- a/net-vpn/strongswan/strongswan-5.9.11.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.11.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="amd64 arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
+KEYWORDS="amd64 arm ~arm64 ~ppc ~ppc64 ~riscv x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="gcm led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2023-10-08 21:51 Conrad Kostecki
0 siblings, 0 replies; 112+ messages in thread
From: Conrad Kostecki @ 2023-10-08 21:51 UTC (permalink / raw
To: gentoo-commits
commit: 328181b0a39b56600ebba16a15ab14e3e4954b85
Author: Conrad Kostecki <conikost <AT> gentoo <DOT> org>
AuthorDate: Sun Oct 8 21:50:15 2023 +0000
Commit: Conrad Kostecki <conikost <AT> gentoo <DOT> org>
CommitDate: Sun Oct 8 21:51:41 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=328181b0
net-vpn/strongswan: drop 5.9.8, 5.9.9, 5.9.10
Bug: https://bugs.gentoo.org/899964
Signed-off-by: Conrad Kostecki <conikost <AT> gentoo.org>
net-vpn/strongswan/Manifest | 3 -
net-vpn/strongswan/strongswan-5.9.10.ebuild | 318 ----------------------------
net-vpn/strongswan/strongswan-5.9.8.ebuild | 318 ----------------------------
net-vpn/strongswan/strongswan-5.9.9.ebuild | 318 ----------------------------
4 files changed, 957 deletions(-)
diff --git a/net-vpn/strongswan/Manifest b/net-vpn/strongswan/Manifest
index 4c4b95eee71a..4c78ad450ad0 100644
--- a/net-vpn/strongswan/Manifest
+++ b/net-vpn/strongswan/Manifest
@@ -1,4 +1 @@
-DIST strongswan-5.9.10.tar.bz2 4765407 BLAKE2B 757d55aa0c623356c5d8bf0360df63990ec18294d06f50b6dd475273b75a883354ea8723708e4856a8f0acc4d3237ac6bcf5adc40346fded7051d78375b2bcc9 SHA512 cf1d4a79ec02ac0502494ce6bfcab7399ddff151e2bc39bd4fbb9562bae7d0c66cf8d1e387b3c36a35e4387d597889fd7519e7bce07d3a7f764b1b73bd8a4667
DIST strongswan-5.9.11.tar.bz2 4786552 BLAKE2B e8e84d79d1530b9a968ce8429fec0e7b3fcf19b75fdbd4371a38763d8564d5b37d012769006330b5c94cff3e914acb1b1a3e2829749effb8c35f9e5d775be491 SHA512 d500523215f5ec5c5550c4d2c49060b350ae396d8c60170792c46775d04fc7a132aa70a6242145477753668351d26ed957e08903683ecc340aa8d84fb2ae5498
-DIST strongswan-5.9.8.tar.bz2 4747096 BLAKE2B 2a7e346931f909aefa17a7e2f4a2d5b491979dd21519eaffa5d14ac0e54d86207009526aed903bfadbec2d4d449a23077f391106ed9ac02851a081b563c72eb0 SHA512 16d3afc80704f896f3f97addf452b4bb29fc1911c54e980f76ac48bdbe2340ce3bd4e79024848cb7961bbe9ad5458d93389343878ca042af658d51b11219666b
-DIST strongswan-5.9.9.tar.bz2 4764675 BLAKE2B 9cbc73192527254a2d20b28295e7583a0d9ec81e4d6eb1b7d78e54b30ba8e5304a33e813145d8a47b2b4319d7b49762cd35cdbdaf1d41161d7746d68d3cef1b5 SHA512 7f5d94527193ce7716292f30db75303a0594169647e41e8c9530a7dedd914ad7fecf94885356738fd54d3781a066fa591c621d531923b20780b1fca76ad7bd46
diff --git a/net-vpn/strongswan/strongswan-5.9.10.ebuild b/net-vpn/strongswan/strongswan-5.9.10.ebuild
deleted file mode 100644
index 7737209cacb8..000000000000
--- a/net-vpn/strongswan/strongswan-5.9.10.ebuild
+++ /dev/null
@@ -1,318 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-inherit linux-info systemd
-
-DESCRIPTION="IPsec-based VPN solution, supporting IKEv1/IKEv2 and MOBIKE"
-HOMEPAGE="https://www.strongswan.org/"
-SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
-
-LICENSE="GPL-2 RSA DES"
-SLOT="0"
-KEYWORDS="amd64 arm ~arm64 ~ppc ~ppc64 ~riscv x86"
-IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
-
-STRONGSWAN_PLUGINS_STD="gcm led lookip systime-fix unity vici"
-STRONGSWAN_PLUGINS_OPT_DISABLE="kdf"
-STRONGSWAN_PLUGINS_OPT="addrblock aesni blowfish bypass-lan ccm chapoly ctr error-notify forecast
-ha ipseckey newhope ntru padlock rdrand save-keys unbound whitelist
-xauth-noauth"
-for mod in $STRONGSWAN_PLUGINS_STD; do
- IUSE="${IUSE} +strongswan_plugins_${mod}"
-done
-
-for mod in $STRONGSWAN_PLUGINS_OPT_DISABLE; do
- IUSE="${IUSE} strongswan_plugins_${mod}"
-done
-
-for mod in $STRONGSWAN_PLUGINS_OPT; do
- IUSE="${IUSE} strongswan_plugins_${mod}"
-done
-
-COMMON_DEPEND="non-root? (
- acct-user/ipsec
- acct-group/ipsec
- )
- dev-libs/glib:2
- gmp? ( >=dev-libs/gmp-4.1.5:= )
- gcrypt? ( dev-libs/libgcrypt:= )
- caps? ( sys-libs/libcap )
- curl? ( net-misc/curl )
- ldap? ( net-nds/openldap:= )
- openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist(-)] )
- mysql? ( dev-db/mysql-connector-c:= )
- sqlite? ( >=dev-db/sqlite-3.3.1:3 )
- systemd? ( sys-apps/systemd )
- networkmanager? ( net-misc/networkmanager )
- pam? ( sys-libs/pam )
- strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns:= )"
-
-DEPEND="${COMMON_DEPEND}
- virtual/linux-sources
- sys-kernel/linux-headers"
-
-RDEPEND="${COMMON_DEPEND}
- virtual/logger
- sys-apps/iproute2
- !net-vpn/libreswan
- selinux? ( sec-policy/selinux-ipsec )"
-
-UGID="ipsec"
-
-pkg_setup() {
- linux-info_pkg_setup
-
- elog "Linux kernel version: ${KV_FULL}"
-
- if ! kernel_is -ge 2 6 16; then
- eerror
- eerror "This ebuild currently only supports ${PN} with the"
- eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
- eerror
- fi
-
- if kernel_is -lt 2 6 34; then
- ewarn
- ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
- ewarn
-
- if kernel_is -lt 2 6 29; then
- ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
- ewarn "include all required IPv6 modules even if you just intend"
- ewarn "to run on IPv4 only."
- ewarn
- ewarn "This has been fixed with kernels >= 2.6.29."
- ewarn
- fi
-
- if kernel_is -lt 2 6 33; then
- ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
- ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
- ewarn "miss SHA384 and SHA512 HMAC support altogether."
- ewarn
- ewarn "If you need any of those features, please use kernel >= 2.6.33."
- ewarn
- fi
-
- if kernel_is -lt 2 6 34; then
- ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
- ewarn "ESP cipher is only included in kernels >= 2.6.34."
- ewarn
- ewarn "If you need it, please use kernel >= 2.6.34."
- ewarn
- fi
- fi
-}
-
-src_configure() {
- local myconf=""
-
- if use non-root; then
- myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
- fi
-
- # If a user has already enabled db support, those plugins will
- # most likely be desired as well. Besides they don't impose new
- # dependencies and come at no cost (except for space).
- if use mysql || use sqlite; then
- myconf="${myconf} --enable-attr-sql --enable-sql"
- fi
-
- # strongSwan builds and installs static libs by default which are
- # useless to the user (and to strongSwan for that matter) because no
- # header files or alike get installed... so disabling them is safe.
- if use pam && use eap; then
- myconf="${myconf} --enable-eap-gtc"
- else
- myconf="${myconf} --disable-eap-gtc"
- fi
-
- for mod in $STRONGSWAN_PLUGINS_STD; do
- if use strongswan_plugins_${mod}; then
- myconf+=" --enable-${mod}"
- fi
- done
-
- for mod in $STRONGSWAN_PLUGINS_OPT_DISABLE; do
- if ! use strongswan_plugins_${mod}; then
- myconf+=" --disable-${mod}"
- fi
- done
-
- for mod in $STRONGSWAN_PLUGINS_OPT; do
- if use strongswan_plugins_${mod}; then
- myconf+=" --enable-${mod}"
- fi
- done
-
- econf \
- --disable-static \
- --enable-ikev1 \
- --enable-ikev2 \
- --enable-swanctl \
- --enable-socket-dynamic \
- --enable-cmd \
- $(use_enable curl) \
- $(use_enable constraints) \
- $(use_enable ldap) \
- $(use_enable debug leak-detective) \
- $(use_enable dhcp) \
- $(use_enable eap eap-sim) \
- $(use_enable eap eap-sim-file) \
- $(use_enable eap eap-simaka-sql) \
- $(use_enable eap eap-simaka-pseudonym) \
- $(use_enable eap eap-simaka-reauth) \
- $(use_enable eap eap-identity) \
- $(use_enable eap eap-md5) \
- $(use_enable eap eap-aka) \
- $(use_enable eap eap-aka-3gpp2) \
- $(use_enable eap md4) \
- $(use_enable eap eap-mschapv2) \
- $(use_enable eap eap-radius) \
- $(use_enable eap eap-tls) \
- $(use_enable eap eap-ttls) \
- $(use_enable eap xauth-eap) \
- $(use_enable eap eap-dynamic) \
- $(use_enable farp) \
- $(use_enable gmp) \
- $(use_enable gcrypt) \
- $(use_enable mysql) \
- $(use_enable networkmanager nm) \
- $(use_enable openssl) \
- $(use_enable pam xauth-pam) \
- $(use_enable pkcs11) \
- $(use_enable sqlite) \
- $(use_enable systemd) \
- $(use_with caps capabilities libcap) \
- --with-piddir=/run \
- --with-systemdsystemunitdir="$(systemd_get_systemunitdir)" \
- ${myconf}
-}
-
-src_install() {
- emake DESTDIR="${D}" install
-
- if ! use systemd; then
- rm -rf "${ED}"/lib/systemd || die "Failed removing systemd lib."
- fi
-
- doinitd "${FILESDIR}"/ipsec
-
- local dir_ugid
- if use non-root; then
- fowners ${UGID}:${UGID} \
- /etc/ipsec.conf \
- /etc/strongswan.conf
-
- dir_ugid="${UGID}"
- else
- dir_ugid="root"
- fi
-
- diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
- dodir /etc/ipsec.d \
- /etc/ipsec.d/aacerts \
- /etc/ipsec.d/acerts \
- /etc/ipsec.d/cacerts \
- /etc/ipsec.d/certs \
- /etc/ipsec.d/crls \
- /etc/ipsec.d/ocspcerts \
- /etc/ipsec.d/private \
- /etc/ipsec.d/reqs
-
- dodoc NEWS README TODO
-
- # shared libs are used only internally and there are no static libs,
- # so it's safe to get rid of the .la files
- find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
-}
-
-pkg_preinst() {
- has_version "<net-vpn/strongswan-4.3.6-r1"
- upgrade_from_leq_4_3_6=$(( !$? ))
-
- has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
- previous_4_3_6_with_caps=$(( !$? ))
-}
-
-pkg_postinst() {
- if ! use openssl && ! use gcrypt; then
- elog
- elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
- elog "Please note that this might effect availability and speed of some"
- elog "cryptographic features. You are advised to enable the OpenSSL plugin."
- elif ! use openssl; then
- elog
- elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
- elog "availability and speed of some cryptographic features. There will be"
- elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
- elog "25, 26) and ECDSA."
- fi
-
- if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
- chmod 0750 "${ROOT}"/etc/ipsec.d \
- "${ROOT}"/etc/ipsec.d/aacerts \
- "${ROOT}"/etc/ipsec.d/acerts \
- "${ROOT}"/etc/ipsec.d/cacerts \
- "${ROOT}"/etc/ipsec.d/certs \
- "${ROOT}"/etc/ipsec.d/crls \
- "${ROOT}"/etc/ipsec.d/ocspcerts \
- "${ROOT}"/etc/ipsec.d/private \
- "${ROOT}"/etc/ipsec.d/reqs
-
- ewarn
- ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
- ewarn "security reasons. Your system installed directories have been"
- ewarn "updated accordingly. Please check if necessary."
- ewarn
-
- if [[ $previous_4_3_6_with_caps == 1 ]]; then
- if ! use non-root; then
- ewarn
- ewarn "IMPORTANT: You previously had ${PN} installed without root"
- ewarn "privileges because it was implied by the 'caps' USE flag."
- ewarn "This has been changed. If you want ${PN} with user privileges,"
- ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
- ewarn
- fi
- fi
- fi
- if ! use caps && ! use non-root; then
- ewarn
- ewarn "You have decided to run ${PN} with root privileges and built it"
- ewarn "without support for POSIX capability dropping. It is generally"
- ewarn "strongly suggested that you reconsider- especially if you intend"
- ewarn "to run ${PN} as server with a public ip address."
- ewarn
- ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
- ewarn
- fi
- if use non-root; then
- elog
- elog "${PN} has been installed without superuser privileges (USE=non-root)."
- elog "This imposes a few limitations mainly to the daemon 'charon' in"
- elog "regards of the use of iptables."
- elog
- elog "Please carefully read: http://wiki.strongswan.org/projects/strongswan/wiki/ReducedPrivileges"
- elog
- elog "Thus if you require to specify a custom updown"
- elog "script to charon which requires superuser privileges, you"
- elog "can work around this limitation by using sudo to grant the"
- elog "user \"ipsec\" the appropriate rights."
- elog "For example (the default case):"
- elog "/etc/sudoers:"
- elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
- elog "Under the specific connection block in /etc/ipsec.conf:"
- elog " leftupdown=\"sudo -E ipsec _updown iptables\""
- elog
- fi
- elog
- elog "Make sure you have _all_ required kernel modules available including"
- elog "the appropriate cryptographic algorithms. A list is available at:"
- elog " https://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
- elog
- elog "The up-to-date manual is available online at:"
- elog " https://wiki.strongswan.org/"
- elog
-}
diff --git a/net-vpn/strongswan/strongswan-5.9.8.ebuild b/net-vpn/strongswan/strongswan-5.9.8.ebuild
deleted file mode 100644
index 18fe386f8b0e..000000000000
--- a/net-vpn/strongswan/strongswan-5.9.8.ebuild
+++ /dev/null
@@ -1,318 +0,0 @@
-# Copyright 1999-2022 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-inherit linux-info systemd
-
-DESCRIPTION="IPsec-based VPN solution, supporting IKEv1/IKEv2 and MOBIKE"
-HOMEPAGE="https://www.strongswan.org/"
-SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
-
-LICENSE="GPL-2 RSA DES"
-SLOT="0"
-KEYWORDS="amd64 arm ~arm64 ~ppc ~ppc64 ~riscv x86"
-IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
-
-STRONGSWAN_PLUGINS_STD="gcm led lookip systime-fix unity vici"
-STRONGSWAN_PLUGINS_OPT_DISABLE="kdf"
-STRONGSWAN_PLUGINS_OPT="addrblock aesni blowfish bypass-lan ccm chapoly ctr error-notify forecast
-ha ipseckey newhope ntru padlock rdrand save-keys unbound whitelist
-xauth-noauth"
-for mod in $STRONGSWAN_PLUGINS_STD; do
- IUSE="${IUSE} +strongswan_plugins_${mod}"
-done
-
-for mod in $STRONGSWAN_PLUGINS_OPT_DISABLE; do
- IUSE="${IUSE} strongswan_plugins_${mod}"
-done
-
-for mod in $STRONGSWAN_PLUGINS_OPT; do
- IUSE="${IUSE} strongswan_plugins_${mod}"
-done
-
-COMMON_DEPEND="non-root? (
- acct-user/ipsec
- acct-group/ipsec
- )
- dev-libs/glib:2
- gmp? ( >=dev-libs/gmp-4.1.5:= )
- gcrypt? ( dev-libs/libgcrypt:= )
- caps? ( sys-libs/libcap )
- curl? ( net-misc/curl )
- ldap? ( net-nds/openldap:= )
- openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist(-)] )
- mysql? ( dev-db/mysql-connector-c:= )
- sqlite? ( >=dev-db/sqlite-3.3.1:3 )
- systemd? ( sys-apps/systemd )
- networkmanager? ( net-misc/networkmanager )
- pam? ( sys-libs/pam )
- strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns:= )"
-
-DEPEND="${COMMON_DEPEND}
- virtual/linux-sources
- sys-kernel/linux-headers"
-
-RDEPEND="${COMMON_DEPEND}
- virtual/logger
- sys-apps/iproute2
- !net-vpn/libreswan
- selinux? ( sec-policy/selinux-ipsec )"
-
-UGID="ipsec"
-
-pkg_setup() {
- linux-info_pkg_setup
-
- elog "Linux kernel version: ${KV_FULL}"
-
- if ! kernel_is -ge 2 6 16; then
- eerror
- eerror "This ebuild currently only supports ${PN} with the"
- eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
- eerror
- fi
-
- if kernel_is -lt 2 6 34; then
- ewarn
- ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
- ewarn
-
- if kernel_is -lt 2 6 29; then
- ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
- ewarn "include all required IPv6 modules even if you just intend"
- ewarn "to run on IPv4 only."
- ewarn
- ewarn "This has been fixed with kernels >= 2.6.29."
- ewarn
- fi
-
- if kernel_is -lt 2 6 33; then
- ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
- ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
- ewarn "miss SHA384 and SHA512 HMAC support altogether."
- ewarn
- ewarn "If you need any of those features, please use kernel >= 2.6.33."
- ewarn
- fi
-
- if kernel_is -lt 2 6 34; then
- ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
- ewarn "ESP cipher is only included in kernels >= 2.6.34."
- ewarn
- ewarn "If you need it, please use kernel >= 2.6.34."
- ewarn
- fi
- fi
-}
-
-src_configure() {
- local myconf=""
-
- if use non-root; then
- myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
- fi
-
- # If a user has already enabled db support, those plugins will
- # most likely be desired as well. Besides they don't impose new
- # dependencies and come at no cost (except for space).
- if use mysql || use sqlite; then
- myconf="${myconf} --enable-attr-sql --enable-sql"
- fi
-
- # strongSwan builds and installs static libs by default which are
- # useless to the user (and to strongSwan for that matter) because no
- # header files or alike get installed... so disabling them is safe.
- if use pam && use eap; then
- myconf="${myconf} --enable-eap-gtc"
- else
- myconf="${myconf} --disable-eap-gtc"
- fi
-
- for mod in $STRONGSWAN_PLUGINS_STD; do
- if use strongswan_plugins_${mod}; then
- myconf+=" --enable-${mod}"
- fi
- done
-
- for mod in $STRONGSWAN_PLUGINS_OPT_DISABLE; do
- if ! use strongswan_plugins_${mod}; then
- myconf+=" --disable-${mod}"
- fi
- done
-
- for mod in $STRONGSWAN_PLUGINS_OPT; do
- if use strongswan_plugins_${mod}; then
- myconf+=" --enable-${mod}"
- fi
- done
-
- econf \
- --disable-static \
- --enable-ikev1 \
- --enable-ikev2 \
- --enable-swanctl \
- --enable-socket-dynamic \
- --enable-cmd \
- $(use_enable curl) \
- $(use_enable constraints) \
- $(use_enable ldap) \
- $(use_enable debug leak-detective) \
- $(use_enable dhcp) \
- $(use_enable eap eap-sim) \
- $(use_enable eap eap-sim-file) \
- $(use_enable eap eap-simaka-sql) \
- $(use_enable eap eap-simaka-pseudonym) \
- $(use_enable eap eap-simaka-reauth) \
- $(use_enable eap eap-identity) \
- $(use_enable eap eap-md5) \
- $(use_enable eap eap-aka) \
- $(use_enable eap eap-aka-3gpp2) \
- $(use_enable eap md4) \
- $(use_enable eap eap-mschapv2) \
- $(use_enable eap eap-radius) \
- $(use_enable eap eap-tls) \
- $(use_enable eap eap-ttls) \
- $(use_enable eap xauth-eap) \
- $(use_enable eap eap-dynamic) \
- $(use_enable farp) \
- $(use_enable gmp) \
- $(use_enable gcrypt) \
- $(use_enable mysql) \
- $(use_enable networkmanager nm) \
- $(use_enable openssl) \
- $(use_enable pam xauth-pam) \
- $(use_enable pkcs11) \
- $(use_enable sqlite) \
- $(use_enable systemd) \
- $(use_with caps capabilities libcap) \
- --with-piddir=/run \
- --with-systemdsystemunitdir="$(systemd_get_systemunitdir)" \
- ${myconf}
-}
-
-src_install() {
- emake DESTDIR="${D}" install
-
- if ! use systemd; then
- rm -rf "${ED}"/lib/systemd || die "Failed removing systemd lib."
- fi
-
- doinitd "${FILESDIR}"/ipsec
-
- local dir_ugid
- if use non-root; then
- fowners ${UGID}:${UGID} \
- /etc/ipsec.conf \
- /etc/strongswan.conf
-
- dir_ugid="${UGID}"
- else
- dir_ugid="root"
- fi
-
- diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
- dodir /etc/ipsec.d \
- /etc/ipsec.d/aacerts \
- /etc/ipsec.d/acerts \
- /etc/ipsec.d/cacerts \
- /etc/ipsec.d/certs \
- /etc/ipsec.d/crls \
- /etc/ipsec.d/ocspcerts \
- /etc/ipsec.d/private \
- /etc/ipsec.d/reqs
-
- dodoc NEWS README TODO
-
- # shared libs are used only internally and there are no static libs,
- # so it's safe to get rid of the .la files
- find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
-}
-
-pkg_preinst() {
- has_version "<net-vpn/strongswan-4.3.6-r1"
- upgrade_from_leq_4_3_6=$(( !$? ))
-
- has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
- previous_4_3_6_with_caps=$(( !$? ))
-}
-
-pkg_postinst() {
- if ! use openssl && ! use gcrypt; then
- elog
- elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
- elog "Please note that this might effect availability and speed of some"
- elog "cryptographic features. You are advised to enable the OpenSSL plugin."
- elif ! use openssl; then
- elog
- elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
- elog "availability and speed of some cryptographic features. There will be"
- elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
- elog "25, 26) and ECDSA."
- fi
-
- if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
- chmod 0750 "${ROOT}"/etc/ipsec.d \
- "${ROOT}"/etc/ipsec.d/aacerts \
- "${ROOT}"/etc/ipsec.d/acerts \
- "${ROOT}"/etc/ipsec.d/cacerts \
- "${ROOT}"/etc/ipsec.d/certs \
- "${ROOT}"/etc/ipsec.d/crls \
- "${ROOT}"/etc/ipsec.d/ocspcerts \
- "${ROOT}"/etc/ipsec.d/private \
- "${ROOT}"/etc/ipsec.d/reqs
-
- ewarn
- ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
- ewarn "security reasons. Your system installed directories have been"
- ewarn "updated accordingly. Please check if necessary."
- ewarn
-
- if [[ $previous_4_3_6_with_caps == 1 ]]; then
- if ! use non-root; then
- ewarn
- ewarn "IMPORTANT: You previously had ${PN} installed without root"
- ewarn "privileges because it was implied by the 'caps' USE flag."
- ewarn "This has been changed. If you want ${PN} with user privileges,"
- ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
- ewarn
- fi
- fi
- fi
- if ! use caps && ! use non-root; then
- ewarn
- ewarn "You have decided to run ${PN} with root privileges and built it"
- ewarn "without support for POSIX capability dropping. It is generally"
- ewarn "strongly suggested that you reconsider- especially if you intend"
- ewarn "to run ${PN} as server with a public ip address."
- ewarn
- ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
- ewarn
- fi
- if use non-root; then
- elog
- elog "${PN} has been installed without superuser privileges (USE=non-root)."
- elog "This imposes a few limitations mainly to the daemon 'charon' in"
- elog "regards of the use of iptables."
- elog
- elog "Please carefully read: http://wiki.strongswan.org/projects/strongswan/wiki/ReducedPrivileges"
- elog
- elog "Thus if you require to specify a custom updown"
- elog "script to charon which requires superuser privileges, you"
- elog "can work around this limitation by using sudo to grant the"
- elog "user \"ipsec\" the appropriate rights."
- elog "For example (the default case):"
- elog "/etc/sudoers:"
- elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
- elog "Under the specific connection block in /etc/ipsec.conf:"
- elog " leftupdown=\"sudo -E ipsec _updown iptables\""
- elog
- fi
- elog
- elog "Make sure you have _all_ required kernel modules available including"
- elog "the appropriate cryptographic algorithms. A list is available at:"
- elog " https://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
- elog
- elog "The up-to-date manual is available online at:"
- elog " https://wiki.strongswan.org/"
- elog
-}
diff --git a/net-vpn/strongswan/strongswan-5.9.9.ebuild b/net-vpn/strongswan/strongswan-5.9.9.ebuild
deleted file mode 100644
index 7737209cacb8..000000000000
--- a/net-vpn/strongswan/strongswan-5.9.9.ebuild
+++ /dev/null
@@ -1,318 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-inherit linux-info systemd
-
-DESCRIPTION="IPsec-based VPN solution, supporting IKEv1/IKEv2 and MOBIKE"
-HOMEPAGE="https://www.strongswan.org/"
-SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
-
-LICENSE="GPL-2 RSA DES"
-SLOT="0"
-KEYWORDS="amd64 arm ~arm64 ~ppc ~ppc64 ~riscv x86"
-IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
-
-STRONGSWAN_PLUGINS_STD="gcm led lookip systime-fix unity vici"
-STRONGSWAN_PLUGINS_OPT_DISABLE="kdf"
-STRONGSWAN_PLUGINS_OPT="addrblock aesni blowfish bypass-lan ccm chapoly ctr error-notify forecast
-ha ipseckey newhope ntru padlock rdrand save-keys unbound whitelist
-xauth-noauth"
-for mod in $STRONGSWAN_PLUGINS_STD; do
- IUSE="${IUSE} +strongswan_plugins_${mod}"
-done
-
-for mod in $STRONGSWAN_PLUGINS_OPT_DISABLE; do
- IUSE="${IUSE} strongswan_plugins_${mod}"
-done
-
-for mod in $STRONGSWAN_PLUGINS_OPT; do
- IUSE="${IUSE} strongswan_plugins_${mod}"
-done
-
-COMMON_DEPEND="non-root? (
- acct-user/ipsec
- acct-group/ipsec
- )
- dev-libs/glib:2
- gmp? ( >=dev-libs/gmp-4.1.5:= )
- gcrypt? ( dev-libs/libgcrypt:= )
- caps? ( sys-libs/libcap )
- curl? ( net-misc/curl )
- ldap? ( net-nds/openldap:= )
- openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist(-)] )
- mysql? ( dev-db/mysql-connector-c:= )
- sqlite? ( >=dev-db/sqlite-3.3.1:3 )
- systemd? ( sys-apps/systemd )
- networkmanager? ( net-misc/networkmanager )
- pam? ( sys-libs/pam )
- strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns:= )"
-
-DEPEND="${COMMON_DEPEND}
- virtual/linux-sources
- sys-kernel/linux-headers"
-
-RDEPEND="${COMMON_DEPEND}
- virtual/logger
- sys-apps/iproute2
- !net-vpn/libreswan
- selinux? ( sec-policy/selinux-ipsec )"
-
-UGID="ipsec"
-
-pkg_setup() {
- linux-info_pkg_setup
-
- elog "Linux kernel version: ${KV_FULL}"
-
- if ! kernel_is -ge 2 6 16; then
- eerror
- eerror "This ebuild currently only supports ${PN} with the"
- eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
- eerror
- fi
-
- if kernel_is -lt 2 6 34; then
- ewarn
- ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
- ewarn
-
- if kernel_is -lt 2 6 29; then
- ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
- ewarn "include all required IPv6 modules even if you just intend"
- ewarn "to run on IPv4 only."
- ewarn
- ewarn "This has been fixed with kernels >= 2.6.29."
- ewarn
- fi
-
- if kernel_is -lt 2 6 33; then
- ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
- ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
- ewarn "miss SHA384 and SHA512 HMAC support altogether."
- ewarn
- ewarn "If you need any of those features, please use kernel >= 2.6.33."
- ewarn
- fi
-
- if kernel_is -lt 2 6 34; then
- ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
- ewarn "ESP cipher is only included in kernels >= 2.6.34."
- ewarn
- ewarn "If you need it, please use kernel >= 2.6.34."
- ewarn
- fi
- fi
-}
-
-src_configure() {
- local myconf=""
-
- if use non-root; then
- myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
- fi
-
- # If a user has already enabled db support, those plugins will
- # most likely be desired as well. Besides they don't impose new
- # dependencies and come at no cost (except for space).
- if use mysql || use sqlite; then
- myconf="${myconf} --enable-attr-sql --enable-sql"
- fi
-
- # strongSwan builds and installs static libs by default which are
- # useless to the user (and to strongSwan for that matter) because no
- # header files or alike get installed... so disabling them is safe.
- if use pam && use eap; then
- myconf="${myconf} --enable-eap-gtc"
- else
- myconf="${myconf} --disable-eap-gtc"
- fi
-
- for mod in $STRONGSWAN_PLUGINS_STD; do
- if use strongswan_plugins_${mod}; then
- myconf+=" --enable-${mod}"
- fi
- done
-
- for mod in $STRONGSWAN_PLUGINS_OPT_DISABLE; do
- if ! use strongswan_plugins_${mod}; then
- myconf+=" --disable-${mod}"
- fi
- done
-
- for mod in $STRONGSWAN_PLUGINS_OPT; do
- if use strongswan_plugins_${mod}; then
- myconf+=" --enable-${mod}"
- fi
- done
-
- econf \
- --disable-static \
- --enable-ikev1 \
- --enable-ikev2 \
- --enable-swanctl \
- --enable-socket-dynamic \
- --enable-cmd \
- $(use_enable curl) \
- $(use_enable constraints) \
- $(use_enable ldap) \
- $(use_enable debug leak-detective) \
- $(use_enable dhcp) \
- $(use_enable eap eap-sim) \
- $(use_enable eap eap-sim-file) \
- $(use_enable eap eap-simaka-sql) \
- $(use_enable eap eap-simaka-pseudonym) \
- $(use_enable eap eap-simaka-reauth) \
- $(use_enable eap eap-identity) \
- $(use_enable eap eap-md5) \
- $(use_enable eap eap-aka) \
- $(use_enable eap eap-aka-3gpp2) \
- $(use_enable eap md4) \
- $(use_enable eap eap-mschapv2) \
- $(use_enable eap eap-radius) \
- $(use_enable eap eap-tls) \
- $(use_enable eap eap-ttls) \
- $(use_enable eap xauth-eap) \
- $(use_enable eap eap-dynamic) \
- $(use_enable farp) \
- $(use_enable gmp) \
- $(use_enable gcrypt) \
- $(use_enable mysql) \
- $(use_enable networkmanager nm) \
- $(use_enable openssl) \
- $(use_enable pam xauth-pam) \
- $(use_enable pkcs11) \
- $(use_enable sqlite) \
- $(use_enable systemd) \
- $(use_with caps capabilities libcap) \
- --with-piddir=/run \
- --with-systemdsystemunitdir="$(systemd_get_systemunitdir)" \
- ${myconf}
-}
-
-src_install() {
- emake DESTDIR="${D}" install
-
- if ! use systemd; then
- rm -rf "${ED}"/lib/systemd || die "Failed removing systemd lib."
- fi
-
- doinitd "${FILESDIR}"/ipsec
-
- local dir_ugid
- if use non-root; then
- fowners ${UGID}:${UGID} \
- /etc/ipsec.conf \
- /etc/strongswan.conf
-
- dir_ugid="${UGID}"
- else
- dir_ugid="root"
- fi
-
- diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
- dodir /etc/ipsec.d \
- /etc/ipsec.d/aacerts \
- /etc/ipsec.d/acerts \
- /etc/ipsec.d/cacerts \
- /etc/ipsec.d/certs \
- /etc/ipsec.d/crls \
- /etc/ipsec.d/ocspcerts \
- /etc/ipsec.d/private \
- /etc/ipsec.d/reqs
-
- dodoc NEWS README TODO
-
- # shared libs are used only internally and there are no static libs,
- # so it's safe to get rid of the .la files
- find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
-}
-
-pkg_preinst() {
- has_version "<net-vpn/strongswan-4.3.6-r1"
- upgrade_from_leq_4_3_6=$(( !$? ))
-
- has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
- previous_4_3_6_with_caps=$(( !$? ))
-}
-
-pkg_postinst() {
- if ! use openssl && ! use gcrypt; then
- elog
- elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
- elog "Please note that this might effect availability and speed of some"
- elog "cryptographic features. You are advised to enable the OpenSSL plugin."
- elif ! use openssl; then
- elog
- elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
- elog "availability and speed of some cryptographic features. There will be"
- elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
- elog "25, 26) and ECDSA."
- fi
-
- if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
- chmod 0750 "${ROOT}"/etc/ipsec.d \
- "${ROOT}"/etc/ipsec.d/aacerts \
- "${ROOT}"/etc/ipsec.d/acerts \
- "${ROOT}"/etc/ipsec.d/cacerts \
- "${ROOT}"/etc/ipsec.d/certs \
- "${ROOT}"/etc/ipsec.d/crls \
- "${ROOT}"/etc/ipsec.d/ocspcerts \
- "${ROOT}"/etc/ipsec.d/private \
- "${ROOT}"/etc/ipsec.d/reqs
-
- ewarn
- ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
- ewarn "security reasons. Your system installed directories have been"
- ewarn "updated accordingly. Please check if necessary."
- ewarn
-
- if [[ $previous_4_3_6_with_caps == 1 ]]; then
- if ! use non-root; then
- ewarn
- ewarn "IMPORTANT: You previously had ${PN} installed without root"
- ewarn "privileges because it was implied by the 'caps' USE flag."
- ewarn "This has been changed. If you want ${PN} with user privileges,"
- ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
- ewarn
- fi
- fi
- fi
- if ! use caps && ! use non-root; then
- ewarn
- ewarn "You have decided to run ${PN} with root privileges and built it"
- ewarn "without support for POSIX capability dropping. It is generally"
- ewarn "strongly suggested that you reconsider- especially if you intend"
- ewarn "to run ${PN} as server with a public ip address."
- ewarn
- ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
- ewarn
- fi
- if use non-root; then
- elog
- elog "${PN} has been installed without superuser privileges (USE=non-root)."
- elog "This imposes a few limitations mainly to the daemon 'charon' in"
- elog "regards of the use of iptables."
- elog
- elog "Please carefully read: http://wiki.strongswan.org/projects/strongswan/wiki/ReducedPrivileges"
- elog
- elog "Thus if you require to specify a custom updown"
- elog "script to charon which requires superuser privileges, you"
- elog "can work around this limitation by using sudo to grant the"
- elog "user \"ipsec\" the appropriate rights."
- elog "For example (the default case):"
- elog "/etc/sudoers:"
- elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
- elog "Under the specific connection block in /etc/ipsec.conf:"
- elog " leftupdown=\"sudo -E ipsec _updown iptables\""
- elog
- fi
- elog
- elog "Make sure you have _all_ required kernel modules available including"
- elog "the appropriate cryptographic algorithms. A list is available at:"
- elog " https://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
- elog
- elog "The up-to-date manual is available online at:"
- elog " https://wiki.strongswan.org/"
- elog
-}
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2023-10-31 12:25 Sam James
0 siblings, 0 replies; 112+ messages in thread
From: Sam James @ 2023-10-31 12:25 UTC (permalink / raw
To: gentoo-commits
commit: bc3da9a7531f23d594106e465ca40c5bc9b2a153
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Tue Oct 31 10:11:44 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Tue Oct 31 12:24:34 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bc3da9a7
net-vpn/strongswan: add github upstream metadata
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-vpn/strongswan/metadata.xml | 1 +
1 file changed, 1 insertion(+)
diff --git a/net-vpn/strongswan/metadata.xml b/net-vpn/strongswan/metadata.xml
index e44bbb6b7298..88d8f2f5f8ec 100644
--- a/net-vpn/strongswan/metadata.xml
+++ b/net-vpn/strongswan/metadata.xml
@@ -59,5 +59,6 @@
</use>
<upstream>
<remote-id type="cpe">cpe:/a:strongswan:strongswan</remote-id>
+ <remote-id type="github">strongswan/strongswan</remote-id>
</upstream>
</pkgmetadata>
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2024-01-16 8:39 Florian Schmaus
0 siblings, 0 replies; 112+ messages in thread
From: Florian Schmaus @ 2024-01-16 8:39 UTC (permalink / raw
To: gentoo-commits
commit: 83f4d5014b588e15b1af20f2a74954bdcd92ffce
Author: Philipp Rösner <rndxelement <AT> protonmail <DOT> com>
AuthorDate: Mon Jan 15 16:46:32 2024 +0000
Commit: Florian Schmaus <flow <AT> gentoo <DOT> org>
CommitDate: Tue Jan 16 08:38:29 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=83f4d501
net-vpn/strongswan: add 5.9.13
Signed-off-by: Philipp Rösner <rndxelement <AT> protonmail.com>
Closes: https://github.com/gentoo/gentoo/pull/34822
Signed-off-by: Florian Schmaus <flow <AT> gentoo.org>
net-vpn/strongswan/Manifest | 1 +
net-vpn/strongswan/strongswan-5.9.13.ebuild | 318 ++++++++++++++++++++++++++++
2 files changed, 319 insertions(+)
diff --git a/net-vpn/strongswan/Manifest b/net-vpn/strongswan/Manifest
index 4c78ad450ad0..237c4e84c9e4 100644
--- a/net-vpn/strongswan/Manifest
+++ b/net-vpn/strongswan/Manifest
@@ -1 +1,2 @@
DIST strongswan-5.9.11.tar.bz2 4786552 BLAKE2B e8e84d79d1530b9a968ce8429fec0e7b3fcf19b75fdbd4371a38763d8564d5b37d012769006330b5c94cff3e914acb1b1a3e2829749effb8c35f9e5d775be491 SHA512 d500523215f5ec5c5550c4d2c49060b350ae396d8c60170792c46775d04fc7a132aa70a6242145477753668351d26ed957e08903683ecc340aa8d84fb2ae5498
+DIST strongswan-5.9.13.tar.bz2 4825644 BLAKE2B 1d60864a557cf14e84c62d4c04ae64eb24331e2576c157b276cf13691ac2a7f5d1b92925e4c3e6ab51dc1f6f64aeb7c60ffb16309673a9f78a73f652cb24da8c SHA512 a929c1fb2a5e7d3064f6cd0be76703198406dad981f4b345311a004c18aa3c12adcb49eb33705fe4c3c31daf556cef5906d8753f5d9fbff5a27b732f93d8f19f
diff --git a/net-vpn/strongswan/strongswan-5.9.13.ebuild b/net-vpn/strongswan/strongswan-5.9.13.ebuild
new file mode 100644
index 000000000000..e8b307487c03
--- /dev/null
+++ b/net-vpn/strongswan/strongswan-5.9.13.ebuild
@@ -0,0 +1,318 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+inherit linux-info systemd
+
+DESCRIPTION="IPsec-based VPN solution, supporting IKEv1/IKEv2 and MOBIKE"
+HOMEPAGE="https://www.strongswan.org/"
+SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
+
+LICENSE="GPL-2 RSA DES"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
+IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
+
+STRONGSWAN_PLUGINS_STD="gcm led lookip systime-fix unity vici"
+STRONGSWAN_PLUGINS_OPT_DISABLE="kdf"
+STRONGSWAN_PLUGINS_OPT="addrblock aesni blowfish bypass-lan ccm chapoly ctr error-notify forecast
+ha ipseckey newhope ntru padlock rdrand save-keys unbound whitelist
+xauth-noauth"
+for mod in $STRONGSWAN_PLUGINS_STD; do
+ IUSE="${IUSE} +strongswan_plugins_${mod}"
+done
+
+for mod in $STRONGSWAN_PLUGINS_OPT_DISABLE; do
+ IUSE="${IUSE} strongswan_plugins_${mod}"
+done
+
+for mod in $STRONGSWAN_PLUGINS_OPT; do
+ IUSE="${IUSE} strongswan_plugins_${mod}"
+done
+
+COMMON_DEPEND="non-root? (
+ acct-user/ipsec
+ acct-group/ipsec
+ )
+ dev-libs/glib:2
+ gmp? ( >=dev-libs/gmp-4.1.5:= )
+ gcrypt? ( dev-libs/libgcrypt:= )
+ caps? ( sys-libs/libcap )
+ curl? ( net-misc/curl )
+ ldap? ( net-nds/openldap:= )
+ openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist(-)] )
+ mysql? ( dev-db/mysql-connector-c:= )
+ sqlite? ( >=dev-db/sqlite-3.3.1:3 )
+ systemd? ( sys-apps/systemd )
+ networkmanager? ( net-misc/networkmanager )
+ pam? ( sys-libs/pam )
+ strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns:= )"
+
+DEPEND="${COMMON_DEPEND}
+ virtual/linux-sources
+ sys-kernel/linux-headers"
+
+RDEPEND="${COMMON_DEPEND}
+ virtual/logger
+ sys-apps/iproute2
+ !net-vpn/libreswan
+ selinux? ( sec-policy/selinux-ipsec )"
+
+UGID="ipsec"
+
+pkg_setup() {
+ linux-info_pkg_setup
+
+ elog "Linux kernel version: ${KV_FULL}"
+
+ if ! kernel_is -ge 2 6 16; then
+ eerror
+ eerror "This ebuild currently only supports ${PN} with the"
+ eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
+ eerror
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn
+ ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
+ ewarn
+
+ if kernel_is -lt 2 6 29; then
+ ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
+ ewarn "include all required IPv6 modules even if you just intend"
+ ewarn "to run on IPv4 only."
+ ewarn
+ ewarn "This has been fixed with kernels >= 2.6.29."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 33; then
+ ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
+ ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
+ ewarn "miss SHA384 and SHA512 HMAC support altogether."
+ ewarn
+ ewarn "If you need any of those features, please use kernel >= 2.6.33."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
+ ewarn "ESP cipher is only included in kernels >= 2.6.34."
+ ewarn
+ ewarn "If you need it, please use kernel >= 2.6.34."
+ ewarn
+ fi
+ fi
+}
+
+src_configure() {
+ local myconf=""
+
+ if use non-root; then
+ myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
+ fi
+
+ # If a user has already enabled db support, those plugins will
+ # most likely be desired as well. Besides they don't impose new
+ # dependencies and come at no cost (except for space).
+ if use mysql || use sqlite; then
+ myconf="${myconf} --enable-attr-sql --enable-sql"
+ fi
+
+ # strongSwan builds and installs static libs by default which are
+ # useless to the user (and to strongSwan for that matter) because no
+ # header files or alike get installed... so disabling them is safe.
+ if use pam && use eap; then
+ myconf="${myconf} --enable-eap-gtc"
+ else
+ myconf="${myconf} --disable-eap-gtc"
+ fi
+
+ for mod in $STRONGSWAN_PLUGINS_STD; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ for mod in $STRONGSWAN_PLUGINS_OPT_DISABLE; do
+ if ! use strongswan_plugins_${mod}; then
+ myconf+=" --disable-${mod}"
+ fi
+ done
+
+ for mod in $STRONGSWAN_PLUGINS_OPT; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ econf \
+ --disable-static \
+ --enable-ikev1 \
+ --enable-ikev2 \
+ --enable-swanctl \
+ --enable-socket-dynamic \
+ --enable-cmd \
+ $(use_enable curl) \
+ $(use_enable constraints) \
+ $(use_enable ldap) \
+ $(use_enable debug leak-detective) \
+ $(use_enable dhcp) \
+ $(use_enable eap eap-sim) \
+ $(use_enable eap eap-sim-file) \
+ $(use_enable eap eap-simaka-sql) \
+ $(use_enable eap eap-simaka-pseudonym) \
+ $(use_enable eap eap-simaka-reauth) \
+ $(use_enable eap eap-identity) \
+ $(use_enable eap eap-md5) \
+ $(use_enable eap eap-aka) \
+ $(use_enable eap eap-aka-3gpp2) \
+ $(use_enable eap md4) \
+ $(use_enable eap eap-mschapv2) \
+ $(use_enable eap eap-radius) \
+ $(use_enable eap eap-tls) \
+ $(use_enable eap eap-ttls) \
+ $(use_enable eap xauth-eap) \
+ $(use_enable eap eap-dynamic) \
+ $(use_enable farp) \
+ $(use_enable gmp) \
+ $(use_enable gcrypt) \
+ $(use_enable mysql) \
+ $(use_enable networkmanager nm) \
+ $(use_enable openssl) \
+ $(use_enable pam xauth-pam) \
+ $(use_enable pkcs11) \
+ $(use_enable sqlite) \
+ $(use_enable systemd) \
+ $(use_with caps capabilities libcap) \
+ --with-piddir=/run \
+ --with-systemdsystemunitdir="$(systemd_get_systemunitdir)" \
+ ${myconf}
+}
+
+src_install() {
+ emake DESTDIR="${D}" install
+
+ if ! use systemd; then
+ rm -rf "${ED}"/lib/systemd || die "Failed removing systemd lib."
+ fi
+
+ doinitd "${FILESDIR}"/ipsec
+
+ local dir_ugid
+ if use non-root; then
+ fowners ${UGID}:${UGID} \
+ /etc/ipsec.conf \
+ /etc/strongswan.conf
+
+ dir_ugid="${UGID}"
+ else
+ dir_ugid="root"
+ fi
+
+ diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
+ dodir /etc/ipsec.d \
+ /etc/ipsec.d/aacerts \
+ /etc/ipsec.d/acerts \
+ /etc/ipsec.d/cacerts \
+ /etc/ipsec.d/certs \
+ /etc/ipsec.d/crls \
+ /etc/ipsec.d/ocspcerts \
+ /etc/ipsec.d/private \
+ /etc/ipsec.d/reqs
+
+ dodoc NEWS README TODO
+
+ # shared libs are used only internally and there are no static libs,
+ # so it's safe to get rid of the .la files
+ find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
+}
+
+pkg_preinst() {
+ has_version "<net-vpn/strongswan-4.3.6-r1"
+ upgrade_from_leq_4_3_6=$(( !$? ))
+
+ has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
+ previous_4_3_6_with_caps=$(( !$? ))
+}
+
+pkg_postinst() {
+ if ! use openssl && ! use gcrypt; then
+ elog
+ elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
+ elog "Please note that this might effect availability and speed of some"
+ elog "cryptographic features. You are advised to enable the OpenSSL plugin."
+ elif ! use openssl; then
+ elog
+ elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
+ elog "availability and speed of some cryptographic features. There will be"
+ elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
+ elog "25, 26) and ECDSA."
+ fi
+
+ if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
+ chmod 0750 "${ROOT}"/etc/ipsec.d \
+ "${ROOT}"/etc/ipsec.d/aacerts \
+ "${ROOT}"/etc/ipsec.d/acerts \
+ "${ROOT}"/etc/ipsec.d/cacerts \
+ "${ROOT}"/etc/ipsec.d/certs \
+ "${ROOT}"/etc/ipsec.d/crls \
+ "${ROOT}"/etc/ipsec.d/ocspcerts \
+ "${ROOT}"/etc/ipsec.d/private \
+ "${ROOT}"/etc/ipsec.d/reqs
+
+ ewarn
+ ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
+ ewarn "security reasons. Your system installed directories have been"
+ ewarn "updated accordingly. Please check if necessary."
+ ewarn
+
+ if [[ $previous_4_3_6_with_caps == 1 ]]; then
+ if ! use non-root; then
+ ewarn
+ ewarn "IMPORTANT: You previously had ${PN} installed without root"
+ ewarn "privileges because it was implied by the 'caps' USE flag."
+ ewarn "This has been changed. If you want ${PN} with user privileges,"
+ ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
+ ewarn
+ fi
+ fi
+ fi
+ if ! use caps && ! use non-root; then
+ ewarn
+ ewarn "You have decided to run ${PN} with root privileges and built it"
+ ewarn "without support for POSIX capability dropping. It is generally"
+ ewarn "strongly suggested that you reconsider- especially if you intend"
+ ewarn "to run ${PN} as server with a public ip address."
+ ewarn
+ ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
+ ewarn
+ fi
+ if use non-root; then
+ elog
+ elog "${PN} has been installed without superuser privileges (USE=non-root)."
+ elog "This imposes a few limitations mainly to the daemon 'charon' in"
+ elog "regards of the use of iptables."
+ elog
+ elog "Please carefully read: http://wiki.strongswan.org/projects/strongswan/wiki/ReducedPrivileges"
+ elog
+ elog "Thus if you require to specify a custom updown"
+ elog "script to charon which requires superuser privileges, you"
+ elog "can work around this limitation by using sudo to grant the"
+ elog "user \"ipsec\" the appropriate rights."
+ elog "For example (the default case):"
+ elog "/etc/sudoers:"
+ elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
+ elog "Under the specific connection block in /etc/ipsec.conf:"
+ elog " leftupdown=\"sudo -E ipsec _updown iptables\""
+ elog
+ fi
+ elog
+ elog "Make sure you have _all_ required kernel modules available including"
+ elog "the appropriate cryptographic algorithms. A list is available at:"
+ elog " https://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
+ elog
+ elog "The up-to-date manual is available online at:"
+ elog " https://wiki.strongswan.org/"
+ elog
+}
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2024-03-12 20:54 Arthur Zamarin
0 siblings, 0 replies; 112+ messages in thread
From: Arthur Zamarin @ 2024-03-12 20:54 UTC (permalink / raw
To: gentoo-commits
commit: 93567fe9e01e57ae975ccf3b01b5855c8a2e28b3
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Tue Mar 12 20:54:51 2024 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Tue Mar 12 20:54:51 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=93567fe9
net-vpn/strongswan: Stabilize 5.9.13 arm, #926852
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.13.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.13.ebuild b/net-vpn/strongswan/strongswan-5.9.13.ebuild
index e8b307487c03..6fa540ecd4a1 100644
--- a/net-vpn/strongswan/strongswan-5.9.13.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.13.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
+KEYWORDS="~amd64 arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="gcm led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2024-03-12 21:04 Arthur Zamarin
0 siblings, 0 replies; 112+ messages in thread
From: Arthur Zamarin @ 2024-03-12 21:04 UTC (permalink / raw
To: gentoo-commits
commit: 39d4505404581f2131dfbd9c1910218795dc4f05
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Tue Mar 12 21:04:30 2024 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Tue Mar 12 21:04:30 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=39d45054
net-vpn/strongswan: Stabilize 5.9.13 amd64, #926852
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.13.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.13.ebuild b/net-vpn/strongswan/strongswan-5.9.13.ebuild
index 6fa540ecd4a1..94bb03b5cd37 100644
--- a/net-vpn/strongswan/strongswan-5.9.13.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.13.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="~amd64 arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
+KEYWORDS="amd64 arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="gcm led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2024-03-12 21:52 Arthur Zamarin
0 siblings, 0 replies; 112+ messages in thread
From: Arthur Zamarin @ 2024-03-12 21:52 UTC (permalink / raw
To: gentoo-commits
commit: b394cf60d4a53031e76967943fedc1183269ba4c
Author: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
AuthorDate: Tue Mar 12 21:52:42 2024 +0000
Commit: Arthur Zamarin <arthurzam <AT> gentoo <DOT> org>
CommitDate: Tue Mar 12 21:52:42 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b394cf60
net-vpn/strongswan: Stabilize 5.9.13 x86, #926852
Signed-off-by: Arthur Zamarin <arthurzam <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.13.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.13.ebuild b/net-vpn/strongswan/strongswan-5.9.13.ebuild
index 94bb03b5cd37..9ff569276908 100644
--- a/net-vpn/strongswan/strongswan-5.9.13.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.13.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="amd64 arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
+KEYWORDS="amd64 arm ~arm64 ~ppc ~ppc64 ~riscv x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="gcm led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2024-04-03 17:38 Florian Schmaus
0 siblings, 0 replies; 112+ messages in thread
From: Florian Schmaus @ 2024-04-03 17:38 UTC (permalink / raw
To: gentoo-commits
commit: 560a183f6613064cbf9a36190290e6ed36dfc186
Author: Dennis Eisele <kernlpanic <AT> dennis-eisele <DOT> de>
AuthorDate: Tue Apr 2 21:34:17 2024 +0000
Commit: Florian Schmaus <flow <AT> gentoo <DOT> org>
CommitDate: Wed Apr 3 17:34:44 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=560a183f
net-vpn/strongswan: version bump to 5.9.14
Signed-off-by: Dennis Eisele <kernlpanic <AT> dennis-eisele.de>
Closes: https://github.com/gentoo/gentoo/pull/36068
Signed-off-by: Florian Schmaus <flow <AT> gentoo.org>
net-vpn/strongswan/Manifest | 1 +
net-vpn/strongswan/strongswan-5.9.14.ebuild | 318 ++++++++++++++++++++++++++++
2 files changed, 319 insertions(+)
diff --git a/net-vpn/strongswan/Manifest b/net-vpn/strongswan/Manifest
index 237c4e84c9e4..de09a60e3900 100644
--- a/net-vpn/strongswan/Manifest
+++ b/net-vpn/strongswan/Manifest
@@ -1,2 +1,3 @@
DIST strongswan-5.9.11.tar.bz2 4786552 BLAKE2B e8e84d79d1530b9a968ce8429fec0e7b3fcf19b75fdbd4371a38763d8564d5b37d012769006330b5c94cff3e914acb1b1a3e2829749effb8c35f9e5d775be491 SHA512 d500523215f5ec5c5550c4d2c49060b350ae396d8c60170792c46775d04fc7a132aa70a6242145477753668351d26ed957e08903683ecc340aa8d84fb2ae5498
DIST strongswan-5.9.13.tar.bz2 4825644 BLAKE2B 1d60864a557cf14e84c62d4c04ae64eb24331e2576c157b276cf13691ac2a7f5d1b92925e4c3e6ab51dc1f6f64aeb7c60ffb16309673a9f78a73f652cb24da8c SHA512 a929c1fb2a5e7d3064f6cd0be76703198406dad981f4b345311a004c18aa3c12adcb49eb33705fe4c3c31daf556cef5906d8753f5d9fbff5a27b732f93d8f19f
+DIST strongswan-5.9.14.tar.bz2 4869709 BLAKE2B 8b64903cfa087d42ae0895e7c11a2fcbd9c6a4a4241548d947753e081a4a4e3c5946e5cf4bbd326840e596e51c61554146f007e6882f11c874454b9480f6f7a6 SHA512 e48bc9d215f9de6b54e24f7b4765d59aec4c615291d5c1f24f6a6d7da45dc8b17b2e0e150faf5fabb35e5d465abc5e6f6efa06cd002467067c5d7844ead359f6
diff --git a/net-vpn/strongswan/strongswan-5.9.14.ebuild b/net-vpn/strongswan/strongswan-5.9.14.ebuild
new file mode 100644
index 000000000000..e8b307487c03
--- /dev/null
+++ b/net-vpn/strongswan/strongswan-5.9.14.ebuild
@@ -0,0 +1,318 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+inherit linux-info systemd
+
+DESCRIPTION="IPsec-based VPN solution, supporting IKEv1/IKEv2 and MOBIKE"
+HOMEPAGE="https://www.strongswan.org/"
+SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
+
+LICENSE="GPL-2 RSA DES"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
+IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
+
+STRONGSWAN_PLUGINS_STD="gcm led lookip systime-fix unity vici"
+STRONGSWAN_PLUGINS_OPT_DISABLE="kdf"
+STRONGSWAN_PLUGINS_OPT="addrblock aesni blowfish bypass-lan ccm chapoly ctr error-notify forecast
+ha ipseckey newhope ntru padlock rdrand save-keys unbound whitelist
+xauth-noauth"
+for mod in $STRONGSWAN_PLUGINS_STD; do
+ IUSE="${IUSE} +strongswan_plugins_${mod}"
+done
+
+for mod in $STRONGSWAN_PLUGINS_OPT_DISABLE; do
+ IUSE="${IUSE} strongswan_plugins_${mod}"
+done
+
+for mod in $STRONGSWAN_PLUGINS_OPT; do
+ IUSE="${IUSE} strongswan_plugins_${mod}"
+done
+
+COMMON_DEPEND="non-root? (
+ acct-user/ipsec
+ acct-group/ipsec
+ )
+ dev-libs/glib:2
+ gmp? ( >=dev-libs/gmp-4.1.5:= )
+ gcrypt? ( dev-libs/libgcrypt:= )
+ caps? ( sys-libs/libcap )
+ curl? ( net-misc/curl )
+ ldap? ( net-nds/openldap:= )
+ openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist(-)] )
+ mysql? ( dev-db/mysql-connector-c:= )
+ sqlite? ( >=dev-db/sqlite-3.3.1:3 )
+ systemd? ( sys-apps/systemd )
+ networkmanager? ( net-misc/networkmanager )
+ pam? ( sys-libs/pam )
+ strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns:= )"
+
+DEPEND="${COMMON_DEPEND}
+ virtual/linux-sources
+ sys-kernel/linux-headers"
+
+RDEPEND="${COMMON_DEPEND}
+ virtual/logger
+ sys-apps/iproute2
+ !net-vpn/libreswan
+ selinux? ( sec-policy/selinux-ipsec )"
+
+UGID="ipsec"
+
+pkg_setup() {
+ linux-info_pkg_setup
+
+ elog "Linux kernel version: ${KV_FULL}"
+
+ if ! kernel_is -ge 2 6 16; then
+ eerror
+ eerror "This ebuild currently only supports ${PN} with the"
+ eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
+ eerror
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn
+ ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
+ ewarn
+
+ if kernel_is -lt 2 6 29; then
+ ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
+ ewarn "include all required IPv6 modules even if you just intend"
+ ewarn "to run on IPv4 only."
+ ewarn
+ ewarn "This has been fixed with kernels >= 2.6.29."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 33; then
+ ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
+ ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
+ ewarn "miss SHA384 and SHA512 HMAC support altogether."
+ ewarn
+ ewarn "If you need any of those features, please use kernel >= 2.6.33."
+ ewarn
+ fi
+
+ if kernel_is -lt 2 6 34; then
+ ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
+ ewarn "ESP cipher is only included in kernels >= 2.6.34."
+ ewarn
+ ewarn "If you need it, please use kernel >= 2.6.34."
+ ewarn
+ fi
+ fi
+}
+
+src_configure() {
+ local myconf=""
+
+ if use non-root; then
+ myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
+ fi
+
+ # If a user has already enabled db support, those plugins will
+ # most likely be desired as well. Besides they don't impose new
+ # dependencies and come at no cost (except for space).
+ if use mysql || use sqlite; then
+ myconf="${myconf} --enable-attr-sql --enable-sql"
+ fi
+
+ # strongSwan builds and installs static libs by default which are
+ # useless to the user (and to strongSwan for that matter) because no
+ # header files or alike get installed... so disabling them is safe.
+ if use pam && use eap; then
+ myconf="${myconf} --enable-eap-gtc"
+ else
+ myconf="${myconf} --disable-eap-gtc"
+ fi
+
+ for mod in $STRONGSWAN_PLUGINS_STD; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ for mod in $STRONGSWAN_PLUGINS_OPT_DISABLE; do
+ if ! use strongswan_plugins_${mod}; then
+ myconf+=" --disable-${mod}"
+ fi
+ done
+
+ for mod in $STRONGSWAN_PLUGINS_OPT; do
+ if use strongswan_plugins_${mod}; then
+ myconf+=" --enable-${mod}"
+ fi
+ done
+
+ econf \
+ --disable-static \
+ --enable-ikev1 \
+ --enable-ikev2 \
+ --enable-swanctl \
+ --enable-socket-dynamic \
+ --enable-cmd \
+ $(use_enable curl) \
+ $(use_enable constraints) \
+ $(use_enable ldap) \
+ $(use_enable debug leak-detective) \
+ $(use_enable dhcp) \
+ $(use_enable eap eap-sim) \
+ $(use_enable eap eap-sim-file) \
+ $(use_enable eap eap-simaka-sql) \
+ $(use_enable eap eap-simaka-pseudonym) \
+ $(use_enable eap eap-simaka-reauth) \
+ $(use_enable eap eap-identity) \
+ $(use_enable eap eap-md5) \
+ $(use_enable eap eap-aka) \
+ $(use_enable eap eap-aka-3gpp2) \
+ $(use_enable eap md4) \
+ $(use_enable eap eap-mschapv2) \
+ $(use_enable eap eap-radius) \
+ $(use_enable eap eap-tls) \
+ $(use_enable eap eap-ttls) \
+ $(use_enable eap xauth-eap) \
+ $(use_enable eap eap-dynamic) \
+ $(use_enable farp) \
+ $(use_enable gmp) \
+ $(use_enable gcrypt) \
+ $(use_enable mysql) \
+ $(use_enable networkmanager nm) \
+ $(use_enable openssl) \
+ $(use_enable pam xauth-pam) \
+ $(use_enable pkcs11) \
+ $(use_enable sqlite) \
+ $(use_enable systemd) \
+ $(use_with caps capabilities libcap) \
+ --with-piddir=/run \
+ --with-systemdsystemunitdir="$(systemd_get_systemunitdir)" \
+ ${myconf}
+}
+
+src_install() {
+ emake DESTDIR="${D}" install
+
+ if ! use systemd; then
+ rm -rf "${ED}"/lib/systemd || die "Failed removing systemd lib."
+ fi
+
+ doinitd "${FILESDIR}"/ipsec
+
+ local dir_ugid
+ if use non-root; then
+ fowners ${UGID}:${UGID} \
+ /etc/ipsec.conf \
+ /etc/strongswan.conf
+
+ dir_ugid="${UGID}"
+ else
+ dir_ugid="root"
+ fi
+
+ diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
+ dodir /etc/ipsec.d \
+ /etc/ipsec.d/aacerts \
+ /etc/ipsec.d/acerts \
+ /etc/ipsec.d/cacerts \
+ /etc/ipsec.d/certs \
+ /etc/ipsec.d/crls \
+ /etc/ipsec.d/ocspcerts \
+ /etc/ipsec.d/private \
+ /etc/ipsec.d/reqs
+
+ dodoc NEWS README TODO
+
+ # shared libs are used only internally and there are no static libs,
+ # so it's safe to get rid of the .la files
+ find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
+}
+
+pkg_preinst() {
+ has_version "<net-vpn/strongswan-4.3.6-r1"
+ upgrade_from_leq_4_3_6=$(( !$? ))
+
+ has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
+ previous_4_3_6_with_caps=$(( !$? ))
+}
+
+pkg_postinst() {
+ if ! use openssl && ! use gcrypt; then
+ elog
+ elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
+ elog "Please note that this might effect availability and speed of some"
+ elog "cryptographic features. You are advised to enable the OpenSSL plugin."
+ elif ! use openssl; then
+ elog
+ elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
+ elog "availability and speed of some cryptographic features. There will be"
+ elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
+ elog "25, 26) and ECDSA."
+ fi
+
+ if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
+ chmod 0750 "${ROOT}"/etc/ipsec.d \
+ "${ROOT}"/etc/ipsec.d/aacerts \
+ "${ROOT}"/etc/ipsec.d/acerts \
+ "${ROOT}"/etc/ipsec.d/cacerts \
+ "${ROOT}"/etc/ipsec.d/certs \
+ "${ROOT}"/etc/ipsec.d/crls \
+ "${ROOT}"/etc/ipsec.d/ocspcerts \
+ "${ROOT}"/etc/ipsec.d/private \
+ "${ROOT}"/etc/ipsec.d/reqs
+
+ ewarn
+ ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
+ ewarn "security reasons. Your system installed directories have been"
+ ewarn "updated accordingly. Please check if necessary."
+ ewarn
+
+ if [[ $previous_4_3_6_with_caps == 1 ]]; then
+ if ! use non-root; then
+ ewarn
+ ewarn "IMPORTANT: You previously had ${PN} installed without root"
+ ewarn "privileges because it was implied by the 'caps' USE flag."
+ ewarn "This has been changed. If you want ${PN} with user privileges,"
+ ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
+ ewarn
+ fi
+ fi
+ fi
+ if ! use caps && ! use non-root; then
+ ewarn
+ ewarn "You have decided to run ${PN} with root privileges and built it"
+ ewarn "without support for POSIX capability dropping. It is generally"
+ ewarn "strongly suggested that you reconsider- especially if you intend"
+ ewarn "to run ${PN} as server with a public ip address."
+ ewarn
+ ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
+ ewarn
+ fi
+ if use non-root; then
+ elog
+ elog "${PN} has been installed without superuser privileges (USE=non-root)."
+ elog "This imposes a few limitations mainly to the daemon 'charon' in"
+ elog "regards of the use of iptables."
+ elog
+ elog "Please carefully read: http://wiki.strongswan.org/projects/strongswan/wiki/ReducedPrivileges"
+ elog
+ elog "Thus if you require to specify a custom updown"
+ elog "script to charon which requires superuser privileges, you"
+ elog "can work around this limitation by using sudo to grant the"
+ elog "user \"ipsec\" the appropriate rights."
+ elog "For example (the default case):"
+ elog "/etc/sudoers:"
+ elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
+ elog "Under the specific connection block in /etc/ipsec.conf:"
+ elog " leftupdown=\"sudo -E ipsec _updown iptables\""
+ elog
+ fi
+ elog
+ elog "Make sure you have _all_ required kernel modules available including"
+ elog "the appropriate cryptographic algorithms. A list is available at:"
+ elog " https://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
+ elog
+ elog "The up-to-date manual is available online at:"
+ elog " https://wiki.strongswan.org/"
+ elog
+}
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2024-04-06 4:47 Sam James
0 siblings, 0 replies; 112+ messages in thread
From: Sam James @ 2024-04-06 4:47 UTC (permalink / raw
To: gentoo-commits
commit: 65de42ca7bb87bd386d11074fe4ff9b65bdeda96
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Sat Apr 6 04:47:37 2024 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Sat Apr 6 04:47:37 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=65de42ca
net-vpn/strongswan: Stabilize 5.9.14 arm, #928650
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.14.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.14.ebuild b/net-vpn/strongswan/strongswan-5.9.14.ebuild
index e8b307487c03..6fa540ecd4a1 100644
--- a/net-vpn/strongswan/strongswan-5.9.14.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.14.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
+KEYWORDS="~amd64 arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="gcm led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2024-04-06 6:09 Joonas Niilola
0 siblings, 0 replies; 112+ messages in thread
From: Joonas Niilola @ 2024-04-06 6:09 UTC (permalink / raw
To: gentoo-commits
commit: 387d86b4184984c7dda95bbf6bea613f88cb72ef
Author: Joonas Niilola <juippis <AT> gentoo <DOT> org>
AuthorDate: Sat Apr 6 06:08:41 2024 +0000
Commit: Joonas Niilola <juippis <AT> gentoo <DOT> org>
CommitDate: Sat Apr 6 06:08:41 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=387d86b4
net-vpn/strongswan: Stabilize 5.9.14 amd64, #928650
Signed-off-by: Joonas Niilola <juippis <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.14.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.14.ebuild b/net-vpn/strongswan/strongswan-5.9.14.ebuild
index 6fa540ecd4a1..94bb03b5cd37 100644
--- a/net-vpn/strongswan/strongswan-5.9.14.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.14.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="~amd64 arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
+KEYWORDS="amd64 arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="gcm led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2024-04-06 6:09 Joonas Niilola
0 siblings, 0 replies; 112+ messages in thread
From: Joonas Niilola @ 2024-04-06 6:09 UTC (permalink / raw
To: gentoo-commits
commit: c054d829d68957eb7f5b2e64d54e834be8a569e7
Author: Joonas Niilola <juippis <AT> gentoo <DOT> org>
AuthorDate: Sat Apr 6 06:08:57 2024 +0000
Commit: Joonas Niilola <juippis <AT> gentoo <DOT> org>
CommitDate: Sat Apr 6 06:08:57 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c054d829
net-vpn/strongswan: Stabilize 5.9.14 x86, #928650
Signed-off-by: Joonas Niilola <juippis <AT> gentoo.org>
net-vpn/strongswan/strongswan-5.9.14.ebuild | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net-vpn/strongswan/strongswan-5.9.14.ebuild b/net-vpn/strongswan/strongswan-5.9.14.ebuild
index 94bb03b5cd37..9ff569276908 100644
--- a/net-vpn/strongswan/strongswan-5.9.14.ebuild
+++ b/net-vpn/strongswan/strongswan-5.9.14.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
LICENSE="GPL-2 RSA DES"
SLOT="0"
-KEYWORDS="amd64 arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
+KEYWORDS="amd64 arm ~arm64 ~ppc ~ppc64 ~riscv x86"
IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
STRONGSWAN_PLUGINS_STD="gcm led lookip systime-fix unity vici"
^ permalink raw reply related [flat|nested] 112+ messages in thread
* [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/
@ 2024-07-06 4:58 John Helmert III
0 siblings, 0 replies; 112+ messages in thread
From: John Helmert III @ 2024-07-06 4:58 UTC (permalink / raw
To: gentoo-commits
commit: 341486cf27f6090c2ac643374be6bb20cfec1f35
Author: John Helmert III <ajak <AT> gentoo <DOT> org>
AuthorDate: Sat Jul 6 04:57:23 2024 +0000
Commit: John Helmert III <ajak <AT> gentoo <DOT> org>
CommitDate: Sat Jul 6 04:58:37 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=341486cf
net-vpn/strongswan: drop 5.9.11
Bug: https://bugs.gentoo.org/920105
Signed-off-by: John Helmert III <ajak <AT> gentoo.org>
net-vpn/strongswan/Manifest | 1 -
net-vpn/strongswan/strongswan-5.9.11.ebuild | 318 ----------------------------
2 files changed, 319 deletions(-)
diff --git a/net-vpn/strongswan/Manifest b/net-vpn/strongswan/Manifest
index de09a60e3900..f81055f2dfa1 100644
--- a/net-vpn/strongswan/Manifest
+++ b/net-vpn/strongswan/Manifest
@@ -1,3 +1,2 @@
-DIST strongswan-5.9.11.tar.bz2 4786552 BLAKE2B e8e84d79d1530b9a968ce8429fec0e7b3fcf19b75fdbd4371a38763d8564d5b37d012769006330b5c94cff3e914acb1b1a3e2829749effb8c35f9e5d775be491 SHA512 d500523215f5ec5c5550c4d2c49060b350ae396d8c60170792c46775d04fc7a132aa70a6242145477753668351d26ed957e08903683ecc340aa8d84fb2ae5498
DIST strongswan-5.9.13.tar.bz2 4825644 BLAKE2B 1d60864a557cf14e84c62d4c04ae64eb24331e2576c157b276cf13691ac2a7f5d1b92925e4c3e6ab51dc1f6f64aeb7c60ffb16309673a9f78a73f652cb24da8c SHA512 a929c1fb2a5e7d3064f6cd0be76703198406dad981f4b345311a004c18aa3c12adcb49eb33705fe4c3c31daf556cef5906d8753f5d9fbff5a27b732f93d8f19f
DIST strongswan-5.9.14.tar.bz2 4869709 BLAKE2B 8b64903cfa087d42ae0895e7c11a2fcbd9c6a4a4241548d947753e081a4a4e3c5946e5cf4bbd326840e596e51c61554146f007e6882f11c874454b9480f6f7a6 SHA512 e48bc9d215f9de6b54e24f7b4765d59aec4c615291d5c1f24f6a6d7da45dc8b17b2e0e150faf5fabb35e5d465abc5e6f6efa06cd002467067c5d7844ead359f6
diff --git a/net-vpn/strongswan/strongswan-5.9.11.ebuild b/net-vpn/strongswan/strongswan-5.9.11.ebuild
deleted file mode 100644
index 7737209cacb8..000000000000
--- a/net-vpn/strongswan/strongswan-5.9.11.ebuild
+++ /dev/null
@@ -1,318 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-inherit linux-info systemd
-
-DESCRIPTION="IPsec-based VPN solution, supporting IKEv1/IKEv2 and MOBIKE"
-HOMEPAGE="https://www.strongswan.org/"
-SRC_URI="https://download.strongswan.org/${P}.tar.bz2"
-
-LICENSE="GPL-2 RSA DES"
-SLOT="0"
-KEYWORDS="amd64 arm ~arm64 ~ppc ~ppc64 ~riscv x86"
-IUSE="+caps curl +constraints debug dhcp eap farp gcrypt +gmp ldap mysql networkmanager +non-root +openssl selinux sqlite systemd pam pkcs11"
-
-STRONGSWAN_PLUGINS_STD="gcm led lookip systime-fix unity vici"
-STRONGSWAN_PLUGINS_OPT_DISABLE="kdf"
-STRONGSWAN_PLUGINS_OPT="addrblock aesni blowfish bypass-lan ccm chapoly ctr error-notify forecast
-ha ipseckey newhope ntru padlock rdrand save-keys unbound whitelist
-xauth-noauth"
-for mod in $STRONGSWAN_PLUGINS_STD; do
- IUSE="${IUSE} +strongswan_plugins_${mod}"
-done
-
-for mod in $STRONGSWAN_PLUGINS_OPT_DISABLE; do
- IUSE="${IUSE} strongswan_plugins_${mod}"
-done
-
-for mod in $STRONGSWAN_PLUGINS_OPT; do
- IUSE="${IUSE} strongswan_plugins_${mod}"
-done
-
-COMMON_DEPEND="non-root? (
- acct-user/ipsec
- acct-group/ipsec
- )
- dev-libs/glib:2
- gmp? ( >=dev-libs/gmp-4.1.5:= )
- gcrypt? ( dev-libs/libgcrypt:= )
- caps? ( sys-libs/libcap )
- curl? ( net-misc/curl )
- ldap? ( net-nds/openldap:= )
- openssl? ( >=dev-libs/openssl-0.9.8:=[-bindist(-)] )
- mysql? ( dev-db/mysql-connector-c:= )
- sqlite? ( >=dev-db/sqlite-3.3.1:3 )
- systemd? ( sys-apps/systemd )
- networkmanager? ( net-misc/networkmanager )
- pam? ( sys-libs/pam )
- strongswan_plugins_unbound? ( net-dns/unbound:= net-libs/ldns:= )"
-
-DEPEND="${COMMON_DEPEND}
- virtual/linux-sources
- sys-kernel/linux-headers"
-
-RDEPEND="${COMMON_DEPEND}
- virtual/logger
- sys-apps/iproute2
- !net-vpn/libreswan
- selinux? ( sec-policy/selinux-ipsec )"
-
-UGID="ipsec"
-
-pkg_setup() {
- linux-info_pkg_setup
-
- elog "Linux kernel version: ${KV_FULL}"
-
- if ! kernel_is -ge 2 6 16; then
- eerror
- eerror "This ebuild currently only supports ${PN} with the"
- eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
- eerror
- fi
-
- if kernel_is -lt 2 6 34; then
- ewarn
- ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
- ewarn
-
- if kernel_is -lt 2 6 29; then
- ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
- ewarn "include all required IPv6 modules even if you just intend"
- ewarn "to run on IPv4 only."
- ewarn
- ewarn "This has been fixed with kernels >= 2.6.29."
- ewarn
- fi
-
- if kernel_is -lt 2 6 33; then
- ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
- ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
- ewarn "miss SHA384 and SHA512 HMAC support altogether."
- ewarn
- ewarn "If you need any of those features, please use kernel >= 2.6.33."
- ewarn
- fi
-
- if kernel_is -lt 2 6 34; then
- ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
- ewarn "ESP cipher is only included in kernels >= 2.6.34."
- ewarn
- ewarn "If you need it, please use kernel >= 2.6.34."
- ewarn
- fi
- fi
-}
-
-src_configure() {
- local myconf=""
-
- if use non-root; then
- myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
- fi
-
- # If a user has already enabled db support, those plugins will
- # most likely be desired as well. Besides they don't impose new
- # dependencies and come at no cost (except for space).
- if use mysql || use sqlite; then
- myconf="${myconf} --enable-attr-sql --enable-sql"
- fi
-
- # strongSwan builds and installs static libs by default which are
- # useless to the user (and to strongSwan for that matter) because no
- # header files or alike get installed... so disabling them is safe.
- if use pam && use eap; then
- myconf="${myconf} --enable-eap-gtc"
- else
- myconf="${myconf} --disable-eap-gtc"
- fi
-
- for mod in $STRONGSWAN_PLUGINS_STD; do
- if use strongswan_plugins_${mod}; then
- myconf+=" --enable-${mod}"
- fi
- done
-
- for mod in $STRONGSWAN_PLUGINS_OPT_DISABLE; do
- if ! use strongswan_plugins_${mod}; then
- myconf+=" --disable-${mod}"
- fi
- done
-
- for mod in $STRONGSWAN_PLUGINS_OPT; do
- if use strongswan_plugins_${mod}; then
- myconf+=" --enable-${mod}"
- fi
- done
-
- econf \
- --disable-static \
- --enable-ikev1 \
- --enable-ikev2 \
- --enable-swanctl \
- --enable-socket-dynamic \
- --enable-cmd \
- $(use_enable curl) \
- $(use_enable constraints) \
- $(use_enable ldap) \
- $(use_enable debug leak-detective) \
- $(use_enable dhcp) \
- $(use_enable eap eap-sim) \
- $(use_enable eap eap-sim-file) \
- $(use_enable eap eap-simaka-sql) \
- $(use_enable eap eap-simaka-pseudonym) \
- $(use_enable eap eap-simaka-reauth) \
- $(use_enable eap eap-identity) \
- $(use_enable eap eap-md5) \
- $(use_enable eap eap-aka) \
- $(use_enable eap eap-aka-3gpp2) \
- $(use_enable eap md4) \
- $(use_enable eap eap-mschapv2) \
- $(use_enable eap eap-radius) \
- $(use_enable eap eap-tls) \
- $(use_enable eap eap-ttls) \
- $(use_enable eap xauth-eap) \
- $(use_enable eap eap-dynamic) \
- $(use_enable farp) \
- $(use_enable gmp) \
- $(use_enable gcrypt) \
- $(use_enable mysql) \
- $(use_enable networkmanager nm) \
- $(use_enable openssl) \
- $(use_enable pam xauth-pam) \
- $(use_enable pkcs11) \
- $(use_enable sqlite) \
- $(use_enable systemd) \
- $(use_with caps capabilities libcap) \
- --with-piddir=/run \
- --with-systemdsystemunitdir="$(systemd_get_systemunitdir)" \
- ${myconf}
-}
-
-src_install() {
- emake DESTDIR="${D}" install
-
- if ! use systemd; then
- rm -rf "${ED}"/lib/systemd || die "Failed removing systemd lib."
- fi
-
- doinitd "${FILESDIR}"/ipsec
-
- local dir_ugid
- if use non-root; then
- fowners ${UGID}:${UGID} \
- /etc/ipsec.conf \
- /etc/strongswan.conf
-
- dir_ugid="${UGID}"
- else
- dir_ugid="root"
- fi
-
- diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
- dodir /etc/ipsec.d \
- /etc/ipsec.d/aacerts \
- /etc/ipsec.d/acerts \
- /etc/ipsec.d/cacerts \
- /etc/ipsec.d/certs \
- /etc/ipsec.d/crls \
- /etc/ipsec.d/ocspcerts \
- /etc/ipsec.d/private \
- /etc/ipsec.d/reqs
-
- dodoc NEWS README TODO
-
- # shared libs are used only internally and there are no static libs,
- # so it's safe to get rid of the .la files
- find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
-}
-
-pkg_preinst() {
- has_version "<net-vpn/strongswan-4.3.6-r1"
- upgrade_from_leq_4_3_6=$(( !$? ))
-
- has_version "<net-vpn/strongswan-4.3.6-r1[-caps]"
- previous_4_3_6_with_caps=$(( !$? ))
-}
-
-pkg_postinst() {
- if ! use openssl && ! use gcrypt; then
- elog
- elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
- elog "Please note that this might effect availability and speed of some"
- elog "cryptographic features. You are advised to enable the OpenSSL plugin."
- elif ! use openssl; then
- elog
- elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
- elog "availability and speed of some cryptographic features. There will be"
- elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
- elog "25, 26) and ECDSA."
- fi
-
- if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
- chmod 0750 "${ROOT}"/etc/ipsec.d \
- "${ROOT}"/etc/ipsec.d/aacerts \
- "${ROOT}"/etc/ipsec.d/acerts \
- "${ROOT}"/etc/ipsec.d/cacerts \
- "${ROOT}"/etc/ipsec.d/certs \
- "${ROOT}"/etc/ipsec.d/crls \
- "${ROOT}"/etc/ipsec.d/ocspcerts \
- "${ROOT}"/etc/ipsec.d/private \
- "${ROOT}"/etc/ipsec.d/reqs
-
- ewarn
- ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
- ewarn "security reasons. Your system installed directories have been"
- ewarn "updated accordingly. Please check if necessary."
- ewarn
-
- if [[ $previous_4_3_6_with_caps == 1 ]]; then
- if ! use non-root; then
- ewarn
- ewarn "IMPORTANT: You previously had ${PN} installed without root"
- ewarn "privileges because it was implied by the 'caps' USE flag."
- ewarn "This has been changed. If you want ${PN} with user privileges,"
- ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
- ewarn
- fi
- fi
- fi
- if ! use caps && ! use non-root; then
- ewarn
- ewarn "You have decided to run ${PN} with root privileges and built it"
- ewarn "without support for POSIX capability dropping. It is generally"
- ewarn "strongly suggested that you reconsider- especially if you intend"
- ewarn "to run ${PN} as server with a public ip address."
- ewarn
- ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
- ewarn
- fi
- if use non-root; then
- elog
- elog "${PN} has been installed without superuser privileges (USE=non-root)."
- elog "This imposes a few limitations mainly to the daemon 'charon' in"
- elog "regards of the use of iptables."
- elog
- elog "Please carefully read: http://wiki.strongswan.org/projects/strongswan/wiki/ReducedPrivileges"
- elog
- elog "Thus if you require to specify a custom updown"
- elog "script to charon which requires superuser privileges, you"
- elog "can work around this limitation by using sudo to grant the"
- elog "user \"ipsec\" the appropriate rights."
- elog "For example (the default case):"
- elog "/etc/sudoers:"
- elog " ipsec ALL=(ALL) NOPASSWD: SETENV: /usr/sbin/ipsec"
- elog "Under the specific connection block in /etc/ipsec.conf:"
- elog " leftupdown=\"sudo -E ipsec _updown iptables\""
- elog
- fi
- elog
- elog "Make sure you have _all_ required kernel modules available including"
- elog "the appropriate cryptographic algorithms. A list is available at:"
- elog " https://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
- elog
- elog "The up-to-date manual is available online at:"
- elog " https://wiki.strongswan.org/"
- elog
-}
^ permalink raw reply related [flat|nested] 112+ messages in thread
end of thread, other threads:[~2024-07-06 4:58 UTC | newest]
Thread overview: 112+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-12-04 6:52 [gentoo-commits] repo/gentoo:master commit in: net-vpn/strongswan/ Joonas Niilola
-- strict thread matches above, loose matches on Subject: below --
2024-07-06 4:58 John Helmert III
2024-04-06 6:09 Joonas Niilola
2024-04-06 6:09 Joonas Niilola
2024-04-06 4:47 Sam James
2024-04-03 17:38 Florian Schmaus
2024-03-12 21:52 Arthur Zamarin
2024-03-12 21:04 Arthur Zamarin
2024-03-12 20:54 Arthur Zamarin
2024-01-16 8:39 Florian Schmaus
2023-10-31 12:25 Sam James
2023-10-08 21:51 Conrad Kostecki
2023-10-04 7:49 Joonas Niilola
2023-10-03 14:15 Sam James
2023-10-03 14:15 Sam James
2023-06-28 21:11 Sam James
2023-04-19 5:28 Sam James
2023-04-19 5:28 Sam James
2023-04-19 5:28 Sam James
2023-03-30 17:22 Arthur Zamarin
2023-03-17 18:25 Sam James
2023-03-14 23:14 Conrad Kostecki
2023-01-09 8:44 Florian Schmaus
2022-12-04 18:08 Arthur Zamarin
2022-12-04 6:52 Joonas Niilola
2022-11-02 5:11 Jakov Smolić
2022-10-05 7:46 Florian Schmaus
2022-10-05 7:46 Florian Schmaus
2022-10-05 6:46 Agostino Sarubbo
2022-10-05 6:14 Joonas Niilola
2022-10-05 6:14 Joonas Niilola
2022-08-16 7:44 Agostino Sarubbo
2022-08-16 5:50 Joonas Niilola
2022-08-16 5:50 Joonas Niilola
2022-08-10 8:20 Florian Schmaus
2022-06-29 15:35 Florian Schmaus
2022-05-06 10:04 Florian Schmaus
2022-05-06 10:04 Florian Schmaus
2022-02-02 15:23 Jakov Smolić
2022-02-02 9:47 Sam James
2022-02-02 8:04 Agostino Sarubbo
2022-02-02 8:02 Agostino Sarubbo
2022-01-28 7:53 Sam James
2022-01-27 15:32 Florian Schmaus
2022-01-12 8:25 Florian Schmaus
2022-01-07 15:06 Florian Schmaus
2022-01-06 18:33 Florian Schmaus
2022-01-06 18:33 Florian Schmaus
2022-01-02 14:15 Florian Schmaus
2022-01-02 14:15 Florian Schmaus
2021-06-17 22:18 Thomas Deutschmann
2021-06-17 22:18 Thomas Deutschmann
2021-06-17 20:32 Thomas Deutschmann
2021-06-07 6:25 Sergei Trofimovich
2021-06-03 8:23 Sam James
2021-06-03 0:45 Sam James
2021-06-01 0:46 Sam James
2021-05-31 20:45 David Seifert
2021-03-27 1:08 Thomas Deutschmann
2021-02-16 12:34 Sam James
2021-02-11 9:31 Sam James
2021-02-06 15:39 Sam James
2021-02-05 12:31 Sam James
2020-11-15 16:33 Thomas Deutschmann
2020-11-15 16:33 Thomas Deutschmann
2020-10-07 7:09 Agostino Sarubbo
2020-10-07 6:50 Agostino Sarubbo
2020-10-07 6:42 Agostino Sarubbo
2020-10-06 17:26 Sam James
2020-08-31 4:07 Sam James
2020-08-18 11:22 Agostino Sarubbo
2020-08-17 7:01 Agostino Sarubbo
2020-08-15 17:48 Sam James
2020-08-11 17:33 Thomas Deutschmann
2020-08-11 8:24 Sam James
2020-05-03 19:01 Thomas Deutschmann
2019-12-24 15:07 Thomas Deutschmann
2019-12-24 15:07 Thomas Deutschmann
2019-12-24 14:49 Mikle Kolyada
2019-12-15 18:03 Agostino Sarubbo
2019-12-15 14:07 Agostino Sarubbo
2019-12-15 13:43 Agostino Sarubbo
2019-10-20 20:20 Thomas Deutschmann
2019-04-30 10:26 Thomas Deutschmann
2019-03-10 14:19 Mikle Kolyada
2019-03-03 11:59 Mikle Kolyada
2019-03-02 20:49 Thomas Deutschmann
2019-03-02 20:02 Sergei Trofimovich
2019-01-06 21:57 Thomas Deutschmann
2018-11-15 12:35 Thomas Deutschmann
2018-11-07 22:59 Sergei Trofimovich
2018-10-31 17:17 Markus Meier
2018-10-18 11:31 Thomas Deutschmann
2018-10-17 16:10 Agostino Sarubbo
2018-10-17 10:19 Thomas Deutschmann
2018-10-17 10:05 Thomas Deutschmann
2018-09-14 22:13 Thomas Deutschmann
2018-09-02 19:24 Thomas Deutschmann
2018-03-13 11:59 Pacho Ramos
2018-03-03 22:16 Sergei Trofimovich
2018-02-24 15:17 Patrick Lauer
2018-02-05 21:27 Markus Meier
2018-01-26 18:21 Thomas Deutschmann
2018-01-23 16:41 Agostino Sarubbo
2017-11-26 23:23 David Seifert
2017-09-25 13:22 Patrick Lauer
2017-09-24 17:31 Patrick Lauer
2017-07-16 0:19 Aaron Bauman
2017-06-23 4:38 Markus Meier
2017-06-18 14:01 Agostino Sarubbo
2017-06-02 15:36 Bjarke Istrup Pedersen
2017-06-02 12:23 Bjarke Istrup Pedersen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox