[ptxdist] [PATCHv3 0/3] openvpn: cleanups, extras and version bumps

[ptxdist] [PATCHv3 0/3] openvpn: cleanups, extras and version bumps

[Alexander Aring]

This patch series contains some cleanups and version bumps for openvpn.

Some points which I detected and can be improved:

- Easy-rsa contains support for programming smartcards.
  This tool isn't ported yet, because I don't have fancy
  programmable (hackable) smartcards.

I mainly "test" it to run a bridged network into my local area network.
Description how to setup such thing is available at:

https://openvpn.net/index.php/open-source/documentation/miscellaneous/76-ethernet-bridging.html

- Alex

changes since v3:
 - easy-rsa: add "if RUNTIME" to OPENSSL and OPENSSL_BIN
 - easy-rsa: remove openssl-0.9.6.cnf openssl-0.9.8.cnf - file
   openssl-1.0.0.cnf is still needed. Sorry I thought this would be an
   alternative config for /usr/lib/openssl.cnf :D
 - openssl: change to install_alternative the openssl.cnf
 - openvpn: move build dependencies into OPENVPN select statements
 - openvpn: add more "if RUNTIME" to all others tools which are called
   by execve(2) while running openvpn. That's why we need to add all
   absolute paths while configure.

changes since v2:
 - fix openvpn depends on to select
 - make the same fix for openvpn also for easy-rsa with GREP and BUSYBOX_GREP
 - install openssl.cnf per default without an option
   - changes commit msg of openssl.cnf patch according to the changes
 - add description into cover letter what I tested now

Alexander Aring (3):
  openssl: allow to install openssl.cnf
  easy-rsa: initial commit
  openvpn: rework and version bump

 patches/easy-rsa-2.2.2/autogen.sh |  1 +
 rules/easy-rsa.in                 | 17 +++++++++++
 rules/easy-rsa.make               | 62 +++++++++++++++++++++++++++++++++++++++
 rules/openssl.make                |  4 +++
 rules/openvpn.in                  | 29 +++++++++++++++++-
 rules/openvpn.make                | 59 +++++++++++++++++++++++++++++--------
 6 files changed, 159 insertions(+), 13 deletions(-)
 create mode 120000 patches/easy-rsa-2.2.2/autogen.sh
 create mode 100644 rules/easy-rsa.in
 create mode 100644 rules/easy-rsa.make

-- 
2.2.2


-- 
ptxdist mailing list
ptxdist@pengutronix.de

[ptxdist] [PATCHv3 1/3] openssl: allow to install openssl.cnf

[Alexander Aring]

For doing some certificates magic the openssl tool requires some
openssl.cnf file. This patch adds support to install the default
shipped openssl.cnf file.

Signed-off-by: Alexander Aring <alex.aring@gmail.com>
---
 rules/openssl.make | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/rules/openssl.make b/rules/openssl.make
index 50039c7..4a9795c 100644
--- a/rules/openssl.make
+++ b/rules/openssl.make
@@ -100,6 +100,10 @@ ifdef PTXCONF_OPENSSL_BIN
 	@$(call install_copy, openssl, 0, 0, 0755, -, \
 		/usr/bin/openssl)
 endif
+
+	@$(call install_alternative, openssl, 0, 0, 0644, \
+		/usr/lib/ssl/openssl.cnf)
+
 	@$(call install_lib, openssl, 0, 0, 0644, libssl)
 	@$(call install_lib, openssl, 0, 0, 0644, libcrypto)
 
-- 
2.2.2


-- 
ptxdist mailing list
ptxdist@pengutronix.de

[ptxdist] [PATCHv3 2/3] easy-rsa: initial commit

[Alexander Aring]

This patch adds easy-rsa. Some scripting framework to generate a PKI
CA "correctly".

Signed-off-by: Alexander Aring <alex.aring@gmail.com>
---
 patches/easy-rsa-2.2.2/autogen.sh |  1 +
 rules/easy-rsa.in                 | 17 +++++++++++
 rules/easy-rsa.make               | 62 +++++++++++++++++++++++++++++++++++++++
 3 files changed, 80 insertions(+)
 create mode 120000 patches/easy-rsa-2.2.2/autogen.sh
 create mode 100644 rules/easy-rsa.in
 create mode 100644 rules/easy-rsa.make

diff --git a/patches/easy-rsa-2.2.2/autogen.sh b/patches/easy-rsa-2.2.2/autogen.sh
new file mode 120000
index 0000000..9f8a4cb
--- /dev/null
+++ b/patches/easy-rsa-2.2.2/autogen.sh
@@ -0,0 +1 @@
+../autogen.sh
\ No newline at end of file
diff --git a/rules/easy-rsa.in b/rules/easy-rsa.in
new file mode 100644
index 0000000..282fb9a
--- /dev/null
+++ b/rules/easy-rsa.in
@@ -0,0 +1,17 @@
+## SECTION=security
+
+config EASY_RSA
+	tristate
+	prompt "easy-rsa"
+	select GREP		if !BUSYBOX_GREP && RUNTIME
+	select GCCLIBS_GCC_S	if !BUSYBOX_GREP && RUNTIME
+	select OPENSSL		if RUNTIME
+	select OPENSSL_BIN	if RUNTIME
+	help
+	  easy-rsa is a CLI utility to build and manage a PKI CA. In laymen's
+	  terms, this means to create a root certificate authority, and request
+	  and sign certificates, including sub-CAs and certificate revokation
+	  lists (CRL). This is for people which don't know how to generate
+	  all PKI files with openssl tool. Additional this is for people which
+	  have a enough less paranoia to generate keys on an embedded device.
+	  The easy-rsa scripts will be placed at /usr/share/easy-rsa aferwards.
diff --git a/rules/easy-rsa.make b/rules/easy-rsa.make
new file mode 100644
index 0000000..05c3f0c
--- /dev/null
+++ b/rules/easy-rsa.make
@@ -0,0 +1,62 @@
+# -*-makefile-*-
+#
+# Copyright (C) 2014 by Alexander Aring <aar@pengutronix.de>
+#
+# See CREDITS for details about who has contributed to this project.
+#
+# For further information about the PTXdist project and license conditions
+# see the README file.
+#
+
+#
+# We provide this package
+#
+PACKAGES-$(PTXCONF_EASY_RSA) += easy-rsa
+
+#
+# Paths and names
+#
+EASY_RSA_VERSION	:= 2.2.2
+EASY_RSA_MD5		:= 040238338980617bc9c2df4274349593
+EASY_RSA		:= easy-rsa-$(EASY_RSA_VERSION)
+EASY_RSA_SUFFIX		:= tar.gz
+EASY_RSA_TARBALL	:= $(EASY_RSA_VERSION).$(EASY_RSA_SUFFIX)
+EASY_RSA_URL		:= https://github.com/OpenVPN/easy-rsa/archive/$(EASY_RSA_TARBALL)
+EASY_RSA_SOURCE		:= $(SRCDIR)/$(EASY_RSA).$(EASY_RSA_SUFFIX)
+EASY_RSA_DIR		:= $(BUILDDIR)/$(EASY_RSA)
+EASY_RSA_LICENSE	:= GPLv2
+
+EASY_RSA_INSTALL_SCRIPTS := \
+	build-ca build-dh build-inter build-key build-key-pass build-key-pkcs12 \
+	build-key-server build-req build-req-pass clean-all inherit-inter \
+	list-crl pkitool revoke-full sign-req whichopensslcnf
+
+EASY_RSA_INSTALL_FILES := \
+	openssl-1.0.0.cnf vars
+
+# ----------------------------------------------------------------------------
+# Target-Install
+# ----------------------------------------------------------------------------
+
+$(STATEDIR)/easy-rsa.targetinstall:
+	@$(call targetinfo)
+
+	@$(call install_init, easy-rsa)
+	@$(call install_fixup, easy-rsa,PRIORITY,optional)
+	@$(call install_fixup, easy-rsa,SECTION,base)
+	@$(call install_fixup, easy-rsa,AUTHOR,"Alexander Aring <aar@pengutronix.de>")
+	@$(call install_fixup, easy-rsa,DESCRIPTION,missing)
+
+	@$(foreach script,$(EASY_RSA_INSTALL_SCRIPTS), \
+		$(call install_copy, easy-rsa, 0, 0, 0755, -, \
+		/usr/share/easy-rsa/$(script));)
+
+	@$(foreach file,$(EASY_RSA_INSTALL_FILES), \
+		$(call install_copy, easy-rsa, 0, 0, 0644, -, \
+		/usr/share/easy-rsa/$(file));)
+
+	@$(call install_finish, easy-rsa)
+
+	@$(call touch)
+
+# vim: syntax=make
-- 
2.2.2


-- 
ptxdist mailing list
ptxdist@pengutronix.de

[ptxdist] [PATCHv3 3/3] openvpn: rework and version bump

[Alexander Aring]

This patch reworks the openvpn rules. Some points which are new now:

- systemd support if OPENVPN_SYSTEMD
- install openvpn sample configs as reference for /etc/openvpn/
- install openvpn sample scripts (ethernet bridging)
- add required environemnt for networking utilities while configure
- add several missed autoconf configure options

Additional this patch do a version bump to 2.3.6

Signed-off-by: Alexander Aring <alex.aring@gmail.com>
---
 rules/openvpn.in   | 29 ++++++++++++++++++++++++++-
 rules/openvpn.make | 59 +++++++++++++++++++++++++++++++++++++++++++-----------
 2 files changed, 75 insertions(+), 13 deletions(-)

diff --git a/rules/openvpn.in b/rules/openvpn.in
index 3649968..3ad493a 100644
--- a/rules/openvpn.in
+++ b/rules/openvpn.in
@@ -4,7 +4,16 @@ menuconfig OPENVPN
 	tristate
 	prompt "openvpn                       "
 	select OPENSSL
-	select LIBLZO if OPENVPN_LZO
+	select LIBLZO			if OPENVPN_LZO
+	select SYSTEMD			if OPENVPN_SYSTEMD
+	select IPTABLES			if OPENVPN_INSTALL_SAMPLE_CONFIGS && RUNTIME
+	select IPTABLES_INSTALL_TOOLS	if OPENVPN_INSTALL_SAMPLE_CONFIGS && RUNTIME
+	select BRIDGE_UTILS		if OPENVPN_INSTALL_SAMPLE_SCRIPTS && RUNTIME
+	select IPROUTE2			if !BUSYBOX_IP && RUNTIME
+	select IPROUTE2_IP		if !BUSYBOX_IP && RUNTIME
+	select BUSYBOX_IFCONFIG		if RUNTIME
+	select BUSYBOX_NETSTAT		if RUNTIME
+	select BUSYBOX_ROUTE		if RUNTIME
 	help
 	  virtual private network daemon
 
@@ -34,4 +43,22 @@ config OPENVPN_LZO
 	  will select the LZO library as well.
 	  If unsure, say N.
 
+config OPENVPN_SYSTEMD
+	bool
+	prompt "Enable systemd support"
+	help
+	  This enables systemd support for openvpn.
+
+config OPENVPN_INSTALL_SAMPLE_CONFIGS
+	bool
+	prompt "Install sample configs"
+	help
+	  Install sample configs into /usr/share/openvpn/sample-config-files.
+
+config OPENVPN_INSTALL_SAMPLE_SCRIPTS
+	bool
+	prompt "Install sample scripts"
+	help
+	  Install sample scripts into /usr/share/openvpn/sample-scripts.
+
 endif
diff --git a/rules/openvpn.make b/rules/openvpn.make
index d288d43..7cfa427 100644
--- a/rules/openvpn.make
+++ b/rules/openvpn.make
@@ -16,11 +16,11 @@ PACKAGES-$(PTXCONF_OPENVPN) += openvpn
 #
 # Paths and names
 #
-OPENVPN_VERSION		:= 2.1.1
-OPENVPN_MD5		:= b273ed2b5ec8616fb9834cde8634bce7
+OPENVPN_VERSION		:= 2.3.6
+OPENVPN_MD5		:= 6ca03fe0fd093e0d01601abee808835c
 OPENVPN			:= openvpn-$(OPENVPN_VERSION)
 OPENVPN_SUFFIX		:= tar.gz
-OPENVPN_URL		:= http://openvpn.net/release/$(OPENVPN).$(OPENVPN_SUFFIX)
+OPENVPN_URL		:= http://swupdate.openvpn.org/community/releases/$(OPENVPN).$(OPENVPN_SUFFIX)
 OPENVPN_SOURCE		:= $(SRCDIR)/$(OPENVPN).$(OPENVPN_SUFFIX)
 OPENVPN_DIR		:= $(BUILDDIR)/$(OPENVPN)
 
@@ -29,18 +29,36 @@ OPENVPN_DIR		:= $(BUILDDIR)/$(OPENVPN)
 # ----------------------------------------------------------------------------
 
 OPENVPN_PATH	:= PATH=$(CROSS_PATH)
-OPENVPN_ENV 	:= $(CROSS_ENV)
+OPENVPN_ENV	:= \
+	$(CROSS_ENV) \
+	IFCONFIG=/sbin/ifconfig \
+	ROUTE=/sbin/route \
+	IPROUTE=/sbin/ip \
+	NETSTAT=/bin/netstat
 
 #
 # autoconf
 #
-OPENVPN_AUTOCONF := $(CROSS_AUTOCONF_USR)
+OPENVPN_AUTOCONF := \
+	$(CROSS_AUTOCONF_USR) \
+	--$(call ptx/endis, PTXCONF_OPENVPN_LZO)-lzo \
+	--disable-plugins \
+	--disable-debug \
+	--enable-small \
+	--disable-iproute2 \
+	--disable-selinux \
+	--$(call ptx/endis, PTXCONF_OPENVPN_SYSTEMD)-systemd \
+	--with-crypto-library=openssl
 
-ifdef PTXCONF_OPENVPN_LZO
-OPENVPN_AUTOCONF += --enable-lzo
-else
-OPENVPN_AUTOCONF += --disable-lzo
-endif
+OPENVPN_INSTALL_SAMPLE_CONFIG_FILES := \
+	client.conf loopback-client loopback-server README server.conf \
+	static-home.conf static-office.conf tls-home.conf tls-office.conf \
+	xinetd-client-config xinetd-server-config
+
+OPENVPN_INSTALL_SAMPLE_CONFIG_SCRIPTS := \
+	firewall.sh home.up office.up openvpn-shutdown.sh openvpn-startup.sh
+
+OPENVPN_INSTALL_SAMPLE_SCRIPTS := bridge-start bridge-stop
 
 # ----------------------------------------------------------------------------
 # Target-Install
@@ -55,9 +73,26 @@ $(STATEDIR)/openvpn.targetinstall:
 	@$(call install_fixup, openvpn,AUTHOR,"Carsten Schlote <c.schlote@konzeptpark.de>")
 	@$(call install_fixup, openvpn,DESCRIPTION,missing)
 
-	@$(call install_copy, openvpn, 0, 0, 0755, -, /usr/sbin/openvpn)
+ifdef PTXCONF_OPENVPN_INSTALL_SAMPLE_CONFIGS
+	@$(foreach file,$(OPENVPN_INSTALL_SAMPLE_CONFIG_FILES), \
+		$(call install_copy, openvpn, 0, 0, 0644, \
+		$(OPENVPN_DIR)/sample/sample-config-files/$(file), \
+		/usr/share/openvpn/sample-config-files/$(file));)
 
-	@$(call install_copy, openvpn, 0, 0, 0755, /etc/openvpn)
+	@$(foreach script,$(OPENVPN_INSTALL_SAMPLE_CONFIG_SCRIPTS), \
+		$(call install_copy, openvpn, 0, 0, 0755, \
+		$(OPENVPN_DIR)/sample/sample-config-files/$(script), \
+		/usr/share/openvpn/sample-config-files/$(script));)
+endif
+
+ifdef PTXCONF_OPENVPN_INSTALL_SAMPLE_SCRIPTS
+	@$(foreach script,$(OPENVPN_INSTALL_SAMPLE_SCRIPTS), \
+		$(call install_copy, openvpn, 0, 0, 0755, \
+		$(OPENVPN_DIR)/sample/sample-scripts/$(script), \
+		/usr/share/openvpn/sample-scripts/$(script));)
+endif
+
+	@$(call install_copy, openvpn, 0, 0, 0755, -, /usr/sbin/openvpn)
 
 	@$(call install_finish, openvpn)
 
-- 
2.2.2


-- 
ptxdist mailing list
ptxdist@pengutronix.de