[ptxdist] [PATCHv2 0/4] openvpn: cleanups, extras and version bumps

[ptxdist] [PATCHv2 0/4] openvpn: cleanups, extras and version bumps

[Alexander Aring]

This patch series contains some cleanups and version bumps for openvpn.

Some points which I detected and can be improved:

- Install the openssl.cnf as install_alternatives?
- Easy-rsa contains support for programming smartcards.
  This tool isn't ported yet, because I don't have fancy
  programmable (hackable) smartcards.

I mainly "test" it to run a bridged network into my local area network.
Description how to setup such thing is available at:

https://openvpn.net/index.php/open-source/documentation/miscellaneous/76-ethernet-bridging.html

- Alex

changes since v2:
 - fix openvpn depends on to select
 - make the same fix for openvpn also for easy-rsa with GREP and BUSYBOX_GREP
 - install openssl.cnf per default without an option
   - changes commit msg of openssl.cnf patch according to the changes
 - add description into cover letter what I tested now

Alexander Aring (4):
  liblzo: rework and version bump
  openssl: allow to install openssl.cnf
  easy-rsa: initial commit
  openvpn: rework and version bump

 patches/easy-rsa-2.2.2/autogen.sh |  1 +
 rules/easy-rsa.in                 | 17 +++++++++++
 rules/easy-rsa.make               | 62 +++++++++++++++++++++++++++++++++++++++
 rules/liblzo.in                   | 18 ------------
 rules/liblzo.make                 | 11 ++++---
 rules/openssl.make                |  4 +++
 rules/openvpn.in                  | 27 +++++++++++++++++
 rules/openvpn.make                | 59 +++++++++++++++++++++++++++++--------
 8 files changed, 163 insertions(+), 36 deletions(-)
 create mode 120000 patches/easy-rsa-2.2.2/autogen.sh
 create mode 100644 rules/easy-rsa.in
 create mode 100644 rules/easy-rsa.make

-- 
2.2.2


-- 
ptxdist mailing list
ptxdist@pengutronix.de

[ptxdist] [PATCHv2 1/4] liblzo: rework and version bump

[Alexander Aring]

This patch removes the menuentries to generate a static or shared
library. Instead we do default a shared library now. Additional we
do slightly a version bump to 2.08 liblzo version.

Signed-off-by: Alexander Aring <alex.aring@gmail.com>
---
 rules/liblzo.in   | 18 ------------------
 rules/liblzo.make | 11 +++++------
 2 files changed, 5 insertions(+), 24 deletions(-)

diff --git a/rules/liblzo.in b/rules/liblzo.in
index 62c74c7..d416b59 100644
--- a/rules/liblzo.in
+++ b/rules/liblzo.in
@@ -9,21 +9,3 @@ menuconfig LIBLZO
 	  Compiles the LZO compression libraries on your target system.
 
           See http://www.oberhumer.com/opensource/lzo/ for info about it.
-
-if LIBLZO
-
-config LIBLZO_SHARED
-	bool
-	default y
-	prompt "Create shared library"
-	help
-	  Create a shared library and install it into /usr/lib
-
-config LIBLZO_STATIC
-	bool
-	prompt "Create static link library"
-	help
-	  Create a static link library and install it into /usr/lib.
-	  Normally not needed.
-
-endif
diff --git a/rules/liblzo.make b/rules/liblzo.make
index 2bcb25f..dcb4c9e 100644
--- a/rules/liblzo.make
+++ b/rules/liblzo.make
@@ -17,8 +17,8 @@ PACKAGES-$(PTXCONF_LIBLZO) += liblzo
 #
 # Paths and names
 #
-LIBLZO_VERSION	:= 2.03
-LIBLZO_MD5	:= 0c3d078c2e8ea5a88971089a2f02a726
+LIBLZO_VERSION	:= 2.08
+LIBLZO_MD5	:= fcec64c26a0f4f4901468f360029678f
 LIBLZO		:= lzo-$(LIBLZO_VERSION)
 LIBLZO_SUFFIX	:= tar.gz
 LIBLZO_URL	:= http://www.oberhumer.com/opensource/lzo/download/$(LIBLZO).$(LIBLZO_SUFFIX)
@@ -38,8 +38,8 @@ LIBLZO_ENV 	:= $(CROSS_ENV)
 #
 LIBLZO_AUTOCONF := \
 	$(CROSS_AUTOCONF_USR) \
-	--$(call ptx/endis, PTXCONF_LIBLZO_SHARED)-shared \
-	--$(call ptx/endis, PTXCONF_LIBLZO_STATIC)-static
+	--enable-shared \
+	--disable-static
 
 # ----------------------------------------------------------------------------
 # Target-Install
@@ -54,9 +54,8 @@ $(STATEDIR)/liblzo.targetinstall:
 	@$(call install_fixup, liblzo,AUTHOR,"Carsten Schlote <c.schlote@konzeptpark.de>")
 	@$(call install_fixup, liblzo,DESCRIPTION,missing)
 
-ifdef PTXCONF_LIBLZO_SHARED
 	@$(call install_lib, liblzo, 0, 0, 0644, liblzo2)
-endif
+
 	@$(call install_finish, liblzo)
 
 	@$(call touch)
-- 
2.2.2


-- 
ptxdist mailing list
ptxdist@pengutronix.de

Re: [ptxdist] [PATCHv2 1/4] liblzo: rework and version bump

[Michael Olbrich]

On Sun, Jan 25, 2015 at 08:56:21PM +0100, Alexander Aring wrote:
> This patch removes the menuentries to generate a static or shared
> library. Instead we do default a shared library now. Additional we
> do slightly a version bump to 2.08 liblzo version.
> 
> Signed-off-by: Alexander Aring <alex.aring@gmail.com>

Thanks, applied.

Michael

> ---
>  rules/liblzo.in   | 18 ------------------
>  rules/liblzo.make | 11 +++++------
>  2 files changed, 5 insertions(+), 24 deletions(-)
> 
> diff --git a/rules/liblzo.in b/rules/liblzo.in
> index 62c74c7..d416b59 100644
> --- a/rules/liblzo.in
> +++ b/rules/liblzo.in
> @@ -9,21 +9,3 @@ menuconfig LIBLZO
>  	  Compiles the LZO compression libraries on your target system.
>  
>            See http://www.oberhumer.com/opensource/lzo/ for info about it.
> -
> -if LIBLZO
> -
> -config LIBLZO_SHARED
> -	bool
> -	default y
> -	prompt "Create shared library"
> -	help
> -	  Create a shared library and install it into /usr/lib
> -
> -config LIBLZO_STATIC
> -	bool
> -	prompt "Create static link library"
> -	help
> -	  Create a static link library and install it into /usr/lib.
> -	  Normally not needed.
> -
> -endif
> diff --git a/rules/liblzo.make b/rules/liblzo.make
> index 2bcb25f..dcb4c9e 100644
> --- a/rules/liblzo.make
> +++ b/rules/liblzo.make
> @@ -17,8 +17,8 @@ PACKAGES-$(PTXCONF_LIBLZO) += liblzo
>  #
>  # Paths and names
>  #
> -LIBLZO_VERSION	:= 2.03
> -LIBLZO_MD5	:= 0c3d078c2e8ea5a88971089a2f02a726
> +LIBLZO_VERSION	:= 2.08
> +LIBLZO_MD5	:= fcec64c26a0f4f4901468f360029678f
>  LIBLZO		:= lzo-$(LIBLZO_VERSION)
>  LIBLZO_SUFFIX	:= tar.gz
>  LIBLZO_URL	:= http://www.oberhumer.com/opensource/lzo/download/$(LIBLZO).$(LIBLZO_SUFFIX)
> @@ -38,8 +38,8 @@ LIBLZO_ENV 	:= $(CROSS_ENV)
>  #
>  LIBLZO_AUTOCONF := \
>  	$(CROSS_AUTOCONF_USR) \
> -	--$(call ptx/endis, PTXCONF_LIBLZO_SHARED)-shared \
> -	--$(call ptx/endis, PTXCONF_LIBLZO_STATIC)-static
> +	--enable-shared \
> +	--disable-static
>  
>  # ----------------------------------------------------------------------------
>  # Target-Install
> @@ -54,9 +54,8 @@ $(STATEDIR)/liblzo.targetinstall:
>  	@$(call install_fixup, liblzo,AUTHOR,"Carsten Schlote <c.schlote@konzeptpark.de>")
>  	@$(call install_fixup, liblzo,DESCRIPTION,missing)
>  
> -ifdef PTXCONF_LIBLZO_SHARED
>  	@$(call install_lib, liblzo, 0, 0, 0644, liblzo2)
> -endif
> +
>  	@$(call install_finish, liblzo)
>  
>  	@$(call touch)
> -- 
> 2.2.2
> 
> 
> -- 
> ptxdist mailing list
> ptxdist@pengutronix.de
> 

-- 
Pengutronix e.K.                           |                             |
Industrial Linux Solutions                 | http://www.pengutronix.de/  |
Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

-- 
ptxdist mailing list
ptxdist@pengutronix.de

[ptxdist] [PATCHv2 2/4] openssl: allow to install openssl.cnf

[Alexander Aring]

For doing some certificates magic the openssl tool requires some
openssl.cnf file. This patch adds support to install the default
shipped openssl.cnf file.

Signed-off-by: Alexander Aring <alex.aring@gmail.com>
---
 rules/openssl.make | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/rules/openssl.make b/rules/openssl.make
index 50039c7..d3928a0 100644
--- a/rules/openssl.make
+++ b/rules/openssl.make
@@ -100,6 +100,10 @@ ifdef PTXCONF_OPENSSL_BIN
 	@$(call install_copy, openssl, 0, 0, 0755, -, \
 		/usr/bin/openssl)
 endif
+
+	@$(call install_copy, openssl, 0, 0, 0644, -, \
+		/usr/lib/ssl/openssl.cnf)
+
 	@$(call install_lib, openssl, 0, 0, 0644, libssl)
 	@$(call install_lib, openssl, 0, 0, 0644, libcrypto)
 
-- 
2.2.2


-- 
ptxdist mailing list
ptxdist@pengutronix.de

Re: [ptxdist] [PATCHv2 2/4] openssl: allow to install openssl.cnf

[Michael Olbrich]

On Sun, Jan 25, 2015 at 08:56:22PM +0100, Alexander Aring wrote:
> For doing some certificates magic the openssl tool requires some
> openssl.cnf file. This patch adds support to install the default
> shipped openssl.cnf file.
> 
> Signed-off-by: Alexander Aring <alex.aring@gmail.com>
> ---
>  rules/openssl.make | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/rules/openssl.make b/rules/openssl.make
> index 50039c7..d3928a0 100644
> --- a/rules/openssl.make
> +++ b/rules/openssl.make
> @@ -100,6 +100,10 @@ ifdef PTXCONF_OPENSSL_BIN
>  	@$(call install_copy, openssl, 0, 0, 0755, -, \
>  		/usr/bin/openssl)
>  endif
> +
> +	@$(call install_copy, openssl, 0, 0, 0644, -, \
> +		/usr/lib/ssl/openssl.cnf)

Use install_alternative. This will fall back to PKGDIR if nothing else is
available, but it can be overwritten in projectroot/ in the BSP.

Michael

> +
>  	@$(call install_lib, openssl, 0, 0, 0644, libssl)
>  	@$(call install_lib, openssl, 0, 0, 0644, libcrypto)
>  
> -- 
> 2.2.2
> 
> 
> -- 
> ptxdist mailing list
> ptxdist@pengutronix.de
> 

-- 
Pengutronix e.K.                           |                             |
Industrial Linux Solutions                 | http://www.pengutronix.de/  |
Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

-- 
ptxdist mailing list
ptxdist@pengutronix.de

Re: [ptxdist] [PATCHv2 2/4] openssl: allow to install openssl.cnf

[Alexander Aring]

On Mon, Jan 26, 2015 at 04:03:34PM +0100, Michael Olbrich wrote:
> On Sun, Jan 25, 2015 at 08:56:22PM +0100, Alexander Aring wrote:
> > For doing some certificates magic the openssl tool requires some
> > openssl.cnf file. This patch adds support to install the default
> > shipped openssl.cnf file.
> > 
> > Signed-off-by: Alexander Aring <alex.aring@gmail.com>
> > ---
> >  rules/openssl.make | 4 ++++
> >  1 file changed, 4 insertions(+)
> > 
> > diff --git a/rules/openssl.make b/rules/openssl.make
> > index 50039c7..d3928a0 100644
> > --- a/rules/openssl.make
> > +++ b/rules/openssl.make
> > @@ -100,6 +100,10 @@ ifdef PTXCONF_OPENSSL_BIN
> >  	@$(call install_copy, openssl, 0, 0, 0755, -, \
> >  		/usr/bin/openssl)
> >  endif
> > +
> > +	@$(call install_copy, openssl, 0, 0, 0644, -, \
> > +		/usr/lib/ssl/openssl.cnf)
> 
> Use install_alternative. This will fall back to PKGDIR if nothing else is
> available, but it can be overwritten in projectroot/ in the BSP.
> 

+1

- Alex

-- 
ptxdist mailing list
ptxdist@pengutronix.de

[ptxdist] [PATCHv2 3/4] easy-rsa: initial commit

[Alexander Aring]

This patch adds easy-rsa. Some scripting framework to generate a PKI
CA "correctly".

Signed-off-by: Alexander Aring <alex.aring@gmail.com>
---
 patches/easy-rsa-2.2.2/autogen.sh |  1 +
 rules/easy-rsa.in                 | 17 +++++++++++
 rules/easy-rsa.make               | 62 +++++++++++++++++++++++++++++++++++++++
 3 files changed, 80 insertions(+)
 create mode 120000 patches/easy-rsa-2.2.2/autogen.sh
 create mode 100644 rules/easy-rsa.in
 create mode 100644 rules/easy-rsa.make

diff --git a/patches/easy-rsa-2.2.2/autogen.sh b/patches/easy-rsa-2.2.2/autogen.sh
new file mode 120000
index 0000000..9f8a4cb
--- /dev/null
+++ b/patches/easy-rsa-2.2.2/autogen.sh
@@ -0,0 +1 @@
+../autogen.sh
\ No newline at end of file
diff --git a/rules/easy-rsa.in b/rules/easy-rsa.in
new file mode 100644
index 0000000..25aebb4
--- /dev/null
+++ b/rules/easy-rsa.in
@@ -0,0 +1,17 @@
+## SECTION=security
+
+config EASY_RSA
+	tristate
+	prompt "easy-rsa"
+	select GREP		if !BUSYBOX_GREP && RUNTIME
+	select GCCLIBS_GCC_S	if !BUSYBOX_GREP && RUNTIME
+	select OPENSSL
+	select OPENSSL_BIN
+	help
+	  easy-rsa is a CLI utility to build and manage a PKI CA. In laymen's
+	  terms, this means to create a root certificate authority, and request
+	  and sign certificates, including sub-CAs and certificate revokation
+	  lists (CRL). This is for people which don't know how to generate
+	  all PKI files with openssl tool. Additional this is for people which
+	  have a enough less paranoia to generate keys on an embedded device.
+	  The easy-rsa scripts will be placed at /usr/share/easy-rsa aferwards.
diff --git a/rules/easy-rsa.make b/rules/easy-rsa.make
new file mode 100644
index 0000000..e6b18f8
--- /dev/null
+++ b/rules/easy-rsa.make
@@ -0,0 +1,62 @@
+# -*-makefile-*-
+#
+# Copyright (C) 2014 by Alexander Aring <aar@pengutronix.de>
+#
+# See CREDITS for details about who has contributed to this project.
+#
+# For further information about the PTXdist project and license conditions
+# see the README file.
+#
+
+#
+# We provide this package
+#
+PACKAGES-$(PTXCONF_EASY_RSA) += easy-rsa
+
+#
+# Paths and names
+#
+EASY_RSA_VERSION	:= 2.2.2
+EASY_RSA_MD5		:= 040238338980617bc9c2df4274349593
+EASY_RSA		:= easy-rsa-$(EASY_RSA_VERSION)
+EASY_RSA_SUFFIX		:= tar.gz
+EASY_RSA_TARBALL	:= $(EASY_RSA_VERSION).$(EASY_RSA_SUFFIX)
+EASY_RSA_URL		:= https://github.com/OpenVPN/easy-rsa/archive/$(EASY_RSA_TARBALL)
+EASY_RSA_SOURCE		:= $(SRCDIR)/$(EASY_RSA).$(EASY_RSA_SUFFIX)
+EASY_RSA_DIR		:= $(BUILDDIR)/$(EASY_RSA)
+EASY_RSA_LICENSE	:= GPLv2
+
+EASY_RSA_INSTALL_SCRIPTS := \
+	build-ca build-dh build-inter build-key build-key-pass build-key-pkcs12 \
+	build-key-server build-req build-req-pass clean-all inherit-inter \
+	list-crl pkitool revoke-full sign-req whichopensslcnf
+
+EASY_RSA_INSTALL_FILES := \
+	openssl-0.9.6.cnf openssl-0.9.8.cnf openssl-1.0.0.cnf vars
+
+# ----------------------------------------------------------------------------
+# Target-Install
+# ----------------------------------------------------------------------------
+
+$(STATEDIR)/easy-rsa.targetinstall:
+	@$(call targetinfo)
+
+	@$(call install_init, easy-rsa)
+	@$(call install_fixup, easy-rsa,PRIORITY,optional)
+	@$(call install_fixup, easy-rsa,SECTION,base)
+	@$(call install_fixup, easy-rsa,AUTHOR,"Alexander Aring <aar@pengutronix.de>")
+	@$(call install_fixup, easy-rsa,DESCRIPTION,missing)
+
+	@$(foreach script,$(EASY_RSA_INSTALL_SCRIPTS), \
+		$(call install_copy, easy-rsa, 0, 0, 0755, -, \
+		/usr/share/easy-rsa/$(script));)
+
+	@$(foreach file,$(EASY_RSA_INSTALL_FILES), \
+		$(call install_copy, easy-rsa, 0, 0, 0644, -, \
+		/usr/share/easy-rsa/$(file));)
+
+	@$(call install_finish, easy-rsa)
+
+	@$(call touch)
+
+# vim: syntax=make
-- 
2.2.2


-- 
ptxdist mailing list
ptxdist@pengutronix.de

Re: [ptxdist] [PATCHv2 3/4] easy-rsa: initial commit

[Michael Olbrich]

On Sun, Jan 25, 2015 at 08:56:23PM +0100, Alexander Aring wrote:
> This patch adds easy-rsa. Some scripting framework to generate a PKI
> CA "correctly".
> 
> Signed-off-by: Alexander Aring <alex.aring@gmail.com>
> ---
>  patches/easy-rsa-2.2.2/autogen.sh |  1 +
>  rules/easy-rsa.in                 | 17 +++++++++++
>  rules/easy-rsa.make               | 62 +++++++++++++++++++++++++++++++++++++++
>  3 files changed, 80 insertions(+)
>  create mode 120000 patches/easy-rsa-2.2.2/autogen.sh
>  create mode 100644 rules/easy-rsa.in
>  create mode 100644 rules/easy-rsa.make
> 
> diff --git a/patches/easy-rsa-2.2.2/autogen.sh b/patches/easy-rsa-2.2.2/autogen.sh
> new file mode 120000
> index 0000000..9f8a4cb
> --- /dev/null
> +++ b/patches/easy-rsa-2.2.2/autogen.sh
> @@ -0,0 +1 @@
> +../autogen.sh
> \ No newline at end of file
> diff --git a/rules/easy-rsa.in b/rules/easy-rsa.in
> new file mode 100644
> index 0000000..25aebb4
> --- /dev/null
> +++ b/rules/easy-rsa.in
> @@ -0,0 +1,17 @@
> +## SECTION=security
> +
> +config EASY_RSA
> +	tristate
> +	prompt "easy-rsa"
> +	select GREP		if !BUSYBOX_GREP && RUNTIME
> +	select GCCLIBS_GCC_S	if !BUSYBOX_GREP && RUNTIME
> +	select OPENSSL

	select OPENSSL		if RUNTIME

right?

> +	select OPENSSL_BIN
> +	help
> +	  easy-rsa is a CLI utility to build and manage a PKI CA. In laymen's
> +	  terms, this means to create a root certificate authority, and request
> +	  and sign certificates, including sub-CAs and certificate revokation
> +	  lists (CRL). This is for people which don't know how to generate
> +	  all PKI files with openssl tool. Additional this is for people which
> +	  have a enough less paranoia to generate keys on an embedded device.
> +	  The easy-rsa scripts will be placed at /usr/share/easy-rsa aferwards.
> diff --git a/rules/easy-rsa.make b/rules/easy-rsa.make
> new file mode 100644
> index 0000000..e6b18f8
> --- /dev/null
> +++ b/rules/easy-rsa.make
> @@ -0,0 +1,62 @@
> +# -*-makefile-*-
> +#
> +# Copyright (C) 2014 by Alexander Aring <aar@pengutronix.de>
> +#
> +# See CREDITS for details about who has contributed to this project.
> +#
> +# For further information about the PTXdist project and license conditions
> +# see the README file.
> +#
> +
> +#
> +# We provide this package
> +#
> +PACKAGES-$(PTXCONF_EASY_RSA) += easy-rsa
> +
> +#
> +# Paths and names
> +#
> +EASY_RSA_VERSION	:= 2.2.2
> +EASY_RSA_MD5		:= 040238338980617bc9c2df4274349593
> +EASY_RSA		:= easy-rsa-$(EASY_RSA_VERSION)
> +EASY_RSA_SUFFIX		:= tar.gz
> +EASY_RSA_TARBALL	:= $(EASY_RSA_VERSION).$(EASY_RSA_SUFFIX)
> +EASY_RSA_URL		:= https://github.com/OpenVPN/easy-rsa/archive/$(EASY_RSA_TARBALL)
> +EASY_RSA_SOURCE		:= $(SRCDIR)/$(EASY_RSA).$(EASY_RSA_SUFFIX)
> +EASY_RSA_DIR		:= $(BUILDDIR)/$(EASY_RSA)
> +EASY_RSA_LICENSE	:= GPLv2
> +
> +EASY_RSA_INSTALL_SCRIPTS := \
> +	build-ca build-dh build-inter build-key build-key-pass build-key-pkcs12 \
> +	build-key-server build-req build-req-pass clean-all inherit-inter \
> +	list-crl pkitool revoke-full sign-req whichopensslcnf
> +
> +EASY_RSA_INSTALL_FILES := \
> +	openssl-0.9.6.cnf openssl-0.9.8.cnf openssl-1.0.0.cnf vars

I don't think we need openssl-0.9.6.cnf and openssl-0.9.8.cnf. We just have
1.0.x in ptxdist.

Michael

> +
> +# ----------------------------------------------------------------------------
> +# Target-Install
> +# ----------------------------------------------------------------------------
> +
> +$(STATEDIR)/easy-rsa.targetinstall:
> +	@$(call targetinfo)
> +
> +	@$(call install_init, easy-rsa)
> +	@$(call install_fixup, easy-rsa,PRIORITY,optional)
> +	@$(call install_fixup, easy-rsa,SECTION,base)
> +	@$(call install_fixup, easy-rsa,AUTHOR,"Alexander Aring <aar@pengutronix.de>")
> +	@$(call install_fixup, easy-rsa,DESCRIPTION,missing)
> +
> +	@$(foreach script,$(EASY_RSA_INSTALL_SCRIPTS), \
> +		$(call install_copy, easy-rsa, 0, 0, 0755, -, \
> +		/usr/share/easy-rsa/$(script));)
> +
> +	@$(foreach file,$(EASY_RSA_INSTALL_FILES), \
> +		$(call install_copy, easy-rsa, 0, 0, 0644, -, \
> +		/usr/share/easy-rsa/$(file));)
> +
> +	@$(call install_finish, easy-rsa)
> +
> +	@$(call touch)
> +
> +# vim: syntax=make
> -- 
> 2.2.2
> 
> 
> -- 
> ptxdist mailing list
> ptxdist@pengutronix.de
> 

-- 
Pengutronix e.K.                           |                             |
Industrial Linux Solutions                 | http://www.pengutronix.de/  |
Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

-- 
ptxdist mailing list
ptxdist@pengutronix.de

Re: [ptxdist] [PATCHv2 3/4] easy-rsa: initial commit

[Alexander Aring]

Hi,

On Mon, Jan 26, 2015 at 04:00:51PM +0100, Michael Olbrich wrote:
> On Sun, Jan 25, 2015 at 08:56:23PM +0100, Alexander Aring wrote:
> > This patch adds easy-rsa. Some scripting framework to generate a PKI
> > CA "correctly".
> > 
> > Signed-off-by: Alexander Aring <alex.aring@gmail.com>
> > ---
> >  patches/easy-rsa-2.2.2/autogen.sh |  1 +
> >  rules/easy-rsa.in                 | 17 +++++++++++
> >  rules/easy-rsa.make               | 62 +++++++++++++++++++++++++++++++++++++++
> >  3 files changed, 80 insertions(+)
> >  create mode 120000 patches/easy-rsa-2.2.2/autogen.sh
> >  create mode 100644 rules/easy-rsa.in
> >  create mode 100644 rules/easy-rsa.make
> > 
> > diff --git a/patches/easy-rsa-2.2.2/autogen.sh b/patches/easy-rsa-2.2.2/autogen.sh
> > new file mode 120000
> > index 0000000..9f8a4cb
> > --- /dev/null
> > +++ b/patches/easy-rsa-2.2.2/autogen.sh
> > @@ -0,0 +1 @@
> > +../autogen.sh
> > \ No newline at end of file
> > diff --git a/rules/easy-rsa.in b/rules/easy-rsa.in
> > new file mode 100644
> > index 0000000..25aebb4
> > --- /dev/null
> > +++ b/rules/easy-rsa.in
> > @@ -0,0 +1,17 @@
> > +## SECTION=security
> > +
> > +config EASY_RSA
> > +	tristate
> > +	prompt "easy-rsa"
> > +	select GREP		if !BUSYBOX_GREP && RUNTIME
> > +	select GCCLIBS_GCC_S	if !BUSYBOX_GREP && RUNTIME
> > +	select OPENSSL
> 
> 	select OPENSSL		if RUNTIME
> 
> right?
> 

okay if we need RUNTIME when some binary will be called at runtime only.
Then this is right, because the easy-rsa are some helper scripts only
which call openssl and grep.

> > +	select OPENSSL_BIN
> > +	help
> > +	  easy-rsa is a CLI utility to build and manage a PKI CA. In laymen's
> > +	  terms, this means to create a root certificate authority, and request
> > +	  and sign certificates, including sub-CAs and certificate revokation
> > +	  lists (CRL). This is for people which don't know how to generate
> > +	  all PKI files with openssl tool. Additional this is for people which
> > +	  have a enough less paranoia to generate keys on an embedded device.
> > +	  The easy-rsa scripts will be placed at /usr/share/easy-rsa aferwards.
> > diff --git a/rules/easy-rsa.make b/rules/easy-rsa.make
> > new file mode 100644
> > index 0000000..e6b18f8
> > --- /dev/null
> > +++ b/rules/easy-rsa.make
> > @@ -0,0 +1,62 @@
> > +# -*-makefile-*-
> > +#
> > +# Copyright (C) 2014 by Alexander Aring <aar@pengutronix.de>
> > +#
> > +# See CREDITS for details about who has contributed to this project.
> > +#
> > +# For further information about the PTXdist project and license conditions
> > +# see the README file.
> > +#
> > +
> > +#
> > +# We provide this package
> > +#
> > +PACKAGES-$(PTXCONF_EASY_RSA) += easy-rsa
> > +
> > +#
> > +# Paths and names
> > +#
> > +EASY_RSA_VERSION	:= 2.2.2
> > +EASY_RSA_MD5		:= 040238338980617bc9c2df4274349593
> > +EASY_RSA		:= easy-rsa-$(EASY_RSA_VERSION)
> > +EASY_RSA_SUFFIX		:= tar.gz
> > +EASY_RSA_TARBALL	:= $(EASY_RSA_VERSION).$(EASY_RSA_SUFFIX)
> > +EASY_RSA_URL		:= https://github.com/OpenVPN/easy-rsa/archive/$(EASY_RSA_TARBALL)
> > +EASY_RSA_SOURCE		:= $(SRCDIR)/$(EASY_RSA).$(EASY_RSA_SUFFIX)
> > +EASY_RSA_DIR		:= $(BUILDDIR)/$(EASY_RSA)
> > +EASY_RSA_LICENSE	:= GPLv2
> > +
> > +EASY_RSA_INSTALL_SCRIPTS := \
> > +	build-ca build-dh build-inter build-key build-key-pass build-key-pkcs12 \
> > +	build-key-server build-req build-req-pass clean-all inherit-inter \
> > +	list-crl pkitool revoke-full sign-req whichopensslcnf
> > +
> > +EASY_RSA_INSTALL_FILES := \
> > +	openssl-0.9.6.cnf openssl-0.9.8.cnf openssl-1.0.0.cnf vars
> 
> I don't think we need openssl-0.9.6.cnf and openssl-0.9.8.cnf. We just have
> 1.0.x in ptxdist.
> 

I would remove the whole list and copy "vars" only. I tried to use
openssl-1.0.0.cnf at first when I found that some openssl.cnf was
missing. Result: it didn't work, then I used the shipped openssl one and
it worked. I didn't looked deeper inside the possibilities to making
openssl.cnf changes.

- Alex

-- 
ptxdist mailing list
ptxdist@pengutronix.de

[ptxdist] [PATCHv2 4/4] openvpn: rework and version bump

[Alexander Aring]

This patch reworks the openvpn rules. Some points which are new now:

- systemd support if OPENVPN_SYSTEMD
- install openvpn sample configs as reference for /etc/openvpn/
- install openvpn sample scripts (ethernet bridging)
- add required environemnt for networking utilities while configure
- add several missed autoconf configure options

Additional this patch do a version bump to 2.3.6

Signed-off-by: Alexander Aring <alex.aring@gmail.com>
---
 rules/openvpn.in   | 27 +++++++++++++++++++++++++
 rules/openvpn.make | 59 +++++++++++++++++++++++++++++++++++++++++++-----------
 2 files changed, 74 insertions(+), 12 deletions(-)

diff --git a/rules/openvpn.in b/rules/openvpn.in
index 3649968..1cd4a54 100644
--- a/rules/openvpn.in
+++ b/rules/openvpn.in
@@ -5,6 +5,11 @@ menuconfig OPENVPN
 	prompt "openvpn                       "
 	select OPENSSL
 	select LIBLZO if OPENVPN_LZO
+	select IPROUTE2		if !BUSYBOX_IP && RUNTIME
+	select IPROUTE2_IP	if !BUSYBOX_IP && RUNTIME
+	select BUSYBOX_IFCONFIG
+	select BUSYBOX_NETSTAT
+	select BUSYBOX_ROUTE
 	help
 	  virtual private network daemon
 
@@ -34,4 +39,26 @@ config OPENVPN_LZO
 	  will select the LZO library as well.
 	  If unsure, say N.
 
+config OPENVPN_SYSTEMD
+	bool
+	prompt "Enable systemd support"
+	depends on SYSTEMD
+	help
+	  This enables systemd support for openvpn.
+
+config OPENVPN_INSTALL_SAMPLE_CONFIGS
+	bool
+	prompt "Install sample configs"
+	select IPTABLES
+	select IPTABLES_INSTALL_TOOLS
+	help
+	  Install sample configs into /usr/share/openvpn/sample-config-files.
+
+config OPENVPN_INSTALL_SAMPLE_SCRIPTS
+	bool
+	prompt "Install sample scripts"
+	select BRIDGE_UTILS
+	help
+	  Install sample scripts into /usr/share/openvpn/sample-scripts.
+
 endif
diff --git a/rules/openvpn.make b/rules/openvpn.make
index d288d43..7cfa427 100644
--- a/rules/openvpn.make
+++ b/rules/openvpn.make
@@ -16,11 +16,11 @@ PACKAGES-$(PTXCONF_OPENVPN) += openvpn
 #
 # Paths and names
 #
-OPENVPN_VERSION		:= 2.1.1
-OPENVPN_MD5		:= b273ed2b5ec8616fb9834cde8634bce7
+OPENVPN_VERSION		:= 2.3.6
+OPENVPN_MD5		:= 6ca03fe0fd093e0d01601abee808835c
 OPENVPN			:= openvpn-$(OPENVPN_VERSION)
 OPENVPN_SUFFIX		:= tar.gz
-OPENVPN_URL		:= http://openvpn.net/release/$(OPENVPN).$(OPENVPN_SUFFIX)
+OPENVPN_URL		:= http://swupdate.openvpn.org/community/releases/$(OPENVPN).$(OPENVPN_SUFFIX)
 OPENVPN_SOURCE		:= $(SRCDIR)/$(OPENVPN).$(OPENVPN_SUFFIX)
 OPENVPN_DIR		:= $(BUILDDIR)/$(OPENVPN)
 
@@ -29,18 +29,36 @@ OPENVPN_DIR		:= $(BUILDDIR)/$(OPENVPN)
 # ----------------------------------------------------------------------------
 
 OPENVPN_PATH	:= PATH=$(CROSS_PATH)
-OPENVPN_ENV 	:= $(CROSS_ENV)
+OPENVPN_ENV	:= \
+	$(CROSS_ENV) \
+	IFCONFIG=/sbin/ifconfig \
+	ROUTE=/sbin/route \
+	IPROUTE=/sbin/ip \
+	NETSTAT=/bin/netstat
 
 #
 # autoconf
 #
-OPENVPN_AUTOCONF := $(CROSS_AUTOCONF_USR)
+OPENVPN_AUTOCONF := \
+	$(CROSS_AUTOCONF_USR) \
+	--$(call ptx/endis, PTXCONF_OPENVPN_LZO)-lzo \
+	--disable-plugins \
+	--disable-debug \
+	--enable-small \
+	--disable-iproute2 \
+	--disable-selinux \
+	--$(call ptx/endis, PTXCONF_OPENVPN_SYSTEMD)-systemd \
+	--with-crypto-library=openssl
 
-ifdef PTXCONF_OPENVPN_LZO
-OPENVPN_AUTOCONF += --enable-lzo
-else
-OPENVPN_AUTOCONF += --disable-lzo
-endif
+OPENVPN_INSTALL_SAMPLE_CONFIG_FILES := \
+	client.conf loopback-client loopback-server README server.conf \
+	static-home.conf static-office.conf tls-home.conf tls-office.conf \
+	xinetd-client-config xinetd-server-config
+
+OPENVPN_INSTALL_SAMPLE_CONFIG_SCRIPTS := \
+	firewall.sh home.up office.up openvpn-shutdown.sh openvpn-startup.sh
+
+OPENVPN_INSTALL_SAMPLE_SCRIPTS := bridge-start bridge-stop
 
 # ----------------------------------------------------------------------------
 # Target-Install
@@ -55,9 +73,26 @@ $(STATEDIR)/openvpn.targetinstall:
 	@$(call install_fixup, openvpn,AUTHOR,"Carsten Schlote <c.schlote@konzeptpark.de>")
 	@$(call install_fixup, openvpn,DESCRIPTION,missing)
 
-	@$(call install_copy, openvpn, 0, 0, 0755, -, /usr/sbin/openvpn)
+ifdef PTXCONF_OPENVPN_INSTALL_SAMPLE_CONFIGS
+	@$(foreach file,$(OPENVPN_INSTALL_SAMPLE_CONFIG_FILES), \
+		$(call install_copy, openvpn, 0, 0, 0644, \
+		$(OPENVPN_DIR)/sample/sample-config-files/$(file), \
+		/usr/share/openvpn/sample-config-files/$(file));)
 
-	@$(call install_copy, openvpn, 0, 0, 0755, /etc/openvpn)
+	@$(foreach script,$(OPENVPN_INSTALL_SAMPLE_CONFIG_SCRIPTS), \
+		$(call install_copy, openvpn, 0, 0, 0755, \
+		$(OPENVPN_DIR)/sample/sample-config-files/$(script), \
+		/usr/share/openvpn/sample-config-files/$(script));)
+endif
+
+ifdef PTXCONF_OPENVPN_INSTALL_SAMPLE_SCRIPTS
+	@$(foreach script,$(OPENVPN_INSTALL_SAMPLE_SCRIPTS), \
+		$(call install_copy, openvpn, 0, 0, 0755, \
+		$(OPENVPN_DIR)/sample/sample-scripts/$(script), \
+		/usr/share/openvpn/sample-scripts/$(script));)
+endif
+
+	@$(call install_copy, openvpn, 0, 0, 0755, -, /usr/sbin/openvpn)
 
 	@$(call install_finish, openvpn)
 
-- 
2.2.2


-- 
ptxdist mailing list
ptxdist@pengutronix.de

Re: [ptxdist] [PATCHv2 4/4] openvpn: rework and version bump

[Michael Olbrich]

On Sun, Jan 25, 2015 at 08:56:24PM +0100, Alexander Aring wrote:
> This patch reworks the openvpn rules. Some points which are new now:
> 
> - systemd support if OPENVPN_SYSTEMD
> - install openvpn sample configs as reference for /etc/openvpn/
> - install openvpn sample scripts (ethernet bridging)
> - add required environemnt for networking utilities while configure
> - add several missed autoconf configure options
> 
> Additional this patch do a version bump to 2.3.6
> 
> Signed-off-by: Alexander Aring <alex.aring@gmail.com>
> ---
>  rules/openvpn.in   | 27 +++++++++++++++++++++++++
>  rules/openvpn.make | 59 +++++++++++++++++++++++++++++++++++++++++++-----------
>  2 files changed, 74 insertions(+), 12 deletions(-)
> 
> diff --git a/rules/openvpn.in b/rules/openvpn.in
> index 3649968..1cd4a54 100644
> --- a/rules/openvpn.in
> +++ b/rules/openvpn.in
> @@ -5,6 +5,11 @@ menuconfig OPENVPN
>  	prompt "openvpn                       "
>  	select OPENSSL
>  	select LIBLZO if OPENVPN_LZO
> +	select IPROUTE2		if !BUSYBOX_IP && RUNTIME
> +	select IPROUTE2_IP	if !BUSYBOX_IP && RUNTIME
> +	select BUSYBOX_IFCONFIG
> +	select BUSYBOX_NETSTAT
> +	select BUSYBOX_ROUTE
>  	help
>  	  virtual private network daemon
>  
> @@ -34,4 +39,26 @@ config OPENVPN_LZO
>  	  will select the LZO library as well.
>  	  If unsure, say N.
>  
> +config OPENVPN_SYSTEMD
> +	bool
> +	prompt "Enable systemd support"
> +	depends on SYSTEMD

This does not work. We need a build-time dependency.

add

	select SYSTEMD		if OPENVPN_SYSTEMD

above instead.

Michael

> +	help
> +	  This enables systemd support for openvpn.
> +
> +config OPENVPN_INSTALL_SAMPLE_CONFIGS
> +	bool
> +	prompt "Install sample configs"
> +	select IPTABLES
> +	select IPTABLES_INSTALL_TOOLS

mot this to the main option with 'if OPENVPN_INSTALL_SAMPLE_CONFIGS && RUNTIME'

> +	help
> +	  Install sample configs into /usr/share/openvpn/sample-config-files.
> +
> +config OPENVPN_INSTALL_SAMPLE_SCRIPTS
> +	bool
> +	prompt "Install sample scripts"
> +	select BRIDGE_UTILS

The same here.

Michael

> +	help
> +	  Install sample scripts into /usr/share/openvpn/sample-scripts.
> +
>  endif
> diff --git a/rules/openvpn.make b/rules/openvpn.make
> index d288d43..7cfa427 100644
> --- a/rules/openvpn.make
> +++ b/rules/openvpn.make
> @@ -16,11 +16,11 @@ PACKAGES-$(PTXCONF_OPENVPN) += openvpn
>  #
>  # Paths and names
>  #
> -OPENVPN_VERSION		:= 2.1.1
> -OPENVPN_MD5		:= b273ed2b5ec8616fb9834cde8634bce7
> +OPENVPN_VERSION		:= 2.3.6
> +OPENVPN_MD5		:= 6ca03fe0fd093e0d01601abee808835c
>  OPENVPN			:= openvpn-$(OPENVPN_VERSION)
>  OPENVPN_SUFFIX		:= tar.gz
> -OPENVPN_URL		:= http://openvpn.net/release/$(OPENVPN).$(OPENVPN_SUFFIX)
> +OPENVPN_URL		:= http://swupdate.openvpn.org/community/releases/$(OPENVPN).$(OPENVPN_SUFFIX)
>  OPENVPN_SOURCE		:= $(SRCDIR)/$(OPENVPN).$(OPENVPN_SUFFIX)
>  OPENVPN_DIR		:= $(BUILDDIR)/$(OPENVPN)
>  
> @@ -29,18 +29,36 @@ OPENVPN_DIR		:= $(BUILDDIR)/$(OPENVPN)
>  # ----------------------------------------------------------------------------
>  
>  OPENVPN_PATH	:= PATH=$(CROSS_PATH)
> -OPENVPN_ENV 	:= $(CROSS_ENV)
> +OPENVPN_ENV	:= \
> +	$(CROSS_ENV) \
> +	IFCONFIG=/sbin/ifconfig \
> +	ROUTE=/sbin/route \
> +	IPROUTE=/sbin/ip \
> +	NETSTAT=/bin/netstat
>  
>  #
>  # autoconf
>  #
> -OPENVPN_AUTOCONF := $(CROSS_AUTOCONF_USR)
> +OPENVPN_AUTOCONF := \
> +	$(CROSS_AUTOCONF_USR) \
> +	--$(call ptx/endis, PTXCONF_OPENVPN_LZO)-lzo \
> +	--disable-plugins \
> +	--disable-debug \
> +	--enable-small \
> +	--disable-iproute2 \
> +	--disable-selinux \
> +	--$(call ptx/endis, PTXCONF_OPENVPN_SYSTEMD)-systemd \
> +	--with-crypto-library=openssl
>  
> -ifdef PTXCONF_OPENVPN_LZO
> -OPENVPN_AUTOCONF += --enable-lzo
> -else
> -OPENVPN_AUTOCONF += --disable-lzo
> -endif
> +OPENVPN_INSTALL_SAMPLE_CONFIG_FILES := \
> +	client.conf loopback-client loopback-server README server.conf \
> +	static-home.conf static-office.conf tls-home.conf tls-office.conf \
> +	xinetd-client-config xinetd-server-config
> +
> +OPENVPN_INSTALL_SAMPLE_CONFIG_SCRIPTS := \
> +	firewall.sh home.up office.up openvpn-shutdown.sh openvpn-startup.sh
> +
> +OPENVPN_INSTALL_SAMPLE_SCRIPTS := bridge-start bridge-stop
>  
>  # ----------------------------------------------------------------------------
>  # Target-Install
> @@ -55,9 +73,26 @@ $(STATEDIR)/openvpn.targetinstall:
>  	@$(call install_fixup, openvpn,AUTHOR,"Carsten Schlote <c.schlote@konzeptpark.de>")
>  	@$(call install_fixup, openvpn,DESCRIPTION,missing)
>  
> -	@$(call install_copy, openvpn, 0, 0, 0755, -, /usr/sbin/openvpn)
> +ifdef PTXCONF_OPENVPN_INSTALL_SAMPLE_CONFIGS
> +	@$(foreach file,$(OPENVPN_INSTALL_SAMPLE_CONFIG_FILES), \
> +		$(call install_copy, openvpn, 0, 0, 0644, \
> +		$(OPENVPN_DIR)/sample/sample-config-files/$(file), \
> +		/usr/share/openvpn/sample-config-files/$(file));)
>  
> -	@$(call install_copy, openvpn, 0, 0, 0755, /etc/openvpn)
> +	@$(foreach script,$(OPENVPN_INSTALL_SAMPLE_CONFIG_SCRIPTS), \
> +		$(call install_copy, openvpn, 0, 0, 0755, \
> +		$(OPENVPN_DIR)/sample/sample-config-files/$(script), \
> +		/usr/share/openvpn/sample-config-files/$(script));)
> +endif
> +
> +ifdef PTXCONF_OPENVPN_INSTALL_SAMPLE_SCRIPTS
> +	@$(foreach script,$(OPENVPN_INSTALL_SAMPLE_SCRIPTS), \
> +		$(call install_copy, openvpn, 0, 0, 0755, \
> +		$(OPENVPN_DIR)/sample/sample-scripts/$(script), \
> +		/usr/share/openvpn/sample-scripts/$(script));)
> +endif
> +
> +	@$(call install_copy, openvpn, 0, 0, 0755, -, /usr/sbin/openvpn)
>  
>  	@$(call install_finish, openvpn)
>  
> -- 
> 2.2.2
> 
> 
> -- 
> ptxdist mailing list
> ptxdist@pengutronix.de
> 

-- 
Pengutronix e.K.                           |                             |
Industrial Linux Solutions                 | http://www.pengutronix.de/  |
Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

-- 
ptxdist mailing list
ptxdist@pengutronix.de

Re: [ptxdist] [PATCHv2 4/4] openvpn: rework and version bump

[Alexander Aring]

On Mon, Jan 26, 2015 at 04:24:10PM +0100, Michael Olbrich wrote:
> On Sun, Jan 25, 2015 at 08:56:24PM +0100, Alexander Aring wrote:
> > This patch reworks the openvpn rules. Some points which are new now:
> > 
> > - systemd support if OPENVPN_SYSTEMD
> > - install openvpn sample configs as reference for /etc/openvpn/
> > - install openvpn sample scripts (ethernet bridging)
> > - add required environemnt for networking utilities while configure
> > - add several missed autoconf configure options
> > 
> > Additional this patch do a version bump to 2.3.6
> > 
> > Signed-off-by: Alexander Aring <alex.aring@gmail.com>
> > ---
> >  rules/openvpn.in   | 27 +++++++++++++++++++++++++
> >  rules/openvpn.make | 59 +++++++++++++++++++++++++++++++++++++++++++-----------
> >  2 files changed, 74 insertions(+), 12 deletions(-)
> > 
> > diff --git a/rules/openvpn.in b/rules/openvpn.in
> > index 3649968..1cd4a54 100644
> > --- a/rules/openvpn.in
> > +++ b/rules/openvpn.in
> > @@ -5,6 +5,11 @@ menuconfig OPENVPN
> >  	prompt "openvpn                       "
> >  	select OPENSSL
> >  	select LIBLZO if OPENVPN_LZO
> > +	select IPROUTE2		if !BUSYBOX_IP && RUNTIME
> > +	select IPROUTE2_IP	if !BUSYBOX_IP && RUNTIME
> > +	select BUSYBOX_IFCONFIG
> > +	select BUSYBOX_NETSTAT
> > +	select BUSYBOX_ROUTE
> >  	help
> >  	  virtual private network daemon
> >  
> > @@ -34,4 +39,26 @@ config OPENVPN_LZO
> >  	  will select the LZO library as well.
> >  	  If unsure, say N.
> >  
> > +config OPENVPN_SYSTEMD
> > +	bool
> > +	prompt "Enable systemd support"
> > +	depends on SYSTEMD
> 
> This does not work. We need a build-time dependency.
> 
> add
> 
> 	select SYSTEMD		if OPENVPN_SYSTEMD
> 
> above instead.
> 

ok.

> Michael
> 
> > +	help
> > +	  This enables systemd support for openvpn.
> > +
> > +config OPENVPN_INSTALL_SAMPLE_CONFIGS
> > +	bool
> > +	prompt "Install sample configs"
> > +	select IPTABLES
> > +	select IPTABLES_INSTALL_TOOLS
> 
> mot this to the main option with 'if OPENVPN_INSTALL_SAMPLE_CONFIGS && RUNTIME'
> 
> > +	help
> > +	  Install sample configs into /usr/share/openvpn/sample-config-files.
> > +
> > +config OPENVPN_INSTALL_SAMPLE_SCRIPTS
> > +	bool
> > +	prompt "Install sample scripts"
> > +	select BRIDGE_UTILS
> 
> The same here.
> 

ok.

-- 
ptxdist mailing list
ptxdist@pengutronix.de