mailarchive of the ptxdist mailing list
 help / color / mirror / Atom feed
* [ptxdist] [PATCH] strongswan: Version bump 5.6.1 -> 5.8.1
@ 2019-11-18 12:45 Lars Pedersen
  2019-11-19 12:49 ` [ptxdist] [PATCH v2] " Lars Pedersen
  2019-12-05  9:34 ` Lars Pedersen
  0 siblings, 2 replies; 8+ messages in thread
From: Lars Pedersen @ 2019-11-18 12:45 UTC (permalink / raw)
  To: ptxdist; +Cc: Lars Pedersen

Add swanctl support which replaces the old starter, ipsec and stroke
backend. In this patch swanctl requires systemd.
https://wiki.strongswan.org/projects/strongswan/wiki/Charon-systemd

Use install_glob to install all compiled plugins.

Option to enable strongswan service if systemd is used.

Option to set sysconfdir. Default /etc.

Signed-off-by: Lars Pedersen <lapeddk@gmail.com>
---
 rules/strongswan.in   |  25 ++++++--
 rules/strongswan.make | 129 ++++++++++++++++++------------------------
 2 files changed, 76 insertions(+), 78 deletions(-)

diff --git a/rules/strongswan.in b/rules/strongswan.in
index d0e660c57..651fd86a6 100644
--- a/rules/strongswan.in
+++ b/rules/strongswan.in
@@ -48,10 +48,27 @@ config STRONGSWAN_AFALG
 
 config STRONGSWAN_SYSTEMD_UNIT
 	bool
-	default y
-	# uses old systemd-daemon / libsystemd-journal libs
-	depends on BROKEN
 	depends on INITMETHOD_SYSTEMD
-	prompt "install systemd service file"
+	prompt "install systemd unit file"
+
+config STRONGSWAN_SYSTEMD_UNIT_ENABLE_SERVICE
+	bool
+	depends on STRONGSWAN_SYSTEMD_UNIT
+	prompt "Enable strongswan unit file"
+
+config STRONGSWAN_SWANCTL
+	bool
+	depends on STRONGSWAN_SYSTEMD_UNIT
+	prompt "Use swanctl for configuration"
+	help
+		Swanctl is a new, portable command line utility to configure,
+		control and monitor the IKE daemon charon using the vici interface.
+
+config STRONGSWAN_SYSCONF_DIR
+	string
+	prompt "Sysconf directory"
+	default "/etc"
+	help
+		Override default /etc sysconf directory for strongswan.
 
 endif
diff --git a/rules/strongswan.make b/rules/strongswan.make
index 90db7bef7..3e8c9b827 100644
--- a/rules/strongswan.make
+++ b/rules/strongswan.make
@@ -15,8 +15,8 @@ PACKAGES-$(PTXCONF_STRONGSWAN) += strongswan
 #
 # Paths and names
 #
-STRONGSWAN_VERSION	:= 5.6.1
-STRONGSWAN_MD5		:= cb2241f1b96c524cd15b1c0f50ed9a27
+STRONGSWAN_VERSION	:= 5.8.1
+STRONGSWAN_MD5		:= 5a6b9980cd1ac4fad3c24b55ed960ac9
 STRONGSWAN		:= strongswan-$(STRONGSWAN_VERSION)
 STRONGSWAN_SUFFIX	:= tar.bz2
 STRONGSWAN_URL		:= https://download.strongswan.org/$(STRONGSWAN).$(STRONGSWAN_SUFFIX)
@@ -36,6 +36,7 @@ STRONGSWAN_CONF_OPT	:= \
 	--$(call ptx/endis, PTXCONF_STRONGSWAN_AFALG)-af-alg \
 	--disable-bliss \
 	--disable-blowfish \
+	--disable-botan \
 	--disable-ccm \
 	--disable-chapoly \
 	--enable-cmac \
@@ -54,6 +55,7 @@ STRONGSWAN_CONF_OPT	:= \
 	--enable-nonce \
 	--disable-ntru \
 	--$(call ptx/endis, PTXCONF_STRONGSWAN_OPENSSL)-openssl \
+	--disable-wolfssl \
 	--disable-padlock \
 	--enable-random \
 	--disable-rc2 \
@@ -126,11 +128,9 @@ STRONGSWAN_CONF_OPT	:= \
 	--enable-socket-default \
 	--disable-socket-dynamic \
 	--disable-socket-win \
-	--enable-stroke \
 	--disable-smp \
 	--disable-sql \
 	--disable-uci \
-	--disable-vici \
 	--disable-android-dns \
 	--enable-attr \
 	--disable-attr-sql \
@@ -147,8 +147,6 @@ STRONGSWAN_CONF_OPT	:= \
 	--disable-imv-os \
 	--disable-imc-attestation \
 	--disable-imv-attestation \
-	--disable-imc-swid \
-	--disable-imv-swid \
 	--disable-imc-swima \
 	--disable-imv-swima \
 	--disable-imc-hcd \
@@ -174,14 +172,13 @@ STRONGSWAN_CONF_OPT	:= \
 	--disable-load-tester \
 	--disable-lookip \
 	--disable-radattr \
+	--disable-save-keys \
 	--disable-systime-fix \
 	--disable-test-vectors \
 	--enable-updown \
 	--disable-aikgen \
-	--enable-charon \
 	--disable-cmd \
 	--disable-conftest \
-	--disable-dumm \
 	--disable-fast \
 	--disable-fuzzing \
 	--disable-libipsec \
@@ -190,11 +187,9 @@ STRONGSWAN_CONF_OPT	:= \
 	--disable-medsrv \
 	--disable-nm \
 	--enable-pki \
-	--enable-scepclient \
 	--enable-scripts \
 	--disable-svc \
 	--$(call ptx/endis, PTXCONF_STRONGSWAN_SYSTEMD_UNIT)-systemd \
-	--disable-swanctl \
 	--disable-tkm \
 	--disable-bfd-backtraces \
 	--disable-dbghelp-backtraces \
@@ -221,52 +216,29 @@ STRONGSWAN_CONF_OPT	:= \
 	--enable-dependency-tracking \
 	--enable-shared \
 	--with-ipseclibdir=/usr/lib \
-	--with-systemdsystemunitdir=/usr/lib/systemd/system
+	--with-systemdsystemunitdir=/usr/lib/systemd/system \
+	--sysconfdir=$(PTXCONF_STRONGSWAN_SYSCONF_DIR)
+
+ifdef PTXCONF_STRONGSWAN_SWANCTL
+	STRONGSWAN_CONF_OPT += \
+		--enable-swanctl \
+		--disable-charon \
+		--disable-stroke \
+		--enable-vici \
+		--disable-scepclient
+else
+	STRONGSWAN_CONF_OPT += \
+		--disable-swanctl \
+		--enable-charon \
+		--enable-stroke \
+		--disable-vici \
+		--enable-scepclient
+endif
 
 # ----------------------------------------------------------------------------
 # Target-Install
 # ----------------------------------------------------------------------------
 
-STRONGSWAN_PLUGINS := \
-	libstrongswan-aes.so \
-	libstrongswan-attr.so \
-	libstrongswan-cmac.so \
-	libstrongswan-constraints.so \
-	libstrongswan-dnskey.so \
-	libstrongswan-fips-prf.so \
-	libstrongswan-gcm.so \
-	libstrongswan-gmp.so \
-	libstrongswan-hmac.so \
-	libstrongswan-kernel-netlink.so \
-	libstrongswan-nonce.so \
-	libstrongswan-pem.so \
-	libstrongswan-pgp.so \
-	libstrongswan-pkcs1.so \
-	libstrongswan-pkcs7.so \
-	libstrongswan-pkcs8.so \
-	libstrongswan-pubkey.so \
-	libstrongswan-random.so \
-	libstrongswan-resolve.so \
-	libstrongswan-revocation.so \
-	libstrongswan-sha1.so \
-	libstrongswan-sha2.so \
-	libstrongswan-socket-default.so \
-	libstrongswan-stroke.so \
-	libstrongswan-updown.so \
-	libstrongswan-x509.so \
-	libstrongswan-xauth-generic.so \
-	libstrongswan-xcbc.so
-
-ifdef PTXCONF_STRONGSWAN_LIBCURL
-	STRONGSWAN_PLUGINS += libstrongswan-curl.so
-endif
-ifdef PTXCONF_STRONGSWAN_OPENSSL
-	STRONGSWAN_PLUGINS += libstrongswan-openssl.so
-endif
-ifdef PTXCONF_STRONGSWAN_AFALG
-	STRONGSWAN_PLUGINS += libstrongswan-af-alg.so
-endif
-
 $(STATEDIR)/strongswan.targetinstall:
 	@$(call targetinfo)
 
@@ -276,34 +248,43 @@ $(STATEDIR)/strongswan.targetinstall:
 	@$(call install_fixup, strongswan,AUTHOR,"Christoph Fritz <chf@fritzc.com>")
 	@$(call install_fixup, strongswan,DESCRIPTION,missing)
 
-	@$(call install_alternative, strongswan, 0, 0, 0644, /etc/strongswan.conf)
-
-	@$(call install_copy, strongswan, 0, 0, 0755, -, /usr/sbin/ipsec)
-
-	@$(call install_tree, strongswan, 0, 0, -, /usr/libexec/ipsec)
+ifdef PTXCONF_STRONGSWAN_SYSTEMD_UNIT_ENABLE_SERVICE
+	@$(call install_link, strongswan, ../strongswan.service, \
+		/usr/lib/systemd/system/multi-user.target.wants/strongswan.service)
+endif
 
-	@$(call install_lib, strongswan, 0, 0, 0644, libcharon)
-	@$(call install_lib, strongswan, 0, 0, 0644, libstrongswan)
+	@$(call install_tree, strongswan, 0, 0, -, /usr/bin)
+	@$(call install_glob, strongswan, 0, 0, -, /usr/lib,,*.la)
+	@$(call install_tree, strongswan, 0, 0, -, /usr/libexec)
+	@$(call install_tree, strongswan, 0, 0, -, /usr/sbin)
 
-	@$(foreach plugin, $(STRONGSWAN_PLUGINS), \
-		$(call install_copy, strongswan, 0, 0, 0644, -, \
-			/usr/lib/plugins/$(plugin));)
+	@$(call install_alternative, strongswan, 0, 0, 0644,  $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/strongswan.conf)
 
-ifdef PTXCONF_STRONGSWAN_SYSTEMD_UNIT
-	@$(call install_alternative, strongswan, 0, 0, 0644, \
-		/usr/lib/systemd/system/strongswan.service)
-	@$(call install_link, strongswan, ../strongswan.service, \
-		/usr/lib/systemd/system/multi-user.target.wants/strongswan.service)
+ifdef PTXCONF_STRONGSWAN_SWANCTL
+	@$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/bliss)
+	@$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/conf.d)
+	@$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/ecdsa)
+	@$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/pkcs12)
+	@$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/pkcs8)
+	@$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/private)
+	@$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/pubkey)
+	@$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/rsa)
+	@$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509)
+	@$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509aa)
+	@$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509ac)
+	@$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509ca)
+	@$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509crl)
+	@$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509ocsp)
 endif
 
-	@$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/aacerts)
-	@$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/acerts)
-	@$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/cacerts)
-	@$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/certs)
-	@$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/crls)
-	@$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/ocspcerts)
-	@$(call install_copy, strongswan, 0, 0, 0600, /etc/ipsec.d/private)
-	@$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/reqs)
+	@$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/aacerts)
+	@$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/acerts)
+	@$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/cacerts)
+	@$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/certs)
+	@$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/crls)
+	@$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/ocspcerts)
+	@$(call install_copy, strongswan, 0, 0, 0600, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/private)
+	@$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/reqs)
 
 	@$(call install_finish, strongswan)
 
-- 
2.23.0


_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de

^ permalink raw reply	[flat|nested] 8+ messages in thread

end of thread, other threads:[~2019-12-05 15:45 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-11-18 12:45 [ptxdist] [PATCH] strongswan: Version bump 5.6.1 -> 5.8.1 Lars Pedersen
2019-11-19 12:49 ` [ptxdist] [PATCH v2] " Lars Pedersen
2019-11-19 14:56   ` Bruno Thomsen
2019-11-25  6:53   ` Michael Olbrich
2019-11-26 10:21     ` Lars Pedersen
2019-11-28 16:21       ` Michael Olbrich
2019-12-05  9:34 ` Lars Pedersen
2019-12-05 15:45   ` Michael Olbrich

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox