* [ptxdist] [PATCH] strongswan: Version bump 5.6.1 -> 5.8.1
@ 2019-11-18 12:45 Lars Pedersen
2019-11-19 12:49 ` [ptxdist] [PATCH v2] " Lars Pedersen
2019-12-05 9:34 ` Lars Pedersen
0 siblings, 2 replies; 8+ messages in thread
From: Lars Pedersen @ 2019-11-18 12:45 UTC (permalink / raw)
To: ptxdist; +Cc: Lars Pedersen
Add swanctl support which replaces the old starter, ipsec and stroke
backend. In this patch swanctl requires systemd.
https://wiki.strongswan.org/projects/strongswan/wiki/Charon-systemd
Use install_glob to install all compiled plugins.
Option to enable strongswan service if systemd is used.
Option to set sysconfdir. Default /etc.
Signed-off-by: Lars Pedersen <lapeddk@gmail.com>
---
rules/strongswan.in | 25 ++++++--
rules/strongswan.make | 129 ++++++++++++++++++------------------------
2 files changed, 76 insertions(+), 78 deletions(-)
diff --git a/rules/strongswan.in b/rules/strongswan.in
index d0e660c57..651fd86a6 100644
--- a/rules/strongswan.in
+++ b/rules/strongswan.in
@@ -48,10 +48,27 @@ config STRONGSWAN_AFALG
config STRONGSWAN_SYSTEMD_UNIT
bool
- default y
- # uses old systemd-daemon / libsystemd-journal libs
- depends on BROKEN
depends on INITMETHOD_SYSTEMD
- prompt "install systemd service file"
+ prompt "install systemd unit file"
+
+config STRONGSWAN_SYSTEMD_UNIT_ENABLE_SERVICE
+ bool
+ depends on STRONGSWAN_SYSTEMD_UNIT
+ prompt "Enable strongswan unit file"
+
+config STRONGSWAN_SWANCTL
+ bool
+ depends on STRONGSWAN_SYSTEMD_UNIT
+ prompt "Use swanctl for configuration"
+ help
+ Swanctl is a new, portable command line utility to configure,
+ control and monitor the IKE daemon charon using the vici interface.
+
+config STRONGSWAN_SYSCONF_DIR
+ string
+ prompt "Sysconf directory"
+ default "/etc"
+ help
+ Override default /etc sysconf directory for strongswan.
endif
diff --git a/rules/strongswan.make b/rules/strongswan.make
index 90db7bef7..3e8c9b827 100644
--- a/rules/strongswan.make
+++ b/rules/strongswan.make
@@ -15,8 +15,8 @@ PACKAGES-$(PTXCONF_STRONGSWAN) += strongswan
#
# Paths and names
#
-STRONGSWAN_VERSION := 5.6.1
-STRONGSWAN_MD5 := cb2241f1b96c524cd15b1c0f50ed9a27
+STRONGSWAN_VERSION := 5.8.1
+STRONGSWAN_MD5 := 5a6b9980cd1ac4fad3c24b55ed960ac9
STRONGSWAN := strongswan-$(STRONGSWAN_VERSION)
STRONGSWAN_SUFFIX := tar.bz2
STRONGSWAN_URL := https://download.strongswan.org/$(STRONGSWAN).$(STRONGSWAN_SUFFIX)
@@ -36,6 +36,7 @@ STRONGSWAN_CONF_OPT := \
--$(call ptx/endis, PTXCONF_STRONGSWAN_AFALG)-af-alg \
--disable-bliss \
--disable-blowfish \
+ --disable-botan \
--disable-ccm \
--disable-chapoly \
--enable-cmac \
@@ -54,6 +55,7 @@ STRONGSWAN_CONF_OPT := \
--enable-nonce \
--disable-ntru \
--$(call ptx/endis, PTXCONF_STRONGSWAN_OPENSSL)-openssl \
+ --disable-wolfssl \
--disable-padlock \
--enable-random \
--disable-rc2 \
@@ -126,11 +128,9 @@ STRONGSWAN_CONF_OPT := \
--enable-socket-default \
--disable-socket-dynamic \
--disable-socket-win \
- --enable-stroke \
--disable-smp \
--disable-sql \
--disable-uci \
- --disable-vici \
--disable-android-dns \
--enable-attr \
--disable-attr-sql \
@@ -147,8 +147,6 @@ STRONGSWAN_CONF_OPT := \
--disable-imv-os \
--disable-imc-attestation \
--disable-imv-attestation \
- --disable-imc-swid \
- --disable-imv-swid \
--disable-imc-swima \
--disable-imv-swima \
--disable-imc-hcd \
@@ -174,14 +172,13 @@ STRONGSWAN_CONF_OPT := \
--disable-load-tester \
--disable-lookip \
--disable-radattr \
+ --disable-save-keys \
--disable-systime-fix \
--disable-test-vectors \
--enable-updown \
--disable-aikgen \
- --enable-charon \
--disable-cmd \
--disable-conftest \
- --disable-dumm \
--disable-fast \
--disable-fuzzing \
--disable-libipsec \
@@ -190,11 +187,9 @@ STRONGSWAN_CONF_OPT := \
--disable-medsrv \
--disable-nm \
--enable-pki \
- --enable-scepclient \
--enable-scripts \
--disable-svc \
--$(call ptx/endis, PTXCONF_STRONGSWAN_SYSTEMD_UNIT)-systemd \
- --disable-swanctl \
--disable-tkm \
--disable-bfd-backtraces \
--disable-dbghelp-backtraces \
@@ -221,52 +216,29 @@ STRONGSWAN_CONF_OPT := \
--enable-dependency-tracking \
--enable-shared \
--with-ipseclibdir=/usr/lib \
- --with-systemdsystemunitdir=/usr/lib/systemd/system
+ --with-systemdsystemunitdir=/usr/lib/systemd/system \
+ --sysconfdir=$(PTXCONF_STRONGSWAN_SYSCONF_DIR)
+
+ifdef PTXCONF_STRONGSWAN_SWANCTL
+ STRONGSWAN_CONF_OPT += \
+ --enable-swanctl \
+ --disable-charon \
+ --disable-stroke \
+ --enable-vici \
+ --disable-scepclient
+else
+ STRONGSWAN_CONF_OPT += \
+ --disable-swanctl \
+ --enable-charon \
+ --enable-stroke \
+ --disable-vici \
+ --enable-scepclient
+endif
# ----------------------------------------------------------------------------
# Target-Install
# ----------------------------------------------------------------------------
-STRONGSWAN_PLUGINS := \
- libstrongswan-aes.so \
- libstrongswan-attr.so \
- libstrongswan-cmac.so \
- libstrongswan-constraints.so \
- libstrongswan-dnskey.so \
- libstrongswan-fips-prf.so \
- libstrongswan-gcm.so \
- libstrongswan-gmp.so \
- libstrongswan-hmac.so \
- libstrongswan-kernel-netlink.so \
- libstrongswan-nonce.so \
- libstrongswan-pem.so \
- libstrongswan-pgp.so \
- libstrongswan-pkcs1.so \
- libstrongswan-pkcs7.so \
- libstrongswan-pkcs8.so \
- libstrongswan-pubkey.so \
- libstrongswan-random.so \
- libstrongswan-resolve.so \
- libstrongswan-revocation.so \
- libstrongswan-sha1.so \
- libstrongswan-sha2.so \
- libstrongswan-socket-default.so \
- libstrongswan-stroke.so \
- libstrongswan-updown.so \
- libstrongswan-x509.so \
- libstrongswan-xauth-generic.so \
- libstrongswan-xcbc.so
-
-ifdef PTXCONF_STRONGSWAN_LIBCURL
- STRONGSWAN_PLUGINS += libstrongswan-curl.so
-endif
-ifdef PTXCONF_STRONGSWAN_OPENSSL
- STRONGSWAN_PLUGINS += libstrongswan-openssl.so
-endif
-ifdef PTXCONF_STRONGSWAN_AFALG
- STRONGSWAN_PLUGINS += libstrongswan-af-alg.so
-endif
-
$(STATEDIR)/strongswan.targetinstall:
@$(call targetinfo)
@@ -276,34 +248,43 @@ $(STATEDIR)/strongswan.targetinstall:
@$(call install_fixup, strongswan,AUTHOR,"Christoph Fritz <chf@fritzc.com>")
@$(call install_fixup, strongswan,DESCRIPTION,missing)
- @$(call install_alternative, strongswan, 0, 0, 0644, /etc/strongswan.conf)
-
- @$(call install_copy, strongswan, 0, 0, 0755, -, /usr/sbin/ipsec)
-
- @$(call install_tree, strongswan, 0, 0, -, /usr/libexec/ipsec)
+ifdef PTXCONF_STRONGSWAN_SYSTEMD_UNIT_ENABLE_SERVICE
+ @$(call install_link, strongswan, ../strongswan.service, \
+ /usr/lib/systemd/system/multi-user.target.wants/strongswan.service)
+endif
- @$(call install_lib, strongswan, 0, 0, 0644, libcharon)
- @$(call install_lib, strongswan, 0, 0, 0644, libstrongswan)
+ @$(call install_tree, strongswan, 0, 0, -, /usr/bin)
+ @$(call install_glob, strongswan, 0, 0, -, /usr/lib,,*.la)
+ @$(call install_tree, strongswan, 0, 0, -, /usr/libexec)
+ @$(call install_tree, strongswan, 0, 0, -, /usr/sbin)
- @$(foreach plugin, $(STRONGSWAN_PLUGINS), \
- $(call install_copy, strongswan, 0, 0, 0644, -, \
- /usr/lib/plugins/$(plugin));)
+ @$(call install_alternative, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/strongswan.conf)
-ifdef PTXCONF_STRONGSWAN_SYSTEMD_UNIT
- @$(call install_alternative, strongswan, 0, 0, 0644, \
- /usr/lib/systemd/system/strongswan.service)
- @$(call install_link, strongswan, ../strongswan.service, \
- /usr/lib/systemd/system/multi-user.target.wants/strongswan.service)
+ifdef PTXCONF_STRONGSWAN_SWANCTL
+ @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/bliss)
+ @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/conf.d)
+ @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/ecdsa)
+ @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/pkcs12)
+ @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/pkcs8)
+ @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/private)
+ @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/pubkey)
+ @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/rsa)
+ @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509)
+ @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509aa)
+ @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509ac)
+ @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509ca)
+ @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509crl)
+ @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509ocsp)
endif
- @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/aacerts)
- @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/acerts)
- @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/cacerts)
- @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/certs)
- @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/crls)
- @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/ocspcerts)
- @$(call install_copy, strongswan, 0, 0, 0600, /etc/ipsec.d/private)
- @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/reqs)
+ @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/aacerts)
+ @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/acerts)
+ @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/cacerts)
+ @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/certs)
+ @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/crls)
+ @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/ocspcerts)
+ @$(call install_copy, strongswan, 0, 0, 0600, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/private)
+ @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/reqs)
@$(call install_finish, strongswan)
--
2.23.0
_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
^ permalink raw reply [flat|nested] 8+ messages in thread
* [ptxdist] [PATCH v2] strongswan: Version bump 5.6.1 -> 5.8.1
2019-11-18 12:45 [ptxdist] [PATCH] strongswan: Version bump 5.6.1 -> 5.8.1 Lars Pedersen
@ 2019-11-19 12:49 ` Lars Pedersen
2019-11-19 14:56 ` Bruno Thomsen
2019-11-25 6:53 ` Michael Olbrich
2019-12-05 9:34 ` Lars Pedersen
1 sibling, 2 replies; 8+ messages in thread
From: Lars Pedersen @ 2019-11-19 12:49 UTC (permalink / raw)
To: ptxdist; +Cc: Lars Pedersen
Add swanctl support which replaces the old starter, ipsec and stroke
backend. In this patch swanctl requires systemd.
https://wiki.strongswan.org/projects/strongswan/wiki/Charon-systemd
Use install_glob to install all compiled plugins.
Option to enable strongswan service if systemd is used.
Option to set sysconfdir. Default /etc.
Signed-off-by: Lars Pedersen <lapeddk@gmail.com>
---
v2: Missing tree install of strongswan.d directory in sysconf dir.
rules/strongswan.in | 25 ++++++--
rules/strongswan.make | 130 ++++++++++++++++++------------------------
2 files changed, 77 insertions(+), 78 deletions(-)
diff --git a/rules/strongswan.in b/rules/strongswan.in
index d0e660c57..651fd86a6 100644
--- a/rules/strongswan.in
+++ b/rules/strongswan.in
@@ -48,10 +48,27 @@ config STRONGSWAN_AFALG
config STRONGSWAN_SYSTEMD_UNIT
bool
- default y
- # uses old systemd-daemon / libsystemd-journal libs
- depends on BROKEN
depends on INITMETHOD_SYSTEMD
- prompt "install systemd service file"
+ prompt "install systemd unit file"
+
+config STRONGSWAN_SYSTEMD_UNIT_ENABLE_SERVICE
+ bool
+ depends on STRONGSWAN_SYSTEMD_UNIT
+ prompt "Enable strongswan unit file"
+
+config STRONGSWAN_SWANCTL
+ bool
+ depends on STRONGSWAN_SYSTEMD_UNIT
+ prompt "Use swanctl for configuration"
+ help
+ Swanctl is a new, portable command line utility to configure,
+ control and monitor the IKE daemon charon using the vici interface.
+
+config STRONGSWAN_SYSCONF_DIR
+ string
+ prompt "Sysconf directory"
+ default "/etc"
+ help
+ Override default /etc sysconf directory for strongswan.
endif
diff --git a/rules/strongswan.make b/rules/strongswan.make
index 90db7bef7..c0116e286 100644
--- a/rules/strongswan.make
+++ b/rules/strongswan.make
@@ -15,8 +15,8 @@ PACKAGES-$(PTXCONF_STRONGSWAN) += strongswan
#
# Paths and names
#
-STRONGSWAN_VERSION := 5.6.1
-STRONGSWAN_MD5 := cb2241f1b96c524cd15b1c0f50ed9a27
+STRONGSWAN_VERSION := 5.8.1
+STRONGSWAN_MD5 := 5a6b9980cd1ac4fad3c24b55ed960ac9
STRONGSWAN := strongswan-$(STRONGSWAN_VERSION)
STRONGSWAN_SUFFIX := tar.bz2
STRONGSWAN_URL := https://download.strongswan.org/$(STRONGSWAN).$(STRONGSWAN_SUFFIX)
@@ -36,6 +36,7 @@ STRONGSWAN_CONF_OPT := \
--$(call ptx/endis, PTXCONF_STRONGSWAN_AFALG)-af-alg \
--disable-bliss \
--disable-blowfish \
+ --disable-botan \
--disable-ccm \
--disable-chapoly \
--enable-cmac \
@@ -54,6 +55,7 @@ STRONGSWAN_CONF_OPT := \
--enable-nonce \
--disable-ntru \
--$(call ptx/endis, PTXCONF_STRONGSWAN_OPENSSL)-openssl \
+ --disable-wolfssl \
--disable-padlock \
--enable-random \
--disable-rc2 \
@@ -126,11 +128,9 @@ STRONGSWAN_CONF_OPT := \
--enable-socket-default \
--disable-socket-dynamic \
--disable-socket-win \
- --enable-stroke \
--disable-smp \
--disable-sql \
--disable-uci \
- --disable-vici \
--disable-android-dns \
--enable-attr \
--disable-attr-sql \
@@ -147,8 +147,6 @@ STRONGSWAN_CONF_OPT := \
--disable-imv-os \
--disable-imc-attestation \
--disable-imv-attestation \
- --disable-imc-swid \
- --disable-imv-swid \
--disable-imc-swima \
--disable-imv-swima \
--disable-imc-hcd \
@@ -174,14 +172,13 @@ STRONGSWAN_CONF_OPT := \
--disable-load-tester \
--disable-lookip \
--disable-radattr \
+ --disable-save-keys \
--disable-systime-fix \
--disable-test-vectors \
--enable-updown \
--disable-aikgen \
- --enable-charon \
--disable-cmd \
--disable-conftest \
- --disable-dumm \
--disable-fast \
--disable-fuzzing \
--disable-libipsec \
@@ -190,11 +187,9 @@ STRONGSWAN_CONF_OPT := \
--disable-medsrv \
--disable-nm \
--enable-pki \
- --enable-scepclient \
--enable-scripts \
--disable-svc \
--$(call ptx/endis, PTXCONF_STRONGSWAN_SYSTEMD_UNIT)-systemd \
- --disable-swanctl \
--disable-tkm \
--disable-bfd-backtraces \
--disable-dbghelp-backtraces \
@@ -221,52 +216,29 @@ STRONGSWAN_CONF_OPT := \
--enable-dependency-tracking \
--enable-shared \
--with-ipseclibdir=/usr/lib \
- --with-systemdsystemunitdir=/usr/lib/systemd/system
+ --with-systemdsystemunitdir=/usr/lib/systemd/system \
+ --sysconfdir=$(PTXCONF_STRONGSWAN_SYSCONF_DIR)
+
+ifdef PTXCONF_STRONGSWAN_SWANCTL
+ STRONGSWAN_CONF_OPT += \
+ --enable-swanctl \
+ --disable-charon \
+ --disable-stroke \
+ --enable-vici \
+ --disable-scepclient
+else
+ STRONGSWAN_CONF_OPT += \
+ --disable-swanctl \
+ --enable-charon \
+ --enable-stroke \
+ --disable-vici \
+ --enable-scepclient
+endif
# ----------------------------------------------------------------------------
# Target-Install
# ----------------------------------------------------------------------------
-STRONGSWAN_PLUGINS := \
- libstrongswan-aes.so \
- libstrongswan-attr.so \
- libstrongswan-cmac.so \
- libstrongswan-constraints.so \
- libstrongswan-dnskey.so \
- libstrongswan-fips-prf.so \
- libstrongswan-gcm.so \
- libstrongswan-gmp.so \
- libstrongswan-hmac.so \
- libstrongswan-kernel-netlink.so \
- libstrongswan-nonce.so \
- libstrongswan-pem.so \
- libstrongswan-pgp.so \
- libstrongswan-pkcs1.so \
- libstrongswan-pkcs7.so \
- libstrongswan-pkcs8.so \
- libstrongswan-pubkey.so \
- libstrongswan-random.so \
- libstrongswan-resolve.so \
- libstrongswan-revocation.so \
- libstrongswan-sha1.so \
- libstrongswan-sha2.so \
- libstrongswan-socket-default.so \
- libstrongswan-stroke.so \
- libstrongswan-updown.so \
- libstrongswan-x509.so \
- libstrongswan-xauth-generic.so \
- libstrongswan-xcbc.so
-
-ifdef PTXCONF_STRONGSWAN_LIBCURL
- STRONGSWAN_PLUGINS += libstrongswan-curl.so
-endif
-ifdef PTXCONF_STRONGSWAN_OPENSSL
- STRONGSWAN_PLUGINS += libstrongswan-openssl.so
-endif
-ifdef PTXCONF_STRONGSWAN_AFALG
- STRONGSWAN_PLUGINS += libstrongswan-af-alg.so
-endif
-
$(STATEDIR)/strongswan.targetinstall:
@$(call targetinfo)
@@ -276,34 +248,44 @@ $(STATEDIR)/strongswan.targetinstall:
@$(call install_fixup, strongswan,AUTHOR,"Christoph Fritz <chf@fritzc.com>")
@$(call install_fixup, strongswan,DESCRIPTION,missing)
- @$(call install_alternative, strongswan, 0, 0, 0644, /etc/strongswan.conf)
-
- @$(call install_copy, strongswan, 0, 0, 0755, -, /usr/sbin/ipsec)
-
- @$(call install_tree, strongswan, 0, 0, -, /usr/libexec/ipsec)
+ifdef PTXCONF_STRONGSWAN_SYSTEMD_UNIT_ENABLE_SERVICE
+ @$(call install_link, strongswan, ../strongswan.service, \
+ /usr/lib/systemd/system/multi-user.target.wants/strongswan.service)
+endif
- @$(call install_lib, strongswan, 0, 0, 0644, libcharon)
- @$(call install_lib, strongswan, 0, 0, 0644, libstrongswan)
+ @$(call install_tree, strongswan, 0, 0, -, /usr/bin)
+ @$(call install_glob, strongswan, 0, 0, -, /usr/lib,,*.la)
+ @$(call install_tree, strongswan, 0, 0, -, /usr/libexec)
+ @$(call install_tree, strongswan, 0, 0, -, /usr/sbin)
- @$(foreach plugin, $(STRONGSWAN_PLUGINS), \
- $(call install_copy, strongswan, 0, 0, 0644, -, \
- /usr/lib/plugins/$(plugin));)
+ @$(call install_alternative, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/strongswan.conf)
-ifdef PTXCONF_STRONGSWAN_SYSTEMD_UNIT
- @$(call install_alternative, strongswan, 0, 0, 0644, \
- /usr/lib/systemd/system/strongswan.service)
- @$(call install_link, strongswan, ../strongswan.service, \
- /usr/lib/systemd/system/multi-user.target.wants/strongswan.service)
+ifdef PTXCONF_STRONGSWAN_SWANCTL
+ @$(call install_tree, strongswan, 0, 0, -, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/strongswan.d)
+ @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/bliss)
+ @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/conf.d)
+ @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/ecdsa)
+ @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/pkcs12)
+ @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/pkcs8)
+ @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/private)
+ @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/pubkey)
+ @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/rsa)
+ @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509)
+ @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509aa)
+ @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509ac)
+ @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509ca)
+ @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509crl)
+ @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509ocsp)
endif
- @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/aacerts)
- @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/acerts)
- @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/cacerts)
- @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/certs)
- @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/crls)
- @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/ocspcerts)
- @$(call install_copy, strongswan, 0, 0, 0600, /etc/ipsec.d/private)
- @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/reqs)
+ @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/aacerts)
+ @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/acerts)
+ @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/cacerts)
+ @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/certs)
+ @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/crls)
+ @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/ocspcerts)
+ @$(call install_copy, strongswan, 0, 0, 0600, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/private)
+ @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/reqs)
@$(call install_finish, strongswan)
--
2.23.0
_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [ptxdist] [PATCH v2] strongswan: Version bump 5.6.1 -> 5.8.1
2019-11-19 12:49 ` [ptxdist] [PATCH v2] " Lars Pedersen
@ 2019-11-19 14:56 ` Bruno Thomsen
2019-11-25 6:53 ` Michael Olbrich
1 sibling, 0 replies; 8+ messages in thread
From: Bruno Thomsen @ 2019-11-19 14:56 UTC (permalink / raw)
To: ptxdist; +Cc: Lars Pedersen
Hi,
Den tir. 19. nov. 2019 kl. 13.50 skrev Lars Pedersen <lapeddk@gmail.com>:
>
> Add swanctl support which replaces the old starter, ipsec and stroke
> backend. In this patch swanctl requires systemd.
> https://wiki.strongswan.org/projects/strongswan/wiki/Charon-systemd
>
> Use install_glob to install all compiled plugins.
>
> Option to enable strongswan service if systemd is used.
>
> Option to set sysconfdir. Default /etc.
>
> Signed-off-by: Lars Pedersen <lapeddk@gmail.com>
Systemd service and swanctl seems to work fine in version 2.
Tested-by: Bruno Thomsen <bruno.thomsen@gmail.com>
/Bruno
_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [ptxdist] [PATCH v2] strongswan: Version bump 5.6.1 -> 5.8.1
2019-11-19 12:49 ` [ptxdist] [PATCH v2] " Lars Pedersen
2019-11-19 14:56 ` Bruno Thomsen
@ 2019-11-25 6:53 ` Michael Olbrich
2019-11-26 10:21 ` Lars Pedersen
1 sibling, 1 reply; 8+ messages in thread
From: Michael Olbrich @ 2019-11-25 6:53 UTC (permalink / raw)
To: ptxdist
On Tue, Nov 19, 2019 at 01:49:37PM +0100, Lars Pedersen wrote:
> Add swanctl support which replaces the old starter, ipsec and stroke
> backend. In this patch swanctl requires systemd.
> https://wiki.strongswan.org/projects/strongswan/wiki/Charon-systemd
>
> Use install_glob to install all compiled plugins.
>
> Option to enable strongswan service if systemd is used.
>
> Option to set sysconfdir. Default /etc.
>
> Signed-off-by: Lars Pedersen <lapeddk@gmail.com>
> ---
> v2: Missing tree install of strongswan.d directory in sysconf dir.
> rules/strongswan.in | 25 ++++++--
> rules/strongswan.make | 130 ++++++++++++++++++------------------------
> 2 files changed, 77 insertions(+), 78 deletions(-)
>
> diff --git a/rules/strongswan.in b/rules/strongswan.in
> index d0e660c57..651fd86a6 100644
> --- a/rules/strongswan.in
> +++ b/rules/strongswan.in
> @@ -48,10 +48,27 @@ config STRONGSWAN_AFALG
>
> config STRONGSWAN_SYSTEMD_UNIT
> bool
> - default y
> - # uses old systemd-daemon / libsystemd-journal libs
> - depends on BROKEN
> depends on INITMETHOD_SYSTEMD
> - prompt "install systemd service file"
> + prompt "install systemd unit file"
> +
> +config STRONGSWAN_SYSTEMD_UNIT_ENABLE_SERVICE
> + bool
> + depends on STRONGSWAN_SYSTEMD_UNIT
> + prompt "Enable strongswan unit file"
> +
> +config STRONGSWAN_SWANCTL
> + bool
> + depends on STRONGSWAN_SYSTEMD_UNIT
> + prompt "Use swanctl for configuration"
> + help
> + Swanctl is a new, portable command line utility to configure,
> + control and monitor the IKE daemon charon using the vici interface.
> +
> +config STRONGSWAN_SYSCONF_DIR
> + string
> + prompt "Sysconf directory"
> + default "/etc"
> + help
> + Override default /etc sysconf directory for strongswan.
>
> endif
> diff --git a/rules/strongswan.make b/rules/strongswan.make
> index 90db7bef7..c0116e286 100644
> --- a/rules/strongswan.make
> +++ b/rules/strongswan.make
> @@ -15,8 +15,8 @@ PACKAGES-$(PTXCONF_STRONGSWAN) += strongswan
> #
> # Paths and names
> #
> -STRONGSWAN_VERSION := 5.6.1
> -STRONGSWAN_MD5 := cb2241f1b96c524cd15b1c0f50ed9a27
> +STRONGSWAN_VERSION := 5.8.1
> +STRONGSWAN_MD5 := 5a6b9980cd1ac4fad3c24b55ed960ac9
> STRONGSWAN := strongswan-$(STRONGSWAN_VERSION)
> STRONGSWAN_SUFFIX := tar.bz2
> STRONGSWAN_URL := https://download.strongswan.org/$(STRONGSWAN).$(STRONGSWAN_SUFFIX)
> @@ -36,6 +36,7 @@ STRONGSWAN_CONF_OPT := \
> --$(call ptx/endis, PTXCONF_STRONGSWAN_AFALG)-af-alg \
> --disable-bliss \
> --disable-blowfish \
> + --disable-botan \
> --disable-ccm \
> --disable-chapoly \
> --enable-cmac \
> @@ -54,6 +55,7 @@ STRONGSWAN_CONF_OPT := \
> --enable-nonce \
> --disable-ntru \
> --$(call ptx/endis, PTXCONF_STRONGSWAN_OPENSSL)-openssl \
> + --disable-wolfssl \
> --disable-padlock \
> --enable-random \
> --disable-rc2 \
> @@ -126,11 +128,9 @@ STRONGSWAN_CONF_OPT := \
> --enable-socket-default \
> --disable-socket-dynamic \
> --disable-socket-win \
> - --enable-stroke \
> --disable-smp \
> --disable-sql \
> --disable-uci \
> - --disable-vici \
> --disable-android-dns \
> --enable-attr \
> --disable-attr-sql \
> @@ -147,8 +147,6 @@ STRONGSWAN_CONF_OPT := \
> --disable-imv-os \
> --disable-imc-attestation \
> --disable-imv-attestation \
> - --disable-imc-swid \
> - --disable-imv-swid \
> --disable-imc-swima \
> --disable-imv-swima \
> --disable-imc-hcd \
> @@ -174,14 +172,13 @@ STRONGSWAN_CONF_OPT := \
> --disable-load-tester \
> --disable-lookip \
> --disable-radattr \
> + --disable-save-keys \
> --disable-systime-fix \
> --disable-test-vectors \
> --enable-updown \
> --disable-aikgen \
> - --enable-charon \
> --disable-cmd \
> --disable-conftest \
> - --disable-dumm \
> --disable-fast \
> --disable-fuzzing \
> --disable-libipsec \
> @@ -190,11 +187,9 @@ STRONGSWAN_CONF_OPT := \
> --disable-medsrv \
> --disable-nm \
> --enable-pki \
> - --enable-scepclient \
> --enable-scripts \
> --disable-svc \
> --$(call ptx/endis, PTXCONF_STRONGSWAN_SYSTEMD_UNIT)-systemd \
> - --disable-swanctl \
> --disable-tkm \
> --disable-bfd-backtraces \
> --disable-dbghelp-backtraces \
> @@ -221,52 +216,29 @@ STRONGSWAN_CONF_OPT := \
> --enable-dependency-tracking \
> --enable-shared \
> --with-ipseclibdir=/usr/lib \
> - --with-systemdsystemunitdir=/usr/lib/systemd/system
> + --with-systemdsystemunitdir=/usr/lib/systemd/system \
> + --sysconfdir=$(PTXCONF_STRONGSWAN_SYSCONF_DIR)
> +
> +ifdef PTXCONF_STRONGSWAN_SWANCTL
> + STRONGSWAN_CONF_OPT += \
> + --enable-swanctl \
> + --disable-charon \
> + --disable-stroke \
> + --enable-vici \
> + --disable-scepclient
> +else
> + STRONGSWAN_CONF_OPT += \
> + --disable-swanctl \
> + --enable-charon \
> + --enable-stroke \
> + --disable-vici \
> + --enable-scepclient
> +endif
>
> # ----------------------------------------------------------------------------
> # Target-Install
> # ----------------------------------------------------------------------------
>
> -STRONGSWAN_PLUGINS := \
> - libstrongswan-aes.so \
> - libstrongswan-attr.so \
> - libstrongswan-cmac.so \
> - libstrongswan-constraints.so \
> - libstrongswan-dnskey.so \
> - libstrongswan-fips-prf.so \
> - libstrongswan-gcm.so \
> - libstrongswan-gmp.so \
> - libstrongswan-hmac.so \
> - libstrongswan-kernel-netlink.so \
> - libstrongswan-nonce.so \
> - libstrongswan-pem.so \
> - libstrongswan-pgp.so \
> - libstrongswan-pkcs1.so \
> - libstrongswan-pkcs7.so \
> - libstrongswan-pkcs8.so \
> - libstrongswan-pubkey.so \
> - libstrongswan-random.so \
> - libstrongswan-resolve.so \
> - libstrongswan-revocation.so \
> - libstrongswan-sha1.so \
> - libstrongswan-sha2.so \
> - libstrongswan-socket-default.so \
> - libstrongswan-stroke.so \
> - libstrongswan-updown.so \
> - libstrongswan-x509.so \
> - libstrongswan-xauth-generic.so \
> - libstrongswan-xcbc.so
> -
> -ifdef PTXCONF_STRONGSWAN_LIBCURL
> - STRONGSWAN_PLUGINS += libstrongswan-curl.so
> -endif
> -ifdef PTXCONF_STRONGSWAN_OPENSSL
> - STRONGSWAN_PLUGINS += libstrongswan-openssl.so
> -endif
> -ifdef PTXCONF_STRONGSWAN_AFALG
> - STRONGSWAN_PLUGINS += libstrongswan-af-alg.so
> -endif
> -
> $(STATEDIR)/strongswan.targetinstall:
> @$(call targetinfo)
>
> @@ -276,34 +248,44 @@ $(STATEDIR)/strongswan.targetinstall:
> @$(call install_fixup, strongswan,AUTHOR,"Christoph Fritz <chf@fritzc.com>")
> @$(call install_fixup, strongswan,DESCRIPTION,missing)
>
> - @$(call install_alternative, strongswan, 0, 0, 0644, /etc/strongswan.conf)
> -
> - @$(call install_copy, strongswan, 0, 0, 0755, -, /usr/sbin/ipsec)
> -
> - @$(call install_tree, strongswan, 0, 0, -, /usr/libexec/ipsec)
> +ifdef PTXCONF_STRONGSWAN_SYSTEMD_UNIT_ENABLE_SERVICE
> + @$(call install_link, strongswan, ../strongswan.service, \
> + /usr/lib/systemd/system/multi-user.target.wants/strongswan.service)
> +endif
>
> - @$(call install_lib, strongswan, 0, 0, 0644, libcharon)
> - @$(call install_lib, strongswan, 0, 0, 0644, libstrongswan)
> + @$(call install_tree, strongswan, 0, 0, -, /usr/bin)
> + @$(call install_glob, strongswan, 0, 0, -, /usr/lib,,*.la)
> + @$(call install_tree, strongswan, 0, 0, -, /usr/libexec)
> + @$(call install_tree, strongswan, 0, 0, -, /usr/sbin)
No, we deliberately install the files explicitly. For shared libraries,
this ensures that only the necessary links are installed.
For all other files, this makes sure that we notice issues with the build
configuration.
Also, my check scripts noticed, that /usr/libexec/ipsec/xfrmi uses
libstrongswan-kernel-netlink.so but is missing the correct rpath for this.
It's in /usr/lib/plugins so not found by default.
This can happen in ptxdist because we do tricks with the rpath to avoid
paths to the build tree. Pulseaudio has the same problem. Take a look how
it's handled there.
Michael
>
> - @$(foreach plugin, $(STRONGSWAN_PLUGINS), \
> - $(call install_copy, strongswan, 0, 0, 0644, -, \
> - /usr/lib/plugins/$(plugin));)
> + @$(call install_alternative, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/strongswan.conf)
>
> -ifdef PTXCONF_STRONGSWAN_SYSTEMD_UNIT
> - @$(call install_alternative, strongswan, 0, 0, 0644, \
> - /usr/lib/systemd/system/strongswan.service)
> - @$(call install_link, strongswan, ../strongswan.service, \
> - /usr/lib/systemd/system/multi-user.target.wants/strongswan.service)
> +ifdef PTXCONF_STRONGSWAN_SWANCTL
> + @$(call install_tree, strongswan, 0, 0, -, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/strongswan.d)
> + @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/bliss)
> + @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/conf.d)
> + @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/ecdsa)
> + @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/pkcs12)
> + @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/pkcs8)
> + @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/private)
> + @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/pubkey)
> + @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/rsa)
> + @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509)
> + @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509aa)
> + @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509ac)
> + @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509ca)
> + @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509crl)
> + @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509ocsp)
> endif
>
> - @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/aacerts)
> - @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/acerts)
> - @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/cacerts)
> - @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/certs)
> - @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/crls)
> - @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/ocspcerts)
> - @$(call install_copy, strongswan, 0, 0, 0600, /etc/ipsec.d/private)
> - @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/reqs)
> + @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/aacerts)
> + @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/acerts)
> + @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/cacerts)
> + @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/certs)
> + @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/crls)
> + @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/ocspcerts)
> + @$(call install_copy, strongswan, 0, 0, 0600, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/private)
> + @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/reqs)
>
> @$(call install_finish, strongswan)
>
> --
> 2.23.0
>
>
> _______________________________________________
> ptxdist mailing list
> ptxdist@pengutronix.de
>
--
Pengutronix e.K. | |
Steuerwalder Str. 21 | http://www.pengutronix.de/ |
31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [ptxdist] [PATCH v2] strongswan: Version bump 5.6.1 -> 5.8.1
2019-11-25 6:53 ` Michael Olbrich
@ 2019-11-26 10:21 ` Lars Pedersen
2019-11-28 16:21 ` Michael Olbrich
0 siblings, 1 reply; 8+ messages in thread
From: Lars Pedersen @ 2019-11-26 10:21 UTC (permalink / raw)
To: ptxdist
Thanks for the review.
On Mon, 25 Nov 2019 at 07:53, Michael Olbrich <m.olbrich@pengutronix.de> wrote:
>
> > - @$(call install_lib, strongswan, 0, 0, 0644, libcharon)
> > - @$(call install_lib, strongswan, 0, 0, 0644, libstrongswan)
> > + @$(call install_tree, strongswan, 0, 0, -, /usr/bin)
> > + @$(call install_glob, strongswan, 0, 0, -, /usr/lib,,*.la)
> > + @$(call install_tree, strongswan, 0, 0, -, /usr/libexec)
> > + @$(call install_tree, strongswan, 0, 0, -, /usr/sbin)
>
> No, we deliberately install the files explicitly. For shared libraries,
> this ensures that only the necessary links are installed.
> For all other files, this makes sure that we notice issues with the build
> configuration.
>
> Also, my check scripts noticed, that /usr/libexec/ipsec/xfrmi uses
> libstrongswan-kernel-netlink.so but is missing the correct rpath for this.
> It's in /usr/lib/plugins so not found by default.
>
> This can happen in ptxdist because we do tricks with the rpath to avoid
> paths to the build tree. Pulseaudio has the same problem. Take a look how
> it's handled there.
>
So basically you want the install_glob of libraries to be reverted
back into installing them all in a for loop using install_lib like
before?
I'm unsure about the rpath for xfrmi. The paths looks similar using
readelf if I compare it with the starter executable in the same dir.
What does your script output? The xfrmi is a new executable in
strongswan for policy based routing.
$readelf -a xfrmi
...
Dynamic section at offset 0x1e38 contains 32 entries:
Tag Type Name/Value
0x00000001 (NEEDED) Shared library:
[libstrongswan-kernel-netlink.so]
0x00000001 (NEEDED) Shared library: [libstrongswan.so.0]
0x00000001 (NEEDED) Shared library: [libcharon.so.0]
0x00000001 (NEEDED) Shared library: [libc.so.6]
0x00000001 (NEEDED) Shared library: [ld-linux.so.3]
...
/Lars Pedersen
_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [ptxdist] [PATCH v2] strongswan: Version bump 5.6.1 -> 5.8.1
2019-11-26 10:21 ` Lars Pedersen
@ 2019-11-28 16:21 ` Michael Olbrich
0 siblings, 0 replies; 8+ messages in thread
From: Michael Olbrich @ 2019-11-28 16:21 UTC (permalink / raw)
To: ptxdist
On Tue, Nov 26, 2019 at 11:21:41AM +0100, Lars Pedersen wrote:
> Thanks for the review.
>
> On Mon, 25 Nov 2019 at 07:53, Michael Olbrich <m.olbrich@pengutronix.de> wrote:
> >
> > > - @$(call install_lib, strongswan, 0, 0, 0644, libcharon)
> > > - @$(call install_lib, strongswan, 0, 0, 0644, libstrongswan)
> > > + @$(call install_tree, strongswan, 0, 0, -, /usr/bin)
> > > + @$(call install_glob, strongswan, 0, 0, -, /usr/lib,,*.la)
> > > + @$(call install_tree, strongswan, 0, 0, -, /usr/libexec)
> > > + @$(call install_tree, strongswan, 0, 0, -, /usr/sbin)
> >
> > No, we deliberately install the files explicitly. For shared libraries,
> > this ensures that only the necessary links are installed.
> > For all other files, this makes sure that we notice issues with the build
> > configuration.
> >
> > Also, my check scripts noticed, that /usr/libexec/ipsec/xfrmi uses
> > libstrongswan-kernel-netlink.so but is missing the correct rpath for this.
> > It's in /usr/lib/plugins so not found by default.
> >
> > This can happen in ptxdist because we do tricks with the rpath to avoid
> > paths to the build tree. Pulseaudio has the same problem. Take a look how
> > it's handled there.
> >
>
> So basically you want the install_glob of libraries to be reverted
> back into installing them all in a for loop using install_lib like
> before?
exactly.
> I'm unsure about the rpath for xfrmi. The paths looks similar using
> readelf if I compare it with the starter executable in the same dir.
> What does your script output? The xfrmi is a new executable in
> strongswan for policy based routing.
>
> $readelf -a xfrmi
> ...
> Dynamic section at offset 0x1e38 contains 32 entries:
> Tag Type Name/Value
> 0x00000001 (NEEDED) Shared library:
> [libstrongswan-kernel-netlink.so]
This library is in a non-standard directory, so it won't be found by ld.so.
If you try to execute this xfrmi on the target you should get a 'file not
found' error or something like that.
To fix this, an rpath for /usr/lib/plugins (the directory containing this
lib) must be added.
Pulseaudio has the same problem (with two dirs instead of one).
Michael
> 0x00000001 (NEEDED) Shared library: [libstrongswan.so.0]
> 0x00000001 (NEEDED) Shared library: [libcharon.so.0]
> 0x00000001 (NEEDED) Shared library: [libc.so.6]
> 0x00000001 (NEEDED) Shared library: [ld-linux.so.3]
> ...
>
> /Lars Pedersen
>
> _______________________________________________
> ptxdist mailing list
> ptxdist@pengutronix.de
>
--
Pengutronix e.K. | |
Steuerwalder Str. 21 | http://www.pengutronix.de/ |
31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
^ permalink raw reply [flat|nested] 8+ messages in thread
* [ptxdist] [PATCH v2] strongswan: Version bump 5.6.1 -> 5.8.1
2019-11-18 12:45 [ptxdist] [PATCH] strongswan: Version bump 5.6.1 -> 5.8.1 Lars Pedersen
2019-11-19 12:49 ` [ptxdist] [PATCH v2] " Lars Pedersen
@ 2019-12-05 9:34 ` Lars Pedersen
2019-12-05 15:45 ` Michael Olbrich
1 sibling, 1 reply; 8+ messages in thread
From: Lars Pedersen @ 2019-12-05 9:34 UTC (permalink / raw)
To: ptxdist; +Cc: Lars Pedersen
Add swanctl support which replaces the old starter, ipsec and stroke
backend. In this patch swanctl requires systemd.
https://wiki.strongswan.org/projects/strongswan/wiki/Charon-systemd
Option to enable strongswan service if systemd is used.
Option to set sysconfdir. Default /etc.
Signed-off-by: Lars Pedersen <lapeddk@gmail.com>
---
v2:
- Install_lib and plugins installed like before
- Set rpath to /usr/lib/plugins
- Add license_files field
rules/strongswan.in | 25 ++++++++++--
rules/strongswan.make | 91 ++++++++++++++++++++++++++++---------------
2 files changed, 81 insertions(+), 35 deletions(-)
diff --git a/rules/strongswan.in b/rules/strongswan.in
index d0e660c57..5bcef7d8d 100644
--- a/rules/strongswan.in
+++ b/rules/strongswan.in
@@ -48,10 +48,27 @@ config STRONGSWAN_AFALG
config STRONGSWAN_SYSTEMD_UNIT
bool
- default y
- # uses old systemd-daemon / libsystemd-journal libs
- depends on BROKEN
depends on INITMETHOD_SYSTEMD
- prompt "install systemd service file"
+ prompt "install systemd unit file"
+
+config STRONGSWAN_SYSTEMD_UNIT_ENABLE_SERVICE
+ bool
+ depends on STRONGSWAN_SYSTEMD_UNIT
+ prompt "Enable strongswan unit file"
+
+config STRONGSWAN_SWANCTL
+ bool
+ depends on STRONGSWAN_SYSTEMD_UNIT
+ prompt "Use swanctl for configuration"
+ help
+ Swanctl is a new, portable command line utility to configure,
+ control and monitor the IKE daemon charon using the vici interface.
+
+config STRONGSWAN_SYSCONF_DIR
+ string
+ prompt "Sysconf directory"
+ default "/etc"
+ help
+ Override default /etc sysconf directory for strongswan.
endif
diff --git a/rules/strongswan.make b/rules/strongswan.make
index 90db7bef7..e5ecac591 100644
--- a/rules/strongswan.make
+++ b/rules/strongswan.make
@@ -15,14 +15,17 @@ PACKAGES-$(PTXCONF_STRONGSWAN) += strongswan
#
# Paths and names
#
-STRONGSWAN_VERSION := 5.6.1
-STRONGSWAN_MD5 := cb2241f1b96c524cd15b1c0f50ed9a27
+STRONGSWAN_VERSION := 5.8.1
+STRONGSWAN_MD5 := 5a6b9980cd1ac4fad3c24b55ed960ac9
STRONGSWAN := strongswan-$(STRONGSWAN_VERSION)
STRONGSWAN_SUFFIX := tar.bz2
STRONGSWAN_URL := https://download.strongswan.org/$(STRONGSWAN).$(STRONGSWAN_SUFFIX)
STRONGSWAN_SOURCE := $(SRCDIR)/$(STRONGSWAN).$(STRONGSWAN_SUFFIX)
STRONGSWAN_DIR := $(BUILDDIR)/$(STRONGSWAN)
STRONGSWAN_LICENSE := GPL
+STRONGSWAN_LICENSE_FILES := \
+ file://LICENSE;md5=7744b64eaadabebdfd17e8a5ae6c9855 \
+ file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263
# ----------------------------------------------------------------------------
# Prepare
@@ -36,6 +39,7 @@ STRONGSWAN_CONF_OPT := \
--$(call ptx/endis, PTXCONF_STRONGSWAN_AFALG)-af-alg \
--disable-bliss \
--disable-blowfish \
+ --disable-botan \
--disable-ccm \
--disable-chapoly \
--enable-cmac \
@@ -54,6 +58,7 @@ STRONGSWAN_CONF_OPT := \
--enable-nonce \
--disable-ntru \
--$(call ptx/endis, PTXCONF_STRONGSWAN_OPENSSL)-openssl \
+ --disable-wolfssl \
--disable-padlock \
--enable-random \
--disable-rc2 \
@@ -126,11 +131,11 @@ STRONGSWAN_CONF_OPT := \
--enable-socket-default \
--disable-socket-dynamic \
--disable-socket-win \
- --enable-stroke \
+ --$(call ptx/disen, PTXCONF_STRONGSWAN_SWANCTL)-stroke \
--disable-smp \
--disable-sql \
--disable-uci \
- --disable-vici \
+ --$(call ptx/endis, PTXCONF_STRONGSWAN_SWANCTL)-vici \
--disable-android-dns \
--enable-attr \
--disable-attr-sql \
@@ -147,8 +152,6 @@ STRONGSWAN_CONF_OPT := \
--disable-imv-os \
--disable-imc-attestation \
--disable-imv-attestation \
- --disable-imc-swid \
- --disable-imv-swid \
--disable-imc-swima \
--disable-imv-swima \
--disable-imc-hcd \
@@ -174,14 +177,14 @@ STRONGSWAN_CONF_OPT := \
--disable-load-tester \
--disable-lookip \
--disable-radattr \
+ --disable-save-keys \
--disable-systime-fix \
--disable-test-vectors \
--enable-updown \
--disable-aikgen \
- --enable-charon \
+ --$(call ptx/disen, PTXCONF_STRONGSWAN_SWANCTL)-charon \
--disable-cmd \
--disable-conftest \
- --disable-dumm \
--disable-fast \
--disable-fuzzing \
--disable-libipsec \
@@ -190,11 +193,10 @@ STRONGSWAN_CONF_OPT := \
--disable-medsrv \
--disable-nm \
--enable-pki \
- --enable-scepclient \
+ --$(call ptx/disen, PTXCONF_STRONGSWAN_SWANCTL)-scepclient \
--enable-scripts \
--disable-svc \
--$(call ptx/endis, PTXCONF_STRONGSWAN_SYSTEMD_UNIT)-systemd \
- --disable-swanctl \
--disable-tkm \
--disable-bfd-backtraces \
--disable-dbghelp-backtraces \
@@ -220,8 +222,12 @@ STRONGSWAN_CONF_OPT := \
--disable-defaults \
--enable-dependency-tracking \
--enable-shared \
+ --$(call ptx/endis, PTXCONF_STRONGSWAN_SWANCTL)-swanctl \
--with-ipseclibdir=/usr/lib \
- --with-systemdsystemunitdir=/usr/lib/systemd/system
+ --with-systemdsystemunitdir=/usr/lib/systemd/system \
+ --sysconfdir=$(PTXCONF_STRONGSWAN_SYSCONF_DIR)
+
+STRONGSWAN_LDFLAGS := -Wl,-rpath,/usr/lib/plugins
# ----------------------------------------------------------------------------
# Target-Install
@@ -251,12 +257,17 @@ STRONGSWAN_PLUGINS := \
libstrongswan-sha1.so \
libstrongswan-sha2.so \
libstrongswan-socket-default.so \
- libstrongswan-stroke.so \
libstrongswan-updown.so \
libstrongswan-x509.so \
libstrongswan-xauth-generic.so \
libstrongswan-xcbc.so
+ifdef PTXCONF_STRONGSWAN_SWANCTL
+ STRONGSWAN_PLUGINS += libstrongswan-vici.so
+else
+ STRONGSWAN_PLUGINS += libstrongswan-stroke.so
+endif
+
ifdef PTXCONF_STRONGSWAN_LIBCURL
STRONGSWAN_PLUGINS += libstrongswan-curl.so
endif
@@ -267,6 +278,7 @@ ifdef PTXCONF_STRONGSWAN_AFALG
STRONGSWAN_PLUGINS += libstrongswan-af-alg.so
endif
+
$(STATEDIR)/strongswan.targetinstall:
@$(call targetinfo)
@@ -276,34 +288,51 @@ $(STATEDIR)/strongswan.targetinstall:
@$(call install_fixup, strongswan,AUTHOR,"Christoph Fritz <chf@fritzc.com>")
@$(call install_fixup, strongswan,DESCRIPTION,missing)
- @$(call install_alternative, strongswan, 0, 0, 0644, /etc/strongswan.conf)
-
- @$(call install_copy, strongswan, 0, 0, 0755, -, /usr/sbin/ipsec)
+ifdef PTXCONF_STRONGSWAN_SYSTEMD_UNIT_ENABLE_SERVICE
+ @$(call install_link, strongswan, ../strongswan.service, \
+ /usr/lib/systemd/system/multi-user.target.wants/strongswan.service)
+endif
- @$(call install_tree, strongswan, 0, 0, -, /usr/libexec/ipsec)
+ @$(call install_tree, strongswan, 0, 0, -, /usr/bin)
+ @$(call install_tree, strongswan, 0, 0, -, /usr/libexec)
+ @$(call install_tree, strongswan, 0, 0, -, /usr/sbin)
@$(call install_lib, strongswan, 0, 0, 0644, libcharon)
@$(call install_lib, strongswan, 0, 0, 0644, libstrongswan)
@$(foreach plugin, $(STRONGSWAN_PLUGINS), \
- $(call install_copy, strongswan, 0, 0, 0644, -, \
- /usr/lib/plugins/$(plugin));)
+ $(call install_copy, strongswan, 0, 0, 0644, -, \
+ /usr/lib/plugins/$(plugin));)
-ifdef PTXCONF_STRONGSWAN_SYSTEMD_UNIT
- @$(call install_alternative, strongswan, 0, 0, 0644, \
- /usr/lib/systemd/system/strongswan.service)
- @$(call install_link, strongswan, ../strongswan.service, \
- /usr/lib/systemd/system/multi-user.target.wants/strongswan.service)
+ @$(call install_alternative, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/strongswan.conf)
+
+ifdef PTXCONF_STRONGSWAN_SWANCTL
+ @$(call install_lib, strongswan, 0, 0, 0644, libvici)
+ @$(call install_tree, strongswan, 0, 0, -, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/strongswan.d)
+ @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/bliss)
+ @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/conf.d)
+ @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/ecdsa)
+ @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/pkcs12)
+ @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/pkcs8)
+ @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/private)
+ @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/pubkey)
+ @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/rsa)
+ @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509)
+ @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509aa)
+ @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509ac)
+ @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509ca)
+ @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509crl)
+ @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509ocsp)
endif
- @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/aacerts)
- @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/acerts)
- @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/cacerts)
- @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/certs)
- @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/crls)
- @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/ocspcerts)
- @$(call install_copy, strongswan, 0, 0, 0600, /etc/ipsec.d/private)
- @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/reqs)
+ @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/aacerts)
+ @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/acerts)
+ @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/cacerts)
+ @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/certs)
+ @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/crls)
+ @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/ocspcerts)
+ @$(call install_copy, strongswan, 0, 0, 0600, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/private)
+ @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/reqs)
@$(call install_finish, strongswan)
--
2.23.0
_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [ptxdist] [PATCH v2] strongswan: Version bump 5.6.1 -> 5.8.1
2019-12-05 9:34 ` Lars Pedersen
@ 2019-12-05 15:45 ` Michael Olbrich
0 siblings, 0 replies; 8+ messages in thread
From: Michael Olbrich @ 2019-12-05 15:45 UTC (permalink / raw)
To: ptxdist
On Thu, Dec 05, 2019 at 10:34:26AM +0100, Lars Pedersen wrote:
> Add swanctl support which replaces the old starter, ipsec and stroke
> backend. In this patch swanctl requires systemd.
> https://wiki.strongswan.org/projects/strongswan/wiki/Charon-systemd
>
> Option to enable strongswan service if systemd is used.
>
> Option to set sysconfdir. Default /etc.
>
> Signed-off-by: Lars Pedersen <lapeddk@gmail.com>
> ---
> v2:
> - Install_lib and plugins installed like before
> - Set rpath to /usr/lib/plugins
> - Add license_files field
>
> rules/strongswan.in | 25 ++++++++++--
> rules/strongswan.make | 91 ++++++++++++++++++++++++++++---------------
> 2 files changed, 81 insertions(+), 35 deletions(-)
>
> diff --git a/rules/strongswan.in b/rules/strongswan.in
> index d0e660c57..5bcef7d8d 100644
> --- a/rules/strongswan.in
> +++ b/rules/strongswan.in
> @@ -48,10 +48,27 @@ config STRONGSWAN_AFALG
>
> config STRONGSWAN_SYSTEMD_UNIT
> bool
> - default y
keep the default.
> - # uses old systemd-daemon / libsystemd-journal libs
> - depends on BROKEN
> depends on INITMETHOD_SYSTEMD
> - prompt "install systemd service file"
> + prompt "install systemd unit file"
Why change this? It's a service.
> +
> +config STRONGSWAN_SYSTEMD_UNIT_ENABLE_SERVICE
> + bool
> + depends on STRONGSWAN_SYSTEMD_UNIT
> + prompt "Enable strongswan unit file"
No, why install the unit but not enable it?
> +
> +config STRONGSWAN_SWANCTL
> + bool
> + depends on STRONGSWAN_SYSTEMD_UNIT
Why the dependency?
> + prompt "Use swanctl for configuration"
> + help
> + Swanctl is a new, portable command line utility to configure,
> + control and monitor the IKE daemon charon using the vici interface.
> +
> +config STRONGSWAN_SYSCONF_DIR
> + string
> + prompt "Sysconf directory"
> + default "/etc"
> + help
> + Override default /etc sysconf directory for strongswan.
No. I don't want something like this configurable in PTXdist upstream.
If you need to move this elsewhere, then there are other ways to do this.
E.g. create /dev/null links[1] for all the config files in projectroot/ and
create a symlink for /etc/ipsec.d that points to your directory.
[1] https://www.ptxdist.org/doc/ref_manual.html#install-alternative
> endif
> diff --git a/rules/strongswan.make b/rules/strongswan.make
> index 90db7bef7..e5ecac591 100644
> --- a/rules/strongswan.make
> +++ b/rules/strongswan.make
> @@ -15,14 +15,17 @@ PACKAGES-$(PTXCONF_STRONGSWAN) += strongswan
> #
> # Paths and names
> #
> -STRONGSWAN_VERSION := 5.6.1
> -STRONGSWAN_MD5 := cb2241f1b96c524cd15b1c0f50ed9a27
> +STRONGSWAN_VERSION := 5.8.1
> +STRONGSWAN_MD5 := 5a6b9980cd1ac4fad3c24b55ed960ac9
> STRONGSWAN := strongswan-$(STRONGSWAN_VERSION)
> STRONGSWAN_SUFFIX := tar.bz2
> STRONGSWAN_URL := https://download.strongswan.org/$(STRONGSWAN).$(STRONGSWAN_SUFFIX)
> STRONGSWAN_SOURCE := $(SRCDIR)/$(STRONGSWAN).$(STRONGSWAN_SUFFIX)
> STRONGSWAN_DIR := $(BUILDDIR)/$(STRONGSWAN)
> STRONGSWAN_LICENSE := GPL
> +STRONGSWAN_LICENSE_FILES := \
> + file://LICENSE;md5=7744b64eaadabebdfd17e8a5ae6c9855 \
> + file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263
>
> # ----------------------------------------------------------------------------
> # Prepare
> @@ -36,6 +39,7 @@ STRONGSWAN_CONF_OPT := \
> --$(call ptx/endis, PTXCONF_STRONGSWAN_AFALG)-af-alg \
> --disable-bliss \
> --disable-blowfish \
> + --disable-botan \
> --disable-ccm \
> --disable-chapoly \
> --enable-cmac \
> @@ -54,6 +58,7 @@ STRONGSWAN_CONF_OPT := \
> --enable-nonce \
> --disable-ntru \
> --$(call ptx/endis, PTXCONF_STRONGSWAN_OPENSSL)-openssl \
> + --disable-wolfssl \
> --disable-padlock \
> --enable-random \
> --disable-rc2 \
> @@ -126,11 +131,11 @@ STRONGSWAN_CONF_OPT := \
> --enable-socket-default \
> --disable-socket-dynamic \
> --disable-socket-win \
> - --enable-stroke \
> + --$(call ptx/disen, PTXCONF_STRONGSWAN_SWANCTL)-stroke \
> --disable-smp \
> --disable-sql \
> --disable-uci \
> - --disable-vici \
> + --$(call ptx/endis, PTXCONF_STRONGSWAN_SWANCTL)-vici \
> --disable-android-dns \
> --enable-attr \
> --disable-attr-sql \
> @@ -147,8 +152,6 @@ STRONGSWAN_CONF_OPT := \
> --disable-imv-os \
> --disable-imc-attestation \
> --disable-imv-attestation \
> - --disable-imc-swid \
> - --disable-imv-swid \
> --disable-imc-swima \
> --disable-imv-swima \
> --disable-imc-hcd \
> @@ -174,14 +177,14 @@ STRONGSWAN_CONF_OPT := \
> --disable-load-tester \
> --disable-lookip \
> --disable-radattr \
> + --disable-save-keys \
> --disable-systime-fix \
> --disable-test-vectors \
> --enable-updown \
> --disable-aikgen \
> - --enable-charon \
> + --$(call ptx/disen, PTXCONF_STRONGSWAN_SWANCTL)-charon \
> --disable-cmd \
> --disable-conftest \
> - --disable-dumm \
> --disable-fast \
> --disable-fuzzing \
> --disable-libipsec \
> @@ -190,11 +193,10 @@ STRONGSWAN_CONF_OPT := \
> --disable-medsrv \
> --disable-nm \
> --enable-pki \
> - --enable-scepclient \
> + --$(call ptx/disen, PTXCONF_STRONGSWAN_SWANCTL)-scepclient \
> --enable-scripts \
> --disable-svc \
> --$(call ptx/endis, PTXCONF_STRONGSWAN_SYSTEMD_UNIT)-systemd \
> - --disable-swanctl \
> --disable-tkm \
> --disable-bfd-backtraces \
> --disable-dbghelp-backtraces \
> @@ -220,8 +222,12 @@ STRONGSWAN_CONF_OPT := \
> --disable-defaults \
> --enable-dependency-tracking \
> --enable-shared \
> + --$(call ptx/endis, PTXCONF_STRONGSWAN_SWANCTL)-swanctl \
> --with-ipseclibdir=/usr/lib \
> - --with-systemdsystemunitdir=/usr/lib/systemd/system
> + --with-systemdsystemunitdir=/usr/lib/systemd/system \
> + --sysconfdir=$(PTXCONF_STRONGSWAN_SYSCONF_DIR)
> +
> +STRONGSWAN_LDFLAGS := -Wl,-rpath,/usr/lib/plugins
>
> # ----------------------------------------------------------------------------
> # Target-Install
> @@ -251,12 +257,17 @@ STRONGSWAN_PLUGINS := \
> libstrongswan-sha1.so \
> libstrongswan-sha2.so \
> libstrongswan-socket-default.so \
> - libstrongswan-stroke.so \
> libstrongswan-updown.so \
> libstrongswan-x509.so \
> libstrongswan-xauth-generic.so \
> libstrongswan-xcbc.so
>
> +ifdef PTXCONF_STRONGSWAN_SWANCTL
> + STRONGSWAN_PLUGINS += libstrongswan-vici.so
> +else
> + STRONGSWAN_PLUGINS += libstrongswan-stroke.so
> +endif
> +
> ifdef PTXCONF_STRONGSWAN_LIBCURL
> STRONGSWAN_PLUGINS += libstrongswan-curl.so
> endif
> @@ -267,6 +278,7 @@ ifdef PTXCONF_STRONGSWAN_AFALG
> STRONGSWAN_PLUGINS += libstrongswan-af-alg.so
> endif
>
> +
> $(STATEDIR)/strongswan.targetinstall:
> @$(call targetinfo)
>
> @@ -276,34 +288,51 @@ $(STATEDIR)/strongswan.targetinstall:
> @$(call install_fixup, strongswan,AUTHOR,"Christoph Fritz <chf@fritzc.com>")
> @$(call install_fixup, strongswan,DESCRIPTION,missing)
>
> - @$(call install_alternative, strongswan, 0, 0, 0644, /etc/strongswan.conf)
> -
> - @$(call install_copy, strongswan, 0, 0, 0755, -, /usr/sbin/ipsec)
> +ifdef PTXCONF_STRONGSWAN_SYSTEMD_UNIT_ENABLE_SERVICE
> + @$(call install_link, strongswan, ../strongswan.service, \
> + /usr/lib/systemd/system/multi-user.target.wants/strongswan.service)
> +endif
>
> - @$(call install_tree, strongswan, 0, 0, -, /usr/libexec/ipsec)
> + @$(call install_tree, strongswan, 0, 0, -, /usr/bin)
> + @$(call install_tree, strongswan, 0, 0, -, /usr/libexec)
> + @$(call install_tree, strongswan, 0, 0, -, /usr/sbin)
>
> @$(call install_lib, strongswan, 0, 0, 0644, libcharon)
> @$(call install_lib, strongswan, 0, 0, 0644, libstrongswan)
>
> @$(foreach plugin, $(STRONGSWAN_PLUGINS), \
> - $(call install_copy, strongswan, 0, 0, 0644, -, \
> - /usr/lib/plugins/$(plugin));)
> + $(call install_copy, strongswan, 0, 0, 0644, -, \
> + /usr/lib/plugins/$(plugin));)
Keep the indention.
>
> -ifdef PTXCONF_STRONGSWAN_SYSTEMD_UNIT
> - @$(call install_alternative, strongswan, 0, 0, 0644, \
> - /usr/lib/systemd/system/strongswan.service)
This looks wrong. It looks like strongswan.service is not installed any
more.
> - @$(call install_link, strongswan, ../strongswan.service, \
> - /usr/lib/systemd/system/multi-user.target.wants/strongswan.service)
> + @$(call install_alternative, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/strongswan.conf)
> +
> +ifdef PTXCONF_STRONGSWAN_SWANCTL
> + @$(call install_lib, strongswan, 0, 0, 0644, libvici)
> + @$(call install_tree, strongswan, 0, 0, -, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/strongswan.d)
> + @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/bliss)
> + @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/conf.d)
> + @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/ecdsa)
> + @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/pkcs12)
> + @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/pkcs8)
> + @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/private)
> + @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/pubkey)
> + @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/rsa)
> + @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509)
> + @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509aa)
> + @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509ac)
> + @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509ca)
> + @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509crl)
> + @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509ocsp)
> endif
>
> - @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/aacerts)
> - @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/acerts)
> - @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/cacerts)
> - @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/certs)
> - @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/crls)
> - @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/ocspcerts)
> - @$(call install_copy, strongswan, 0, 0, 0600, /etc/ipsec.d/private)
> - @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/reqs)
> + @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/aacerts)
> + @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/acerts)
> + @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/cacerts)
> + @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/certs)
> + @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/crls)
> + @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/ocspcerts)
> + @$(call install_copy, strongswan, 0, 0, 0600, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/private)
> + @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/reqs)
see above.
Michael
>
> @$(call install_finish, strongswan)
>
> --
> 2.23.0
>
>
> _______________________________________________
> ptxdist mailing list
> ptxdist@pengutronix.de
>
--
Pengutronix e.K. | |
Steuerwalder Str. 21 | http://www.pengutronix.de/ |
31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2019-12-05 15:45 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-11-18 12:45 [ptxdist] [PATCH] strongswan: Version bump 5.6.1 -> 5.8.1 Lars Pedersen
2019-11-19 12:49 ` [ptxdist] [PATCH v2] " Lars Pedersen
2019-11-19 14:56 ` Bruno Thomsen
2019-11-25 6:53 ` Michael Olbrich
2019-11-26 10:21 ` Lars Pedersen
2019-11-28 16:21 ` Michael Olbrich
2019-12-05 9:34 ` Lars Pedersen
2019-12-05 15:45 ` Michael Olbrich
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox