From: Michael Olbrich <m.olbrich@pengutronix.de>
To: ptxdist@pengutronix.de
Subject: Re: [ptxdist] [PATCH v2] strongswan: Version bump 5.6.1 -> 5.8.1
Date: Thu, 5 Dec 2019 16:45:38 +0100 [thread overview]
Message-ID: <20191205154538.GK14948@pengutronix.de> (raw)
In-Reply-To: <20191205093426.62635-1-lapeddk@gmail.com>
On Thu, Dec 05, 2019 at 10:34:26AM +0100, Lars Pedersen wrote:
> Add swanctl support which replaces the old starter, ipsec and stroke
> backend. In this patch swanctl requires systemd.
> https://wiki.strongswan.org/projects/strongswan/wiki/Charon-systemd
>
> Option to enable strongswan service if systemd is used.
>
> Option to set sysconfdir. Default /etc.
>
> Signed-off-by: Lars Pedersen <lapeddk@gmail.com>
> ---
> v2:
> - Install_lib and plugins installed like before
> - Set rpath to /usr/lib/plugins
> - Add license_files field
>
> rules/strongswan.in | 25 ++++++++++--
> rules/strongswan.make | 91 ++++++++++++++++++++++++++++---------------
> 2 files changed, 81 insertions(+), 35 deletions(-)
>
> diff --git a/rules/strongswan.in b/rules/strongswan.in
> index d0e660c57..5bcef7d8d 100644
> --- a/rules/strongswan.in
> +++ b/rules/strongswan.in
> @@ -48,10 +48,27 @@ config STRONGSWAN_AFALG
>
> config STRONGSWAN_SYSTEMD_UNIT
> bool
> - default y
keep the default.
> - # uses old systemd-daemon / libsystemd-journal libs
> - depends on BROKEN
> depends on INITMETHOD_SYSTEMD
> - prompt "install systemd service file"
> + prompt "install systemd unit file"
Why change this? It's a service.
> +
> +config STRONGSWAN_SYSTEMD_UNIT_ENABLE_SERVICE
> + bool
> + depends on STRONGSWAN_SYSTEMD_UNIT
> + prompt "Enable strongswan unit file"
No, why install the unit but not enable it?
> +
> +config STRONGSWAN_SWANCTL
> + bool
> + depends on STRONGSWAN_SYSTEMD_UNIT
Why the dependency?
> + prompt "Use swanctl for configuration"
> + help
> + Swanctl is a new, portable command line utility to configure,
> + control and monitor the IKE daemon charon using the vici interface.
> +
> +config STRONGSWAN_SYSCONF_DIR
> + string
> + prompt "Sysconf directory"
> + default "/etc"
> + help
> + Override default /etc sysconf directory for strongswan.
No. I don't want something like this configurable in PTXdist upstream.
If you need to move this elsewhere, then there are other ways to do this.
E.g. create /dev/null links[1] for all the config files in projectroot/ and
create a symlink for /etc/ipsec.d that points to your directory.
[1] https://www.ptxdist.org/doc/ref_manual.html#install-alternative
> endif
> diff --git a/rules/strongswan.make b/rules/strongswan.make
> index 90db7bef7..e5ecac591 100644
> --- a/rules/strongswan.make
> +++ b/rules/strongswan.make
> @@ -15,14 +15,17 @@ PACKAGES-$(PTXCONF_STRONGSWAN) += strongswan
> #
> # Paths and names
> #
> -STRONGSWAN_VERSION := 5.6.1
> -STRONGSWAN_MD5 := cb2241f1b96c524cd15b1c0f50ed9a27
> +STRONGSWAN_VERSION := 5.8.1
> +STRONGSWAN_MD5 := 5a6b9980cd1ac4fad3c24b55ed960ac9
> STRONGSWAN := strongswan-$(STRONGSWAN_VERSION)
> STRONGSWAN_SUFFIX := tar.bz2
> STRONGSWAN_URL := https://download.strongswan.org/$(STRONGSWAN).$(STRONGSWAN_SUFFIX)
> STRONGSWAN_SOURCE := $(SRCDIR)/$(STRONGSWAN).$(STRONGSWAN_SUFFIX)
> STRONGSWAN_DIR := $(BUILDDIR)/$(STRONGSWAN)
> STRONGSWAN_LICENSE := GPL
> +STRONGSWAN_LICENSE_FILES := \
> + file://LICENSE;md5=7744b64eaadabebdfd17e8a5ae6c9855 \
> + file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263
>
> # ----------------------------------------------------------------------------
> # Prepare
> @@ -36,6 +39,7 @@ STRONGSWAN_CONF_OPT := \
> --$(call ptx/endis, PTXCONF_STRONGSWAN_AFALG)-af-alg \
> --disable-bliss \
> --disable-blowfish \
> + --disable-botan \
> --disable-ccm \
> --disable-chapoly \
> --enable-cmac \
> @@ -54,6 +58,7 @@ STRONGSWAN_CONF_OPT := \
> --enable-nonce \
> --disable-ntru \
> --$(call ptx/endis, PTXCONF_STRONGSWAN_OPENSSL)-openssl \
> + --disable-wolfssl \
> --disable-padlock \
> --enable-random \
> --disable-rc2 \
> @@ -126,11 +131,11 @@ STRONGSWAN_CONF_OPT := \
> --enable-socket-default \
> --disable-socket-dynamic \
> --disable-socket-win \
> - --enable-stroke \
> + --$(call ptx/disen, PTXCONF_STRONGSWAN_SWANCTL)-stroke \
> --disable-smp \
> --disable-sql \
> --disable-uci \
> - --disable-vici \
> + --$(call ptx/endis, PTXCONF_STRONGSWAN_SWANCTL)-vici \
> --disable-android-dns \
> --enable-attr \
> --disable-attr-sql \
> @@ -147,8 +152,6 @@ STRONGSWAN_CONF_OPT := \
> --disable-imv-os \
> --disable-imc-attestation \
> --disable-imv-attestation \
> - --disable-imc-swid \
> - --disable-imv-swid \
> --disable-imc-swima \
> --disable-imv-swima \
> --disable-imc-hcd \
> @@ -174,14 +177,14 @@ STRONGSWAN_CONF_OPT := \
> --disable-load-tester \
> --disable-lookip \
> --disable-radattr \
> + --disable-save-keys \
> --disable-systime-fix \
> --disable-test-vectors \
> --enable-updown \
> --disable-aikgen \
> - --enable-charon \
> + --$(call ptx/disen, PTXCONF_STRONGSWAN_SWANCTL)-charon \
> --disable-cmd \
> --disable-conftest \
> - --disable-dumm \
> --disable-fast \
> --disable-fuzzing \
> --disable-libipsec \
> @@ -190,11 +193,10 @@ STRONGSWAN_CONF_OPT := \
> --disable-medsrv \
> --disable-nm \
> --enable-pki \
> - --enable-scepclient \
> + --$(call ptx/disen, PTXCONF_STRONGSWAN_SWANCTL)-scepclient \
> --enable-scripts \
> --disable-svc \
> --$(call ptx/endis, PTXCONF_STRONGSWAN_SYSTEMD_UNIT)-systemd \
> - --disable-swanctl \
> --disable-tkm \
> --disable-bfd-backtraces \
> --disable-dbghelp-backtraces \
> @@ -220,8 +222,12 @@ STRONGSWAN_CONF_OPT := \
> --disable-defaults \
> --enable-dependency-tracking \
> --enable-shared \
> + --$(call ptx/endis, PTXCONF_STRONGSWAN_SWANCTL)-swanctl \
> --with-ipseclibdir=/usr/lib \
> - --with-systemdsystemunitdir=/usr/lib/systemd/system
> + --with-systemdsystemunitdir=/usr/lib/systemd/system \
> + --sysconfdir=$(PTXCONF_STRONGSWAN_SYSCONF_DIR)
> +
> +STRONGSWAN_LDFLAGS := -Wl,-rpath,/usr/lib/plugins
>
> # ----------------------------------------------------------------------------
> # Target-Install
> @@ -251,12 +257,17 @@ STRONGSWAN_PLUGINS := \
> libstrongswan-sha1.so \
> libstrongswan-sha2.so \
> libstrongswan-socket-default.so \
> - libstrongswan-stroke.so \
> libstrongswan-updown.so \
> libstrongswan-x509.so \
> libstrongswan-xauth-generic.so \
> libstrongswan-xcbc.so
>
> +ifdef PTXCONF_STRONGSWAN_SWANCTL
> + STRONGSWAN_PLUGINS += libstrongswan-vici.so
> +else
> + STRONGSWAN_PLUGINS += libstrongswan-stroke.so
> +endif
> +
> ifdef PTXCONF_STRONGSWAN_LIBCURL
> STRONGSWAN_PLUGINS += libstrongswan-curl.so
> endif
> @@ -267,6 +278,7 @@ ifdef PTXCONF_STRONGSWAN_AFALG
> STRONGSWAN_PLUGINS += libstrongswan-af-alg.so
> endif
>
> +
> $(STATEDIR)/strongswan.targetinstall:
> @$(call targetinfo)
>
> @@ -276,34 +288,51 @@ $(STATEDIR)/strongswan.targetinstall:
> @$(call install_fixup, strongswan,AUTHOR,"Christoph Fritz <chf@fritzc.com>")
> @$(call install_fixup, strongswan,DESCRIPTION,missing)
>
> - @$(call install_alternative, strongswan, 0, 0, 0644, /etc/strongswan.conf)
> -
> - @$(call install_copy, strongswan, 0, 0, 0755, -, /usr/sbin/ipsec)
> +ifdef PTXCONF_STRONGSWAN_SYSTEMD_UNIT_ENABLE_SERVICE
> + @$(call install_link, strongswan, ../strongswan.service, \
> + /usr/lib/systemd/system/multi-user.target.wants/strongswan.service)
> +endif
>
> - @$(call install_tree, strongswan, 0, 0, -, /usr/libexec/ipsec)
> + @$(call install_tree, strongswan, 0, 0, -, /usr/bin)
> + @$(call install_tree, strongswan, 0, 0, -, /usr/libexec)
> + @$(call install_tree, strongswan, 0, 0, -, /usr/sbin)
>
> @$(call install_lib, strongswan, 0, 0, 0644, libcharon)
> @$(call install_lib, strongswan, 0, 0, 0644, libstrongswan)
>
> @$(foreach plugin, $(STRONGSWAN_PLUGINS), \
> - $(call install_copy, strongswan, 0, 0, 0644, -, \
> - /usr/lib/plugins/$(plugin));)
> + $(call install_copy, strongswan, 0, 0, 0644, -, \
> + /usr/lib/plugins/$(plugin));)
Keep the indention.
>
> -ifdef PTXCONF_STRONGSWAN_SYSTEMD_UNIT
> - @$(call install_alternative, strongswan, 0, 0, 0644, \
> - /usr/lib/systemd/system/strongswan.service)
This looks wrong. It looks like strongswan.service is not installed any
more.
> - @$(call install_link, strongswan, ../strongswan.service, \
> - /usr/lib/systemd/system/multi-user.target.wants/strongswan.service)
> + @$(call install_alternative, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/strongswan.conf)
> +
> +ifdef PTXCONF_STRONGSWAN_SWANCTL
> + @$(call install_lib, strongswan, 0, 0, 0644, libvici)
> + @$(call install_tree, strongswan, 0, 0, -, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/strongswan.d)
> + @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/bliss)
> + @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/conf.d)
> + @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/ecdsa)
> + @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/pkcs12)
> + @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/pkcs8)
> + @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/private)
> + @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/pubkey)
> + @$(call install_copy, strongswan, 0, 0, 750, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/rsa)
> + @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509)
> + @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509aa)
> + @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509ac)
> + @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509ca)
> + @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509crl)
> + @$(call install_copy, strongswan, 0, 0, 755, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/swanctl/x509ocsp)
> endif
>
> - @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/aacerts)
> - @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/acerts)
> - @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/cacerts)
> - @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/certs)
> - @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/crls)
> - @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/ocspcerts)
> - @$(call install_copy, strongswan, 0, 0, 0600, /etc/ipsec.d/private)
> - @$(call install_copy, strongswan, 0, 0, 0644, /etc/ipsec.d/reqs)
> + @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/aacerts)
> + @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/acerts)
> + @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/cacerts)
> + @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/certs)
> + @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/crls)
> + @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/ocspcerts)
> + @$(call install_copy, strongswan, 0, 0, 0600, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/private)
> + @$(call install_copy, strongswan, 0, 0, 0644, $(PTXCONF_STRONGSWAN_SYSCONF_DIR)/ipsec.d/reqs)
see above.
Michael
>
> @$(call install_finish, strongswan)
>
> --
> 2.23.0
>
>
> _______________________________________________
> ptxdist mailing list
> ptxdist@pengutronix.de
>
--
Pengutronix e.K. | |
Steuerwalder Str. 21 | http://www.pengutronix.de/ |
31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
prev parent reply other threads:[~2019-12-05 15:45 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-18 12:45 [ptxdist] [PATCH] " Lars Pedersen
2019-11-19 12:49 ` [ptxdist] [PATCH v2] " Lars Pedersen
2019-11-19 14:56 ` Bruno Thomsen
2019-11-25 6:53 ` Michael Olbrich
2019-11-26 10:21 ` Lars Pedersen
2019-11-28 16:21 ` Michael Olbrich
2019-12-05 9:34 ` Lars Pedersen
2019-12-05 15:45 ` Michael Olbrich [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191205154538.GK14948@pengutronix.de \
--to=m.olbrich@pengutronix.de \
--cc=ptxdist@pengutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox