forked from pool/strongswan
411 lines
16 KiB
RPMSpec
411 lines
16 KiB
RPMSpec
#
|
|
# spec file for package strongswan (Version 4.2.6)
|
|
#
|
|
# Copyright (c) 2008 SUSE LINUX Products GmbH, Nuernberg, Germany.
|
|
#
|
|
# All modifications and additions to the file contributed by third parties
|
|
# remain the property of their copyright owners, unless otherwise agreed
|
|
# upon. The license for this file, and modifications and additions to the
|
|
# file, is the same license as for the pristine package itself (unless the
|
|
# license for the pristine package is not an Open Source License, in which
|
|
# case the license is the MIT License). An "Open Source License" is a
|
|
# license that conforms to the Open Source Definition (Version 1.9)
|
|
# published by the Open Source Initiative.
|
|
|
|
# Please submit bugfixes or comments via http://bugs.opensuse.org/
|
|
#
|
|
|
|
# norootforbuild
|
|
|
|
|
|
Name: strongswan
|
|
%define upstream_version 4.2.6
|
|
%define strongswan_docdir %{_docdir}/%{name}
|
|
Version: 4.2.6
|
|
Release: 3
|
|
License: GPL v2 or later
|
|
Group: Productivity/Networking/Security
|
|
Summary: StrongSwan -- OpenSource IPsec-based VPN Solution
|
|
Url: http://www.strongswan.org/
|
|
PreReq: gmp grep %insserv_prereq %fillup_prereq
|
|
Requires: iproute2
|
|
Provides: pluto klips ipsec VPN freeswan
|
|
Obsoletes: freeswan
|
|
Conflicts: openswan
|
|
AutoReqProv: on
|
|
Source0: http://download.strongswan.org/strongswan-%{upstream_version}.tar.bz2
|
|
Source1: http://download.strongswan.org/strongswan-%{upstream_version}.tar.bz2.sig
|
|
Source2: %{name}.init.in
|
|
Source3: %{name}-%{version}-rpmlintrc
|
|
Patch1: %{name}_modprobe_syslog.dif
|
|
Patch2: %{name}-%{upstream_version}.dif
|
|
Patch3: %{name}_update-dns-server.dif
|
|
BuildRoot: %{_tmppath}/%{name}-%{version}-build
|
|
BuildRequires: bison flex gmp-devel gperf pkg-config
|
|
%if 0%{?suse_version} >= 1030
|
|
BuildRequires: libopenssl-devel libpcap-devel
|
|
%else
|
|
BuildRequires: libpcap openssl-devel
|
|
%endif
|
|
# --enable-curl
|
|
BuildRequires: curl-devel
|
|
# --enable-ldap
|
|
BuildRequires: openldap2-devel
|
|
|
|
%description
|
|
StrongSwan is an OpenSource IPsec-based VPN Solution for Linux
|
|
|
|
* runs both on Linux 2.4 (KLIPS IPsec) and Linux 2.6 (NETKEY IPsec)
|
|
kernels
|
|
|
|
* implements both the IKEv1 and IKEv2 (RFC 4306) key exchange
|
|
protocols
|
|
|
|
* NEW: Fully tested support of IPv6 IPsec tunnel connections
|
|
|
|
* Dynamical IP address and interface update with IKEv2 MOBIKE (RFC
|
|
4555)
|
|
|
|
* Fast connection startup and periodic update using ipsec starter
|
|
|
|
* Automatic insertion and deletion of IPsec policy based firewall
|
|
rules
|
|
|
|
* Strong 3DES, AES, Serpent, Twofish, or Blowfish encryption
|
|
|
|
* NAT-Traversal via UDP encapsulation and port floating (RFC 3947)
|
|
|
|
* Static Virtual IPs and IKE Mode Config Pull and Push modes
|
|
|
|
* XAUTH server and client functionality on top of IKE Main Mode
|
|
authentication
|
|
|
|
* Dead Peer Detection (DPD, RFC 3706) takes care of dangling tunnels
|
|
|
|
* Authentication based on X.509 certificates or preshared keys
|
|
|
|
* Generation of a default self-signed certificate during first
|
|
strongSwan startup
|
|
|
|
* Retrieval and local caching of Certificate Revocation Lists via
|
|
HTTP or LDAP
|
|
|
|
* Full support of the Online Certificate Status Protocol (OCSP, RCF
|
|
2560).
|
|
|
|
* CA management (OCSP and CRL URIs, default LDAP server)
|
|
|
|
* Powerful IPsec policies based on wildcards or intermediate CAs
|
|
|
|
* Group policies based on X.509 attribute certificates ( RFC 3281)
|
|
|
|
* Optional storage of RSA private keys and certificates on a
|
|
smartcard
|
|
|
|
* Smartcard access via standardized PKCS #11 interface
|
|
|
|
* PKCS #11 proxy function offering RSA decryption services via whack
|
|
|
|
* NEW: strongSwan Manager - a graphical management interface for IKEv2
|
|
|
|
|
|
|
|
Authors:
|
|
--------
|
|
Andreas Steffen
|
|
and others
|
|
|
|
%package doc
|
|
License: GPL v2 or later
|
|
Summary: StrongSwan -- OpenSource IPsec-based VPN Solution
|
|
Group: Productivity/Networking/Security
|
|
|
|
%description doc
|
|
StrongSwan is an OpenSource IPsec-based VPN Solution for Linux
|
|
|
|
This package provides the StrongSwan documentation.
|
|
|
|
|
|
|
|
Authors:
|
|
--------
|
|
Andreas Steffen
|
|
and others
|
|
|
|
%prep
|
|
%setup -q -n %{name}-%{upstream_version}
|
|
%patch1 -p0
|
|
%patch2 -p0
|
|
%patch3 -p0
|
|
sed -e 's|@libexecdir@|%_libexecdir|g' \
|
|
< $RPM_SOURCE_DIR/strongswan.init.in \
|
|
> strongswan.init
|
|
|
|
%build
|
|
export RPM_OPT_FLAGS="$RPM_OPT_FLAGS -W -Wall"
|
|
export CFLAGS="$RPM_OPT_FLAGS"
|
|
libtoolize --force
|
|
%{?suse_update_config:%{suse_update_config -f}}
|
|
autoreconf
|
|
%configure \
|
|
--enable-smartcard --with-default-pkcs11=%{_libdir}/opensc-pkcs11.so \
|
|
--enable-cisco-quirks \
|
|
--enable-openssl \
|
|
--enable-curl \
|
|
--enable-ldap
|
|
make %{?_smp_mflags:%_smp_mflags}
|
|
|
|
%install
|
|
export RPM_BUILD_ROOT
|
|
install -m755 -d ${RPM_BUILD_ROOT}%{_sbindir}/
|
|
install -m755 -d ${RPM_BUILD_ROOT}%{_sysconfdir}/ipsec.d/
|
|
install -m755 -d ${RPM_BUILD_ROOT}%{_sysconfdir}/init.d/
|
|
install -m755 strongswan.init ${RPM_BUILD_ROOT}%{_sysconfdir}/init.d/ipsec
|
|
ln -s %{_sysconfdir}/init.d/ipsec ${RPM_BUILD_ROOT}%{_sbindir}/rcipsec
|
|
#
|
|
make install DESTDIR="$RPM_BUILD_ROOT"
|
|
#
|
|
rm -f ${RPM_BUILD_ROOT}%{_sysconfdir}/ipsec.secrets
|
|
cat << EOT > ${RPM_BUILD_ROOT}%{_sysconfdir}/ipsec.secrets
|
|
#
|
|
# ipsec.secrets
|
|
#
|
|
# This file holds the RSA private keys or the PSK preshared secrets for
|
|
# the IKE/IPsec authentication. See the ipsec.secrets(5) manual page.
|
|
#
|
|
EOT
|
|
#
|
|
rm -f $RPM_BUILD_ROOT%{_libdir}/libstrongswan.{so,a,la}
|
|
find $RPM_BUILD_ROOT%{_libdir}/ipsec \
|
|
-name "*.a" -o -name "*.la" | xargs -r rm -f
|
|
#
|
|
install -m755 -d ${RPM_BUILD_ROOT}%{strongswan_docdir}/
|
|
install -m644 TODO NEWS README COPYING CREDITS \
|
|
${RPM_BUILD_ROOT}%{strongswan_docdir}/
|
|
|
|
%clean
|
|
if [ -n "$RPM_BUILD_ROOT" ] && [ "$RPM_BUILD_ROOT" != "/" ] ; then
|
|
rm -rf "$RPM_BUILD_ROOT"
|
|
fi
|
|
|
|
%post
|
|
%{run_ldconfig}
|
|
%{fillup_and_insserv ipsec}
|
|
|
|
%preun
|
|
%{stop_on_removal ipsec}
|
|
if test -s %{_sysconfdir}/ipsec.secrets.rpmsave; then
|
|
cp -p --backup=numbered %{_sysconfdir}/ipsec.secrets.rpmsave %{_sysconfdir}/ipsec.secrets.rpmsave.old
|
|
fi
|
|
if test -s %{_sysconfdir}/ipsec.conf.rpmsave; then
|
|
cp -p --backup=numbered %{_sysconfdir}/ipsec.conf.rpmsave %{_sysconfdir}/ipsec.conf.rpmsave.old
|
|
fi
|
|
|
|
%postun
|
|
%{run_ldconfig}
|
|
%{restart_on_update ipsec}
|
|
%{insserv_cleanup}
|
|
|
|
%files
|
|
%defattr(-,root,root)
|
|
%config(noreplace) %attr(600,root,root) %{_sysconfdir}/ipsec.conf
|
|
%config(noreplace) %attr(600,root,root) %{_sysconfdir}/ipsec.secrets
|
|
%config(noreplace) %attr(600,root,root) %{_sysconfdir}/strongswan.conf
|
|
%dir %{_sysconfdir}/ipsec.d
|
|
%dir %{_sysconfdir}/ipsec.d/crls
|
|
%dir %{_sysconfdir}/ipsec.d/reqs
|
|
%dir %{_sysconfdir}/ipsec.d/certs
|
|
%dir %{_sysconfdir}/ipsec.d/acerts
|
|
%dir %{_sysconfdir}/ipsec.d/aacerts
|
|
%dir %{_sysconfdir}/ipsec.d/cacerts
|
|
%dir %{_sysconfdir}/ipsec.d/ocspcerts
|
|
%dir %attr(700,root,root) %{_sysconfdir}/ipsec.d/private
|
|
%config %{_sysconfdir}/init.d/ipsec
|
|
%{_sbindir}/rcipsec
|
|
%{_sbindir}/ipsec
|
|
%{_libdir}/ipsec
|
|
%{_libdir}/libstrongswan.*
|
|
%if "%{_libdir}" != "%{_libexecdir}"
|
|
%{_libexecdir}/ipsec
|
|
%endif
|
|
%{_mandir}/man5/ipsec.conf.5*
|
|
%{_mandir}/man5/ipsec.secrets.5*
|
|
%{_mandir}/man8/ipsec.8*
|
|
|
|
%files doc
|
|
%defattr(-,root,root)
|
|
%dir %{strongswan_docdir}
|
|
%{strongswan_docdir}/TODO
|
|
%{strongswan_docdir}/NEWS
|
|
%{strongswan_docdir}/README
|
|
%{strongswan_docdir}/COPYING
|
|
%{strongswan_docdir}/CREDITS
|
|
%{_mandir}/man3/anyaddr.3*
|
|
%{_mandir}/man3/atoaddr.3*
|
|
%{_mandir}/man3/atoasr.3*
|
|
%{_mandir}/man3/atosa.3*
|
|
%{_mandir}/man3/atoul.3*
|
|
%{_mandir}/man3/goodmask.3*
|
|
%{_mandir}/man3/initaddr.3*
|
|
%{_mandir}/man3/initsubnet.3*
|
|
%{_mandir}/man3/keyblobtoid.3*
|
|
%{_mandir}/man3/optionsfrom.3*
|
|
%{_mandir}/man3/portof.3*
|
|
%{_mandir}/man3/prng.3*
|
|
%{_mandir}/man3/rangetosubnet.3*
|
|
%{_mandir}/man3/sameaddr.3*
|
|
%{_mandir}/man3/subnetof.3*
|
|
%{_mandir}/man3/ttoaddr.3*
|
|
%{_mandir}/man3/ttodata.3*
|
|
%{_mandir}/man3/ttosa.3*
|
|
%{_mandir}/man3/ttoul.3*
|
|
%{_mandir}/man3/version.3*
|
|
%{_mandir}/man8/_copyright.8*
|
|
%{_mandir}/man8/_updown.8*
|
|
%{_mandir}/man8/_updown_espmark.8*
|
|
%{_mandir}/man8/openac.8*
|
|
%{_mandir}/man8/pluto.8*
|
|
%{_mandir}/man8/scepclient.8*
|
|
%{_mandir}/man8/starter.8*
|
|
|
|
%changelog
|
|
* Thu Aug 28 2008 mt@suse.de
|
|
- Fixed to use --enable-curl instead of --enable-http as before
|
|
- Enabled the OpenSSL crypto plugin in the spec file.
|
|
* Thu Aug 28 2008 mt@suse.de
|
|
- Updated to 4.2.6 release, fixing bugs and offering a lot of new
|
|
features comparing to the last version provided by this package.
|
|
Most important are:
|
|
* A NetworkManager plugin allows GUI-based configuration of
|
|
road-warrior clients in a simple way. It features X509 based
|
|
gateway authentication and EAP client authentication, tunnel
|
|
setup/teardown and storing passwords in the Gnome Keyring.
|
|
* A new EAP-GTC plugin implements draft-sheffer-ikev2-gtc-00.txt
|
|
and allows username/password authentication against any PAM
|
|
service on the gateway. The new EAP method interacts nicely with
|
|
the NetworkManager plugin and allows client authentication against
|
|
e.g. LDAP.
|
|
* Improved support for the EAP-Identity method. The new ipsec.conf
|
|
eap_identity parameter defines an additional identity to pass to
|
|
the server in EAP authentication.
|
|
* Fixed two multithreading deadlocks occurring when starting up
|
|
several hundred tunnels concurrently.
|
|
* Fixed the --enable-integrity-test configure option which
|
|
computes a SHA-1 checksum over the libstrongswan library.
|
|
* Consistent logging of IKE and CHILD SAs at the audit (AUD) level.
|
|
* Improved the performance of the SQL-based virtual IP address pool
|
|
by introducing an additional addresses table. The leases table
|
|
storing only history information has become optional and can be
|
|
disabled by setting charon.plugins.sql.lease_history = no in
|
|
strongswan.conf.
|
|
* The XFRM_STATE_AF_UNSPEC flag added to xfrm.h allows IPv4-over-IPv6
|
|
and IPv6-over-IPv4 tunnels with the 2.6.26 and later Linux kernels.
|
|
* management of different virtual IP pools for different network
|
|
interfaces have become possible.
|
|
* fixed a bug which prevented the assignment of more than 256
|
|
virtual IP addresses from a pool managed by an sql database.
|
|
* fixed a bug which did not delete own IPCOMP SAs in the kernel.
|
|
* The openssl plugin supports the elliptic curve Diffie-Hellman
|
|
groups 19, 20, 21, 25, and 26 and ECDSA authentication using
|
|
elliptic curve X.509 certificates.
|
|
* Fixed a bug in stroke which caused multiple charon threads to
|
|
close the file descriptors during packet transfers over the stroke
|
|
socket.
|
|
* ESP sequence numbers are now migrated in IPsec SA updates handled
|
|
by MOBIKE. Works only with Linux kernels >= 2.6.17.
|
|
* Fixed a number of minor bugs that where discovered during the 4th
|
|
IKEv2 interoperability workshop in San Antonio, TX.
|
|
* Plugins for libstrongswan and charon can optionally be loaded
|
|
according to a configuration in strongswan.conf. Most components
|
|
provide a "load = " option followed by a space separated list of
|
|
plugins to load. This allows e.g. the fallback from a hardware
|
|
crypto accelerator to to software-based crypto plugins.
|
|
* Charons SQL plugin has been extended by a virtual IP address pool.
|
|
Configurations with a rightsourceip=%%poolname setting query a
|
|
SQLite or MySQL database for leases. The "ipsec pool" command helps
|
|
in administrating the pool database. See ipsec pool --help for the
|
|
available options
|
|
* The Authenticated Encryption Algorithms AES-CCM-8/12/16 and
|
|
AES-GCM-8/12/16 for ESP are now supported starting with the Linux
|
|
2.6.25 kernel. The syntax is e.g. esp=aes128ccm12 or esp=aes256gcm16.
|
|
- Added patch disabling direct modifications of resolv.conf; has to
|
|
be replaced by a netconfig call.
|
|
- Added patch adding a missed file name argument in printf call in the
|
|
scripts/thread_analysis.c file -- resulting binary is not installed.
|
|
- Removed obsolete patches crash_badcfg_reload and old-caps-version.
|
|
* Tue Jul 01 2008 mt@suse.de
|
|
- Added fix that explicitly enables version 1 linux capabilities
|
|
on version 2 systems to aviod that the charon and pluto daemons
|
|
exit because of failed capset call (bnc#404989).
|
|
* Mon May 19 2008 mt@suse.de
|
|
- Applied fix (strongswan_crash_badcfg_reload.dif) to avoid
|
|
a crash after reloading with bad config (bnc#392062).
|
|
* Wed Apr 23 2008 mt@suse.de
|
|
- Updated to 4.2.1 release. A lot of code refactoring in the 4.2
|
|
release provides much more modularity and therefore much more
|
|
extensiblity and offers the following new features:
|
|
* libstrongswan has been modularized to attach crypto algorithms,
|
|
credential implementations (secret and private keys, certificates)
|
|
and http/ldap fetchers dynamically through plugins.
|
|
* A relational database API that uses pluggable database providers
|
|
was added to libstrongswan including plugins for MySQL and SQLite.
|
|
* The IKEv2 keying charon daemon has become more extensible. Generic
|
|
plugins can provide arbitrary interfaces to credential stores and
|
|
connection management interfaces. Also any EAP method can be added.
|
|
* The authentication and credential framework in charon has been
|
|
heavily refactored to support modular credential providers, proper
|
|
CERTREQ/CERT payload exchanges and extensible authorization rules.
|
|
* Support for "Hash and URL" encoded certificate payloads has been
|
|
implemented in the IKEv2 daemon charon.
|
|
* The IKEv2 daemon charon now supports the "uniqueids" option to
|
|
close multiple IKE_SAs with the same peer.
|
|
* The crypto factory in libstrongswan additionally supports random
|
|
number generators. Plugins may provide other sources of randomness.
|
|
* Extended the credential framework by a caching option to allow
|
|
plugins persistent caching of fetched credentials.
|
|
* The new trust chain verification introduced in 4.2.0 has been
|
|
parallelized. Threads fetching CRL or OCSP information no longer
|
|
block other threads.
|
|
* A new IKEv2 configuration attribute framework has been introduced
|
|
allowing plugins to provide virtual IP addresses, and in the future,
|
|
other configuration attribute services (e.g. DNS/WINS servers).
|
|
* The stroke plugin has been extended to provide virtual IP addresses
|
|
from a simple pool defined in ipsec.conf.
|
|
* Fixed compilation on uClibc and a couple of other minor bugs.
|
|
* The IKEv1 pluto daemon now supports the ESP encryption algorithm
|
|
CAMELLIA with key lengths of 128, 192, and 256 bits, as well as the
|
|
authentication algorithm AES_XCBC_MAC.
|
|
- Applied a small patch defining _GNU_SOURCE for struct in6_pktinfo
|
|
and adding inclusion of limits.h for PATH_MAX availability.
|
|
- Added rpmlintrc file and a libtoolize call to the spec file.
|
|
* Tue Feb 19 2008 mt@suse.de
|
|
- Updated to 4.1.11 maintenance release, providing following fixes:
|
|
* IKE rekeying in NAT situations did not inherit the NAT conditions
|
|
to the rekeyed IKE_SA so that the UDP encapsulation was lost with
|
|
the next CHILD_SA rekeying.
|
|
* Wrong type definition of the next_payload variable in id_payload.c
|
|
caused an INVALID_SYNTAX error on PowerPC platforms.
|
|
* Implemented IKEv2 EAP-SIM server and client test modules that use
|
|
triplets stored in a file. For details on the configuration see
|
|
the scenario 'ikev2/rw-eap-sim-rsa'.
|
|
- The 4.1.10 final version, declared upstream as "Fully tested support
|
|
of IPv6 IPsec tunnel connections", fixes ordering error in oscp cache,
|
|
IPv6 defaults of the nexthop parameter, adds support for new EAP
|
|
modules [disabled in this build] and obsoletes our strongswan_path
|
|
and strongswan_ipsec_script_msg patches.
|
|
- Removed a sed call from init script.
|
|
* Sat Dec 08 2007 mt@suse.de
|
|
- Updated to 4.1.9 final, including all our patches.
|
|
- Changed init script to use ipsec cmd using LSB codes now.
|
|
- Added strongswan_path.dif setting a PATH in scripts (updown).
|
|
- Added strongswan_ipsec_script_msg.dif for consistent look of
|
|
ipsec script messages.
|
|
- Added strongswan_modprobe_syslog.dif redirecting modprobe
|
|
output to syslog.
|
|
* Mon Nov 26 2007 mt@suse.de
|
|
- Renamed charon plugins to avoid rpm conflicts with existing
|
|
libraries (libstroke). Patch: strongswan-libconflicts.dif
|
|
- Added init script. Template file: strongswan.init.in
|
|
* Thu Nov 22 2007 mt@suse.de
|
|
- Initial, unfinished package
|