c4052e0aeb
- actually verify tarballs - use as many pkgconfig and rubygem names OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=57
162 lines
5.9 KiB
RPMSpec
162 lines
5.9 KiB
RPMSpec
#
|
|
# spec file for package ocserv
|
|
#
|
|
# Copyright (c) 2024 SUSE LLC
|
|
#
|
|
# All modifications and additions to the file contributed by third parties
|
|
# remain the property of their copyright owners, unless otherwise agreed
|
|
# upon. The license for this file, and modifications and additions to the
|
|
# file, is the same license as for the pristine package itself (unless the
|
|
# license for the pristine package is not an Open Source License, in which
|
|
# case the license is the MIT License). An "Open Source License" is a
|
|
# license that conforms to the Open Source Definition (Version 1.9)
|
|
# published by the Open Source Initiative.
|
|
|
|
# Please submit bugfixes or comments via https://bugs.opensuse.org/
|
|
#
|
|
|
|
|
|
#!BuildIgnore: pkgconfig(libevent)
|
|
|
|
Name: ocserv
|
|
Version: 1.3.0
|
|
Release: 0
|
|
Summary: OpenConnect VPN Server
|
|
License: GPL-2.0-only
|
|
Group: Productivity/Networking/Security
|
|
URL: https://ocserv.gitlab.io/www/
|
|
Source: https://www.infradead.org/%{name}/download/%{name}-%{version}.tar.xz
|
|
Source1: https://www.infradead.org/%{name}/download/%{name}-%{version}.tar.xz.sig
|
|
Source2: ca.tmpl
|
|
Source3: server.tmpl
|
|
Source4: user.tmpl
|
|
Source5: ocserv-forwarding.sh
|
|
Source6: ocserv.firewalld.xml
|
|
Source99: README.SUSE
|
|
Source100: https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x1f42418905d8206aa754ccdc29ee58b996865171#/%{name}.keyring
|
|
#PATCH-FIX-UPSTREAM marguerite@opensuse.org $LIBSYSTEMD_DAEMON env is not set on openSUSE
|
|
Patch1: %{name}-enable-systemd.patch
|
|
#PATCH-FIX-UPSTREAM marguerite@opensuse.org tweak configuration
|
|
Patch2: %{name}.config.patch
|
|
#PATCH-FIX-OPENSUSE marguerite@opensuse.org leap doesn't have LZ4_compress_default
|
|
Patch3: %{name}-LZ4_compress_default.patch
|
|
BuildRequires: autogen
|
|
BuildRequires: firewall-macros
|
|
BuildRequires: firewalld
|
|
BuildRequires: freeradius-client-devel
|
|
BuildRequires: gperf
|
|
BuildRequires: gpg2
|
|
BuildRequires: ipcalc
|
|
BuildRequires: libtool
|
|
BuildRequires: pkgconfig
|
|
BuildRequires: protobuf-c
|
|
BuildRequires: pkgconfig(dbus-1)
|
|
BuildRequires: pkgconfig(gnutls) >= 3.1.10
|
|
BuildRequires: pkgconfig(libev)
|
|
BuildRequires: pkgconfig(liblz4)
|
|
BuildRequires: pkgconfig(libmaxminddb)
|
|
BuildRequires: pkgconfig(libnl-3.0)
|
|
BuildRequires: pkgconfig(liboath)
|
|
BuildRequires: pkgconfig(libprotobuf-c)
|
|
BuildRequires: pkgconfig(libseccomp)
|
|
BuildRequires: pkgconfig(libsystemd)
|
|
BuildRequires: pkgconfig(pam)
|
|
BuildRequires: pkgconfig(readline)
|
|
BuildRequires: pkgconfig(talloc)
|
|
BuildRequires: rubygem(ronn-ng)
|
|
# /usr/bin/certtool for generating certificates
|
|
Requires: gnutls >= 3.1.10
|
|
%{?systemd_requires}
|
|
|
|
%if 0%{?suse_version} < 1600
|
|
ExclusiveArch: do_not_build
|
|
%endif
|
|
|
|
%description
|
|
OpenConnect server (ocserv) is an SSL VPN server. Its purpose is to
|
|
be a secure, small, fast and configurable VPN server. It implements
|
|
the OpenConnect SSL VPN protocol, and has also (currently experimental)
|
|
compatibility with clients using the AnyConnect SSL VPN protocol.
|
|
The OpenConnect protocol provides a dual TCP/UDP VPN channel, and
|
|
uses the standard IETF security protocols to secure it. The server
|
|
is implemented primarily for the GNU/Linux platform but its code
|
|
is designed to be portable to other UNIX variants as well.
|
|
|
|
Ocserv's main features are security through privilege separation
|
|
and sandboxing, accounting, and resilience due to a combined use
|
|
of TCP and UDP. Authentication occurs in an isolated security
|
|
module process, and each user is assigned an unprivileged worker
|
|
process, and a networking (tun) device. That not only eases the
|
|
control of the resources of each user or group of users, but also
|
|
prevents data leak (e.g., heartbleed-style attacks), and privilege
|
|
escalation due to any bug on the VPN handling (worker) process.
|
|
A management interface allows for viewing and querying logged-in users.
|
|
|
|
%prep
|
|
%autosetup -p1
|
|
|
|
%build
|
|
autoreconf -fiv
|
|
%configure --enable-systemd \
|
|
--enable-seccomp \
|
|
--disable-rpath \
|
|
--enable-local-libopts \
|
|
--enable-libopts-install
|
|
%make_build
|
|
|
|
%install
|
|
%make_install DESTDIR=%{buildroot}
|
|
|
|
install -Dm 0755 %{SOURCE5} %{buildroot}%{_sbindir}/%{name}-forwarding
|
|
install -D -m 644 %{SOURCE6} %{buildroot}%{_prefix}/lib/firewalld/services/%{name}.xml
|
|
|
|
install -d %{buildroot}%{_sysconfdir}/%{name}/certificates
|
|
install -m 0644 %{SOURCE2} %{buildroot}%{_sysconfdir}/%{name}/certificates
|
|
install -m 0644 %{SOURCE3} %{buildroot}%{_sysconfdir}/%{name}/certificates
|
|
install -m 0644 %{SOURCE4} %{buildroot}%{_sysconfdir}/%{name}/certificates
|
|
install -m 0644 %{SOURCE99} %{buildroot}%{_sysconfdir}/%{name}/
|
|
install -m 0644 doc/sample.config %{buildroot}%{_sysconfdir}/ocserv/%{name}.conf
|
|
install -m 0644 doc/sample.passwd %{buildroot}%{_sysconfdir}/ocserv/ocpasswd
|
|
install -m 0755 doc/scripts/%{name}-script %{buildroot}%{_bindir}
|
|
|
|
install -d %{buildroot}%{_unitdir}
|
|
# if --with-dubs, here should be "standalone"
|
|
install -m 0644 doc/systemd/socket-activated/%{name}.socket %{buildroot}%{_unitdir}
|
|
install -m 0644 doc/systemd/socket-activated/%{name}.service %{buildroot}%{_unitdir}
|
|
|
|
sed -i '/^\[Service\].*/a ExecStopPost=%{_sbindir}/%{name}-forwarding --disable' %{buildroot}%{_unitdir}/%{name}.service
|
|
sed -i '/^\[Service\].*/a ExecStartPre=%{_sbindir}/%{name}-forwarding --enable' %{buildroot}%{_unitdir}/%{name}.service
|
|
|
|
%pre
|
|
%service_add_pre %{name}.service %{name}.socket
|
|
|
|
%post
|
|
%service_add_post %{name}.service %{name}.socket
|
|
%firewalld_reload
|
|
|
|
%preun
|
|
%service_del_preun %{name}.service %{name}.socket
|
|
|
|
%postun
|
|
%service_del_postun %{name}.service %{name}.socket
|
|
|
|
%files
|
|
%doc AUTHORS NEWS README.md
|
|
%license COPYING
|
|
%config %{_sysconfdir}/%{name}
|
|
%{_prefix}/lib/firewalld/services/%{name}.xml
|
|
%{_bindir}/occtl
|
|
%{_bindir}/ocpasswd
|
|
%{_bindir}/%{name}-script
|
|
%{_libexecdir}/%{name}-fw
|
|
%{_sbindir}/%{name}
|
|
%{_sbindir}/%{name}-forwarding
|
|
%{_sbindir}/%{name}-worker
|
|
%{_unitdir}/%{name}.service
|
|
%{_unitdir}/%{name}.socket
|
|
%{_mandir}/man?/occtl.?%{ext_man}
|
|
%{_mandir}/man?/ocpasswd.?%{ext_man}
|
|
%{_mandir}/man?/%{name}.?%{ext_man}
|
|
|
|
%changelog
|