strongswan/strongswan.spec

#
# spec file for package strongswan (Version 4.2.1)
#
# Copyright (c) 2008 SUSE LINUX Products GmbH, Nuernberg, Germany.
# This file and all modifications and additions to the pristine
# package are under the same license as the package itself.
#
# Please submit bugfixes or comments via http://bugs.opensuse.org/
#

# norootforbuild


Name:           strongswan
%define         upstream_version 4.2.1
%define         strongswan_docdir %{_docdir}/%{name}
Version:        4.2.1
Release:        16
License:        GPL v2 or later
Group:          Productivity/Networking/Security
Summary:        StrongSwan -- OpenSource IPsec-based VPN Solution
Url:            http://www.strongswan.org/
PreReq:         gmp grep %insserv_prereq %fillup_prereq
Requires:       iproute2
Provides:       pluto klips ipsec VPN freeswan
Obsoletes:      freeswan
Conflicts:      openswan
AutoReqProv:    on
Source0:        http://download.strongswan.org/strongswan-%{upstream_version}.tar.bz2
Source1:        http://download.strongswan.org/strongswan-%{upstream_version}.tar.bz2.sig
Source2:        %{name}.init.in
Source3:        %{name}-%{version}-rpmlintrc
Patch1:         %{name}_modprobe_syslog.dif
Patch2:         %{name}-%{upstream_version}.dif
Patch3:         %{name}_crash_badcfg_reload.dif
Patch4:         %{name}_old-caps-version.diff
BuildRoot:      %{_tmppath}/%{name}-%{version}-build
BuildRequires:  bison flex gmp-devel gperf pkg-config
%if 0%{?suse_version} >= 1030
BuildRequires:  libpcap-devel
%else
BuildRequires:  libpcap
%endif
#               --enable-http
BuildRequires:  curl-devel
#               --enable-ldap
BuildRequires:  openldap2-devel

%description
StrongSwan is an OpenSource IPsec-based VPN Solution for Linux

* runs both on Linux 2.4 (KLIPS IPsec) and Linux 2.6 (NETKEY IPsec)
   kernels

* implements both the IKEv1 and IKEv2 (RFC 4306) key exchange
   protocols

* NEW: Fully tested support of IPv6 IPsec tunnel connections

* Dynamical IP address and interface update with IKEv2 MOBIKE (RFC
   4555)

* Fast connection startup and periodic update using ipsec starter

* Automatic insertion and deletion of IPsec policy based firewall
   rules

* Strong 3DES, AES, Serpent, Twofish, or Blowfish encryption

* NAT-Traversal via UDP encapsulation and port floating (RFC 3947)

* Static Virtual IPs and IKE Mode Config Pull and Push modes

* XAUTH server and client functionality on top of IKE Main Mode
   authentication

* Dead Peer Detection (DPD, RFC 3706) takes care of dangling tunnels

* Authentication based on X.509 certificates or preshared keys

* Generation of a default self-signed certificate during first
   strongSwan startup

* Retrieval and local caching of Certificate Revocation Lists via
   HTTP or LDAP

* Full support of the Online Certificate Status Protocol (OCSP, RCF
   2560).

* CA management (OCSP and CRL URIs, default LDAP server)

* Powerful IPsec policies based on wildcards or intermediate CAs

* Group policies based on X.509 attribute certificates ( RFC 3281)

* Optional storage of RSA private keys and certificates on a
   smartcard

* Smartcard access via standardized PKCS #11 interface

* PKCS #11 proxy function offering RSA decryption services via whack

* NEW: strongSwan Manager - a graphical management interface for IKEv2



Authors:
--------
    Andreas Steffen
    and others

%package doc
License:        GPL v2 or later
Summary:        StrongSwan -- OpenSource IPsec-based VPN Solution
Group:          Productivity/Networking/Security

%description doc
StrongSwan is an OpenSource IPsec-based VPN Solution for Linux

This package provides the StrongSwan documentation.



Authors:
--------
    Andreas Steffen
    and others

%prep
%setup -q -n %{name}-%{upstream_version}
%patch1 -p0
%patch2 -p0
%patch3 -p0
%patch4 -p2
sed -e 's|@libexecdir@|%_libexecdir|g'    \
     < $RPM_SOURCE_DIR/strongswan.init.in \
     > strongswan.init

%build
export RPM_OPT_FLAGS="$RPM_OPT_FLAGS -W -Wall"
export CFLAGS="$RPM_OPT_FLAGS"
libtoolize --force
%{?suse_update_config:%{suse_update_config -f}}
autoreconf
%configure \
	--enable-smartcard --with-default-pkcs11=%{_libdir}/opensc-pkcs11.so \
	--enable-cisco-quirks	\
	--enable-http		\
	--enable-ldap
make %_smp_mflags

%install
export RPM_BUILD_ROOT
install -m755 -d              ${RPM_BUILD_ROOT}%{_sbindir}/
install -m755 -d              ${RPM_BUILD_ROOT}%{_sysconfdir}/init.d/
install -m755 strongswan.init ${RPM_BUILD_ROOT}%{_sysconfdir}/init.d/ipsec
ln -s   %{_sysconfdir}/init.d/ipsec ${RPM_BUILD_ROOT}%{_sbindir}/rcipsec
#
make install DESTDIR="$RPM_BUILD_ROOT"
#
rm -f ${RPM_BUILD_ROOT}%{_sysconfdir}/ipsec.secrets
cat << EOT > ${RPM_BUILD_ROOT}%{_sysconfdir}/ipsec.secrets
#
# ipsec.secrets
#
# This file holds the RSA private keys or the PSK preshared secrets for
# the IKE/IPsec authentication. See the ipsec.secrets(5) manual page.
#
EOT
#
rm -f $RPM_BUILD_ROOT%{_libdir}/libstrongswan.{so,a,la}
find  $RPM_BUILD_ROOT%{_libdir}/ipsec \
      -name "*.a" -o -name "*.la" | xargs -r rm -f
#
install -m755 -d ${RPM_BUILD_ROOT}%{strongswan_docdir}/
install -m644 TODO NEWS README COPYING CREDITS \
                 ${RPM_BUILD_ROOT}%{strongswan_docdir}/

%clean
if [ -n "$RPM_BUILD_ROOT" ] && [ "$RPM_BUILD_ROOT" != "/" ] ; then
	rm -rf "$RPM_BUILD_ROOT"
fi

%post
%{run_ldconfig}
%{fillup_and_insserv ipsec}

%preun
%{stop_on_removal ipsec}
if test -s %{_sysconfdir}/ipsec.secrets.rpmsave; then
  cp -p --backup=numbered %{_sysconfdir}/ipsec.secrets.rpmsave %{_sysconfdir}/ipsec.secrets.rpmsave.old
fi
if test -s %{_sysconfdir}/ipsec.conf.rpmsave; then
  cp -p --backup=numbered %{_sysconfdir}/ipsec.conf.rpmsave %{_sysconfdir}/ipsec.conf.rpmsave.old
fi

%postun
%{run_ldconfig}
%{restart_on_update ipsec}
%{insserv_cleanup}

%files
%defattr(-,root,root)
%config(noreplace) %attr(600,root,root) %{_sysconfdir}/ipsec.conf
%config(noreplace) %attr(600,root,root) %{_sysconfdir}/ipsec.secrets
%config(noreplace) %attr(600,root,root) %{_sysconfdir}/strongswan.conf
%dir %{_sysconfdir}/ipsec.d
%dir %{_sysconfdir}/ipsec.d/crls
%dir %{_sysconfdir}/ipsec.d/reqs
%dir %{_sysconfdir}/ipsec.d/certs
%dir %{_sysconfdir}/ipsec.d/acerts
%dir %{_sysconfdir}/ipsec.d/aacerts
%dir %{_sysconfdir}/ipsec.d/cacerts
%dir %{_sysconfdir}/ipsec.d/ocspcerts
%dir %attr(700,root,root) %{_sysconfdir}/ipsec.d/private
%config %{_sysconfdir}/init.d/ipsec
%{_sbindir}/rcipsec
%{_sbindir}/ipsec
%{_libdir}/ipsec
%{_libdir}/libstrongswan.*
%if "%{_libdir}" != "%{_libexecdir}"
%{_libexecdir}/ipsec
%endif
%{_mandir}/man5/ipsec.conf.5*
%{_mandir}/man5/ipsec.secrets.5*
%{_mandir}/man8/ipsec.8*

%files doc
%defattr(-,root,root)
%dir %{strongswan_docdir}
%{strongswan_docdir}/TODO
%{strongswan_docdir}/NEWS
%{strongswan_docdir}/README
%{strongswan_docdir}/COPYING
%{strongswan_docdir}/CREDITS
%{_mandir}/man3/anyaddr.3*
%{_mandir}/man3/atoaddr.3*
%{_mandir}/man3/atoasr.3*
%{_mandir}/man3/atosa.3*
%{_mandir}/man3/atoul.3*
%{_mandir}/man3/goodmask.3*
%{_mandir}/man3/initaddr.3*
%{_mandir}/man3/initsubnet.3*
%{_mandir}/man3/keyblobtoid.3*
%{_mandir}/man3/optionsfrom.3*
%{_mandir}/man3/portof.3*
%{_mandir}/man3/prng.3*
%{_mandir}/man3/rangetosubnet.3*
%{_mandir}/man3/sameaddr.3*
%{_mandir}/man3/subnetof.3*
%{_mandir}/man3/ttoaddr.3*
%{_mandir}/man3/ttodata.3*
%{_mandir}/man3/ttosa.3*
%{_mandir}/man3/ttoul.3*
%{_mandir}/man3/version.3*
%{_mandir}/man8/_copyright.8*
%{_mandir}/man8/_updown.8*
%{_mandir}/man8/_updown_espmark.8*
%{_mandir}/man8/openac.8*
%{_mandir}/man8/pluto.8*
%{_mandir}/man8/scepclient.8*
%{_mandir}/man8/starter.8*

%changelog
* Tue Jul 01 2008 mt@suse.de
- Added fix that explicitly enables version 1 linux capabilities
  on version 2 systems to aviod that the charon and pluto daemons
  exit because of failed capset call (bnc#404989).
* Mon May 19 2008 mt@suse.de
- Applied fix (strongswan_crash_badcfg_reload.dif) to avoid
  a crash after reloading with bad config (bnc#392062).
* Wed Apr 23 2008 mt@suse.de
- Updated to 4.2.1 release. A lot of code refactoring in the 4.2
  release provides much more modularity and therefore much more
  extensiblity and offers the following new features:
  * libstrongswan has been modularized to attach crypto algorithms,
  credential implementations (secret and private keys, certificates)
  and http/ldap fetchers dynamically through plugins.
  * A relational database API that uses pluggable database providers
  was added to libstrongswan including plugins for MySQL and SQLite.
  * The IKEv2 keying charon daemon has become more extensible. Generic
  plugins can provide arbitrary interfaces to credential stores and
  connection management interfaces. Also any EAP method can be added.
  * The authentication and credential framework in charon has been
  heavily refactored to support modular credential providers, proper
  CERTREQ/CERT payload exchanges and extensible authorization rules.
  * Support for "Hash and URL" encoded certificate payloads has been
  implemented in the IKEv2 daemon charon.
  * The IKEv2 daemon charon now supports the "uniqueids" option to
  close multiple IKE_SAs with the same peer.
  * The crypto factory in libstrongswan additionally supports random
  number generators. Plugins may provide other sources of randomness.
  * Extended the credential framework by a caching option to allow
  plugins persistent caching of fetched credentials.
  * The new trust chain verification introduced in 4.2.0 has been
  parallelized. Threads fetching CRL or OCSP information no longer
  block other threads.
  * A new IKEv2 configuration attribute framework has been introduced
  allowing plugins to provide virtual IP addresses, and in the future,
  other configuration attribute services (e.g. DNS/WINS servers).
  * The stroke plugin has been extended to provide virtual IP addresses
  from a simple pool defined in ipsec.conf.
  * Fixed compilation on uClibc and a couple of other minor bugs.
  * The IKEv1 pluto daemon now supports the ESP encryption algorithm
  CAMELLIA with key lengths of 128, 192, and 256 bits, as well as the
  authentication algorithm AES_XCBC_MAC.
- Applied a small patch defining _GNU_SOURCE for struct in6_pktinfo
  and adding inclusion of limits.h for PATH_MAX availability.
- Added rpmlintrc file and a libtoolize call to the spec file.
* Tue Feb 19 2008 mt@suse.de
- Updated to 4.1.11 maintenance release, providing following fixes:
  * IKE rekeying in NAT situations did not inherit the NAT conditions
  to the rekeyed IKE_SA so that the UDP encapsulation was lost with
  the next CHILD_SA rekeying.
  * Wrong type definition of the next_payload variable in id_payload.c
  caused an INVALID_SYNTAX error on PowerPC platforms.
  * Implemented IKEv2 EAP-SIM server and client test modules that use
  triplets stored in a file. For details on the configuration see
  the scenario 'ikev2/rw-eap-sim-rsa'.
- The 4.1.10 final version, declared upstream as "Fully tested support
  of IPv6 IPsec tunnel connections", fixes ordering error in oscp cache,
  IPv6 defaults of the nexthop parameter, adds support for new EAP
  modules [disabled in this build] and obsoletes our strongswan_path
  and strongswan_ipsec_script_msg patches.
- Removed a sed call from init script.
* Sat Dec 08 2007 mt@suse.de
- Updated to 4.1.9 final, including all our patches.
- Changed init script to use ipsec cmd using LSB codes now.
- Added strongswan_path.dif setting a PATH in scripts (updown).
- Added strongswan_ipsec_script_msg.dif for consistent look of
  ipsec script messages.
- Added strongswan_modprobe_syslog.dif redirecting modprobe
  output to syslog.
* Mon Nov 26 2007 mt@suse.de
- Renamed charon plugins to avoid rpm conflicts with existing
  libraries (libstroke). Patch: strongswan-libconflicts.dif
- Added init script. Template file: strongswan.init.in
* Thu Nov 22 2007 mt@suse.de
- Initial, unfinished package