rpm/strongswan
SHA256
1
0
Fork 0
forked from pool/strongswan
Code Pull Requests Activity
bb81a4479d
strongswan/strongswan.spec
Marius Tomaschewski bb81a4479d - Updated to strongSwan 4.4.0 release, changes since 4.3.6 are: 
* The IKEv2 High Availability plugin has been integrated. It
  provides load sharing and failover capabilities in a cluster of
  currently two nodes, based on an extend ClusterIP kernel module.
  More information is available at
  http://wiki.strongswan.org/projects/strongswan/wiki/HighAvailability.
  The development of the High Availability functionality was sponsored
  by secunet Security Networks AG.
  * Added IKEv1 and IKEv2 configuration support for the AES-GMAC
  authentication-only ESP cipher. Our aes_gmac kernel patch or a Linux
  2.6.34 kernel is required to make AES-GMAC available via the XFRM
  kernel interface.
  * Added support for Diffie-Hellman groups 22, 23 and 24 to the gmp,
  gcrypt and openssl plugins, usable by both pluto and charon. The new
  proposal keywords are modp1024s160, modp2048s224 and modp2048s256.
  Thanks to Joy Latten from IBM for her contribution.
  * The IKEv1 pluto daemon supports RAM-based virtual IP pools using
  the rightsourceip directive with a subnet from which addresses
  are allocated.
  * The ipsec pki --gen and --pub commands now allow the output of
  private and public keys in PEM format using the --outform pem
  command line option.
  * The new DHCP plugin queries virtual IP addresses for clients from
  a DHCP server using broadcasts, or a defined server using the
  charon.plugins.dhcp.server strongswan.conf option. DNS/WINS server
  information is additionally served to clients if the DHCP server
  provides such information. The plugin is used in ipsec.conf
  configurations having rightsourceip set to %dhcp.
  * A new plugin called farp fakes ARP responses for virtual IP
  addresses handed out to clients from the IKEv2 daemon charon. The
  plugin lets a road-warrior act as a client on the local LAN if it
  uses a virtual IP from the responders subnet, e.g. acquired using
  the DHCP plugin.
  * The existing IKEv2 socket implementations have been migrated to
  the socket-default and the socket-raw plugins.  The new
  socket-dynamic plugin binds sockets dynamically to ports configured
  via the left-/rightikeport ipsec.conf connection parameters.
  * The android charon plugin stores received DNS server information
  as "net.dns" system properties, as used by the Android platform.
- Splitted package into strongswan-ipsec, that install the traditional
  ipsec service starter scripts, -ikev1 and -ikev2 installing daemons
  and -libs0, that contains the library and plugins.
- Enabled NetworkManager, dhcp, farp, ha and socket-dynamic plugins,
  with NetworkManager plugin in a separate strongswan-nm package.

OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=10
2010-05-14 15:10:14 +00:00

406 lines
14 KiB
RPMSpec
Raw Blame History

#
# spec file for package strongswan (Version 4.4.0)
#
# Copyright (c) 2010 SUSE LINUX Products GmbH, Nuernberg, Germany.
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
# upon. The license for this file, and modifications and additions to the
# file, is the same license as for the pristine package itself (unless the
# license for the pristine package is not an Open Source License, in which
# case the license is the MIT License). An "Open Source License" is a
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.
# Please submit bugfixes or comments via http://bugs.opensuse.org/
#
# norootforbuild
Name: strongswan
%define upstream_version 4.4.0
%define strongswan_docdir %{_docdir}/%{name}
Version: 4.4.0
Release: 0
License: GPLv2+
Group: Productivity/Networking/Security
Summary: OpenSource IPsec-based VPN Solution
Url: http://www.strongswan.org/
Requires: strongswan-ikev1 = %{version}
Requires: strongswan-ikev2 = %{version}
Requires: strongswan-ipsec = %{version}
AutoReqProv: on
Source0: http://download.strongswan.org/strongswan-%{upstream_version}.tar.bz2
Source1: http://download.strongswan.org/strongswan-%{upstream_version}.tar.bz2.sig
Source2: %{name}.init.in
Source3: %{name}-%{version}-rpmlintrc
Patch1: %{name}_modprobe_syslog.patch
BuildRoot: %{_tmppath}/%{name}-%{version}-build
BuildRequires: bison flex gmp-devel gperf pkg-config
BuildRequires: libcap-devel
BuildRequires: libopenssl-devel
BuildRequires: libgcrypt-devel
BuildRequires: openldap2-devel
BuildRequires: curl-devel
BuildRequires: libuuid-devel
BuildRequires: NetworkManager-devel
%description
StrongSwan is an OpenSource IPsec-based VPN Solution for Linux
* runs both on Linux 2.4 (KLIPS IPsec) and Linux 2.6 (NETKEY IPsec) kernels
* implements both the IKEv1 and IKEv2 (RFC 4306) key exchange protocols
* Fully tested support of IPv6 IPsec tunnel and transport connections
* Dynamical IP address and interface update with IKEv2 MOBIKE (RFC 4555)
* Automatic insertion and deletion of IPsec-policy-based firewall rules
* Strong 128/192/256 bit AES or Camellia encryption, 3DES support
* NAT-Traversal via UDP encapsulation and port floating (RFC 3947)
* Dead Peer Detection (DPD, RFC 3706) takes care of dangling tunnels
* Static virtual IPs and IKEv1 ModeConfig pull and push modes
* XAUTH server and client functionality on top of IKEv1 Main Mode authentication
* Virtual IP address pool managed by IKE daemon or SQL database
* Secure IKEv2 EAP user authentication (EAP-SIM, EAP-AKA, EAP-MSCHAPv2, etc.)
* Optional relaying of EAP messages to AAA server via EAP-RADIUS plugin
* Support of IKEv2 Multiple Authentication Exchanges (RFC 4739)
* Authentication based on X.509 certificates or preshared keys
* Generation of a default self-signed certificate during first strongSwan startup
* Retrieval and local caching of Certificate Revocation Lists via HTTP or LDAP
* Full support of the Online Certificate Status Protocol (OCSP, RCF 2560).
* CA management (OCSP and CRL URIs, default LDAP server)
* Powerful IPsec policies based on wildcards or intermediate CAs
* Group policies based on X.509 attribute certificates (RFC 3281)
* Storage of RSA private keys and certificates on a smartcard (PKCS #11 interface)
* Modular plugins for crypto algorithms and relational database interfaces
* Support of elliptic curve DH groups and ECDSA certificates (Suite B, RFC 4869)
* Optional built-in integrity and crypto tests for plugins and libraries
* Smooth Linux desktop integration via the strongSwan NetworkManager applet
This package triggers the installation of both, IKEv1 and IKEv2 daemons.
Authors:
--------
Andreas Steffen
and others
%package doc
License: GPL v2 or later
Summary: OpenSource IPsec-based VPN Solution
Group: Productivity/Networking/Security
%description doc
StrongSwan is an OpenSource IPsec-based VPN Solution for Linux
This package provides the StrongSwan documentation.
Authors:
--------
Andreas Steffen
and others
%package libs0
License: GPL v2 or later
Summary: OpenSource IPsec-based VPN Solution
Group: Productivity/Networking/Security
Conflicts: strongswan < %{version}
%description libs0
StrongSwan is an OpenSource IPsec-based VPN Solution for Linux
This package provides the strongswan library and plugins.
%package ikev1
License: GPL v2 or later
Summary: OpenSource IPsec-based VPN Solution
Group: Productivity/Networking/Security
Requires: iproute2
Requires: strongswan-libs0 = %{version}
Requires: strongswan-ipsec = %{version}
Provides: strongswan-daemon = %{version} ikev1
Provides: pluto
Conflicts: freeswan openswan strongswan < %{version}
%description ikev1
StrongSwan is an OpenSource IPsec-based VPN Solution for Linux
This package provides the pluto IKEv1 daemon.
%package ikev2
License: GPL v2 or later
Summary: OpenSource IPsec-based VPN Solution
Group: Productivity/Networking/Security
Requires: iproute2
Requires: strongswan-libs0 = %{version}
Requires: strongswan-daemon-starter = %{version}
Provides: strongswan-daemon = %{version} ikev2
Conflicts: openswan strongswan < %{version}
%description ikev2
StrongSwan is an OpenSource IPsec-based VPN Solution for Linux
This package provides the charon IKEv2 daemon.
%package ipsec
License: GPL v2 or later
Summary: OpenSource IPsec-based VPN Solution
Group: Productivity/Networking/Security
PreReq: grep %insserv_prereq %fillup_prereq
Requires: strongswan-libs0 = %{version}
Requires: strongswan-daemon = %{version}
#Recommends: strongswan-ikev1 = %{version}
#Recommends: strongswan-ikev2 = %{version}
Provides: strongswan-daemon-starter = %{version}
Provides: strongswan = %{version} ipsec VPN
Obsoletes: strongswan < %{version}
Conflicts: freeswan openswan
%description ipsec
StrongSwan is an OpenSource IPsec-based VPN Solution for Linux
This package provides the /etc/init.d/ipsec service script and allows
to maintain both, IKEv1 and IKEv2 daemons, using /etc/ipsec.conf and
/etc/ipsec.sectes files.
%package nm
License: GPL v2 or later
Summary: OpenSource IPsec-based VPN Solution
Group: Productivity/Networking/Security
Requires: strongswan-libs0 = %{version}
Requires: strongswan-ikev2 = %{version}
Provides: strongswan-daemon-starter = %{version}
%description nm
StrongSwan is an OpenSource IPsec-based VPN Solution for Linux
This package provides the NetworkManager plugin to control the
charon IKEv2 daemon through D-Bus, designed to work using the
NetworkManager-strongswan graphical user interface.
%prep
%setup -q -n %{name}-%{upstream_version}
%patch1 -p0
sed -e 's|@libexecdir@|%_libexecdir|g' \
< $RPM_SOURCE_DIR/strongswan.init.in \
> strongswan.init
%build
CFLAGS="$RPM_OPT_FLAGS -W -Wall -Wno-pointer-sign -Wno-strict-aliasing"
export RPM_OPT_FLAGS CFLAGS
#libtoolize --force
%{?suse_update_config:%{suse_update_config -f}}
#autoreconf
%configure \
--enable-integrity-test \
--with-capabilities=libcap \
--with-resolv-conf=%{_localstatedir}/run/strongswan/resolv.conf \
--enable-smartcard \
--with-default-pkcs11=%{_libdir}/opensc-pkcs11.so \
--enable-cisco-quirks \
--enable-openssl \
%if 0%{suse_version} >= 1110
--enable-gcrypt \
%endif
%if 0%{suse_version} >= 1130
--enable-ha \
--enable-dhcp \
--enable-farp \
--enable-attr-sql \
--enable-socket-dynamic \
%endif
--enable-ldap \
--enable-curl \
--enable-nm
make %{?_smp_mflags:%_smp_mflags}
%install
export RPM_BUILD_ROOT
install -m755 -d ${RPM_BUILD_ROOT}%{_sbindir}/
install -m755 -d ${RPM_BUILD_ROOT}%{_sysconfdir}/ipsec.d/
install -m755 -d ${RPM_BUILD_ROOT}%{_sysconfdir}/init.d/
install -m755 strongswan.init ${RPM_BUILD_ROOT}%{_sysconfdir}/init.d/ipsec
ln -s %{_sysconfdir}/init.d/ipsec ${RPM_BUILD_ROOT}%{_sbindir}/rcipsec
#
make install DESTDIR="$RPM_BUILD_ROOT"
#
rm -f ${RPM_BUILD_ROOT}%{_sysconfdir}/ipsec.secrets
cat << EOT > ${RPM_BUILD_ROOT}%{_sysconfdir}/ipsec.secrets
#
# ipsec.secrets
#
# This file holds the RSA private keys or the PSK preshared secrets for
# the IKE/IPsec authentication. See the ipsec.secrets(5) manual page.
#
EOT
#
rm -f $RPM_BUILD_ROOT%{_libdir}/lib*.{so,a,la}
find $RPM_BUILD_ROOT%{_libexecdir}/ipsec \
-name "*.a" -o -name "*.la" | xargs -r rm -f
#
install -m755 -d ${RPM_BUILD_ROOT}%{strongswan_docdir}/
install -m644 TODO NEWS README COPYING CREDITS \
${RPM_SOURCE_DIR}/README.SUSE \
${RPM_BUILD_ROOT}%{strongswan_docdir}/
install -m755 -d $RPM_BUILD_ROOT%{_localstatedir}/run/strongswan
%post libs0
%{run_ldconfig}
test -d %{_localstatedir}/run/strongswan || \
%{__mkdir_p} %{_localstatedir}/run/strongswan
%postun libs0
%{run_ldconfig}
%post ipsec
%{fillup_and_insserv ipsec}
%preun ipsec
%{stop_on_removal ipsec}
if test -s %{_sysconfdir}/ipsec.secrets.rpmsave; then
cp -p --backup=numbered %{_sysconfdir}/ipsec.secrets.rpmsave %{_sysconfdir}/ipsec.secrets.rpmsave.old
fi
if test -s %{_sysconfdir}/ipsec.conf.rpmsave; then
cp -p --backup=numbered %{_sysconfdir}/ipsec.conf.rpmsave %{_sysconfdir}/ipsec.conf.rpmsave.old
fi
%postun ipsec
%{insserv_cleanup}
%files
%defattr(-,root,root)
%dir %{strongswan_docdir}
%{strongswan_docdir}/README.SUSE
%files ipsec
%defattr(-,root,root)
%config(noreplace) %attr(600,root,root) %{_sysconfdir}/ipsec.conf
%config(noreplace) %attr(600,root,root) %{_sysconfdir}/ipsec.secrets
%dir %{_sysconfdir}/ipsec.d
%dir %{_sysconfdir}/ipsec.d/crls
%dir %{_sysconfdir}/ipsec.d/reqs
%dir %{_sysconfdir}/ipsec.d/certs
%dir %{_sysconfdir}/ipsec.d/acerts
%dir %{_sysconfdir}/ipsec.d/aacerts
%dir %{_sysconfdir}/ipsec.d/cacerts
%dir %{_sysconfdir}/ipsec.d/ocspcerts
%dir %attr(700,root,root) %{_sysconfdir}/ipsec.d/private
%config %{_sysconfdir}/init.d/ipsec
%{_sbindir}/rcipsec
%{_sbindir}/ipsec
%{_mandir}/man8/ipsec.8*
%{_mandir}/man5/ipsec.conf.5*
%{_mandir}/man5/ipsec.secrets.5*
%dir %{_libexecdir}/ipsec
%{_libexecdir}/ipsec/_updown
%{_libexecdir}/ipsec/_updown_espmark
%{_libexecdir}/ipsec/_copyright
%{_libexecdir}/ipsec/pki
%{_libexecdir}/ipsec/openac
%{_libexecdir}/ipsec/scepclient
%{_libexecdir}/ipsec/starter
%{_libexecdir}/ipsec/stroke
%dir %{_libexecdir}/ipsec/plugins
%{_libexecdir}/ipsec/plugins/libstrongswan-stroke.so
%{_libexecdir}/ipsec/plugins/libstrongswan-updown.so
%files ikev1
%defattr(-,root,root)
%dir %{_libexecdir}/ipsec
%{_libexecdir}/ipsec/whack
%{_libexecdir}/ipsec/pluto
%{_libexecdir}/ipsec/_pluto_adns
%files ikev2
%defattr(-,root,root)
%dir %{_libexecdir}/ipsec
%{_libexecdir}/ipsec/charon
#%dir %{_libexecdir}/ipsec/plugins
%files nm
%defattr(-,root,root)
%dir %{_libexecdir}/ipsec
%dir %{_libexecdir}/ipsec/plugins
%{_libexecdir}/ipsec/plugins/libstrongswan-nm.so
%files doc
%defattr(-,root,root)
%dir %{strongswan_docdir}
%{strongswan_docdir}/TODO
%{strongswan_docdir}/NEWS
%{strongswan_docdir}/README
%{strongswan_docdir}/COPYING
%{strongswan_docdir}/CREDITS
%{_mandir}/man3/anyaddr.3*
%{_mandir}/man3/atoaddr.3*
%{_mandir}/man3/atoasr.3*
%{_mandir}/man3/atosa.3*
%{_mandir}/man3/atoul.3*
%{_mandir}/man3/goodmask.3*
%{_mandir}/man3/initaddr.3*
%{_mandir}/man3/initsubnet.3*
%{_mandir}/man3/keyblobtoid.3*
%{_mandir}/man3/portof.3*
%{_mandir}/man3/prng.3*
%{_mandir}/man3/rangetosubnet.3*
%{_mandir}/man3/sameaddr.3*
%{_mandir}/man3/subnetof.3*
%{_mandir}/man3/ttoaddr.3*
%{_mandir}/man3/ttodata.3*
%{_mandir}/man3/ttosa.3*
%{_mandir}/man3/ttoul.3*
%{_mandir}/man8/_copyright.8*
%{_mandir}/man8/_updown.8*
%{_mandir}/man8/_updown_espmark.8*
%{_mandir}/man8/openac.8*
%{_mandir}/man8/pluto.8*
%{_mandir}/man8/scepclient.8*
%{_mandir}/man8/starter.8*
%files libs0
%defattr(-,root,root)
%config(noreplace) %attr(600,root,root) %{_sysconfdir}/strongswan.conf
%{_libdir}/libhydra.so.0
%{_libdir}/libhydra.so.0.0.0
%{_libdir}/libcharon.so.0
%{_libdir}/libcharon.so.0.0.0
%{_libdir}/libstrongswan.so.0
%{_libdir}/libstrongswan.so.0.0.0
%dir %{_libexecdir}/ipsec
%dir %{_libexecdir}/ipsec/pool
%dir %{_libexecdir}/ipsec/plugins
%{_libexecdir}/ipsec/libchecksum.so
%{_libexecdir}/ipsec/plugins/libstrongswan-aes.so
%{_libexecdir}/ipsec/plugins/libstrongswan-attr.so
%{_libexecdir}/ipsec/plugins/libstrongswan-curl.so
%{_libexecdir}/ipsec/plugins/libstrongswan-des.so
%{_libexecdir}/ipsec/plugins/libstrongswan-fips-prf.so
%{_libexecdir}/ipsec/plugins/libstrongswan-gcrypt.so
%{_libexecdir}/ipsec/plugins/libstrongswan-gmp.so
%{_libexecdir}/ipsec/plugins/libstrongswan-hmac.so
%{_libexecdir}/ipsec/plugins/libstrongswan-kernel-netlink.so
%{_libexecdir}/ipsec/plugins/libstrongswan-ldap.so
%{_libexecdir}/ipsec/plugins/libstrongswan-md5.so
%{_libexecdir}/ipsec/plugins/libstrongswan-openssl.so
%{_libexecdir}/ipsec/plugins/libstrongswan-pubkey.so
%{_libexecdir}/ipsec/plugins/libstrongswan-random.so
%{_libexecdir}/ipsec/plugins/libstrongswan-resolve.so
%{_libexecdir}/ipsec/plugins/libstrongswan-sha1.so
%{_libexecdir}/ipsec/plugins/libstrongswan-sha2.so
%{_libexecdir}/ipsec/plugins/libstrongswan-x509.so
%{_libexecdir}/ipsec/plugins/libstrongswan-xcbc.so
%{_libexecdir}/ipsec/plugins/libstrongswan-dnskey.so
%{_libexecdir}/ipsec/plugins/libstrongswan-pem.so
%{_libexecdir}/ipsec/plugins/libstrongswan-pgp.so
%{_libexecdir}/ipsec/plugins/libstrongswan-pkcs1.so
%{_libexecdir}/ipsec/plugins/libstrongswan-socket-dynamic.so
%{_libexecdir}/ipsec/plugins/libstrongswan-socket-raw.so
%{_libexecdir}/ipsec/plugins/libstrongswan-attr-sql.so
%{_libexecdir}/ipsec/plugins/libstrongswan-dhcp.so
%{_libexecdir}/ipsec/plugins/libstrongswan-farp.so
%{_libexecdir}/ipsec/plugins/libstrongswan-ha.so
%dir %ghost %{_localstatedir}/run/strongswan
%changelog
View Git Blame Copy Permalink