[gentoo-commits] gentoo-x86 commit in net-misc/strongswan: metadata.xml ChangeLog strongswan-4.3.6-r2.ebuild strongswan-4.2.17.ebuild strongswan-4.3.5.ebuild strongswan-4.3.6.ebuild strongswan-4.3.6-r1.ebuild strongswan-4.3.4.ebuild strongswan-4.3.3.ebuild

[Ben de Groot (yngwin)]

yngwin      10/04/02 15:39:54

  Modified:             metadata.xml ChangeLog
  Added:                strongswan-4.3.6-r2.ebuild
  Removed:              strongswan-4.2.17.ebuild strongswan-4.3.5.ebuild
                        strongswan-4.3.6.ebuild strongswan-4.3.6-r1.ebuild
                        strongswan-4.3.4.ebuild strongswan-4.3.3.ebuild
  Log:
    Remove 'nat' useflag as it is misleading and replace it with an
    appropriate 'nat-transport' flag and warn users about it. Fix dependency on
    openssl[-bindist] wrt bug #311981. Thanks to Thomas Klute for reporting this.
    Overhaul of package/useflag descriptions. Drop built_with_use again
    (deprecated) which I introduced in the latest revision. Addition of several
    new warnings/logs that will hopefully help the user. Drop old (and
    unsupported by proxy maintainer) ebuilds. Update metadata.xml.
  (Portage version: 2.2_rc67/cvs/Linux x86_64)

Revision  Changes    Path
1.10                 net-misc/strongswan/metadata.xml

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/net-misc/strongswan/metadata.xml?rev=1.10&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/net-misc/strongswan/metadata.xml?rev=1.10&content-type=text/plain
diff : http://sources.gentoo.org/viewcvs.py/gentoo-x86/net-misc/strongswan/metadata.xml?r1=1.9&r2=1.10

Index: metadata.xml
===================================================================
RCS file: /var/cvsroot/gentoo-x86/net-misc/strongswan/metadata.xml,v
retrieving revision 1.9
retrieving revision 1.10
diff -u -r1.9 -r1.10
--- metadata.xml	16 Mar 2010 18:37:21 -0000	1.9
+++ metadata.xml	2 Apr 2010 15:39:54 -0000	1.10
@@ -2,29 +2,54 @@
 <!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
 <pkgmetadata>
   <herd>no-herd</herd>
-        <maintainer>
-                <email>patrick@g.o</email>
-                <name>Patrick Lauer</name>
-        </maintainer>
-        <maintainer>
-                <email>ua_bugz_gentoo@×××××××××××.de</email>
-                <name>Matthias Dahl </name>
-        </maintainer>
-
+  <maintainer>
+    <email>patrick@g.o</email>
+    <name>Patrick Lauer</name>
+  </maintainer>
+  <maintainer>
+    <email>ua_bugz_gentoo@×××××××××××.de</email>
+    <name>Matthias Dahl</name>
+    <description>Proxy Maintainer, CC on all bugs</description>
+  </maintainer>
   <longdescription lang="en">
-		strongSwan is an OpenSource IPsec implementation for the Linux
-		operating system. It is based on the discontinued FreeS/WAN project and
-		the X.509 patch which we developed over the last three years. In order
-		to have a stable IPsec platform to base our future extensions of the
-		X.509 capability on, we decided to lauch the strongSwan project.
-	</longdescription>
+    StrongSwan is direct descendant of the discontinued FreeS/WAN project.
+    As an IPsec based VPN solution which is focused on security and ease of
+    use, it fully implements the IKEv1/IKEv2 protocols, MOBIKE, NAT-Traversal
+    via UDP encapsulation (incl. port floating) and Dead Peer Detection. It
+    also fully supports the Linux 2.6 IPsec stack, IPv6, certificates/keys on
+    Smartcards and virtual IP address pools.
+  </longdescription>
   <use>
-    <flag name="cisco">Enable support of Cisco VPN client</flag>
-    <flag name="nat">Enable NAT traversal with IPsec transport mode</flag>
-    <flag name="gcrypt">Enable gcrypt support</flag>
-    <flag name="ikev1">Enable ikev1 protocol</flag>
-    <flag name="ikev2">Enable ikev2 protocol</flag>
-    <flag name="openssl">Enable openssl support</flag>
-    <flag name="non-root">Enable running as non-root</flag>
+    <flag name="cisco">
+      Enable support for the Cisco VPN client.
+    </flag>
+    <flag name="gcrypt">
+      Enable <pkg>dev-libs/libgcrypt</pkg> plugin which provides 3DES, AES,
+      Blowfish, Camellia, CAST, DES, Serpent and Twofish ciphers along with
+      MD4, MD5 and SHA1/2 hash algorithms, RSA and a software	random number
+      generator.
+    </flag>
+    <flag name="nat-transport">
+      Enable potentially insecure NAT traversal for transport mode in IKEv1.
+      Only enable if you really need this.
+    </flag>
+    <flag name="ikev1">
+      Enable IKEv1 protocol (pluto daemon).
+    </flag>
+    <flag name="ikev2">
+      Enable IKEv2 protocol (charon daemon).
+    </flag>
+    <flag name="openssl">
+      Enable <pkg>dev-libs/openssl</pkg> plugin which is required for Elliptic
+      Curve Cryptography (Diffie-Hellman groups 19-21, 25, 26) and ECDSA. Also
+      provides 3DES, AES, Blowfish, Camellia, CAST, DES, IDEA and RC5 ciphers
+      along with MD2, MD4, MD5 and SHA1/2 hash algorithms and RSA.
+      <pkg>dev-libs/openssl</pkg> has to be compiled with USE="-bindist".
+    </flag>
+    <flag name="non-root">
+      Force IKEv1/IKEv2 daemons to normal user privileges. This might impose
+      some restrictions mainly to the IKEv1 daemon. Disable only if you really
+      require superuser privileges.
+    </flag>
   </use>
 </pkgmetadata>



1.82                 net-misc/strongswan/ChangeLog

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/net-misc/strongswan/ChangeLog?rev=1.82&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/net-misc/strongswan/ChangeLog?rev=1.82&content-type=text/plain
diff : http://sources.gentoo.org/viewcvs.py/gentoo-x86/net-misc/strongswan/ChangeLog?r1=1.81&r2=1.82

Index: ChangeLog
===================================================================
RCS file: /var/cvsroot/gentoo-x86/net-misc/strongswan/ChangeLog,v
retrieving revision 1.81
retrieving revision 1.82
diff -u -r1.81 -r1.82
--- ChangeLog	23 Mar 2010 01:38:58 -0000	1.81
+++ ChangeLog	2 Apr 2010 15:39:54 -0000	1.82
@@ -1,6 +1,20 @@
 # ChangeLog for net-misc/strongswan
 # Copyright 1999-2010 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/net-misc/strongswan/ChangeLog,v 1.81 2010/03/23 01:38:58 yngwin Exp $
+# $Header: /var/cvsroot/gentoo-x86/net-misc/strongswan/ChangeLog,v 1.82 2010/04/02 15:39:54 yngwin Exp $
+
+*strongswan-4.3.6-r2 (02 Apr 2010)
+
+  02 Apr 2010; Ben de Groot <yngwin@g.o> -strongswan-4.2.17.ebuild,
+  -strongswan-4.3.3.ebuild, -strongswan-4.3.4.ebuild,
+  -strongswan-4.3.5.ebuild, -strongswan-4.3.6.ebuild,
+  -strongswan-4.3.6-r1.ebuild, +strongswan-4.3.6-r2.ebuild, metadata.xml:
+  Remove 'nat' useflag as it is misleading and replace it with an
+  appropriate 'nat-transport' flag and warn users about it. Fix dependency on
+  openssl[-bindist] wrt bug #311981. Thanks to Thomas Klute for reporting this.
+  Overhaul of package/useflag descriptions. Drop built_with_use again
+  (deprecated) which I introduced in the latest revision. Addition of several
+  new warnings/logs that will hopefully help the user. Drop old (and
+  unsupported by proxy maintainer) ebuilds. Update metadata.xml.
 
   23 Mar 2010; Ben de Groot <yngwin@g.o> strongswan-4.3.6-r1.ebuild:
   Fix directory ownership for '+non-root -caps'/'-non-root +caps'



1.1                  net-misc/strongswan/strongswan-4.3.6-r2.ebuild

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/net-misc/strongswan/strongswan-4.3.6-r2.ebuild?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/net-misc/strongswan/strongswan-4.3.6-r2.ebuild?rev=1.1&content-type=text/plain

Index: strongswan-4.3.6-r2.ebuild
===================================================================
# Copyright 1999-2010 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
# $Header: /var/cvsroot/gentoo-x86/net-misc/strongswan/strongswan-4.3.6-r2.ebuild,v 1.1 2010/04/02 15:39:54 yngwin Exp $

EAPI=2
inherit eutils linux-info

DESCRIPTION="IPsec-based VPN solution focused on security and ease of use, supporting IKEv1/IKEv2 and MOBIKE"
HOMEPAGE="http://www.strongswan.org/"
SRC_URI="http://download.strongswan.org/${P}.tar.bz2"

LICENSE="GPL-2 RSA-MD5 RSA-PKCS11 DES"
SLOT="0"
KEYWORDS="~amd64 ~ppc ~sparc ~x86"
IUSE="+caps cisco curl debug gcrypt ldap +ikev1 +ikev2 mysql nat-transport +non-root +openssl smartcard sqlite"

COMMON_DEPEND="!net-misc/openswan
	>=dev-libs/gmp-4.1.5
	gcrypt? ( dev-libs/libgcrypt )
	caps? ( sys-libs/libcap )
	curl? ( net-misc/curl )
	ldap? ( net-nds/openldap )
	smartcard? ( dev-libs/opensc )
	openssl? ( >=dev-libs/openssl-0.9.8[-bindist] )
	mysql? ( virtual/mysql )
	sqlite? ( >=dev-db/sqlite-3.3.1 )"
DEPEND="${COMMON_DEPEND}
	virtual/linux-sources
	sys-kernel/linux-headers"
RDEPEND="${COMMON_DEPEND}
	virtual/logger
	sys-apps/iproute2"

UGID="ipsec"

pkg_setup() {
	linux-info_pkg_setup
	elog "Linux kernel version: ${KV_FULL}"

	if ! kernel_is -ge 2 6 16; then
		eerror
		eerror "This ebuild currently only supports ${PN} with the"
		eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
		eerror
		die "Please install a recent 2.6 kernel."
	fi

	if use nat-transport; then
		ewarn
		ewarn "You have enabled NAT Traversal for transport mode with the IKEv1"
		ewarn "protocol. Please double check if you really require this feature"
		ewarn "as it is potentially insecure and usually only required in certain"
		ewarn "situations when interoperating with Windows using L2TP/IPsec."
		ewarn
	fi

	if kernel_is -lt 2 6 33; then
		ewarn
		ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
		ewarn

		if kernel_is -lt 2 6 29; then
			ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
			ewarn "include all required IPv6 modules even if you just intend"
			ewarn "to run on IPv4 only."
			ewarn
			ewarn "This has been fixed with kernels >= 2.6.29."
			ewarn
		fi

		if kernel_is -lt 2 6 33; then
			ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
			ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
			ewarn "miss SHA384 and SHA512 HMAC support altogether."
			ewarn
			ewarn "If you need any of those features, please use kernel >= 2.6.33."
			ewarn
		fi
	fi

	if use non-root; then
		enewgroup ${UGID}
		enewuser ${UGID} -1 -1 -1 ${UGID}
	fi
}

src_configure() {
	local myconf=""

	if use non-root; then
		myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
	fi

	# If a user has already enabled db support, those plugins will
	# most likely be desired as well. Besides they don't impose new
	# dependencies and come at no cost (except for space).
	if use mysql || use sqlite; then
		myconf="${myconf} --enable-attr-sql --enable-sql"
	fi

	# strongSwan builds and installs static libs by default which are
	# useless to the user (and to strongSwan for that matter) because no
	# header files or alike get installed... so disabling them is safe.
	econf \
		--disable-static \
		$(use_with caps capabilities libcap) \
		$(use_enable curl) \
		$(use_enable ldap) \
		$(use_enable smartcard) \
		$(use_enable cisco cisco-quirks) \
		$(use_enable debug leak-detective) \
		$(use_enable nat-transport) \
		$(use_enable openssl) \
		$(use_enable gcrypt) \
		$(use_enable mysql) \
		$(use_enable sqlite) \
		$(use_enable ikev1 pluto) \
		$(use_enable ikev2 charon) \
		${myconf}
}

src_install() {
	einstall || die "einstall failed"

	doinitd "${FILESDIR}"/ipsec

	local dir_ugid
	if use non-root; then
		fowners ${UGID}:${UGID} \
			/etc/ipsec.conf \
			/etc/ipsec.secrets \
			/etc/strongswan.conf

		dir_ugid="${UGID}"
	else
		dir_ugid="root"
	fi

	diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
	dodir /etc/ipsec.d \
		/etc/ipsec.d/aacerts \
		/etc/ipsec.d/acerts \
		/etc/ipsec.d/cacerts \
		/etc/ipsec.d/certs \
		/etc/ipsec.d/crls \
		/etc/ipsec.d/ocspcerts \
		/etc/ipsec.d/private \
		/etc/ipsec.d/reqs

	dodoc CREDITS NEWS README TODO || die

	# shared libs are used only internally and there are no static libs,
	# so it's safe to get rid of the .la files
	find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
}

pkg_preinst() {
	has_version "<net-misc/strongswan-4.3.6-r1"
	upgrade_from_leq_4_3_6=$(( !$? ))

	has_version "<net-misc/strongswan-4.3.6-r1[-caps]"
	previous_4_3_6_with_caps=$(( !$? ))
}

pkg_postinst() {
	if ! use openssl && ! use gcrypt; then
		elog
		elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
		elog "Please note that this might effect availability and speed of some"
		elog "cryptographic features. You are advised to enable the OpenSSL plugin."
	elif ! use openssl; then
		elog
		elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
		elog "availability and speed of some cryptographic features. There will be"
		elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
		elog "25, 26) and ECDSA."
	fi

	if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
		chmod 0750 "${ROOT}"/etc/ipsec.d \
			"${ROOT}"/etc/ipsec.d/aacerts \
			"${ROOT}"/etc/ipsec.d/acerts \
			"${ROOT}"/etc/ipsec.d/cacerts \
			"${ROOT}"/etc/ipsec.d/certs \
			"${ROOT}"/etc/ipsec.d/crls \
			"${ROOT}"/etc/ipsec.d/ocspcerts \
			"${ROOT}"/etc/ipsec.d/private \
			"${ROOT}"/etc/ipsec.d/reqs

		ewarn
		ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
		ewarn "security reasons. Your system installed directories have been"
		ewarn "updated accordingly. Please check if necessary."
		ewarn

		if [[ $previous_4_3_6_with_caps == 1 ]]; then
			if ! use non-root; then
				ewarn
				ewarn "IMPORTANT: You previously had ${PN} installed without root"
				ewarn "privileges because it was implied by the 'caps' USE flag."
				ewarn "This has been changed. If you want ${PN} with user privileges,"
				ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
				ewarn
			fi
		fi
	fi
	if ! use caps && ! use non-root; then
		ewarn
		ewarn "You have decided to run ${PN} with root privileges and built it"
		ewarn "without support for POSIX capability dropping. It is generally"
		ewarn "strongly suggested that you reconsider- especially if you intend"
		ewarn "to run ${PN} as server with a public ip address."
		ewarn
		ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
		ewarn
	fi
	if use non-root; then
		elog
		elog "${PN} has been installed without superuser privileges (USE=non-root)."
		elog "This imposes several limitations mainly to the IKEv1 daemon 'pluto'"
		elog "but also a few to the IKEv2 daemon 'charon'."
		elog
		elog "Please carefully read: http://wiki.strongswan.org/wiki/nonRoot"
		elog
		elog "pluto uses a helper script by default to insert/remove routing and"
		elog "policy rules upon connection start/stop which requires superuser"
		elog "privileges. charon in contrast does this internally and can do so"
		elog "even with reduced (user) privileges."
		elog
		elog "Thus if you require IKEv1 (pluto) or need to specify a custom updown"
		elog "script to pluto or charon which requires superuser privileges, you"
		elog "can work around this limitation by using sudo to grant the"
		elog "user \"ipsec\" the appropriate rights."
		elog "For example (the default case):"
		elog "/etc/sudoers:"
		elog "  Defaults:ipsec always_set_home,!env_reset"
		elog "  ipsec ALL=(ALL) NOPASSWD: /usr/sbin/ipsec"
		elog "Under the specific connection block in /etc/ipsec.conf:"
		elog "  leftupdown=\"sudo ipsec _updown\""
		elog
	fi
	elog
	elog "Make sure you have _all_ required kernel modules available including"
	elog "the appropriate cryptographic algorithms. A list is available at:"
	elog "  http://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
	elog
	elog "The up-to-date manual is available online at:"
	elog "  http://wiki.strongswan.org/"
	elog
}