summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorHans de Graaff <graaff@gentoo.org>2022-03-12 08:30:35 +0100
committerHans de Graaff <graaff@gentoo.org>2022-03-12 08:30:35 +0100
commitf0976cbe58de272ab04a19e821677dfa466fb22a (patch)
treebd18871f66fa151f21d9858adb6be58350b15fdd /net-vpn
parentdev-ruby/stringio: add ruby31 (diff)
downloadgentoo-f0976cbe58de272ab04a19e821677dfa466fb22a.tar.gz
gentoo-f0976cbe58de272ab04a19e821677dfa466fb22a.tar.bz2
gentoo-f0976cbe58de272ab04a19e821677dfa466fb22a.zip
net-vpn/libreswan: security cleanup
Package-Manager: Portage-3.0.30, Repoman-3.0.3 Signed-off-by: Hans de Graaff <graaff@gentoo.org>
Diffstat (limited to 'net-vpn')
-rw-r--r--net-vpn/libreswan/Manifest2
-rw-r--r--net-vpn/libreswan/libreswan-3.32-r4.ebuild119
-rw-r--r--net-vpn/libreswan/libreswan-4.5.ebuild122
3 files changed, 0 insertions, 243 deletions
diff --git a/net-vpn/libreswan/Manifest b/net-vpn/libreswan/Manifest
index 8177dcb0c785..b7a2cc17fadf 100644
--- a/net-vpn/libreswan/Manifest
+++ b/net-vpn/libreswan/Manifest
@@ -1,3 +1 @@
-DIST libreswan-3.32.tar.gz 4141631 BLAKE2B 37a4cb5c1f52d69b17ba60abd2b7a181d9f5567914a453ab875185110aeda4d33ecdaacfc83e361f153860a1db66faec70e0ad06af65e310af28ae72ce68fc6a SHA512 bb65512351059e2fac6f1c3ed1e291eabd6835faacf6d9c58649dd71dab1bb4fe6d6074178dea6dea01f24d39f3fbefd84c6060e4d8436b5d057fa55ae4467f3
-DIST libreswan-4.5.tar.gz 3529355 BLAKE2B 7485a8c77b997026681b3b99194ee54176f1cd7230af72a2aa231e5caa97946c40b0178f0ffa1dd200085b5919883697d7300bb328561501789707035f045337 SHA512 451a4f71099aa4776624a4c127fdaff492acc38a44228255dcbf955efa0982fd963c989d63522f56279eec6a9ef738febb573dde34aa541724ab11e37a554f9e
DIST libreswan-4.6.tar.gz 3579760 BLAKE2B 56099e753d9da882ea9e4b7966706f39bac36cd88adcba5fa1c3201cbe0a2ba7a02042cb9eeb8fd52a7b1ba0f3128b854114abc748fe9bf6d9059937a72eb0e4 SHA512 c1c3efd7665dee6caaf08cb5aa50fcd37c299acad4b62648284fdb04edd50ba8fc8d33a9fb210edaf2312697f8cd251f33a6b16587eb2cfefd1269b4482dd499
diff --git a/net-vpn/libreswan/libreswan-3.32-r4.ebuild b/net-vpn/libreswan/libreswan-3.32-r4.ebuild
deleted file mode 100644
index 6d019790c6e4..000000000000
--- a/net-vpn/libreswan/libreswan-3.32-r4.ebuild
+++ /dev/null
@@ -1,119 +0,0 @@
-# Copyright 1999-2021 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit systemd toolchain-funcs tmpfiles
-
-DESCRIPTION="IPsec implementation for Linux, fork of Openswan"
-HOMEPAGE="https://libreswan.org/"
-SRC_URI="https://download.libreswan.org/${P}.tar.gz"
-
-LICENSE="GPL-2 BSD-4 RSA DES"
-SLOT="0"
-KEYWORDS="amd64 ~arm ~ppc x86"
-IUSE="caps curl dnssec ldap pam seccomp selinux systemd test"
-RESTRICT="!test? ( test )"
-
-DEPEND="
- dev-libs/gmp:0=
- dev-libs/libevent:0=
- dev-libs/nspr
- >=dev-libs/nss-3.42
- >=sys-kernel/linux-headers-4.19
- virtual/libcrypt:=
- caps? ( sys-libs/libcap-ng )
- curl? ( net-misc/curl )
- dnssec? ( >=net-dns/unbound-1.9.1-r1:= net-libs/ldns:= )
- ldap? ( net-nds/openldap )
- pam? ( sys-libs/pam )
- seccomp? ( sys-libs/libseccomp )
- selinux? ( sys-libs/libselinux )
- systemd? ( sys-apps/systemd:0= )
-"
-BDEPEND="
- app-text/docbook-xml-dtd:4.1.2
- app-text/xmlto
- dev-libs/nss
- sys-devel/bison
- sys-devel/flex
- virtual/pkgconfig
- test? ( dev-python/setproctitle )
-"
-RDEPEND="${DEPEND}
- dev-libs/nss[utils(+)]
- sys-apps/iproute2
- !net-vpn/strongswan
- selinux? ( sec-policy/selinux-ipsec )
-"
-
-usetf() {
- usex "$1" true false
-}
-
-PATCHES=( "${FILESDIR}/${PN}-3.30-ip-path.patch" )
-
-src_prepare() {
- sed -i -e 's:/sbin/runscript:/sbin/openrc-run:' initsystems/openrc/ipsec.init.in || die
- sed -i -e '/^install/ s/postcheck//' -e '/^doinstall/ s/oldinitdcheck//' initsystems/systemd/Makefile || die
- default
-}
-
-src_configure() {
- tc-export AR CC
- export INC_USRLOCAL=/usr
- export INC_MANDIR=share/man
- export FINALEXAMPLECONFDIR=/usr/share/doc/${PF}
- export FINALDOCDIR=/usr/share/doc/${PF}/html
- export INITSYSTEM=openrc
- export INC_RCDIRS=
- export INC_RCDEFAULT=/etc/init.d
- export USERCOMPILE=
- export USERLINK=
- export USE_DNSSEC=$(usetf dnssec)
- export USE_LABELED_IPSEC=$(usetf selinux)
- export USE_LIBCAP_NG=$(usetf caps)
- export USE_LIBCURL=$(usetf curl)
- export USE_LINUX_AUDIT=$(usetf selinux)
- export USE_LDAP=$(usetf ldap)
- export USE_SECCOMP=$(usetf seccomp)
- export USE_SYSTEMD_WATCHDOG=$(usetf systemd)
- export SD_WATCHDOGSEC=$(usex systemd 200 0)
- export USE_XAUTHPAM=$(usetf pam)
- export DEBUG_CFLAGS=
- export OPTIMIZE_CFLAGS=
- export WERROR_CFLAGS=
-}
-
-src_compile() {
- emake all
- emake -C initsystems INITSYSTEM=systemd SYSTEMUNITDIR="$(systemd_get_systemunitdir)" SYSTEMTMPFILESDIR="/usr/lib/tmpfiles.d" all
-}
-
-src_test() {
- : # integration tests only that require set of kvms to be set up
-}
-
-src_install() {
- default
- emake -C initsystems INITSYSTEM=systemd SYSTEMUNITDIR="$(systemd_get_systemunitdir)" SYSTEMTMPFILESDIR="/usr/lib/tmpfiles.d" DESTDIR="${D}" install
-
- echo "include /etc/ipsec.d/*.secrets" > "${D}"/etc/ipsec.secrets
- fperms 0600 /etc/ipsec.secrets
-
- dodoc -r docs
-
- find "${D}" -type d -empty -delete || die
-}
-
-pkg_postinst() {
- tmpfiles_process libreswan.conf
-
- local IPSEC_CONFDIR=${ROOT}/etc/ipsec.d
- if [[ ! -f ${IPSEC_CONFDIR}/cert8.db && ! -f ${IPSEC_CONFDIR}/cert9.db ]] ; then
- ebegin "Setting up NSS database in ${IPSEC_CONFDIR} with empty password"
- certutil -N -d "${IPSEC_CONFDIR}" --empty-password
- eend $?
- einfo "To set a password: certutil -W -d sql:${IPSEC_CONFDIR}"
- fi
-}
diff --git a/net-vpn/libreswan/libreswan-4.5.ebuild b/net-vpn/libreswan/libreswan-4.5.ebuild
deleted file mode 100644
index 6e63e0b26f56..000000000000
--- a/net-vpn/libreswan/libreswan-4.5.ebuild
+++ /dev/null
@@ -1,122 +0,0 @@
-# Copyright 1999-2022 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit systemd toolchain-funcs tmpfiles
-
-DESCRIPTION="IPsec implementation for Linux, fork of Openswan"
-HOMEPAGE="https://libreswan.org/"
-SRC_URI="https://download.libreswan.org/${P}.tar.gz"
-
-LICENSE="GPL-2 BSD-4 RSA DES"
-SLOT="0"
-KEYWORDS="amd64 ~arm ~ppc x86"
-IUSE="caps curl dnssec ldap networkmanager pam seccomp selinux systemd test"
-RESTRICT="!test? ( test )"
-
-DEPEND="
- dev-libs/gmp:0=
- dev-libs/libevent:0=
- dev-libs/nspr
- >=dev-libs/nss-3.42
- >=sys-kernel/linux-headers-4.19
- virtual/libcrypt:=
- caps? ( sys-libs/libcap-ng )
- curl? ( net-misc/curl )
- dnssec? ( >=net-dns/unbound-1.9.1-r1:= net-libs/ldns:= )
- ldap? ( net-nds/openldap )
- pam? ( sys-libs/pam )
- seccomp? ( sys-libs/libseccomp )
- selinux? ( sys-libs/libselinux )
- systemd? ( sys-apps/systemd:0= )
-"
-BDEPEND="
- app-text/docbook-xml-dtd:4.1.2
- app-text/xmlto
- dev-libs/nss
- sys-devel/bison
- sys-devel/flex
- virtual/pkgconfig
- test? ( dev-python/setproctitle )
-"
-RDEPEND="${DEPEND}
- dev-libs/nss[utils(+)]
- sys-apps/iproute2
- !net-vpn/strongswan
- selinux? ( sec-policy/selinux-ipsec )
-"
-
-usetf() {
- usex "$1" true false
-}
-
-PATCHES=( "${FILESDIR}/${PN}-4.2-ip-path.patch" )
-
-src_prepare() {
- sed -i -e 's:/sbin/runscript:/sbin/openrc-run:' initsystems/openrc/ipsec.init.in || die
- sed -i -e '/^install/ s/postcheck//' -e '/^doinstall/ s/oldinitdcheck//' initsystems/systemd/Makefile || die
- default
-}
-
-src_configure() {
- tc-export AR CC
- export PREFIX=/usr
- export FINALEXAMPLECONFDIR=/usr/share/doc/${PF}
- export FINALDOCDIR=/usr/share/doc/${PF}/html
- export INITSYSTEM=$(usex systemd systemd openrc)
- export INITDDIRS=
- export INITDDIR_DEFAULT=/etc/init.d
- export USERCOMPILE=${CFLAGS}
- export USERLINK=${LDFLAGS}
- export USE_DNSSEC=$(usetf dnssec)
- export USE_LABELED_IPSEC=$(usetf selinux)
- export USE_LIBCAP_NG=$(usetf caps)
- export USE_LIBCURL=$(usetf curl)
- export USE_LINUX_AUDIT=$(usetf selinux)
- export USE_LDAP=$(usetf ldap)
- export USE_NM=$(usetf networkmanager)
- export USE_SECCOMP=$(usetf seccomp)
- export USE_SYSTEMD_WATCHDOG=$(usetf systemd)
- export SD_WATCHDOGSEC=$(usex systemd 200 0)
- export USE_AUTHPAM=$(usetf pam)
- export DEBUG_CFLAGS=
- export OPTIMIZE_CFLAGS=
- export WERROR_CFLAGS=
-}
-
-src_compile() {
- emake all
- emake -C initsystems INITSYSTEM=systemd SYSTEMUNITDIR="$(systemd_get_systemunitdir)" SYSTEMTMPFILESDIR="/usr/lib/tmpfiles.d" all
-}
-
-src_test() {
- : # integration tests only that require set of kvms to be set up
-}
-
-src_install() {
- default
- emake -C initsystems INITSYSTEM=systemd SYSTEMUNITDIR="$(systemd_get_systemunitdir)" SYSTEMTMPFILESDIR="/usr/lib/tmpfiles.d" DESTDIR="${D}" install
-
- echo "include /etc/ipsec.d/*.secrets" > "${D}"/etc/ipsec.secrets
- fperms 0600 /etc/ipsec.secrets
-
- keepdir /var/lib/ipsec/nss
- fperms 0700 /var/lib/ipsec/nss
-
- dodoc -r docs
-
- find "${D}" -type d -empty -delete || die
-}
-
-pkg_postinst() {
- tmpfiles_process libreswan.conf
-
- local IPSEC_CONFDIR=${ROOT}/var/lib/ipsec/nss
- if [[ ! -f ${IPSEC_CONFDIR}/cert8.db && ! -f ${IPSEC_CONFDIR}/cert9.db ]] ; then
- ebegin "Setting up NSS database in ${IPSEC_CONFDIR} with empty password"
- certutil -N -d "${IPSEC_CONFDIR}" --empty-password
- eend $?
- einfo "To set a password: certutil -W -d sql:${IPSEC_CONFDIR}"
- fi
-}