summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAnthony G. Basile <blueness@gentoo.org>2012-03-08 12:03:24 +0000
committerAnthony G. Basile <blueness@gentoo.org>2012-03-08 12:03:24 +0000
commita0c3b9cf46d2fb7c312690405829c74e5c917ec7 (patch)
tree98404b33bef013a98e2c336e1179fd7fd8dfb445 /net-firewall/ipsec-tools
parentx86 stable wrt bug #400045 (diff)
downloadhistorical-a0c3b9cf46d2fb7c312690405829c74e5c917ec7.tar.gz
historical-a0c3b9cf46d2fb7c312690405829c74e5c917ec7.tar.bz2
historical-a0c3b9cf46d2fb7c312690405829c74e5c917ec7.zip
Install simple configs so it racoon runs out of the box
Package-Manager: portage-2.1.10.44/cvs/Linux x86_64
Diffstat (limited to 'net-firewall/ipsec-tools')
-rw-r--r--net-firewall/ipsec-tools/ChangeLog9
-rw-r--r--net-firewall/ipsec-tools/Manifest12
-rw-r--r--net-firewall/ipsec-tools/files/ipsec.conf26
-rw-r--r--net-firewall/ipsec-tools/files/psk.txt10
-rw-r--r--net-firewall/ipsec-tools/files/racoon.conf33
-rw-r--r--net-firewall/ipsec-tools/ipsec-tools-0.8.0-r3.ebuild236
6 files changed, 321 insertions, 5 deletions
diff --git a/net-firewall/ipsec-tools/ChangeLog b/net-firewall/ipsec-tools/ChangeLog
index ffc30f3eeb27..1ccc71119ff5 100644
--- a/net-firewall/ipsec-tools/ChangeLog
+++ b/net-firewall/ipsec-tools/ChangeLog
@@ -1,6 +1,13 @@
# ChangeLog for net-firewall/ipsec-tools
# Copyright 1999-2012 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/net-firewall/ipsec-tools/ChangeLog,v 1.86 2012/03/06 00:18:07 blueness Exp $
+# $Header: /var/cvsroot/gentoo-x86/net-firewall/ipsec-tools/ChangeLog,v 1.87 2012/03/08 12:03:24 blueness Exp $
+
+*ipsec-tools-0.8.0-r3 (08 Mar 2012)
+
+ 08 Mar 2012; Anthony G. Basile <blueness@gentoo.org>
+ +ipsec-tools-0.8.0-r3.ebuild, +files/ipsec.conf, +files/psk.txt,
+ +files/racoon.conf:
+ Install simple configs so it racoon runs out of the box
06 Mar 2012; Anthony G. Basile <blueness@gentoo.org>
-ipsec-tools-0.8.0.ebuild:
diff --git a/net-firewall/ipsec-tools/Manifest b/net-firewall/ipsec-tools/Manifest
index 897e9e7fb1d0..65f974ad970b 100644
--- a/net-firewall/ipsec-tools/Manifest
+++ b/net-firewall/ipsec-tools/Manifest
@@ -5,6 +5,9 @@ AUX ipsec-tools-def-psk.patch 907 RMD160 4a72e22ecbc821cc96b338004b6ebb578701856
AUX ipsec-tools-duplicate-header.patch 440 RMD160 0a9f53ad68232b382388447c3c4aa7c81f5b6de1 SHA1 1d48f49fae5e7c5278d52a512e6b06998f24eacf SHA256 47d31a605a48fc7168cd579f62217316a12b153177bc6b16618d46c38e6936d1
AUX ipsec-tools-include-vendoridh.patch 434 RMD160 cf30a122392ba179a7c6b0cd65f4c21d68d16266 SHA1 a0de513e850618caa2b5917b5d5b838360eaa200 SHA256 be0fd6ec217405a6f1ab97231568297e705d995d0f5fa8a6ebae896e1b2e910c
AUX ipsec-tools-system-kernel-headers.patch 1732 RMD160 521555b745f061cc60073f96d3c5031301e24f64 SHA1 0ab4f8bd7eaaec6a54819bab7e1b3a574436799d SHA256 7c8f11b1297ea5657b3665ad7541543bdba91f6d2b1f13016628749895ba7496
+AUX ipsec.conf 1209 RMD160 38ed5ce1b0ca6ce48d92ba0ad13b14122bd3371c SHA1 563926c8b14dc54cadebfcef108fe53abb189d4a SHA256 a9a6cbf1bd42aaefdb637814bc6198079bab84e37888e1b705f938f590978816
+AUX psk.txt 293 RMD160 b626935831085771ee71486b9c5e24e606518dc8 SHA1 49e68d8cb0208ed55ebc76a12dec7180f43af431 SHA256 d34b142b4566712f87382caf0a64bcc070bbde17f16e2ee49d5dde26cb1bbe08
+AUX racoon.conf 772 RMD160 4ad6f3f94dc587d9b4278e165e76b7eacb475b91 SHA1 e7a74b34181480764e36fc452a9e6a516c8c86b4 SHA256 e00cea25741fa16aa985d80ce49f2a59af0c98a44707a047193e936644b497a3
AUX racoon.conf.d 621 RMD160 773a21f70bd4786eb6758f052bb54cc40273c259 SHA1 1291dbe1639cbb72a161e3af727c9c65c6ae0132 SHA256 bc7cf9c0fe8bd5f99c9353aa3c19e3314b3da21a7a2138fc6e901375be21b109
AUX racoon.init.d 1314 RMD160 14fd9ea02fdb20d13a0e3284e1f1e468117247f2 SHA1 41cb71c0354d632ad35565dbf98a26364b592d56 SHA256 7c9447197032b30a2cb76a62179a3b0ef3768870c340adf4743976e7d65eba75
AUX racoon.pam.d 156 RMD160 c4f6ba6e3a705eef63e571189e28de71e7d61178 SHA1 1223f7a43a5e124521d48852b2d23bb8ba0a788f SHA256 166136e27d653e0bf481a6ca79fecb7d9fa2fc3d597d041f97df595f65a8193c
@@ -14,12 +17,13 @@ EBUILD ipsec-tools-0.7.3-r1.ebuild 5504 RMD160 c80cca70aec3efa13f87c3c66bec051cc
EBUILD ipsec-tools-0.7.3.ebuild 8375 RMD160 990aa70c71acc7f3c523aaa1abcfef4f8999e7c7 SHA1 f65d04115cce6277297953cfbac91ce89a3ce83b SHA256 fb7cd6ae897526e409bb9799c9594955577894f87cf79fef27fe8f673d4eaafd
EBUILD ipsec-tools-0.8.0-r1.ebuild 6059 RMD160 8362f600f68800c907e177a5566e1356377c470f SHA1 1cc992a2e39073e89fae48278c36ada363d0d366 SHA256 b0908292a9bd960f988009ed9a7a9f3be073243838c7b4f3ea7715695e8b48fa
EBUILD ipsec-tools-0.8.0-r2.ebuild 6115 RMD160 6a5dbfacc11d4314d23d7914b5df48f98ed0ee0b SHA1 87df6e0743d04f427e5c438a09aae443f7ff02d9 SHA256 1259f0731b7905106f9c2b8c0b54ba55fd4327db12fc9686b146b8650915d41b
-MISC ChangeLog 14183 RMD160 32cd9beb04a3fa7711587312805fe17ce70a9b77 SHA1 8febe3aed26eb962d377ef3ef5b360e675f8d816 SHA256 65ec3563f4a37dbeff9285adef9b9fc7d9f93580728fb734ca545cbe7aeb8219
+EBUILD ipsec-tools-0.8.0-r3.ebuild 5986 RMD160 994b5f20996f0dfdac044f977ddd73004df7969e SHA1 45c88f508fc3ce21f9125db5dea0e484bfd5210b SHA256 ad604ee6a915fa5c96239e6de2dda0779c2f7dbca01e6b3fdac6ab3f8f6e098e
+MISC ChangeLog 14423 RMD160 45a8d479b4bdfe5c89ef8126f5484e60fcabcc70 SHA1 8aee2ca7319ff0baf254a8baae4f9e334d9cb7d9 SHA256 9c2cd5a21bdf377e6788f9d522b559059fb3a2fcaf9d64b307e8fff94745133a
MISC metadata.xml 537 RMD160 41f7f604e33d56879ee9dd0d5a18c7f8fcc0910e SHA1 0fdf06aa17efa68aa50f04db0277e0dc4f4be590 SHA256 12de55d6d62b8e91c8996422e33462b5637f9720a5096025752b93906bcbdc40
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (GNU/Linux)
-iEYEAREIAAYFAk9VV8kACgkQl5yvQNBFVTU25wCff+/0j/OPBlOk2D7Ya36CCheG
-/4oAn2OdUhFK9waZBONPwa0c6BH9itwn
-=egqC
+iEYEAREIAAYFAk9YoBYACgkQl5yvQNBFVTVo3ACdFPCb1oJCEMYDf8LEHzB0M2+B
+gq4AoJKGnd0XYVTQlDS8FH2DjDbSLzz/
+=k6DU
-----END PGP SIGNATURE-----
diff --git a/net-firewall/ipsec-tools/files/ipsec.conf b/net-firewall/ipsec-tools/files/ipsec.conf
new file mode 100644
index 000000000000..bfff04af069a
--- /dev/null
+++ b/net-firewall/ipsec-tools/files/ipsec.conf
@@ -0,0 +1,26 @@
+#!/usr/sbin/setkey -f
+#
+# THIS IS A SAMPLE FILE!
+#
+# This is a sample file to test Gentoo's ipsec-tools out of the box.
+# Do not use it in production. See: http://www.ipsec-howto.org/
+#
+flush;
+spdflush;
+
+#
+# Uncomment the following if you want to do manual keying, ie, you want to run IPsec without racoon.
+# Do not switch 192.168.3.21 <-> 192.168.3.25 on the peer
+#
+#add 192.168.3.25 192.168.3.21 ah 0x200 -A hmac-md5 0xc0291ff014dccdd03874d9e8e4cdf3e6;
+#add 192.168.3.21 192.168.3.25 ah 0x300 -A hmac-md5 0x96358c90783bbfa3d7b196ceabe0536b;
+#add 192.168.3.25 192.168.3.21 esp 0x201 -E 3des-cbc 0x7aeaca3f87d060a12f4a4487d5a5c3355920fae69a96c831;
+#add 192.168.3.21 192.168.3.25 esp 0x301 -E 3des-cbc 0xf6ddb555acfd9d77b03ea3843f2653255afe8eb5573965df;
+
+#
+# Make sure to switch 192.168.3.21 <-> 192.168.3.25 on the peer
+#
+#spdadd 192.168.3.21 192.168.3.25 any -P out ipsec esp/transport//require ah/transport//require;
+#spdadd 192.168.3.25 192.168.3.21 any -P in ipsec esp/transport//require ah/transport//require;
+spdadd 192.168.3.25 192.168.3.21 any -P out ipsec esp/transport//require ah/transport//require;
+spdadd 192.168.3.21 192.168.3.25 any -P in ipsec esp/transport//require ah/transport//require;
diff --git a/net-firewall/ipsec-tools/files/psk.txt b/net-firewall/ipsec-tools/files/psk.txt
new file mode 100644
index 000000000000..97f5180f5ae5
--- /dev/null
+++ b/net-firewall/ipsec-tools/files/psk.txt
@@ -0,0 +1,10 @@
+# THIS IS A SAMPLE FILE!
+#
+# This is a sample file to test Gentoo's ipsec-tools out of the box.
+# Do not use it in production. See: http://www.ipsec-howto.org/
+#
+# Make sure to switch 192.168.3.21 <-> 192.168.3.25 on the peer
+#
+# Peer IP/FQDN Secret
+# 192.168.3.25 sample
+192.168.3.21 sample
diff --git a/net-firewall/ipsec-tools/files/racoon.conf b/net-firewall/ipsec-tools/files/racoon.conf
new file mode 100644
index 000000000000..2e9206db9506
--- /dev/null
+++ b/net-firewall/ipsec-tools/files/racoon.conf
@@ -0,0 +1,33 @@
+# THIS IS A SAMPLE FILE!
+#
+# This is a sample file to test Gentoo's ipsec-tools out of the box.
+# Do not use it in production. See: http://www.ipsec-howto.org/
+#
+path pre_shared_key "/etc/racoon/psk.txt";
+
+#
+# Make sure to switch 192.168.3.21 <-> 192.168.3.25 on the peer
+#
+#remote 192.168.3.25
+remote 192.168.3.21
+{
+ exchange_mode main;
+ proposal {
+ encryption_algorithm 3des;
+ hash_algorithm md5;
+ authentication_method pre_shared_key;
+ dh_group modp1024;
+ }
+}
+
+#
+# Make sure to switch 192.168.3.21 <-> 192.168.3.25 on the peer
+#
+#sainfo address 192.168.3.21 any address 192.168.3.25 any
+sainfo address 192.168.3.25 any address 192.168.3.21 any
+{
+ pfs_group modp768;
+ encryption_algorithm 3des;
+ authentication_algorithm hmac_md5;
+ compression_algorithm deflate;
+}
diff --git a/net-firewall/ipsec-tools/ipsec-tools-0.8.0-r3.ebuild b/net-firewall/ipsec-tools/ipsec-tools-0.8.0-r3.ebuild
new file mode 100644
index 000000000000..42ee412e58ff
--- /dev/null
+++ b/net-firewall/ipsec-tools/ipsec-tools-0.8.0-r3.ebuild
@@ -0,0 +1,236 @@
+# Copyright 1999-2012 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-firewall/ipsec-tools/ipsec-tools-0.8.0-r3.ebuild,v 1.1 2012/03/08 12:03:24 blueness Exp $
+
+EAPI="4"
+
+inherit eutils flag-o-matic autotools linux-info pam
+
+DESCRIPTION="A port of KAME's IPsec utilities to the Linux-2.6 IPsec implementation"
+HOMEPAGE="http://ipsec-tools.sourceforge.net/"
+SRC_URI="mirror://sourceforge/${PN}/${P}.tar.bz2"
+
+LICENSE="BSD"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="hybrid idea ipv6 kerberos ldap nat pam rc5 readline selinux stats"
+
+RDEPEND="
+ dev-libs/openssl
+ kerberos? ( virtual/krb5 )
+ ldap? ( net-nds/openldap )
+ pam? ( sys-libs/pam )
+ readline? ( sys-libs/readline )
+ selinux? (
+ sys-libs/libselinux
+ sec-policy/selinux-ipsec-tools
+ )"
+
+DEPEND="${RDEPEND}
+ >=sys-kernel/linux-headers-2.6.30"
+
+pkg_setup() {
+ linux-info_pkg_setup
+
+ get_version
+
+ if linux_config_exists && kernel_is -ge 2 6 19; then
+ ewarn
+ ewarn "\033[1;33m**************************************************\033[00m"
+ ewarn
+ ewarn "Checking kernel configuration in /usr/src/linux or"
+ ewarn "or /proc/config.gz for compatibility with ${PN}."
+ ewarn "Here are the potential problems:"
+ ewarn
+
+ local nothing="1"
+
+ # Check options for all flavors of IPSec
+ local msg=""
+ for i in XFRM_USER NET_KEY; do
+ if ! linux_chkconfig_present ${i}; then
+ msg="${msg} ${i}"
+ fi
+ done
+ if [[ ! -z "$msg" ]]; then
+ nothing="0"
+ ewarn
+ ewarn "ALL IPSec may fail. CHECK:"
+ ewarn "${msg}"
+ fi
+
+ # Check unencrypted IPSec
+ if ! linux_chkconfig_present CRYPTO_NULL; then
+ nothing="0"
+ ewarn
+ ewarn "Unencrypted IPSec may fail. CHECK:"
+ ewarn " CRYPTO_NULL"
+ fi
+
+ # Check IPv4 IPSec
+ msg=""
+ for i in \
+ INET_IPCOMP INET_AH INET_ESP \
+ INET_XFRM_MODE_TRANSPORT \
+ INET_XFRM_MODE_TUNNEL \
+ INET_XFRM_MODE_BEET
+ do
+ if ! linux_chkconfig_present ${i}; then
+ msg="${msg} ${i}"
+ fi
+ done
+ if [[ ! -z "$msg" ]]; then
+ nothing="0"
+ ewarn
+ ewarn "IPv4 IPSec may fail. CHECK:"
+ ewarn "${msg}"
+ fi
+
+ # Check IPv6 IPSec
+ if use ipv6; then
+ msg=""
+ for i in INET6_IPCOMP INET6_AH INET6_ESP \
+ INET6_XFRM_MODE_TRANSPORT \
+ INET6_XFRM_MODE_TUNNEL \
+ INET6_XFRM_MODE_BEET
+ do
+ if ! linux_chkconfig_present ${i}; then
+ msg="${msg} ${i}"
+ fi
+ done
+ if [[ ! -z "$msg" ]]; then
+ nothing="0"
+ ewarn
+ ewarn "IPv6 IPSec may fail. CHECK:"
+ ewarn "${msg}"
+ fi
+ fi
+
+ # Check IPSec behind NAT
+ if use nat; then
+ if ! linux_chkconfig_present NETFILTER_XT_MATCH_POLICY; then
+ nothing="0"
+ ewarn
+ ewarn "IPSec behind NAT may fail. CHECK:"
+ ewarn " NETFILTER_XT_MATCH_POLICY"
+ fi
+ fi
+
+ if [[ $nothing == "1" ]]; then
+ ewarn "NO PROBLEMS FOUND"
+ fi
+
+ ewarn
+ ewarn "WARNING: If your *configured* and *running* kernel"
+ ewarn "differ either now or in the future, then these checks"
+ ewarn "may lead to misleading results."
+ ewarn
+ ewarn "\033[1;33m**************************************************\033[00m"
+ ewarn
+ else
+ eerror
+ eerror "\033[1;31m**************************************************\033[00m"
+ eerror "Make sure that your *running* kernel is/will be >=2.6.19."
+ eerror "Building ${PN} now, assuming that you know what you're doing."
+ eerror "\033[1;31m**************************************************\033[00m"
+ eerror
+ fi
+}
+
+src_prepare() {
+ # fix for bug #124813
+ sed -i 's:-Werror::g' "${S}"/configure.ac || die
+ # fix for building with gcc-4.6
+ sed -i 's: -R: -Wl,-R:' "${S}"/configure.ac || die
+
+ epatch "${FILESDIR}/${PN}-def-psk.patch"
+ epatch "${FILESDIR}/${PN}-include-vendoridh.patch"
+
+ AT_M4DIR="${S}" eautoreconf
+ epunt_cxx
+}
+
+src_configure() {
+ #--with-{iconv,libradius} lead to "Broken getaddrinfo()"
+ #--enable-samode-unspec is not supported in linux
+ local myconf
+ myconf="--with-kernel-headers=/usr/include \
+ --enable-adminport \
+ --enable-dependency-tracking \
+ --enable-dpd \
+ --enable-frag \
+ --without-libiconv \
+ --without-libradius \
+ --disable-samode-unspec \
+ $(use_enable idea) \
+ $(use_enable ipv6) \
+ $(use_enable kerberos gssapi) \
+ $(use_with ldap libldap) \
+ $(use_enable nat natt) \
+ $(use_with pam libpam) \
+ $(use_enable rc5) \
+ $(use_with readline) \
+ $(use_enable selinux security-context) \
+ $(use_enable stats)"
+
+ use nat && myconf="${myconf} --enable-natt-versions=yes"
+
+ # enable mode-cfg and xauth support
+ if use pam; then
+ myconf="${myconf} --enable-hybrid"
+ else
+ myconf="${myconf} $(use_enable hybrid)"
+ fi
+
+ econf ${myconf}
+}
+
+src_install() {
+ emake DESTDIR="${D}" install
+ keepdir /var/lib/racoon
+ newconfd "${FILESDIR}"/racoon.conf.d racoon
+ newinitd "${FILESDIR}"/racoon.init.d racoon
+ use pam && newpamd "${FILESDIR}"/racoon.pam.d racoon
+
+ insinto /etc
+ doins "${FILESDIR}"/ipsec.conf
+ insinto /etc/racoon
+ doins "${FILESDIR}"/racoon.conf
+ doins "${FILESDIR}"/psk.txt
+ chmod 400 "${D}"/etc/racoon/psk.txt
+
+ dodoc ChangeLog README NEWS
+ dodoc -r src/racoon/samples
+ dodoc -r src/racoon/doc
+ docinto samples
+ newdoc src/setkey/sample.cf ipsec.conf
+}
+
+pkg_postinst() {
+ if use nat; then
+ elog
+ elog "You have enabled the nat traversal functionnality."
+ elog "Nat versions wich are enabled by default are 00,02,rfc"
+ elog "you can find those drafts in the CVS repository:"
+ elog "cvs -d anoncvs@anoncvs.netbsd.org:/cvsroot co ipsec-tools"
+ elog
+ elog "If you feel brave enough and you know what you are"
+ elog "doing, you can consider emerging this ebuild with"
+ elog "EXTRA_ECONF=\"--enable-natt-versions=08,07,06\""
+ elog
+ fi
+
+ if use ldap; then
+ elog
+ elog "You have enabled ldap support with {$PN}."
+ elog "The man page does NOT contain any information on it yet."
+ elog "Consider using a more recent version or CVS."
+ elog
+ fi
+
+ elog
+ elog "Please have a look in /usr/share/doc/${P} and visit"
+ elog "http://www.netbsd.org/Documentation/network/ipsec/"
+ elog "to find more information on how to configure this tool."
+ elog
+}