Merge pull request #5054 from lucize/libreswan
libreswan: add libreswan 3.27
This commit is contained in:
Rosen Penev
GitHub
commit
d1a7d35ebe
4 changed files with 395 additions and 0 deletions
125
net/libreswan/Makefile
Normal file
125
net/libreswan/Makefile
Normal file
|
|
@ -0,0 +1,125 @@
|
|||
#
|
||||
# Copyright (C) 2019 Lucian Cristian <lucian.cristian@gmail.com>
|
||||
#
|
||||
# This is free software, licensed under the GNU General Public License v2.
|
||||
# See /LICENSE for more information.
|
||||
|
||||
include $(TOPDIR)/rules.mk
|
||||
|
||||
PKG_NAME:=libreswan
|
||||
PKG_VERSION:=3.27
|
||||
PKG_RELEASE:=1
|
||||
|
||||
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
|
||||
PKG_SOURCE_URL:=https://download.libreswan.org/
|
||||
PKG_HASH:=ead07dd701116094b483dc57e54e2a5ee9a06d3982bb142260bcbf3d1faf7b82
|
||||
|
||||
PKG_LICENSE:=GPL-2.0
|
||||
PKG_MAINTAINER:=Lucian Cristian <lucian.cristian@gmail.com>
|
||||
|
||||
PKG_BUILD_PARALLEL:=1
|
||||
PKG_INSTALL:=1
|
||||
|
||||
include $(INCLUDE_DIR)/package.mk
|
||||
include $(INCLUDE_DIR)/kernel.mk
|
||||
|
||||
define Package/libreswan/Default
|
||||
TITLE:=Libreswan
|
||||
URL:=https://libreswan.org/
|
||||
endef
|
||||
|
||||
define Package/libreswan/Default/description
|
||||
Libreswan is a free software implementation of the most widely supported and
|
||||
standardized VPN protocol based on ("IPsec") and the Internet Key Exchange
|
||||
("IKE"). These standards are produced and maintained by the Internet
|
||||
Engineering Task Force ("IETF").
|
||||
endef
|
||||
|
||||
define Package/libreswan
|
||||
$(call Package/libreswan/Default)
|
||||
SUBMENU:=VPN
|
||||
SECTION:=net
|
||||
CATEGORY:=Network
|
||||
DEPENDS:= +kmod-libreswan +libnss +librt +libevent2 +libevent2-pthreads \
|
||||
+ip-full
|
||||
PROVIDES:=openswan
|
||||
CONFLICTS:=strongswan
|
||||
TITLE+= IPsec Server
|
||||
endef
|
||||
|
||||
define Package/libreswan/description
|
||||
$(call Package/libreswan/Default/description)
|
||||
Libreswan is a free software implementation of the most widely supported and
|
||||
standardized VPN protocol based on ("IPsec") and the Internet Key Exchange
|
||||
("IKE"). These standards are produced and maintained by the Internet
|
||||
Engineering Task Force ("IETF").
|
||||
endef
|
||||
|
||||
define KernelPackage/libreswan
|
||||
$(call Package/libreswan/Default)
|
||||
SUBMENU:=Network Support
|
||||
TITLE+= (kernel module)
|
||||
FILES:=$(PKG_BUILD_DIR)/modobj*/ipsec.$(LINUX_KMOD_SUFFIX)
|
||||
DEPENDS:= +kmod-crypto-authenc +kmod-crypto-hash +kmod-ipt-ipsec +iptables-mod-ipsec \
|
||||
+kmod-ipsec +kmod-ipsec4 +kmod-crypto-rng +IPV6:kmod-ipsec6
|
||||
endef
|
||||
|
||||
define KernelPackage/libreswan/description
|
||||
$(call Package/libreswan/Default/description)
|
||||
This package contains the Libreswan kernel module.
|
||||
endef
|
||||
|
||||
define Package/libreswan/conffiles
|
||||
/etc/ipsec.d
|
||||
/etc/ipsec.conf
|
||||
/etc/ipsec.secrets
|
||||
endef
|
||||
|
||||
TARGET_CFLAGS+= -Wno-error=format-nonliteral
|
||||
MAKE_FLAGS+= \
|
||||
WERROR_CFLAGS=" " \
|
||||
USE_DNSSEC=false \
|
||||
USE_LINUX_AUDIT=false \
|
||||
USE_LABELED_IPSEC=false \
|
||||
USE_NM=false \
|
||||
USE_LIBCURL=false \
|
||||
USE_GLIBC_KERN_FLIP_HEADERS=true \
|
||||
USE_XAUTHPAM=false \
|
||||
USE_FIPSCHECK=false \
|
||||
USE_LIBCAP_NG=false \
|
||||
USE_SYSTEMD_WATCHDOG=false \
|
||||
INC_USRLOCAL="/usr" \
|
||||
FINALRUNDIR="/var/run/pluto" \
|
||||
KERNELSRC="$(LINUX_DIR)"
|
||||
|
||||
define Build/Prepare
|
||||
$(call Build/Prepare/Default)
|
||||
$(SED) 's,include $$$$(top_srcdir)/mk/manpages.mk,,g' \
|
||||
$(PKG_BUILD_DIR)/mk/program.mk
|
||||
endef
|
||||
|
||||
define Build/Compile
|
||||
$(call Build/Compile/Default,base)
|
||||
$(call Build/Compile/Default,module)
|
||||
endef
|
||||
|
||||
define Package/libreswan/install
|
||||
$(INSTALL_DIR) \
|
||||
$(1)/etc/init.d \
|
||||
$(1)/etc/ipsec.d/policies \
|
||||
$(1)/usr/libexec/ipsec \
|
||||
$(1)/usr/sbin
|
||||
|
||||
$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/ipsec \
|
||||
$(1)/usr/sbin/ipsec
|
||||
$(INSTALL_BIN) ./files/ipsec.init $(1)/etc/init.d/ipsec
|
||||
$(INSTALL_DATA) ./files/ipsec.conf $(1)/etc/ipsec.conf
|
||||
$(INSTALL_DATA) ./files/ipsec.secrets $(1)/etc/ipsec.secrets
|
||||
$(INSTALL_DATA) $(PKG_INSTALL_DIR)/etc/ipsec.d/policies/* \
|
||||
$(1)/etc/ipsec.d/policies/
|
||||
$(CP) $(PKG_INSTALL_DIR)/usr/libexec/ipsec/* \
|
||||
$(1)/usr/libexec/ipsec/
|
||||
endef
|
||||
|
||||
$(eval $(call BuildPackage,libreswan))
|
||||
$(eval $(call KernelPackage,libreswan))
|
||||
46
net/libreswan/files/ipsec.conf
Normal file
46
net/libreswan/files/ipsec.conf
Normal file
|
|
@ -0,0 +1,46 @@
|
|||
# /etc/ipsec.conf - Libreswan IPsec configuration file
|
||||
#
|
||||
# see 'man ipsec.conf' and 'man pluto' for more information
|
||||
#
|
||||
# For example configurations and documentation, see https://libreswan.org/wiki/
|
||||
|
||||
config setup
|
||||
# Normally, pluto logs via syslog.
|
||||
#logfile=/var/log/pluto.log
|
||||
#
|
||||
# Do not enable debug options to debug configuration issues!
|
||||
#
|
||||
# plutodebug="control parsing"
|
||||
# plutodebug="all crypt"
|
||||
plutodebug=none
|
||||
#
|
||||
# NAT-TRAVERSAL support
|
||||
# exclude networks used on server side by adding %v4:!a.b.c.0/24
|
||||
# It seems that T-Mobile in the US and Rogers/Fido in Canada are
|
||||
# using 25/8 as "private" address space on their wireless networks.
|
||||
# This range has never been announced via BGP (at least up to 2015)
|
||||
virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v4:100.64.0.0/10,%v6:fd00::/8,%v6:fe80::/10
|
||||
|
||||
# if it exists, include system wide crypto-policy defaults
|
||||
# include /etc/crypto-policies/back-ends/libreswan.config
|
||||
|
||||
# It is best to add your IPsec connections as separate files in /etc/ipsec.d/
|
||||
|
||||
conn L2TP-PSK-NAT
|
||||
rightsubnet=vhost:%priv
|
||||
also=L2TP-PSK-noNAT
|
||||
|
||||
conn L2TP-PSK-noNAT
|
||||
authby=secret
|
||||
pfs=no
|
||||
auto=add
|
||||
keyingtries=8
|
||||
ikelifetime=8h
|
||||
keylife=1h
|
||||
type=transport
|
||||
left=A.B.C.D
|
||||
leftprotoport=17/1701
|
||||
right=%any
|
||||
rightprotoport=17/%any
|
||||
|
||||
include /etc/ipsec.d/*.conf
|
||||
207
net/libreswan/files/ipsec.init
Executable file
207
net/libreswan/files/ipsec.init
Executable file
|
|
@ -0,0 +1,207 @@
|
|||
#!/bin/sh /etc/rc.common
|
||||
|
||||
START=90
|
||||
STOP=10
|
||||
|
||||
#USE_PROCD=1
|
||||
|
||||
. $IPKG_INSTROOT/lib/functions.sh
|
||||
|
||||
EXTRA_COMMANDS=status
|
||||
EXTRA_HELP=" status Show the status of the service"
|
||||
|
||||
# Check that networking is up.
|
||||
[ "${NETWORKING}" = "no" ] && exit 6
|
||||
|
||||
if [ $(id -u) -ne 0 ]; then
|
||||
echo "permission denied (must be superuser)" | \
|
||||
logger -s -p daemon.error -t ipsec_setup 2>&1
|
||||
exit 4
|
||||
fi
|
||||
|
||||
# where the private directory and the config files are
|
||||
IPSEC_EXECDIR="${IPSEC_EXECDIR-/usr/libexec/ipsec}"
|
||||
IPSEC_SBINDIR="${IPSEC_SBINDIR-/usr/sbin}"
|
||||
IPSEC_CONF="${IPSEC_CONF-/etc/ipsec.conf}"
|
||||
unset PLUTO_OPTIONS
|
||||
|
||||
rundir=/var/run/pluto
|
||||
plutopid=${rundir}/pluto.pid
|
||||
plutoctl=${rundir}/pluto.ctl
|
||||
lockdir=/var/lock
|
||||
lockfile=${lockdir}/ipsec
|
||||
ipsecversion=/proc/net/ipsec_version
|
||||
kamepfkey=/proc/net/pfkey
|
||||
|
||||
# /etc/resolv.conf related paths
|
||||
LIBRESWAN_RESOLV_CONF=${rundir}/libreswan-resolv-conf-backup
|
||||
ORIG_RESOLV_CONF=/etc/resolv.conf
|
||||
|
||||
# misc setup
|
||||
umask 022
|
||||
|
||||
# standardize PATH, and export it for everything else's benefit
|
||||
PATH="${IPSEC_SBINDIR}":/sbin:/usr/sbin:/usr/local/bin:/bin:/usr/bin
|
||||
export PATH
|
||||
|
||||
mkdir -p ${rundir}
|
||||
chmod 700 ${rundir}
|
||||
|
||||
verify_config() {
|
||||
[ -f ${IPSEC_CONF} ] || exit 6
|
||||
config_error=$(ipsec addconn --config ${IPSEC_CONF} --checkconfig 2>&1)
|
||||
RETVAL=$?
|
||||
if [ ${RETVAL} -gt 0 ]; then
|
||||
echo "Configuration error - the following error occurred:"
|
||||
echo ${config_error}
|
||||
echo "IKE daemon status was not modified"
|
||||
exit ${RETVAL}
|
||||
fi
|
||||
}
|
||||
|
||||
start() {
|
||||
echo -n "Starting pluto IKE daemon for IPsec: "
|
||||
ipsec _stackmanager start
|
||||
# pluto searches the current directory, so this is required for making it selinux compliant
|
||||
cd /
|
||||
# Create nss db or convert from old format to new sql format
|
||||
ipsec --checknss
|
||||
# Enable nflog if configured
|
||||
ipsec --checknflog > /dev/null
|
||||
# This script will enter an endless loop to ensure pluto restarts on crash
|
||||
ipsec _plutorun --config ${IPSEC_CONF} --nofork ${PLUTO_OPTIONS} & [ -d ${lockdir} ] || mkdir -p ${lockdir}
|
||||
touch ${lockfile}
|
||||
# Because _plutorun starts pluto at background we need to make sure pluto is started
|
||||
# before we know if start was successful or not
|
||||
for waitsec in 1 2 3 4 5; do
|
||||
if status >/dev/null; then
|
||||
RETVAL=0
|
||||
break
|
||||
else
|
||||
echo -n "."
|
||||
sleep 1
|
||||
RETVAL=1
|
||||
fi
|
||||
done
|
||||
if [ ${RETVAL} -ge 1 ]; then
|
||||
rm -f ${lockfile}
|
||||
fi
|
||||
echo
|
||||
return ${RETVAL}
|
||||
}
|
||||
|
||||
stop() {
|
||||
if [ -e ${plutoctl} ]; then
|
||||
echo "Shutting down pluto IKE daemon"
|
||||
ipsec whack --shutdown 2>/dev/null
|
||||
# don't use seq, might not exist on embedded
|
||||
for waitsec in 1 2 3 4 5 6 7 8 9 10; do
|
||||
if [ -s ${plutopid} ]; then
|
||||
echo -n "."
|
||||
sleep 1
|
||||
else
|
||||
break
|
||||
fi
|
||||
done
|
||||
echo
|
||||
rm -f ${plutoctl} # we won't be using this anymore
|
||||
fi
|
||||
if [ -s ${plutopid} ]; then
|
||||
# pluto did not die peacefully
|
||||
pid=$(cat ${plutopid})
|
||||
if [ -d /proc/${pid} ]; then
|
||||
kill -TERM ${pid}
|
||||
RETVAL=$?
|
||||
sleep 5;
|
||||
if [ -d /proc/${pid} ]; then
|
||||
kill -KILL ${pid}
|
||||
RETVAL=$?
|
||||
fi
|
||||
if [ ${RETVAL} -ne 0 ]; then
|
||||
echo "Kill failed - removing orphaned ${plutopid}"
|
||||
fi
|
||||
else
|
||||
echo "Removing orphaned ${plutopid}"
|
||||
fi
|
||||
rm -f ${plutopid}
|
||||
fi
|
||||
|
||||
ipsec _stackmanager stop
|
||||
ipsec --stopnflog > /dev/null
|
||||
|
||||
# cleaning up backup resolv.conf
|
||||
if [ -e ${LIBRESWAN_RESOLV_CONF} ]; then
|
||||
if grep 'Libreswan' ${ORIG_RESOLV_CONF} > /dev/null 2>&1; then
|
||||
cp ${LIBRESWAN_RESOLV_CONF} ${ORIG_RESOLV_CONF}
|
||||
fi
|
||||
rm -f ${LIBRESWAN_RESOLV_CONF}
|
||||
fi
|
||||
|
||||
rm -f ${lockfile}
|
||||
return ${RETVAL}
|
||||
}
|
||||
|
||||
restart() {
|
||||
verify_config
|
||||
stop
|
||||
start
|
||||
return $?
|
||||
}
|
||||
|
||||
status() {
|
||||
local RC
|
||||
if [ -f ${plutopid} ]; then
|
||||
if [ -r ${plutopid} ]; then
|
||||
pid=$(cat ${plutopid})
|
||||
if [ -n "$pid" -a -d /proc/${pid} ]; then
|
||||
RC=0 # running
|
||||
else
|
||||
RC=1 # not running but pid exists
|
||||
fi
|
||||
else
|
||||
RC=4 # insufficient privileges
|
||||
fi
|
||||
fi
|
||||
if [ -z "${RC}" ]; then
|
||||
if [ -f ${lockfile} ]; then
|
||||
RC=2
|
||||
else
|
||||
RC=3
|
||||
fi
|
||||
fi
|
||||
case "${RC}" in
|
||||
0)
|
||||
echo "ipsec: pluto (pid ${pid}) is running..."
|
||||
return 0
|
||||
;;
|
||||
1)
|
||||
echo "ipsec: pluto dead but pid file exits"
|
||||
return 1
|
||||
;;
|
||||
2)
|
||||
echo "ipsec: pluto dead but subsys locked"
|
||||
return 2
|
||||
;;
|
||||
4)
|
||||
echo "ipsec: pluto status unknown due to insufficient privileges."
|
||||
return 4
|
||||
;;
|
||||
esac
|
||||
echo "ipsec: pluto is stopped"
|
||||
return 3
|
||||
}
|
||||
|
||||
condrestart() {
|
||||
verify_config
|
||||
RETVAL=$?
|
||||
if [ -f ${lockfile} ]; then
|
||||
restart
|
||||
RETVAL=$?
|
||||
fi
|
||||
return ${RETVAL}
|
||||
}
|
||||
|
||||
version() {
|
||||
ipsec version
|
||||
return $?
|
||||
}
|
||||
17
net/libreswan/files/ipsec.secrets
Normal file
17
net/libreswan/files/ipsec.secrets
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
# This file holds shared secrets (PSK) and XAUTH user passwords used for
|
||||
# authentication. See pluto(8) manpage or the libreswan website.
|
||||
|
||||
# Unlike older openswan, this file does NOT contain any X.509 related
|
||||
# information such as private key :RSA statements as these now reside
|
||||
# in the NSS database. See:
|
||||
#
|
||||
# https://libreswan.org/wiki/Using_NSS_with_libreswan
|
||||
# https://libreswan.org/wiki/Migrating_from_Openswan
|
||||
#
|
||||
# The preferred method for adding secrets is to create a new file in
|
||||
# the /etc/ipsec.d/ directory, so it will be included via the include
|
||||
# line below
|
||||
|
||||
#A.B.C.D %any : PSK "SsEeCcRrEeTt"
|
||||
|
||||
include /etc/ipsec.d/*.secrets
|
||||
Loading…
Reference in a new issue