strongswan: update to 5.2.1
[feed/packages.git] / net / strongswan / Makefile
1 #
2 # Copyright (C) 2012-2014 OpenWrt.org
3 #
4 # This is free software, licensed under the GNU General Public License v2.
5 # See /LICENSE for more information.
6 #
7
8 include $(TOPDIR)/rules.mk
9
10 PKG_NAME:=strongswan
11 PKG_VERSION:=5.2.1
12 PKG_RELEASE:=1
13
14 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
15 PKG_SOURCE_URL:=http://download.strongswan.org/ http://download2.strongswan.org/
16 PKG_MD5SUM:=dd3717c0aa59ab4591ca1812941ebb82
17 PKG_LICENSE:=GPL-2.0+
18 PKG_MAINTAINER:=Steven Barth <cyrus@openwrt.org>
19
20 PKG_MOD_AVAILABLE:= \
21 addrblock \
22 aes \
23 af-alg \
24 agent \
25 attr \
26 attr-sql \
27 blowfish \
28 ccm \
29 cmac \
30 constraints \
31 coupling \
32 ctr \
33 curl \
34 des \
35 dhcp \
36 dnskey \
37 duplicheck \
38 eap-identity \
39 eap-md5 \
40 eap-mschapv2 \
41 eap-radius \
42 farp \
43 fips-prf \
44 gcm \
45 gcrypt \
46 gmp \
47 ha \
48 hmac \
49 kernel-libipsec \
50 kernel-netlink \
51 ldap \
52 led \
53 load-tester \
54 nonce \
55 md4 \
56 md5 \
57 mysql \
58 openssl \
59 padlock \
60 pem \
61 pgp \
62 pkcs1 \
63 pkcs8 \
64 pkcs11 \
65 pubkey \
66 random \
67 resolve \
68 revocation \
69 sha1 \
70 sha2 \
71 smp \
72 socket-default \
73 socket-dynamic \
74 sql \
75 sqlite \
76 stroke \
77 test-vectors \
78 unity \
79 uci \
80 updown \
81 whitelist \
82 x509 \
83 xauth-eap \
84 xauth-generic \
85 xcbc
86
87 PKG_CONFIG_DEPENDS:= \
88 CONFIG_STRONGSWAN_ROUTING_TABLE \
89 CONFIG_STRONGSWAN_ROUTING_TABLE_PRIO \
90 $(patsubst %,CONFIG_PACKAGE_strongswan-mod-%,$(PKG_MOD_AVAILABLE)) \
91
92 PKG_FIXUP:=autoreconf
93 PKG_INSTALL:=1
94 PKG_BUILD_PARALLEL:=1
95
96 include $(INCLUDE_DIR)/package.mk
97
98 define Package/strongswan/Default
99 SUBMENU:=VPN
100 SECTION:=net
101 CATEGORY:=Network
102 TITLE:=StrongSwan
103 URL:=http://www.strongswan.org/
104 endef
105
106 define Package/strongswan/description/Default
107 StrongSwan is an OpenSource IPsec implementation for the Linux operating system.
108 endef
109
110 define Package/strongswan
111 $(call Package/strongswan/Default)
112 DEPENDS:= +libpthread +ip \
113 +kmod-crypto-authenc \
114 +kmod-ipsec +kmod-ipsec4 +kmod-ipsec6 \
115 +kmod-ipt-ipsec +iptables-mod-ipsec
116 endef
117
118 define Package/strongswan/config
119 source "$(SOURCE)/Config.in"
120 endef
121
122 define Package/strongswan/description
123 $(call Package/strongswan/description/Default)
124 This package contains shared libraries and scripts.
125 endef
126
127 define Package/strongswan-full
128 $(call Package/strongswan/Default)
129 TITLE+= (full)
130 DEPENDS:= +strongswan \
131 +strongswan-charon \
132 +strongswan-mod-addrblock \
133 +strongswan-mod-aes \
134 +strongswan-mod-af-alg \
135 +strongswan-mod-agent \
136 +strongswan-mod-attr \
137 +strongswan-mod-attr-sql \
138 +strongswan-mod-blowfish \
139 +strongswan-mod-ccm \
140 +strongswan-mod-cmac \
141 +strongswan-mod-constraints \
142 +strongswan-mod-coupling \
143 +strongswan-mod-ctr \
144 +strongswan-mod-curl \
145 +strongswan-mod-des \
146 +strongswan-mod-dhcp \
147 +strongswan-mod-dnskey \
148 +strongswan-mod-duplicheck \
149 +strongswan-mod-eap-identity \
150 +strongswan-mod-eap-md5 \
151 +strongswan-mod-eap-mschapv2 \
152 +strongswan-mod-eap-radius \
153 +strongswan-mod-farp \
154 +strongswan-mod-fips-prf \
155 +strongswan-mod-gcm \
156 +strongswan-mod-gcrypt \
157 +strongswan-mod-gmp \
158 +strongswan-mod-ha \
159 +strongswan-mod-hmac \
160 +strongswan-mod-kernel-netlink \
161 +strongswan-mod-ldap \
162 +strongswan-mod-led \
163 +strongswan-mod-load-tester \
164 +strongswan-mod-nonce \
165 +strongswan-mod-md4 \
166 +strongswan-mod-md5 \
167 +strongswan-mod-mysql \
168 +strongswan-mod-openssl \
169 +TARGET_x86:strongswan-mod-padlock \
170 +strongswan-mod-pem \
171 +strongswan-mod-pgp \
172 +strongswan-mod-pkcs1 \
173 +strongswan-mod-pkcs8 \
174 +strongswan-mod-pkcs11 \
175 +strongswan-mod-pubkey \
176 +strongswan-mod-random \
177 +strongswan-mod-resolve \
178 +strongswan-mod-revocation \
179 +strongswan-mod-sha1 \
180 +strongswan-mod-sha2 \
181 +strongswan-mod-smp \
182 +strongswan-mod-socket-default \
183 +strongswan-mod-sql \
184 +strongswan-mod-sqlite \
185 +strongswan-mod-stroke \
186 +strongswan-mod-test-vectors \
187 +strongswan-mod-uci \
188 +strongswan-mod-unity \
189 +strongswan-mod-updown \
190 +strongswan-mod-whitelist \
191 +strongswan-mod-x509 \
192 +strongswan-mod-xauth-eap \
193 +strongswan-mod-xauth-generic \
194 +strongswan-mod-xcbc \
195 +strongswan-utils \
196 @DEVEL
197 endef
198
199 define Package/strongswan-full/description
200 $(call Package/strongswan/description/Default)
201 This meta-package contains dependencies for all of the strongswan plugins
202 except kernel-libipsec,
203 socket-dynamic and which are ommitted in favor of the kernel-netlink and
204 socket-default plugins.
205 endef
206
207
208 define Package/strongswan-default
209 $(call Package/strongswan/Default)
210 TITLE+= (default)
211 DEPENDS:= +strongswan \
212 +strongswan-charon \
213 +strongswan-mod-aes \
214 +strongswan-mod-attr \
215 +strongswan-mod-constraints \
216 +strongswan-mod-des \
217 +strongswan-mod-dnskey \
218 +strongswan-mod-fips-prf \
219 +strongswan-mod-gmp \
220 +strongswan-mod-hmac \
221 +strongswan-mod-kernel-netlink \
222 +strongswan-mod-md5 \
223 +strongswan-mod-nonce \
224 +strongswan-mod-pem \
225 +strongswan-mod-pgp \
226 +strongswan-mod-pkcs1 \
227 +strongswan-mod-pubkey \
228 +strongswan-mod-random \
229 +strongswan-mod-resolve \
230 +strongswan-mod-revocation \
231 +strongswan-mod-sha1 \
232 +strongswan-mod-sha2 \
233 +strongswan-mod-socket-default \
234 +strongswan-mod-stroke \
235 +strongswan-mod-updown \
236 +strongswan-mod-x509 \
237 +strongswan-mod-xauth-generic \
238 +strongswan-mod-xcbc \
239 +strongswan-utils
240 endef
241
242 define Package/strongswan-default/description
243 $(call Package/strongswan/description/Default)
244 This meta-package contains only dependencies to match upstream defaults.
245 endef
246
247 define Package/strongswan-minimal
248 $(call Package/strongswan/Default)
249 TITLE+= (minimal)
250 DEPENDS:= +strongswan \
251 +strongswan-charon \
252 +strongswan-mod-aes \
253 +strongswan-mod-gmp \
254 +strongswan-mod-hmac \
255 +strongswan-mod-kernel-netlink \
256 +strongswan-mod-nonce \
257 +strongswan-mod-pubkey \
258 +strongswan-mod-random \
259 +strongswan-mod-sha1 \
260 +strongswan-mod-socket-default \
261 +strongswan-mod-stroke \
262 +strongswan-mod-updown \
263 +strongswan-mod-x509 \
264 +strongswan-mod-xcbc
265 endef
266
267 define Package/strongswan-minimal/description
268 $(call Package/strongswan/description/Default)
269 This meta-package contains only dependencies for a minimal IKEv2 setup.
270 endef
271
272 define Package/strongswan-charon
273 $(call Package/strongswan/Default)
274 TITLE+= IKEv1/IKEv2 keying daemon
275 DEPENDS:= +strongswan
276 endef
277
278 define Package/strongswan-charon/description
279 $(call Package/strongswan/description/Default)
280 This package contains charon, an IKEv2 keying daemon.
281 endef
282
283 define Package/strongswan-utils
284 $(call Package/strongswan/Default)
285 TITLE+= utilities
286 DEPENDS:= +strongswan
287 endef
288
289 define Package/strongswan-utils/description
290 $(call Package/strongswan/description/Default)
291 This package contains the pki & scepclient utilities.
292 endef
293
294 define BuildPlugin
295 define Package/strongswan-mod-$(1)
296 $$(call Package/strongswan/Default)
297 TITLE:= StrongSwan $(2) plugin
298 DEPENDS:= +strongswan $(3)
299 endef
300
301 strongswan_mod_conf=$(wildcard $(PKG_INSTALL_DIR)/etc/strongswan.d/charon/$(1).conf)
302 define Package/strongswan-mod-$(1)/install
303 $(INSTALL_DIR) $$(1)/etc/strongswan.d/charon
304 $(if $(call strongswan_mod_conf,$(1)), \
305 $(INSTALL_DATA) \
306 $(call strongswan_mod_conf,$(1)) \
307 $$(1)/etc/strongswan.d/charon/ \
308 )
309 $(INSTALL_DIR) $$(1)/usr/lib/ipsec/plugins
310 $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/plugins/libstrongswan-$(1).so \
311 $$(1)/usr/lib/ipsec/plugins/
312 $(call Plugin/$(1)/install,$$(1))
313 endef
314
315 Package/strongswan-mod-$(1)/conffiles=$(patsubst $(PKG_INSTALL_DIR)%,%,$(call strongswan_mod_conf,$(1)))
316
317 $$(eval $$(call BuildPackage,strongswan-mod-$(1)))
318 endef
319
320 CONFIGURE_ARGS+= \
321 --disable-scripts \
322 --disable-static \
323 --disable-fast \
324 --with-systemdsystemunitdir=no \
325 $(if $(CONFIG_PACKAGE_strongswan-utils),--enable-pki --enable-scepclient,--disable-pki --disable-scepclient) \
326 --with-random-device=/dev/random \
327 --with-urandom-device=/dev/urandom \
328 --with-routing-table="$(call qstrip,$(CONFIG_STRONGSWAN_ROUTING_TABLE))" \
329 --with-routing-table-prio="$(call qstrip,$(CONFIG_STRONGSWAN_ROUTING_TABLE_PRIO))" \
330 $(foreach m,$(PKG_MOD_AVAILABLE), \
331 $(if $(CONFIG_PACKAGE_strongswan-mod-$(m)),--enable-$(m),--disable-$(m)) \
332 )
333
334 EXTRA_LDFLAGS+= -Wl,-rpath-link,$(STAGING_DIR)/usr/lib
335
336 define Package/strongswan/conffiles
337 /etc/ipsec.conf
338 /etc/ipsec.secrets
339 /etc/ipsec.user
340 /etc/strongswan.conf
341 endef
342
343 define Package/strongswan/install
344 $(INSTALL_DIR) $(1)/etc
345 $(CP) $(PKG_INSTALL_DIR)/etc/strongswan.conf $(1)/etc/
346 $(INSTALL_DIR) $(1)/usr/lib/ipsec
347 $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/{libstrongswan.so.*,libhydra.so.*} $(1)/usr/lib/ipsec/
348 $(INSTALL_CONF) ./files/ipsec.secrets $(1)/etc/
349 $(INSTALL_DIR) $(1)/etc/init.d
350 $(INSTALL_BIN) ./files/ipsec.init $(1)/etc/init.d/ipsec
351 endef
352
353 define Package/strongswan-default/install
354 true
355 endef
356
357 define Package/strongswan-full/install
358 true
359 endef
360
361 define Package/strongswan-minimal/install
362 true
363 endef
364
365 define Package/strongswan-charon/install
366 $(INSTALL_DIR) $(1)/usr/lib/ipsec
367 $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/lib/ipsec/charon $(1)/usr/lib/ipsec/
368 $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/libcharon.so.* $(1)/usr/lib/ipsec/
369 endef
370
371 define Package/strongswan-utils/install
372 $(INSTALL_DIR) $(1)/usr/sbin
373 $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/ipsec $(1)/usr/sbin/
374 $(INSTALL_DIR) $(1)/usr/bin
375 $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/pki $(1)/usr/bin/
376 $(INSTALL_DIR) $(1)/usr/lib/ipsec
377 $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/lib/ipsec/scepclient $(1)/usr/lib/ipsec/
378 endef
379
380 define Plugin/duplicheck/install
381 $(INSTALL_DIR) $(1)/usr/lib/ipsec/plugins
382 $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/duplicheck $(1)/usr/lib/ipsec/
383 $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/plugins/libstrongswan-duplicheck.so $(1)/usr/lib/ipsec/plugins/
384 endef
385
386 define Plugin/eap-radius/install
387 $(INSTALL_DIR) $(1)/usr/lib/ipsec/plugins
388 $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/libradius.so.* $(1)/usr/lib/ipsec/
389 $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/plugins/libstrongswan-eap-radius.so $(1)/usr/lib/ipsec/plugins/
390 endef
391
392 define Plugin/attr-sql/install
393 $(INSTALL_DIR) $(1)/usr/lib/ipsec
394 $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/pool $(1)/usr/lib/ipsec/
395 endef
396
397 define Plugin/stroke/install
398 $(INSTALL_DIR) $(1)/etc/ipsec.d/aacerts
399 $(INSTALL_DIR) $(1)/etc/ipsec.d/acerts
400 $(INSTALL_DIR) $(1)/etc/ipsec.d/cacerts
401 $(INSTALL_DIR) $(1)/etc/ipsec.d/certs
402 $(INSTALL_DIR) $(1)/etc/ipsec.d/crls
403 $(INSTALL_DIR) $(1)/etc/ipsec.d/ocspcerts
404 $(INSTALL_DIR) $(1)/etc/ipsec.d/private
405 $(INSTALL_DIR) $(1)/etc/ipsec.d/reqs
406
407 $(INSTALL_CONF) $(PKG_INSTALL_DIR)/etc/ipsec.conf $(1)/etc/
408
409 $(INSTALL_DIR) $(1)/usr/lib/ipsec/plugins
410 $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/lib/ipsec/{starter,stroke} $(1)/usr/lib/ipsec/
411 $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/plugins/libstrongswan-stroke.so $(1)/usr/lib/ipsec/plugins/
412 endef
413
414 define Plugin/updown/install
415 $(INSTALL_DIR) $(1)/usr/lib/ipsec/plugins
416 $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/{_updown,_updown_espmark} $(1)/usr/lib/ipsec/
417 $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/plugins/libstrongswan-updown.so $(1)/usr/lib/ipsec/plugins/
418 $(INSTALL_DIR) $(1)/etc
419 $(INSTALL_CONF) ./files/ipsec.user $(1)/etc/
420 endef
421
422 define Plugin/whitelist/install
423 $(INSTALL_DIR) $(1)/usr/lib/ipsec/plugins
424 $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/whitelist $(1)/usr/lib/ipsec/
425 $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/plugins/libstrongswan-whitelist.so $(1)/usr/lib/ipsec/plugins/
426 endef
427
428 define Plugin/kernel-libipsec/install
429 $(INSTALL_DIR) $(1)/usr/lib/ipsec
430 $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/libipsec.so.* $(1)/usr/lib/ipsec/
431 endef
432
433 $(eval $(call BuildPackage,strongswan))
434 $(eval $(call BuildPackage,strongswan-default))
435 $(eval $(call BuildPackage,strongswan-full))
436 $(eval $(call BuildPackage,strongswan-minimal))
437 $(eval $(call BuildPackage,strongswan-charon))
438 $(eval $(call BuildPackage,strongswan-utils))
439 $(eval $(call BuildPlugin,addrblock,RFC 3779 address block constraint support,))
440 $(eval $(call BuildPlugin,aes,AES crypto,))
441 $(eval $(call BuildPlugin,af-alg,AF_ALG crypto interface to Linux Crypto API,+kmod-crypto-user))
442 $(eval $(call BuildPlugin,agent,SSH agent signing,))
443 $(eval $(call BuildPlugin,attr,file based config,))
444 $(eval $(call BuildPlugin,attr-sql,SQL based config,+strongswan-mod-sql))
445 $(eval $(call BuildPlugin,blowfish,Blowfish crypto,))
446 $(eval $(call BuildPlugin,ccm,CCM AEAD wrapper crypto,))
447 $(eval $(call BuildPlugin,cmac,CMAC crypto,))
448 $(eval $(call BuildPlugin,constraints,advanced X509 constraint checking,))
449 $(eval $(call BuildPlugin,coupling,IKEv2 plugin to couple peer certificates permanently to authentication,))
450 $(eval $(call BuildPlugin,ctr,Counter Mode wrapper crypto,))
451 $(eval $(call BuildPlugin,curl,cURL fetcher plugin,+PACKAGE_strongswan-mod-curl:libcurl))
452 $(eval $(call BuildPlugin,des,DES crypto,))
453 $(eval $(call BuildPlugin,dhcp,DHCP based attribute provider,))
454 $(eval $(call BuildPlugin,dnskey,DNS RR key decoding,))
455 $(eval $(call BuildPlugin,duplicheck,advanced duplicate checking,))
456 $(eval $(call BuildPlugin,eap-identity,EAP identity helper,))
457 $(eval $(call BuildPlugin,eap-md5,EAP MD5 (CHAP) EAP auth,))
458 $(eval $(call BuildPlugin,eap-mschapv2,EAP MS-CHAPv2 EAP auth,+strongswan-mod-md4 +strongswan-mod-des))
459 $(eval $(call BuildPlugin,eap-radius,EAP RADIUS auth,))
460 $(eval $(call BuildPlugin,farp,fake arp respsonses,))
461 $(eval $(call BuildPlugin,fips-prf,FIPS PRF crypto,+strongswan-mod-sha1))
462 $(eval $(call BuildPlugin,gcm,GCM AEAD wrapper crypto,))
463 $(eval $(call BuildPlugin,gcrypt,libgcrypt,+PACKAGE_strongswan-mod-gcrypt:libgcrypt))
464 $(eval $(call BuildPlugin,gmp,libgmp,+PACKAGE_strongswan-mod-gmp:libgmp))
465 $(eval $(call BuildPlugin,ha,high availability cluster,))
466 $(eval $(call BuildPlugin,hmac,HMAC crypto,))
467 $(eval $(call BuildPlugin,kernel-libipsec,libipsec kernel interface,))
468 $(eval $(call BuildPlugin,kernel-netlink,netlink kernel interface,))
469 $(eval $(call BuildPlugin,ldap,LDAP,+PACKAGE_strongswan-mod-ldap:libopenldap))
470 $(eval $(call BuildPlugin,led,LED blink on IKE activity,))
471 $(eval $(call BuildPlugin,load-tester,load testing,))
472 $(eval $(call BuildPlugin,nonce,nonce genereation,))
473 $(eval $(call BuildPlugin,md4,MD4 crypto,))
474 $(eval $(call BuildPlugin,md5,MD5 crypto,))
475 $(eval $(call BuildPlugin,mysql,MySQL database interface,+strongswan-mod-sql +PACKAGE_strongswan-mod-mysql:libmysqlclient-r))
476 $(eval $(call BuildPlugin,openssl,OpenSSL crypto,+PACKAGE_strongswan-mod-openssl:libopenssl))
477 $(eval $(call BuildPlugin,padlock,VIA PadLock crypto,@TARGET_x86))
478 $(eval $(call BuildPlugin,pem,PEM decoding,))
479 $(eval $(call BuildPlugin,pgp,PGP key decoding,))
480 $(eval $(call BuildPlugin,pkcs1,PKCS1 key decoding,))
481 $(eval $(call BuildPlugin,pkcs8,PKCS8 key decoding,))
482 $(eval $(call BuildPlugin,pkcs11,PKCS11 key decoding,))
483 $(eval $(call BuildPlugin,pubkey,raw public key,))
484 $(eval $(call BuildPlugin,random,RNG,))
485 $(eval $(call BuildPlugin,resolve,DNS resolver,))
486 $(eval $(call BuildPlugin,revocation,X509 CRL/OCSP revocation,))
487 $(eval $(call BuildPlugin,sha1,SHA1 crypto,))
488 $(eval $(call BuildPlugin,sha2,SHA2 crypto,))
489 $(eval $(call BuildPlugin,smp,SMP configuration and control interface,+PACKAGE_strongswan-mod-smp:libxml2))
490 $(eval $(call BuildPlugin,socket-default,default socket implementation for charon,))
491 $(eval $(call BuildPlugin,socket-dynamic,dynamic socket implementation for charon,))
492 $(eval $(call BuildPlugin,sql,SQL database interface,))
493 $(eval $(call BuildPlugin,sqlite,SQLite database interface,+strongswan-mod-sql +PACKAGE_strongswan-mod-sqlite:libsqlite3))
494 $(eval $(call BuildPlugin,stroke,Stroke,+strongswan-utils))
495 $(eval $(call BuildPlugin,test-vectors,crypto test vectors,))
496 $(eval $(call BuildPlugin,uci,UCI config interface,+PACKAGE_strongswan-mod-uci:libuci))
497 $(eval $(call BuildPlugin,unity,Cisco Unity extension,))
498 $(eval $(call BuildPlugin,updown,updown firewall,))
499 $(eval $(call BuildPlugin,whitelist,peer identity whitelisting,))
500 $(eval $(call BuildPlugin,x509,x509 certificate,))
501 $(eval $(call BuildPlugin,xauth-eap,EAP XAuth backend,))
502 $(eval $(call BuildPlugin,xauth-generic,generic XAuth backend,))
503 $(eval $(call BuildPlugin,xcbc,xcbc crypto,))