net/strongswan/Makefile

   1 #
   2 # Copyright (C) 2012-2013 OpenWrt.org
   3 #
   4 # This is free software, licensed under the GNU General Public License v2.
   5 # See /LICENSE for more information.
   6 #
   7
   8 include $(TOPDIR)/rules.mk
   9
  10 PKG_NAME:=strongswan
  11 PKG_VERSION:=5.0.2
  12 PKG_RELEASE:=1
  13
  14 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
  15 PKG_SOURCE_URL:=http://download.strongswan.org/
  16 PKG_MD5SUM:=77dc16443fd141f46183d3a4f60986ef
  17
  18 PKG_MOD_AVAILABLE:= \
  19         addrblock \
  20         aes \
  21         af-alg \
  22         agent \
  23         attr \
  24         attr-sql \
  25         blowfish \
  26         ccm \
  27         cmac \
  28         constraints \
  29         coupling \
  30         ctr \
  31         curl \
  32         des \
  33         dhcp \
  34         dnskey \
  35         duplicheck \
  36         eap-identity \
  37         eap-md5 \
  38         eap-mschapv2 \
  39         farp \
  40         fips-prf \
  41         gcm \
  42         gcrypt \
  43         gmp \
  44         ha \
  45         hmac \
  46         kernel-klips \
  47         kernel-netlink \
  48         kernel-pfkey \
  49         ldap \
  50         led \
  51         load-tester \
  52         nonce \
  53         md4 \
  54         md5 \
  55         mysql \
  56         openssl \
  57         padlock \
  58         pem \
  59         pgp \
  60         pkcs1 \
  61         pkcs8 \
  62         pkcs11 \
  63         pubkey \
  64         random \
  65         resolve \
  66         revocation \
  67         sha1 \
  68         sha2 \
  69         smp \
  70         socket-default \
  71         socket-dynamic \
  72         sql \
  73         sqlite \
  74         stroke \
  75         test-vectors \
  76         unity \
  77         uci \
  78         updown \
  79         whitelist \
  80         x509 \
  81         xauth-eap \
  82         xauth-generic \
  83         xcbc \
  84
  85 PKG_CONFIG_DEPENDS:= \
  86         CONFIG_STRONGSWAN_DEVICE_RANDOM \
  87         CONFIG_STRONGSWAN_DEVICE_URANDOM \
  88         CONFIG_STRONGSWAN_ROUTING_TABLE \
  89         CONFIG_STRONGSWAN_ROUTING_TABLE_PRIO \
  90         $(patsubst %,CONFIG_PACKAGE_strongswan-mod-%,$(PKG_MOD_AVAILABLE)) \
  91
  92 PKG_FIXUP:=autoreconf
  93 PKG_INSTALL:=1
  94 PKG_BUILD_PARALLEL:=1
  95
  96 include $(INCLUDE_DIR)/package.mk
  97
  98 define Package/strongswan/Default
  99   SUBMENU:=VPN
 100   SECTION:=net
 101   CATEGORY:=Network
 102   TITLE:=StrongSwan
 103   URL:=http://www.strongswan.org/
 104 endef
 105
 106 define Package/strongswan/description/Default
 107  StrongSwan is an OpenSource IPsec implementation for the Linux operating system.
 108 endef
 109
 110 define Package/strongswan
 111 $(call Package/strongswan/Default)
 112   DEPENDS:= +libpthread +ip \
 113         +kmod-crypto-authenc \
 114         +kmod-ipsec +kmod-ipsec4 +kmod-ipsec6 \
 115         +kmod-ipt-ipsec +iptables-mod-ipsec
 116 endef
 117
 118 define Package/strongswan/config
 119   source "$(SOURCE)/Config.in"
 120 endef
 121
 122 define Package/strongswan/description
 123 $(call Package/strongswan/description/Default)
 124  This package contains shared libraries and scripts.
 125 endef
 126
 127 define Package/strongswan-full
 128 $(call Package/strongswan/Default)
 129   TITLE+= (full)
 130   DEPENDS:= +strongswan \
 131         +strongswan-charon \
 132         +strongswan-libfast \
 133         +strongswan-mod-addrblock \
 134         +strongswan-mod-aes \
 135         +strongswan-mod-af-alg \
 136         +strongswan-mod-agent \
 137         +strongswan-mod-attr \
 138         +strongswan-mod-attr-sql \
 139         +strongswan-mod-blowfish \
 140         +strongswan-mod-ccm \
 141         +strongswan-mod-cmac \
 142         +strongswan-mod-constraints \
 143         +strongswan-mod-coupling \
 144         +strongswan-mod-ctr \
 145         +strongswan-mod-curl \
 146         +strongswan-mod-des \
 147         +strongswan-mod-dhcp \
 148         +strongswan-mod-dnskey \
 149         +strongswan-mod-duplicheck \
 150         +strongswan-mod-eap-identity \
 151         +strongswan-mod-eap-md5 \
 152         +strongswan-mod-eap-mschapv2 \
 153         +strongswan-mod-farp \
 154         +strongswan-mod-fips-prf \
 155         +strongswan-mod-gcm \
 156         +strongswan-mod-gcrypt \
 157         +strongswan-mod-gmp \
 158         +strongswan-mod-ha \
 159         +strongswan-mod-hmac \
 160         +strongswan-mod-kernel-netlink \
 161         +strongswan-mod-ldap \
 162         +strongswan-mod-led \
 163         +strongswan-mod-load-tester \
 164         +strongswan-mod-nonce \
 165         +strongswan-mod-md4 \
 166         +strongswan-mod-md5 \
 167         +strongswan-mod-mysql \
 168         +strongswan-mod-openssl \
 169         +TARGET_x86:strongswan-mod-padlock \
 170         +strongswan-mod-pem \
 171         +strongswan-mod-pgp \
 172         +strongswan-mod-pkcs1 \
 173         +strongswan-mod-pkcs8 \
 174         +strongswan-mod-pkcs11 \
 175         +strongswan-mod-pubkey \
 176         +strongswan-mod-random \
 177         +strongswan-mod-resolve \
 178         +strongswan-mod-revocation \
 179         +strongswan-mod-sha1 \
 180         +strongswan-mod-sha2 \
 181         +strongswan-mod-smp \
 182         +strongswan-mod-socket-default \
 183         +strongswan-mod-sql \
 184         +strongswan-mod-sqlite \
 185         +strongswan-mod-stroke \
 186         +strongswan-mod-test-vectors \
 187         +strongswan-mod-uci \
 188         +strongswan-mod-unity \
 189         +strongswan-mod-updown \
 190         +strongswan-mod-whitelist \
 191         +strongswan-mod-x509 \
 192         +strongswan-mod-xauth-eap \
 193         +strongswan-mod-xauth-generic \
 194         +strongswan-mod-xcbc \
 195         +strongswan-utils \
 196         @DEVEL
 197 endef
 198
 199 define Package/strongswan-full/description
 200 $(call Package/strongswan/description/Default)
 201  This meta-package contains dependencies for all of the strongswan plugins
 202  except kernel-klips, kernel-pfkey, socket-dynamic and which are
 203  ommitted in favor of the kernel-netlink and socket-default plugins.
 204 endef
 205
 206
 207 define Package/strongswan-default
 208 $(call Package/strongswan/Default)
 209   TITLE+= (default)
 210   DEPENDS:= +strongswan \
 211         +strongswan-charon \
 212         +strongswan-mod-aes \
 213         +strongswan-mod-attr \
 214         +strongswan-mod-constraints \
 215         +strongswan-mod-des \
 216         +strongswan-mod-dnskey \
 217         +strongswan-mod-fips-prf \
 218         +strongswan-mod-gmp \
 219         +strongswan-mod-hmac \
 220         +strongswan-mod-kernel-netlink \
 221         +strongswan-mod-md5 \
 222         +strongswan-mod-nonce \
 223         +strongswan-mod-pem \
 224         +strongswan-mod-pgp \
 225         +strongswan-mod-pkcs1 \
 226         +strongswan-mod-pubkey \
 227         +strongswan-mod-random \
 228         +strongswan-mod-resolve \
 229         +strongswan-mod-revocation \
 230         +strongswan-mod-sha1 \
 231         +strongswan-mod-sha2 \
 232         +strongswan-mod-socket-default \
 233         +strongswan-mod-stroke \
 234         +strongswan-mod-updown \
 235         +strongswan-mod-x509 \
 236         +strongswan-mod-xauth-generic \
 237         +strongswan-mod-xcbc \
 238         +strongswan-utils
 239 endef
 240
 241 define Package/strongswan-default/description
 242 $(call Package/strongswan/description/Default)
 243  This meta-package contains only dependencies to match upstream defaults.
 244 endef
 245
 246 define Package/strongswan-minimal
 247 $(call Package/strongswan/Default)
 248   TITLE+= (minimal)
 249   DEPENDS:= +strongswan \
 250         +strongswan-charon \
 251         +strongswan-mod-aes \
 252         +strongswan-mod-gmp \
 253         +strongswan-mod-hmac \
 254         +strongswan-mod-kernel-netlink \
 255         +strongswan-mod-nonce \
 256         +strongswan-mod-pubkey \
 257         +strongswan-mod-random \
 258         +strongswan-mod-sha1 \
 259         +strongswan-mod-socket-default \
 260         +strongswan-mod-stroke \
 261         +strongswan-mod-updown \
 262         +strongswan-mod-x509 \
 263         +strongswan-mod-xcbc
 264 endef
 265
 266 define Package/strongswan-minimal/description
 267 $(call Package/strongswan/description/Default)
 268  This meta-package contains only dependencies for a minimal IKEv2 setup.
 269 endef
 270
 271 define Package/strongswan-charon
 272 $(call Package/strongswan/Default)
 273   TITLE+= IKEv1/IKEv2 keying daemon
 274   DEPENDS:= +strongswan
 275 endef
 276
 277 define Package/strongswan-charon/description
 278 $(call Package/strongswan/description/Default)
 279  This package contains charon, an IKEv2 keying daemon.
 280 endef
 281
 282 define Package/strongswan-libfast
 283 $(call Package/strongswan/Default)
 284   TITLE+= libfast
 285   DEPENDS:= +strongswan \
 286                 +PACKAGE_strongswan-libfast:zlib \
 287                 +PACKAGE_strongswan-libfast:fcgi \
 288                 +PACKAGE_strongswan-libfast:clearsilver
 289 endef
 290
 291 define Package/strongswan-libfast/description
 292 $(call Package/strongswan/description/Default)
 293  This package contains libfast, a lightweight framework to build native web
 294  applications using ClearSilver and FastCGI.
 295 endef
 296
 297 define Package/strongswan-utils
 298 $(call Package/strongswan/Default)
 299   TITLE+= utilities
 300   DEPENDS:= +strongswan
 301 endef
 302
 303 define Package/strongswan-utils/description
 304 $(call Package/strongswan/description/Default)
 305  This package contains the openac, pki & scepclient utilities.
 306 endef
 307
 308 define BuildPlugin
 309   define Package/strongswan-mod-$(1)
 310     $$(call Package/strongswan/Default)
 311     TITLE:= StrongSwan $(2) plugin
 312     DEPENDS:= +strongswan $(3)
 313   endef
 314
 315   define Package/strongswan-mod-$(1)/install
 316         $(INSTALL_DIR) $$(1)/usr/lib/ipsec/plugins
 317         $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/plugins/libstrongswan-$(1).so \
 318                 $$(1)/usr/lib/ipsec/plugins/
 319         $(call Plugin/$(1)/install,$$(1))
 320   endef
 321
 322   $$(eval $$(call BuildPackage,strongswan-mod-$(1)))
 323 endef
 324
 325 CONFIGURE_ARGS+= \
 326         --disable-scripts \
 327         --disable-static \
 328         $(if $(CONFIG_PACKAGE_strongswan-libfast),--enable-fast,--disable-fast) \
 329         $(if $(CONFIG_PACKAGE_strongswan-utils),--enable-tools,--disable-tools) \
 330         --with-random-device="$(call qstrip,$(CONFIG_STRONGSWAN_DEVICE_RANDOM))" \
 331         --with-urandom-device="$(call qstrip,$(CONFIG_STRONGSWAN_DEVICE_URANDOM))" \
 332         --with-routing-table="$(call qstrip,$(CONFIG_STRONGSWAN_ROUTING_TABLE))" \
 333         --with-routing-table-prio="$(call qstrip,$(CONFIG_STRONGSWAN_ROUTING_TABLE_PRIO))" \
 334         $(foreach m,$(PKG_MOD_AVAILABLE), \
 335           $(if $(CONFIG_PACKAGE_strongswan-mod-$(m)),--enable-$(m),--disable-$(m)) \
 336         )
 337
 338 ifneq ($(CONFIG_PACKAGE_strongswan-libfast),)
 339   EXTRA_CPPFLAGS+= -I$(STAGING_DIR)/usr/include/ClearSilver
 340 endif
 341
 342 EXTRA_LDFLAGS+= -Wl,-rpath-link,$(STAGING_DIR)/usr/lib
 343
 344 define Package/strongswan/conffiles
 345 /etc/ipsec.conf
 346 /etc/ipsec.secrets
 347 /etc/strongswan.conf
 348 endef
 349
 350 define Package/strongswan/install
 351         $(INSTALL_DIR) $(1)/etc
 352         $(CP) $(PKG_INSTALL_DIR)/etc/strongswan.conf $(1)/etc/
 353         $(INSTALL_DIR) $(1)/usr/lib/ipsec
 354         $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/{libstrongswan.so.*,libhydra.so.*} $(1)/usr/lib/ipsec/
 355         $(INSTALL_CONF) ./files/ipsec.secrets $(1)/etc/
 356 endef
 357
 358 define Package/strongswan-default/install
 359         true
 360 endef
 361
 362 define Package/strongswan-full/install
 363         true
 364 endef
 365
 366 define Package/strongswan-minimal/install
 367         true
 368 endef
 369
 370 define Package/strongswan-charon/install
 371         $(INSTALL_DIR) $(1)/usr/lib/ipsec
 372         $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/lib/ipsec/charon $(1)/usr/lib/ipsec/
 373         $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/libcharon.so.* $(1)/usr/lib/ipsec/
 374 endef
 375
 376 define Package/strongswan-libfast/install
 377         $(INSTALL_DIR) $(1)/usr/lib/ipsec
 378         $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/libfast.so.* $(1)/usr/lib/ipsec/
 379 endef
 380
 381 define Package/strongswan-utils/install
 382         $(INSTALL_DIR) $(1)/usr/sbin
 383         $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/ipsec $(1)/usr/sbin/
 384         $(INSTALL_DIR) $(1)/usr/lib/ipsec
 385         $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/lib/ipsec/{openac,pki,scepclient} $(1)/usr/lib/ipsec/
 386 endef
 387
 388 define Plugin/duplicheck/install
 389         $(INSTALL_DIR) $(1)/usr/lib/ipsec/plugins
 390         $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/duplicheck $(1)/usr/lib/ipsec/
 391         $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/plugins/libstrongswan-duplicheck.so $(1)/usr/lib/ipsec/plugins/
 392 endef
 393
 394 define Plugin/attr-sql/install
 395         $(INSTALL_DIR) $(1)/usr/lib/ipsec
 396         $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/pool $(1)/usr/lib/ipsec/
 397 endef
 398
 399 define Plugin/stroke/install
 400         $(INSTALL_DIR) $(1)/etc/ipsec.d/aacerts
 401         $(INSTALL_DIR) $(1)/etc/ipsec.d/acerts
 402         $(INSTALL_DIR) $(1)/etc/ipsec.d/cacerts
 403         $(INSTALL_DIR) $(1)/etc/ipsec.d/certs
 404         $(INSTALL_DIR) $(1)/etc/ipsec.d/crls
 405         $(INSTALL_DIR) $(1)/etc/ipsec.d/ocspcerts
 406         $(INSTALL_DIR) $(1)/etc/ipsec.d/private
 407         $(INSTALL_DIR) $(1)/etc/ipsec.d/reqs
 408
 409         $(INSTALL_CONF) $(PKG_INSTALL_DIR)/etc/ipsec.conf $(1)/etc/
 410
 411         $(INSTALL_DIR) $(1)/usr/lib/ipsec/plugins
 412         $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/lib/ipsec/{starter,stroke} $(1)/usr/lib/ipsec/
 413         $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/plugins/libstrongswan-stroke.so $(1)/usr/lib/ipsec/plugins/
 414 endef
 415
 416 define Plugin/updown/install
 417         $(INSTALL_DIR) $(1)/usr/lib/ipsec/plugins
 418         $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/{_updown,_updown_espmark} $(1)/usr/lib/ipsec/
 419         $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/plugins/libstrongswan-updown.so $(1)/usr/lib/ipsec/plugins/
 420 endef
 421
 422 define Plugin/whitelist/install
 423         $(INSTALL_DIR) $(1)/usr/lib/ipsec/plugins
 424         $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/whitelist $(1)/usr/lib/ipsec/
 425         $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/plugins/libstrongswan-whitelist.so $(1)/usr/lib/ipsec/plugins/
 426 endef
 427
 428 $(eval $(call BuildPackage,strongswan))
 429 $(eval $(call BuildPackage,strongswan-default))
 430 $(eval $(call BuildPackage,strongswan-full))
 431 $(eval $(call BuildPackage,strongswan-minimal))
 432 $(eval $(call BuildPackage,strongswan-charon))
 433 $(eval $(call BuildPackage,strongswan-libfast))
 434 $(eval $(call BuildPackage,strongswan-utils))
 435 $(eval $(call BuildPlugin,addrblock,RFC 3779 address block constraint support,))
 436 $(eval $(call BuildPlugin,aes,AES crypto,))
 437 $(eval $(call BuildPlugin,af-alg,AF_ALG crypto interface to Linux Crypto API,+kmod-crypto-user))
 438 $(eval $(call BuildPlugin,agent,SSH agent signing,))
 439 $(eval $(call BuildPlugin,attr,file based config,))
 440 $(eval $(call BuildPlugin,attr-sql,SQL based config,+strongswan-mod-sql))
 441 $(eval $(call BuildPlugin,blowfish,Blowfish crypto,))
 442 $(eval $(call BuildPlugin,ccm,CCM AEAD wrapper crypto,))
 443 $(eval $(call BuildPlugin,cmac,CMAC crypto,))
 444 $(eval $(call BuildPlugin,constraints,advanced X509 constraint checking,))
 445 $(eval $(call BuildPlugin,coupling,IKEv2 plugin to couple peer certificates permanently to authentication,))
 446 $(eval $(call BuildPlugin,ctr,Counter Mode wrapper crypto,))
 447 $(eval $(call BuildPlugin,curl,cURL fetcher plugin,+PACKAGE_strongswan-mod-curl:libcurl))
 448 $(eval $(call BuildPlugin,des,DES crypto,))
 449 $(eval $(call BuildPlugin,dhcp,DHCP based attribute provider,))
 450 $(eval $(call BuildPlugin,dnskey,DNS RR key decoding,))
 451 $(eval $(call BuildPlugin,duplicheck,advanced duplicate checking,))
 452 $(eval $(call BuildPlugin,eap-identity,EAP identity helper,))
 453 $(eval $(call BuildPlugin,eap-md5,EAP MD5 (CHAP) EAP auth,))
 454 $(eval $(call BuildPlugin,eap-mschapv2,EAP MS-CHAPv2 EAP auth,))
 455 $(eval $(call BuildPlugin,farp,fake arp respsonses,))
 456 $(eval $(call BuildPlugin,fips-prf,FIPS PRF crypto,+strongswan-mod-sha1))
 457 $(eval $(call BuildPlugin,gcm,GCM AEAD wrapper crypto,))
 458 $(eval $(call BuildPlugin,gcrypt,libgcrypt,+PACKAGE_strongswan-mod-gcrypt:libgcrypt))
 459 $(eval $(call BuildPlugin,gmp,libgmp,+PACKAGE_strongswan-mod-gmp:libgmp))
 460 $(eval $(call BuildPlugin,ha,high availability cluster,))
 461 $(eval $(call BuildPlugin,hmac,HMAC crypto,))
 462 $(eval $(call BuildPlugin,kernel-klips,KLIPS kernel interface,))
 463 $(eval $(call BuildPlugin,kernel-netlink,netlink kernel interface,))
 464 $(eval $(call BuildPlugin,kernel-pfkey,PK_KEY kernel interface,))
 465 $(eval $(call BuildPlugin,ldap,LDAP,+PACKAGE_strongswan-mod-ldap:libopenldap))
 466 $(eval $(call BuildPlugin,led,LED blink on IKE activity,))
 467 $(eval $(call BuildPlugin,load-tester,load testing,))
 468 $(eval $(call BuildPlugin,nonce,nonce genereation,))
 469 $(eval $(call BuildPlugin,md4,MD4 crypto,))
 470 $(eval $(call BuildPlugin,md5,MD5 crypto,))
 471 $(eval $(call BuildPlugin,mysql,MySQL database interface,+strongswan-mod-sql +PACKAGE_strongswan-mod-mysql:libmysqlclient-r))
 472 $(eval $(call BuildPlugin,openssl,OpenSSL crypto,+PACKAGE_strongswan-mod-openssl:libopenssl))
 473 $(eval $(call BuildPlugin,padlock,VIA PadLock crypto,@TARGET_x86))
 474 $(eval $(call BuildPlugin,pem,PEM decoding,))
 475 $(eval $(call BuildPlugin,pgp,PGP key decoding,))
 476 $(eval $(call BuildPlugin,pkcs1,PKCS1 key decoding,))
 477 $(eval $(call BuildPlugin,pkcs8,PKCS8 key decoding,))
 478 $(eval $(call BuildPlugin,pkcs11,PKCS11 key decoding,))
 479 $(eval $(call BuildPlugin,pubkey,raw public key,))
 480 $(eval $(call BuildPlugin,random,RNG,))
 481 $(eval $(call BuildPlugin,resolve,DNS resolver,))
 482 $(eval $(call BuildPlugin,revocation,X509 CRL/OCSP revocation,))
 483 $(eval $(call BuildPlugin,sha1,SHA1 crypto,))
 484 $(eval $(call BuildPlugin,sha2,SHA2 crypto,))
 485 $(eval $(call BuildPlugin,smp,SMP configuration and control interface,+PACKAGE_strongswan-mod-smp:libxml2))
 486 $(eval $(call BuildPlugin,socket-default,default socket implementation for charon,))
 487 $(eval $(call BuildPlugin,socket-dynamic,dynamic socket implementation for charon,))
 488 $(eval $(call BuildPlugin,sql,SQL database interface,))
 489 $(eval $(call BuildPlugin,sqlite,SQLite database interface,+strongswan-mod-sql +PACKAGE_strongswan-mod-sqlite:libsqlite3))
 490 $(eval $(call BuildPlugin,stroke,Stroke,+strongswan-utils))
 491 $(eval $(call BuildPlugin,test-vectors,crypto test vectors,))
 492 $(eval $(call BuildPlugin,uci,UCI config interface,+PACKAGE_strongswan-mod-uci:libuci))
 493 $(eval $(call BuildPlugin,unity,Cisco Unity extension,))
 494 $(eval $(call BuildPlugin,updown,updown firewall,))
 495 $(eval $(call BuildPlugin,whitelist,peer identity whitelisting,))
 496 $(eval $(call BuildPlugin,x509,x509 certificate,))
 497 $(eval $(call BuildPlugin,xauth-eap,EAP XAuth backend,))
 498 $(eval $(call BuildPlugin,xauth-generic,generic XAuth backend,))
 499 $(eval $(call BuildPlugin,xcbc,xcbc crypto,))