commit: a0f872033e85edb4868f76650fa205cd7d10bd07 Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org> AuthorDate: Mon May 24 01:16:04 2021 +0000 Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org> CommitDate: Mon May 24 01:19:18 2021 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a0f87203
net-vpn/openvpn: security cleanup Bug: https://bugs.gentoo.org/785115 Package-Manager: Portage-3.0.18, Repoman-3.0.3 Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org> net-vpn/openvpn/Manifest | 3 - net-vpn/openvpn/openvpn-2.4.9.ebuild | 170 ------------------------------- net-vpn/openvpn/openvpn-2.5.0-r1.ebuild | 169 ------------------------------- net-vpn/openvpn/openvpn-2.5.1-r1.ebuild | 171 -------------------------------- 4 files changed, 513 deletions(-) diff --git a/net-vpn/openvpn/Manifest b/net-vpn/openvpn/Manifest index 109a33040d1..63f99fb3f7f 100644 --- a/net-vpn/openvpn/Manifest +++ b/net-vpn/openvpn/Manifest @@ -1,4 +1 @@ -DIST openvpn-2.4.9.tar.gz 1000602 BLAKE2B 4a10ec76d1a816f9184dd33e4384623e011a1af40ea38ad56cc06f70ab2c911b6fd92cf8ffcd2ec3ab4179fef87feb187fc9df61c5bea92b1c69ee4113093866 SHA512 7683dfb93592968459f080a07ea750992b7444708cdb1a5aafc0118ab8528fc488f2b9fbd7d042e57ad1811303208875237ae9decf0bb4977c45cd30da53751b -DIST openvpn-2.5.0-r1.tar.gz 1815964 BLAKE2B cca1c1ec4fbfe0c337c14525cf706280c9d961c4bba992dfa0b13c9f96e00092864301138037485095716c746ef6ff3473a2085780b3ef77183bf4a6f1c602ae SHA512 3deb55973b87cc95c0437ab9ce6c43fdc246aa7e42e3e68bd6a5651deffa798b6750f625917cb2aaa2c82f0b3a0805bcf206a2aa8e2c735fd24e6bd38f736562 -DIST openvpn-2.5.1.tar.gz 1827517 BLAKE2B 068af9313c9b2b93dcaa06f82ad66489154ce04973e323af07f38f209b4be77b7b785046aa31559a9f744b4b8c6976acd3e644d5a573f3c5511dc11f5bab3dce SHA512 eb85d14eeb383bed09670941451328db38feacc0b8b7b960840a3f465de83a7527de7d183e66344011da3a3655d558483c569d096b36964209a23418f89052e2 DIST openvpn-2.5.2.tar.gz 1830763 BLAKE2B d1c5fa97b3a9168e8715a7cf926b581e054d1d8ac905dcb78e91b9e7f2ea2abf2f03a02e6b4ee10184e810ebb871f4fc638834848eb3b4a9122b177705382fe8 SHA512 5811d26b32e7f258dc1f7ed704d28f9eb03200b54a128e4cb5dfa37ace5113d7841830fc04e1c5f69a138141d0f6f0ca6cb7fc3c39d67456e476eb4c45102be1 diff --git a/net-vpn/openvpn/openvpn-2.4.9.ebuild b/net-vpn/openvpn/openvpn-2.4.9.ebuild deleted file mode 100644 index fa2a4e2f026..00000000000 --- a/net-vpn/openvpn/openvpn-2.4.9.ebuild +++ /dev/null @@ -1,170 +0,0 @@ -# Copyright 1999-2021 Gentoo Authors -# Distributed under the terms of the GNU General Public License v2 - -EAPI=7 - -inherit autotools flag-o-matic systemd linux-info - -DESCRIPTION="Robust and highly flexible tunneling application compatible with many OSes" -SRC_URI="https://github.com/OpenVPN/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz" -HOMEPAGE="https://openvpn.net/"; - -LICENSE="GPL-2" -SLOT="0" -KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~mips ppc ppc64 ~s390 ~sparc x86 ~amd64-linux ~x86-linux" - -IUSE="down-root examples inotify iproute2 +lz4 +lzo mbedtls pam" -IUSE+=" pkcs11 +plugins selinux +ssl systemd test userland_BSD" - -RESTRICT="!test? ( test )" -REQUIRED_USE="pkcs11? ( ssl ) - !plugins? ( !pam !down-root ) - inotify? ( plugins ) -" - -CDEPEND=" - kernel_linux? ( - iproute2? ( sys-apps/iproute2[-minimal] ) - !iproute2? ( >=sys-apps/net-tools-1.60_p20160215155418 ) - ) - pam? ( sys-libs/pam ) - ssl? ( - !mbedtls? ( >=dev-libs/openssl-0.9.8:0= ) - mbedtls? ( net-libs/mbedtls:= ) - ) - lz4? ( app-arch/lz4 ) - lzo? ( >=dev-libs/lzo-1.07 ) - pkcs11? ( >=dev-libs/pkcs11-helper-1.11 ) - systemd? ( sys-apps/systemd ) -" -DEPEND="${CDEPEND} - test? ( dev-util/cmocka ) -" -RDEPEND="${CDEPEND} - acct-group/openvpn - acct-user/openvpn - selinux? ( sec-policy/selinux-openvpn ) -" - -CONFIG_CHECK="~TUN" - -pkg_setup() { - linux-info_pkg_setup -} - -src_prepare() { - default - eautoreconf -} - -src_configure() { - local myeconfargs=( - $(use_enable inotify async-push) - $(use_enable ssl crypto) - ) - if use ssl; then - myeconfargs+=( - $(use_with ssl crypto-library $(usex mbedtls mbedtls openssl)) - ) - if ! use mbedtls; then - myeconfargs+=( - $(use_enable pkcs11) - ) - fi - fi - myeconfargs+=( - $(use_enable lz4) - $(use_enable lzo) - $(use_enable plugins) - $(use_enable iproute2) - $(use_enable pam plugin-auth-pam) - $(use_enable down-root plugin-down-root) - $(use_enable systemd) - ) - SYSTEMD_UNIT_DIR=$(systemd_get_systemunitdir) \ - TMPFILES_DIR="/usr/lib/tmpfiles.d" \ - IFCONFIG=/bin/ifconfig \ - ROUTE=/bin/route \ - econf "${myeconfargs[@]}" -} - -src_test() { - make check || die "top-level tests failed" - pushd tests/unit_tests > /dev/null || die - make check || die "unit tests failed" - popd > /dev/null || die -} - -src_install() { - default - find "${ED}/usr" -name '*.la' -delete - # install documentation - dodoc AUTHORS ChangeLog PORTS README README.IPv6 - - # Install some helper scripts - keepdir /etc/openvpn - exeinto /etc/openvpn - doexe "${FILESDIR}/up.sh" - doexe "${FILESDIR}/down.sh" - - # Install the init script and config file - newinitd "${FILESDIR}/${PN}-2.1.init" openvpn - newconfd "${FILESDIR}/${PN}-2.1.conf" openvpn - - # install examples, controlled by the respective useflag - if use examples ; then - # dodoc does not supportly support directory traversal, #15193 - docinto /usr/share/doc/${PF}/examples - dodoc -r sample contrib - fi -} - -pkg_postinst() { - if use x64-macos; then - elog "You might want to install tuntaposx for TAP interface support:" - elog "http://tuntaposx.sourceforge.net"; - fi - - if systemd_is_booted || has_version sys-apps/systemd; then - elog "In order to use OpenVPN with systemd please use the correct systemd service file." - elog "" - elog "server:" - elog "" - elog "- Place your server configuration file in /etc/openvpn/server" - elog "- Use the openvpn-server@.service like so" - elog "systemctl start openvpn-server@{Server-config}" - elog "" - elog "client:" - elog "" - elog "- Place your client configuration file in /etc/openvpn/client" - elog "- Use the openvpn-client@.service like so:" - elog "systemctl start openvpn-client@{Client-config}" - else - elog "The openvpn init script expects to find the configuration file" - elog "openvpn.conf in /etc/openvpn along with any extra files it may need." - elog "" - elog "To create more VPNs, simply create a new .conf file for it and" - elog "then create a symlink to the openvpn init script from a link called" - elog "openvpn.newconfname - like so" - elog " cd /etc/openvpn" - elog " ${EDITOR##*/} foo.conf" - elog " cd /etc/init.d" - elog " ln -s openvpn openvpn.foo" - elog "" - elog "You can then treat openvpn.foo as any other service, so you can" - elog "stop one vpn and start another if you need to." - fi - - if grep -Eq "^[ \t]*(up|down)[ \t].*" "${ROOT}/etc/openvpn"/*.conf 2>/dev/null ; then - ewarn "" - ewarn "WARNING: If you use the remote keyword then you are deemed to be" - ewarn "a client by our init script and as such we force up,down scripts." - ewarn "These scripts call /etc/openvpn/\$SVCNAME-{up,down}.sh where you" - ewarn "can move your scripts to." - fi - - if use plugins ; then - einfo "" - einfo "plugins have been installed into /usr/$(get_libdir)/${PN}/plugins" - fi -} diff --git a/net-vpn/openvpn/openvpn-2.5.0-r1.ebuild b/net-vpn/openvpn/openvpn-2.5.0-r1.ebuild deleted file mode 100644 index 8ee40bcb156..00000000000 --- a/net-vpn/openvpn/openvpn-2.5.0-r1.ebuild +++ /dev/null @@ -1,169 +0,0 @@ -# Copyright 1999-2021 Gentoo Authors -# Distributed under the terms of the GNU General Public License v2 - -EAPI=7 - -inherit autotools flag-o-matic systemd linux-info - -DESCRIPTION="Robust and highly flexible tunneling application compatible with many OSes" -SRC_URI="https://build.openvpn.net/downloads/releases/${P}.tar.gz -> ${P}-r1.tar.gz" -HOMEPAGE="https://openvpn.net/"; - -LICENSE="GPL-2" -SLOT="0" -KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux" - -IUSE="down-root examples inotify iproute2 +lz4 +lzo mbedtls +openssl" -IUSE+=" pam pkcs11 +plugins selinux systemd test userland_BSD" - -RESTRICT="!test? ( test )" -REQUIRED_USE=" - ^^ ( openssl mbedtls ) - pkcs11? ( !mbedtls ) - !plugins? ( !pam !down-root ) - inotify? ( plugins ) -" - -CDEPEND=" - kernel_linux? ( - iproute2? ( sys-apps/iproute2[-minimal] ) - ) - lz4? ( app-arch/lz4 ) - lzo? ( >=dev-libs/lzo-1.07 ) - mbedtls? ( net-libs/mbedtls:= ) - openssl? ( >=dev-libs/openssl-0.9.8:0= ) - pam? ( sys-libs/pam ) - pkcs11? ( >=dev-libs/pkcs11-helper-1.11 ) - systemd? ( sys-apps/systemd ) -" -DEPEND="${CDEPEND} - test? ( dev-util/cmocka ) -" -RDEPEND="${CDEPEND} - acct-group/openvpn - acct-user/openvpn - selinux? ( sec-policy/selinux-openvpn ) -" - -PATCHES=( - "${FILESDIR}/openvpn-2.5.0-auth-pam-missing-header.patch" -) - -pkg_setup() { - local CONFIG_CHECK="~TUN" - linux-info_pkg_setup -} - -src_prepare() { - default - eautoreconf -} - -src_configure() { - local -a myeconfargs - - if ! use mbedtls; then - myeconfargs+=( - $(use_enable pkcs11) - ) - fi - myeconfargs+=( - $(use_enable inotify async-push) - --with-crypto-library=$(usex mbedtls mbedtls openssl) - $(use_enable lz4) - $(use_enable lzo) - $(use_enable plugins) - $(use_enable iproute2) - $(use_enable pam plugin-auth-pam) - $(use_enable down-root plugin-down-root) - $(use_enable systemd) - ) - SYSTEMD_UNIT_DIR=$(systemd_get_systemunitdir) \ - TMPFILES_DIR="/usr/lib/tmpfiles.d" \ - IPROUTE=$(usex iproute2 '/bin/ip' '') \ - econf "${myeconfargs[@]}" -} - -src_test() { - make check || die "top-level tests failed" - pushd tests/unit_tests > /dev/null || die - make check || die "unit tests failed" - popd > /dev/null || die -} - -src_install() { - default - find "${ED}/usr" -name '*.la' -delete - # install documentation - dodoc AUTHORS ChangeLog PORTS README README.IPv6 - - # Install some helper scripts - keepdir /etc/openvpn - exeinto /etc/openvpn - doexe "${FILESDIR}/up.sh" - doexe "${FILESDIR}/down.sh" - - # Install the init script and config file - newinitd "${FILESDIR}/${PN}-2.1.init" openvpn - newconfd "${FILESDIR}/${PN}-2.1.conf" openvpn - - # install examples, controlled by the respective useflag - if use examples ; then - # dodoc does not supportly support directory traversal, #15193 - docinto /usr/share/doc/${PF}/examples - dodoc -r sample contrib - fi - - # https://bugs.gentoo.org/755680#c3 - doman doc/openvpn.8 -} - -pkg_postinst() { - if use x64-macos; then - elog "You might want to install tuntaposx for TAP interface support:" - elog "http://tuntaposx.sourceforge.net"; - fi - - if systemd_is_booted || has_version sys-apps/systemd; then - elog "In order to use OpenVPN with systemd please use the correct systemd service file." - elog "" - elog "server:" - elog "" - elog "- Place your server configuration file in /etc/openvpn/server" - elog "- Use the openvpn-server@.service like so" - elog "systemctl start openvpn-server@{Server-config}" - elog "" - elog "client:" - elog "" - elog "- Place your client configuration file in /etc/openvpn/client" - elog "- Use the openvpn-client@.service like so:" - elog "systemctl start openvpn-client@{Client-config}" - else - elog "The openvpn init script expects to find the configuration file" - elog "openvpn.conf in /etc/openvpn along with any extra files it may need." - elog "" - elog "To create more VPNs, simply create a new .conf file for it and" - elog "then create a symlink to the openvpn init script from a link called" - elog "openvpn.newconfname - like so" - elog " cd /etc/openvpn" - elog " ${EDITOR##*/} foo.conf" - elog " cd /etc/init.d" - elog " ln -s openvpn openvpn.foo" - elog "" - elog "You can then treat openvpn.foo as any other service, so you can" - elog "stop one vpn and start another if you need to." - fi - - if grep -Eq "^[ \t]*(up|down)[ \t].*" "${ROOT}/etc/openvpn"/*.conf 2>/dev/null ; then - ewarn "" - ewarn "WARNING: If you use the remote keyword then you are deemed to be" - ewarn "a client by our init script and as such we force up,down scripts." - ewarn "These scripts call /etc/openvpn/\$SVCNAME-{up,down}.sh where you" - ewarn "can move your scripts to." - fi - - if use plugins ; then - einfo "" - einfo "plugins have been installed into /usr/$(get_libdir)/${PN}/plugins" - fi -} diff --git a/net-vpn/openvpn/openvpn-2.5.1-r1.ebuild b/net-vpn/openvpn/openvpn-2.5.1-r1.ebuild deleted file mode 100644 index f6859b6c7e0..00000000000 --- a/net-vpn/openvpn/openvpn-2.5.1-r1.ebuild +++ /dev/null @@ -1,171 +0,0 @@ -# Copyright 1999-2021 Gentoo Authors -# Distributed under the terms of the GNU General Public License v2 - -EAPI=7 - -inherit autotools flag-o-matic systemd linux-info - -DESCRIPTION="Robust and highly flexible tunneling application compatible with many OSes" -SRC_URI="https://build.openvpn.net/downloads/releases/${P}.tar.gz"; -HOMEPAGE="https://openvpn.net/"; - -LICENSE="GPL-2" -SLOT="0" -KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux" - -IUSE="down-root examples inotify iproute2 +lz4 +lzo mbedtls +openssl" -IUSE+=" pam pkcs11 +plugins selinux systemd test userland_BSD" - -RESTRICT="!test? ( test )" -REQUIRED_USE=" - ^^ ( openssl mbedtls ) - pkcs11? ( !mbedtls ) - !plugins? ( !pam !down-root ) - inotify? ( plugins ) -" - -CDEPEND=" - kernel_linux? ( - iproute2? ( sys-apps/iproute2[-minimal] ) - ) - lz4? ( app-arch/lz4 ) - lzo? ( >=dev-libs/lzo-1.07 ) - mbedtls? ( net-libs/mbedtls:= ) - openssl? ( >=dev-libs/openssl-0.9.8:0= ) - pam? ( sys-libs/pam ) - pkcs11? ( >=dev-libs/pkcs11-helper-1.11 ) - systemd? ( sys-apps/systemd ) -" -DEPEND="${CDEPEND} - test? ( dev-util/cmocka ) -" -RDEPEND="${CDEPEND} - acct-group/openvpn - acct-user/openvpn - selinux? ( sec-policy/selinux-openvpn ) -" - -PATCHES=( - "${FILESDIR}/openvpn-2.5.0-auth-pam-missing-header.patch" -) - -pkg_setup() { - local CONFIG_CHECK="~TUN" - linux-info_pkg_setup -} - -src_prepare() { - default - eautoreconf -} - -src_configure() { - local -a myeconfargs - - if ! use mbedtls; then - myeconfargs+=( - $(use_enable pkcs11) - ) - fi - myeconfargs+=( - $(use_enable inotify async-push) - --with-crypto-library=$(usex mbedtls mbedtls openssl) - $(use_enable lz4) - $(use_enable lzo) - $(use_enable plugins) - $(use_enable iproute2) - $(use_enable pam plugin-auth-pam) - $(use_enable down-root plugin-down-root) - $(use_enable systemd) - ) - SYSTEMD_UNIT_DIR=$(systemd_get_systemunitdir) \ - TMPFILES_DIR="/usr/lib/tmpfiles.d" \ - IPROUTE=$(usex iproute2 '/bin/ip' '') \ - econf "${myeconfargs[@]}" -} - -src_test() { - make check || die "top-level tests failed" - pushd tests/unit_tests > /dev/null || die - make check || die "unit tests failed" - popd > /dev/null || die -} - -src_install() { - default - find "${ED}/usr" -name '*.la' -delete - # install documentation - dodoc AUTHORS ChangeLog PORTS README README.IPv6 - - # Install some helper scripts - keepdir /etc/openvpn - exeinto /etc/openvpn - doexe "${FILESDIR}/up.sh" - doexe "${FILESDIR}/down.sh" - - # Install the init script and config file - newinitd "${FILESDIR}/${PN}-2.1.init" openvpn - newconfd "${FILESDIR}/${PN}-2.1.conf" openvpn - - # install examples, controlled by the respective useflag - if use examples ; then - # dodoc does not supportly support directory traversal, #15193 - docinto /usr/share/doc/${PF}/examples - dodoc -r sample contrib - fi - - # https://bugs.gentoo.org/755680#c3 - doman doc/openvpn.8 -} - -pkg_postinst() { - if use x64-macos; then - elog "You might want to install tuntaposx for TAP interface support:" - elog "http://tuntaposx.sourceforge.net"; - fi - - if systemd_is_booted || has_version sys-apps/systemd; then - elog "In order to use OpenVPN with systemd please use the correct systemd service file." - elog "" - elog "server:" - elog "" - elog "- Place your server configuration file in /etc/openvpn/server" - elog "- Use the openvpn-server@.service like so" - elog "systemctl start openvpn-server@{Server-config}" - elog "" - elog "client:" - elog "" - elog "- Place your client configuration file in /etc/openvpn/client" - elog "- Use the openvpn-client@.service like so:" - elog "systemctl start openvpn-client@{Client-config}" - - else - - elog "The openvpn init script expects to find the configuration file" - elog "openvpn.conf in /etc/openvpn along with any extra files it may need." - elog "" - elog "To create more VPNs, simply create a new .conf file for it and" - elog "then create a symlink to the openvpn init script from a link called" - elog "openvpn.newconfname - like so" - elog " cd /etc/openvpn" - elog " ${EDITOR##*/} foo.conf" - elog " cd /etc/init.d" - elog " ln -s openvpn openvpn.foo" - elog "" - elog "You can then treat openvpn.foo as any other service, so you can" - elog "stop one vpn and start another if you need to." - fi - - if grep -Eq "^[ \t]*(up|down)[ \t].*" "${ROOT}/etc/openvpn"/*.conf 2>/dev/null ; then - ewarn "" - ewarn "WARNING: If you use the remote keyword then you are deemed to be" - ewarn "a client by our init script and as such we force up,down scripts." - ewarn "These scripts call /etc/openvpn/\$SVCNAME-{up,down}.sh where you" - ewarn "can move your scripts to." - fi - - if use plugins ; then - einfo "" - einfo "plugins have been installed into /usr/$(get_libdir)/${PN}/plugins" - fi -}
