commit: ee8b389b8cabe9cbe8fcc0360f2062708974297d Author: Jakov Smolić <jsmolic <AT> gentoo <DOT> org> AuthorDate: Tue Sep 28 14:29:14 2021 +0000 Commit: Jakov Smolić <jsmolic <AT> gentoo <DOT> org> CommitDate: Tue Sep 28 14:29:14 2021 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ee8b389b
net-vpn/ipsec-tools: Remove last-rited package Signed-off-by: Jakov Smolić <jsmolic <AT> gentoo.org> net-vpn/ipsec-tools/Manifest | 2 - .../files/ipsec-tools-0.8.0-sysctl.patch | 22 -- .../files/ipsec-tools-CVE-2015-4047.patch | 16 -- .../files/ipsec-tools-CVE-2016-10396.patch | 201 --------------- .../ipsec-tools/files/ipsec-tools-def-psk.patch | 25 -- .../files/ipsec-tools-include-vendoridh.patch | 11 - net-vpn/ipsec-tools/files/ipsec-tools.conf | 26 -- net-vpn/ipsec-tools/files/ipsec-tools.service | 12 - net-vpn/ipsec-tools/files/psk.txt | 10 - net-vpn/ipsec-tools/files/racoon.conf | 33 --- net-vpn/ipsec-tools/files/racoon.conf.d-r2 | 29 --- net-vpn/ipsec-tools/files/racoon.init.d-r3 | 57 ----- net-vpn/ipsec-tools/files/racoon.pam.d | 4 - net-vpn/ipsec-tools/files/racoon.service | 11 - net-vpn/ipsec-tools/ipsec-tools-0.8.2-r8.ebuild | 284 --------------------- net-vpn/ipsec-tools/metadata.xml | 17 -- profiles/package.mask | 4 - 17 files changed, 764 deletions(-) diff --git a/net-vpn/ipsec-tools/Manifest b/net-vpn/ipsec-tools/Manifest deleted file mode 100644 index 2490dbc0ab0..00000000000 --- a/net-vpn/ipsec-tools/Manifest +++ /dev/null @@ -1,2 +0,0 @@ -DIST ipsec-tools-0.8.2.tar.bz2 866465 BLAKE2B cf8c9175d96326fc5c74e6b1921bc66911256e289e6fe9cef77f26c197546902be3ebd5696af39c749a2abaac3f42010c9e2a281fd208122cd59222044b9dd4c SHA512 2b7d0efa908d3a699be7ef8b2b126a3809956cb7add50e8efb1cfdfc2d9b70c39ef517379cb9a4fad9e5f0c25937e98535b06c32bd3e729f5129da4ab133e30f -DIST ipsec-tools-add-openssl-1.1.x-support.patch 32066 BLAKE2B b8380408c90bb93f0b95938de2efc61c80d727ae61a1417134583a8c74055fcfe1f7f75893f1f701b0f301a16d8b4d14f1b8a09d1e81d238821bcc122dfe183f SHA512 f2bd85f1c51226da6fc50d3473129e4c2e3c0e46107337f8d676029b7072b98bf164b6813a16de7dd4481f80038453b55a5ff56e7f5ec08ab07641034258e778 diff --git a/net-vpn/ipsec-tools/files/ipsec-tools-0.8.0-sysctl.patch b/net-vpn/ipsec-tools/files/ipsec-tools-0.8.0-sysctl.patch deleted file mode 100644 index 5c69bbb2fa6..00000000000 --- a/net-vpn/ipsec-tools/files/ipsec-tools-0.8.0-sysctl.patch +++ /dev/null @@ -1,22 +0,0 @@ -https://bugs.gentoo.org/425770 - ---- a/src/racoon/pfkey.c -+++ b/src/racoon/pfkey.c -@@ -59,7 +59,6 @@ - #include <sys/param.h> - #include <sys/socket.h> - #include <sys/queue.h> --#include <sys/sysctl.h> - - #include <net/route.h> - #include <net/pfkeyv2.h> ---- a/src/setkey/setkey.c -+++ b/src/setkey/setkey.c -@@ -40,7 +40,6 @@ - #include <sys/socket.h> - #include <sys/time.h> - #include <sys/stat.h> --#include <sys/sysctl.h> - #include <err.h> - #include <netinet/in.h> - #include <net/pfkeyv2.h> diff --git a/net-vpn/ipsec-tools/files/ipsec-tools-CVE-2015-4047.patch b/net-vpn/ipsec-tools/files/ipsec-tools-CVE-2015-4047.patch deleted file mode 100644 index 58f72e109c4..00000000000 --- a/net-vpn/ipsec-tools/files/ipsec-tools-CVE-2015-4047.patch +++ /dev/null @@ -1,16 +0,0 @@ -See: https://bugs.gentoo.org/show_bug.cgi?id=550118 - ---- ./src/racoon/gssapi.c 9 Sep 2006 16:22:09 -0000 1.4 -+++ ./src/racoon/gssapi.c 19 May 2015 15:16:00 -0000 1.6 -@@ -192,6 +192,11 @@ - gss_name_t princ, canon_princ; - OM_uint32 maj_stat, min_stat; - -+ if (iph1->rmconf == NULL) { -+ plog(LLV_ERROR, LOCATION, NULL, "no remote config\n"); -+ return -1; -+ } -+ - gps = racoon_calloc(1, sizeof (struct gssapi_ph1_state)); - if (gps == NULL) { - plog(LLV_ERROR, LOCATION, NULL, "racoon_calloc failed\n"); diff --git a/net-vpn/ipsec-tools/files/ipsec-tools-CVE-2016-10396.patch b/net-vpn/ipsec-tools/files/ipsec-tools-CVE-2016-10396.patch deleted file mode 100644 index e123007bb59..00000000000 --- a/net-vpn/ipsec-tools/files/ipsec-tools-CVE-2016-10396.patch +++ /dev/null @@ -1,201 +0,0 @@ -Description: Fix remotely exploitable DoS. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10396 -Source: vendor; https://gnats.netbsd.org/cgi-bin/query-pr-single.pl?number=51682 -Bug-debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=867986 - -Index: pkg-ipsec-tools/src/racoon/isakmp_frag.c -=================================================================== ---- pkg-ipsec-tools.orig/src/racoon/isakmp_frag.c -+++ pkg-ipsec-tools/src/racoon/isakmp_frag.c -@@ -1,4 +1,4 @@ --/* $NetBSD: isakmp_frag.c,v 1.5 2009/04/22 11:24:20 tteras Exp $ */ -+/* $NetBSD: isakmp_frag.c,v 1.5.36.1 2017/04/21 16:50:42 bouyer Exp $ */ - - /* Id: isakmp_frag.c,v 1.4 2004/11/13 17:31:36 manubsd Exp */ - -@@ -173,6 +173,43 @@ vendorid_frag_cap(gen) - return ntohl(hp[MD5_DIGEST_LENGTH / sizeof(*hp)]); - } - -+static int -+isakmp_frag_insert(struct ph1handle *iph1, struct isakmp_frag_item *item) -+{ -+ struct isakmp_frag_item *pitem = NULL; -+ struct isakmp_frag_item *citem = iph1->frag_chain; -+ -+ /* no frag yet, just insert at beginning of list */ -+ if (iph1->frag_chain == NULL) { -+ iph1->frag_chain = item; -+ return 0; -+ } -+ -+ do { -+ /* duplicate fragment number, abort (CVE-2016-10396) */ -+ if (citem->frag_num == item->frag_num) -+ return -1; -+ -+ /* need to insert before current item */ -+ if (citem->frag_num > item->frag_num) { -+ if (pitem != NULL) -+ pitem->frag_next = item; -+ else -+ /* insert at the beginning of the list */ -+ iph1->frag_chain = item; -+ item->frag_next = citem; -+ return 0; -+ } -+ -+ pitem = citem; -+ citem = citem->frag_next; -+ } while (citem != NULL); -+ -+ /* we reached the end of the list, insert */ -+ pitem->frag_next = item; -+ return 0; -+} -+ - int - isakmp_frag_extract(iph1, msg) - struct ph1handle *iph1; -@@ -224,39 +261,43 @@ isakmp_frag_extract(iph1, msg) - item->frag_next = NULL; - item->frag_packet = buf; - -- /* Look for the last frag while inserting the new item in the chain */ -- if (item->frag_last) -- last_frag = item->frag_num; -+ /* Check for the last frag before inserting the new item in the chain */ -+ if (item->frag_last) { -+ /* if we have the last fragment, indices must match */ -+ if (iph1->frag_last_index != 0 && -+ item->frag_last != iph1->frag_last_index) { -+ plog(LLV_ERROR, LOCATION, NULL, -+ "Repeated last fragment index mismatch\n"); -+ racoon_free(item); -+ vfree(buf); -+ return -1; -+ } - -- if (iph1->frag_chain == NULL) { -- iph1->frag_chain = item; -- } else { -- struct isakmp_frag_item *current; -+ last_frag = iph1->frag_last_index = item->frag_num; -+ } - -- current = iph1->frag_chain; -- while (current->frag_next) { -- if (current->frag_last) -- last_frag = item->frag_num; -- current = current->frag_next; -- } -- current->frag_next = item; -+ /* insert fragment into chain */ -+ if (isakmp_frag_insert(iph1, item) == -1) { -+ plog(LLV_ERROR, LOCATION, NULL, -+ "Repeated fragment index mismatch\n"); -+ racoon_free(item); -+ vfree(buf); -+ return -1; - } - -- /* If we saw the last frag, check if the chain is complete */ -+ /* If we saw the last frag, check if the chain is complete -+ * we have a sorted list now, so just walk through */ - if (last_frag != 0) { -+ item = iph1->frag_chain; - for (i = 1; i <= last_frag; i++) { -- item = iph1->frag_chain; -- do { -- if (item->frag_num == i) -- break; -- item = item->frag_next; -- } while (item != NULL); -- -+ if (item->frag_num != i) -+ break; -+ item = item->frag_next; - if (item == NULL) /* Not found */ - break; - } - -- if (item != NULL) /* It is complete */ -+ if (i > last_frag) /* It is complete */ - return 1; - } - -@@ -291,15 +332,9 @@ isakmp_frag_reassembly(iph1) - } - data = buf->v; - -+ item = iph1->frag_chain; - for (i = 1; i <= frag_count; i++) { -- item = iph1->frag_chain; -- do { -- if (item->frag_num == i) -- break; -- item = item->frag_next; -- } while (item != NULL); -- -- if (item == NULL) { -+ if (item->frag_num != i) { - plog(LLV_ERROR, LOCATION, NULL, - "Missing fragment #%d\n", i); - vfree(buf); -@@ -308,6 +343,7 @@ isakmp_frag_reassembly(iph1) - } - memcpy(data, item->frag_packet->v, item->frag_packet->l); - data += item->frag_packet->l; -+ item = item->frag_next; - } - - out: -Index: pkg-ipsec-tools/src/racoon/isakmp_inf.c -=================================================================== ---- pkg-ipsec-tools.orig/src/racoon/isakmp_inf.c -+++ pkg-ipsec-tools/src/racoon/isakmp_inf.c -@@ -720,6 +720,7 @@ isakmp_info_send_nx(isakmp, remote, loca - #endif - #ifdef ENABLE_FRAG - iph1->frag = 0; -+ iph1->frag_last_index = 0; - iph1->frag_chain = NULL; - #endif - -Index: pkg-ipsec-tools/src/racoon/isakmp.c -=================================================================== ---- pkg-ipsec-tools.orig/src/racoon/isakmp.c -+++ pkg-ipsec-tools/src/racoon/isakmp.c -@@ -1072,6 +1072,7 @@ isakmp_ph1begin_i(rmconf, remote, local) - iph1->frag = 1; - else - iph1->frag = 0; -+ iph1->frag_last_index = 0; - iph1->frag_chain = NULL; - #endif - iph1->approval = NULL; -@@ -1176,6 +1177,7 @@ isakmp_ph1begin_r(msg, remote, local, et - #endif - #ifdef ENABLE_FRAG - iph1->frag = 0; -+ iph1->frag_last_index = 0; - iph1->frag_chain = NULL; - #endif - iph1->approval = NULL; -Index: pkg-ipsec-tools/src/racoon/handler.h -=================================================================== ---- pkg-ipsec-tools.orig/src/racoon/handler.h -+++ pkg-ipsec-tools/src/racoon/handler.h -@@ -1,4 +1,4 @@ --/* $NetBSD: handler.h,v 1.25 2010/11/17 10:40:41 tteras Exp $ */ -+/* $NetBSD: handler.h,v 1.26 2017/01/24 19:23:56 christos Exp $ */ - - /* Id: handler.h,v 1.19 2006/02/25 08:25:12 manubsd Exp */ - -@@ -141,6 +141,7 @@ struct ph1handle { - #endif - #ifdef ENABLE_FRAG - int frag; /* IKE phase 1 fragmentation */ -+ int frag_last_index; - struct isakmp_frag_item *frag_chain; /* Received fragments */ - #endif - diff --git a/net-vpn/ipsec-tools/files/ipsec-tools-def-psk.patch b/net-vpn/ipsec-tools/files/ipsec-tools-def-psk.patch deleted file mode 100644 index f351860a84e..00000000000 --- a/net-vpn/ipsec-tools/files/ipsec-tools-def-psk.patch +++ /dev/null @@ -1,25 +0,0 @@ -diff -brau ipsec-tools-0.7.3.o/src/racoon/oakley.c ipsec-tools-0.7.3/src/racoon/oakley.c ---- ipsec-tools-0.7.3.o/src/racoon/oakley.c 2009-08-13 11:18:45.000000000 +0200 -+++ ipsec-tools-0.7.3/src/racoon/oakley.c 2011-06-06 09:36:11.000000000 +0200 -@@ -2498,8 +2498,21 @@ - plog(LLV_ERROR, LOCATION, iph1->remote, - "couldn't find the pskey for %s.\n", - saddrwop2str(iph1->remote)); -+ } -+ } -+ if (iph1->authstr == NULL) { -+ /* -+ * If we could not locate a psk above try and locate -+ * the default psk, ie, "*". -+ */ -+ iph1->authstr = privsep_getpsk("*", 1); -+ if (iph1->authstr == NULL) { -+ plog(LLV_ERROR, LOCATION, iph1->remote, -+ "couldn't find the the default pskey either.\n"); - goto end; - } -+ plog(LLV_NOTIFY, LOCATION, iph1->remote, -+ "Using default PSK.\n"); - } - plog(LLV_DEBUG, LOCATION, NULL, "the psk found.\n"); - /* should be secret PSK */ diff --git a/net-vpn/ipsec-tools/files/ipsec-tools-include-vendoridh.patch b/net-vpn/ipsec-tools/files/ipsec-tools-include-vendoridh.patch deleted file mode 100644 index 2e22c82db47..00000000000 --- a/net-vpn/ipsec-tools/files/ipsec-tools-include-vendoridh.patch +++ /dev/null @@ -1,11 +0,0 @@ -diff -Naur ipsec-tools-0.8.0.orig//src/racoon/ipsec_doi.c ipsec-tools-0.8.0/src/racoon/ipsec_doi.c ---- ipsec-tools-0.8.0.orig//src/racoon/ipsec_doi.c 2012-02-28 13:42:24.000000000 -0500 -+++ ipsec-tools-0.8.0/src/racoon/ipsec_doi.c 2012-02-28 13:41:22.000000000 -0500 -@@ -87,6 +87,7 @@ - #ifdef HAVE_GSSAPI - #include <iconv.h> - #include "gssapi.h" -+#include "vendorid.h" - #ifdef HAVE_ICONV_2ND_CONST - #define __iconv_const const - #else diff --git a/net-vpn/ipsec-tools/files/ipsec-tools.conf b/net-vpn/ipsec-tools/files/ipsec-tools.conf deleted file mode 100644 index bfff04af069..00000000000 --- a/net-vpn/ipsec-tools/files/ipsec-tools.conf +++ /dev/null @@ -1,26 +0,0 @@ -#!/usr/sbin/setkey -f -# -# THIS IS A SAMPLE FILE! -# -# This is a sample file to test Gentoo's ipsec-tools out of the box. -# Do not use it in production. See: http://www.ipsec-howto.org/ -# -flush; -spdflush; - -# -# Uncomment the following if you want to do manual keying, ie, you want to run IPsec without racoon. -# Do not switch 192.168.3.21 <-> 192.168.3.25 on the peer -# -#add 192.168.3.25 192.168.3.21 ah 0x200 -A hmac-md5 0xc0291ff014dccdd03874d9e8e4cdf3e6; -#add 192.168.3.21 192.168.3.25 ah 0x300 -A hmac-md5 0x96358c90783bbfa3d7b196ceabe0536b; -#add 192.168.3.25 192.168.3.21 esp 0x201 -E 3des-cbc 0x7aeaca3f87d060a12f4a4487d5a5c3355920fae69a96c831; -#add 192.168.3.21 192.168.3.25 esp 0x301 -E 3des-cbc 0xf6ddb555acfd9d77b03ea3843f2653255afe8eb5573965df; - -# -# Make sure to switch 192.168.3.21 <-> 192.168.3.25 on the peer -# -#spdadd 192.168.3.21 192.168.3.25 any -P out ipsec esp/transport//require ah/transport//require; -#spdadd 192.168.3.25 192.168.3.21 any -P in ipsec esp/transport//require ah/transport//require; -spdadd 192.168.3.25 192.168.3.21 any -P out ipsec esp/transport//require ah/transport//require; -spdadd 192.168.3.21 192.168.3.25 any -P in ipsec esp/transport//require ah/transport//require; diff --git a/net-vpn/ipsec-tools/files/ipsec-tools.service b/net-vpn/ipsec-tools/files/ipsec-tools.service deleted file mode 100644 index 0341aa7e4ed..00000000000 --- a/net-vpn/ipsec-tools/files/ipsec-tools.service +++ /dev/null @@ -1,12 +0,0 @@ -[Unit] -Description=Load IPSec Security Policy Database -After=syslog.target network.target - -[Service] -Type=oneshot -RemainAfterExit=true -ExecStart=/usr/sbin/setkey -k -f /etc/ipsec-tools.conf -ExecStop=/usr/sbin/setkey -F -P ; /usr/sbin/setkey -F - -[Install] -WantedBy=multi-user.target diff --git a/net-vpn/ipsec-tools/files/psk.txt b/net-vpn/ipsec-tools/files/psk.txt deleted file mode 100644 index 97f5180f5ae..00000000000 --- a/net-vpn/ipsec-tools/files/psk.txt +++ /dev/null @@ -1,10 +0,0 @@ -# THIS IS A SAMPLE FILE! -# -# This is a sample file to test Gentoo's ipsec-tools out of the box. -# Do not use it in production. See: http://www.ipsec-howto.org/ -# -# Make sure to switch 192.168.3.21 <-> 192.168.3.25 on the peer -# -# Peer IP/FQDN Secret -# 192.168.3.25 sample -192.168.3.21 sample diff --git a/net-vpn/ipsec-tools/files/racoon.conf b/net-vpn/ipsec-tools/files/racoon.conf deleted file mode 100644 index 2e9206db950..00000000000 --- a/net-vpn/ipsec-tools/files/racoon.conf +++ /dev/null @@ -1,33 +0,0 @@ -# THIS IS A SAMPLE FILE! -# -# This is a sample file to test Gentoo's ipsec-tools out of the box. -# Do not use it in production. See: http://www.ipsec-howto.org/ -# -path pre_shared_key "/etc/racoon/psk.txt"; - -# -# Make sure to switch 192.168.3.21 <-> 192.168.3.25 on the peer -# -#remote 192.168.3.25 -remote 192.168.3.21 -{ - exchange_mode main; - proposal { - encryption_algorithm 3des; - hash_algorithm md5; - authentication_method pre_shared_key; - dh_group modp1024; - } -} - -# -# Make sure to switch 192.168.3.21 <-> 192.168.3.25 on the peer -# -#sainfo address 192.168.3.21 any address 192.168.3.25 any -sainfo address 192.168.3.25 any address 192.168.3.21 any -{ - pfs_group modp768; - encryption_algorithm 3des; - authentication_algorithm hmac_md5; - compression_algorithm deflate; -} diff --git a/net-vpn/ipsec-tools/files/racoon.conf.d-r2 b/net-vpn/ipsec-tools/files/racoon.conf.d-r2 deleted file mode 100644 index c592d358496..00000000000 --- a/net-vpn/ipsec-tools/files/racoon.conf.d-r2 +++ /dev/null @@ -1,29 +0,0 @@ -# Copyright 1999-2014 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Config file for /etc/init.d/racoon - -# See the man page or run `racoon --help` for valid command-line options -# RACOON_OPTS="-d" - -RACOON_CONF="/etc/racoon/racoon.conf" -RACOON_PSK_FILE="/etc/racoon/psk.txt" - -# The amount of time in ms for start-stop-daemon to wait before a timeout -# Racoon can sometimes be slow. We'll wait 1 sec. Bug #435398. - -RACOON_WAIT="1000" - -# The setkey config file. Don't name it ipsec.conf as this clashes -# with strongswan. We'll follow debian's naming. Bug #436144. - -SETKEY_CONF="/etc/ipsec-tools.conf" - -# Comment or remove the following if you don't want the policy tables -# to be flushed when racoon is stopped. - -RACOON_RESET_TABLES="true" - -# If you need to set custom options to the setkey command when loading rules, use this -# more info in the setkey mangage (example below sets kernel mode instead of RFC mode): -#SETKEY_OPTS="-k" diff --git a/net-vpn/ipsec-tools/files/racoon.init.d-r3 b/net-vpn/ipsec-tools/files/racoon.init.d-r3 deleted file mode 100644 index 66e10bb84d4..00000000000 --- a/net-vpn/ipsec-tools/files/racoon.init.d-r3 +++ /dev/null @@ -1,57 +0,0 @@ -#!/sbin/openrc-run -# Copyright 1999-2014 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -depend() { - before netmount - use net -} - -checkconfig() { - if [ ! -e ${SETKEY_CONF} ] ; then - eerror "You need to configure setkey before starting racoon." - return 1 - fi - if [ ! -e ${RACOON_CONF} ] ; then - eerror "You need a configuration file to start racoon." - return 1 - fi - if [ ! -z ${RACOON_PSK_FILE} ] ; then - if [ ! -f ${RACOON_PSK_FILE} ] ; then - eerror "PSK file not found as specified." - eerror "Set RACOON_PSK_FILE in /etc/conf.d/racoon." - return 1 - fi - case "`ls -Lldn ${RACOON_PSK_FILE}`" in - -r--------*) - ;; - *) - eerror "Your defined PSK file should be mode 400 for security!" - return 1 - ;; - esac - fi -} - -command=/usr/sbin/racoon -command_args="-f ${RACOON_CONF} ${RACOON_OPTS}" -pidfile=/var/run/racoon.pid -start_stop_daemon_args="--wait ${RACOON_WAIT}" - -start_pre() { - checkconfig || return 1 - einfo "Loading ipsec policies from ${SETKEY_CONF}." - /usr/sbin/setkey ${SETKEY_OPTS} -f ${SETKEY_CONF} - if [ $? -eq 1 ] ; then - eerror "Error while loading ipsec policies" - fi -} - -stop_post() { - if [ -n "${RACOON_RESET_TABLES}" ]; then - ebegin "Flushing policy entries" - /usr/sbin/setkey -F - /usr/sbin/setkey -FP - eend $? - fi -} diff --git a/net-vpn/ipsec-tools/files/racoon.pam.d b/net-vpn/ipsec-tools/files/racoon.pam.d deleted file mode 100644 index b801aaafa0f..00000000000 --- a/net-vpn/ipsec-tools/files/racoon.pam.d +++ /dev/null @@ -1,4 +0,0 @@ -auth include system-remote-login -account include system-remote-login -password include system-remote-login -session include system-remote-login diff --git a/net-vpn/ipsec-tools/files/racoon.service b/net-vpn/ipsec-tools/files/racoon.service deleted file mode 100644 index df7f1bb8f8c..00000000000 --- a/net-vpn/ipsec-tools/files/racoon.service +++ /dev/null @@ -1,11 +0,0 @@ -[Unit] -Description=Racoon IKEv1 key management daemon for IPSEC -After=syslog.target network.target -Requires=ipsec-tools.service - -[Service] -Type=forking -ExecStart=/usr/sbin/racoon -f /etc/racoon/racoon.conf - -[Install] -WantedBy=multi-user.target diff --git a/net-vpn/ipsec-tools/ipsec-tools-0.8.2-r8.ebuild b/net-vpn/ipsec-tools/ipsec-tools-0.8.2-r8.ebuild deleted file mode 100644 index f5bcdfcd4ab..00000000000 --- a/net-vpn/ipsec-tools/ipsec-tools-0.8.2-r8.ebuild +++ /dev/null @@ -1,284 +0,0 @@ -# Copyright 1999-2021 Gentoo Authors -# Distributed under the terms of the GNU General Public License v2 - -EAPI="6" - -inherit flag-o-matic autotools linux-info pam systemd - -DESCRIPTION="A port of KAME's IPsec utilities to the Linux-2.6 IPsec implementation" -HOMEPAGE="http://ipsec-tools.sourceforge.net/"; -SRC_URI="mirror://sourceforge/${PN}/${P}.tar.bz2 - https://dev.gentoo.org/~juippis/distfiles/tmp/ipsec-tools-add-openssl-1.1.x-support.patch"; - -LICENSE="BSD GPL-2" -SLOT="0" -KEYWORDS="amd64 arm ~ia64 ~mips ppc ppc64 x86" -IUSE="hybrid idea ipv6 kerberos ldap nat pam rc5 readline selinux stats" - -CDEPEND=" - dev-libs/openssl:0= - virtual/libcrypt:= - kerberos? ( virtual/krb5 ) - ldap? ( net-nds/openldap ) - pam? ( sys-libs/pam ) - readline? ( sys-libs/readline:0= ) - selinux? ( sys-libs/libselinux )" - -DEPEND="${CDEPEND} - >=sys-kernel/linux-headers-2.6.30" - -RDEPEND="${CDEPEND} - selinux? ( sec-policy/selinux-ipsec ) -" - -pkg_preinst() { - if has_version "<${CATEGORY}/${PN}-0.8.0-r5" ; then - ewarn - ewarn "\033[1;33m**************************************************\033[00m" - ewarn - if ! has_version "net-vpn/strongswan" && - ! has_version "net-misc/openswan" && - ! has_version "net-vpn/libreswan"; then - ewarn "We found an earlier version of ${PN} installed." - ewarn "As of ${PN}-0.8.0-r5, the old configuration file," - ewarn "ipsec.conf, has been changed to ipsec-tools.conf to avoid" - ewarn "a conflict with net-vpn/strongswan; bug #436144. We will" - ewarn "rename this file for you with this upgrade. However, if" - ewarn "you later downgrade, you'll have to rename the file to" - ewarn "its orignal manually or change /etc/conf.d/racoon to point" - ewarn "to the new file." - - if [[ -f /etc/ipsec.conf && ! -f /etc/ipsec-tools.conf ]] ; then - mv /etc/ipsec.conf /etc/ipsec-tools.conf - else - ewarn - ewarn "Oops! I can't move ipsec.conf to ipsec-tools.conf!" - ewarn "Either the former doesn't exist or the later does and" - ewarn "I won't clobber it. Please fix this situation manually." - fi - else - ewarn "You had both an earlier version of ${PN} and" - ewarn "net-vpn/strongswan installed. I can't tell whether" - ewarn "the configuration file, ipsec.conf, belongs to one" - ewarn "package or the other due to a file conflict; bug #436144." - ewarn "The current version of ${PN} uses ipsec-tools.conf" - ewarn "as its configuration file, as will future versions." - ewarn "Please fix this situation manually." - fi - ewarn - ewarn "\033[1;33m**************************************************\033[00m" - ewarn - fi -} - -pkg_setup() { - linux-info_pkg_setup - - get_version - - if linux_config_exists && kernel_is -ge 2 6 19; then - ewarn - ewarn "\033[1;33m**************************************************\033[00m" - ewarn - ewarn "Checking kernel configuration in /usr/src/linux or" - ewarn "or /proc/config.gz for compatibility with ${PN}." - ewarn "Here are the potential problems:" - ewarn - - local nothing="1" - - # Check options for all flavors of IPSec - local msg="" - for i in XFRM_USER NET_KEY; do - if ! linux_chkconfig_present ${i}; then - msg="${msg} ${i}" - fi - done - if [[ ! -z "$msg" ]]; then - nothing="0" - ewarn - ewarn "ALL IPSec may fail. CHECK:" - ewarn "${msg}" - fi - - # Check unencrypted IPSec - if ! linux_chkconfig_present CRYPTO_NULL; then - nothing="0" - ewarn - ewarn "Unencrypted IPSec may fail. CHECK:" - ewarn " CRYPTO_NULL" - fi - - # Check IPv4 IPSec - msg="" - for i in \ - INET_IPCOMP INET_AH INET_ESP \ - INET_XFRM_MODE_TRANSPORT \ - INET_XFRM_MODE_TUNNEL \ - INET_XFRM_MODE_BEET - do - if ! linux_chkconfig_present ${i}; then - msg="${msg} ${i}" - fi - done - if [[ ! -z "$msg" ]]; then - nothing="0" - ewarn - ewarn "IPv4 IPSec may fail. CHECK:" - ewarn "${msg}" - fi - - # Check IPv6 IPSec - if use ipv6; then - msg="" - for i in INET6_IPCOMP INET6_AH INET6_ESP \ - INET6_XFRM_MODE_TRANSPORT \ - INET6_XFRM_MODE_TUNNEL \ - INET6_XFRM_MODE_BEET - do - if ! linux_chkconfig_present ${i}; then - msg="${msg} ${i}" - fi - done - if [[ ! -z "$msg" ]]; then - nothing="0" - ewarn - ewarn "IPv6 IPSec may fail. CHECK:" - ewarn "${msg}" - fi - fi - - # Check IPSec behind NAT - if use nat; then - if ! linux_chkconfig_present NETFILTER_XT_MATCH_POLICY; then - nothing="0" - ewarn - ewarn "IPSec behind NAT may fail. CHECK:" - ewarn " NETFILTER_XT_MATCH_POLICY" - fi - fi - - if [[ $nothing == "1" ]]; then - ewarn "NO PROBLEMS FOUND" - fi - - ewarn - ewarn "WARNING: If your *configured* and *running* kernel" - ewarn "differ either now or in the future, then these checks" - ewarn "may lead to misleading results." - ewarn - ewarn "\033[1;33m**************************************************\033[00m" - ewarn - else - eerror - eerror "\033[1;31m**************************************************\033[00m" - eerror "Make sure that your *running* kernel is/will be >=2.6.19." - eerror "Building ${PN} now, assuming that you know what you're doing." - eerror "\033[1;31m**************************************************\033[00m" - eerror - fi -} - -src_prepare() { - # fix for bug #124813 - sed -i 's:-Werror::g' "${S}"/configure.ac || die - # fix for building with gcc-4.6 - sed -i 's: -R: -Wl,-R:' "${S}"/configure.ac || die - - eapply "${FILESDIR}/${PN}-def-psk.patch" - eapply "${FILESDIR}/${PN}-include-vendoridh.patch" - eapply "${FILESDIR}"/${PN}-0.8.0-sysctl.patch #425770 - eapply "${FILESDIR}"/${PN}-CVE-2015-4047.patch - eapply "${DISTDIR}"/${PN}-add-openssl-1.1.x-support.patch - eapply "${FILESDIR}"/${PN}-CVE-2016-10396.patch - AT_M4DIR="${S}" eautoreconf - - eapply_user -} - -src_configure() { - #--with-{libiconv,libradius} lead to "Broken getaddrinfo()" - #--enable-samode-unspec is not supported in linux - local myconf - myconf="--with-kernel-headers=/usr/include \ - --enable-adminport \ - --enable-dependency-tracking \ - --enable-dpd \ - --enable-frag \ - --without-libiconv \ - --without-libradius \ - --disable-samode-unspec \ - $(use_enable idea) \ - $(use_enable ipv6) \ - $(use_enable kerberos gssapi) \ - $(use_with ldap libldap) \ - $(use_enable nat natt) \ - $(use_with pam libpam) \ - $(use_enable rc5) \ - $(use_with readline) \ - $(use_enable selinux security-context) \ - $(use_enable stats)" - - use nat && myconf="${myconf} --enable-natt-versions=yes" - - # enable mode-cfg and xauth support - if use pam; then - myconf="${myconf} --enable-hybrid" - else - myconf="${myconf} $(use_enable hybrid)" - fi - - econf ${myconf} -} - -src_install() { - emake DESTDIR="${D}" install - keepdir /var/lib/racoon - newconfd "${FILESDIR}"/racoon.conf.d-r2 racoon - newinitd "${FILESDIR}"/racoon.init.d-r3 racoon - systemd_dounit "${FILESDIR}/ipsec-tools.service" - systemd_dounit "${FILESDIR}/racoon.service" - use pam && newpamd "${FILESDIR}"/racoon.pam.d racoon - - insinto /etc - doins "${FILESDIR}"/ipsec-tools.conf - insinto /etc/racoon - doins "${FILESDIR}"/racoon.conf - doins "${FILESDIR}"/psk.txt - chmod 400 "${D}"/etc/racoon/psk.txt - - dodoc ChangeLog README NEWS - dodoc -r src/racoon/samples - dodoc -r src/racoon/doc - docinto samples - newdoc src/setkey/sample.cf ipsec-tools.conf -} - -pkg_postinst() { - if use nat; then - elog - elog "You have enabled the nat traversal functionnality." - elog "Nat versions wich are enabled by default are 00,02,rfc" - elog "you can find those drafts in the CVS repository:" - elog "cvs -d [email protected]:/cvsroot co ipsec-tools" - elog - elog "If you feel brave enough and you know what you are" - elog "doing, you can consider emerging this ebuild with" - elog "EXTRA_ECONF=\"--enable-natt-versions=08,07,06\"" - elog - fi - - if use ldap; then - elog - elog "You have enabled ldap support with ${PN}." - elog "The man page does NOT contain any information on it yet." - elog "Consider using a more recent version or CVS." - elog - fi - - elog - elog "Please have a look in /usr/share/doc/${P} and visit" - elog "http://www.netbsd.org/Documentation/network/ipsec/"; - elog "to find more information on how to configure this tool." - elog -} diff --git a/net-vpn/ipsec-tools/metadata.xml b/net-vpn/ipsec-tools/metadata.xml deleted file mode 100644 index ebfe94eecee..00000000000 --- a/net-vpn/ipsec-tools/metadata.xml +++ /dev/null @@ -1,17 +0,0 @@ -<?xml version="1.0" encoding="UTF-8"?> -<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd";> -<pkgmetadata> - <maintainer type="person"> - <email>[email protected]</email> - </maintainer> - <use> - <flag name="hybrid">Makes available both mode-cfg and xauth support</flag> - <flag name="idea">Enable support for the IDEA algorithm</flag> - <flag name="nat">Enable NAT-Traversal</flag> - <flag name="rc5">Enable support for the patented RC5 algorithm</flag> - <flag name="stats">Enable statistics reporting</flag> - </use> - <upstream> - <remote-id type="sourceforge">ipsec-tools</remote-id> - </upstream> -</pkgmetadata> diff --git a/profiles/package.mask b/profiles/package.mask index 4e9189e86f1..ce047751e24 100644 --- a/profiles/package.mask +++ b/profiles/package.mask @@ -257,10 +257,6 @@ games-puzzle/gnudoku # and accept a more unstable release. >=www-client/chromium-96 -# Anthony G. Basile <[email protected]> (2021-08-27) -# Masked for removal in 30 days. Deprecated upstream. -net-vpn/ipsec-tools - # Bernard Cafarelli <[email protected]> (2021-08-26) # Preparing for final 5.0.0 release >=app-text/tesseract-5.0.0_beta
