commit: f0976cbe58de272ab04a19e821677dfa466fb22a Author: Hans de Graaff <graaff <AT> gentoo <DOT> org> AuthorDate: Sat Mar 12 07:30:35 2022 +0000 Commit: Hans de Graaff <graaff <AT> gentoo <DOT> org> CommitDate: Sat Mar 12 07:30:35 2022 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f0976cbe
net-vpn/libreswan: security cleanup Package-Manager: Portage-3.0.30, Repoman-3.0.3 Signed-off-by: Hans de Graaff <graaff <AT> gentoo.org> net-vpn/libreswan/Manifest | 2 - net-vpn/libreswan/libreswan-3.32-r4.ebuild | 119 ---------------------------- net-vpn/libreswan/libreswan-4.5.ebuild | 122 ----------------------------- 3 files changed, 243 deletions(-) diff --git a/net-vpn/libreswan/Manifest b/net-vpn/libreswan/Manifest index 8177dcb0c785..b7a2cc17fadf 100644 --- a/net-vpn/libreswan/Manifest +++ b/net-vpn/libreswan/Manifest @@ -1,3 +1 @@ -DIST libreswan-3.32.tar.gz 4141631 BLAKE2B 37a4cb5c1f52d69b17ba60abd2b7a181d9f5567914a453ab875185110aeda4d33ecdaacfc83e361f153860a1db66faec70e0ad06af65e310af28ae72ce68fc6a SHA512 bb65512351059e2fac6f1c3ed1e291eabd6835faacf6d9c58649dd71dab1bb4fe6d6074178dea6dea01f24d39f3fbefd84c6060e4d8436b5d057fa55ae4467f3 -DIST libreswan-4.5.tar.gz 3529355 BLAKE2B 7485a8c77b997026681b3b99194ee54176f1cd7230af72a2aa231e5caa97946c40b0178f0ffa1dd200085b5919883697d7300bb328561501789707035f045337 SHA512 451a4f71099aa4776624a4c127fdaff492acc38a44228255dcbf955efa0982fd963c989d63522f56279eec6a9ef738febb573dde34aa541724ab11e37a554f9e DIST libreswan-4.6.tar.gz 3579760 BLAKE2B 56099e753d9da882ea9e4b7966706f39bac36cd88adcba5fa1c3201cbe0a2ba7a02042cb9eeb8fd52a7b1ba0f3128b854114abc748fe9bf6d9059937a72eb0e4 SHA512 c1c3efd7665dee6caaf08cb5aa50fcd37c299acad4b62648284fdb04edd50ba8fc8d33a9fb210edaf2312697f8cd251f33a6b16587eb2cfefd1269b4482dd499 diff --git a/net-vpn/libreswan/libreswan-3.32-r4.ebuild b/net-vpn/libreswan/libreswan-3.32-r4.ebuild deleted file mode 100644 index 6d019790c6e4..000000000000 --- a/net-vpn/libreswan/libreswan-3.32-r4.ebuild +++ /dev/null @@ -1,119 +0,0 @@ -# Copyright 1999-2021 Gentoo Authors -# Distributed under the terms of the GNU General Public License v2 - -EAPI=7 - -inherit systemd toolchain-funcs tmpfiles - -DESCRIPTION="IPsec implementation for Linux, fork of Openswan" -HOMEPAGE="https://libreswan.org/"; -SRC_URI="https://download.libreswan.org/${P}.tar.gz"; - -LICENSE="GPL-2 BSD-4 RSA DES" -SLOT="0" -KEYWORDS="amd64 ~arm ~ppc x86" -IUSE="caps curl dnssec ldap pam seccomp selinux systemd test" -RESTRICT="!test? ( test )" - -DEPEND=" - dev-libs/gmp:0= - dev-libs/libevent:0= - dev-libs/nspr - >=dev-libs/nss-3.42 - >=sys-kernel/linux-headers-4.19 - virtual/libcrypt:= - caps? ( sys-libs/libcap-ng ) - curl? ( net-misc/curl ) - dnssec? ( >=net-dns/unbound-1.9.1-r1:= net-libs/ldns:= ) - ldap? ( net-nds/openldap ) - pam? ( sys-libs/pam ) - seccomp? ( sys-libs/libseccomp ) - selinux? ( sys-libs/libselinux ) - systemd? ( sys-apps/systemd:0= ) -" -BDEPEND=" - app-text/docbook-xml-dtd:4.1.2 - app-text/xmlto - dev-libs/nss - sys-devel/bison - sys-devel/flex - virtual/pkgconfig - test? ( dev-python/setproctitle ) -" -RDEPEND="${DEPEND} - dev-libs/nss[utils(+)] - sys-apps/iproute2 - !net-vpn/strongswan - selinux? ( sec-policy/selinux-ipsec ) -" - -usetf() { - usex "$1" true false -} - -PATCHES=( "${FILESDIR}/${PN}-3.30-ip-path.patch" ) - -src_prepare() { - sed -i -e 's:/sbin/runscript:/sbin/openrc-run:' initsystems/openrc/ipsec.init.in || die - sed -i -e '/^install/ s/postcheck//' -e '/^doinstall/ s/oldinitdcheck//' initsystems/systemd/Makefile || die - default -} - -src_configure() { - tc-export AR CC - export INC_USRLOCAL=/usr - export INC_MANDIR=share/man - export FINALEXAMPLECONFDIR=/usr/share/doc/${PF} - export FINALDOCDIR=/usr/share/doc/${PF}/html - export INITSYSTEM=openrc - export INC_RCDIRS= - export INC_RCDEFAULT=/etc/init.d - export USERCOMPILE= - export USERLINK= - export USE_DNSSEC=$(usetf dnssec) - export USE_LABELED_IPSEC=$(usetf selinux) - export USE_LIBCAP_NG=$(usetf caps) - export USE_LIBCURL=$(usetf curl) - export USE_LINUX_AUDIT=$(usetf selinux) - export USE_LDAP=$(usetf ldap) - export USE_SECCOMP=$(usetf seccomp) - export USE_SYSTEMD_WATCHDOG=$(usetf systemd) - export SD_WATCHDOGSEC=$(usex systemd 200 0) - export USE_XAUTHPAM=$(usetf pam) - export DEBUG_CFLAGS= - export OPTIMIZE_CFLAGS= - export WERROR_CFLAGS= -} - -src_compile() { - emake all - emake -C initsystems INITSYSTEM=systemd SYSTEMUNITDIR="$(systemd_get_systemunitdir)" SYSTEMTMPFILESDIR="/usr/lib/tmpfiles.d" all -} - -src_test() { - : # integration tests only that require set of kvms to be set up -} - -src_install() { - default - emake -C initsystems INITSYSTEM=systemd SYSTEMUNITDIR="$(systemd_get_systemunitdir)" SYSTEMTMPFILESDIR="/usr/lib/tmpfiles.d" DESTDIR="${D}" install - - echo "include /etc/ipsec.d/*.secrets" > "${D}"/etc/ipsec.secrets - fperms 0600 /etc/ipsec.secrets - - dodoc -r docs - - find "${D}" -type d -empty -delete || die -} - -pkg_postinst() { - tmpfiles_process libreswan.conf - - local IPSEC_CONFDIR=${ROOT}/etc/ipsec.d - if [[ ! -f ${IPSEC_CONFDIR}/cert8.db && ! -f ${IPSEC_CONFDIR}/cert9.db ]] ; then - ebegin "Setting up NSS database in ${IPSEC_CONFDIR} with empty password" - certutil -N -d "${IPSEC_CONFDIR}" --empty-password - eend $? - einfo "To set a password: certutil -W -d sql:${IPSEC_CONFDIR}" - fi -} diff --git a/net-vpn/libreswan/libreswan-4.5.ebuild b/net-vpn/libreswan/libreswan-4.5.ebuild deleted file mode 100644 index 6e63e0b26f56..000000000000 --- a/net-vpn/libreswan/libreswan-4.5.ebuild +++ /dev/null @@ -1,122 +0,0 @@ -# Copyright 1999-2022 Gentoo Authors -# Distributed under the terms of the GNU General Public License v2 - -EAPI=7 - -inherit systemd toolchain-funcs tmpfiles - -DESCRIPTION="IPsec implementation for Linux, fork of Openswan" -HOMEPAGE="https://libreswan.org/"; -SRC_URI="https://download.libreswan.org/${P}.tar.gz"; - -LICENSE="GPL-2 BSD-4 RSA DES" -SLOT="0" -KEYWORDS="amd64 ~arm ~ppc x86" -IUSE="caps curl dnssec ldap networkmanager pam seccomp selinux systemd test" -RESTRICT="!test? ( test )" - -DEPEND=" - dev-libs/gmp:0= - dev-libs/libevent:0= - dev-libs/nspr - >=dev-libs/nss-3.42 - >=sys-kernel/linux-headers-4.19 - virtual/libcrypt:= - caps? ( sys-libs/libcap-ng ) - curl? ( net-misc/curl ) - dnssec? ( >=net-dns/unbound-1.9.1-r1:= net-libs/ldns:= ) - ldap? ( net-nds/openldap ) - pam? ( sys-libs/pam ) - seccomp? ( sys-libs/libseccomp ) - selinux? ( sys-libs/libselinux ) - systemd? ( sys-apps/systemd:0= ) -" -BDEPEND=" - app-text/docbook-xml-dtd:4.1.2 - app-text/xmlto - dev-libs/nss - sys-devel/bison - sys-devel/flex - virtual/pkgconfig - test? ( dev-python/setproctitle ) -" -RDEPEND="${DEPEND} - dev-libs/nss[utils(+)] - sys-apps/iproute2 - !net-vpn/strongswan - selinux? ( sec-policy/selinux-ipsec ) -" - -usetf() { - usex "$1" true false -} - -PATCHES=( "${FILESDIR}/${PN}-4.2-ip-path.patch" ) - -src_prepare() { - sed -i -e 's:/sbin/runscript:/sbin/openrc-run:' initsystems/openrc/ipsec.init.in || die - sed -i -e '/^install/ s/postcheck//' -e '/^doinstall/ s/oldinitdcheck//' initsystems/systemd/Makefile || die - default -} - -src_configure() { - tc-export AR CC - export PREFIX=/usr - export FINALEXAMPLECONFDIR=/usr/share/doc/${PF} - export FINALDOCDIR=/usr/share/doc/${PF}/html - export INITSYSTEM=$(usex systemd systemd openrc) - export INITDDIRS= - export INITDDIR_DEFAULT=/etc/init.d - export USERCOMPILE=${CFLAGS} - export USERLINK=${LDFLAGS} - export USE_DNSSEC=$(usetf dnssec) - export USE_LABELED_IPSEC=$(usetf selinux) - export USE_LIBCAP_NG=$(usetf caps) - export USE_LIBCURL=$(usetf curl) - export USE_LINUX_AUDIT=$(usetf selinux) - export USE_LDAP=$(usetf ldap) - export USE_NM=$(usetf networkmanager) - export USE_SECCOMP=$(usetf seccomp) - export USE_SYSTEMD_WATCHDOG=$(usetf systemd) - export SD_WATCHDOGSEC=$(usex systemd 200 0) - export USE_AUTHPAM=$(usetf pam) - export DEBUG_CFLAGS= - export OPTIMIZE_CFLAGS= - export WERROR_CFLAGS= -} - -src_compile() { - emake all - emake -C initsystems INITSYSTEM=systemd SYSTEMUNITDIR="$(systemd_get_systemunitdir)" SYSTEMTMPFILESDIR="/usr/lib/tmpfiles.d" all -} - -src_test() { - : # integration tests only that require set of kvms to be set up -} - -src_install() { - default - emake -C initsystems INITSYSTEM=systemd SYSTEMUNITDIR="$(systemd_get_systemunitdir)" SYSTEMTMPFILESDIR="/usr/lib/tmpfiles.d" DESTDIR="${D}" install - - echo "include /etc/ipsec.d/*.secrets" > "${D}"/etc/ipsec.secrets - fperms 0600 /etc/ipsec.secrets - - keepdir /var/lib/ipsec/nss - fperms 0700 /var/lib/ipsec/nss - - dodoc -r docs - - find "${D}" -type d -empty -delete || die -} - -pkg_postinst() { - tmpfiles_process libreswan.conf - - local IPSEC_CONFDIR=${ROOT}/var/lib/ipsec/nss - if [[ ! -f ${IPSEC_CONFDIR}/cert8.db && ! -f ${IPSEC_CONFDIR}/cert9.db ]] ; then - ebegin "Setting up NSS database in ${IPSEC_CONFDIR} with empty password" - certutil -N -d "${IPSEC_CONFDIR}" --empty-password - eend $? - einfo "To set a password: certutil -W -d sql:${IPSEC_CONFDIR}" - fi -}
