From: Carsten Schlote <[email protected]> This is a client for cisco VPN concentrators. See http://www.unix-ag.uni-kl.de/~massar/vpnc/ for details.
There are ptx/generics provided. These are taken from the PKGDIR. There is a new install_alternatve macro in work, which also searches the PKGDIR for installed defaults. When available these generics are obsolete. Updated with patches from Wolfram Sang to fix cross- compile issues. Signed-off-by: Carsten Schlote <[email protected]> --- generic/etc/vpnc/default.conf | 6 + generic/etc/vpnc/vpnc-script | 529 ++++++++++++++++++++ .../0001-Add-missing-options-to-manpage.patch | 38 ++ ...02-makeman.pl-make-it-cross-compile-aware.patch | 174 +++++++ patches/vpnc-0.5.3/0003-posix-fixups.patch | 31 ++ patches/vpnc-0.5.3/0004-update-todos.patch | 46 ++ patches/vpnc-0.5.3/series | 4 + rules/vpnc.in | 47 ++ rules/vpnc.make | 89 ++++ 9 files changed, 964 insertions(+), 0 deletions(-) create mode 100644 generic/etc/vpnc/default.conf create mode 100755 generic/etc/vpnc/vpnc-script create mode 100644 patches/vpnc-0.5.3/0001-Add-missing-options-to-manpage.patch create mode 100644 patches/vpnc-0.5.3/0002-makeman.pl-make-it-cross-compile-aware.patch create mode 100644 patches/vpnc-0.5.3/0003-posix-fixups.patch create mode 100644 patches/vpnc-0.5.3/0004-update-todos.patch create mode 100644 patches/vpnc-0.5.3/series create mode 100644 rules/vpnc.in create mode 100644 rules/vpnc.make diff --git a/generic/etc/vpnc/default.conf b/generic/etc/vpnc/default.conf new file mode 100644 index 0000000..2959626 --- /dev/null +++ b/generic/etc/vpnc/default.conf @@ -0,0 +1,6 @@ +IPSec gateway <gateway> +IPSec ID <group-id> +IPSec secret <group-psk> +IKE Authmode hybrid +Xauth username <username> +Xauth password <password> diff --git a/generic/etc/vpnc/vpnc-script b/generic/etc/vpnc/vpnc-script new file mode 100755 index 0000000..4c8dce4 --- /dev/null +++ b/generic/etc/vpnc/vpnc-script @@ -0,0 +1,529 @@ +#!/bin/sh +#* reason -- why this script was called, one of: pre-init connect disconnect +#* VPNGATEWAY -- vpn gateway address (always present) +#* TUNDEV -- tunnel device (always present) +#* INTERNAL_IP4_ADDRESS -- address (always present) +#* INTERNAL_IP4_NETMASK -- netmask (often unset) +#* INTERNAL_IP4_NETMASKLEN -- netmask length (often unset) +#* INTERNAL_IP4_NETADDR -- address of network (only present if netmask is set) +#* INTERNAL_IP4_DNS -- list of dns serverss +#* INTERNAL_IP4_NBNS -- list of wins servers +#* CISCO_DEF_DOMAIN -- default domain name +#* CISCO_BANNER -- banner from server +#* CISCO_SPLIT_INC -- number of networks in split-network-list +#* CISCO_SPLIT_INC_%d_ADDR -- network address +#* CISCO_SPLIT_INC_%d_MASK -- subnet mask (for example: 255.255.255.0) +#* CISCO_SPLIT_INC_%d_MASKLEN -- subnet masklen (for example: 24) +#* CISCO_SPLIT_INC_%d_PROTOCOL -- protocol (often just 0) +#* CISCO_SPLIT_INC_%d_SPORT -- source port (often just 0) +#* CISCO_SPLIT_INC_%d_DPORT -- destination port (often just 0) + +# FIXMEs: + +# Section A: route handling + +# 1) The 3 values CISCO_SPLIT_INC_%d_PROTOCOL/SPORT/DPORT are currently being ignored +# In order to use them, we'll probably need os specific solutions +# * Linux: iptables -t mangle -I PREROUTING <conditions> -j ROUTE --oif $TUNDEV +# This would be an *alternative* to changing the routes (and thus 2) and 3) +# shouldn't be relevant at all) +# 2) There are two different functions to set routes: generic routes and the +# default route. Why isn't the defaultroute handled via the generic route case? +# 3) In the split tunnel case, all routes but the default route might get replaced +# without getting restored later. We should explicitely check and save them just +# like the defaultroute +# 4) Replies to a dhcp-server should never be sent into the tunnel + +# Section B: Split DNS handling + +# 1) Maybe dnsmasq can do something like that +# 2) Parse dns packets going out via tunnel and redirect them to original dns-server + +#env | sort +#set -x + +# =========== script (variable) setup ==================================== + +PATH=/sbin:/usr/sbin:$PATH + +OS="`uname -s`" + +DEFAULT_ROUTE_FILE=/var/run/vpnc/defaultroute +RESOLV_CONF_BACKUP=/var/run/vpnc/resolv.conf-backup +FULL_SCRIPTNAME=/usr/sbin/vpnc +SCRIPTNAME=`basename $FULL_SCRIPTNAME` + +# some systems, eg. Darwin & FreeBSD, prune /var/run on boot +if [ ! -d "/var/run/vpnc" ]; then + mkdir -p /var/run/vpnc +fi + +# stupid SunOS: no blubber in /usr/local/bin ... (on stdout) +IPROUTE="`which ip | grep '^/' 2> /dev/null`" + +if [ "$OS" = "Linux" ]; then + ifconfig_syntax_ptp="pointopoint" + route_syntax_gw="gw" + route_syntax_del="del" + route_syntax_netmask="netmask" +else + ifconfig_syntax_ptp="" + route_syntax_gw="" + route_syntax_del="delete" + route_syntax_netmask="-netmask" +fi + +if [ -x /sbin/resolvconf ]; then # Optional tool on Debian, Ubuntu, Gentoo + MODIFYRESOLVCONF=modify_resolvconf_manager + RESTORERESOLVCONF=restore_resolvconf_manager +elif [ -x /sbin/modify_resolvconf ]; then # Mandatory tool on Suse earlier than 11.1 + MODIFYRESOLVCONF=modify_resolvconf_suse + RESTORERESOLVCONF=restore_resolvconf_suse +else # Generic for any OS + MODIFYRESOLVCONF=modify_resolvconf_generic + RESTORERESOLVCONF=restore_resolvconf_generic +fi + +# =========== tunnel interface handling ==================================== + +do_ifconfig() { + if [ -n "$INTERNAL_IP4_MTU" ]; then + MTU=$INTERNAL_IP4_MTU + elif [ -n "$IPROUTE" ]; then + DEV=$($IPROUTE route | grep ^default | sed 's/^.* dev \([[:alnum:]-]\+\).*$/\1/') + MTU=$(($($IPROUTE link show "$DEV" | grep mtu | sed 's/^.* mtu \([[:digit:]]\+\).*$/\1/') - 88)) + else + MTU=1412 + fi + + # Point to point interface require a netmask of 255.255.255.255 on some systems + ifconfig "$TUNDEV" inet "$INTERNAL_IP4_ADDRESS" $ifconfig_syntax_ptp "$INTERNAL_IP4_ADDRESS" netmask 255.255.255.255 mtu ${MTU} up + + if [ -n "$INTERNAL_IP4_NETMASK" ]; then + set_network_route $INTERNAL_IP4_NETADDR $INTERNAL_IP4_NETMASK $INTERNAL_IP4_NETMASKLEN + fi +} + +destroy_tun_device() { + case "$OS" in + NetBSD) # and probably others... + ifconfig "$TUNDEV" destroy + ;; + esac +} + +# =========== route handling ==================================== + +if [ -n "$IPROUTE" ]; then + fix_ip_get_output () { + sed 's/cache//;s/metric \?[0-9]\+ [0-9]\+//g;s/hoplimit [0-9]\+//g' + } + + set_vpngateway_route() { + $IPROUTE route add `$IPROUTE route get "$VPNGATEWAY" | fix_ip_get_output` + $IPROUTE route flush cache + } + + del_vpngateway_route() { + $IPROUTE route $route_syntax_del "$VPNGATEWAY" + $IPROUTE route flush cache + } + + set_default_route() { + $IPROUTE route | grep '^default' | fix_ip_get_output > "$DEFAULT_ROUTE_FILE" + $IPROUTE route replace default dev "$TUNDEV" + $IPROUTE route flush cache + } + + set_network_route() { + NETWORK="$1" + NETMASK="$2" + NETMASKLEN="$3" + $IPROUTE route replace "$NETWORK/$NETMASKLEN" dev "$TUNDEV" + $IPROUTE route flush cache + } + + reset_default_route() { + if [ -s "$DEFAULT_ROUTE_FILE" ]; then + $IPROUTE route replace `cat "$DEFAULT_ROUTE_FILE"` + $IPROUTE route flush cache + rm -f -- "$DEFAULT_ROUTE_FILE" + fi + } + + del_network_route() { + NETWORK="$1" + NETMASK="$2" + NETMASKLEN="$3" + $IPROUTE route $route_syntax_del "$NETWORK/$NETMASKLEN" dev "$TUNDEV" + $IPROUTE route flush cache + } +else # use route command + get_default_gw() { + # isn't -n supposed to give --numeric output? + # apperently not... + # Get rid of lines containing IPv6 addresses (':') + netstat -r -n | awk '/:/ { next; } /^(default|0\.0\.0\.0)/ { print $2; }' + } + + set_vpngateway_route() { + route add -host "$VPNGATEWAY" $route_syntax_gw "`get_default_gw`" + } + + del_vpngateway_route() { + route $route_syntax_del -host "$VPNGATEWAY" + } + + set_default_route() { + DEFAULTGW="`get_default_gw`" + echo "$DEFAULTGW" > "$DEFAULT_ROUTE_FILE" + route $route_syntax_del default + route add default $route_syntax_gw "$INTERNAL_IP4_ADDRESS" + } + + set_network_route() { + NETWORK="$1" + NETMASK="$2" + NETMASKLEN="$3" + del_network_route "$NETWORK" "$NETMASK" "$NETMASKLEN" + route add -net "$NETWORK" $route_syntax_netmask "$NETMASK" $route_syntax_gw "$INTERNAL_IP4_ADDRESS" + } + + reset_default_route() { + if [ -s "$DEFAULT_ROUTE_FILE" ]; then + route $route_syntax_del default + route add default $route_syntax_gw `cat "$DEFAULT_ROUTE_FILE"` + rm -f -- "$DEFAULT_ROUTE_FILE" + fi + } + + del_network_route() { + case "$OS" in + Linux|NetBSD|Darwin) # and probably others... + # routes are deleted automatically on device shutdown + return + ;; + esac + NETWORK="$1" + NETMASK="$2" + NETMASKLEN="$3" + route $route_syntax_del -net "$NETWORK" $route_syntax_netmask "$NETMASK" $route_syntax_gw "$INTERNAL_IP4_ADDRESS" + } +fi + +# =========== resolv.conf handling ==================================== + +# =========== resolv.conf handling for any OS ========================= + +modify_resolvconf_generic() { + grep '^...@vpnc_generated@' /etc/resolv.conf > /dev/null 2>&1 || cp -- /etc/resolv.conf "$RESOLV_CONF_BACKUP" + NEW_RESOLVCONF="#...@vpnc_generated@ -- this file is generated by vpnc +# and will be overwritten by vpnc +# as long as the above mark is intact" + + # Remember the original value of CISCO_DEF_DOMAIN we need it later + CISCO_DEF_DOMAIN_ORIG="$CISCO_DEF_DOMAIN" + # Don't step on INTERNAL_IP4_DNS value, use a temporary variable + INTERNAL_IP4_DNS_TEMP="$INTERNAL_IP4_DNS" + exec 6< "$RESOLV_CONF_BACKUP" + while read LINE <&6 ; do + case "$LINE" in + nameserver*) + if [ -n "$INTERNAL_IP4_DNS_TEMP" ]; then + read ONE_NAMESERVER INTERNAL_IP4_DNS_TEMP <<-EOF + $INTERNAL_IP4_DNS_TEMP +EOF + LINE="nameserver $ONE_NAMESERVER" + else + LINE="" + fi + ;; + search*) + if [ -n "$CISCO_DEF_DOMAIN" ]; then + LINE="$LINE $CISCO_DEF_DOMAIN" + CISCO_DEF_DOMAIN="" + fi + ;; + domain*) + if [ -n "$CISCO_DEF_DOMAIN" ]; then + LINE="domain $CISCO_DEF_DOMAIN" + CISCO_DEF_DOMAIN="" + fi + ;; + esac + NEW_RESOLVCONF="$NEW_RESOLVCONF +$LINE" + done + exec 6<&- + + for i in $INTERNAL_IP4_DNS_TEMP ; do + NEW_RESOLVCONF="$NEW_RESOLVCONF +nameserver $i" + done + if [ -n "$CISCO_DEF_DOMAIN" ]; then + NEW_RESOLVCONF="$NEW_RESOLVCONF +search $CISCO_DEF_DOMAIN" + fi + echo "$NEW_RESOLVCONF" > /etc/resolv.conf + + if [ "$OS" = "Darwin" ]; then + case "`uname -r`" in + # Skip for pre-10.4 systems + 4.*|5.*|6.*|7.*) + ;; + # 10.4 and later require use of scutil for DNS to work properly + *) + OVERRIDE_PRIMARY="" + if [ -n "$CISCO_SPLIT_INC" ]; then + if [ $CISCO_SPLIT_INC -lt 1 ]; then + # Must override for correct default route + # Cannot use multiple DNS matching in this case + OVERRIDE_PRIMARY='d.add OverridePrimary # 1' + fi + fi + # Uncomment the following if/fi pair to use multiple + # DNS matching when available. When multiple DNS matching + # is present, anything reading the /etc/resolv.conf file + # directly will probably not work as intended. + #if [ -z "$CISCO_DEF_DOMAIN_ORIG" ]; then + # Cannot use multiple DNS matching without a domain + OVERRIDE_PRIMARY='d.add OverridePrimary # 1' + #fi + scutil >/dev/null 2>&1 <<-EOF + open + d.init + d.add ServerAddresses * $INTERNAL_IP4_DNS + set State:/Network/Service/$TUNDEV/DNS + d.init + # next line overrides the default gateway and breaks split routing + # d.add Router $INTERNAL_IP4_ADDRESS + d.add Addresses * $INTERNAL_IP4_ADDRESS + d.add SubnetMasks * 255.255.255.255 + d.add InterfaceName $TUNDEV + $OVERRIDE_PRIMARY + set State:/Network/Service/$TUNDEV/IPv4 + close + EOF + if [ -n "$CISCO_DEF_DOMAIN_ORIG" ]; then + scutil >/dev/null 2>&1 <<-EOF + open + get State:/Network/Service/$TUNDEV/DNS + d.add DomainName $CISCO_DEF_DOMAIN_ORIG + d.add SearchDomains * $CISCO_DEF_DOMAIN_ORIG + d.add SupplementalMatchDomains * $CISCO_DEF_DOMAIN_ORIG + set State:/Network/Service/$TUNDEV/DNS + close + EOF + fi + ;; + esac + fi +} + +restore_resolvconf_generic() { + if [ ! -e "$RESOLV_CONF_BACKUP" ]; then + return + fi + grep '^...@vpnc_generated@' /etc/resolv.conf > /dev/null 2>&1 && cat "$RESOLV_CONF_BACKUP" > /etc/resolv.conf + rm -f -- "$RESOLV_CONF_BACKUP" + + if [ "$OS" = "Darwin" ]; then + case "`uname -r`" in + # Skip for pre-10.4 systems + 4.*|5.*|6.*|7.*) + ;; + # 10.4 and later require use of scutil for DNS to work properly + *) + scutil >/dev/null 2>&1 <<-EOF + open + remove State:/Network/Service/$TUNDEV/IPv4 + remove State:/Network/Service/$TUNDEV/DNS + close + EOF + ;; + esac + fi +} +# === resolv.conf handling via /sbin/modify_resolvconf (Suse) ===================== + +# Suse provides a script that modifies resolv.conf. Use it because it will +# restart/reload all other services that care about it (e.g. lwresd). + +modify_resolvconf_suse() +{ + RESOLV_OPTS='' + test -n "$INTERNAL_IP4_DNS" && RESOLV_OPTS="-n \"$INTERNAL_IP4_DNS\"" + test -n "$CISCO_DEF_DOMAIN" && RESOLV_OPTS="$RESOLV_OPTS -d $CISCO_DEF_DOMAIN" + test -n "$RESOLV_OPTS" && eval /sbin/modify_resolvconf modify -s $SCRIPTNAME -p $SCRIPTNAME -f $FULL_SCRIPTNAME -e $TUNDEV $RESOLV_OPTS -t \"This file was created by $SCRIPTNAME\" +} + +# Restore resolv.conf to old contents on Suse +restore_resolvconf_suse() +{ + /sbin/modify_resolvconf restore -s vpnc -p $SCRIPTNAME -f $FULL_SCRIPTNAME -e $TUNDEV +} + +# === resolv.conf handling via /sbin/resolvconf (Debian, Ubuntu, Gentoo)) ========= + +modify_resolvconf_manager() { + NEW_RESOLVCONF="" + for i in $INTERNAL_IP4_DNS; do + NEW_RESOLVCONF="$NEW_RESOLVCONF +nameserver $i" + done + if [ -n "$CISCO_DEF_DOMAIN" ]; then + NEW_RESOLVCONF="$NEW_RESOLVCONF +domain $CISCO_DEF_DOMAIN" + fi + echo "$NEW_RESOLVCONF" | /sbin/resolvconf -a $TUNDEV +} + +restore_resolvconf_manager() { + /sbin/resolvconf -d $TUNDEV +} + +# ========= Toplevel state handling ======================================= + +kernel_is_2_6_or_above() { + case `uname -r` in + 1.*|2.[012345]*) + return 1 + ;; + *) + return 0 + ;; + esac +} + +do_pre_init() { + if [ "$OS" = "Linux" ]; then + if (exec 6<> /dev/net/tun) > /dev/null 2>&1 ; then + : + else # can't open /dev/net/tun + test -e /proc/sys/kernel/modprobe && `cat /proc/sys/kernel/modprobe` tun 2>/dev/null + # fix for broken devfs in kernel 2.6.x + if [ "`readlink /dev/net/tun`" = misc/net/tun \ + -a ! -e /dev/net/misc/net/tun -a -e /dev/misc/net/tun ] ; then + ln -sf /dev/misc/net/tun /dev/net/tun + fi + # make sure tun device exists + if [ ! -e /dev/net/tun ]; then + mkdir -p /dev/net + mknod -m 0640 /dev/net/tun c 10 200 + fi + # workaround for a possible latency caused by udev, sleep max. 10s + if kernel_is_2_6_or_above ; then + for x in `seq 100` ; do + (exec 6<> /dev/net/tun) > /dev/null 2>&1 && break; + sleep 0.1 + done + fi + fi + elif [ "$OS" = "FreeBSD" ]; then + if [ ! -e /dev/tun ]; then + kldload if_tun + fi + elif [ "$OS" = "GNU/kFreeBSD" ]; then + if [ ! -e /dev/tun ]; then + kldload if_tun + fi + elif [ "$OS" = "NetBSD" ]; then + : + elif [ "$OS" = "OpenBSD" ]; then + : + elif [ "$OS" = "SunOS" ]; then + : + elif [ "$OS" = "Darwin" ]; then + : + fi +} + +do_connect() { + if [ -n "$CISCO_BANNER" ]; then + echo "Connect Banner:" + echo "$CISCO_BANNER" | while read LINE ; do echo "|" "$LINE" ; done + echo + fi + + do_ifconfig + set_vpngateway_route + if [ -n "$CISCO_SPLIT_INC" ]; then + i=0 + while [ $i -lt $CISCO_SPLIT_INC ] ; do + eval NETWORK="\${CISCO_SPLIT_INC_${i}_ADDR}" + eval NETMASK="\${CISCO_SPLIT_INC_${i}_MASK}" + eval NETMASKLEN="\${CISCO_SPLIT_INC_${i}_MASKLEN}" + if [ $NETWORK != "0.0.0.0" ]; then + set_network_route "$NETWORK" "$NETMASK" "$NETMASKLEN" + else + set_default_route + fi + i=`expr $i + 1` + done + for i in $INTERNAL_IP4_DNS ; do + set_network_route "$i" "255.255.255.255" "32" + done + else + set_default_route + fi + + if [ -n "$INTERNAL_IP4_DNS" ]; then + $MODIFYRESOLVCONF + fi +} + +do_disconnect() { + if [ -n "$CISCO_SPLIT_INC" ]; then + i=0 + while [ $i -lt $CISCO_SPLIT_INC ] ; do + eval NETWORK="\${CISCO_SPLIT_INC_${i}_ADDR}" + eval NETMASK="\${CISCO_SPLIT_INC_${i}_MASK}" + eval NETMASKLEN="\${CISCO_SPLIT_INC_${i}_MASKLEN}" + if [ $NETWORK != "0.0.0.0" ]; then + # FIXME: This doesn't restore previously overwritten + # routes. + del_network_route "$NETWORK" "$NETMASK" "$NETMASKLEN" + else + reset_default_route + fi + i=`expr $i + 1` + done + for i in $INTERNAL_IP4_DNS ; do + del_network_route "$i" "255.255.255.255" "32" + done + else + reset_default_route + fi + + del_vpngateway_route + + if [ -n "$INTERNAL_IP4_DNS" ]; then + $RESTORERESOLVCONF + fi + destroy_tun_device +} + +#### Main + +if [ -z "$reason" ]; then + echo "this script must be called from vpnc" 1>&2 + exit 1 +fi + +case "$reason" in + pre-init) + do_pre_init + ;; + connect) + do_connect + ;; + disconnect) + do_disconnect + ;; + *) + echo "unknown reason '$reason'. Maybe vpnc-script is out of date" 1>&2 + exit 1 + ;; +esac + +exit 0 diff --git a/patches/vpnc-0.5.3/0001-Add-missing-options-to-manpage.patch b/patches/vpnc-0.5.3/0001-Add-missing-options-to-manpage.patch new file mode 100644 index 0000000..ead3690 --- /dev/null +++ b/patches/vpnc-0.5.3/0001-Add-missing-options-to-manpage.patch @@ -0,0 +1,38 @@ +From: Wolfram Sang <[email protected]> +Subject: Added missing options to manpage + +Signed-off-by: Wolfram Sang <[email protected]> + +Updated for vpnc-0.5.3 + +Signed-off-by: Carsten Schlote <[email protected]> +--- + vpnc.8.template | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +Index: vpnc.8.template +=================================================================== +--- vpnc.8.template.orig 2008-11-19 21:36:12.000000000 +0100 ++++ vpnc.8.template 2010-02-04 12:50:26.000000000 +0100 +@@ -90,6 +90,21 @@ + .IP + Prints your configuration; output can be used as vpnc.conf + ++.HP ++\fB\-\-version\fR ++.IP ++Displays your version of vpnc. ++ ++.HP ++\fB\-\-help\fR ++.IP ++Displays the basic options you need for running vpnc. ++ ++.HP ++\fB\-\-long\-help\fR ++.IP ++Displays all options of vpnc. ++ + .SH FILES + .I /etc/vpnc.conf + .I /etc/vpnc/default.conf diff --git a/patches/vpnc-0.5.3/0002-makeman.pl-make-it-cross-compile-aware.patch b/patches/vpnc-0.5.3/0002-makeman.pl-make-it-cross-compile-aware.patch new file mode 100644 index 0000000..741edf0 --- /dev/null +++ b/patches/vpnc-0.5.3/0002-makeman.pl-make-it-cross-compile-aware.patch @@ -0,0 +1,174 @@ +From: Wolfram Sang <[email protected]> +Subject: makeman.pl - make cros-compile aware + +If we build cross and can't execute the binary for --long-help, then just +insert a standard text pointing to --long-help. + +Signed-off-by: Wolfram Sang <[email protected]> + +Updated for vpnc-0.5.3 + +Signed-off-by: Carsten Schlote <[email protected]> +--- + makeman.pl | 128 +++++++++++++++++++++++++++++++++---------------------------- + 1 file changed, 71 insertions(+), 57 deletions(-) + +Index: makeman.pl +=================================================================== +--- makeman.pl.orig 2008-11-19 21:36:12.000000000 +0100 ++++ makeman.pl 2010-02-04 12:56:20.000000000 +0100 +@@ -2,11 +2,11 @@ + + # $Id: makeman.pl 312 2008-06-15 18:09:42Z Joerg Mayer $ + +-# Written by Wolfram Sang ([email protected]) in 2007, ++# Written by Wolfram Sang ([email protected]) in 2007-2009, + # some inspiration from help2man by Brendan O'Dea and from Perl::Critic + + # Generate the vpnc-manpage from a template and the --long-help-output. +-# Version 0.2 ++# Version 0.21 + + # Command-line options: none + # Files needed : ./vpnc ./vpnc.8.template ./VERSION +@@ -22,71 +22,85 @@ + + my $vpnc = './vpnc'; + -e $vpnc or die "$0: Can't find $vpnc. Did you compile it?\n"; +--x $vpnc or die "$0: Can't execute $vpnc. Please check permissions.\n"; + + # The code converting the help-output to manpage format is lots of + # regex-fiddling, sorry. It got a bit more complicated by additionally + # indenting lists (those originally starting with an asterisk). I hope + # this pays off when converting the manpage to HTML or such. ++# In case we are cross-compiling, just a standard replacement will be ++# used. The right thing to do would be parsing config.c, but well... + +-open my $LONGHELP, '-|', "$vpnc --long-help"; +-my $vpnc_options = ''; +-my $relative_indent = 0; +-my $indent_needed = 0; +- +-while (<$LONGHELP>) { +- if (/^ /) { +- +- # Check if additional indent needs to be finished by comparing the +- # amount of spaces at the beginning. A bit ugly, but I don't see a +- # better way to do it. +- if ($relative_indent) { +- /^( *)/; +- if (length($1) < $relative_indent) { +- $vpnc_options .= ".RE\n"; +- $relative_indent = 0; +- $indent_needed = 1; +- } +- } +- +- # Highlight the option and make an optional argument italic. +- if (s/^ *(--[\w-]+)/\n.TP\n.BI "$1"/) { +- s/(<.+>)/ " $1"/; +- } +- +- # Highlight conffile-only options. +- s/^ *(\(configfile only option\))/\n.TP\n.B $1/; +- +- # Position the Default-string +- s/^ *(Default:)/.IP\n$1/; +- +- # Highlight the conf-variable and make an optional argument italic. +- if (s/^ *(conf-variable:) (.+?) ?([<\n])/.P\n$1\n.BI "$2"$3/) { +- s/(<.+>)/ " $1"/; +- } ++my $vpnc_options = ''; + +- # Replace asterisk with bulletin; indent if needed. +- if (s/^( +)\* /.IP \\(bu\n/) { +- if (not $relative_indent) { +- $vpnc_options .= ".RS\n"; +- $relative_indent = length $1; ++# Check if file is executable and native binary. Can this be done more elegant? ++system("$vpnc --long-help 2>/dev/null >&2"); ++if (($? >> 8) == 0) { ++ my $relative_indent = 0; ++ my $indent_needed = 0; ++ ++ open my $LONGHELP, '-|', "$vpnc --long-help"; ++ while (<$LONGHELP>) { ++ if (/^ /) { ++ ++ # Check if additional indent needs to be finished by comparing the ++ # amount of spaces at the beginning. A bit ugly, but I don't see a ++ # better way to do it. ++ if ($relative_indent) { ++ /^( *)/; ++ if (length($1) < $relative_indent) { ++ $vpnc_options .= ".RE\n"; ++ $relative_indent = 0; ++ $indent_needed = 1; ++ } ++ } ++ ++ # Highlight the option and make an optional argument italic. ++ if (s/^ *(--[\w-]+)/\n.TP\n.BI "$1"/) { ++ s/(<.+>)/ " $1"/; ++ } ++ ++ # Highlight conffile-only options. ++ s/^ *(\(configfile only option\))/\n.TP\n.B $1/; ++ ++ # Position the Default-string ++ s/^ *(Default:)/.IP\n$1/; ++ ++ # Highlight the conf-variable and make an optional argument italic. ++ if (s/^ *(conf-variable:) (.+?) ?([<\n])/.P\n$1\n.BI "$2"$3/) { ++ s/(<.+>)/ " $1"/; ++ } ++ ++ # Replace asterisk with bulletin; indent if needed. ++ if (s/^( +)\* /.IP \\(bu\n/) { ++ if (not $relative_indent) { ++ $vpnc_options .= ".RS\n"; ++ $relative_indent = length $1; ++ } ++ } ++ ++ # Do we need to add an .IP-command after .RE or is there already one? ++ if ($indent_needed and not /^\n?\.[TI]?P/) { ++ $vpnc_options .= ".IP\n"; ++ $indent_needed = 0; ++ } ++ ++ # Finalize string and add it to buffer ++ s/^ *//; ++ s/ *$//; ++ s/-/\\-/g; ++ $vpnc_options .= $_; + } + } +- +- # Do we need to add an .IP-command after .RE or is there already one? +- if ($indent_needed and not /^\n?\.[TI]?P/) { +- $vpnc_options .= ".IP\n"; +- $indent_needed = 0; +- } +- +- # Finalize string and add it to buffer +- s/^ *//; +- s/ *$//; +- s/-/\\-/g; +- $vpnc_options .= $_; +- } ++ close $LONGHELP; ++} else { ++ $vpnc_options = "\nPlease check --long-help for a complete list of options!\n"; ++ warn "$0: Cannot execute binary (probably cross-compiled). Using default replacement string instead of longhelp-output.\n" + } +-close $LONGHELP; ++ ++open my $LONGHELP, '-|', "$vpnc --long-help"; ++my $vpnc_options = ''; ++my $relative_indent = 0; ++my $indent_needed = 0; + + # Hopefully the code speaks for itself from now on... + diff --git a/patches/vpnc-0.5.3/0003-posix-fixups.patch b/patches/vpnc-0.5.3/0003-posix-fixups.patch new file mode 100644 index 0000000..9a83916 --- /dev/null +++ b/patches/vpnc-0.5.3/0003-posix-fixups.patch @@ -0,0 +1,31 @@ +From: Wolfram Sang <[email protected]> +Subject: index -> strchr + +Those legacy functions can be removed from uClibc when you disable the +UCLIBC_SUSV3_LEGACY option to save space, but some programs still use +them, so we patch that up in buildroot. + +Original patch by Ulf Samuelsson for buildroot. Forwarded with permission. + +Signed-off-by: Wolfram Sang <[email protected]> + +Updated for vpnc-0.5.3, some changes dropped. + +Signed-off-by: Carsten Schlote <[email protected]> +--- + config.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +Index: config.c +=================================================================== +--- config.c.orig 2008-11-19 21:36:12.000000000 +0100 ++++ config.c 2010-02-04 12:57:27.000000000 +0100 +@@ -456,7 +456,7 @@ + { + char *realname; + +- asprintf(&realname, "%s%s%s", index(name, '/') ? "" : "/etc/vpnc/", name, add_dot_conf ? ".conf" : ""); ++ asprintf(&realname, "%s%s%s", strchr(name, '/') ? "" : "/etc/vpnc/", name, add_dot_conf ? ".conf" : ""); + return realname; + } + diff --git a/patches/vpnc-0.5.3/0004-update-todos.patch b/patches/vpnc-0.5.3/0004-update-todos.patch new file mode 100644 index 0000000..0f4e8fc --- /dev/null +++ b/patches/vpnc-0.5.3/0004-update-todos.patch @@ -0,0 +1,46 @@ +From: Wolfram Sang <[email protected]> +Subject: Updated ToDO file + +* mark manpage-generations as done +* add info about the "@"-bug I collected some time ago + +Signed-off-by: Wolfram Sang <[email protected]> + +Updated for vpnc-0.5.3. + +Signed-off-by: Carsten Schlote <[email protected]> +---- + TODO | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +Index: TODO +=================================================================== +--- TODO.orig 2008-11-19 21:36:12.000000000 +0100 ++++ TODO 2010-02-04 12:57:42.000000000 +0100 +@@ -32,7 +32,6 @@ + * implement phase1 rekeying (with or without xauth-reauthentication) + * implement compression + * try a list of gateways (backup server) +-* Generate the manpage command line part directly from vpnc + + * optionally use in-kernel-ipsec with pf-key + - merge patch +@@ -40,7 +39,9 @@ + * add support for pcap and dump decrypted traffic + + * research/bugs: +- - usernames containing "@" unable to login ++ - usernames containing "@" unable to login? ++ (just one report claims this. reporter admitted it might be something ++ else caused by going from IOS12.2 to 12.3) + - ipsec over tcp + - nortel support? + - segfault if > 100 routes/acls (to large paket? read size?) +@@ -86,6 +87,7 @@ + + ---- + ++* DONE Generate the manpage command line part directly from vpnc + * DONE implement hybrid-auth + * DONE implement DPD, RFC 3706 Dead Peer Detection + * DONE --local-address diff --git a/patches/vpnc-0.5.3/series b/patches/vpnc-0.5.3/series new file mode 100644 index 0000000..1d94e80 --- /dev/null +++ b/patches/vpnc-0.5.3/series @@ -0,0 +1,4 @@ +0001-Add-missing-options-to-manpage.patch -p0 +0002-makeman.pl-make-it-cross-compile-aware.patch -p0 +0003-posix-fixups.patch -p0 +0004-update-todos.patch -p0 diff --git a/rules/vpnc.in b/rules/vpnc.in new file mode 100644 index 0000000..17a98fb --- /dev/null +++ b/rules/vpnc.in @@ -0,0 +1,47 @@ +## SECTION=networking + +menuconfig VPNC + tristate + select LIBGCRYPT + select LIBGPG_ERROR + select OPENSSL if VPNC_USE_CERTS + + prompt "vpnc " + help + vpnc - client for cisco vpn concentrator + + vpnc is supposed to work with: + * Cisco VPN concentrator 3000 Series + * Cisco IOS routers + * Cisco PIX / ASA Zecurity Appliances + * Juniper/Netscreen + + Supported Authentications: Hybrid, Pre-Shared-Key + XAUTH, Pre-Shared-Key + Supported IKE DH-Groups: dh1 dh2 dh5 + Supported Hash Algo (IKE/IPSEC): md5 sha1 + Supported Encryptions (IKE/IPSEC): (null) (1des) 3des aes128 aes192 aes256 + Perfect Forward Secrecy: nopfs dh1 dh2 dh5 + + Required Kernel Options: Universal TUN/TAP device driver support + Required Libraries: libgcrypt (version 1.1.90 for pre7 or later) (1.1.12 for pre1 to pre6) + Required dependency: libgpg-error + Optional Libraries: openssl (for hybrid auth support) + +if VPNC + +config VPNC_USE_CERTS + bool + prompt "enable hybrid auth support" + help + Uses SSL certificates and requires OpenSSL library + installed on target. + + NOTE: Enabling this options causes the define OPENSSL_GPL_VIOLATION to be set, + as OpenSSL is used in a way violating the GPL license. See the source code + and the vpnc homepage for more details. + +if VPNC_USE_CERTS +comment "vpnc uses OpenSSL under violation of GPL! Check implications!" +endif + +endif diff --git a/rules/vpnc.make b/rules/vpnc.make new file mode 100644 index 0000000..3ceeda1 --- /dev/null +++ b/rules/vpnc.make @@ -0,0 +1,89 @@ +# -*-makefile-*- +# +# Copyright (C) 2008 by Carsten Schlote <[email protected]> +# +# See CREDITS for details about who has contributed to this project. +# +# For further information about the PTXdist project and license conditions +# see the README file. +# + +# +# We provide this package +# +PACKAGES-$(PTXCONF_VPNC) += vpnc + +# +# Paths and names +# +VPNC_VERSION := 0.5.3 +VPNC := vpnc-$(VPNC_VERSION) +VPNC_SUFFIX := tar.gz +VPNC_URL := http://www.unix-ag.uni-kl.de/~massar/vpnc/$(VPNC).$(VPNC_SUFFIX) +VPNC_SOURCE := $(SRCDIR)/$(VPNC).$(VPNC_SUFFIX) +VPNC_DIR := $(BUILDDIR)/$(VPNC) + +# ---------------------------------------------------------------------------- +# Get +# ---------------------------------------------------------------------------- + +$(VPNC_SOURCE): + @$(call targetinfo) + @$(call get, VPNC) + +# ---------------------------------------------------------------------------- +# Prepare, Compile and Install +# ---------------------------------------------------------------------------- + +VPNC_PATH := PATH=$(CROSS_PATH) + +VPNC_CONF_TOOL := NO + +VPNC_MAKE_ENV := $(CROSS_ENV) + +ifdef PTXCONF_VPNC_USE_CERTS +VPNC_MAKE_ENV += \ + OPENSSL_GPL_VIOLATION=-DOPENSSL_GPL_VIOLATION \ + OPENSSLLIBS=-lcrypto +endif + +VPNC_MAKE_OPT := \ + DESTDIR=$(VPNC_PKGDIR) \ + PREFIX=/usr \ + $(CROSS_ENV_CC) + +VPNC_INSTALL_OPT := \ + $(VPNC_MAKE_OPT) \ + install + +# ---------------------------------------------------------------------------- +# Target-Install +# ---------------------------------------------------------------------------- + +$(STATEDIR)/vpnc.targetinstall: + @$(call targetinfo) + + @$(call install_init, vpnc) + @$(call install_fixup, vpnc,PACKAGE,vpnc) + @$(call install_fixup, vpnc,PRIORITY,optional) + @$(call install_fixup, vpnc,VERSION,$(VPNC_VERSION)) + @$(call install_fixup, vpnc,SECTION,base) + @$(call install_fixup, vpnc,AUTHOR,"Carsten Schlote <[email protected]>") + @$(call install_fixup, vpnc,DEPENDS,) + @$(call install_fixup, vpnc,DESCRIPTION,"vpnc - client for cisco vpn concentrator") + + @$(call install_copy, vpnc, 0, 0, 0755, -, /usr/bin/cisco-decrypt) + @$(call install_copy, vpnc, 0, 0, 0755, -, /usr/bin/pcf2vpnc) + + @$(call install_copy, vpnc, 0, 0, 0755, -, /usr/sbin/vpnc) + @$(call install_copy, vpnc, 0, 0, 0755, -, /usr/sbin/vpnc-disconnect) + + @$(call install_copy, vpnc, 0, 0, 0755, /etc/vpnc) + @$(call install_alternative, vpnc, 0, 0, 0644, /etc/vpnc/default.conf) + @$(call install_alternative, vpnc, 0, 0, 0644, /etc/vpnc/vpnc-script) + + @$(call install_finish, vpnc) + + @$(call touch) + +# vim: syntax=make -- 1.6.6.1 -- ptxdist mailing list [email protected]
