1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
|
#!/usr/bin/make -f
export DEB_LDFLAGS_MAINT_APPEND=-Wl,--as-needed -Wl,-O1
#export DEB_LDFLAGS_MAINT_APPEND=-Wl,--as-needed -Wl,-O1 -Wl,-z,defs
export DEB_BUILD_MAINT_OPTIONS=hardening=+all
CONFIGUREARGS := --libdir=/usr/lib --libexecdir=/usr/lib \
--enable-ldap --enable-curl \
--enable-pkcs11 \
--enable-mediation --enable-medsrv --enable-medcli \
--enable-openssl --enable-agent \
--enable-ctr --enable-ccm --enable-gcm --enable-addrblock \
--enable-eap-radius --enable-eap-identity --enable-eap-md5 \
--enable-eap-gtc --enable-eap-aka --enable-eap-mschapv2 \
--enable-eap-tls --enable-eap-ttls --enable-eap-tnc \
--enable-ha \
--enable-led --enable-gcrypt \
--enable-test-vectors \
--enable-xauth-eap --enable-xauth-pam \
--enable-cmd \
--enable-certexpire \
--enable-lookip \
--enable-error-notify \
--enable-unity \
--disable-blowfish --disable-des # BSD-Young license
#--with-user=strongswan --with-group=nogroup
# --enable-kernel-pfkey --enable-kernel-klips \
# And for --enable-eap-sim we would need the library, which we don't
# have right now.
# Don't --enable-cisco-quirks, because some other IPsec implementations
# (most notably the Phion one) have problems connecting when pluto
# sends these Cisco options.
# get the various DEB_BUILD/DEB_HOST variables
include /usr/share/dpkg/architecture.mk
# the padlock plugin only makes sense on i386
# RdRand only makes sense on i386 and amd64
ifeq ($(DEB_BUILD_ARCH_CPU),i386)
CONFIGUREARGS += --enable-padlock --enable-rdrand
endif
ifeq ($(DEB_BUILD_ARCH_CPU),amd64)
CONFIGUREARGS += --enable-rdrand
endif
ifeq ($(DEB_BUILD_ARCH_OS),linux)
# only enable network-manager and capabilities dropping on linux hosts
# some plugins are linux-only too
CONFIGUREARGS += --enable-nm \
--with-capabilities=libcap \
--enable-farp \
--enable-dhcp \
--enable-af-alg
endif
ifeq ($(DEB_BUILD_ARCH_OS),kfreebsd)
# recommended configure line for FreeBSD
# http://wiki.strongswan.org/projects/strongswan/wiki/FreeBSD
CONFIGUREARGS += --disable-kernel-netlink \
--enable-kernel-pfkey --enable-kernel-pfroute \
--with-group=wheel
endif
override_dh_auto_configure:
dh_auto_configure -- $(CONFIGUREARGS)
override_dh_auto_clean:
dh_auto_clean
# after a make clean, no binaries _should_ be left, but ....
-find $(CURDIR) -name "*.o" | xargs --no-run-if-empty rm
# Really clean (#356716)
# This is a hack: should be better implemented
rm -f lib/libstrongswan/libstrongswan.a || true
rm -f lib/libstrongswan/liboswlog.a || true
# just in case something went wrong
rm -f $(CURDIR)/debian/ipsec.secrets
# and make sure that template are up-to-date
debconf-updatepo
override_dh_install:
# first special cases
ifeq ($(DEB_BUILD_ARCH_OS),linux)
# handle Linux-only plugins
dh_install -p libcharon-extra-plugins usr/lib/ipsec/plugins/libstrongswan-dhcp.so
dh_install -p libcharon-extra-plugins usr/share/strongswan/templates/config/plugins/dhcp.conf
dh_install -p libcharon-extra-plugins etc/strongswan.d/charon/dhcp.conf
dh_install -p libcharon-extra-plugins usr/lib/ipsec/plugins/libstrongswan-farp.so
dh_install -p libcharon-extra-plugins usr/share/strongswan/templates/config/plugins/farp.conf
dh_install -p libcharon-extra-plugins etc/strongswan.d/charon/farp.conf
dh_install -p libstrongswan usr/lib/ipsec/plugins/libstrongswan-kernel-netlink.so
dh_install -p libstrongswan usr/share/strongswan/templates/config/plugins/kernel-netlink.conf
dh_install -p libstrongswan etc/strongswan.d/charon/kernel-netlink.conf
dh_install -p libstrongswan-extra-plugins usr/lib/ipsec/plugins/libstrongswan-af-alg.so
dh_install -p libstrongswan-extra-plugins usr/share/strongswan/templates/config/plugins/af-alg.conf
dh_install -p libstrongswan-extra-plugins etc/strongswan.d/charon/af-alg.conf
# the systemd service file only gets generated on Linux
dh_install -p strongswan-starter lib/systemd/system/strongswan.service
endif
ifeq ($(DEB_BUILD_ARCH_OS),kfreebsd)
# handle FreeBSD-only plugins
dh_install -p libstrongswan usr/lib/ipsec/plugins/libstrongswan-kernel-pfkey.so
dh_install -p libstrongswan usr/share/strongswan/templates/config/plugins/kernel-pfkey.conf
dh_install -p libstrongswan etc/strongswan.d/charon/kernel-pfkey.conf
dh_install -p libstrongswan usr/lib/ipsec/plugins/libstrongswan-kernel-pfroute.so
dh_install -p libstrongswan usr/share/strongswan/templates/config/plugins/kernel-pfroute.conf
dh_install -p libstrongswan etc/strongswan.d/charon/kernel-pfroute.conf
endif
ifeq ($(DEB_BUILD_ARCH_CPU),i386)
# special handling for padlock, as it is only built on i386
dh_install -p libstrongswan-extra-plugins usr/lib/ipsec/plugins/libstrongswan-padlock.so
dh_install -p libstrongswan-extra-plugins usr/share/strongswan/templates/config/plugins/padlock.conf
dh_install -p libstrongswan-extra-plugins etc/strongswan.d/charon/padlock.conf
dh_install -p libstrongswan-extra-plugins usr/lib/ipsec/plugins/libstrongswan-rdrand.so
dh_install -p libstrongswan-extra-plugins usr/share/strongswan/templates/config/plugins/rdrand.conf
dh_install -p libstrongswan-extra-plugins etc/strongswan.d/charon/rdrand.conf
endif
ifeq ($(DEB_BUILD_ARCH_CPU), amd64)
dh_install -p libstrongswan-extra-plugins usr/lib/ipsec/plugins/libstrongswan-rdrand.so
dh_install -p libstrongswan-extra-plugins usr/share/strongswan/templates/config/plugins/rdrand.conf
dh_install -p libstrongswan-extra-plugins etc/strongswan.d/charon/rdrand.conf
endif
# then install the rest, ignoring the above
dh_install --fail-missing \
-X\.la -X\.a \
-Xmedsrv -Xman3 \
-Xlibstrongswan-kernel- -X kernel- \
-Xlibstrongswan-dhcp.so -X dhcp.conf \
-Xlibstrongswan-farp.so -X farp.conf \
-Xlibstrongswan-padlock.so -X padlock.conf \
-Xlibstrongswan-rdrand.so -X rdrand.conf \
-Xlibstrongswan-af-alg.so -X af-alg.conf \
-Xstrongswan.service
# add additional files not covered by upstream makefile...
install --mode=0600 $(CURDIR)/debian/ipsec.secrets.proto $(CURDIR)/debian/strongswan-starter/etc/ipsec.secrets
# also "patch" ipsec.conf to include the debconf-managed file
echo >> $(CURDIR)/debian/strongswan-starter/etc/ipsec.conf
echo "include /var/lib/strongswan/ipsec.conf.inc" >> $(CURDIR)/debian/strongswan-starter/etc/ipsec.conf
# and to enable both IKEv1 and IKEv2 by default
sed -r 's/^[ \t]+# *charonstart=(yes|no) */\tcharonstart=yes/' < $(CURDIR)/debian/strongswan-starter/etc/ipsec.conf > $(CURDIR)/debian/strongswan-starter/etc/ipsec.conf.tmp
mv $(CURDIR)/debian/strongswan-starter/etc/ipsec.conf.tmp $(CURDIR)/debian/strongswan-starter/etc/ipsec.conf
# set permissions on ipsec.secrets
chmod 600 $(CURDIR)/debian/strongswan-starter/etc/ipsec.secrets
chmod 700 -R $(CURDIR)/debian/strongswan-starter/etc/ipsec.d/private/
chmod 700 -R $(CURDIR)/debian/strongswan-starter/var/lib/strongswan/
# this is handled by update-rc.d
rm -rf $(CURDIR)/debian/strongswan-starter/etc/rc?.d
# delete var/lock/subsys and var/run to satisfy lintian
rm -rf $(CURDIR)/debian/openswan/var/lock
rm -rf $(CURDIR)/debian/openswan/var/run
# more lintian cleanups
find $(CURDIR)/debian/*strongswan*/ -name ".cvsignore" | xargs --no-run-if-empty rm -f
find $(CURDIR)/debian/*strongswan*/ -name "/.svn/" | xargs --no-run-if-empty rm -rf
override_dh_installinit:
dh_installinit -n --name=ipsec
override_dh_installchangelogs:
dh_installchangelogs NEWS
override_dh_strip:
dh_strip --dbg-package=strongswan-dbg
override_dh_fixperms:
dh_fixperms -X etc/ipsec.secrets -X etc/ipsec.d -X var/lib/strongswan
override_dh_makeshlibs:
dh_makeshlibs -n -X usr/lib/ipsec/plugins
override_dh_installlogcheck:
dh_installlogcheck --name strongswan
override_dh_auto_test:
ifeq ($(DEB_BUILD_ARCH),amd64)
dh_auto_test
endif
%:
dh $@ --parallel --with autoreconf,systemd
|
