diff options
Diffstat (limited to 'net-vpn')
19 files changed, 2 insertions, 777 deletions
diff --git a/net-vpn/Manifest.gz b/net-vpn/Manifest.gz Binary files differindex aaf8ffd8948a..a1a9971d480e 100644 --- a/net-vpn/Manifest.gz +++ b/net-vpn/Manifest.gz diff --git a/net-vpn/ipsec-tools/Manifest b/net-vpn/ipsec-tools/Manifest deleted file mode 100644 index d70bfd3207e2..000000000000 --- a/net-vpn/ipsec-tools/Manifest +++ /dev/null @@ -1,17 +0,0 @@ -AUX ipsec-tools-0.8.0-sysctl.patch 485 BLAKE2B 95d0ef609a8a744bf8b3451a9b6b8ee4e79d79c99bd7919d45c6fc99d61904e16b3213afbfcde4743dc1be8de0b4455f1da2b3faf210c21833cbd482ab7d0c52 SHA512 a2a96cea5c2b451665d54572e471a6c2b4fb72382dcd90bda536aaabf78cdd36d630d5c1fa56372b95066dc7dffd56480d3402fdbe2d56825a017b2cc075ac66 -AUX ipsec-tools-CVE-2015-4047.patch 517 BLAKE2B 2ef6ddd4b78d7602bc4b19d76a794a1e172049b515932f00d3fe0f63b8157f3652a86f39473dc2f85b017d141790c5bc13378e79d008239899849484c4d9d42a SHA512 1dfda43a9d5919fbf274a28addbf798083f48094c65b88426d471a56e5339b72c9438c36efc6d6a3d74b4a084103c2fd4d1f974cbe494ee1228b2dbcaa304b49 -AUX ipsec-tools-CVE-2016-10396.patch 5805 BLAKE2B dd3c80403033b5a914302bea61de9c8cf088002f27d0a76d42e26c834593faabebd5366a7b46fbf5376fa93086a63a6630b04c2ac895374b1c0b80cd996b7247 SHA512 f0ae3465a41c478db59644d270560452f4f1bbf8ca79e7169a033c5139a4c484c22fb3f5f7f82da5bda0fd436331112f47698648e79a4839c45cdd904fb65d7e -AUX ipsec-tools-def-psk.patch 907 BLAKE2B 511982e1e7902f10442ca7ec7cd2a732f8a523f5fdc4a3630833d4280518296a3b4c735648c2793a40ad7d2d914019dc19699a51f0cdaddc35b13e94ea0d6b49 SHA512 683f168fac390df602ece1608db7f65370749c291e837497fa68fe4f39ddab907d10d67d4c80d583d7f12a1ea0bf02ba98d228e7c6e9267b49a1a8a7e57e99c4 -AUX ipsec-tools-include-vendoridh.patch 434 BLAKE2B ae27d4fc5630ee372314a855ec0c17b9f9efc5f87cbc6b86c1decd685212478a4a5592bd64c2a5ed19779243114eca4bff7f7e243bdc508454ef0bf4d998245f SHA512 fc39e09dd7b1a2d3b6cdfbfad9f4978ab5d070ae2435cf77fe2283b566bea1d58cd26dbf6cafb563587200724c9602a32ce737fd163b757872e8a6d2c8007d5c -AUX ipsec-tools.conf 1209 BLAKE2B 6d84eede1d77f09f1dac1db6866c7a877494cfbce69f01fb09f5961ae213547f2e5aca9ab068e375d2fdba8e326444e2b3f3d3cd6249f641e30127b8c5c52efb SHA512 727297a06b75b883a7bd730d84f7a7cec04f81b51df71a6d2419602d835abe3c958d27aac176e29e2463421792843517bda802b3437b306ab43e94d178593bfa -AUX ipsec-tools.service 282 BLAKE2B 8040f9749d8590506a9e252bdc57614f296f1037bd4da9ee05d35489e518625b7d379e4fefe5d7e81a03ebc6dcf28d240741d9f77b3a03a428a1080e7f127ffb SHA512 71a6accf8a77a837107c627843363aa63cecfb94f3d853a9bae22ed3bd796a0f0dfdae6794fcd74a76d0583b8128e273e07b707451297273fc141f43461222e3 -AUX psk.txt 293 BLAKE2B f7d09ee249e91bb31c36095ab2673eb7d19fa0871263644a8bcfe51740afe047f7a6671b65821b349ecadb17628d8fad2bbaa191081fd808a214b48341b47a2d SHA512 ed09588bcbf9b16e4e18315c7b9a7667788b4ab26cd962376430c316cfb0ee5a30ff26910190731b287c1a1b5927951a79f71a096071e73d67dc867a455b14cf -AUX racoon.conf 772 BLAKE2B 147bc65c8802c0f7404b61e7e8d99a2f35104278b2112d6f873a5247dd11cfdc1bf6b2ce09eabf2254d4acd747a849cbc28c01b9a2c736b1546c9778d2354906 SHA512 8876920331b4003fd096f1997e1266a12783120e390cea55ca283a8fd6485552b54e87f60e75f33409a4cdb99171d2358953287edd47ddeac8bda6da0cc8becc -AUX racoon.conf.d-r2 978 BLAKE2B 1070533eff1f70fa86eaec0624afa1be1f3c0b16aa732609aed619e30672fc1e27f8a72449bddbda4470c84094ada0f875d3edd3bcbf5df51502b7590f6cd783 SHA512 28c011831276df27384bc97978c6e88c4b88f98bccd7f578c40881b0544488047ad8fcb83f0654e99dbfe38a979606ceef87973d566e9bfded941cbfe882ecd3 -AUX racoon.init.d-r3 1295 BLAKE2B 730b7c7069ea94f0e27fe3c0ed344d6f9631e0445d2368a89a432a16091cc8c135e5a3c813ed2b4225514650eee4f47fba1894c9f443405c31f46e9c8737d37b SHA512 4e52d86237204134a5cc5726d8639d96723fab58dba6f6ddc1e3c1ed2e1e453c644037f65e118fdd6ca0b25eac4de83e78675dd072e095d9f4ef2dfa4f965475 -AUX racoon.pam.d 156 BLAKE2B 91ebefbb1264fe3fe98df0a72ac22a4cd8a787b3b391af5769798e0b0185f0a588bc089d229c76138fd2db39fbe6bd33924f0d53e0513074d9c2d7abf88dcb78 SHA512 d3f7e6ca8c9f2b5060ebccb259316bb59c9a7e158e8ef9466765a20db263a4043a590811f1a3ab072b718dbd70898bc69b77e0b19603d7f394b5ac1bd0a4a56c -AUX racoon.service 244 BLAKE2B f7e268518787a67e9363c936b8a9e69763c41db1926f99f3f001fdf738b0b3a92cd62770ab6cc0189cea20ca22d3abe675c832363ad77974e3f531ffbf525e7b SHA512 56d84f36b307e1ea93f3cdc9fbb7b459f4b3b65ea2bb765f61def10d06a3ff09d61b8d53b21796a55022279e791d751f3bc1ccf0d0f85799a743371390930567 -DIST ipsec-tools-0.8.2.tar.bz2 866465 BLAKE2B cf8c9175d96326fc5c74e6b1921bc66911256e289e6fe9cef77f26c197546902be3ebd5696af39c749a2abaac3f42010c9e2a281fd208122cd59222044b9dd4c SHA512 2b7d0efa908d3a699be7ef8b2b126a3809956cb7add50e8efb1cfdfc2d9b70c39ef517379cb9a4fad9e5f0c25937e98535b06c32bd3e729f5129da4ab133e30f -DIST ipsec-tools-add-openssl-1.1.x-support.patch 32066 BLAKE2B b8380408c90bb93f0b95938de2efc61c80d727ae61a1417134583a8c74055fcfe1f7f75893f1f701b0f301a16d8b4d14f1b8a09d1e81d238821bcc122dfe183f SHA512 f2bd85f1c51226da6fc50d3473129e4c2e3c0e46107337f8d676029b7072b98bf164b6813a16de7dd4481f80038453b55a5ff56e7f5ec08ab07641034258e778 -EBUILD ipsec-tools-0.8.2-r8.ebuild 8010 BLAKE2B 88e36224a1a75f842025580d09ab15b20b0fa233681e13a2f31f0b1e00a0dfd1675e743b9173501fef3bdfa74c7408edcacbe02e2873962f51d987a3044cc485 SHA512 5b0c199ba0aa14cb1310d7923869da27673731580eb0ecd7473bd66908ee558060ea8f621ea740854e357bce6a314cd55816c6148f7b7099e81a440c7614c1b8 -MISC metadata.xml 633 BLAKE2B 52069cbea4508b892d7f43c769173f871bca05232f5286760dd6878e5eb28487623de3433a4d77551dcf667d7d52a709ef5f040945a246a67711d1b1540d9b21 SHA512 4aaf5869b29f621b03952aa8c2b2fa53c076cf83610a4433587305a603e3949aad38798e27ff578c1228dc8f6f9f0cccd4efc51ed31b4e26787271da7b0c6a59 diff --git a/net-vpn/ipsec-tools/files/ipsec-tools-0.8.0-sysctl.patch b/net-vpn/ipsec-tools/files/ipsec-tools-0.8.0-sysctl.patch deleted file mode 100644 index 5c69bbb2fa61..000000000000 --- a/net-vpn/ipsec-tools/files/ipsec-tools-0.8.0-sysctl.patch +++ /dev/null @@ -1,22 +0,0 @@ -https://bugs.gentoo.org/425770 - ---- a/src/racoon/pfkey.c -+++ b/src/racoon/pfkey.c -@@ -59,7 +59,6 @@ - #include <sys/param.h> - #include <sys/socket.h> - #include <sys/queue.h> --#include <sys/sysctl.h> - - #include <net/route.h> - #include <net/pfkeyv2.h> ---- a/src/setkey/setkey.c -+++ b/src/setkey/setkey.c -@@ -40,7 +40,6 @@ - #include <sys/socket.h> - #include <sys/time.h> - #include <sys/stat.h> --#include <sys/sysctl.h> - #include <err.h> - #include <netinet/in.h> - #include <net/pfkeyv2.h> diff --git a/net-vpn/ipsec-tools/files/ipsec-tools-CVE-2015-4047.patch b/net-vpn/ipsec-tools/files/ipsec-tools-CVE-2015-4047.patch deleted file mode 100644 index 58f72e109c40..000000000000 --- a/net-vpn/ipsec-tools/files/ipsec-tools-CVE-2015-4047.patch +++ /dev/null @@ -1,16 +0,0 @@ -See: https://bugs.gentoo.org/show_bug.cgi?id=550118 - ---- ./src/racoon/gssapi.c 9 Sep 2006 16:22:09 -0000 1.4 -+++ ./src/racoon/gssapi.c 19 May 2015 15:16:00 -0000 1.6 -@@ -192,6 +192,11 @@ - gss_name_t princ, canon_princ; - OM_uint32 maj_stat, min_stat; - -+ if (iph1->rmconf == NULL) { -+ plog(LLV_ERROR, LOCATION, NULL, "no remote config\n"); -+ return -1; -+ } -+ - gps = racoon_calloc(1, sizeof (struct gssapi_ph1_state)); - if (gps == NULL) { - plog(LLV_ERROR, LOCATION, NULL, "racoon_calloc failed\n"); diff --git a/net-vpn/ipsec-tools/files/ipsec-tools-CVE-2016-10396.patch b/net-vpn/ipsec-tools/files/ipsec-tools-CVE-2016-10396.patch deleted file mode 100644 index e123007bb593..000000000000 --- a/net-vpn/ipsec-tools/files/ipsec-tools-CVE-2016-10396.patch +++ /dev/null @@ -1,201 +0,0 @@ -Description: Fix remotely exploitable DoS. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10396 -Source: vendor; https://gnats.netbsd.org/cgi-bin/query-pr-single.pl?number=51682 -Bug-debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=867986 - -Index: pkg-ipsec-tools/src/racoon/isakmp_frag.c -=================================================================== ---- pkg-ipsec-tools.orig/src/racoon/isakmp_frag.c -+++ pkg-ipsec-tools/src/racoon/isakmp_frag.c -@@ -1,4 +1,4 @@ --/* $NetBSD: isakmp_frag.c,v 1.5 2009/04/22 11:24:20 tteras Exp $ */ -+/* $NetBSD: isakmp_frag.c,v 1.5.36.1 2017/04/21 16:50:42 bouyer Exp $ */ - - /* Id: isakmp_frag.c,v 1.4 2004/11/13 17:31:36 manubsd Exp */ - -@@ -173,6 +173,43 @@ vendorid_frag_cap(gen) - return ntohl(hp[MD5_DIGEST_LENGTH / sizeof(*hp)]); - } - -+static int -+isakmp_frag_insert(struct ph1handle *iph1, struct isakmp_frag_item *item) -+{ -+ struct isakmp_frag_item *pitem = NULL; -+ struct isakmp_frag_item *citem = iph1->frag_chain; -+ -+ /* no frag yet, just insert at beginning of list */ -+ if (iph1->frag_chain == NULL) { -+ iph1->frag_chain = item; -+ return 0; -+ } -+ -+ do { -+ /* duplicate fragment number, abort (CVE-2016-10396) */ -+ if (citem->frag_num == item->frag_num) -+ return -1; -+ -+ /* need to insert before current item */ -+ if (citem->frag_num > item->frag_num) { -+ if (pitem != NULL) -+ pitem->frag_next = item; -+ else -+ /* insert at the beginning of the list */ -+ iph1->frag_chain = item; -+ item->frag_next = citem; -+ return 0; -+ } -+ -+ pitem = citem; -+ citem = citem->frag_next; -+ } while (citem != NULL); -+ -+ /* we reached the end of the list, insert */ -+ pitem->frag_next = item; -+ return 0; -+} -+ - int - isakmp_frag_extract(iph1, msg) - struct ph1handle *iph1; -@@ -224,39 +261,43 @@ isakmp_frag_extract(iph1, msg) - item->frag_next = NULL; - item->frag_packet = buf; - -- /* Look for the last frag while inserting the new item in the chain */ -- if (item->frag_last) -- last_frag = item->frag_num; -+ /* Check for the last frag before inserting the new item in the chain */ -+ if (item->frag_last) { -+ /* if we have the last fragment, indices must match */ -+ if (iph1->frag_last_index != 0 && -+ item->frag_last != iph1->frag_last_index) { -+ plog(LLV_ERROR, LOCATION, NULL, -+ "Repeated last fragment index mismatch\n"); -+ racoon_free(item); -+ vfree(buf); -+ return -1; -+ } - -- if (iph1->frag_chain == NULL) { -- iph1->frag_chain = item; -- } else { -- struct isakmp_frag_item *current; -+ last_frag = iph1->frag_last_index = item->frag_num; -+ } - -- current = iph1->frag_chain; -- while (current->frag_next) { -- if (current->frag_last) -- last_frag = item->frag_num; -- current = current->frag_next; -- } -- current->frag_next = item; -+ /* insert fragment into chain */ -+ if (isakmp_frag_insert(iph1, item) == -1) { -+ plog(LLV_ERROR, LOCATION, NULL, -+ "Repeated fragment index mismatch\n"); -+ racoon_free(item); -+ vfree(buf); -+ return -1; - } - -- /* If we saw the last frag, check if the chain is complete */ -+ /* If we saw the last frag, check if the chain is complete -+ * we have a sorted list now, so just walk through */ - if (last_frag != 0) { -+ item = iph1->frag_chain; - for (i = 1; i <= last_frag; i++) { -- item = iph1->frag_chain; -- do { -- if (item->frag_num == i) -- break; -- item = item->frag_next; -- } while (item != NULL); -- -+ if (item->frag_num != i) -+ break; -+ item = item->frag_next; - if (item == NULL) /* Not found */ - break; - } - -- if (item != NULL) /* It is complete */ -+ if (i > last_frag) /* It is complete */ - return 1; - } - -@@ -291,15 +332,9 @@ isakmp_frag_reassembly(iph1) - } - data = buf->v; - -+ item = iph1->frag_chain; - for (i = 1; i <= frag_count; i++) { -- item = iph1->frag_chain; -- do { -- if (item->frag_num == i) -- break; -- item = item->frag_next; -- } while (item != NULL); -- -- if (item == NULL) { -+ if (item->frag_num != i) { - plog(LLV_ERROR, LOCATION, NULL, - "Missing fragment #%d\n", i); - vfree(buf); -@@ -308,6 +343,7 @@ isakmp_frag_reassembly(iph1) - } - memcpy(data, item->frag_packet->v, item->frag_packet->l); - data += item->frag_packet->l; -+ item = item->frag_next; - } - - out: -Index: pkg-ipsec-tools/src/racoon/isakmp_inf.c -=================================================================== ---- pkg-ipsec-tools.orig/src/racoon/isakmp_inf.c -+++ pkg-ipsec-tools/src/racoon/isakmp_inf.c -@@ -720,6 +720,7 @@ isakmp_info_send_nx(isakmp, remote, loca - #endif - #ifdef ENABLE_FRAG - iph1->frag = 0; -+ iph1->frag_last_index = 0; - iph1->frag_chain = NULL; - #endif - -Index: pkg-ipsec-tools/src/racoon/isakmp.c -=================================================================== ---- pkg-ipsec-tools.orig/src/racoon/isakmp.c -+++ pkg-ipsec-tools/src/racoon/isakmp.c -@@ -1072,6 +1072,7 @@ isakmp_ph1begin_i(rmconf, remote, local) - iph1->frag = 1; - else - iph1->frag = 0; -+ iph1->frag_last_index = 0; - iph1->frag_chain = NULL; - #endif - iph1->approval = NULL; -@@ -1176,6 +1177,7 @@ isakmp_ph1begin_r(msg, remote, local, et - #endif - #ifdef ENABLE_FRAG - iph1->frag = 0; -+ iph1->frag_last_index = 0; - iph1->frag_chain = NULL; - #endif - iph1->approval = NULL; -Index: pkg-ipsec-tools/src/racoon/handler.h -=================================================================== ---- pkg-ipsec-tools.orig/src/racoon/handler.h -+++ pkg-ipsec-tools/src/racoon/handler.h -@@ -1,4 +1,4 @@ --/* $NetBSD: handler.h,v 1.25 2010/11/17 10:40:41 tteras Exp $ */ -+/* $NetBSD: handler.h,v 1.26 2017/01/24 19:23:56 christos Exp $ */ - - /* Id: handler.h,v 1.19 2006/02/25 08:25:12 manubsd Exp */ - -@@ -141,6 +141,7 @@ struct ph1handle { - #endif - #ifdef ENABLE_FRAG - int frag; /* IKE phase 1 fragmentation */ -+ int frag_last_index; - struct isakmp_frag_item *frag_chain; /* Received fragments */ - #endif - diff --git a/net-vpn/ipsec-tools/files/ipsec-tools-def-psk.patch b/net-vpn/ipsec-tools/files/ipsec-tools-def-psk.patch deleted file mode 100644 index f351860a84e9..000000000000 --- a/net-vpn/ipsec-tools/files/ipsec-tools-def-psk.patch +++ /dev/null @@ -1,25 +0,0 @@ -diff -brau ipsec-tools-0.7.3.o/src/racoon/oakley.c ipsec-tools-0.7.3/src/racoon/oakley.c ---- ipsec-tools-0.7.3.o/src/racoon/oakley.c 2009-08-13 11:18:45.000000000 +0200 -+++ ipsec-tools-0.7.3/src/racoon/oakley.c 2011-06-06 09:36:11.000000000 +0200 -@@ -2498,8 +2498,21 @@ - plog(LLV_ERROR, LOCATION, iph1->remote, - "couldn't find the pskey for %s.\n", - saddrwop2str(iph1->remote)); -+ } -+ } -+ if (iph1->authstr == NULL) { -+ /* -+ * If we could not locate a psk above try and locate -+ * the default psk, ie, "*". -+ */ -+ iph1->authstr = privsep_getpsk("*", 1); -+ if (iph1->authstr == NULL) { -+ plog(LLV_ERROR, LOCATION, iph1->remote, -+ "couldn't find the the default pskey either.\n"); - goto end; - } -+ plog(LLV_NOTIFY, LOCATION, iph1->remote, -+ "Using default PSK.\n"); - } - plog(LLV_DEBUG, LOCATION, NULL, "the psk found.\n"); - /* should be secret PSK */ diff --git a/net-vpn/ipsec-tools/files/ipsec-tools-include-vendoridh.patch b/net-vpn/ipsec-tools/files/ipsec-tools-include-vendoridh.patch deleted file mode 100644 index 2e22c82db478..000000000000 --- a/net-vpn/ipsec-tools/files/ipsec-tools-include-vendoridh.patch +++ /dev/null @@ -1,11 +0,0 @@ -diff -Naur ipsec-tools-0.8.0.orig//src/racoon/ipsec_doi.c ipsec-tools-0.8.0/src/racoon/ipsec_doi.c ---- ipsec-tools-0.8.0.orig//src/racoon/ipsec_doi.c 2012-02-28 13:42:24.000000000 -0500 -+++ ipsec-tools-0.8.0/src/racoon/ipsec_doi.c 2012-02-28 13:41:22.000000000 -0500 -@@ -87,6 +87,7 @@ - #ifdef HAVE_GSSAPI - #include <iconv.h> - #include "gssapi.h" -+#include "vendorid.h" - #ifdef HAVE_ICONV_2ND_CONST - #define __iconv_const const - #else diff --git a/net-vpn/ipsec-tools/files/ipsec-tools.conf b/net-vpn/ipsec-tools/files/ipsec-tools.conf deleted file mode 100644 index bfff04af069a..000000000000 --- a/net-vpn/ipsec-tools/files/ipsec-tools.conf +++ /dev/null @@ -1,26 +0,0 @@ -#!/usr/sbin/setkey -f -# -# THIS IS A SAMPLE FILE! -# -# This is a sample file to test Gentoo's ipsec-tools out of the box. -# Do not use it in production. See: http://www.ipsec-howto.org/ -# -flush; -spdflush; - -# -# Uncomment the following if you want to do manual keying, ie, you want to run IPsec without racoon. -# Do not switch 192.168.3.21 <-> 192.168.3.25 on the peer -# -#add 192.168.3.25 192.168.3.21 ah 0x200 -A hmac-md5 0xc0291ff014dccdd03874d9e8e4cdf3e6; -#add 192.168.3.21 192.168.3.25 ah 0x300 -A hmac-md5 0x96358c90783bbfa3d7b196ceabe0536b; -#add 192.168.3.25 192.168.3.21 esp 0x201 -E 3des-cbc 0x7aeaca3f87d060a12f4a4487d5a5c3355920fae69a96c831; -#add 192.168.3.21 192.168.3.25 esp 0x301 -E 3des-cbc 0xf6ddb555acfd9d77b03ea3843f2653255afe8eb5573965df; - -# -# Make sure to switch 192.168.3.21 <-> 192.168.3.25 on the peer -# -#spdadd 192.168.3.21 192.168.3.25 any -P out ipsec esp/transport//require ah/transport//require; -#spdadd 192.168.3.25 192.168.3.21 any -P in ipsec esp/transport//require ah/transport//require; -spdadd 192.168.3.25 192.168.3.21 any -P out ipsec esp/transport//require ah/transport//require; -spdadd 192.168.3.21 192.168.3.25 any -P in ipsec esp/transport//require ah/transport//require; diff --git a/net-vpn/ipsec-tools/files/ipsec-tools.service b/net-vpn/ipsec-tools/files/ipsec-tools.service deleted file mode 100644 index 0341aa7e4ed9..000000000000 --- a/net-vpn/ipsec-tools/files/ipsec-tools.service +++ /dev/null @@ -1,12 +0,0 @@ -[Unit] -Description=Load IPSec Security Policy Database -After=syslog.target network.target - -[Service] -Type=oneshot -RemainAfterExit=true -ExecStart=/usr/sbin/setkey -k -f /etc/ipsec-tools.conf -ExecStop=/usr/sbin/setkey -F -P ; /usr/sbin/setkey -F - -[Install] -WantedBy=multi-user.target diff --git a/net-vpn/ipsec-tools/files/psk.txt b/net-vpn/ipsec-tools/files/psk.txt deleted file mode 100644 index 97f5180f5ae5..000000000000 --- a/net-vpn/ipsec-tools/files/psk.txt +++ /dev/null @@ -1,10 +0,0 @@ -# THIS IS A SAMPLE FILE! -# -# This is a sample file to test Gentoo's ipsec-tools out of the box. -# Do not use it in production. See: http://www.ipsec-howto.org/ -# -# Make sure to switch 192.168.3.21 <-> 192.168.3.25 on the peer -# -# Peer IP/FQDN Secret -# 192.168.3.25 sample -192.168.3.21 sample diff --git a/net-vpn/ipsec-tools/files/racoon.conf b/net-vpn/ipsec-tools/files/racoon.conf deleted file mode 100644 index 2e9206db9506..000000000000 --- a/net-vpn/ipsec-tools/files/racoon.conf +++ /dev/null @@ -1,33 +0,0 @@ -# THIS IS A SAMPLE FILE! -# -# This is a sample file to test Gentoo's ipsec-tools out of the box. -# Do not use it in production. See: http://www.ipsec-howto.org/ -# -path pre_shared_key "/etc/racoon/psk.txt"; - -# -# Make sure to switch 192.168.3.21 <-> 192.168.3.25 on the peer -# -#remote 192.168.3.25 -remote 192.168.3.21 -{ - exchange_mode main; - proposal { - encryption_algorithm 3des; - hash_algorithm md5; - authentication_method pre_shared_key; - dh_group modp1024; - } -} - -# -# Make sure to switch 192.168.3.21 <-> 192.168.3.25 on the peer -# -#sainfo address 192.168.3.21 any address 192.168.3.25 any -sainfo address 192.168.3.25 any address 192.168.3.21 any -{ - pfs_group modp768; - encryption_algorithm 3des; - authentication_algorithm hmac_md5; - compression_algorithm deflate; -} diff --git a/net-vpn/ipsec-tools/files/racoon.conf.d-r2 b/net-vpn/ipsec-tools/files/racoon.conf.d-r2 deleted file mode 100644 index c592d3584967..000000000000 --- a/net-vpn/ipsec-tools/files/racoon.conf.d-r2 +++ /dev/null @@ -1,29 +0,0 @@ -# Copyright 1999-2014 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Config file for /etc/init.d/racoon - -# See the man page or run `racoon --help` for valid command-line options -# RACOON_OPTS="-d" - -RACOON_CONF="/etc/racoon/racoon.conf" -RACOON_PSK_FILE="/etc/racoon/psk.txt" - -# The amount of time in ms for start-stop-daemon to wait before a timeout -# Racoon can sometimes be slow. We'll wait 1 sec. Bug #435398. - -RACOON_WAIT="1000" - -# The setkey config file. Don't name it ipsec.conf as this clashes -# with strongswan. We'll follow debian's naming. Bug #436144. - -SETKEY_CONF="/etc/ipsec-tools.conf" - -# Comment or remove the following if you don't want the policy tables -# to be flushed when racoon is stopped. - -RACOON_RESET_TABLES="true" - -# If you need to set custom options to the setkey command when loading rules, use this -# more info in the setkey mangage (example below sets kernel mode instead of RFC mode): -#SETKEY_OPTS="-k" diff --git a/net-vpn/ipsec-tools/files/racoon.init.d-r3 b/net-vpn/ipsec-tools/files/racoon.init.d-r3 deleted file mode 100644 index 66e10bb84d42..000000000000 --- a/net-vpn/ipsec-tools/files/racoon.init.d-r3 +++ /dev/null @@ -1,57 +0,0 @@ -#!/sbin/openrc-run -# Copyright 1999-2014 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -depend() { - before netmount - use net -} - -checkconfig() { - if [ ! -e ${SETKEY_CONF} ] ; then - eerror "You need to configure setkey before starting racoon." - return 1 - fi - if [ ! -e ${RACOON_CONF} ] ; then - eerror "You need a configuration file to start racoon." - return 1 - fi - if [ ! -z ${RACOON_PSK_FILE} ] ; then - if [ ! -f ${RACOON_PSK_FILE} ] ; then - eerror "PSK file not found as specified." - eerror "Set RACOON_PSK_FILE in /etc/conf.d/racoon." - return 1 - fi - case "`ls -Lldn ${RACOON_PSK_FILE}`" in - -r--------*) - ;; - *) - eerror "Your defined PSK file should be mode 400 for security!" - return 1 - ;; - esac - fi -} - -command=/usr/sbin/racoon -command_args="-f ${RACOON_CONF} ${RACOON_OPTS}" -pidfile=/var/run/racoon.pid -start_stop_daemon_args="--wait ${RACOON_WAIT}" - -start_pre() { - checkconfig || return 1 - einfo "Loading ipsec policies from ${SETKEY_CONF}." - /usr/sbin/setkey ${SETKEY_OPTS} -f ${SETKEY_CONF} - if [ $? -eq 1 ] ; then - eerror "Error while loading ipsec policies" - fi -} - -stop_post() { - if [ -n "${RACOON_RESET_TABLES}" ]; then - ebegin "Flushing policy entries" - /usr/sbin/setkey -F - /usr/sbin/setkey -FP - eend $? - fi -} diff --git a/net-vpn/ipsec-tools/files/racoon.pam.d b/net-vpn/ipsec-tools/files/racoon.pam.d deleted file mode 100644 index b801aaafa0f9..000000000000 --- a/net-vpn/ipsec-tools/files/racoon.pam.d +++ /dev/null @@ -1,4 +0,0 @@ -auth include system-remote-login -account include system-remote-login -password include system-remote-login -session include system-remote-login diff --git a/net-vpn/ipsec-tools/files/racoon.service b/net-vpn/ipsec-tools/files/racoon.service deleted file mode 100644 index df7f1bb8f8c0..000000000000 --- a/net-vpn/ipsec-tools/files/racoon.service +++ /dev/null @@ -1,11 +0,0 @@ -[Unit] -Description=Racoon IKEv1 key management daemon for IPSEC -After=syslog.target network.target -Requires=ipsec-tools.service - -[Service] -Type=forking -ExecStart=/usr/sbin/racoon -f /etc/racoon/racoon.conf - -[Install] -WantedBy=multi-user.target diff --git a/net-vpn/ipsec-tools/ipsec-tools-0.8.2-r8.ebuild b/net-vpn/ipsec-tools/ipsec-tools-0.8.2-r8.ebuild deleted file mode 100644 index f5bcdfcd4ab9..000000000000 --- a/net-vpn/ipsec-tools/ipsec-tools-0.8.2-r8.ebuild +++ /dev/null @@ -1,284 +0,0 @@ -# Copyright 1999-2021 Gentoo Authors -# Distributed under the terms of the GNU General Public License v2 - -EAPI="6" - -inherit flag-o-matic autotools linux-info pam systemd - -DESCRIPTION="A port of KAME's IPsec utilities to the Linux-2.6 IPsec implementation" -HOMEPAGE="http://ipsec-tools.sourceforge.net/" -SRC_URI="mirror://sourceforge/${PN}/${P}.tar.bz2 - https://dev.gentoo.org/~juippis/distfiles/tmp/ipsec-tools-add-openssl-1.1.x-support.patch" - -LICENSE="BSD GPL-2" -SLOT="0" -KEYWORDS="amd64 arm ~ia64 ~mips ppc ppc64 x86" -IUSE="hybrid idea ipv6 kerberos ldap nat pam rc5 readline selinux stats" - -CDEPEND=" - dev-libs/openssl:0= - virtual/libcrypt:= - kerberos? ( virtual/krb5 ) - ldap? ( net-nds/openldap ) - pam? ( sys-libs/pam ) - readline? ( sys-libs/readline:0= ) - selinux? ( sys-libs/libselinux )" - -DEPEND="${CDEPEND} - >=sys-kernel/linux-headers-2.6.30" - -RDEPEND="${CDEPEND} - selinux? ( sec-policy/selinux-ipsec ) -" - -pkg_preinst() { - if has_version "<${CATEGORY}/${PN}-0.8.0-r5" ; then - ewarn - ewarn "\033[1;33m**************************************************\033[00m" - ewarn - if ! has_version "net-vpn/strongswan" && - ! has_version "net-misc/openswan" && - ! has_version "net-vpn/libreswan"; then - ewarn "We found an earlier version of ${PN} installed." - ewarn "As of ${PN}-0.8.0-r5, the old configuration file," - ewarn "ipsec.conf, has been changed to ipsec-tools.conf to avoid" - ewarn "a conflict with net-vpn/strongswan; bug #436144. We will" - ewarn "rename this file for you with this upgrade. However, if" - ewarn "you later downgrade, you'll have to rename the file to" - ewarn "its orignal manually or change /etc/conf.d/racoon to point" - ewarn "to the new file." - - if [[ -f /etc/ipsec.conf && ! -f /etc/ipsec-tools.conf ]] ; then - mv /etc/ipsec.conf /etc/ipsec-tools.conf - else - ewarn - ewarn "Oops! I can't move ipsec.conf to ipsec-tools.conf!" - ewarn "Either the former doesn't exist or the later does and" - ewarn "I won't clobber it. Please fix this situation manually." - fi - else - ewarn "You had both an earlier version of ${PN} and" - ewarn "net-vpn/strongswan installed. I can't tell whether" - ewarn "the configuration file, ipsec.conf, belongs to one" - ewarn "package or the other due to a file conflict; bug #436144." - ewarn "The current version of ${PN} uses ipsec-tools.conf" - ewarn "as its configuration file, as will future versions." - ewarn "Please fix this situation manually." - fi - ewarn - ewarn "\033[1;33m**************************************************\033[00m" - ewarn - fi -} - -pkg_setup() { - linux-info_pkg_setup - - get_version - - if linux_config_exists && kernel_is -ge 2 6 19; then - ewarn - ewarn "\033[1;33m**************************************************\033[00m" - ewarn - ewarn "Checking kernel configuration in /usr/src/linux or" - ewarn "or /proc/config.gz for compatibility with ${PN}." - ewarn "Here are the potential problems:" - ewarn - - local nothing="1" - - # Check options for all flavors of IPSec - local msg="" - for i in XFRM_USER NET_KEY; do - if ! linux_chkconfig_present ${i}; then - msg="${msg} ${i}" - fi - done - if [[ ! -z "$msg" ]]; then - nothing="0" - ewarn - ewarn "ALL IPSec may fail. CHECK:" - ewarn "${msg}" - fi - - # Check unencrypted IPSec - if ! linux_chkconfig_present CRYPTO_NULL; then - nothing="0" - ewarn - ewarn "Unencrypted IPSec may fail. CHECK:" - ewarn " CRYPTO_NULL" - fi - - # Check IPv4 IPSec - msg="" - for i in \ - INET_IPCOMP INET_AH INET_ESP \ - INET_XFRM_MODE_TRANSPORT \ - INET_XFRM_MODE_TUNNEL \ - INET_XFRM_MODE_BEET - do - if ! linux_chkconfig_present ${i}; then - msg="${msg} ${i}" - fi - done - if [[ ! -z "$msg" ]]; then - nothing="0" - ewarn - ewarn "IPv4 IPSec may fail. CHECK:" - ewarn "${msg}" - fi - - # Check IPv6 IPSec - if use ipv6; then - msg="" - for i in INET6_IPCOMP INET6_AH INET6_ESP \ - INET6_XFRM_MODE_TRANSPORT \ - INET6_XFRM_MODE_TUNNEL \ - INET6_XFRM_MODE_BEET - do - if ! linux_chkconfig_present ${i}; then - msg="${msg} ${i}" - fi - done - if [[ ! -z "$msg" ]]; then - nothing="0" - ewarn - ewarn "IPv6 IPSec may fail. CHECK:" - ewarn "${msg}" - fi - fi - - # Check IPSec behind NAT - if use nat; then - if ! linux_chkconfig_present NETFILTER_XT_MATCH_POLICY; then - nothing="0" - ewarn - ewarn "IPSec behind NAT may fail. CHECK:" - ewarn " NETFILTER_XT_MATCH_POLICY" - fi - fi - - if [[ $nothing == "1" ]]; then - ewarn "NO PROBLEMS FOUND" - fi - - ewarn - ewarn "WARNING: If your *configured* and *running* kernel" - ewarn "differ either now or in the future, then these checks" - ewarn "may lead to misleading results." - ewarn - ewarn "\033[1;33m**************************************************\033[00m" - ewarn - else - eerror - eerror "\033[1;31m**************************************************\033[00m" - eerror "Make sure that your *running* kernel is/will be >=2.6.19." - eerror "Building ${PN} now, assuming that you know what you're doing." - eerror "\033[1;31m**************************************************\033[00m" - eerror - fi -} - -src_prepare() { - # fix for bug #124813 - sed -i 's:-Werror::g' "${S}"/configure.ac || die - # fix for building with gcc-4.6 - sed -i 's: -R: -Wl,-R:' "${S}"/configure.ac || die - - eapply "${FILESDIR}/${PN}-def-psk.patch" - eapply "${FILESDIR}/${PN}-include-vendoridh.patch" - eapply "${FILESDIR}"/${PN}-0.8.0-sysctl.patch #425770 - eapply "${FILESDIR}"/${PN}-CVE-2015-4047.patch - eapply "${DISTDIR}"/${PN}-add-openssl-1.1.x-support.patch - eapply "${FILESDIR}"/${PN}-CVE-2016-10396.patch - AT_M4DIR="${S}" eautoreconf - - eapply_user -} - -src_configure() { - #--with-{libiconv,libradius} lead to "Broken getaddrinfo()" - #--enable-samode-unspec is not supported in linux - local myconf - myconf="--with-kernel-headers=/usr/include \ - --enable-adminport \ - --enable-dependency-tracking \ - --enable-dpd \ - --enable-frag \ - --without-libiconv \ - --without-libradius \ - --disable-samode-unspec \ - $(use_enable idea) \ - $(use_enable ipv6) \ - $(use_enable kerberos gssapi) \ - $(use_with ldap libldap) \ - $(use_enable nat natt) \ - $(use_with pam libpam) \ - $(use_enable rc5) \ - $(use_with readline) \ - $(use_enable selinux security-context) \ - $(use_enable stats)" - - use nat && myconf="${myconf} --enable-natt-versions=yes" - - # enable mode-cfg and xauth support - if use pam; then - myconf="${myconf} --enable-hybrid" - else - myconf="${myconf} $(use_enable hybrid)" - fi - - econf ${myconf} -} - -src_install() { - emake DESTDIR="${D}" install - keepdir /var/lib/racoon - newconfd "${FILESDIR}"/racoon.conf.d-r2 racoon - newinitd "${FILESDIR}"/racoon.init.d-r3 racoon - systemd_dounit "${FILESDIR}/ipsec-tools.service" - systemd_dounit "${FILESDIR}/racoon.service" - use pam && newpamd "${FILESDIR}"/racoon.pam.d racoon - - insinto /etc - doins "${FILESDIR}"/ipsec-tools.conf - insinto /etc/racoon - doins "${FILESDIR}"/racoon.conf - doins "${FILESDIR}"/psk.txt - chmod 400 "${D}"/etc/racoon/psk.txt - - dodoc ChangeLog README NEWS - dodoc -r src/racoon/samples - dodoc -r src/racoon/doc - docinto samples - newdoc src/setkey/sample.cf ipsec-tools.conf -} - -pkg_postinst() { - if use nat; then - elog - elog "You have enabled the nat traversal functionnality." - elog "Nat versions wich are enabled by default are 00,02,rfc" - elog "you can find those drafts in the CVS repository:" - elog "cvs -d anoncvs@anoncvs.netbsd.org:/cvsroot co ipsec-tools" - elog - elog "If you feel brave enough and you know what you are" - elog "doing, you can consider emerging this ebuild with" - elog "EXTRA_ECONF=\"--enable-natt-versions=08,07,06\"" - elog - fi - - if use ldap; then - elog - elog "You have enabled ldap support with ${PN}." - elog "The man page does NOT contain any information on it yet." - elog "Consider using a more recent version or CVS." - elog - fi - - elog - elog "Please have a look in /usr/share/doc/${P} and visit" - elog "http://www.netbsd.org/Documentation/network/ipsec/" - elog "to find more information on how to configure this tool." - elog -} diff --git a/net-vpn/ipsec-tools/metadata.xml b/net-vpn/ipsec-tools/metadata.xml deleted file mode 100644 index ebfe94eecee4..000000000000 --- a/net-vpn/ipsec-tools/metadata.xml +++ /dev/null @@ -1,17 +0,0 @@ -<?xml version="1.0" encoding="UTF-8"?> -<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd"> -<pkgmetadata> - <maintainer type="person"> - <email>blueness@gentoo.org</email> - </maintainer> - <use> - <flag name="hybrid">Makes available both mode-cfg and xauth support</flag> - <flag name="idea">Enable support for the IDEA algorithm</flag> - <flag name="nat">Enable NAT-Traversal</flag> - <flag name="rc5">Enable support for the patented RC5 algorithm</flag> - <flag name="stats">Enable statistics reporting</flag> - </use> - <upstream> - <remote-id type="sourceforge">ipsec-tools</remote-id> - </upstream> -</pkgmetadata> diff --git a/net-vpn/wireguard-tools/Manifest b/net-vpn/wireguard-tools/Manifest index ab948eb807fc..fee3d4be3474 100644 --- a/net-vpn/wireguard-tools/Manifest +++ b/net-vpn/wireguard-tools/Manifest @@ -2,5 +2,5 @@ AUX wg-quick.init 885 BLAKE2B 440224b688b1a1b4762bac7ac3bd6cb6fbee546543f1da70fc DIST wireguard-tools-1.0.20210424.tar.xz 96816 BLAKE2B 4787624d296c22241ff366c799eb07e1e718534eab9c998df24003380ed9743f76c3b8f779c7e534404573583c9654a43527d4c96de0def78a3d88d30ca6985e SHA512 b919c7ce1e8ee8660ccc1490d3dad7817f3d6f0ab79f26866e8ed10d40545a9ddca67959ff6cc84ac36a91683c1f58d274d91d47f40c0b9a7bfee4009dcbbf59 DIST wireguard-tools-1.0.20210914.tar.xz 99744 BLAKE2B 020f4a61597dafc6663e9ee5659f9401416692f5dc8e23afe8d59054bffd32c92814ff2e1f99d6ffe558fdfcf756afc1838e4d425847f892ad4b627a077fe614 SHA512 6727ea65551dbb064457449b93a943bd6534ca93bc7fa5704c2f6826266c98688ee9ea28731fda57a5245d5f63c05f3899fcca54e40c0b6251b7c4796e957445 EBUILD wireguard-tools-1.0.20210424.ebuild 4058 BLAKE2B 3e3f0639ee1dd5f89b6c38a65e930abb1c6f5ad045184c669a0a883b0fa356960137d707c9ce2d93aefb6b5c5ebc0f18fbe725b2f109abe8f3238173c1e05f59 SHA512 8a954a295a93631de815da4da2f37937fc88d59df87160fbbfc4c6ae78f569d42fca41e35642212371816ba06efdde6ce996ff5fa5258ddf57c169fbd41ec7d3 -EBUILD wireguard-tools-1.0.20210914.ebuild 4065 BLAKE2B 6d90de16d5a656005bfe4f190e9c6b99f6deaa81bea1def90d8da792e5e6cc19badabde862f5e8af36e62874ec2e0dd12f23cdff9b06b5d72a0e70547f3fdc0d SHA512 17f3ab190b4ad6660d8b21f1589d0bcc1bd56d63db81c428c8ff6c5fab45e0ebcefdb315c85f774b3b3bccc485fd582ab7c0b0147024cdbf7ca6a500952fb71e +EBUILD wireguard-tools-1.0.20210914.ebuild 4072 BLAKE2B cc321ee0a3ebf95bd33230edd1c1f6df914be68c84d5b88339e7f6b4979d7307d53d62659c1daebed1e321fe2416de6d3fae4be9d873bdc0c68c07a63717174d SHA512 3fdbd697817bc0147d9247872899cb5dd55b3108218189564b5cd9c6d8fee738e88251ed48a4f181b3478d368cf42f4120a7e6eb10c83281c78eb9fd31af1580 MISC metadata.xml 363 BLAKE2B 34748b86884ce0197e3fd579515d3daf62d32d269f71d05ba1d2f795a66d6140b79fc803008beb0d02a2c7ae80adf0ef19c2daa0be9512f87f3e3c046887c58d SHA512 67a6dc99c972a4bb40b73dae1c33dfc6e1288f3c918e0814656ea5f91a33c72cf3bb261b1b38054d0ea0b67efad07c24e7f969114876526526aeffd4d62497c4 diff --git a/net-vpn/wireguard-tools/wireguard-tools-1.0.20210914.ebuild b/net-vpn/wireguard-tools/wireguard-tools-1.0.20210914.ebuild index c707cf29cb33..c962d7b2f091 100644 --- a/net-vpn/wireguard-tools/wireguard-tools-1.0.20210914.ebuild +++ b/net-vpn/wireguard-tools/wireguard-tools-1.0.20210914.ebuild @@ -13,7 +13,7 @@ if [[ ${PV} == 9999 ]]; then EGIT_REPO_URI="https://git.zx2c4.com/wireguard-tools" else SRC_URI="https://git.zx2c4.com/wireguard-tools/snapshot/wireguard-tools-${PV}.tar.xz" - KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86" + KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86" fi LICENSE="GPL-2" |