Bumping to 5.0.1, fixing bug #437676

Package-Manager: portage-2.2.0_alpha136/cvs/Linux i686

3 files changed, 282 insertions, 2 deletions

diff --git a/net-misc/strongswan/ChangeLog b/net-misc/strongswan/ChangeLog
index 2073bc20492a..7a89439f00a0 100644
--- a/net-misc/strongswan/ChangeLog
+++ b/net-misc/strongswan/ChangeLog
@@ -1,6 +1,11 @@
 # ChangeLog for net-misc/strongswan
 # Copyright 1999-2012 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/net-misc/strongswan/ChangeLog,v 1.103 2012/09/30 17:59:38 ago Exp $
+# $Header: /var/cvsroot/gentoo-x86/net-misc/strongswan/ChangeLog,v 1.104 2012/10/10 18:21:24 gurligebis Exp $
+
+*strongswan-5.0.1 (10 Oct 2012)
+
+  10 Oct 2012; <gurligebis@gentoo.org> +strongswan-5.0.1.ebuild:
+  Bumping to 5.0.1, fixing bug #437676
 
   30 Sep 2012; Agostino Sarubbo <ago@gentoo.org> strongswan-5.0.0.ebuild:
   Stable for AMD64, wrt bug #435614
diff --git a/net-misc/strongswan/Manifest b/net-misc/strongswan/Manifest
index 5301920c120a..4a38f6a0050c 100644
--- a/net-misc/strongswan/Manifest
+++ b/net-misc/strongswan/Manifest
@@ -1,5 +1,17 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA256
+
 AUX ipsec 445 SHA256 5ba492de6d612d7def1cb7ceacadf8397e50f8433b91c4f2f09bf216eed34da6 SHA512 fb786be3c356b22d32b86132d11ebc2eca34414aa0961dc66374697c4cf0fc2fe57e8638b3bbd247f1a0fbf5539bd496200d4c70633a855a88591cf113a69754 WHIRLPOOL d90910b657330b84ab3e89456a1fdc49d8bd6bbae377e883cdd073cdf8e6e44f6f45e7118ac76874fa950ad7245fe2a89876ac6a8ffb3d6e4f6cf75bed39b807
 DIST strongswan-5.0.0.tar.bz2 3087071 SHA256 efc13c86e715b5e596d9d8535640c830f83e977fe521afd2c70d68926c4b573e SHA512 93058bc7f84a54799be10547979b48c24ede4144f4e6691aaa08fee9c6c7fd3039f8d31035e72755c37e2436c28796cb5764e97e9cc5cc056d99984d949bc06b WHIRLPOOL 82b67199adaaa03a6972687cd0e009ed3edd410043c03256f3fcc3e7b69d1912c1a26e8da4bc5513abd90c4740b3ddbea390c5b5dd4adee87491ef2bebb43ba8
+DIST strongswan-5.0.1.tar.bz2 3146776 SHA256 1a4dff19ef69d15e0b90b1ea80bd183235ac73b4ecd114aab58ed54de0f5c3b4 SHA512 88b23b731027b4d1f2a31de6ea19264d050034f203061b531e0c869f1078a898841bf8db03c22ee5a48431f665b06836a16cf1f288b2eac3e25343505c250e03 WHIRLPOOL 70049ef4a01b64cb79e120d09450ef8a5760e89cd081429714c13aa9764ac8c22824d88fe24faf89484db1aadc37e44cdca87af79b2753014128b26f66702e49
 EBUILD strongswan-5.0.0.ebuild 8355 SHA256 a4c49409446b66c94b3af8a1389d5881178f431025f6c05a2d397d219d206bfa SHA512 403ab8778f60c910913b6b9ff170b841d6f3bca1dbef8253aed3f078efa8370ae34310ce289963f9713abbaf8a9cf8daad8dccd2c6b74b13a42420ec4294e721 WHIRLPOOL bbb327959cddc2acee5de0c9cc555074ddaa97d0c52ba6ef3c7e45321f89be3084ca875c86a59f4260a5a8ec88dae3cb149b8f58da184da5dae37ffd2bd7cf12
-MISC ChangeLog 18991 SHA256 d0fb8af6ce4574b46972e7f5dcbe5f92741f1e7f1ae536853a5ba974fc883f9d SHA512 78dbb4d5668fae67574aee0ef12c3c991c7f9f5c2cf5b98676ab68501933b1918488c6561be727bdccf05fed260d29fdf0357b4abed921f1e79fb3de41543afa WHIRLPOOL fbd5f7895485f0dd192115c4da6d94ded4e7b80acdb8bcd8a9f54a80966ba49a0d5544f14b32ac4e378ea96e04952603e6594d82e6c0a85e543781297958f208
+EBUILD strongswan-5.0.1.ebuild 8365 SHA256 3ba6d34f4170459b07394b6aa2eefe5be7bc75b2cbe5c2135ae6cc943a7548ae SHA512 50dab9cf2ea094b9c9eff4480bbf743a8979fb87377d626a6408b2a87f6d0e5c70f327690e767c5ca415b2091b29ffd2f1c60a2850abcd11b78b6e305199cb5d WHIRLPOOL 6fc1ab2da29226e4ffb41e9305239769f66924fbc957b5edce076cb870c05049e56daaa73eed2dc9e6955239c919d606513b7909e847bbf2922dba08fb56304f
+MISC ChangeLog 19136 SHA256 e8e69c9684266372848cc053c88d15a8d89a1dfba5c3ed88d5edc0f7061b5a80 SHA512 5c965b5f45bd0970c5993a3404e271285bb2a23bbdd348137deecdcc05cc8503cd5acdf4b2f170e8b01b7e269c811074821c72a19a7bfabacec5ebdb734642bb WHIRLPOOL 07328556ae0766493889d9d7662e543148c3882462cd3f06c8f8fcae9608aff4435dc2df3bbb92e7d0fafac096ab87ca3ff57a2c626d5b150a0a9b4802c721eb
 MISC metadata.xml 2247 SHA256 8c6ab534a8adb21273e95258474d2b9a62624712f50c85804bfdcd0bdd6fe639 SHA512 690fc9a1b6c072ec8763d473fffd40fbe3f9d8f006e94795a58422fd8132ae68ede8ff6509a2d87ba410814ba03a21e81f95fc8a4b926e7a86b09fe6372c52e3 WHIRLPOOL 84cc2a29ba02ce3461905fea1aa72da71edf28ebf94e18cfff7e137008d70a8fba372dead67c80aa722a6653e079bd4f7bb0ff10c6933e90f94b555460c0fd36
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2.0.19 (GNU/Linux)
+
+iEYEAREIAAYFAlB1vKQACgkQsR7PQhRXYEk+WACeLutMKSKleIJ23q4kywTDzLTg
+Gm8AnRWMjbgKXJmNIpLa5ryH8WjkOEbl
+=uCYI
+-----END PGP SIGNATURE-----
diff --git a/net-misc/strongswan/strongswan-5.0.1.ebuild b/net-misc/strongswan/strongswan-5.0.1.ebuild
new file mode 100644
index 000000000000..a9faca3ddab8
--- /dev/null
+++ b/net-misc/strongswan/strongswan-5.0.1.ebuild
@@ -0,0 +1,263 @@
+# Copyright 1999-2012 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-misc/strongswan/strongswan-5.0.1.ebuild,v 1.1 2012/10/10 18:21:24 gurligebis Exp $
+
+EAPI=2
+inherit eutils linux-info user
+
+DESCRIPTION="IPsec-based VPN solution focused on security and ease of use, supporting IKEv1/IKEv2 and MOBIKE"
+HOMEPAGE="http://www.strongswan.org/"
+SRC_URI="http://download.strongswan.org/${P}.tar.bz2"
+
+LICENSE="GPL-2 RSA-MD5 RSA-PKCS11 DES"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~ppc ~ppc64 ~x86"
+IUSE="+caps curl debug dhcp eap farp gcrypt ldap mysql +non-root +openssl sqlite pam"
+
+COMMON_DEPEND="!net-misc/openswan
+	>=dev-libs/gmp-4.1.5
+	gcrypt? ( dev-libs/libgcrypt )
+	caps? ( sys-libs/libcap )
+	curl? ( net-misc/curl )
+	ldap? ( net-nds/openldap )
+	openssl? ( >=dev-libs/openssl-0.9.8[-bindist] )
+	mysql? ( virtual/mysql )
+	sqlite? ( >=dev-db/sqlite-3.3.1 )
+	pam? ( sys-libs/pam )"
+DEPEND="${COMMON_DEPEND}
+	virtual/linux-sources
+	sys-kernel/linux-headers"
+RDEPEND="${COMMON_DEPEND}
+	virtual/logger
+	sys-apps/iproute2"
+
+UGID="ipsec"
+
+pkg_setup() {
+	linux-info_pkg_setup
+	elog "Linux kernel version: ${KV_FULL}"
+
+	if ! kernel_is -ge 2 6 16; then
+		eerror
+		eerror "This ebuild currently only supports ${PN} with the"
+		eerror "native Linux 2.6 IPsec stack on kernels >= 2.6.16."
+		eerror
+		die "Please install a recent 2.6 kernel."
+	fi
+
+	if kernel_is -lt 2 6 34; then
+		ewarn
+		ewarn "IMPORTANT KERNEL NOTES: Please read carefully..."
+		ewarn
+
+		if kernel_is -lt 2 6 29; then
+			ewarn "[ < 2.6.29 ] Due to a missing kernel feature, you have to"
+			ewarn "include all required IPv6 modules even if you just intend"
+			ewarn "to run on IPv4 only."
+			ewarn
+			ewarn "This has been fixed with kernels >= 2.6.29."
+			ewarn
+		fi
+
+		if kernel_is -lt 2 6 33; then
+			ewarn "[ < 2.6.33 ] Kernels prior to 2.6.33 include a non-standards"
+			ewarn "compliant implementation for SHA-2 HMAC support in ESP and"
+			ewarn "miss SHA384 and SHA512 HMAC support altogether."
+			ewarn
+			ewarn "If you need any of those features, please use kernel >= 2.6.33."
+			ewarn
+		fi
+
+		if kernel_is -lt 2 6 34; then
+			ewarn "[ < 2.6.34 ] Support for the AES-GMAC authentification-only"
+			ewarn "ESP cipher is only included in kernels >= 2.6.34."
+			ewarn
+			ewarn "If you need it, please use kernel >= 2.6.34."
+			ewarn
+		fi
+	fi
+
+	if use non-root; then
+		enewgroup ${UGID}
+		enewuser ${UGID} -1 -1 -1 ${UGID}
+	fi
+}
+
+src_configure() {
+	local myconf=""
+
+	if use non-root; then
+		myconf="${myconf} --with-user=${UGID} --with-group=${UGID}"
+	fi
+
+	# If a user has already enabled db support, those plugins will
+	# most likely be desired as well. Besides they don't impose new
+	# dependencies and come at no cost (except for space).
+	if use mysql || use sqlite; then
+		myconf="${myconf} --enable-attr-sql --enable-sql"
+	fi
+
+	# strongSwan builds and installs static libs by default which are
+	# useless to the user (and to strongSwan for that matter) because no
+	# header files or alike get installed... so disabling them is safe.
+	if use pam && use eap; then
+		myconf="${myconf} --enable-eap-gtc"
+	else
+		myconf="${myconf} --disable-eap-gtc"
+	fi
+	econf \
+		--disable-static \
+		--enable-ikev1 \
+		--enable-ikev2 \
+		$(use_with caps capabilities libcap) \
+		$(use_enable curl) \
+		$(use_enable ldap) \
+		$(use_enable debug leak-detective) \
+		$(use_enable eap eap-sim) \
+		$(use_enable eap eap-sim-file) \
+		$(use_enable eap eap-simaka-sql) \
+		$(use_enable eap eap-simaka-pseudonym) \
+		$(use_enable eap eap-simaka-reauth) \
+		$(use_enable eap eap-identity) \
+		$(use_enable eap eap-md5) \
+		$(use_enable eap eap-aka) \
+		$(use_enable eap eap-aka-3gpp2) \
+		$(use_enable eap eap-mschapv2) \
+		$(use_enable eap eap-radius) \
+		$(use_enable openssl) \
+		$(use_enable gcrypt) \
+		$(use_enable mysql) \
+		$(use_enable sqlite) \
+		$(use_enable dhcp) \
+		$(use_enable farp) \
+		${myconf}
+}
+
+src_install() {
+	emake DESTDIR="${D}" install || die "Install failed"
+
+	doinitd "${FILESDIR}"/ipsec
+
+	local dir_ugid
+	if use non-root; then
+		fowners ${UGID}:${UGID} \
+			/etc/ipsec.conf \
+			/etc/strongswan.conf
+
+		dir_ugid="${UGID}"
+	else
+		dir_ugid="root"
+	fi
+
+	diropts -m 0750 -o ${dir_ugid} -g ${dir_ugid}
+	dodir /etc/ipsec.d \
+		/etc/ipsec.d/aacerts \
+		/etc/ipsec.d/acerts \
+		/etc/ipsec.d/cacerts \
+		/etc/ipsec.d/certs \
+		/etc/ipsec.d/crls \
+		/etc/ipsec.d/ocspcerts \
+		/etc/ipsec.d/private \
+		/etc/ipsec.d/reqs
+
+	dodoc NEWS README TODO || die
+
+	# shared libs are used only internally and there are no static libs,
+	# so it's safe to get rid of the .la files
+	find "${D}" -name '*.la' -delete || die "Failed to remove .la files."
+}
+
+pkg_preinst() {
+	has_version "<net-misc/strongswan-4.3.6-r1"
+	upgrade_from_leq_4_3_6=$(( !$? ))
+
+	has_version "<net-misc/strongswan-4.3.6-r1[-caps]"
+	previous_4_3_6_with_caps=$(( !$? ))
+}
+
+pkg_postinst() {
+	if ! use openssl && ! use gcrypt; then
+		elog
+		elog "${PN} has been compiled without both OpenSSL and libgcrypt support."
+		elog "Please note that this might effect availability and speed of some"
+		elog "cryptographic features. You are advised to enable the OpenSSL plugin."
+	elif ! use openssl; then
+		elog
+		elog "${PN} has been compiled without the OpenSSL plugin. This might effect"
+		elog "availability and speed of some cryptographic features. There will be"
+		elog "no support for Elliptic Curve Cryptography (Diffie-Hellman groups 19-21,"
+		elog "25, 26) and ECDSA."
+	fi
+
+	if [[ $upgrade_from_leq_4_3_6 == 1 ]]; then
+		chmod 0750 "${ROOT}"/etc/ipsec.d \
+			"${ROOT}"/etc/ipsec.d/aacerts \
+			"${ROOT}"/etc/ipsec.d/acerts \
+			"${ROOT}"/etc/ipsec.d/cacerts \
+			"${ROOT}"/etc/ipsec.d/certs \
+			"${ROOT}"/etc/ipsec.d/crls \
+			"${ROOT}"/etc/ipsec.d/ocspcerts \
+			"${ROOT}"/etc/ipsec.d/private \
+			"${ROOT}"/etc/ipsec.d/reqs
+
+		ewarn
+		ewarn "The default permissions for /etc/ipsec.d/* have been tightened for"
+		ewarn "security reasons. Your system installed directories have been"
+		ewarn "updated accordingly. Please check if necessary."
+		ewarn
+
+		if [[ $previous_4_3_6_with_caps == 1 ]]; then
+			if ! use non-root; then
+				ewarn
+				ewarn "IMPORTANT: You previously had ${PN} installed without root"
+				ewarn "privileges because it was implied by the 'caps' USE flag."
+				ewarn "This has been changed. If you want ${PN} with user privileges,"
+				ewarn "you have to re-emerge it with the 'non-root' USE flag enabled."
+				ewarn
+			fi
+		fi
+	fi
+	if ! use caps && ! use non-root; then
+		ewarn
+		ewarn "You have decided to run ${PN} with root privileges and built it"
+		ewarn "without support for POSIX capability dropping. It is generally"
+		ewarn "strongly suggested that you reconsider- especially if you intend"
+		ewarn "to run ${PN} as server with a public ip address."
+		ewarn
+		ewarn "You should re-emerge ${PN} with at least the 'caps' USE flag enabled."
+		ewarn
+	fi
+	if use non-root; then
+		elog
+		elog "${PN} has been installed without superuser privileges (USE=non-root)."
+		elog "This imposes several limitations mainly to the IKEv1 daemon 'pluto'"
+		elog "but also a few to the IKEv2 daemon 'charon'."
+		elog
+		elog "Please carefully read: http://wiki.strongswan.org/wiki/nonRoot"
+		elog
+		elog "pluto uses a helper script by default to insert/remove routing and"
+		elog "policy rules upon connection start/stop which requires superuser"
+		elog "privileges. charon in contrast does this internally and can do so"
+		elog "even with reduced (user) privileges."
+		elog
+		elog "Thus if you require IKEv1 (pluto) or need to specify a custom updown"
+		elog "script to pluto or charon which requires superuser privileges, you"
+		elog "can work around this limitation by using sudo to grant the"
+		elog "user \"ipsec\" the appropriate rights."
+		elog "For example (the default case):"
+		elog "/etc/sudoers:"
+		elog "  Defaults:ipsec always_set_home,!env_reset"
+		elog "  ipsec ALL=(ALL) NOPASSWD: /usr/sbin/ipsec"
+		elog "Under the specific connection block in /etc/ipsec.conf:"
+		elog "  leftupdown=\"sudo ipsec _updown\""
+		elog
+	fi
+	elog
+	elog "Make sure you have _all_ required kernel modules available including"
+	elog "the appropriate cryptographic algorithms. A list is available at:"
+	elog "  http://wiki.strongswan.org/projects/strongswan/wiki/KernelModules"
+	elog
+	elog "The up-to-date manual is available online at:"
+	elog "  http://wiki.strongswan.org/"
+	elog
+}