summaryrefslogtreecommitdiff
path: root/pcr/strongswan
diff options
context:
space:
mode:
Diffstat (limited to 'pcr/strongswan')
-rw-r--r--pcr/strongswan/2222-charon-systemd-sighup.patch33
-rw-r--r--pcr/strongswan/2238-eap-dynamic-auth.patch38
-rw-r--r--pcr/strongswan/PKGBUILD27
3 files changed, 91 insertions, 7 deletions
diff --git a/pcr/strongswan/2222-charon-systemd-sighup.patch b/pcr/strongswan/2222-charon-systemd-sighup.patch
new file mode 100644
index 000000000..544612c20
--- /dev/null
+++ b/pcr/strongswan/2222-charon-systemd-sighup.patch
@@ -0,0 +1,33 @@
+index 5c7bbd779..fc93e2182 100644
+--- a/src/charon-systemd/charon-systemd.c
++++ b/src/charon-systemd/charon-systemd.c
+@@ -241,6 +241,7 @@ static int run()
+ sigset_t set;
+
+ sigemptyset(&set);
++ sigaddset(&set, SIGHUP);
+ sigaddset(&set, SIGTERM);
+ sigprocmask(SIG_BLOCK, &set, NULL);
+
+@@ -262,6 +263,21 @@ static int run()
+ }
+ switch (sig)
+ {
++ case SIGHUP:
++ {
++ DBG1(DBG_DMN, "signal of type SIGHUP received. Reloading "
++ "configuration");
++ if (lib->settings->load_files(lib->settings, lib->conf, FALSE))
++ {
++ charon->load_loggers(charon, NULL, FALSE);
++ lib->plugins->reload(lib->plugins, NULL);
++ }
++ else
++ {
++ DBG1(DBG_DMN, "reloading config failed, keeping old");
++ }
++ break;
++ }
+ case SIGTERM:
+ {
+ DBG1(DBG_DMN, "SIGTERM received, shutting down");
diff --git a/pcr/strongswan/2238-eap-dynamic-auth.patch b/pcr/strongswan/2238-eap-dynamic-auth.patch
new file mode 100644
index 000000000..17b954ea7
--- /dev/null
+++ b/pcr/strongswan/2238-eap-dynamic-auth.patch
@@ -0,0 +1,38 @@
+diff --git a/src/libcharon/plugins/eap_dynamic/eap_dynamic.c b/src/libcharon/plugins/eap_dynamic/eap_dynamic.c
+index d0f0595de..83ccd3a8a 100644
+--- a/src/libcharon/plugins/eap_dynamic/eap_dynamic.c
++++ b/src/libcharon/plugins/eap_dynamic/eap_dynamic.c
+@@ -94,6 +94,13 @@ static eap_method_t *load_method(private_eap_dynamic_t *this,
+ return method;
+ }
+
++METHOD(eap_method_t, get_auth, auth_cfg_t*,
++ private_eap_dynamic_t *this)
++{
++ /* get_auth() is only registered if the EAP method supports it */
++ return this->method->get_auth(this->method);
++}
++
+ /**
+ * Select the first method we can instantiate and is supported by both peers.
+ */
+@@ -135,6 +142,10 @@ static void select_method(private_eap_dynamic_t *this)
+ this->method = load_method(this, entry->type, entry->vendor);
+ if (this->method)
+ {
++ if (this->method->get_auth)
++ {
++ this->public.interface.get_auth = _get_auth;
++ }
+ if (entry->vendor)
+ {
+ DBG1(DBG_IKE, "vendor specific EAP method %d-%d selected",
+@@ -211,6 +222,7 @@ METHOD(eap_method_t, process, status_t,
+ /* restart with a different method */
+ this->method->destroy(this->method);
+ this->method = NULL;
++ this->public.interface.get_auth = NULL;
+ return initiate(this, out);
+ }
+ if (!this->other_types)
+
diff --git a/pcr/strongswan/PKGBUILD b/pcr/strongswan/PKGBUILD
index a9483eef1..efd322184 100644
--- a/pcr/strongswan/PKGBUILD
+++ b/pcr/strongswan/PKGBUILD
@@ -1,3 +1,5 @@
+# PLEASE READ THE COMMENTS ON THE AUR AND READ THE WIKI ARTICLE ABOUT BUILDING PACKAGES
+# BEFORE SENDING MAIL!
## Contributor (Arch): nikicat <develniks at gmail dot com>
# Contributor (Arch): danilo <gezuru at gmail dot com>
# Contributor (Arch): Jason Begley <jayray at digitalgoat dot com>
@@ -11,7 +13,7 @@
pkgname=strongswan
pkgver=5.5.1
-pkgrel=1
+pkgrel=5
pkgdesc="open source IPsec implementation"
url='http://www.strongswan.org'
license=("GPL")
@@ -27,24 +29,32 @@ backup=(
etc/swanctl/swanctl.conf
etc/strongswan.conf
etc/strongswan.d/{charon-logging.conf,charon.conf,pki.conf,pool.conf,scepclient.conf,starter.conf,swanctl.conf}
- etc/strongswan.d/charon/{aesni.conf,attr-sql.conf,attr.conf,cmac.conf,connmark.conf,\
+ etc/strongswan.d/charon/{aesni.conf,attr-sql.conf,attr.conf,bliss.conf,chapoly.conf,cmac.conf,connmark.conf,\
constraints.conf,curl.conf,des.conf,dhcp.conf,dnskey.conf,eap-aka-3gpp2.conf,eap-aka.conf,\
eap-gtc.conf,eap-identity.conf,eap-md5.conf,eap-mschapv2.conf,eap-radius.conf,eap-sim-file.conf,\
eap-sim.conf,eap-simaka-pseudonym.conf,eap-simaka-reauth.conf,eap-tls.conf,ext-auth.conf,farp.conf,\
-fips-prf.conf,forecast.conf,gmp.conf,ha.conf,hmac.conf,kernel-netlink.conf,md5.conf,nonce.conf,openssl.conf,\
+fips-prf.conf,forecast.conf,gmp.conf,ha.conf,hmac.conf,kernel-netlink.conf,md5.conf,mgf1.conf,nonce.conf,newhope.conf,ntru.conf,openssl.conf,\
pem.conf,pgp.conf,pkcs1.conf,pkcs12.conf,pkcs7.conf,pkcs8.conf,pubkey.conf,random.conf,rc2.conf,resolve.conf,\
-revocation.conf,sha1.conf,sha2.conf,socket-default.conf,sql.conf,sqlite.conf,sshkey.conf,stroke.conf,updown.conf,\
-vici.conf,x509.conf,xauth-eap.conf,xauth-generic.conf,xcbc.conf,chapoly.conf,unity.conf}
+revocation.conf,sha1.conf,sha2.conf,sha3.conf,socket-default.conf,sql.conf,sqlite.conf,sshkey.conf,stroke.conf,updown.conf,\
+vici.conf,x509.conf,xauth-eap.conf,xauth-generic.conf,xcbc.conf,unity.conf}
)
source=("https://download.strongswan.org/strongswan-${pkgver}.tar.bz2"
+ "https://download.strongswan.org/strongswan-${pkgver}.tar.bz2.sig"
"configure_ac.patch"
+ "2222-charon-systemd-sighup.patch"
+ "2238-eap-dynamic-auth.patch"
)
+validpgpkeys=("948F158A4E76A27BF3D07532DF42C170B34DBA77")
+
# md5 is broken. We use sha256 now. Alternatively, we could check the signature of the file, but that
# doesn't yield any more security and just increases the work users initially have to invest.
sha256sums=('720b301991f77bdedd8d551a956f52e2d11686a0ec18e832094f86cf2b842ab7'
- '003750d77fa501075f1fdb6f55926dc544407c5dd26e2fd8d5eb4917ddf0b3f7')
+ 'SKIP'
+ '003750d77fa501075f1fdb6f55926dc544407c5dd26e2fd8d5eb4917ddf0b3f7'
+ 'SKIP'
+ 'SKIP')
# We don't build libipsec because it would get loaded before kernel-netlink and netkey, which
# would case processing to be handled in user space. Also, the plugin is experimental. If you need it,
@@ -53,6 +63,8 @@ prepare()
{
cd "${srcdir}/${pkgname}-${pkgver}"
patch -p1 -l < "${srcdir}/configure_ac.patch"
+ patch -p1 -l < "${srcdir}/2222-charon-systemd-sighup.patch"
+ patch -p1 -l < "${srcdir}/2238-eap-dynamic-auth.patch"
autoreconf
}
@@ -76,7 +88,8 @@ build() {
--disable-mysql --disable-ldap --enable-cmd --enable-forecast --enable-connmark \
--enable-aesni --enable-eap-ttls --enable-radattr --enable-xauth-pam --enable-xauth-noauth \
--enable-eap-dynamic --enable-eap-peap --enable-eap-tls --enable-chapoly --enable-unity \
- --with-capabilities=libcap
+ --with-capabilities=libcap --enable-newhope --enable-ntru --enable-mgf1 --enable-sha3 \
+ --enable-bliss
# if you want networkmanager support, add --enable-nm
# --enable-ruby-gems --enable-python-eggs
make
generated by cgit v1.2.3 (git 2.39.1) at 2024-10-31 13:08:54 +0000