aboutsummaryrefslogtreecommitdiffstats
path: root/meta-networking/recipes-support/strongswan
AgeCommit message (Collapse)Author
2022-07-04strongswan: upgrade 5.9.5 -> 5.9.6Yi Zhao
* Drop backport patch 0001-openssl-Don-t-unload-providers.patch * Backport a patch to fix the build error: src/libstrongswan/utils/enum.c: In function 'enum_flags_to_string': src/libstrongswan/utils/enum.c:100:9: error: format not a string literal and no format arguments [-Werror=format-security] 100 | if (snprintf(buf, len, e->names[0]) >= len) | ^~ Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 689e8422b836d804d9ab102cb3de0a4f6e1f24c8) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-30strongswan: 5.9.4 -> 5.9.5Yi Zhao
* Backport a patch to fix the segfault with swanctl: $ /usr/sbin/charon-systemd & $ /usr/sbin/swanctl --load-all --noprompt no files found matching '/etc/swanctl/conf.d/*.conf' no authorities found, 0 unloaded no pools found, 0 unloaded no connections found, 0 unloaded Segmentation fault * Drop fix-funtion-parameter.patch and 0001-memory.h-Include-stdint.h-for-uintptr_t.patch as the issues have been fixed upstream. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2022-03-04recipes: Update LICENSE variable to use SPDX license identifiersKhem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2022-02-21Fix DeprecationWarning about regexpsMartin Jansa
* fixes: meta-oe/meta-networking/recipes-support/strongswan/strongswan_5.9.4.bb:125: DeprecationWarning: invalid escape sequence \. meta-oe/meta-networking/recipes-support/strongswan/strongswan_5.9.4.bb:126: DeprecationWarning: invalid escape sequence \. meta-oe/meta-networking/recipes-support/strongswan/strongswan_5.9.4.bb:128: DeprecationWarning: invalid escape sequence \. meta-oe/meta-networking/recipes-support/strongswan/strongswan_5.9.4.bb:129: DeprecationWarning: invalid escape sequence \. meta-oe/meta-networking/recipes-support/strongswan/strongswan_5.9.4.bb:130: DeprecationWarning: invalid escape sequence \. meta-oe/meta-oe/recipes-graphics/ttf-fonts/ttf-mplus_027.bb:18: DeprecationWarning: invalid escape sequence \. meta-oe/meta-oe/recipes-multimedia/libcdio/libcdio-paranoia_10.2+2.0.1.bb:21: DeprecationWarning: invalid escape sequence \. meta-oe/meta-oe/recipes-multimedia/libcdio/libcdio_2.1.0.bb:28: DeprecationWarning: invalid escape sequence \. oe-core/meta/classes/package.bbclass:1342: DeprecationWarning: invalid escape sequence \. oe-core/meta/classes/package.bbclass:1343: DeprecationWarning: invalid escape sequence \- oe-core/meta/classes/package.bbclass:1343: DeprecationWarning: invalid escape sequence \. oe-core/meta/classes/package.bbclass:1344: DeprecationWarning: invalid escape sequence \. oe-core/meta/classes/package.bbclass:1345: DeprecationWarning: invalid escape sequence \. oe-core/meta/classes/package.bbclass:1348: DeprecationWarning: invalid escape sequence \. oe-core/meta/classes/package.bbclass:1350: DeprecationWarning: invalid escape sequence \. oe-core/meta/classes/package.bbclass:1353: DeprecationWarning: invalid escape sequence \. oe-core/meta/classes/package.bbclass:1355: DeprecationWarning: invalid escape sequence \. oe-core/meta/classes/package.bbclass:1358: DeprecationWarning: invalid escape sequence \. oe-core/meta/classes/package.bbclass:1360: DeprecationWarning: invalid escape sequence \. oe-core/meta/classes/package.bbclass:1365: DeprecationWarning: invalid escape sequence \. Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2021-12-27strongswan: remove redundant DEPENDSArmin Kuster
drop openssl and gmp from DEPENDS, covered in PACKAGECONFIG Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2021-12-27strongswan: add integrity optionsArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2021-12-27strongswan: add tpm PACKAGECONFIGArmin Kuster
migrate meta-tpm strongswan tweaks to meta-networking Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2021-12-27strongswan: provide PACKAGECONFIG for cureve25519Armin Kuster
Not everyone wants this to be installed by default. Enable to remove cureve25519 is someone wants to. Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2021-11-11strongswan: add required kernel modules to RRECOMMENDSYi Zhao
Strongswan failed to startup because there is no kernel module named ipsec. Add basic kernel modules required by strongswan per [1]. [1] https://wiki.strongswan.org/projects/strongswan/wiki/KernelModules, Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2021-10-19strongswan: upgrade 5.9.3 -> 5.9.4Yi Zhao
Add openssl PACKAGECONFIG back as the openssl 3.0 compatibility issue has been fixed. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2021-10-14strongswan: disable openssl PACKAGECONFIGAlexander Kanavin
Until upstream addresses openssl 3.x compatibility issues. Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2021-08-03Convert to new override syntaxMartin Jansa
This is the result of automated script (0.9.1) conversion: oe-core/scripts/contrib/convert-overrides.py . converting the metadata to use ":" as the override character instead of "_". Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2021-07-13strongswan: upgrade 5.9.2 -> 5.9.3zangrc
- Added AES_ECB, SHA-3 and SHAKE-256 support to wolfssl plugin. - Added AES_CCM and SHA-3 signature support to openssl plugin. - The x509 and openssl plugins now consider the authorityKeyIdentifier, if available, before verifying signatures, which avoids unnecessary signature verifications after a CA key rollover if both certificates are loaded. - The pkcs11 plugin better handles optional attributes like CKA_TRUSTED, which previously depended on a version check. - charon-nm now supports using SANs as client identities, not only full DNs. - charon-tkm now handles IKE encryption. - A MOBIKE update is sent again if a a change in the NAT mappings is detected but the endpoints stay the same. - Converted most of the test case scenarios to the vici interface Signed-off-by: Zang Ruochen <zangrc.fnst@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2021-04-17strongswan: Make PACKAGECONFIG a default valueJoe Hershberger
Change from a weak default to a default in the definition of the PACKAGECONFIG. In https://github.com/flihp/meta-measured/blob/master/networking-layer/recipes-support/strongswan/strongswan_5.%25.bbappend the PACKAGECONFIG is appended to, so if the definition is weak here, the variable will be empty when the bbappend attempts to add to it. Signed-off-by: Khem Raj <raj.khem@gmail.com>
2021-03-04strongswan: upgrade 5.9.1 -> 5.9.2zangrc
Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-23strongswan: upgrade 5.8.4 -> 5.9.1zangrc
0001-Remove-obsolete-setting-regarding-the-Standard-Outpu.patch Removed since this is included in 5.9.1 Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-10strongswan: remove ldap from default PACKAGECONFIGNick Rosbrook
Since ldap is not a standard DISTRO_FEATURE, leave it disabled by default. Signed-off-by: Nick Rosbrook <rosbrookn@ainfosec.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-10strongswan: do not use deprecated stroke and starter by defaultNick Rosbrook
The swanctl and vici configuration of strongswan is preferred, as the stroke plugin used with starter is deprecated. As a reasonable default, add swanctl to PACKAGECONFIG by default, and remove stroke. When systemd is in DISTRO_FEATURES, add systemd-charon to PACKAGECONFIG, and add charon when systemd is not in DISTRO_FEATURES. While here, make sure strongswan-starter.service is only installed when charon is enabled. The current unconditional installation of strongswan-starter.service can break systems which install strongswan.service for use with swanctl. Signed-off-by: Nick Rosbrook <rosbrookn@ainfosec.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-06strongswan: add some PACKAGECONFIG options for EAPNick Rosbrook
Add options for eap-identity and eap-mschapv2 plugins. Signed-off-by: Nick Rosbrook <rosbrookn@ainfosec.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-09-23strongswan: Remove obsolete setting regarding the Standard OutputMingli Yu
The Standard output type "syslog" is obsolete, causing a warning since systemd version 246 [1]. Please consider using "journal" or "journal+console" [1] https://github.com/systemd/systemd/blob/master/NEWS#L202 Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-03-31strongswan: upgrade 5.8.2 -> 5.8.4Wang Mingyu
Signed-off-by: Wang Mingyu <wangmy@cn.fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-01-03strongswan: upgrade 5.8.1 -> 5.8.2Wang Mingyu
Signed-off-by: Wang Mingyu <wangmy@cn.fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-10-17strongswan: add a PACKAGECONFIG for libbfd stack tracesCallaghan, Dan
Strongswan installs a signal handler for SIGSEGV, SIGILL, and SIGBUS which attempts to print a stack trace of the crash. For producing line numbers in the stack trace, it can use libbfd from binutils, or libunwind, or else it falls back to a slower method using /usr/bin/addr2line. Currently the addr2line method is unlikely to actually work, since there is no RDEPENDS to pull that command into the image. This patch adds a PACKAGECONFIG to enable the libbfd-based stack traces, which is likely the best alternative since binutils is already required for building everything, and it will be faster than the addr2line method (which requires addr2line and libbfd anyway). Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-10-04strongswan: install dev headersCallaghan, Dan
These are needed for other packages which want to link against libstrongswan or other libraries included with Strongswan. By default, no headers are installed. Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-09-07strongswan: Fix do_patch fuzzKhem Raj
Refresh the patch to apply cleanly Fixes Applying patch 0001-memory.h-Include-stdint.h-for-uintptr_t.patch patching file src/libstrongswan/utils/utils/memory.h Hunk #1 succeeded at 26 with fuzz 2 (offset 4 lines). Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-09-02strongswan: upgrade 5.8.0 -> 5.8.1Yuan Chao
Signed-off-by: Yuan Chao <yuanc.fnst@cn.fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-06-25strongswan: upgrade 5.7.1 -> 5.8.0Yi Zhao
Rename systemd service units since it uses strongswan-starter.service for the legacy unit and strongswan.service for the modern one. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-01-13meta-networking: remove True option to getVar calls (again)André Draszik
A couple have still been missed in the past despite multiple attempts at doing so (or simply have re-appeared?). Search & replace made using the following command: sed -e 's|\(d\.getVar \?\)( \?\([^,()]*\), \?True)|\1(\2)|g' \ -i $(git grep -E 'getVar ?\( ?([^,()]*), ?True\)' \ | cut -d':' -f1 \ | sort -u) Signed-off-by: André Draszik <andre.draszik@jci.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2018-10-16strongswan: upgrade to 5.7.1Qi.Chen@windriver.com
Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2018-07-03strongswan: upgrade 5.6.2 -> 5.6.3Yi Zhao
Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2018-05-30strongswan: add UPSTREAM_CHECK_REGEXYi Zhao
Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2018-04-13strongswan: refresh patchesArmin Kuster
WARNING: Some of the context lines in patches were ignored. This can lead to incorrectly applied patches. The context lines in the patches can be updated with devtool: devtool modify <recipe> devtool finish --force-patch-refresh <recipe> <layer_path> Then the updated patches and the source tree (in devtool's workspace) should be reviewed to make sure the patches apply in the correct place and don't introduce duplicate lines (which can, and does happen when some of the context is ignored). Further information: http://lists.openembedded.org/pipermail/openembedded-core/2018-March/148675.html https://bugzilla.yoctoproject.org/show_bug.cgi?id=10450 Details: checking file src/libstrongswan/plugins/openssl/openssl_diffie_hellman.c Hunk #1 succeeded at 192 (offset 50 lines). Hunk #2 succeeded at 255 with fuzz 1 (offset 58 lines). checking file src/libstrongswan/plugins/openssl/openssl_diffie_hellman.h Hunk #1 succeeded at 43 (offset -1 lines). checking file src/libstrongswan/plugins/openssl/openssl_plugin.c Hunk #1 succeeded at 609 (offset 221 lines). Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-04-09strongswan: 5.5.3 -> 5.6.2Huang Qiyu
1.Upgrade strongswan from 5.5.3 to 5.6.2. 2.Modify fix-funtion-parameter.patch, since the data has been changed. Signed-off-by: Huang Qiyu <huangqy.fnst@cn.fujitsu.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2018-02-05strongswan: add ${PN}-plugin-curve25519 to RDEPENDSMingli Yu
* The default DH group curve25519 depends on an optional plugin ${PN}-plugin-curve25519, add it to RDEPENDS to avoid below error: root@test:~# ipsec up host-lan initiating IKE_SA host-lan[1] to 192.168.7.2 configured DH group CURVE_25519 not supported tried to checkin and delete nonexisting IKE_SA establishing connection 'host-lan' failed Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2017-09-08strongswan: Include stdint.h for uintptr_tKhem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2017-06-28strongswan: 5.5.1 -> 5.5.3fan.xin
Signed-off-by: Fan Xin <fan.xin@jp.fujitsu.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2017-04-27strongswan: Split pluginsDavid Vincent
strongSwan offers a plugin mechanism therefore it should not be mandatory to install all of them when installing the package. Each plugin is now a self-contained package with the library and its configuration. To remain compatible with the current configuration, a default set of plugins has been selected as RDEPENDS of the main package. This default list is based on the default strongSwan list minus some plugins enabled via PACKAGECONFIG (see https://wiki.strongswan.org/projects/strongswan/PluginList). Signed-off-by: David Vincent <freesilicon@gmail.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2017-03-07Make use of the new bb.utils.filter() functionPeter Kjellerstedt
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2017-01-19strongswan: update to 5.5.1Oleksandr Kravchuk
Signed-off-by: Oleksandr Kravchuk <oleksandr.kravchuk@pelagicore.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2017-01-19strongswan: delete obsolete patchesOleksandr Kravchuk
Signed-off-by: Oleksandr Kravchuk <oleksandr.kravchuk@pelagicore.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2016-09-12strongswan: 5.3.2 -> 5.5.0Wang Xin
Upgrade strongswan from 5.3.2 to 5.5.0. Signed-off-by: Wang Xin <wangxin2015.fnst@cn.fujitsu.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-05-05meta-networking: use bb.utils.contains() instead of base_contains()Ross Burton
base_contains() is a compatibility wrapper and may warn in the future, so replace all instances with bb.utils.contains(). Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-01-05strongswan: install strongswan-swanctl systemd service by default.Chris Patterson
Matches start-on-boot behaviour of current strongswan.service. Signed-off-by: Chris Patterson <pattersonc@ainfosec.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-01-05strongswan: add configure patch fix for systemdChris Patterson
Fixes strongswan configure script for systemd >= 209, where it merged libsystemd-journal and libsystemd-daemon into libsystemd. Signed-off-by: Chris Patterson <pattersonc@ainfosec.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2016-01-05strongswan: add additional PACKAGECONFIG flagsChris Patterson
- Add aesni, charon, gmp, openssl, scep, stroke, swanctl, and systemd-charon. - Organize the packageconfig list alphabetically. - Update the default PACKAGECONFIG to match current defaults. - If swanctl is enabled, use strongswan-swanctl.service instead of strongswan.service. Signed-off-by: Chris Patterson <pattersonc@ainfosec.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2015-08-06strongswan: upgrade to 5.3.2Roy Li
5.3.2 includes the fixes for CVE-2015-3991 and CVE-2015-4171 Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2015-06-05meta-networking: standardize SECTION valuesJoe MacDonald
SECTION has been used inconsistently throughout the recipes in this layer. Convert them to all use the same convention. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2015-05-13strongswan: upgrade to 5.3.0Roy Li
Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2014-12-09strongswan: update package to 5.2.1Armin Kuster
see https://wiki.strongswan.org/projects/strongswan/wiki/Changelog52 Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2014-08-21strongswan: uprev to version 5.2.0Jackie Huang
* removed two patches which were already integrated in 5.2.0: strongswan-4.3.3-5.1.1_asn1_unwrap.patch strongswan-5.0.0-5.1.2_reject_child_sa.patch Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-09-26 01:52:24 +0000