diff options
15 files changed, 150 insertions, 547 deletions
diff --git a/data/defaults.toml b/data/defaults.toml index 13c790f6..f847017b 100644 --- a/data/defaults.toml +++ b/data/defaults.toml @@ -14,7 +14,7 @@ vyos_mirror = "http://dev.packages.vyos.net/repositories/sagitta" vyos_branch = "sagitta" release_train = "sagitta" -kernel_version = "6.1.63" +kernel_version = "6.1.68" bootloaders = "syslinux,grub-efi" squashfs_compression_type = "xz -Xbcj x86 -b 256k -always-use-fragments -no-recovery" diff --git a/data/live-build-config/hooks/live/18-enable-disable_services.chroot b/data/live-build-config/hooks/live/18-enable-disable_services.chroot index 26bdfc7f..bd1a0800 100755 --- a/data/live-build-config/hooks/live/18-enable-disable_services.chroot +++ b/data/live-build-config/hooks/live/18-enable-disable_services.chroot @@ -1,6 +1,7 @@ #!/bin/sh echo I: Disabling services +systemctl disable arpwatch.service systemctl disable smartd.service systemctl disable isc-dhcp-server.service systemctl disable isc-dhcp-relay.service @@ -78,6 +79,7 @@ systemctl enable vyos-hostsd.service systemctl enable acpid.service systemctl enable vyos-router.service systemctl enable vyos-configd.service +systemctl enable vyos-grub-update.service echo I: Masking services systemctl mask systemd-journald-audit.socket diff --git a/data/live-build-config/includes.chroot/etc/initramfs-tools/hooks/10-vyos-addons b/data/live-build-config/includes.chroot/etc/initramfs-tools/hooks/10-vyos-addons index d533eaca..b9190971 100755 --- a/data/live-build-config/includes.chroot/etc/initramfs-tools/hooks/10-vyos-addons +++ b/data/live-build-config/includes.chroot/etc/initramfs-tools/hooks/10-vyos-addons @@ -33,3 +33,4 @@ copy_exec /usr/sbin/fsck.ext4 # copy other files ("other" here is a file type, so do not delete this keyword) copy_file other /etc/ssl/certs/ca-certificates.crt +copy_file other /etc/ssl/openssl.cnf diff --git a/packages/ddclient/Jenkinsfile b/packages/ddclient/Jenkinsfile index 94d9a7be..80ec8cc7 100644 --- a/packages/ddclient/Jenkinsfile +++ b/packages/ddclient/Jenkinsfile @@ -20,10 +20,14 @@ @Library('vyos-build@sagitta')_ def pkgList = [ - ['name': 'ddclient', + ['name': 'ddclient-debian', 'scmCommit': 'debian/3.10.0-3', 'scmUrl': 'https://salsa.debian.org/debian/ddclient', - 'buildCmd': 'sudo mk-build-deps --install --tool "apt-get --yes --no-install-recommends"; cd ..; ./build.sh'], + 'buildCmd': '/bin/true'], + ['name': 'ddclient-github', + 'scmCommit': 'v3.11.2', + 'scmUrl': 'https://github.com/ddclient/ddclient', + 'buildCmd': 'cd ..; ./build.sh'], ] // Start package build using library function from https://github.com/vyos/vyos-build diff --git a/packages/ddclient/build.sh b/packages/ddclient/build.sh index 76a03815..82e9b899 100755 --- a/packages/ddclient/build.sh +++ b/packages/ddclient/build.sh @@ -1,26 +1,49 @@ -#!/bin/sh +#!/bin/bash CWD=$(pwd) set -e -SRC=ddclient -if [ ! -d ${SRC} ]; then - echo "Source directory does not exists, please 'git clone'" +SRC_DEBIAN=ddclient-debian +SRC_GITHUB=ddclient-github + +if [ ! -d ${SRC_DEBIAN} ]; then + echo "${SRC_DEBIAN} directory does not exists, please 'git clone'" + exit 1 +fi + +if [ ! -d ${SRC_GITHUB} ]; then + echo "${SRC_GITHUB} directory does not exists, please 'git clone'" exit 1 fi +echo "I: Copy Debian build instructions" +cp -a ${SRC_DEBIAN}/debian ${SRC_GITHUB} +# Preserve some of the Debian's default patches +cat > ${SRC_GITHUB}/debian/patches/series << EOF +maxinterval.diff +news.diff +EOF +# Remove vestigial documentation +sed -i '/README\.ssl/d' ${SRC_GITHUB}/debian/docs + PATCH_DIR=${CWD}/patches -if [ -d $PATCH_DIR ]; then +if [ -d ${PATCH_DIR} ]; then for patch in $(ls ${PATCH_DIR}) do echo "I: Apply patch: ${patch} to main repository" - cp ${PATCH_DIR}/${patch} ${SRC}/debian/patches/ - echo ${patch} >> ${SRC}/debian/patches/series + cp ${PATCH_DIR}/${patch} ${SRC_GITHUB}/debian/patches/ + echo ${patch} >> ${SRC_GITHUB}/debian/patches/series done fi -cd ${SRC} -echo "I: bump version" -dch -v "3.10.0-3+vyos0" "Patchset for miscellaneous fixes" +cd ${SRC_GITHUB} + +echo "I: Ensure Debian build dependencies are met" +sudo mk-build-deps --install --tool "apt-get --yes --no-install-recommends" + +echo "I: Bump Debian Package version" +version="$(git describe --tags)" +dch -v "${version:1}+vyos0" "Patchset for miscellaneous fixes" +dch -a "Forward port to upstream version ${version:1}" echo "I: Build Debian Package" dpkg-buildpackage -uc -us -tc -b diff --git a/packages/ddclient/patches/z1_perhost-variable-new-style.patch b/packages/ddclient/patches/z1_perhost-variable-new-style.patch deleted file mode 100644 index cf8793f9..00000000 --- a/packages/ddclient/patches/z1_perhost-variable-new-style.patch +++ /dev/null @@ -1,47 +0,0 @@ -From 11a5bd5e7ef0d199c754947e24c0c8a736d18c48 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Thomas=20du=20Bo=C3=BFs?= <thomas@duboys.info> -Date: Sat, 28 Jan 2023 11:34:41 +0100 -Subject: [PATCH] define usev4, usev6 and dependancies as per-host config - -Ref: ddclient/ddclient#505 ---- - ddclient.in | 15 +++++++++++++++ - 1 file changed, 15 insertions(+) - -diff --git a/ddclient.in b/ddclient.in -index eff10fb4..ad7dee52 100755 ---- a/ddclient.in -+++ b/ddclient.in -@@ -490,17 +490,32 @@ my %variables = ( - 'host' => setv(T_STRING,1, 1, '', undef), - - 'use' => setv(T_USE, 0, 0, 'ip', undef), -+ 'usev4' => setv(T_USEV4, 0, 0, 'disabled', undef), -+ 'usev6' => setv(T_USEV6, 0, 0, 'disabled', undef), - 'if' => setv(T_IF, 0, 0, 'ppp0', undef), -+ 'ifv4' => setv(T_IF, 0, 0, 'default', undef), -+ 'ifv6' => setv(T_IF, 0, 0, 'default', undef), - 'web' => setv(T_STRING,0, 0, 'dyndns', undef), - 'web-skip' => setv(T_STRING,0, 0, '', undef), - 'web-ssl-validate' => setv(T_BOOL, 0, 0, 1, undef), -+ 'webv4' => setv(T_STRING,0, 0, 'googledomains', undef), -+ 'webv4-skip' => setv(T_STRING,1, 0, '', undef), -+ 'webv6' => setv(T_STRING,0, 0, 'googledomains', undef), -+ 'webv6-skip' => setv(T_STRING,1, 0, '', undef), - 'fw' => setv(T_ANY, 0, 0, '', undef), - 'fw-skip' => setv(T_STRING,0, 0, '', undef), - 'fw-login' => setv(T_LOGIN, 0, 0, '', undef), - 'fw-password' => setv(T_PASSWD,0, 0, '', undef), - 'fw-ssl-validate' => setv(T_BOOL, 0, 0, 1, undef), -+ 'fwv4' => setv(T_ANY, 0, 0, '', undef), -+ 'fwv4-skip' => setv(T_STRING,1, 0, '', undef), -+ 'fwv6' => setv(T_ANY, 0, 0, '', undef), -+ 'fwv6-skip' => setv(T_STRING,1, 0, '', undef), - 'cmd' => setv(T_PROG, 0, 0, '', undef), - 'cmd-skip' => setv(T_STRING,0, 0, '', undef), -+ 'cmdv4' => setv(T_PROG, 0, 0, '', undef), -+ 'cmdv6' => setv(T_PROG, 0, 0, '', undef), -+ - 'ip' => setv(T_IP, 0, 1, undef, undef), #TODO remove from cache? - 'ipv4' => setv(T_IPV4, 0, 1, undef, undef), - 'ipv6' => setv(T_IPV6, 0, 1, undef, undef), diff --git a/packages/ddclient/patches/z2_dyndns2-ipv4-ipv6.patch b/packages/ddclient/patches/z2_dyndns2-ipv4-ipv6.patch deleted file mode 100644 index f43fa8e7..00000000 --- a/packages/ddclient/patches/z2_dyndns2-ipv4-ipv6.patch +++ /dev/null @@ -1,114 +0,0 @@ -From fa6c95f5110455b6e1ad80d1147086619ddbf7df Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Thomas=20du=20Bo=C3=BFs?= <thomas@duboys.info> -Date: Fri, 27 Jan 2023 17:58:26 +0100 -Subject: [PATCH 1/2] Update dyndns2 client to use new IPv4/IPv6 logic -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Signed-off-by: Thomas du Boÿs <thomas@duboys.info> - -Ref: ddclient/ddclient#502 ---- - ddclient.in | 32 ++++++++++++++++++++++---------- - 1 file changed, 22 insertions(+), 10 deletions(-) - -diff --git a/ddclient.in b/ddclient.in -index eff10fb4..744d63ed 100755 ---- a/ddclient.in -+++ b/ddclient.in -@@ -4069,10 +4069,13 @@ sub nic_dyndns2_update { - my @hosts = @{$groups{$sig}}; - my $hosts = join(',', @hosts); - my $h = $hosts[0]; -- my $ip = $config{$h}{'wantip'}; -- delete $config{$_}{'wantip'} foreach @hosts; -+ my $ipv4 = $config{$h}{'wantipv4'}; -+ my $ipv6 = $config{$h}{'wantipv6'}; -+ delete $config{$_}{'wantipv4'} foreach @hosts; -+ delete $config{$_}{'wantipv6'} foreach @hosts; - -- info("setting IP address to %s for %s", $ip, $hosts); -+ info("setting IPv4 address to %s for %s", $ipv4, $hosts) if $ipv4; -+ info("setting IPv6 address to %s for %s", $ipv6, $hosts) if $ipv6; - verbose("UPDATE:", "updating %s", $hosts); - - ## Select the DynDNS system to update -@@ -4091,7 +4094,11 @@ sub nic_dyndns2_update { - - $url .= "&hostname=$hosts"; - $url .= "&myip="; -- $url .= $ip if $ip; -+ $url .= $ipv4 if $ipv4; -+ if ($ipv6) { -+ $url .= "," if $ipv4; -+ $url .= $ipv6; -+ } - - ## some args are not valid for a custom domain. - $url .= "&wildcard=ON" if ynu($config{$h}{'wildcard'}, 1, 0, 0); -@@ -4114,7 +4121,6 @@ sub nic_dyndns2_update { - - my @reply = split /\n/, $reply; - my $state = 'header'; -- my $returnedip = $ip; - - foreach my $line (@reply) { - if ($state eq 'header') { -@@ -4128,22 +4134,28 @@ sub nic_dyndns2_update { - - # bug #10: some dyndns providers does not return the IP so - # we can't use the returned IP -- my ($status, $returnedip) = split / /, lc $line; -- $ip = $returnedip if (not $ip); -+ my ($status, $returnedips) = split / /, lc $line; - my $h = shift @hosts; - - $config{$h}{'status'} = $status; -+ $config{$h}{'status-ipv4'} = $status if $ipv4; -+ $config{$h}{'status-ipv6'} = $status if $ipv6; - if ($status eq 'good') { -- $config{$h}{'ip'} = $ip; -+ $config{$h}{'ipv4'} = $ipv4 if $ipv4; -+ $config{$h}{'ipv6'} = $ipv6 if $ipv6; - $config{$h}{'mtime'} = $now; -- success("updating %s: %s: IP address set to %s", $h, $status, $ip); -+ success("updating %s: %s: IPv4 address set to %s", $h, $status, $ipv4) if $ipv4; -+ success("updating %s: %s: IPv6 address set to %s", $h, $status, $ipv6) if $ipv6; - - } elsif (exists $errors{$status}) { - if ($status eq 'nochg') { - warning("updating %s: %s: %s", $h, $status, $errors{$status}); -- $config{$h}{'ip'} = $ip; -+ $config{$h}{'ipv4'} = $ipv4 if $ipv4; -+ $config{$h}{'ipv6'} = $ipv6 if $ipv6; - $config{$h}{'mtime'} = $now; - $config{$h}{'status'} = 'good'; -+ $config{$h}{'status-ipv4'} = 'good' if $ipv4; -+ $config{$h}{'status-ipv6'} = 'good' if $ipv6; - - } else { - failed("updating %s: %s: %s", $h, $status, $errors{$status}); - -From cca4291360ce31aff1ab0d877d2622c11510c1f3 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Thomas=20du=20Bo=C3=BFs?= <thomas@duboys.info> -Date: Sat, 28 Jan 2023 10:46:43 +0100 -Subject: [PATCH 2/2] fix ipv4 address on message log when address already set - ---- - ddclient.in | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/ddclient.in b/ddclient.in -index 744d63ed..a5e9c68c 100755 ---- a/ddclient.in -+++ b/ddclient.in -@@ -3820,7 +3820,7 @@ sub nic_updateable { - success("%s: skipped: IP address was already set to %s.", $host, $ip); - } - if ($usev4 ne 'disabled') { -- success("%s: skipped: IPv4 address was already set to %s.", $host, $ipv6); -+ success("%s: skipped: IPv4 address was already set to %s.", $host, $ipv4); - } - if ($usev6 ne 'disabled') { - success("%s: skipped: IPv6 address was already set to %s.", $host, $ipv6); diff --git a/packages/ddclient/patches/z3_duckdns-reply-fix.patch b/packages/ddclient/patches/z3_duckdns-reply-fix.patch deleted file mode 100644 index ac51add9..00000000 --- a/packages/ddclient/patches/z3_duckdns-reply-fix.patch +++ /dev/null @@ -1,74 +0,0 @@ -From d35d62f3e753ffe15b151f7b7c5dea96bfa3ca7a Mon Sep 17 00:00:00 2001 -From: drinn <drinn@users.noreply.github.com> -Date: Sat, 28 Jan 2023 09:48:51 -0600 -Subject: [PATCH 1/2] updated nic_duckdns_update to account for extra lines in - duckdns reply - -Ref: ddclient/ddclient#506 ---- - ddclient.in | 30 +++++++++++++++++++++--------- - 1 file changed, 21 insertions(+), 9 deletions(-) - -diff --git a/ddclient.in b/ddclient.in -index eff10fb4..8797d7d4 100755 ---- a/ddclient.in -+++ b/ddclient.in -@@ -6559,16 +6559,28 @@ sub nic_duckdns_update { - next if !header_ok($h, $reply); - - my @reply = split /\n/, $reply; -- my $returned = pop(@reply); -- if ($returned =~ /OK/) { -- $config{$h}{'ip'} = $ip; -- $config{$h}{'mtime'} = $now; -- $config{$h}{'status'} = 'good'; -- success("updating %s: good: IP address set to %s", $h, $ip); -- } else { -- $config{$h}{'status'} = 'failed'; -- failed("updating %s: Server said: '%s'", $h, $returned); -+ my $state = 'noresult'; -+ my $line = ''; -+ -+ foreach $line (@reply) { -+ if ($line eq 'OK') { -+ $config{$h}{'ip'} = $ip; -+ $config{$h}{'mtime'} = $now; -+ $config{$h}{'status'} = 'good'; -+ $state = 'result'; -+ success("updating %s: good: IP address set to %s", $h, $ip); -+ -+ } elsif ($line eq 'KO') { -+ $config{$h}{'status'} = 'failed'; -+ $state = 'result'; -+ failed("updating %s: Server said: '%s'", $h, $line); -+ } -+ } -+ -+ if ($state eq 'noresult') { -+ failed("updating %s: Server said: '%s'", $h, $line); - } -+ - } - } - - -From dbc40557d22b36a6847d0cd11e59185647516f7b Mon Sep 17 00:00:00 2001 -From: drinn <drinn@users.noreply.github.com> -Date: Sat, 28 Jan 2023 09:59:58 -0600 -Subject: [PATCH 2/2] removed empty space - ---- - ddclient.in | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/ddclient.in b/ddclient.in -index 8797d7d4..b818ea6e 100755 ---- a/ddclient.in -+++ b/ddclient.in -@@ -6580,7 +6580,6 @@ sub nic_duckdns_update { - if ($state eq 'noresult') { - failed("updating %s: Server said: '%s'", $h, $line); - } -- - } - } diff --git a/packages/ddclient/patches/z4_dyndns2-multiline-multihost-fix.patch b/packages/ddclient/patches/z4_dyndns2-multiline-multihost-fix.patch deleted file mode 100644 index 1c1a78ae..00000000 --- a/packages/ddclient/patches/z4_dyndns2-multiline-multihost-fix.patch +++ /dev/null @@ -1,111 +0,0 @@ -From 69347bd2a27cfb517d0749f1293ad5acdfcf34ad Mon Sep 17 00:00:00 2001 -From: Franco Fichtner <franco@opnsense.org> -Date: Thu, 1 Jun 2023 09:06:27 +0200 -Subject: [PATCH] dyndns2: fix multiline parsing and multiple host handling - -As seen in the wild with DynDNS.com -- status '14' is being stored -for the first host which is removed from @hosts ending up reading -empty host for next line causing 'nochg' to be misplaced in an empty -host. The same likely applies for multi-host handling so expand to -loop where writing to config and use $hosts when logging to catch all. - -RECEIVE: HTTP/1.1 200 OK -RECEIVE: Date: Thu, 01 Jun 2023 06:59:38 GMT -RECEIVE: Server: Apache/2.4.18 (Ubuntu) -RECEIVE: Strict-Transport-Security: max-age=31536000 -RECEIVE: X-UpdateCode: n -RECEIVE: Vary: Accept-Encoding -RECEIVE: Content-Type: text/plain -RECEIVE: Accept-Ranges: none -RECEIVE: X-User-Status: vip -RECEIVE: Connection: close -RECEIVE: Transfer-Encoding: chunked -RECEIVE: -RECEIVE: 14 -RECEIVE: nochg 192.168.178.20 -RECEIVE: 0 -RECEIVE: - -Ref: ddclient/ddclient#542 ---- - ddclient.in | 51 +++++++++++++++++++++++++++++++-------------------- - 1 file changed, 31 insertions(+), 20 deletions(-) - -diff --git a/ddclient.in b/ddclient.in -index a4464e2c..43eb3b15 100755 ---- a/ddclient.in -+++ b/ddclient.in -@@ -4194,30 +4194,38 @@ sub nic_dyndns2_update { - # bug #10: some dyndns providers does not return the IP so - # we can't use the returned IP - my ($status, $returnedips) = split / /, lc $line; -- my $h = shift @hosts; - -- $config{$h}{'status'} = $status; -- $config{$h}{'status-ipv4'} = $status if $ipv4; -- $config{$h}{'status-ipv6'} = $status if $ipv6; -+ foreach my $h (@hosts) { -+ $config{$h}{'status'} = $status; -+ $config{$h}{'status-ipv4'} = $status if $ipv4; -+ $config{$h}{'status-ipv6'} = $status if $ipv6; -+ } -+ - if ($status eq 'good') { -- $config{$h}{'ipv4'} = $ipv4 if $ipv4; -- $config{$h}{'ipv6'} = $ipv6 if $ipv6; -- $config{$h}{'mtime'} = $now; -- success("updating %s: %s: IPv4 address set to %s", $h, $status, $ipv4) if $ipv4; -- success("updating %s: %s: IPv6 address set to %s", $h, $status, $ipv6) if $ipv6; -+ foreach my $h (@hosts) { -+ $config{$h}{'ipv4'} = $ipv4 if $ipv4; -+ $config{$h}{'ipv6'} = $ipv6 if $ipv6; -+ $config{$h}{'mtime'} = $now; -+ } -+ -+ success("updating %s: %s: IPv4 address set to %s", $hosts, $status, $ipv4) if $ipv4; -+ success("updating %s: %s: IPv6 address set to %s", $hosts, $status, $ipv6) if $ipv6; - - } elsif (exists $errors{$status}) { - if ($status eq 'nochg') { -- warning("updating %s: %s: %s", $h, $status, $errors{$status}); -- $config{$h}{'ipv4'} = $ipv4 if $ipv4; -- $config{$h}{'ipv6'} = $ipv6 if $ipv6; -- $config{$h}{'mtime'} = $now; -- $config{$h}{'status'} = 'good'; -- $config{$h}{'status-ipv4'} = 'good' if $ipv4; -- $config{$h}{'status-ipv6'} = 'good' if $ipv6; -+ warning("updating %s: %s: %s", $hosts, $status, $errors{$status}); -+ -+ foreach my $h (@hosts) { -+ $config{$h}{'ipv4'} = $ipv4 if $ipv4; -+ $config{$h}{'ipv6'} = $ipv6 if $ipv6; -+ $config{$h}{'mtime'} = $now; -+ $config{$h}{'status'} = 'good'; -+ $config{$h}{'status-ipv4'} = 'good' if $ipv4; -+ $config{$h}{'status-ipv6'} = 'good' if $ipv6; -+ } - - } else { -- failed("updating %s: %s: %s", $h, $status, $errors{$status}); -+ failed("updating %s: %s: %s", $hosts, $status, $errors{$status}); - } - - } elsif ($status =~ /w(\d+)(.)/) { -@@ -4229,11 +4237,14 @@ sub nic_dyndns2_update { - ($scale, $units) = (60*60, 'hours') if $units eq 'h'; - - $sec = $wait * $scale; -- $config{$h}{'wtime'} = $now + $sec; -- warning("updating %s: %s: wait %s %s before further updates", $h, $status, $wait, $units); -+ foreach my $h (@hosts) { -+ $config{$h}{'wtime'} = $now + $sec; -+ } -+ -+ warning("updating %s: %s: wait %s %s before further updates", $hosts, $status, $wait, $units); - - } else { -- failed("updating %s: unexpected status (%s)", $h, $line); -+ failed("updating %s: unexpected status (%s)", $hosts, $line); - } - } - } diff --git a/packages/strongswan/Jenkinsfile b/packages/strongswan/Jenkinsfile index f246ad62..40ba3c00 100644 --- a/packages/strongswan/Jenkinsfile +++ b/packages/strongswan/Jenkinsfile @@ -21,9 +21,9 @@ def pkgList = [ ['name': 'strongswan', - 'scmCommit': 'debian/5.9.8-5', + 'scmCommit': 'debian/5.9.11-2', 'scmUrl': 'https://salsa.debian.org/debian/strongswan.git', - 'buildCmd': 'sudo mk-build-deps --install --tool "apt-get --yes --no-install-recommends"; cd ..; ./build.sh'], + 'buildCmd': 'cd ..; ./build.sh'], ] // Start package build using library function from https://github.com/vyos/vyos-build diff --git a/packages/strongswan/build.sh b/packages/strongswan/build.sh index e5ffbffa..c0dab4d5 100755 --- a/packages/strongswan/build.sh +++ b/packages/strongswan/build.sh @@ -2,6 +2,35 @@ CWD=$(pwd) set -e +# extracted build dependencies, as autogenerationg and installing them will fail :/ +sudo apt-get install -y bison \ + bzip2 \ + debhelper-compat \ + dh-apparmor \ + dpkg-dev \ + flex \ + gperf \ + libiptc-dev \ + libcap-dev \ + libcurl3-dev \ + libgcrypt20-dev \ + libgmp3-dev \ + libkrb5-dev \ + libldap2-dev \ + libnm-dev \ + libpam0g-dev \ + libsqlite3-dev \ + libssl-dev \ + libsystemd-dev \ + libtool \ + libtss2-dev \ + libxml2-dev \ + pkg-config \ + po-debconf \ + systemd \ + libsystemd-dev \ + tzdata + SRC=strongswan if [ ! -d ${SRC} ]; then echo "Source directory does not exists, please 'git clone'" @@ -21,7 +50,7 @@ fi cd ${SRC} echo "I: bump version" -dch -v "5.9.8-5+vyos0" "Patchset for DMVPN support" -b +dch -v "5.9.11-2+vyos0" "Patchset for DMVPN support" -b echo "I: Build Debian Package" -dpkg-buildpackage -uc -us -tc -b +dpkg-buildpackage -uc -us -tc -b -d diff --git a/packages/strongswan/patches/0001-charon-add-optional-source-and-remote-overrides-for-.patch b/packages/strongswan/patches/0001-charon-add-optional-source-and-remote-overrides-for-.patch index b791166a..ceb47350 100644 --- a/packages/strongswan/patches/0001-charon-add-optional-source-and-remote-overrides-for-.patch +++ b/packages/strongswan/patches/0001-charon-add-optional-source-and-remote-overrides-for-.patch @@ -30,20 +30,20 @@ Signed-off-by: Timo Teräs <timo.teras@iki.fi> 11 files changed, 215 insertions(+), 47 deletions(-) diff --git a/src/charon-cmd/cmd/cmd_connection.c b/src/charon-cmd/cmd/cmd_connection.c -index 8c09cac89..8582798d2 100644 +index 2e2cb3c..b9369a8 100644 --- a/src/charon-cmd/cmd/cmd_connection.c +++ b/src/charon-cmd/cmd/cmd_connection.c @@ -439,7 +439,7 @@ static job_requeue_t initiate(private_cmd_connection_t *this) child_cfg = create_child_cfg(this, peer_cfg); if (charon->controller->initiate(charon->controller, peer_cfg, child_cfg, -- controller_cb_empty, NULL, 0, FALSE) != SUCCESS) -+ NULL, NULL, controller_cb_empty, NULL, 0, FALSE) != SUCCESS) +- controller_cb_empty, NULL, LEVEL_SILENT, 0, FALSE) != SUCCESS) ++ NULL, NULL, controller_cb_empty, NULL, LEVEL_SILENT, 0, FALSE) != SUCCESS) { terminate(pid); } diff --git a/src/libcharon/control/controller.c b/src/libcharon/control/controller.c -index cff504966..9c5afe833 100644 +index 027f48e..4ce8616 100644 --- a/src/libcharon/control/controller.c +++ b/src/libcharon/control/controller.c @@ -15,6 +15,28 @@ @@ -75,7 +75,7 @@ index cff504966..9c5afe833 100644 #include "controller.h" #include <sys/types.h> -@@ -102,6 +124,16 @@ struct interface_listener_t { +@@ -107,6 +129,16 @@ struct interface_listener_t { */ ike_sa_t *ike_sa; @@ -92,7 +92,7 @@ index cff504966..9c5afe833 100644 /** * unique ID, used for various methods */ -@@ -414,10 +446,15 @@ METHOD(job_t, initiate_execute, job_requeue_t, +@@ -417,10 +449,15 @@ METHOD(job_t, initiate_execute, job_requeue_t, ike_sa_t *ike_sa; interface_listener_t *listener = &job->listener; peer_cfg_t *peer_cfg = listener->peer_cfg; @@ -109,15 +109,15 @@ index cff504966..9c5afe833 100644 if (!ike_sa) { DESTROY_IF(listener->child_cfg); -@@ -492,6 +529,7 @@ METHOD(job_t, initiate_execute, job_requeue_t, +@@ -499,6 +536,7 @@ METHOD(job_t, initiate_execute, job_requeue_t, METHOD(controller_t, initiate, status_t, private_controller_t *this, peer_cfg_t *peer_cfg, child_cfg_t *child_cfg, + host_t *my_host, host_t *other_host, - controller_cb_t callback, void *param, u_int timeout, bool limits) + controller_cb_t callback, void *param, level_t max_level, u_int timeout, + bool limits) { - interface_job_t *job; -@@ -514,6 +552,8 @@ METHOD(controller_t, initiate, status_t, +@@ -523,6 +561,8 @@ METHOD(controller_t, initiate, status_t, .status = FAILED, .child_cfg = child_cfg, .peer_cfg = peer_cfg, @@ -127,10 +127,10 @@ index cff504966..9c5afe833 100644 .options.limits = limits, }, diff --git a/src/libcharon/control/controller.h b/src/libcharon/control/controller.h -index cdd3a5d43..507c19fb3 100644 +index 36a1d46..a130fbb 100644 --- a/src/libcharon/control/controller.h +++ b/src/libcharon/control/controller.h -@@ -80,6 +80,8 @@ struct controller_t { +@@ -81,6 +81,8 @@ struct controller_t { * * @param peer_cfg peer_cfg to use for IKE_SA setup * @param child_cfg optional child_cfg to set up CHILD_SA from @@ -138,25 +138,25 @@ index cdd3a5d43..507c19fb3 100644 + * @param other_host optional address hint for destination * @param cb logging callback * @param param parameter to include in each call of cb - * @param timeout timeout in ms to wait for callbacks, 0 to disable -@@ -93,6 +95,7 @@ struct controller_t { + * @param max_level maximum log level for which cb is invoked +@@ -95,6 +97,7 @@ struct controller_t { */ status_t (*initiate)(controller_t *this, peer_cfg_t *peer_cfg, child_cfg_t *child_cfg, + host_t *my_host, host_t *other_host, - controller_cb_t callback, void *param, u_int timeout, - bool limits); + controller_cb_t callback, void *param, + level_t max_level, u_int timeout, bool limits); diff --git a/src/libcharon/plugins/stroke/stroke_control.c b/src/libcharon/plugins/stroke/stroke_control.c -index ba4e5bf9e..db2c6f00b 100644 +index 2824c93..21ff6b3 100644 --- a/src/libcharon/plugins/stroke/stroke_control.c +++ b/src/libcharon/plugins/stroke/stroke_control.c @@ -109,7 +109,7 @@ static void charon_initiate(private_stroke_control_t *this, peer_cfg_t *peer_cfg if (msg->output_verbosity < 0) { charon->controller->initiate(charon->controller, peer_cfg, child_cfg, -- NULL, NULL, 0, FALSE); -+ NULL, NULL, NULL, NULL, 0, FALSE); +- NULL, NULL, 0, 0, FALSE); ++ NULL, NULL, NULL, NULL, 0, 0, FALSE); } else { @@ -167,24 +167,24 @@ index ba4e5bf9e..db2c6f00b 100644 - peer_cfg, child_cfg, (controller_cb_t)stroke_log, + peer_cfg, child_cfg, NULL, NULL, + (controller_cb_t)stroke_log, - &info, this->timeout, FALSE); + &info, msg->output_verbosity, this->timeout, FALSE); switch (status) { diff --git a/src/libcharon/plugins/vici/vici_config.c b/src/libcharon/plugins/vici/vici_config.c -index 0c061d4b2..2da616700 100644 +index 5221225..b1486e3 100644 --- a/src/libcharon/plugins/vici/vici_config.c +++ b/src/libcharon/plugins/vici/vici_config.c -@@ -2215,7 +2215,7 @@ static void run_start_action(private_vici_config_t *this, peer_cfg_t *peer_cfg, +@@ -2252,7 +2252,7 @@ static void run_start_action(private_vici_config_t *this, peer_cfg_t *peer_cfg, DBG1(DBG_CFG, "initiating '%s'", child_cfg->get_name(child_cfg)); charon->controller->initiate(charon->controller, peer_cfg->get_ref(peer_cfg), child_cfg->get_ref(child_cfg), -- NULL, NULL, 0, FALSE); -+ NULL, NULL, NULL, NULL, 0, FALSE); +- NULL, NULL, 0, 0, FALSE); ++ NULL, NULL, NULL, NULL, 0, 0, FALSE); } } diff --git a/src/libcharon/plugins/vici/vici_control.c b/src/libcharon/plugins/vici/vici_control.c -index 7b8ff1215..8d996c044 100644 +index 1c236d2..811d8db 100644 --- a/src/libcharon/plugins/vici/vici_control.c +++ b/src/libcharon/plugins/vici/vici_control.c @@ -15,6 +15,28 @@ @@ -238,7 +238,7 @@ index 7b8ff1215..8d996c044 100644 if (!child && !ike) { -@@ -199,31 +225,51 @@ CALLBACK(initiate, vici_message_t*, +@@ -199,31 +225,52 @@ CALLBACK(initiate, vici_message_t*, log_cb = (controller_cb_t)log_vici; } @@ -265,11 +265,12 @@ index 7b8ff1215..8d996c044 100644 + msg = send_reply(this, "%s config '%s' not found", type, sa); + goto ret; } -- switch (charon->controller->initiate(charon->controller, peer_cfg, -- child_cfg, log_cb, &log, timeout, limits)) +- switch (charon->controller->initiate(charon->controller, peer_cfg, child_cfg, +- log_cb, &log, log.level, timeout, limits)) + switch (charon->controller->initiate(charon->controller, -+ peer_cfg, child_cfg, my_host, other_host, -+ log_cb, &log, timeout, limits)) ++ peer_cfg, child_cfg, ++ my_host, other_host, ++ log_cb, &log, log.level, timeout, limits)) { case SUCCESS: - return send_reply(this, NULL); @@ -297,22 +298,22 @@ index 7b8ff1215..8d996c044 100644 + return msg; } - CALLBACK(terminate, vici_message_t*, + /** diff --git a/src/libcharon/processing/jobs/start_action_job.c b/src/libcharon/processing/jobs/start_action_job.c -index b966cd132..23ed1e01f 100644 +index 122e5ce..dec458c 100644 --- a/src/libcharon/processing/jobs/start_action_job.c +++ b/src/libcharon/processing/jobs/start_action_job.c @@ -84,7 +84,7 @@ METHOD(job_t, execute, job_requeue_t, charon->controller->initiate(charon->controller, peer_cfg->get_ref(peer_cfg), child_cfg->get_ref(child_cfg), -- NULL, NULL, 0, FALSE); -+ NULL, NULL, NULL, NULL, 0, FALSE); +- NULL, NULL, 0, 0, FALSE); ++ NULL, NULL, NULL, NULL, 0, 0, FALSE); } } children->destroy(children); diff --git a/src/libcharon/sa/ike_sa_manager.c b/src/libcharon/sa/ike_sa_manager.c -index c8d439630..d9c32d8cc 100644 +index fc31c2a..51e28bc 100644 --- a/src/libcharon/sa/ike_sa_manager.c +++ b/src/libcharon/sa/ike_sa_manager.c @@ -16,6 +16,28 @@ @@ -401,7 +402,7 @@ index c8d439630..d9c32d8cc 100644 } charon->bus->set_sa(charon->bus, ike_sa); diff --git a/src/libcharon/sa/ike_sa_manager.h b/src/libcharon/sa/ike_sa_manager.h -index 004cc2216..50f8246f8 100644 +index 004cc22..50f8246 100644 --- a/src/libcharon/sa/ike_sa_manager.h +++ b/src/libcharon/sa/ike_sa_manager.h @@ -123,7 +123,8 @@ struct ike_sa_manager_t { @@ -429,7 +430,7 @@ index 004cc2216..50f8246f8 100644 /** * Reset initiator SPI. diff --git a/src/libcharon/sa/trap_manager.c b/src/libcharon/sa/trap_manager.c -index d8d8a421a..e7c906eb7 100644 +index d8d8a42..e7c906e 100644 --- a/src/libcharon/sa/trap_manager.c +++ b/src/libcharon/sa/trap_manager.c @@ -523,7 +523,7 @@ METHOD(trap_manager_t, acquire, void, @@ -456,32 +457,34 @@ index d8d8a421a..e7c906eb7 100644 - - ike_sa->set_peer_cfg(ike_sa, peer); - ike_cfg = ike_sa->get_ike_cfg(ike_sa); -+ { -+ ike_cfg_t *ike_cfg; -+ uint16_t port; -+ uint8_t mask; - +- - port = ike_cfg->get_other_port(ike_cfg); - data->dst->to_subnet(data->dst, &host, &mask); - host->set_port(host, port); - ike_sa->set_other_host(ike_sa, host); -+ ike_cfg = peer->get_ike_cfg(peer); - +- - port = ike_cfg->get_my_port(ike_cfg); - data->src->to_subnet(data->src, &host, &mask); - host->set_port(host, port); - ike_sa->set_my_host(ike_sa, host); -+ port = ike_cfg->get_other_port(ike_cfg); -+ data->dst->to_subnet(data->dst, &other_host, &mask); -+ other_host->set_port(other_host, port); - +- - charon->bus->set_sa(charon->bus, ike_sa); - } - } - else -- { + { - ike_sa = charon->ike_sa_manager->checkout_by_config( - charon->ike_sa_manager, peer); ++ ike_cfg_t *ike_cfg; ++ uint16_t port; ++ uint8_t mask; ++ ++ ike_cfg = peer->get_ike_cfg(peer); ++ ++ port = ike_cfg->get_other_port(ike_cfg); ++ data->dst->to_subnet(data->dst, &other_host, &mask); ++ other_host->set_port(other_host, port); ++ + port = ike_cfg->get_my_port(ike_cfg); + data->src->to_subnet(data->src, &my_host, &mask); + my_host->set_port(my_host, port); @@ -496,7 +499,7 @@ index d8d8a421a..e7c906eb7 100644 if (ike_sa) { diff --git a/src/swanctl/commands/initiate.c b/src/swanctl/commands/initiate.c -index e0fffb907..dcaded59d 100644 +index e0fffb9..dcaded5 100644 --- a/src/swanctl/commands/initiate.c +++ b/src/swanctl/commands/initiate.c @@ -14,6 +14,28 @@ @@ -574,6 +577,3 @@ index e0fffb907..dcaded59d 100644 {"timeout", 't', 1, "timeout in seconds before detaching"}, {"raw", 'r', 0, "dump raw response message"}, {"pretty", 'P', 0, "dump raw response message in pretty print"}, --- -2.38.1 - diff --git a/packages/strongswan/patches/0004-VyOS-disable-options-enabled-by-Debian-that-are-unus.patch b/packages/strongswan/patches/0004-VyOS-disable-options-enabled-by-Debian-that-are-unus.patch index 085d1303..57a622e8 100644 --- a/packages/strongswan/patches/0004-VyOS-disable-options-enabled-by-Debian-that-are-unus.patch +++ b/packages/strongswan/patches/0004-VyOS-disable-options-enabled-by-Debian-that-are-unus.patch @@ -95,7 +95,7 @@ index 2fed1f10f..fa0d21a0c 100755 --enable-addrblock \ --enable-agent \ @@ -88,7 +97,7 @@ ifeq ($(DEB_HOST_ARCH_OS),kfreebsd) - endif + deb_systemdsystemunitdir = $(shell pkg-config --variable=systemdsystemunitdir systemd | sed s,^/,,) override_dh_auto_configure: - dh_auto_configure -- $(CONFIGUREARGS) diff --git a/packages/strongswan/patches/0005-vici-add-soft-lifetime-calculation-if-hard-lifetime-configured.patch b/packages/strongswan/patches/0005-vici-add-soft-lifetime-calculation-if-hard-lifetime-configured.patch deleted file mode 100644 index dc21a96d..00000000 --- a/packages/strongswan/patches/0005-vici-add-soft-lifetime-calculation-if-hard-lifetime-configured.patch +++ /dev/null @@ -1,97 +0,0 @@ -From a2b1e06f07569e8d3f08a37b68a206164b67fbe3 Mon Sep 17 00:00:00 2001 -From: Tobias Brunner <tobias@strongswan.org> -Date: Tue, 6 Dec 2022 17:33:20 +0100 -Subject: [PATCH] vici: Base default soft lifetime on hard lifetime if - configured - -Depending on the configured hard lifetime the default soft lifetime -might not make sense and could even cause rekeying to get disabled. -To avoid that, derive the soft lifetime from the hard lifetime so it's -10% higher than the soft lifetime. - -References strongswan/strongswan#1414 ---- - src/libcharon/plugins/vici/vici_config.c | 46 ++++++++++++++++++++---- - 1 file changed, 40 insertions(+), 6 deletions(-) - -diff --git a/src/libcharon/plugins/vici/vici_config.c b/src/libcharon/plugins/vici/vici_config.c -index 0c061d4b2d7..a59d799caf6 100644 ---- a/src/libcharon/plugins/vici/vici_config.c -+++ b/src/libcharon/plugins/vici/vici_config.c -@@ -1981,18 +1981,52 @@ CALLBACK(auth_sn, bool, - */ - static void check_lifetimes(lifetime_cfg_t *lft) - { -+ /* if no soft lifetime specified, set a default or base it on the hard lifetime */ -+ if (lft->time.rekey == LFT_UNDEFINED) -+ { -+ if (lft->time.life != LFT_UNDEFINED) -+ { -+ lft->time.rekey = lft->time.life / 1.1; -+ } -+ else -+ { -+ lft->time.rekey = LFT_DEFAULT_CHILD_REKEY_TIME; -+ } -+ } -+ if (lft->bytes.rekey == LFT_UNDEFINED) -+ { -+ if (lft->bytes.life != LFT_UNDEFINED) -+ { -+ lft->bytes.rekey = lft->bytes.life / 1.1; -+ } -+ else -+ { -+ lft->bytes.rekey = LFT_DEFAULT_CHILD_REKEY_BYTES; -+ } -+ } -+ if (lft->packets.rekey == LFT_UNDEFINED) -+ { -+ if (lft->packets.life != LFT_UNDEFINED) -+ { -+ lft->packets.rekey = lft->packets.life / 1.1; -+ } -+ else -+ { -+ lft->packets.rekey = LFT_DEFAULT_CHILD_REKEY_PACKETS; -+ } -+ } - /* if no hard lifetime specified, add one at soft lifetime + 10% */ - if (lft->time.life == LFT_UNDEFINED) - { -- lft->time.life = lft->time.rekey * 110 / 100; -+ lft->time.life = lft->time.rekey * 1.1; - } - if (lft->bytes.life == LFT_UNDEFINED) - { -- lft->bytes.life = lft->bytes.rekey * 110 / 100; -+ lft->bytes.life = lft->bytes.rekey * 1.1; - } - if (lft->packets.life == LFT_UNDEFINED) - { -- lft->packets.life = lft->packets.rekey * 110 / 100; -+ lft->packets.life = lft->packets.rekey * 1.1; - } - /* if no rand time defined, use difference of hard and soft */ - if (lft->time.jitter == LFT_UNDEFINED) -@@ -2026,17 +2060,17 @@ CALLBACK(children_sn, bool, - .mode = MODE_TUNNEL, - .lifetime = { - .time = { -- .rekey = LFT_DEFAULT_CHILD_REKEY_TIME, -+ .rekey = LFT_UNDEFINED, - .life = LFT_UNDEFINED, - .jitter = LFT_UNDEFINED, - }, - .bytes = { -- .rekey = LFT_DEFAULT_CHILD_REKEY_BYTES, -+ .rekey = LFT_UNDEFINED, - .life = LFT_UNDEFINED, - .jitter = LFT_UNDEFINED, - }, - .packets = { -- .rekey = LFT_DEFAULT_CHILD_REKEY_PACKETS, -+ .rekey = LFT_UNDEFINED, - .life = LFT_UNDEFINED, - .jitter = LFT_UNDEFINED, - }, diff --git a/scripts/check-qemu-install b/scripts/check-qemu-install index 7c89327d..aa729c6d 100755 --- a/scripts/check-qemu-install +++ b/scripts/check-qemu-install @@ -305,42 +305,29 @@ try: ################################################# log.info('Starting installer') c.sendline('install image') - c.expect('\nWould you like to continue?.*:') - c.sendline('yes') - - if args.raid: - c.expect('\nWould you like to configure RAID-1 mirroring on them?.*:') - c.sendline('yes') - # Erase all data on disks - c.expect('\nAre you sure you want to do this?.*:') - c.sendline('yes') - else: - log.info('Partitioning disk') - c.expect('\nPartition.*:') - c.sendline('') - c.expect('\nInstall the image on.*:') - c.sendline('') - c.expect(r'\nContinue\?.*:') - c.sendline('Yes') - c.expect('\nHow big of a root partition should I create?.*:') - c.sendline('') - - log.info('Disk(s) partitioned, installing...') - c.expect('\nWhat would you like to name this image?.*:', timeout=600) + c.expect('\nWould you like to continue?.*') + c.sendline('y') + c.expect('\nWhat would you like to name this image?.*') c.sendline('') - log.info('Copying files') - c.expect('\nWhich one should I copy to.*:', timeout=600) + c.expect(f'\nPlease enter a password for the "{default_user}" user.*') c.sendline('') - log.info('Files Copied!') - c.expect('\nEnter password for user.*:') - c.sendline(default_user) - c.expect('\nRetype password for user.*:') - c.sendline(default_password) + c.expect('\nWhat console should be used by default?.*') + c.sendline('S') - if not args.raid: - c.expect('\nWhich drive should GRUB modify the boot partition on.*:') + if args.raid: + c.expect('\nWould you like to configure RAID-1 mirroring??.*') + c.sendline('y') + c.expect('\nWould you like to configure RAID-1 mirroring on them?.*') + c.sendline('y') + c.expect('\nInstallation will delete all data on both drives. Continue?.*') + c.sendline('y') + else: + c.expect('\nWhich one should be used for installation?.*') c.sendline('') - c.expect(op_mode_prompt) + c.expect('\nInstallation will delete all data on the drive. Continue?.*') + c.sendline('y') + c.expect('\nWould you like to use all the free space on the drive?.*') + c.sendline('y') log.info('system installed, shutting down') @@ -457,7 +444,7 @@ try: c.expect(op_mode_prompt) log.info('Add member to RAID1 (md0)') - c.sendline('add raid md0 by-id member drive-hd1-part1') + c.sendline('add raid md0 by-id member drive-hd1-part3') c.expect(op_mode_prompt) log.info('Now we need to wait for re-sync to complete') |