summaryrefslogtreecommitdiff
path: root/debian/rules
blob: 3edd624496589bf7ab8be6fc770558881861f799 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
#!/usr/bin/make -f
export DEB_LDFLAGS_MAINT_APPEND=-Wl,--as-needed -Wl,-O1
#export DEB_LDFLAGS_MAINT_APPEND=-Wl,--as-needed -Wl,-O1 -Wl,-z,defs
export DEB_BUILD_MAINT_OPTIONS=hardening=+all

CONFIGUREARGS := --libdir=/usr/lib --libexecdir=/usr/lib \
		--enable-ldap --enable-curl \
		--enable-pkcs11 \
		--enable-mediation --enable-medsrv --enable-medcli \
		--enable-openssl --enable-agent \
		--enable-ctr --enable-ccm --enable-gcm --enable-addrblock \
		--enable-eap-radius --enable-eap-identity --enable-eap-md5 \
		--enable-eap-gtc --enable-eap-aka --enable-eap-mschapv2 \
		--enable-eap-tls --enable-eap-ttls --enable-eap-tnc \
		--enable-ha \
		--enable-led --enable-gcrypt \
		--enable-test-vectors \
		--enable-xauth-eap --enable-xauth-pam \
		--enable-cmd \
		--enable-certexpire \
		--enable-lookip \
		--enable-error-notify \
		--enable-unity \
		--enable-connmark \
		--disable-blowfish --disable-des # BSD-Young license
	#--with-user=strongswan --with-group=nogroup
	#	--enable-kernel-pfkey --enable-kernel-klips \
	# And for --enable-eap-sim we would need the library, which we don't
	# have right now.
	# Don't --enable-cisco-quirks, because some other IPsec implementations
	# (most notably the Phion one) have problems connecting when pluto 
	# sends these Cisco options.

# get the various DEB_BUILD/DEB_HOST variables
include /usr/share/dpkg/architecture.mk

# the padlock plugin only makes sense on i386
# RdRand only makes sense on i386 and amd64
ifeq ($(DEB_BUILD_ARCH_CPU),i386)
  CONFIGUREARGS += --enable-padlock --enable-rdrand
endif

ifeq ($(DEB_BUILD_ARCH_CPU),amd64)
  CONFIGUREARGS += --enable-rdrand
endif

ifeq ($(DEB_BUILD_ARCH_OS),linux)
	# only enable network-manager and capabilities dropping on linux hosts
	# some plugins are linux-only too
	CONFIGUREARGS += --enable-nm \
		--with-capabilities=libcap \
		--enable-farp \
		--enable-dhcp \
		--enable-af-alg
endif

ifeq ($(DEB_BUILD_ARCH_OS),kfreebsd)
	# recommended configure line for FreeBSD
	# http://wiki.strongswan.org/projects/strongswan/wiki/FreeBSD
	CONFIGUREARGS += --disable-kernel-netlink \
		--enable-kernel-pfkey --enable-kernel-pfroute \
		--with-group=wheel
endif

override_dh_auto_configure:
	dh_auto_configure -- $(CONFIGUREARGS)

override_dh_auto_clean:
	dh_auto_clean
	# after a make clean, no binaries _should_ be left, but ....
	-find $(CURDIR) -name "*.o" | xargs --no-run-if-empty rm

	# Really clean (#356716)
	# This is a hack: should be better implemented
	rm -f lib/libstrongswan/libstrongswan.a || true
	rm -f lib/libstrongswan/liboswlog.a || true

	# just in case something went wrong
	rm -f $(CURDIR)/debian/ipsec.secrets

	# and make sure that template are up-to-date
	debconf-updatepo


override_dh_install:

	# first special cases
ifeq ($(DEB_BUILD_ARCH_OS),linux)
	# handle Linux-only plugins
	dh_install -p libcharon-extra-plugins usr/lib/ipsec/plugins/libstrongswan-dhcp.so
	dh_install -p libcharon-extra-plugins usr/share/strongswan/templates/config/plugins/dhcp.conf
	dh_install -p libcharon-extra-plugins etc/strongswan.d/charon/dhcp.conf

	dh_install -p libcharon-extra-plugins usr/lib/ipsec/plugins/libstrongswan-farp.so
	dh_install -p libcharon-extra-plugins usr/share/strongswan/templates/config/plugins/farp.conf
	dh_install -p libcharon-extra-plugins etc/strongswan.d/charon/farp.conf

	dh_install -p libstrongswan usr/lib/ipsec/plugins/libstrongswan-kernel-netlink.so
	dh_install -p libstrongswan usr/share/strongswan/templates/config/plugins/kernel-netlink.conf
	dh_install -p libstrongswan etc/strongswan.d/charon/kernel-netlink.conf

	dh_install -p libstrongswan-extra-plugins usr/lib/ipsec/plugins/libstrongswan-af-alg.so
	dh_install -p libstrongswan-extra-plugins usr/share/strongswan/templates/config/plugins/af-alg.conf
	dh_install -p libstrongswan-extra-plugins etc/strongswan.d/charon/af-alg.conf
	# the systemd service file only gets generated on Linux
	dh_install -p strongswan-starter lib/systemd/system/strongswan.service
endif

ifeq ($(DEB_BUILD_ARCH_OS),kfreebsd)
	# handle FreeBSD-only plugins
	dh_install -p libstrongswan usr/lib/ipsec/plugins/libstrongswan-kernel-pfkey.so
	dh_install -p libstrongswan usr/share/strongswan/templates/config/plugins/kernel-pfkey.conf
	dh_install -p libstrongswan etc/strongswan.d/charon/kernel-pfkey.conf

	dh_install -p libstrongswan usr/lib/ipsec/plugins/libstrongswan-kernel-pfroute.so
	dh_install -p libstrongswan usr/share/strongswan/templates/config/plugins/kernel-pfroute.conf
	dh_install -p libstrongswan etc/strongswan.d/charon/kernel-pfroute.conf
endif

ifeq ($(DEB_BUILD_ARCH_CPU),i386)
	# special handling for padlock, as it is only built on i386
	dh_install -p libstrongswan-extra-plugins usr/lib/ipsec/plugins/libstrongswan-padlock.so
	dh_install -p libstrongswan-extra-plugins usr/share/strongswan/templates/config/plugins/padlock.conf
	dh_install -p libstrongswan-extra-plugins etc/strongswan.d/charon/padlock.conf

	dh_install -p libstrongswan-extra-plugins usr/lib/ipsec/plugins/libstrongswan-rdrand.so
	dh_install -p libstrongswan-extra-plugins usr/share/strongswan/templates/config/plugins/rdrand.conf
	dh_install -p libstrongswan-extra-plugins etc/strongswan.d/charon/rdrand.conf
endif

ifeq ($(DEB_BUILD_ARCH_CPU), amd64)
	dh_install -p libstrongswan-extra-plugins usr/lib/ipsec/plugins/libstrongswan-rdrand.so
	dh_install -p libstrongswan-extra-plugins usr/share/strongswan/templates/config/plugins/rdrand.conf
	dh_install -p libstrongswan-extra-plugins etc/strongswan.d/charon/rdrand.conf
endif

	# then install the rest, ignoring the above
	dh_install --fail-missing \
		-X\.la -X\.a \
		-Xmedsrv -Xman3 \
		-Xlibstrongswan-kernel- -X kernel- \
		-Xlibstrongswan-dhcp.so -X dhcp.conf \
		-Xlibstrongswan-farp.so -X farp.conf \
		-Xlibstrongswan-padlock.so -X padlock.conf \
		-Xlibstrongswan-rdrand.so -X rdrand.conf \
		-Xlibstrongswan-af-alg.so -X af-alg.conf \
		-Xstrongswan.service

	# add additional files not covered by upstream makefile...
	install --mode=0600 $(CURDIR)/debian/ipsec.secrets.proto $(CURDIR)/debian/strongswan-starter/etc/ipsec.secrets
	# also "patch" ipsec.conf to include the debconf-managed file
	echo >> $(CURDIR)/debian/strongswan-starter/etc/ipsec.conf
	echo "include /var/lib/strongswan/ipsec.conf.inc" >> $(CURDIR)/debian/strongswan-starter/etc/ipsec.conf
	# and to enable both IKEv1 and IKEv2 by default
	sed -r 's/^[ \t]+# *charonstart=(yes|no) */\tcharonstart=yes/' < $(CURDIR)/debian/strongswan-starter/etc/ipsec.conf > $(CURDIR)/debian/strongswan-starter/etc/ipsec.conf.tmp
	mv $(CURDIR)/debian/strongswan-starter/etc/ipsec.conf.tmp $(CURDIR)/debian/strongswan-starter/etc/ipsec.conf

	# set permissions on ipsec.secrets
	chmod 600 $(CURDIR)/debian/strongswan-starter/etc/ipsec.secrets
	chmod 700 -R $(CURDIR)/debian/strongswan-starter/etc/ipsec.d/private/
	chmod 700 -R $(CURDIR)/debian/strongswan-starter/var/lib/strongswan/

	# this is handled by update-rc.d
	rm -rf $(CURDIR)/debian/strongswan-starter/etc/rc?.d

	# delete var/lock/subsys and var/run to satisfy lintian
	rm -rf $(CURDIR)/debian/openswan/var/lock
	rm -rf $(CURDIR)/debian/openswan/var/run

	# more lintian cleanups
	find $(CURDIR)/debian/*strongswan*/ -name ".cvsignore" | xargs --no-run-if-empty rm -f
	find $(CURDIR)/debian/*strongswan*/ -name "/.svn/" | xargs --no-run-if-empty rm -rf

override_dh_installinit:
	dh_installinit -n --name=ipsec

override_dh_installchangelogs:
	dh_installchangelogs NEWS

override_dh_strip:
	dh_strip --dbg-package=strongswan-dbg

override_dh_fixperms:
	dh_fixperms -X etc/ipsec.secrets -X etc/ipsec.d -X var/lib/strongswan

override_dh_makeshlibs:
	dh_makeshlibs -n -X usr/lib/ipsec/plugins

override_dh_installlogcheck:
	dh_installlogcheck --name strongswan

override_dh_auto_test:
ifeq ($(DEB_BUILD_ARCH),amd64)
	dh_auto_test
endif

%:
	dh $@ --parallel --with autoreconf,systemd