1DESCRIPTION = "strongSwan is an OpenSource IPsec implementation for the \
2Linux operating system."
3SUMMARY = "strongSwan is an OpenSource IPsec implementation"
4HOMEPAGE = "http://www.strongswan.org"
5SECTION = "net"
6LICENSE = "GPL-2.0-only"
7LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263"
8DEPENDS = "flex-native flex bison-native"
9DEPENDS:append = "${@bb.utils.contains('DISTRO_FEATURES', 'tpm2', '  tpm2-tss', '', d)}"
10
11SRC_URI = "http://download.strongswan.org/strongswan-${PV}.tar.bz2 \
12           file://0001-enum-Fix-compiler-warning.patch \
13           file://CVE-2022-40617.patch \
14           "
15
16SRC_URI[sha256sum] = "91d0978ac448912759b85452d8ff0d578aafd4507aaf4f1c1719f9d0c7318ab7"
17
18UPSTREAM_CHECK_REGEX = "strongswan-(?P<pver>\d+(\.\d+)+)\.tar"
19
20EXTRA_OECONF = " \
21        --without-lib-prefix \
22        --with-dev-headers=${includedir}/strongswan \
23"
24
25EXTRA_OECONF += "${@bb.utils.contains('DISTRO_FEATURES', 'systemd', '--with-systemdsystemunitdir=${systemd_unitdir}/system/', '--without-systemdsystemunitdir', d)}"
26
27PACKAGECONFIG ?= "curl gmp openssl sqlite3 swanctl curve25519\
28        ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'systemd-charon', 'charon', d)} \
29        ${@bb.utils.contains('DISTRO_FEATURES', 'tpm2', 'tpm2', '', d)} \
30        ${@bb.utils.contains('DISTRO_FEATURES', 'ima', 'tnc-imc imc-hcd imc-os imc-scanner imc-attestation', '', d)} \
31        ${@bb.utils.contains('DISTRO_FEATURES', 'ima', 'tnc-imv imv-hcd imv-os imv-scanner imv-attestation', '', d)} \
32"
33
34PACKAGECONFIG[aesni] = "--enable-aesni,--disable-aesni,,${PN}-plugin-aesni"
35PACKAGECONFIG[bfd] = "--enable-bfd-backtraces,--disable-bfd-backtraces,binutils"
36PACKAGECONFIG[charon] = "--enable-charon,--disable-charon,"
37PACKAGECONFIG[curl] = "--enable-curl,--disable-curl,curl,${PN}-plugin-curl"
38PACKAGECONFIG[eap-identity] = "--enable-eap-identity,--disable-eap-identity,,${PN}-plugin-eap-identity"
39PACKAGECONFIG[eap-mschapv2] = "--enable-eap-mschapv2,--disable-eap-mschapv2,,${PN}-plugin-eap-mschapv2"
40PACKAGECONFIG[gmp] = "--enable-gmp,--disable-gmp,gmp,${PN}-plugin-gmp"
41PACKAGECONFIG[ldap] = "--enable-ldap,--disable-ldap,openldap,${PN}-plugin-ldap"
42PACKAGECONFIG[mysql] = "--enable-mysql,--disable-mysql,mysql5,${PN}-plugin-mysql"
43PACKAGECONFIG[openssl] = "--enable-openssl,--disable-openssl,openssl,${PN}-plugin-openssl"
44PACKAGECONFIG[scep] = "--enable-scepclient,--disable-scepclient,"
45PACKAGECONFIG[soup] = "--enable-soup,--disable-soup,libsoup-2.4,${PN}-plugin-soup"
46PACKAGECONFIG[sqlite3] = "--enable-sqlite,--disable-sqlite,sqlite3,${PN}-plugin-sqlite"
47PACKAGECONFIG[stroke] = "--enable-stroke,--disable-stroke,,${PN}-plugin-stroke"
48PACKAGECONFIG[swanctl] = "--enable-swanctl,--disable-swanctl,,libgcc"
49PACKAGECONFIG[curve25519] = "--enable-curve25519,--disable-curve25519,, ${PN}-plugin-curve25519"
50
51# requires swanctl
52PACKAGECONFIG[systemd-charon] = "--enable-systemd,--disable-systemd,systemd,"
53
54# tpm needs meta-tpm layer
55PACKAGECONFIG[tpm2] = "--enable-tpm,--disable-tpm,,${PN}-plugin-tpm"
56
57
58# integraty configuration needs meta-integraty
59#imc
60PACKAGECONFIG[tnc-imc] = "--enable-tnc-imc,--disable-tnc-imc,,  ${PN}-plugin-tnc-imc ${PN}-plugin-tnc-tnccs"
61PACKAGECONFIG[imc-test] = "--enable-imc-test,--disable-imc-test,,"
62PACKAGECONFIG[imc-scanner] = "--enable-imc-scanner,--disable-imc-scanner,,"
63PACKAGECONFIG[imc-os] = "--enable-imc-os,--disable-imc-os,,"
64PACKAGECONFIG[imc-attestation] = "--enable-imc-attestation,--disable-imc-attestation,,"
65PACKAGECONFIG[imc-swima] = "--enable-imc-swima, --disable-imc-swima, json-c,"
66PACKAGECONFIG[imc-hcd] = "--enable-imc-hcd, --disable-imc-hcd,,"
67
68#imv set
69PACKAGECONFIG[tnc-imv] = "--enable-tnc-imv,--disable-tnc-imv,, ${PN}-plugin-tnc-imv ${PN}-plugin-tnc-tnccs"
70PACKAGECONFIG[imv-test] = "--enable-imv-test,--disable-imv-test,,"
71PACKAGECONFIG[imv-scanner] = "--enable-imv-scanner,--disable-imv-scanner,,"
72PACKAGECONFIG[imv-os] = "--enable-imv-os,--disable-imv-os,,"
73PACKAGECONFIG[imv-attestation] = "--enable-imv-attestation,--disable-imv-attestation,,"
74PACKAGECONFIG[imv-swima] = "--enable-imv-swima, --disable-imv-swima, json-c,"
75PACKAGECONFIG[imv-hcd] = "--enable-imv-hcd, --disable-imv-hcd,,"
76
77PACKAGECONFIG[tnc-ifmap] = "--enable-tnc-ifmap,--disable-tnc-ifmap, libxml2, ${PN}-plugin-tnc-ifmap"
78PACKAGECONFIG[tnc-pdp] = "--enable-tnc-pdp,--disable-tnc-pdp,, ${PN}-plugin-tnc-pdp"
79
80PACKAGECONFIG[tnccs-11] = "--enable-tnccs-11,--disable-tnccs-11,libxml2, ${PN}-plugin-tnccs-11"
81PACKAGECONFIG[tnccs-20] = "--enable-tnccs-20,--disable-tnccs-20,, ${PN}-plugin-tnccs-20"
82PACKAGECONFIG[tnccs-dynamic] = "--enable-tnccs-dynamic,--disable-tnccs-dynamic,,${PN}-plugin-tnccs-dynamic"
83
84inherit autotools systemd pkgconfig
85
86RRECOMMENDS:${PN} = "kernel-module-ah4 \
87                     kernel-module-esp4 \
88                     kernel-module-xfrm-user \
89                    "
90
91FILES:${PN} += "${libdir}/ipsec/lib*${SOLIBS}"
92FILES:${PN}-dbg += "${bindir}/.debug ${sbindir}/.debug ${libdir}/ipsec/.debug ${libexecdir}/ipsec/.debug"
93FILES:${PN}-dev += "${libdir}/ipsec/lib*${SOLIBSDEV} ${libdir}/ipsec/*.la ${libdir}/ipsec/include/config.h"
94FILES:${PN}-staticdev += "${libdir}/ipsec/*.a"
95
96CONFFILES:${PN} = "${sysconfdir}/*.conf ${sysconfdir}/ipsec.d/*.conf ${sysconfdir}/strongswan.d/*.conf"
97
98PACKAGES += "${PN}-plugins"
99ALLOW_EMPTY:${PN}-plugins = "1"
100
101PACKAGE_BEFORE_PN = "${PN}-imcvs ${PN}-imcvs-dbg"
102ALLOW_EMPTY:${PN}-imcvs = "1"
103
104FILES:${PN}-imcvs = "${libdir}/ipsec/imcvs/*.so"
105FILES:${PN}-imcvs-dbg += "${libdir}/ipsec/imcvs/.debug"
106
107PACKAGES_DYNAMIC += "^${PN}-plugin-.*$"
108NOAUTOPACKAGEDEBUG = "1"
109
110python split_strongswan_plugins () {
111    sysconfdir = d.expand('${sysconfdir}/strongswan.d/charon')
112    libdir = d.expand('${libdir}/ipsec/plugins')
113    dbglibdir = os.path.join(libdir, '.debug')
114
115    def add_plugin_conf(f, pkg, file_regex, output_pattern, modulename):
116        dvar = d.getVar('PKGD')
117        oldfiles = d.getVar('CONFFILES:' + pkg)
118        newfile = '/' + os.path.relpath(f, dvar)
119
120        if not oldfiles:
121            d.setVar('CONFFILES:' + pkg, newfile)
122        else:
123            d.setVar('CONFFILES:' + pkg, oldfiles + " " + newfile)
124
125    split_packages = do_split_packages(d, libdir, r'libstrongswan-(.*)\.so', '${PN}-plugin-%s', 'strongSwan %s plugin', prepend=True)
126    do_split_packages(d, sysconfdir, r'(.*)\.conf', '${PN}-plugin-%s', 'strongSwan %s plugin', prepend=True, hook=add_plugin_conf)
127
128    split_dbg_packages = do_split_packages(d, dbglibdir, r'libstrongswan-(.*)\.so', '${PN}-plugin-%s-dbg', 'strongSwan %s plugin - Debugging files', prepend=True, extra_depends='${PN}-dbg')
129    split_dev_packages = do_split_packages(d, libdir, r'libstrongswan-(.*)\.la', '${PN}-plugin-%s-dev', 'strongSwan %s plugin - Development files', prepend=True, extra_depends='${PN}-dev')
130    split_staticdev_packages = do_split_packages(d, libdir, r'libstrongswan-(.*)\.a', '${PN}-plugin-%s-staticdev', 'strongSwan %s plugin - Development files (Static Libraries)', prepend=True, extra_depends='${PN}-staticdev')
131
132    if split_packages:
133        pn = d.getVar('PN')
134        d.setVar('RRECOMMENDS:' + pn + '-plugins', ' '.join(split_packages))
135        d.appendVar('RRECOMMENDS:' + pn + '-dbg', ' ' + ' '.join(split_dbg_packages))
136        d.appendVar('RRECOMMENDS:' + pn + '-dev', ' ' + ' '.join(split_dev_packages))
137        d.appendVar('RRECOMMENDS:' + pn + '-staticdev', ' ' + ' '.join(split_staticdev_packages))
138}
139
140PACKAGESPLITFUNCS:prepend = "split_strongswan_plugins "
141
142# Install some default plugins based on default strongSwan ./configure options
143# See https://wiki.strongswan.org/projects/strongswan/wiki/Pluginlist
144RDEPENDS:${PN} += "\
145    ${PN}-plugin-aes \
146    ${PN}-plugin-attr \
147    ${PN}-plugin-cmac \
148    ${PN}-plugin-constraints \
149    ${PN}-plugin-des \
150    ${PN}-plugin-dnskey \
151    ${PN}-plugin-hmac \
152    ${PN}-plugin-kernel-netlink \
153    ${PN}-plugin-md5 \
154    ${PN}-plugin-nonce \
155    ${PN}-plugin-pem \
156    ${PN}-plugin-pgp \
157    ${PN}-plugin-pkcs1 \
158    ${PN}-plugin-pkcs7 \
159    ${PN}-plugin-pkcs8 \
160    ${PN}-plugin-pkcs12 \
161    ${PN}-plugin-pubkey \
162    ${PN}-plugin-random \
163    ${PN}-plugin-rc2 \
164    ${PN}-plugin-resolve \
165    ${PN}-plugin-revocation \
166    ${PN}-plugin-sha1 \
167    ${PN}-plugin-sha2 \
168    ${PN}-plugin-socket-default \
169    ${PN}-plugin-sshkey \
170    ${PN}-plugin-updown \
171    ${PN}-plugin-vici \
172    ${PN}-plugin-x509 \
173    ${PN}-plugin-xauth-generic \
174    ${PN}-plugin-xcbc \
175    "
176
177RPROVIDES:${PN} += "${PN}-systemd"
178RREPLACES:${PN} += "${PN}-systemd"
179RCONFLICTS:${PN} += "${PN}-systemd"
180
181# The deprecated legacy 'strongswan-starter' service should only be used when charon and
182# stroke are enabled. When swanctl is in use, 'strongswan.service' is needed.
183# See: https://wiki.strongswan.org/projects/strongswan/wiki/Charon-systemd
184SYSTEMD_SERVICE:${PN} = " \
185    ${@bb.utils.contains('PACKAGECONFIG', 'swanctl', '${BPN}.service', '', d)} \
186    ${@bb.utils.contains('PACKAGECONFIG', 'charon', '${BPN}-starter.service', '', d)} \
187"
188