2 # Copyright (C) 2012-2014 OpenWrt.org
4 # This is free software, licensed under the GNU General Public License v2.
5 # See /LICENSE for more information.
8 include $(TOPDIR)/rules.mk
14 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
15 PKG_SOURCE_URL:=http://download.strongswan.org/ http://download2.strongswan.org/
16 PKG_MD5SUM:=1d1c108775242743cd8699215b2918c3
87 PKG_CONFIG_DEPENDS:= \
88 CONFIG_STRONGSWAN_DEVICE_RANDOM \
89 CONFIG_STRONGSWAN_DEVICE_URANDOM \
90 CONFIG_STRONGSWAN_ROUTING_TABLE \
91 CONFIG_STRONGSWAN_ROUTING_TABLE_PRIO \
92 $(patsubst %,CONFIG_PACKAGE_strongswan-mod-%,$(PKG_MOD_AVAILABLE)) \
98 include $(INCLUDE_DIR)/package.mk
100 define Package/strongswan/Default
105 URL:=http://www.strongswan.org/
108 define Package/strongswan/description/Default
109 StrongSwan is an OpenSource IPsec implementation for the Linux operating system.
112 define Package/strongswan
113 $(call Package/strongswan/Default)
114 DEPENDS:= +libpthread +ip \
115 +kmod-crypto-authenc \
116 +kmod-ipsec +kmod-ipsec4 +kmod-ipsec6 \
117 +kmod-ipt-ipsec +iptables-mod-ipsec
120 define Package/strongswan/config
121 source "$(SOURCE)/Config.in"
124 define Package/strongswan/description
125 $(call Package/strongswan/description/Default)
126 This package contains shared libraries and scripts.
129 define Package/strongswan-full
130 $(call Package/strongswan/Default)
132 DEPENDS:= +strongswan \
134 +strongswan-libfast \
135 +strongswan-mod-addrblock \
136 +strongswan-mod-aes \
137 +strongswan-mod-af-alg \
138 +strongswan-mod-agent \
139 +strongswan-mod-attr \
140 +strongswan-mod-attr-sql \
141 +strongswan-mod-blowfish \
142 +strongswan-mod-ccm \
143 +strongswan-mod-cmac \
144 +strongswan-mod-constraints \
145 +strongswan-mod-coupling \
146 +strongswan-mod-ctr \
147 +strongswan-mod-curl \
148 +strongswan-mod-des \
149 +strongswan-mod-dhcp \
150 +strongswan-mod-dnskey \
151 +strongswan-mod-duplicheck \
152 +strongswan-mod-eap-identity \
153 +strongswan-mod-eap-md5 \
154 +strongswan-mod-eap-mschapv2 \
155 +strongswan-mod-eap-radius \
156 +strongswan-mod-farp \
157 +strongswan-mod-fips-prf \
158 +strongswan-mod-gcm \
159 +strongswan-mod-gcrypt \
160 +strongswan-mod-gmp \
162 +strongswan-mod-hmac \
163 +strongswan-mod-kernel-netlink \
164 +strongswan-mod-ldap \
165 +strongswan-mod-led \
166 +strongswan-mod-load-tester \
167 +strongswan-mod-nonce \
168 +strongswan-mod-md4 \
169 +strongswan-mod-md5 \
170 +strongswan-mod-mysql \
171 +strongswan-mod-openssl \
172 +TARGET_x86:strongswan-mod-padlock \
173 +strongswan-mod-pem \
174 +strongswan-mod-pgp \
175 +strongswan-mod-pkcs1 \
176 +strongswan-mod-pkcs8 \
177 +strongswan-mod-pkcs11 \
178 +strongswan-mod-pubkey \
179 +strongswan-mod-random \
180 +strongswan-mod-resolve \
181 +strongswan-mod-revocation \
182 +strongswan-mod-sha1 \
183 +strongswan-mod-sha2 \
184 +strongswan-mod-smp \
185 +strongswan-mod-socket-default \
186 +strongswan-mod-sql \
187 +strongswan-mod-sqlite \
188 +strongswan-mod-stroke \
189 +strongswan-mod-test-vectors \
190 +strongswan-mod-uci \
191 +strongswan-mod-unity \
192 +strongswan-mod-updown \
193 +strongswan-mod-whitelist \
194 +strongswan-mod-x509 \
195 +strongswan-mod-xauth-eap \
196 +strongswan-mod-xauth-generic \
197 +strongswan-mod-xcbc \
202 define Package/strongswan-full/description
203 $(call Package/strongswan/description/Default)
204 This meta-package contains dependencies for all of the strongswan plugins
205 except kernel-klips, kernel-libipsec, kernel-pfkey,
206 socket-dynamic and which are ommitted in favor of the kernel-netlink and
207 socket-default plugins.
211 define Package/strongswan-default
212 $(call Package/strongswan/Default)
214 DEPENDS:= +strongswan \
216 +strongswan-mod-aes \
217 +strongswan-mod-attr \
218 +strongswan-mod-constraints \
219 +strongswan-mod-des \
220 +strongswan-mod-dnskey \
221 +strongswan-mod-fips-prf \
222 +strongswan-mod-gmp \
223 +strongswan-mod-hmac \
224 +strongswan-mod-kernel-netlink \
225 +strongswan-mod-md5 \
226 +strongswan-mod-nonce \
227 +strongswan-mod-pem \
228 +strongswan-mod-pgp \
229 +strongswan-mod-pkcs1 \
230 +strongswan-mod-pubkey \
231 +strongswan-mod-random \
232 +strongswan-mod-resolve \
233 +strongswan-mod-revocation \
234 +strongswan-mod-sha1 \
235 +strongswan-mod-sha2 \
236 +strongswan-mod-socket-default \
237 +strongswan-mod-stroke \
238 +strongswan-mod-updown \
239 +strongswan-mod-x509 \
240 +strongswan-mod-xauth-generic \
241 +strongswan-mod-xcbc \
245 define Package/strongswan-default/description
246 $(call Package/strongswan/description/Default)
247 This meta-package contains only dependencies to match upstream defaults.
250 define Package/strongswan-minimal
251 $(call Package/strongswan/Default)
253 DEPENDS:= +strongswan \
255 +strongswan-mod-aes \
256 +strongswan-mod-gmp \
257 +strongswan-mod-hmac \
258 +strongswan-mod-kernel-netlink \
259 +strongswan-mod-nonce \
260 +strongswan-mod-pubkey \
261 +strongswan-mod-random \
262 +strongswan-mod-sha1 \
263 +strongswan-mod-socket-default \
264 +strongswan-mod-stroke \
265 +strongswan-mod-updown \
266 +strongswan-mod-x509 \
270 define Package/strongswan-minimal/description
271 $(call Package/strongswan/description/Default)
272 This meta-package contains only dependencies for a minimal IKEv2 setup.
275 define Package/strongswan-charon
276 $(call Package/strongswan/Default)
277 TITLE+= IKEv1/IKEv2 keying daemon
278 DEPENDS:= +strongswan
281 define Package/strongswan-charon/description
282 $(call Package/strongswan/description/Default)
283 This package contains charon, an IKEv2 keying daemon.
286 define Package/strongswan-libfast
287 $(call Package/strongswan/Default)
289 DEPENDS:= +strongswan \
290 +PACKAGE_strongswan-libfast:zlib \
291 +PACKAGE_strongswan-libfast:fcgi \
292 +PACKAGE_strongswan-libfast:clearsilver
295 define Package/strongswan-libfast/description
296 $(call Package/strongswan/description/Default)
297 This package contains libfast, a lightweight framework to build native web
298 applications using ClearSilver and FastCGI.
301 define Package/strongswan-utils
302 $(call Package/strongswan/Default)
304 DEPENDS:= +strongswan
307 define Package/strongswan-utils/description
308 $(call Package/strongswan/description/Default)
309 This package contains the pki & scepclient utilities.
313 define Package/strongswan-mod-$(1)
314 $$(call Package/strongswan/Default)
315 TITLE:= StrongSwan $(2) plugin
316 DEPENDS:= +strongswan $(3)
319 strongswan_mod_conf=$(wildcard $(PKG_INSTALL_DIR)/etc/strongswan.d/charon/$(1).conf)
320 define Package/strongswan-mod-$(1)/install
321 $(INSTALL_DIR) $$(1)/etc/strongswan.d/charon
322 $(if $(call strongswan_mod_conf,$(1)), \
324 $(call strongswan_mod_conf,$(1)) \
325 $$(1)/etc/strongswan.d/charon/ \
327 $(INSTALL_DIR) $$(1)/usr/lib/ipsec/plugins
328 $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/plugins/libstrongswan-$(1).so \
329 $$(1)/usr/lib/ipsec/plugins/
330 $(call Plugin/$(1)/install,$$(1))
333 Package/strongswan-mod-$(1)/conffiles=$(patsubst $(PKG_INSTALL_DIR)%,%,$(call strongswan_mod_conf,$(1)))
335 $$(eval $$(call BuildPackage,strongswan-mod-$(1)))
341 $(if $(CONFIG_PACKAGE_strongswan-libfast),--enable-fast,--disable-fast) \
342 $(if $(CONFIG_PACKAGE_strongswan-utils),--enable-tools,--disable-tools) \
343 --with-random-device="$(call qstrip,$(CONFIG_STRONGSWAN_DEVICE_RANDOM))" \
344 --with-urandom-device="$(call qstrip,$(CONFIG_STRONGSWAN_DEVICE_URANDOM))" \
345 --with-routing-table="$(call qstrip,$(CONFIG_STRONGSWAN_ROUTING_TABLE))" \
346 --with-routing-table-prio="$(call qstrip,$(CONFIG_STRONGSWAN_ROUTING_TABLE_PRIO))" \
347 $(foreach m,$(PKG_MOD_AVAILABLE), \
348 $(if $(CONFIG_PACKAGE_strongswan-mod-$(m)),--enable-$(m),--disable-$(m)) \
351 ifneq ($(CONFIG_PACKAGE_strongswan-libfast),)
352 EXTRA_CPPFLAGS+= -I$(STAGING_DIR)/usr/include/ClearSilver
355 EXTRA_LDFLAGS+= -Wl,-rpath-link,$(STAGING_DIR)/usr/lib
357 define Package/strongswan/conffiles
364 define Package/strongswan/install
365 $(INSTALL_DIR) $(1)/etc
366 $(CP) $(PKG_INSTALL_DIR)/etc/strongswan.conf $(1)/etc/
367 $(INSTALL_DIR) $(1)/usr/lib/ipsec
368 $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/{libstrongswan.so.*,libhydra.so.*} $(1)/usr/lib/ipsec/
369 $(INSTALL_CONF) ./files/ipsec.secrets $(1)/etc/
370 $(INSTALL_DIR) $(1)/etc/init.d
371 $(INSTALL_BIN) ./files/ipsec.init $(1)/etc/init.d/ipsec
374 define Package/strongswan-default/install
378 define Package/strongswan-full/install
382 define Package/strongswan-minimal/install
386 define Package/strongswan-charon/install
387 $(INSTALL_DIR) $(1)/usr/lib/ipsec
388 $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/lib/ipsec/charon $(1)/usr/lib/ipsec/
389 $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/libcharon.so.* $(1)/usr/lib/ipsec/
392 define Package/strongswan-libfast/install
393 $(INSTALL_DIR) $(1)/usr/lib/ipsec
394 $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/libfast.so.* $(1)/usr/lib/ipsec/
397 define Package/strongswan-utils/install
398 $(INSTALL_DIR) $(1)/usr/sbin
399 $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/ipsec $(1)/usr/sbin/
400 $(INSTALL_DIR) $(1)/usr/bin
401 $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/pki $(1)/usr/bin/
402 $(INSTALL_DIR) $(1)/usr/lib/ipsec
403 $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/lib/ipsec/scepclient $(1)/usr/lib/ipsec/
406 define Plugin/duplicheck/install
407 $(INSTALL_DIR) $(1)/usr/lib/ipsec/plugins
408 $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/duplicheck $(1)/usr/lib/ipsec/
409 $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/plugins/libstrongswan-duplicheck.so $(1)/usr/lib/ipsec/plugins/
412 define Plugin/eap-radius/install
413 $(INSTALL_DIR) $(1)/usr/lib/ipsec/plugins
414 $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/libradius.so.* $(1)/usr/lib/ipsec/
415 $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/plugins/libstrongswan-eap-radius.so $(1)/usr/lib/ipsec/plugins/
418 define Plugin/attr-sql/install
419 $(INSTALL_DIR) $(1)/usr/lib/ipsec
420 $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/pool $(1)/usr/lib/ipsec/
423 define Plugin/stroke/install
424 $(INSTALL_DIR) $(1)/etc/ipsec.d/aacerts
425 $(INSTALL_DIR) $(1)/etc/ipsec.d/acerts
426 $(INSTALL_DIR) $(1)/etc/ipsec.d/cacerts
427 $(INSTALL_DIR) $(1)/etc/ipsec.d/certs
428 $(INSTALL_DIR) $(1)/etc/ipsec.d/crls
429 $(INSTALL_DIR) $(1)/etc/ipsec.d/ocspcerts
430 $(INSTALL_DIR) $(1)/etc/ipsec.d/private
431 $(INSTALL_DIR) $(1)/etc/ipsec.d/reqs
433 $(INSTALL_CONF) $(PKG_INSTALL_DIR)/etc/ipsec.conf $(1)/etc/
435 $(INSTALL_DIR) $(1)/usr/lib/ipsec/plugins
436 $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/lib/ipsec/{starter,stroke} $(1)/usr/lib/ipsec/
437 $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/plugins/libstrongswan-stroke.so $(1)/usr/lib/ipsec/plugins/
440 define Plugin/updown/install
441 $(INSTALL_DIR) $(1)/usr/lib/ipsec/plugins
442 $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/{_updown,_updown_espmark} $(1)/usr/lib/ipsec/
443 $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/plugins/libstrongswan-updown.so $(1)/usr/lib/ipsec/plugins/
444 $(INSTALL_DIR) $(1)/etc
445 $(INSTALL_CONF) ./files/ipsec.user $(1)/etc/
448 define Plugin/whitelist/install
449 $(INSTALL_DIR) $(1)/usr/lib/ipsec/plugins
450 $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/whitelist $(1)/usr/lib/ipsec/
451 $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/plugins/libstrongswan-whitelist.so $(1)/usr/lib/ipsec/plugins/
454 define Plugin/kernel-libipsec/install
455 $(INSTALL_DIR) $(1)/usr/lib/ipsec
456 $(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/libipsec.so.* $(1)/usr/lib/ipsec/
459 $(eval $(call BuildPackage,strongswan))
460 $(eval $(call BuildPackage,strongswan-default))
461 $(eval $(call BuildPackage,strongswan-full))
462 $(eval $(call BuildPackage,strongswan-minimal))
463 $(eval $(call BuildPackage,strongswan-charon))
464 $(eval $(call BuildPackage,strongswan-libfast))
465 $(eval $(call BuildPackage,strongswan-utils))
466 $(eval $(call BuildPlugin,addrblock,RFC 3779 address block constraint support,))
467 $(eval $(call BuildPlugin,aes,AES crypto,))
468 $(eval $(call BuildPlugin,af-alg,AF_ALG crypto interface to Linux Crypto API,+kmod-crypto-user))
469 $(eval $(call BuildPlugin,agent,SSH agent signing,))
470 $(eval $(call BuildPlugin,attr,file based config,))
471 $(eval $(call BuildPlugin,attr-sql,SQL based config,+strongswan-mod-sql))
472 $(eval $(call BuildPlugin,blowfish,Blowfish crypto,))
473 $(eval $(call BuildPlugin,ccm,CCM AEAD wrapper crypto,))
474 $(eval $(call BuildPlugin,cmac,CMAC crypto,))
475 $(eval $(call BuildPlugin,constraints,advanced X509 constraint checking,))
476 $(eval $(call BuildPlugin,coupling,IKEv2 plugin to couple peer certificates permanently to authentication,))
477 $(eval $(call BuildPlugin,ctr,Counter Mode wrapper crypto,))
478 $(eval $(call BuildPlugin,curl,cURL fetcher plugin,+PACKAGE_strongswan-mod-curl:libcurl))
479 $(eval $(call BuildPlugin,des,DES crypto,))
480 $(eval $(call BuildPlugin,dhcp,DHCP based attribute provider,))
481 $(eval $(call BuildPlugin,dnskey,DNS RR key decoding,))
482 $(eval $(call BuildPlugin,duplicheck,advanced duplicate checking,))
483 $(eval $(call BuildPlugin,eap-identity,EAP identity helper,))
484 $(eval $(call BuildPlugin,eap-md5,EAP MD5 (CHAP) EAP auth,))
485 $(eval $(call BuildPlugin,eap-mschapv2,EAP MS-CHAPv2 EAP auth,+strongswan-mod-md4 +strongswan-mod-des))
486 $(eval $(call BuildPlugin,eap-radius,EAP RADIUS auth,))
487 $(eval $(call BuildPlugin,farp,fake arp respsonses,))
488 $(eval $(call BuildPlugin,fips-prf,FIPS PRF crypto,+strongswan-mod-sha1))
489 $(eval $(call BuildPlugin,gcm,GCM AEAD wrapper crypto,))
490 $(eval $(call BuildPlugin,gcrypt,libgcrypt,+PACKAGE_strongswan-mod-gcrypt:libgcrypt))
491 $(eval $(call BuildPlugin,gmp,libgmp,+PACKAGE_strongswan-mod-gmp:libgmp))
492 $(eval $(call BuildPlugin,ha,high availability cluster,))
493 $(eval $(call BuildPlugin,hmac,HMAC crypto,))
494 $(eval $(call BuildPlugin,kernel-klips,KLIPS kernel interface,))
495 $(eval $(call BuildPlugin,kernel-libipsec,libipsec kernel interface,))
496 $(eval $(call BuildPlugin,kernel-netlink,netlink kernel interface,))
497 $(eval $(call BuildPlugin,kernel-pfkey,PK_KEY kernel interface,))
498 $(eval $(call BuildPlugin,ldap,LDAP,+PACKAGE_strongswan-mod-ldap:libopenldap))
499 $(eval $(call BuildPlugin,led,LED blink on IKE activity,))
500 $(eval $(call BuildPlugin,load-tester,load testing,))
501 $(eval $(call BuildPlugin,nonce,nonce genereation,))
502 $(eval $(call BuildPlugin,md4,MD4 crypto,))
503 $(eval $(call BuildPlugin,md5,MD5 crypto,))
504 $(eval $(call BuildPlugin,mysql,MySQL database interface,+strongswan-mod-sql +PACKAGE_strongswan-mod-mysql:libmysqlclient-r))
505 $(eval $(call BuildPlugin,openssl,OpenSSL crypto,+PACKAGE_strongswan-mod-openssl:libopenssl))
506 $(eval $(call BuildPlugin,padlock,VIA PadLock crypto,@TARGET_x86))
507 $(eval $(call BuildPlugin,pem,PEM decoding,))
508 $(eval $(call BuildPlugin,pgp,PGP key decoding,))
509 $(eval $(call BuildPlugin,pkcs1,PKCS1 key decoding,))
510 $(eval $(call BuildPlugin,pkcs8,PKCS8 key decoding,))
511 $(eval $(call BuildPlugin,pkcs11,PKCS11 key decoding,))
512 $(eval $(call BuildPlugin,pubkey,raw public key,))
513 $(eval $(call BuildPlugin,random,RNG,))
514 $(eval $(call BuildPlugin,resolve,DNS resolver,))
515 $(eval $(call BuildPlugin,revocation,X509 CRL/OCSP revocation,))
516 $(eval $(call BuildPlugin,sha1,SHA1 crypto,))
517 $(eval $(call BuildPlugin,sha2,SHA2 crypto,))
518 $(eval $(call BuildPlugin,smp,SMP configuration and control interface,+PACKAGE_strongswan-mod-smp:libxml2))
519 $(eval $(call BuildPlugin,socket-default,default socket implementation for charon,))
520 $(eval $(call BuildPlugin,socket-dynamic,dynamic socket implementation for charon,))
521 $(eval $(call BuildPlugin,sql,SQL database interface,))
522 $(eval $(call BuildPlugin,sqlite,SQLite database interface,+strongswan-mod-sql +PACKAGE_strongswan-mod-sqlite:libsqlite3))
523 $(eval $(call BuildPlugin,stroke,Stroke,+strongswan-utils))
524 $(eval $(call BuildPlugin,test-vectors,crypto test vectors,))
525 $(eval $(call BuildPlugin,uci,UCI config interface,+PACKAGE_strongswan-mod-uci:libuci))
526 $(eval $(call BuildPlugin,unity,Cisco Unity extension,))
527 $(eval $(call BuildPlugin,updown,updown firewall,))
528 $(eval $(call BuildPlugin,whitelist,peer identity whitelisting,))
529 $(eval $(call BuildPlugin,x509,x509 certificate,))
530 $(eval $(call BuildPlugin,xauth-eap,EAP XAuth backend,))
531 $(eval $(call BuildPlugin,xauth-generic,generic XAuth backend,))
532 $(eval $(call BuildPlugin,xcbc,xcbc crypto,))