globalprotect-openconnect: add core logic and packages for 2.x releases (#316526)
This commit is contained in:
Weijia Wang
@@ -2733,6 +2733,13 @@
|
||||
githubId = 19915050;
|
||||
name = "binarycat";
|
||||
};
|
||||
binary-eater = {
|
||||
email = "sergeantsagara@protonmail.com";
|
||||
github = "Binary-Eater";
|
||||
githubId = 10691440;
|
||||
name = "Rahul Rameshbabu";
|
||||
keys = [ { fingerprint = "678A 8DF1 D9F2 B51B 7110 BE53 FF24 7B3E 5411 387B"; } ];
|
||||
};
|
||||
binsky = {
|
||||
email = "timo@binsky.org";
|
||||
github = "binsky08";
|
||||
|
||||
@@ -472,6 +472,12 @@
|
||||
|
||||
- The `isync` package has been updated to version `1.5.0`, which introduces some breaking changes. See the [compatibility concerns](https://sourceforge.net/projects/isync/files/isync/1.5.0/) for more details.
|
||||
|
||||
- Legacy package `globalprotect-openconnect` 1.x and related module
|
||||
`globalprotect-vpn` were dropped. Two new packages `gpauth` and `gpclient`
|
||||
from the 2.x version of the GlobalProtect-openconnect project are added in its
|
||||
place. The GUI components related to the project are non-free and not
|
||||
packaged.
|
||||
|
||||
## Other Notable Changes {#sec-release-24.11-notable-changes}
|
||||
|
||||
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
|
||||
|
||||
@@ -1045,7 +1045,6 @@
|
||||
./services/networking/gdomap.nix
|
||||
./services/networking/ghostunnel.nix
|
||||
./services/networking/git-daemon.nix
|
||||
./services/networking/globalprotect-vpn.nix
|
||||
./services/networking/gns3-server.nix
|
||||
./services/networking/gnunet.nix
|
||||
./services/networking/go-autoconfig.nix
|
||||
|
||||
@@ -74,6 +74,7 @@ in
|
||||
(mkRemovedOptionModule [ "services" "fourStoreEndpoint" ] "The fourStoreEndpoint module has been removed")
|
||||
(mkRemovedOptionModule [ "services" "fprot" ] "The corresponding package was removed from nixpkgs.")
|
||||
(mkRemovedOptionModule [ "services" "frab" ] "The frab module has been removed")
|
||||
(mkRemovedOptionModule [ "services" "globalprotect"] "The corresponding package was removed from nixpkgs.")
|
||||
(mkRemovedOptionModule [ "services" "homeassistant-satellite"] "The `services.homeassistant-satellite` module has been replaced by `services.wyoming-satellite`.")
|
||||
(mkRemovedOptionModule [ "services" "hydron" ] "The `services.hydron` module has been removed as the project has been archived upstream since 2022 and is affected by a severe remote code execution vulnerability.")
|
||||
(mkRemovedOptionModule [ "services" "ihatemoney" ] "The ihatemoney module has been removed for lack of downstream maintainer")
|
||||
|
||||
@@ -1,57 +0,0 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
let
|
||||
cfg = config.services.globalprotect;
|
||||
|
||||
execStart =
|
||||
if cfg.csdWrapper == null then
|
||||
"${pkgs.globalprotect-openconnect}/bin/gpservice"
|
||||
else
|
||||
"${pkgs.globalprotect-openconnect}/bin/gpservice --csd-wrapper=${cfg.csdWrapper}";
|
||||
in
|
||||
|
||||
{
|
||||
options.services.globalprotect = {
|
||||
enable = lib.mkEnableOption "globalprotect";
|
||||
|
||||
settings = lib.mkOption {
|
||||
description = ''
|
||||
GlobalProtect-openconnect configuration. For more information, visit
|
||||
<https://github.com/yuezk/GlobalProtect-openconnect/wiki/Configuration>.
|
||||
'';
|
||||
default = { };
|
||||
example = {
|
||||
"vpn1.company.com" = {
|
||||
openconnect-args = "--script=/path/to/vpnc-script";
|
||||
};
|
||||
};
|
||||
type = lib.types.attrs;
|
||||
};
|
||||
|
||||
csdWrapper = lib.mkOption {
|
||||
description = ''
|
||||
A script that will produce a Host Integrity Protection (HIP) report,
|
||||
as described at <https://www.infradead.org/openconnect/hip.html>
|
||||
'';
|
||||
default = null;
|
||||
example = lib.literalExpression ''"''${pkgs.openconnect}/libexec/openconnect/hipreport.sh"'';
|
||||
type = lib.types.nullOr lib.types.path;
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.dbus.packages = [ pkgs.globalprotect-openconnect ];
|
||||
|
||||
environment.etc."gpservice/gp.conf".text = lib.generators.toINI { } cfg.settings;
|
||||
|
||||
systemd.services.gpservice = {
|
||||
description = "GlobalProtect openconnect DBus service";
|
||||
serviceConfig = {
|
||||
Type = "dbus";
|
||||
BusName = "com.yuezk.qt.GPService";
|
||||
ExecStart = execStart;
|
||||
};
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network.target" ];
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,50 @@
|
||||
{
|
||||
rustPlatform,
|
||||
lib,
|
||||
fetchFromGitHub,
|
||||
libsoup,
|
||||
openssl,
|
||||
pkg-config,
|
||||
perl,
|
||||
webkitgtk,
|
||||
}:
|
||||
|
||||
rustPlatform.buildRustPackage rec {
|
||||
pname = "gpauth";
|
||||
version = "2.3.7";
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "yuezk";
|
||||
repo = "GlobalProtect-openconnect";
|
||||
rev = "v${version}";
|
||||
hash = "sha256-Zr888II65bUjrbStZfD0AYCXKY6VdKVJHQhbKwaY3is=";
|
||||
};
|
||||
|
||||
buildAndTestSubdir = "apps/gpauth";
|
||||
cargoHash = "sha256-AuYw8CC0bMJzIJJQXhcQajQ4SACz4aKv6rG4HMq7U18=";
|
||||
|
||||
nativeBuildInputs = [
|
||||
perl
|
||||
pkg-config
|
||||
];
|
||||
buildInputs = [
|
||||
libsoup
|
||||
openssl
|
||||
webkitgtk
|
||||
];
|
||||
|
||||
meta = with lib; {
|
||||
changelog = "https://github.com/${src.owner}/${src.repo}/blob/${src.rev}/changelog.md";
|
||||
description = "A CLI for GlobalProtect VPN, based on OpenConnect, supports the SSO authentication method";
|
||||
longDescription = ''
|
||||
A CLI for GlobalProtect VPN, based on OpenConnect, supports the SSO
|
||||
authentication method. Inspired by gp-saml-gui.
|
||||
|
||||
The CLI version is always free and open source in this repo. It has almost
|
||||
the same features as the GUI version.
|
||||
'';
|
||||
homepage = "https://github.com/${src.owner}/${src.repo}";
|
||||
license = with licenses; [ gpl3Only ];
|
||||
maintainers = with maintainers; [ binary-eater ];
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,41 @@
|
||||
{
|
||||
rustPlatform,
|
||||
gpauth,
|
||||
openconnect,
|
||||
openssl,
|
||||
perl,
|
||||
vpnc-scripts,
|
||||
}:
|
||||
|
||||
rustPlatform.buildRustPackage rec {
|
||||
pname = "gpclient";
|
||||
|
||||
inherit (gpauth) version src meta;
|
||||
|
||||
buildAndTestSubdir = "apps/gpclient";
|
||||
cargoHash = "sha256-aJYFBvVrj1n2+9WLLBH5WTRRzTle19LsdJ2DielJYik=";
|
||||
|
||||
nativeBuildInputs = [ perl ];
|
||||
buildInputs = [
|
||||
gpauth
|
||||
openconnect
|
||||
openssl
|
||||
];
|
||||
|
||||
preConfigure = ''
|
||||
substituteInPlace crates/gpapi/src/lib.rs \
|
||||
--replace-fail /usr/bin/gpauth ${gpauth}/bin/gpauth
|
||||
substituteInPlace crates/common/src/vpn_utils.rs \
|
||||
--replace-fail /usr/sbin/vpnc-script ${vpnc-scripts}/bin/vpnc-script
|
||||
'';
|
||||
|
||||
postInstall = ''
|
||||
mkdir -p $out/share/applications
|
||||
cp packaging/files/usr/share/applications/gpgui.desktop $out/share/applications/gpgui.desktop
|
||||
'';
|
||||
|
||||
postFixup = ''
|
||||
substituteInPlace $out/share/applications/gpgui.desktop \
|
||||
--replace-fail /usr/bin/gpclient $out/bin/gpclient
|
||||
'';
|
||||
}
|
||||
@@ -1,32 +0,0 @@
|
||||
{ stdenv, lib, fetchurl
|
||||
, cmake, qtwebsockets, qtwebengine, qtkeychain, wrapQtAppsHook, openconnect
|
||||
}:
|
||||
|
||||
stdenv.mkDerivation rec {
|
||||
pname = "globalprotect-openconnect";
|
||||
version = "1.4.9";
|
||||
|
||||
src = fetchurl {
|
||||
url = "https://github.com/yuezk/GlobalProtect-openconnect/releases/download/v${version}/globalprotect-openconnect-${version}.tar.gz";
|
||||
hash = "sha256-vhvVKESLbqHx3XumxbIWOXIreDkW3yONDMXMHxhjsvk=";
|
||||
};
|
||||
|
||||
nativeBuildInputs = [ cmake wrapQtAppsHook ];
|
||||
|
||||
buildInputs = [ openconnect qtwebsockets qtwebengine qtkeychain ];
|
||||
|
||||
patchPhase = ''
|
||||
substituteInPlace GPService/gpservice.h \
|
||||
--replace /usr/local/bin/openconnect ${openconnect}/bin/openconnect;
|
||||
substituteInPlace GPService/CMakeLists.txt \
|
||||
--replace /etc/gpservice $out/etc/gpservice;
|
||||
'';
|
||||
|
||||
meta = with lib; {
|
||||
description = "GlobalProtect VPN client (GUI) for Linux based on OpenConnect that supports SAML auth mode";
|
||||
homepage = "https://github.com/yuezk/GlobalProtect-openconnect";
|
||||
license = licenses.gpl3Only;
|
||||
maintainers = [ maintainers.jerith666 ];
|
||||
platforms = platforms.linux;
|
||||
};
|
||||
}
|
||||
@@ -556,6 +556,7 @@ mapAliases ({
|
||||
glide = throw "'glide' has been removed as it is unmaintained, please use Go modules instead"; # Added 2023-12-26
|
||||
glfw-wayland = glfw; # Added 2024-04-19
|
||||
glfw-wayland-minecraft = glfw3-minecraft; # Added 2024-05-08
|
||||
globalprotect-openconnect = throw "'globalprotect-openconnect' has been renamed to/replaced by 'gpauth' and 'gpclient'"; # Added 2024-09-21
|
||||
glxinfo = mesa-demos; # Added 2024-07-04
|
||||
gmailieer = lieer; # Added 2020-04-19
|
||||
gmic-qt-krita = throw "gmic-qt-krita was removed as it's no longer supported upstream."; # Converted to throw 2023-02-02
|
||||
|
||||
@@ -13558,8 +13558,6 @@ with pkgs;
|
||||
|
||||
inherit (openconnectPackages) openconnect openconnect_openssl;
|
||||
|
||||
globalprotect-openconnect = libsForQt5.callPackage ../tools/networking/globalprotect-openconnect { };
|
||||
|
||||
ding-libs = callPackage ../tools/misc/ding-libs { };
|
||||
|
||||
sssd = callPackage ../os-specific/linux/sssd {
|
||||
|
||||
Reference in New Issue
Block a user