diff --git a/pkgs/by-name/st/strongswan/package.nix b/pkgs/by-name/st/strongswan/package.nix index 12a07f974d19..d8f46ac8f746 100644 --- a/pkgs/by-name/st/strongswan/package.nix +++ b/pkgs/by-name/st/strongswan/package.nix @@ -2,209 +2,200 @@ lib, stdenv, fetchFromGitHub, - fetchpatch2, - pkg-config, autoreconfHook, - perl, - gperf, + pkg-config, bison, flex, - gmp, - python3, - iptables, - ldns, - unbound, + curl, + perl, + gperf, openssl, pcsclite, - glib, + networkmanager, openresolv, + glib, systemd, + tpm2-tss, + libxml2, pam, - curl, - enableTNC ? false, + iptables, trousers, sqlite, - libxml2, - enableTPM2 ? false, - tpm2-tss, - enableNetworkManager ? false, - networkmanager, + unbound, + ldns, + gmp, nixosTests, + enableNetworkManager ? false, + enableTNC ? false, + enableTPM2 ? false, }: +let + features = rec { + nm = enableNetworkManager; + cmd = true; + stroke = true; + swanctl = true; + systemd = stdenv.hostPlatform.isLinux; -# Note on curl support: If curl is built with gnutls as its backend, the -# strongswan curl plugin may break. -# See https://wiki.strongswan.org/projects/strongswan/wiki/Curl for more info. + openssl = true; + farp = stdenv.hostPlatform.isLinux; + dhcp = stdenv.hostPlatform.isLinux; + af-alg = stdenv.hostPlatform.isLinux; + resolve = stdenv.hostPlatform.isLinux; + scripts = stdenv.hostPlatform.isLinux; + connmark = stdenv.hostPlatform.isLinux; + forecast = stdenv.hostPlatform.isLinux; + kernel-netlink = stdenv.hostPlatform.isLinux; + + aesni = stdenv.hostPlatform.isx86_64; + rdrand = stdenv.hostPlatform.isx86_64; + padlock = stdenv.hostPlatform.system == "i686-linux"; + + kernel-pfkey = stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isFreeBSD; + kernel-pfroute = stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isFreeBSD; + kernel-libipsec = stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isFreeBSD; + + keychain = false; # breaks build + osx-attr = stdenv.hostPlatform.isDarwin; + + ml = true; + # Note on curl support: If curl is built with gnutls as its backend, the + # strongswan curl plugin may break. + # See https://wiki.strongswan.org/projects/strongswan/wiki/Curl for more info. + curl = true; + acert = true; + pkcs11 = true; + dnscert = true; + unbound = true; + chapoly = true; + ext-auth = true; + socket-dynamic = stdenv.hostPlatform.isLinux; + + eap-sim = true; + eap-sim-file = true; + eap-sim-pcsc = true; + eap-simaka-pseudonym = true; + eap-simaka-reauth = true; + eap-identity = true; + eap-md5 = true; + eap-gtc = true; + eap-aka = true; + eap-aka-3gpp = true; + eap-aka-3gpp2 = true; + eap-mschapv2 = true; + eap-tls = true; + eap-peap = true; + eap-radius = true; + + xauth-eap = true; + xauth-pam = stdenv.hostPlatform.isLinux; + xauth-noauth = true; + + gmp = eap-aka-3gpp2; + } + // lib.optionalAttrs enableTNC { + eap-tnc = true; + eap-ttls = true; + eap-dynamic = true; + + tnccs-20 = true; + + tnc-imc = true; + tnc-imv = true; + tnc-ifmap = true; + + imc-os = true; + imv-os = true; + imc-attestation = true; + imv-attestation = true; + + aikgen = true; + tss-trousers = true; + + sqlite = true; + } + // lib.optionalAttrs enableTPM2 { + tpm = true; + tss-tss2 = true; + }; +in stdenv.mkDerivation rec { pname = "strongswan"; - version = "5.9.14"; # Make sure to also update when upgrading! + version = "6.0.2"; # Make sure to also update when upgrading! src = fetchFromGitHub { owner = "strongswan"; repo = "strongswan"; - rev = version; - hash = "sha256-qFM7ErfqiDlUsZdGXJQVW3nJoh+I6tEdKRwzrKteRVY="; + tag = version; + hash = "sha256-wjz41gt+Xu4XJkEXRRVl3b3ryEoEtijeqmfVFoRjnA4="; }; - dontPatchELF = true; - - nativeBuildInputs = [ - pkg-config - autoreconfHook - perl - gperf - bison - flex - ]; - buildInputs = [ - curl - gmp - python3 - ldns - unbound - openssl - pcsclite - ] - ++ lib.optionals enableTNC [ - trousers - sqlite - libxml2 - ] - ++ lib.optional enableTPM2 tpm2-tss - ++ lib.optionals stdenv.hostPlatform.isLinux [ - systemd.dev - pam - iptables - ] - ++ lib.optionals enableNetworkManager [ - networkmanager - glib - ]; - patches = [ ./ext_auth-path.patch ./firewall_defaults.patch ./updown-path.patch - # Fixes for gettext 0.25 - (fetchpatch2 { - url = "https://github.com/strongswan/strongswan/commit/7ec0101250bf2ac3da7a576cbb4204fceb2ef10c.patch?full_index=1"; - excludes = [ "scripts/test.sh" ]; - hash = "sha256-ATd/oj6/1vrtZdwMs45rA2MGtH2viumyucVj0LZ8Nnc="; - }) - (fetchpatch2 { - url = "https://github.com/strongswan/strongswan/commit/e8e5e2d4419a686c5a2c064648618ec281089b2e.patch?full_index=1"; - hash = "sha256-p98LSX8jjsDK/GZTovj/salmQ8T+txEV3vKD+wTUvsM="; - }) - (fetchpatch2 { - url = "https://github.com/strongswan/strongswan/commit/2b3a5172d89c513ed28d21bb406c1b4ef0ac787a.patch?full_index=1"; - hash = "sha256-xqp2Lq4pp3Uu0nVC/fl4E5mpJqCNgyZXP2g/Y2wShhI="; - }) ]; - postPatch = lib.optionalString stdenv.hostPlatform.isLinux '' - # glibc-2.26 reorganized internal includes - sed '1i#include ' -i src/libstrongswan/utils/utils/memory.h + nativeBuildInputs = [ + autoreconfHook + pkg-config + bison + flex + perl + gperf + ]; - substituteInPlace src/libcharon/plugins/resolve/resolve_handler.c --replace "/sbin/resolvconf" "${openresolv}/sbin/resolvconf" - ''; + buildInputs = + lib.optional (features.gmp or false) gmp + ++ lib.optional (features.eap-sim-pcsc or false) pcsclite + ++ lib.optional (features.openssl or false) openssl + ++ lib.optional (features.curl or false) curl + ++ lib.optional (features.systemd or false) systemd + ++ lib.optional (features.tnc-ifmap or false) libxml2 + ++ lib.optional (features.xauth-pam or false) pam + ++ lib.optional (features.forecast or false || features.connmark or false) iptables + ++ lib.optional (features.tss-trousers or false) trousers + ++ lib.optional (features.tss-tss2 or false) tpm2-tss + ++ lib.optional (features.sqlite or false) sqlite + ++ lib.optionals (features.unbound or false) [ + unbound + ldns + ] + ++ lib.optionals (features.nm or false) [ + networkmanager + glib + ]; - configureFlags = [ + configureFlags = (lib.mapAttrsToList (lib.flip lib.enableFeature)) features ++ [ "--sysconfdir=/etc" - "--enable-swanctl" - "--enable-cmd" - "--enable-openssl" - "--enable-eap-sim" - "--enable-eap-sim-file" - "--enable-eap-simaka-pseudonym" - "--enable-eap-simaka-reauth" - "--enable-eap-identity" - "--enable-eap-md5" - "--enable-eap-gtc" - "--enable-eap-aka" - "--enable-eap-aka-3gpp2" - "--enable-eap-mschapv2" - "--enable-eap-radius" - "--enable-xauth-eap" - "--enable-ext-auth" - "--enable-acert" - "--enable-pkcs11" - "--enable-eap-sim-pcsc" - "--enable-dnscert" - "--enable-unbound" - "--enable-chapoly" - "--enable-curl" - ] - ++ lib.optionals stdenv.hostPlatform.isLinux [ - "--enable-farp" - "--enable-dhcp" - "--enable-systemd" - "--with-systemdsystemunitdir=${placeholder "out"}/etc/systemd/system" - "--enable-xauth-pam" - "--enable-forecast" - "--enable-connmark" - "--enable-af-alg" - ] - ++ lib.optionals stdenv.hostPlatform.isx86_64 [ - "--enable-aesni" - "--enable-rdrand" - ] - ++ lib.optional (stdenv.hostPlatform.system == "i686-linux") "--enable-padlock" - ++ lib.optionals enableTNC [ - "--disable-gmp" - "--disable-aes" - "--disable-md5" - "--disable-sha1" - "--disable-sha2" - "--disable-fips-prf" - "--enable-eap-tnc" - "--enable-eap-ttls" - "--enable-eap-dynamic" - "--enable-tnccs-20" - "--enable-tnc-imc" - "--enable-imc-os" - "--enable-imc-attestation" - "--enable-tnc-imv" - "--enable-imv-attestation" - "--enable-tnc-ifmap" - "--enable-tnc-imc" - "--enable-tnc-imv" - "--with-tss=trousers" - "--enable-aikgen" - "--enable-sqlite" - ] - ++ lib.optionals enableTPM2 [ - "--enable-tpm" - "--enable-tss-tss2" - ] - ++ lib.optionals enableNetworkManager [ - "--enable-nm" - "--with-nm-ca-dir=/etc/ssl/certs" - ] - # Taken from: https://wiki.strongswan.org/projects/strongswan/wiki/MacOSX - ++ lib.optionals stdenv.hostPlatform.isDarwin [ - "--disable-systemd" - "--disable-xauth-pam" - "--disable-kernel-netlink" - "--enable-kernel-pfkey" - "--enable-kernel-pfroute" - "--enable-kernel-libipsec" - "--enable-osx-attr" - "--disable-scripts" + (lib.withFeatureAs (features.nm or false) "nm-ca-dir" "/etc/ssl/certs") + (lib.withFeatureAs (features.systemd or false + ) "systemdsystemunitdir" "${placeholder "out"}/etc/systemd/system") ]; installFlags = [ "sysconfdir=${placeholder "out"}/etc" ]; - NIX_LDFLAGS = lib.optionalString stdenv.cc.isGNU "-lgcc_s"; + enableParallelBuilding = true; + + dontPatchELF = true; passthru.tests = { inherit (nixosTests) strongswan-swanctl; }; - meta = with lib; { - description = "OpenSource IPsec-based VPN Solution"; - homepage = "https://www.strongswan.org"; - license = licenses.gpl2Plus; - platforms = platforms.all; + postPatch = lib.optionalString features.resolve '' + substituteInPlace src/libcharon/plugins/resolve/resolve_handler.c \ + --replace-fail "/sbin/resolvconf" "${openresolv}/sbin/resolvconf" + ''; + + meta = { + description = "OpenSource IPsec-based VPN solution"; + homepage = "https://www.strongswan.org/"; + changelog = "https://github.com/strongswan/strongswan/blob/${src.rev}/ChangeLog"; + license = lib.licenses.gpl2Plus; + maintainers = with lib.maintainers; [ nickcao ]; + mainProgram = "swanctl"; + platforms = lib.platforms.unix; }; }