Move VPN packages into net-vpn/

12 files changed, 256 insertions, 0 deletions

diff --git a/net-vpn/ipsec-tools/files/ipsec-tools-0.8.0-sysctl.patch b/net-vpn/ipsec-tools/files/ipsec-tools-0.8.0-sysctl.patch
new file mode 100644
index 000000000000..5c69bbb2fa61
--- /dev/null
+++ b/net-vpn/ipsec-tools/files/ipsec-tools-0.8.0-sysctl.patch
@@ -0,0 +1,22 @@
+https://bugs.gentoo.org/425770
+
+--- a/src/racoon/pfkey.c
++++ b/src/racoon/pfkey.c
+@@ -59,7 +59,6 @@
+ #include <sys/param.h>
+ #include <sys/socket.h>
+ #include <sys/queue.h>
+-#include <sys/sysctl.h>
+ 
+ #include <net/route.h>
+ #include <net/pfkeyv2.h>
+--- a/src/setkey/setkey.c
++++ b/src/setkey/setkey.c
+@@ -40,7 +40,6 @@
+ #include <sys/socket.h>
+ #include <sys/time.h>
+ #include <sys/stat.h>
+-#include <sys/sysctl.h>
+ #include <err.h>
+ #include <netinet/in.h>
+ #include <net/pfkeyv2.h>
diff --git a/net-vpn/ipsec-tools/files/ipsec-tools-CVE-2015-4047.patch b/net-vpn/ipsec-tools/files/ipsec-tools-CVE-2015-4047.patch
new file mode 100644
index 000000000000..58f72e109c40
--- /dev/null
+++ b/net-vpn/ipsec-tools/files/ipsec-tools-CVE-2015-4047.patch
@@ -0,0 +1,16 @@
+See: https://bugs.gentoo.org/show_bug.cgi?id=550118
+
+--- ./src/racoon/gssapi.c    9 Sep 2006 16:22:09 -0000       1.4
++++ ./src/racoon/gssapi.c    19 May 2015 15:16:00 -0000      1.6
+@@ -192,6 +192,11 @@
+	gss_name_t princ, canon_princ;
+	OM_uint32 maj_stat, min_stat;
+ 
++	if (iph1->rmconf == NULL) {
++		plog(LLV_ERROR, LOCATION, NULL, "no remote config\n");
++		return -1;
++	}
++
+	gps = racoon_calloc(1, sizeof (struct gssapi_ph1_state));
+	if (gps == NULL) {
+		plog(LLV_ERROR, LOCATION, NULL, "racoon_calloc failed\n");
diff --git a/net-vpn/ipsec-tools/files/ipsec-tools-def-psk.patch b/net-vpn/ipsec-tools/files/ipsec-tools-def-psk.patch
new file mode 100644
index 000000000000..f351860a84e9
--- /dev/null
+++ b/net-vpn/ipsec-tools/files/ipsec-tools-def-psk.patch
@@ -0,0 +1,25 @@
+diff -brau ipsec-tools-0.7.3.o/src/racoon/oakley.c ipsec-tools-0.7.3/src/racoon/oakley.c
+--- ipsec-tools-0.7.3.o/src/racoon/oakley.c	2009-08-13 11:18:45.000000000 +0200
++++ ipsec-tools-0.7.3/src/racoon/oakley.c	2011-06-06 09:36:11.000000000 +0200
+@@ -2498,8 +2498,21 @@
+ 				plog(LLV_ERROR, LOCATION, iph1->remote,
+ 					"couldn't find the pskey for %s.\n",
+ 					saddrwop2str(iph1->remote));
++			}
++		}
++		if (iph1->authstr == NULL) {
++			/*
++			 * If we could not locate a psk above try and locate
++			 * the default psk, ie, "*".
++			 */
++			iph1->authstr = privsep_getpsk("*", 1);
++			if (iph1->authstr == NULL) {
++				plog(LLV_ERROR, LOCATION, iph1->remote,
++					"couldn't find the the default pskey either.\n");
+ 				goto end;
+ 			}
++			plog(LLV_NOTIFY, LOCATION, iph1->remote,
++					"Using default PSK.\n");
+ 		}
+ 		plog(LLV_DEBUG, LOCATION, NULL, "the psk found.\n");
+ 		/* should be secret PSK */
diff --git a/net-vpn/ipsec-tools/files/ipsec-tools-include-vendoridh.patch b/net-vpn/ipsec-tools/files/ipsec-tools-include-vendoridh.patch
new file mode 100644
index 000000000000..2e22c82db478
--- /dev/null
+++ b/net-vpn/ipsec-tools/files/ipsec-tools-include-vendoridh.patch
@@ -0,0 +1,11 @@
+diff -Naur ipsec-tools-0.8.0.orig//src/racoon/ipsec_doi.c ipsec-tools-0.8.0/src/racoon/ipsec_doi.c
+--- ipsec-tools-0.8.0.orig//src/racoon/ipsec_doi.c	2012-02-28 13:42:24.000000000 -0500
++++ ipsec-tools-0.8.0/src/racoon/ipsec_doi.c	2012-02-28 13:41:22.000000000 -0500
+@@ -87,6 +87,7 @@
+ #ifdef HAVE_GSSAPI
+ #include <iconv.h>
+ #include "gssapi.h"
++#include "vendorid.h"
+ #ifdef HAVE_ICONV_2ND_CONST
+ #define __iconv_const const
+ #else
diff --git a/net-vpn/ipsec-tools/files/ipsec-tools.conf b/net-vpn/ipsec-tools/files/ipsec-tools.conf
new file mode 100644
index 000000000000..bfff04af069a
--- /dev/null
+++ b/net-vpn/ipsec-tools/files/ipsec-tools.conf
@@ -0,0 +1,26 @@
+#!/usr/sbin/setkey -f
+#
+# THIS IS A SAMPLE FILE!
+#
+# This is a sample file to test Gentoo's ipsec-tools out of the box.
+# Do not use it in production.  See: http://www.ipsec-howto.org/
+#
+flush;
+spdflush;
+
+#
+# Uncomment the following if you want to do manual keying, ie, you want to run IPsec without racoon.
+# Do not switch 192.168.3.21 <-> 192.168.3.25 on the peer
+#
+#add 192.168.3.25 192.168.3.21 ah 0x200 -A hmac-md5 0xc0291ff014dccdd03874d9e8e4cdf3e6;
+#add 192.168.3.21 192.168.3.25 ah 0x300 -A hmac-md5 0x96358c90783bbfa3d7b196ceabe0536b;
+#add 192.168.3.25 192.168.3.21 esp 0x201 -E 3des-cbc 0x7aeaca3f87d060a12f4a4487d5a5c3355920fae69a96c831;
+#add 192.168.3.21 192.168.3.25 esp 0x301 -E 3des-cbc 0xf6ddb555acfd9d77b03ea3843f2653255afe8eb5573965df;
+
+#
+# Make sure to switch 192.168.3.21 <-> 192.168.3.25 on the peer
+#
+#spdadd 192.168.3.21 192.168.3.25 any -P out ipsec esp/transport//require ah/transport//require;
+#spdadd 192.168.3.25 192.168.3.21 any -P in  ipsec esp/transport//require ah/transport//require;
+spdadd 192.168.3.25 192.168.3.21 any -P out ipsec esp/transport//require ah/transport//require;
+spdadd 192.168.3.21 192.168.3.25 any -P in  ipsec esp/transport//require ah/transport//require;
diff --git a/net-vpn/ipsec-tools/files/ipsec-tools.service b/net-vpn/ipsec-tools/files/ipsec-tools.service
new file mode 100644
index 000000000000..0341aa7e4ed9
--- /dev/null
+++ b/net-vpn/ipsec-tools/files/ipsec-tools.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=Load IPSec Security Policy Database
+After=syslog.target network.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=true
+ExecStart=/usr/sbin/setkey -k -f /etc/ipsec-tools.conf
+ExecStop=/usr/sbin/setkey -F -P ; /usr/sbin/setkey -F
+
+[Install]
+WantedBy=multi-user.target
diff --git a/net-vpn/ipsec-tools/files/psk.txt b/net-vpn/ipsec-tools/files/psk.txt
new file mode 100644
index 000000000000..97f5180f5ae5
--- /dev/null
+++ b/net-vpn/ipsec-tools/files/psk.txt
@@ -0,0 +1,10 @@
+# THIS IS A SAMPLE FILE!
+#
+# This is a sample file to test Gentoo's ipsec-tools out of the box.
+# Do not use it in production.  See: http://www.ipsec-howto.org/
+#
+# Make sure to switch 192.168.3.21 <-> 192.168.3.25 on the peer
+#
+# Peer IP/FQDN	Secret
+# 192.168.3.25	sample
+192.168.3.21	sample
diff --git a/net-vpn/ipsec-tools/files/racoon.conf b/net-vpn/ipsec-tools/files/racoon.conf
new file mode 100644
index 000000000000..2e9206db9506
--- /dev/null
+++ b/net-vpn/ipsec-tools/files/racoon.conf
@@ -0,0 +1,33 @@
+# THIS IS A SAMPLE FILE!
+#
+# This is a sample file to test Gentoo's ipsec-tools out of the box.
+# Do not use it in production.  See: http://www.ipsec-howto.org/
+#
+path pre_shared_key "/etc/racoon/psk.txt";
+
+#
+# Make sure to switch 192.168.3.21 <-> 192.168.3.25 on the peer
+#
+#remote 192.168.3.25
+remote 192.168.3.21
+{
+	exchange_mode main;
+	proposal {
+		encryption_algorithm 3des;
+		hash_algorithm md5;
+		authentication_method pre_shared_key;
+		dh_group modp1024;
+	}
+}
+
+#
+# Make sure to switch 192.168.3.21 <-> 192.168.3.25 on the peer
+#
+#sainfo address 192.168.3.21 any address 192.168.3.25 any
+sainfo address 192.168.3.25 any address 192.168.3.21 any
+{
+	pfs_group modp768;
+	encryption_algorithm 3des;
+	authentication_algorithm hmac_md5;
+	compression_algorithm deflate;
+}
diff --git a/net-vpn/ipsec-tools/files/racoon.conf.d-r2 b/net-vpn/ipsec-tools/files/racoon.conf.d-r2
new file mode 100644
index 000000000000..c592d3584967
--- /dev/null
+++ b/net-vpn/ipsec-tools/files/racoon.conf.d-r2
@@ -0,0 +1,29 @@
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+# Config file for /etc/init.d/racoon
+
+# See the man page or run `racoon --help` for valid command-line options
+# RACOON_OPTS="-d"
+
+RACOON_CONF="/etc/racoon/racoon.conf"
+RACOON_PSK_FILE="/etc/racoon/psk.txt"
+
+# The amount of time in ms for start-stop-daemon to wait before a timeout
+# Racoon can sometimes be slow.  We'll wait 1 sec.  Bug #435398.
+
+RACOON_WAIT="1000"
+
+# The setkey config file.  Don't name it ipsec.conf as this clashes
+# with strongswan.  We'll follow debian's naming.  Bug #436144.
+
+SETKEY_CONF="/etc/ipsec-tools.conf"
+
+# Comment or remove the following if you don't want the policy tables
+# to be flushed when racoon is stopped.
+
+RACOON_RESET_TABLES="true"
+
+# If you need to set custom options to the setkey command when loading rules, use this
+# more info in the setkey mangage (example below sets kernel mode instead of RFC mode):
+#SETKEY_OPTS="-k"
diff --git a/net-vpn/ipsec-tools/files/racoon.init.d-r3 b/net-vpn/ipsec-tools/files/racoon.init.d-r3
new file mode 100644
index 000000000000..66e10bb84d42
--- /dev/null
+++ b/net-vpn/ipsec-tools/files/racoon.init.d-r3
@@ -0,0 +1,57 @@
+#!/sbin/openrc-run
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+depend() {
+	before netmount
+	use net
+}
+
+checkconfig() {
+	if [ ! -e ${SETKEY_CONF} ] ; then
+		eerror "You need to configure setkey before starting racoon."
+		return 1
+	fi
+	if [ ! -e ${RACOON_CONF} ] ; then
+		eerror "You need a configuration file to start racoon."
+		return 1
+	fi
+	if [ ! -z ${RACOON_PSK_FILE} ] ; then
+		if [ ! -f ${RACOON_PSK_FILE} ] ; then
+			eerror "PSK file not found as specified."
+			eerror "Set RACOON_PSK_FILE in /etc/conf.d/racoon."
+			return 1
+		fi
+		case "`ls -Lldn ${RACOON_PSK_FILE}`" in
+			-r--------*)
+				;;
+			*)
+				eerror "Your defined PSK file should be mode 400 for security!"
+				return 1
+				;;
+		esac
+	fi
+}
+
+command=/usr/sbin/racoon
+command_args="-f ${RACOON_CONF} ${RACOON_OPTS}"
+pidfile=/var/run/racoon.pid
+start_stop_daemon_args="--wait ${RACOON_WAIT}"
+
+start_pre() {
+	checkconfig || return 1
+	einfo "Loading ipsec policies from ${SETKEY_CONF}."
+	/usr/sbin/setkey ${SETKEY_OPTS} -f ${SETKEY_CONF}
+	if [ $? -eq 1 ] ; then
+		eerror "Error while loading ipsec policies"
+	fi
+}
+
+stop_post() {
+	if [ -n "${RACOON_RESET_TABLES}" ]; then
+		ebegin "Flushing policy entries"
+		/usr/sbin/setkey -F
+		/usr/sbin/setkey -FP
+		eend $?
+	fi
+}
diff --git a/net-vpn/ipsec-tools/files/racoon.pam.d b/net-vpn/ipsec-tools/files/racoon.pam.d
new file mode 100644
index 000000000000..b801aaafa0f9
--- /dev/null
+++ b/net-vpn/ipsec-tools/files/racoon.pam.d
@@ -0,0 +1,4 @@
+auth       include	system-remote-login
+account    include	system-remote-login
+password   include	system-remote-login
+session	   include	system-remote-login
diff --git a/net-vpn/ipsec-tools/files/racoon.service b/net-vpn/ipsec-tools/files/racoon.service
new file mode 100644
index 000000000000..df7f1bb8f8c0
--- /dev/null
+++ b/net-vpn/ipsec-tools/files/racoon.service
@@ -0,0 +1,11 @@
+[Unit]
+Description=Racoon IKEv1 key management daemon for IPSEC
+After=syslog.target network.target
+Requires=ipsec-tools.service
+
+[Service]
+Type=forking
+ExecStart=/usr/sbin/racoon -f /etc/racoon/racoon.conf
+
+[Install]
+WantedBy=multi-user.target