99 Commits

Author SHA1 Message Date
Thomas Petazzoni
792f92db2b linux, package: do not use <pkg>_NAME when defining CPE ID variables
As we discussed on the mailing list, using $(<pkg>_NAME) when defining
CPE ID variables feels a bit odd and needlessly complicated. Just use
the package name directly.

Cc: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-15 08:02:08 +01:00
Fabrice Fontaine
9fc3dd8895 package/openvpn: set OPENVPN_CPE_ID_VENDOR
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-09 16:08:32 +01:00
Thomas Petazzoni
30bc58d376 package/openvpn: use make install instead of custom install step
Commit 7105e65cd6 ("package/openvpn:
adds target install of systemd unit files") added the installation of
systemd unit files. But in fact, they can be installed by openvpn's
build system. It was simply not working due to the custom install step
implemented in openvpn.mk.

So instead, let's have the autotools-package infra call "make
install", which properly installs everything that's needed for
openvpn, including systemd units, but also plugins, etc.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-12-31 16:53:02 +01:00
Edmundo Ferreira
7105e65cd6 package/openvpn: adds target install of systemd unit files
Signed-off-by: Edmundo Ferreira <fc.edmundo@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-12-31 15:41:32 +01:00
Fabrice Fontaine
ba8f55d7c1 package/openvpn: bump to version 2.5.0
- Disable unit-tests which are enabled by default if cmocka is found:
  222e691739
- Drop --enable-iproute2 to enable netlink(3) support (and so drop
  IFCONFIG, IPROUTE and ROUTE environment variables and keep NETSTAT
  even if it is only used by tests/t_client.sh.in).
  netlink is much faster than calling ifconfig or route and also enables
  OpenVPN to run with less privileges.
- Update indentation in hash file (two spaces)

https://github.com/OpenVPN/openvpn/blob/release/2.5/Changes.rst

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-11-07 15:04:16 +01:00
Fabrice Fontaine
b11f92ff0e package/openvpn: add mbedtls support
mbedtls (former polarssl) support was dropped with commit
3380da69c5

Put it back as openvpn supports mbedtls 2.x since version 2.4.0 and
86d8cd6860

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-03 23:22:54 +01:00
Maxim Kochetkov
d8e68597a7 package/openvpn: use start-stop-daemon to perform start/stop actions
Using 'start-stop-daemon' prevents multiple instances creation by
'/etc/init.d/S60openvpn start'.

Signed-off-by: Maxim Kochetkov <fido_max@inbox.ru>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-10-08 23:24:44 +02:00
Bernd Kuhls
d9045f2596 package/openvpn: security bump version to 2.4.9
Changelog:
https://github.com/OpenVPN/openvpn/blob/release/2.4/ChangeLog

Fixes CVE-2020-11810.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-04-19 10:23:05 +02:00
Adam Duskett
bf8eca8fd3 package/openvpn: add pkcs11 support
If the pkcs11-helper package is selected, add the package to the
dependency list and explicitly set --enable-pkcs11.

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-04-12 23:35:34 +02:00
Adam Duskett
e6acd76584 package/openvpn: enable pam plugin support
If the linux-pam package is selected, add the package to the
dependency list and explicitly set --enable-plugin-auth-pam.

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-01-02 09:28:25 +01:00
Bernd Kuhls
b94f6c40a0 package/openvpn: bump version to 2.4.8
Changelog:
3976acda9b (diff-8ca39f14de952fe02a97ac77c27eab25)

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-10-31 22:02:46 +01:00
Adam Duskett
e87cb52b55 package/openvpn: add libselinux support
If the libselinux package is selected, add the package to the
dependency list and explicitly set --enable-selinux.

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2019-10-30 00:06:32 +01:00
Adam Duskett
62264233b2 package/openvpn: add systemd support
If the systemd package is selected, add the package to the
dependency list and explicitly set --enable-systemd.

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2019-10-30 00:06:11 +01:00
Bernd Kuhls
ee7d5e54a6 package/openvpn: bump version to 2.4.7
Quoting https://openvpn.net/community-downloads/
"This is primarily a maintenance release with bugfixes and improvements.
 One of the big things is enhanced TLS 1.3 support."

Release notes:
2b8aec62d5

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-03-15 21:36:14 +01:00
Matt Weber
590e9e05b6 packages: update sysv S* scripts to 644
Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-02-08 11:35:22 +01:00
Baruch Siach
525f20dae1 openvpn: bump to version 2.4.6
Note that CVE-2018-9336 fixed in this version does not affect Buildroot
since it is Windows specific.

Drop interoperability with older busybox versions. We removed support
for busybox version selection long ago.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2018-05-04 09:15:28 +02:00
Carlos Santos
59520e54fe openvpn: don't test if the binary exists in the init script
The test doesn't make sense. It just exits without any error if the
binary doesn't exist, which is silly.

Replace the DAEMON variable, which was used only once, by the full path
of the binary file.

Signed-off-by: Carlos Santos <casantos@datacom.ind.br>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2018-04-16 07:34:53 +02:00
Bernd Kuhls
7e7caee21e package/openvpn: bump version to 2.4.5
Changelog: https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn24

This bump depends on libressl 2.7.2 to avoid a build error with this
defconfig:

BR2_PACKAGE_LIBRESSL=y
BR2_PACKAGE_OPENVPN=y

Added license hash.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2018-04-02 11:27:41 +02:00
Bernd Kuhls
aa070c802e package/openvpn: security bump to version 2.4.4
Fixes CVE-2017-12166:
https://community.openvpn.net/openvpn/wiki/CVE-2017-12166

Changelog:
https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn24
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-09-27 22:03:43 +02:00
Baruch Siach
24f2eb1e15 openvpn: security bump to version 2.4.3
Fixes:

CVE-2017-7508 - Remotely-triggerable ASSERT() on malformed IPv6 packet

CVE-2017-7520 - Pre-authentication remote crash/information disclosure for
clients

CVE-2017-7521 - Potential double-free in --x509-alt-username

CVE-2017-7521 - Remote-triggerable memory leaks

CVE-2017-7522 - Post-authentication remote DoS when using the --x509-track
option

Details at

  https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243

Cc: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-06-22 23:26:57 +02:00
Bernd Kuhls
a4e5ee245e package/openvpn: security bump to 2.4.2
Fixes CVE-2017-7478 & CVE-2017-7479:
https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-05-11 21:12:20 +02:00
Rahul Bedarkar
af31c309e7 boot, linux, package: use SPDX short identifier for GPLv2/GPLv2+
We want to use SPDX identifier for license strings as much as possible.
SPDX short identifier for GPLv2/GPLv2+ is GPL-2.0/GPL-2.0+.

This change is done by using following command.
find . -name "*.mk" | xargs sed -ri '/LICENSE( )?[\+:]?=/s/\<GPLv2\>/GPL-2.0/g'

Signed-off-by: Rahul Bedarkar <rahulbedarkar89@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-04-01 15:16:38 +02:00
Jeroen Roovers
65e6f6ff2a openvpn: Add explicit support for external lz4
2.4.0 added lz4 support. Make that choice explicit or the bundled compat-lz4
"stub" will be used.

Signed-off-by: Jeroen Roovers <jer@airfi.aero>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-03-25 14:57:17 +01:00
Vicente Olivert Riera
9ecbe727aa openvpn: bump version to 2.4.1
--disable-eurephia configure option doesn't exist, so remove it.

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-03-25 14:56:43 +01:00
Vicente Olivert Riera
878dc8cc9b openvpn: bump version to 2.4.0
--enable-password-save option has been removed
(9ffd00e754). Since
it now defaults to "enabled" in the upstream package, there is no
point in adding Config.in.legacy support for it: Config.in.legacy
logic only kicks in when the option is enabled, but the upstream
package precisely preserve the compatibility with this situation.

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-01-24 23:24:46 +13:00
Bernd Kuhls
c021b13291 package/openvpn: bump version to 2.3.14
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2016-12-08 22:22:11 +01:00
Bernd Kuhls
fdc9f9d035 package/openvpn: bump to version 2.3.13
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2016-11-04 10:15:06 +01:00
Gustavo Zacarias
40b6d22eab openvpn: bump to version 2.3.12
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2016-08-23 23:14:36 +02:00
Gustavo Zacarias
814e99d21a openvpn: security bump to version 2.3.11
Fixed port-share bug with DoS potential.
Fix buffer overflow by user supplied data.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2016-05-15 22:41:30 +02:00
Gustavo Zacarias
3380da69c5 openvpn: remove polarssl crypto backend option
Now that we need to bump openvpn to version 2.3.11 for security fixes
the time has come to remove the polarssl option.
Add legacy handling explaining the situation:
PolarSSL 1.2.x can coexist with mbedTLS 2.x+, but OpenVPN requires
PolarSSL/mbedTLS 1.3.x (the transition branch) >= 1.3.8 but doesn't
build/work with the 2.x series. And PolarSSL/mbedTLS 1.3.x can't coexist
with mbedTLS 2.x on the same target.
So, unfortunately, openssl is now the only option (until libressl
arrives) which means no more backend options in general.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2016-05-15 22:41:24 +02:00
Gustavo Zacarias
bb446a7b77 Revert "package/openvpn: bump version to 2.3.10"
openvpn 2.3.10 doesn't work with polarssl 1.2.x, hence this bump breaks
builds for the polarssl backend.

This reverts commit 06f3e7904f.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Reviewed-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2016-01-31 16:39:17 +01:00
Bernd Kuhls
06f3e7904f package/openvpn: bump version to 2.3.10
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2016-01-31 11:26:49 +01:00
Gustavo Zacarias
152fffa4a4 openvpn: bump to version 2.3.9
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-12-17 12:56:21 +01:00
Maxime Hadjinlian
0f75b2635e package: Replace 'echo -n' by 'printf'
'echo -n' is not a POSIX construct (no flag support), we shoud use
'printf', especially in init script.

This patch was generated by the following command line:
git grep -l 'echo -n' -- `git ls-files | grep -v 'patch'` | xargs sed -i 's/echo -n/printf/'

Signed-off-by: Maxime Hadjinlian <maxime.hadjinlian@gmail.com>
Reviewed-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2015-10-04 00:56:41 +02:00
Andreas Wetzel
58dfd45aec openvpn: add option for --enable-password-save
Added configuration option BR2_PACKAGE_OPENVPN_PWSAVE that
adds --enable-password-save to OPENVPN_CONF_OPTS if selected.

[Thomas: rewrap Config.in help text, as suggested by Vicente.]

Signed-off-by: Andreas Wetzel <andreas.wetzel@nanotronic.ch>
Reviewed-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-09-30 13:04:33 +02:00
Gustavo Zacarias
85e7763e31 openvpn: bump to version 2.3.8
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-08-09 11:42:44 +02:00
Gustavo Zacarias
fb67b749ca openvpn: bump to version 2.3.7
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-06-09 22:43:34 +02:00
Gustavo Zacarias
79ce08bbdc packages: remove non-IPv6 dependencies and tweaks
Now that IPv6 is mandatory remove package dependencies and conditionals
for it.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-04-22 23:06:35 +02:00
Jerzy Grzegorek
bd8c733fb4 packages: indentation cleanup
This commit doesn't touch infra packages.

Signed-off-by: Jerzy Grzegorek <jerzy.grzegorek@trzebnica.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-03-31 13:57:41 +02:00
Thomas Petazzoni
665e13c85e Rename BR2_PREFER_STATIC_LIB to BR2_STATIC_LIBS
Since a while, the semantic of BR2_PREFER_STATIC_LIB has been changed
from "prefer static libraries when possible" to "use only static
libraries". The former semantic didn't make much sense, since the user
had absolutely no control/idea of which package would use static
libraries, and which packages would not. Therefore, for quite some
time, we have been starting to enforce that BR2_PREFER_STATIC_LIB
should really build everything with static libraries.

As a consequence, this patch renames BR2_PREFER_STATIC_LIB to
BR2_STATIC_LIBS, and adjust the Config.in option accordingly.

This also helps preparing the addition of other options to select
shared, shared+static or just static.

Note that we have verified that this commit can be reproduced by
simply doing a global rename of BR2_PREFER_STATIC_LIB to
BR2_STATIC_LIBS plus adding BR2_PREFER_STATIC_LIB to Config.in.legacy.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
2014-12-11 22:48:13 +01:00
Fabian Mewes
8214188319 openvpn: CVE-2014-8104: bump to version 2.3.6
see
https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-97597e732b

Signed-off-by: Fabian Mewes <architekt@coding4coffee.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2014-12-02 10:30:19 +01:00
Thomas Petazzoni
2b7b3f50a7 openvpn: use <pkg>_INSTALL_INIT_SYSV mechanism
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Acked-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2014-12-01 23:06:01 +01:00
Gustavo Zacarias
6a6acc5b79 openvpn: bump to version 2.3.5
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2014-10-29 21:43:03 +01:00
Gustavo Zacarias
f4936d76b4 openvpn: add hash file
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Acked-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2014-10-19 19:24:58 +02:00
Bernd Kuhls
822a757456 infra: Move --enable/--disable-debug to package/Makefile.in
A lot of packages ignored BR2_ENABLE_DEBUG. This patch simplifies the handling of
this option by adding the corresponding configure option to the global Makefile
for target packages.

For host packages --disable-debug is added to the global Makefile.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2014-10-19 17:07:14 +02:00
Thomas De Schampheleire
aaffd209fa packages: rename FOO_CONF_OPT into FOO_CONF_OPTS
To be consistent with the recent change of FOO_MAKE_OPT into FOO_MAKE_OPTS,
make the same change for FOO_CONF_OPT.

Sed command used:
   find * -type f | xargs sed -i 's#_CONF_OPT\>#&S#g'

Signed-off-by: Thomas De Schampheleire <thomas.de.schampheleire@gmail.com>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2014-10-04 18:54:16 +02:00
Gustavo Zacarias
93d2377781 openvpn: disable plugins for static builds
Fixes:
http://autobuild.buildroot.net/results/082/08295cdcb3d14198bc7fbddec89d6fead946afba/

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2014-07-09 15:46:33 +02:00
Simon Dawson
0be303cacc replace references to Busybox with BusyBox
The correct capitalised form appears to be "BusyBox" rather than "Busybox";
fix all references to the latter form. (Most such references occur in the
manual and in commentary in package makefiles.)

Signed-off-by: Simon Dawson <spdawson@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2014-06-01 23:58:43 +02:00
Gustavo Zacarias
63bf62a473 openvpn: bump to version 2.3.4
Fixes TLS version interoperability issues.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2014-05-14 09:24:43 +02:00
Gustavo Zacarias
b5fa54ecf5 openvpn: bump to version 2.3.3
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2014-04-15 21:54:09 +02:00