[oe-commits] Bian Naimeng : openvpn: upgrade to 2.3.6.

[git at git.openembedded.org]

Module: meta-openembedded.git
Branch: master
Commit: 3add4db0fc379ef2bb10d27f212f380411f302a5
URL:    http://git.openembedded.org/?p=meta-openembedded.git&a=commit;h=3add4db0fc379ef2bb10d27f212f380411f302a5

Author: Bian Naimeng <biannm at cn.fujitsu.com>
Date:   Mon Dec 15 14:29:00 2014 +0800

openvpn: upgrade to 2.3.6.

The purpose of this patch as below.

 1. upgrade openvpn to 2.3.6 in order to fix CVE-2014-8104

 2. enable systemd

 3. provide new packages named ${PN}-sample to help user create config file
    easily and check whether is openvpn work.

Signed-off-by: Bian Naimeng <biannm at cn.fujitsu.com>
Signed-off-by: Martin Jansa <Martin.Jansa at gmail.com>

---

 .../openvpn/openvpn/openvpn at .service               | 12 +++++
 .../recipes-support/openvpn/openvpn_2.3.4.bb       | 33 ------------
 .../recipes-support/openvpn/openvpn_2.3.6.bb       | 63 ++++++++++++++++++++++
 3 files changed, 75 insertions(+), 33 deletions(-)

diff --git a/meta-networking/recipes-support/openvpn/openvpn/openvpn at .service b/meta-networking/recipes-support/openvpn/openvpn/openvpn at .service
new file mode 100644
index 0000000..358dcb7
--- /dev/null
+++ b/meta-networking/recipes-support/openvpn/openvpn/openvpn at .service
@@ -0,0 +1,12 @@
+[Unit]
+Description=OpenVPN Robust And Highly Flexible Tunneling Application On %I
+After=syslog.target network.target
+
+[Service]
+PrivateTmp=true
+Type=forking
+PIDFile=/var/run/openvpn/%i.pid
+ExecStart=/usr/sbin/openvpn --daemon --writepid /var/run/openvpn/%i.pid --cd /etc/openvpn/ --config %i.conf
+
+[Install]
+WantedBy=multi-user.target
diff --git a/meta-networking/recipes-support/openvpn/openvpn_2.3.4.bb b/meta-networking/recipes-support/openvpn/openvpn_2.3.4.bb
deleted file mode 100644
index 1fb722a..0000000
--- a/meta-networking/recipes-support/openvpn/openvpn_2.3.4.bb
+++ /dev/null
@@ -1,33 +0,0 @@
-SUMMARY = "A full-featured SSL VPN solution via tun device."
-HOMEPAGE = "http://openvpn.sourceforge.net"
-SECTION = "console/network"
-LICENSE = "GPLv2"
-LIC_FILES_CHKSUM = "file://COPYING;md5=5aac200199fde47501876cba7263cb0c"
-DEPENDS = "lzo openssl iproute2 ${@base_contains('DISTRO_FEATURES', 'pam', 'libpam', '', d)}"
-
-inherit autotools
-
-SRC_URI = "http://swupdate.openvpn.org/community/releases/openvpn-${PV}.tar.gz \
-           file://openvpn"
-
-SRC_URI[md5sum] = "04d47237907faabe9d046970ffe44b2e"
-SRC_URI[sha256sum] = "af506d5f48568fa8d2f2435cb3fad35f9a9a8f263999ea6df3ba296960cec85a"
-
-CFLAGS += "-fno-inline"
-
-# I want openvpn to be able to read password from file (hrw)
-EXTRA_OECONF += "--enable-password-save --enable-iproute2"
-EXTRA_OECONF += "${@base_contains('DISTRO_FEATURES', 'pam', '', '--disable-plugin-auth-pam', d)}"
-
-# Explicitly specify IPROUTE to bypass the configure-time check for /sbin/ip on the host.
-EXTRA_OECONF += "IPROUTE=/sbin/ip"
-
-do_install_append() {
-    install -d ${D}/${sysconfdir}/init.d
-    install -d ${D}/${sysconfdir}/openvpn
-    install -m 755 ${WORKDIR}/openvpn ${D}/${sysconfdir}/init.d
-}
-
-RRECOMMENDS_${PN} = "kernel-module-tun"
-
-FILES_${PN}-dbg += "${libdir}/openvpn/plugins/.debug"
diff --git a/meta-networking/recipes-support/openvpn/openvpn_2.3.6.bb b/meta-networking/recipes-support/openvpn/openvpn_2.3.6.bb
new file mode 100644
index 0000000..58ddcc8
--- /dev/null
+++ b/meta-networking/recipes-support/openvpn/openvpn_2.3.6.bb
@@ -0,0 +1,63 @@
+SUMMARY = "A full-featured SSL VPN solution via tun device."
+HOMEPAGE = "http://openvpn.sourceforge.net"
+SECTION = "console/network"
+LICENSE = "GPLv2"
+LIC_FILES_CHKSUM = "file://COPYING;md5=5aac200199fde47501876cba7263cb0c"
+DEPENDS = "lzo openssl iproute2 ${@base_contains('DISTRO_FEATURES', 'pam', 'libpam', '', d)}"
+
+inherit autotools systemd
+
+SRC_URI = "http://swupdate.openvpn.org/community/releases/openvpn-${PV}.tar.gz \
+           file://openvpn \
+           file://openvpn@.service "
+
+SRC_URI[md5sum] = "6ca03fe0fd093e0d01601abee808835c"
+SRC_URI[sha256sum] = "7baed2ff39c12e1a1a289ec0b46fcc49ff094ca58b8d8d5f29b36ac649ee5b26"
+
+SYSTEMD_SERVICE_${PN} += "openvpn at loopback-server.service openvpn at loopback-client.service"
+SYSTEMD_AUTO_ENABLE = "disable"
+
+CFLAGS += "-fno-inline"
+
+# I want openvpn to be able to read password from file (hrw)
+EXTRA_OECONF += "--enable-password-save --enable-iproute2"
+EXTRA_OECONF += "${@base_contains('DISTRO_FEATURES', 'pam', '', '--disable-plugin-auth-pam', d)}"
+
+# Explicitly specify IPROUTE to bypass the configure-time check for /sbin/ip on the host.
+EXTRA_OECONF += "IPROUTE=/sbin/ip"
+
+do_install_append() {
+    install -d ${D}/${sysconfdir}/init.d
+    install -m 755 ${WORKDIR}/openvpn ${D}/${sysconfdir}/init.d
+
+    install -d ${D}/${sysconfdir}/openvpn
+    install -d ${D}/${sysconfdir}/openvpn/sample
+    install -m 755 ${S}/sample/sample-config-files/loopback-server  ${D}${sysconfdir}/openvpn/sample/loopback-server.conf
+    install -m 755 ${S}/sample/sample-config-files/loopback-client  ${D}${sysconfdir}/openvpn/sample/loopback-client.conf
+    install -dm 755 ${D}${sysconfdir}/openvpn/sample/sample-keys
+    install -m 644 ${S}/sample/sample-keys/* ${D}${sysconfdir}/openvpn/sample/sample-keys
+
+    if ${@base_contains('DISTRO_FEATURES','systemd','true','false',d)}; then
+        install -d ${D}/${systemd_unitdir}/system
+        install -m 644 ${WORKDIR}/openvpn at .service ${D}/${systemd_unitdir}/system
+        install -m 644 ${WORKDIR}/openvpn at .service ${D}/${systemd_unitdir}/system/openvpn at loopback-server.service
+        install -m 644 ${WORKDIR}/openvpn at .service ${D}/${systemd_unitdir}/system/openvpn at loopback-client.service
+
+        install -d ${D}/${localstatedir}
+        install -d ${D}/${localstatedir}/lib
+        install -d -m 710 ${D}/${localstatedir}/lib/openvpn
+        install -d -m 755 ${D}/${localstatedir}/run/
+        install -d -m 755 ${D}/${localstatedir}/run/openvpn
+    fi
+}
+
+PACKAGES =+ " ${PN}-sample "
+
+RRECOMMENDS_${PN} = "kernel-module-tun"
+
+FILES_${PN}-dbg += "${libdir}/openvpn/plugins/.debug"
+FILES_${PN} += "${systemd_unitdir}/system/openvpn at .service \
+                /run"
+FILES_${PN}-sample += "${systemd_unitdir}/system/openvpn at loopback-server.service \
+                       ${systemd_unitdir}/system/openvpn at loopback-client.service \
+                       ${sysconfdir}/openvpn/sample/"