%define _hardened_build 1 %global snap_tstamp 20200719 %global commit 4cabd28a77116ab3926f81258af9bdb342e0336a %global shortcommit %(c=%{commit}; echo ${c:0:7}) # Build conditionals # tests_long - Enabled by default, enables long running tests in %%check %bcond_without tests_long Name: openvpn Version: 2.5 Release: %{snap_tstamp}git%{shortcommit}%{?dist} Summary: A full-featured SSL VPN solution URL: https://community.openvpn.net/ Source0: https://github.com/OpenVPN/openvpn/archive/%{commit}/openvpn-%{shortcommit}.tar.gz Source2: roadwarrior-server.conf Source3: roadwarrior-client.conf Source4: openvpn.init Patch1: 0001-Change-the-default-cipher-to-AES-256-GCM-for-server-.patch Patch50: openvpn-2.4-change-tmpfiles-permissions.patch License: GPLv2 BuildRequires: gcc BuildRequires: automake BuildRequires: autoconf BuildRequires: libtool BuildRequires: gettext BuildRequires: lzo-devel BuildRequires: lz4-devel BuildRequires: openssl-devel BuildRequires: pkcs11-helper-devel >= 1.11 BuildRequires: pam-devel BuildRequires: libselinux-devel BuildRequires: libcmocka-devel %if 0%{?rhel} > 6 || 0%{?fedora} > 0 # For the perl_default_filter macro BuildRequires: perl-macros BuildRequires: autoconf-archive BuildRequires: systemd-devel BuildRequires: systemd %{?systemd_requires} %endif # For /sbin/ip. Requires(pre): /usr/sbin/useradd %if 0%{?rhel} > 7 || 0%{?fedora} > 29 BuildRequires: python3-docutils %else # We cannot use python36-docutils on RHEL-7 as # the ./configure script does not currently find # the rst2man-3 executable, it only looks for rst2man BuildRequires: python-docutils %endif # Filter out the perl(Authen::PAM) dependency. # No perl dependency is really needed at all. %{?perl_default_filter} %description OpenVPN is a robust and highly flexible tunneling application that uses all of the encryption, authentication, and certification features of the OpenSSL library to securely tunnel IP networks over a single UDP or TCP port. It can use the Marcus Franz Xaver Johannes Oberhumers LZO library for compression. %package devel Summary: Development headers and examples for OpenVPN plug-ins %description devel OpenVPN can be extended through the --plugin option, which provides possibilities to add specialized authentication, user accounting, packet filtering and related features. These plug-ins need to be written in C and provides a more low-level and information rich access to similar features as the various script-hooks. %prep %setup -q -n openvpn-%{commit} %patch1 -p1 -b .ch_default_cipher %patch50 -p1 echo "define([PRODUCT_NAME], [OpenVPN])" > version.m4 echo "define([PRODUCT_VERSION], [%{version}-%{release}])" >> version.m4 echo "define([PRODUCT_GUIVERSION], [copr:%{version}-%{release}])" >> version.m4 echo "define([PRODUCT_TARNAME], [openvpn])" >> version.m4 echo "define([PRODUCT_BUGREPORT], [openvpn-devel@lists.sourceforge.net])" >> version.m4 echo "define([PRODUCT_VERSION_MAJOR], [2])" >> version.m4 echo "define([PRODUCT_VERSION_MINOR], [5])" >> version.m4 echo "define([PRODUCT_VERSION_PATCH], [_git%{shortcommit}])" >> version.m4 autoreconf -vi # %%doc items shouldn't be executable. find contrib sample -type f -perm /100 \ -exec chmod a-x {} \; %build %configure \ --with-crypto-library=openssl \ --enable-pkcs11 \ --enable-selinux \ --enable-x509-alt-username \ --enable-async-push \ --docdir=%{_pkgdocdir} \ %if 0%{?rhel} > 6 || 0%{?fedora} > 0 --enable-systemd \ SYSTEMD_UNIT_DIR=%{_unitdir} \ TMPFILES_DIR=%{_tmpfilesdir} %endif %{__make} %{?_smp_mflags} %check # Test Crypto: ./src/openvpn/openvpn --genkey --secret key ./src/openvpn/openvpn --cipher aes-128-cbc --test-crypto --secret key ./src/openvpn/openvpn --cipher aes-256-cbc --test-crypto --secret key ./src/openvpn/openvpn --cipher aes-128-gcm --test-crypto --secret key ./src/openvpn/openvpn --cipher aes-256-gcm --test-crypto --secret key pushd tests/unit_tests %{__make} %{?_smp_mflags} check popd %if %{with tests_long} # Randomize ports for tests to avoid conflicts on the build servers. cport=$[ 50000 + ($RANDOM % 15534) ] sport=$[ $cport + 1 ] sed -e 's/^\(rport\) .*$/\1 '$sport'/' \ -e 's/^\(lport\) .*$/\1 '$cport'/' \ < sample/sample-config-files/loopback-client \ > %{_tmppath}/%{name}-%{version}-%{release}-%(%{__id_u})-loopback-client sed -e 's/^\(rport\) .*$/\1 '$cport'/' \ -e 's/^\(lport\) .*$/\1 '$sport'/' \ < sample/sample-config-files/loopback-server \ > %{_tmppath}/%{name}-%{version}-%{release}-%(%{__id_u})-loopback-server pushd sample # Test SSL/TLS negotiations (runs for 2 minutes): ../src/openvpn/openvpn --config \ %{_tmppath}/%{name}-%{version}-%{release}-%(%{__id_u})-loopback-client & ../src/openvpn/openvpn --config \ %{_tmppath}/%{name}-%{version}-%{release}-%(%{__id_u})-loopback-server wait popd rm -f %{_tmppath}/%{name}-%{version}-%{release}-%(%{__id_u})-loopback-client \ %{_tmppath}/%{name}-%{version}-%{release}-%(%{__id_u})-loopback-server %endif %install %{__make} install DESTDIR=$RPM_BUILD_ROOT find $RPM_BUILD_ROOT -name '*.la' | xargs rm -f mkdir -p -m 0750 $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/client $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/server cp %{SOURCE2} %{SOURCE3} sample/sample-config-files/ # For EL-6 install the sys-v based openvpn init script %if 0%{?rhel} == 6 install -D -m 0755 %{SOURCE4} $RPM_BUILD_ROOT%{_initrddir}/%{name} %endif # Create some directories the OpenVPN package should own %if 0%{?rhel} > 6 || 0%{?fedora} > 0 mkdir -m 0750 -p $RPM_BUILD_ROOT%{_rundir}/%{name}-{client,server} %endif mkdir -m 0770 -p $RPM_BUILD_ROOT%{_sharedstatedir}/%{name} # Package installs into %%{_pkgdocdir} directly # Add various additional files cp -a AUTHORS ChangeLog contrib sample distro/systemd/README.systemd $RPM_BUILD_ROOT%{_pkgdocdir} # Remove some files which does not really belong here rm -f $RPM_BUILD_ROOT%{_pkgdocdir}/sample/Makefile{,.in,.am} rm -f $RPM_BUILD_ROOT%{_pkgdocdir}/contrib/multilevel-init.patch rm -rf $RPM_BUILD_ROOT%{_pkgdocdir}/sample/sample-keys %pre getent group openvpn &>/dev/null || groupadd -r openvpn getent passwd openvpn &>/dev/null || \ /usr/sbin/useradd -r -g openvpn -s /sbin/nologin -c OpenVPN \ -d /etc/openvpn openvpn %post %if 0%{?rhel} > 6 || 0%{?fedora} > 0 %systemd_post openvpn-client@\*.service %systemd_post openvpn-server@\*.service %else /sbin/chkconfig --add %{name} %endif %preun %if 0%{?rhel} > 6 || 0%{?fedora} > 0 %systemd_preun openvpn-client@\*.service %systemd_preun openvpn-server@\*.service %else if [ "$1" = 0 ]; then /sbin/service %{name} stop /sbin/chkconfig --del %{name} fi %endif %postun %if 0%{?rhel} > 6 || 0%{?fedora} > 0 %systemd_postun_with_restart openvpn-client@\*.service %systemd_postun_with_restart openvpn-server@\*.service %systemd_postun_with_restart openvpn@\*.service %else if [ "$1" -ge 1 ]; then /sbin/service %{name} condrestart >/dev/null 2>&1 fi %endif %files %{_pkgdocdir} %exclude %{_pkgdocdir}/README.IPv6 %exclude %{_pkgdocdir}/README.mbedtls %exclude %{_pkgdocdir}/sample/sample-plugins %{_mandir}/man8/%{name}.8* %{_sbindir}/%{name} %{_libdir}/%{name}/ %config %dir %{_sysconfdir}/%{name}/ %config %dir %attr(-,-,openvpn) %{_sysconfdir}/%{name}/client %config %dir %attr(-,-,openvpn) %{_sysconfdir}/%{name}/server %attr(0770,openvpn,openvpn) %{_sharedstatedir}/%{name} %if 0%{?rhel} > 6 || 0%{?fedora} > 0 %attr(0750,-,openvpn) %{_rundir}/%{name}-client %attr(0750,-,openvpn) %{_rundir}/%{name}-server %{_unitdir}/%{name}-client@.service %{_unitdir}/%{name}-server@.service %{_tmpfilesdir}/%{name}.conf %else %{_initrddir}/%{name} %endif %files devel %{_pkgdocdir}/sample/sample-plugins %{_includedir}/openvpn-plugin.h %{_includedir}/openvpn-msg.h %changelog * Sun Jul 19 2020 David Sommerseth - 2.5.20200719git4cabd28 - Update to git master 4cabd28a77116a * Mon Jun 22 2020 David Sommerseth - 2.5.20200622git933b4ab - Update to git master 933b4ab8088918 * Mon May 11 2020 David Sommerseth - 2.5.20200511git42fe3e8 - Update to git master 42fe3e8175822a - Removed the two added quick fix patches, as they are now in the upstream tree - Added cmocka build dependencies for unit tests * Fri May 8 2020 David Sommerseth - 2.5-20200508git042429d - Quick fix: options: Fix failing inline tls-auth/crypt with persist-key - Quick fix: options: Restore --tls-crypt-v2 inline file capability * Thu May 7 2020 David Sommerseth - 2.5-20200507git042429d - Update to git master 042429d3454ca - Run unit tests during the check phase * Fri Apr 24 2020 David Sommerseth - 2.5-20200423git75aa88a - Update to git master 75aa88af774ab * Sun Mar 22 2020 David Sommerseth - 2.5-20200322gite1eb630 - Update to git master e1eb630df1b3e * Thu Mar 5 2020 David Sommerseth - 2.5-20200305git32723d2 - Fix missing packaging of systemd service files on RHEL 7+ and Fedora - Fix missing packaging of sysv init.d script for RHEL 6 * Wed Mar 4 2020 David Sommerseth - 2.5-20200304git32723d2 - Packaging OpenVPN 2.5 git master development snapshot