writing strongswan mk file - what to do with all those dirs?

[jpsollie]

as stated in a previous discussion - I'm trying to integrate strongswan into freetz as it looks a lot better than default AVM IPSEC tunnel config (IKEv2, sha512, dh groups, ipv6, etc ...).
I think these options would be fine in the config script:

$(PKG)_CONFIGURE_OPTIONS += --sysconfdir=/mod/etc/
$(PKG)_CONFIGURE_OPTIONS += --enable-ikev1
$(PKG)_CONFIGURE_OPTIONS += --enable-ikev2
$(PKG)_CONFIGURE_OPTIONS += --disable-unbound
$(PKG)_CONFIGURE_OPTIONS += --disable-systemd
$(PKG)_CONFIGURE_OPTIONS += --disable-tss-trousers
$(PKG)_CONFIGURE_OPTIONS += --disable-tss-tss2
$(PKG)_CONFIGURE_OPTIONS += --disable-rc2
$(PKG)_CONFIGURE_OPTIONS += --disable-constraints
$(PKG)_CONFIGURE_OPTIONS += --disable-pkcs1
$(PKG)_CONFIGURE_OPTIONS += --disable-sshkey
$(PKG)_CONFIGURE_OPTIONS += --disable-fips-prf
$(PKG)_CONFIGURE_OPTIONS += --disable-gmp
$(PKG)_CONFIGURE_OPTIONS += --enable-openssl
$(PKG)_CONFIGURE_OPTIONS += --disable-stroke
$(PKG)_CONFIGURE_OPTIONS += --disable-counters
$(PKG)_CONFIGURE_OPTIONS += --disable-nonce
$(PKG)_CONFIGURE_OPTIONS += --disable-x509
$(PKG)_CONFIGURE_OPTIONS += --disable-pgp
$(PKG)_CONFIGURE_OPTIONS += --disable-dnskey
$(PKG)_CONFIGURE_OPTIONS += --disable-drbg
$(PKG)_CONFIGURE_OPTIONS += --with-ipsecdir="$($(PKG)_DEST_DIR)/usr/sbin/"
$(PKG)_CONFIGURE_OPTIONS += --enable-monolithic

(off course, I could eventually expand it in further revisions, but let's stick to the basics right now).
Anyway, the setup creates a lot of libraries + config files + executables in src/(dir)/(file), which should be put somewhat like this:

./etc/ipsec.secrets
./etc/strongswan.conf
./etc/strongswan.d/charon/openssl.conf
./etc/strongswan.d/charon/dnskey.conf
./etc/strongswan.d/charon/socket-dynamic.conf
./etc/strongswan.d/charon/sha2.conf
./etc/strongswan.d/charon/fips-prf.conf
./etc/strongswan.d/charon/md5.conf
./etc/strongswan.d/charon/des.conf
./etc/strongswan.d/charon/xcbc.conf
./etc/strongswan.d/charon/hmac.conf
./etc/strongswan.d/charon/random.conf
./etc/strongswan.d/charon/revocation.conf
./etc/strongswan.d/charon/counters.conf
./etc/strongswan.d/charon/cmac.conf
./etc/strongswan.d/charon/attr.conf
./etc/strongswan.d/charon/sha1.conf
./etc/strongswan.d/charon/vici.conf
./etc/strongswan.d/charon/pkcs7.conf
./etc/strongswan.d/charon/pkcs8.conf
./etc/strongswan.d/charon/nonce.conf
./etc/strongswan.d/charon/pkcs12.conf
./etc/strongswan.d/charon/drbg.conf
./etc/strongswan.d/charon/updown.conf
./etc/strongswan.d/charon/pgp.conf
./etc/strongswan.d/charon/rc2.conf
./etc/strongswan.d/charon/x509.conf
./etc/strongswan.d/charon/pem.conf
./etc/strongswan.d/charon/curve25519.conf
./etc/strongswan.d/charon/pkcs1.conf
./etc/strongswan.d/charon/socket-default.conf
./etc/strongswan.d/charon/kernel-netlink.conf
./etc/strongswan.d/charon/xauth-generic.conf
./etc/strongswan.d/charon/resolve.conf
./etc/strongswan.d/charon/stroke.conf
./etc/strongswan.d/charon/aes.conf
./etc/strongswan.d/charon/pubkey.conf
./etc/strongswan.d/charon/sshkey.conf
./etc/strongswan.d/pki.conf
./etc/strongswan.d/swanctl.conf
./etc/strongswan.d/scepclient.conf
./etc/strongswan.d/starter.conf
./etc/strongswan.d/charon-logging.conf
./etc/strongswan.d/charon.conf
./etc/swanctl/swanctl.conf
./etc/ipsec.conf
./usr/lib64/ipsec/libcharon.la
./usr/lib64/ipsec/libcharon.so.0.0.0
./usr/lib64/ipsec/libstrongswan.la
./usr/lib64/ipsec/libvici.so.0.0.0
./usr/lib64/ipsec/libvici.la
./usr/lib64/ipsec/libstrongswan.so.0.0.0
./usr/libexec/ipsec/_updown
./usr/libexec/ipsec/charon
./usr/libexec/ipsec/stroke
./usr/libexec/ipsec/scepclient
./usr/libexec/ipsec/_copyright
./usr/libexec/ipsec/xfrmi
./usr/libexec/ipsec/starter
./usr/bin/pki
./usr/sbin/ipsec
./usr/sbin/swanctl

so, a few questions:
a) what should I do with all those config files? most of them can be narrowed down to ipsec.conf, swanctl.conf and strongswan.conf. ipsec.secrets is something to configure via a yet-to-be-written web frontend, and subdirs could be merged with appropriate file in /etc (I guess)
b) what should I do with all those libs + binaries? strongswan has 2 options which could help placing them, but what's a good location?

  --with-ipsecdir=arg     set installation path for ipsec tools (default: ${libexecdir%/}/ipsec).
  --with-ipseclibdir=arg  set installation path for ipsec libraries (default:  ${libdir%/}/ipsec).

also: when playing a bit with the options, and running make install, eg:
$(SUBMAKE1) -C $(STRONGSWAN_DIR)/src/charon install DESTDIR="$(STRONGSWAN_DEST_DIR)"

it replies with:

libtool: error: 'packages/target-mips_gcc-8.3.0_uClibc-1.0.36-nptl_kernel-4.9/strongswan-5.9.1/rootpackages/target-mips_gcc-8.3.0_uClibc-1.0.36-nptl_kernel-4.9/strongswan-5.9.1/root/usr/sbin' must be an absolute directory name

• how do I modify the install command to work around this error?
• what about the static archives in usr/lib/ipsec/ ?

[fda77]

You found https://freetz-ng.github.io/freetz-ng/wiki/60_Development/ ? Old but should still help.
Why dont you use Wireguard or OpenVPN?
Because of the dir name "lib64" i think somthing is wrong, there is no x64 Fritzbox. There are many config files, but with freetz you can not alter them, only in /tmp/flash are 32KB for everything of freetz So you need to generate them if they are all needed (later)
A good location for files? Just see the other pckages - the source is the doku :)
"must be an absolute directory name": You need the full path name, which start with a "/"
The "installation path" does not matter, as the files are copied from source/ to packages/ directory depending on your .mk file

[jpsollie]

You found https://freetz-ng.github.io/freetz-ng/wiki/60_Development/ ? Old but should still help.

I read that one, I was simply a bit confused
Yes, I did, but as you said: it's old but I never found out what to do with all config files I do not intend to use.

Why dont you use Wireguard or OpenVPN?

https://openvpn.net/faq/openvpn-compatibility/
sorry, but the enterprise firewall @ work requires static IPSEC tunnel

Because of the dir name "lib64" i think somthing is wrong, there is no x64 Fritzbox.

I'm sorry for the confusion: this was simply to create a list of files in gentoo with the options above so I could at least estimate what I'd have to install.

A good location for files? Just see the other pckages - the source is the doku :)

The source is confusing when you eat all docs at once. But it's definitely a good thing.
In meantime, I managed to create a mk file which should work (at least works with make strongswan-precompiled), would you mind taking a look at it and tell me whether this is a good start or not even close?

strongswan.zip

[fda77]

So 1st your package should build in in source/ . And then the needed! files should be copied to packages/
To find an example of a package with libs: grep LIBR make/*/*mk

[jpsollie]

do the libs in /usr/lib also need to be copied to /packages? because that's not really clear to me

[fda77]

Are they all needed? If they whould be in the .image, they have to be copied to packages/.
With freetz there is a "hidden" dir /usr/lib/freetz/ with libs. The AVM binaries dont find& use them

[jpsollie]

Are they all needed?

no idea, actually.
I assume the .la files contain the same functionality compared to the .so files, so it should be fine without those. However, as charon-cmd and ipsec are apparently not elf files, they might need the .la archive

If they whould be in the .image, they have to be copied to packages/.
With freetz there is a "hidden" dir /usr/lib/freetz/ with libs. The AVM binaries dont find& use them

Thank you! I'll try to make it work

[fda77]

The .la files are not needed on the Fritzbox, they are used by libtool