push sheeet

pkgs/tools/networking/openvpn/auth-ldap-fix-conftest.patch

@@ -0,0 +1,36 @@
+diff --git a/aclocal.m4 b/aclocal.m4
+index e5b7dbf..01cecf1 100644
+--- a/aclocal.m4
++++ b/aclocal.m4
+@@ -73,6 +73,7 @@ AC_DEFUN([OD_OBJC_RUNTIME],[
+ 				AC_LANG_PROGRAM([
+ 						#include <objc/objc.h>
+ 						#include <objc/Object.h>
++						#include <stdio.h>
+ 					], [
+ 						Object *obj = @<:@Object alloc@:>@;
+ 						puts(@<:@obj name@:>@);
+@@ -94,6 +95,7 @@ AC_DEFUN([OD_OBJC_RUNTIME],[
+ 					AC_LANG_PROGRAM([
+ 							#include <objc/objc.h>
+ 							#include <objc/Object.h>
++							#include <stdio.h>
+ 						], [
+ 							Object *obj = @<:@Object alloc@:>@;
+ 							puts(@<:@obj name@:>@);
+@@ -131,6 +133,7 @@ AC_DEFUN([OD_OBJC_RUNTIME],[
+ 					AC_LANG_PROGRAM([
+ 							#include <objc/objc.h>
+ 							#include <objc/objc-api.h>
++							#include <stdio.h>
+ 						], [
+ 							id class = objc_lookUpClass("Object");
+ 							id obj = @<:@class alloc@:>@;
+@@ -162,6 +165,7 @@ AC_DEFUN([OD_OBJC_RUNTIME],[
+ 							#else
+ 							#include <objc/objc-api.h>
+ 							#endif
++							#include <stdio.h>
+ 						], [
+ 							#ifdef __GNU_LIBOBJC_
+ 							Class class = objc_lookUpClass("Object");

pkgs/tools/networking/openvpn/dco.patch

@@ -0,0 +1,25 @@
+diff --git a/src/openvpn/ovpn_dco_linux.h b/src/openvpn/ovpn_dco_linux.h
+index 73e19b5..46c2786 100644
+--- a/src/openvpn/ovpn_dco_linux.h
++++ b/src/openvpn/ovpn_dco_linux.h
+@@ -237,20 +237,4 @@ enum ovpn_netlink_packet_attrs {
+ 	OVPN_PACKET_ATTR_MAX = __OVPN_PACKET_ATTR_AFTER_LAST - 1,
+ };
+ 
+-enum ovpn_ifla_attrs {
+-	IFLA_OVPN_UNSPEC = 0,
+-	IFLA_OVPN_MODE,
+-
+-	__IFLA_OVPN_AFTER_LAST,
+-	IFLA_OVPN_MAX = __IFLA_OVPN_AFTER_LAST - 1,
+-};
+-
+-enum ovpn_mode {
+-	__OVPN_MODE_FIRST = 0,
+-	OVPN_MODE_P2P = __OVPN_MODE_FIRST,
+-	OVPN_MODE_MP,
+-
+-	__OVPN_MODE_AFTER_LAST,
+-};
+-
+ #endif /* _UAPI_LINUX_OVPN_DCO_H_ */

pkgs/tools/networking/openvpn/default.nix

@@ -0,0 +1,93 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  libcap_ng,
+  libnl,
+  lz4,
+  lzo,
+  openssl,
+  pam,
+  useSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
+  systemd,
+  update-systemd-resolved,
+  pkcs11Support ? false,
+  pkcs11helper,
+  nixosTests,
+  unixtools,
+}:
+
+let
+  inherit (lib) optional optionals optionalString;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "openvpn";
+  version = "2.6.14";
+
+  src = fetchurl {
+    url = "https://swupdate.openvpn.net/community/releases/openvpn-${finalAttrs.version}.tar.gz";
+    hash = "sha256-nramYYNS+ee3canTiuFjG17f7tbUAjPiQ+YC3fIZXno=";
+  };
+
+  # Effectively a backport of https://github.com/OpenVPN/openvpn/commit/1d3c2b67a73a0aa011c13e62f876d24e49d41df0
+  # to fix build on linux-headers 6.16.
+  # FIXME: remove in next update
+  patches = [
+    ./dco.patch
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    unixtools.route
+    unixtools.ifconfig
+  ];
+
+  buildInputs = [
+    lz4
+    lzo
+    openssl
+  ]
+  ++ optionals stdenv.hostPlatform.isLinux [
+    libcap_ng
+    libnl
+    pam
+  ]
+  ++ optional useSystemd systemd
+  ++ optional pkcs11Support pkcs11helper;
+
+  configureFlags =
+    optional useSystemd "--enable-systemd"
+    ++ optional pkcs11Support "--enable-pkcs11"
+    ++ optional stdenv.hostPlatform.isDarwin "--disable-plugin-auth-pam";
+
+  # We used to vendor the update-systemd-resolved script inside libexec,
+  # but a separate package was made, that uses libexec/openvpn. Copy it
+  # into libexec in case any consumers expect it to be there even though
+  # they should use the update-systemd-resolved package instead.
+  postInstall = ''
+    mkdir -p $out/share/doc/openvpn/examples
+    cp -r sample/sample-{config-files,keys,scripts}/ $out/share/doc/openvpn/examples
+  ''
+  + optionalString useSystemd ''
+    install -Dm555 -t $out/libexec ${update-systemd-resolved}/libexec/openvpn/*
+  '';
+
+  enableParallelBuilding = true;
+
+  passthru.tests = {
+    inherit (nixosTests) initrd-network-openvpn systemd-initrd-networkd-openvpn;
+  };
+
+  meta = with lib; {
+    description = "Robust and highly flexible tunneling application";
+    downloadPage = "https://openvpn.net/community-downloads/";
+    homepage = "https://openvpn.net/";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ peterhoeg ];
+    platforms = platforms.unix;
+    mainProgram = "openvpn";
+  };
+})

pkgs/tools/networking/openvpn/openvpn-auth-ldap.nix

@@ -0,0 +1,77 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchpatch2,
+  autoreconfHook,
+  gnustep-base,
+  re2c,
+  openldap,
+  openssl,
+  openvpn,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "openvpn-auth-ldap";
+  version = "2.0.4";
+
+  src = fetchFromGitHub {
+    owner = "threerings";
+    repo = "openvpn-auth-ldap";
+    rev = "auth-ldap-${version}";
+    sha256 = "1j30sygj8nm8wjqxzpb7pfzr3dxqxggswzxd7z5yk7y04c0yp1hb";
+  };
+
+  patches = [
+    ./auth-ldap-fix-conftest.patch
+    (fetchpatch2 {
+      name = "fix-cve-2024-28820";
+      url = "https://patch-diff.githubusercontent.com/raw/threerings/openvpn-auth-ldap/pull/92.patch";
+      hash = "sha256-SXuo1D/WywKO5hCsmoeDdTsR7EelxFxJAKmlAQJ6vuE=";
+    })
+  ];
+
+  # clang > 17 dropped support for `-export-dynamic` but `-rdynamic` does the
+  # same thing
+  postPatch = ''
+    substituteInPlace platform.m4 \
+      --replace-fail -export-dynamic -rdynamic
+  '';
+
+  nativeBuildInputs = [
+    autoreconfHook
+    re2c
+  ];
+
+  buildInputs = [
+    openldap
+    openssl
+    openvpn
+    gnustep-base
+  ];
+
+  configureFlags = [
+    "--with-objc-runtime=GNU"
+    "--with-openvpn=${openvpn}/include"
+    "--libdir=$(out)/lib/openvpn"
+  ];
+
+  doCheck = true;
+
+  preInstall = ''
+    mkdir -p $out/lib/openvpn $out/share/doc/openvpn/examples
+    cp README.md $out/share/doc/openvpn/
+    cp auth-ldap.conf $out/share/doc/openvpn/examples/
+  '';
+
+  meta = with lib; {
+    description = "LDAP authentication plugin for OpenVPN";
+    homepage = "https://github.com/threerings/openvpn-auth-ldap";
+    license = [
+      licenses.asl20
+      licenses.bsd3
+    ];
+    maintainers = [ maintainers.benley ];
+    platforms = platforms.unix;
+  };
+}

pkgs/tools/networking/openvpn/openvpn_learnaddress.nix

@@ -0,0 +1,47 @@
+{
+  lib,
+  stdenv,
+  fetchgit,
+  makeWrapper,
+  coreutils,
+  gawk,
+  util-linux,
+}:
+
+stdenv.mkDerivation {
+  pname = "openvpn-learnaddress";
+  version = "unstable-2013-10-21";
+
+  src = fetchgit {
+    url = "https://gist.github.com/4058733.git";
+    rev = "19b03c3beb0190df46ea07bf4b68244acb8eae80";
+    sha256 = "16pcyvyhwsx34i0cjkkx906lmrwdd9gvznvqdwlad4ha8l8f8z42";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [
+    coreutils
+    gawk
+    util-linux
+  ];
+
+  installPhase = ''
+    install -Dm555 ovpn-learnaddress $out/libexec/openvpn/openvpn-learnaddress
+
+    wrapProgram $out/libexec/openvpn/openvpn-learnaddress \
+        --prefix PATH : ${
+          lib.makeBinPath [
+            coreutils
+            gawk
+            util-linux
+          ]
+        }
+  '';
+
+  meta = {
+    description = "Openvpn learn-address script to manage a hosts-like file";
+    homepage = "https://gist.github.com/offlinehacker/4058733/";
+    maintainers = [ lib.maintainers.offline ];
+    platforms = lib.platforms.unix;
+  };
+}

pkgs/tools/networking/openvpn/update-resolv-conf.nix

@@ -0,0 +1,48 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  makeWrapper,
+  openresolv,
+  coreutils,
+  systemd,
+}:
+
+let
+  binPath = lib.makeBinPath [
+    coreutils
+    openresolv
+    systemd
+  ];
+
+in
+stdenv.mkDerivation {
+  pname = "update-resolv-conf";
+  version = "unstable-2017-06-21";
+
+  src = fetchFromGitHub {
+    owner = "masterkorp";
+    repo = "openvpn-update-resolv-conf";
+    rev = "43093c2f970bf84cd374e18ec05ac6d9cae444b8";
+    sha256 = "1lf66bsgv2w6nzg1iqf25zpjf4ckcr45adkpgdq9gvhkfnvlp8av";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    install -Dm555 update-resolv-conf.sh $out/libexec/openvpn/update-resolv-conf
+    install -Dm555 update-systemd-network.sh $out/libexec/openvpn/update-systemd-network
+
+    for i in $out/libexec/openvpn/*; do
+      wrapProgram $i --prefix PATH : ${binPath}
+    done
+  '';
+
+  meta = with lib; {
+    description = "Script to update your /etc/resolv.conf with DNS settings that come from the received push dhcp-options";
+    homepage = "https://github.com/masterkorp/openvpn-update-resolv-conf/";
+    maintainers = [ ];
+    license = licenses.gpl2Only;
+    platforms = platforms.unix;
+  };
+}

pkgs/tools/networking/openvpn/update-systemd-resolved.nix

@@ -0,0 +1,51 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  iproute2,
+  runtimeShell,
+  systemd,
+  coreutils,
+  util-linux,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "update-systemd-resolved";
+  # when updating this, check if additional binaries need injecting into PATH
+  version = "1.3.0";
+
+  src = fetchFromGitHub {
+    owner = "jonathanio";
+    repo = "update-systemd-resolved";
+    rev = "v${version}";
+    hash = "sha256-lYJTR3oBmpENcqNHa9PFXsw7ly6agwjBWf4UXf1d8Kc=";
+  };
+
+  # set SCRIPT_NAME in case we are wrapped and inject PATH
+  patches = [
+    ./update-systemd-resolved.patch
+  ];
+
+  PREFIX = "${placeholder "out"}/libexec/openvpn";
+
+  postInstall = ''
+    substituteInPlace ${PREFIX}/update-systemd-resolved \
+      --subst-var-by PATH ${
+        lib.makeBinPath [
+          coreutils
+          iproute2
+          runtimeShell
+          systemd
+          util-linux
+        ]
+      }
+  '';
+
+  meta = with lib; {
+    description = "Helper script for OpenVPN to directly update the DNS settings of a link through systemd-resolved via DBus";
+    homepage = "https://github.com/jonathanio/update-systemd-resolved";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ eadwu ];
+    platforms = platforms.linux;
+  };
+}

pkgs/tools/networking/openvpn/update-systemd-resolved.patch

@@ -0,0 +1,26 @@
+diff --git a/Makefile b/Makefile
+index 524b6b7..8a880f1 100644
+--- a/Makefile
++++ b/Makefile
+@@ -9,7 +9,6 @@ all: install info
+ 
+ install:
+ 	@install -Dm750 $(SRC) $(DEST)
+-	@install -Dm644 $(SRC).conf $(DEST).conf
+ 
+ info:
+ 	@printf 'Successfully installed %s to %s.\n' $(SRC) $(DEST)
+diff --git a/update-systemd-resolved b/update-systemd-resolved
+index 1452e1a..39641cb 100755
+--- a/update-systemd-resolved
++++ b/update-systemd-resolved
+@@ -29,7 +29,8 @@
+ DBUS_DEST="org.freedesktop.resolve1"
+ DBUS_NODE="/org/freedesktop/resolve1"
+ 
+-SCRIPT_NAME="${BASH_SOURCE[0]##*/}"
++PATH="@PATH@"
++SCRIPT_NAME="update-systemd-resolved"
+ 
+ log() {
+   logger -s -t "$SCRIPT_NAME" "$@"