# Copyright 1999-2007 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
# $Header: $

inherit eutils flag-o-matic autotools linux-info

DESCRIPTION="IPsec-Tools is a port of KAME's IPsec utilities to the Linux-2.6 IPsec implementation."
HOMEPAGE="http://ipsec-tools.sourceforge.net/"
SRC_URI="mirror://sourceforge/${PN}/${P}.tar.bz2"
LICENSE="BSD"
KEYWORDS="~amd64 ~ppc sparc ~x86"
SLOT="0"
IUSE="idea ipv6 pam rc5 readline selinux ldap stats frag dpd gssapi security-context fastquit natt hybrid adminport static shared pic broken-natt"

AT_M4DIR="${S}"

DEPEND="virtual/libc
	!<sys-kernel/linux-headers-2.6
	readline? ( sys-libs/readline )
	pam? ( sys-libs/pam )
	ldap? ( net-nds/openldap )
	gssapi? ( app-crypt/mit-krb5 )
	gssapi? ( app-crypt/libgssapi )
	>=dev-libs/openssl-0.9.6
	iconv? ( virtual/libiconv )"

#	radius? ( net-dialup/gnuradius )

RDEPEND="${DEPEND}
	selinux? ( sec-policy/selinux-ipsec-tools )"

kernel_check() {
	get_version
	if kernel_is 2 6 ; then
		if test "${KV_PATCH}" -ge 19 ; then
		# Just for kernel >=2.6.19
			ebegin "Checking for suitable kernel configuration (Networking | Networking support | Networking options)"

			if use natt ; then
				if ! { linux_chkconfig_present NETFILTER_XT_MATCH_POLICY; } ; then
					ewarn "[NETFILTER_XT_MATCH_POLICY] IPsec policy match support is NOT enabled"
					eerror "${P} won't compile with use nat traversal (USE=natt) until you enable NETFILTER_XT_MATCH_POLICY in your kernel"
					die
				else
					einfo "....[NETFILTER_XT_MATCH_POLICY] IPsec policy match support is enabled :-)"
				fi
			fi

			# {{{ general stuff
			if ! { linux_chkconfig_present XFRM_USER; }; then
				ewarn "[XFRM_USER] Transformation user configuration interface is NOT enabled."
			else
				einfo "....[XFRM_USER] Transformation user configuration interface is enabled :-)"
			fi

			if ! { linux_chkconfig_present NET_KEY; }; then
				ewarn "[NET_KEY] PF_KEY sockets is NOT enabled."
			else
				einfo "....[NET_KEY] PF_KEY sockets is enabled :-)"
			fi
			# }}}
			# {{{ IPv4 stuff
			if ! { linux_chkconfig_present INET_IPCOMP; }; then
				ewarn "[INET_IPCOMP] IP: IPComp transformation is NOT enabled"
			else
				einfo "....[INET_IPCOMP] IP: IPComp transformation is enabled :-)"
			fi

			if ! { linux_chkconfig_present INET_AH; }; then
				ewarn "[INET_AH] AH Transformation is NOT enabled."
			else
				einfo "....[INET_AH] AH Transformation is enabled :-)"
			fi

			if ! { linux_chkconfig_present INET_ESP; }; then
				ewarn "[INET_ESP] ESP Transformation is NOT enabled."
			else
				einfo "....[INET_ESP] ESP Transformation is enabled :-)"
			fi

			if ! { linux_chkconfig_present INET_XFRM_MODE_TRANSPORT; }; then
				ewarn "[INET_XFRM_MODE_TRANSPORT] IP: IPsec transport mode is NOT enabled."
			else
				einfo "....[INET_XFRM_MODE_TRANSPORT] IP: IPsec transport mode is enabled :-)"
			fi

			if ! { linux_chkconfig_present INET_XFRM_MODE_TUNNEL; }; then
				ewarn "[INET_XFRM_MODE_TUNNEL] IP: IPsec tunnel mode is NOT enabled."
			else
				einfo "....[INET_XFRM_MODE_TUNNEL] IP: IPsec tunnel mode is enabled :-)"
			fi

			if ! { linux_chkconfig_present INET_XFRM_MODE_BEET; }; then
				ewarn "[INET_XFRM_MODE_BEET] IP: IPsec BEET mode is NOT enabled."
			else
				einfo "....[INET_XFRM_MODE_BEET] IP: IPsec BEET mode is enabled :-)"
			fi
			# }}}
			# {{{ IPv6 stuff
			if use ipv6 ; then
				if ! { linux_chkconfig_present INET6_IPCOMP; }; then
					ewarn "[INET6_IPCOMP] IPv6: IPComp transformation is NOT enabled"
				else
					einfo "....[INET6_IPCOMP] IPv6: IPComp transformation is enabled :-)"
				fi

				if ! { linux_chkconfig_present INET6_AH; }; then
					ewarn "[INET6_AH] IPv6: AH Transformation is NOT enabled."
				else
					einfo "....[INET6_AH] IPv6: AH Transformation is enabled :-)"
				fi

				if ! { linux_chkconfig_present INET6_ESP; }; then
					ewarn "[INET6_ESP] IPv6: ESP Transformation is NOT enabled."
				else
					einfo "....[INET6_ESP] IPv6: ESP Transformation is enabled :-)"
				fi

				if ! { linux_chkconfig_present INET6_XFRM_MODE_TRANSPORT; }; then
					ewarn "[INET6_XFRM_MODE_TRANSPORT] IPv6: IPsec transport mode is NOT enabled."
				else
					einfo "....[INET6_XFRM_MODE_TRANSPORT] IPv6: IPsec transport mode is enabled :-)"
				fi

				if ! { linux_chkconfig_present INET6_XFRM_MODE_TUNNEL; }; then
					ewarn "[INET6_XFRM_MODE_TUNNEL] IPv6: IPsec tunnel mode is NOT enabled."
				else
					einfo "....[INET6_XFRM_MODE_TUNNEL] IPv6: IPsec tunnel mode is enabled :-)"
				fi

				if ! { linux_chkconfig_present INET6_XFRM_MODE_BEET; }; then
					ewarn "[INET6_XFRM_MODE_BEET] IPv6: IPsec BEET mode is NOT enabled."
				else
					einfo "....[INET6_XFRM_MODE_BEET] IPv6: IPsec BEET mode is enabled :-)"
				fi
			fi
			# }}}

			eend $?
		fi
	fi
}



src_unpack() {
	unpack ${A}
	cd ${S}
	sed -i 's:#include <sys/sysctl.h>::' src/racoon/pfkey.c src/setkey/setkey.c
	sed -i 's:-Werror::g' ${S}/configure.ac
	
	export WANT_AUTOMAKE="1.10"
	export WANT_AUTOCONF="2.61"
	eautoreconf || die "autotools failed"
	epunt_cxx
}



src_compile() {
	# Filter the c3 flag for now. Probably a GCC problem, but we'll
	# avoid it here for now. See bug #61025
	filter-flags -march=c3

	kernel_check

	myconf="${myconf} --with-kernel-headers=/lib/modules/${KV_FULL}/build/include"

	if use natt && linux_chkconfig_present NETFILTER_XT_MATCH_POLICY; then
		myconf="${myconf} --enable-natt --enable-natt-versions=yes"
	fi;
	myconf="${myconf} $(use_enable broken-natt)"
	myconf="${myconf} --enable-dependency-tracking $(use_enable ipv6)"
	myconf="${myconf} $(use_with pic)"
	myconf="${myconf} $(use_enable static)"
	myconf="${myconf} $(use_enable adminport)"
	myconf="${myconf} $(use_enable shared)"
	# rc5 is patented and not used on gentoo (come from openssl)
	myconf="${myconf} $(use_enable rc5)"
	if use pam; then
		myconf="${myconf} --enable-hybrid"
	else
		myconf="${myconf} $(use_enable hybrid)"
	fi;
	myconf="${myconf} $(use_enable dpd)"
	myconf="${myconf} $(use_enable frag)"
	myconf="${myconf} $(use_enable stats)"
	myconf="${myconf} $(use_enable fastquit)"
	# idea is patented and not used on Gentoo (come from openssl)
	myconf="${myconf} $(use_enable idea)"
	myconf="${myconf} $(use_enable gssapi)"
	myconf="${myconf} $(use_enable security-context)"

	# Not ready yet to compile with. dev-libs/libiconv is hard masked
	#use iconv && myconf="${myconf} $(use_with iconv libiconv)"
	myconf="${myconf} $(use_with ldap libldap)"
	myconf="${myconf} $(use_with pam libpam)"

	# This flag is done to indicate an other include repertory
	# the default one is ok (/usr/include/openssl/) So we won't change it
	# myconf="${myconf} $(use_with ssl openssl )"

	# No way to get it compiling with freeradius or gnuradius
	# We need libradius wich only exist on FreeBSD
	#use radius && myconf="${myconf} $(use_with radius libradius )"

	use readline && myconf="${myconf} $(use_with readline )"


	econf ${myconf} || die
		# Removed due to some problems
		# --enable-samode-unspec \
	emake -j1 || die

}

src_install() {
	einstall || die
	keepdir /var/lib/racoon
	insinto /etc/conf.d && newins ${FILESDIR}/racoon.conf.d racoon
	exeinto /etc/init.d && newexe ${FILESDIR}/racoon.init.d racoon

	dodoc ChangeLog README NEWS
	# In this version, there are a lot of samples. 
	dodoc ${S}/src/racoon/samples/*
	dodoc ${S}/src/racoon/doc/*

	dodir "/usr/share/doc/${P}/rfc"
	dodir "/usr/share/doc/${P}/roadwarrior"
	docinto "roadwarrior"
	dodoc ${S}/src/racoon/samples/roadwarrior/*
	dodir "/usr/share/doc/${P}/roadwarrior/client"
	dodir "/usr/share/doc/${P}/roadwarrior/server"
	dodir "/usr/share/doc/${P}/setkey"
	docinto "roadwarrior/client"
	dodoc ${S}/src/racoon/samples/roadwarrior/client/*
	docinto "roadwarrior/server"
	dodoc ${S}/src/racoon/samples/roadwarrior/server/*
	docinto "setkey"
	dodoc ${S}/src/setkey/sample.cf
	# RFC are only available from CVS for the moment
	#docinto "rfc"
	#dodoc ${S}/src/racoon/rfc/*
}

pkg_postinst() {
	if use natt; then
	  ewarn ""
	  ewarn " You have enabled the nat traversal functionnality."
	  ewarn " Nat versions wich are enabled by default are 00,02,rfc"
	  ewarn " you can find those drafts in the CVS repository:"
	  ewarn "cvs -d anoncvs@anoncvs.netbsd.org:/cvsroot co ipsec-tools"
	  ewarn ""
	  ewarn "If you feel brave enough and you know what you are"
	  ewarn "doing, you can consider editing this ebuild to change"
	  ewarn "the nat traversal options:"
	  ewarn "--enable-natt-versions=08,07,06"
	  ewarn ""
	fi;

	if use ldap; then
	  ewarn ""
	  ewarn " You have enabled ldap support with {$PN}."
	  ewarn " The man page does NOT contain any information on it yet."
	  ewarn " Consider to use a more recent version or CVS"
	  ewarn ""
	fi;


	einfo ""
	einfo "---- Ipsec from the Kame project is installed on your system.-------"
	einfo ""
	einfo "  Important : Have a look in /usr/share/doc/${P} and"
	einfo "http://www.netbsd.org/Documentation/network/ipsec/"
	einfo "you will find a lot information to configure this great tool."
	einfo "                              Enjoy !"
	einfo ""
	einfo "---------------------------------------------------------------------"

}

# vim: set foldmethod=marker nowrap :