gnu/packages/vpn.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2013 Andreas Enge <andreas@enge.fr>
   3 ;;; Copyright © 2013, 2016, 2018, 2019, 2020 Ludovic Courtès <ludo@gnu.org>
   4 ;;; Copyright © 2014 Eric Bavier <bavier@member.fsf.org>
   5 ;;; Copyright © 2015 Jeff Mickey <j@codemac.net>
   6 ;;; Copyright © 2016, 2017, 2019, 2021 Efraim Flashner <efraim@flashner.co.il>
   7 ;;; Copyright © 2016–2021 Tobias Geerinckx-Rice <me@tobias.gr>
   8 ;;; Copyright © 2017 Julien Lepiller <julien@lepiller.eu>
   9 ;;; Copyright © 2018, 2020 Pierre Langlois <pierre.langlois@gmx.com>
  10 ;;; Copyright © 2018 Meiyo Peng <meiyo.peng@gmail.com>
  11 ;;; Copyright © 2019, 2020 Leo Famulari <leo@famulari.name>
  12 ;;; Copyright © 2019 Rutger Helling <rhelling@mykolab.com>
  13 ;;; Copyright © 2019 Ricardo Wurmus <rekado@elephly.net>
  14 ;;; Copyright © 2020 Brice Waegeneire <brice@waegenei.re>
  15 ;;; Copyright © 2020 Ryan Prior <rprior@protonmail.com>
  16 ;;; Copyright © 2020 Ivan Kozlov <kanichos@yandex.ru>
  17 ;;; Copyright © 2020 David Dashyan <mail@davie.li>
  18 ;;;
  19 ;;; This file is part of GNU Guix.
  20 ;;;
  21 ;;; GNU Guix is free software; you can redistribute it and/or modify it
  22 ;;; under the terms of the GNU General Public License as published by
  23 ;;; the Free Software Foundation; either version 3 of the License, or (at
  24 ;;; your option) any later version.
  25 ;;;
  26 ;;; GNU Guix is distributed in the hope that it will be useful, but
  27 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  28 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  29 ;;; GNU General Public License for more details.
  30 ;;;
  31 ;;; You should have received a copy of the GNU General Public License
  32 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  33
  34 (define-module (gnu packages vpn)
  35   #:use-module ((guix licenses) #:prefix license:)
  36   #:use-module (guix packages)
  37   #:use-module (guix download)
  38   #:use-module (guix git-download)
  39   #:use-module (guix build-system cmake)
  40   #:use-module (guix build-system gnu)
  41   #:use-module (guix build-system linux-module)
  42   #:use-module (guix build-system python)
  43   #:use-module (guix utils)
  44   #:use-module (gnu packages)
  45   #:use-module (gnu packages admin)
  46   #:use-module (gnu packages base)
  47   #:use-module (gnu packages bash)
  48   #:use-module (gnu packages check)
  49   #:use-module (gnu packages dns)
  50   #:use-module (gnu packages autotools)
  51   #:use-module (gnu packages compression)
  52   #:use-module (gnu packages freedesktop)
  53   #:use-module (gnu packages gettext)
  54   #:use-module (gnu packages gnupg)
  55   #:use-module (gnu packages guile)
  56   #:use-module (gnu packages libevent)
  57   #:use-module (gnu packages linux)
  58   #:use-module (gnu packages ncurses)
  59   #:use-module (gnu packages nss)
  60   #:use-module (gnu packages perl)
  61   #:use-module (gnu packages pkg-config)
  62   #:use-module (gnu packages python)
  63   #:use-module (gnu packages python-build)
  64   #:use-module (gnu packages python-crypto)
  65   #:use-module (gnu packages python-xyz)
  66   #:use-module (gnu packages python-web)
  67   #:use-module (gnu packages qt)
  68   #:use-module (gnu packages samba)
  69   #:use-module (gnu packages tls)
  70   #:use-module (gnu packages xml))
  71
  72 (define-public gvpe
  73   (package
  74     (name "gvpe")
  75     (version "3.1")
  76     (source (origin
  77               (method url-fetch)
  78               (uri (string-append "mirror://gnu/gvpe/gvpe-"
  79                                   version ".tar.gz"))
  80               (sha256
  81                (base32
  82                 "1cz8n75ksl0l908zc5l3rnfm1hv7130s2w8710799fr5sxrdbszi"))))
  83     (build-system gnu-build-system)
  84     (home-page "http://software.schmorp.de/pkg/gvpe.html")
  85     (native-inputs `(("pkg-config" ,pkg-config)))
  86     (inputs `(("openssl" ,openssl)
  87               ("zlib" ,zlib)))
  88     (synopsis "Secure VPN among multiple nodes over an untrusted network")
  89     (description
  90      "The GNU Virtual Private Ethernet creates a virtual network
  91 with multiple nodes using a variety of transport protocols.  It works
  92 by creating encrypted host-to-host tunnels between multiple
  93 endpoints.")
  94     (license license:gpl3+)))
  95
  96 (define-public vpnc
  97   (package
  98    (name "vpnc")
  99    (version "0.5.3")
 100    (source (origin
 101             (method url-fetch)
 102             (uri (string-append "https://www.unix-ag.uni-kl.de/~massar/vpnc/vpnc-"
 103                                 version ".tar.gz"))
 104             (sha256 (base32
 105                      "1128860lis89g1s21hqxvap2nq426c9j4bvgghncc1zj0ays7kj6"))))
 106    (build-system gnu-build-system)
 107    (inputs `(("libgcrypt" ,libgcrypt)
 108              ("perl" ,perl)
 109              ("vpnc-scripts" ,vpnc-scripts)))
 110    (arguments
 111     `(#:tests? #f ; there is no check target
 112       #:phases
 113       (modify-phases %standard-phases
 114         (add-after 'unpack 'use-store-paths
 115           (lambda* (#:key inputs outputs #:allow-other-keys)
 116             (let ((out          (assoc-ref outputs "out"))
 117                   (vpnc-scripts (assoc-ref inputs  "vpnc-scripts")))
 118               (substitute* "config.c"
 119                 (("/etc/vpnc/vpnc-script")
 120                  (string-append vpnc-scripts "/etc/vpnc/vpnc-script")))
 121               (substitute* "Makefile"
 122                 (("ETCDIR=.*")
 123                  (string-append "ETCDIR=" out "/etc/vpnc\n"))
 124                 (("PREFIX=.*")
 125                  (string-append "PREFIX=" out "\n")))
 126               #t)))
 127         (delete 'configure))))          ; no configure script
 128    (synopsis "Client for Cisco VPN concentrators")
 129    (description
 130     "vpnc is a VPN client compatible with Cisco's EasyVPN equipment.
 131 It supports IPSec (ESP) with Mode Configuration and Xauth.  It supports only
 132 shared-secret IPSec authentication with Xauth, AES (256, 192, 128), 3DES,
 133 1DES, MD5, SHA1, DH1/2/5 and IP tunneling.  It runs entirely in userspace.
 134 Only \"Universal TUN/TAP device driver support\" is needed in the kernel.")
 135    (license license:gpl2+) ; some file are bsd-2, see COPYING
 136    (home-page "https://www.unix-ag.uni-kl.de/~massar/vpnc/")))
 137
 138 (define-public vpnc-scripts
 139   (let ((commit "3885f8bbc4ae03fd6da0ada6de12f7223a59595c"))
 140     (package
 141       (name "vpnc-scripts")
 142       (version (string-append "20200925." (string-take commit 7)))
 143       (source (origin
 144                 (method git-fetch)
 145                 (uri
 146                  (git-reference
 147                   (url "git://git.infradead.org/users/dwmw2/vpnc-scripts.git")
 148                   (commit commit)))
 149                 (file-name (git-file-name name version))
 150                 (sha256
 151                  (base32
 152                   "1pmi4n58q81pmn9arvfixhvv6vkkf3rpwac3hwnwyl882q5q0ccx"))))
 153       (build-system gnu-build-system)
 154       (inputs `(("guile" ,guile-3.0) ; for the wrapper scripts
 155                 ("coreutils" ,coreutils)
 156                 ("grep" ,grep)
 157                 ("iproute2" ,iproute)    ; for ‘ip’
 158                 ("net-tools" ,net-tools) ; for ‘ifconfig’, ‘route’
 159                 ("sed" ,sed)
 160                 ("which" ,which)))
 161       (arguments
 162        `(#:phases
 163          (modify-phases %standard-phases
 164            (add-after 'unpack 'use-relative-paths
 165              ;; Patch the scripts to work with and use relative paths.
 166              (lambda* _
 167                (for-each (lambda (script)
 168                            (substitute* script
 169                              (("^PATH=.*") "")
 170                              (("/usr/s?bin/") "")
 171                              (("\\[ +-x +([^]]+) +\\]" _ command)
 172                               (string-append "command -v >/dev/null 2>&1 "
 173                                              command))))
 174                          (find-files "." "^vpnc-script"))
 175                #t))
 176            (delete 'configure)          ; no configure script
 177            (replace 'build
 178              (lambda _
 179                (invoke "gcc" "-o" "netunshare" "netunshare.c")))
 180            (replace 'install
 181              ;; There is no Makefile; manually install the relevant files.
 182              (lambda* (#:key outputs #:allow-other-keys)
 183                (let* ((out (assoc-ref outputs "out"))
 184                       (etc (string-append out "/etc/vpnc")))
 185                  (for-each (lambda (file)
 186                              (install-file file etc))
 187                            (append (find-files "." "^vpnc-script")
 188                                    (list "netunshare"
 189                                          "xinetd.netns.conf")))
 190                  #t)))
 191            (add-after 'install 'wrap-scripts
 192              ;; Wrap scripts with paths to their common hard dependencies.
 193              ;; Optional dependencies will need to be installed by the user.
 194              (lambda* (#:key inputs outputs #:allow-other-keys)
 195                (let ((out (assoc-ref outputs "out")))
 196                  (for-each
 197                   (lambda (script)
 198                     (wrap-script (string-append out "/etc/vpnc/" script)
 199                       `("PATH" ":" prefix
 200                         ,(map (lambda (name)
 201                                 (let ((input (assoc-ref inputs name)))
 202                                   (string-append input "/bin:"
 203                                                  input "/sbin")))
 204                               (list "coreutils"
 205                                     "grep"
 206                                     "iproute2"
 207                                     "net-tools"
 208                                     "sed"
 209                                     "which")))))
 210                   (list "vpnc-script-ptrtd"
 211                         "vpnc-script-sshd"
 212                         "vpnc-script"))
 213                  #t))))
 214          #:tests? #f))                  ; no tests
 215       (home-page "http://git.infradead.org/users/dwmw2/vpnc-scripts.git")
 216       (synopsis "Network configuration scripts for Cisco VPN clients")
 217       (description
 218        "This set of scripts configures routing and name services when invoked
 219 by the VPNC or OpenConnect Cisco @dfn{Virtual Private Network} (VPN) clients.
 220
 221 The default @command{vpnc-script} automatically configures most common
 222 connections, and provides hooks for performing custom actions at various stages
 223 of the connection or disconnection process.
 224
 225 Alternative scripts are provided for more complicated set-ups, or to serve as an
 226 example for writing your own.  For example, @command{vpnc-script-sshd} contains
 227 the entire VPN in a network namespace accessible only through SSH.")
 228       (license license:gpl2+))))
 229
 230 (define-public ocproxy
 231   (package
 232     (name "ocproxy")
 233     (version "1.60")
 234     (source (origin
 235               (method git-fetch)
 236               (uri (git-reference
 237                      (url "https://github.com/cernekee/ocproxy")
 238                      (commit (string-append "v" version))))
 239               (file-name (git-file-name name version))
 240               (sha256
 241                (base32
 242                 "03323nnhb4y9nzwva04mq7xg03dvdrgp689g89f69jqc261skcqx"))))
 243     (build-system gnu-build-system)
 244     (native-inputs
 245      `(("autoconf" ,autoconf)
 246        ("automake" ,automake)))
 247     (inputs
 248      `(("libevent" ,libevent)))
 249     (home-page "https://github.com/cernekee/ocproxy")
 250     (synopsis "OpenConnect proxy")
 251     (description
 252      "User-level @dfn{SOCKS} and port forwarding proxy for OpenConnect based
 253 on LwIP.  When using ocproxy, OpenConnect only handles network activity that
 254 the user specifically asks to proxy, so the @dfn{VPN} interface no longer
 255 \"hijacks\" all network traffic on the host.")
 256     (license license:bsd-3)))
 257
 258 (define-public openconnect
 259   (package
 260    (name "openconnect")
 261    (version "8.10")
 262    (source (origin
 263             (method url-fetch)
 264             (uri (string-append "ftp://ftp.infradead.org/pub/openconnect/"
 265                                 "openconnect-" version ".tar.gz"))
 266             (sha256
 267              (base32 "1cdsx4nsrwawbsisfkldfc9i4qn60g03vxb13nzppr2br9p4rrih"))))
 268    (build-system gnu-build-system)
 269    (propagated-inputs
 270     `(("libxml2" ,libxml2)
 271       ("gnutls" ,gnutls)
 272       ("zlib" ,zlib)))
 273    (inputs
 274     `(("lz4" ,lz4)
 275       ("vpnc-scripts" ,vpnc-scripts)))
 276    (native-inputs
 277     `(("gettext" ,gettext-minimal)
 278       ("pkg-config" ,pkg-config)))
 279    (arguments
 280     `(#:configure-flags
 281       `(,(string-append "--with-vpnc-script="
 282                         (assoc-ref %build-inputs "vpnc-scripts")
 283                         "/etc/vpnc/vpnc-script"))))
 284    (synopsis "Client for Cisco VPN")
 285    (description
 286     "OpenConnect is a client for Cisco's AnyConnect SSL VPN, which is
 287 supported by the ASA5500 Series, by IOS 12.4(9)T or later on Cisco SR500,
 288 870, 880, 1800, 2800, 3800, 7200 Series and Cisco 7301 Routers,
 289 and probably others.")
 290    (license license:lgpl2.1)
 291    (home-page "https://www.infradead.org/openconnect/")))
 292
 293 (define-public openconnect-sso
 294   (package
 295     (name "openconnect-sso")
 296     (version "0.7.2")
 297     (source
 298       (origin
 299         (method url-fetch)
 300         (uri (pypi-uri "openconnect-sso" version))
 301         (sha256
 302          (base32
 303           "0nb40zfpp38mz6389y0qvrr4mmak53swpg7578cldnhnk0g15qni"))))
 304     (build-system python-build-system)
 305     (arguments
 306      `(#:tests? #f  ; Tests not included, building from git requires poetry.
 307        #:phases
 308        (modify-phases %standard-phases
 309          (add-after 'unpack 'patch-openconnect
 310            (lambda _
 311              (substitute* "openconnect_sso/app.py"
 312                (("\"openconnect\"")
 313                 (string-append "\"" (which "openconnect") "\"")))
 314              #t))
 315          (replace 'check
 316            (lambda* (#:key tests? #:allow-other-keys)
 317              (when tests?
 318                (invoke "pytest" "-v"))
 319              #t))
 320          (add-after 'install 'wrap-qt-process-path
 321            (lambda* (#:key inputs outputs #:allow-other-keys)
 322              (let* ((out (assoc-ref outputs "out"))
 323                     (bin (string-append out "/bin/openconnect-sso"))
 324                     (qt-process-path (string-append
 325                                        (assoc-ref inputs "qtwebengine")
 326                                        "/lib/qt5/libexec/QtWebEngineProcess")))
 327                (wrap-program bin
 328                  `("QTWEBENGINEPROCESS_PATH" = (,qt-process-path)))
 329                #t))))))
 330     (inputs
 331      `(("openconnect" ,openconnect)
 332        ("python-attrs" ,python-attrs)
 333        ("python-colorama" ,python-colorama)
 334        ("python-keyring" ,python-keyring)
 335        ("python-lxml" ,python-lxml)
 336        ("python-prompt-toolkit" ,python-prompt-toolkit)
 337        ("python-requests" ,python-requests)
 338        ("python-pyqt" ,python-pyqt)
 339        ("python-pyqtwebengine" ,python-pyqtwebengine)
 340        ("python-pysocks" ,python-pysocks)
 341        ("python-pyxdg" ,python-pyxdg)
 342        ("python-structlog" ,python-structlog)
 343        ("python-toml" ,python-toml)
 344        ("qtwebengine" ,qtwebengine)))
 345     (native-inputs
 346      `(("python-pytest" ,python-pytest)
 347        ("python-setuptools-scm" ,python-setuptools-scm)))
 348     (home-page "https://github.com/vlaci/openconnect-sso")
 349     (synopsis "OpenConnect wrapper script supporting Azure AD (SAMLv2)")
 350     (description
 351      "This package provides a wrapper script for OpenConnect supporting Azure AD
 352 (SAMLv2) authentication to Cisco SSL-VPNs.")
 353     (license license:gpl3)))
 354
 355 (define-public openfortivpn
 356   (package
 357     (name "openfortivpn")
 358     (version "1.15.0")
 359     (source (origin
 360               (method git-fetch)
 361               (uri (git-reference
 362                     (url "https://github.com/adrienverge/openfortivpn")
 363                     (commit (string-append "v" version))))
 364               (file-name (git-file-name name version))
 365               (sha256
 366                (base32
 367                 "1qsfgpxg553s8rc9cyrc4k96z0pislxsdxb9wyhp8fdprkak2mw2"))))
 368     (build-system gnu-build-system)
 369     (native-inputs
 370      `(("autoconf" ,autoconf)
 371        ("autotools" ,automake)
 372        ("pkg-config" ,pkg-config)))
 373     (inputs
 374      `(("openssl" ,openssl)
 375        ("ppp" ,ppp)))
 376     (home-page "https://github.com/adrienverge/openfortivpn")
 377     (synopsis "Client for PPP+SSL VPN tunnel services")
 378     (description "Openfortivpn is a client for PPP+SSL VPN tunnel services.  It
 379 spawns a pppd process and operates the communication between the gateway and
 380 this process.  It is compatible with Fortinet VPNs.")
 381     (license license:gpl3+)))
 382
 383 (define-public openvpn
 384   (package
 385     (name "openvpn")
 386     (version "2.5.1")
 387     (source (origin
 388               (method url-fetch)
 389               (uri (string-append
 390                     "https://swupdate.openvpn.org/community/releases/openvpn-"
 391                     version ".tar.xz"))
 392               (sha256
 393                (base32
 394                 "157ikzap2bbkzx34hkh33bpk2i14xjx1x3pkadhmzh1pr24h94s0"))))
 395     (build-system gnu-build-system)
 396     (arguments
 397      '(#:configure-flags '("--enable-iproute2=yes")))
 398     (native-inputs
 399      `(("iproute2" ,iproute)))
 400     (inputs
 401      `(("lz4" ,lz4)
 402        ("lzo" ,lzo)
 403        ("openssl" ,openssl)
 404        ("linux-pam" ,linux-pam)))
 405     (home-page "https://openvpn.net/")
 406     (synopsis "Virtual private network daemon")
 407     (description
 408      "OpenVPN implements virtual private network (@dfn{VPN}) techniques
 409 for creating secure point-to-point or site-to-site connections in routed or
 410 bridged configurations and remote access facilities.  It uses a custom
 411 security protocol that utilizes SSL/TLS for key exchange.  It is capable of
 412 traversing network address translators (@dfn{NAT}s) and firewalls.")
 413     (license license:gpl2)))
 414
 415 (define-public protonvpn-cli
 416   (package
 417     (name "protonvpn-cli")
 418     (version "2.2.6")
 419     (source
 420      (origin
 421        ;; PyPI has a ".whl" file but not a proper source release.
 422        ;; Thus, fetch code from Git.
 423        (method git-fetch)
 424        (uri (git-reference
 425              (url "https://github.com/ProtonVPN/linux-cli")
 426              (commit (string-append "v" version))))
 427        (file-name (git-file-name name version))
 428        (sha256
 429         (base32 "0y7v9ikrmy5dbjlpbpacp08gy838i8z54m8m4ps7ldk1j6kyia3n"))))
 430     (build-system python-build-system)
 431     (arguments
 432      '(#:tests? #f ; no tests in repo
 433        #:phases
 434        (modify-phases %standard-phases
 435          (add-after 'wrap 'wrap-wrapper
 436            ;; Wrap entrypoint with paths to its hard dependencies.
 437            (lambda* (#:key inputs outputs #:allow-other-keys)
 438              (let ((entrypoint (string-append (assoc-ref outputs "out")
 439                                               "/bin/.protonvpn-real")))
 440                (wrap-program entrypoint
 441                             `("PATH" ":" prefix
 442                               ,(map (lambda (name)
 443                                       (let ((input (assoc-ref inputs name)))
 444                                         (string-append input "/bin:"
 445                                                        input "/sbin")))
 446                                     (list "dialog"
 447                                           "iproute2"
 448                                           "iptables"
 449                                           "ncurses"
 450                                           "openvpn"
 451                                           "procps"
 452                                           "which")))))
 453              #t)))))
 454     (native-inputs
 455      `(("python-docopt" ,python-docopt)))
 456     (inputs
 457      `(("dialog" ,dialog)
 458        ("iproute2" ,iproute)
 459        ("iptables" ,iptables)
 460        ("ncurses" ,ncurses)
 461        ("openvpn" ,openvpn)
 462        ("procps" ,procps)
 463        ("python-jinja2" ,python-jinja2)
 464        ("python-pythondialog" ,python-pythondialog)
 465        ("python-requests" ,python-requests)
 466        ("which" ,which)))
 467     (synopsis "Command-line client for ProtonVPN")
 468     (description
 469      "This is the official command-line interface for ProtonVPN, a secure
 470 point-to-point virtual private networking (VPN) service with a gratis tier.
 471 It can automatically find and connect to the fastest servers or use Tor over
 472 VPN.  The gratis tier offers unlimited bandwidth for up to 10 devices.")
 473     (home-page "https://github.com/ProtonVPN/linux-cli")
 474     (license license:gpl3+)))
 475
 476 (define-public tinc
 477   (package
 478     (name "tinc")
 479     (version "1.0.36")
 480     (source (origin
 481               (method url-fetch)
 482               (uri (string-append "https://tinc-vpn.org/packages/"
 483                                   "tinc-" version ".tar.gz"))
 484               (sha256
 485                (base32
 486                 "021i2sl2mjscbm8g59d7vs74iw3gf0m48wg7w3zhwj6czarkpxs0"))))
 487     (build-system gnu-build-system)
 488     (arguments
 489      '(#:configure-flags
 490        '("--sysconfdir=/etc"
 491          "--localstatedir=/var")))
 492     (inputs `(("zlib" ,zlib)
 493               ("lzo" ,lzo)
 494               ("openssl" ,openssl)))
 495     (home-page "https://tinc-vpn.org")
 496     (synopsis "Virtual Private Network (VPN) daemon")
 497     (description
 498      "Tinc is a VPN that uses tunnelling and encryption to create a secure
 499 private network between hosts on the internet.")
 500     (license license:gpl2+)))
 501
 502 (define-public sshuttle
 503   (package
 504     (name "sshuttle")
 505     (version "0.78.5")
 506     (source
 507      (origin
 508        (method url-fetch)
 509        (uri (pypi-uri name version))
 510        (sha256
 511         (base32
 512          "0vp13xwrhx4m6zgsyzvai84lkq9mzkaw47j58dk0ll95kaymk2x8"))))
 513     (build-system python-build-system)
 514     (arguments
 515      `(#:phases
 516        (modify-phases %standard-phases
 517          (add-after 'unpack 'patch-FHS-file-names
 518            (lambda _
 519              (substitute* "sshuttle/client.py"
 520                (("/usr/bin/env") (which "env")))
 521              (substitute* "sshuttle/ssh.py"
 522                (("/bin/sh") "sh"))
 523              #t)))))
 524     (native-inputs
 525      `(("python-setuptools-scm" ,python-setuptools-scm)
 526        ;; For tests only.
 527        ("python-flake8" ,python-flake8)
 528        ("python-mock" ,python-mock)
 529        ("python-pytest-cov" ,python-pytest-cov)
 530        ("python-pytest-runner" ,python-pytest-runner)))
 531     (home-page "https://github.com/sshuttle/sshuttle")
 532     (synopsis "VPN that transparently forwards connections over SSH")
 533     (description "sshuttle creates an encrypted virtual private network (VPN)
 534 connection to any remote server to which you have secure shell (SSH) access.
 535 The only requirement is a suitable version of Python on the server;
 536 administrative privileges are required only on the client.  Unlike most VPNs,
 537 sshuttle forwards entire sessions, not packets, using kernel transparent
 538 proxying.  This makes it faster and more reliable than SSH's own tunneling and
 539 port forwarding features.  It can forward both TCP and UDP traffic, including
 540 DNS domain name queries.")
 541     (license license:lgpl2.0))) ; incorrectly identified as GPL in ‘setup.py’
 542
 543 (define-public sshoot
 544   (package
 545     (name "sshoot")
 546     (version "1.2.6")
 547     (source
 548      (origin
 549        (method url-fetch)
 550        (uri (pypi-uri name version))
 551        (sha256
 552         (base32
 553          "1ccgh0hjyxrwkgy3hnxz3hgbjbs0lmfs25d5l5jam0xbpcpj63h0"))))
 554     (build-system python-build-system)
 555     (arguments
 556      '(#:phases
 557        (modify-phases %standard-phases
 558          (add-after 'unpack 'patch-paths
 559            (lambda _
 560              (substitute* "sshoot/tests/test_manager.py"
 561                (("/bin/sh") (which "sh")))
 562              #t)))))
 563     (inputs
 564      `(("python-argcomplete" ,python-argcomplete)
 565        ("python-prettytable" ,python-prettytable)
 566        ("python-pyyaml" ,python-pyyaml)))
 567     ;; For tests only.
 568     (native-inputs
 569      `(("python-fixtures" ,python-fixtures)
 570        ("python-pbr" ,python-pbr)
 571        ("python-testtools" ,python-testtools)))
 572     (home-page "https://github.com/albertodonato/sshoot")
 573     (synopsis "sshuttle VPN session manager")
 574     (description "sshoot provides a command-line interface to manage multiple
 575 @command{sshuttle} virtual private networks.  It supports flexible profiles
 576 with configuration options for most of @command{sshuttle}’s features.")
 577     (license license:gpl3+)))
 578
 579 (define-public badvpn
 580   (package
 581     (name "badvpn")
 582     (version "1.999.130")
 583     (source
 584      (origin
 585        (method git-fetch)
 586        (uri (git-reference
 587              (url "https://github.com/ambrop72/badvpn")
 588              (commit version)))
 589        (file-name (git-file-name name version))
 590        (sha256
 591         (base32 "0rm67xhi7bh3yph1vh07imv5y1pwyldvw3wa5bz471g8mnkc7d3c"))))
 592     (build-system cmake-build-system)
 593     (arguments
 594      '(#:tests? #f))                    ; no tests
 595     (inputs
 596      `(("nspr" ,nspr)
 597        ("nss" ,nss)
 598        ("openssl" ,openssl)))
 599     (native-inputs
 600      `(("pkg-config" ,pkg-config)))
 601     (home-page "https://github.com/ambrop72/badvpn")
 602     (synopsis "Peer-to-peer virtual private network (VPN)")
 603     (description "@code{BadVPN} is a collection of virtual private
 604 network (VPN) tools.  It includes:
 605
 606 @enumerate
 607 @item NCD programming language.\n
 608 NCD (Network Configuration Daemon) is a daemon and programming/scripting
 609 language for configuration of network interfaces and other aspects of the
 610 operating system.
 611 @item Tun2socks network-layer proxifier.\n
 612 The tun2socks program socksifes TCP connections at the network layer.  It
 613 implements a TUN device which accepts all incoming TCP connections (regardless
 614 of destination IP), and forwards the connections through a SOCKS server.
 615 @item Peer-to-peer VPN.\n
 616 The peer-to-peer VPN implements a Layer 2 (Ethernet) network between the peers
 617 (VPN nodes).
 618 @end enumerate")
 619     ;; This project contains a bundled lwIP. lwIP is also released under the
 620     ;; 3-clause BSD license.
 621     (license license:bsd-3)))
 622
 623 (define-public wireguard-linux-compat
 624   (package
 625     (name "wireguard-linux-compat")
 626     (version "1.0.20201221")
 627     (source (origin
 628               (method url-fetch)
 629               (uri (string-append "https://git.zx2c4.com/wireguard-linux-compat/"
 630                                   "snapshot/wireguard-linux-compat-" version
 631                                   ".tar.xz"))
 632               (sha256
 633                (base32
 634                 "0ci13in0fqq32n5qamch4qhjgbdq86ygrgmfhc9szsh2nsl8jlkf"))))
 635     (build-system linux-module-build-system)
 636     (outputs '("out"
 637                "kernel-patch"))
 638     (arguments
 639      `(#:linux ,linux-libre-5.4         ; mustn't have WG built-in
 640        #:tests? #f                      ; no test suite
 641        #:modules ((guix build linux-module-build-system)
 642                   (guix build utils)
 643                   (ice-9 popen)
 644                   (ice-9 textual-ports))
 645        #:phases
 646        (modify-phases %standard-phases
 647          (add-before 'build 'change-directory
 648            (lambda _
 649              (chdir "./src")
 650              #t))
 651          (add-after 'build 'build-patch
 652            (lambda* (#:key outputs #:allow-other-keys)
 653              (let* ((patch-builder "../kernel-tree-scripts/create-patch.sh")
 654                     (port (open-input-pipe patch-builder))
 655                     (str (get-string-all port)))
 656                (close-pipe port)
 657                (call-with-output-file "wireguard.patch"
 658                  (lambda (port)
 659                    (format port "~a" str))))
 660              #t))
 661          (add-after 'install 'install-patch
 662            (lambda* (#:key outputs #:allow-other-keys)
 663              (install-file "wireguard.patch"
 664                            (assoc-ref %outputs "kernel-patch"))
 665              #t))
 666          ;; So that 'install-license-files' works...
 667          (add-before 'install-license-files 'reset-cwd
 668            (lambda _
 669              (chdir "..")
 670              #t)))))
 671     (home-page "https://git.zx2c4.com/wireguard-linux-compat/")
 672     (synopsis "WireGuard kernel module for Linux 3.10 through 5.5")
 673     (description "This package contains an out-of-tree kernel patch and
 674 a loadable module adding WireGuard to Linux kernel versions 3.10 through 5.5.
 675 WireGuard was added to Linux 5.6.")
 676     (license license:gpl2)))
 677
 678 (define-public wireguard-tools
 679   (package
 680     (name "wireguard-tools")
 681     (version "1.0.20210315")
 682     (source
 683      (origin
 684        (method git-fetch)
 685        (uri (git-reference
 686              (url "https://git.zx2c4.com/wireguard-tools.git")
 687              (commit (string-append "v" version))))
 688        (file-name (git-file-name name version))
 689        (sha256
 690         (base32 "1an5gm2dv111n3fylbrnyynxmi2d3iwf2b46zq08hc54kzazxcml"))))
 691     (build-system gnu-build-system)
 692     (arguments
 693      `(#:make-flags
 694        (list ,(string-append "CC=" (cc-for-target))
 695              "--directory=src"
 696              "WITH_BASHCOMPLETION=yes"
 697              ;; Install the ‘simple and dirty’ helper script wg-quick(8).
 698              "WITH_WGQUICK=yes"
 699              (string-append "PREFIX=" (assoc-ref %outputs "out"))
 700              ;; Currently used only to create an empty /etc/wireguard directory.
 701              (string-append "SYSCONFDIR=no-thanks"))
 702        ;; The test suite is meant to be run interactively.  It runs Clang's
 703        ;; scan-build static analyzer and then starts a web server to display the
 704        ;; results.
 705        #:tests? #f
 706        #:phases
 707        (modify-phases %standard-phases
 708          ;; No configure script
 709          (delete 'configure)
 710          (add-after 'install 'install-contrib-docs
 711            (lambda* (#:key outputs #:allow-other-keys)
 712              (let ((out (assoc-ref outputs "out")))
 713                (copy-recursively "contrib/"
 714                                  (string-append out "/share/doc/wireguard-tools"))
 715                #t)))
 716          (add-after 'install 'wrap-wg-quick
 717            (lambda* (#:key inputs outputs #:allow-other-keys)
 718              (let* ((out (assoc-ref outputs "out"))
 719                     (inputs-sbin (map (lambda (input)
 720                                         (string-append (assoc-ref inputs input) "/sbin"))
 721                                       (list "resolvconf" "iproute" "procps"
 722                                             "iptables")))
 723                    (coreutils (string-append (assoc-ref inputs "coreutils")
 724                                              "/bin")))
 725                (wrap-program (string-append out "/bin/wg-quick")
 726                  `("PATH" ":" prefix ,(append inputs-sbin
 727                                               (list coreutils))))
 728                #t))))))
 729     (inputs
 730      `(("resolvconf" ,openresolv)
 731        ("coreutils" ,coreutils)
 732        ("bash" ,bash)                   ; for scripts using /dev/tcp
 733        ("procps" ,procps)
 734        ("iproute" ,iproute)
 735        ("iptables" ,iptables)))
 736     (home-page "https://www.wireguard.com/")
 737     (synopsis "Tools for configuring WireGuard tunnels")
 738     (description
 739      "This package provides the user-space command-line tools for using and
 740 configuring WireGuard tunnels.
 741
 742 WireGuard is a simple and fast general-purpose @acronym{VPN, Virtual Private
 743 Network} that securely encapsulates IP packets over UDP.  It aims to be as easy
 744 to configure and deploy as SSH.  VPN connections are made simply by exchanging
 745 public keys and can roam across IP addresses.")
 746     (license
 747      (list license:lgpl2.1+    ; src/netlink.h & contrib/embeddable-wg-library
 748            license:gpl2))))    ; everything else
 749
 750 (define-public wireguard
 751   (deprecated-package "wireguard" wireguard-tools))
 752
 753 (define-public xl2tpd
 754   (package
 755     (name "xl2tpd")
 756     (version "1.3.16")
 757     (source (origin
 758               (method git-fetch)
 759               (uri (git-reference
 760                     (url "https://github.com/xelerance/xl2tpd")
 761                     (commit (string-append "v" version))))
 762               (file-name (git-file-name name version))
 763               (sha256
 764                (base32
 765                 "0is5ccrvijz0pfm45pfrlbb9y8231yz3c4zqs8mkgakl9rxajy6l"))))
 766     (build-system gnu-build-system)
 767     (arguments
 768      `(#:make-flags (list (string-append "PREFIX=" %output)
 769                           "CC=gcc")
 770        #:phases (modify-phases %standard-phases
 771                   (delete 'configure) ;no configure script
 772                   (add-before 'build 'setup-environment
 773                     (lambda* (#:key inputs #:allow-other-keys)
 774                       (substitute* "l2tp.h"
 775                         (("/usr/sbin/pppd")
 776                          (string-append (assoc-ref inputs "ppp")
 777                                         "/sbin/pppd")))
 778                       (setenv "KERNELSRC"
 779                               (assoc-ref inputs "linux-libre-headers"))
 780                       #t)))
 781        #:tests? #f))                    ; no tests provided
 782     (inputs `(("libpcap" ,libpcap)
 783               ("linux-libre-headers" ,linux-libre-headers)
 784               ("ppp" ,ppp)))
 785     (home-page "https://www.xelerance.com/software/xl2tpd/")
 786     (synopsis "Layer 2 Tunnelling Protocol Daemon (RFC 2661)")
 787     (description
 788      "xl2tpd is an implementation of the Layer 2 Tunnelling Protocol (RFC 2661).
 789 L2TP allows you to tunnel PPP over UDP.")
 790     (license license:gpl2)))