net/ocserv 1.3.0_4

net/radcli: Update to 1.5.0

- Bump PORTREVISION of dependent ports for shlib change

Changes:	https://github.com/radcli/radcli/releases

*/*: Bump PORTREVISION for devel/protobuf-c update

libprotobuf-c.so once again has version info.  Force a rebuild of
its consumers.

PR:		282060
MFH:		2025Q3
Sponsored by:	<If the change was sponsored by an organization.>

net/ocserv: Do not check for Linux-style /proc filesystem

Otherwise it may fail to run when linprocfs is mounted
on /proc.

Reported by:	Ivan Brawley <ivan@brawley.id.au>

net/radcli: Update to 1.4.0

- Bump PORTREVISION of dependent ports for shlib change

Changes:	https://github.com/radcli/radcli/releases

net/ocserv: Update to 1.3.0

Release notes: https://gitlab.com/openconnect/ocserv/-/releases/1.3.0

net/ocserv: Update to 1.2.4

net/ocserv: Sanitize MANPREFIX

Approved by:    portmgr (blanket)

net/ocserv: Update to 1.2.3

Release notes: https://gitlab.com/openconnect/ocserv/-/releases/1.2.3

net/ocserv: Fix build and wrong PLIST

Do not include now-non-existing file in plist.

Reported by:	Trond Endrestøl <Trond.Endrestol@ximalas.info>
PR:		274983

net/ocserv: Update to 1.2.2

Release notes: https://gitlab.com/openconnect/ocserv/-/releases/1.2.2

Reported by:	portscout

net/ocserv: Update to 1.2.1

Release notes: https://gitlab.com/openconnect/ocserv/-/releases/1.2.1

net/ocserv: Update to 1.2.0

- Update to 1.2.0
- Adjust dependencies
- Make DTLS work
- Regen patches

Co-authored-by:	Eugene Mitrofanov <emitrofanov@gmail.com>

net/ocserv: Update to 1.1.7

- Update to 1.1.7
- Regen patches

Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)

Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)

net/ocserv: Update to 1.1.6

- Update to 1.1.6
- Switch download from ftp to https

net/ocserv: Update to 1.1.3

devel/protobuf-c: Bump PORTREVISION of dependent ports

Bump the PORTREVISION of ports that use protobuf-c and bake in the value
of PROTOBUF_C_VERSION*.
Sponsored by:	Farsight Security, Inc.

all: Remove all other $FreeBSD keywords.

Remove # $FreeBSD$ from Makefiles.

net/ocserv: Update to 1.1.2

- Update to 1.1.2
- Reformat Makefile according to portclippy/portfmt
- Install sample config with PREFIX-ized values where
  apropriate.
- Take MAINTAINERship

Reviewed by:	osa (mentor)
Approved by:	osa (mentor)
MFH:		2021Q1
Differential Revision:	https://reviews.freebsd.org/D28346

Bump PORTREVISION for net/radcli shlib change

net/ocserv: update 1.0.1 -> 1.1.1

- Fixed compatibility with OpenBSD that lacks procfs
- Improved rate-limit-ms and made it dependent on secmod backlog. This makes
  the server more resilient (and prevents connection failures) on multiple
  concurrent connections
- Added namespace support for listen address by introducing the listen-netns
  option
- Disable TLS1.3 when cisco client compatibility is enabled. New anyconnect
  clients seem to supporting TLS1.3 but are unable to handle a
  client with an RSA key
- Enable a race free user disconnection via occtl
- Added the config option of a pre-login-banner
- Ocserv siwtched to using multiple ocserv-sm processes to improve scale,
  with the number of ocserv-sm process dependent on maximum clients
  and number of CPUs. Configuration option sec-mod-scale can be
  used to override the heuristics.
- Fixed issue with group selection on radius servers sending multiple group
  class attribute.

PR:		250225
Submitted by:	Juraj Lutter <juraj@lutter.sk>
Relnotes:	https://gitlab.com/openconnect/ocserv/-/releases/1.1.1

Return cpm@'s ports to the pool after safekeeping his commit bit.

With hat:	portmgr-secretary

Bump PORTREVISION for security/nettle shlib change

net/ocserv: Update to 1.0.1

Changelog:
https://gitlab.com/openconnect/ocserv/-/blob/1.0.1/NEWS#L1

This commit makes the following additional changes from Juraj's
submission:

- fix LIB_DEPENDS to libpc.so:devel/pcl (not devel/libpcl)
- replace LOCALBASE by PREFIX throughout, as these are internal references
- remove the src/config.c patch, it makes no sense to first
  statically patch and then run REINPLACE_CMD for DEFAULT_CFG_FILE
- remove doc/sample.config from another REINPLACE_CMD
- remove @ - it makes no sense to hide running commands
- patch example configuration to avoid isolate-workers = true, which
  currently only works on Linux's seccomp.
- in the same vein, put up a warning pkg-message that there is no worker
  process isolation
- install the @sample file as ocserv.conf.sample, not conf.sample,
  so it matches the default configuration file path

Things that could be done but are not:
- rcfile option to configure a separate config file

PR:		245521
Submitted by:	Juraj Lutter <juraj@lutter.sk>
Approved by:	cpm@ (maintainer timeout, 15 d)

net/ocserv: fix tun handoff between parent and worker process

ocserv hands off a tun fd to a worker process, but the worker process never
claims the tun with TUNSIFPID. The parent then closes the tunnel and leaves
it in a nasty state.

Bump PORTREVISION, as this is runtime breakage.

PR:		238500
Approved by:	bapt (ports), cpm (maintainer, e-mail)
MFH:		2019Q4 (blanket, runtime fix)

Implement new virtual category: net-vpn for VPN related ports

based on discussion at ports@ [1]. As VPN softwares are put in different
physical category net and security. This is a little bit confusing. Let's
give them new virtual category net-vpn.

[1] https://lists.freebsd.org/pipermail/freebsd-ports/2019-April/115915.html

PR:		239395
Submitted by:	myself
Approved by:	portmgr (mat)
Differential Revision:	https://reviews.freebsd.org/D21174

net/ocserv: Fix typos in pkg-descr

PR:		239577
Submitted by:	Mikael Urankar <mikael.urankar@gmail.com>

Update security/nettle to 3.5.1

- Bump PORTREVISION of dependent ports for shlib change
- Fix build of devel/pijul [1]

Changes:	https://git.lysator.liu.se/nettle/nettle/blob/master/NEWS
PR:		238991
Exp-run by:	antoine
Thanks to:	tobik [1]

net/ocserv: Update to 0.12.4

Noteworthy changes in 0.12.4

- Added support for radius access-challenge (multifactor) authentication.
- Fixed race condition when connect-script and disconnect-script are set, which could potentially cause a crash (#208).
- Perform quicker cleanup of sessions which their user explicitly disconnected (#210).

MFH:		2019Q3

net/ocserv: fix build with base GCC

-Wno-implicit-fallthrough is not supported by GCC 4.2

PR:		237558
Approved by:	tcberner (mentor), cpm (maintainer)
Differential Revision:	https://reviews.freebsd.org/D20075

Update devel/readline to 8.0

- Bump PORTREVISION of dependent ports for shlib change

Changes:	https://tiswww.case.edu/php/chet/readline/CHANGES
PR:		236156
Exp-run by:	antoine

net/ocserv: Update to 0.12.3

- Remove LOCAL MASTER_SITES

Noteworthy changes in 0.12.3

- Fixed crash when no DTLS ciphersuite is negotiated.
- Fixed crash happening arbitrarily depending on handled string sizes (#197).
- Fixed compatibility issue with GnuTLS 3.3.x (#201).
- occtl: print the TLS session information, even if the DTLS channel is not established.

MFH:		2019Q1

net/ocserv: update to 0.12.2

Noteworthy changes in 0.12.2

- Added support for AES256-SHA legacy cipher. This allows the anyconnect clients to use AES256.
- Added support for the DTLS1.2 protocol hack used by new anyconnect client.

While I'm here pet portlint.

MFH:		2019Q1

net/ocserv: Use devel/libpcl as a dependency

PR:		232771
Approved by:	Carlos J. Puga Medina <cpm@freebsd.org> (maintainer)

net/ocserv: update to 0.12.1

Changelog: https://gitlab.com/ocserv/ocserv/blob/master/NEWS

Tested by:	Jov <amutu@amutu.com>

net/ocserv: Update to 0.11.11

Changelog: http://lists.infradead.org/pipermail/openconnect-devel/2018-March/004766.html

net/ocserv: Update to 0.11.10

- Pet portlint, the port doesn't install any shared libraries, so there is no point in USE_LDCONFIG

Changelog: http://lists.infradead.org/pipermail/openconnect-devel/2018-January/004655.html

- Update to 0.11.9 - Update WWW in pkg-descr

Noteworthy changes in 0.11.9

- Fixed bug which caused the acceptable of invalid IPv4 address as valid.
- Fixed compatibility with gnutls 3.3.8 by avoiding the use of the 'VERS-ALL'
  priority string which was introduced in 3.3.24.
- Fixed null pointer dereference when parsing locked accounts in plain password
  authentication.
- Add support for RSA-PSS and Ed25519 private keys when used with GnuTLS 3.6.0.
- ocpasswd: when locking an account multiple times, add the '!' character only once.
  Based on patch by Frank Huang.

Changes: http://lists.infradead.org/pipermail/openconnect-devel/2017-October/004529.html

MFH:		2017Q4

Update devel/readline to 7.0 patch 3

- Bump PORTREVISION for shlib change

Changes:	https://cnswww.cns.cwru.edu/php/chet/readline/CHANGES
		https://lists.gnu.org/archive/html/bug-bash/2016-09/msg00107.html
		https://lists.gnu.org/archive/html/bug-readline/2017-01/msg00002.html
Differential Revision:	https://reviews.freebsd.org/D11172
PR:		219947
Exp-run by:	antoine

- Make RADIUS auth backend optional - Bump PORTREVISION

PR:		219393
Submitted by:	Jov <amutu@amutu.com>

- Add security/oath-toolkit to LIB_DEPENDS - Sort BUILD_DEPENDS and LIB_DEPENDS - Enable radius support - Bump PORTREVISION

net/ocserv: update to 0.11.8

- Update to 0.11.8
- Add my LOCAL to MASTER_SITES

Changes: http://lists.infradead.org/pipermail/openconnect-devel/2017-May/004293.html

- Fix ownership and permissions in /var/run/ocserv - Bump PORTREVISION

PR:		219054
Reported by:	Joy <amutu@amutu.com>

net/ocserv: update to 0.11.7

- Update PORTVERSION and distinfo checksum (0.11.7)
- Regenerate some patches to apply cleanly
- Remove MAKE_JOBS_UNSAFE=yes

Changelog: http://lists.infradead.org/pipermail/openconnect-devel/2017-February/004204.html

net/ocserv: Update to 0.11.6

- Update PORTVERSION and distinfo checksum (0.11.6)
- Add LICENSE_FILE
- Cosmetic fixes
- Remove STRIP_CMD target since all binaries are installed with --strip (-s) option by default
- Silence two explicitly called commands

Changelog:
   http://lists.infradead.org/pipermail/openconnect-devel/2016-November/004066.html

Reviewed by:	amdmi3 (mentor)
Approved by:	amdmi3 (mentor)
Differential Revision:	D8538

- Update ocserv to 0.11.5 release

Changelog:
  http://lists.infradead.org/pipermail/openconnect-devel/2016-September/003972.html

Reviewed by:	pi, feld (mentor)
Approved by:	feld (mentor)
Differential Revision:	D8024

Let USES=localbase add -L${LOCALBASE}/lib to LIBS instead of LDFLAGS. USES=localbase:ldflags can be used to set LDFLAGS.  Normally LDFLAGS appears too early on the command line causing some ports to link with their own libraries in LOCALBASE (if installed) instead of WRKSRC.

Also make use of _USES_POST so -L${LOCALBASE}/lib is added as late as
possible after anything a port Makefile might set.  Use _USES_POST
instead of .include in libedit.mk and libarchive.mk so things like
'USES=libedit localbase:ldflags' work correctly.

Fix some issues with LIBS in some ports.

Switch ports that don't support LIBS to localbase:ldflags.

PR:		212987
Exp-run by:	antoine
Approved by:	portmgr (antoine)

- Update to 0.11.4

Changelog:
  http://lists.infradead.org/pipermail/openconnect-devel/2016-August/003817.html

Reviewed by:	junovitch (mentor)
Approved by:	junovitch (mentor)
Differential Revision:	D7441