6 files changed, 283 insertions, 123 deletions

diff --git a/security/strongswan/Makefile b/security/strongswan/Makefile
index b8d163f6e943..6e28fdc7a830 100644
--- a/security/strongswan/Makefile
+++ b/security/strongswan/Makefile
@@ -5,44 +5,109 @@
 # $FreeBSD$
 
 PORTNAME=	strongswan
-PORTVERSION=	4.5.1
+PORTVERSION=	4.5.3
 CATEGORIES=	security
 MASTER_SITES=	http://download.strongswan.org/ \
 		http://download2.strongswan.org/
 
 MAINTAINER=	riaank@gmail.com
-COMMENT=	Open Source IPSec-based VPN solution
+COMMENT=	Open Source IKEv2 IPsec-based VPN solution
 
-LIB_DEPENDS=	vstr:${PORTSDIR}/devel/vstr \
-				gmp.10:${PORTSDIR}/math/gmp
+OPTIONS=	SQLITE		"Enable SQLite" off \
+		MYSQL		"Enable MySQL" off \
+		CURL		"Enable CURL to fetch CRL/OCSP" off \
+		EAPAKA3GPP2	"Enable EAP AKA with 3gpp2 backend" off \
+		EAPSIMFILE	"Enable EAP SIM with filebased backend" off
 
+USE_RC_SUBR=	strongswan
 USE_BZIP2=	yes
-
 USE_AUTOTOOLS=	libtool
 GNU_CONFIGURE=	yes
+USE_OPENSSL=	yes
 USE_LDCONFIG=	yes
+
 CONFIGURE_ARGS=	--enable-kernel-pfkey \
 		--enable-kernel-pfroute  \
 		--disable-kernel-netlink  \
 		--disable-tools  \
 		--disable-scripts  \
 		--disable-pluto  \
+		--disable-gmp \
+		--enable-openssl \
+		--enable-eap-identity \
+		--enable-eap-md5 \
+		--enable-eap-tls \
+		--enable-eap-mschapv2 \
+		--enable-md4 \
+		--enable-blowfish \
+		--enable-addrblock \
+		--enable-whitelist \
 		--with-group=wheel  \
-		--enable-gmp \
-		--enable-vstr \
 		--with-lib-prefix=${PREFIX}
 
-MAN3=		anyaddr.3 atoaddr.3 atoasr.3 atoul.3 goodmask.3 \
-		initaddr.3 initsubnet.3 portof.3 rangetosubnet.3 \
-		sameaddr.3 subnetof.3 ttoaddr.3 ttodata.3 \
-		ttosa.3 ttoul.3
-MAN5=		ipsec.conf.5 ipsec.secrets.5 strongswan.conf.5
-MAN8=		ipsec.8 _updown.8 _updown_espmark.8
+# Man pages with default install
+MAN3=	anyaddr.3 atoaddr.3 atoasr.3 atoul.3 goodmask.3 initaddr.3 \
+	initsubnet.3 portof.3 rangetosubnet.3 sameaddr.3 subnetof.3 \
+	ttoaddr.3 ttodata.3 ttosa.3 ttoul.3
+MAN5=	ipsec.conf.5 ipsec.secrets.5 strongswan.conf.5
+MAN8=	ipsec.8 _updown.8 _updown_espmark.8
 
 .include <bsd.port.pre.mk>
 
+# Requires FreeBSD 8 and above to work
 .if ${OSVERSION} < 800000
 IGNORE=		requires at least FreeBSD 8.X
 .endif
 
+# Extra options
+.if defined(WITH_SQLITE) || defined (WITH_MYSQL)
+CONFIGURE_ARGS+=	--enable-attr-sql
+CONFIGURE_ARGS+=	--enable-sql
+PLIST_SUB+=	SQL=""
+.else
+PLIST_SUB+=	SQL="@comment "
+.endif
+
+.if defined(WITH_SQLITE)
+CONFIGURE_ARGS+=	--enable-sqlite
+LIB_DEPENDS += sqlite3.8:${PORTSDIR}/databases/sqlite3
+PLIST_SUB+=	SQLITE=""
+.else
+PLIST_SUB+=	SQLITE="@comment "
+.endif
+
+.if defined(WITH_MYSQL)
+CONFIGURE_ARGS+=	--enable-mysql
+USE_MYSQL=	yes
+PLIST_SUB+=	MYSQL=""
+.else
+PLIST_SUB+=	MYSQL="@comment "
+.endif
+
+.if defined(WITH_CURL)
+CONFIGURE_ARGS+=	--enable-curl
+LIB_DEPENDS+=	curl.6:${PORTSDIR}/ftp/curl
+PLIST_SUB+=	CURL=""
+.else
+PLIST_SUB+=	CURL="@comment "
+.endif
+
+.if defined(WITH_EAPSIMFILE)
+CONFIGURE_ARGS+=	--enable-eap-sim
+CONFIGURE_ARGS+=	--enable-eap-sim-file
+PLIST_SUB+=	EAPSIMFILE=""
+.else
+PLIST_SUB+=	EAPSIMFILE="@comment "
+.endif
+
+.if defined(WITH_EAPAKA3GPP2)
+CONFIGURE_ARGS+=	--enable-eap-aka
+CONFIGURE_ARGS+=	--enable-eap-aka-3gpp2
+CONFIGURE_ARGS+=	--enable-gmp
+LIB_DEPENDS+=	gmp.10:${PORTSDIR}/math/gmp
+PLIST_SUB+=	EAPAKA3GPP2=""
+.else
+PLIST_SUB+=	EAPAKA3GPP2="@comment "
+.endif
+
 .include <bsd.port.post.mk>
diff --git a/security/strongswan/distinfo b/security/strongswan/distinfo
index 5697d1ffbb4c..6dfa1da75c9d 100644
--- a/security/strongswan/distinfo
+++ b/security/strongswan/distinfo
@@ -1,2 +1,2 @@
-SHA256 (strongswan-4.5.1.tar.bz2) = 252d7369d94aa2d79e6fad078853b07ca897ea811ab1e1a2b008bcec0d1e758a
-SIZE (strongswan-4.5.1.tar.bz2) = 3254264
+SHA256 (strongswan-4.5.3.tar.bz2) = a59fa0d9820fb06a3c848f4537b9256d2067265ad10e1b007b79f3b16279f1ff
+SIZE (strongswan-4.5.3.tar.bz2) = 3299522
diff --git a/security/strongswan/files/patch-src__ipsec__ipsec.in b/security/strongswan/files/patch-src__ipsec__ipsec.in
new file mode 100644
index 000000000000..eb1118ba85b1
--- /dev/null
+++ b/security/strongswan/files/patch-src__ipsec__ipsec.in
@@ -0,0 +1,20 @@
+diff -ur srcold/ipsec/ipsec.in src/ipsec/ipsec.in
+--- srcold/ipsec/ipsec.in	2011-09-22 08:39:26.589952124 +0200
++++ src/ipsec/ipsec.in	2011-09-22 08:39:44.640945476 +0200
+@@ -19,6 +19,7 @@
+ export PATH
+ 
+ # name and version of the ipsec implementation
++OS_NAME=`uname -s`
+ IPSEC_NAME="@IPSEC_NAME@"
+ IPSEC_VERSION="U@IPSEC_VERSION@/K`uname -r`"
+ 
+@@ -378,7 +379,7 @@
+ 	fi
+ 	;;
+ version|--version)
+-	printf "Linux $IPSEC_NAME $IPSEC_VERSION\n"
++	printf "$OS_NAME $IPSEC_NAME $IPSEC_VERSION\n"
+ 	printf "$IPSEC_DISTRO\n"
+ 	printf "See 'ipsec --copyright' for copyright information.\n"
+ 	exit 0
diff --git a/security/strongswan/files/patch-src__libcharon__bus__listeners__sys_logger.c b/security/strongswan/files/patch-src__libcharon__bus__listeners__sys_logger.c
deleted file mode 100644
index 1dbbf50ca281..000000000000
--- a/security/strongswan/files/patch-src__libcharon__bus__listeners__sys_logger.c
+++ /dev/null
@@ -1,19 +0,0 @@
---- srcold/libcharon/bus/listeners/sys_logger.c	2011-03-10 20:50:01.000000000 +0200
-+++ src/libcharon/bus/listeners/sys_logger.c	2011-03-10 20:53:59.000000000 +0200
-@@ -79,13 +79,15 @@
- 		/* do a syslog with every line */
- 		while (current)
- 		{
-+			char tmp[8192];
- 			next = strchr(current, '\n');
- 			if (next)
- 			{
- 				*(next++) = '\0';
- 			}
--			syslog(this->facility|LOG_INFO, "%.2d[%N]%s %s\n",
-+			snprintf(tmp, 8192, "%.2d[%N]%s %s\n",
- 				   thread, debug_names, group, namestr, current);
-+			syslog(this->facility|LOG_INFO, tmp);
- 			current = next;
- 		}
- 	}
diff --git a/security/strongswan/files/strongswan.in b/security/strongswan/files/strongswan.in
new file mode 100644
index 000000000000..3e3c16147c94
--- /dev/null
+++ b/security/strongswan/files/strongswan.in
@@ -0,0 +1,37 @@
+#!/bin/sh
+
+# $FreeBSD$
+
+# PROVIDE: strongswan
+# REQUIRE: LOGIN
+# KEYWORD: shutdown
+
+# Add the following lines to /etc/rc.conf.local or /etc/rc.conf
+# to enable this service:
+#
+# strongswan_enable (bool):   Set to NO by default.
+#               Set it to YES to enable strongswan.
+
+. /etc/rc.subr
+
+name="strongswan"
+rcvar=`set_rcvar`
+
+command="%%PREFIX%%/sbin/ipsec"
+extra_commands="reload statusall"
+
+load_rc_config $name
+
+start_cmd="strongswan_command start"
+stop_cmd="strongswan_command stop"
+restart_cmd="strongswan_command restart"
+status_cmd="strongswan_command status"
+reload_cmd="strongswan_command reload"
+statusall_cmd="strongswan_command statusall"
+
+strongswan_command()
+{
+	$command ${rc_arg}
+}
+
+run_rc_command "$1"
diff --git a/security/strongswan/pkg-plist b/security/strongswan/pkg-plist
index 72509bec68b7..036e76d4b621 100644
--- a/security/strongswan/pkg-plist
+++ b/security/strongswan/pkg-plist
@@ -1,101 +1,158 @@
 etc/ipsec.conf
-%%ETCDIR%%.conf
-lib/libcharon.a
-lib/libcharon.la
-lib/libcharon.so
-lib/libcharon.so.0
-lib/libhydra.a
-lib/libhydra.la
-lib/libhydra.so
-lib/libhydra.so.0
-lib/libstrongswan.a
-lib/libstrongswan.la
-lib/libstrongswan.so
-lib/libstrongswan.so.0
+etc/strongswan.conf
+lib/ipsec/libcharon.a
+lib/ipsec/libcharon.la
+lib/ipsec/libcharon.so
+lib/ipsec/libcharon.so.0
+lib/ipsec/libhydra.a
+lib/ipsec/libhydra.la
+lib/ipsec/libhydra.so
+lib/ipsec/libhydra.so.0
+lib/ipsec/libstrongswan.a
+lib/ipsec/libstrongswan.la
+lib/ipsec/libstrongswan.so
+lib/ipsec/libstrongswan.so.0
+lib/ipsec/plugins/libstrongswan-addrblock.a
+lib/ipsec/plugins/libstrongswan-addrblock.la
+lib/ipsec/plugins/libstrongswan-addrblock.so
+lib/ipsec/plugins/libstrongswan-aes.a
+lib/ipsec/plugins/libstrongswan-aes.la
+lib/ipsec/plugins/libstrongswan-aes.so
+lib/ipsec/plugins/libstrongswan-attr.a
+lib/ipsec/plugins/libstrongswan-attr.la
+lib/ipsec/plugins/libstrongswan-attr.so
+lib/ipsec/plugins/libstrongswan-blowfish.a
+lib/ipsec/plugins/libstrongswan-blowfish.la
+lib/ipsec/plugins/libstrongswan-blowfish.so
+lib/ipsec/plugins/libstrongswan-constraints.a
+lib/ipsec/plugins/libstrongswan-constraints.la
+lib/ipsec/plugins/libstrongswan-constraints.so
+lib/ipsec/plugins/libstrongswan-des.a
+lib/ipsec/plugins/libstrongswan-des.la
+lib/ipsec/plugins/libstrongswan-des.so
+lib/ipsec/plugins/libstrongswan-dnskey.a
+lib/ipsec/plugins/libstrongswan-dnskey.la
+lib/ipsec/plugins/libstrongswan-dnskey.so
+lib/ipsec/plugins/libstrongswan-eap-identity.a
+lib/ipsec/plugins/libstrongswan-eap-identity.la
+lib/ipsec/plugins/libstrongswan-eap-identity.so
+lib/ipsec/plugins/libstrongswan-eap-md5.a
+lib/ipsec/plugins/libstrongswan-eap-md5.la
+lib/ipsec/plugins/libstrongswan-eap-md5.so
+lib/ipsec/plugins/libstrongswan-eap-mschapv2.a
+lib/ipsec/plugins/libstrongswan-eap-mschapv2.la
+lib/ipsec/plugins/libstrongswan-eap-mschapv2.so
+lib/ipsec/plugins/libstrongswan-eap-tls.a
+lib/ipsec/plugins/libstrongswan-eap-tls.la
+lib/ipsec/plugins/libstrongswan-eap-tls.so
+lib/ipsec/plugins/libstrongswan-fips-prf.a
+lib/ipsec/plugins/libstrongswan-fips-prf.la
+lib/ipsec/plugins/libstrongswan-fips-prf.so
+lib/ipsec/plugins/libstrongswan-hmac.a
+lib/ipsec/plugins/libstrongswan-hmac.la
+lib/ipsec/plugins/libstrongswan-hmac.so
+lib/ipsec/plugins/libstrongswan-kernel-pfkey.a
+lib/ipsec/plugins/libstrongswan-kernel-pfkey.la
+lib/ipsec/plugins/libstrongswan-kernel-pfkey.so
+lib/ipsec/plugins/libstrongswan-kernel-pfroute.a
+lib/ipsec/plugins/libstrongswan-kernel-pfroute.la
+lib/ipsec/plugins/libstrongswan-kernel-pfroute.so
+lib/ipsec/plugins/libstrongswan-md4.a
+lib/ipsec/plugins/libstrongswan-md4.la
+lib/ipsec/plugins/libstrongswan-md4.so
+lib/ipsec/plugins/libstrongswan-md5.a
+lib/ipsec/plugins/libstrongswan-md5.la
+lib/ipsec/plugins/libstrongswan-md5.so
+lib/ipsec/plugins/libstrongswan-openssl.a
+lib/ipsec/plugins/libstrongswan-openssl.la
+lib/ipsec/plugins/libstrongswan-openssl.so
+lib/ipsec/plugins/libstrongswan-pem.a
+lib/ipsec/plugins/libstrongswan-pem.la
+lib/ipsec/plugins/libstrongswan-pem.so
+lib/ipsec/plugins/libstrongswan-pgp.a
+lib/ipsec/plugins/libstrongswan-pgp.la
+lib/ipsec/plugins/libstrongswan-pgp.so
+lib/ipsec/plugins/libstrongswan-pkcs1.a
+lib/ipsec/plugins/libstrongswan-pkcs1.la
+lib/ipsec/plugins/libstrongswan-pkcs1.so
+lib/ipsec/plugins/libstrongswan-pubkey.a
+lib/ipsec/plugins/libstrongswan-pubkey.la
+lib/ipsec/plugins/libstrongswan-pubkey.so
+lib/ipsec/plugins/libstrongswan-random.a
+lib/ipsec/plugins/libstrongswan-random.la
+lib/ipsec/plugins/libstrongswan-random.so
+lib/ipsec/plugins/libstrongswan-resolve.a
+lib/ipsec/plugins/libstrongswan-resolve.la
+lib/ipsec/plugins/libstrongswan-resolve.so
+lib/ipsec/plugins/libstrongswan-revocation.a
+lib/ipsec/plugins/libstrongswan-revocation.la
+lib/ipsec/plugins/libstrongswan-revocation.so
+lib/ipsec/plugins/libstrongswan-sha1.a
+lib/ipsec/plugins/libstrongswan-sha1.la
+lib/ipsec/plugins/libstrongswan-sha1.so
+lib/ipsec/plugins/libstrongswan-sha2.a
+lib/ipsec/plugins/libstrongswan-sha2.la
+lib/ipsec/plugins/libstrongswan-sha2.so
+lib/ipsec/plugins/libstrongswan-socket-default.a
+lib/ipsec/plugins/libstrongswan-socket-default.la
+lib/ipsec/plugins/libstrongswan-socket-default.so
+lib/ipsec/plugins/libstrongswan-stroke.a
+lib/ipsec/plugins/libstrongswan-stroke.la
+lib/ipsec/plugins/libstrongswan-stroke.so
+lib/ipsec/plugins/libstrongswan-updown.a
+lib/ipsec/plugins/libstrongswan-updown.la
+lib/ipsec/plugins/libstrongswan-updown.so
+lib/ipsec/plugins/libstrongswan-whitelist.a
+lib/ipsec/plugins/libstrongswan-whitelist.la
+lib/ipsec/plugins/libstrongswan-whitelist.so
+lib/ipsec/plugins/libstrongswan-x509.a
+lib/ipsec/plugins/libstrongswan-x509.la
+lib/ipsec/plugins/libstrongswan-x509.so
+lib/ipsec/plugins/libstrongswan-xcbc.a
+lib/ipsec/plugins/libstrongswan-xcbc.la
+lib/ipsec/plugins/libstrongswan-xcbc.so
 libexec/ipsec/_copyright
 libexec/ipsec/_updown
 libexec/ipsec/_updown_espmark
 libexec/ipsec/charon
-libexec/ipsec/plugins/libstrongswan-aes.a
-libexec/ipsec/plugins/libstrongswan-aes.la
-libexec/ipsec/plugins/libstrongswan-aes.so
-libexec/ipsec/plugins/libstrongswan-attr.a
-libexec/ipsec/plugins/libstrongswan-attr.la
-libexec/ipsec/plugins/libstrongswan-attr.so
-libexec/ipsec/plugins/libstrongswan-des.a
-libexec/ipsec/plugins/libstrongswan-des.la
-libexec/ipsec/plugins/libstrongswan-des.so
-libexec/ipsec/plugins/libstrongswan-constraints.a
-libexec/ipsec/plugins/libstrongswan-constraints.la
-libexec/ipsec/plugins/libstrongswan-constraints.so
-libexec/ipsec/plugins/libstrongswan-dnskey.a
-libexec/ipsec/plugins/libstrongswan-dnskey.la
-libexec/ipsec/plugins/libstrongswan-dnskey.so
-libexec/ipsec/plugins/libstrongswan-fips-prf.a
-libexec/ipsec/plugins/libstrongswan-fips-prf.la
-libexec/ipsec/plugins/libstrongswan-fips-prf.so
-libexec/ipsec/plugins/libstrongswan-gmp.a
-libexec/ipsec/plugins/libstrongswan-gmp.la
-libexec/ipsec/plugins/libstrongswan-gmp.so
-libexec/ipsec/plugins/libstrongswan-hmac.a
-libexec/ipsec/plugins/libstrongswan-hmac.la
-libexec/ipsec/plugins/libstrongswan-hmac.so
-libexec/ipsec/plugins/libstrongswan-kernel-pfkey.a
-libexec/ipsec/plugins/libstrongswan-kernel-pfkey.la
-libexec/ipsec/plugins/libstrongswan-kernel-pfkey.so
-libexec/ipsec/plugins/libstrongswan-kernel-pfroute.a
-libexec/ipsec/plugins/libstrongswan-kernel-pfroute.la
-libexec/ipsec/plugins/libstrongswan-kernel-pfroute.so
-libexec/ipsec/plugins/libstrongswan-md5.a
-libexec/ipsec/plugins/libstrongswan-md5.la
-libexec/ipsec/plugins/libstrongswan-md5.so
-libexec/ipsec/plugins/libstrongswan-pem.a
-libexec/ipsec/plugins/libstrongswan-pem.la
-libexec/ipsec/plugins/libstrongswan-pem.so
-libexec/ipsec/plugins/libstrongswan-pgp.a
-libexec/ipsec/plugins/libstrongswan-pgp.la
-libexec/ipsec/plugins/libstrongswan-pgp.so
-libexec/ipsec/plugins/libstrongswan-pkcs1.a
-libexec/ipsec/plugins/libstrongswan-pkcs1.la
-libexec/ipsec/plugins/libstrongswan-pkcs1.so
-libexec/ipsec/plugins/libstrongswan-pubkey.a
-libexec/ipsec/plugins/libstrongswan-pubkey.la
-libexec/ipsec/plugins/libstrongswan-pubkey.so
-libexec/ipsec/plugins/libstrongswan-random.a
-libexec/ipsec/plugins/libstrongswan-random.la
-libexec/ipsec/plugins/libstrongswan-random.so
-libexec/ipsec/plugins/libstrongswan-resolve.a
-libexec/ipsec/plugins/libstrongswan-resolve.la
-libexec/ipsec/plugins/libstrongswan-resolve.so
-libexec/ipsec/plugins/libstrongswan-sha1.a
-libexec/ipsec/plugins/libstrongswan-sha1.la
-libexec/ipsec/plugins/libstrongswan-sha1.so
-libexec/ipsec/plugins/libstrongswan-sha2.a
-libexec/ipsec/plugins/libstrongswan-sha2.la
-libexec/ipsec/plugins/libstrongswan-sha2.so
-libexec/ipsec/plugins/libstrongswan-revocation.a
-libexec/ipsec/plugins/libstrongswan-revocation.la
-libexec/ipsec/plugins/libstrongswan-revocation.so
-libexec/ipsec/plugins/libstrongswan-socket-default.a
-libexec/ipsec/plugins/libstrongswan-socket-default.la
-libexec/ipsec/plugins/libstrongswan-socket-default.so
-libexec/ipsec/plugins/libstrongswan-stroke.a
-libexec/ipsec/plugins/libstrongswan-stroke.la
-libexec/ipsec/plugins/libstrongswan-stroke.so
-libexec/ipsec/plugins/libstrongswan-updown.a
-libexec/ipsec/plugins/libstrongswan-updown.la
-libexec/ipsec/plugins/libstrongswan-updown.so
-libexec/ipsec/plugins/libstrongswan-x509.a
-libexec/ipsec/plugins/libstrongswan-x509.la
-libexec/ipsec/plugins/libstrongswan-x509.so
-libexec/ipsec/plugins/libstrongswan-xcbc.a
-libexec/ipsec/plugins/libstrongswan-xcbc.la
-libexec/ipsec/plugins/libstrongswan-xcbc.so
 libexec/ipsec/starter
 libexec/ipsec/stroke
+libexec/ipsec/whitelist
 sbin/ipsec
-@dirrm libexec/ipsec/plugins
+%%EAPAKA3GPP2%%lib/ipsec/plugins/libstrongswan-eap-aka.a
+%%EAPAKA3GPP2%%lib/ipsec/plugins/libstrongswan-eap-aka.la
+%%EAPAKA3GPP2%%lib/ipsec/plugins/libstrongswan-eap-aka.so
+%%EAPAKA3GPP2%%lib/ipsec/plugins/libstrongswan-eap-aka-3gpp2.a
+%%EAPAKA3GPP2%%lib/ipsec/plugins/libstrongswan-eap-aka-3gpp2.la
+%%EAPAKA3GPP2%%lib/ipsec/plugins/libstrongswan-eap-aka-3gpp2.so
+%%EAPAKA3GPP2%%lib/ipsec/plugins/libstrongswan-gmp.a
+%%EAPAKA3GPP2%%lib/ipsec/plugins/libstrongswan-gmp.la
+%%EAPAKA3GPP2%%lib/ipsec/plugins/libstrongswan-gmp.so
+%%EAPSIMFILE%%lib/ipsec/plugins/libstrongswan-eap-sim.a
+%%EAPSIMFILE%%lib/ipsec/plugins/libstrongswan-eap-sim.la
+%%EAPSIMFILE%%lib/ipsec/plugins/libstrongswan-eap-sim.so
+%%EAPSIMFILE%%lib/ipsec/plugins/libstrongswan-eap-sim-file.a
+%%EAPSIMFILE%%lib/ipsec/plugins/libstrongswan-eap-sim-file.la
+%%EAPSIMFILE%%lib/ipsec/plugins/libstrongswan-eap-sim-file.so
+%%CURL%%lib/ipsec/plugins/libstrongswan-curl.a
+%%CURL%%lib/ipsec/plugins/libstrongswan-curl.la
+%%CURL%%lib/ipsec/plugins/libstrongswan-curl.so
+%%MYSQL%%lib/ipsec/plugins/libstrongswan-mysql.a
+%%MYSQL%%lib/ipsec/plugins/libstrongswan-mysql.la
+%%MYSQL%%lib/ipsec/plugins/libstrongswan-mysql.so
+%%SQL%%lib/ipsec/plugins/libstrongswan-attr-sql.a
+%%SQL%%lib/ipsec/plugins/libstrongswan-attr-sql.la
+%%SQL%%lib/ipsec/plugins/libstrongswan-attr-sql.so
+%%SQL%%lib/ipsec/plugins/libstrongswan-sql.a
+%%SQL%%lib/ipsec/plugins/libstrongswan-sql.la
+%%SQL%%lib/ipsec/plugins/libstrongswan-sql.so
+%%SQL%%libexec/ipsec/pool
+%%SQLITE%%lib/ipsec/plugins/libstrongswan-sqlite.a
+%%SQLITE%%lib/ipsec/plugins/libstrongswan-sqlite.la
+%%SQLITE%%lib/ipsec/plugins/libstrongswan-sqlite.so
 @dirrm libexec/ipsec
+@dirrm lib/ipsec/plugins
+@dirrm lib/ipsec
 @dirrm etc/ipsec.d/reqs
 @dirrm etc/ipsec.d/private
 @dirrm etc/ipsec.d/ocspcerts