From 43165e26af3d74ce379a8ce5440f0ad664994b44 Mon Sep 17 00:00:00 2001 From: Matthias Schiffer Date: Sat, 7 Apr 2012 00:21:03 +0200 Subject: [PATCH 01/11] Add libuecc package This adds a package for the Elliptic Curve Cryptography library libuecc which is a dependency for the fastd tunneling daemon. --- libs/libuecc/Makefile | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 libs/libuecc/Makefile diff --git a/libs/libuecc/Makefile b/libs/libuecc/Makefile new file mode 100644 index 0000000..c944043 --- /dev/null +++ b/libs/libuecc/Makefile @@ -0,0 +1,38 @@ +# +# Copyright (C) 2012 OpenWrt.org +# +# This is free software, licensed under the GNU General Public License v2. +# See /LICENSE for more information. +# + +include $(TOPDIR)/rules.mk + +PKG_NAME:=libuecc +PKG_VERSION:=0.1 +PKG_RELEASE:=1 + +PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2 +PKG_SOURCE_URL:=https://projects.universe-factory.net/attachments/download/1 +PKG_MD5SUM:=a4a336d54d97ffb5842f87c48a7ad3e4 + +include $(INCLUDE_DIR)/package.mk +include $(INCLUDE_DIR)/cmake.mk + +define Package/libuecc + SECTION:=libs + CATEGORY:=Libraries + TITLE:=Very small Elliptic Curve Cryptography library + URL:=http://git.universe-factory.net/libuecc/ +endef + +CMAKE_OPTIONS += \ + -DCMAKE_BUILD_TYPE:String="MINSIZEREL" + +define Build/InstallDev + $(INSTALL_DIR) $(1)/usr/include + $(CP) $(PKG_INSTALL_DIR)/usr/include/libuecc $(1)/usr/include/ + $(INSTALL_DIR) $(1)/usr/lib + $(CP) $(PKG_INSTALL_DIR)/usr/lib/libuecc.a $(1)/usr/lib/ +endef + +$(eval $(call BuildPackage,libuecc)) From d7af1bf78b2872a0eb0a2b5a2ec0f7fa3eedfc69 Mon Sep 17 00:00:00 2001 From: Matthias Schiffer Date: Wed, 4 Jul 2012 17:04:15 +0200 Subject: [PATCH 02/11] Add fastd package --- net/fastd/Config.in | 14 +++ net/fastd/Makefile | 78 +++++++++++++ net/fastd/files/fastd.config | 61 +++++++++++ net/fastd/files/fastd.init | 199 ++++++++++++++++++++++++++++++++++ net/fastd/files/fastd.upgrade | 1 + 5 files changed, 353 insertions(+) create mode 100644 net/fastd/Config.in create mode 100644 net/fastd/Makefile create mode 100644 net/fastd/files/fastd.config create mode 100644 net/fastd/files/fastd.init create mode 100644 net/fastd/files/fastd.upgrade diff --git a/net/fastd/Config.in b/net/fastd/Config.in new file mode 100644 index 0000000..e12705b --- /dev/null +++ b/net/fastd/Config.in @@ -0,0 +1,14 @@ +menu "Configuration" + depends on PACKAGE_fastd + +config FASTD_DISABLE_METHOD_XSALSA20_POLY1305 + bool "Disable xsalsa20-poly1305 method" + depends on PACKAGE_fastd + default n + +config FASTD_DISABLE_METHOD_AES128_GCM + bool "Disable aes128-gcm method" + depends on PACKAGE_fastd + default n + +endmenu diff --git a/net/fastd/Makefile b/net/fastd/Makefile new file mode 100644 index 0000000..175073d --- /dev/null +++ b/net/fastd/Makefile @@ -0,0 +1,78 @@ +# +# Copyright (C) 2012 OpenWrt.org +# +# This is free software, licensed under the GNU General Public License v2. +# See /LICENSE for more information. +# + +include $(TOPDIR)/rules.mk + +PKG_NAME:=fastd +PKG_VERSION:=0.5-rc2 +PKG_RELEASE:=1 + +PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2 +PKG_SOURCE_URL:=https://projects.universe-factory.net/attachments/download/32 +PKG_MD5SUM:=74b2ab08f90303f8ae1937e99c734134 + +PKG_CONFIG_DEPENDS:=CONFIG_FASTD_DISABLE_METHOD_XSALSA20_POLY1305 CONFIG_FASTD_DISABLE_METHOD_AES128_GCM +PKG_BUILD_DEPENDS:=nacl libuecc + +include $(INCLUDE_DIR)/package.mk +include $(INCLUDE_DIR)/cmake.mk + +define Package/fastd + SECTION:=net + CATEGORY:=Network + DEPENDS:=+kmod-tun +librt +libpthread + TITLE:=Fast and Secure Tunneling Daemon + URL:=https://projects.universe-factory.net/projects/fastd + SUBMENU:=VPN +endef + +define Package/fastd/config + source "$(SOURCE)/Config.in" +endef + +CMAKE_OPTIONS += \ + -DCMAKE_BUILD_TYPE:String="MINSIZEREL" \ + + +ifeq ($(CONFIG_FASTD_DISABLE_METHOD_XSALSA20_POLY1305),y) +CMAKE_OPTIONS += \ + -DWITH_METHOD_XSALSA20_POLY1305:BOOL=FALSE +else +CMAKE_OPTIONS += \ + -DWITH_METHOD_XSALSA20_POLY1305:BOOL=TRUE +endif + +ifeq ($(CONFIG_FASTD_DISABLE_METHOD_AES128_GCM),y) +CMAKE_OPTIONS += \ + -DWITH_METHOD_AES128_GCM:BOOL=FALSE +else +CMAKE_OPTIONS += \ + -DWITH_METHOD_AES128_GCM:BOOL=TRUE +endif + +define Package/fastd/description + Fast and secure tunneling daemon, which is optimized on small code size and few dependencies +endef + +define Package/fastd/conffiles +/etc/config/fastd +endef + +define Package/fastd/install + $(INSTALL_DIR) $(1)/usr/sbin + $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/fastd $(1)/usr/sbin/ + + $(INSTALL_DIR) $(1)/etc/init.d/ + $(INSTALL_BIN) files/fastd.init $(1)/etc/init.d/fastd + $(INSTALL_DIR) $(1)/etc/config + $(INSTALL_CONF) files/fastd.config $(1)/etc/config/fastd + $(INSTALL_DIR) $(1)/etc/fastd + $(INSTALL_DIR) $(1)/lib/upgrade/keep.d + $(INSTALL_DATA) files/fastd.upgrade $(1)/lib/upgrade/keep.d/fastd +endef + +$(eval $(call BuildPackage,fastd)) diff --git a/net/fastd/files/fastd.config b/net/fastd/files/fastd.config new file mode 100644 index 0000000..0828e45 --- /dev/null +++ b/net/fastd/files/fastd.config @@ -0,0 +1,61 @@ +package fastd + +config fastd sample_config + + # Set to 1 to enable this instance: + option enabled 0 + + # Sets a static config file, optional + # Options set via UCI have higher priority that statically configured ones + # If a config file is set all other options except the interface may become optional if the are set in the file +# list config '/etc/fastd/sample_config/fastd.conf' + + # Sets a directory from which peers configurations are read + # The peer list can be reloaded without restarting fastd + # This is currently the only way to configure the peers + list config_peer_dir '/etc/fastd/sample_config/peers' + + # Sets the log level + # Possible values: error, warn, info, verbose, debug + # Default: info + option syslog_level 'info' + + # IP address and port of the local end, optional + # 'any' can be used to bind to both IPv4 and IPv6 + # If the port is 0 fastd will bind to a random port +# option bind 'any:1337' +# option bind '0.0.0.0:1337' +# option bind '[::]:1337' + + # "method null" uses no encryption or MAC + # "method xsalsa20-poly1305" uses the XSalsa20 encryption ad the Poly1305 MAC + option method 'xsalsa20-poly1305' + + # "mode tap" will create an ethernet tunnel (tap device), + # "mode tun" will create an IP tunnel (tun device). + option mode 'tap' + + # Set the name of the tunnel interface to use + option interface 'tap0' +# option interface 'tun0' +# option interface 'fastd0' + + # Sets the MTU of the tunnel interface, default is 1500 + # 1426 is a good value that avoids fragmentation for the xsalsa20-poly1305 method + # when the tunnel uses an IPv4 connection on a line with an MTU of 1492 or higher + option mtu 1426 + + # Enables direct forwaring of packets between peers + # WARNING: Only enable this if you know what you are doing, as this can lead to forwarding loops! + option forward 0 + + # The secret key + # A keypair can be generated with `fastd --generate-key` + # When the corresponding public key is lost it can be recovered with `/etc/init.d/fastd show-key ` +# option secret '0000000000000000000000000000000000000000000000000000000000000000' + + # command to configure IP addresses etc. after the tunnel interface is up; $1 will be the interface name (optional) +# option up '' + + # command to execute before the tunnel interface is set down; $1 will be the interface name (optional) +# option down '' diff --git a/net/fastd/files/fastd.init b/net/fastd/files/fastd.init new file mode 100644 index 0000000..0f347af --- /dev/null +++ b/net/fastd/files/fastd.init @@ -0,0 +1,199 @@ +#!/bin/sh /etc/rc.common +# Copyright (C) 2012 OpenWrt.org + +START=95 + +EXTRA_COMMANDS="up down show_key" + +LIST_SEP=" +" +TMP_FASTD=/tmp/fastd +FASTD_COMMAND=/usr/sbin/fastd + +append_opt() { + local v="$1"; local p="$2" + + OPTS="$OPTS --${p//_/-} '${v//'/\\'}'" +} + +append_opt_bool() { + local p="$1" + + OPTS="$OPTS --${p//_/-}" +} + +append_opts() { + local p; local v; local s="$1"; shift + for p in $*; do + config_get v "$s" "$p" + [ -n "$v" ] && append_opt "$v" "$p" + done +} + +append_opts_bool() { + local p; local v; local s="$1"; shift + for p in $*; do + config_get_bool v "$s" "$p" 0 + [ "$v" == 1 ] && append_opt_bool "$p" + done +} + +append_opts_list() { + local p; local s="$1"; shift + for p in $*; do + config_list_foreach "$s" "$p" append_opt "$p" + done +} + +section_enabled() { + config_get_bool enabled "$1" 'enabled' 0 + [ $enabled -gt 0 ] +} + +error() { + echo "${initscript}:" "$@" 1>&2 +} + +start_instance() { + local s="$1" + + section_enabled "$s" || return 1 + + SERVICE_PID_FILE="/var/run/fastd.$s.pid" + OPTS="" + + config_get interface "$s" interface + if [ -z "$interface" ]; then + error "$s: interface is not set" + return 1 + fi + + if ifconfig "$interface" &>/dev/null; then + error "$s: interface '$interface' is already in use" + return 1 + fi + + config_get secret "$s" secret + if [ -z "$secret" ]; then + error "$s: secret is not set" + return 1 + fi + + append_opts_list "$s" config config_peer_dir + append_opts "$s" syslog_level bind method mode interface mtu + append_opts_bool "$s" forward + + mkdir -p "$TMP_FASTD" + echo "secret \"$secret\";" > "$TMP_FASTD/secret.$s.conf" + + eval service_start "'$FASTD_COMMAND'" --daemon --pid-file "'$SERVICE_PID_FILE'" --syslog-level info $OPTS --config "'$TMP_FASTD/secret.$s.conf'" + + if ! ifconfig "$interface" >/dev/null 2>&1; then + error "$s: startup failed" + return 1 + fi + + config_get up "$s" up + [ -n "$up" ] && sh -c "$up" - "$interface" +} + +stop_instance() { + local s="$1" + + section_enabled "$s" || return 1 + + SERVICE_PID_FILE="/var/run/fastd.$s.pid" + + config_get interface "$s" interface + if [ -z "$interface" ]; then + error "$s: interface is not set" + return 1 + fi + + if ! ifconfig "$interface" &>/dev/null; then + error "$s: interface '$interface' does not exist" + return 1 + fi + + config_get down "$s" down + [ -n "$down" ] && sh -c "$down" - "$interface" + + service_stop "$FASTD_COMMAND" + + rm -f "$TMP_FASTD/secret.$s.conf" +} + +show_key_instance() { + local s="$1" + + config_get secret "$s" secret + if [ -z "$secret" ]; then + error "$s: secret is not set" + return 1 + fi + + mkdir -p "$TMP_FASTD" + echo "secret \"$secret\";" > "$TMP_FASTD/secret.$s.conf" + + "$FASTD_COMMAND" --config "$TMP_FASTD/secret.$s.conf" --show-key --machine-readable +} + +reload_instance() { + local s="$1" + + section_enabled "$s" || return 1 + + SERVICE_PID_FILE="/var/run/fastd.$s.pid" + service_reload "$FASTD_COMMAND" +} + +start() { + config_load 'fastd' + config_foreach start_instance 'fastd' +} + +stop() { + config_load 'fastd' + config_foreach stop_instance 'fastd' +} + +reload() { + config_load 'fastd' + config_foreach reload_instance 'fastd' +} + +up() { + local exists + local instance + config_load 'fastd' + for instance in "$@"; do + config_get exists "$instance" 'TYPE' + if [ "$exists" == "fastd" ]; then + start_instance "$instance" + fi + done +} + +down() { + local exists + local instance + config_load 'fastd' + for instance in "$@"; do + config_get exists "$instance" 'TYPE' + if [ "$exists" == "fastd" ]; then + stop_instance "$instance" + fi + done +} + +show_key() { + local exists + local instance + config_load 'fastd' + for instance in "$@"; do + config_get exists "$instance" 'TYPE' + if [ "$exists" == "fastd" ]; then + show_key_instance "$instance" + fi + done +} diff --git a/net/fastd/files/fastd.upgrade b/net/fastd/files/fastd.upgrade new file mode 100644 index 0000000..7406613 --- /dev/null +++ b/net/fastd/files/fastd.upgrade @@ -0,0 +1 @@ +/etc/fastd/ From 16f4ebbc71b86e01f3b60215138608353f069168 Mon Sep 17 00:00:00 2001 From: Matthias Schiffer Date: Sun, 16 Sep 2012 07:52:00 +0200 Subject: [PATCH 03/11] Update fastd to version 0.5-rc4 --- net/fastd/Makefile | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/net/fastd/Makefile b/net/fastd/Makefile index 175073d..d218401 100644 --- a/net/fastd/Makefile +++ b/net/fastd/Makefile @@ -8,12 +8,12 @@ include $(TOPDIR)/rules.mk PKG_NAME:=fastd -PKG_VERSION:=0.5-rc2 +PKG_VERSION:=0.5-rc4 PKG_RELEASE:=1 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2 -PKG_SOURCE_URL:=https://projects.universe-factory.net/attachments/download/32 -PKG_MD5SUM:=74b2ab08f90303f8ae1937e99c734134 +PKG_SOURCE_URL:=https://projects.universe-factory.net/attachments/download/34 +PKG_MD5SUM:=f341811a69146e1befc14a7920781511 PKG_CONFIG_DEPENDS:=CONFIG_FASTD_DISABLE_METHOD_XSALSA20_POLY1305 CONFIG_FASTD_DISABLE_METHOD_AES128_GCM PKG_BUILD_DEPENDS:=nacl libuecc From 7e7dd100ab448590c5582249efc76d0d447a6428 Mon Sep 17 00:00:00 2001 From: Matthias Schiffer Date: Fri, 21 Sep 2012 17:17:00 +0200 Subject: [PATCH 04/11] Update fastd to v0.5 --- net/fastd/Config.in | 32 ++++++++++++++++++---- net/fastd/Makefile | 67 +++++++++++++++++++++++++++++++++++---------- 2 files changed, 79 insertions(+), 20 deletions(-) diff --git a/net/fastd/Config.in b/net/fastd/Config.in index e12705b..93d4375 100644 --- a/net/fastd/Config.in +++ b/net/fastd/Config.in @@ -1,14 +1,34 @@ menu "Configuration" depends on PACKAGE_fastd -config FASTD_DISABLE_METHOD_XSALSA20_POLY1305 - bool "Disable xsalsa20-poly1305 method" +config FASTD_ENABLE_METHOD_XSALSA20_POLY1305 + bool "Enable xsalsa20-poly1305 method" depends on PACKAGE_fastd - default n + default y -config FASTD_DISABLE_METHOD_AES128_GCM - bool "Disable aes128-gcm method" +config FASTD_ENABLE_METHOD_AES128_GCM + bool "Enable aes128-gcm method" + depends on PACKAGE_fastd && (FASTD_ENABLE_CRYPTO_AES128CTR_NACL || FASTD_ENABLE_CRYPTO_AES128CTR_LINUX) && (FASTD_ENABLE_CRYPTO_GHASH_BUILTIN || FASTD_ENABLE_CRYPTO_GHASH_LINUX) + default y + +config FASTD_ENABLE_CRYPTO_AES128CTR_NACL + bool "Include the AES128-CTR implementation from the NaCl library" depends on PACKAGE_fastd - default n + default y + +config FASTD_ENABLE_CRYPTO_AES128CTR_LINUX + bool "Support using the AES128-CTR implementation in the Linux kernel" + depends on PACKAGE_fastd + default y + +config FASTD_ENABLE_CRYPTO_GHASH_BUILTIN + bool "Include the built-in GHASH implementation" + depends on PACKAGE_fastd + default y + +config FASTD_ENABLE_CRYPTO_GHASH_LINUX + bool "Support using the GHASH implementation in the Linux kernel" + depends on PACKAGE_fastd + default y endmenu diff --git a/net/fastd/Makefile b/net/fastd/Makefile index d218401..e69cf09 100644 --- a/net/fastd/Makefile +++ b/net/fastd/Makefile @@ -8,14 +8,20 @@ include $(TOPDIR)/rules.mk PKG_NAME:=fastd -PKG_VERSION:=0.5-rc4 +PKG_VERSION:=0.5 PKG_RELEASE:=1 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2 -PKG_SOURCE_URL:=https://projects.universe-factory.net/attachments/download/34 -PKG_MD5SUM:=f341811a69146e1befc14a7920781511 +PKG_SOURCE_URL:=https://projects.universe-factory.net/attachments/download/35 +PKG_MD5SUM:=f7cc6fdddf52aab2b3f582d22159de4f -PKG_CONFIG_DEPENDS:=CONFIG_FASTD_DISABLE_METHOD_XSALSA20_POLY1305 CONFIG_FASTD_DISABLE_METHOD_AES128_GCM +PKG_CONFIG_DEPENDS:=\ + CONFIG_FASTD_ENABLE_METHOD_XSALSA20_POLY1305 \ + CONFIG_FASTD_ENABLE_METHOD_AES128_GCM \ + CONFIG_FASTD_ENABLE_CRYPTO_AES128CTR_NACL \ + CONFIG_FASTD_ENABLE_CRYPTO_AES128CTR_LINUX \ + CONFIG_FASTD_ENABLE_CRYPTO_GHASH_BUILTIN \ + CONFIG_FASTD_ENABLE_CRYPTO_GHASH_LINUX \ PKG_BUILD_DEPENDS:=nacl libuecc include $(INCLUDE_DIR)/package.mk @@ -38,22 +44,55 @@ CMAKE_OPTIONS += \ -DCMAKE_BUILD_TYPE:String="MINSIZEREL" \ -ifeq ($(CONFIG_FASTD_DISABLE_METHOD_XSALSA20_POLY1305),y) -CMAKE_OPTIONS += \ - -DWITH_METHOD_XSALSA20_POLY1305:BOOL=FALSE -else +ifeq ($(CONFIG_FASTD_ENABLE_METHOD_XSALSA20_POLY1305),y) CMAKE_OPTIONS += \ -DWITH_METHOD_XSALSA20_POLY1305:BOOL=TRUE -endif - -ifeq ($(CONFIG_FASTD_DISABLE_METHOD_AES128_GCM),y) -CMAKE_OPTIONS += \ - -DWITH_METHOD_AES128_GCM:BOOL=FALSE else CMAKE_OPTIONS += \ - -DWITH_METHOD_AES128_GCM:BOOL=TRUE + -DWITH_METHOD_XSALSA20_POLY1305:BOOL=FALSE endif +ifeq ($(CONFIG_FASTD_ENABLE_METHOD_AES128_GCM),y) +CMAKE_OPTIONS += \ + -DWITH_METHOD_AES128_GCM:BOOL=TRUE +else +CMAKE_OPTIONS += \ + -DWITH_METHOD_AES128_GCM:BOOL=FALSE +endif + +ifeq ($(CONFIG_FASTD_ENABLE_CRYPTO_AES128CTR_NACL),y) +CMAKE_OPTIONS += \ + -DWITH_CRYPTO_AES128CTR_NACL:BOOL=TRUE +else +CMAKE_OPTIONS += \ + -DWITH_CRYPTO_AES128CTR_NACL:BOOL=FALSE +endif + +ifeq ($(CONFIG_FASTD_ENABLE_CRYPTO_AES128CTR_LINUX),y) +CMAKE_OPTIONS += \ + -DWITH_CRYPTO_AES128CTR_LINUX:BOOL=TRUE +else +CMAKE_OPTIONS += \ + -DWITH_CRYPTO_AES128CTR_LINUX:BOOL=FALSE +endif + +ifeq ($(CONFIG_FASTD_ENABLE_CRYPTO_GHASH_BUILTIN),y) +CMAKE_OPTIONS += \ + -DWITH_CRYPTO_GHASH_BUILTIN:BOOL=TRUE +else +CMAKE_OPTIONS += \ + -DWITH_CRYPTO_GHASH_BUILTIN:BOOL=FALSE +endif + +ifeq ($(CONFIG_FASTD_ENABLE_CRYPTO_GHASH_LINUX),y) +CMAKE_OPTIONS += \ + -DWITH_CRYPTO_GHASH_LINUX:BOOL=TRUE +else +CMAKE_OPTIONS += \ + -DWITH_CRYPTO_GHASH_LINUX:BOOL=FALSE +endif + + define Package/fastd/description Fast and secure tunneling daemon, which is optimized on small code size and few dependencies endef From 203e0c042cececfe7df06ca9bc4231f491dd2892 Mon Sep 17 00:00:00 2001 From: Matthias Schiffer Date: Thu, 27 Sep 2012 00:21:03 +0200 Subject: [PATCH 05/11] Fix build depends --- net/fastd/Makefile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/fastd/Makefile b/net/fastd/Makefile index e69cf09..33f90c6 100644 --- a/net/fastd/Makefile +++ b/net/fastd/Makefile @@ -21,7 +21,8 @@ PKG_CONFIG_DEPENDS:=\ CONFIG_FASTD_ENABLE_CRYPTO_AES128CTR_NACL \ CONFIG_FASTD_ENABLE_CRYPTO_AES128CTR_LINUX \ CONFIG_FASTD_ENABLE_CRYPTO_GHASH_BUILTIN \ - CONFIG_FASTD_ENABLE_CRYPTO_GHASH_LINUX \ + CONFIG_FASTD_ENABLE_CRYPTO_GHASH_LINUX + PKG_BUILD_DEPENDS:=nacl libuecc include $(INCLUDE_DIR)/package.mk From d6cbae9885a5d2f34af760da7cf30abcf44355e6 Mon Sep 17 00:00:00 2001 From: Matthias Schiffer Date: Sat, 10 Nov 2012 18:17:41 +0100 Subject: [PATCH 06/11] Update fastd to v6 --- net/fastd/Makefile | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/net/fastd/Makefile b/net/fastd/Makefile index 33f90c6..0a169a6 100644 --- a/net/fastd/Makefile +++ b/net/fastd/Makefile @@ -8,12 +8,12 @@ include $(TOPDIR)/rules.mk PKG_NAME:=fastd -PKG_VERSION:=0.5 +PKG_VERSION:=6 PKG_RELEASE:=1 -PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2 -PKG_SOURCE_URL:=https://projects.universe-factory.net/attachments/download/35 -PKG_MD5SUM:=f7cc6fdddf52aab2b3f582d22159de4f +PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz +PKG_SOURCE_URL:=https://projects.universe-factory.net/attachments/download/36 +PKG_MD5SUM:=91c871830b2ceeaf54470332825844c7 PKG_CONFIG_DEPENDS:=\ CONFIG_FASTD_ENABLE_METHOD_XSALSA20_POLY1305 \ From 8f284eac0e275059d58f6e5d2996794e8f0fe346 Mon Sep 17 00:00:00 2001 From: Matthias Schiffer Date: Mon, 19 Nov 2012 18:36:02 +0100 Subject: [PATCH 07/11] Make bind and method lists instead of options --- net/fastd/files/fastd.config | 8 ++++---- net/fastd/files/fastd.init | 4 ++-- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/net/fastd/files/fastd.config b/net/fastd/files/fastd.config index 0828e45..a51de60 100644 --- a/net/fastd/files/fastd.config +++ b/net/fastd/files/fastd.config @@ -23,13 +23,13 @@ config fastd sample_config # IP address and port of the local end, optional # 'any' can be used to bind to both IPv4 and IPv6 # If the port is 0 fastd will bind to a random port -# option bind 'any:1337' -# option bind '0.0.0.0:1337' -# option bind '[::]:1337' +# list bind 'any:1337' +# list bind '0.0.0.0:1337' +# list bind '[::]:1337' # "method null" uses no encryption or MAC # "method xsalsa20-poly1305" uses the XSalsa20 encryption ad the Poly1305 MAC - option method 'xsalsa20-poly1305' + list method 'xsalsa20-poly1305' # "mode tap" will create an ethernet tunnel (tap device), # "mode tun" will create an IP tunnel (tun device). diff --git a/net/fastd/files/fastd.init b/net/fastd/files/fastd.init index 0f347af..279a7d3 100644 --- a/net/fastd/files/fastd.init +++ b/net/fastd/files/fastd.init @@ -79,8 +79,8 @@ start_instance() { return 1 fi - append_opts_list "$s" config config_peer_dir - append_opts "$s" syslog_level bind method mode interface mtu + append_opts_list "$s" config config_peer_dir bind method + append_opts "$s" syslog_level mode interface mtu append_opts_bool "$s" forward mkdir -p "$TMP_FASTD" From 2a57741dfe8d4fb4f1a28af0dab21df69239e451 Mon Sep 17 00:00:00 2001 From: Matthias Schiffer Date: Sat, 12 Jan 2013 12:22:39 +0100 Subject: [PATCH 08/11] Update libuecc to v3 --- libs/libuecc/Makefile | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/libs/libuecc/Makefile b/libs/libuecc/Makefile index c944043..ad34f26 100644 --- a/libs/libuecc/Makefile +++ b/libs/libuecc/Makefile @@ -8,12 +8,12 @@ include $(TOPDIR)/rules.mk PKG_NAME:=libuecc -PKG_VERSION:=0.1 +PKG_VERSION:=3 PKG_RELEASE:=1 -PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2 -PKG_SOURCE_URL:=https://projects.universe-factory.net/attachments/download/1 -PKG_MD5SUM:=a4a336d54d97ffb5842f87c48a7ad3e4 +PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz +PKG_SOURCE_URL:=https://projects.universe-factory.net/attachments/download/42 +PKG_MD5SUM:=3c45ffecc7709ea929892993808e218e include $(INCLUDE_DIR)/package.mk include $(INCLUDE_DIR)/cmake.mk @@ -30,9 +30,11 @@ CMAKE_OPTIONS += \ define Build/InstallDev $(INSTALL_DIR) $(1)/usr/include - $(CP) $(PKG_INSTALL_DIR)/usr/include/libuecc $(1)/usr/include/ + $(CP) $(PKG_INSTALL_DIR)/usr/include/libuecc-$(PKG_VERSION) $(1)/usr/include/ $(INSTALL_DIR) $(1)/usr/lib $(CP) $(PKG_INSTALL_DIR)/usr/lib/libuecc.a $(1)/usr/lib/ + $(INSTALL_DIR) $(1)/usr/lib/pkgconfig + $(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/libuecc.pc $(1)/usr/lib/pkgconfig/ endef $(eval $(call BuildPackage,libuecc)) From cc6e38f2c91060a7afbbc226c5ad88f1720a8379 Mon Sep 17 00:00:00 2001 From: Matthias Schiffer Date: Sat, 12 Jan 2013 12:23:14 +0100 Subject: [PATCH 09/11] Update fastd to v7 --- net/fastd/Makefile | 12 ++++++------ net/fastd/files/fastd.init | 2 +- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/net/fastd/Makefile b/net/fastd/Makefile index 0a169a6..d78ca75 100644 --- a/net/fastd/Makefile +++ b/net/fastd/Makefile @@ -8,12 +8,12 @@ include $(TOPDIR)/rules.mk PKG_NAME:=fastd -PKG_VERSION:=6 +PKG_VERSION:=7 PKG_RELEASE:=1 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz -PKG_SOURCE_URL:=https://projects.universe-factory.net/attachments/download/36 -PKG_MD5SUM:=91c871830b2ceeaf54470332825844c7 +PKG_SOURCE_URL:=https://projects.universe-factory.net/attachments/download/43 +PKG_MD5SUM:=17dd6049d072f24dba9d959ac9edbc16 PKG_CONFIG_DEPENDS:=\ CONFIG_FASTD_ENABLE_METHOD_XSALSA20_POLY1305 \ @@ -43,7 +43,7 @@ endef CMAKE_OPTIONS += \ -DCMAKE_BUILD_TYPE:String="MINSIZEREL" \ - + -DWITH_CAPABILITIES=FALSE ifeq ($(CONFIG_FASTD_ENABLE_METHOD_XSALSA20_POLY1305),y) CMAKE_OPTIONS += \ @@ -103,8 +103,8 @@ define Package/fastd/conffiles endef define Package/fastd/install - $(INSTALL_DIR) $(1)/usr/sbin - $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/fastd $(1)/usr/sbin/ + $(INSTALL_DIR) $(1)/usr/bin + $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/fastd $(1)/usr/bin/ $(INSTALL_DIR) $(1)/etc/init.d/ $(INSTALL_BIN) files/fastd.init $(1)/etc/init.d/fastd diff --git a/net/fastd/files/fastd.init b/net/fastd/files/fastd.init index 279a7d3..56f5972 100644 --- a/net/fastd/files/fastd.init +++ b/net/fastd/files/fastd.init @@ -8,7 +8,7 @@ EXTRA_COMMANDS="up down show_key" LIST_SEP=" " TMP_FASTD=/tmp/fastd -FASTD_COMMAND=/usr/sbin/fastd +FASTD_COMMAND=/usr/bin/fastd append_opt() { local v="$1"; local p="$2" From 82c6942d468ebf3c079becf60348574ef28b627c Mon Sep 17 00:00:00 2001 From: Matthias Schiffer Date: Mon, 14 Jan 2013 05:23:38 +0100 Subject: [PATCH 10/11] Add support for generating keys to the init script --- net/fastd/files/fastd.init | 90 ++++++++++++++++++++++++++------------ 1 file changed, 62 insertions(+), 28 deletions(-) diff --git a/net/fastd/files/fastd.init b/net/fastd/files/fastd.init index 56f5972..dfae243 100644 --- a/net/fastd/files/fastd.init +++ b/net/fastd/files/fastd.init @@ -1,9 +1,9 @@ #!/bin/sh /etc/rc.common -# Copyright (C) 2012 OpenWrt.org +# Copyright (C) 2012-2013 OpenWrt.org START=95 -EXTRA_COMMANDS="up down show_key" +EXTRA_COMMANDS="up down show_key generate_key" LIST_SEP=" " @@ -34,7 +34,7 @@ append_opts_bool() { local p; local v; local s="$1"; shift for p in $*; do config_get_bool v "$s" "$p" 0 - [ "$v" == 1 ] && append_opt_bool "$p" + [ "$v" = 1 ] && append_opt_bool "$p" done } @@ -54,6 +54,46 @@ error() { echo "${initscript}:" "$@" 1>&2 } +get_key_instance() { + local s="$1" + + config_get secret "$s" secret + if [ "$secret" = 'generate' ]; then + secret=`fastd --generate-key --machine-readable` + uci -q set fastd."$s".secret="$secret" && uci -q commit fastd + fi + + echo "$secret" +} + +generate_key_instance() { + local s="$1" + + config_get secret "$s" secret + if [ -z "$secret" -o "$secret" = 'generate' ]; then + secret=`fastd --generate-key --machine-readable` + uci -q set fastd."$s".secret="$secret" && uci -q commit fastd + fi + + "$FASTD_COMMAND" --config - --show-key --machine-readable < "$TMP_FASTD/secret.$s.conf" - - eval service_start "'$FASTD_COMMAND'" --daemon --pid-file "'$SERVICE_PID_FILE'" --syslog-level info $OPTS --config "'$TMP_FASTD/secret.$s.conf'" + eval service_start "'$FASTD_COMMAND'" --daemon --pid-file "'$SERVICE_PID_FILE'" --syslog-level info $OPTS --config - </dev/null 2>&1; then error "$s: startup failed" @@ -119,23 +158,6 @@ stop_instance() { [ -n "$down" ] && sh -c "$down" - "$interface" service_stop "$FASTD_COMMAND" - - rm -f "$TMP_FASTD/secret.$s.conf" -} - -show_key_instance() { - local s="$1" - - config_get secret "$s" secret - if [ -z "$secret" ]; then - error "$s: secret is not set" - return 1 - fi - - mkdir -p "$TMP_FASTD" - echo "secret \"$secret\";" > "$TMP_FASTD/secret.$s.conf" - - "$FASTD_COMMAND" --config "$TMP_FASTD/secret.$s.conf" --show-key --machine-readable } reload_instance() { @@ -168,7 +190,7 @@ up() { config_load 'fastd' for instance in "$@"; do config_get exists "$instance" 'TYPE' - if [ "$exists" == "fastd" ]; then + if [ "$exists" = 'fastd' ]; then start_instance "$instance" fi done @@ -180,7 +202,7 @@ down() { config_load 'fastd' for instance in "$@"; do config_get exists "$instance" 'TYPE' - if [ "$exists" == "fastd" ]; then + if [ "$exists" = 'fastd' ]; then stop_instance "$instance" fi done @@ -192,8 +214,20 @@ show_key() { config_load 'fastd' for instance in "$@"; do config_get exists "$instance" 'TYPE' - if [ "$exists" == "fastd" ]; then + if [ "$exists" = 'fastd' ]; then show_key_instance "$instance" fi done } + +generate_key() { + local exists + local instance + config_load 'fastd' + for instance in "$@"; do + config_get exists "$instance" 'TYPE' + if [ "$exists" = 'fastd' ]; then + generate_key_instance "$instance" + fi + done +} From 85e1a33b41a2af1914ec29d1687c9f9f953357ca Mon Sep 17 00:00:00 2001 From: Matthias Schiffer Date: Mon, 14 Jan 2013 07:09:22 +0100 Subject: [PATCH 11/11] Allow specifying peers via UCI --- net/fastd/files/fastd.config | 35 +++++++++++++++++- net/fastd/files/fastd.init | 72 +++++++++++++++++++++++++++++++++++- 2 files changed, 105 insertions(+), 2 deletions(-) diff --git a/net/fastd/files/fastd.config b/net/fastd/files/fastd.config index a51de60..afba82c 100644 --- a/net/fastd/files/fastd.config +++ b/net/fastd/files/fastd.config @@ -12,7 +12,7 @@ config fastd sample_config # Sets a directory from which peers configurations are read # The peer list can be reloaded without restarting fastd - # This is currently the only way to configure the peers + # Peer can either be configured via UCI (see example below) or via peer dirs list config_peer_dir '/etc/fastd/sample_config/peers' # Sets the log level @@ -59,3 +59,36 @@ config fastd sample_config # command to execute before the tunnel interface is set down; $1 will be the interface name (optional) # option down '' + + +config peer sample_peer + + # Set to 1 to enable this peer: + option enabled 0 + + # Controls which instance this peer is associated with + option net 'sample_config' + + # The peer's public key + option key '0000000000000000000000000000000000000000000000000000000000000000' + + # A complete remote specification consists of an address or a hostname, and a port + # When a hostname is given, it is recommended to specify an address family to use + + # The address to connect to (optional) +# option address '192.0.2.1' +# option address '[2001:db8::1]' + + # The hostname to connect to (optional) +# option hostname 'example.com' + + # The address family to use to connect to the hostname (optional) + # Must be 'ipv4' or 'ipv6' + # Has no effect when an address is specified +# option address_family 'ipv4' + + # The remote port to connect to (optional) +# option port 1337 + + # Setting float to 1 allow incoming connections with this key from other addresses/hostnames/ports than the specified remote + option float 0 diff --git a/net/fastd/files/fastd.init b/net/fastd/files/fastd.init index dfae243..5cea2ee 100644 --- a/net/fastd/files/fastd.init +++ b/net/fastd/files/fastd.init @@ -54,6 +54,70 @@ error() { echo "${initscript}:" "$@" 1>&2 } +create_peer_config() { + local s="$2"; local peer="$1" + + config_get net "$peer" net + [ "$net" == "$s" ] || return 0 + + section_enabled "$peer" || return 0 + + config_get key "$peer" key + config_get address "$peer" address + config_get hostname "$peer" hostname + config_get address_family "$peer" address_family + config_get port "$peer" port + config_get_bool float "$peer" float 0 + + if [ -z "$key" ]; then + error "peer $peer: key is not set" + return 1 + fi + + local remote='' + if [ "$address" -o "$hostname" ]; then + if [ "$address" -a "$hostname" ]; then + error "peer $peer: both address and hostname given" + return 1 + fi + + if [ "$float" = 0 ]; then + float='' + else + float='float' + fi + + if [ "$port" ]; then + if [ "$address" ]; then + remote="remote $address port $port $float;" + else # $hostname + if [ "$address_family" -a "$address_family" != 'ipv4' -a "$address_family" != 'ipv6' ]; then + error "peer $peer: invalid address family given" + return 1 + fi + remote="remote $address_family \"$hostname\" port $port $float;" + fi + else + error "peer $peer: address or hostname, but no port given" + return 1 + fi + fi + + cat > "$TMP_FASTD/fastd.$s.peers/$peer" <