You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

117 lines
3.4 KiB

wireguard: version bump From upstream's changelog: * main: annotate init/exit functions to save memory * selftest: remove antique siphash self test * haskell: re-add updated haskell example * socket: use ip_rt_put instead of dst_release * device: avoid double icmp send on routing loop * compat: clean up cruft * global: cleanup IP header checking * compat: do not export symbols unnecessarily Various cleanups and updates. * device: netdevice destruction logic change for 4.12 When Linux 4.12 is released next week, we're good to go. * device: only use one sleep notifier Rather than have a separate sleep notification for every interface, we now have a single notifier for every interface. This improves performance, especially when creating many interfaces at once. * device: remove icmp conntrack hacks We're moving hacks upstream the proper way, and then backporting them to compat. * receive: extend rate limiting to 1 second after under load detection After we determine that we're under load, we now wait 1 second before not being under load again, a timer which is global across all interfaces on a given system. * curve25519: satisfy sparse and use short types * curve25519: keep certain sandy2x functions in C Certain functions have been made into C, which should improve stack frames and reliability. * ratelimiter: rewrite from scratch This is a big change. We no longer rely on x_tables or xt_hashlimit, instead using a super minimal and sleek token bucket ratelimiter. This works much better than the old cruft and should allow us to run more places. It also has the benefit of being global, so that it's possible to have thousands of interfaces without killing the system with separate GCs and vmallocs, which is what happened prior. * socket: verify saddr belongs to interface We now more quickly react to changes of the v4 routing table, by ensuring that the sticky source address is actually still valid. * wg-quick: properly match IPv6 endpoint wg-quick now works better with IPv6. * wg-quick: use printf -v instead of namerefs for bash 4.2 This adds support for old bash, which means wg-quick should be generically "bash 4 and up". I'm not happy about this but EL7 uses old bash, so we're stuck with it. * compat: support EL7.3 Support for RHEL, CentOS, ScientificLinux, and so forth. * compat: support Ubuntu 14.04 An old crufty Ubuntu is now supported, since it's LTS.
8 years ago
  1. #
  2. # Copyright (C) 2016-2017 Jason A. Donenfeld <Jason@zx2c4.com>
  3. # Copyright (C) 2016 Baptiste Jonglez <openwrt@bitsofnetworks.org>
  4. # Copyright (C) 2016-2017 Dan Luedtke <mail@danrl.com>
  5. #
  6. # This is free software, licensed under the GNU General Public License v2.
  7. # See /LICENSE for more information.
  8. include $(TOPDIR)/rules.mk
  9. include $(INCLUDE_DIR)/kernel.mk
  10. PKG_NAME:=wireguard
  11. PKG_VERSION:=0.0.20170907
  12. PKG_RELEASE:=1
  13. PKG_SOURCE:=WireGuard-$(PKG_VERSION).tar.xz
  14. PKG_SOURCE_URL:=https://git.zx2c4.com/WireGuard/snapshot/
  15. PKG_HASH:=a1ee12d60662607e4c5a19f84b5115e56f083e2600053882e161537f12d963fd
  16. PKG_LICENSE:=GPL-2.0
  17. PKG_LICENSE_FILES:=COPYING
  18. PKG_BUILD_DIR:=$(BUILD_DIR)/WireGuard-$(PKG_VERSION)
  19. PKG_BUILD_PARALLEL:=1
  20. PKG_USE_MIPS16:=0
  21. # Wireguard's makefile needs this to know where to build the kernel module
  22. export KERNELDIR:=$(LINUX_DIR)
  23. include $(INCLUDE_DIR)/package.mk
  24. define Package/wireguard/Default
  25. SECTION:=net
  26. CATEGORY:=Network
  27. SUBMENU:=VPN
  28. URL:=https://www.wireguard.io
  29. MAINTAINER:=Baptiste Jonglez <openwrt@bitsofnetworks.org>, \
  30. Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> \
  31. Dan Luedtke <mail@danrl.com>, \
  32. Jason A. Donenfeld <Jason@zx2c4.com>
  33. endef
  34. define Package/wireguard/Default/description
  35. WireGuard is a novel VPN that runs inside the Linux Kernel and utilizes
  36. state-of-the-art cryptography. It aims to be faster, simpler, leaner, and
  37. more useful than IPSec, while avoiding the massive headache. It intends to
  38. be considerably more performant than OpenVPN. WireGuard is designed as a
  39. general purpose VPN for running on embedded interfaces and super computers
  40. alike, fit for many different circumstances.
  41. It runs over UDP.
  42. endef
  43. define Package/wireguard
  44. $(call Package/wireguard/Default)
  45. TITLE:=Wireguard meta-package
  46. DEPENDS:=+wireguard-tools +kmod-wireguard
  47. endef
  48. include $(INCLUDE_DIR)/kernel-defaults.mk
  49. include $(INCLUDE_DIR)/package-defaults.mk
  50. # Used by Build/Compile/Default
  51. MAKE_PATH:=src/tools
  52. define Build/Compile
  53. $(MAKE) $(KERNEL_MAKEOPTS) M="$(PKG_BUILD_DIR)/src" modules
  54. $(call Build/Compile/Default)
  55. endef
  56. define Package/wireguard/install
  57. true
  58. endef
  59. define Package/wireguard/description
  60. $(call Package/wireguard/Default/description)
  61. endef
  62. define Package/wireguard-tools
  63. $(call Package/wireguard/Default)
  64. TITLE:=Wireguard userspace control program (wg)
  65. DEPENDS:=+libmnl
  66. endef
  67. define Package/wireguard-tools/description
  68. $(call Package/wireguard/Default/description)
  69. This package provides the userspace control program for wireguard, `wg`,
  70. and a netifd protocol helper.
  71. endef
  72. define Package/wireguard-tools/install
  73. $(INSTALL_DIR) $(1)/usr/bin/
  74. $(INSTALL_BIN) $(PKG_BUILD_DIR)/src/tools/wg $(1)/usr/bin/
  75. $(INSTALL_DIR) $(1)/lib/netifd/proto/
  76. $(INSTALL_BIN) ./files/wireguard.sh $(1)/lib/netifd/proto/
  77. endef
  78. define KernelPackage/wireguard
  79. SECTION:=kernel
  80. CATEGORY:=Kernel modules
  81. SUBMENU:=Network Support
  82. TITLE:=Wireguard kernel module
  83. DEPENDS:=+IPV6:kmod-udptunnel6 +kmod-udptunnel4
  84. FILES:= $(PKG_BUILD_DIR)/src/wireguard.$(LINUX_KMOD_SUFFIX)
  85. AUTOLOAD:=$(call AutoProbe,wireguard)
  86. endef
  87. define KernelPackage/wireguard/description
  88. $(call Package/wireguard/Default/description)
  89. This package provides the kernel module for wireguard.
  90. endef
  91. $(eval $(call BuildPackage,wireguard))
  92. $(eval $(call BuildPackage,wireguard-tools))
  93. $(eval $(call KernelPackage,wireguard))