Merge pull request #14 from NeoRaider/master

Import ethtool from the old repo, add new package fastd and its dependencies

libs/libuecc/Makefile

@@ -0,0 +1,44 @@
+#
+# Copyright (C) 2012-2014 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=libuecc
+PKG_VERSION:=4
+PKG_RELEASE:=1
+
+PKG_MAINTAINER:=Matthias Schiffer <mschiffer@universe-factory.net>
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
+PKG_SOURCE_URL:=https://projects.universe-factory.net/attachments/download/71
+PKG_MD5SUM:=7f44df5dc69cb8686947562e2a11eea9
+
+include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/cmake.mk
+
+define Package/libuecc
+  SECTION:=libs
+  CATEGORY:=Libraries
+  TITLE:=Very small Elliptic Curve Cryptography library
+  URL:=http://git.universe-factory.net/libuecc/
+endef
+
+TARGET_CFLAGS += -ffunction-sections -fdata-sections
+
+CMAKE_OPTIONS += \
+	-DCMAKE_BUILD_TYPE:String="MINSIZEREL"
+
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(1)/usr/include
+	$(CP) $(PKG_INSTALL_DIR)/usr/include/libuecc-$(PKG_VERSION) $(1)/usr/include/
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libuecc.a $(1)/usr/lib/
+	$(INSTALL_DIR) $(1)/usr/lib/pkgconfig
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/libuecc.pc $(1)/usr/lib/pkgconfig/
+endef
+
+$(eval $(call BuildPackage,libuecc))

libs/nacl/Makefile

@@ -0,0 +1,45 @@
+#
+# Copyright (C) 2011-2014 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=nacl
+PKG_VERSION:=20110221
+PKG_RELEASE:=1
+
+PKG_MAINTAINER:=Matthias Schiffer <mschiffer@universe-factory.net>
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
+PKG_SOURCE_URL:=http://hyperelliptic.org/nacl
+PKG_MD5SUM:=7efb5715561c3d10dafd3fa97b4f2d20
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/nacl
+  SECTION:=libs
+  CATEGORY:=Libraries
+  TITLE:=NaCl Networking and Cryptography library
+  URL:=http://nacl.cace-project.eu/
+endef
+
+define Build/Compile
+	(cd $(PKG_BUILD_DIR) && \
+			CC="$(TARGET_CC)" \
+			CFLAGS="$(TARGET_CFLAGS) $(TARGET_CPPFLAGS)" \
+			AR="$(TARGET_CROSS)ar" \
+			RANLIB="$(TARGET_CROSS)ranlib" \
+		$(CURDIR)/do-openwrt \
+	)
+endef
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(1)/usr/include/nacl
+	$(CP) $(PKG_BUILD_DIR)/build/include/*.h $(1)/usr/include/nacl/
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_BUILD_DIR)/build/lib/libnacl.a $(1)/usr/lib/
+endef
+
+$(eval $(call BuildPackage,nacl))

libs/nacl/do-openwrt

@@ -0,0 +1,206 @@
+#!/bin/sh
+set -e
+
+# nacl/do
+# D. J. Bernstein
+# Public domain.
+
+version=`cat version`
+project=nacl
+
+top="`pwd`/build"
+bin="$top/bin"
+lib="$top/lib"
+include="$top/include"
+work="$top/work"
+
+
+# and work around bug in GNU sort
+LANG=C
+export LANG
+
+rm -rf "$top"
+mkdir -p "$top"
+mkdir -p "$bin"
+mkdir -p "$lib"
+mkdir -p "$include"
+
+exec >"$top/log"
+exec 2>&1
+exec 5>"$top/data"
+exec </dev/null
+
+echo "=== `date` === starting"
+
+echo "=== `date` === building inttypes"
+for target in int8 int16 int32 int64 uint8 uint16 uint32 uint64; do
+  (
+    echo "#ifndef crypto_${target}_h"
+    echo "#define crypto_${target}_h"
+    echo ""
+    echo "#include <stdint.h>"
+    echo ""
+    echo "typedef ${target}_t crypto_${target};"
+    echo ""
+    echo "#endif"
+  ) > "$include/crypto_$target.h"
+done
+
+echo "=== `date` === building randombytes"
+rm -rf "$work"
+mkdir -p "$work"
+cp -pr randombytes/* "$work"
+(
+  cd "$work"
+
+  cp devurandom.c randombytes-impl.c
+  cp devurandom.h randombytes-impl.h
+  $CC $CFLAGS -c randombytes-impl.c
+  mkdir -p lib
+  mv randombytes-impl.o lib/randombytes.o
+  mkdir -p include
+  mv randombytes-impl.h include/randombytes.h
+)
+cp -pr "$work"/lib/* "$lib"
+cp -pr "$work"/include/* "$include"
+
+rm -rf "$work"
+mkdir -p "$work"
+echo 'void crypto_'"$project"'_base(void) { ; }' > "$work/${project}_base.c"
+( cd "$work" && $CC $CFLAGS -c ${project}_base.c )
+$AR cr "$lib/lib${project}.a" "$work/${project}_base.o"
+( $RANLIB "$lib/lib${project}.a" || exit 0 )
+
+# loop over operations
+cat OPERATIONS \
+| while read o
+do
+  [ -d "$o" ] || continue
+
+  # for each operation, loop over primitives
+  ls "$o" \
+  | sort \
+  | while read p
+  do
+    [ -d "$o/$p" ] || continue
+    op="${o}_${p}"
+
+    startdate=`date +%Y%m%d`
+
+    echo "=== `date` === $o/$p"
+
+    rm -rf "$work"
+    mkdir -p "$work"
+
+    if [ -d "$o/$p/ref" ]; then
+      implementationdir="$o/$p/ref"
+    else
+      implementationdir="$o/$p/portable"
+    fi
+
+    opi=`echo "$implementationdir" | tr ./- ___`
+
+    echo "=== `date` === $implementationdir"
+
+    cfiles=`ls "$implementationdir" | grep '\.c$' || :`
+    sfiles=`ls "$implementationdir" | grep '\.[sS]$' || :`
+
+    cp -p "$o"/*.c "$work"
+
+    cp -pr "$implementationdir"/* "$work"
+
+    cp -p MACROS "$work/MACROS"
+    cp -p PROTOTYPES.c "$work/PROTOTYPES.c"
+
+    (
+      cd "$work"
+      (
+	echo "#ifndef ${o}_H"
+	echo "#define ${o}_H"
+	echo ""
+	echo "#include \"${op}.h\""
+	echo ""
+	egrep "${o}"'$|'"${o}"'\(|'"${o}"'_' < MACROS \
+	  | sed "s/$o/$op/" | while read mop
+	do
+	  echo "#define ${mop} ${mop}" | sed "s/$op/$o/"
+	done
+	echo "#define ${o}_PRIMITIVE \"${p}\""
+	echo "#define ${o}_IMPLEMENTATION ${op}_IMPLEMENTATION"
+	echo "#define ${o}_VERSION ${op}_VERSION"
+	echo ""
+	echo "#endif"
+      ) > "$o.h"
+      (
+	echo "#ifndef ${op}_H"
+	echo "#define ${op}_H"
+	echo ""
+	sed 's/[ 	]CRYPTO_/ '"${opi}"'_/g' < api.h
+	echo '#ifdef __cplusplus'
+	  #echo '#include <string>'
+	  #egrep "${o}"'$|'"${o}"'\(|'"${o}"'_' < PROTOTYPES.cpp \
+	  #    | sed "s/$o/$opi/"
+	echo 'extern "C" {'
+	echo '#endif'
+	egrep "${o}"'$|'"${o}"'\(|'"${o}"'_' < PROTOTYPES.c \
+	  | sed "s/$o/$opi/"
+	echo '#ifdef __cplusplus'
+	echo '}'
+	echo '#endif'
+	echo ""
+	egrep "${o}"'$|'"${o}"'\(|'"${o}"'_' < MACROS \
+	  | sed "s/$o/$opi/" | while read mopi
+	do
+	    echo "#define ${mopi} ${mopi}" | sed "s/$opi/$op/"
+	done
+	echo "#define ${op}_IMPLEMENTATION \"${implementationdir}\""
+	echo "#ifndef ${opi}_VERSION"
+	echo "#define ${opi}_VERSION \"-\""
+	echo "#endif"
+	echo "#define ${op}_VERSION ${opi}_VERSION"
+	echo ""
+	echo "#endif"
+      ) > "$op.h"
+
+      echo "=== `date` === $implementationdir $CC $CFLAGS"
+      for f in $cfiles $sfiles
+      do
+	ok=1
+	$CC $CFLAGS \
+	    -I. -I"$include" \
+	    -c "$f" >errors 2>&1 || ok=0
+	( if [ `wc -l < errors` -lt 25 ]
+	  then
+	    cat errors
+	  else
+	    head errors
+	    echo ...
+	    tail errors
+	  fi
+	) \
+	| while read err
+	do
+	  echo "$version $startdate $o $p fromcompiler $implementationdir $f $err" >&5
+	done
+
+	[ "$ok" = 1 ]
+      done
+
+      for f in *.o
+      do
+	mv "$f" "${opi}-$f"
+      done
+    )
+
+    echo "=== `date` === $implementationdir $CC $CFLAGS finishing"
+
+    $AR cr "$lib/lib${project}.a" "$work"/*.o \
+    && ( $RANLIB "$lib/lib${project}.a" || exit 0 ) \
+    && cp -p "$work/$op.h" "$include/$op.h" \
+    && [ -f "$o/$p/selected" ] \
+    && cp -p "$work/$o.h" "$include/$o.h" \
+    || :
+  done
+done
+
+echo "=== `date` === finishing"

net/ethtool/Makefile

@@ -0,0 +1,42 @@
+#
+# Copyright (C) 2006-2014 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=ethtool
+PKG_VERSION:=3.14
+PKG_RELEASE:=1
+
+PKG_MAINTAINER:=Matthias Schiffer <mschiffer@universe-factory.net>
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
+PKG_SOURCE_URL:=@KERNEL/software/network/ethtool
+PKG_MD5SUM:=d46b809ddd672b51d7e23787ae9122e0
+
+PKG_FIXUP:=autoreconf
+PKG_INSTALL:=1
+PKG_BUILD_PARALLEL:=1
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/ethtool
+  SECTION:=net
+  CATEGORY:=Network
+  TITLE:=Display or change ethernet card settings
+  URL:=http://www.kernel.org/pub/software/network/ethtool/
+endef
+
+define Package/ethtool/description
+ ethtool is a small utility for examining and tuning your ethernet-based
+ network interface
+endef
+
+define Package/ethtool/install
+	$(INSTALL_DIR) $(1)/usr/sbin
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/ethtool $(1)/usr/sbin
+endef
+
+$(eval $(call BuildPackage,ethtool))

net/ethtool/patches/100-ixp4xx.patch

@@ -0,0 +1,166 @@
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -13,7 +13,7 @@ ethtool_SOURCES += \
+ 		  fec_8xx.c ibm_emac.c ixgb.c ixgbe.c natsemi.c	\
+ 		  pcnet32.c realtek.c tg3.c marvell.c vioc.c	\
+ 		  smsc911x.c at76c50x-usb.c sfc.c stmmac.c	\
+-		  sfpid.c sfpdiag.c ixgbevf.c
++		  sfpid.c sfpdiag.c ixgbevf.c ixp4xx.c
+ endif
+ 
+ TESTS = test-cmdline test-features
+--- a/ethtool.c
++++ b/ethtool.c
+@@ -894,6 +894,7 @@ static const struct {
+ 	{ "ixgb", ixgb_dump_regs },
+ 	{ "ixgbe", ixgbe_dump_regs },
+ 	{ "ixgbevf", ixgbevf_dump_regs },
++	{ "ixp4xx", ixp4xx_dump_regs },
+ 	{ "natsemi", natsemi_dump_regs },
+ 	{ "e100", e100_dump_regs },
+ 	{ "amd8111e", amd8111e_dump_regs },
+--- a/internal.h
++++ b/internal.h
+@@ -243,6 +243,9 @@ int st_gmac_dump_regs(struct ethtool_drv
+ /* Et131x ethernet controller */
+ int et131x_dump_regs(struct ethtool_drvinfo *info, struct ethtool_regs *regs);
+ 
++/* Intel IXP4xx internal MAC */
++int ixp4xx_dump_regs(struct ethtool_drvinfo *info, struct ethtool_regs *regs);
++
+ /* Rx flow classification */
+ int rxclass_parse_ruleopts(struct cmd_context *ctx,
+ 			   struct ethtool_rx_flow_spec *fsp);
+--- /dev/null
++++ b/ixp4xx.c
+@@ -0,0 +1,130 @@
++/*
++ * Copyright (c) 2006 Christian Hohnstaed <chohnstaedt@innominate.com>
++ * This file is released under the GPLv2
++ */
++
++#include <stdio.h>
++#include "internal.h"
++
++#ifndef BIT
++#define BIT(x) (1<<x)
++#endif
++
++#define TX_CNTRL1_TX_EN         BIT(0)
++#define TX_CNTRL1_DUPLEX        BIT(1)
++#define TX_CNTRL1_RETRY         BIT(2)
++#define TX_CNTRL1_PAD_EN        BIT(3)
++#define TX_CNTRL1_FCS_EN        BIT(4)
++#define TX_CNTRL1_2DEFER        BIT(5)
++#define TX_CNTRL1_RMII          BIT(6)
++
++/* TX Control Register 2 */
++#define TX_CNTRL2_RETRIES_MASK  0xf
++
++/* RX Control Register 1 */
++#define RX_CNTRL1_RX_EN         BIT(0)
++#define RX_CNTRL1_PADSTRIP_EN   BIT(1)
++#define RX_CNTRL1_CRC_EN        BIT(2)
++#define RX_CNTRL1_PAUSE_EN      BIT(3)
++#define RX_CNTRL1_LOOP_EN       BIT(4)
++#define RX_CNTRL1_ADDR_FLTR_EN  BIT(5)
++#define RX_CNTRL1_RX_RUNT_EN    BIT(6)
++#define RX_CNTRL1_BCAST_DIS     BIT(7)
++
++/* Core Control Register */
++#define CORE_RESET              BIT(0)
++#define CORE_RX_FIFO_FLUSH      BIT(1)
++#define CORE_TX_FIFO_FLUSH      BIT(2)
++#define CORE_SEND_JAM           BIT(3)
++#define CORE_MDC_EN             BIT(4)
++
++#define MAC "%02x:%02x:%02x:%02x:%02x:%02x"
++#define MAC_DATA(d) (d)[0], (d)[1], (d)[2], (d)[3], (d)[4], (d)[5]
++
++int ixp4xx_dump_regs(struct ethtool_drvinfo *info, struct ethtool_regs *regs)
++{
++	u8 *data = regs->data;
++
++	fprintf(stdout,
++		"TXctrl:          0x%02x:0x%02x\n"
++		"    Enable:      %s\n"
++		"    Duplex:      %s\n"
++		"    Retry:       %s (%d)\n"
++		"    Padding:     %s\n"
++		"    Frame check: %s\n"
++		"    TX deferral: %s\n"
++		"    Connection:  %s\n"
++		"\n",
++		data[0], data[1],
++		data[0] & TX_CNTRL1_TX_EN   ? "yes"      : "no",
++		data[0] & TX_CNTRL1_DUPLEX  ? "half"     : "full",
++		data[0] & TX_CNTRL1_RETRY   ? "enabled"  : "disabled",
++		data[1] & TX_CNTRL2_RETRIES_MASK,
++		data[0] & TX_CNTRL1_PAD_EN  ? "enabled"  : "disabled",
++		data[0] & TX_CNTRL1_FCS_EN  ? "enabled"  : "disabled",
++		data[0] & TX_CNTRL1_2DEFER  ? "two-part" : "one-part",
++		data[0] & TX_CNTRL1_RMII    ? "RMII"     : "Full MII"
++	);
++
++	fprintf(stdout,
++		"RXctrl:          0x%02x\n"
++		"    Enable:      %s\n"
++		"    Pad strip:   %s\n"
++		"    CRC check:   %s\n"
++		"    Pause:       %s\n"
++		"    Loop:        %s\n"
++		"    Promiscous:  %s\n"
++		"    Runt frames: %s\n"
++		"    Broadcast:   %s\n"
++		"\n",
++		data[2],
++		data[2] & RX_CNTRL1_RX_EN        ? "yes"      : "no",
++		data[2] & RX_CNTRL1_PADSTRIP_EN  ? "enabled"  : "disabled",
++		data[2] & RX_CNTRL1_CRC_EN       ? "enabled"  : "disabled",
++		data[2] & RX_CNTRL1_PAUSE_EN     ? "enabled"  : "disabled",
++		data[2] & RX_CNTRL1_LOOP_EN      ? "enabled"  : "disabled",
++		data[2] & RX_CNTRL1_ADDR_FLTR_EN ? "disabled" : "enabled",
++		data[2] & RX_CNTRL1_RX_RUNT_EN   ? "forward"  : "discard",
++		data[2] & RX_CNTRL1_BCAST_DIS    ? "disabled" : "enabled"
++	);
++	fprintf(stdout,
++		"Core control:    0x%02x\n"
++		"    Core state:  %s\n"
++		"    RX fifo:     %s\n"
++		"    TX fifo:     %s\n"
++		"    Send jam:    %s\n"
++		"    MDC clock    %s\n"
++		"\n",
++		data[32],
++		data[32] & CORE_RESET          ? "reset"  : "normal operation",
++		data[32] & CORE_RX_FIFO_FLUSH  ? "flush"  : "ok",
++		data[32] & CORE_TX_FIFO_FLUSH  ? "flush"  : "ok",
++		data[32] & CORE_SEND_JAM       ? "yes"    : "no",
++		data[32] & CORE_MDC_EN         ? "output" : "input"
++	);
++	fprintf(stdout,
++		"MAC addresses: \n"
++		"  Multicast mask:     " MAC "\n"
++		"  Multicast address:  " MAC "\n"
++		"  Unicast address:    " MAC "\n"
++		"\n",
++		MAC_DATA(data+13), MAC_DATA(data+19), MAC_DATA(data+26)
++	);
++	fprintf(stdout,
++		"Random seed:      0x%02x\n"
++		"Threshold empty:   %3d\n"
++		"Threshold full:    %3d\n"
++		"TX buffer size:    %3d\n"
++		"TX deferral:       %3d\n"
++		"RX deferral:       %3d\n"
++		"TX two deferral 1: %3d\n"
++		"TX two deferral 2: %3d\n"
++		"Slot time:         %3d\n"
++		"Internal clock:    %3d\n"
++		"\n",
++		data[4], data[5], data[6], data[7], data[8], data[9],
++		data[10], data[11], data[12], data[25]
++	);
++
++	return 0;
++}

net/fastd/Config.in

@@ -0,0 +1,82 @@
+menu "Configuration"
+	depends on PACKAGE_fastd
+
+config FASTD_ENABLE_METHOD_CIPHER_TEST
+	bool "Enable cipher-test method provider"
+	depends on PACKAGE_fastd
+	default n
+
+config FASTD_ENABLE_METHOD_COMPOSED_GMAC
+	bool "Enable composed-gmac method provider"
+	depends on PACKAGE_fastd
+	default y
+
+config FASTD_ENABLE_METHOD_GENERIC_GMAC
+	bool "Enable generic-gmac method provider"
+	depends on PACKAGE_fastd
+	default y
+
+config FASTD_ENABLE_METHOD_GENERIC_POLY1305
+	bool "Enable generic-poly1305 method provider"
+	depends on PACKAGE_fastd
+	default n
+
+config FASTD_ENABLE_METHOD_NULL
+	bool "Enable null method"
+	depends on PACKAGE_fastd
+	default y
+
+config FASTD_ENABLE_METHOD_XSALSA20_POLY1305
+	bool "Enable xsalsa20-poly1305 method"
+	depends on PACKAGE_fastd
+	default n
+
+
+config FASTD_ENABLE_CIPHER_AES128_CTR
+	bool "Enable the AES128-CTR cipher"
+	depends on PACKAGE_fastd
+	default n
+
+config FASTD_ENABLE_CIPHER_NULL
+	bool "Enable the null cipher"
+	depends on PACKAGE_fastd
+	default y
+
+config FASTD_ENABLE_CIPHER_SALSA20
+	bool "Enable the Salsa20 cipher"
+	depends on PACKAGE_fastd
+	default n
+
+config FASTD_ENABLE_CIPHER_SALSA2012
+	bool "Enable the Salsa20/12 cipher"
+	depends on PACKAGE_fastd
+	default y
+
+
+config FASTD_ENABLE_MAC_GHASH
+	bool "Enable the GHASH message authentication code"
+	depends on PACKAGE_fastd
+	default y
+
+
+config FASTD_WITH_CMDLINE_USER
+	bool "Include support for setting user/group related options on the command line"
+	depends on PACKAGE_fastd
+	default n
+
+config FASTD_WITH_CMDLINE_LOGGING
+	bool "Include support for setting logging related options on the command line"
+	depends on PACKAGE_fastd
+	default n
+
+config FASTD_WITH_CMDLINE_OPERATION
+	bool "Include support for setting options related to the VPN operation (like mode, interface, encryption method) on the command line"
+	depends on PACKAGE_fastd
+	default n
+
+config FASTD_WITH_CMDLINE_COMMANDS
+	bool "Include support for setting handler scripts (e.g. --on-up) on the command line"
+	depends on PACKAGE_fastd
+	default n
+
+endmenu

net/fastd/Makefile

@@ -0,0 +1,163 @@
+#
+# Copyright (C) 2012-2014 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=fastd
+PKG_VERSION:=12
+PKG_RELEASE:=1
+
+PKG_MAINTAINER:=Matthias Schiffer <mschiffer@universe-factory.net>
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
+PKG_SOURCE_URL:=https://projects.universe-factory.net/attachments/download/73
+PKG_MD5SUM:=1dadc61f4d712a10844afcb9b9f49a41
+
+PKG_CONFIG_DEPENDS:=\
+	CONFIG_FASTD_ENABLE_METHOD_CIPHER_TEST \
+	CONFIG_FASTD_ENABLE_METHOD_COMPOSED_GMAC \
+	CONFIG_FASTD_ENABLE_METHOD_GENERIC_GMAC \
+	CONFIG_FASTD_ENABLE_METHOD_GENERIC_POLY1305 \
+	CONFIG_FASTD_ENABLE_METHOD_NULL \
+	CONFIG_FASTD_ENABLE_METHOD_XSALSA20_POLY1305 \
+	CONFIG_FASTD_ENABLE_CIPHER_AES128_CTR \
+	CONFIG_FASTD_ENABLE_CIPHER_NULL \
+	CONFIG_FASTD_ENABLE_CIPHER_SALSA20 \
+	CONFIG_FASTD_ENABLE_CIPHER_SALSA2012 \
+	CONFIG_FASTD_ENABLE_MAC_GHASH \
+	CONFIG_FASTD_WITH_CMDLINE_USER \
+	CONFIG_FASTD_WITH_CMDLINE_LOGGING \
+	CONFIG_FASTD_WITH_CMDLINE_OPERATION \
+	CONFIG_FASTD_WITH_CMDLINE_COMMANDS
+
+
+PKG_BUILD_DEPENDS:=nacl libuecc
+
+include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/cmake.mk
+
+define Package/fastd
+  SECTION:=net
+  CATEGORY:=Network
+  DEPENDS:=+kmod-tun +librt +libpthread
+  TITLE:=Fast and Secure Tunneling Daemon
+  URL:=https://projects.universe-factory.net/projects/fastd
+  SUBMENU:=VPN
+endef
+
+define Package/fastd/config
+  source "$(SOURCE)/Config.in"
+endef
+
+TARGET_CFLAGS += -ffunction-sections -fdata-sections
+TARGET_LDFLAGS += -Wl,--gc-sections
+
+CMAKE_OPTIONS += \
+	-DCMAKE_BUILD_TYPE:STRING=MINSIZEREL \
+	-DWITH_METHOD_CIPHER_TEST:BOOL=FALSE \
+	-DWITH_METHOD_COMPOSED_GMAC:BOOL=FALSE \
+	-DWITH_METHOD_GENERIC_GMAC:BOOL=FALSE \
+	-DWITH_METHOD_GENERIC_POLY1305:BOOL=FALSE \
+	-DWITH_METHOD_NULL:BOOL=FALSE \
+	-DWITH_METHOD_XSALSA20_POLY1305:BOOL=FALSE \
+	-DWITH_CIPHER_AES128_CTR:BOOL=FALSE \
+	-DWITH_CIPHER_NULL:BOOL=FALSE \
+	-DWITH_CIPHER_SALSA20:BOOL=FALSE \
+	-DWITH_CIPHER_SALSA2012:BOOL=FALSE \
+	-DWITH_MAC_GHASH:BOOL=FALSE \
+	-DWITH_CMDLINE_USER:BOOL=FALSE \
+	-DWITH_CMDLINE_LOGGING:BOOL=FALSE \
+	-DWITH_CMDLINE_OPERATION:BOOL=FALSE \
+	-DWITH_CMDLINE_COMMANDS:BOOL=FALSE \
+	-DWITH_CAPABILITIES:BOOL=FALSE
+
+
+ifeq ($(CONFIG_FASTD_ENABLE_METHOD_CIPHER_TEST),y)
+CMAKE_OPTIONS += -DWITH_METHOD_CIPHER_TEST:BOOL=TRUE
+endif
+
+ifeq ($(CONFIG_FASTD_ENABLE_METHOD_COMPOSED_GMAC),y)
+CMAKE_OPTIONS += -DWITH_METHOD_COMPOSED_GMAC:BOOL=TRUE
+endif
+
+ifeq ($(CONFIG_FASTD_ENABLE_METHOD_GENERIC_GMAC),y)
+CMAKE_OPTIONS += -DWITH_METHOD_GENERIC_GMAC:BOOL=TRUE
+endif
+
+ifeq ($(CONFIG_FASTD_ENABLE_METHOD_GENERIC_POLY1305),y)
+CMAKE_OPTIONS += -DWITH_METHOD_GENERIC_POLY1305:BOOL=TRUE
+endif
+
+ifeq ($(CONFIG_FASTD_ENABLE_METHOD_NULL),y)
+CMAKE_OPTIONS += -DWITH_METHOD_NULL:BOOL=TRUE
+endif
+
+ifeq ($(CONFIG_FASTD_ENABLE_METHOD_XSALSA20_POLY1305),y)
+CMAKE_OPTIONS += -DWITH_METHOD_XSALSA20_POLY1305:BOOL=TRUE
+endif
+
+
+ifeq ($(CONFIG_FASTD_ENABLE_CIPHER_AES128_CTR),y)
+CMAKE_OPTIONS += -DWITH_CIPHER_AES128_CTR:BOOL=TRUE
+endif
+
+ifeq ($(CONFIG_FASTD_ENABLE_CIPHER_NULL),y)
+CMAKE_OPTIONS += -DWITH_CIPHER_NULL:BOOL=TRUE
+endif
+
+ifeq ($(CONFIG_FASTD_ENABLE_CIPHER_SALSA20),y)
+CMAKE_OPTIONS += -DWITH_CIPHER_SALSA20:BOOL=TRUE
+endif
+
+ifeq ($(CONFIG_FASTD_ENABLE_CIPHER_SALSA2012),y)
+CMAKE_OPTIONS += -DWITH_CIPHER_SALSA2012:BOOL=TRUE
+endif
+
+
+ifeq ($(CONFIG_FASTD_ENABLE_MAC_GHASH),y)
+CMAKE_OPTIONS += -DWITH_MAC_GHASH:BOOL=TRUE
+endif
+
+
+ifeq ($(CONFIG_FASTD_WITH_CMDLINE_USER),y)
+CMAKE_OPTIONS += -DWITH_CMDLINE_USER:BOOL=TRUE
+endif
+
+ifeq ($(CONFIG_FASTD_WITH_CMDLINE_LOGGING),y)
+CMAKE_OPTIONS += -DWITH_CMDLINE_LOGGING:BOOL=TRUE
+endif
+
+ifeq ($(CONFIG_FASTD_WITH_CMDLINE_OPERATION),y)
+CMAKE_OPTIONS += -DWITH_CMDLINE_OPERATION:BOOL=TRUE
+endif
+
+ifeq ($(CONFIG_FASTD_WITH_CMDLINE_COMMANDS),y)
+CMAKE_OPTIONS += -DWITH_CMDLINE_COMMANDS:BOOL=TRUE
+endif
+
+
+define Package/fastd/description
+ Fast and secure tunneling daemon, which is optimized on small code size and few dependencies
+endef
+
+define Package/fastd/conffiles
+/etc/config/fastd
+endef
+
+define Package/fastd/install
+	$(INSTALL_DIR) $(1)/usr/bin
+	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/fastd $(1)/usr/bin/
+
+	$(INSTALL_DIR) $(1)/etc/init.d/
+	$(INSTALL_BIN) files/fastd.init $(1)/etc/init.d/fastd
+	$(INSTALL_DIR) $(1)/etc/config
+	$(INSTALL_CONF) files/fastd.config $(1)/etc/config/fastd
+	$(INSTALL_DIR) $(1)/etc/fastd
+	$(INSTALL_DIR) $(1)/lib/upgrade/keep.d
+	$(INSTALL_DATA) files/fastd.upgrade $(1)/lib/upgrade/keep.d/fastd
+endef
+
+$(eval $(call BuildPackage,fastd))

net/fastd/files/fastd.config

@@ -0,0 +1,143 @@
+package fastd
+
+config fastd sample_config
+
+	# Set to 1 to enable this instance:
+	option enabled 0
+
+	# Sets a static config file, optional
+	# Options set via UCI have higher priority that statically configured ones
+#	list config '/etc/fastd/sample_config/fastd.conf'
+
+	# Configures a single static peer from a configuration file
+#	list config_peer '/etc/fastd/sample_config/sample_peer.conf'
+
+	# Sets an additional directory from which peers configurations are read
+	# The peer list can be reloaded without restarting fastd
+	# Peer can either be configured via UCI (see examples below) or via peer dirs
+	# Can't be used in tun mode
+#	list config_peer_dir '/etc/fastd/sample_config/peers'
+
+	# Sets the log level
+	# Possible values: error, warn, info, verbose, debug
+	# Default: info
+	option syslog_level 'info'
+
+	# IP address and port of the local end, optional
+	# 'any' can be used to bind to both IPv4 and IPv6
+	# If no port is given fastd will bind to a random port
+#	list bind 'any:1337'
+#	list bind '0.0.0.0:1337'
+#	list bind '[::]:1337'
+
+	# "method null" uses no encryption or MAC
+	# "method xsalsa20-poly1305" uses the XSalsa20 encryption ad the Poly1305 MAC
+	list method 'xsalsa20-poly1305'
+
+	# "mode tap" will create an ethernet tunnel (tap device),
+	# "mode tun" will create an IP tunnel (tun device).
+	option mode 'tap'
+
+	# Set the name of the tunnel interface to use
+	option interface 'tap0'
+#	option interface 'tun0'
+#	option interface 'fastd0'
+
+	# Sets the MTU of the tunnel interface, default is 1500
+	# 1426 is a good value that avoids fragmentation for the xsalsa20-poly1305 method
+	# when the tunnel uses an IPv4 connection on a line with an MTU of 1492 or higher
+	option mtu 1426
+
+	# Enables direct forwaring of packets between peers
+	# WARNING: Only enable this if you know what you are doing, as this can lead to forwarding loops!
+	option forward 0
+
+	# Disable for compatiblity with fastd v10 and older
+	option secure_handshakes 1
+
+	# Set a packet mark to filter for with iptables or ip rules
+#	option packet_mark 42
+
+	# Limits the maximum number of connections, optional
+#	option peer_limit 5
+
+	# The secret key
+	# A keypair can be generated with `fastd --generate-key`
+	# When the corresponding public key is lost it can be recovered with `/etc/init.d/fastd show-key <config name>`
+#	option secret '0000000000000000000000000000000000000000000000000000000000000000'
+
+	# Sets the user to run fastd as. Defaults to root
+#	option user 'daemon'
+
+	# Sets the group to run fastd as. Defaults to the user's primary group
+#	option group 'daemon'
+
+	# If set to 1, the logs won't contain peers' IP addresses
+#	option hide_ip_addresses '0'
+
+	# If set to 1, the logs won't contain peers' MAC addresses
+#	option hide_mac_addresses '0'
+
+	# Read the documentation about this one. Only ever useful in severly broken networks.
+#	option pmtu ''
+
+	# command to configure IP addresses etc. after the tunnel interface is up; $1 will be the interface name (optional)
+#	option up ''
+
+	# command to execute before the tunnel interface is set down; $1 will be the interface name (optional)
+#	option down ''
+
+
+config peer sample_peer
+
+	# Set to 1 to enable this peer
+	# In tap mode peers can be reloaded dynamically
+	option enabled 0
+
+	# Controls which instance this peer is associated with
+	option net 'sample_config'
+
+	# Controls which peer group this peer belongs to, optional
+	# For most use cases peer groups aren't necessary
+#	option group 'sample_group'
+
+	# The peer's public key
+	option key '0000000000000000000000000000000000000000000000000000000000000000'
+
+	# A remote specification consists of an address or a hostname, and a port
+	# When a hostname is given, it is recommended to specify the address family to use
+	# It is possible to specify no, one or multiple remotes
+	# (but all entries must designate the same host as the public key must be unique)
+#	list remote '192.0.2.1:1337'
+#	list remote '[2001:db8::1]:1337'
+#	list remote '"example.com" port 1337'
+#	list remote 'ipv4 "example.com" port 1337'
+#	list remote 'ipv6 "example.com" port 1337'
+
+	# Setting float to 1 allow incoming connections with this key from other addresses/hostnames/ports than the specified remotes
+#	option float 0
+
+
+config peer_group sample_group
+
+	# Set to 1 to enable this peer group
+	option enabled 0
+
+	# Controls which instance this peer group is associated with
+	# Peer groups can't be used in tun mode
+	option net 'sample_config'
+
+	# Allows configuring nested groups
+#	option parent 'other_group'
+
+	# Includes another config file inside the peer group definition
+#	list config '/etc/fastd/sample_config/sample_group.conf'
+
+	# Configures a single static peer from a configuration file
+#	list config_peer '/etc/fastd/sample_config/sample_peer.conf'
+
+	# Configures an additional peer directory for this group
+#	list config_peer_dir '/etc/fastd/sample_config/peers2'
+
+	# Limits the maximum number of connections to peers in this group (optional)
+#	option peer_limit 5

net/fastd/files/fastd.init

@@ -0,0 +1,420 @@
+#!/bin/sh /etc/rc.common
+# Copyright (C) 2012-2013 OpenWrt.org
+
+START=95
+
+EXTRA_COMMANDS="up down show_key generate_key"
+
+LIST_SEP="
+"
+TMP_FASTD=/tmp/fastd
+FASTD_COMMAND=/usr/bin/fastd
+
+
+section_enabled() {
+	config_get_bool enabled "$1" 'enabled' 0
+	[ $enabled -gt 0 ]
+}
+
+error() {
+	echo "${initscript}:" "$@" 1>&2
+}
+
+get_key_instance() {
+	local s="$1"
+
+	config_get secret "$s" secret
+	if [ "$secret" = 'generate' ]; then
+		secret=`"$FASTD_COMMAND" --generate-key --machine-readable`
+		uci -q set fastd."$s".secret="$secret" && uci -q commit fastd
+	fi
+
+	echo "$secret"
+}
+
+
+escape_string() {
+	local t=${1//\\/\\\\}
+	echo -n "\"${t//\"/\\\"}\""
+}
+
+guard_value() {
+	local t=${1//[^-a-z0-9\[\].:]/}
+	echo -n "$t"
+}
+
+guard_remote() {
+	local t=${1//[^-a-zA-Z0-9\[\].:\"% ]/}
+	local quotes=${t//[^\"]/}
+	if [ "${#quotes}" = 0 -o "${#quotes}" = 2 ]; then
+		echo -n "$t"
+	fi
+}
+
+yes_no() {
+	case "$1" in
+		0|no|off|false|disabled) echo -n no;;
+		*) echo -n yes;;
+	esac
+}
+
+config_string_config='include $(escape_string "$value");'
+config_string_config_peer='include peer $(escape_string "$value");'
+config_string_config_peer_dir='include peers from $(escape_string "$value");'
+config_string_bind='bind $(guard_value "$value");'
+config_string_method='method $(escape_string "$value");'
+config_string_syslog_level='log to syslog level $(guard_value "$value");'
+config_string_mode='mode $(guard_value "$value");'
+config_string_interface='interface $(escape_string "$value");'
+config_string_mtu='mtu $(guard_value "$value");'
+config_string_peer_limit='peer limit $(guard_value "$value");'
+config_string_user='user $(escape_string "$value");'
+config_string_group='group $(escape_string "$value");'
+config_string_pmtu='pmtu $(yes_no "$value");'
+config_string_forward='forward $(yes_no "$value");'
+config_string_hide_ip_addresses='hide ip addresses $(yes_no "$value");'
+config_string_hide_mac_addresses='hide mac addresses $(yes_no "$value");'
+config_string_secure_handshakes='secure handshakes $(yes_no "$value");'
+config_string_packet_mark='packet mark $(guard_value "$value");'
+
+config_string_peer='peer $(escape_string "$value") {'
+config_string_peer_group='peer group $(escape_string "$value") {'
+
+peer_string_key='key $(escape_string "$value");'
+peer_string_float='float $(yes_no "$value");'
+peer_string_remote='remote $(guard_remote "$value");'
+
+generate_option() {
+	local __string=$(eval echo \"\$$2\")
+	local value="$1";
+	eval echo "\"$__string\""
+}
+
+append_option() {
+	local v; local len; local s="$1"; local prefix="$2"; local p="$3"
+
+	config_get len "$s" "${p}_LENGTH"
+
+	if [ -z "$len" ]; then
+		config_get v "$s" "$p"
+		[ -n "$v" ] && generate_option "$v" "${prefix}_string_${p}"
+	else
+		config_list_foreach "$s" "$p" generate_option "${prefix}_string_${p}"
+	fi
+}
+
+append_options() {
+	local p; local s="$1"; local prefix="$2"; shift; shift
+	for p in $*; do
+		append_option "$s" "$prefix" "$p"
+	done
+}
+
+
+generate_config_secret() {
+	echo "secret $(escape_string "$1");"
+}
+
+
+generate_peer_config() {
+	local peer="$1"
+
+	# These options are deprecated
+	config_get address "$peer" address
+	config_get hostname "$peer" hostname
+	config_get address_family "$peer" address_family
+	config_get port "$peer" port
+
+	if [ "$address" -o "$hostname" ]; then
+		if [ -z "$port" ]; then
+			error "peer $peer: address or hostname, but no port given"
+			return 1
+		fi
+
+		if [ "$hostname" ]; then
+			generate_option peer_string_remote "$address_family \"$hostname\" port $port"
+		fi
+
+		if [ "$address" ]; then
+			generate_option peer_string_remote "$address port $port"
+		fi
+	fi
+
+	append_options "$peer" peer \
+		key float remote
+}
+
+generate_single_peer_config() {
+	local peer="$1"; local net="$2"
+
+	config_get peer_net "$peer" net
+	config_get peer_group "$peer" group
+	[ "$net" = "$peer_net" -a "$peer_group" = '' ] || return 0
+
+	section_enabled "$peer" || return 0
+
+	generate_option "$peer" config_string_peer
+	generate_peer_config "$peer"
+	echo '}'
+}
+
+create_peer_config() {
+	local peer="$1"; local net="$2"; local group="$3"; local path="$4"
+
+	config_get peer_net "$peer" net
+	config_get peer_group "$peer" group
+	[ "$group" = "$peer_group" ] || return 0
+
+	if [ "$net" != "$peer_net" ]; then
+		[ -z "$group" ] || error "warning: the peer group of peer '$peer' doesn't match its net, the peer will be ignored"
+		return 0
+	fi
+
+	section_enabled "$peer" || return 0
+
+	generate_peer_config "$peer" >"$path/$peer"
+}
+
+update_peer_group() {
+	local net="$1"; local group_dir="$2"; local group="$3"; local update_only="$4"
+	local path="$TMP_FASTD/fastd.$net/$group_dir"
+
+	rm -rf "$path"
+	mkdir -p "$path"
+
+	config_foreach create_peer_config 'peer' "$net" "$group" "$path"
+
+	if [ -z "$update_only" ]; then
+		generate_option "$path" config_string_config_peer_dir
+	fi
+
+	config_foreach generate_peer_group_config 'peer_group' "$net" "$group_dir" "$update_only" "$group"
+}
+
+generate_peer_group_config() {
+	local group="$1"; local net="$2"; local group_dir="$3%$group"; local update_only="$4"; local parent="$5"
+
+	config_get group_net "$group" net
+	config_get group_parent "$group" parent
+	[ "$parent" = "$group_parent" ] || return 0
+
+	if [ "$net" != "$peer_net" ]; then
+		[ -z "$parent" ] || error "warning: the parent of peer group '$group' doesn't match its net, the peer group will be ignored"
+		return 0
+	fi
+
+	section_enabled "$group" || return 0
+
+	if [ -z "$update_only" ]; then
+		generate_option "$group" config_string_peer_group
+		append_options "$group" config \
+			config config_peer config_peer_dir peer_limit
+	fi
+
+	update_peer_group "$net" "$group_dir" "$group" "$update_only"
+
+	if [ -z "$update_only" ]; then
+		echo '}'
+	fi
+}
+
+update_peer_groups() {
+	local net="$1"; local update_only="$2"
+
+	update_peer_group "$net" 'peers' '' "$update_only"
+}
+
+generate_config() {
+	local s="$1"
+
+	generate_option 'info' config_string_syslog_level
+
+	append_options "$s" config \
+		config config_peer config_peer_dir bind method syslog_level mode interface mtu peer_limit \
+		user group pmtu forward hide_ip_addresses hide_mac_addresses secure_handshakes packet_mark
+
+	config_get mode "$s" mode
+
+	if [ "$mode" = "tun" ]; then
+		config_foreach generate_single_peer_config 'peer' "$s"
+	else
+		update_peer_groups "$s"
+	fi
+}
+
+
+generate_key_instance() {
+	local s="$1"
+
+	config_get secret "$s" secret
+	if [ -z "$secret" -o "$secret" = 'generate' ]; then
+		secret=`fastd --generate-key --machine-readable`
+		uci -q set fastd."$s".secret="$secret" && uci -q commit fastd
+	fi
+
+	generate_config_secret "$secret" | "$FASTD_COMMAND" --config - --show-key --machine-readable
+}
+
+show_key_instance() {
+	local s="$1"
+
+	local secret=`get_key_instance "$s"`
+	if [ -z "$secret" ]; then
+		error "$s: secret is not set"
+		return 1
+	fi
+
+	generate_config_secret "$secret" | "$FASTD_COMMAND" --config - --show-key --machine-readable
+}
+
+start_instance() {
+	local s="$1"
+
+	section_enabled "$s" || return 1
+
+	SERVICE_PID_FILE="/var/run/fastd.$s.pid"
+
+	config_get interface "$s" interface
+	if [ -z "$interface" ]; then
+		error "$s: interface is not set"
+		return 1
+	fi
+
+	if ifconfig "$interface" &>/dev/null; then
+		error "$s: interface '$interface' is already in use"
+		return 1
+	fi
+
+	config_get mode "$s" mode
+	if [ -z "$mode" ]; then
+		error "$s: mode is not set"
+		return 1
+	fi
+
+	local secret=`get_key_instance "$s"`
+	if [ -z "$secret" ]; then
+		error "$s: secret is not set"
+		return 1
+	fi
+
+	rm -f "$SERVICE_PID_FILE"
+	touch "$SERVICE_PID_FILE"
+
+	config_get user "$s" user
+	if [ "$user" ]; then
+		chown "$user" "$SERVICE_PID_FILE"
+	fi
+
+	(generate_config_secret "$secret"; generate_config "$s") | service_start "$FASTD_COMMAND" --config - --daemon --pid-file "$SERVICE_PID_FILE"
+
+	if ! ifconfig "$interface" >/dev/null 2>&1; then
+		error "$s: startup failed"
+		return 1
+	fi
+
+	config_get up "$s" up
+	[ -n "$up" ] && sh -c "$up" - "$interface"
+}
+
+stop_instance() {
+	local s="$1"
+
+	section_enabled "$s" || return 1
+
+	SERVICE_PID_FILE="/var/run/fastd.$s.pid"
+
+	config_get interface "$s" interface
+	if [ -z "$interface" ]; then
+		error "$s: interface is not set"
+		return 1
+	fi
+
+	if ! ifconfig "$interface" &>/dev/null; then
+		error "$s: interface '$interface' does not exist"
+		return 1
+	fi
+
+	config_get down "$s" down
+	[ -n "$down" ] && sh -c "$down" - "$interface"
+
+	service_stop "$FASTD_COMMAND"
+
+	rm -rf "$TMP_FASTD/fastd.$s"
+}
+
+reload_instance() {
+	local s="$1"
+
+	section_enabled "$s" || return 1
+
+	config_get mode "$s" mode
+	[ "$mode" = "tun" ] && return 1
+
+	update_peer_groups "$s" true
+
+	SERVICE_PID_FILE="/var/run/fastd.$s.pid"
+	service_reload "$FASTD_COMMAND"
+}
+
+start() {
+	config_load 'fastd'
+	config_foreach start_instance 'fastd'
+}
+
+stop() {
+	config_load 'fastd'
+	config_foreach stop_instance 'fastd'
+}
+
+reload() {
+	config_load 'fastd'
+	config_foreach reload_instance 'fastd'
+}
+
+up() {
+	local exists
+	local instance
+	config_load 'fastd'
+	for instance in "$@"; do
+		config_get exists "$instance" 'TYPE'
+		if [ "$exists" = 'fastd' ]; then
+			start_instance "$instance"
+		fi
+	done
+}
+
+down() {
+	local exists
+	local instance
+	config_load 'fastd'
+	for instance in "$@"; do
+		config_get exists "$instance" 'TYPE'
+		if [ "$exists" = 'fastd' ]; then
+			stop_instance "$instance"
+		fi
+	done
+}
+
+show_key() {
+	local exists
+	local instance
+	config_load 'fastd'
+	for instance in "$@"; do
+		config_get exists "$instance" 'TYPE'
+		if [ "$exists" = 'fastd' ]; then
+			show_key_instance "$instance"
+		fi
+	done
+}
+
+generate_key() {
+	local exists
+	local instance
+	config_load 'fastd'
+	for instance in "$@"; do
+		config_get exists "$instance" 'TYPE'
+		if [ "$exists" = 'fastd' ]; then
+			generate_key_instance "$instance"
+		fi
+	done
+}

net/fastd/files/fastd.upgrade

@@ -0,0 +1 @@
+/etc/fastd/