Re: Bering-uClibc build files for Wireguard VPN server (rerouted to leaf-user and leaf-devel)

Hi John

HI everybody and sorry for cross posting

Am 23.08.2018 um 20:20 schrieb John Sager:
> Erich,
> 
> I have used Bering-uClibc for many years as a router/firewall and recently I
> have become interested in a new VPN server - wireguard:
> https://www.wireguard.com. This is a lightweight VPN server - much more so
> than IPSec or OpenVPN. It runs in a kernel module and has a control
> application to set it up. I now have a build environment for Bering-uClibc
> v6.1.4, in the attached archive wireguard_bering6.tgz. I haven't included
> the source but the latest version can be downloaded from
> https://git.zx2c4.com/WireGuard/snapshot/WireGuard-0.0.20180809.tar.xz
> 
> The build environment builds the kernel module, puts it in kernel/extra &
> then runs depmod. It then builds the control application and the lrp package
> contains this, a startup script, an init.d script that calls it, and a dummy
> VPN server config.
> 
> However to integrate with Bering-uClibc it needs a couple of changes, one to
> busybox.config and one to root.linuxrc in initrd. The startup script,
> wg-quick, requires bash,

I guess this can be easily integrated using a dependency.

 and it needs 'readlink -f' hence the change to
> busybox.config to include this readlink option.

OK

 The change to root.linuxrc
> is to generate a link from /dev/fd to /proc/self/fd.

Is proc/self/fd provided by the kernel module? Can this link be
generated by the startup script?

 The startup script uses
> the construct:
> 'wg setconf "$INTERFACE" <(echo "$WG_CONFIG")' to set up the VPN
> configuration from an environment variable. When piping the output of the
> echo command in the subprocess into wg, bash uses /dev/fd/N to refer to the
> pipe, where N is the fd number of the script end of the pipe.
> 
> Wireguard is currently very much in beta with fairly regular snapshots so
> you may not want to include it in a mainline distribution of Bering yet but
> it's there to play with.

Very interesting work. I heard about wireguard some time ago but did not
pay much attention.

I believe the easiest way would be to discuss this on leaf-devel and I
hope you can be tricked into integrating it yourself in the repository.
Should you not be susbscribed to leaf-devel then please do so. I am sure
KP would be very keen to welcome a new contributor.

About the beta stage, as long as this is packed in a .lrp file,
everybody is free to use it or not. Being just a small group forces us
to rely heavily on the work done uplink.

> 
> Also, I found an issue with ntpd.lrp. Currently it doesn't save the drift
> file /var/lib/ntp/ntp.drift, which stores the frequency error of the system
> clock to allow ntp to synchronise quickly on reboot. The file ntpd.local
> should also have the line 'var/lib/ntp' to save that directory.

This can be done easily. I am working right now on a rather big overhaul
of initrd and signed packages, so I might be a bit distracted. Thank you
anyway for the heads up and hope to see you on leaf-devel

cheers

ET


------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
------------------------------------------------------------------------
leaf-user mailing list: [email protected]
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/