mirror of
https://github.com/jmcorgan/fips.git
synced 2026-08-11 17:17:54 +00:00
origami74@gmail.comandJohnathan Corgan
46ccd9744e
Adds packaging/openwrt/ with everything needed to produce and distribute FIPS .ipk packages for OpenWrt routers: - Makefile: OpenWrt feed package definition using rust/host toolchain, maps OpenWrt ARCH to Rust musl target triples - build-ipk.sh: local build script using cargo-zigbuild + direct tar assembly — no OpenWrt SDK or Docker required. Handles macOS BSD tar (ustar format, resource fork suppression) and portable ar header generation for cross-platform .ipk creation. Accepts PKG_VERSION env var override for CI use. - files/: procd init script, default fips.yaml (persistent identity, br-lan and wwan interface examples), firewall helper, dnsmasq .fips forwarding, br_netfilter sysctl, hotplug for fips0, UCI defaults for first-boot setup, sysupgrade keeplist - .github/workflows/package-openwrt.yml: CI workflow (ubuntu-latest + cargo-zigbuild) building aarch64 and x86_64 .ipk packages using build-ipk.sh; llvm-strip for cross-compiled binaries; triggers on every push; publishes to GitHub Releases on version tags. MIPS targets disabled pending portable-atomic crate (32-bit MIPS lacks native AtomicU64), with nightly/rust-src toolchain steps prepared for re-enablement. - .gitignore: add reference/, dist/, *.ipk
13 lines
542 B
Plaintext
13 lines
542 B
Plaintext
# FIPS: bridge netfilter settings
|
|
#
|
|
# kmod-br-netfilter must be loaded for AF_PACKET sockets to receive frames
|
|
# on bridge member ports (e.g. eth1 when it is a member of br-lan).
|
|
# Without it, the bridge's rx_handler intercepts frames before they reach
|
|
# the packet socket layer.
|
|
#
|
|
# We load br_netfilter for the AF_PACKET visibility benefit but disable its
|
|
# IP/IPv6/ARP call hooks to avoid double-processing of routed traffic.
|
|
net.bridge.bridge-nf-call-iptables=0
|
|
net.bridge.bridge-nf-call-ip6tables=0
|
|
net.bridge.bridge-nf-call-arptables=0
|