mirror of
https://github.com/jmcorgan/fips.git
synced 2026-10-05 19:18:25 +00:00
Johnathan Corgan
72159a911d
Both OpenWrt packages and the SDK feed Makefile installed /etc/dnsmasq.d/fips.conf. As shipped it forwarded .fips to 127.0.0.1#5354, an address the daemon's DNS responder does not listen on, since it binds ::1. On a device that has ever run the gateway the file says something else: the gateway init script rewrote its server line to ::1#5353 on every start and left the comments above it naming 127.0.0.1:5354. Neither version was ever read, because OpenWrt's dnsmasq init script builds its config from UCI and never loads that directory. What forwards .fips is the UCI server entry. 90-fips-setup adds it pointing at the daemon on ::1#5354, and the gateway init script points it at the gateway on ::1#5353 when the gateway starts and back at the daemon when it stops. This change leaves both writers of that entry alone; which port it should name while the gateway runs is a separate question. The drop-in is removed from the payload, the builders, the Makefile, the README and the packaging workflow's path lists. fips-gateway no longer rewrites it on every start and stop. The 90-fips-setup comment now says that the UCI entry is the forwarding path and that the gateway repoints it, and the shipped fips.yaml comment on the gateway, which said the fips init script configures that forwarding, now names the fips-gateway init script. An opkg upgrade removes the old file; an apk upgrade keeps it only if it was modified, as it is on a device that ran the gateway. Either way nothing reads it. package-test.sh now also builds the .ipk and checks that neither package installs anything under /etc/dnsmasq.d, with a positive control on files both packages must ship, and that no OpenWrt packaging file still names the drop-in, which is the only check covering the SDK Makefile.
136 lines
5.0 KiB
Makefile
136 lines
5.0 KiB
Makefile
include $(TOPDIR)/rules.mk
|
|
|
|
PKG_NAME:=fips
|
|
PKG_VERSION:=0.1.0
|
|
PKG_RELEASE:=1
|
|
|
|
# Pin to a specific commit for reproducible builds.
|
|
# Update PKG_SOURCE_VERSION and PKG_MIRROR_HASH when upgrading.
|
|
PKG_SOURCE_PROTO:=git
|
|
PKG_SOURCE_URL:=https://github.com/jmcorgan/fips.git
|
|
PKG_SOURCE_VERSION:=master
|
|
PKG_MIRROR_HASH:=skip
|
|
|
|
PKG_MAINTAINER:=FIPS Network
|
|
PKG_LICENSE:=MIT
|
|
PKG_LICENSE_FILES:=LICENSE
|
|
|
|
# Rust host toolchain must be present in the build system.
|
|
# In the OpenWrt build system, enable via: make menuconfig → Advanced → Rust
|
|
PKG_BUILD_DEPENDS:=rust/host
|
|
PKG_BUILD_PARALLEL:=1
|
|
|
|
include $(INCLUDE_DIR)/package.mk
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Map OpenWrt ARCH to Rust target triple.
|
|
# All OpenWrt targets use musl libc.
|
|
# ---------------------------------------------------------------------------
|
|
ifeq ($(ARCH),aarch64)
|
|
RUST_TARGET:=aarch64-unknown-linux-musl
|
|
else ifeq ($(ARCH),x86_64)
|
|
RUST_TARGET:=x86_64-unknown-linux-musl
|
|
else ifeq ($(ARCH),mipsel)
|
|
RUST_TARGET:=mipsel-unknown-linux-musl
|
|
else ifeq ($(ARCH),mips)
|
|
RUST_TARGET:=mips-unknown-linux-musl
|
|
else ifeq ($(ARCH),arm)
|
|
# OpenWrt ARM targets predominantly use hardfloat ABI.
|
|
# Override RUST_TARGET in your build if your target uses softfloat.
|
|
RUST_TARGET:=arm-unknown-linux-musleabihf
|
|
else
|
|
$(error Unsupported architecture: $(ARCH). Add a RUST_TARGET mapping in packaging/openwrt-ipk/Makefile.)
|
|
endif
|
|
|
|
RUST_RELEASE_DIR:=$(PKG_BUILD_DIR)/target/$(RUST_TARGET)/release
|
|
|
|
define Package/fips
|
|
SECTION:=net
|
|
CATEGORY:=Network
|
|
TITLE:=FIPS Mesh Network Daemon
|
|
URL:=https://github.com/jmcorgan/fips
|
|
DEPENDS:=+kmod-tun +kmod-br-netfilter +kmod-nft-nat \
|
|
+kmod-nf-conntrack +ip-full
|
|
endef
|
|
|
|
define Package/fips/description
|
|
FIPS is a distributed, decentralized mesh networking daemon. It routes
|
|
traffic across nodes connected over UDP, TCP, or raw Ethernet (EtherType
|
|
0x2121). Provides a TUN interface (fips0) with ULA IPv6 mesh addressing
|
|
and a local DNS responder for .fips name resolution.
|
|
|
|
Four binaries are installed:
|
|
fips — mesh daemon
|
|
fipsctl — CLI control and inspection tool
|
|
fipstop — live TUI dashboard (requires a terminal)
|
|
fips-gateway — outbound LAN gateway (not started by default)
|
|
endef
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Build
|
|
#
|
|
# We write a temporary .cargo/config.toml to set the cross-linker without
|
|
# polluting the source tree. CARGO_HOME is scoped to the staging directory
|
|
# to avoid touching the developer's ~/.cargo during SDK builds.
|
|
# ---------------------------------------------------------------------------
|
|
define Build/Compile
|
|
mkdir -p $(PKG_BUILD_DIR)/.cargo
|
|
printf '[target.$(RUST_TARGET)]\nlinker = "$(TARGET_CC)"\n' \
|
|
> $(PKG_BUILD_DIR)/.cargo/config.toml
|
|
cd $(PKG_BUILD_DIR) && \
|
|
CARGO_HOME=$(STAGING_DIR_HOST)/share/cargo \
|
|
cargo build \
|
|
--release \
|
|
--target $(RUST_TARGET) \
|
|
--bin fips \
|
|
--bin fipsctl \
|
|
--bin fipstop \
|
|
--bin fips-gateway
|
|
endef
|
|
|
|
define Package/fips/install
|
|
# Binaries
|
|
$(INSTALL_DIR) $(1)/usr/bin
|
|
$(INSTALL_BIN) $(RUST_RELEASE_DIR)/fips $(1)/usr/bin/fips
|
|
$(INSTALL_BIN) $(RUST_RELEASE_DIR)/fipsctl $(1)/usr/bin/fipsctl
|
|
$(INSTALL_BIN) $(RUST_RELEASE_DIR)/fipstop $(1)/usr/bin/fipstop
|
|
$(INSTALL_BIN) $(RUST_RELEASE_DIR)/fips-gateway $(1)/usr/bin/fips-gateway
|
|
|
|
# 802.11s mesh backhaul setup helper
|
|
$(INSTALL_BIN) $(CURDIR)/files/usr/bin/fips-mesh-setup $(1)/usr/bin/fips-mesh-setup
|
|
|
|
# Open "FIPS" access SSID setup helper
|
|
$(INSTALL_BIN) $(CURDIR)/files/usr/bin/fips-ap-setup $(1)/usr/bin/fips-ap-setup
|
|
|
|
# procd init script
|
|
$(INSTALL_DIR) $(1)/etc/init.d
|
|
$(INSTALL_BIN) $(CURDIR)/files/etc/init.d/fips $(1)/etc/init.d/fips
|
|
$(INSTALL_BIN) $(CURDIR)/files/etc/init.d/fips-gateway $(1)/etc/init.d/fips-gateway
|
|
|
|
# Default config — installed as CONF so opkg will not overwrite it on upgrade
|
|
$(INSTALL_DIR) $(1)/etc/fips
|
|
$(INSTALL_CONF) $(CURDIR)/files/etc/fips/fips.yaml $(1)/etc/fips/fips.yaml
|
|
|
|
# Firewall helper script (called by UCI include and hotplug)
|
|
$(INSTALL_BIN) $(CURDIR)/files/etc/fips/firewall.sh $(1)/etc/fips/firewall.sh
|
|
|
|
# sysctl: enable br_netfilter so AF_PACKET sees frames on bridge member ports
|
|
$(INSTALL_DIR) $(1)/etc/sysctl.d
|
|
$(INSTALL_DATA) $(CURDIR)/files/etc/sysctl.d/fips-bridge.conf $(1)/etc/sysctl.d/fips-bridge.conf
|
|
$(INSTALL_DATA) $(CURDIR)/files/etc/sysctl.d/fips-gateway.conf $(1)/etc/sysctl.d/fips-gateway.conf
|
|
|
|
# Hotplug: apply firewall rules when the FIPS TUN interface comes up
|
|
$(INSTALL_DIR) $(1)/etc/hotplug.d/net
|
|
$(INSTALL_BIN) $(CURDIR)/files/etc/hotplug.d/net/99-fips $(1)/etc/hotplug.d/net/99-fips
|
|
|
|
# UCI defaults: one-time first-boot firewall and module setup
|
|
$(INSTALL_DIR) $(1)/etc/uci-defaults
|
|
$(INSTALL_BIN) $(CURDIR)/files/etc/uci-defaults/90-fips-setup $(1)/etc/uci-defaults/90-fips-setup
|
|
|
|
# sysupgrade: preserve /etc/fips/ (config + identity key) across firmware upgrades
|
|
$(INSTALL_DIR) $(1)/lib/upgrade/keep.d
|
|
$(INSTALL_DATA) $(CURDIR)/files/lib/upgrade/keep.d/fips $(1)/lib/upgrade/keep.d/fips
|
|
endef
|
|
|
|
$(eval $(call BuildPackage,fips))
|