Johnathan Corgan
40c67abbe6
Five files conflicted and each needed a different call, because the two lines had rewritten different halves of the same code. The handshake handler takes next's version whole. master's entire change there was three comment blocks and one widened debug_assert, and the assert names HandshakePhase::ReceivedMsg1, a variant next's XX rewrite does not have. Nothing semantic was dropped. The peer reaper takes master's: reap_peers_on_transport is new and its route_link_dead doc now describes both callers, which is true on this line too. The ethernet transport takes master's binder rewrite with next's wire format re-applied on top. The send path, the receive path and the frame tests merged to the 4-byte header on their own, but three sites are new in master's rewrite and had never seen it: the Binding default and both arms of the binder's MTU calculation still subtracted 3. The transports snapshot fixture moved with them, 1499 to 1496, and that single field was the whole diff. Beacons carry no pubkey here, so local_pubkey leaves the transport, its binder context and the node's transport construction with it. The changelog keeps both sides' entries, with master's Added subsection lifted back out of Changed where the merge had left it. Two tests do not come across. a_transient_msg2_failure_keeps_the_link_for_ the_retry and its restart-path sibling assert that the machine rests at ReceivedMsg1. This line's nearest state is SentMsg2, and it means something else: the inbound leg parks there awaiting msg3, where on the other line that phase was the last stop before promotion. Renaming it would produce a test that passes without exercising the deferral. The behaviour they guard did merge and sits in the transient arm of the msg2 send failure; what is missing is coverage shaped for this handshake, which is tracked separately. The two connected-socket tests did come across. Their helper took the responder's session straight after msg2, which is an IK assumption; it now runs msg3 as well. Both pass here and both go red when the clear is removed or made unconditional. The test-harness fixes arrive through master rather than as follow-ups here, so this line never carries the versions that failed: the interface-binding suite's veth naming, and the chaos veth restore, random streams, settle wait, netem restore and shared down-node set.
FIPS OpenWrt Package
This directory is an OpenWrt feed package that builds and installs FIPS on any
OpenWrt 22.03+ router via the standard opkg package system.
Package contents
| Installed path | Purpose |
|---|---|
/usr/bin/fips |
Mesh daemon |
/usr/bin/fipsctl |
CLI control tool (fipsctl show peers, fipsctl show links, …) |
/usr/bin/fipstop |
Live TUI dashboard |
/usr/bin/fips-gateway |
Outbound LAN gateway service (not started by default) |
/usr/bin/fips-mesh-setup |
Opt-in helper — creates an open 802.11s mesh interface for router↔router backhaul |
/usr/bin/fips-ap-setup |
Opt-in helper — creates the open !FIPS access SSID for client devices |
/etc/init.d/fips |
procd service for the daemon (auto-start, crash respawn) |
/etc/init.d/fips-gateway |
procd service for the gateway (disabled by default) |
/etc/fips/fips.yaml |
Node configuration (edit before first start) |
/etc/fips/firewall.sh |
Firewall helper — accepts traffic on fips0 |
/etc/dnsmasq.d/fips.conf |
Forwards .fips DNS queries to the daemon |
/etc/sysctl.d/fips-bridge.conf |
br_netfilter settings for Ethernet transport |
/etc/sysctl.d/fips-gateway.conf |
proxy_ndp and IPv6 forwarding for the gateway |
/etc/hotplug.d/net/99-fips |
Applies firewall rules when fips0 comes up |
/etc/uci-defaults/90-fips-setup |
First-boot kernel module and firewall setup |
/lib/upgrade/keep.d/fips |
Preserves /etc/fips/ across sysupgrade |
Requirements
Build host
| Requirement | Notes |
|---|---|
| OpenWrt SDK 22.03+ | Older versions lack fw4 / nftables support |
| Rust host toolchain | Enable in make menuconfig → Advanced → Rust, or install rustup |
| Rust target for your router | Added automatically by the Makefile via rustup target add |
Router
| Requirement | Notes |
|---|---|
kmod-tun |
Required for fips0 TUN interface |
kmod-br-netfilter |
Required for Ethernet transport on bridge member ports |
Both kernel modules are listed as package dependencies (DEPENDS) and will be
installed automatically by opkg.
Target architectures
The Makefile maps the OpenWrt ARCH variable to the correct Rust musl target:
OpenWrt ARCH |
Rust target |
|---|---|
aarch64 |
aarch64-unknown-linux-musl |
x86_64 |
x86_64-unknown-linux-musl |
mipsel |
mipsel-unknown-linux-musl |
mips |
mips-unknown-linux-musl |
arm |
arm-unknown-linux-musleabihf |
To add a missing architecture, add an ifeq block in Makefile mapping the
OpenWrt ARCH value to the Rust target triple.
Building with the OpenWrt SDK
1. Obtain the SDK
Download the SDK for your router's target from downloads.openwrt.org and extract it.
2. Add this package
Copy or symlink this directory into the SDK's package/ tree:
# From inside the SDK root:
ln -s /path/to/fips/packaging/openwrt-ipk package/fips
Or add the FIPS repository as a feed in feeds.conf:
src-git-full fips https://github.com/jmcorgan/fips.git
Then update and install feeds:
./scripts/feeds update fips
./scripts/feeds install -a -p fips
3. Build
make package/fips/compile V=s
The resulting .ipk is placed in bin/packages/<arch>/.
4. Pin the source version
For reproducible production builds, replace PKG_SOURCE_VERSION:=master in
Makefile with a specific commit SHA and set PKG_MIRROR_HASH to the correct
hash (or keep skip for development):
PKG_SOURCE_VERSION:=bf117dfabc123... # full 40-char SHA
PKG_MIRROR_HASH:=skip
Installing on the router
scp bin/packages/<arch>/fips_0.1.0-1_<arch>.ipk root@192.168.1.1:/tmp/
ssh root@192.168.1.1 opkg install /tmp/fips_0.1.0-1_<arch>.ipk
First-time configuration
Edit /etc/fips/fips.yaml on the router before starting the daemon:
ssh root@192.168.1.1
vi /etc/fips/fips.yaml
The default config enables:
- Persistent identity (key generated on first start, saved to
/etc/fips/fips.key) - TUN interface
fips0 - DNS responder on
127.0.0.1:5354 - UDP transport on
0.0.0.0:2121
For Ethernet transport, uncomment the ethernet: section and set the correct
physical interface names for your router. Always use physical port names
(eth0, eth1, or DSA port names like wan/lan1), never bridge names
(br-lan). The shipped default WAN port is eth0 (OpenWrt 24); on OpenWrt
25 (DSA) boards the WAN port is named wan — the .apk package ships that
default. Run ip link show to confirm the names on your board.
Service management
/etc/init.d/fips start
/etc/init.d/fips stop
/etc/init.d/fips restart
/etc/init.d/fips enable # start at boot (already enabled by opkg postinstall)
/etc/init.d/fips disable
Outbound LAN gateway (optional)
The fips-gateway service is installed but disabled by default. It
turns the router into an outbound gateway that bridges LAN clients
onto the FIPS mesh. Enable only after configuring a gateway:
section in /etc/fips/fips.yaml:
/etc/init.d/fips-gateway enable
/etc/init.d/fips-gateway start
See docs/tutorials/deploy-fips-gateway.md in the source tree for
the full walkthrough.
Inspection and logs
# Node-level status overview
fipsctl show status
# Peer table
fipsctl show peers
# Transport links
fipsctl show links
# Active end-to-end sessions
fipsctl show sessions
# Live TUI dashboard
fipstop
# Daemon logs (OpenWrt syslog)
logread | grep fips
See docs/reference/cli-fipsctl.md
for the full subcommand list.
Upgrading
Install the new .ipk over the existing one:
opkg install --force-reinstall fips_<new-version>_<arch>.ipk
The config in /etc/fips/fips.yaml and the identity key /etc/fips/fips.key
are preserved by opkg (the yaml is installed as a conffile; the key is not a
package file). Both survive sysupgrade via /lib/upgrade/keep.d/fips.