testing/wireguard-grsec / wireguard-vanilla / wireguard-tools #948

itoffshore · 2017-03-02T06:21:15Z

WireGuard is a novel VPN that runs inside the Linux Kernel and utilizes
state-of-the-art cryptography.

It aims to be faster, simpler, leaner, and more useful than IPSec, while
avoiding the massive headache. It intends to be considerably more performant
than OpenVPN.

WireGuard is designed as a general purpose VPN for running on embedded
interfaces and super computers alike, fit for many different circumstances.
It runs over UDP.

https://www.wireguard.io

grsecurity kernel module only for wireguard

vanilla kernel module only for wireguard

WireGuard is a novel VPN that runs inside the Linux Kernel and utilizes **state-of-the-art cryptography**. It aims to be faster, simpler, leaner, and more useful than IPSec, while avoiding the massive headache. It intends to be considerably more performant than OpenVPN. WireGuard is designed as a general purpose VPN for running on embedded interfaces and super computers alike, fit for many different circumstances. It runs over UDP. https://www.wireguard.io

algitbot · 2017-03-02T06:26:11Z

Merged in 302e07d, 9b2a721, bb1bb8e by @kaniini. Thanks for your contribution!

(This pull request has been closed automatically by GitHub PR Closer. If you think that it’s not resolved yet, please add a comment.)

zx2c4

Thanks for this package contribution! In the future, please give me a mention in any PRs or issues, so I can review before merging. This is wonderful work nonetheless, and I'm quite happy to see this in alpine. This review has a few little nits to cleanup in the next commit.

zx2c4 · 2017-03-02T15:21:42Z

testing/wireguard-grsec/APKBUILD

+arch='all'
+url='https://www.wireguard.io'
+license="GPLv2"
+makedepends="linux-grsec-dev=$_kpkgver libmnl-dev sparse"


You probably do not need to depend on sparse, unless you're actually doing development. It's not the "test suite" that you think it is.

have removed make check & changed the makedepends

zx2c4 · 2017-03-02T15:22:46Z

testing/wireguard-grsec/APKBUILD

+
+	local module=
+	for module in *.ko; do
+		install -v -D -m644 ${module} \


Why not instead run make -C src/ .... module-install?

module-install tries to install into /lib & does not obey DESTDIR="$pkgdir" passed to make

zx2c4 · 2017-03-02T15:23:18Z

testing/wireguard-grsec/APKBUILD

+	for module in *.ko; do
+		install -v -D -m644 ${module} \
+			"$pkgdir/lib/modules/$_abi_release/extra/${module}"
+	done


Do you need to run depmod after installing kernel modules, or does some higher level alpine layer already do that for you?

the kernel modules should install themselves automatically when wireguard-tools is installed - fixing in #954

zx2c4 · 2017-03-02T15:24:37Z

testing/wireguard-grsec/APKBUILD

+	return 0
+	# currently failing: attribute 'nocapture': unknown attribute
+	# not part of musl libc ?
+	make -C src/ \


Just remove this section. It doesn't do what you want in the first place. It's for development, not for usage by packagers. If this confusion becomes widespread, I'll just remove it from the package I distribute and keep the shortcut locally.

zx2c4 · 2017-03-02T15:25:00Z

testing/wireguard-tools/APKBUILD

+arch='all'
+url='https://www.wireguard.io'
+license="GPLv2"
+makedepends="libmnl-dev sparse"


Sparse has nothing to do with the tools and is not needed. Remove this dependency.

it was never a hard dependency to the userspace tools (only a build time depends)

removed in #954

zx2c4 · 2017-03-02T15:27:44Z

testing/wireguard-tools/APKBUILD

+}
+
+check() {
+	return 0


This has no business at all of being in the -tools package, and doesn't do what you'd hope it does anyway. Please remove this section.

Alpine Linux's apkbuild runs check() on every single package in the repo now. If available it should run the software's built in unit tests.

Have removed make check as requested in #954

I'm not sure how this would work for you, but the WireGuard module actually has built-in selftests when built in DEBUG mode. When enabled, either the module inserts and everything is fine, or it fails to insert, which implies the tests have failed (and you get something in dmesg). This probably is too difficult to do in a package though...

zx2c4 · 2017-03-02T15:28:22Z

testing/wireguard-vanilla/APKBUILD

+arch='all'
+url='https://www.wireguard.io'
+license="GPLv2"
+makedepends="linux-vanilla-dev=$_kpkgver libmnl-dev sparse"


Sparse is not a requirement. Please remove it.

zx2c4 · 2017-03-02T15:28:46Z

testing/wireguard-vanilla/APKBUILD

+
+	local module=
+	for module in *.ko; do
+		install -v -D -m644 ${module} \


Why not instead run make -C src/ .... module-install?

module-install tries to install into /lib & does not obey DESTDIR="$pkgdir" passed to make

module-install will respond to INSTALL_MOD_PATH being set, actually. So this is the right way to do it. In the next WireGuard release, I'll investigate wiring DESTDIR up to INSTALL_MOD_PATH, so that these can be unified. Thanks for pointing out the shortcomings to me.

zx2c4 · 2017-03-02T15:29:07Z

testing/wireguard-vanilla/APKBUILD

+	for module in *.ko; do
+		install -v -D -m644 ${module} \
+			"$pkgdir/lib/modules/$_abi_release/extra/${module}"
+	done


Do you need to run depmod after installing kernel modules, or does some higher level alpine layer already do that for you?

the kernel modules should install themselves automatically when wireguard-tools is installed - fixing in #954

zx2c4 · 2017-03-02T15:29:26Z

testing/wireguard-vanilla/APKBUILD

+	done
+}
+
+check() {


Just remove this section. It doesn't do what you want in the first place. It's for development, not for usage by packagers. If this confusion becomes widespread, I'll just remove it from the package I distribute and keep the shortcut locally.

Alpine Linux's apkbuild runs check() on every single package in the repo now. If available it should run the software's built in unit tests.

Have removed make check as requested in #954

itoffshore · 2017-03-02T21:33:35Z

@zx2c4 - in summary:

you can view the various wireguard packages + their contents & dependencies here.
sparse was never a hard dependency (only build time) & is removed in testing/wireguard: various small fixes #954
tests subpkg completely removed in testing/wireguard: various small fixes #954
running apk add wireguard-tools will also automatically install the appropriate kernel modules.

At the moment wireguard is in the testing repo so you will need to pin the edge repo & apk add linux-grsec@edge or apk add linux-vanilla@edge.

NB: pinning the testing repo normally causes dependency problems particularly with perl & python packages. You probably want to set /etc/apk/repositories to:

http://nl.alpinelinux.org/alpine/v3.5/main
http://nl.alpinelinux.org/alpine/v3.5/community
@edge http://nl.alpinelinux.org/alpine/edge/main
@edgecom http://nl.alpinelinux.org/alpine/edge/community
http://nl.alpinelinux.org/alpine/edge/testing

zx2c4 · 2017-03-03T03:02:17Z

developer tools are contained in wireguards-tests not wireguard-tools

That tests package is bogus and will never work. It should not ever be distributed as a package by distributions. As written elsewhere, if other people make this same confusion, then I'll just remove that code from the tree.

running apk add wireguard-tools will also automatically install the appropriate kernel modules.

Awesome! That's super easy. I like the reverse dependency logic of apk; very nice.

itoffshore added 3 commits March 2, 2017 06:15

testing/wireguard-grsec: new aport

f0a0b97

grsecurity kernel module only for wireguard

testing/wireguard-vanilla: new aport

a293a0d

vanilla kernel module only for wireguard

algitbot closed this Mar 2, 2017

itoffshore deleted the wireguard branch March 2, 2017 06:27

zx2c4 reviewed Mar 2, 2017

View reviewed changes

riyazdf mentioned this pull request Mar 2, 2017

[project] Build WireGuard into Moby linuxkit/linuxkit#1224

Merged

This was referenced Mar 2, 2017

testing/wireguard-*: fix $install_if #953

Closed

testing/wireguard: various small fixes #954

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

testing/wireguard-grsec / wireguard-vanilla / wireguard-tools #948

testing/wireguard-grsec / wireguard-vanilla / wireguard-tools #948

itoffshore commented Mar 2, 2017

algitbot commented Mar 2, 2017

zx2c4 left a comment

zx2c4 Mar 2, 2017

itoffshore Mar 2, 2017

zx2c4 Mar 2, 2017

itoffshore Mar 2, 2017

zx2c4 Mar 2, 2017

itoffshore Mar 2, 2017

zx2c4 Mar 2, 2017

itoffshore Mar 2, 2017

zx2c4 Mar 2, 2017

itoffshore Mar 2, 2017

zx2c4 Mar 2, 2017

itoffshore Mar 2, 2017

zx2c4 Mar 3, 2017

zx2c4 Mar 2, 2017

itoffshore Mar 2, 2017

zx2c4 Mar 2, 2017

itoffshore Mar 2, 2017

zx2c4 Mar 3, 2017 •

edited

Loading

zx2c4 Mar 2, 2017

itoffshore Mar 2, 2017

zx2c4 Mar 2, 2017

itoffshore Mar 2, 2017

itoffshore commented Mar 2, 2017 •

edited

Loading

zx2c4 commented Mar 3, 2017

testing/wireguard-grsec / wireguard-vanilla / wireguard-tools #948

testing/wireguard-grsec / wireguard-vanilla / wireguard-tools #948

Conversation

itoffshore commented Mar 2, 2017

algitbot commented Mar 2, 2017

zx2c4 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

zx2c4 Mar 3, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

itoffshore commented Mar 2, 2017 • edited Loading

zx2c4 commented Mar 3, 2017

zx2c4 Mar 3, 2017 •

edited

Loading

itoffshore commented Mar 2, 2017 •

edited

Loading