Daniel Pocock: Enabling Elliptic Curve Cryptography in OpenWRT and strongSwan VPNs
OpenWRT currently ships an OpenSSL package with Elliptic Curve Cryptography (ECC) disabled. This is very inconvenient as ECC is now standard in other distributions like Debian and Ubuntu and it is necessary to solve certain problems such as making IPsec VPNs work reliably
It is relatively easy to enable it, this also provides a useful opportunity to see how the OpenWRT build system works.
Preparing the build environment
The build was done on a Debian 7 (wheezy) workstation. It is necessary to install some packages that provide tools needed for the build:
Running strongSwan IPsec on a router requires a router with plenty of flash, RAM and CPU power. Cheap routers with limited flash will not be able to install the packages at all. I tested on the Buffalo WZR-HP-AG300H-EU which has 32MB flash and 128MB RAM
Here are the commands executed on the Debian build workstation:
apt-get install gcc binutils flex make unzip gawk libz-dev linux-libc-devRebuild the OpenSSL and StrongSwan packages This was tested with an ar71xx CPU-based router. You can easily change the config (run make menuconfig just before make defconfig) for other variations of router.
Running strongSwan IPsec on a router requires a router with plenty of flash, RAM and CPU power. Cheap routers with limited flash will not be able to install the packages at all. I tested on the Buffalo WZR-HP-AG300H-EU which has 32MB flash and 128MB RAM
Here are the commands executed on the Debian build workstation:
mkdir ~/ws cd ~/ws svn checkout svn://svn.openwrt.org/openwrt/trunk openwrt-trunk cd openwrt-trunk ./scripts/feeds update -a ./scripts/feeds install -a wget -O .config \ http://danielpocock.com/sites/danielpocock.com/files/openwrt.config.txt sed -i -e 's/no-ec//' package/libs/openssl/Makefile make defconfig make -j 13The "make" command will build all the packages. It takes some time. Copy the packages to a router The actual location of the packages in your source tree depends on the CPU architecture you chose to build for. You can find them with a command such as:
find . -name '*.ipk'Here we look at how to copy the packages for the ar71xx based router into the /tmp directory on the router. The router IP is 192.168.1.1 below:
cd ./bin/ar71xx/packages/ scp libopenssl_1.0.1e-1_ar71xx.ipk strongswan*.ipk root@192.168.1.1:/tmpInstalling the packages It is relatively easy to install the packages using the opkg utility on OpenWRT. When using self-compiled packages, you are likely to get errors about the checksums. OpenWRT compares the checksum of the package to the checksum from the package catalog file. You can delete the catalog file (e.g. rm /var/opkg-lists/attitude_adjustment) and then opkg will install the package without complaining. The file is automatically placed there each time you run opkg update so there is no harm in deleting it. In my earlier blog, I looked at how to link Android clients to the strongSwan VPN. Unfortunately Android has a bug in ECC support too and must still be used with RSA certificates. Nonetheless, the OpenWRT VPN will be quite happy talking to Linux laptops and servers - you may need to rebuild OpenSSL and StrongSwan on any Fedora, Red Hat or CentOS systems that require ECC support too. As you migrate from RSA to ECC certificates it is quite feasible to have both types of certificates in use at the same time. strongSwan supports this type of hybrid environment. To make the migration to ECC go smoothly it is desirable to ensure all boxes have ECC support at the earliest opportunity.
I ve been 
</video>
(
not that we have a lack of RC bugs; still, I was a bit lazy in the last two
weeks. here's what I've worked on:
A co-incidence that caught my eye this week was the failure of emergency call centers in Melbourne, Australia and Detroit, USA.
Melbourne's system 
A huge release, the combined 0.9.9 and 0.9.10 releases (I made a mistake releasing) are now tagged and pushed to pypi. It features a number of enhancements and fixes, and is just an absolute thrill to play with.
Thanks to the contributors this cycle:
Having 
Someone recently asked me about the Debian Xfce 4.10 status, as
apparently I forgot to update this post series.
So, as you might have noticed, the full Xfce 4.10 desktop
environment is currently in Debian Jessie (current name for
testing). All in all, the transition went well and smooth.
One of the most regular question I get about Xfce 4.10 is the
panel behavior when it comes to the task bar expansion. In
xfce4-panel 4.8, when people wanted to have a full side panel with
a task bar plugin inside, they added a Windows buttons plugin and
configured the panel to 100% length. Then the Windows buttons
would expand to occupy all the free space on the panel. It was a
special case plugins, as usually other plugins only used a fixed
space. Now, in 4.10, this is not the case anymore. Windows button
uses a fixed size. And the plugins are left-aligned, which means
usually people end up with some space at the far right of the
panel. To restore the previous behavior back (which is actually the
pre-4.8 behavior, 4.8 was an exception by itself), one needs to add
a Separator plugin, then configure it to expand (and optionnally
select a transparent handle). Then move it next right to the
Windows buttons plugin.
Another thing which might be a bit surprising for upgrading
users is the change in the Action buttons plugin, which people
usually use to logout. In 4.8, by default, it's set to run the
logout dialog. In 4.10, by default, it's set to logout directly
(but with a confirmation dialog). If you prefer the previous
behavior, you can just configure the Action buttons plugin and
select the Log out item instead of the Log out one (I know,
it's a bit confusing).
If you have any question, don't hesitate to reach us by mail or
on irc (#debian-xfce on Freenode). Other than that remember that
Xfce really needs you help, both in Debian and upstream (and at
that point, I'd say *especially* upstream). There's a lot of
unmaintained project under the Xfce umbrella, some of them part of
the core (like xfce4-power-manager), so if you have some spare time
and some C/GTK+ knowledge, feel free to contact the Xfce team on
the mailing list.
