🌴 Sync 2026-03-05 23:51:42

glorytun/Makefile

@@ -0,0 +1,62 @@
+#
+# Copyright (C) 2015 OVH
+# Copyright (C) 2017-2025 Ycarus (Yannick Chabanois) <ycarus@zugaina.org>
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=glorytun
+PKG_RELEASE:=1
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_VERSION:=95fa5ead2154adb546bcdb454c56c876e9f60bb5
+PKG_SOURCE:=glorytun-$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL:=https://github.com/Ysurac/glorytun.git
+PKG_VERSION:=0.0.35
+PKG_LICENSE:=BSD-2-Clause
+PKG_LICENSE_FILES:=LICENSE
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/$(PKG_NAME)
+SECTION:=net
+CATEGORY:=Network
+DEPENDS:=+kmod-tun +libsodium +librt
+TITLE:=Glorytun
+URL:=https://github.com/angt/glorytun
+SUBMENU:=VPN
+endef
+
+define Package/$(PKG_NAME)/description
+ A small, simple and secure VPN
+endef
+
+# not everything groks --disable-nls
+DISABLE_NLS:=
+TARGET_CFLAGS += -std=c17 -D_GNU_SOURCE
+
+define Package/$(PKG_NAME)/conffiles
+/etc/config/glorytun
+endef
+
+define Build/Configure
+	cd $(PKG_BUILD_DIR); \
+		$(AM_TOOL_PATHS) ./bootstrap.sh
+	$(call Build/Configure/Default)
+endef
+
+define Package/$(PKG_NAME)/install
+	$(INSTALL_DIR) $(1)/usr/sbin
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/glorytun $(1)/usr/sbin/$(PKG_NAME)
+	$(INSTALL_BIN) files/glorytun-irq-affinity.sh $(1)/usr/sbin/glorytun-irq-affinity.sh
+	$(INSTALL_DIR) $(1)/etc/init.d
+	$(INSTALL_BIN) init $(1)/etc/init.d/$(PKG_NAME)
+	$(INSTALL_DIR) $(1)/etc/config
+	$(INSTALL_DATA) glorytun.config $(1)/etc/config/glorytun
+	$(INSTALL_DIR) $(1)/etc/glorytun
+	$(INSTALL_DATA) files/glorytun-sysctl.conf $(1)/etc/glorytun/glorytun-sysctl.conf
+endef
+
+$(eval $(call BuildPackage,$(PKG_NAME)))

glorytun/files/glorytun-irq-affinity.sh

@@ -0,0 +1,86 @@
+#!/bin/sh
+
+# Set IRQ affinity for glorytun interfaces
+set_irq_affinity() {
+    local irq=$1
+    local cpu=$2
+    local mask=$(printf "%x" $((1 << $cpu)))
+    
+    echo "Setting IRQ $irq to CPU $cpu (mask: $mask)"
+    echo $mask > /proc/irq/$irq/smp_affinity
+}
+
+# Get interface IRQs
+get_interface_irqs() {
+    local interface=$1
+    grep -E "$interface" /proc/interrupts | awk '{print $1}' | tr -d ':'
+}
+
+# Main function
+setup_irq_affinity() {
+    # Get available CPU cores
+    local cpu_count=$(grep -c processor /proc/cpuinfo)
+    echo "Available CPU cores: $cpu_count"
+    
+    # Determine tun interface
+    local tun_interface=$(ip link | grep tun | awk -F': ' '{print $2}' | head -n1)
+    if [ -z "$tun_interface" ]; then
+        echo "No tun interface found"
+        return 1
+    fi
+    
+    echo "Found tun interface: $tun_interface"
+    
+    # Get IRQs for tun interface
+    local irqs=$(get_interface_irqs $tun_interface)
+    if [ -z "$irqs" ]; then
+        echo "No IRQs found for $tun_interface"
+        return 1
+    fi
+    
+    # Distribute IRQs across available cores (except CPU0)
+    local cpu=1
+    for irq in $irqs; do
+        set_irq_affinity $irq $cpu
+        cpu=$(( (cpu + 1) % cpu_count ))
+        if [ $cpu -eq 0 ]; then
+            cpu=1
+        fi
+    done
+    
+    # Set RPS (Receive Packet Steering) for better packet distribution
+    if [ -e /sys/class/net/$tun_interface/queues/rx-0/rps_cpus ]; then
+        # Calculate mask for all CPUs except CPU0
+        local rps_mask=$(printf "%x" $(( (1 << $cpu_count) - 2 )))
+        echo "Setting RPS mask to $rps_mask for $tun_interface"
+        echo $rps_mask > /sys/class/net/$tun_interface/queues/rx-0/rps_cpus
+    fi
+    
+    # Set RFS (Receive Flow Steering) limits if available
+    if [ -e /proc/sys/net/core/rps_sock_flow_entries ]; then
+        echo 32768 > /proc/sys/net/core/rps_sock_flow_entries
+        if [ -e /sys/class/net/$tun_interface/queues/rx-0/rps_flow_cnt ]; then
+            echo 32768 > /sys/class/net/$tun_interface/queues/rx-0/rps_flow_cnt
+        fi
+    fi
+    
+    # Set XPS (Transmit Packet Steering) if available
+    if [ -e /sys/class/net/$tun_interface/queues/tx-0/xps_cpus ]; then
+        # Use all CPUs except CPU0 for transmit
+        local xps_mask=$(printf "%x" $(( (1 << $cpu_count) - 2 )))
+        echo "Setting XPS mask to $xps_mask for $tun_interface"
+        echo $xps_mask > /sys/class/net/$tun_interface/queues/tx-0/xps_cpus
+    fi
+    
+    # Increase network queue length for better performance
+    if [ -e /sys/class/net/$tun_interface/tx_queue_len ]; then
+        echo 1000 > /sys/class/net/$tun_interface/tx_queue_len
+    fi
+    
+    echo "IRQ affinity setup completed for $tun_interface"
+}
+
+# Run the main function
+setup_irq_affinity
+
+exit 0 

glorytun/files/glorytun-sysctl.conf

@@ -0,0 +1,27 @@
+# Glorytun-specific optimizations
+# Note: These settings complement the system-wide sysctl parameters
+
+# Buffer size optimization for glorytun tunnels
+# Increase only if not already set in system configuration
+net.core.rmem_max = 16777216
+net.core.wmem_max = 16777216
+net.core.optmem_max = 16777216
+
+# Enable BBR congestion control for better tunnel performance
+net.core.default_qdisc = fq
+
+# RPS/RFS settings for tunnel interfaces
+# These are critical for multicore performance with glorytun
+net.core.rps_sock_flow_entries = 32768
+
+# Network device tuning for tunnel interfaces
+net.core.netdev_max_backlog = 10000
+net.core.netdev_budget = 600
+net.core.netdev_budget_usecs = 10000
+
+# Lower TCP timeout for faster recovery of tunnel connections
+net.ipv4.tcp_keepalive_intvl = 10
+net.ipv4.tcp_keepalive_probes = 6
+
+# Disable slow start after idle for more consistent tunnel performance
+net.ipv4.tcp_slow_start_after_idle = 0 

glorytun/glorytun.config

@@ -0,0 +1,16 @@
+config glorytun 'vpn'
+	option enable '0'
+	option host '127.0.0.1'
+	option port '65001'
+	option dev 'tun0'
+	option key ''
+	option mptcp '1'
+	option proto 'tcp'
+	option chacha20 '1'
+	option mtuauto '1'
+	option localip '10.255.255.2'
+	option remoteip '10.255.255.1'
+	option multiqueue '1'
+	option cpu_affinity '1'
+	option label 'Default VPN'
+	option timeout '10000'

glorytun/init

@@ -0,0 +1,175 @@
+#!/bin/sh /etc/rc.common
+# vim: set noexpandtab tabstop=4 shiftwidth=4 softtabstop=4 :
+# Copyright (C) 2015 ovh.com
+# Copyright (C) 2017 Ycarus (Yannick Chabanois) <ycarus@zugaina.org>
+
+START=90
+STOP=10
+
+USE_PROCD=1
+PROG_NAME=glorytun
+PROG=/usr/sbin/${PROG_NAME}
+
+_log() {
+	logger -p daemon.info -t ${PROG_NAME} "$@"
+}
+
+_err() {
+	logger -p daemon.err -t ${PROG_NAME} "$@"
+}
+
+# Apply system optimizations
+apply_sysctl_optimizations() {
+	if [ -f /etc/glorytun/glorytun-sysctl.conf ]; then
+		_log "Applying system optimizations"
+		sysctl -q -p /etc/glorytun/glorytun-sysctl.conf
+	fi
+}
+
+validate_section() {
+	uci_validate_section glorytun glorytun "${1}" \
+		'enable:bool:0'      \
+		'mptcp:bool:0'       \
+		'mode:string'    \
+		'key:string'         \
+		'host:host'          \
+		'port:port'          \
+		'dev:string'         \
+		'timeout:uinteger:10000'         \
+		'chacha20:bool:0'    \
+		'multiqueue:bool:1'  \
+		'cpu_affinity:bool:1' \
+		'proto:string' \
+		'localip:string' \
+		'remoteip:string'
+}
+
+# New function for CPU core optimization
+optimize_cpu_cores() {
+	local dev="$1"
+	local multiqueue="$2"
+	local cpu_affinity="$3"
+	
+	if [ "$cpu_affinity" = "1" ]; then
+		_log "Setting up CPU affinity for $dev"
+		if [ -x /usr/sbin/glorytun-irq-affinity.sh ]; then
+			/usr/sbin/glorytun-irq-affinity.sh
+		fi
+	fi
+	
+	if [ "$multiqueue" = "1" ]; then
+		_log "Enabling multiqueue for $dev"
+		
+		# Get CPU count
+		local cpu_count=$(grep -c processor /proc/cpuinfo)
+		if [ "$cpu_count" -gt 1 ]; then
+			# Use half of available CPUs but at least 2
+			local queue_count=$(( cpu_count / 2 ))
+			[ "$queue_count" -lt 2 ] && queue_count=2
+			
+			# Set multiqueue parameters
+			ip link set dev "$dev" multiqueue on
+			
+			# Increase buffer sizes for better performance
+			if [ -e /proc/sys/net/core/rmem_max ]; then
+				echo 16777216 > /proc/sys/net/core/rmem_max
+				echo 16777216 > /proc/sys/net/core/wmem_max
+				echo 16777216 > /proc/sys/net/core/optmem_max
+			fi
+		fi
+	fi
+}
+
+start_instance() {
+	local enable key host port dev mptcp proto chacha20 mode multiqueue cpu_affinity timeout localip remoteip
+
+	validate_section "${1}" || {
+		_err "validation failed"
+		return 1
+	}
+
+	[ "${enable}" = "1" ] || return 1
+	[ "${proto}" = "tcp" ] || return 1
+	[ -n "${key}" ] || {
+		_err "Key empty"
+		return 1
+	}
+	[ "${key}" != "secretkey" ] || return 1
+	[ -n "${port}" ] || return 1
+	[ -n "${dev}" ] || return 1
+	[ -n "${host}" ] || return 1
+
+	echo "${key}" > /tmp/${PROG_NAME}-${1}.key
+	[ -f "/tmp/${PROG_NAME}-${1}.key" ] || {
+		_err "can't create key file"
+		return 1
+	}
+	key=""
+
+	if [ "$(uci -q get network.omrvpn)" != "" ]; then
+		uci -q set network.omrvpn.device=${dev}
+		uci -q commit network
+	fi
+
+	_log "starting ${PROG_NAME} ${1} instance $*"
+
+	procd_open_instance
+
+	procd_set_param command ${PROG} \
+		keyfile /tmp/${PROG_NAME}-${1}.key \
+		${port:+port "$port"} \
+		${host:+host "$host"} \
+		${dev:+dev "$dev"} 
+
+	[ "${mode}" = "listener" ] && procd_append_param command listener
+	[ "${mptcp}" = "1" ] && procd_append_param command mptcp
+	[ "${chacha20}" = "1" ] && procd_append_param command chacha20
+	[ "${multiqueue}" = "1" ] && procd_append_param command multiqueue
+
+	procd_append_param command \
+		retry count -1 const 5000000 \
+		timeout ${timeout} \
+		keepalive count 5 idle 20 interval 2 \
+		buffer-size 65536
+
+	procd_set_param respawn 0 30 0
+	procd_set_param nice 10
+	procd_set_param file /tmp/${PROG_NAME}-${1}.key
+
+	procd_set_param stdout 1
+	procd_set_param stderr 1
+
+	procd_close_instance
+	
+	# Apply CPU optimizations after the instance is started
+	optimize_cpu_cores "$dev" "$multiqueue" "$cpu_affinity"
+	
+	# Configure interface IP addresses
+	if [ -n "$localip" ] && [ -n "$remoteip" ]; then
+                (
+                        # Wait for device to be created
+                        local count=0
+                        while [ $count -lt 10 ]; do
+                                if ip link show "$dev" >/dev/null 2>&1; then
+                                        ifconfig "$dev" "$localip" pointopoint "$remoteip" up && \
+                                        _log "Configured $dev with IP $localip peer $remoteip"
+                                        break
+                                fi
+                                sleep 1
+                                count=$((count + 1))
+                        done
+                ) &
+	fi
+}
+
+start_service() {
+	# Apply system optimizations before starting instances
+	apply_sysctl_optimizations
+	
+	config_load glorytun
+	config_foreach start_instance glorytun
+}
+
+service_triggers() {
+	procd_add_reload_trigger glorytun network
+}

glorytun/patches/001-fix-compilation-errors-gcc14.patch

@@ -0,0 +1,15 @@
+--- a/src/main.c
++++ b/src/main.c
+@@ -1164,9 +1164,9 @@
+
+     if (memcmp(&data_r[size-hash_size-sizeof(proto)], proto, 3)) {
+         gt_log("bad packet [%02"PRIX8"%02"PRIX8"%02"PRIX8"] !\n",
+-            &data_r[size-hash_size-sizeof(proto)+0],
+-            &data_r[size-hash_size-sizeof(proto)+1],
+-            &data_r[size-hash_size-sizeof(proto)+2]);
++            data_r[size-hash_size-sizeof(proto)+0],
++            data_r[size-hash_size-sizeof(proto)+1],
++            data_r[size-hash_size-sizeof(proto)+2]);
+         return -2;
+     }
+ 

glorytun/patches/002-fix-crypto-aead-pointer-types.patch

@@ -0,0 +1,13 @@
+--- a/src/main.c
++++ b/src/main.c
+@@ -1228,8 +1228,8 @@
+         memcpy(ctx->read.key, key_r, sizeof(key_r));
+         memcpy(ctx->write.key, key_w, sizeof(key_w));
+     } else {
+-        crypto_aead_aes256gcm_beforenm(&ctx->read.key, key_r);
+-        crypto_aead_aes256gcm_beforenm(&ctx->write.key, key_w);
++        crypto_aead_aes256gcm_beforenm((crypto_aead_aes256gcm_state *)ctx->read.key, key_r);
++        crypto_aead_aes256gcm_beforenm((crypto_aead_aes256gcm_state *)ctx->write.key, key_w);
+     }
+ 
+     sodium_memzero(secret, sizeof(secret));