Merge pull request #4139 from chewitt/wireguard-matrix

wireguard: add initial support for WireGuard VPNs
2025-07-24 11:16:51 +00:00 · 2020-01-29 21:12:23 +00:00 · 2020-01-29 21:12:23 +00:00 · 2500f20522
commit 2500f20522
parent 20f94f06d1 8d0868c437
22 changed files with 217 additions and 14 deletions
--- a/config/show_config
+++ b/config/show_config
@ -90,6 +90,7 @@ show_config() {
  config_message="$config_message\n - SAMBA server support:\t\t $SAMBA_SERVER"
  config_message="$config_message\n - SFTP server support:\t\t\t $SFTP_SERVER"
  config_message="$config_message\n - OpenVPN support:\t\t\t $OPENVPN_SUPPORT"
+  config_message="$config_message\n - WireGuard support:\t\t\t $WIREGUARD_SUPPORT"

  # OS configuration

--- a/distributions/LibreELEC/options
+++ b/distributions/LibreELEC/options
@ -115,6 +115,9 @@
 # build and install OpenVPN support (yes / no)
  OPENVPN_SUPPORT="yes"

+# build and install WireGuard support (yes / no)
+  WIREGUARD_SUPPORT="yes"
+
 # build and install diskmounter support (udevil)
 # this service provide auto mounting support for external drives in the
 # mediacenter also automount internally drives at boottime via udev (yes / no)
--- a/packages/network/connman/package.mk
+++ b/packages/network/connman/package.mk
@ -3,11 +3,11 @@
 # Copyright (C) 2019-present Team LibreELEC (https://libreelec.tv)

 PKG_NAME="connman"
-PKG_VERSION="1.37"
-PKG_SHA256="6ce29b3eb0bb16a7387bc609c39455fd13064bdcde5a4d185fab3a0c71946e16"
+PKG_VERSION="9c781b75657bb72a9d65ba7cc73aa5111ae13eb2" # pre 1.38
+PKG_SHA256="384ac276b593e919614f8615da8641dac4268c8e6ebc1166b78b3d260d5ca242"
 PKG_LICENSE="GPL"
 PKG_SITE="http://www.connman.net"
-PKG_URL="https://www.kernel.org/pub/linux/network/connman/$PKG_NAME-$PKG_VERSION.tar.xz"
+PKG_URL="https://git.kernel.org/pub/scm/network/connman/connman.git/snapshot/connman-$PKG_VERSION.tar.gz"
 PKG_DEPENDS_TARGET="toolchain glib readline dbus iptables"
 PKG_LONGDESC="A modular network connection manager."
 PKG_TOOLCHAIN="autotools"
@ -44,6 +44,12 @@ PKG_CONFIGURE_OPTS_TARGET="--srcdir=.. \
                           --with-systemdunitdir=/usr/lib/systemd/system \
                           --disable-silent-rules"

+if [ "$WIREGUARD_SUPPORT" = "yes" ]; then
+  PKG_CONFIGURE_OPTS_TARGET+=" --enable-wireguard=builtin"
+else
+  PKG_CONGIGURE_OPTS_TARGET+=" --disable-wireguard"
+fi
+
 case "$WIRELESS_DAEMON" in
  wpa_supplicant)
    PKG_DEPENDS_TARGET+=" wpa_supplicant"
@ -59,6 +65,7 @@ case "$WIRELESS_DAEMON" in
 esac

 PKG_MAKE_OPTS_TARGET="storagedir=/storage/.cache/connman \
+                      vpn_storagedir=/storage/.config/wireguard \
                      statedir=/run/connman"

 post_makeinstall_target() {
@ -93,4 +100,7 @@ post_install() {
  add_group system 430

  enable_service connman.service
+  if [ "$WIREGUARD_SUPPORT" = "yes" ]; then
+    enable_service connman-vpn.service
+  fi
 }
--- a/packages/network/connman/system.d/connman-vpn.service
+++ b/packages/network/connman/system.d/connman-vpn.service
@ -0,0 +1,14 @@
+[Unit]
+Description=ConnMan VPN service
+
+[Service]
+Type=dbus
+BusName=net.connman.vpn
+ExecStart=/usr/sbin/connman-vpnd -n
+StandardOutput=null
+CapabilityBoundingSet=CAP_KILL CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID
+ProtectHome=read-only
+ProtectSystem=full
+
+[Install]
+WantedBy=multi-user.target
--- a/packages/network/libmnl/package.mk
+++ b/packages/network/libmnl/package.mk
@ -9,5 +9,3 @@ PKG_SITE="http://netfilter.org/projects/libmnl"
 PKG_URL="http://netfilter.org/projects/libmnl/files/$PKG_NAME-$PKG_VERSION.tar.bz2"
 PKG_DEPENDS_TARGET="toolchain"
 PKG_LONGDESC="A minimalistic user-space library oriented to Netlink developers."
-
-PKG_CONFIGURE_OPTS_TARGET="--disable-shared --enable-static"
--- a/packages/network/wireguard-linux-compat/modules-load.d/wireguard.conf
+++ b/packages/network/wireguard-linux-compat/modules-load.d/wireguard.conf
@ -0,0 +1 @@
+wireguard
--- a/packages/network/wireguard-linux-compat/package.mk
+++ b/packages/network/wireguard-linux-compat/package.mk
@ -0,0 +1,27 @@
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (C) 2019-present Team LibreELEC (https://libreelec.tv)
+
+PKG_NAME="wireguard-linux-compat"
+PKG_VERSION="v0.0.20200121"
+PKG_SHA256="509a26a28ac1e96cf15d9a457a4143c43d4455eee877fdef20ebf11cbfd012b6"
+PKG_LICENSE="GPLv2"
+PKG_SITE="https://www.wireguard.com"
+PKG_URL="https://git.zx2c4.com/wireguard-linux-compat/snapshot/wireguard-linux-compat-$PKG_VERSION.tar.xz"
+PKG_DEPENDS_TARGET="toolchain linux libmnl"
+PKG_NEED_UNPACK="$LINUX_DEPENDS"
+PKG_LONGDESC="WireGuard VPN kernel module"
+PKG_TOOLCHAIN="manual"
+PKG_IS_KERNEL_PKG="yes"
+
+pre_make_target() {
+  unset LDFLAGS
+}
+
+make_target() {
+  kernel_make KERNELDIR=$(kernel_path) -C src/ module
+}
+
+makeinstall_target() {
+  mkdir -p $INSTALL/$(get_full_module_dir)/$PKG_NAME
+    cp src/*.ko $INSTALL/$(get_full_module_dir)/$PKG_NAME
+}
--- a/packages/network/wireguard-tools/config/system.d/wireguard.service.sample
+++ b/packages/network/wireguard-tools/config/system.d/wireguard.service.sample
@ -0,0 +1,13 @@
+[Unit]
+Description=WireGuard VPN Service
+After=network-online.target nss-lookup.target connman-vpn.service
+Wants=network-online.target nss-lookup.target connman-vpn.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/bin/connmanctl connect vpn_service_name_goes_here
+ExecStop=/usr/bin/connmanctl disconnect vpn_service_name_goes_here
+
+[Install]
+WantedBy=multi-user.target
--- a/packages/network/wireguard-tools/config/wireguard/wireguard.config.sample
+++ b/packages/network/wireguard-tools/config/wireguard/wireguard.config.sample
@ -0,0 +1,14 @@
+[provider_wireguard]
+Type = WireGuard
+Name = WireGuard VPN Tunnel
+Host = 3.2.5.6
+Domain = my.home.network
+WireGuard.Address = 10.2.0.2/24
+WireGuard.ListenPort = 51820
+WireGuard.PrivateKey = qKIj010hDdWSjQQyVCnEgthLXusBgm3I6HWrJUaJymc=
+WireGuard.PublicKey = zzqUfWGIil6QxrAGz77HE5BGUEdD2PgHYnCg3CDKagE=
+WireGuard.PresharedKey = DfEYeVs04HS9XhKGM4/ZXHG3Qc4MFK2AJd8XouYDbRQ=
+WireGuard.DNS = 8.8.8.8, 1.1.1.1
+WireGuard.AllowedIPs = 0.0.0.0/0
+WireGuard.EndpointPort = 51820
+WireGuard.PersistentKeepalive = 25
--- a/packages/network/wireguard-tools/package.mk
+++ b/packages/network/wireguard-tools/package.mk
@ -0,0 +1,31 @@
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (C) 2019-present Team LibreELEC (https://libreelec.tv)
+
+PKG_NAME="wireguard-tools"
+PKG_VERSION="v1.0.20200121"
+PKG_SHA256="e7aa8985dfeb495eff4b90b1817ea6c44f59ed124bac9fc85f6ba78173beef29"
+PKG_LICENSE="GPLv2"
+PKG_SITE="https://www.wireguard.com"
+PKG_URL="https://git.zx2c4.com/wireguard-tools/snapshot/wireguard-tools-$PKG_VERSION.tar.xz"
+PKG_DEPENDS_TARGET="toolchain linux libmnl"
+PKG_NEED_UNPACK="$LINUX_DEPENDS"
+PKG_LONGDESC="WireGuard VPN userspace tools"
+PKG_TOOLCHAIN="manual"
+PKG_IS_KERNEL_PKG="yes"
+
+pre_make_target() {
+  unset LDFLAGS
+}
+
+make_target() {
+  kernel_make KERNELDIR=$(kernel_path) -C src/ wg
+}
+
+makeinstall_target() {
+  mkdir -p $INSTALL/usr/bin
+    cp $PKG_DIR/scripts/wg-keygen $INSTALL/usr/bin
+    cp $PKG_BUILD/src/wg $INSTALL/usr/bin
+
+  mkdir -p $INSTALL/usr
+    cp -R $PKG_DIR/config $INSTALL/usr
+}
--- a/packages/network/wireguard-tools/scripts/wg-keygen
+++ b/packages/network/wireguard-tools/scripts/wg-keygen
@ -0,0 +1,34 @@
+#!/bin/sh
+
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (C) 2019-present Team LibreELEC (https://libreelec.tv)
+
+if [ -x /usr/bin/wg ]; then
+
+  umask 077
+  mkdir -p /storage/.cache/wireguard
+
+  if [ ! -f /storage/.cache/wireguard/privatekey ]; then
+    wg genkey > /storage/.cache/wireguard/privatekey
+    echo "created /storage/.cache/wireguard/privatekey"
+  else
+    echo "error, /storage/.cache/wireguard/privatekey already exists"
+  fi
+
+  if [ ! -f /storage/.cache/wireguard/publickey ]; then
+    wg pubkey < /storage/.cache/wireguard/privatekey > /storage/.cache/wireguard/publickey
+    echo "created /storage/.cache/wireguard/publickey"
+  else
+    echo "error, /storage/.cache/wireguard/publickey already exists"
+  fi
+
+  if [ ! -f /storage/.cache/wireguard/preshared ]; then
+    wg genpsk > /storage/.cache/wireguard/preshared
+    echo "created /storage/.cache/wireguard/preshared"
+  else
+    echo "error, /storage/.cache/wireguard/preshared already exists"
+  fi
+
+fi
+
+exit
--- a/packages/network/wireguard-tools/tmpfiles.d/z_03_wireguard.conf
+++ b/packages/network/wireguard-tools/tmpfiles.d/z_03_wireguard.conf
@ -0,0 +1,4 @@
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (C) 2019-present Team LibreELEC (https://libreelec.tv)
+
+d    /storage/.cache/wireguard   0755 root root - -
--- a/packages/virtual/network/package.mk
+++ b/packages/virtual/network/package.mk
@ -22,6 +22,10 @@ if [ "$OPENVPN_SUPPORT" = "yes" ]; then
  PKG_DEPENDS_TARGET="$PKG_DEPENDS_TARGET openvpn"
 fi

+if [ "$WIREGUARD_SUPPORT" = "yes" ]; then
+  PKG_DEPENDS_TARGET="$PKG_DEPENDS_TARGET wireguard-tools wireguard-linux-compat"
+fi
+
 # nss needed by inputstream.adaptive, chromium etc.
 if [ "$TARGET_ARCH" = "x86_64" ] || [ "$TARGET_ARCH" = "arm" ]; then
  PKG_DEPENDS_TARGET="$PKG_DEPENDS_TARGET nss"
--- a/projects/Allwinner/linux/linux.aarch64.conf
+++ b/projects/Allwinner/linux/linux.aarch64.conf
@ -817,7 +817,7 @@ CONFIG_NET_IP_TUNNEL=m
 # CONFIG_SYN_COOKIES is not set
 # CONFIG_NET_IPVTI is not set
 CONFIG_NET_UDP_TUNNEL=m
-# CONFIG_NET_FOU is not set
+CONFIG_NET_FOU=m
 # CONFIG_NET_FOU_IP_TUNNELS is not set
 # CONFIG_INET_AH is not set
 CONFIG_INET_ESP=y
@ -846,6 +846,7 @@ CONFIG_IPV6_SIT=m
 # CONFIG_IPV6_SIT_6RD is not set
 CONFIG_IPV6_NDISC_NODETYPE=y
 # CONFIG_IPV6_TUNNEL is not set
+CONFIG_IPV6_FOU=m
 # CONFIG_IPV6_MULTIPLE_TABLES is not set
 # CONFIG_IPV6_MROUTE is not set
 # CONFIG_IPV6_SEG6_LWTUNNEL is not set
--- a/projects/Allwinner/linux/linux.arm.conf
+++ b/projects/Allwinner/linux/linux.arm.conf
@ -826,7 +826,7 @@ CONFIG_IP_MROUTE=y
 # CONFIG_SYN_COOKIES is not set
 # CONFIG_NET_IPVTI is not set
 CONFIG_NET_UDP_TUNNEL=m
-# CONFIG_NET_FOU is not set
+CONFIG_NET_FOU=m
 # CONFIG_NET_FOU_IP_TUNNELS is not set
 # CONFIG_INET_AH is not set
 CONFIG_INET_ESP=m
@ -851,6 +851,7 @@ CONFIG_IPV6_SIT=m
 # CONFIG_IPV6_SIT_6RD is not set
 CONFIG_IPV6_NDISC_NODETYPE=y
 # CONFIG_IPV6_TUNNEL is not set
+CONFIG_IPV6_FOU=m
 # CONFIG_IPV6_MULTIPLE_TABLES is not set
 # CONFIG_IPV6_MROUTE is not set
 # CONFIG_IPV6_SEG6_LWTUNNEL is not set
--- a/projects/Generic/linux/linux.x86_64.conf
+++ b/projects/Generic/linux/linux.x86_64.conf
@ -903,7 +903,12 @@ CONFIG_UNIX=y
 CONFIG_UNIX_SCM=y
 # CONFIG_UNIX_DIAG is not set
 # CONFIG_TLS is not set
+CONFIG_XFRM=y
 # CONFIG_XFRM_USER is not set
+# CONFIG_XFRM_INTERFACE is not set
+# CONFIG_XFRM_SUB_POLICY is not set
+# CONFIG_XFRM_MIGRATE is not set
+# CONFIG_XFRM_STATISTICS is not set
 # CONFIG_NET_KEY is not set
 # CONFIG_XDP_SOCKETS is not set
 CONFIG_INET=y
@ -927,7 +932,8 @@ CONFIG_IP_MROUTE=y
 # CONFIG_IP_PIMSM_V2 is not set
 # CONFIG_SYN_COOKIES is not set
 # CONFIG_NET_IPVTI is not set
-# CONFIG_NET_FOU is not set
+CONFIG_NET_UDP_TUNNEL=m
+CONFIG_NET_FOU=m
 # CONFIG_NET_FOU_IP_TUNNELS is not set
 # CONFIG_INET_AH is not set
 # CONFIG_INET_ESP is not set
@ -968,6 +974,7 @@ CONFIG_IPV6_SIT=m
 # CONFIG_IPV6_SIT_6RD is not set
 CONFIG_IPV6_NDISC_NODETYPE=y
 # CONFIG_IPV6_TUNNEL is not set
+CONFIG_IPV6_FOU=m
 # CONFIG_IPV6_MULTIPLE_TABLES is not set
 # CONFIG_IPV6_MROUTE is not set
 # CONFIG_IPV6_SEG6_LWTUNNEL is not set
@ -1086,6 +1093,7 @@ CONFIG_NETFILTER_XT_MATCH_IPRANGE=m
 # CONFIG_NETFILTER_XT_MATCH_NFACCT is not set
 # CONFIG_NETFILTER_XT_MATCH_OSF is not set
 CONFIG_NETFILTER_XT_MATCH_OWNER=m
+# CONFIG_NETFILTER_XT_MATCH_POLICY is not set
 # CONFIG_NETFILTER_XT_MATCH_PHYSDEV is not set
 # CONFIG_NETFILTER_XT_MATCH_PKTTYPE is not set
 # CONFIG_NETFILTER_XT_MATCH_QUOTA is not set
--- a/projects/RPi/devices/RPi/linux/linux.arm.conf
+++ b/projects/RPi/devices/RPi/linux/linux.arm.conf
@ -690,7 +690,12 @@ CONFIG_UNIX=y
 CONFIG_UNIX_SCM=y
 # CONFIG_UNIX_DIAG is not set
 # CONFIG_TLS is not set
+CONFIG_XFRM=y
 # CONFIG_XFRM_USER is not set
+# CONFIG_XFRM_INTERFACE is not set
+# CONFIG_XFRM_SUB_POLICY is not set
+# CONFIG_XFRM_MIGRATE is not set
+# CONFIG_XFRM_STATISTICS is not set
 # CONFIG_NET_KEY is not set
 # CONFIG_XDP_SOCKETS is not set
 CONFIG_INET=y
@ -714,7 +719,8 @@ CONFIG_IP_MROUTE=y
 # CONFIG_IP_PIMSM_V2 is not set
 # CONFIG_SYN_COOKIES is not set
 # CONFIG_NET_IPVTI is not set
-# CONFIG_NET_FOU is not set
+CONFIG_NET_UDP_TUNNEL=m
+CONFIG_NET_FOU=m
 # CONFIG_NET_FOU_IP_TUNNELS is not set
 # CONFIG_INET_AH is not set
 # CONFIG_INET_ESP is not set
@ -755,6 +761,7 @@ CONFIG_IPV6_SIT=m
 # CONFIG_IPV6_SIT_6RD is not set
 CONFIG_IPV6_NDISC_NODETYPE=y
 # CONFIG_IPV6_TUNNEL is not set
+CONFIG_IPV6_FOU=m
 # CONFIG_IPV6_MULTIPLE_TABLES is not set
 # CONFIG_IPV6_MROUTE is not set
 # CONFIG_IPV6_SEG6_LWTUNNEL is not set
@ -872,6 +879,7 @@ CONFIG_NETFILTER_XT_MATCH_IPRANGE=m
 # CONFIG_NETFILTER_XT_MATCH_NFACCT is not set
 # CONFIG_NETFILTER_XT_MATCH_OSF is not set
 CONFIG_NETFILTER_XT_MATCH_OWNER=m
+# CONFIG_NETFILTER_XT_MATCH_POLICY is not set
 # CONFIG_NETFILTER_XT_MATCH_PHYSDEV is not set
 # CONFIG_NETFILTER_XT_MATCH_PKTTYPE is not set
 # CONFIG_NETFILTER_XT_MATCH_QUOTA is not set
--- a/projects/RPi/devices/RPi2/linux/linux.arm.conf
+++ b/projects/RPi/devices/RPi2/linux/linux.arm.conf
@ -805,7 +805,12 @@ CONFIG_UNIX=y
 CONFIG_UNIX_SCM=y
 # CONFIG_UNIX_DIAG is not set
 # CONFIG_TLS is not set
+CONFIG_XFRM=y
 # CONFIG_XFRM_USER is not set
+# CONFIG_XFRM_INTERFACE is not set
+# CONFIG_XFRM_SUB_POLICY is not set
+# CONFIG_XFRM_MIGRATE is not set
+# CONFIG_XFRM_STATISTICS is not set
 # CONFIG_NET_KEY is not set
 # CONFIG_XDP_SOCKETS is not set
 CONFIG_INET=y
@ -829,7 +834,8 @@ CONFIG_IP_MROUTE=y
 # CONFIG_IP_PIMSM_V2 is not set
 # CONFIG_SYN_COOKIES is not set
 # CONFIG_NET_IPVTI is not set
-# CONFIG_NET_FOU is not set
+CONFIG_NET_UDP_TUNNEL=m
+CONFIG_NET_FOU=m
 # CONFIG_NET_FOU_IP_TUNNELS is not set
 # CONFIG_INET_AH is not set
 # CONFIG_INET_ESP is not set
@ -870,6 +876,7 @@ CONFIG_IPV6_SIT=m
 # CONFIG_IPV6_SIT_6RD is not set
 CONFIG_IPV6_NDISC_NODETYPE=y
 # CONFIG_IPV6_TUNNEL is not set
+CONFIG_IPV6_FOU=m
 # CONFIG_IPV6_MULTIPLE_TABLES is not set
 # CONFIG_IPV6_MROUTE is not set
 # CONFIG_IPV6_SEG6_LWTUNNEL is not set
@ -987,6 +994,7 @@ CONFIG_NETFILTER_XT_MATCH_IPRANGE=m
 # CONFIG_NETFILTER_XT_MATCH_NFACCT is not set
 # CONFIG_NETFILTER_XT_MATCH_OSF is not set
 CONFIG_NETFILTER_XT_MATCH_OWNER=m
+# CONFIG_NETFILTER_XT_MATCH_POLICY is not set
 # CONFIG_NETFILTER_XT_MATCH_PHYSDEV is not set
 # CONFIG_NETFILTER_XT_MATCH_PKTTYPE is not set
 # CONFIG_NETFILTER_XT_MATCH_QUOTA is not set
--- a/projects/RPi/devices/RPi4/linux/linux.arm.conf
+++ b/projects/RPi/devices/RPi4/linux/linux.arm.conf
@ -819,7 +819,12 @@ CONFIG_UNIX=y
 CONFIG_UNIX_SCM=y
 # CONFIG_UNIX_DIAG is not set
 # CONFIG_TLS is not set
+CONFIG_XFRM=y
 # CONFIG_XFRM_USER is not set
+# CONFIG_XFRM_INTERFACE is not set
+# CONFIG_XFRM_SUB_POLICY is not set
+# CONFIG_XFRM_MIGRATE is not set
+# CONFIG_XFRM_STATISTICS is not set
 # CONFIG_NET_KEY is not set
 # CONFIG_XDP_SOCKETS is not set
 CONFIG_INET=y
@ -843,7 +848,8 @@ CONFIG_IP_MROUTE=y
 # CONFIG_IP_PIMSM_V2 is not set
 # CONFIG_SYN_COOKIES is not set
 # CONFIG_NET_IPVTI is not set
-# CONFIG_NET_FOU is not set
+CONFIG_NET_UDP_TUNNEL=m
+CONFIG_NET_FOU=m
 # CONFIG_NET_FOU_IP_TUNNELS is not set
 # CONFIG_INET_AH is not set
 # CONFIG_INET_ESP is not set
@ -884,6 +890,7 @@ CONFIG_IPV6_SIT=m
 # CONFIG_IPV6_SIT_6RD is not set
 CONFIG_IPV6_NDISC_NODETYPE=y
 # CONFIG_IPV6_TUNNEL is not set
+CONFIG_IPV6_FOU=m
 # CONFIG_IPV6_MULTIPLE_TABLES is not set
 # CONFIG_IPV6_MROUTE is not set
 # CONFIG_IPV6_SEG6_LWTUNNEL is not set
@ -1001,6 +1008,7 @@ CONFIG_NETFILTER_XT_MATCH_IPRANGE=m
 # CONFIG_NETFILTER_XT_MATCH_NFACCT is not set
 # CONFIG_NETFILTER_XT_MATCH_OSF is not set
 CONFIG_NETFILTER_XT_MATCH_OWNER=m
+# CONFIG_NETFILTER_XT_MATCH_POLICY is not set
 # CONFIG_NETFILTER_XT_MATCH_PHYSDEV is not set
 # CONFIG_NETFILTER_XT_MATCH_PKTTYPE is not set
 # CONFIG_NETFILTER_XT_MATCH_QUOTA is not set
--- a/projects/Rockchip/devices/RK3288/linux/default/linux.arm.conf
+++ b/projects/Rockchip/devices/RK3288/linux/default/linux.arm.conf
@ -800,7 +800,7 @@ CONFIG_NET_IP_TUNNEL=y
 # CONFIG_SYN_COOKIES is not set
 # CONFIG_NET_IPVTI is not set
 CONFIG_NET_UDP_TUNNEL=m
-# CONFIG_NET_FOU is not set
+CONFIG_NET_FOU=m
 # CONFIG_NET_FOU_IP_TUNNELS is not set
 # CONFIG_INET_AH is not set
 # CONFIG_INET_ESP is not set
@ -831,6 +831,7 @@ CONFIG_IPV6_SIT=y
 # CONFIG_IPV6_SIT_6RD is not set
 CONFIG_IPV6_NDISC_NODETYPE=y
 CONFIG_IPV6_TUNNEL=m
+CONFIG_IPV6_FOU=m
 CONFIG_IPV6_MULTIPLE_TABLES=y
 # CONFIG_IPV6_SUBTREES is not set
 # CONFIG_IPV6_MROUTE is not set
--- a/projects/Rockchip/devices/RK3328/linux/default/linux.aarch64.conf
+++ b/projects/Rockchip/devices/RK3328/linux/default/linux.aarch64.conf
@ -809,7 +809,12 @@ CONFIG_UNIX=y
 CONFIG_UNIX_SCM=y
 # CONFIG_UNIX_DIAG is not set
 # CONFIG_TLS is not set
+CONFIG_XFRM=y
 # CONFIG_XFRM_USER is not set
+# CONFIG_XFRM_INTERFACE is not set
+# CONFIG_XFRM_SUB_POLICY is not set
+# CONFIG_XFRM_MIGRATE is not set
+# CONFIG_XFRM_STATISTICS is not set
 # CONFIG_NET_KEY is not set
 # CONFIG_XDP_SOCKETS is not set
 CONFIG_INET=y
@ -826,7 +831,7 @@ CONFIG_NET_IP_TUNNEL=m
 # CONFIG_SYN_COOKIES is not set
 # CONFIG_NET_IPVTI is not set
 CONFIG_NET_UDP_TUNNEL=m
-# CONFIG_NET_FOU is not set
+CONFIG_NET_FOU=m
 # CONFIG_NET_FOU_IP_TUNNELS is not set
 # CONFIG_INET_AH is not set
 # CONFIG_INET_ESP is not set
@ -854,6 +859,7 @@ CONFIG_IPV6_SIT=m
 # CONFIG_IPV6_SIT_6RD is not set
 CONFIG_IPV6_NDISC_NODETYPE=y
 # CONFIG_IPV6_TUNNEL is not set
+CONFIG_IPV6_FOU=m
 # CONFIG_IPV6_MULTIPLE_TABLES is not set
 # CONFIG_IPV6_MROUTE is not set
 # CONFIG_IPV6_SEG6_LWTUNNEL is not set
@ -968,6 +974,7 @@ CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
 # CONFIG_NETFILTER_XT_MATCH_NFACCT is not set
 # CONFIG_NETFILTER_XT_MATCH_OSF is not set
 # CONFIG_NETFILTER_XT_MATCH_OWNER is not set
+# CONFIG_NETFILTER_XT_MATCH_POLICY is not set
 # CONFIG_NETFILTER_XT_MATCH_PHYSDEV is not set
 # CONFIG_NETFILTER_XT_MATCH_PKTTYPE is not set
 # CONFIG_NETFILTER_XT_MATCH_QUOTA is not set
--- a/projects/Rockchip/devices/RK3399/linux/default/linux.aarch64.conf
+++ b/projects/Rockchip/devices/RK3399/linux/default/linux.aarch64.conf
@ -809,7 +809,12 @@ CONFIG_UNIX=y
 CONFIG_UNIX_SCM=y
 # CONFIG_UNIX_DIAG is not set
 # CONFIG_TLS is not set
+CONFIG_XFRM=y
 # CONFIG_XFRM_USER is not set
+# CONFIG_XFRM_INTERFACE is not set
+# CONFIG_XFRM_SUB_POLICY is not set
+# CONFIG_XFRM_MIGRATE is not set
+# CONFIG_XFRM_STATISTICS is not set
 # CONFIG_NET_KEY is not set
 # CONFIG_XDP_SOCKETS is not set
 CONFIG_INET=y
@ -826,7 +831,7 @@ CONFIG_NET_IP_TUNNEL=m
 # CONFIG_SYN_COOKIES is not set
 # CONFIG_NET_IPVTI is not set
 CONFIG_NET_UDP_TUNNEL=m
-# CONFIG_NET_FOU is not set
+CONFIG_NET_FOU=m
 # CONFIG_NET_FOU_IP_TUNNELS is not set
 # CONFIG_INET_AH is not set
 # CONFIG_INET_ESP is not set
@ -854,6 +859,7 @@ CONFIG_IPV6_SIT=m
 # CONFIG_IPV6_SIT_6RD is not set
 CONFIG_IPV6_NDISC_NODETYPE=y
 # CONFIG_IPV6_TUNNEL is not set
+CONFIG_IPV6_FOU=m
 # CONFIG_IPV6_MULTIPLE_TABLES is not set
 # CONFIG_IPV6_MROUTE is not set
 # CONFIG_IPV6_SEG6_LWTUNNEL is not set
@ -968,6 +974,7 @@ CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
 # CONFIG_NETFILTER_XT_MATCH_NFACCT is not set
 # CONFIG_NETFILTER_XT_MATCH_OSF is not set
 # CONFIG_NETFILTER_XT_MATCH_OWNER is not set
+# CONFIG_NETFILTER_XT_MATCH_POLICY is not set
 # CONFIG_NETFILTER_XT_MATCH_PHYSDEV is not set
 # CONFIG_NETFILTER_XT_MATCH_PKTTYPE is not set
 # CONFIG_NETFILTER_XT_MATCH_QUOTA is not set