No need to iterate to look up a table entry.

find_phy() did not match OpenWrt's logic for PHY names anymore, and
could not handle PHYs that don't match the 'phyX' naming scheme. Instead
of trying to add more complex logic to our own code, simply do what
OpenWrt does and use iwinfo to resolve UCI sections to PHY names.

Stop and start the gluon-arp-limiter service before the network is
brought down when commencing update.

Start the service after the network is brought back up when aborting.

Signed-off-by: David Bauer <mail@david-bauer.net>

Signed-off-by: David Bauer <mail@david-bauer.net>

Signed-off-by: Magnus Frühling <skorpy@frankfurt.ccc.de>

The Gluon Tunneldigger protocol handler hasn't received the care and
attention a core package, especially a VPN protocol, should.

Due to the works in #2102 it's no longer required to maintain
VPN handlers in the Gluon Core and they can be instead included via a
package feed.

Users who wish to continue using a supported core Gluon package are
encouraged to take a look at fastd in conjunction with it's null@l2tp method.
It offers roughly the same performance (it's using the same principle
of operation) and supports connections via IPv6 as a bonus.

In general it should be possible to change the VPN used protocol
asynchronously with a normal update.

If Gluon users wish to continue using tunneldigger the recomendation
is to participate in the development of tunneldigger inside our
community-packages.

This package allows to easily select the correct libustream implementation
without all communities having the need to manually change their included
packages.

Remove legacy migrations. These predate the currently supported upgrade path,
therefore we no longer need them.

Signed-off-by: Magnus Frühling <skorpy@frankfurt.ccc.de>

Signed-off-by: David Bauer <mail@david-bauer.net>

Use a delete_call with a boolean parameter function instead of manually
iterating over all devices.

Link: https://github.com/freifunk-gluon/gluon/pull/3102



Signed-off-by: David Bauer <mail@david-bauer.net>

This preserves configuration of MAC-addresses for each interface in case
OpenWrt sets them using netifd.

This is done by preserving all device-configuration which does not
define a bridge or the MAC-address of a bridge.

Closes #3100

Signed-off-by: David Bauer <mail@david-bauer.net>

OpenWrt now uses the new mbedTLS implementation for hostapd as well as
wpa_supplicant.

In order to keep as close to upstream as possible, use these
derivations.

Signed-off-by: David Bauer <mail@david-bauer.net>

Use CAKE for shaping ingress as well as egress bandwidth shaping.

CAKE allows to better shape egress as well as ingress bandwidth. It not
only performs bandwidth shaping but also flow-queueing.

This in conjunction with the batadv flow dissector allows us to utilize
CAKE for all mesh-implementations currently supported in Gluon.

Signed-off-by: David Bauer <mail@david-bauer.net>

Add GLuon meta-package to include on devices that support SQM.

This package provides sqm-scripts as a dependency. SUpporting mesh-vpn
protocols can then conditionally enable SQM on the VPN link.

Signed-off-by: David Bauer <mail@david-bauer.net>

This code was added way back in 2017. We don't support updates from
those old versions, so we can remove it.

Signed-off-by: David Bauer <mail@david-bauer.net>

In case no interface role was selected for a given interface,
gluon-reconfigure currently fails with

Configuring: 021-interface-roles
/usr/bin/lua: /usr/lib/lua/gluon/util.lua:25: bad argument #1 to 'pairs' (table expected, got nil)
stack traceback:
	[C]: in function '?'
	/usr/lib/lua/simple-uci.lua:22: in function 'foreach'
	./021-interface-roles:47: in main chunk
	[C]: ?

Check we actually have a role set before accessing the table.

Signed-off-by: David Bauer <mail@david-bauer.net>

Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>

google-lighthouse:
Warning: Consider avoiding viewport values that prevent users from resizing documents.

Rule ID: meta-viewport
Accessibility:
Ruleset: axe-core 4.4
User Impact: Critical
Guidelines: WCAG 2.1 Best Practice, WCAG 2.0 Best Practice

The vpn-core package does not utilize simple-tc anymore.
This is now up to the VPN implementations.

Signed-off-by: David Bauer <mail@david-bauer.net>

Remove old migrations which are due to be removed.

Signed-off-by: David Bauer <mail@david-bauer.net>

Signed-off-by: David Bauer <mail@david-bauer.net>

Allocation of the router structure for newly detected router
advertisements was done using malloc and selectively clearing some of
the structure fields. However the redirect boolean was never set to 0,
which means that during update_redirect, we would depend on the random
initialization value of the structure.

This means that sometimes ebtables-tiny wouldn't add the correct rules
for the advertised routes.

Also known in Germany as Gigacube CAT20

The lua-bit32 library is pulled in by luaposix already, so we can drop
luabitops.

The dependency is unused.

Enterasys WS-AP3715i is a dualband wireless-N access point.
It comes in a similar casing as the WS-AP3825i, however the hardware is
fundamentally different from its bigger cousin.

Signed-off-by: David Bauer <mail@david-bauer.net>

Rewrite the gluon-wan-dnsmasq initfile to use procd. This allows for
configuring restart handling by procd in case of a crash.

While at it, disable the caching feature optionally used for the regular
dnsmasq on the wan dnsmasq. This daemon is only for redirecting DNS
requests to use local network resolvers, not introducing caching.

Signed-off-by: David Bauer <mail@david-bauer.net>

The tunneldigger init script has been migrated to procd, so there is no
PID file anymore. Remove the obsolete check altogether - it shouldn't
be needed anymore, as procd will take care of crashes of tunneldigger by
itself. This fixes the watchdog resetting tunneldigger every time it runs.

Closes #2977

Disallow crawlers to crawl and index page.
Crawling causes  traffic and high load.
Indexation max cause unintended attention, e.g. spam, ..

Reference:
https://developers.google.com/search/docs/crawling-indexing/robots-meta-tag

Use DNS servers received from the cellular provider for the WAN dnsmasq
instance.

This fixes resolving VPN endpoint DNS requests when using only cellular
uplink.

Signed-off-by: David Bauer <mail@david-bauer.net>

Don't use the DNS server received from the cellular provider. The
provider DNS server shall only be used for the WAN dnsmasq resolver
instance.

Signed-off-by: David Bauer <mail@david-bauer.net>