This preserves configuration of MAC-addresses for each interface in case
OpenWrt sets them using netifd.

This is done by preserving all device-configuration which does not
define a bridge or the MAC-address of a bridge.

Closes #3100

Signed-off-by: David Bauer <mail@david-bauer.net>

OpenWrt now uses the new mbedTLS implementation for hostapd as well as
wpa_supplicant.

In order to keep as close to upstream as possible, use these
derivations.

Signed-off-by: David Bauer <mail@david-bauer.net>

Use CAKE for shaping ingress as well as egress bandwidth shaping.

CAKE allows to better shape egress as well as ingress bandwidth. It not
only performs bandwidth shaping but also flow-queueing.

This in conjunction with the batadv flow dissector allows us to utilize
CAKE for all mesh-implementations currently supported in Gluon.

Signed-off-by: David Bauer <mail@david-bauer.net>

Add GLuon meta-package to include on devices that support SQM.

This package provides sqm-scripts as a dependency. SUpporting mesh-vpn
protocols can then conditionally enable SQM on the VPN link.

Signed-off-by: David Bauer <mail@david-bauer.net>

This code was added way back in 2017. We don't support updates from
those old versions, so we can remove it.

Signed-off-by: David Bauer <mail@david-bauer.net>

In case no interface role was selected for a given interface,
gluon-reconfigure currently fails with

Configuring: 021-interface-roles
/usr/bin/lua: /usr/lib/lua/gluon/util.lua:25: bad argument #1 to 'pairs' (table expected, got nil)
stack traceback:
	[C]: in function '?'
	/usr/lib/lua/simple-uci.lua:22: in function 'foreach'
	./021-interface-roles:47: in main chunk
	[C]: ?

Check we actually have a role set before accessing the table.

Signed-off-by: David Bauer <mail@david-bauer.net>

Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>

google-lighthouse:
Warning: Consider avoiding viewport values that prevent users from resizing documents.

Rule ID: meta-viewport
Accessibility:
Ruleset: axe-core 4.4
User Impact: Critical
Guidelines: WCAG 2.1 Best Practice, WCAG 2.0 Best Practice

The vpn-core package does not utilize simple-tc anymore.
This is now up to the VPN implementations.

Signed-off-by: David Bauer <mail@david-bauer.net>

Remove old migrations which are due to be removed.

Signed-off-by: David Bauer <mail@david-bauer.net>

Signed-off-by: David Bauer <mail@david-bauer.net>

Allocation of the router structure for newly detected router
advertisements was done using malloc and selectively clearing some of
the structure fields. However the redirect boolean was never set to 0,
which means that during update_redirect, we would depend on the random
initialization value of the structure.

This means that sometimes ebtables-tiny wouldn't add the correct rules
for the advertised routes.

Also known in Germany as Gigacube CAT20

The lua-bit32 library is pulled in by luaposix already, so we can drop
luabitops.

The dependency is unused.

Enterasys WS-AP3715i is a dualband wireless-N access point.
It comes in a similar casing as the WS-AP3825i, however the hardware is
fundamentally different from its bigger cousin.

Signed-off-by: David Bauer <mail@david-bauer.net>

Rewrite the gluon-wan-dnsmasq initfile to use procd. This allows for
configuring restart handling by procd in case of a crash.

While at it, disable the caching feature optionally used for the regular
dnsmasq on the wan dnsmasq. This daemon is only for redirecting DNS
requests to use local network resolvers, not introducing caching.

Signed-off-by: David Bauer <mail@david-bauer.net>

The tunneldigger init script has been migrated to procd, so there is no
PID file anymore. Remove the obsolete check altogether - it shouldn't
be needed anymore, as procd will take care of crashes of tunneldigger by
itself. This fixes the watchdog resetting tunneldigger every time it runs.

Closes #2977

Disallow crawlers to crawl and index page.
Crawling causes  traffic and high load.
Indexation max cause unintended attention, e.g. spam, ..

Reference:
https://developers.google.com/search/docs/crawling-indexing/robots-meta-tag

Use DNS servers received from the cellular provider for the WAN dnsmasq
instance.

This fixes resolving VPN endpoint DNS requests when using only cellular
uplink.

Signed-off-by: David Bauer <mail@david-bauer.net>

Don't use the DNS server received from the cellular provider. The
provider DNS server shall only be used for the WAN dnsmasq resolver
instance.

Signed-off-by: David Bauer <mail@david-bauer.net>

This reverts commit 97efc8ab. (#2580)

Since the commit was openend the device was moved from ath79-generic to ath79-tiny ([4b5bd15](https://github.com/openwrt/openwrt/commit/4b5bd1509195bc8f19999ebe481b59356b5c3512)).

Therefore the commit breaks builds of the ath79-generic target (`unable to enable device 'ubnt_rocket-m'`).

It might be possible to add support for the ath79-tiny target, and with it the Rocket M2/M5 (XM), in the future.

Signed-off-by: Christoph Krapp <achterin@gmail.com>

- provides easier information of the currently active domain
- tested by patching a running node