package/gluon-alfred/files/usr/lib/autoupdater/abort.d/60gluon-alfred

 #!/bin/sh
 
+# shellcheck source=package/gluon-autoupdater/files/lib/gluon/autoupdater/lib.sh
 . /lib/gluon/autoupdater/lib.sh
 
-
 start_enabled alfred

package/gluon-alfred/files/usr/lib/autoupdater/download.d/40gluon-alfred

 #!/bin/sh
 
+# shellcheck source=package/gluon-autoupdater/files/lib/gluon/autoupdater/lib.sh
 . /lib/gluon/autoupdater/lib.sh
 
-
 stop alfred

package/gluon-authorized-keys/Makefile

 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=gluon-authorized-keys
-PKG_VERSION:=2
 
 include ../gluon.mk
 

package/gluon-autoupdater/Config.in

+if PACKAGE_gluon-autoupdater
+
+config GLUON_AUTOUPDATER_BRANCH
+	string "Autoupdater branch"
+	default ""
+
+config GLUON_AUTOUPDATER_ENABLED
+	bool "Enable autoupdater by default"
+
+endif

package/gluon-autoupdater/Makefile

 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=gluon-autoupdater
-PKG_VERSION:=4
 
-PKG_CONFIG_DEPENDS := CONFIG_GLUON_BRANCH
+PKG_CONFIG_DEPENDS := CONFIG_GLUON_AUTOUPDATER_BRANCH CONFIG_GLUON_AUTOUPDATER_ENABLED
 
 include ../gluon.mk
 
@@ -13,18 +12,18 @@ define Package/gluon-autoupdater
 endef
 
 define Package/gluon-autoupdater/config
-config GLUON_BRANCH
-	string "Gluon autoupdater branch"
-	depends on PACKAGE_gluon-autoupdater
-	default ""
+	source "$(SOURCE)/Config.in"
 endef
 
 define Package/gluon-autoupdater/install
 	$(Gluon/Build/Install)
 
-ifneq ($(CONFIG_GLUON_BRANCH),"")
 	$(INSTALL_DIR) $(1)/lib/gluon/autoupdater
-	echo '$(call qstrip,$(CONFIG_GLUON_BRANCH))' > $(1)/lib/gluon/autoupdater/default_branch
+  ifneq ($(CONFIG_GLUON_AUTOUPDATER_BRANCH),"")
+	echo '$(call qstrip,$(CONFIG_GLUON_AUTOUPDATER_BRANCH))' > $(1)/lib/gluon/autoupdater/default_branch
+  endif
+  ifneq ($(CONFIG_GLUON_AUTOUPDATER_ENABLED),)
+	touch $(1)/lib/gluon/autoupdater/default_enabled
   endif
 endef
 

package/gluon-autoupdater/check_site.lua

-need_string(in_site({'autoupdater', 'branch'}))
+local has_tls = (function()
+	local f = io.open((os.getenv('IPKG_INSTROOT') or '') .. '/lib/gluon/features/tls')
+	if f then
+		f:close()
+		return true
+	end
+	return false
+end)()
 
-need_table({'autoupdater', 'branches'}, function(branch)
+local branches = table_keys(need_table({'autoupdater', 'branches'}, function(branch)
 	need_alphanumeric_key(branch)
 
 	need_string(in_site(extend(branch, {'name'})))
-	need_string_array_match(extend(branch, {'mirrors'}), '^http://')
+	need_array(extend(branch, {'mirrors'}), function(mirror)
+		alternatives(function()
+			need_string_match(mirror, 'http://')
+		end, function()
+			need_string_match(mirror, 'https://')
+			need(mirror, function() return has_tls end, nil,
+				"use HTTPS only if the 'tls' feature is enabled")
+		end, function()
+			need_string_match(mirror, '^//')
+		end)
+	end)
+
+	local pubkeys = need_string_array_match(in_site(extend(branch, {'pubkeys'})), '^%x+$')
 	need_number(in_site(extend(branch, {'good_signatures'})))
-	need_string_array_match(in_site(extend(branch, {'pubkeys'})), '^%x+$')
+	need(in_site(extend(branch, {'good_signatures'})), function(good_signatures)
+		return good_signatures <= #pubkeys
+	end, nil, string.format('be less than or equal to the number of public keys (%d)', #pubkeys))
+
 	obsolete(in_site(extend(branch, {'probability'})), 'Use GLUON_PRIORITY in site.mk instead.')
-end)
+end))
+
+need_one_of(in_site({'autoupdater', 'branch'}), branches, false)
+
+-- Check GLUON_AUTOUPDATER_BRANCH
+local default_branch
+local f = io.open((os.getenv('IPKG_INSTROOT') or '') .. '/lib/gluon/autoupdater/default_branch')
+if f then
+	default_branch = f:read('*line')
+	f:close()
+end
+need_one_of(value('GLUON_AUTOUPDATER_BRANCH', default_branch), branches, false)

package/gluon-autoupdater/files/usr/lib/autoupdater/abort.d/90gluon-autoupdater

 #!/bin/sh
 
+# shellcheck source=package/gluon-autoupdater/files/lib/gluon/autoupdater/lib.sh
 . /lib/gluon/autoupdater/lib.sh
 
 
 start_enabled cron
-start_enabled haveged
+start_enabled urngd
 start_enabled micrond
 start_enabled sysntpd

package/gluon-autoupdater/files/usr/lib/autoupdater/download.d/10gluon-autoupdater

 #!/bin/sh
 
+# shellcheck source=package/gluon-autoupdater/files/lib/gluon/autoupdater/lib.sh
 . /lib/gluon/autoupdater/lib.sh
 
 
 stop cron
-stop haveged
+stop urngd
 stop micrond
 stop sysntpd

package/gluon-autoupdater/luasrc/lib/gluon/upgrade/500-autoupdater

@@ -2,34 +2,69 @@
 
 local site = require 'gluon.site'
 local uci = require('simple-uci').cursor()
+local unistd = require 'posix.unistd'
 
+local has_tls = unistd.access('/lib/gluon/features/tls') ~= nil
+local default_scheme = has_tls and 'https:' or 'http:'
+
+local min_branch
+
+local function mirror_urls(mirrors)
+	local ret = {}
+
+	for _, mirror in ipairs(mirrors) do
+		if string.match(mirror, '^//') ~= nil then
+			table.insert(ret, default_scheme .. mirror)
+		else
+			table.insert(ret, mirror)
+		end
+	end
+
+	return ret
+end
 
 for name, config in pairs(site.autoupdater.branches()) do
 	uci:delete('autoupdater', name)
 	uci:section('autoupdater', 'branch', name, {
 		name = config.name,
-		mirror = config.mirrors,
+		mirror = mirror_urls(config.mirrors),
 		good_signatures = config.good_signatures,
 		pubkey = config.pubkeys,
 	})
-end
 
-if not uci:get('autoupdater', 'settings') then
-	local enabled = false
-	local branch = site.autoupdater.branch()
+	if not min_branch or (name < min_branch) then
+		min_branch = name
+	end
+end
 
+local function default_branch()
 	local f = io.open('/lib/gluon/autoupdater/default_branch')
 	if f then
-		enabled = true
-		branch = f:read('*line')
+		local ret = f:read('*line')
 		f:close()
+		return ret
+	end
+
+	return site.autoupdater.branch(min_branch)
+end
+
+local enabled, branch
+if not uci:get('autoupdater', 'settings') then
+	enabled = unistd.access('/lib/gluon/autoupdater/default_enabled') ~= nil
+end
+
+local old_branch = uci:get('autoupdater', 'settings', 'branch')
+if not old_branch or not uci:get('autoupdater', old_branch) then
+	branch = default_branch()
+	if not branch then
+		enabled = false
+	end
 end
 
 uci:section('autoupdater', 'autoupdater', 'settings', {
 	enabled = enabled,
 	branch = branch,
 })
-end
 
 uci:set('autoupdater', 'settings', 'version_file', '/lib/gluon/release')
 

package/gluon-autoupdater/src/respondd.c

-/*
-  Copyright (c) 2016, Matthias Schiffer <mschiffer@universe-factory.net>
-  All rights reserved.
-
-  Redistribution and use in source and binary forms, with or without
-  modification, are permitted provided that the following conditions are met:
-
-    1. Redistributions of source code must retain the above copyright notice,
-       this list of conditions and the following disclaimer.
-    2. Redistributions in binary form must reproduce the above copyright notice,
-       this list of conditions and the following disclaimer in the documentation
-       and/or other materials provided with the distribution.
-
-  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-  AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-  DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-  DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-  SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-  CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-  OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-  OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-*/
+/* SPDX-FileCopyrightText: 2016, Matthias Schiffer <mschiffer@universe-factory.net> */
+/* SPDX-License-Identifier: BSD-2-Clause */
 
 
 #include <respondd.h>

package/gluon-client-bridge/Makefile

 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=gluon-client-bridge
-PKG_VERSION:=1
 
 include ../gluon.mk
 
 define Package/gluon-client-bridge
   TITLE:=Provides a bridge and a wireless interface for clients to connect to
-  DEPENDS:=+gluon-core +kmod-veth +@GLUON_SPECIALIZE_KERNEL:KERNEL_VETH
+  DEPENDS:=+gluon-core +kmod-veth
 endef
 
 $(eval $(call BuildPackageGluon,gluon-client-bridge))

package/gluon-client-bridge/check_site.lua

@@ -9,7 +9,13 @@ need_string_match(in_domain({'next_node', 'ip6'}), '^[%x:]+$', false)
 
 for _, config in ipairs({'wifi24', 'wifi5'}) do
 	if need_table({config, 'ap'}, nil, false) then
-		need_string_match(in_domain({config, 'ap', 'ssid'}), '^' .. ('.?'):rep(32) .. '$')
 		need_boolean({config, 'ap', 'disabled'}, false)
+		if need_boolean({config, 'ap', 'owe_transition_mode'}, false) then
+			need_string_match(in_domain({config, 'ap', 'ssid'}), '^' .. ('.?'):rep(32) .. '$')
+			need_string_match(in_domain({config, 'ap', 'owe_ssid'}), '^' .. ('.?'):rep(32) .. '$')
+		else
+			need_string_match(in_domain({config, 'ap', 'ssid'}), '^' .. ('.?'):rep(32) .. '$', false)
+			need_string_match(in_domain({config, 'ap', 'owe_ssid'}), '^' .. ('.?'):rep(32) .. '$', false)
+		end
 	end
 end

package/gluon-client-bridge/luasrc/lib/gluon/upgrade/300-gluon-client-bridge-network

@@ -6,26 +6,9 @@ local util = require 'gluon.util'
 local uci = require('simple-uci').cursor()
 
 
-local interfaces = uci:get('network', 'client', 'ifname') or {}
-
-if type(interfaces) == 'string' then
-	local ifname = interfaces
-	interfaces = {}
-	for iface in ifname:gmatch('%S+') do
-		util.add_to_set(interfaces, iface)
-	end
-end
-
-if sysconfig.lan_ifname and uci:get_bool('network', 'mesh_lan', 'disabled') then
-	for lanif in sysconfig.lan_ifname:gmatch('%S+') do
-		util.add_to_set(interfaces, lanif)
-	end
-end
-
+local interfaces = util.get_role_interfaces(uci, 'client', true)
 util.add_to_set(interfaces, 'local-port')
 
-
-uci:delete('network', 'client')
 uci:section('network', 'interface', 'client', {
 	type = 'bridge',
 	ifname = interfaces,
@@ -40,9 +23,6 @@ uci:section('network', 'interface', 'client', {
 
 uci:save('network')
 
--- TODO: remove this line and the next in 2019. Firewall zones have been renamed in 2017.
-uci:delete('firewall', 'client')
-
 uci:section('firewall', 'zone', 'drop', {
 	name = 'drop',
 	network = {'client'},
@@ -51,9 +31,9 @@ uci:section('firewall', 'zone', 'drop', {
 	forward = 'DROP',
 })
 
-local networks = uci:get_list('firewall', 'local_client', 'network')
+local networks = uci:get_list('firewall', 'loc_client', 'network')
 util.add_to_set(networks, 'local_node')
-uci:set_list('firewall', 'local_client', 'network', networks)
+uci:set_list('firewall', 'loc_client', 'network', networks)
 
 
 local dnsmasq = uci:get_first('dhcp', 'dnsmasq')
@@ -61,10 +41,6 @@ uci:set('dhcp', dnsmasq, 'boguspriv', false)
 uci:set('dhcp', dnsmasq, 'localise_queries', false)
 uci:set('dhcp', dnsmasq, 'rebind_protection', false)
 
--- TODO: remove this line and the next two in 2019 the zones were removed in 2017
-uci:delete('dhcp', 'client')
-uci:delete('firewall', 'local_node')
-
 uci:section('dhcp', 'dhcp', 'local_client', {
 	interface = 'client',
 	ignore = true,

package/gluon-client-bridge/luasrc/lib/gluon/upgrade/310-gluon-client-bridge-local-node

@@ -10,7 +10,6 @@ local uci = require('simple-uci').cursor()
 local next_node = site.next_node({})
 
 
-uci:delete('network', 'local_node_dev')
 uci:section('network', 'device', 'local_node_dev', {
 	type = 'veth',
 	name = 'local-node',
@@ -31,7 +30,6 @@ if next_node.ip6 then
 	ip6 = next_node.ip6 .. '/128'
 end
 
-uci:delete('network', 'local_node')
 uci:section('network', 'interface', 'local_node', {
 	ifname = 'local-node',
 	proto = 'static',

package/gluon-client-bridge/luasrc/lib/gluon/upgrade/320-gluon-client-bridge-wireless

 #!/usr/bin/lua
 
-local util = require 'gluon.util'
+local wireless = require 'gluon.wireless'
 
 local uci = require('simple-uci').cursor()
 
@@ -13,9 +13,7 @@ local function is_disabled(config, name)
 	return config.disabled(false)
 end
 
-util.foreach_radio(uci, function(radio, index, config)
-	local radio_name = radio['.name']
-
+local function configure_ap(radio, index, config, radio_name)
 	local name = 'client_' .. radio_name
 	local suffix = radio_name:match('^radio(%d+)$')
 
@@ -24,12 +22,9 @@ util.foreach_radio(uci, function(radio, index, config)
 
 	uci:delete('wireless', name)
 
-	if not ap() then
-		return
-	end
+	local macaddr = wireless.get_wlan_mac(uci, radio, index, 1)
 
-	local macaddr = util.get_wlan_mac(uci, radio, index, 1)
-	if not macaddr then
+	if not ap.ssid() or not macaddr then
 		return
 	end
 
@@ -42,6 +37,79 @@ util.foreach_radio(uci, function(radio, index, config)
 		ifname = suffix and 'client' .. suffix,
 		disabled = disabled or false,
 	})
+end
+
+local function configure_owe(radio, index, config, radio_name)
+	local name = 'owe_' .. radio_name
+	local suffix = radio_name:match('^radio(%d+)$')
+
+	local ap = config.ap
+
+	local disabled = is_disabled(ap, 'client_' .. radio_name)
+
+	uci:delete('wireless', name)
+
+	-- Don't configure OWE in case our device
+	-- can't do MFP, as it's mandatory for OWE.
+	if not wireless.device_supports_mfp(uci) then
+		return
+	end
+
+	local macaddr = wireless.get_wlan_mac(uci, radio, index, 3)
+
+	if not ap.owe_ssid() or not macaddr then
+		return
+	end
+
+	uci:section('wireless', 'wifi-iface', name, {
+		device = radio_name,
+		network = 'client',
+		mode = 'ap',
+		ssid = ap.owe_ssid(),
+		macaddr = macaddr,
+		ifname = suffix and 'owe' .. suffix,
+		disabled = disabled or false,
+		encryption = 'owe',
+		ieee80211w = 2,
+	})
+end
+
+local function configure_owe_transition_mode(config, radio_name)
+	local ap = config.ap
+
+	-- Don't configure OWE in case our device
+	-- can't do MFP, as it's mandatory for OWE.
+	if not wireless.device_supports_mfp(uci) then
+		return
+	end
+
+	if not ap.owe_transition_mode(false) then
+		return
+	end
+
+	local name_client = 'client_' .. radio_name
+	local name_owe = 'owe_' .. radio_name
+
+	local ifname_client = uci:get('wireless', name_client, 'ifname')
+	local ifname_owe = uci:get('wireless', name_owe, 'ifname')
+
+	if not (ifname_client and ifname_owe) then
+		return
+	end
+
+	uci:set('wireless', name_client, 'owe_transition_ifname', ifname_owe)
+	uci:set('wireless', name_owe, 'owe_transition_ifname', ifname_client)
+
+	uci:set('wireless', name_owe, 'hidden', '1')
+end
+
+wireless.foreach_radio(uci, function(radio, index, config)
+	local radio_name = radio['.name']
+
+	configure_ap(radio, index, config, radio_name)
+
+	configure_owe(radio, index, config, radio_name)
+	configure_owe_transition_mode(config, radio_name)
 end)
 
 uci:save('wireless')

package/gluon-config-mode-autoupdater/Makefile

 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=gluon-config-mode-autoupdater
-PKG_VERSION:=1
 
 include ../gluon.mk
 

package/gluon-config-mode-autoupdater/i18n/de.po

 msgid ""
 msgstr ""
-"Content-Type: text/plain; charset=UTF-8\n"
 "Project-Id-Version: PACKAGE VERSION\n"
 "PO-Revision-Date: 2015-03-18 16:03+0100\n"
 "Last-Translator: Matthias Schiffer <mschiffer@universe-factory.net>\n"
 "Language-Team: German\n"
 "Language: de\n"
 "MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=(n != 1);\n"
 
-msgid ""
-"This node will automatically update its firmware when a new version is "
-"available."
-msgstr ""
-"Dieser Knoten aktualisiert seine Firmware automatisch, sobald "
-"eine neue Version vorliegt."
-
 msgid ""
 "Automatic updates are disabled. They can be enabled in <em>Advanced "
 "settings</em>."
 msgstr ""
 "Automatische Updates sind deaktiviert. Sie können in den <em>Erweiterten "
 "Einstellungen</em> aktiviert werden."
+
+msgid ""
+"This node will automatically update its firmware when a new version is "
+"available."
+msgstr ""
+"Dieser Knoten aktualisiert seine Firmware automatisch, sobald eine neue "
+"Version vorliegt."

package/gluon-config-mode-autoupdater/i18n/fr.po

 msgid ""
 msgstr ""
-"Content-Type: text/plain; charset=UTF-8\n"
 "Project-Id-Version: PACKAGE VERSION\n"
 "PO-Revision-Date: 2015-08-04 20:20+0100\n"
 "Last-Translator: Bernot Tobias <tqbs@airmail.cc>\n"
 "Language-Team: French\n"
 "Language: fr\n"
 "MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=(n != 1);\n"
 
-msgid ""
-"This node will automatically update its firmware when a new version is "
-"available."
-msgstr "Ce nœud s'actualisera automatiquement quand une nouvelle "
-"version sera disponible."
-
 msgid ""
 "Automatic updates are disabled. They can be enabled in <em>Advanced "
 "settings</em>."
 msgstr ""
 "Mises à jour automatiques sont désactivées. Ils peuvent être activés dans "
 "<em>Paramètres avancés</em>."
+
+msgid ""
+"This node will automatically update its firmware when a new version is "
+"available."
+msgstr ""
+"Ce nœud s'actualisera automatiquement quand une nouvelle version sera "
+"disponible."