package/gluon-wireless-encryption/Makefile → package/gluon-wireless-encryption-wpa3/Makefile

 include $(TOPDIR)/rules.mk
 
-PKG_NAME:=gluon-wireless-encryption
-PKG_RELEASE:=1
+PKG_NAME:=gluon-wireless-encryption-wpa3
 
 include ../gluon.mk
 
 define Package/gluon-wireless-encryption-wpa3
-  DEPENDS:=+hostapd-openssl
+  DEPENDS:=+hostapd-mbedtls
   TITLE:=Package for supporting WPA3 encrypted wireless networks
 endef
 

package/gluon.mk

 GLUON_MK := $(abspath $(lastword $(MAKEFILE_LIST)))
 PKG_FILE_DEPENDS += $(GLUON_MK)
 
+PKG_VERSION ?= 1
+
 PKG_BUILD_DEPENDS += luasrcdiet/host
 
 ifneq ($(wildcard ./luasrc/.),)
@@ -21,7 +23,8 @@ shell-verbatim = $(call shell-unescape,$(call shell-escape,$(1)))
 
 
 define GluonCheckSite
-[ -z "$$IPKG_INSTROOT" ] || "${TOPDIR}/staging_dir/hostpkg/bin/lua" "${TOPDIR}/../scripts/check_site.lua" <<'END__GLUON__CHECK__SITE'
+[ -z "$$STAGING_DIR_HOSTPKG" ] || PATH="$$STAGING_DIR_HOSTPKG/bin:$$PATH"
+lua "$$IPKG_INSTROOT/lib/gluon/check-site.lua" <<'END__GLUON__CHECK__SITE'
 $(call shell-verbatim,cat '$(1)')
 END__GLUON__CHECK__SITE
 endef
@@ -62,11 +65,12 @@ define GluonSrcDiet
 	rm -rf $(2)
 	$(CP) $(1) $(2)
   ifdef CONFIG_GLUON_MINIFY
-	$(FIND) $(2) -type f | while read src; do \
-		if luasrcdiet --noopt-binequiv -o "$$$$src.o" "$$$$src"; then \
-			chmod $$$$(stat -c%a "$$$$src") "$$$$src.o"; \
-			mv "$$$$src.o" "$$$$src"; \
-		fi; \
+	# Use cp + rm instead of mv to preserve destination permissions
+	set -e; $(FIND) $(2) -type f | while read src; do \
+		echo "Minifying $$$$src..."; \
+		luasrcdiet --noopt-binequiv -o "$$$$src.tmp" "$$$$src"; \
+		cp "$$$$src.tmp" "$$$$src"; \
+		rm "$$$$src.tmp"; \
 	done
   endif
 endef

package/libbatadv/src/batadv-genl.c

@@ -41,58 +41,206 @@
 
 __attribute__ ((visibility ("default")))
 struct nla_policy batadv_genl_policy[NUM_BATADV_ATTR] = {
-	[BATADV_ATTR_VERSION]		= { .type = NLA_STRING },
-	[BATADV_ATTR_ALGO_NAME]		= { .type = NLA_STRING },
-	[BATADV_ATTR_MESH_IFINDEX]	= { .type = NLA_U32 },
-	[BATADV_ATTR_MESH_IFNAME]	= { .type = NLA_STRING,
-					    .maxlen = IFNAMSIZ },
-	[BATADV_ATTR_MESH_ADDRESS]	= { .type = NLA_UNSPEC,
+	[BATADV_ATTR_VERSION] = {
+		.type = NLA_STRING,
+	},
+	[BATADV_ATTR_ALGO_NAME] = {
+		.type = NLA_STRING,
+	},
+	[BATADV_ATTR_MESH_IFINDEX] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_MESH_IFNAME] = {
+		.type = NLA_STRING,
+		.maxlen = IFNAMSIZ,
+	},
+	[BATADV_ATTR_MESH_ADDRESS] = {
+		.type = NLA_UNSPEC,
 		.minlen = ETH_ALEN,
-					    .maxlen = ETH_ALEN },
-	[BATADV_ATTR_HARD_IFINDEX]	= { .type = NLA_U32 },
-	[BATADV_ATTR_HARD_IFNAME]	= { .type = NLA_STRING,
-					    .maxlen = IFNAMSIZ },
-	[BATADV_ATTR_HARD_ADDRESS]	= { .type = NLA_UNSPEC,
+		.maxlen = ETH_ALEN,
+	},
+	[BATADV_ATTR_HARD_IFINDEX] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_HARD_IFNAME] = {
+		.type = NLA_STRING,
+		.maxlen = IFNAMSIZ,
+	},
+	[BATADV_ATTR_HARD_ADDRESS] = {
+		.type = NLA_UNSPEC,
 		.minlen = ETH_ALEN,
-					    .maxlen = ETH_ALEN },
-	[BATADV_ATTR_ORIG_ADDRESS]	= { .type = NLA_UNSPEC,
+		.maxlen = ETH_ALEN,
+	},
+	[BATADV_ATTR_ORIG_ADDRESS] = {
+		.type = NLA_UNSPEC,
 		.minlen = ETH_ALEN,
-					    .maxlen = ETH_ALEN },
-	[BATADV_ATTR_TPMETER_RESULT]	= { .type = NLA_U8 },
-	[BATADV_ATTR_TPMETER_TEST_TIME]	= { .type = NLA_U32 },
-	[BATADV_ATTR_TPMETER_BYTES]	= { .type = NLA_U64 },
-	[BATADV_ATTR_TPMETER_COOKIE]	= { .type = NLA_U32 },
-	[BATADV_ATTR_PAD]		= { .type = NLA_UNSPEC },
-	[BATADV_ATTR_ACTIVE]		= { .type = NLA_FLAG },
-	[BATADV_ATTR_TT_ADDRESS]	= { .type = NLA_UNSPEC,
+		.maxlen = ETH_ALEN,
+	},
+	[BATADV_ATTR_TPMETER_RESULT] = {
+		.type = NLA_U8,
+	},
+	[BATADV_ATTR_TPMETER_TEST_TIME] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_TPMETER_BYTES] = {
+		.type = NLA_U64,
+	},
+	[BATADV_ATTR_TPMETER_COOKIE] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_PAD] = {
+		.type = NLA_UNSPEC,
+	},
+	[BATADV_ATTR_ACTIVE] = {
+		.type = NLA_FLAG,
+	},
+	[BATADV_ATTR_TT_ADDRESS] = {
+		.type = NLA_UNSPEC,
 		.minlen = ETH_ALEN,
-					    .maxlen = ETH_ALEN },
-	[BATADV_ATTR_TT_TTVN]		= { .type = NLA_U8 },
-	[BATADV_ATTR_TT_LAST_TTVN]	= { .type = NLA_U8 },
-	[BATADV_ATTR_TT_CRC32]		= { .type = NLA_U32 },
-	[BATADV_ATTR_TT_VID]		= { .type = NLA_U16 },
-	[BATADV_ATTR_TT_FLAGS]		= { .type = NLA_U32 },
-	[BATADV_ATTR_FLAG_BEST]		= { .type = NLA_FLAG },
-	[BATADV_ATTR_LAST_SEEN_MSECS]	= { .type = NLA_U32 },
-	[BATADV_ATTR_NEIGH_ADDRESS]	= { .type = NLA_UNSPEC,
+		.maxlen = ETH_ALEN,
+	},
+	[BATADV_ATTR_TT_TTVN] = {
+		.type = NLA_U8,
+	},
+	[BATADV_ATTR_TT_LAST_TTVN] = {
+		.type = NLA_U8,
+	},
+	[BATADV_ATTR_TT_CRC32] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_TT_VID] = {
+		.type = NLA_U16,
+	},
+	[BATADV_ATTR_TT_FLAGS] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_FLAG_BEST] = {
+		.type = NLA_FLAG,
+	},
+	[BATADV_ATTR_LAST_SEEN_MSECS] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_NEIGH_ADDRESS] = {
+		.type = NLA_UNSPEC,
 		.minlen = ETH_ALEN,
-					    .maxlen = ETH_ALEN },
-	[BATADV_ATTR_TQ]		= { .type = NLA_U8 },
-	[BATADV_ATTR_THROUGHPUT]	= { .type = NLA_U32 },
-	[BATADV_ATTR_BANDWIDTH_UP]	= { .type = NLA_U32 },
-	[BATADV_ATTR_BANDWIDTH_DOWN]	= { .type = NLA_U32 },
-	[BATADV_ATTR_ROUTER]		= { .type = NLA_UNSPEC,
+		.maxlen = ETH_ALEN,
+	},
+	[BATADV_ATTR_TQ] = {
+		.type = NLA_U8,
+	},
+	[BATADV_ATTR_THROUGHPUT] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_BANDWIDTH_UP] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_BANDWIDTH_DOWN] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_ROUTER] = {
+		.type = NLA_UNSPEC,
 		.minlen = ETH_ALEN,
-					    .maxlen = ETH_ALEN },
-	[BATADV_ATTR_BLA_OWN]		= { .type = NLA_FLAG },
-	[BATADV_ATTR_BLA_ADDRESS]	= { .type = NLA_UNSPEC,
+		.maxlen = ETH_ALEN,
+	},
+	[BATADV_ATTR_BLA_OWN] = {
+		.type = NLA_FLAG,
+	},
+	[BATADV_ATTR_BLA_ADDRESS] = {
+		.type = NLA_UNSPEC,
 		.minlen = ETH_ALEN,
-					    .maxlen = ETH_ALEN },
-	[BATADV_ATTR_BLA_VID]		= { .type = NLA_U16 },
-	[BATADV_ATTR_BLA_BACKBONE]	= { .type = NLA_UNSPEC,
+		.maxlen = ETH_ALEN,
+	},
+	[BATADV_ATTR_BLA_VID] = {
+		.type = NLA_U16,
+	},
+	[BATADV_ATTR_BLA_BACKBONE] = {
+		.type = NLA_UNSPEC,
 		.minlen = ETH_ALEN,
-					    .maxlen = ETH_ALEN },
-	[BATADV_ATTR_BLA_CRC]		= { .type = NLA_U16 },
+		.maxlen = ETH_ALEN,
+	},
+	[BATADV_ATTR_BLA_CRC] = {
+		.type = NLA_U16,
+	},
+	[BATADV_ATTR_DAT_CACHE_IP4ADDRESS] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_DAT_CACHE_HWADDRESS] = {
+		.type = NLA_UNSPEC,
+		.minlen = ETH_ALEN,
+		.maxlen = ETH_ALEN,
+	},
+	[BATADV_ATTR_DAT_CACHE_VID] = {
+		.type = NLA_U16,
+	},
+	[BATADV_ATTR_MCAST_FLAGS] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_MCAST_FLAGS_PRIV] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_VLANID] = {
+		.type = NLA_U16,
+	},
+	[BATADV_ATTR_AGGREGATED_OGMS_ENABLED] = {
+		.type = NLA_U8,
+	},
+	[BATADV_ATTR_AP_ISOLATION_ENABLED] = {
+		.type = NLA_U8,
+	},
+	[BATADV_ATTR_ISOLATION_MARK] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_ISOLATION_MASK] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_BONDING_ENABLED] = {
+		.type = NLA_U8,
+	},
+	[BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED] = {
+		.type = NLA_U8,
+	},
+	[BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED] = {
+		.type = NLA_U8,
+	},
+	[BATADV_ATTR_FRAGMENTATION_ENABLED] = {
+		.type = NLA_U8,
+	},
+	[BATADV_ATTR_GW_BANDWIDTH_DOWN] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_GW_BANDWIDTH_UP] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_GW_MODE] = {
+		.type = NLA_U8,
+	},
+	[BATADV_ATTR_GW_SEL_CLASS] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_HOP_PENALTY] = {
+		.type = NLA_U8,
+	},
+	[BATADV_ATTR_LOG_LEVEL] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED] = {
+		.type = NLA_U8,
+	},
+	[BATADV_ATTR_NETWORK_CODING_ENABLED] = {
+		.type = NLA_U8,
+	},
+	[BATADV_ATTR_ORIG_INTERVAL] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_ELP_INTERVAL] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_THROUGHPUT_OVERRIDE] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_MULTICAST_FANOUT] = {
+		.type = NLA_U32,
+	},
 };
 
 /**

package/libbatadv/src/batadv-genl.h

@@ -79,10 +79,8 @@ struct batadv_nlquery_opts {
  *
  * Return: Return true when a attribute is missing, false otherwise
  */
-static inline bool
-batadv_genl_missing_attrs(struct nlattr *attrs[],
-			  const enum batadv_nl_attrs mandatory[], size_t num)
-{
+static inline bool batadv_genl_missing_attrs(struct nlattr *attrs[],
+		const enum batadv_nl_attrs mandatory[], size_t num) {
 	size_t i;
 
 	for (i = 0; i < num; i++) {

package/libbatadv/src/batman_adv.h

 /* SPDX-License-Identifier: MIT */
-/* Copyright (C) 2016-2017  B.A.T.M.A.N. contributors:
+/* Copyright (C) B.A.T.M.A.N. contributors:
  *
  * Matthias Schiffer
- *
- * Permission is hereby granted, free of charge, to any person obtaining a
- * copy of this software and associated documentation files (the "Software"),
- * to deal in the Software without restriction, including without limitation
- * the rights to use, copy, modify, merge, publish, distribute, sublicense,
- * and/or sell copies of the Software, and to permit persons to whom the
- * Software is furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
- * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
- * DEALINGS IN THE SOFTWARE.
  */
 
 #ifndef _UAPI_LINUX_BATMAN_ADV_H_
@@ -27,6 +9,7 @@
 
 #define BATADV_NL_NAME "batadv"
 
+#define BATADV_NL_MCAST_GROUP_CONFIG	"config"
 #define BATADV_NL_MCAST_GROUP_TPMETER	"tpmeter"
 
 /**
@@ -86,11 +69,72 @@ enum batadv_tt_client_flags {
 
 	/**
 	 * @BATADV_TT_CLIENT_TEMP: this global client has been detected to be
-	 * part of the network but no nnode has already announced it
+	 * part of the network but no node has already announced it
 	 */
 	BATADV_TT_CLIENT_TEMP	 = (1 << 11),
 };
 
+/**
+ * enum batadv_mcast_flags_priv - Private, own multicast flags
+ *
+ * These are internal, multicast related flags. Currently they describe certain
+ * multicast related attributes of the segment this originator bridges into the
+ * mesh.
+ *
+ * Those attributes are used to determine the public multicast flags this
+ * originator is going to announce via TT.
+ *
+ * For netlink, if BATADV_MCAST_FLAGS_BRIDGED is unset then all querier
+ * related flags are undefined.
+ */
+enum batadv_mcast_flags_priv {
+	/**
+	 * @BATADV_MCAST_FLAGS_BRIDGED: There is a bridge on top of the mesh
+	 * interface.
+	 */
+	BATADV_MCAST_FLAGS_BRIDGED			= (1 << 0),
+
+	/**
+	 * @BATADV_MCAST_FLAGS_QUERIER_IPV4_EXISTS: Whether an IGMP querier
+	 * exists in the mesh
+	 */
+	BATADV_MCAST_FLAGS_QUERIER_IPV4_EXISTS		= (1 << 1),
+
+	/**
+	 * @BATADV_MCAST_FLAGS_QUERIER_IPV6_EXISTS: Whether an MLD querier
+	 * exists in the mesh
+	 */
+	BATADV_MCAST_FLAGS_QUERIER_IPV6_EXISTS		= (1 << 2),
+
+	/**
+	 * @BATADV_MCAST_FLAGS_QUERIER_IPV4_SHADOWING: If an IGMP querier
+	 * exists, whether it is potentially shadowing multicast listeners
+	 * (i.e. querier is behind our own bridge segment)
+	 */
+	BATADV_MCAST_FLAGS_QUERIER_IPV4_SHADOWING	= (1 << 3),
+
+	/**
+	 * @BATADV_MCAST_FLAGS_QUERIER_IPV6_SHADOWING: If an MLD querier
+	 * exists, whether it is potentially shadowing multicast listeners
+	 * (i.e. querier is behind our own bridge segment)
+	 */
+	BATADV_MCAST_FLAGS_QUERIER_IPV6_SHADOWING	= (1 << 4),
+};
+
+/**
+ * enum batadv_gw_modes - gateway mode of node
+ */
+enum batadv_gw_modes {
+	/** @BATADV_GW_MODE_OFF: gw mode disabled */
+	BATADV_GW_MODE_OFF,
+
+	/** @BATADV_GW_MODE_CLIENT: send DHCP requests to gw servers */
+	BATADV_GW_MODE_CLIENT,
+
+	/** @BATADV_GW_MODE_SERVER: announce itself as gateway server */
+	BATADV_GW_MODE_SERVER,
+};
+
 /**
  * enum batadv_nl_attrs - batman-adv netlink attributes
  */
@@ -272,6 +316,171 @@ enum batadv_nl_attrs {
 	 */
 	BATADV_ATTR_BLA_CRC,
 
+	/**
+	 * @BATADV_ATTR_DAT_CACHE_IP4ADDRESS: Client IPv4 address
+	 */
+	BATADV_ATTR_DAT_CACHE_IP4ADDRESS,
+
+	/**
+	 * @BATADV_ATTR_DAT_CACHE_HWADDRESS: Client MAC address
+	 */
+	BATADV_ATTR_DAT_CACHE_HWADDRESS,
+
+	/**
+	 * @BATADV_ATTR_DAT_CACHE_VID: VLAN ID
+	 */
+	BATADV_ATTR_DAT_CACHE_VID,
+
+	/**
+	 * @BATADV_ATTR_MCAST_FLAGS: Per originator multicast flags
+	 */
+	BATADV_ATTR_MCAST_FLAGS,
+
+	/**
+	 * @BATADV_ATTR_MCAST_FLAGS_PRIV: Private, own multicast flags
+	 */
+	BATADV_ATTR_MCAST_FLAGS_PRIV,
+
+	/**
+	 * @BATADV_ATTR_VLANID: VLAN id on top of soft interface
+	 */
+	BATADV_ATTR_VLANID,
+
+	/**
+	 * @BATADV_ATTR_AGGREGATED_OGMS_ENABLED: whether the batman protocol
+	 *  messages of the mesh interface shall be aggregated or not.
+	 */
+	BATADV_ATTR_AGGREGATED_OGMS_ENABLED,
+
+	/**
+	 * @BATADV_ATTR_AP_ISOLATION_ENABLED: whether the data traffic going
+	 *  from a wireless client to another wireless client will be silently
+	 *  dropped.
+	 */
+	BATADV_ATTR_AP_ISOLATION_ENABLED,
+
+	/**
+	 * @BATADV_ATTR_ISOLATION_MARK: the isolation mark which is used to
+	 *  classify clients as "isolated" by the Extended Isolation feature.
+	 */
+	BATADV_ATTR_ISOLATION_MARK,
+
+	/**
+	 * @BATADV_ATTR_ISOLATION_MASK: the isolation (bit)mask which is used to
+	 *  classify clients as "isolated" by the Extended Isolation feature.
+	 */
+	BATADV_ATTR_ISOLATION_MASK,
+
+	/**
+	 * @BATADV_ATTR_BONDING_ENABLED: whether the data traffic going through
+	 *  the mesh will be sent using multiple interfaces at the same time.
+	 */
+	BATADV_ATTR_BONDING_ENABLED,
+
+	/**
+	 * @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED: whether the bridge loop
+	 *  avoidance feature is enabled. This feature detects and avoids loops
+	 *  between the mesh and devices bridged with the soft interface
+	 */
+	BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED,
+
+	/**
+	 * @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED: whether the distributed
+	 *  arp table feature is enabled. This feature uses a distributed hash
+	 *  table to answer ARP requests without flooding the request through
+	 *  the whole mesh.
+	 */
+	BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED,
+
+	/**
+	 * @BATADV_ATTR_FRAGMENTATION_ENABLED: whether the data traffic going
+	 *  through the mesh will be fragmented or silently discarded if the
+	 *  packet size exceeds the outgoing interface MTU.
+	 */
+	BATADV_ATTR_FRAGMENTATION_ENABLED,
+
+	/**
+	 * @BATADV_ATTR_GW_BANDWIDTH_DOWN: defines the download bandwidth which
+	 *  is propagated by this node if %BATADV_ATTR_GW_BANDWIDTH_MODE was set
+	 *  to 'server'.
+	 */
+	BATADV_ATTR_GW_BANDWIDTH_DOWN,
+
+	/**
+	 * @BATADV_ATTR_GW_BANDWIDTH_UP: defines the upload bandwidth which
+	 *  is propagated by this node if %BATADV_ATTR_GW_BANDWIDTH_MODE was set
+	 *  to 'server'.
+	 */
+	BATADV_ATTR_GW_BANDWIDTH_UP,
+
+	/**
+	 * @BATADV_ATTR_GW_MODE: defines the state of the gateway features.
+	 * Possible values are specified in enum batadv_gw_modes
+	 */
+	BATADV_ATTR_GW_MODE,
+
+	/**
+	 * @BATADV_ATTR_GW_SEL_CLASS: defines the selection criteria this node
+	 *  will use to choose a gateway if gw_mode was set to 'client'.
+	 */
+	BATADV_ATTR_GW_SEL_CLASS,
+
+	/**
+	 * @BATADV_ATTR_HOP_PENALTY: defines the penalty which will be applied
+	 *  to an originator message's tq-field on every hop and/or per
+	 *  hard interface
+	 */
+	BATADV_ATTR_HOP_PENALTY,
+
+	/**
+	 * @BATADV_ATTR_LOG_LEVEL: bitmask with to define which debug messages
+	 *  should be send to the debug log/trace ring buffer
+	 */
+	BATADV_ATTR_LOG_LEVEL,
+
+	/**
+	 * @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED: whether multicast
+	 *  optimizations should be replaced by simple broadcast-like flooding
+	 *  of multicast packets. If set to non-zero then all nodes in the mesh
+	 *  are going to use classic flooding for any multicast packet with no
+	 *  optimizations.
+	 */
+	BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED,
+
+	/**
+	 * @BATADV_ATTR_NETWORK_CODING_ENABLED: whether Network Coding (using
+	 *  some magic to send fewer wifi packets but still the same content) is
+	 *  enabled or not.
+	 */
+	BATADV_ATTR_NETWORK_CODING_ENABLED,
+
+	/**
+	 * @BATADV_ATTR_ORIG_INTERVAL: defines the interval in milliseconds in
+	 *  which batman sends its protocol messages.
+	 */
+	BATADV_ATTR_ORIG_INTERVAL,
+
+	/**
+	 * @BATADV_ATTR_ELP_INTERVAL: defines the interval in milliseconds in
+	 *  which batman emits probing packets for neighbor sensing (ELP).
+	 */
+	BATADV_ATTR_ELP_INTERVAL,
+
+	/**
+	 * @BATADV_ATTR_THROUGHPUT_OVERRIDE: defines the throughput value to be
+	 *  used by B.A.T.M.A.N. V when estimating the link throughput using
+	 *  this interface. If the value is set to 0 then batman-adv will try to
+	 *  estimate the throughput by itself.
+	 */
+	BATADV_ATTR_THROUGHPUT_OVERRIDE,
+
+	/**
+	 * @BATADV_ATTR_MULTICAST_FANOUT: defines the maximum number of packet
+	 * copies that may be generated for a multicast-to-unicast conversion.
+	 * Once this limit is exceeded distribution will fall back to broadcast.
+	 */
+	BATADV_ATTR_MULTICAST_FANOUT,
+
 	/* add attributes above here, update the policy in netlink.c */
 
 	/**
@@ -300,10 +509,14 @@ enum batadv_nl_commands {
 	BATADV_CMD_UNSPEC,
 
 	/**
-	 * @BATADV_CMD_GET_MESH_INFO: Query basic information about batman-adv
-	 * device
+	 * @BATADV_CMD_GET_MESH: Get attributes from softif/mesh
 	 */
-	BATADV_CMD_GET_MESH_INFO,
+	BATADV_CMD_GET_MESH,
+
+	/**
+	 * @BATADV_CMD_GET_MESH_INFO: Alias for @BATADV_CMD_GET_MESH
+	 */
+	BATADV_CMD_GET_MESH_INFO = BATADV_CMD_GET_MESH,
 
 	/**
 	 * @BATADV_CMD_TP_METER: Start a tp meter session
@@ -321,9 +534,15 @@ enum batadv_nl_commands {
 	BATADV_CMD_GET_ROUTING_ALGOS,
 
 	/**
-	 * @BATADV_CMD_GET_HARDIFS: Query list of hard interfaces
+	 * @BATADV_CMD_GET_HARDIF: Get attributes from a hardif of the
+	 *  current softif
 	 */
-	BATADV_CMD_GET_HARDIFS,
+	BATADV_CMD_GET_HARDIF,
+
+	/**
+	 * @BATADV_CMD_GET_HARDIFS: Alias for @BATADV_CMD_GET_HARDIF
+	 */
+	BATADV_CMD_GET_HARDIFS = BATADV_CMD_GET_HARDIF,
 
 	/**
 	 * @BATADV_CMD_GET_TRANSTABLE_LOCAL: Query list of local translations
@@ -361,6 +580,39 @@ enum batadv_nl_commands {
 	 */
 	BATADV_CMD_GET_BLA_BACKBONE,
 
+	/**
+	 * @BATADV_CMD_GET_DAT_CACHE: Query list of DAT cache entries
+	 */
+	BATADV_CMD_GET_DAT_CACHE,
+
+	/**
+	 * @BATADV_CMD_GET_MCAST_FLAGS: Query list of multicast flags
+	 */
+	BATADV_CMD_GET_MCAST_FLAGS,
+
+	/**
+	 * @BATADV_CMD_SET_MESH: Set attributes for softif/mesh
+	 */
+	BATADV_CMD_SET_MESH,
+
+	/**
+	 * @BATADV_CMD_SET_HARDIF: Set attributes for hardif of the
+	 *  current softif
+	 */
+	BATADV_CMD_SET_HARDIF,
+
+	/**
+	 * @BATADV_CMD_GET_VLAN: Get attributes from a VLAN of the
+	 *  current softif
+	 */
+	BATADV_CMD_GET_VLAN,
+
+	/**
+	 * @BATADV_CMD_SET_VLAN: Set attributes for VLAN of the
+	 *  current softif
+	 */
+	BATADV_CMD_SET_VLAN,
+
 	/* add new commands above here */
 
 	/**
@@ -423,4 +675,30 @@ enum batadv_tp_meter_reason {
 	BATADV_TP_REASON_TOO_MANY		= 133,
 };
 
+/**
+ * enum batadv_ifla_attrs - batman-adv ifla nested attributes
+ */
+enum batadv_ifla_attrs {
+	/**
+	 * @IFLA_BATADV_UNSPEC: unspecified attribute which is not parsed by
+	 *  rtnetlink
+	 */
+	IFLA_BATADV_UNSPEC,
+
+	/**
+	 * @IFLA_BATADV_ALGO_NAME: routing algorithm (name) which should be
+	 *  used by the newly registered batadv net_device.
+	 */
+	IFLA_BATADV_ALGO_NAME,
+
+	/* add attributes above here, update the policy in soft-interface.c */
+
+	/**
+	 * @__IFLA_BATADV_MAX: internal use
+	 */
+	__IFLA_BATADV_MAX,
+};
+
+#define IFLA_BATADV_MAX (__IFLA_BATADV_MAX - 1)
+
 #endif /* _UAPI_LINUX_BATMAN_ADV_H_ */

package/libgluonutil/src/libgluonutil.c

-/*
-  Copyright (c) 2016, Matthias Schiffer <mschiffer@universe-factory.net>
-  All rights reserved.
-
-  Redistribution and use in source and binary forms, with or without
-  modification, are permitted provided that the following conditions are met:
-
-    1. Redistributions of source code must retain the above copyright notice,
-       this list of conditions and the following disclaimer.
-    2. Redistributions in binary form must reproduce the above copyright notice,
-       this list of conditions and the following disclaimer in the documentation
-       and/or other materials provided with the distribution.
-
-  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-  AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-  DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-  DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-  SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-  CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-  OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-  OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-*/
+/* SPDX-FileCopyrightText: 2016 Matthias Schiffer <mschiffer@universe-factory.net> */
+/* SPDX-License-Identifier: BSD-2-Clause */
 
 
 #include "libgluonutil.h"
 
 #include <json-c/json.h>
 #include <uci.h>
+
 #include <arpa/inet.h>
+
+#include <errno.h>
+#include <glob.h>
+#include <libgen.h>
+#include <limits.h>
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
 #include <unistd.h>
-#include <limits.h>
-#include <errno.h>
 
 /**
  * Merges two JSON objects
@@ -129,6 +111,75 @@ char * gluonutil_get_interface_address(const char *ifname) {
 	return gluonutil_read_line(path);
 }
 
+void gluonutil_get_interface_lower(char out[IF_NAMESIZE], const char *ifname) {
+	strncpy(out, ifname, IF_NAMESIZE-1);
+	out[IF_NAMESIZE-1] = 0;
+
+	const char *format = "/sys/class/net/%s/lower_*";
+	char pattern[strlen(format) + IF_NAMESIZE];
+
+	while (true) {
+		snprintf(pattern, sizeof(pattern), format, out);
+		size_t pattern_len = strlen(pattern);
+
+		glob_t lower;
+		if (glob(pattern, GLOB_NOSORT, NULL, &lower) != 0)
+			break;
+
+		strncpy(out, lower.gl_pathv[0] + pattern_len - 1, IF_NAMESIZE-1);
+
+		globfree(&lower);
+	}
+}
+
+enum gluonutil_interface_type lookup_interface_type(const char *devtype) {
+	if (strcmp(devtype, "wlan") == 0)
+		return GLUONUTIL_INTERFACE_TYPE_WIRELESS;
+
+	if (strcmp(devtype, "l2tpeth") == 0 || strcmp(devtype, "wireguard") == 0)
+		return GLUONUTIL_INTERFACE_TYPE_TUNNEL;
+
+	/* Regular wired interfaces do not set DEVTYPE, so if this point is
+	 * reached, we have something different */
+	return GLUONUTIL_INTERFACE_TYPE_UNKNOWN;
+}
+
+enum gluonutil_interface_type gluonutil_get_interface_type(const char *ifname) {
+	const char *pattern = "/sys/class/net/%s/%s";
+
+	/* Default to wired type when no DEVTYPE is set */
+	enum gluonutil_interface_type ret = GLUONUTIL_INTERFACE_TYPE_WIRED;
+	char *line = NULL, path[PATH_MAX];
+	size_t buflen = 0;
+	ssize_t len;
+	FILE *f;
+
+	snprintf(path, sizeof(path), pattern, ifname, "tun_flags");
+	if (access(path, F_OK) == 0)
+		return GLUONUTIL_INTERFACE_TYPE_TUNNEL;
+
+	snprintf(path, sizeof(path), pattern, ifname, "uevent");
+	f = fopen(path, "r");
+	if (!f)
+		return GLUONUTIL_INTERFACE_TYPE_UNKNOWN;
+
+	while ((len = getline(&line, &buflen, f)) >= 0) {
+		if (len == 0)
+			continue;
+
+		if (line[len-1] == '\n')
+			line[len-1] = '\0';
+
+		if (strncmp(line, "DEVTYPE=", 8) == 0) {
+			ret = lookup_interface_type(line+8);
+			break;
+		}
+	}
+	free(line);
+
+	fclose(f);
+	return ret;
+}
 
 
 struct json_object * gluonutil_wrap_string(const char *str) {

package/libgluonutil/src/libgluonutil.h

-/*
-  Copyright (c) 2016, Matthias Schiffer <mschiffer@universe-factory.net>
-  All rights reserved.
-
-  Redistribution and use in source and binary forms, with or without
-  modification, are permitted provided that the following conditions are met:
-
-    1. Redistributions of source code must retain the above copyright notice,
-       this list of conditions and the following disclaimer.
-    2. Redistributions in binary form must reproduce the above copyright notice,
-       this list of conditions and the following disclaimer in the documentation
-       and/or other materials provided with the distribution.
-
-  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-  AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-  DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-  DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-  SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-  CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-  OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-  OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-*/
+/* SPDX-FileCopyrightText: 2016 Matthias Schiffer <mschiffer@universe-factory.net> */
+/* SPDX-License-Identifier: BSD-2-Clause */
 
 
 #ifndef _LIBGLUON_LIBGLUON_H_
 #define _LIBGLUON_LIBGLUON_H_
 
+#include <net/if.h>
 #include <netinet/in.h>
 #include <stdbool.h>
 
@@ -34,7 +13,18 @@
 char * gluonutil_read_line(const char *filename);
 char * gluonutil_get_sysconfig(const char *key);
 char * gluonutil_get_node_id(void);
+
+enum gluonutil_interface_type {
+	GLUONUTIL_INTERFACE_TYPE_UNKNOWN,
+	GLUONUTIL_INTERFACE_TYPE_WIRED,
+	GLUONUTIL_INTERFACE_TYPE_WIRELESS,
+	GLUONUTIL_INTERFACE_TYPE_TUNNEL,
+};
+
+void gluonutil_get_interface_lower(char out[IF_NAMESIZE], const char *ifname);
 char * gluonutil_get_interface_address(const char *ifname);
+enum gluonutil_interface_type gluonutil_get_interface_type(const char *ifname);
+
 bool gluonutil_get_node_prefix6(struct in6_addr *prefix);
 
 struct json_object * gluonutil_wrap_string(const char *str);
@@ -42,6 +32,7 @@ struct json_object * gluonutil_wrap_and_free_string(char *str);
 
 bool gluonutil_has_domains(void);
 char * gluonutil_get_domain(void);
+char * gluonutil_get_primary_domain(void);
 struct json_object * gluonutil_load_site_config(void);
 
 #endif /* _LIBGLUON_LIBGLUON_H_ */

patches/openwrt/0004-dropbear-add-a-failsafe-mode-that-will-always-allow-password-less-root-login.patch → patches/openwrt/0003-dropbear-add-a-failsafe-mode-that-will-always-allow-password-less-root-login.patch

@@ -6,13 +6,13 @@ Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
 
 diff --git a/package/network/services/dropbear/patches/700-failsafe-mode.patch b/package/network/services/dropbear/patches/700-failsafe-mode.patch
 new file mode 100644
-index 0000000000000000000000000000000000000000..bd9cf1ce4234d94bcc5b782cc753f59993f999bc
+index 0000000000000000000000000000000000000000..9b619ce80b2963c67ac62bcf95b33b28b505ad2a
 --- /dev/null
 +++ b/package/network/services/dropbear/patches/700-failsafe-mode.patch
 @@ -0,0 +1,57 @@
-+--- a/svr-auth.c
-++++ b/svr-auth.c
-+@@ -125,10 +125,11 @@ void recv_msg_userauth_request() {
++--- a/src/svr-auth.c
+++++ b/src/svr-auth.c
++@@ -124,10 +124,11 @@ void recv_msg_userauth_request() {
 + 				AUTH_METHOD_NONE_LEN) == 0) {
 + 		TRACE(("recv_msg_userauth_request: 'none' request"))
 + 		if (valid_user
@@ -28,38 +28,38 @@ index 0000000000000000000000000000000000000000..bd9cf1ce4234d94bcc5b782cc753f599
 + 		{
 + 			dropbear_log(LOG_NOTICE, 
 + 					"Auth succeeded with blank password for '%s' from %s",
-+--- a/svr-runopts.c
-++++ b/svr-runopts.c
-+@@ -77,6 +77,7 @@ static void printhelp(const char * progn
++--- a/src/svr-runopts.c
+++++ b/src/svr-runopts.c
++@@ -82,6 +82,7 @@ static void printhelp(const char * progn
 + 					"-s		Disable password logins\n"
 + 					"-g		Disable password logins for root\n"
 + 					"-B		Allow blank password logins\n"
 ++					"-f             Failsafe mode: always allow password-less root login\n"
++ 					"-t		Enable two-factor authentication (both password and public key required)\n"
 + #endif
 + 					"-T		Maximum authentication tries (default %d)\n"
-+ #if DROPBEAR_SVR_LOCALTCPFWD
-+@@ -144,6 +145,7 @@ void svr_getopts(int argc, char ** argv)
++@@ -166,6 +167,7 @@ void svr_getopts(int argc, char ** argv)
 + 	svr_opts.noauthpass = 0;
 + 	svr_opts.norootpass = 0;
 + 	svr_opts.allowblankpass = 0;
 ++	svr_opts.failsafe_mode = 0;
++ 	svr_opts.multiauthmethod = 0;
 + 	svr_opts.maxauthtries = MAX_AUTH_TRIES;
 + 	svr_opts.inetdmode = 0;
-+ 	svr_opts.portcount = 0;
-+@@ -266,6 +268,9 @@ void svr_getopts(int argc, char ** argv)
-+ 				case 'B':
-+ 					svr_opts.allowblankpass = 1;
++@@ -263,6 +265,9 @@ void svr_getopts(int argc, char ** argv)
++ 				case '2':
++ 					next = &reexec_fd_arg;
 + 					break;
 ++				case 'f':
 ++					svr_opts.failsafe_mode = 1;
 ++					break;
 + #endif
-+ 				case 'h':
-+ 					printhelp(argv[0]);
-+--- a/runopts.h
-++++ b/runopts.h
-+@@ -106,6 +106,8 @@ typedef struct svr_runopts {
-+ 	int allowblankpass;
++ 				case 'p':
++ 					nextisport = 1;
++--- a/src/runopts.h
+++++ b/src/runopts.h
++@@ -110,6 +110,8 @@ typedef struct svr_runopts {
++ 	int multiauthmethod;
 + 	unsigned int maxauthtries;
 + 
 ++	int failsafe_mode;

patches/openwrt/0003-libjson-c-Add-support-for-custom-format-strings-for-doubles.patch

-From: Jan-Philipp Litza <janphilipp@litza.de>
-Date: Fri, 6 May 2016 16:44:29 +0200
-Subject: libjson-c: Add support for custom format strings for doubles
-
-diff --git a/package/libs/libjson-c/patches/002-custom-format-string.patch b/package/libs/libjson-c/patches/002-custom-format-string.patch
-new file mode 100644
-index 0000000000000000000000000000000000000000..b67433a7baf37654a17fa5036c4266b33bdda9f2
---- /dev/null
-+++ b/package/libs/libjson-c/patches/002-custom-format-string.patch
-@@ -0,0 +1,91 @@
-+From 21dc5dc92bd56f5f4dc2c90b9ea6bf1e1407714e Mon Sep 17 00:00:00 2001
-+From: Jan-Philipp Litza <janphilipp@litza.de>
-+Date: Fri, 6 May 2016 16:12:44 +0200
-+Subject: [PATCH] Export json_object_double_to_json_string() and use custom
-+ format string
-+BCC: janphilipp@litza.de
-+
-+---
-+ json_object.c | 12 ++++++------
-+ json_object.h | 28 ++++++++++++++++++++++++++++
-+ 2 files changed, 34 insertions(+), 6 deletions(-)
-+
-+--- a/json_object.c
-++++ b/json_object.c
-+@@ -55,7 +55,6 @@ static struct json_object* json_object_n
-+ static json_object_to_json_string_fn json_object_object_to_json_string;
-+ static json_object_to_json_string_fn json_object_boolean_to_json_string;
-+ static json_object_to_json_string_fn json_object_int_to_json_string;
-+-static json_object_to_json_string_fn json_object_double_to_json_string;
-+ static json_object_to_json_string_fn json_object_string_to_json_string;
-+ static json_object_to_json_string_fn json_object_array_to_json_string;
-+ 
-+@@ -560,10 +559,10 @@ int64_t json_object_get_int64(struct jso
-+ 
-+ /* json_object_double */
-+ 
-+-static int json_object_double_to_json_string(struct json_object* jso,
-+-					     struct printbuf *pb,
-+-					     int level,
-+-						 int flags)
-++int json_object_double_to_json_string(struct json_object* jso,
-++				      struct printbuf *pb,
-++				      int level,
-++				      int flags)
-+ {
-+   char buf[128], *p, *q;
-+   int size;
-+@@ -579,7 +578,8 @@ static int json_object_double_to_json_st
-+     else
-+       size = snprintf(buf, sizeof(buf), "-Infinity");
-+   else
-+-    size = snprintf(buf, sizeof(buf), "%.17g", jso->o.c_double);
-++    size = snprintf(buf, sizeof(buf),
-++        jso->_userdata ? (const char*) jso->_userdata : "%.17g", jso->o.c_double);
-+ 
-+   p = strchr(buf, ',');
-+   if (p) {
-+--- a/json_object.h
-++++ b/json_object.h
-+@@ -515,6 +515,9 @@ extern int64_t json_object_get_int64(str
-+ /* double type methods */
-+ 
-+ /** Create a new empty json_object of type json_type_double
-++ *
-++ * @see json_object_double_to_json_string() for how to set a custom format string.
-++ *
-+  * @param d the double
-+  * @returns a json_object of type json_type_double
-+  */
-+@@ -543,6 +546,31 @@ extern struct json_object* json_object_n
-+  */
-+ extern struct json_object* json_object_new_double_s(double d, const char *ds);
-+ 
-++
-++/** Serialize a json_object of type json_type_double to a string.
-++ *
-++ * This function isn't meant to be called directly. Instead, you can set a
-++ * custom format string for the serialization of this double using the
-++ * following call (where "%.17g" actually is the default):
-++ *
-++ * @code
-++ *   jso = json_object_new_double(d);
-++ *   json_object_set_serializer(jso, json_object_double_to_json_string,
-++ *       "%.17g", NULL);
-++ * @endcode
-++ *
-++ * @see printf(3) man page for format strings
-++ *
-++ * @param jso The json_type_double object that is serialized.
-++ * @param pb The destination buffer.
-++ * @param level Ignored.
-++ * @param flags Ignored.
-++ */
-++extern int json_object_double_to_json_string(struct json_object* jso,
-++					     struct printbuf *pb,
-++					     int level,
-++					     int flags);
-++
-+ /** Get the double floating point value of a json_object
-+  *
-+  * The type is coerced to a double if the passed object is not a double.

patches/openwrt/0004-HACK-opkg-do-not-preserve-opkg-keys-on-upgrades-by-default.patch

+From: Matthias Schiffer <mschiffer@universe-factory.net>
+Date: Sun, 30 Mar 2025 13:16:02 +0200
+Subject: HACK: opkg: do not preserve opkg keys on upgrades by default
+
+Custom keys can still be preserved by listing them in sysupgrade.conf.
+
+Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
+
+diff --git a/package/system/opkg/Makefile b/package/system/opkg/Makefile
+index e7c45e3523135a6cc35385a81c65cf2831b842bb..fc5ec6a7ed1eb559a478b00b03102fbccd543c57 100644
+--- a/package/system/opkg/Makefile
++++ b/package/system/opkg/Makefile
+@@ -56,7 +56,6 @@ endef
+ 
+ define Package/opkg/conffiles
+ /etc/opkg.conf
+-/etc/opkg/keys/
+ /etc/opkg/customfeeds.conf
+ endef
+ 

patches/openwrt/0005-kernel-bridge-Implement-MLD-Querier-wake-up-calls-Android-bug-workaround.patch

+From: Linus Lüssing <linus.luessing@c0d3.blue>
+Date: Sat, 1 Jan 2022 10:09:13 +0100
+Subject: kernel: bridge: Implement MLD Querier wake-up calls / Android bug workaround
+
+Implement a configurable MLD Querier wake-up calls "feature" which
+works around a widely spread Android bug in connection with IGMP/MLD
+snooping.
+
+Currently there are mobile devices (e.g. Android) which are not able
+to receive and respond to MLD Queries reliably because the Wifi driver
+filters a lot of ICMPv6 when the device is asleep - including
+MLD. This in turn breaks IPv6 communication when MLD Snooping is
+enabled. However there is one ICMPv6 type which is allowed to pass and
+which can be used to wake up the mobile device: ICMPv6 Echo Requests.
+
+If this bridge is the selected MLD Querier then setting
+"multicast_wakeupcall" to a number n greater than 0 will send n
+ICMPv6 Echo Requests to each host behind this port to wake
+them up with each MLD Query. Upon receiving a matching ICMPv6 Echo
+Reply an MLD Query with a unicast ethernet destination will be sent
+to the specific host(s).
+
+Link: https://issuetracker.google.com/issues/149630944
+Link: https://github.com/freifunk-gluon/gluon/issues/1832
+
+Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
+
+diff --git a/package/network/config/netifd/patches/0001-bridge-Add-multicast_wakeupcall-option.patch b/package/network/config/netifd/patches/0001-bridge-Add-multicast_wakeupcall-option.patch
+new file mode 100644
+index 0000000000000000000000000000000000000000..077a563b6066cd1d3aee4b1e82328e8cc5e042ea
+--- /dev/null
++++ b/package/network/config/netifd/patches/0001-bridge-Add-multicast_wakeupcall-option.patch
+@@ -0,0 +1,142 @@
++From d23a49e6542dc068b12fbc7b6a4520f9fb3626f9 Mon Sep 17 00:00:00 2001
++From: =?UTF-8?q?Linus=20L=C3=BCssing?= <linus.luessing@c0d3.blue>
++Date: Sun, 5 Jul 2020 23:33:51 +0200
++Subject: [PATCH] bridge: Add multicast_wakeupcall option
++MIME-Version: 1.0
++Content-Type: text/plain; charset=UTF-8
++Content-Transfer-Encoding: 8bit
++
++This makes the new per bridge port multicast_wakeupcall feature
++for the Linux bridge configurable for wireless interfaces and enables it
++by default for an AP interface.
++
++The MLD Querier wake-up calls "feature" works around a widely spread Android
++bug in connection with IGMP/MLD snooping.
++
++Currently there are mobile devices (e.g. Android) which are not able
++to receive and respond to MLD Queries reliably because the Wifi driver
++filters a lot of ICMPv6 when the device is asleep - including
++MLD. This in turn breaks IPv6 communication when MLD Snooping is
++enabled. However there is one ICMPv6 type which is allowed to pass and
++which can be used to wake up the mobile device: ICMPv6 Echo Requests.
++
++If this bridge is the selected MLD Querier then setting
++"multicast_wakeupcall" to a number n greater than 0 will send n
++ICMPv6 Echo Requests to each host behind this port to wake
++them up with each MLD Query. Upon receiving a matching ICMPv6 Echo
++Reply an MLD Query with a unicast ethernet destination will be sent
++to the specific host(s).
++
++Link: https://issuetracker.google.com/issues/149630944
++Link: https://github.com/freifunk-gluon/gluon/issues/1832
++
++Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
++---
++ device.c       |  9 +++++++++
++ device.h       |  3 +++
++ system-linux.c | 13 +++++++++++++
++ 3 files changed, 25 insertions(+)
++
++--- a/device.c
+++++ b/device.c
++@@ -49,6 +49,7 @@ static const struct blobmsg_policy dev_a
++ 	[DEV_ATTR_NEIGHGCSTALETIME] = { .name = "neighgcstaletime", .type = BLOBMSG_TYPE_INT32 },
++ 	[DEV_ATTR_DADTRANSMITS] = { .name = "dadtransmits", .type = BLOBMSG_TYPE_INT32 },
++ 	[DEV_ATTR_MULTICAST_TO_UNICAST] = { .name = "multicast_to_unicast", .type = BLOBMSG_TYPE_BOOL },
+++	[DEV_ATTR_MULTICAST_WAKEUPCALL] = { .name = "multicast_wakeupcall", .type = BLOBMSG_TYPE_INT32 },
++ 	[DEV_ATTR_MULTICAST_ROUTER] = { .name = "multicast_router", .type = BLOBMSG_TYPE_INT32 },
++ 	[DEV_ATTR_MULTICAST_FAST_LEAVE] = { .name = "multicast_fast_leave", . type = BLOBMSG_TYPE_BOOL },
++ 	[DEV_ATTR_MULTICAST] = { .name ="multicast", .type = BLOBMSG_TYPE_BOOL },
++@@ -275,6 +276,7 @@ device_merge_settings(struct device *dev
++ 	n->multicast = s->flags & DEV_OPT_MULTICAST ?
++ 		s->multicast : os->multicast;
++ 	n->multicast_to_unicast = s->multicast_to_unicast;
+++	n->multicast_wakeupcall = s->multicast_wakeupcall;
++ 	n->multicast_router = s->multicast_router;
++ 	n->multicast_fast_leave = s->multicast_fast_leave;
++ 	n->learning = s->learning;
++@@ -449,6 +451,11 @@ device_init_settings(struct device *dev,
++ 		s->flags |= DEV_OPT_MULTICAST_TO_UNICAST;
++ 	}
++ 
+++	if ((cur = tb[DEV_ATTR_MULTICAST_WAKEUPCALL])) {
+++		s->multicast_wakeupcall = blobmsg_get_u32(cur);
+++		s->flags |= DEV_OPT_MULTICAST_WAKEUPCALL;
+++	}
+++
++ 	if ((cur = tb[DEV_ATTR_MULTICAST_ROUTER])) {
++ 		s->multicast_router = blobmsg_get_u32(cur);
++ 		if (s->multicast_router <= 2)
++@@ -1372,6 +1379,8 @@ device_dump_status(struct blob_buf *b, s
++ 			blobmsg_add_u32(b, "dadtransmits", st.dadtransmits);
++ 		if (st.flags & DEV_OPT_MULTICAST_TO_UNICAST)
++ 			blobmsg_add_u8(b, "multicast_to_unicast", st.multicast_to_unicast);
+++		if (st.flags & DEV_OPT_MULTICAST_WAKEUPCALL)
+++			blobmsg_add_u32(b, "multicast_wakeupcall", st.multicast_wakeupcall);
++ 		if (st.flags & DEV_OPT_MULTICAST_ROUTER)
++ 			blobmsg_add_u32(b, "multicast_router", st.multicast_router);
++ 		if (st.flags & DEV_OPT_MULTICAST_FAST_LEAVE)
++--- a/device.h
+++++ b/device.h
++@@ -44,6 +44,7 @@ enum {
++ 	DEV_ATTR_NEIGHREACHABLETIME,
++ 	DEV_ATTR_DADTRANSMITS,
++ 	DEV_ATTR_MULTICAST_TO_UNICAST,
+++	DEV_ATTR_MULTICAST_WAKEUPCALL,
++ 	DEV_ATTR_MULTICAST_ROUTER,
++ 	DEV_ATTR_MULTICAST_FAST_LEAVE,
++ 	DEV_ATTR_MULTICAST,
++@@ -144,6 +145,7 @@ enum {
++ 	DEV_OPT_GRO			= (1ULL << 37),
++ 	DEV_OPT_MASTER			= (1ULL << 38),
++ 	DEV_OPT_EEE			= (1ULL << 39),
+++	DEV_OPT_MULTICAST_WAKEUPCALL	= (1ULL << 63),
++ };
++ 
++ /* events broadcasted to all users of a device */
++@@ -205,6 +207,7 @@ struct device_settings {
++ 	int neigh4locktime;
++ 	unsigned int dadtransmits;
++ 	bool multicast_to_unicast;
+++	unsigned int multicast_wakeupcall;
++ 	unsigned int multicast_router;
++ 	bool multicast_fast_leave;
++ 	bool multicast;
++--- a/system-linux.c
+++++ b/system-linux.c
++@@ -536,6 +536,11 @@ static void system_bridge_set_multicast_
++ 	system_set_dev_sysfs("brport/multicast_to_unicast", dev->ifname, val);
++ }
++ 
+++static void system_bridge_set_multicast_wakeupcall(struct device *dev, const char *val)
+++{
+++	system_set_dev_sysfs("brport/multicast_wakeupcall", dev->ifname, val);
+++}
+++
++ static void system_bridge_set_multicast_fast_leave(struct device *dev, const char *val)
++ {
++ 	system_set_dev_sysfs("brport/multicast_fast_leave", dev->ifname, val);
++@@ -923,8 +928,10 @@ static char *system_get_bridge(const cha
++ static void
++ system_bridge_set_wireless(struct device *bridge, struct device *dev)
++ {
+++	unsigned int mcast_wakeupcall = dev->wireless_ap ? 2 : 0;
++ 	bool mcast_to_ucast = dev->wireless_ap;
++ 	bool hairpin;
+++	char buf[64];
++ 
++ 	if (dev->settings.flags & DEV_OPT_MULTICAST_TO_UNICAST)
++ 		mcast_to_ucast = dev->settings.multicast_to_unicast;
++@@ -939,6 +946,12 @@ system_bridge_set_wireless(struct device
++ 	system_bridge_set_multicast_to_unicast(dev, mcast_to_ucast ? "1" : "0");
++ 	system_bridge_set_hairpin_mode(dev, hairpin ? "1" : "0");
++ 	system_bridge_set_proxyarp_wifi(dev, dev->wireless_proxyarp ? "1" : "0");
+++
+++	if (bridge->settings.flags & DEV_OPT_MULTICAST_WAKEUPCALL)
+++		mcast_wakeupcall = dev->settings.multicast_wakeupcall;
+++
+++	snprintf(buf, sizeof(buf), "%u", mcast_wakeupcall);
+++	system_bridge_set_multicast_wakeupcall(dev, buf);
++ }
++ 
++ int system_bridge_addif(struct device *bridge, struct device *dev)
+diff --git a/target/linux/generic/config-6.6 b/target/linux/generic/config-6.6
+index deb58397b5cc7b3057529e30e33ddd1071a00d65..25f6b354d2380f2a6b90798e91f1e6bcffb376bc 100644
+--- a/target/linux/generic/config-6.6
++++ b/target/linux/generic/config-6.6
+@@ -716,6 +716,7 @@ CONFIG_BRIDGE=y
+ # CONFIG_BRIDGE_EBT_T_NAT is not set
+ # CONFIG_BRIDGE_EBT_VLAN is not set
+ CONFIG_BRIDGE_IGMP_SNOOPING=y
++CONFIG_BRIDGE_IGMP_SNOOPING_WAKEUPCALLS=y
+ # CONFIG_BRIDGE_MRP is not set
+ # CONFIG_BRIDGE_NETFILTER is not set
+ # CONFIG_BRIDGE_NF_EBTABLES is not set
+diff --git a/target/linux/generic/hack-6.6/602-bridge-Implement-MLD-Querier-wake-up-calls-Android-b.patch b/target/linux/generic/hack-6.6/602-bridge-Implement-MLD-Querier-wake-up-calls-Android-b.patch
+new file mode 100644
+index 0000000000000000000000000000000000000000..5a54131fab24f9cfaa9c51d51b3163bd2ecaf4c3
+--- /dev/null
++++ b/target/linux/generic/hack-6.6/602-bridge-Implement-MLD-Querier-wake-up-calls-Android-b.patch
+@@ -0,0 +1,690 @@
++From 9734fac17903cc0c67c63361525cc99f793fd6d7 Mon Sep 17 00:00:00 2001
++From: =?UTF-8?q?Linus=20L=C3=BCssing?= <linus.luessing@c0d3.blue>
++Date: Mon, 29 Jun 2020 19:04:05 +0200
++Subject: [PATCH] bridge: Implement MLD Querier wake-up calls / Android bug
++ workaround
++MIME-Version: 1.0
++Content-Type: text/plain; charset=UTF-8
++Content-Transfer-Encoding: 8bit
++
++Implement a configurable MLD Querier wake-up calls "feature" which
++works around a widely spread Android bug in connection with IGMP/MLD
++snooping.
++
++Currently there are mobile devices (e.g. Android) which are not able
++to receive and respond to MLD Queries reliably because the Wifi driver
++filters a lot of ICMPv6 when the device is asleep - including
++MLD. This in turn breaks IPv6 communication when MLD Snooping is
++enabled. However there is one ICMPv6 type which is allowed to pass and
++which can be used to wake up the mobile device: ICMPv6 Echo Requests.
++
++If this bridge is the selected MLD Querier then setting
++"multicast_wakeupcall" to a number n greater than 0 will send n
++ICMPv6 Echo Requests to each host behind this port to wake
++them up with each MLD Query. Upon receiving a matching ICMPv6 Echo
++Reply an MLD Query with a unicast ethernet destination will be sent
++to the specific host(s).
++
++Link: https://issuetracker.google.com/issues/149630944
++Link: https://github.com/freifunk-gluon/gluon/issues/1832
++
++Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
++---
++ include/linux/if_bridge.h    |   1 +
++ include/net/addrconf.h       |   1 +
++ include/uapi/linux/if_link.h |   1 +
++ net/bridge/Kconfig           |  26 ++++
++ net/bridge/br_fdb.c          |  10 ++
++ net/bridge/br_input.c        |   4 +-
++ net/bridge/br_multicast.c    | 291 ++++++++++++++++++++++++++++++++++-
++ net/bridge/br_netlink.c      |  19 +++
++ net/bridge/br_private.h      |  20 +++
++ net/bridge/br_sysfs_if.c     |  18 +++
++ net/core/rtnetlink.c         |   2 +-
++ net/ipv6/mcast_snoop.c       |   3 +-
++ 12 files changed, 386 insertions(+), 10 deletions(-)
++
++diff --git a/include/linux/if_bridge.h b/include/linux/if_bridge.h
++index cff03a1dfd68..70b6f74653d0 100644
++--- a/include/linux/if_bridge.h
+++++ b/include/linux/if_bridge.h
++@@ -62,6 +62,7 @@ struct br_ip_list {
++ #define BR_PORT_MAB		BIT(22)
++ #define BR_NEIGH_VLAN_SUPPRESS	BIT(23)
++ #define BR_BPDU_FILTER		BIT(24)
+++#define BR_MULTICAST_WAKEUPCALL	BIT(25)
++ 
++ #define BR_DEFAULT_AGEING_TIME	(300 * HZ)
++ 
++diff --git a/include/net/addrconf.h b/include/net/addrconf.h
++index facb7a469efa..817a33d1c055 100644
++--- a/include/net/addrconf.h
+++++ b/include/net/addrconf.h
++@@ -243,6 +243,7 @@ void ipv6_mc_unmap(struct inet6_dev *idev);
++ void ipv6_mc_remap(struct inet6_dev *idev);
++ void ipv6_mc_init_dev(struct inet6_dev *idev);
++ void ipv6_mc_destroy_dev(struct inet6_dev *idev);
+++int ipv6_mc_check_icmpv6(struct sk_buff *skb);
++ int ipv6_mc_check_mld(struct sk_buff *skb);
++ void addrconf_dad_failure(struct sk_buff *skb, struct inet6_ifaddr *ifp);
++ 
++diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h
++index b29417908271..88b1c8a19bb4 100644
++--- a/include/uapi/linux/if_link.h
+++++ b/include/uapi/linux/if_link.h
++@@ -572,6 +572,7 @@ enum {
++ 	IFLA_BRPORT_NEIGH_VLAN_SUPPRESS,
++ 	IFLA_BRPORT_BACKUP_NHID,
++ 	IFLA_BRPORT_BPDU_FILTER,
+++	IFLA_BRPORT_MCAST_WAKEUPCALL,
++ 	__IFLA_BRPORT_MAX
++ };
++ #define IFLA_BRPORT_MAX (__IFLA_BRPORT_MAX - 1)
++diff --git a/net/bridge/Kconfig b/net/bridge/Kconfig
++index 3c8ded7d3e84..1a11e22c7d51 100644
++--- a/net/bridge/Kconfig
+++++ b/net/bridge/Kconfig
++@@ -48,6 +48,32 @@ config BRIDGE_IGMP_SNOOPING
++ 
++ 	  If unsure, say Y.
++ 
+++config BRIDGE_IGMP_SNOOPING_WAKEUPCALLS
+++	bool "MLD Querier wake-up calls"
+++	depends on BRIDGE_IGMP_SNOOPING
+++	depends on IPV6
+++	help
+++	  If you say Y here, then the MLD Snooping Querier will be built
+++	  with a per bridge port wake-up call "feature"/workaround.
+++
+++	  Currently there are mobile devices (e.g. Android) which are not able
+++	  to receive and respond to MLD Queries reliably because the Wifi driver
+++	  filters a lot of ICMPv6 when the device is asleep - including MLD.
+++	  This in turn breaks IPv6 communication when MLD Snooping is enabled.
+++	  However there is one ICMPv6 type which is allowed to pass and
+++	  which can be used to wake up the mobile device: ICMPv6 Echo Requests.
+++
+++	  If this bridge is the selected MLD Querier then setting
+++	  "multicast_wakeupcall" to a number n greater than 0 will send n
+++	  ICMPv6 Echo Requests to each host behind this port to wake them up
+++	  with each MLD Query. Upon receiving a matching ICMPv6 Echo Reply
+++	  an MLD Query with a unicast ethernet destination will be sent to the
+++	  specific host(s).
+++
+++	  Say N to exclude this support and reduce the binary size.
+++
+++	  If unsure, say N.
+++
++ config BRIDGE_VLAN_FILTERING
++ 	bool "VLAN filtering"
++ 	depends on BRIDGE
++diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
++index a6d8cd9a5807..b70426806d45 100644
++--- a/net/bridge/br_fdb.c
+++++ b/net/bridge/br_fdb.c
++@@ -80,6 +80,10 @@ static void fdb_rcu_free(struct rcu_head *head)
++ {
++ 	struct net_bridge_fdb_entry *ent
++ 		= container_of(head, struct net_bridge_fdb_entry, rcu);
+++
+++#ifdef CONFIG_BRIDGE_IGMP_SNOOPING_WAKEUPCALLS
+++	del_timer_sync(&ent->wakeupcall_timer);
+++#endif
++ 	kmem_cache_free(br_fdb_cache, ent);
++ }
++ 
++@@ -400,6 +404,12 @@ static struct net_bridge_fdb_entry *fdb_create(struct net_bridge *br,
++ 	fdb->key.vlan_id = vid;
++ 	fdb->flags = flags;
++ 	fdb->updated = fdb->used = jiffies;
+++
+++#ifdef CONFIG_BRIDGE_IGMP_SNOOPING_WAKEUPCALLS
+++		timer_setup(&fdb->wakeupcall_timer,
+++			    br_multicast_send_wakeupcall, 0);
+++#endif
+++
++ 	err = rhashtable_lookup_insert_fast(&br->fdb_hash_tbl, &fdb->rhnode,
++ 					    br_fdb_rht_params);
++ 	if (err) {
++diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
++index 4540c76d6079..d4644aab7dbf 100644
++--- a/net/bridge/br_input.c
+++++ b/net/bridge/br_input.c
++@@ -204,8 +204,10 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb
++ 	if (dst) {
++ 		unsigned long now = jiffies;
++ 
++-		if (test_bit(BR_FDB_LOCAL, &dst->flags))
+++		if (test_bit(BR_FDB_LOCAL, &dst->flags)) {
+++			br_multicast_wakeupcall_rcv(brmctx, pmctx, skb, vid);
++ 			return br_pass_frame_up(skb, false);
+++		}
++ 
++ 		if (now != dst->used)
++ 			dst->used = now;
++diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
++index c38244d60ff8..df3a4d4dbb8f 100644
++--- a/net/bridge/br_multicast.c
+++++ b/net/bridge/br_multicast.c
++@@ -1076,15 +1076,16 @@ static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge_mcast *brm
++ 						    const struct in6_addr *group,
++ 						    bool with_srcs, bool over_llqt,
++ 						    u8 sflag, u8 *igmp_type,
++-						    bool *need_rexmit)
+++						    bool *need_rexmit,
+++						    bool delay)
++ {
++ 	struct net_bridge_port *p = pg ? pg->key.port : NULL;
++ 	struct net_bridge_group_src *ent;
++ 	size_t pkt_size, mld_hdr_size;
++ 	unsigned long now = jiffies;
+++	unsigned long interval = 0;
++ 	struct mld2_query *mld2q;
++ 	void *csum_start = NULL;
++-	unsigned long interval;
++ 	__sum16 *csum = NULL;
++ 	struct ipv6hdr *ip6h;
++ 	struct mld_msg *mldq;
++@@ -1166,9 +1167,13 @@ static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge_mcast *brm
++ 
++ 	/* ICMPv6 */
++ 	skb_set_transport_header(skb, skb->len);
++-	interval = ipv6_addr_any(group) ?
++-			brmctx->multicast_query_response_interval :
++-			brmctx->multicast_last_member_interval;
+++	if (delay) {
+++		interval = ipv6_addr_any(group) ?
+++				brmctx->multicast_query_response_interval :
+++				brmctx->multicast_last_member_interval;
+++		interval = jiffies_to_msecs(interval);
+++	}
+++
++ 	*igmp_type = ICMPV6_MGM_QUERY;
++ 	switch (brmctx->multicast_mld_version) {
++ 	case 1:
++@@ -1176,7 +1181,7 @@ static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge_mcast *brm
++ 		mldq->mld_type = ICMPV6_MGM_QUERY;
++ 		mldq->mld_code = 0;
++ 		mldq->mld_cksum = 0;
++-		mldq->mld_maxdelay = htons((u16)jiffies_to_msecs(interval));
+++		mldq->mld_maxdelay = htons((u16)interval);
++ 		mldq->mld_reserved = 0;
++ 		mldq->mld_mca = *group;
++ 		csum = &mldq->mld_cksum;
++@@ -1267,7 +1272,7 @@ static struct sk_buff *br_multicast_alloc_query(struct net_bridge_mcast *brmctx,
++ 						    &ip6_dst, &group->dst.ip6,
++ 						    with_srcs, over_lmqt,
++ 						    sflag, igmp_type,
++-						    need_rexmit);
+++						    need_rexmit, true);
++ 	}
++ #endif
++ 	}
++@@ -1777,6 +1782,169 @@ static void br_multicast_select_own_querier(struct net_bridge_mcast *brmctx,
++ #endif
++ }
++ 
+++#ifdef CONFIG_BRIDGE_IGMP_SNOOPING_WAKEUPCALLS
+++
+++#define BR_MC_WAKEUP_ID htons(0xEC6B) /* random identifier */
+++#define BR_MC_ETH_ZERO { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }
+++#define BR_MC_IN6_ZERO \
+++{ \
+++	.s6_addr32[0] = 0, .s6_addr32[1] = 0, \
+++	.s6_addr32[2] = 0, .s6_addr32[3] = 0, \
+++}
+++
+++#define BR_MC_IN6_FE80 \
+++{ \
+++	.s6_addr32[0] = htonl(0xfe800000), \
+++	.s6_addr32[1] = 0, \
+++	.s6_addr32[2] = htonl(0x000000ff), \
+++	.s6_addr32[3] = htonl(0xfe000000), \
+++}
+++
+++#define BR_MC_ECHO_LEN sizeof(pkt->echohdr)
+++
+++static struct sk_buff *br_multicast_alloc_wakeupcall(struct net_bridge *br,
+++						     struct net_bridge_port *port,
+++						     u8 *eth_dst)
+++{
+++	struct in6_addr ip6_src, ip6_dst = BR_MC_IN6_FE80;
+++	struct sk_buff *skb;
+++	__wsum csum_part;
+++	__sum16 csum;
+++
+++	struct wakeupcall_pkt {
+++		struct ethhdr ethhdr;
+++		struct ipv6hdr ip6hdr;
+++		struct icmp6hdr echohdr;
+++	} __packed;
+++
+++	struct wakeupcall_pkt *pkt;
+++
+++	static const struct wakeupcall_pkt __pkt_template = {
+++		.ethhdr = {
+++			.h_dest = BR_MC_ETH_ZERO, // update
+++			.h_source = BR_MC_ETH_ZERO, // update
+++			.h_proto = htons(ETH_P_IPV6),
+++		},
+++		.ip6hdr = {
+++			.priority = 0,
+++			.version = 0x6,
+++			.flow_lbl = { 0x00, 0x00, 0x00 },
+++			.payload_len = htons(BR_MC_ECHO_LEN),
+++			.nexthdr = IPPROTO_ICMPV6,
+++			.hop_limit = 1,
+++			.saddr = BR_MC_IN6_ZERO, // update
+++			.daddr = BR_MC_IN6_ZERO, // update
+++		},
+++		.echohdr = {
+++			.icmp6_type = ICMPV6_ECHO_REQUEST,
+++			.icmp6_code = 0,
+++			.icmp6_cksum = 0, // update
+++			.icmp6_dataun.u_echo = {
+++				.identifier = BR_MC_WAKEUP_ID,
+++				.sequence = 0,
+++			},
+++		},
+++	};
+++
+++	memcpy(&ip6_dst.s6_addr32[2], &eth_dst[0], ETH_ALEN / 2);
+++	memcpy(&ip6_dst.s6_addr[13], &eth_dst[3], ETH_ALEN / 2);
+++	ip6_dst.s6_addr[8] ^= 0x02;
+++	if (ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6_dst, 0,
+++			       &ip6_src))
+++		return NULL;
+++
+++	skb = netdev_alloc_skb_ip_align(br->dev, sizeof(*pkt));
+++	if (!skb)
+++		return NULL;
+++
+++	skb->protocol = htons(ETH_P_IPV6);
+++	skb->dev = port->dev;
+++
+++	pkt = (struct wakeupcall_pkt *)skb->data;
+++	*pkt = __pkt_template;
+++
+++	ether_addr_copy(pkt->ethhdr.h_source, br->dev->dev_addr);
+++	ether_addr_copy(pkt->ethhdr.h_dest, eth_dst);
+++
+++	pkt->ip6hdr.saddr = ip6_src;
+++	pkt->ip6hdr.daddr = ip6_dst;
+++
+++	csum_part = csum_partial(&pkt->echohdr, sizeof(pkt->echohdr), 0);
+++	csum = csum_ipv6_magic(&ip6_src, &ip6_dst, sizeof(pkt->echohdr),
+++			       IPPROTO_ICMPV6, csum_part);
+++	pkt->echohdr.icmp6_cksum = csum;
+++
+++	skb_reset_mac_header(skb);
+++	skb_set_network_header(skb, offsetof(struct wakeupcall_pkt, ip6hdr));
+++	skb_set_transport_header(skb, offsetof(struct wakeupcall_pkt, echohdr));
+++	skb_put(skb, sizeof(*pkt));
+++	__skb_pull(skb, sizeof(pkt->ethhdr));
+++
+++	return skb;
+++}
+++
+++void br_multicast_send_wakeupcall(struct timer_list *t)
+++{
+++	struct net_bridge_fdb_entry *fdb = from_timer(fdb, t, wakeupcall_timer);
+++	struct net_bridge_port *port = fdb->dst;
+++	struct net_bridge *br = port->br;
+++	struct sk_buff *skb, *skb0;
+++	int i;
+++
+++	skb0 = br_multicast_alloc_wakeupcall(br, port, fdb->key.addr.addr);
+++	if (!skb0)
+++		return;
+++
+++	for (i = port->wakeupcall_num_rings; i > 0; i--) {
+++		if (i > 1) {
+++			skb = skb_clone(skb0, GFP_ATOMIC);
+++			if (!skb) {
+++				kfree_skb(skb0);
+++				break;
+++			}
+++		} else {
+++			skb = skb0;
+++		}
+++
+++		NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT,
+++			dev_net(port->dev), NULL, skb, NULL, skb->dev,
+++			br_dev_queue_push_xmit);
+++	}
+++}
+++
+++static void
+++br_multicast_schedule_wakeupcalls(struct net_bridge_mcast *brmctx,
+++				  struct net_bridge_mcast_port *pmctx,
+++				  const struct in6_addr *group)
+++{
+++	struct net_bridge_fdb_entry *fdb;
+++	unsigned long delay;
+++
+++	rcu_read_lock();
+++	hlist_for_each_entry_rcu(fdb, &brmctx->br->fdb_list, fdb_node) {
+++		if (!fdb->dst || fdb->dst->dev != pmctx->port->dev)
+++			continue;
+++
+++		/* Wake-up calls to VLANs unsupported for now */
+++		if (fdb->key.vlan_id)
+++			continue;
+++
+++		/* Spread the ICMPv6 Echo Requests to avoid congestion.
+++		 * We then won't use a max response delay for the queries later,
+++		 * as that would be redundant. Spread randomly by a little less
+++		 * than max response delay to anticipate the extra round trip.
+++		 */
+++		delay =	ipv6_addr_any(group) ?
+++				brmctx->multicast_query_response_interval :
+++				brmctx->multicast_last_member_interval;
+++		delay = get_random_u32_below(3 * delay / 4);
+++
+++		timer_reduce(&fdb->wakeupcall_timer, jiffies + delay);
+++	}
+++	rcu_read_unlock();
+++}
+++#endif /* CONFIG_BRIDGE_IGMP_SNOOPING_WAKEUPCALLS */
+++
++ static void __br_multicast_send_query(struct net_bridge_mcast *brmctx,
++ 				      struct net_bridge_mcast_port *pmctx,
++ 				      struct net_bridge_port_group *pg,
++@@ -1809,6 +1977,13 @@ static void __br_multicast_send_query(struct net_bridge_mcast *brmctx,
++ 			dev_net(pmctx->port->dev), NULL, skb, NULL, skb->dev,
++ 			br_dev_queue_push_xmit);
++ 
+++#ifdef CONFIG_BRIDGE_IGMP_SNOOPING_WAKEUPCALLS
+++		if (pmctx->port->wakeupcall_num_rings &&
+++		    group->proto == htons(ETH_P_IPV6))
+++			br_multicast_schedule_wakeupcalls(brmctx, pmctx,
+++							  &group->dst.ip6);
+++#endif
+++
++ 		if (over_lmqt && with_srcs && sflag) {
++ 			over_lmqt = false;
++ 			goto again_under_lmqt;
++@@ -3976,6 +4151,99 @@ int br_multicast_rcv(struct net_bridge_mcast **brmctx,
++ 	return ret;
++ }
++ 
+++#ifdef CONFIG_BRIDGE_IGMP_SNOOPING_WAKEUPCALLS
+++
+++static bool br_multicast_wakeupcall_check(struct net_bridge *br,
+++					  struct net_bridge_port *port,
+++					  struct sk_buff *skb, u16 vid)
+++{
+++	struct ethhdr *eth = eth_hdr(skb);
+++	const struct ipv6hdr *ip6h;
+++	unsigned int offset, len;
+++	struct icmp6hdr *icmp6h;
+++
+++	/* Wake-up calls to VLANs unsupported for now */
+++	if (!port->wakeupcall_num_rings || vid ||
+++	    eth->h_proto != htons(ETH_P_IPV6))
+++		return false;
+++
+++	if (!ether_addr_equal(eth->h_dest, br->dev->dev_addr) ||
+++	    is_multicast_ether_addr(eth->h_source) ||
+++	    is_zero_ether_addr(eth->h_source))
+++		return false;
+++
+++	offset = skb_network_offset(skb) + sizeof(*ip6h);
+++	if (!pskb_may_pull(skb, offset))
+++		return false;
+++
+++	ip6h = ipv6_hdr(skb);
+++
+++	if (ip6h->version != 6)
+++		return false;
+++
+++	len = offset + ntohs(ip6h->payload_len);
+++	if (skb->len < len || len <= offset)
+++		return false;
+++
+++	if (ip6h->nexthdr != IPPROTO_ICMPV6)
+++		return false;
+++
+++	skb_set_transport_header(skb, offset);
+++
+++	if (ipv6_mc_check_icmpv6(skb) < 0)
+++		return false;
+++
+++	icmp6h = (struct icmp6hdr *)skb_transport_header(skb);
+++	if (icmp6h->icmp6_type != ICMPV6_ECHO_REPLY ||
+++	    icmp6h->icmp6_dataun.u_echo.identifier != BR_MC_WAKEUP_ID)
+++		return false;
+++
+++	return true;
+++}
+++
+++static void br_multicast_wakeupcall_send_mldq(struct net_bridge_mcast *brmctx,
+++					      struct net_bridge_mcast_port *pmctx,
+++					      const u8 *eth_dst)
+++{
+++	const struct in6_addr group = BR_MC_IN6_ZERO;
+++	struct in6_addr ip6_dst;
+++	struct sk_buff *skb;
+++	u8 igmp_type;
+++
+++	/* we might have been triggered by multicast-address-specific query
+++	 * but reply with a general MLD query for now to keep things simple
+++	 */
+++	ipv6_addr_set(&ip6_dst, htonl(0xff020000), 0, 0, htonl(1));
+++
+++	skb = br_ip6_multicast_alloc_query(brmctx, pmctx, NULL, &ip6_dst,
+++					   &group, false, false, false,
+++					   &igmp_type, NULL, false);
+++	if (!skb)
+++		return;
+++
+++	skb->dev = pmctx->port->dev;
+++	ether_addr_copy(eth_hdr(skb)->h_dest, eth_dst);
+++
+++	br_multicast_count(brmctx->br, pmctx->port, skb, igmp_type,
+++			   BR_MCAST_DIR_TX);
+++	NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT,
+++		dev_net(pmctx->port->dev), NULL, skb, NULL, skb->dev,
+++		br_dev_queue_push_xmit);
+++}
+++
+++void br_multicast_wakeupcall_rcv(struct net_bridge_mcast *brmctx,
+++				 struct net_bridge_mcast_port *pmctx,
+++				 struct sk_buff *skb, u16 vid)
+++{
+++	if (!br_multicast_wakeupcall_check(brmctx->br, pmctx->port, skb, vid))
+++		return;
+++
+++	br_multicast_wakeupcall_send_mldq(brmctx, pmctx,
+++					  eth_hdr(skb)->h_source);
+++}
+++
+++#endif /* CONFIG_BRIDGE_IGMP_SNOOPING_WAKEUPCALLS */
+++
++ static void br_multicast_query_expired(struct net_bridge_mcast *brmctx,
++ 				       struct bridge_mcast_own_query *query,
++ 				       struct bridge_mcast_querier *querier)
++@@ -4504,6 +4772,15 @@ int br_multicast_set_vlan_router(struct net_bridge_vlan *v, u8 mcast_router)
++ 	return err;
++ }
++ 
+++int br_multicast_set_wakeupcall(struct net_bridge_port *p, unsigned long val)
+++{
+++	if (val > U8_MAX)
+++		return -EINVAL;
+++
+++	p->wakeupcall_num_rings = val;
+++	return 0;
+++}
+++
++ static void br_multicast_start_querier(struct net_bridge_mcast *brmctx,
++ 				       struct bridge_mcast_own_query *query)
++ {
++diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
++index a760d5a5ad12..8fdabad8e10a 100644
++--- a/net/bridge/br_netlink.c
+++++ b/net/bridge/br_netlink.c
++@@ -206,6 +206,9 @@ static inline size_t br_port_info_size(void)
++ 		+ nla_total_size(sizeof(u8))	/* IFLA_BRPORT_MULTICAST_ROUTER */
++ 		+ nla_total_size(sizeof(u32))	/* IFLA_BRPORT_MCAST_N_GROUPS */
++ 		+ nla_total_size(sizeof(u32))	/* IFLA_BRPORT_MCAST_MAX_GROUPS */
+++#endif
+++#ifdef CONFIG_BRIDGE_IGMP_SNOOPING_WAKEUPCALLS
+++		+ nla_total_size(sizeof(u8))	/* IFLA_BRPORT_MCAST_WAKEUPCALL */
++ #endif
++ 		+ nla_total_size(sizeof(u16))	/* IFLA_BRPORT_GROUP_FWD_MASK */
++ 		+ nla_total_size(sizeof(u8))	/* IFLA_BRPORT_MRP_RING_OPEN */
++@@ -313,6 +316,11 @@ static int br_port_fill_attrs(struct sk_buff *skb,
++ 			br_multicast_ngroups_get_max(&p->multicast_ctx)))
++ 		return -EMSGSIZE;
++ #endif
+++#ifdef CONFIG_BRIDGE_IGMP_SNOOPING_WAKEUPCALLS
+++	if (nla_put_u8(skb, IFLA_BRPORT_MCAST_WAKEUPCALL,
+++		       p->wakeupcall_num_rings))
+++		return -EMSGSIZE;
+++#endif
++ 
++ 	/* we might be called only with br->lock */
++ 	rcu_read_lock();
++@@ -890,6 +898,7 @@ static const struct nla_policy br_port_policy[IFLA_BRPORT_MAX + 1] = {
++ 	[IFLA_BRPORT_PROXYARP_WIFI] = { .type = NLA_U8 },
++ 	[IFLA_BRPORT_MULTICAST_ROUTER] = { .type = NLA_U8 },
++ 	[IFLA_BRPORT_MCAST_TO_UCAST] = { .type = NLA_U8 },
+++	[IFLA_BRPORT_MCAST_WAKEUPCALL] = { .type = NLA_U8 },
++ 	[IFLA_BRPORT_MCAST_FLOOD] = { .type = NLA_U8 },
++ 	[IFLA_BRPORT_BCAST_FLOOD] = { .type = NLA_U8 },
++ 	[IFLA_BRPORT_VLAN_TUNNEL] = { .type = NLA_U8 },
++@@ -1051,6 +1060,16 @@ static int br_setport(struct net_bridge_port *p, struct nlattr *tb[],
++ 	}
++ #endif
++ 
+++#ifdef CONFIG_BRIDGE_IGMP_SNOOPING_WAKEUPCALLS
+++	if (tb[IFLA_BRPORT_MCAST_WAKEUPCALL]) {
+++		u8 wakeupcall = nla_get_u8(tb[IFLA_BRPORT_MCAST_WAKEUPCALL]);
+++
+++		err = br_multicast_set_wakeupcall(p, wakeupcall);
+++		if (err)
+++			return err;
+++	}
+++#endif
+++
++ 	if (tb[IFLA_BRPORT_GROUP_FWD_MASK]) {
++ 		u16 fwd_mask = nla_get_u16(tb[IFLA_BRPORT_GROUP_FWD_MASK]);
++ 
++diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
++index 72d80fd943a8..b237c39edd35 100644
++--- a/net/bridge/br_private.h
+++++ b/net/bridge/br_private.h
++@@ -294,6 +294,10 @@ struct net_bridge_fdb_entry {
++ 	unsigned long			used;
++ 
++ 	struct rcu_head			rcu;
+++
+++#ifdef CONFIG_BRIDGE_IGMP_SNOOPING_WAKEUPCALLS
+++	struct timer_list		wakeupcall_timer;
+++#endif
++ };
++ 
++ struct net_bridge_fdb_flush_desc {
++@@ -417,6 +421,7 @@ struct net_bridge_port {
++ 	u32				multicast_eht_hosts_limit;
++ 	u32				multicast_eht_hosts_cnt;
++ 	struct hlist_head		mglist;
+++	u8				wakeupcall_num_rings;
++ #endif
++ 
++ #ifdef CONFIG_SYSFS
++@@ -1504,6 +1509,21 @@ br_multicast_ctx_options_equal(const struct net_bridge_mcast *brmctx1,
++ }
++ #endif
++ 
+++#ifdef CONFIG_BRIDGE_IGMP_SNOOPING_WAKEUPCALLS
+++void br_multicast_wakeupcall_rcv(struct net_bridge_mcast *brmctx,
+++				 struct net_bridge_mcast_port *pmctx,
+++				 struct sk_buff *skb, u16 vid);
+++void br_multicast_send_wakeupcall(struct timer_list *t);
+++int br_multicast_set_wakeupcall(struct net_bridge_port *p, unsigned long val);
+++#else
+++static inline void
+++br_multicast_wakeupcall_rcv(struct net_bridge_mcast *brmctx,
+++			    struct net_bridge_mcast_port *pmctx,
+++			    struct sk_buff *skb, u16 vid)
+++{
+++}
+++#endif /* CONFIG_BRIDGE_IGMP_SNOOPING_WAKEUPCALLS */
+++
++ /* br_vlan.c */
++ #ifdef CONFIG_BRIDGE_VLAN_FILTERING
++ bool br_allowed_ingress(const struct net_bridge *br,
++diff --git a/net/bridge/br_sysfs_if.c b/net/bridge/br_sysfs_if.c
++index aee7c5902206..15ee27e1aa72 100644
++--- a/net/bridge/br_sysfs_if.c
+++++ b/net/bridge/br_sysfs_if.c
++@@ -260,6 +260,21 @@ BRPORT_ATTR_FLAG(multicast_fast_leave, BR_MULTICAST_FAST_LEAVE);
++ BRPORT_ATTR_FLAG(multicast_to_unicast, BR_MULTICAST_TO_UNICAST);
++ #endif
++ 
+++#ifdef CONFIG_BRIDGE_IGMP_SNOOPING_WAKEUPCALLS
+++static ssize_t show_multicast_wakeupcall(struct net_bridge_port *p, char *buf)
+++{
+++	return sprintf(buf, "%d\n", p->wakeupcall_num_rings);
+++}
+++
+++static int store_multicast_wakeupcall(struct net_bridge_port *p,
+++				      unsigned long v)
+++{
+++	return br_multicast_set_wakeupcall(p, v);
+++}
+++static BRPORT_ATTR(multicast_wakeupcall, 0644, show_multicast_wakeupcall,
+++		   store_multicast_wakeupcall);
+++#endif
+++
++ static const struct brport_attribute *brport_attrs[] = {
++ 	&brport_attr_path_cost,
++ 	&brport_attr_priority,
++@@ -285,6 +300,9 @@ static const struct brport_attribute *brport_attrs[] = {
++ 	&brport_attr_multicast_router,
++ 	&brport_attr_multicast_fast_leave,
++ 	&brport_attr_multicast_to_unicast,
+++#endif
+++#ifdef CONFIG_BRIDGE_IGMP_SNOOPING_WAKEUPCALLS
+++	&brport_attr_multicast_wakeupcall,
++ #endif
++ 	&brport_attr_proxyarp,
++ 	&brport_attr_proxyarp_wifi,
++diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
++index 71797d44af4c..abe17f8c4939 100644
++--- a/net/core/rtnetlink.c
+++++ b/net/core/rtnetlink.c
++@@ -61,7 +61,7 @@
++ #include "dev.h"
++ 
++ #define RTNL_MAX_TYPE		50
++-#define RTNL_SLAVE_MAX_TYPE	45
+++#define RTNL_SLAVE_MAX_TYPE	46
++ 
++ struct rtnl_link {
++ 	rtnl_doit_func		doit;
++diff --git a/net/ipv6/mcast_snoop.c b/net/ipv6/mcast_snoop.c
++index 04d5fcdfa6e0..9a5061edbaf3 100644
++--- a/net/ipv6/mcast_snoop.c
+++++ b/net/ipv6/mcast_snoop.c
++@@ -131,7 +131,7 @@ static inline __sum16 ipv6_mc_validate_checksum(struct sk_buff *skb)
++ 	return skb_checksum_validate(skb, IPPROTO_ICMPV6, ip6_compute_pseudo);
++ }
++ 
++-static int ipv6_mc_check_icmpv6(struct sk_buff *skb)
+++int ipv6_mc_check_icmpv6(struct sk_buff *skb)
++ {
++ 	unsigned int len = skb_transport_offset(skb) + sizeof(struct icmp6hdr);
++ 	unsigned int transport_len = ipv6_transport_len(skb);
++@@ -150,6 +150,7 @@ static int ipv6_mc_check_icmpv6(struct sk_buff *skb)
++ 
++ 	return 0;
++ }
+++EXPORT_SYMBOL(ipv6_mc_check_icmpv6);
++ 
++ /**
++  * ipv6_mc_check_mld - checks whether this is a sane MLD packet
++-- 
++2.45.2
++

patches/openwrt/0005-kernel-ebtables-add-support-for-ICMP-IGMP-type-matches.patch

-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Thu, 12 Apr 2018 07:50:02 +0200
-Subject: kernel: ebtables: add support for ICMP/IGMP type matches
-
-Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
-
-diff --git a/target/linux/generic/backport-4.14/096-0001-ebtables-add-support-for-matching-ICMP-type-and-code.patch b/target/linux/generic/backport-4.14/096-0001-ebtables-add-support-for-matching-ICMP-type-and-code.patch
-new file mode 100644
-index 0000000000000000000000000000000000000000..fe9c479338a7b597be649c761c70a63085b51c5f
---- /dev/null
-+++ b/target/linux/generic/backport-4.14/096-0001-ebtables-add-support-for-matching-ICMP-type-and-code.patch
-@@ -0,0 +1,134 @@
-+From: Matthias Schiffer <mschiffer@universe-factory.net>
-+Date: Sat, 3 Mar 2018 11:55:21 +0100
-+Subject: [PATCH 1/2] ebtables: add support for matching ICMP type and code
-+
-+We already have ICMPv6 type/code matches. This adds support for IPv4 ICMP
-+matches in the same way.
-+
-+Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
-+---
-+ include/uapi/linux/netfilter_bridge/ebt_ip.h | 13 +++++++--
-+ net/bridge/netfilter/ebt_ip.c                | 43 +++++++++++++++++++++-------
-+ 2 files changed, 43 insertions(+), 13 deletions(-)
-+
-+--- a/include/uapi/linux/netfilter_bridge/ebt_ip.h
-++++ b/include/uapi/linux/netfilter_bridge/ebt_ip.h
-+@@ -24,8 +24,9 @@
-+ #define EBT_IP_PROTO 0x08
-+ #define EBT_IP_SPORT 0x10
-+ #define EBT_IP_DPORT 0x20
-++#define EBT_IP_ICMP 0x40
-+ #define EBT_IP_MASK (EBT_IP_SOURCE | EBT_IP_DEST | EBT_IP_TOS | EBT_IP_PROTO |\
-+- EBT_IP_SPORT | EBT_IP_DPORT )
-++		     EBT_IP_SPORT | EBT_IP_DPORT | EBT_IP_ICMP)
-+ #define EBT_IP_MATCH "ip"
-+ 
-+ /* the same values are used for the invflags */
-+@@ -38,8 +39,14 @@ struct ebt_ip_info {
-+ 	__u8  protocol;
-+ 	__u8  bitmask;
-+ 	__u8  invflags;
-+-	__u16 sport[2];
-+-	__u16 dport[2];
-++	union {
-++		__u16 sport[2];
-++		__u8 icmp_type[2];
-++	};
-++	union {
-++		__u16 dport[2];
-++		__u8 icmp_code[2];
-++	};
-+ };
-+ 
-+ #endif
-+--- a/net/bridge/netfilter/ebt_ip.c
-++++ b/net/bridge/netfilter/ebt_ip.c
-+@@ -19,9 +19,15 @@
-+ #include <linux/netfilter_bridge/ebtables.h>
-+ #include <linux/netfilter_bridge/ebt_ip.h>
-+ 
-+-struct tcpudphdr {
-+-	__be16 src;
-+-	__be16 dst;
-++union pkthdr {
-++	struct {
-++		__be16 src;
-++		__be16 dst;
-++	} tcpudphdr;
-++	struct {
-++		u8 type;
-++		u8 code;
-++	} icmphdr;
-+ };
-+ 
-+ static bool
-+@@ -30,8 +36,8 @@ ebt_ip_mt(const struct sk_buff *skb, str
-+ 	const struct ebt_ip_info *info = par->matchinfo;
-+ 	const struct iphdr *ih;
-+ 	struct iphdr _iph;
-+-	const struct tcpudphdr *pptr;
-+-	struct tcpudphdr _ports;
-++	const union pkthdr *pptr;
-++	union pkthdr _pkthdr;
-+ 
-+ 	ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph);
-+ 	if (ih == NULL)
-+@@ -50,29 +56,38 @@ ebt_ip_mt(const struct sk_buff *skb, str
-+ 	if (info->bitmask & EBT_IP_PROTO) {
-+ 		if (NF_INVF(info, EBT_IP_PROTO, info->protocol != ih->protocol))
-+ 			return false;
-+-		if (!(info->bitmask & EBT_IP_DPORT) &&
-+-		    !(info->bitmask & EBT_IP_SPORT))
-++		if (!(info->bitmask & (EBT_IP_DPORT | EBT_IP_SPORT |
-++				       EBT_IP_ICMP)))
-+ 			return true;
-+ 		if (ntohs(ih->frag_off) & IP_OFFSET)
-+ 			return false;
-++
-++		/* min icmp headersize is 4, so sizeof(_pkthdr) is ok. */
-+ 		pptr = skb_header_pointer(skb, ih->ihl*4,
-+-					  sizeof(_ports), &_ports);
-++					  sizeof(_pkthdr), &_pkthdr);
-+ 		if (pptr == NULL)
-+ 			return false;
-+ 		if (info->bitmask & EBT_IP_DPORT) {
-+-			u32 dst = ntohs(pptr->dst);
-++			u32 dst = ntohs(pptr->tcpudphdr.dst);
-+ 			if (NF_INVF(info, EBT_IP_DPORT,
-+ 				    dst < info->dport[0] ||
-+ 				    dst > info->dport[1]))
-+ 				return false;
-+ 		}
-+ 		if (info->bitmask & EBT_IP_SPORT) {
-+-			u32 src = ntohs(pptr->src);
-++			u32 src = ntohs(pptr->tcpudphdr.src);
-+ 			if (NF_INVF(info, EBT_IP_SPORT,
-+ 				    src < info->sport[0] ||
-+ 				    src > info->sport[1]))
-+ 				return false;
-+ 		}
-++		if ((info->bitmask & EBT_IP_ICMP) &&
-++		    NF_INVF(info, EBT_IP_ICMP,
-++			    pptr->icmphdr.type < info->icmp_type[0] ||
-++			    pptr->icmphdr.type > info->icmp_type[1] ||
-++			    pptr->icmphdr.code < info->icmp_code[0] ||
-++			    pptr->icmphdr.code > info->icmp_code[1]))
-++			return false;
-+ 	}
-+ 	return true;
-+ }
-+@@ -101,6 +116,14 @@ static int ebt_ip_mt_check(const struct
-+ 		return -EINVAL;
-+ 	if (info->bitmask & EBT_IP_SPORT && info->sport[0] > info->sport[1])
-+ 		return -EINVAL;
-++	if (info->bitmask & EBT_IP_ICMP) {
-++		if ((info->invflags & EBT_IP_PROTO) ||
-++		    info->protocol != IPPROTO_ICMP)
-++			return -EINVAL;
-++		if (info->icmp_type[0] > info->icmp_type[1] ||
-++		    info->icmp_code[0] > info->icmp_code[1])
-++			return -EINVAL;
-++	}
-+ 	return 0;
-+ }
-+ 
-diff --git a/target/linux/generic/backport-4.14/096-0002-ebtables-add-support-for-matching-IGMP-type.patch b/target/linux/generic/backport-4.14/096-0002-ebtables-add-support-for-matching-IGMP-type.patch
-new file mode 100644
-index 0000000000000000000000000000000000000000..4c8144834d87c58ff90363cdc2f2933194e54fdc
---- /dev/null
-+++ b/target/linux/generic/backport-4.14/096-0002-ebtables-add-support-for-matching-IGMP-type.patch
-@@ -0,0 +1,88 @@
-+From: Matthias Schiffer <mschiffer@universe-factory.net>
-+Date: Sat, 3 Mar 2018 12:02:21 +0100
-+Subject: [PATCH 2/2] ebtables: add support for matching IGMP type
-+
-+We already have ICMPv6 type/code matches (which can be used to distinguish
-+different types of MLD packets). Add support for IPv4 IGMP matches in the
-+same way.
-+
-+Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
-+---
-+ include/uapi/linux/netfilter_bridge/ebt_ip.h |  4 +++-
-+ net/bridge/netfilter/ebt_ip.c                | 19 +++++++++++++++++--
-+ 2 files changed, 20 insertions(+), 3 deletions(-)
-+
-+--- a/include/uapi/linux/netfilter_bridge/ebt_ip.h
-++++ b/include/uapi/linux/netfilter_bridge/ebt_ip.h
-+@@ -25,8 +25,9 @@
-+ #define EBT_IP_SPORT 0x10
-+ #define EBT_IP_DPORT 0x20
-+ #define EBT_IP_ICMP 0x40
-++#define EBT_IP_IGMP 0x80
-+ #define EBT_IP_MASK (EBT_IP_SOURCE | EBT_IP_DEST | EBT_IP_TOS | EBT_IP_PROTO |\
-+-		     EBT_IP_SPORT | EBT_IP_DPORT | EBT_IP_ICMP)
-++		     EBT_IP_SPORT | EBT_IP_DPORT | EBT_IP_ICMP | EBT_IP_IGMP)
-+ #define EBT_IP_MATCH "ip"
-+ 
-+ /* the same values are used for the invflags */
-+@@ -42,6 +43,7 @@ struct ebt_ip_info {
-+ 	union {
-+ 		__u16 sport[2];
-+ 		__u8 icmp_type[2];
-++		__u8 igmp_type[2];
-+ 	};
-+ 	union {
-+ 		__u16 dport[2];
-+--- a/net/bridge/netfilter/ebt_ip.c
-++++ b/net/bridge/netfilter/ebt_ip.c
-+@@ -28,6 +28,9 @@ union pkthdr {
-+ 		u8 type;
-+ 		u8 code;
-+ 	} icmphdr;
-++	struct {
-++		u8 type;
-++	} igmphdr;
-+ };
-+ 
-+ static bool
-+@@ -57,12 +60,12 @@ ebt_ip_mt(const struct sk_buff *skb, str
-+ 		if (NF_INVF(info, EBT_IP_PROTO, info->protocol != ih->protocol))
-+ 			return false;
-+ 		if (!(info->bitmask & (EBT_IP_DPORT | EBT_IP_SPORT |
-+-				       EBT_IP_ICMP)))
-++				       EBT_IP_ICMP | EBT_IP_IGMP)))
-+ 			return true;
-+ 		if (ntohs(ih->frag_off) & IP_OFFSET)
-+ 			return false;
-+ 
-+-		/* min icmp headersize is 4, so sizeof(_pkthdr) is ok. */
-++		/* min icmp/igmp headersize is 4, so sizeof(_pkthdr) is ok. */
-+ 		pptr = skb_header_pointer(skb, ih->ihl*4,
-+ 					  sizeof(_pkthdr), &_pkthdr);
-+ 		if (pptr == NULL)
-+@@ -88,6 +91,11 @@ ebt_ip_mt(const struct sk_buff *skb, str
-+ 			    pptr->icmphdr.code < info->icmp_code[0] ||
-+ 			    pptr->icmphdr.code > info->icmp_code[1]))
-+ 			return false;
-++		if ((info->bitmask & EBT_IP_IGMP) &&
-++		    NF_INVF(info, EBT_IP_IGMP,
-++			    pptr->igmphdr.type < info->igmp_type[0] ||
-++			    pptr->igmphdr.type > info->igmp_type[1]))
-++			return false;
-+ 	}
-+ 	return true;
-+ }
-+@@ -124,6 +132,13 @@ static int ebt_ip_mt_check(const struct
-+ 		    info->icmp_code[0] > info->icmp_code[1])
-+ 			return -EINVAL;
-+ 	}
-++	if (info->bitmask & EBT_IP_IGMP) {
-++		if ((info->invflags & EBT_IP_PROTO) ||
-++		    info->protocol != IPPROTO_IGMP)
-++			return -EINVAL;
-++		if (info->igmp_type[0] > info->igmp_type[1])
-++			return -EINVAL;
-++	}
-+ 	return 0;
-+ }
-+ 

patches/openwrt/0006-build-set-TARGET_ROOTFS_PARTSIZE-to-make-combined-image-fit-in-128MB.patch

-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Sat, 21 Sep 2019 13:21:36 +0200
-Subject: build: set TARGET_ROOTFS_PARTSIZE to make combined image fit in 128MB
-
-Change TARGET_ROOTFS_PARTSIZE from 128 to 104 MiB, so the whole image
-(bootloader + boot + root) will fit on a 128MB CF card by default.
-
-With these settings, the generated images (tested on x86-generic and
-x86-64) have 126,353,408 bytes; the smallest CF card marketed as "128MB"
-that I found a datasheet for (a Transcend TS128MCF80) has 126,959,616
-bytes.
-
-Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
-
-diff --git a/config/Config-images.in b/config/Config-images.in
-index 8548c7cd24742daad4fb1c64e58bad82590795c2..dc7a9cbd54ffbe3c78a7fdbd124f389c102ef6c1 100644
---- a/config/Config-images.in
-+++ b/config/Config-images.in
-@@ -274,7 +274,7 @@ menu "Target Images"
- 	config TARGET_ROOTFS_PARTSIZE
- 		int "Root filesystem partition size (in MB)"
- 		depends on GRUB_IMAGES || USES_ROOTFS_PART || TARGET_ROOTFS_EXT4FS || TARGET_omap || TARGET_rb532 || TARGET_sunxi || TARGET_uml
--		default 256
-+		default 104
- 		help
- 		  Select the root filesystem partition size.
- 

patches/openwrt/0006-mac80211-silence-warning-for-missing-rate-information.patch

+From: David Bauer <mail@david-bauer.net>
+Date: Thu, 18 Jan 2024 00:52:09 +0100
+Subject: mac80211: silence warning for missing rate information
+
+Silence warnings for missing rate information.
+
+These warnings do not provide value. Instead, they might rotate more
+crucial information out of the kernel message ringbuffer.
+
+Link: https://github.com/freifunk-gluon/gluon/issues/3160
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+
+diff --git a/package/kernel/mac80211/patches/subsys/999-silence-missing-rate.patch b/package/kernel/mac80211/patches/subsys/999-silence-missing-rate.patch
+new file mode 100644
+index 0000000000000000000000000000000000000000..a34455f78960ded59b60d3d9600823b39fc7b7a2
+--- /dev/null
++++ b/package/kernel/mac80211/patches/subsys/999-silence-missing-rate.patch
+@@ -0,0 +1,11 @@
++--- a/net/mac80211/mesh_hwmp.c
+++++ b/net/mac80211/mesh_hwmp.c
++@@ -350,7 +350,7 @@ u32 airtime_link_metric_get(struct ieee8
++ 			return MAX_METRIC;
++ 
++ 		rate = ewma_mesh_tx_rate_avg_read(&sta->mesh->tx_rate_avg);
++-		if (WARN_ON(!rate))
+++		if (!rate)
++ 			return MAX_METRIC;
++ 
++ 		err = (fail_avg << ARITH_SHIFT) / 100;

patches/openwrt/0007-ipq-wifi-add-BDF-for-Aruba-AP-303.patch

-From: David Bauer <mail@david-bauer.net>
-Date: Sun, 15 Dec 2019 23:02:54 +0100
-Subject: ipq-wifi: add BDF for Aruba AP-303
-
-The BDF originates from the vendor-firmware.
-
-Signed-off-by: David Bauer <mail@david-bauer.net>
-(cherry picked from commit 4113d8a2554adf5ecee55cc07956eafad378eaff)
-
-diff --git a/package/firmware/ipq-wifi/Makefile b/package/firmware/ipq-wifi/Makefile
-index eb7c2df1aa36ded7774a772c8a7e02b2acb81b40..cc0505b97c6a04bafd88972cf6ce7890a637c33b 100644
---- a/package/firmware/ipq-wifi/Makefile
-+++ b/package/firmware/ipq-wifi/Makefile
-@@ -25,6 +25,7 @@ endef
- 
- ALLWIFIBOARDS:= \
- 	alfa-network_ap120c-ac \
-+	aruba_ap-303 \
- 	asus_map-ac2200 \
- 	avm_fritzbox-7530 \
- 	avm_fritzrepeater-1200 \
-@@ -97,6 +98,7 @@ endef
- # Add $(eval $(call generate-ipq-wifi-package,<devicename>,<display name>))
- 
- $(eval $(call generate-ipq-wifi-package,alfa-network_ap120c-ac,ALFA Network AP120C-AC))
-+$(eval $(call generate-ipq-wifi-package,aruba_ap-303,Aruba AP-303))
- $(eval $(call generate-ipq-wifi-package,asus_map-ac2200,ASUS MAP-AC2200))
- $(eval $(call generate-ipq-wifi-package,avm_fritzbox-7530,AVM FRITZ!Box 7530))
- $(eval $(call generate-ipq-wifi-package,avm_fritzrepeater-1200,AVM FRITZRepeater 1200))
-diff --git a/package/firmware/ipq-wifi/board-aruba_ap-303.qca4019 b/package/firmware/ipq-wifi/board-aruba_ap-303.qca4019
-new file mode 100644
-index 0000000000000000000000000000000000000000..4848115cfbe3a4a0ed6b17cac929731ecbd7968c
-GIT binary patch
-literal 24316
-zcmeHPdr(tX8b1l)p-UHTNDu)pAp}Se0tBi-!W$`%6c7~&un1I<M58<m4?`F1_@EFG
-zfm#qEXc?48Q$)t%1F%?IJEP40v48CBA8luLw|}fVw5!gvGrOyM?hO}02ql3q<#9ha
-z=X~e8-#O<yzk5jTz30c>6BFeZwJ$y}AjvN}B`Pfz$mMbX<(NN~1F#FGd_`$kUSYm(
-zzFg|}UZJ$ePkJaU0I%hr$SXO7RRsaQWqBpiyyGXsqDmC`d45r;enA02aybRIXTiQ$
-z{(Fv6D8Qnc9-NN#>(d1&AQynm*7jHxFaWR*!ZjM6>t{S38|w;yprD{vFJ4eY3@h-<
-z-!4WF$pUt;M0u#+u2DM@cmo9<o32e4-TK}{-42{)MS-YT8nB=KA&y`%68dZzvGj;%
-zJAvBfnQ>V_`vZ+ET^9yjw-&*$wzjskw6xF>07kKy8YxWZr<)vMT{juo&5WBJl$pvJ
-zSBe@2uw^qXb0;%4&|Y78I5R0hICi_exl*3FFCluYul;;oiF8lGj<J5Il}ghR-u?y3
-z<F9$%VC>WOy2|{_1bA?;y|Gf7nVJwj){D78n-DgruPe_KCxqe+o_PC!v0LpI;0W&~
-zgp7R#8_4hmJ+PC)%p@TfcGpx{l$j<Bm~P-bH@-z`l~5LOnR}RQFc%NQwe^6K;hC*1
-zYj=HKdB|b!bl0Sb=920-IsYItdbF>&E$%$G#3{F}KdUX|Jgd|puct0g5t8q<cU!`P
-z#^Y7HrM_9r@UMC+KTbK%FWvUuz5epHckBJiT?>XU6jp>E=A|Pc_n}{`jGyHYexpa)
-z8eg})+@<jDr)8b~)ow)&xoZn0GFk!wOY2R)d&>@SU~bv!vW@t_*D0~j*k2Ra54<44
-zGAfly!Ey@=__b^`E!H<{G6I~Qyq_vSIUEo8>&bR^_h7rT+37SJ;+lkrg)CPdfsBl_
-zWH#Fk4)pWSFMfRe8oL4#@;p7Xw*UV4*B^9knBz8EYbuTQKj>!%PuOhxmoH!ZTkE^h
-zQ5Oxs>k&9eQFX%rmay^oy5hs-a5%Vu>&0fVaLp_>UjzM_W;28hf+9#18ifR+fk=_!
-zRP~t;8=70^D?l_Y4@^?%D4kD#N=KYgXTG!89<@iD&}cN8AN@2MNkkL*iQ-5!5{X9z
-zsDLkcDnNFjyZF1r0cZdsL}!9fUpK7I#3T~UL`ACe&W|yWIG_$w4u}it!gmqJpfOW1
-zND`XFPZ9^AK~q6UC>qKS6>Cp|ZjKM7g?`0zZ0#0(s2<Qwp34-SuNH%<p}&`<+SbE0
-zDLDsY&OV6}iP8cHkV|6$VCI-NBuaA-AS)ySBmyJ?BmyJ?Bmx^4fh~e9h#UPK!8=F_
-zeWze25<#~i1f=CRT_1X+n-jPGrj_%@*hGlg#@N88kes@S2)vvpCU&q=?$dOIMY}iF
-zZ_$ocmxDOFP&NDv09aP2x`v<WmwZ28Utjp7n}x1U4F>1q!}Wsktx^q!Hyz)q)K=GO
-zoF7djK!C#!ycz%kffr-~xxvJNR46t~SlLJq1Z=jeD_c)mpnblT&CYJ-0FjUaUY!7-
-z#TubR1_QvgL4XK|Xt`DhpfahOvtem(k8e884~Vp^8wB1A+A^rrLvRNI?k-blHXlQ|
-z28Ed52$bd6#2N6zwQKmBg-UNPPtI?dv^#g&y*lmgoH%t~Mt1I@LRDi+Ye!f2&4Iz;
-zk<l+6fAh@r13LS7rd_$N8E=5^gNo_3#7-!_2P%%PC3Zpa{ZFx=me>I`9mEA&tbcUZ
-z%raPCff}=CoSdFh&~W)`kLJ$!*9+<E3zgZ~FkUkdSJaj7DrSJ#*RhBg74ya7SP=X=
-z7!jc&zDOKww)^YZQBBbt1&#<xj}ycp$@Cq99Y{Dm^9uGezYpSjjwsj4Esm+2`@lsx
-z_pP233MAZDG~x_!W*4x)IQLBJ8XOwPV6wwG_mF@_V5M8~BrC?bzpXnCrvEDEUf+49
-zzBuO|MP{6#qUF9@TUl7rX4vll48Jjsia$KVkvGV>*BuD^e+C^f1J|FyU;r!;;^^oI
-zutbQ7^|zo9O_y4-fz<*{BN<(cKQSIMS&pfWHI9R`Q7+)GZ~m87zSOtRt#@=xPIh$J
-z+RmlJ%=Iy)wjsB2$w?ctL{=e6#)NGiAEXw5z3>BC;Y0;D{!GEsIar?io&qX3RM0m-
-z1^qu!!LtzyFeRb^yHOg52(ttT)56l)JRy+1kO+_nY&ZmFIrD}%_y76l-@pIvyT3qG
-z!a_rK!Uv_0b8llsqdtHB4`|cp+)q8%a_-ajrKM^)`>$U7G-ZAsz9G)NzdxUkC2X$&
-zduq<ccO90m`EJJ_!n5Hnfmt*|3ykF4Yws{0%-(2jK-HM%C%SBVt&T&cMQg=#Z0+ju
-z?J<3slzUHc2KJzP^x51yjM<u@zZYHGw?pGC>M~`z#Q)p7<L&AyWsXERen)*-SuBYY
-zdX5iix>ZV<MCgkBpV)(k-dq41G^-WL{SyA<pyrb5ge*-W)C{Y;WHL#z(0BZEb(2yq
-zi59Z32BQ<+-T-%#DbtndllL?oDuryXWT)ny>awgPK2|7z4Vsn5hz4U5-aIh*Kyy`9
-z2K#+`d{Fa=s!Ar2h&1D>cG=1J-CQSpgrl-7ZAjx2Fr>-5ns)VRm0Y%a{Fdgrx(+r@
-z*4$UM$;#s6xh~@)>W}b{+^~=yKH~BKoNA}$qFSNKg(0ccXH~^YiRPBNQznm(68cZx
-z*IZXs$_@yfwGDV)*c_VFr&I;XWO(qZszR13@rQx5DHW0=A#d`I=8CFBmJ-jw8hkOq
-zgDBk|Z&R15a+I-?Bk*9UGFz4i!@LHuj1;2qXotF778Ab}Z}1q-!4z4Am-=K##+*PB
-zB@(3t5LgdOV}YrW<_(KL>(KEV5iNeTE@js=e`t@r=v}q-_{qz0XL!ZV`L=NnyANLo
-zQ+gcPBDpqn@<w#Cf31sRXs|$?cxn3|T~1u=N^b}}#gf@2f7N@eDYC{>zBNZRxW7|)
-z$*qbmtL@F{5S&95^!$;V#g`*L;FZw#KkAb<N7Q&6bIPge-+$Gw*17EWd3}TBpF}or
-ztF{!X+LO-)o@5?)YxmvW{H9&itfS1VFYhY*Qrf*wJIXb;6xT!R*k$yCb!{o<g3FvF
-zw(+<74}K*4z)jA~>Cs3#V=uB4NN#U`sakZFU2HEI?ks7Dsq&ROrak#AvEH|GYk~cN
-z-oYbXaZQ|4jDps_<5wf<yeb%ZH`=7N;R>H44oN*XPh1H-<59xMxzd~07FF+FO3!KO
-zkzNs<^C)%5zR+;s{a_h8iyk@DSK5($fm`l$c*8Cna^fTc>i~h}zJUY22WwUg;4xU6
-zE40Voz~Sl1fxqzW8!QiZceZ;vST%3pn9qkNDEBsI+pnKL20^*sWVSI3z)zY;1PmfD
-zk8=M~&&^oEhq?Xq!q{llMLGBQ>t)~ra4xR!eZAQ1X^ph;*FG+*f4xJlJ!C>*eEV+r
-z#z~GXOppZ=2|4(iyLmNON}QN2ao#+YHqDy{lvv2w_X*(?ul{+G5$Yp=apGx^6Q9v~
-z^YKb>;`PTfcYPtQJz@VX`S#e@B<CLA>so3?a_*Ok9NBKwB4Es(@j^U%UHht?;4%Xv
-NIrrxNmNc!u{{!hMI2Hf^
-
-literal 0
-HcmV?d00001
-