patches/packages/routing/0002-batman-adv-Introduce-no-noflood-mark.patch

+From: Linus Lüssing <linus.luessing@c0d3.blue>
+Date: Sun, 10 Nov 2024 19:34:26 +0100
+Subject: batman-adv: Introduce no noflood mark
+
+This mark prevents a multicast packet being flooded through the whole
+mesh. The advantage of marking certain multicast packets via e.g.
+ebtables instead of dropping is then the following:
+
+This allows an administrator to let specific multicast packets pass as
+long as they are forwarded to a limited number of nodes only and are
+therefore creating no burdon to unrelated nodes.
+
+Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
+
+diff --git a/batman-adv/patches/2002-batman-adv-Introduce-no-noflood-mark.patch b/batman-adv/patches/2002-batman-adv-Introduce-no-noflood-mark.patch
+new file mode 100644
+index 0000000000000000000000000000000000000000..6058bff5bb4d07c78a82f59b47213a52b04d6a1e
+--- /dev/null
++++ b/batman-adv/patches/2002-batman-adv-Introduce-no-noflood-mark.patch
+@@ -0,0 +1,137 @@
++From: Linus Lüssing <linus.luessing@c0d3.blue>
++Date: Sat, 31 Mar 2018 03:36:19 +0200
++Subject: batman-adv: Introduce no noflood mark
++
++This mark prevents a multicast packet being flooded through the whole
++mesh. The advantage of marking certain multicast packets via e.g.
++ebtables instead of dropping is then the following:
++
++This allows an administrator to let specific multicast packets pass as
++long as they are forwarded to a limited number of nodes only and are
++therefore creating no burdon to unrelated nodes.
++
++Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
++
++--- a/include/uapi/linux/batman_adv.h
+++++ b/include/uapi/linux/batman_adv.h
++@@ -481,6 +481,18 @@ enum batadv_nl_attrs {
++ 	 */
++ 	BATADV_ATTR_MULTICAST_FANOUT,
++ 
+++	/**
+++	 * @BATADV_ATTR_NOFLOOD_MARK: the noflood mark which allows to tag
+++	 *  frames which should never be broadcast flooded through the mesh.
+++	 */
+++	BATADV_ATTR_NOFLOOD_MARK,
+++
+++	/**
+++	 * @BATADV_ATTR_NOFLOOD_MASK: the noflood (bit)mask which allows to tag
+++	 *  frames which should never be broadcast flooded through the mesh.
+++	 */
+++	BATADV_ATTR_NOFLOOD_MASK,
+++
++ 	/* add attributes above here, update the policy in netlink.c */
++ 
++ 	/**
++--- a/net/batman-adv/netlink.c
+++++ b/net/batman-adv/netlink.c
++@@ -133,6 +133,8 @@ static const struct nla_policy batadv_ne
++ 	[BATADV_ATTR_AP_ISOLATION_ENABLED]	= { .type = NLA_U8 },
++ 	[BATADV_ATTR_ISOLATION_MARK]		= { .type = NLA_U32 },
++ 	[BATADV_ATTR_ISOLATION_MASK]		= { .type = NLA_U32 },
+++	[BATADV_ATTR_NOFLOOD_MARK]		= { .type = NLA_U32 },
+++	[BATADV_ATTR_NOFLOOD_MASK]		= { .type = NLA_U32 },
++ 	[BATADV_ATTR_BONDING_ENABLED]		= { .type = NLA_U8 },
++ 	[BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED]	= { .type = NLA_U8 },
++ 	[BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED]	= { .type = NLA_U8 },
++@@ -285,6 +287,14 @@ static int batadv_netlink_mesh_fill(stru
++ 			bat_priv->isolation_mark_mask))
++ 		goto nla_put_failure;
++ 
+++	if (nla_put_u32(msg, BATADV_ATTR_NOFLOOD_MARK,
+++			bat_priv->noflood_mark))
+++		goto nla_put_failure;
+++
+++	if (nla_put_u32(msg, BATADV_ATTR_NOFLOOD_MASK,
+++			bat_priv->noflood_mark_mask))
+++		goto nla_put_failure;
+++
++ 	if (nla_put_u8(msg, BATADV_ATTR_BONDING_ENABLED,
++ 		       !!atomic_read(&bat_priv->bonding)))
++ 		goto nla_put_failure;
++@@ -463,6 +473,18 @@ static int batadv_netlink_set_mesh(struc
++ 		bat_priv->isolation_mark_mask = nla_get_u32(attr);
++ 	}
++ 
+++	if (info->attrs[BATADV_ATTR_NOFLOOD_MARK]) {
+++		attr = info->attrs[BATADV_ATTR_NOFLOOD_MARK];
+++
+++		bat_priv->noflood_mark = nla_get_u32(attr);
+++	}
+++
+++	if (info->attrs[BATADV_ATTR_NOFLOOD_MASK]) {
+++		attr = info->attrs[BATADV_ATTR_NOFLOOD_MASK];
+++
+++		bat_priv->noflood_mark_mask = nla_get_u32(attr);
+++	}
+++
++ 	if (info->attrs[BATADV_ATTR_BONDING_ENABLED]) {
++ 		attr = info->attrs[BATADV_ATTR_BONDING_ENABLED];
++ 
++--- a/net/batman-adv/soft-interface.c
+++++ b/net/batman-adv/soft-interface.c
++@@ -177,6 +177,23 @@ static void batadv_interface_set_rx_mode
++ {
++ }
++ 
+++/**
+++ * batadv_send_skb_has_noflood_mark() - check if packet has a noflood mark
+++ * @bat_priv: the bat priv with all the soft interface information
+++ * @skb: the packet to check
+++ *
+++ * Return: True if the skb's mark matches a configured noflood mark and
+++ * noflood mark mask. False otherwise.
+++ */
+++static bool
+++batadv_skb_has_noflood_mark(struct batadv_priv *bat_priv, struct sk_buff *skb)
+++{
+++	u32 match_mark = skb->mark & bat_priv->noflood_mark_mask;
+++
+++	return bat_priv->noflood_mark_mask &&
+++	       match_mark == bat_priv->noflood_mark;
+++}
+++
++ static netdev_tx_t batadv_interface_tx(struct sk_buff *skb,
++ 				       struct net_device *soft_iface)
++ {
++@@ -333,6 +350,9 @@ send:
++ 		if (batadv_dat_snoop_outgoing_arp_request(bat_priv, skb))
++ 			brd_delay = msecs_to_jiffies(ARP_REQ_DELAY);
++ 
+++		if (batadv_skb_has_noflood_mark(bat_priv, skb))
+++			goto dropped;
+++
++ 		if (batadv_skb_head_push(skb, sizeof(*bcast_packet)) < 0)
++ 			goto dropped;
++ 
++--- a/net/batman-adv/types.h
+++++ b/net/batman-adv/types.h
++@@ -1711,6 +1711,18 @@ struct batadv_priv {
++ 	 */
++ 	u32 isolation_mark_mask;
++ 
+++	/**
+++	 * @noflood_mark: the skb->mark value used to allow directed targeting
+++	 *  only
+++	 */
+++	u32 noflood_mark;
+++
+++	/**
+++	 * @noflood_mark_mask: bitmask identifying the bits in skb->mark to be
+++	 *  used for the noflood mark
+++	 */
+++	u32 noflood_mark_mask;
+++
++ 	/** @bcast_seqno: last sent broadcast packet sequence number */
++ 	atomic_t bcast_seqno;
++ 

patches/packages/routing/0002-batman-adv-compat-remove-ip_mc_check_igmp-ipv6_mc_check_mld.patch

-From: Linus Lüssing <linus.luessing@c0d3.blue>
-Date: Sun, 5 Jul 2020 04:02:17 +0200
-Subject: batman-adv: compat: remove ip_mc_check_igmp() + ipv6_mc_check_mld()
-
-The upstream Linux patches which reduced the number of arguments for
-these functions from two to one were added to OpenWrt. Therefore compat
-code for them is no more needed.
-
-Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
-
-diff --git a/batman-adv/src/compat-hacks.h b/batman-adv/src/compat-hacks.h
-index d8de483a10243c77b2c5f49720a39dedb1404f01..1cbcfcf070c7dd943574612c0d13f886c88ecc25 100644
---- a/batman-adv/src/compat-hacks.h
-+++ b/batman-adv/src/compat-hacks.h
-@@ -53,39 +53,12 @@ int ipv6_mc_check_mld(struct sk_buff *skb);
- 
- #elif LINUX_VERSION_CODE < KERNEL_VERSION(5, 1, 0)
- 
-+#undef ip_mc_check_igmp
-+#undef ipv6_mc_check_mld
-+
- #include_next <linux/igmp.h>
- #include_next <net/addrconf.h>
- 
--static inline int batadv_ipv6_mc_check_mld1(struct sk_buff *skb)
--{
--	return ipv6_mc_check_mld(skb, NULL);
--}
--
--static inline int batadv_ipv6_mc_check_mld2(struct sk_buff *skb,
--					    struct sk_buff **skb_trimmed)
--{
--	return ipv6_mc_check_mld(skb, skb_trimmed);
--}
--
--#define ipv6_mc_check_mld_get(_1, _2, ipv6_mc_check_mld_name, ...) ipv6_mc_check_mld_name
--#define ipv6_mc_check_mld(...) \
--	ipv6_mc_check_mld_get(__VA_ARGS__, batadv_ipv6_mc_check_mld2, batadv_ipv6_mc_check_mld1)(__VA_ARGS__)
--
--static inline int batadv_ip_mc_check_igmp1(struct sk_buff *skb)
--{
--	return ip_mc_check_igmp(skb, NULL);
--}
--
--static inline int batadv_ip_mc_check_igmp2(struct sk_buff *skb,
--					   struct sk_buff **skb_trimmed)
--{
--	return ip_mc_check_igmp(skb, skb_trimmed);
--}
--
--#define ip_mc_check_igmp_get(_1, _2, ip_mc_check_igmp_name, ...) ip_mc_check_igmp_name
--#define ip_mc_check_igmp(...) \
--	ip_mc_check_igmp_get(__VA_ARGS__, batadv_ip_mc_check_igmp2, batadv_ip_mc_check_igmp1)(__VA_ARGS__)
--
- #endif /* < KERNEL_VERSION(4, 2, 0) */
- 
- #if LINUX_VERSION_CODE < KERNEL_VERSION(4, 3, 0)

patches/packages/routing/0003-batctl-Add-noflood_mark-command.patch

+From: Linus Lüssing <linus.luessing@c0d3.blue>
+Date: Sun, 10 Nov 2024 19:35:52 +0100
+Subject: batctl: Add noflood_mark command
+
+Adds support for the new 'noflood_mark' setting in batman-adv.
+
+Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
+
+diff --git a/batctl/patches/2002-batctl-Add-noflood_mark-command.patch b/batctl/patches/2002-batctl-Add-noflood_mark-command.patch
+new file mode 100644
+index 0000000000000000000000000000000000000000..d4498603785a21a71951a6195cd96661be44d685
+--- /dev/null
++++ b/batctl/patches/2002-batctl-Add-noflood_mark-command.patch
+@@ -0,0 +1,217 @@
++From 12884631753aa24d9e36c5d65950320ecab61384 Mon Sep 17 00:00:00 2001
++From: =?UTF-8?q?Linus=20L=C3=BCssing?= <linus.luessing@c0d3.blue>
++Date: Fri, 26 Apr 2019 19:27:38 +0200
++Subject: [PATCH] batctl: Add noflood_mark command
++MIME-Version: 1.0
++Content-Type: text/plain; charset=UTF-8
++Content-Transfer-Encoding: 8bit
++
++Adds support for the new 'noflood_mark' setting in batman-adv.
++
++Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
++---
++ Makefile       |   1 +
++ README.rst     |  15 ++++++
++ batman_adv.h   |  12 +++++
++ noflood_mark.c | 140 +++++++++++++++++++++++++++++++++++++++++++++++++
++ 4 files changed, 168 insertions(+)
++ create mode 100644 noflood_mark.c
++
++--- a/Makefile
+++++ b/Makefile
++@@ -69,6 +69,7 @@ $(eval $(call add_command,multicast_mode
++ $(eval $(call add_command,neighbors,y))
++ $(eval $(call add_command,neighbors_json,y))
++ $(eval $(call add_command,network_coding,y))
+++$(eval $(call add_command,noflood_mark,y))
++ $(eval $(call add_command,orig_interval,y))
++ $(eval $(call add_command,originators,y))
++ $(eval $(call add_command,originators_json,y))
++--- a/README.rst
+++++ b/README.rst
++@@ -430,6 +430,21 @@ Example::
++ 
++ 
++ 
+++batctl noflood_mark
+++=======================
+++
+++display or modify noflood_mark setting
+++
+++Usage::
+++
+++  batctl noflood_mark|nf $value[/0x$mask]
+++
+++* Example 1: ``batctl nf 0x00000001/0xffffffff``
+++* Example 2: ``batctl nf 0x00040000/0xffff0000``
+++* Example 3: ``batctl nf 16``
+++* Example 4: ``batctl nf 0x0f``
+++
+++
++ batctl translocal
++ -----------------
++ 
++--- a/batman_adv.h
+++++ b/batman_adv.h
++@@ -481,6 +481,18 @@ enum batadv_nl_attrs {
++ 	 */
++ 	BATADV_ATTR_MULTICAST_FANOUT,
++ 
+++	/**
+++	 * @BATADV_ATTR_NOFLOOD_MARK: the noflood mark which allows to tag
+++	 *  frames which should never be broadcast flooded through the mesh.
+++	 */
+++	BATADV_ATTR_NOFLOOD_MARK,
+++
+++	/**
+++	 * @BATADV_ATTR_NOFLOOD_MASK: the noflood (bit)mask which allows to tag
+++	 *  frames which should never be broadcast flooded through the mesh.
+++	 */
+++	BATADV_ATTR_NOFLOOD_MASK,
+++
++ 	/* add attributes above here, update the policy in netlink.c */
++ 
++ 	/**
++--- /dev/null
+++++ b/noflood_mark.c
++@@ -0,0 +1,140 @@
+++// SPDX-License-Identifier: GPL-2.0
+++/* Copyright (C) 2009-2019  B.A.T.M.A.N. contributors:
+++ *
+++ * Antonio Quartulli <a@unstable.cc>
+++ * Linus Lüssing <linus.luessing@c0d3.blue>
+++ *
+++ * License-Filename: LICENSES/preferred/GPL-2.0
+++ */
+++
+++#include <errno.h>
+++#include <stddef.h>
+++#include <stdint.h>
+++#include <string.h>
+++
+++#include "main.h"
+++#include "sys.h"
+++
+++static struct noflood_mark_data {
+++	uint32_t noflood_mark;
+++	uint32_t noflood_mask;
+++} noflood_mark;
+++
+++static int parse_noflood_mark(struct state *state, int argc, char *argv[])
+++{
+++	struct settings_data *settings = state->cmd->arg;
+++	struct noflood_mark_data *data = settings->data;
+++	char *mask_ptr;
+++	char buff[256];
+++	uint32_t mark;
+++	uint32_t mask;
+++	char *endptr;
+++
+++	if (argc != 2) {
+++		fprintf(stderr, "Error - incorrect number of arguments (expected 1)\n");
+++		return -EINVAL;
+++	}
+++
+++	strncpy(buff, argv[1], sizeof(buff));
+++	buff[sizeof(buff) - 1] = '\0';
+++
+++	/* parse the mask if it has been specified, otherwise assume the mask is
+++	 * the biggest possible
+++	 */
+++	mask = 0xFFFFFFFF;
+++	mask_ptr = strchr(buff, '/');
+++	if (mask_ptr) {
+++		*mask_ptr = '\0';
+++		mask_ptr++;
+++
+++		/* the mask must be entered in hex base as it is going to be a
+++		 * bitmask and not a prefix length
+++		 */
+++		mask = strtoul(mask_ptr, &endptr, 16);
+++		if (!endptr || *endptr != '\0')
+++			goto inval_format;
+++	}
+++
+++	/* the mark can be entered in any base */
+++	mark = strtoul(buff, &endptr, 0);
+++	if (!endptr || *endptr != '\0')
+++		goto inval_format;
+++
+++	data->noflood_mask = mask;
+++	/* erase bits not covered by the mask */
+++	data->noflood_mark = mark & mask;
+++
+++	return 0;
+++
+++inval_format:
+++	fprintf(stderr, "Error - incorrect number of arguments (expected 1)\n");
+++	fprintf(stderr, "The following formats for mark(/mask) are allowed:\n");
+++	fprintf(stderr, " * 0x12345678\n");
+++	fprintf(stderr, " * 0x12345678/0xabcdef09\n");
+++	return -EINVAL;
+++}
+++
+++static int print_noflood_mark(struct nl_msg *msg, void *arg)
+++{
+++	struct nlattr *attrs[BATADV_ATTR_MAX + 1];
+++	struct nlmsghdr *nlh = nlmsg_hdr(msg);
+++	struct genlmsghdr *ghdr;
+++	int *result = arg;
+++
+++	if (!genlmsg_valid_hdr(nlh, 0))
+++		return NL_OK;
+++
+++	ghdr = nlmsg_data(nlh);
+++
+++	if (nla_parse(attrs, BATADV_ATTR_MAX, genlmsg_attrdata(ghdr, 0),
+++		      genlmsg_len(ghdr), batadv_netlink_policy)) {
+++		return NL_OK;
+++	}
+++
+++	if (!attrs[BATADV_ATTR_NOFLOOD_MARK] ||
+++	    !attrs[BATADV_ATTR_NOFLOOD_MASK])
+++		return NL_OK;
+++
+++	printf("0x%08x/0x%08x\n",
+++	       nla_get_u32(attrs[BATADV_ATTR_NOFLOOD_MARK]),
+++	       nla_get_u32(attrs[BATADV_ATTR_NOFLOOD_MASK]));
+++
+++	*result = 0;
+++	return NL_STOP;
+++}
+++
+++static int get_noflood_mark(struct state *state)
+++{
+++	return sys_simple_nlquery(state, BATADV_CMD_GET_MESH,
+++				  NULL, print_noflood_mark);
+++}
+++
+++static int set_attrs_noflood_mark(struct nl_msg *msg, void *arg)
+++{
+++	struct state *state = arg;
+++	struct settings_data *settings = state->cmd->arg;
+++	struct noflood_mark_data *data = settings->data;
+++
+++	nla_put_u32(msg, BATADV_ATTR_NOFLOOD_MARK, data->noflood_mark);
+++	nla_put_u32(msg, BATADV_ATTR_NOFLOOD_MASK, data->noflood_mask);
+++
+++	return 0;
+++}
+++
+++static int set_noflood_mark(struct state *state)
+++{
+++	return sys_simple_nlquery(state, BATADV_CMD_SET_MESH,
+++				  set_attrs_noflood_mark, NULL);
+++}
+++
+++static struct settings_data batctl_settings_noflood_mark = {
+++	.data = &noflood_mark,
+++	.parse = parse_noflood_mark,
+++	.netlink_get = get_noflood_mark,
+++	.netlink_set = set_noflood_mark,
+++};
+++
+++COMMAND_NAMED(SUBCOMMAND, noflood_mark, "nf", handle_sys_setting,
+++	      COMMAND_FLAG_MESH_IFACE | COMMAND_FLAG_NETLINK,
+++	      &batctl_settings_noflood_mark,
+++	      "[mark]            \tdisplay or modify noflood_mark setting");

scripts/basic_openwrt_config.sh

+#!/usr/bin/env bash
+
+set -euo pipefail
+
+echo "CONFIG_DEVEL=y"
+if [ "$GLUON_AUTOREMOVE" != "0" ]; then
+	echo "CONFIG_AUTOREMOVE=y"
+else
+	echo "# CONFIG_AUTOREMOVE is not set"
+fi

scripts/container.sh

+#!/usr/bin/env bash
+# shellcheck enable=check-unassigned-uppercase
+
+set -euo pipefail
+
+# move into base directory, in case this script is not executed via `make container`
+cd "$(dirname "$0")/.."
+
+# normalize branch name to reflect a valid image name
+BRANCH=$(git branch --show-current 2>/dev/null | sed 's/[^a-z0-9-]/_/ig')
+TAG="gluon:${BRANCH:-latest}"
+
+if [ "$(command -v podman)" ]
+then
+	podman build -t "${TAG}" contrib/docker
+	podman run -it --rm -u "$(id -u):$(id -g)" --userns=keep-id --volume="$(pwd):/gluon:z" "${TAG}"
+elif [ "$(command -v docker)" ]
+then
+	docker build -t "${TAG}" contrib/docker
+	docker run -it --rm -u "$(id -u):$(id -g)" --volume="$(pwd):/gluon" -e HOME=/gluon "${TAG}"
+else
+	echo "Please install either podman or docker. Exiting" >&2
+	exit 1
+fi

scripts/copy_output.lua

@@ -28,6 +28,7 @@ mkdir(env.GLUON_IMAGEDIR..'/factory')
 mkdir(env.GLUON_IMAGEDIR..'/sysupgrade')
 mkdir(env.GLUON_IMAGEDIR..'/other')
 mkdir(env.GLUON_DEBUGDIR)
+mkdir(env.GLUON_METADIR..'/openwrt-profiles')
 
 
 lib.include(target)
@@ -81,9 +82,16 @@ local kernel_debug_dest = string.format('%s/gluon-%s-%s-%s-kernel-debug.tar.zst'
 	target)
 lib.exec {'cp', kernel_debug_source, kernel_debug_dest}
 
+-- copy OpenWrt profile JSON
+local profile_json_source = string.format('openwrt/bin/targets/%s/profiles.json',
+	bindir)
+local profile_json_dest = string.format('%s/openwrt-profiles/%s.json',
+	env.GLUON_METADIR,
+	target)
+lib.exec {'cp', profile_json_source, profile_json_dest}
 
 -- Copy opkg repo
-if lib.opkg and (env.GLUON_DEVICES or '') == '' then
+if (env.GLUON_DEVICES or '') == '' then
 	local package_prefix = string.format('gluon-%s-%s', lib.site_code, env.GLUON_RELEASE)
 	local function dest_dir(prefix)
 		return env.GLUON_PACKAGEDIR..'/'..prefix..'/'..bindir
@@ -92,5 +100,6 @@ if lib.opkg and (env.GLUON_DEVICES or '') == '' then
 	lib.exec {'rm', '-f', dest_dir('\0')..'/\0'}
 	lib.exec({'rmdir', '-p', dest_dir('\0')}, true, '2>/dev/null')
 	mkdir(dest_dir(package_prefix))
+	lib.exec {'rm', '-rf', 'openwrt/bin/targets/'..bindir..'/packages/tmp'}
 	lib.exec {'cp', 'openwrt/bin/targets/'..bindir..'/packages/\0', dest_dir(package_prefix)}
 end

scripts/default_feeds.sh

+#!/bin/sh
+
 # list feeds which don't start with #
 DEFAULT_FEEDS="$(awk '!/^#/ {print $2}' openwrt/feeds.conf.default)"
+export DEFAULT_FEEDS

scripts/domain_aliases.lua

-local cjson = require 'cjson'
+local json = require 'jsonc'
 
-local function load_json(filename)
-	local f = assert(io.open(filename))
-	local json = cjson.decode(f:read('*a'))
-	f:close()
-	return json
-end
-
-local domain = load_json(arg[1])
+local domain = assert(json.load(arg[1]))
 for k, _ in pairs(domain.domain_names) do
 	print(k)
 end

scripts/feeds.sh

-#!/bin/bash
+#!/usr/bin/env bash
 
 set -e
 

scripts/getversion.sh

+#!/bin/sh
+
+if [ $# -ne 1 ]; then
+	echo >&2 "Usage: getversion.sh <directory>"
+	exit 1
+fi
+
+cd "$1" || exit 1
+
+cat .scmversion 2>/dev/null && exit 0
+git --git-dir=.git describe --tags --always --abbrev=7 --dirty=+ 2>/dev/null && exit 0
+
+echo unknown

scripts/image_customization_lib.lua

+local M = {
+	customization_file = nil,
+}
+
+local function evaluate_device(env, dev)
+	local selections = {
+		features = {},
+		packages = {},
+	}
+	local funcs = {}
+	local device_overrides = {}
+
+	local function add_elements(element_type, element_list)
+		local error_msg = string.format(
+			'incorrect use of %s(): list of %s expected as argument',
+			element_type, element_type)
+		assert(type(element_list) == 'table', error_msg)
+
+		-- We depend on the fact both feature and package
+		-- are already initialized as empty tables
+		for _, element in ipairs(element_list) do
+			assert(type(element) == 'string', error_msg)
+			table.insert(selections[element_type], element)
+		end
+	end
+
+	local function add_override(ovr_key, ovr_value)
+		device_overrides[ovr_key] = ovr_value
+	end
+
+	function funcs.features(features)
+		add_elements('features', features)
+	end
+
+	function funcs.packages(packages)
+		add_elements('packages', packages)
+	end
+
+	function funcs.broken(broken)
+		assert(
+			type(broken) == 'boolean',
+			'incorrect use of broken(): boolean argument expected')
+		add_override('broken', broken)
+	end
+
+	function funcs.disable()
+		add_override('disabled', true)
+	end
+
+	function funcs.disable_factory()
+		add_override('disable_factory', true)
+	end
+
+	function funcs.device(device_names)
+		assert(
+			type(device_names) == 'table',
+			'incorrect use of device(): list of device names expected as argument')
+
+		for _, device_name in ipairs(device_names) do
+			assert(
+				type(device_name) == 'string',
+				'incorrect use of device(): list of device names expected as argument')
+
+			if device_name == dev.image then
+				return true
+			end
+		end
+
+		return false
+	end
+
+	function funcs.target(target, subtarget)
+		assert(
+			type(target) == 'string',
+			'incorrect use of target(): target name expected as first argument')
+
+		if target ~= env.BOARD then
+			return false
+		end
+
+		if subtarget then
+			assert(
+				type(subtarget) == 'string',
+				'incorrect use of target(): subtarget name expected as first argument')
+
+			if subtarget ~= env.SUBTARGET then
+				return false
+			end
+		end
+
+		return true
+	end
+
+	function funcs.device_class(class)
+		assert(
+			type(class) == 'string',
+			'incorrect use of device_class(): class name expected as first argument')
+
+		return dev.options.class == class
+	end
+
+	function funcs.include(path)
+		assert(
+			type(path) == 'string',
+			'incorrect use of include(): path expected as first argument')
+
+		if string.sub(path, 1, 1) ~= '/' then
+			assert(
+				string.find(path, '/') == nil,
+				'incorrect use of include(): including files from subdirectories is unsupported')
+			path = env.GLUON_SITEDIR .. '/' .. path
+		end
+		local f = assert(loadfile(path))
+		setfenv(f, funcs)
+		return f()
+	end
+
+	-- Evaluate the feature definition files
+	setfenv(M.customization_file, funcs)
+	M.customization_file()
+
+	return {
+		selections = selections,
+		device_overrides = device_overrides,
+	}
+end
+
+function M.get_selections(dev)
+	local eval_result = evaluate_device(M.env, dev)
+	return eval_result.selections
+end
+
+function M.device_overrides(dev)
+	local eval_result = evaluate_device(M.env, dev)
+	return eval_result.device_overrides
+end
+
+function M.init(env)
+	local filename = env.GLUON_SITEDIR .. '/image-customization.lua'
+
+	M.env = env
+	M.customization_file = assert(loadfile(filename))
+end
+
+return M

scripts/lint-editorconfig.sh

+#!/bin/sh
+
+set -e
+
+editorconfig-checker .github contrib docs package scripts targets tests ./*.* .luacheckrc .editorconfig

scripts/lint-sh.sh

@@ -3,7 +3,11 @@
 set -e
 
 is_scriptfile() {
-	echo "$1" | grep -qE '.*\.sh$' || head -n1 "$1" | grep -qE '^#.*(sh|bash)$'
+	echo "$1" | grep -q '\.sh$' || head -n1 "$1" | grep -qE '^#!(.*\<bash|/bin/sh)$'
+}
+
+is_initscript() {
+	head -n1 "$1" | grep -qxF '#!/bin/sh /etc/rc.common'
 }
 
 find contrib -type f | while read -r file; do
@@ -14,15 +18,18 @@ find contrib -type f | while read -r file; do
 done
 
 find package -type f | while read -r file; do
-	is_scriptfile "$file" || continue
-
+	if is_scriptfile "$file"; then
 		echo "Checking $file"
-	shellcheck -f gcc -x -s sh -e SC2039,SC1091,SC2155,SC2034 "$file"
+		shellcheck -f gcc -x -s sh -e SC2039,SC3043,SC3037,SC3057 "$file"
+	elif is_initscript "$file"; then
+		echo "Checking $file (initscript)"
+		shellcheck -f gcc -x -s sh -e SC2034,SC2039,SC3043,SC3037,SC3057 "$file"
+	fi
 done
 
 find scripts -type f | while read -r file; do
 	is_scriptfile "$file" || continue
 
 	echo "Checking $file"
-	shellcheck -f gcc -x -e SC2154,SC1090,SC2181,SC2155,SC2148,SC2034,SC2148 "$file"
+	shellcheck -f gcc -x "$file"
 done

scripts/module_check.sh

-#!/bin/bash
+#!/usr/bin/env bash
 
 set -e
 
@@ -14,8 +14,10 @@ fi
 need_sync=false
 
 for module in $GLUON_MODULES; do
-	var=$(echo "$module" | tr '[:lower:]/' '[:upper:]_')
-	eval 'commit_expected=${'"${var}"'_COMMIT}'
+	echo "Checking module '$module'"
+	var=${module//\//_}
+	_remote_commit=${var^^}_COMMIT
+	commit_expected=${!_remote_commit}
 
 	prefix=invalid
 	cd "$GLUONDIR/$module" 2>/dev/null && prefix="$(git rev-parse --show-prefix 2>/dev/null)"

scripts/modules.sh

+#!/bin/sh
+
+# shellcheck source=./modules
 . ./modules
+
 [ ! -f "$GLUON_SITEDIR"/modules ] || . "$GLUON_SITEDIR"/modules
 
 # shellcheck disable=SC2086
-FEEDS="$(echo $GLUON_FEEDS $GLUON_SITE_FEEDS | tr ' ' '\n')"
+FEEDS="$(echo $GLUON_SITE_FEEDS $GLUON_FEEDS | tr ' ' '\n')"
 
 GLUON_MODULES=openwrt
 

scripts/patch.sh

-#!/bin/bash
+#!/usr/bin/env bash
+# shellcheck enable=check-unassigned-uppercase
 
 set -e
 shopt -s nullglob

scripts/sha256sum.sh

@@ -15,6 +15,7 @@ else
 	exit 1
 fi
 
+# shellcheck disable=SC2181
 [ "$?" -eq 0 ] || exit 1
 
 echo "$ret" | awk '{ print $1 }'

scripts/target_config_lib.lua

 local lib = dofile('scripts/target_lib.lua')
 local feature_lib = dofile('scripts/feature_lib.lua')
+local image_customization_lib = dofile('scripts/image_customization_lib.lua')
 local env = lib.env
 
 local target = env.GLUON_TARGET
@@ -15,6 +16,8 @@ else
 	openwrt_config_target = env.BOARD
 end
 
+-- Initialize image-customization
+image_customization_lib.init(env)
 
 -- Split a string into words
 local function split(s)
@@ -73,23 +76,6 @@ local function file_exists(file)
 	return true
 end
 
-local function site_vars(var)
-	return lib.exec_capture_raw(string.format(
-[[
-MAKEFLAGS= make print _GLUON_SITE_VARS_=%s --no-print-directory -s -f - <<'END_MAKE'
-include $(GLUON_SITEDIR)/site.mk
-
-print:
-	echo -n '$(_GLUON_SITE_VARS_)'
-END_MAKE
-]],
-	lib.escape(var)))
-end
-
-local function site_packages(image)
-	return split(site_vars(string.format('$(GLUON_%s_SITE_PACKAGES)', image)))
-end
-
 local function feature_packages(features)
 	local files = {'package/features'}
 	for _, feed in ipairs(feeds) do
@@ -102,20 +88,29 @@ local function feature_packages(features)
 	return feature_lib.get_packages(files, features)
 end
 
--- This involves running a few processes to evaluate site.mk, so we add a simple cache
-local class_cache = {}
-local function class_packages(class)
-	if class_cache[class] then
-		return class_cache[class]
-	end
+local function site_specific_packages(dev_info)
+	local site_selections
+	local site_packages
+	local feature_inherited_pkgs
+	local site_features
+
+	-- Get all enabled selections from image-customization.lua
+	site_selections = image_customization_lib.get_selections(dev_info)
 
-	local features = site_vars(string.format('$(GLUON_FEATURES) $(GLUON_FEATURES_%s)', class))
-	features = compact_list(split(features), false)
+	-- First read enabled features from site
+	site_features = site_selections['features']
+	site_features = compact_list(site_features, false)
 
-	local pkgs = feature_packages(features)
-	pkgs = concat_list(pkgs, split(site_vars(string.format('$(GLUON_SITE_PACKAGES) $(GLUON_SITE_PACKAGES_%s)', class))))
+	-- Create List from packages inherited from features
+	feature_inherited_pkgs = feature_packages(site_features)
 
-	class_cache[class] = pkgs
+	-- Read list of packages from site
+	site_packages = site_selections['packages']
+
+	-- Concat feature-packages with site-packages
+	local pkgs = concat_list(feature_inherited_pkgs, site_packages)
+
+	-- Negations for the resulting package-list are dealt with in the calling function
 	return pkgs
 end
 
@@ -123,6 +118,14 @@ local enabled_packages = {}
 -- Arguments: package name and config value (true: y, nil: m, false: unset)
 -- Ensures precedence of y > m > unset
 local function config_package(pkg, v)
+	-- HACK: Handle virtual default packages
+	local subst = {
+		nftables = 'nftables-nojson'
+	}
+	if subst[pkg] then
+		pkg = subst[pkg]
+	end
+
 	if v == false then
 		if not enabled_packages[pkg] then
 			lib.try_config('PACKAGE_' .. pkg, false)
@@ -146,24 +149,33 @@ local function handle_target_pkgs(pkgs)
 	end
 end
 
+local function get_default_pkgs()
+	local targetinfo_target = string.gsub(openwrt_config_target, '_', '/', 1)
+	local target_matches = false
+	for line in io.lines('openwrt/tmp/.targetinfo') do
+		local target_match = string.match(line, '^Target: (.+)$')
+		if target_match then
+			target_matches = (target_match == targetinfo_target)
+		end
+
+		local default_packages_match = string.match(line, '^Default%-Packages: (.+)$')
+		if target_matches and default_packages_match then
+			return split(default_packages_match)
+		end
+	end
+
+	io.stderr:write('Error: unable to get default packages for OpenWrt target ', targetinfo_target, '\n')
+	os.exit(1)
+end
+
 lib.include('generic')
 lib.include(target)
 
 lib.check_devices()
 
-if not lib.opkg then
-	lib.config('SIGNED_PACKAGES', false)
-	lib.config('CLEAN_IPKG', true)
-	lib.config('ALL_NONSHARED', false)
-	lib.packages {'-opkg'}
-end
-
-if #lib.devices > 0 then
-	handle_target_pkgs(lib.target_packages)
+handle_target_pkgs(concat_list(get_default_pkgs(), lib.target_packages))
 
 for _, dev in ipairs(lib.devices) do
-		local profile = dev.options.profile or dev.name
-
 	local device_pkgs = {}
 	local function handle_pkgs(pkgs)
 		for _, pkg in ipairs(pkgs) do
@@ -175,34 +187,18 @@ if #lib.devices > 0 then
 	end
 
 	handle_pkgs(lib.target_packages)
-		handle_pkgs(class_packages(dev.options.class))
 	handle_pkgs(dev.options.packages or {})
-		handle_pkgs(site_packages(dev.image))
+	handle_pkgs(site_specific_packages(dev))
 
-		local profile_config = string.format('%s_DEVICE_%s', openwrt_config_target, profile)
+	local profile_config = string.format('%s_DEVICE_%s', openwrt_config_target, dev.name)
 	lib.config(
 		'TARGET_DEVICE_' .. profile_config, true,
-			string.format("unable to enable device '%s'", profile)
+		string.format("unable to enable device '%s'", dev.name)
 	)
 	lib.config(
 		'TARGET_DEVICE_PACKAGES_' .. profile_config,
 		table.concat(device_pkgs, ' ')
 	)
 end
-else
-	-- x86 fallback: no devices
-	local target_pkgs = {}
-	local function handle_pkgs(pkgs)
-		target_pkgs = concat_list(target_pkgs, pkgs)
-	end
-
-	-- Just hardcode the class for device-less targets to 'standard'
-	-- - this is x86 only at the moment, and it will have devices
-	-- in OpenWrt 19.07 + 1 as well
-	handle_pkgs(lib.target_packages)
-	handle_pkgs(class_packages('standard'))
-
-	handle_target_pkgs(target_pkgs)
-end
 
 return lib

scripts/target_lib.lua

+local image_customization_lib = dofile('scripts/image_customization_lib.lua')
+
 -- Functions for use in targets/*
 local F = {}
 
@@ -28,11 +30,11 @@ M.target_packages = {}
 M.configs = {}
 M.devices = {}
 M.images = {}
-M.opkg = true
 
+-- Initialize image-customization
+image_customization_lib.init(env)
 
 local default_options = {
-	profile = false,
 	factory = '-squashfs-factory',
 	factory_ext = '.bin',
 	sysupgrade = '-squashfs-sysupgrade',
@@ -57,24 +59,43 @@ function F.istrue(v)
 	return (tonumber(v) or 0) > 0
 end
 
-local function want_device(dev, options)
-	if options.broken and not F.istrue(env.BROKEN) then
+local function device_broken(device_info, overrides)
+	if F.istrue(env.BROKEN) then
 		return false
 	end
-	if options.deprecated and env.GLUON_DEPRECATED == '0' then
+
+	if overrides['broken'] ~= nil then
+		return overrides['broken'] == true
+	elseif device_info.options.broken then
+		return true
+	end
+
 	return false
 end
 
-	if (env.GLUON_DEVICES or '') == '' then
-		return true
+local function want_device(device_info)
+	local overrides = image_customization_lib.device_overrides(device_info)
+
+	-- Check if device is disabled via image-customization.lua in site
+	if overrides['disabled'] then
+		return false
 	end
 
-	unknown_devices[dev] = nil
-	return gluon_devices[dev]
+	if device_broken(device_info, overrides) then
+		return false
 	end
 
-local full_deprecated = env.GLUON_DEPRECATED == 'full'
+	if device_info.options.deprecated and env.GLUON_DEPRECATED == '0' then
+		return false
+	end
 
+	if (env.GLUON_DEVICES or '') == '' then
+		return true
+	end
+
+	unknown_devices[device_info.image] = nil
+	return gluon_devices[device_info.image]
+end
 
 local function merge(a, b)
 	local ret = {}
@@ -212,18 +233,33 @@ local function as_table(v)
 	end
 end
 
-function F.device(image, name, options)
-	options = merge(default_options, options)
+local function disable_factory_image(device_info)
+	if device_info.options.deprecated and env.GLUON_DEPRECATED ~= 'full' then
+		return true
+	end
 
-	if not want_device(image, options) then
-		return
+	local overrides = image_customization_lib.device_overrides(device_info)
+	if overrides["disable_factory"] then
+		return true
 	end
 
-	table.insert(M.devices, {
+	return false
+end
+
+function F.device(image, name, options)
+	options = merge(default_options, options)
+
+	local device_info = {
 		image = image,
 		name = name,
 		options = options,
-	})
+	}
+
+	if not want_device(device_info) then
+		return
+	end
+
+	table.insert(M.devices, device_info)
 
 	if options.sysupgrade then
 		add_image {
@@ -238,7 +274,7 @@ function F.device(image, name, options)
 		}
 	end
 
-	if options.deprecated and not full_deprecated then
+	if disable_factory_image(device_info) then
 		return
 	end
 
@@ -268,51 +304,6 @@ function F.device(image, name, options)
 	end
 end
 
-function F.factory_image(image, name, ext, options)
-	options = merge(default_options, options)
-
-	if not want_device(image, options) then
-		return
-	end
-
-	if options.deprecated and not full_deprecated then
-		return
-	end
-
-	add_image {
-		image = image,
-		name = name,
-		subdir = 'factory',
-		in_suffix = '',
-		out_suffix = '',
-		extension = ext,
-		aliases = options.aliases,
-	}
-end
-
-function F.sysupgrade_image(image, name, ext, options)
-	options = merge(default_options, options)
-
-	if not want_device(image, options) then
-		return
-	end
-
-	add_image {
-		image = image,
-		name = name,
-		subdir = 'sysupgrade',
-		in_suffix = '',
-		out_suffix = '-sysupgrade',
-		extension = ext,
-		aliases = options.aliases,
-		manifest_aliases = options.manifest_aliases,
-	}
-end
-
-function F.no_opkg()
-	M.opkg = false
-end
-
 function F.defaults(options)
 	default_options = merge(default_options, options)
 end

scripts/update-ci.sh

+#!/bin/sh -e
+
+make --no-print-directory list-targets BROKEN=1 | ./contrib/actions/generate-target-filters.py > .github/filters.yml