README.md

@@ -19,7 +19,7 @@ the future development of Gluon.
 
 Please refrain from using the `master` branch for anything else but development purposes!
 Use the most recent release instead. You can list all releases by running `git tag`
-and switch to one by running `git checkout v2018.1 && make update`.
+and switch to one by running `git checkout v2018.1.1 && make update`.
 
 If you're using the autoupdater, do not autoupdate nodes with anything but releases.
 If you upgrade using random master commits the nodes *will break* eventually.

docs/conf.py

@@ -52,11 +52,7 @@ copyright = '2015-2018, Project Gluon'
 # The version info for the project you're documenting, acts as replacement for
 # |version| and |release|, also used in various other places throughout the
 # built documents.
-#
-# The short X.Y version.
-version = '2018.1'
-# The full version, including alpha/beta/rc tags.
-release = '2018.1'
+version = release = '2018.1.1'
 
 # The language for content autogenerated by Sphinx. Refer to documentation
 # for a list of supported languages.

docs/features/multidomain.rst

@@ -160,8 +160,8 @@ site.conf only variables
    in a domain specific way:
 
    -  mesh_vpn.fastd.syslog_level
-   -  wifi*.ibss.supported_basic_rates
-   -  wifi*.mesh.supported_basic_rates
+   -  wifi*.supported_rates
+   -  wifi*.basic_rates
    -  timezone
    -  regdom
 

docs/features/vpn.rst

@@ -37,7 +37,7 @@ increase throughput, although in practice the gain is minimal.
 
 **Gateway configuration:**
 
-1) Prepend the ``none`` cipher in fastds method list
+1) Prepend the ``null`` cipher in fastd's method list
 
 
 **Config Mode:**

docs/index.rst

@@ -70,6 +70,7 @@ Several Freifunk communities in Germany use Gluon as the foundation of their Fre
    :caption: Releases
    :maxdepth: 1
 
+   releases/v2018.1.1
    releases/v2018.1
    releases/v2017.1.8
    releases/v2017.1.7

docs/releases/v2018.1.1.rst

+Gluon 2018.1.1
+==============
+
+Bugfixes
+~~~~~~~~
+
+* Fix a bug leading to configuration loss on upgrade under certain circumstances
+  (`#1496 <https://github.com/freifunk-gluon/gluon/issues/1496>`_)
+
+  The issue can only occur when upgrading from 2018.1 and there are multiple
+  mirror entries in *site.conf* (specifically, an early failure for one of the
+  mirrors, e.g. during DNS resolution, followed by a successful upgrade from a
+  different mirror triggers the issue).
+
+  This is a regression in Gluon 2018.1.
+
+* Fix next-node ARP issue
+  (`#1488 <https://github.com/freifunk-gluon/gluon/issues/1488>`_)
+
+  A routing table issue led to ARP requests being sent from the next-node IPv4 address, but with
+  a node-specific source MAC address. This could make the next-node IPv4 address unreachable.
+
+  This is a regression in Gluon 2018.1.
+
+* Fix build on hosts with glibc 2.28
+
+  Fixed by various tool upgrades in LEDE (*bison*, *e2fsutils*, ...)
+
+Other changes
+~~~~~~~~~~~~~
+
+* Linux kernel has been updated to v4.4.148
+
+Known issues
+~~~~~~~~~~~~
+
+* Default TX power on many Ubiquiti devices is too high, correct offsets are unknown (`#94 <https://github.com/freifunk-gluon/gluon/issues/94>`_)
+
+  Reducing the TX power in the Advanced Settings is recommended.
+
+* The MAC address of the WAN interface is modified even when Mesh-on-WAN is disabled (`#496 <https://github.com/freifunk-gluon/gluon/issues/496>`_)
+
+  This may lead to issues in environments where a fixed MAC address is expected (like VMware when promicious mode is disallowed).
+
+* Inconsistent respondd API (`#522 <https://github.com/freifunk-gluon/gluon/issues/522>`_)
+
+  The current API is inconsistent and will be replaced eventually. The old API will still be supported for a while.
+
+* Frequent reboots due to out-of-memory or high load due to memory pressure on weak hardware specially in larger meshes
+  (`#1243 <https://github.com/freifunk-gluon/gluon/issues/1243>`_)
+
+  Optimizations in Gluon 2018.1 have significantly improved memory usage.
+  There are still known bugs leading to unreasonably high load that we hope to
+  solve in future releases.

docs/releases/v2018.1.rst

@@ -92,9 +92,9 @@ ramips-rt305x [#newtarget]_ [#noibss]_
 sunxi [#newtarget]_
 ===================
 
-* LeMaker
+* LeMaker/SinoVoip
 
-  - Lamobo r1
+  - Banana Pi (M1)
 
 
 .. [#newtarget]
@@ -207,6 +207,7 @@ site.mk
 * We recommend to use *GLUON_FEATURES* for all Gluon packages, and rely on
   *GLUON_SITE_PACKAGES* for non-Gluon (OpenWrt) packages only, as explained
   in :ref:`user-site-feature-flags`.
+* The `GLUON_ATH10K_MESH` variable was renamed to `GLUON_WLAN_MESH`.
 
 site.conf
 =========
@@ -268,6 +269,20 @@ must be made:
   When shown, the password form requires a minimum password length of 12 characters now. This requirement
   can be modified using the *config_mode.remote_login.min_password_length* setting.
 
+* Next-node hostnames
+
+  The builtin DNS resolver of Gluon can be configured to resolve a next-node hostname to the
+  next-node IP address without querying an upstream DNS server. Since Gluon v2018.1, multiple
+  names can be specified. Old configurations setting *next_node.name* to a string must be
+  updated to provide an array of strings instead:
+
+  .. code-block:: lua
+
+    next_node = {
+      name = { 'nextnode.location.community.example.org' },
+      -- ...
+    },
+
 i18n
 ====
 
@@ -287,7 +302,19 @@ The status page has been rewritten to simplify the code and reduce its size. Rat
 having a static frontend and retrieving all information via JavaScript, all static information
 in the status page is now generated on the node, and JavaScript is only used for dynamic data.
 
-To achieve this, the status page was ported to the gluon-web framework. The new status page
+Many status page API endpoints have been removed; for all remaining endpoints, CORS
+(Cross-Origin Resource Sharing) has been disabled, as it led to a privacy issues:
+malicious websites could access the API via cross-site scripting, determining which
+node a user was connected to.
+
+The removal of CORS breaks compatibility with the node switching feature of the
+old status page implementation: In the new status page, switching to another node will
+reload the whole status page from the target node, while the old implementation would
+only switch to another backend host. While this will facilitate future updates, as
+frontend and backend always come from the same node and no stable API needs to be maintained,
+it prevents switching from the old status page to nodes running the new version.
+
+To achieve all this, the status page was ported to the gluon-web framework. The new status page
 also makes use of Gluon's usual i18n facilities now. In addition, the gluon-web-model
 package was split out of the gluon-web core package, as model support is only required
 for config mode packages, but not for the new status page.
@@ -374,3 +401,21 @@ Known issues
   Optimizations in Gluon 2018.1 have significantly improved memory usage.
   There are still known bugs leading to unreasonably high load that we hope to
   solve in future releases.
+
+* Configuration loss on upgrade under certain circumstances
+  (`#1496 <https://github.com/freifunk-gluon/gluon/issues/1496>`_)
+
+  The issue can only occur when upgrading from 2018.1 and there are multiple
+  mirror entries in *site.conf* (specifically, an early failure for one of the
+  mirrors, e.g. during DNS resolution, followed by a successful upgrade from a
+  different mirror triggers the issue).
+
+  This is a regression in Gluon 2018.1.
+
+* Next-node ARP issue
+  (`#1488 <https://github.com/freifunk-gluon/gluon/issues/1488>`_)
+
+  A routing table issue leads to ARP requests being sent from the next-node IPv4 address, but with
+  a node-specific source MAC address. This can make the next-node IPv4 address unreachable.
+
+  This is a regression in Gluon 2018.1.

docs/site-example/site.conf

--- This is an example site configuration for Gluon v2018.1
+-- This is an example site configuration for Gluon v2018.1.1
 --
 -- Take a look at the documentation located at
 -- http://gluon.readthedocs.org/ for details.

docs/user/getting_started.rst

@@ -8,7 +8,7 @@ Gluon's releases are managed using `Git tags`_. If you are just getting
 started with Gluon we recommend to use the latest stable release of Gluon.
 
 Take a look at the `list of gluon releases`_ and notice the latest release,
-e.g. *v2018.1*. Always get Gluon using git and don't try to download it
+e.g. *v2018.1.1*. Always get Gluon using git and don't try to download it
 as a Zip archive as the archive will be missing version information.
 
 Please keep in mind that there is no "default Gluon" build; a site configuration
@@ -43,7 +43,7 @@ Building the images
 -------------------
 
 To build Gluon, first check out the repository. Replace *RELEASE* with the
-version you'd like to checkout, e.g. *v2018.1*.
+version you'd like to checkout, e.g. *v2018.1.1*.
 
 ::
 

docs/user/site.rst

@@ -104,7 +104,7 @@ wifi24 \: optional
     WLAN configuration for 2.4 GHz devices.
     ``channel`` must be set to a valid wireless channel for your radio.
 
-    There are currently three interface types available. You many choose to
+    There are currently three interface types available. You may choose to
     configure any subset of them:
 
     - ``ap`` creates a master interface where clients may connect

modules

@@ -2,18 +2,18 @@ GLUON_FEEDS='openwrt gluon routing luci'
 
 LEDE_REPO=https://git.openwrt.org/openwrt/openwrt.git
 LEDE_BRANCH=lede-17.01
-LEDE_COMMIT=b6a1f43075f96b0028e33ed1af1fe31068791d24
+LEDE_COMMIT=184fe11483b9595f31a028356f8cc18fb18536e3
 
 PACKAGES_OPENWRT_REPO=https://github.com/openwrt/packages.git
 PACKAGES_OPENWRT_BRANCH=lede-17.01
-PACKAGES_OPENWRT_COMMIT=338690b2f79e2c7090be4e9adbb19b452c9e3c36
+PACKAGES_OPENWRT_COMMIT=40da7ecf21ffe1f3523ffa430c406e1db58ce3d4
 
 PACKAGES_GLUON_REPO=https://github.com/freifunk-gluon/packages.git
 PACKAGES_GLUON_COMMIT=be2c35785994e443d895225c7240474a46f64f5e
 
 PACKAGES_ROUTING_REPO=https://github.com/openwrt-routing/packages.git
 PACKAGES_ROUTING_BRANCH=openwrt-18.06
-PACKAGES_ROUTING_COMMIT=1b9d1c419f0ecefda51922a7845ab2183d6acd76
+PACKAGES_ROUTING_COMMIT=bc6e7f6903c8237c77131aedfc92dba40e1bc6ac
 
 PACKAGES_LUCI_REPO=https://github.com/openwrt/luci.git
 PACKAGES_LUCI_BRANCH=lede-17.01

package/gluon-client-bridge/luasrc/lib/gluon/upgrade/310-gluon-client-bridge-local-node

@@ -23,7 +23,8 @@ uci:section('network', 'device', 'local_node_dev', {
 local ip4, ip6
 
 if next_node.ip4 then
-	ip4 = next_node.ip4 .. '/32'
+	local plen = site.prefix4():match('/%d+$')
+	ip4 = next_node.ip4 .. plen
 end
 
 if next_node.ip6 then

package/gluon-config-mode-core/files/lib/gluon/config-mode/www/index.html

 <!DOCTYPE html>
 <html xmlns="http://www.w3.org/1999/xhtml">
 	<head>
+		<meta http-equiv="Cache-Control" content="no-cache, no-store, must-revalidate" />
+		<meta http-equiv="Pragma" content="no-cache" />
+		<meta http-equiv="Expires" content="0" />
 		<meta http-equiv="refresh" content="0; URL=/cgi-bin/config" />
 	</head>
 	<body>

package/gluon-config-mode-mesh-vpn/i18n/de.po

@@ -29,7 +29,7 @@ msgid ""
 "bandwidth available for the network. You can limit how much bandwidth the "
 "node will use at most."
 msgstr ""
-"Dein Knoten kann deine Internetverbindung nutzen um darüber eine "
+"Dein Knoten kann deine Internetverbindung nutzen, um darüber eine "
 "VPN-Verbindung zu anderen Knoten aufzubauen. Die dafür "
 "genutzte Bandbreite kannst du beschränken. Aktiviere die Option, falls keine "
 "per WLAN erreichbaren Nachbarknoten in deiner Nähe sind oder du deine "

package/gluon-mesh-batman-adv/files/lib/gluon/ebtables/250-next-node

@@ -15,6 +15,14 @@ rule('OUTPUT --logical-out br-client -o bat0 -s ' .. macaddr .. ' -j DROP')
 if next_node.ip4 then
 	rule('FORWARD --logical-out br-client -o bat0 -p ARP --arp-ip-src ' .. next_node.ip4 .. ' -j DROP')
 	rule('FORWARD --logical-out br-client -o bat0 -p ARP --arp-ip-dst ' .. next_node.ip4 .. ' -j DROP')
+	rule('FORWARD --logical-out br-client -i bat0 -p ARP --arp-ip-src ' .. next_node.ip4 .. ' -j DROP')
+	rule('FORWARD --logical-out br-client -i bat0 -p ARP --arp-ip-dst ' .. next_node.ip4 .. ' -j DROP')
+
+	rule('OUTPUT --logical-out br-client -o bat0 -p ARP --arp-ip-src ' .. next_node.ip4 .. ' -j DROP')
+	rule('OUTPUT --logical-out br-client -o bat0 -p ARP --arp-ip-dst ' .. next_node.ip4 .. ' -j DROP')
+
+	rule('INPUT -i bat0 -p ARP --arp-ip-src ' .. next_node.ip4 .. ' -j DROP')
+	rule('INPUT -i bat0 -p ARP --arp-ip-dst ' .. next_node.ip4 .. ' -j DROP')
 
 	rule('FORWARD --logical-out br-client -o bat0 -p IPv4 --ip-destination ' .. next_node.ip4 .. ' -j DROP')
 	rule('OUTPUT --logical-out br-client -o bat0 -p IPv4 --ip-destination ' .. next_node.ip4 .. ' -j DROP')

package/gluon-mesh-batman-adv/luasrc/lib/gluon/upgrade/320-gluon-mesh-batman-adv-client-bridge

@@ -25,10 +25,6 @@ uci:section('network', 'interface', 'client', {
 uci:delete('network', 'client_lan')
 
 uci:delete('network', 'local_node_route')
-uci:section('network', 'route', 'local_node_route', {
-	interface = 'client',
-	target = site.prefix4(),
-})
 
 uci:delete('network', 'local_node_route6')
 uci:section('network', 'route6', 'local_node_route6', {

package/gluon-mesh-batman-adv/src/respondd.c

@@ -94,7 +94,7 @@ static struct json_object * get_addresses(void) {
 		if (sscanf(line,
 			   "%2"SCNx8"%2"SCNx8"%2"SCNx8"%2"SCNx8"%2"SCNx8"%2"SCNx8"%2"SCNx8"%2"SCNx8
 			   "%2"SCNx8"%2"SCNx8"%2"SCNx8"%2"SCNx8"%2"SCNx8"%2"SCNx8"%2"SCNx8"%2"SCNx8
-			   "  %*2x %*2x %*2x %2x %"STRINGIFY(IF_NAMESIZE)"s",
+			   "  %*x %*x %*x %x %"STRINGIFY(IF_NAMESIZE)"s",
 			   &addr.s6_addr[0], &addr.s6_addr[1], &addr.s6_addr[2], &addr.s6_addr[3],
 			   &addr.s6_addr[4], &addr.s6_addr[5], &addr.s6_addr[6], &addr.s6_addr[7],
 			   &addr.s6_addr[8], &addr.s6_addr[9], &addr.s6_addr[10], &addr.s6_addr[11],

package/gluon-status-page/files/lib/gluon/status-page/www/index.html

 <!DOCTYPE html>
 <html xmlns="http://www.w3.org/1999/xhtml">
 	<head>
+		<meta http-equiv="Cache-Control" content="no-cache, no-store, must-revalidate" />
+		<meta http-equiv="Pragma" content="no-cache" />
+		<meta http-equiv="Expires" content="0" />
 		<meta http-equiv="refresh" content="0; URL=/cgi-bin/status" />
 	</head>
 	<body>

patches/lede/0014-procd-remove-procd-nand-package.patch

@@ -12,7 +12,7 @@ as a separate package.
 Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
 
 diff --git a/package/base-files/Makefile b/package/base-files/Makefile
-index 4fbc9a265b535d850fe812085677b3f6aabf4e1f..c971de4deee7cd331ddcad6b87eb9fefd7af6a64 100644
+index 1d034fdede7598f15b1f802c47e834990e5852d9..f473ef732106eb8fa05e7c5b59df176fef33e42d 100644
 --- a/package/base-files/Makefile
 +++ b/package/base-files/Makefile
 @@ -19,7 +19,9 @@ PKG_BUILD_DEPENDS:=usign/host

patches/lede/0038-ar71xx-add-support-for-TP-Link-Archer-C25-v1.patch

@@ -64,10 +64,10 @@ index bc2fc2f774c4f2f0bbfa6e43d9b9a55e9b63153d..38cc5d7853c79f2a7800a387310a95ab
  	mr16|\
  	nbg6616|\
 diff --git a/target/linux/ar71xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata b/target/linux/ar71xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
-index b3e23c9a8f8c56870ef36fb55ae52e6b5ea61134..68f90de802ddd18e09a1da39c0d56292eea9489c 100644
+index 96ca65e694bb5ed449dcae8dbca1930d25612602..fc9eb005623fc029f839d7ce14788ffba32e42e5 100644
 --- a/target/linux/ar71xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
 +++ b/target/linux/ar71xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
-@@ -92,6 +92,7 @@ case "$FIRMWARE" in
+@@ -98,6 +98,7 @@ case "$FIRMWARE" in
  		ath10kcal_extract "art" 20480 2116
  		ath10kcal_patch_mac $(macaddr_add $(cat /sys/class/net/eth0/address) -2)
  		;;
@@ -102,7 +102,7 @@ index d2dc88127c02746cdecc4ced28f33548f35d037c..6258713dd0e3325ab109689f0ed3b51e
  	c-55|\
  	carambola2|\
 diff --git a/target/linux/ar71xx/config-4.4 b/target/linux/ar71xx/config-4.4
-index a8622454b421c1c74a8a71134b53c50399114aa5..e10401d42ae06506f82f2f5538fbc7df79fd4c65 100644
+index 91eb9f0de7ef6c472cdccf2022d888df53b75e46..d1d879cd764259571cce2a5e091ae99f0d7a6d6d 100644
 --- a/target/linux/ar71xx/config-4.4
 +++ b/target/linux/ar71xx/config-4.4
 @@ -51,6 +51,7 @@ CONFIG_ATH79_MACH_AP152=y