Jan Luebbe authored 6 years ago and chrissi^ committed 3 months ago

For parker we need DHCP on the client interface. Ths rule
prevents us from doing so.
In addition: make sure old rules will be deleted on upgrade.

Jan Luebbe authored 3 years ago and chrissi^ committed 3 months ago

respondd drops existing json object if any provider returns NULL, so we need to
return an empty object instead.

This change removes the prefix4 and prefix6 attributes from the
site.conf. These do not make sense in the context of parker.

Packages that are usually used in parker do not use these anymore. Some
other packages do - you should not enable those :-)

With this change a ipv6 route to prefix_6 will no longer be set on
br-client. Systems that already have this route will keep it.

With this change the (not working) redirect in the http status page has
been removed. We should consider to add this later on.

Hint: Some changes were moved from this commit to:
community-packages:ffbs-mesh-vpn-parker/files/lib/gluon/upgrade/401-respondd-firewall-parker
This reverts changes done in package/gluon-respondd/luasrc/lib/gluon/upgrade/400-respondd-firewall.

Jan Luebbe authored 4 years ago and chrissi^ committed 4 months ago

Packets which have a destination MAC of other local nodes should not be
redirected, as this possibly results in routing loops in networks with more
than one uplink.

Signed-off-by: Jan Luebbe <sho@stratum0.net>

chrissi^ authored 4 years ago and chrissi^ committed 4 months ago

This change let's uradvd deliver the v6 link-local of this node as DNS.
With this change DNS-requests are not affected by the radv-filterd
-rewrites during roaming.

Signed-off-by: Chrissi^ <chris@tinyhost.de>

Jan Luebbe authored 5 years ago and chrissi^ committed 4 months ago

When multiple routers are in the same local mesh and clients roam from one (A)
to the next (B), the change of global IP and default gateway are not
synchronized. This leads to packets with an address belonging to router A to be
sent via router B (or the other way around). Those packets are then dropped by
wireguard at the concentrator.

To avoid this, we let gluon-radv-filterd monitor router advertisements and keep
a list of neighbouring v6 networks. With this information, it can maintain a
set of ebtables DNAT rules to redirect the packets to the matching gateway.

Signed-off-by: Jan Luebbe <jluebbe@debian.org>

chrissi^ authored 5 years ago and chrissi^ committed 4 months ago

Using this change an VPN-node announces it's own IPv6 as DNS server.
/tmp/addr6 is written by nodeoute.lua during runtime configuration.

Signed-off-by: Chrissi^ <chris@tinyhost.de>

chrissi^ authored 6 years ago and chrissi^ committed 4 months ago

This change alles meshed PARKER-Nodes to forward IPv6 to the next node.

Signed-off-by: Chrissi^ <chris@tinyhost.de>

Jan Luebbe authored 6 years ago and chrissi^ committed 4 months ago

Signed-off-by: Jan Luebbe <jlu@pengutronix.de>

Switch config for swconfig can be found in the network,
not the system config.

This resulted in `Switch type: none` beeing reported for swconfig devices.

(cherry picked from commit d9cfa194c131452bc4f927076f35a8217dc2a483)

find_phy() did not match OpenWrt's logic for PHY names anymore, and
could not handle PHYs that don't match the 'phyX' naming scheme. Instead
of trying to add more complex logic to our own code, simply do what
OpenWrt does and use iwinfo to resolve UCI sections to PHY names.

(cherry picked from commit 29e281f759cf019d323fc0ae8c8202ad2476ce9f)

Co-authored-by: Matthias Schiffer <mschiffer@universe-factory.net>

(cherry picked from commit 10721f6e23184a1ca501ba35173e49cd90b1bfd3)

Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 9fc4918c52b7815c31ffb0317b5ca843acea5939)

(cherry picked from commit 067dc3ed02d173cf08a6089b31fe511657493e4c)

(cherry picked from commit 0e102e79904342d91fa27b75f47a5ae6b9486280)

This package allows to easily select the correct libustream implementation
without all communities having the need to manually change their included
packages.

Remove legacy migrations. These predate the currently supported upgrade path,
therefore we no longer need them.

Signed-off-by: Magnus Frühling <skorpy@frankfurt.ccc.de>

Signed-off-by: David Bauer <mail@david-bauer.net>

Use a delete_call with a boolean parameter function instead of manually
iterating over all devices.

Link: https://github.com/freifunk-gluon/gluon/pull/3102



Signed-off-by: David Bauer <mail@david-bauer.net>

This preserves configuration of MAC-addresses for each interface in case
OpenWrt sets them using netifd.

This is done by preserving all device-configuration which does not
define a bridge or the MAC-address of a bridge.

Closes #3100

Signed-off-by: David Bauer <mail@david-bauer.net>

OpenWrt now uses the new mbedTLS implementation for hostapd as well as
wpa_supplicant.

In order to keep as close to upstream as possible, use these
derivations.

Signed-off-by: David Bauer <mail@david-bauer.net>

Use CAKE for shaping ingress as well as egress bandwidth shaping.

CAKE allows to better shape egress as well as ingress bandwidth. It not
only performs bandwidth shaping but also flow-queueing.

This in conjunction with the batadv flow dissector allows us to utilize
CAKE for all mesh-implementations currently supported in Gluon.

Signed-off-by: David Bauer <mail@david-bauer.net>

Add GLuon meta-package to include on devices that support SQM.

This package provides sqm-scripts as a dependency. SUpporting mesh-vpn
protocols can then conditionally enable SQM on the VPN link.

Signed-off-by: David Bauer <mail@david-bauer.net>

This code was added way back in 2017. We don't support updates from
those old versions, so we can remove it.

Signed-off-by: David Bauer <mail@david-bauer.net>

In case no interface role was selected for a given interface,
gluon-reconfigure currently fails with

Configuring: 021-interface-roles
/usr/bin/lua: /usr/lib/lua/gluon/util.lua:25: bad argument #1 to 'pairs' (table expected, got nil)
stack traceback:
	[C]: in function '?'
	/usr/lib/lua/simple-uci.lua:22: in function 'foreach'
	./021-interface-roles:47: in main chunk
	[C]: ?

Check we actually have a role set before accessing the table.

Signed-off-by: David Bauer <mail@david-bauer.net>

Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>

google-lighthouse:
Warning: Consider avoiding viewport values that prevent users from resizing documents.

Rule ID: meta-viewport
Accessibility:
Ruleset: axe-core 4.4
User Impact: Critical
Guidelines: WCAG 2.1 Best Practice, WCAG 2.0 Best Practice

The vpn-core package does not utilize simple-tc anymore.
This is now up to the VPN implementations.

Signed-off-by: David Bauer <mail@david-bauer.net>

Remove old migrations which are due to be removed.

Signed-off-by: David Bauer <mail@david-bauer.net>

Signed-off-by: David Bauer <mail@david-bauer.net>

Rouven Czerwinski authored 1 year ago and Emantor committed 1 year ago

Allocation of the router structure for newly detected router
advertisements was done using malloc and selectively clearing some of
the structure fields. However the redirect boolean was never set to 0,
which means that during update_redirect, we would depend on the random
initialization value of the structure.

This means that sometimes ebtables-tiny wouldn't add the correct rules
for the advertised routes.

Also known in Germany as Gigacube CAT20

The lua-bit32 library is pulled in by luaposix already, so we can drop
luabitops.