Commit 7c7332d5 authored by oni's avatar oni

Merge branch 'experimental' into beta

parents 88203f0f 00b3544e
......@@ -131,8 +131,8 @@ GLUON_$(1)_MODELS :=
define GluonModel
GLUON_$(1)_MODELS += $(2)
GLUON_$(1)_MODEL_$(2) := $(3)
GLUON_$(1)_MODELS += $(3)
GLUON_$(1)_MODEL_$(3) := $(2)
......@@ -339,11 +339,11 @@ image: FORCE
$(foreach model,$(GLUON_$(PROFILE)_MODELS), \
rm -f $(GLUON_IMAGEDIR)/factory/gluon-*-$(GLUON_$(PROFILE)_MODEL_$(model)).bin && \
rm -f $(GLUON_IMAGEDIR)/sysupgrade/gluon-*-$(GLUON_$(PROFILE)_MODEL_$(model))-sysupgrade.bin && \
rm -f $(GLUON_IMAGEDIR)/factory/gluon-*-$(model).bin && \
rm -f $(GLUON_IMAGEDIR)/sysupgrade/gluon-*-$(model)-sysupgrade.bin && \
cp $(BIN_DIR)/gluon-$(model)-factory.bin $(GLUON_IMAGEDIR)/factory/$(IMAGE_PREFIX)-$(GLUON_$(PROFILE)_MODEL_$(model)).bin && \
cp $(BIN_DIR)/gluon-$(model)-sysupgrade.bin $(GLUON_IMAGEDIR)/sysupgrade/$(IMAGE_PREFIX)-$(GLUON_$(PROFILE)_MODEL_$(model))-sysupgrade.bin && \
cp $(BIN_DIR)/gluon-$(GLUON_$(PROFILE)_MODEL_$(model))-factory.bin $(GLUON_IMAGEDIR)/factory/$(IMAGE_PREFIX)-$(model).bin && \
cp $(BIN_DIR)/gluon-$(GLUON_$(PROFILE)_MODEL_$(model))-sysupgrade.bin $(GLUON_IMAGEDIR)/sysupgrade/$(IMAGE_PREFIX)-$(model)-sysupgrade.bin && \
) :
image/%: $(gluon_prepared_stamp)
......@@ -363,10 +363,10 @@ manifest: FORCE
echo && \
($(foreach profile,$(PROFILES), \
$(foreach model,$(GLUON_$(profile)_MODELS), \
for file in gluon-*-'$(GLUON_$(profile)_MODEL_$(model))-sysupgrade.bin'; do \
for file in gluon-*-'$(model)-sysupgrade.bin'; do \
[ -e "$$file" ] && echo \
'$(GLUON_$(profile)_MODEL_$(model))' \
"$$(echo "$$file" | sed -n -r -e 's/^gluon-$(call regex-escape,$(GLUON_SITE_CODE))-(.*)-$(call regex-escape,$(GLUON_$(profile)_MODEL_$(model)))-sysupgrade\.bin$$/\1/p')" \
'$(model)' \
"$$(echo "$$file" | sed -n -r -e 's/^gluon-$(call regex-escape,$(GLUON_SITE_CODE))-(.*)-$(call regex-escape,$(model))-sysupgrade\.bin$$/\1/p')" \
"$$($(SHA512SUM) "$$file")" \
"$$file" && break; \
done; \
......@@ -3,6 +3,18 @@
if [ $# -eq 0 -o "-h" = "$1" -o "-help" = "$1" -o "--help" = "$1" ]; then
cat <<EOHELP
Usage: $0 <secret> <manifest> adds lines to a manifest to indicate the approval
of the integrity of the firmware as required for automated
updates. The first argument <secret> references a file harboring
the private key of a public-private key pair of a developer
that referenced by its public key in the site configuration.
The script may be performed multiple times to the same document
to indicate an approval by multiple developers.
See also
* edcsautils on
exit 1
Config Mode
As of 2014.4 `gluon-config-mode` consists of several modules.
This modules provides the core functionality for the config mode.
All modules must depend on it.
Provides a hostname field.
Informs whether the autoupdater is enabled.
Allows toggling of mesh-vpn-fastd and setting a bandwidth limit.
Enables the user to set the geographical location of the node.
Adds a field where the user can provide contact information.
In order to get a config mode close to the one found in 2014.3.x you may add
these modules to your ``:
Writing Config Mode Modules
Config mode modules are located at `/lib/gluon/config-mode/wizard` and
`/lib/gluon/config-mode/reboot`. Modules are named like `0000-name.lua` and
are executed in lexical order. If you take the standard set of modules, the
order is, for wizard modules:
- 0050-autoupdater-info
- 0100-hostname
- 0300-mesh-vpn
- 0400-geo-location
- 0500-contact-info
While for reboot modules it is:
- 0100-mesh-vpn
- 0900-msg-reboot
Wizard modules return a UCI section. A simple module capable of changing the
hostname might look like this::
local cbi = require "luci.cbi"
local uci = luci.model.uci.cursor()
local M = {}
function M.section(form)
local s = form:section(cbi.SimpleSection, nil, nil)
local o = s:option(cbi.Value, "_hostname", "Hostname")
o.value = uci:get_first("system", "system", "hostname")
o.rmempty = false
o.datatype = "hostname"
function M.handle(data)
uci:set("system", uci:get_first("system", "system"), "hostname", data._hostname)
return M
Reboot page
Reboot modules return a function that will be called when the page is to be
rendered or nil (i.e. the module is skipped)::
if no_hello_world_today then
return nil
return function ()
luci.template.render_string("Hello World!")
......@@ -45,7 +45,7 @@ The final image name must be the same that is returned by the following command.
lua -e 'print(require("platform_info").get_image_name())'
This is so the autoupdater can work. On targets which aren't supported by the autoupdater,
This is just for the autoupdater can work. The command has to be executed _on_ the target (eg. the hardware router with a flashed image). So you'll first have to build an image with a guessed name, and afterwards build a new, correctly named image. On targets which aren't supported by the autoupdater,
``require("platform_info").get_image_name()`` will just return ``nil`` and the final image name
may be defined arbitrarily.
......@@ -36,26 +36,49 @@ Developer Documentation
Supported Devices
* Buffalo
- WZR-HP-AG300H / WZR-600DHP
- WZR-HP-G450H
* D-Link
- DIR-825 (B1)
* Linksys
- WRT160NL
* TP-Link
- CPE210 (v1)
- CPE220 (v1)
- CPE510 (v1)
- CPE520 (v1)
- TL-MR3020 (v1)
- TL-MR3040 (v1, v2)
- TL-MR3220 (v1)
- TL-MR3420 (v1, v2)
- TL-WA750RE (v1)
- TL-WA801N/ND (v2)
- TL-WA850RE (v1)
- TL-WA901N/ND (v2)
- TL-WDR3500 (v1)
- TL-WDR3600 (v1)
- TL-WDR4300 (v1)
- TL-WR1043N/ND (v1, v2)
- TL-WR703N (v1)
- TL-WR710N (v1)
- TL-WR740N (v1, v3, v4)
- TL-WR741N/ND (v1, v2, v4)
- TL-WR841N/ND (v3, v5, v7, v8, v9)
- TL-WR842N/ND (v1, v2)
- TL-WR941N/ND (v2, v3, v4)
- TL-WR1043N/ND (v1, v2)
- TL-WDR3500 (v1)
- TL-WDR3600 (v1)
- TL-WDR4300 (v1)
- TL-WA901N/ND (v2)
- TL-MR3020 (v1)
- TL-MR3040 (v1)
- TL-MR3220 (v1)
- TL-MR3420 (v1, v2)
* Ubiquiti
......@@ -65,14 +88,6 @@ Supported Devices
- UniFi AP
- UniFi AP Outdoor
* D-Link
- DIR-615 (E1)
- DIR-825 (B1)
* Linksys
- WRT160NL
Gluon 2014.4 (In development)
Gluon 2014.4
Added (and removed) hardware support
* Buffalo
- WZR-HP-AG300H / WZR-600DHP
- WZR-HP-G450H
* D-Link
- DIR-615 (E1) support had to be dropped
- CPE210/220/510/520 (v1)
- TL-MR3040 (v2
- TL-WA750RE (v1)
- TL-WA801N/ND (v2)
- TL-WA850RE (v1)
- TL-WR703N (v1)
- TL-WR710N (v1)
- TL-WR1043N/ND (v2)
New hardware support
* TP-Link TL-WR1043N/ND v2
New features
OpenWrt Barrier Breaker
Switching to the new OpenWrt release 14.09 ("Barrier Breaker") has yielded
lots of updates for both the kernel and most packages. Besides better
performance, this has also greatly improved stability (far less out-of-memory
Modular config mode
The old ``gluon-config-mode`` package has been split into five
small packages, each providing a single section of the config
mode form. This simplifies removing or replacing parts of the wizard.
See the *Site changes* section for details.
Experimental support for batman-adv compat 15
As batman-adv has broken compatiblity starting with batman-adv 2014.0
(bumping the "compat level" to 15), Gluon users must decide which
batman-adv version to use. The package for the old batman-adv version
``gluon-mesh-batman-adv`` has been renamed to ``gluon-mesh-batman-adv-14``,
the new version can be used with ``gluon-mesh-batman-adv-15``.
Please note that batman-adv compat 15 still isn't tested very well
(and there are known bugs in the current release 2014.3), so for now
we still recommend using compat 14 in "production" environments.
fastd v16
Besides other new features and bugfixes, fastd v16 support the new
authentication method "UMAC". We recommend switching from the old
``salsa2012+gmac`` and ``null+salsa2012+gmac`` methods to the new
``salsa2012+umac`` and ``null+salsa2012+umac`` as UMAC is
much faster and even more secure than GMAC.
Private WLAN
The new package ``gluon-luci-private-wifi`` allows to configure a private WLAN
with WPA-PSK in the expert mode which is bridged with the WAN uplink.
Embedding SSH keys
Using ``gluon-authorized-keys`` it is possible to embed predefined SSH
public keys to firmware images. If ``gluon-config-mode-*`` is left out
images will be ready to mesh after the first boot with SSH running for
further configuration.
Status page resolves nodenames
The tools ``gluon-announced`` and ``gluon-neighbour-info`` are now
available. Using them enables the status page to resolve hostnames and
IPs of a nodes' neighbours.
This will also work on devices with multiple wireless interfaces.
* Expert Mode: Fixed all SSH keys being removed when a password was set
* ``gluon-mesh-vpn-fastd``: Fixed VPN peers removed from the ``site.conf`` not being removed from ``/etc/config/fastd``
* TL-LINK TL-WDR3600/4300: Added workaround for reboot issues
* Improved stability (due to switch to OpenWrt Barrier Breaker)
Site changes
* ``site.conf``
* ````
- Obsolete packages:
......@@ -32,8 +107,46 @@ Site changes
+ ``gluon-config-mode-mesh-vpn``
+ ``gluon-config-mode-geo-location``
+ ``gluon-config-mode-contact-info``
+ ``gluon-mesh-batman-adv-14`` or ``gluon-mesh-batman-adv-15`` (specify this before all other packages in the list)
+ ``gluon-mesh-batman-adv-14`` (specify this before all other packages in the ````!)
* We're on Barrier Breaker now!
The switch to Barrier Breaker has led to a multitude of changes all over Gluon:
* The config mode/setup mode is now started by an own set of init scripts in ``/lib/gluon/setup-mode/rc.d`` run by procd
* Many tools and services used by Gluon have been replaced by our own implementations to reduce the size of the images:
- ethtool has been replaced by our minimal Lua library *lua-ethtool-stats*
- tc has been replaced by our minimal implementation *gluon-simple-tc*
- radvd has been replaced by our minimal implementation *gluon-radvd*
Known Issues
Alfred crashes
Alfred may still crash unconditionally. Some measures have been taken
to aid but the core problem hasn't been analyzed yet.
Out of memory / batman-adv memory leaks
In some (hopefully rare!) cases batman-adv may still leak memory
associated with global TT entries. This may result in kernel panics or
out-of-memory conditions.
Ignored tx-power offset on Ubiquiti AirMax devices
There is still no OpenWRT support for determining the transmission
power offsets on Ubiquiti AirMax devices (Bullet M2, Picostation
M2, Nanostation (loco) M2, ...). Use Gluon with caution on these
devices! Manual adjustment may be required.
## gluon site modules example
# this file allows to define additional
# package feeds to be used.
# packages from this feeds can then be included
# via
# feeds to include, note that this is not called
# GLUON_FEEDS as in the Gluon modules file.
# This file allows specifying additional repositories to use
# when building gluon.
# for each feed name given, there have to be
# two variables given in the following.
# In most cases, it is not required so don't add it.
# for each feed name given, add the corresponding PACKAGES_* lines
# documented below
## PACKAGES_$feedname_REPO
# the git repository from where to clone the package feed
## PACKAGES_$feedname_COMMIT
# the version/commit of the git repository to clone
## PACKAGES_$feedname_BRANCH
# the branch to check out
--[[ gluon site.conf example
This file is loosely related to the original site.conf used in Lübeck.
There are comments added to most switches to explain the usage of gluon.
This is lua code now, not perl anymore.
Happy compiling!
-- This is an example site configuration for Gluon v2014.4
-- Take a look at the documentation located at
-- for details.
-- This configuration will not work as it. You're required to make
-- community specific changes to it!
--[[ Community settings
hostname_prefix: Nodename prefix
freifunk-abcdef123456 (hex-part is generated from node's MAC address)
site_name: Name of your community
site_code: Shortcode of your community
hostname_prefix = 'freifunk',
site_name = 'Freifunk Lübeck',
site_code = 'ffhl',
--[[ General network settings
prefix4: IPv4 range of your community
prefix6: IPv6 range of your community
is also required for radvd
prefix4 = '',
prefix6 = 'fdef:ffc0:3dd7::/64',
--[[ NTP settings
Synchronize the time of the nodes
timezone: Timezone of your community
ntp_servers: List of NTP-Servers to query. You can use any public and/or your private NTP-Servers of your community.
timezone = 'CET-1CEST,M3.5.0,M10.5.0/3',
ntp_servers = {''},
--[[ Wireless settings
regdom: IEEE 802.11 Regulatory Domain
wifi24: Wifi settings for 2.4 GHz frequency devices
wifi5: Wifi settings for 5 GHz frequency devices
ssid: Wifi name shown to the user (We recommend
channel: Wifi channel to use
htmode: Specifies the channel width in 802.11n and 802.11ac mode, possible values are:
HT20 (single 20MHz channel),
HT40- (2x 20MHz channels, primary/control channel is upper, secondary channel is below)
HT40+ (2x 20MHz channels, primary/control channel is lower, secondary channel is above).
VHT20 / VHT40 / VHT80 / VHT160 (channel width in 802.11ac, extra channels are picked according to the specification) (-> htmode)
mesh_ssid: SSID of the mesh-interface, only used between nodes
mesh_bssid: BSSID of the mesh-interface
The supplied default of ff:ff:ff:ff:ff:ff will not work.
You'll need to replace it with randomly generated, non-broadcast BSSID!
mesh_mcast_rate: multicast rate of the mesh-interface
regdom = 'DE',
wifi24 = {
ssid = '',
channel = 1,
htmode = 'HT40+',
mesh_ssid = 'ff:ff:ff:ff:ff:ff',
mesh_bssid = 'ff:ff:ff:ff:ff:ff',
mesh_mcast_rate = 12000,
wifi5 = {
ssid = '',
channel = 44,
htmode = 'HT40+',
mesh_ssid = 'ff:ff:ff:ff:ff:ff',
mesh_bssid = 'ff:ff:ff:ff:ff:ff',
mesh_mcast_rate = 12000,
--[[ Next-Node
next_node: Howto reach the node you are currently connected to
The node will always be reachable at that address, and it's the same on all nodes. Because next_node packets are redirected within the node itself, there will be no conflicts.
ip4: IPv4 Address to use
ip6: IPv6 Address to use
mac: MAC Address to use
(TODO: What is the purpose of this MAC-Address here?)
next_node = {
ip4 = '',
ip6 = 'fdef:ffc0:3dd7::1',
mac = '16:41:95:40:f7:dc',
--[[ Gateway settings
fastd_mesh_vpn: fastd vpn settings
methods: encryption algorithms to use
When multiple method statements are given, the first one has the highest preference.
mtu: package size
backbone: fastd vpn gateways of your community
limit: Number of gateways each node connects to
On startup, each node tries to connect to every gateway, and then chooses the number of 'limit' fastest gateways it could reach
peers: Gateways
sub sub
key: public fastd key of your gateway
remotes: List of fastd configuration strings to connect to your gateway server
fastd_mesh_vpn = {
methods = {'salsa2012+gmac'},
mtu = 1426,
backbone = {
limit = 2,
peers = {
burgtor = {
key = '657af03e36ff1b8bbe5a5134982a4f110c8523a9a63293870caf548916a95a03',
remotes = {'ipv4 "" port 10000'},
holstentor = {
key = '8c660f7511bf101ea1b599fe53af20e1146cd923c9e9d2a3a0d534ee75af9067',
remotes = {'ipv4 "" port 10000'},
huextertor = {
key = 'a1b124f43eae4f5929850c09cda825ef35d659e3db4d7746e3d97627e9fa7238',
remotes = {'ipv4 "" port 10000'},
muehlentor = {
key = 'bd4ec3cf87bb0042eed2fa121fbc402154d28fb1ae9dff9cdb71bb21892f401a',
remotes = {'ipv4 "" port 10000'},
--[[ Autoupdater settings
branch: Automatically update to this branch
branches: Available branches your community is publishing
sub sub
name: Name of branch (is used when compiling images)
mirrors: List of urls where to find the firmware
just serve the images on port 80 via http. a simple apache file-listing is enough.
probability: How often should a node search for updates
1.0 - perform an update every hour
0.5 - on average, perform an update every two hours
0.0 - inhibit any automatic updates
good_signatures: How many signatures should be valid so the node decides to upgrade itself
pubkeys: public keys by developers used in manifest file of branch
manifest file - see gluon readme
$ make manifest GLUON_BRANCH=mybranch
$ contrib/ $SECRETKEY.file images/sysupgrade/manifest
autoupdater = {
branch = 'experimental',
branches = {
stable = {
name = 'stable',
mirrors = {''},
probability = 0.08,
good_signatures = 2,
pubkeys = {
'daa19b44bbd7033965e02088127bad9516ba0fea8f34267a777144a23ec8900c', -- Linus
'a8dd60765b07330a4bbfdf8406102befca132881a4b65f3efda32cf2d5b362d9', -- Nils
'323bd3285c4e5547a89cd6da1f2aef67f1654b0928bbd5b104efc9dab2156d0b', -- NeoRaider
experimental = {
-- DE: Name des "braches" wird beim erstellen von Images / update generiert
name = 'experimental',
mirrors = {''},
probability = 1.00,
good_signatures = 2,
good_signatures = 1,
-- DE: Oeffentlicher Schluessel / Public Key der Entwickler
pubkeys = {
'496136b37e5f561dfdf523611f14e4b6bc2a745cbc1ab7daffa59fded5f202d1', -- philae
--[[ Simple TC settings to limit the bandwidth of the vpn-uplink