Many functions of configure-layer3 terminate the program after
successful execution, as they were originally only intended for
execution of configure-layer3 commands.
However, some functions are used both for command exection, but also as
helper functions. For example, revert_changes() is used as a helper
function in test_changes(). Terminating the program at the end of the
function therefore ends the exection of test_changes() prematurely. As a
result, the test mode of configure-layer3 never reloads services after
a successful configuration revert.
Replace exit commands with appropriate function return values, which can
then be evaluated by the caller where appropriate.
While at it, add a missing return to the parameter validation in
execute_subshell().
Fixes: #256
Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
Support for devices with two ports was originally intended for built-in
swconfig switches with only two externally exposed ethernet ports.
With the switch from ath71xx to ath79, the only device which ever made
use of this uncommon configuration (CPE210-v1) now has to dedicated
interfaces exposed to Linux. Therefore, two-port support was modified to
support two distinct interfaces instead of swconfig switch
configuration, which also simplified support for a few other devices.
However, the Web UI has not been taken into account. Due to the way the
Web UI detected a two-port device, the already implemented port selector
is not shown.
Use the TWO_PORT variable introduced with the change mentioned above to
detect two-port devices instead.
Fixes: #257
Fixes: c22032e254 ("fff-network: support native two-port devices")
Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
Currently router ipv6 addresses imported via the direct protocol from
the lo interface are all filtered. This should fix it.
Signed-off-by: Johannes Kimmel <fff@bareminimum.eu>
Reviewed-by: Fabian Bläse <fabian@blaese.de>
The stderr of batctl should be redirected.
In a row of pipes a redirection at the end will only redirect the output of the last command! Put it on the right place.
It's just shell grammar.
Signed-off-by: Robert Langhammer <rlanghammer@web.de>
Reviewed-by: Christian Dresel <freifunk@dresel.systems>
The update notification has been botched into the web ui a long time
ago. It has not been overhauled ever since.
Make it at least a little bit less ugly.
Signed-off-by: Fabian Bläse <fabian@blaese.de>
None of our current settings require a reboot to be applied. Only a
hood change is not done immediately. Therefore, the user is not required
to reboot the router after changing settings, so remove the reboot
request.
Fixes: #107
Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Christian Dresel <freifunk@dresel.systems>
A full reboot is not required for changing the port mode. The port mode
is configured dynamically using configurenetwork, which can be launched
after the port mode has been changed.
Fixes: #107
Signed-off-by: Fabian Bläse <fabian@blaese.de>
Acked-by: Christian Dresel <freifunk@dresel.systems>
This allows to specify the number of threads used in
'./buildscript build' manually by adding them as third option, e.g.
./buildscript build fast 20
./buildscript build debug 4
./buildscript build default 10
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Reviewed-by: Fabian Bläse <fabian@blaese.de>
The md5 checksum has not been used by fff-upgrade since 2016 [1]. Since
md5 does not have any advantages over sha256 in our use case, drop md5
checksum entirely.
[1] da1199a55b
Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Christian Dresel <freifunk@dresel.systems>
The new x86_64 target produces gzip compressed binaries, so it is
necessary to generate checksums for *.img.gz files as well.
Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Christian Dresel <freifunk@dresel.systems>
A recent change (b26399283a) introduced an upper limit for the preferred
and valid lifetimes, so the statically configured addresses on the client
interface do not result in infinite lifetimes.
This upper bound is derived from the dhcp lease time. However, the
preferred lifetime is unexpectedly bound by an explicit configuration
option in recent versions of odhcpd. Due to our short dhcp leasetime,
the default value of this option is higher than the lease time, which
results preferred lifetimes longer than the valid lifetime.
As this behavior is rather unintuitive, a proper fix for it should be
done upstream (see #238). Until then, lower the preferred lifetime
option to the same value as our leasetime.
Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Christian Dresel <freifunk@dresel.systems>
Insert the lost "&"
Fixes: #239
Signed-off-by: Robert Langhammer <rlanghammer@web.de>
Reviewed-by: Christian Dresel <freifunk@dresel.systems>
Reviewed-by: Fabian Bläse <fabian@blaese.de>
Do not hide uci errors when checking if gateway config exists, so an
appropriate uci error message is displayed. This can be helpful to find
syntax errors.
Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Christian Dresel <freifunk@dresel.systems>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
When advertising network prefixes gathered from the interface, odhcpd
sets the preferred and valid lifetime of those prefixes in the router
advertisement to the values set for those addresses on the interface.
When prefixes are configured statically (as done in our firmware), this
means that odhcp announces these prefixes for SLAAC with infinite
preferred and valid lifetimes.
While this does not seem like a problem at first, it hurts significantly
when configuration errors are made or cables are plugged into the wrong
ports, because those addresses never vanish from devices anymore, as long
as they are powered up. Also, it makes it impossible to change prefixes
without gracefully shutting down the RA server, so it can announce zero
lifetimes for previously announced prefixes.
Sadly, odhcp does not have an option to configure these lifetimes
explicitly, but it is possible to limit these lifetimes to the lease
time configured and used for the DHCP functionality of odhcpd.
Enable the appropriate 'ra_useleasetime' option to reduce impact of the
before mentioned problems.
Fixes: #142
Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Christian Dresel <freifunk@dresel.systems>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
Add pipeline configuration for Woodpecker CI. This tells Woodpecker how
to build our firmware, so it can automatically generate firmware images
for all commits to the master branch.
Continuous integration not only helps spotting build errors early, but
also allows non-developers to test the firmware during development.
Signed-off-by: Fabian Bläse <fabian@blaese.de>
Acked-by: Christian Dresel <freifunk@dresel.systems>
The x86 OpenWrt target does not have device names, as x86 images are
generic for various hardware. Therefore, removing the target and
subtarget from the image name results in an indistiguishable image name.
Keep the target name for x86 images, so the resulting images are
distinguishable.
Fixes: #229
Signed-off-by: Fabian Bläse <fabian@blaese.de>
*-ssl variants of mosquitto require libopenssl, which increases the
storage requirement by almost 1 MB, even when compressed with squashfs.
Because we currently do not need TLS support for fff-mqtt, switch to the
nossl variant to save space and allow building for devices with 8 MiB
flash.
Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Christian Dresel <freifunk@dresel.systems>
Disabling vxlan via uci solves all problemes.
A reload_config does now everything we need. Bringing up vxlan if peers available and shuting down the Interface if not.
This will also remove old fdb entries and clear the batman tables immediately.
No ifup and no extra cleaning of the fdb is required.
Signed-off-by: Robert Langhammer <rlanghammer@web.de>
Acked-by: Fabian Bläse <fabian@blaese.de>
Reset vid if no peers are available.
If a router switches to a hood without vxlan, or the peers in the hoodfile disappear, the vid should be reset.
Signed-off-by: Robert Langhammer <rlanghammer@web.de>
Acked-by: Fabian Bläse <fabian@blaese.de>
Without "uci commit" peers do not appear in /etc/config network. Use uci show instead.
Signed-off-by: Robert Langhammer <rlanghammer@web.de>
Acked-by: Fabian Bläse <fabian@blaese.de>
In a previous change all static configuration has been moved from
configurenetwork to a static uci-defaults script. As the configuration
of the switch is completely static, while port assignment for ONE and
TWO_PORT devices is dynamic, this patch slightly changed the condition
for the creation of the switch config.
Instead of only configuring the switch, if ONE_PORT and TWO_PORT is not
set, the switch is now always configured if a swconfig device is
present. However, some ONE and TWO_PORT devices have a swconfig device,
even though only a single physical port is connected to it. Those
devices require an unconfigured switch to function properly.
Therefore, introduce additional conditions, so the switch configuration
is not generated if ONE_PORT or TWO_PORT is set.
Fixes: 1c3328e64a ("Remove static configuration from dynamic script")
Signed-off-by: Fabian Bläse <fabian@blaese.de>
ETHPORT was used to configure devices with two physical ethernet ports,
one of them being connected directly to the CPU, while the other one is
connected to the internal switch of the platform.
As the GL-AR150 has been converted to the TWO_PORT codepath and no other
devices utilizes ETHPORT, remove all leftovers.
Signed-off-by: Fabian Bläse <fabian@blaese.de>
Tested-by: Sebastian Beck <freifunk@beibecks.de>
The GL-AR150 has two ethernet ports. One of them is connected directly
to the CPU (labeled "WAN"), while the other one (labeled "LAN") is
connected to the internal switch of the AR9330 platform.
Previously, this device had its own codepath in configurenetwork,
utilizing the ETHPORT variable, so the single physical port of the
switch could be connected to either the CLIENT or BATMAN vlan of the
SWITCHPORT.
When adding support for TWO_PORT devices, this codepath was accidentally
removed, so the LAN-Port was not configured anymore.
Configuring the internal switch is not necessary when only a single
physical port ist connected to it. Instead, leave the switch
unconfigured, so it behaves like an unmanaged vlan-transparent switch.
As we support TWO_PORT devices now, utilize the TWO_PORT codepath
(instead of the ONE_PORT codepath, which would be equivalent to the old
behaviour) to make both ports configureable. To retain the previously
configured mode of the LAN-Port, migrate ETHPORT to LAN1MODE before
executing configurenetwork.
Fixes: #222
Fixes: c22032e254 ("fff-network: support native two-port devices")
Signed-off-by: Fabian Bläse <fabian@blaese.de>
Tested-by: Sebastian Beck <freifunk@beibecks.de>
Instead of tampering with the 'DEFAULT' property of meta packages on
every build in a non-portable way, use the build system as intended and
select packages using an approriate build config ('.config').
This is achived by adding the approriate variant package to the build
config before expanding it using defconfig.
By that, the fff-variant-* packages and FFF_VARIANT environment variable
can be removed. Base packages required in both variants are now included
via fff-base (formerly fff-variant/default).
Besides cleaning up the build process, this change also fixes a recent
issue with build dependencies, as they are evaluated on a per-package
basis instead of per-variant. Due to that, dependencies of all
variants are compiled, regardless of the selected variant. Combined with
a recent build issue of mosquitto (see [1]), the node variant could not
be built from a clean state.
[1] https://github.com/eclipse/mosquitto/issues/2432
Signed-off-by: Fabian Bläse <fabian@blaese.de>
fastd startup changed to procd. That's why it's broken.
Now a fastd reload can be used for all conditions.
An extra fastd stop is implemented to bring down the Interface.
fastd reload doesn't do that.
Fixes: #215
Signed-off-by: Robert Langhammer <rlanghammer@web.de>
Acked-by: Fabian Bläse <fabian@blaese.de>
There are two reasons why there should be no peers.
Meshrouter without wan or no peers in hoodfile for a protocol.
With this patch there is only one condition left for vpn-start-stop.
Peers present or not. And it is less complicated to implement start/stop.
Signed-off-by: Robert Langhammer <rlanghammer@web.de>
Acked-by: Fabian Bläse <fabian@blaese.de>
This patch add the latency to the nodewatcher data.
The target of the ping can configure in /etc/config/fff
Example:
config latency 'latency'
option ipv4 'ff1.zbau.f3netze.de'
option ipv6 'ff1.zbau.f3netze.de'
if no target is set, no latency is send.
Signed-off-by: Christian Dresel <freifunk@dresel.systems>
Acked-by: Fabian Bläse <fabian@blaese.de>
Some users might want to prefer one babel implementation over another
for various reasons. Having to compile the firmware from scratch can be
quite tedious in that case.
Instead, make the babel implementation switchable at runtime.
The implementation can be switched manually using the uci option
`babelimpl.impl.impl`, which currently is not upgrade-safe.
Signed-off-by: Fabian Bläse <fabian@blaese.de>
Acked-by: Christian Dresel <freifunk@dresel.systems>
Bird 2 has a few advantages over babeld. Especially the possiblity to
dynamically reload the configuration without restarting the daemon and
birds significant performance advantage make it an interesting
alternative to babeld for our firmware.
This adds the necessary implementation-specific fff-babel-bird2 package,
which allows to integrate bird2 into the fff firmware.
Signed-off-by: Fabian Bläse <fabian@blaese.de>
Acked-by: Christian Dresel <freifunk@dresel.systems>
To be able to swap out babeld for a different babel implementation in
the future, this splits all fff-specific configuration into a seperate
fff-babel package.
Implementation specific configuration is done in
/lib/functions/fff/babeldaemon, which is included with every selectable
babel implementation. It contains functions, which are called by the
fff-specific code, and therefore allows to configure the implementation
specific parts.
The babel implementation is provided by implementation-specific
fff-packages, which provide 'fff-babel-implementation'. At the moment,
only fff-babeld is supported for use as babel implementation.
Signed-off-by: Fabian Bläse <fabian@blaese.de>
Acked-by: Christian Dresel <freifunk@dresel.systems>
This patch adds support for the x86_64 target. Both legacy and UEFI boot
are supported.
Currently, only a single network interface is supported, which is
configured like any other ONE_PORT device. Therefore, this target is not
very useful for the node variant. However, vlan interfaces can be
configured for client, wan and peering sections in the layer3
configuation.
Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Christian Dresel <freifunk@dresel.systems>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
If a prefix is used for a client interface utilizing snat, it shall
not be publicly reachable, so it can be reused across multiple routers.
To prevent such prefixes from leaking, create appropriate babel filters
if snat is used.
Fixes: #196
Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Christian Dresel <freifunk@dresel.systems>
The default cachesize for dnsmasq is 150 entries, which results in a
poor cache hit rate.
Raise the default to 1024 to provide better cache hit rates on all
devices while still keeping memory usage in check.
Further increase the cachesize to 8192 entries for systems with enough
ram (currently more than 64MB).
The memory usage will increase roughly 100B per entry.
The size was chosen empirically. Higher values don't seem to increase
cache hit rate a lot.
Signed-off-by: Johannes Kimmel <fff@bareminimum.eu>
Reviewed-by: Fabian Bläse <fabian@blaese.de>
This adds snmp-utils support to facilitate testing future uses for s2nproxy
WIP/RFC for s2nproxy:
freifunk-franken/firmware#194
Signed-off-by: Christian Dresel <freifunk@dresel.systems>
Reviewed-by: Fabian Bläse <fabian@blaese.de>
The OOM killer does not make much sense on a router, because regardless
of which process is killed, most of the time some essential core
functionality is affected.
Set the panic on OOM sysctl, so every OOM leads to a kernel panic and
results in a reboot of the router, which restores a clean state.
Fixes: #131
Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Johannes Kimmel <fff@bareminimum.eu>
Previously, some interfaces in the client ifname list have been kept.
The actual reason for this is unknown, it might have been used for the
bat0 interfaces.
Filtering the interface list in this way might lead to interfaces being
retained unintentionally, especially with the diverse naming of DSA
interfaces.
As it is not required anymore, remove the retention of some interfaces
completely.
Fixes: #207
Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
Reviewed-by: Johannes Kimmel <fff@bareminimum.eu>
Currently we are utilizing stacked bridges to keep configuration of DSA
devices as close as possible to swconfig devices. The lower bridge is
for configuration of the DSA hardware and is vlan-aware, while the upper
bridge is used to connect wireless interfaces to the client interface.
A packet arriving from the switch might have the offload_fwd_mark flag
set in the skb to prevent it from being sent to DSA ports, as this has
already been done in hardware.
However, this flag is not cleared before the skb is processed by the
upper bridge, which prevents it from being sent to any other ports of
that bridge. Therefore, communication is not possible between different
ports of that bridge, while communication with the bridge interface
itself is possible.
This issue affects both the layer3 and node variant, but due to the
layer 2 architecture of the node firmware, it is far more noticeable in
the node firmware, as it prevents ethernet clients from sending packets
to the gateway.
Work around this issue by clearing the offload_fwd_mark flag before
passing the skb up.
Fixes: #205
Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Johannes Kimmel <fff@bareminimum.eu>
The base network configuration has been completely migrated to
uci-defaults scripts and any existing network configuration is dropped.
Therefore, the hardcoded /etc/config/network configuration file is not
required anymore. Remove it.
Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
With the recent rework of the network configuration, any existing
configuration is dropped in a uci-defaults script (22-network-base) and
generated from scratch. When rebasing this rather old patchset, the
packet_steering option was overlooked, so it is missing now.
Restore the removed packet_steering option by setting it using a
dedicated uci-defaults script.
Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
With a recent patchset the initial boot process of the fff-network
package has been significantly altered. The base network configuration
is now generated by a uci-defaults script which completely drops
any existing network configuration first (22-network-base).
Reorder some uci-defaults scripts which extend the base network
configuration with layer3-specific rules, so they are executed after
22-network-base.
Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
Most of the configuration done in configurenetwork is static and does
not change after the first boot. Move this static configuration into a
uci-defaults script, which is only executed on first boot.
Configuration which might be changed at runtime (e.g. port assignment),
is kept in the configurenetwork script.
To improve readability and speed, combine multiple uci commands into a
uci batch. Drop any existing network configuration before applying our
own configuration. This requires the network.globals section to be
created explicitly. Also, the fdff:: addresses, ETHMESHMAC and ROUTERMAC
can be set unconditionally, as the uci-defaults script is only executed
once. Other than that, the static configuration has not been altered.
Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
The explicit restat of fff-uradvd is not necessary anymore, as
appropriate procd reload triggers have been added, and reload_config is
executed after every run of configurenetwork.
Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
Instead of both setting values in the uci configuration and applying
them manually, only set the values in the uci configuration and do a
combined reload_config afterward.
This not only ensures that the changes to the configuration are actually
correct, but also decreases the runtime of configurenetwork.
Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
Fabian Bläse
Johannes Kimmel
Robert Langhammer
Adrian Schmutzler
Christian Dresel