Commit Graph

1277 Commits

Author SHA1 Message Date
Adrian Schmutzler 539406d96b fff-network: fix primary port for Nanostation M
Migration from ar71xx to ath79 included changes to the ethernet/switch
driver for the target. This introduced a peculiar issue where
eth0 and eth1 are swapped for several devices. Most of the relevant
cases were already covered in 1cf4d762ff ("treewide: move devices
from ar71xx to ath79").

This switch also affects the Nanostation M, where the PoE-in port
is now eth1 und the PoE-out port is eth0. However, no action was
taken in the referenced patch, as nobody was aware of it then.

Since the Nanostation M is a two-port device, which we cannot
implement properly so far, it was implemented as a one-port with
the "primary" PoE-in port so far. This was broken by the ath79
introduction and is now fixed in this patch by using the one-port
setup on eth1. That way, the PoE-in port can now be switched by
ETHMODE as usual again.

Note that custom scripts, e.g. to set up the second port, need to
be adjusted manually, as that one is eth0 now.

Fixes: 1cf4d762ff ("treewide: move devices from ar71xx to ath79")
Fixes: #109 (gitea)

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Reviewed-by: Fabian Bläse <fabian@blaese.de>
Tested-by: Fabian Bläse <fabian@blaese.de>
2021-02-18 01:19:24 +01:00
Adrian Schmutzler bd15c7e178 fff-network: don't hardcode eth0 for one-ports in configurenetwork
We use the one-port implementation also on two-ports like the
Nanostation M. Therefore, hard-coding eth0 in configurenetwork
will break if the port implemented for the one-port setup
(SWITCHDEV/WANDEV) is not eth0.

Just use SWITCHDEV instead, like done for the rest of the one-port
setup.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Reviewed-by: Fabian Bläse <fabian@blaese.de>
Tested-by: Fabian Bläse <fabian@blaese.de>
2021-02-18 01:19:06 +01:00
Fabian Bläse 0927a4e51a bsp: Allow for arguments in passwd function
Previously, we have added a passwd function to our shell which executes
passwd and restarts uhttpd afterwards, so the WebUI password is updated.

This adds the ability to still pass command-line arguments to passwd.

The quoting of the shell variable $@ is special:
"$@" expands to "$1" "$2" .., so its use is correct here.

Fixes: #117

Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
2021-02-18 01:17:10 +01:00
Adrian Schmutzler fcb19bd233 buildscript: remove unneeded global download directory link
Some time ago, the firmware created a directory for each target
and built OpenWrt separately there. In this situation, it made
sense to download files only once and share them between these
build directories.

However, since we nowadays only have one build directory for all
targets, this makes no sense anymore. Remove the link.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
2021-02-09 23:01:30 +01:00
Adrian Schmutzler 597ecdc244 fff-dhcp: fix indexing and output in uci-defaults
When creating a new uci section, the safest way to refer to it is
with index '-1'. While it (probably) does not make a functional
difference for our specific case, since we expect to only have one
section anyway, let's just make sure and use the proper indexing.

While at it, suppress output from the 'add' command.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
2021-02-09 22:59:18 +01:00
Adrian Schmutzler 1946aaca87 fff: create proper package variants instead of copying file
So far, we ensure the selection of a specific variant by copying
included Make files. This not only breaks if the packages are used
as a feed, but also is against the concept of how packages are used.

In this patch, the fff package is converted into a set of variants
that allow selection via a FFF_VARIANT variable that is exported by
buildscript. If no export happens, e.g. when using packages in a
feed, no package is selected.

Since the names fff-node and fff-layer3 are not available anymore,
the packages for the variants are called (though irrelevant for
the user):

  * fff-variant-layer3
  * fff-variant-node

The only drawback is that we now have to specify the list of
available variants in the buildscript. However, these values are
hardcoded in several other places as well, and the former code
based on file names was not really appealing anyway.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Tested-by: Robert Langhammer <rlanghammer@web.de>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
2021-02-09 22:54:05 +01:00
Fabian Bläse 31866435a1 fff-layer3-config: Add script to set wan vlan/interface
Allow setting WAN vlan/interface from gateway config.
A configuration without explicit definition of a WAN interface is
valid at the moment and results in the default configuration from
fff-network being used.

Originally, it was intended to automatically set WAN to vlan 2, if nothing was
specified. As this would break devices, which don't use swconfig for
WAN, the already configured WAN interface is left untouched.

Fixes: #85 (gitea)
Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Christian Dresel <freifunk@dresel.systems>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
2021-02-09 22:46:58 +01:00
Adrian Schmutzler 6ff350fcf9 fff-network: wrap CPUPORT into a function
Instead of exposing the CPUPORT variable to the calling script
directly, wrap it into a function which can be called there.

Fixes: #52 (gitea)

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Acked-by: Christian Dresel <freifunk@dresel.systems>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
2021-02-09 22:38:55 +01:00
Adrian Schmutzler cb4bce7cc2 fff-network: move PORTORDER to function/library
So far, we define PORTORDER individually in each network.* file.
This creates a lot of duplications, and makes the code to parse those
values very ugly (and it's only used outside of configurenetwork
anyway).

Therefore, move the assignment to a library file, and wrap it into
a function for tidyness. This gives us more overview and nicer
implementation of the retrieval.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Acked-by: Christian Dresel <freifunk@dresel.systems>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
2021-02-09 22:37:20 +01:00
Fabian Bläse 37695a1cfc fff-network: Add migration for Archer C7 WAN ports
With 8d66bdf the port configuration of TP-Link Archer C7 has been
changed to a single-interface configuration.

This had unforseen side effects on upgraded devices. Because WANDEV
is evaluated from the updated network.* file, the port configuration
of the switch is evaluated from the update-safe network.config, which
is now incompatible with the updated interface configuration.

Therefore, a migration script has to be added, which updates the port
configuration in network.config to the new single-interface network
configuration.

Fixes: #60 (gitea)
Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
2021-01-31 14:11:14 +01:00
Fabian Bläse afe633e874 fff-hoods: Allow correct ula_prefix syntax in hoodfiles
In earlier firmware versions the prefix had to be written
in an incorrect syntax (missing a trailing colon).
To make hoodfiles with this old incorrect syntax work with
newer firmware versions like this one, we have to fix the
incorrect syntax. Both the old, incorrect and the correct
syntax work with this fix, so in the far away future, the
correct syntax can be used in hoodfiles.

Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-01-31 14:08:09 +01:00
Adrian Schmutzler ae1ed11cd9 Revert "fff-babeld: Add rule to lookup in fff table for everything except wireguard"
This reverts commit e5da228cb1.

With the patch there can be situations with just "*" in traceroute,
breaking MTU in wireguard. If R1 with IPv6 address from provider P1
is connected to Freifunk via wireguard, and another R2 with address
from provider P2 is behind it, then R1 won't answer to traceroutes
sent from R2.

Revert the patch for now.

Fixes: #66 (gitea)

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Reviewed-by: Christian Dresel <freifunk@dresel.systems>
Reviewed-by: Fabian Bläse <fabian@blaese.de>
2021-01-31 14:05:26 +01:00
Adrian Schmutzler e3954fddf5 packages/fff: drop redundant PKG_BUILD_DIR
PKG_BUILD_DIR has the following default values set in include/package.mk,
in case no BUILD_VARIANT is set:

With PKG_VERSION set: $(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)
Without PKG_VERSION:  $(BUILD_DIR)/$(PKG_NAME)

Consequently, all PKG_BUILD_DIR definitions in our packages are
redundant. Remove them.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
2021-01-27 20:22:02 +01:00
Adrian Schmutzler 95c8ee78b7 fff-ra: remove IPv4 support of odhcpd
We do not use the IPv4 functionality of odhcpd, but use dnsmasq
for that. Use odhcpd-ipv6only instead.

This is also the default for OpenWrt.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Reviewed-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Johannes Kimmel <fff@bareminimum.eu>
2021-01-27 19:58:07 +01:00
Fabian Bläse a79b453de1 fff-random: Use strtol to parse numbers
Other than atoi, strtol allows to detect parsing errors.
Therefore atoi is replaced with strtol and appropriate error
checks are added.

Fixes: #33 (gitea)

Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Johannes Kimmel <fff@bareminimum.eu>
2021-01-27 19:55:00 +01:00
Robert Langhammer 1146a81a64 treewide: Update webui password on password change
If the password is changed via SSH, the web UI still
used the old password until uhttpd is restart.

Fix it by forcing uhttpd restart when passwd is called.

Fixes: #11 (gitea)

Signed-off-by: Robert Langhammer <rlanghammer@web.de>
Reviewed-by: Christian Dresel <freifunk@dresel.systems>
Reviewed-by: Fabian Bläse <fabian@blaese.de>
[add commit message]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-01-27 19:49:03 +01:00
Adrian Schmutzler 0092713196 treewide: replace IP string manipulation by owipcalc tool
The owipcalc tool provides an "add" algorithm which can be used
to concateneted IPv6 addresses from prefix and suffix.

Since it's available upstream and our string manipulation is ugly,
let's replace our IP concatenation with that tool. The package
consists of a single .c file with about 1000 lines resulting in
about 4 kB for the ipk package.

This patch does _not_ introduce any conceptual changes yet. Thus,
the "wrong" IPv6 prefix from KeyXchange will be expected in the
same format, it is just healed for the new code for now.

The change allows to get rid of some bloat, i.e. some quite trivial
custom functions on the way. This also drops the ipTidyColon()
function, as owipcalc seems to return the collapsed version by default.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Reviewed-by: Fabian Bläse <fabian@blaese.de>
2021-01-27 19:44:07 +01:00
Fabian Bläse f8b93325f2 fff-firewall: Remove variables not used by procd
The variables SERVICE_WRITE_PID and SERVICE_DAEMONIZE are not used by
procd, so they are removed.

Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
Reviewed-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-01-27 19:36:51 +01:00
Robert Langhammer 3eb744e491 fff-firewall: Restart when network configuration changes
The configuration of our firewall depends on the network configuration.
Most importantly, the firewall has to be restarted, if the WAN-interface
is changed.

Therefore, a procd reload trigger is added to the init-script, so our
firewall is automatically restarted, when the network configuration is
changed.

Fixes: #46 (gitea)

Signed-off-by: Robert Langhammer <rlanghammer@web.de>
[fabian@blaese.de: Remove unrelated changes]
Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
Reviewed-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-01-27 19:31:55 +01:00
Fabian Bläse aea773a2a9 fff-web-ui: Allow ampersand (&) in passwords
Fixes: #51 (gitea)

Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
2021-01-27 19:26:11 +01:00
Fabian Bläse 30cdaf6e54 fff-network: Remove sysctls that depend on disabled kernel features
Some sysctls currently are completely useless, as they only exist if
specific kernel configurations are enabled, which we have not.

To hide the error message and prevent them from interfering
unintentionally, if new kernel configurations are activated in the
future, they are removed.

Fixes: #42 (gitea)

Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Christian Dresel <freifunk@dresel.systems>
2021-01-27 19:21:55 +01:00
Fabian Bläse 39df9ba501 fff-network: Remove relocated netfilter sysctls
The net.ipv4.netfilter.ip* sysctls have been moved to
net.netfilter.nf* a long time ago, so they have been useless in our
firmware for quite a while.

It probably originally has been added because it was included in the
OpenWrt defaults and in earlier versions of our firmware the OpenWrt
defaults file got overwritten by our own one.

Because there does not seem to be any obvious reason to keep them (they
have been added without a comment in the commit or file) and they have
been inactive ever since they were moved in the kernel, they are removed
completely instead of using the correct path.

Fixes: #42 (gitea)

Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Christian Dresel <freifunk@dresel.systems>
2021-01-27 19:21:46 +01:00
Adrian Schmutzler 1189833757 OpenWrt: bump to 19.07.6
Bump main repo and packages. (No changes for routing.)

Refresh patches (no diff returned).

This is a small release containing mostly kernel and package updates
and security fixes.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Reviewed-by: Fabian Bläse <fabian@blaese.de>
2021-01-27 18:36:15 +01:00
Johannes Kimmel f6c1e4da52 vxlan: backport vxlan patches to 19.07.5
vxlan support in 19.07.5 is very limited.

This set of patches adds
  - more flexible source ip selection
  - control over most options
  - multiple remote endpoint configuration

List of patches backported:
  - 5222aadbf3 vxlan: remove mandatory peeraddr
  - 65e9de3c33 vxlan: add capability for multiple fdb entries
  - 036221ce5a vxlan: add extra config options
  - ad3044c424 vxlan: fix rsc config option
  - 3f5619f259 vxlan: allow for dynamic source ip selection (FS#3426)
  - a3c033e2af netifd: vxlan: handle srcport range
  - 226566b967 netifd: vxlan: refactor mapping of boolean attrs
  - 11223f5550 netifd: vxlan: add most missing boolean options
  - 55a7b6b7f2 netifd: vxlan: add aging and maxaddress options

Signed-off-by: Johannes Kimmel <fff@bareminimum.eu>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
Tested-by: Robert Langhammer <rlanghammer@web.de>
Reviewed-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
[refresh patches and remove some bloat]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-01-19 16:19:48 +01:00
Adrian Schmutzler 352b95acd9 README.md: remove 'realpath' from dependencies
The package 'realpath' isn't available anymore on Debian 10, it is
part of coreutils now.

Reported-by: Felix Luber <Felix.Luber@servercreator.de>
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-01-19 15:51:38 +01:00
Adrian Schmutzler a39ee47811 buildscript: reorganize user-defined variables
The only part that is changed regularly inside buildscript are
the OpenWrt and package revisions and the selected packages.

Move them up and put them into dedicated variables so it is more
obvious what to change and easier to do so.

While at it, remove outdated COMPAT_VERSION comment from Gluon
package; we don't pull it from there anyway. Update comment on
feed definition syntax as well.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
2021-01-19 15:48:53 +01:00
Fabian Bläse be4c1fe689 fff-layer3: Add cake scheduler kernel module
The cake scheduler is a popular fair queuing scheduler, which is also
capable of shaping traffic. Due to its sensible defaults it is very
easy to set up.

When tunnel traffic exceeds the capability of the transport connection,
firmware users might want to shape traffic, so meaningful queueing can be done
before tunnel packets are dropped. As this is typically combined with a fair
scheduler, cake provides a simple yet very powerful solution for both problems.

Therefore the cake kernel module is now included in the layer3 variant.

Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Christian Dresel <freifunk@dresel.systems>
2021-01-13 22:05:12 +01:00
Fabian Bläse 33d65836fe fff-babeld: Clarify warning about missing ipv4 peering address
When neither peer_ip nor ipaddr are set, no ipv4 address for peering
interfaces is available. Therefore, no IPv4 routes can be advertised.

Other than that, a configuration like this is perfectly valid and
configuration is already continued. Therefore, the "FATAL" message might
be misleading so it is replaced with "WARNING" and clarified slightly.

Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Johannes Kimmel <fff@bareminimum.eu>
[bump PKG_RELEASE]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2021-01-13 22:05:00 +01:00
Johannes Kimmel 6e5a6073b8 buildscript: count available cpus with nproc
Grepping `/proc/cpuinfo` does not yield the correct number of available
cpus when running in a docker container or setting the number of
available cpus with taskset.

```
$ taskset 1 grep -c processor /proc/cpuinfo
8
$ taskset 1 nproc
1
```

This will prevent using too many build jobs on environments where the
number of available cpus is reduced.

`nproc` is part of `coreutils`.

Signed-off-by: Johannes Kimmel <fff@bareminimum.eu>
Reviewed-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
2021-01-13 21:44:51 +01:00
Christian Dresel 5469399112 fff-layer3-config: Make it easier to keep the settings in testmode
On call -t we write the pid on /tmp/configure-layer3-pid.
If the script exits from user we use trap to run the new function keep_changes()
If the connections to the router lost, the user	can run	configure-layer3 -k after
reconnect to keep changes manually

Signed-off-by: Christian Dresel <freifunk@dresel.systems>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
[wrap and rephrase exit comment, bump PKG_RELEASE]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-12-28 17:42:15 +01:00
Fabian Bläse 6fe053bcf7 fff-layer3-config: Autoconfigure layer3 router after update
This adds a script to init.d to automatically call
the appropriate configure-layer3 commands after an upgrade,
so the configuration of the device is restored.

The changes are applied if configure-layer3 is successful.
Otherwise, they are reverted. Due to this, no additional checks for
the configuration are necessary: The configure-layer3 script
will fail if the config version is wrong or no configuration exists at all.

After executing the script destroys itself. With START=99,
the execution happens _after_ uci-defaults and configurenetwork,
and no interference is expected.

Signed-off-by: Fabian Bläse <fabian@blaese.de>
[convert to init.d, extend commit message, rebase]
Signed-off-by: Christian Dresel <freifunk@dresel.systems>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
Reviewed-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-12-28 17:34:03 +01:00
Adrian Schmutzler 4f76367b5a fff-web-hood: create directory /www/hood via Makefile
Creating a directory via a .keep subfile is not really nice.

Use the OpenWrt mechanism for this instead.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
Acked-by: Christian Dresel <freifunk@dresel.systems>
2020-12-22 14:11:10 +01:00
Adrian Schmutzler def42fadde fff-web: rename to fff-web-ui
The former fff-web package is essentially for serving a user
interface (UI). Therefore, include the UI in the name to distinguish
it from other web packages.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
Acked-by: Christian Dresel <freifunk@dresel.systems>
2020-12-22 14:10:16 +01:00
Adrian Schmutzler 341d5cc57d fff-web-hood: separate package for hood file via HTTP
There might be scenarios where a user only needs the hood file,
but no WebUI (e.g. for 4M devices and node firmware), or only
the WebUI, but no hood file (e.g. layer3 firmware).

This separates the HTTP server (section) for the hood file into a
separate package fff-web-hood. The new package is then only added
to the node firmware.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
Acked-by: Christian Dresel <freifunk@dresel.systems>
2020-12-22 14:05:19 +01:00
Adrian Schmutzler b69469a0b9 packages/fff: remove unneeded Build/Prepare and Build/Configure
Build/Prepare and Build/Configure are not required for packages
which only contain local files and do not need any compilation.

Remove them.

Note that Build/Compile needs to be present and empty to overwrite
the defaults, though.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
2020-12-22 13:47:45 +01:00
Adrian Schmutzler 3214388680 treewide: rename br-mesh to br-client
The name br-mesh is actually quite misleading, since the bridge
actually includes the "client" interfaces. In order to make this
obvious, and to prevent confusion with the properly named wXmesh
interfaces, rename them to br-client.

Note that br-mesh is also particularly disturbing for the layer 3
firmware without batman-adv.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Acked-by: Fabian Bläse <fabian@blaese.de>
Acked-by: Christian Dresel <freifunk@dresel.systems>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
2020-12-22 13:41:44 +01:00
Adrian Schmutzler 7e552761f6 packages/fff: rename fff-gateway to fff-layer3
The term "gateway" is ambiguous, and we are using "layer 3" for this
flavor now. Reflect that in the package name as well.

This is cosmetic otherwise.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Reviewed-by: Christian Dresel <freifunk@dresel.systems>
2020-12-17 15:38:28 +01:00
Adrian Schmutzler f9a68be465 packages/fff: move config scripts to fff-layer3-config
configuregateway and it's gateway.d files represent a specific
functionality that other packages depend on. Thus, it is put into
a package of its own so dependencies can be expressed more properly.

While at, use the chance to get rid of the ambiguous term "gateway"
and rename the script to configure-layer3 and the folders to layer3.d.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Reviewed-by: Christian Dresel <freifunk@dresel.systems>
2020-12-17 15:38:20 +01:00
Christian Dresel e5da228cb1 fff-babeld: Add rule to lookup in fff table for everything except wireguard
With this patch the router answers in traceroute over the fff table with
Freifunk IPs and not with the WAN IP. All other connections use the fff
table too.

We already have the rules with 5000 and 5001 so that wireguard does not use
the fff table anyway and connect the VPN only via the main table.

Signed-off-by: Christian Dresel <freifunk@dresel.systems>
Acked-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
2020-12-16 17:53:56 +01:00
Adrian Schmutzler 31df0a3779 packages/fff: remove whitespace from package TITLE
Some packages contain a whitespace at the start of TITLE, some
don't. This is completely irrelevant since Make strips leading
and trailing spaces anyway. Nevertheless, make it consistent.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
2020-12-13 14:40:53 +01:00
Felix Luber 2484d8defb README.md: explain more commands from buildscript
Signed-off-by: Felix Luber <Felix.Luber@servercreator.de>
Reviewed-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-12-13 14:39:56 +01:00
Felix Luber 87c420c4a0 README.md: remove unnecessary empty lines
Signed-off-by: Felix Luber <Felix.Luber@servercreator.de>
Reviewed-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-12-13 14:38:30 +01:00
Felix Luber 939950a881 README.md: change git url to new gitea host
Signed-off-by: Felix Luber <Felix.Luber@servercreator.de>
Reviewed-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-12-13 14:37:34 +01:00
Christian Dresel da50954db7 fff-web: Make ssl menu modular
To add new menu items in other packages we need a modular construction:
- Simpel Babelweb
- Layer 3 configuration
and so on

Every menu item needs a file in /www/menu/ssl/ with the content

  link,name

  - link is the name of the html file without extension (.html)
  - name is the text of the link in the webui

While at it, rename "Password" menu item to German "Passwort".

Signed-off-by: Christian Dresel <freifunk@dresel.systems>
[bump PKG_RELEASE, use /www/menu, use script_file for link,
improve use of class_active, commit message adjustments,
improve variable names, keep HTML umlaut, keep Logout]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-12-12 21:14:42 +01:00
Adrian Schmutzler d4e6482b60 fff-web: remove included files from HTTP-accessible folder
Certain files are only included, but are not meant to be accessed
via HTTP directly. Move those to a dedicated directory that is not
served via HTTP.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Reviewed-by: Christian Dresel <freifunk@dresel.systems>
2020-12-12 21:12:35 +01:00
Adrian Schmutzler 8fe7512ae5 ramips/mt76x8: Add support for TP-Link Archer C50 v4
Add support for the TP-Link Archer C50 v4, a low-cost mt7628-based
dual-band router.

Label MAC address is on ethernet and 2.4 GHz WiFi.

The v4 uses the same hardware as the v3 variant, but v4 includes
the newer split uboot.

ATTENTION:

Initial flashing of this device requires additional steps:

As all installation methods require an U-Boot to be integrated into the
image (and we do not ship one with the image) we are not able to create
an image in our build-process.

Download a TP-Link image from their Website and a FFF/OpenWRT sysupgrade
image for the device and build yourself a factory image like following:

TP-Link image:             tpl.bin
OpenWRT sysupgrade image:  owrt.bin

 > dd if=tpl.bin of=boot.bin bs=131584 count=1
 > cat owrt.bin >> boot.bin

This image can be used for Web-UI and recovery, but not TFTP.

Additional instruction can be found in the OpenWrt commit
01dcd574a248 ("ramips: add support for Archer C50 v4")

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Reviewed-by: Fabian Bläse <fabian@blaese.de>
2020-12-09 13:10:09 +01:00
Adrian Schmutzler 87d875cd94 build_patches: add fix for 2.4 GHz on Archer C50 v4
Fixes low signal issue for 2.4 GHz for the TP-Link Archer C50 v4.
The first two bytes in the eeprom are the chip id. The working
devices have 0x7628 there, whereas the non-working devices have
0x7600 there. This chip id gets checked by the function
mt7603_check_eeprom() which leads the driver to ignore the
contents of the eeprom partition and load default values from otp.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Reviewed-by: Fabian Bläse <fabian@blaese.de>
2020-12-09 13:10:01 +01:00
Adrian Schmutzler b5b0557f13 OpenWrt: bump to 19.07.5
Bump main repo, packages and routing repos.

Refresh patches, drop upstreamed ones.

Relevant highlights (v19.07.4 -> v19.07.5):
- fix WAN disconnect issues on ath79
- fix 2.4 GHz MAC address for Unifi AC devices
- use correct firmware for Unifi AP

Relevant highlights (v19.07.3 -> v19.07.4):
- add wpad-basic-wolfssl package
- add support for CPE210 v3.2
- vxlan UDP checksum fix
- squashfs: Fix compile with GCC 10

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Reviewed-by: Fabian Bläse <fabian@blaese.de>
2020-12-09 13:08:26 +01:00
Fabian Bläse 52e15e072c fff-firewall: Remove ssh firewall on WAN interface
This firewall was introduced as a countermeasure for very slow routers
directly connected to the internet without any firewall.

Our routers have got quite a bit faster since then. Also, a setup like
this is highly uncommon, especially for slower routers.

Therefore this firewall rule is removed.

Fixes: #138
Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
[bump PKG_RELEASE]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-09-15 13:05:49 +02:00
Fabian Bläse c91e2d03ec fff-gateway: Send ICMP errors using inbound ifaddr
When using NATs and tunnels at the same time, the correct
source address has to be used so the ICMP errors is sent
through the NAT. This is necessary so the NAT can modify
the ICMP payload so it is correctly identified by the
destination host, which is required for PMTUD

Fixes: #142
Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Christian Dresel <fff@chrisi01.de>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
[bump PKG_RELEASE]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
2020-09-15 13:05:49 +02:00