update

* update regex handling
* simplify iptables rules to setup nfq into single rule
* update makefile to not compile urlfilter as a kernel module

bbfdm/Makefile

@@ -5,13 +5,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=bbfdm
-PKG_VERSION:=1.9.16
+PKG_VERSION:=1.10.0
 
 USE_LOCAL:=0
 ifneq ($(USE_LOCAL),1)
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/bbf/bbfdm.git
-PKG_SOURCE_VERSION:=93a6f6f51c3edb88aa63f150ef077d9f70cb883b
+PKG_SOURCE_VERSION:=75195a112e3aef2b07e224afbbffcb15368be58f
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_MIRROR_HASH:=skip
 endif

dectmngr/Makefile

@@ -2,13 +2,13 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=dectmngr
 PKG_RELEASE:=3
-PKG_VERSION:=3.6.6
+PKG_VERSION:=3.6.7
 
 LOCAL_DEV=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_URL:=https://dev.iopsys.eu/iopsys/dectmngr.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_VERSION:=85c173d1fac535726b2e750be8c282b74fb7dbca
+PKG_SOURCE_VERSION:=98999eb75755f79a3c8a7e802e024b42914d1efc
 PKG_MIRROR_HASH:=skip
 endif
 

dnsmngr/Makefile

@@ -5,13 +5,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=dnsmngr
-PKG_VERSION:=1.0.7
+PKG_VERSION:=1.0.8
 
 LOCAL_DEV:=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/network/dnsmngr.git
-PKG_SOURCE_VERSION:=f6223f6034a57753ae9d1552ab1334194b1deaff
+PKG_SOURCE_VERSION:=e46f27dd2be08775909a69ac58917213549c7704
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_MIRROR_HASH:=skip
 endif

icwmp/Makefile

@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=icwmp
-PKG_VERSION:=9.8.6
+PKG_VERSION:=9.8.8
 
 LOCAL_DEV:=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/bbf/icwmp.git
-PKG_SOURCE_VERSION:=798dfcf2a206b2603d64e92a9ce8cc69dd481ced
+PKG_SOURCE_VERSION:=580f923cfc89aa9f151096d8606dde71e4604d08
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_MIRROR_HASH:=skip
 endif
@@ -64,6 +64,7 @@ define Package/icwmp/install
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/icwmpd $(1)/usr/sbin/icwmpd
 	$(INSTALL_DATA) ./files/etc/config/cwmp $(1)/etc/config/cwmp
 	$(INSTALL_BIN) ./files/etc/firewall.cwmp $(1)/etc/firewall.cwmp
+	$(INSTALL_BIN) ./files/etc/critical_services.json $(1)/etc/icwmpd/critical_services.json
 	$(INSTALL_BIN) ./files/etc/init.d/icwmpd $(1)/etc/init.d/icwmpd
 	$(INSTALL_BIN) ./files/etc/uci-defaults/85-cwmp-set-userid $(1)/etc/uci-defaults/
 	$(INSTALL_BIN) ./files/etc/uci-defaults/90-cwmpfirewall $(1)/etc/uci-defaults/

icwmp/files/etc/critical_services.json

@@ -0,0 +1,11 @@
+{
+	"services_list": [
+			"firewall",
+			"network",
+			"dhcp",
+			"stunc",
+			"xmpp",
+			"wireless",
+			"time"
+	]
+}

iopsys-analytics/Makefile

@@ -29,6 +29,11 @@ define Package/$(PKG_NAME)
     +collectd-mod-processes                             \
     +collectd-mod-write-http                            \
     +@PACKAGE_COLLECTD_ENCRYPTED_NETWORK                \
+  # remote syslog
+  DEPENDS+=                                             \
+    +syslog-ng                                          \
+    +@SYSLOGNG_LOGROTATE                                \
+
 endef
 
 define Package/$(PKG_NAME)/description

map-agent/Makefile

@@ -5,9 +5,9 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=map-agent
-PKG_VERSION:=6.1.1.7
+PKG_VERSION:=6.1.1.9
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)
-PKG_SOURCE_VERSION:=ce4bbb86e02c7c083c8bdd6bf05a5f83a4cbda0f
+PKG_SOURCE_VERSION:=8779b993dc8075aa48525340b9e86e13fa7ac54b
 PKG_MAINTAINER:=Jakob Olsson <jakob.olsson@iopsys.eu>
 
 PKG_LICENSE:=BSD-3-Clause

netmode/README.md

@@ -0,0 +1,109 @@
+# Creating Custom Netmodes in IOWRT
+
+This guide provides developers with detailed instructions on how to create and manage custom network modes (netmodes) in IOWRT. The `netmode` script allows for flexible network configuration, and developers can define their own modes by structuring the necessary files and scripts within the `/etc/netmodes/` directory.
+
+## Table of Contents
+1. [Overview of Netmodes](#overview-of-netmodes)
+2. [Directory Structure](#directory-structure)
+3. [Creating a Custom Netmode](#creating-a-custom-netmode)
+   - [Step 1: Pre-Execution Scripts](#step-1-pre-execution-scripts)
+   - [Step 2: UCI Configuration Files](#step-2-uci-configuration-files)
+   - [Step 3: Custom Execution Scripts](#step-3-custom-execution-scripts)
+   - [Step 4: Post-Execution Scripts](#step-4-post-execution-scripts)
+4. [Enabling and Switching Netmodes](#enabling-and-switching-netmodes)
+
+## Overview of Netmodes
+
+Netmodes in IOWRT provide a way to switch between different network configurations based on the needs of the environment. Developers can create custom netmodes by organizing scripts and configuration files in specific directories under `/etc/netmodes/<NETMODE_NAME>`.
+
+## Directory Structure
+
+A custom netmode is defined within the `/etc/netmodes/<NETMODE_NAME>` directory, which should contain the following subdirectories:
+
+- **/lib/netmode/pre/**: Generic scripts executed before the netmode-specific configurations are applied.
+- **/etc/netmodes/<NETMODE_NAME>/uci/**: Contains UCI configuration files that will be copied to `/etc/config/` during the application of the netmode.
+- **/etc/netmodes/<NETMODE_NAME>/scripts/**: Custom scripts specific to the netmode that are executed after the UCI configurations are applied.
+- **/lib/netmode/post/**: Generic scripts executed after the netmode-specific configurations are completed.
+
+## Creating a Custom Netmode
+
+To create a new netmode, follow these steps:
+
+### Step 1: Pre-Execution Scripts
+
+Scripts located in `/lib/netmode/pre/` are executed before any mode-specific actions. These are typically used for preparing the system or cleaning up configurations from the previous netmode.
+
+- **Create Pre-Execution Scripts**:
+  - Place your generic pre-execution scripts in `/lib/netmode/pre/`.
+  - Example script (`/lib/netmode/pre/cleanup.sh`):
+    ```bash
+    #!/bin/sh
+    echo "Cleaning up old network configurations..."
+    # Add commands here
+    ```
+
+### Step 2: UCI Configuration Files
+
+The UCI configuration files stored in `/etc/netmodes/<NETMODE_NAME>/uci/` will be copied to `/etc/config/`, effectively applying the desired network configuration.
+
+- **Place UCI Config Files**:
+  - Create UCI configuration files under `/etc/netmodes/<NETMODE_NAME>/uci/`.
+  - Example (`/etc/netmodes/bridge/uci/network`):
+````bash
+config device 'br_lan'
+        option name 'br-lan'
+        option type 'bridge'
+        option multicast_to_unicast '0'
+        option bridge_empty '1'
+        list ports 'eth1'
+        list ports 'eth3'
+        list ports 'eth4'
+
+config interface 'lan'
+        option proto 'dhcp'
+        option device 'br-lan'
+        option force_link '1'
+        option reqopts '43 125'
+````
+
+### Step 3: Custom Execution Scripts
+
+After the UCI files are applied, any scripts in `/etc/netmodes/<NETMODE_NAME>/scripts/` are executed. These can be used to perform additional configuration tasks that are specific to the netmode.
+
+- **Create Custom Scripts**:
+  - Add scripts to `/etc/netmodes/<NETMODE_NAME>/scripts/`.
+  - Example (`/etc/netmodes/bridge/scripts/setup_bridge.sh`):
+    ```bash
+    #!/bin/sh
+    echo "Setting up bridge mode..."
+    # Additional configuration commands here
+    ```
+
+### Step 4: Post-Execution Scripts
+
+Finally, the generic scripts in `/lib/netmode/post/` are executed. These scripts typically finalize the setup or perform any necessary cleanups.
+
+- **Create Post-Execution Scripts**:
+  - Place scripts in `/lib/netmode/post/`.
+  - Example script (`/lib/netmode/post/restart_services.sh`):
+    ```bash
+    #!/bin/sh
+    echo "Restarting network services..."
+    # Add commands here
+    ```
+
+## Enabling and Switching Netmodes
+
+The netmode mechanism can be enabled or disabled via the UCI configuration, and you can switch between netmodes using UCI commands.
+
+- **Enable Netmode**:
+  ```bash
+  uci set netmode.global.enabled=1
+  uci commit netmode
+    ```
+    
+- **Switch Netmode**:
+  ```bash
+  uci set netmode.global.mode='<NETMODE_NAME>'
+  uci commit netmode
+    ```

urlfilter/Makefile

@@ -3,16 +3,15 @@
 #
 
 include $(TOPDIR)/rules.mk
-include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=urlfilter
-PKG_VERSION:=1.1.15
+PKG_VERSION:=2.0.0
 
 LOCAL_DEV:=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/network/urlfilter.git
-PKG_SOURCE_VERSION:=b68c9bb94c24a7394997522e982e37d85e172e0c
+PKG_SOURCE_VERSION:=08044747036259db23d6581fcbaa51750516749e
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_MIRROR_HASH:=skip
 endif

urlfilter/files/etc/init.d/urlfilter

@@ -1,6 +1,6 @@
 #!/bin/sh /etc/rc.common
 
-START=21
+START=95
 STOP=10
 
 USE_PROCD=1
@@ -13,16 +13,11 @@ configure_firewall()
 	if [ "$?" -ne 0 ]; then
 		# setup netfilter queue 0, use queue bypass so that if no application is
 		# listening to this queue then traffic is unaffected.
-		iptables -w -I FORWARD 1 -p tcp --dport 80 -j NFQUEUE --queue-num 0 --queue-bypass
-		iptables -w -I FORWARD 2 -p tcp --dport 443 -j NFQUEUE --queue-num 0 --queue-bypass
-		iptables -w -I FORWARD 3 -p udp --dport 53 -j NFQUEUE --queue-num 0 --queue-bypass
-		iptables -w -I FORWARD 4 -p udp --sport 53 -j NFQUEUE --queue-num 0 --queue-bypass
-		iptables -w -I FORWARD 5 -p tcp --dport 53 -j NFQUEUE --queue-num 0 --queue-bypass
-		iptables -w -I FORWARD 6 -p tcp --sport 53 -j NFQUEUE --queue-num 0 --queue-bypass
-		iptables -w -I INPUT 1 -p udp --dport 53 -j NFQUEUE --queue-num 0 --queue-bypass
-		iptables -w -I INPUT 2 -p udp --sport 53 -j NFQUEUE --queue-num 0 --queue-bypass
-		iptables -w -I INPUT 3 -p tcp --dport 53 -j NFQUEUE --queue-num 0 --queue-bypass
-		iptables -w -I INPUT 4 -p tcp --sport 53 -j NFQUEUE --queue-num 0 --queue-bypass
+		iptables -w -I FORWARD 1 -p tcp --match multiport --ports 80,443,53 -j NFQUEUE --queue-num 0 --queue-bypass
+		iptables -w -I FORWARD 1 -p udp --match multiport --ports 80,443,53 -j NFQUEUE --queue-num 0 --queue-bypass
+
+		iptables -w -I INPUT 1 -p tcp --match multiport --ports 80,443,53 -j NFQUEUE --queue-num 0 --queue-bypass
+		iptables -w -I INPUT 1 -p udp --match multiport --ports 80,443,53 -j NFQUEUE --queue-num 0 --queue-bypass
 
 		# disable acceleration for https packet so that they can be read by urlfilter
 		ebtables --concurrent -A FORWARD -p ip --ip-protocol 6 --ip-destination-port 443 -j SKIPLOG 2> /dev/null
@@ -32,16 +27,11 @@ configure_firewall()
 	ip6tables -w -nL FORWARD|grep -iqE "NFQUEUE"
 	if [ "$?" -ne 0 ]; then
 		#ip6table rules
-		ip6tables -w -I FORWARD 1 -p tcp --dport 80 -j NFQUEUE --queue-num 0 --queue-bypass
-		ip6tables -w -I FORWARD 2 -p tcp --dport 443 -j NFQUEUE --queue-num 0 --queue-bypass
-		ip6tables -w -I FORWARD 3 -p udp --dport 53 -j NFQUEUE --queue-num 0 --queue-bypass
-		ip6tables -w -I FORWARD 4 -p udp --sport 53 -j NFQUEUE --queue-num 0 --queue-bypass
-		ip6tables -w -I FORWARD 5 -p tcp --dport 53 -j NFQUEUE --queue-num 0 --queue-bypass
-		ip6tables -w -I FORWARD 6 -p tcp --sport 53 -j NFQUEUE --queue-num 0 --queue-bypass
-		ip6tables -w -I INPUT 1 -p udp --dport 53 -j NFQUEUE --queue-num 0 --queue-bypass
-		ip6tables -w -I INPUT 2 -p udp --sport 53 -j NFQUEUE --queue-num 0 --queue-bypass
-		ip6tables -w -I INPUT 3 -p tcp --dport 53 -j NFQUEUE --queue-num 0 --queue-bypass
-		ip6tables -w -I INPUT 4 -p tcp --sport 53 -j NFQUEUE --queue-num 0 --queue-bypass
+		ip6tables -w -I FORWARD 1 -p tcp --match multiport --ports 80,443,53 -j NFQUEUE --queue-num 0 --queue-bypass
+		ip6tables -w -I FORWARD 1 -p udp --match multiport --ports 80,443,53 -j NFQUEUE --queue-num 0 --queue-bypass
+
+		ip6tables -w -I INPUT 1 -p tcp --match multiport --ports 80,443,53 -j NFQUEUE --queue-num 0 --queue-bypass
+		ip6tables -w -I INPUT 1 -p udp --match multiport --ports 80,443,53 -j NFQUEUE --queue-num 0 --queue-bypass
 
 		# disable acceleration for https packet so that they can be read by urlfilter
 		ebtables --concurrent -A FORWARD -p ip6 --ip6-protocol 6 --ip6-destination-port 443 -j SKIPLOG 2> /dev/null
@@ -54,9 +44,9 @@ configure_firewall()
 start_service() {
 
 	if [ "$(uci -q get urlfilter.globals.enable)" == "1" ]; then
+		configure_firewall
 		procd_open_instance urlfilter
 		procd_set_param command ${PROG}
-		configure_firewall
 		procd_set_param respawn
 		procd_close_instance
 
@@ -72,16 +62,12 @@ start_service() {
 stop_service() {
 	iptables -w -nL FORWARD|grep -iqE "NFQUEUE"
 	if [ "$?" -eq 0 ]; then
-		iptables -w -D FORWARD -p tcp --dport 80 -j NFQUEUE --queue-num 0 --queue-bypass
-		iptables -w -D FORWARD -p tcp --dport 443 -j NFQUEUE --queue-num 0 --queue-bypass
-		iptables -w -D FORWARD -p udp --dport 53 -j NFQUEUE --queue-num 0 --queue-bypass
-		iptables -w -D FORWARD -p udp --sport 53 -j NFQUEUE --queue-num 0 --queue-bypass
-		iptables -w -D FORWARD -p tcp --dport 53 -j NFQUEUE --queue-num 0 --queue-bypass
-		iptables -w -D FORWARD -p tcp --sport 53 -j NFQUEUE --queue-num 0 --queue-bypass
-		iptables -w -D INPUT -p udp --dport 53 -j NFQUEUE --queue-num 0 --queue-bypass
-		iptables -w -D INPUT -p udp --sport 53 -j NFQUEUE --queue-num 0 --queue-bypass
-		iptables -w -D INPUT -p tcp --dport 53 -j NFQUEUE --queue-num 0 --queue-bypass
-		iptables -w -D INPUT -p tcp --sport 53 -j NFQUEUE --queue-num 0 --queue-bypass
+		iptables -w -D FORWARD -p tcp --match multiport --ports 80,443,53 -j NFQUEUE --queue-num 0 --queue-bypass
+		iptables -w -D FORWARD -p udp --match multiport --ports 80,443,53 -j NFQUEUE --queue-num 0 --queue-bypass
+
+		iptables -w -D INPUT -p tcp --match multiport --ports 80,443,53 -j NFQUEUE --queue-num 0 --queue-bypass
+		iptables -w -D INPUT -p udp --match multiport --ports 80,443,53 -j NFQUEUE --queue-num 0 --queue-bypass
+
 		ebtables --concurrent -D FORWARD -p ip --ip-protocol 6 --ip-destination-port 443 -j SKIPLOG 2> /dev/null
 		ebtables --concurrent -D FORWARD -p ip --ip-protocol 6 --ip-source-port 53 -j SKIPLOG 2> /dev/null
 		ebtables --concurrent -D FORWARD -p ip --ip-protocol 17 --ip-source-port 53 -j SKIPLOG 2> /dev/null
@@ -89,16 +75,12 @@ stop_service() {
 	ip6tables -w -nL FORWARD|grep -iqE "NFQUEUE"
 	if [ "$?" -eq 0 ]; then
 		#ip6table rules
-		ip6tables -w -D FORWARD -p tcp --dport 80 -j NFQUEUE --queue-num 0 --queue-bypass
-		ip6tables -w -D FORWARD -p tcp --dport 443 -j NFQUEUE --queue-num 0 --queue-bypass
-		ip6tables -w -D FORWARD -p udp --dport 53 -j NFQUEUE --queue-num 0 --queue-bypass
-		ip6tables -w -D FORWARD -p udp --sport 53 -j NFQUEUE --queue-num 0 --queue-bypass
-		ip6tables -w -D FORWARD -p tcp --dport 53 -j NFQUEUE --queue-num 0 --queue-bypass
-		ip6tables -w -D FORWARD -p tcp --sport 53 -j NFQUEUE --queue-num 0 --queue-bypass
-		ip6tables -w -D INPUT -p udp --dport 53 -j NFQUEUE --queue-num 0 --queue-bypass
-		ip6tables -w -D INPUT -p udp --sport 53 -j NFQUEUE --queue-num 0 --queue-bypass
-		ip6tables -w -D INPUT -p tcp --dport 53 -j NFQUEUE --queue-num 0 --queue-bypass
-		ip6tables -w -D INPUT -p tcp --sport 53 -j NFQUEUE --queue-num 0 --queue-bypass
+		ip6tables -w -D FORWARD -p tcp --match multiport --ports 80,443,53 -j NFQUEUE --queue-num 0 --queue-bypass
+		ip6tables -w -D FORWARD -p udp --match multiport --ports 80,443,53 -j NFQUEUE --queue-num 0 --queue-bypass
+
+		ip6tables -w -D INPUT -p tcp --match multiport --ports 80,443,53 -j NFQUEUE --queue-num 0 --queue-bypass
+		ip6tables -w -D INPUT -p udp --match multiport --ports 80,443,53 -j NFQUEUE --queue-num 0 --queue-bypass
+
 		ebtables --concurrent -D FORWARD -p ip6 --ip6-protocol 6 --ip6-destination-port 443 -j SKIPLOG 2> /dev/null
 		ebtables --concurrent -D FORWARD -p ip6 --ip6-protocol 6 --ip6-source-port 53 -j SKIPLOG 2> /dev/null
 		ebtables --concurrent -D FORWARD -p ip6 --ip6-protocol 17 --ip6-source-port 53 -j SKIPLOG 2> /dev/null