netmode doc

This reverts commit 61bda623ca

bbfdm/Makefile

@@ -5,13 +5,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=bbfdm
-PKG_VERSION:=1.18.14
+PKG_VERSION:=1.18.16
 
 USE_LOCAL:=0
 ifneq ($(USE_LOCAL),1)
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/bbf/bbfdm.git
-PKG_SOURCE_VERSION:=a0347e59b69d8e0b20d6c26b7ddb02450813545d
+PKG_SOURCE_VERSION:=72c3307651cb583121fa5b4abcaad957ddc264bd
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_MIRROR_HASH:=skip
 endif
@@ -107,7 +107,7 @@ endif
 
 CMAKE_OPTIONS += \
 	-DBBF_VENDOR_PREFIX:String="$(CONFIG_BBF_VENDOR_PREFIX)" \
-	-DBBFDMD_MAX_MSG_LEN:Integer=10485760 \
+	-DBBFDMD_MAX_MSG_LEN:Integer=20971520 \
 	-DCMAKE_BUILD_TYPE:String="Debug" \
 
 

decollector/Makefile

@@ -6,12 +6,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=decollector
-PKG_VERSION:=6.2.3.4
+PKG_VERSION:=6.2.3.8
 
 LOCAL_DEV=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_VERSION:=aa09f90ca39101a0a33ec9c61993a944671e0724
+PKG_SOURCE_VERSION:=8396091a83aefaf8423dfd41a957b04f3ed821e7
 PKG_SOURCE_URL:=https://dev.iopsys.eu/multi-ap/decollector.git
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_MIRROR_HASH:=skip

dhcpmngr/Config.in

@@ -0,0 +1,12 @@
+if PACKAGE_dhcpmngr
+
+config DHCPMNGR_ENABLE_VENDOR_EXT
+	bool "Use datamodel vendor extensions"
+	default y
+	help
+	   Set this option to use bridge BBF vendor extensions.
+
+config DHCPMNGR_VENDOR_PREFIX
+	string "Package specific datamodel Vendor Prefix for TR181 extensions"
+	default ""
+endif

dhcpmngr/Makefile

@@ -5,13 +5,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=dhcpmngr
-PKG_VERSION:=1.1.3
+PKG_VERSION:=1.1.6
 
 LOCAL_DEV:=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/network/dhcpmngr.git
-PKG_SOURCE_VERSION:=5c10fc1228c7e62f18315df57460dd8a876964e3
+PKG_SOURCE_VERSION:=74d96cd70119e4ea08767d68b45b4922162d0328
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_MIRROR_HASH:=skip
 endif
@@ -39,6 +39,22 @@ define Package/dhcpmngr/description
   Package to add Device.DHCPv4. and Device.DHCPv6. data model support.
 endef
 
+define Package/$(PKG_NAME)/config
+        source "$(SOURCE)/Config.in"
+endef
+
+ifeq ($(CONFIG_DHCPMNGR_ENABLE_VENDOR_EXT),y)
+MAKE_FLAGS += DHCPMNGR_ENABLE_VENDOR_EXT=y
+endif
+
+ifeq ($(CONFIG_DHCPMNGR_VENDOR_PREFIX),"")
+VENDOR_PREFIX = $(CONFIG_BBF_VENDOR_PREFIX)
+else
+VENDOR_PREFIX = $(CONFIG_DHCPMNGR_VENDOR_PREFIX)
+endif
+
+TARGET_CFLAGS += -DBBF_VENDOR_PREFIX=\\\"$(VENDOR_PREFIX)\\\"
+
 ifeq ($(LOCAL_DEV),1)
 define Build/Prepare
 	$(CP) -rf ~/git/dhcpmngr/* $(PKG_BUILD_DIR)/

dmcli/Makefile

@@ -11,11 +11,12 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=dmcli
 PKG_LICENSE:=PROPRIETARY GENEXIS
-PKG_VERSION:=1.9.4
+PKG_VERSION:=1.9.6
+PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/gnx/dmcli.git
-PKG_SOURCE_VERSION:=6171e208611ba4ea1abdab2b70a8fa30f55476ca
+PKG_SOURCE_VERSION:=f03188eff6c2cab59e4c8f18a435c940ff5043f5
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.xz
 PKG_MIRROR_HASH:=skip
 

dnsmngr/Makefile

@@ -5,13 +5,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=dnsmngr
-PKG_VERSION:=1.0.19
+PKG_VERSION:=1.0.20
 
 LOCAL_DEV:=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/network/dnsmngr.git
-PKG_SOURCE_VERSION:=205938aa1f686d5b43460e4a17f3900ed82bd29f
+PKG_SOURCE_VERSION:=83e485fae8905f9061257264cf43ea41e47743a6
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_MIRROR_HASH:=skip
 endif

hostmngr/Makefile

@@ -5,12 +5,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=hostmngr
-PKG_VERSION:=1.4.2
+PKG_VERSION:=1.4.3
 
 LOCAL_DEV=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_VERSION:=ac50f621e19f74b7af4e4b8c1e810503507cc3dd
+PKG_SOURCE_VERSION:=667866b8149d3df83a05536319eac02aee0b6d75
 PKG_SOURCE_URL:=https://dev.iopsys.eu/iopsys/hostmngr.git
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)_$(PKG_SOURCE_VERSION).tar.xz
 PKG_MIRROR_HASH:=skip

ieee1905/Makefile

@@ -6,12 +6,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=ieee1905
-PKG_VERSION:=8.7.42
+PKG_VERSION:=8.7.44
 
 LOCAL_DEV=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_VERSION:=2e7d1377794b8d4f8aad252265110b09b129fdc8
+PKG_SOURCE_VERSION:=29ba8f04dc6bd7e77683352c0c71988f51fbadf8
 PKG_SOURCE_URL:=https://dev.iopsys.eu/multi-ap/ieee1905.git
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)_$(PKG_SOURCE_VERSION).tar.xz
 PKG_MIRROR_HASH:=skip

iopsys-analytics/Makefile

@@ -4,7 +4,7 @@ PKG_NAME:=iopsys-analytics
 PKG_RELEASE:=$(COMMITCOUNT)
 PKG_LICENSE:=PROPRIETARY
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_VERSION:=25e32ac5a860aec6e53e3449565b71595073e014
+PKG_SOURCE_VERSION:=5ad41ca8eb5de887487feb7148b5dce44943218c
 PKG_SOURCE_URL:=https://dev.iopsys.eu/iopsys/iopsys-analytics.git
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)_$(PKG_SOURCE_VERSION).tar.xz
 PKG_MIRROR_HASH:=skip

libdpp/Makefile

@@ -5,12 +5,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=libdpp
-PKG_VERSION:=2.1.1
+PKG_VERSION:=2.1.3
 
 LOCAL_DEV=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_VERSION:=6024efd3db9dd490c07465ea9b0c15120063165c
+PKG_SOURCE_VERSION:=fdfe23e51ff77ca6d2661ad6208d097758524147
 PKG_SOURCE_URL:=https://dev.iopsys.eu/multi-ap/libdpp.git
 PKG_MAINTAINER:=Jakob Olsson <jakob.olsson@iopsys.eu>
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)_$(PKG_SOURCE_VERSION).tar.xz

libqos/Makefile

@@ -5,13 +5,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=libqos
-PKG_VERSION:=7.2.110
+PKG_VERSION:=7.2.111
 
 LOCAL_DEV=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/iopsys/libqos.git
-PKG_SOURCE_VERSION:=b36f26d6d14c8fa65b4559381f6a43219d55e93a
+PKG_SOURCE_VERSION:=2e4c6a9c27e0f4f68dfe7a5c930afefd8dc7119a
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)_$(PKG_SOURCE_VERSION).tar.xz
 PKG_MIRROR_HASH:=skip
 endif
@@ -65,7 +65,7 @@ define Package/libqos
   SUBMENU:=IOPSYS HAL libs
   MENU:=1
   TITLE:= QoS library (libqos)
-  DEPENDS+=+libnl +libnl-route +libeasy +TARGET_brcmbca:bcm963xx-bsp
+  DEPENDS+=+libnl +libnl-route +libeasy +TARGET_brcmbca:bcm963xx-bsp +TARGET_airoha:libuci
 endef
 
 define Package/libqos/config

logmngr/Makefile

@@ -65,8 +65,10 @@ define Package/logmngr/install
 	$(INSTALL_DIR) $(1)/lib/logmngr
 ifeq ($(CONFIG_LOGMNGR_BACKEND_FLUENTBIT),y)
 	$(INSTALL_DIR) $(1)/sbin
+	$(INSTALL_DIR) $(1)/etc/hotplug.d/ntp/
 	$(INSTALL_BIN) ./files/logread $(1)/sbin/
 	$(INSTALL_DATA) ./files/lib/logmngr/fluent-bit.sh $(1)/lib/logmngr/
+	$(INSTALL_BIN) ./files/etc/hotplug.d/ntp/20-reload_fluent_bit $(1)/etc/hotplug.d/ntp/
 else ifeq ($(CONFIG_LOGMNGR_BACKEND_SYSLOG_NG),y)
 	$(INSTALL_DATA) ./files/lib/logmngr/syslog-ng.sh $(1)/lib/logmngr/
 endif

logmngr/files/etc/hotplug.d/ntp/20-reload_fluent_bit

@@ -0,0 +1,14 @@
+#!/bin/sh
+# This hotplug script reloads fluent-bit, so that kmsg logs' timestamp gets in sync
+
+[ "$ACTION" = stratum ] || exit 0
+
+# only once
+if ! uci -q get time.global.first_use_date > /dev/null 2>&1; then
+	flb_pid="$(pidof fluent-bit)"
+
+	if [ -n "$flb_pid" ]; then
+		logger -t "logmngr.hotplug" -p info "reload fluent-bit due to ntp sync"
+		kill -SIGHUP "$flb_pid"
+	fi
+fi

logmngr/files/lib/logmngr/fluent-bit.sh

@@ -63,7 +63,7 @@ create_service_section() {
 	append_conf "    flush        1"
 	append_conf "    daemon       off"
 	append_conf "    log_level    info"
-	append_conf "    coro_stack_size    24576"
+	append_conf "    coro_stack_size    1048576"
 	append_conf "    parsers_file /etc/fluent-bit/parsers.conf"
 	append_conf "    hot_reload        on"
 	append_conf ""

map-agent/Makefile

@@ -6,9 +6,9 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=map-agent
-PKG_VERSION:=6.5.0.5
+PKG_VERSION:=6.5.0.9
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)
-PKG_SOURCE_VERSION:=5734cb47c704e75378eaccc823a7da9f47304c99
+PKG_SOURCE_VERSION:=f4d201acde3320b1019c1831315e58a8ecb0290c
 PKG_MAINTAINER:=Jakob Olsson <jakob.olsson@iopsys.eu>
 
 PKG_LICENSE:=BSD-3-Clause

map-controller/Makefile

@@ -6,9 +6,9 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=map-controller
-PKG_VERSION:=6.4.4.13
+PKG_VERSION:=6.4.4.16
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)
-PKG_SOURCE_VERSION:=bd0fb2b63830e19038d9495517c03fdc3900cdfa
+PKG_SOURCE_VERSION:=2f8d2afc604c090637acdb01e630e233cd9aceff
 PKG_MAINTAINER:=Jakob Olsson <jakob.olsson@genexis.eu>
 
 LOCAL_DEV=0

map-controller/files/etc/uci-defaults/99-mapcntlr-add-qos-rule-id

@@ -0,0 +1,66 @@
+#!/bin/sh
+
+. /lib/functions.sh
+
+cfg="mapcontroller"
+config_load "$cfg"
+
+used_ids=""
+
+collect_used_ids() {
+	local section="$1"
+	local id
+
+	id=$(uci -q get ${cfg}.${section}.id)
+	if [ -n "$id" ] && printf "%s" "$id" | grep -qE '^[0-9]+$'; then
+		used_ids="$used_ids $id"
+	fi
+}
+
+# Find first available ID from 0 to INT32_MAX
+find_first_available_id() {
+	local max_int=2147483647
+	local expected=0
+	local id
+
+	# Convert list to sorted unique list
+	sorted_ids=$(printf "%s\n" $used_ids | sort -n | uniq)
+
+	for id in $sorted_ids; do
+		if [ "$id" -eq "$expected" ]; then
+			expected=$((expected + 1))
+		elif [ "$id" -gt "$expected" ]; then
+			# Found a gap -> return the gap
+			echo "$expected"
+			return
+		fi
+	done
+
+	# If no gaps, next available is `expected`
+	if [ "$expected" -le "$max_int" ]; then
+		echo "$expected"
+	else
+		echo -1
+	fi
+}
+
+# Assign ID if missing
+add_qos_rule_id() {
+	local section="$1"
+	local id
+
+	id=$(uci -q get ${cfg}.${section}.id)
+	if [ -z "$id" ]; then
+		new_id=$(find_first_available_id)
+		[ "$new_id" -ge 0 ] || return # No available ID
+		uci -q set ${cfg}.${section}.id="$new_id"
+
+		used_ids="$used_ids $new_id"
+	fi
+}
+
+# Step 1: Collect all existing IDs
+config_foreach collect_used_ids qos_rule
+
+# Step 2: Assign IDs to rules missing them
+config_foreach add_qos_rule_id qos_rule

map-controller/files/etc/uci-defaults/99-mapcntlr-uci-rename-singletons

@@ -14,5 +14,3 @@ for sec in $sections; do
 
     uci rename $cfg.$s=$sec
 done
-
-uci commit $cfg

mcastmngr/files/broadcom/lib/mcast/broadcom.sh

@@ -235,7 +235,7 @@ configure_mcpd() {
 
 setup_mcast_mode() {
 	# set the mode at chip to allow both tagged and untagged multicast forwarding
-	bs /b/c iptv lookup_method=group_ip_src_ip_vid
+	bs /b/c iptv lookup_method=group_ip_src_ip
 }
 
 configure_mcast() {

netmode/Makefile

@@ -8,7 +8,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=netmode
-PKG_VERSION:=1.1.10
+PKG_VERSION:=1.1.11
 PKG_RELEASE:=1
 PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)
 PKG_LICENSE:=GPL-2.0-only

netmode/README.md

@@ -1,109 +1,380 @@
-# Creating Custom Netmodes in IOWRT
+# Netmode - Network Mode Switching for OpenWrt/iopsys
 
-This guide provides developers with detailed instructions on how to create and manage custom network modes (netmodes) in IOWRT. The `netmode` script allows for flexible network configuration, and developers can define their own modes by structuring the necessary files and scripts within the `/etc/netmodes/` directory.
+**Version**: 1.1.11
+**License**: GPL-2.0-only
+**Maintainer**: iopsys
 
-## Table of Contents
-1. [Overview of Netmodes](#overview-of-netmodes)
-2. [Directory Structure](#directory-structure)
-3. [Creating a Custom Netmode](#creating-a-custom-netmode)
-   - [Step 1: Pre-Execution Scripts](#step-1-pre-execution-scripts)
-   - [Step 2: UCI Configuration Files](#step-2-uci-configuration-files)
-   - [Step 3: Custom Execution Scripts](#step-3-custom-execution-scripts)
-   - [Step 4: Post-Execution Scripts](#step-4-post-execution-scripts)
-4. [Enabling and Switching Netmodes](#enabling-and-switching-netmodes)
+## Overview
 
-## Overview of Netmodes
+Netmode is a network configuration management package for OpenWrt/iopsys-based routers that enables seamless switching between different WAN connection types. It provides a unified interface for managing network modes including DHCP, PPPoE, Static IP, and Bridge configurations.
 
-Netmodes in IOWRT provide a way to switch between different network configurations based on the needs of the environment. Developers can create custom netmodes by organizing scripts and configuration files in specific directories under `/etc/netmodes/<NETMODE_NAME>`.
+### Key Features
 
-## Directory Structure
+- **Simple Mode Switching**: Change WAN connection type with a single command
+- **Multiple Mode Support**: DHCP, PPPoE, Static IP, and Bridged mode
+- **Automatic Configuration**: Handles network, firewall, DHCP, and multicast settings
+- **TR-069/USP Integration**: Remote management via BBF data model
+- **Extensible Architecture**: Easy to add custom network modes
+- **Safe Transitions**: Proper cleanup and validation during mode switches
 
-A custom netmode is defined within the `/etc/netmodes/<NETMODE_NAME>` directory, which should contain the following subdirectories:
+## Quick Start
 
-- **/lib/netmode/pre/**: Generic scripts executed before the netmode-specific configurations are applied.
-- **/etc/netmodes/<NETMODE_NAME>/uci/**: Contains UCI configuration files that will be copied to `/etc/config/` during the application of the netmode.
-- **/etc/netmodes/<NETMODE_NAME>/scripts/**: Custom scripts specific to the netmode that are executed after the UCI configurations are applied.
-- **/lib/netmode/post/**: Generic scripts executed after the netmode-specific configurations are completed.
+### Installation
 
-## Creating a Custom Netmode
+```bash
+# Install via opkg
+opkg update
+opkg install netmode
 
-To create a new netmode, follow these steps:
+# Or build from source
+make package/feeds/iopsys/netmode/compile
+```
 
-### Step 1: Pre-Execution Scripts
+### Basic Usage
 
-Scripts located in `/lib/netmode/pre/` are executed before any mode-specific actions. These are typically used for preparing the system or cleaning up configurations from the previous netmode.
+```bash
+# Check current mode
+cat /etc/netmodes/.last_mode
 
-- **Create Pre-Execution Scripts**:
-  - Place your generic pre-execution scripts in `/lib/netmode/pre/`.
-  - Example script (`/lib/netmode/pre/cleanup.sh`):
-    ```bash
-    #!/bin/sh
-    echo "Cleaning up old network configurations..."
-    # Add commands here
-    ```
+# Switch to DHCP mode
+uci set netmode.global.mode='routed-dhcp'
+uci commit netmode
+service netmode restart
 
-### Step 2: UCI Configuration Files
+# Switch to PPPoE mode
+uci set netmode.global.mode='routed-pppoe'
+uci set netmode.@supported_args[2].value='username@isp.com'
+uci set netmode.@supported_args[3].value='password'
+uci commit netmode
+service netmode restart
+```
 
-The UCI configuration files stored in `/etc/netmodes/<NETMODE_NAME>/uci/` will be copied to `/etc/config/`, effectively applying the desired network configuration.
+## Supported Modes
 
-- **Place UCI Config Files**:
-  - Create UCI configuration files under `/etc/netmodes/<NETMODE_NAME>/uci/`.
-  - Example (`/etc/netmodes/bridge/uci/network`):
-````bash
-config device 'br_lan'
-        option name 'br-lan'
-        option type 'bridge'
-        option multicast_to_unicast '0'
-        option bridge_empty '1'
-        list ports 'eth1'
-        list ports 'eth3'
-        list ports 'eth4'
+| Mode | Description | Use Case |
+|------|-------------|----------|
+| **routed-dhcp** | Router with DHCP WAN | Cable/Fiber internet with automatic IP |
+| **routed-pppoe** | Router with PPPoE WAN | DSL internet with authentication |
+| **routed-static** | Router with Static IP WAN | Business connections with fixed IP |
+| **bridged** | L2 Bridge Mode | Transparent bridge, no routing |
 
-config interface 'lan'
-        option proto 'dhcp'
-        option device 'br-lan'
-        option force_link '1'
-        option reqopts '43 125'
-````
+## Documentation
 
-### Step 3: Custom Execution Scripts
+Comprehensive documentation is available in the following guides:
 
-After the UCI files are applied, any scripts in `/etc/netmodes/<NETMODE_NAME>/scripts/` are executed. These can be used to perform additional configuration tasks that are specific to the netmode.
+### For Users
+- **[USER_GUIDE.md](USER_GUIDE.md)** - Complete user guide with configuration examples
+  - Getting started
+  - Mode descriptions
+  - Common use cases
+  - Troubleshooting
+  - FAQ
 
-- **Create Custom Scripts**:
-  - Add scripts to `/etc/netmodes/<NETMODE_NAME>/scripts/`.
-  - Example (`/etc/netmodes/bridge/scripts/setup_bridge.sh`):
-    ```bash
-    #!/bin/sh
-    echo "Setting up bridge mode..."
-    # Additional configuration commands here
-    ```
+### For Developers
+- **[DEVELOPER_GUIDE.md](DEVELOPER_GUIDE.md)** - Developer documentation
+  - Development environment setup
+  - Code organization
+  - API reference
+  - Testing framework
+  - Contributing guidelines
 
-### Step 4: Post-Execution Scripts
+### For Implementers
+- **[IMPLEMENTATION_GUIDE.md](IMPLEMENTATION_GUIDE.md)** - Implementation details
+  - Architecture overview
+  - Creating custom modes
+  - Environment variables
+  - Hook system
+  - Data model integration
 
-Finally, the generic scripts in `/lib/netmode/post/` are executed. These scripts typically finalize the setup or perform any necessary cleanups.
+## Architecture
 
-- **Create Post-Execution Scripts**:
-  - Place scripts in `/lib/netmode/post/`.
-  - Example script (`/lib/netmode/post/restart_services.sh`):
-    ```bash
-    #!/bin/sh
-    echo "Restarting network services..."
-    # Add commands here
-    ```
+```
+┌─────────────────────────────────────────┐
+│         Netmode System                   │
+├─────────────────────────────────────────┤
+│  UCI Config → Init Service → Mode Scripts│
+│       ↓             ↓              ↓     │
+│  Environment    Pre-hooks      UCI Copy │
+│   Variables       ↓              ↓       │
+│       ↓       Mode Scripts   Post-hooks │
+│       └──────────┴────────────┘         │
+│              Network Reconfiguration     │
+└─────────────────────────────────────────┘
+```
 
-## Enabling and Switching Netmodes
+### Components
 
-The netmode mechanism can be enabled or disabled via the UCI configuration, and you can switch between netmodes using UCI commands.
+- **Init Service** (`/etc/init.d/netmode`): Orchestrates mode switching
+- **Mode Scripts** (`/etc/netmodes/<mode>/scripts/`): Mode-specific configuration
+- **UCI Config** (`/etc/config/netmode`): Mode definitions and parameters
+- **Data Model** (`datamodel.json`): BBF TR-181 integration
+- **Hooks** (`/lib/netmode/{pre,post}/`): Pre/post mode switch scripts
 
-- **Enable Netmode**:
-  ```bash
-  uci set netmode.global.enabled=1
-  uci commit netmode
-    ```
-    
-- **Switch Netmode**:
-  ```bash
-  uci set netmode.global.mode='<NETMODE_NAME>'
-  uci commit netmode
-    ```
+## Configuration Examples
+
+### DHCP with VLAN
+
+```bash
+uci set netmode.global.mode='routed-dhcp'
+uci set netmode.@supported_args[0].value='100'  # VLAN ID
+uci commit netmode
+service netmode restart
+```
+
+### PPPoE with Custom DNS
+
+```bash
+uci set netmode.global.mode='routed-pppoe'
+uci set netmode.@supported_args[2].value='user@isp.com'
+uci set netmode.@supported_args[3].value='password123'
+uci set netmode.@supported_args[6].value='8.8.8.8,8.8.4.4'
+uci commit netmode
+service netmode restart
+```
+
+### Static IP Business Connection
+
+```bash
+uci set netmode.global.mode='routed-static'
+uci set netmode.@supported_args[6].value='203.0.113.10'
+uci set netmode.@supported_args[7].value='255.255.255.0'
+uci set netmode.@supported_args[8].value='203.0.113.1'
+uci commit netmode
+service netmode restart
+```
+
+## Creating Custom Modes
+
+Custom network modes can be added by following these steps:
+
+1. **Create mode directory structure**:
+   ```bash
+   mkdir -p /etc/netmodes/my-mode/scripts
+   ```
+
+2. **Define mode in supported_modes.json**:
+   ```json
+   {
+     "name": "my-mode",
+     "description": "My Custom Mode",
+     "supported_args": [...]
+   }
+   ```
+
+3. **Create mode script**:
+   ```bash
+   cat > /etc/netmodes/my-mode/scripts/10-my-mode << 'EOF'
+   #!/bin/sh
+   # Configuration logic here
+   EOF
+   chmod +x /etc/netmodes/my-mode/scripts/10-my-mode
+   ```
+
+4. **Import to UCI and test**:
+   ```bash
+   sh /etc/uci-defaults/40_netmode_populated_supported_modes
+   uci set netmode.global.mode='my-mode'
+   service netmode restart
+   ```
+
+See [IMPLEMENTATION_GUIDE.md](IMPLEMENTATION_GUIDE.md#creating-a-new-network-mode) for detailed instructions.
+
+## TR-069/USP Integration
+
+Netmode exposes a BBF TR-181 data model for remote management:
+
+**Data Model Path**: `Device.X_IOPSYS_EU_NetMode.`
+
+```
+Device.X_IOPSYS_EU_NetMode.
+├── Enable (boolean, r/w)
+├── Mode (string, r/w)
+├── SupportedModesNumberOfEntries (unsignedInt, r)
+└── SupportedModes.{i}.
+    ├── Name (string, r)
+    ├── Description (string, r)
+    └── SupportedArguments.{i}.
+        ├── Name (string, r)
+        ├── Type (string, r)
+        ├── Required (boolean, r)
+        └── Value (string, r/w)
+```
+
+Example TR-069 operation:
+```xml
+<SetParameterValues>
+  <ParameterList>
+    <ParameterValueStruct>
+      <Name>Device.X_IOPSYS_EU_NetMode.Mode</Name>
+      <Value>routed-dhcp</Value>
+    </ParameterValueStruct>
+  </ParameterList>
+</SetParameterValues>
+```
+
+## System Requirements
+
+- **Platform**: OpenWrt/iopsys
+- **Dependencies**:
+  - `dm-service` (BBF data model service)
+  - `uci`
+  - `procd`
+  - `libubox` (jshn)
+- **Recommended**:
+  - `logread` for monitoring
+  - `firewall`, `odhcpd`, `mcast` for full functionality
+
+## File Structure
+
+```
+netmode/
+├── Makefile                          # Package build definition
+├── README.md                         # This file
+├── IMPLEMENTATION_GUIDE.md           # Implementation guide
+├── DEVELOPER_GUIDE.md                # Developer documentation
+├── USER_GUIDE.md                     # User documentation
+├── bbfdm_service.json                # BBF service registration
+└── files/
+    ├── etc/
+    │   ├── config/netmode            # UCI configuration
+    │   ├── init.d/netmode            # Init script (START=11)
+    │   ├── uci-defaults/             # First-boot scripts
+    │   └── netmodes/
+    │       ├── supported_modes.json  # Mode definitions
+    │       ├── routed-dhcp/scripts/
+    │       ├── routed-pppoe/scripts/
+    │       ├── routed-static/scripts/
+    │       └── bridged/scripts/
+    └── lib/
+        ├── netmode/
+        │   ├── pre/                  # Pre-switch hooks
+        │   └── post/                 # Post-switch hooks
+        └── upgrade/keep.d/netmode    # Sysupgrade preservation
+```
+
+## Troubleshooting
+
+### Mode Not Switching
+
+```bash
+# Check if enabled
+uci get netmode.global.enabled
+
+# Check logs
+logread | grep netmode
+
+# Force mode change
+rm /etc/netmodes/.last_mode
+service netmode restart
+```
+
+### No Internet After Switch
+
+```bash
+# Verify mode applied
+cat /etc/netmodes/.last_mode
+
+# Check WAN status
+ifconfig wan
+ip route
+
+# Restart network
+/etc/init.d/network restart
+```
+
+### PPPoE Authentication Failed
+
+```bash
+# Check credentials
+uci show network.wan | grep -E "username|password"
+
+# Check logs
+logread | grep ppp
+
+# Verify VLAN if required
+uci get network.wan.device
+```
+
+See [USER_GUIDE.md](USER_GUIDE.md#troubleshooting) for comprehensive troubleshooting.
+
+## Development
+
+### Building
+
+```bash
+# Clone repository
+cd feeds/iopsys/netmode
+
+# Build package
+make package/feeds/iopsys/netmode/compile V=s
+
+# Install on device
+scp bin/packages/*/iopsys/netmode_*.ipk root@192.168.1.1:/tmp/
+ssh root@192.168.1.1 "opkg install /tmp/netmode_*.ipk"
+```
+
+### Testing
+
+```bash
+# Run mode switch test
+./test-mode-switch.sh routed-dhcp
+
+# Monitor logs
+logread -f | grep netmode
+
+# Verify configuration
+uci show network
+cat /etc/netmodes/.last_mode
+```
+
+### Contributing
+
+Contributions are welcome! Please follow these steps:
+
+1. Fork the repository
+2. Create a feature branch
+3. Make your changes
+4. Test thoroughly on target hardware
+5. Update documentation
+6. Submit a pull request
+
+See [DEVELOPER_GUIDE.md](DEVELOPER_GUIDE.md#contributing-guidelines) for detailed guidelines.
+
+## License
+
+This project is licensed under the GNU General Public License v2.0 only.
+
+See `/LICENSE` for more information.
+
+## Support
+
+- **Documentation**: See guides in this repository
+- **Issues**: Contact iopsys development team
+- **Community**: OpenWrt and iopsys forums
+
+## Changelog
+
+### Version 1.1.11
+- Current stable release
+- Support for DHCP, PPPoE, Static IP, and Bridge modes
+- BBF TR-181 data model integration
+- Comprehensive documentation
+
+## Acknowledgments
+
+- OpenWrt project for the underlying platform
+- iopsys for development and maintenance
+- Contributors and testers
+
+## Related Projects
+
+- [OpenWrt](https://openwrt.org/) - Linux operating system for embedded devices
+- [iopsys](https://www.iopsys.eu/) - Broadband device management
+- [BBF](https://www.broadband-forum.org/) - Broadband Forum standards
+
+---
+
+**For detailed information, please refer to the specific guides:**
+- Users: [USER_GUIDE.md](USER_GUIDE.md)
+- Developers: [DEVELOPER_GUIDE.md](DEVELOPER_GUIDE.md)
+- Implementers: [IMPLEMENTATION_GUIDE.md](IMPLEMENTATION_GUIDE.md)

netmode/USER_GUIDE.md

@@ -0,0 +1,857 @@
+# Netmode User Guide
+
+## Table of Contents
+1. [Introduction](#introduction)
+2. [Getting Started](#getting-started)
+3. [Available Network Modes](#available-network-modes)
+4. [Configuration Methods](#configuration-methods)
+5. [Common Use Cases](#common-use-cases)
+6. [Troubleshooting](#troubleshooting)
+7. [FAQ](#faq)
+8. [Glossary](#glossary)
+
+---
+
+## Introduction
+
+### What is Netmode?
+
+Netmode is a network configuration management system for iopsys-based routers that allows you to easily switch between different WAN (Wide Area Network) connection types without manual configuration.
+
+### Why Use Netmode?
+
+- **Simplicity**: Switch network modes with a single command
+- **Flexibility**: Support for multiple WAN connection types
+- **Consistency**: Ensures proper configuration of all related network services
+- **Remote Management**: Can be controlled via TR-069/USP protocols
+- **Safety**: Automatically handles complex network reconfigurations
+
+### Supported Connection Types
+
+- **DHCP**: Automatic IP configuration (most common for cable/fiber connections)
+- **PPPoE**: Username/password authentication (common for DSL connections)
+- **Static IP**: Manual IP configuration (business connections)
+- **Bridged Mode**: Bridge/modem mode (disable routing)
+
+---
+
+## Getting Started
+
+### Checking if Netmode is Installed
+
+```bash
+# Check if netmode package is installed
+opkg list-installed | grep netmode
+
+# Check netmode service status
+service netmode status
+```
+
+Expected output:
+```
+netmode - 1.1.11-1 - Network Modes and Utils
+```
+
+### Checking Current Mode
+
+```bash
+# View current configuration
+uci show netmode.global
+
+# Check active mode
+cat /etc/netmodes/.last_mode
+```
+
+Example output:
+```
+netmode.global=netmode
+netmode.global.enabled='1'
+netmode.global.mode='routed-dhcp'
+```
+
+### Viewing Available Modes
+
+```bash
+# List all supported modes
+uci show netmode | grep "supported_modes.*name"
+```
+
+Example output:
+```
+netmode.@supported_modes[0].name='routed-dhcp'
+netmode.@supported_modes[1].name='routed-pppoe'
+netmode.@supported_modes[2].name='routed-static'
+netmode.@supported_modes[3].name='bridged'
+```
+
+---
+
+## Available Network Modes
+
+### 1. Routed DHCP Mode
+
+**Mode Name**: `routed-dhcp`
+
+**When to Use**:
+- Cable internet connection
+- Fiber internet connection
+- Any ISP that automatically provides IP configuration
+
+**Features**:
+- Automatic IP address assignment
+- Built-in router (NAT)
+- Firewall enabled
+- DHCP server for local devices
+- IPv4 and IPv6 support
+
+**Configuration Parameters**:
+- `vlanid` (optional): VLAN ID if required by ISP
+- `dns_servers` (optional): Custom DNS servers (comma-separated)
+
+**Example Configuration**:
+```bash
+# Basic DHCP mode
+uci set netmode.global.mode='routed-dhcp'
+uci commit netmode
+service netmode restart
+
+# DHCP with VLAN ID 100
+uci set netmode.global.mode='routed-dhcp'
+# Find VLAN argument and set value
+uci set netmode.@supported_args[0].value='100'
+uci commit netmode
+service netmode restart
+```
+
+---
+
+### 2. Routed PPPoE Mode
+
+**Mode Name**: `routed-pppoe`
+
+**When to Use**:
+- DSL internet connection
+- ISP requires username and password authentication
+- Connection uses PPPoE protocol
+
+**Features**:
+- Username/password authentication
+- Built-in router (NAT)
+- Firewall enabled
+- DHCP server for local devices
+- Automatic MTU optimization
+
+**Required Parameters**:
+- `username`: PPPoE username (provided by ISP)
+- `password`: PPPoE password (provided by ISP)
+
+**Optional Parameters**:
+- `vlanid`: VLAN ID if required by ISP
+- `mtu`: Maximum transmission unit (default: 1492 for PPPoE)
+- `dns_servers`: Custom DNS servers (comma-separated)
+
+**Example Configuration**:
+```bash
+# Set mode
+uci set netmode.global.mode='routed-pppoe'
+
+# Set username (find correct argument index)
+uci set netmode.@supported_args[2].value='myuser@isp.com'
+
+# Set password
+uci set netmode.@supported_args[3].value='mypassword'
+
+# Optional: Set VLAN
+uci set netmode.@supported_args[4].value='100'
+
+# Optional: Set MTU
+uci set netmode.@supported_args[5].value='1492'
+
+# Apply configuration
+uci commit netmode
+service netmode restart
+```
+
+**Important Notes**:
+- Device will reboot after configuration
+- Keep ISP credentials safe
+- Most DSL connections use VLAN ID 7 or 100 (check with ISP)
+- MTU typically 1492 for PPPoE (auto-configured)
+
+---
+
+### 3. Routed Static IP Mode
+
+**Mode Name**: `routed-static`
+
+**When to Use**:
+- Business internet connection with static IP
+- ISP provided specific IP address, subnet mask, and gateway
+- Fixed IP address required for services (web server, VPN, etc.)
+
+**Features**:
+- Manual IP configuration
+- Built-in router (NAT)
+- Firewall enabled
+- DHCP server for local devices
+- Fixed WAN IP address
+
+**Required Parameters**:
+- `ipaddr`: Static IP address (e.g., 93.21.0.104)
+- `netmask`: Subnet mask (e.g., 255.255.255.0)
+- `gateway`: Default gateway IP (e.g., 93.21.0.1)
+
+**Optional Parameters**:
+- `vlanid`: VLAN ID if required
+- `dns_servers`: DNS servers (comma-separated, e.g., 8.8.8.8,8.8.4.4)
+
+**Example Configuration**:
+```bash
+# Set mode
+uci set netmode.global.mode='routed-static'
+
+# Set IP address
+uci set netmode.@supported_args[6].value='93.21.0.104'
+
+# Set subnet mask
+uci set netmode.@supported_args[7].value='255.255.255.0'
+
+# Set gateway
+uci set netmode.@supported_args[8].value='93.21.0.1'
+
+# Optional: Set DNS servers
+uci set netmode.@supported_args[9].value='8.8.8.8,8.8.4.4'
+
+# Apply configuration
+uci commit netmode
+service netmode restart
+```
+
+**Important Notes**:
+- Use exact IP settings provided by ISP
+- Incorrect settings will result in no internet connectivity
+- DNS servers are optional but recommended
+- Device will reboot after configuration
+
+---
+
+### 4. Bridged Mode
+
+**Mode Name**: `bridged`
+
+**When to Use**:
+- Using router as a bridge/modem only
+- Another router handles routing and DHCP
+- ISP requires bridge mode
+- Cascading routers (not recommended, prefer this mode on upstream device)
+
+**Features**:
+- All LAN and WAN ports bridged together
+- No routing (NAT disabled)
+- Firewall disabled
+- DHCP server disabled
+- Device acts as transparent bridge
+
+**Configuration Parameters**:
+- No parameters required
+
+**Example Configuration**:
+```bash
+# Set mode
+uci set netmode.global.mode='bridged'
+uci commit netmode
+service netmode restart
+```
+
+**Important Notes**:
+- Device will obtain IP from upstream router/ISP
+- Web interface may be inaccessible until device gets IP
+- To access device: connect directly and check DHCP leases on upstream router
+- Device will reboot after configuration
+- Use this mode carefully - you may lose access to the device
+
+**Reverting from Bridge Mode**:
+If you lose access, connect via serial console or perform factory reset.
+
+---
+
+## Configuration Methods
+
+### Method 1: UCI Command Line (SSH/Console)
+
+**Step-by-step procedure**:
+
+```bash
+# 1. Connect to device
+ssh root@192.168.1.1
+
+# 2. View current configuration
+uci show netmode
+
+# 3. Set desired mode
+uci set netmode.global.mode='routed-dhcp'
+
+# 4. Set any required parameters (example for PPPoE)
+uci set netmode.@supported_args[2].value='username@isp.com'
+uci set netmode.@supported_args[3].value='password123'
+
+# 5. Save configuration
+uci commit netmode
+
+# 6. Apply changes
+service netmode restart
+
+# 7. Monitor logs (optional)
+logread -f | grep netmode
+```
+
+### Method 2: TR-069/CWMP (Remote Management)
+
+If your device is managed by an ACS (Auto Configuration Server):
+
+**Get current mode**:
+```xml
+GetParameterValues
+  Device.X_IOPSYS_EU_NetMode.Mode
+```
+
+**Set PPPoE mode**:
+```xml
+SetParameterValues
+  Device.X_IOPSYS_EU_NetMode.Mode = "routed-pppoe"
+  Device.X_IOPSYS_EU_NetMode.SupportedModes.2.SupportedArguments.1.Value = "username@isp.com"
+  Device.X_IOPSYS_EU_NetMode.SupportedModes.2.SupportedArguments.2.Value = "password123"
+```
+
+**Trigger mode change**:
+```bash
+# On device (via TR-069 script)
+service netmode restart
+```
+
+### Method 3: Web Interface (if available)
+
+Some firmware may provide a web interface for netmode configuration.
+
+Typical location: **Network → WAN → Connection Type**
+
+---
+
+## Common Use Cases
+
+### Use Case 1: Switching from DHCP to PPPoE
+
+**Scenario**: ISP changed from cable to DSL connection
+
+```bash
+# 1. Connect to router
+ssh root@192.168.1.1
+
+# 2. Find username and password argument indices
+uci show netmode | grep -A3 "name='username'"
+# Note the index numbers
+
+# 3. Set mode and credentials
+uci set netmode.global.mode='routed-pppoe'
+uci set netmode.@supported_args[2].value='newuser@dsl-isp.com'
+uci set netmode.@supported_args[3].value='newpassword'
+
+# 4. If ISP requires VLAN (e.g., VLAN 7)
+uci set netmode.@supported_args[4].value='7'
+
+# 5. Apply
+uci commit netmode
+service netmode restart
+
+# Device will reboot
+```
+
+### Use Case 2: Adding Custom DNS Servers
+
+**Scenario**: Want to use Google DNS or Cloudflare DNS
+
+```bash
+# For DHCP mode
+uci set netmode.global.mode='routed-dhcp'
+
+# Find dns_servers argument index
+uci show netmode | grep -B2 "name='dns_servers'"
+
+# Set custom DNS (Google DNS example)
+uci set netmode.@supported_args[1].value='8.8.8.8,8.8.4.4'
+
+# Or Cloudflare DNS
+uci set netmode.@supported_args[1].value='1.1.1.1,1.0.0.1'
+
+# Apply
+uci commit netmode
+service netmode restart
+```
+
+### Use Case 3: Configuring VLAN for ISP
+
+**Scenario**: ISP requires VLAN tagging (common for fiber)
+
+```bash
+# Identify your mode (example: DHCP)
+uci set netmode.global.mode='routed-dhcp'
+
+# Find VLAN argument
+uci show netmode | grep -B2 "name='vlanid'"
+
+# Set VLAN ID (ISP will provide this, commonly 100, 7, or other)
+uci set netmode.@supported_args[0].value='100'
+
+# Apply
+uci commit netmode
+service netmode restart
+```
+
+### Use Case 4: Setting Up Bridge Mode for Secondary Router
+
+**Scenario**: Using dedicated router behind ISP modem
+
+```bash
+# Configure device as bridge
+uci set netmode.global.mode='bridged'
+uci commit netmode
+service netmode restart
+
+# After reboot, device will be in bridge mode
+# Connect to it via the IP it receives from upstream
+```
+
+### Use Case 5: Business Static IP Setup
+
+**Scenario**: ISP provided static IP configuration
+
+**ISP Information**:
+- IP Address: 203.0.113.10
+- Subnet Mask: 255.255.255.248
+- Gateway: 203.0.113.9
+- DNS: 203.0.113.1, 203.0.113.2
+
+```bash
+# Set mode
+uci set netmode.global.mode='routed-static'
+
+# Configure IP settings (find argument indices first)
+uci show netmode | grep -B2 "name='ipaddr'"
+uci show netmode | grep -B2 "name='netmask'"
+uci show netmode | grep -B2 "name='gateway'"
+
+# Set values
+uci set netmode.@supported_args[6].value='203.0.113.10'
+uci set netmode.@supported_args[7].value='255.255.255.248'
+uci set netmode.@supported_args[8].value='203.0.113.9'
+uci set netmode.@supported_args[9].value='203.0.113.1,203.0.113.2'
+
+# Apply
+uci commit netmode
+service netmode restart
+```
+
+---
+
+## Troubleshooting
+
+### Problem: No Internet After Mode Switch
+
+**Symptoms**:
+- Cannot access websites
+- No WAN IP address
+- Local network works but no internet
+
+**Diagnosis**:
+```bash
+# Check WAN interface status
+ifconfig wan
+
+# Check if WAN has IP
+ip addr show wan
+
+# Check routing table
+ip route
+
+# Check DNS resolution
+nslookup google.com
+
+# Check mode applied correctly
+cat /etc/netmodes/.last_mode
+uci show netmode.global.mode
+```
+
+**Solutions**:
+
+1. **For DHCP mode**:
+   ```bash
+   # Restart network
+   /etc/init.d/network restart
+
+   # Release and renew DHCP
+   udhcpc -i wan -n
+   ```
+
+2. **For PPPoE mode**:
+   ```bash
+   # Check credentials
+   uci show network.wan.username
+   uci show network.wan.password
+
+   # Check PPPoE connection
+   logread | grep pppd
+
+   # Restart PPPoE
+   ifdown wan
+   ifup wan
+   ```
+
+3. **For Static IP mode**:
+   ```bash
+   # Verify settings
+   uci show network.wan
+
+   # Check if gateway is reachable
+   ping -c 3 $(uci get network.wan.gateway)
+   ```
+
+### Problem: Cannot Access Router After Mode Change
+
+**Symptoms**:
+- Cannot reach router web interface
+- Cannot SSH to router
+- Router appears offline
+
+**Solutions**:
+
+1. **Check router IP address**:
+   - Routed modes: Router should be at `192.168.1.1`
+   - Bridged mode: Router gets IP from upstream device
+
+2. **For bridged mode**:
+   ```bash
+   # Connect to upstream router
+   # Check DHCP leases for your device MAC address
+   # Or connect via serial console
+   ```
+
+3. **Factory reset** (last resort):
+   - Hold reset button for 10 seconds
+   - Device will reset to default configuration
+
+### Problem: Mode Not Switching
+
+**Symptoms**:
+- `.last_mode` not updated
+- Old configuration still active
+- No changes after restart
+
+**Diagnosis**:
+```bash
+# Check if netmode is enabled
+uci get netmode.global.enabled
+
+# Check logs
+logread | grep netmode
+
+# Check if mode exists
+ls /etc/netmodes/*/scripts/
+```
+
+**Solutions**:
+```bash
+# Enable netmode if disabled
+uci set netmode.global.enabled='1'
+uci commit netmode
+
+# Force mode change by removing last_mode
+rm /etc/netmodes/.last_mode
+service netmode restart
+```
+
+### Problem: PPPoE Authentication Failure
+
+**Symptoms**:
+- WAN interface shows "connecting" but never connects
+- Logs show authentication errors
+
+**Diagnosis**:
+```bash
+# Check PPPoE logs
+logread | grep ppp
+
+# Common errors:
+# - "authentication failed"
+# - "LCP timeout"
+# - "CHAP authentication failed"
+```
+
+**Solutions**:
+```bash
+# Verify credentials (double-check with ISP)
+uci show network.wan.username
+uci show network.wan.password
+
+# Some ISPs require VLAN tagging
+uci set netmode.@supported_args[4].value='7'  # or ISP-specific VLAN
+uci commit netmode
+service netmode restart
+
+# Check if service name is required (rare)
+uci set network.wan.service='ISP-SERVICE-NAME'
+uci commit network
+```
+
+### Problem: Slow Internet After Mode Switch
+
+**Symptoms**:
+- Internet works but very slow
+- High latency
+
+**Solutions**:
+
+1. **Check MTU settings** (especially for PPPoE):
+   ```bash
+   # Set MTU for PPPoE
+   uci set netmode.@supported_args[5].value='1492'
+   uci commit netmode
+   service netmode restart
+   ```
+
+2. **Check for DNS issues**:
+   ```bash
+   # Test DNS resolution speed
+   time nslookup google.com
+
+   # Use faster DNS
+   uci set netmode.@supported_args[X].value='1.1.1.1,1.0.0.1'
+   uci commit netmode
+   service netmode restart
+   ```
+
+3. **Check WAN speed**:
+   ```bash
+   # Install iperf3 and test
+   opkg update
+   opkg install iperf3
+   ```
+
+---
+
+## FAQ
+
+### General Questions
+
+**Q: Will I lose my configuration when switching modes?**
+
+A: Netmode preserves most router settings (WiFi, firewall rules, etc.), but WAN-specific settings are reconfigured. Local network settings remain unchanged.
+
+**Q: How long does a mode switch take?**
+
+A: The mode switch itself takes a few seconds, but the device will reboot, which takes 1-2 minutes total.
+
+**Q: Can I switch modes remotely?**
+
+A: Yes, via SSH or TR-069/USP if configured. However, be careful with bridge mode as you may lose connectivity.
+
+**Q: Do I need to reboot manually?**
+
+A: No, the system automatically reboots after applying a new mode.
+
+**Q: Can I schedule a mode switch?**
+
+A: Yes, using cron:
+```bash
+# Switch to bridged mode at 2 AM
+echo "0 2 * * * uci set netmode.global.mode='bridged' && uci commit && service netmode restart" | crontab -
+```
+
+### Mode-Specific Questions
+
+**Q: Which mode should I use?**
+
+A: Depends on your ISP:
+- Cable/Fiber without login: **routed-dhcp**
+- DSL with username/password: **routed-pppoe**
+- Static IP business connection: **routed-static**
+- Using as bridge only: **bridged**
+
+**Q: Can I use PPPoE with VLAN?**
+
+A: Yes, set both the mode and VLAN ID:
+```bash
+uci set netmode.global.mode='routed-pppoe'
+uci set netmode.@supported_args[4].value='100'
+```
+
+**Q: What's the difference between routed and bridged mode?**
+
+A:
+- **Routed modes**: Router performs NAT, runs firewall, provides DHCP to local network
+- **Bridged mode**: Router acts as transparent bridge, no NAT, no firewall, no DHCP
+
+**Q: Can I customize the LAN IP in routed modes?**
+
+A: Yes, but not through netmode. After mode switch, manually configure:
+```bash
+uci set network.lan.ipaddr='192.168.2.1'
+uci commit network
+/etc/init.d/network restart
+```
+
+### Technical Questions
+
+**Q: Where are my credentials stored?**
+
+A: In `/etc/config/netmode` (UCI configuration). They are cleared from memory after mode application for security.
+
+**Q: Can I create custom modes?**
+
+A: Yes, advanced users can create custom modes. See the IMPLEMENTATION_GUIDE.md and DEVELOPER_GUIDE.md.
+
+**Q: Does netmode support IPv6?**
+
+A: Yes, routed-dhcp and routed-pppoe modes support IPv6 (DHCPv6).
+
+**Q: What happens to firewall rules?**
+
+A: Firewall is enabled for routed modes and disabled for bridged mode. Custom rules are preserved.
+
+**Q: Can I use multiple WAN connections?**
+
+A: Netmode manages the primary WAN. For multi-WAN setups, configure secondary WANs manually after netmode configuration.
+
+---
+
+## Glossary
+
+**Bridge Mode**: Operating mode where the router acts as a transparent network bridge without routing or NAT.
+
+**DHCP (Dynamic Host Configuration Protocol)**: Automatic IP address assignment protocol.
+
+**DMZ (Demilitarized Zone)**: Network segment that sits between internal network and external network.
+
+**DNS (Domain Name System)**: Service that translates domain names to IP addresses.
+
+**Gateway**: Router IP address that connects local network to the internet.
+
+**ISP (Internet Service Provider)**: Company providing internet access.
+
+**LAN (Local Area Network)**: Internal network (devices in your home/office).
+
+**MTU (Maximum Transmission Unit)**: Largest packet size that can be transmitted. PPPoE typically uses 1492.
+
+**NAT (Network Address Translation)**: Technology allowing multiple devices to share one public IP address.
+
+**PPPoE (Point-to-Point Protocol over Ethernet)**: Authentication protocol commonly used for DSL connections.
+
+**Static IP**: Fixed IP address that doesn't change (opposite of DHCP).
+
+**Subnet Mask**: Defines the network portion of an IP address (e.g., 255.255.255.0).
+
+**TR-069/CWMP**: Remote management protocol for network devices.
+
+**UCI (Unified Configuration Interface)**: OpenWrt configuration system.
+
+**USP (User Services Platform)**: Next-generation device management protocol.
+
+**VLAN (Virtual LAN)**: Network segmentation using VLAN tags (802.1Q).
+
+**WAN (Wide Area Network)**: External network connection (internet).
+
+---
+
+## Getting Help
+
+### Log Collection
+
+When reporting issues, collect these logs:
+
+```bash
+# System logs
+logread > /tmp/system.log
+
+# Network configuration
+uci export network > /tmp/network.conf
+uci export netmode > /tmp/netmode.conf
+
+# Interface status
+ifconfig > /tmp/interfaces.txt
+ip route > /tmp/routes.txt
+
+# Copy to external system
+scp /tmp/*.{log,conf,txt} user@external-host:/path/
+```
+
+### Support Resources
+
+- **Documentation**: Check IMPLEMENTATION_GUIDE.md and DEVELOPER_GUIDE.md
+- **Community Forums**: OpenWrt and iopsys community forums
+- **Issue Tracker**: Report bugs to iopsys development team
+- **ISP Support**: Contact ISP for connection-specific parameters (VLAN, credentials, etc.)
+
+### Before Contacting Support
+
+Please have ready:
+1. Current mode: `cat /etc/netmodes/.last_mode`
+2. Netmode version: `opkg info netmode | grep Version`
+3. Error logs: `logread | grep netmode`
+4. Network configuration: `uci export netmode`
+5. What you're trying to achieve
+6. What you've already tried
+
+---
+
+## Quick Reference Card
+
+### Common Commands
+
+```bash
+# View current mode
+cat /etc/netmodes/.last_mode
+
+# List available modes
+uci show netmode | grep "supported_modes.*name"
+
+# Switch to DHCP
+uci set netmode.global.mode='routed-dhcp'
+uci commit netmode && service netmode restart
+
+# Switch to PPPoE
+uci set netmode.global.mode='routed-pppoe'
+uci set netmode.@supported_args[2].value='username'
+uci set netmode.@supported_args[3].value='password'
+uci commit netmode && service netmode restart
+
+# Switch to Bridge
+uci set netmode.global.mode='bridged'
+uci commit netmode && service netmode restart
+
+# View logs
+logread | grep netmode
+
+# Reset to last mode
+rm /etc/netmodes/.last_mode
+service netmode restart
+```
+
+### Emergency Recovery
+
+```bash
+# If locked out after bridge mode
+# Connect via serial console and run:
+uci set netmode.global.mode='routed-dhcp'
+uci commit netmode
+service netmode restart
+
+# Factory reset (hold reset button 10 seconds)
+# Or via console:
+firstboot -y && reboot
+```
+
+---
+
+**Document Version**: 1.0
+**Package Version**: 1.1.11
+**Last Updated**: 2024
+**License**: GPL-2.0-only

netmode/files/etc/init.d/netmode

@@ -117,6 +117,7 @@ start_service() {
 	config_get_bool enabled global enabled '0'
 	[ $enabled -eq 0 ] && return
 
+	[ -d $MODEDIR ] || mkdir -p $MODEDIR
 	# Get the desired netmode from config
 	config_get mode global mode ""
 	# Check if netmode is set as boot environment parameter
@@ -127,9 +128,12 @@ start_service() {
 	# Get the last saved mode
 	lastmode="$(cat $MODEDIR/.last_mode 2>/dev/null)"
 	# Return if desired mode is same as last saved mode
-	[ "$mode" == "$lastmode" ] && return
+	if [ "$mode" = "$lastmode" ]; then
+		_log "Not switching mode[${mode}], lastmode[${lastmode}]"
+		return
+	fi
 
-	_log "Switching to [${mode}] Mode" >/dev/console
+	_log "Switching to [${mode}] Mode"
 
 	# Configure env variables
 	configure_env_vars ${mode}
@@ -147,20 +151,19 @@ start_service() {
 
 	# Execute mode specific scripts
 	if [ -d $MODEDIR/$mode/scripts ]; then
-		_log "Executing $MODEDIR/$mode/scripts/* scripts"
 		for script in $(ls $MODEDIR/$mode/scripts/); do
+			_log "Executing [${mode}], script [${script}]"
 			sh $MODEDIR/$mode/scripts/$script
 		done
 	fi
 
+	# Save mode as last mode
+	echo "$mode" > $MODEDIR/.last_mode
+	_log "Switching to Mode [${mode}] done, last mode updated"
+
 	# Execute netmode generic post-mode-switch scripts
 	libnetmode_exec "post"
 	cleanup_env_vars "${mode}"
-
-	# Save mode as last mode
-	[ -d $MODEDIR ] || mkdir -p $MODEDIR
-	echo "$mode" > $MODEDIR/.last_mode
-	_log "Switching to Mode [${mode}] done, last mode updated" >/dev/console
 }
 
 service_triggers()

netmode/files/etc/netmodes/bridged/scripts/10-bridged

@@ -61,8 +61,8 @@ l2_network_config() {
 	uci -q set network.lan6.device='@lan'
 	uci -q set network.lan6.reqprefix='no'
 
-	uci -q set network.wan.disabled='1'
-	uci -q set network.wan6.disabled='1'
+	uci -q delete network.wan
+	uci -q delete network.wan6
 
 	uci -q delete network.br_lan.ports
 	uci -q set network.br_lan.bridge_empty='1'
@@ -116,12 +116,3 @@ l2_network_config() {
 
 l2_network_config
 l2_mcast_config
-
-# If device is already boot-up, assume netmode changed during runtime
-if [ -f /var/run/boot_complete ]; then
-	/etc/init.d/odhcpd stop 2>/dev/null
-	for config in network dhcp ssdpd cwmp gateway firewall mcast; do
-		ubus call uci commit "{\"config\":\"$config\"}"
-		sleep 1
-	done
-fi

netmode/files/etc/netmodes/routed-dhcp/scripts/10-routed-dhcp

@@ -43,17 +43,24 @@ l3_network_config() {
 	uci -q delete network.wan.netmask
 
 	uci -q set network.wan6=interface
-	uci -q set network.wan6.proto='dhcpv6'
+	uci -q set network.wan6.proto="dhcpv6"
 	uci -q delete network.wan6.disabled
 
-	if [ -n "$wandev" ] && echo "$NETMODE_vlanid" | grep -Eq '^[0-9]+$' && [ "$NETMODE_vlanid" -ge 1 ]; then
-		uci -q set network.vlan_${NETMODE_vlanid}=device
-		uci -q set network.vlan_${NETMODE_vlanid}.type="8021q"
-		uci -q set network.vlan_${NETMODE_vlanid}.name="$wandev.$NETMODE_vlanid"
-		uci -q set network.vlan_${NETMODE_vlanid}.ifname="$wandev"
-		uci -q set network.vlan_${NETMODE_vlanid}.vid=$NETMODE_vlanid
+	# Delete all VLAN sections; new ones will be created in next function if required
+	for vlandev_sec in $(uci show network | grep "type=.*8021q" | cut -d'.' -f1,2); do
+		uci -q delete $vlandev_sec
+	done
 
-		wandev="$wandev.$NETMODE_vlanid"
+	if [ -n "$wandev" ] && echo "$NETMODE_vlanid" | grep -Eq '^[0-9]+$' && [ "$NETMODE_vlanid" -ge 1 ]; then
+		vlandev="$wandev.$NETMODE_vlanid"
+		vlandev_sec=$(echo $vlandev | tr '.' '_')
+		uci -q set network.${vlandev_sec}=device
+		uci -q set network.${vlandev_sec}.type="8021q"
+		uci -q set network.${vlandev_sec}.name="$vlandev"
+		uci -q set network.${vlandev_sec}.ifname="$wandev"
+		uci -q set network.${vlandev_sec}.vid=$NETMODE_vlanid
+
+		wandev="$vlandev"
 	fi
 
 	uci -q set network.wan.device="$wandev"
@@ -119,12 +126,3 @@ l3_network_config() {
 
 l3_network_config
 l3_mcast_config
-
-# If device is already boot-up, assume netmode changed during runtime
-if [ -f /var/run/boot_complete ]; then
-	/etc/init.d/odhcpd restart 2>/dev/null
-	for config in network dhcp ssdpd cwmp gateway firewall mcast; do
-		ubus call uci commit "{\"config\":\"$config\"}"
-		sleep 1
-	done
-fi

netmode/files/etc/netmodes/routed-pppoe/scripts/10-routed-pppoe

@@ -42,20 +42,26 @@ l3_network_pppoe_config() {
 	uci -q delete network.wan.gateway
 	uci -q delete network.wan.netmask
 
-	uci -q set network.wan6.disabled='1'
+	uci -q delete network.wan6
+
+	# Delete all VLAN sections; new ones will be created in next function if required
+	for vlandev_sec in $(uci show network | grep "type=.*8021q" | cut -d'.' -f1,2); do
+		uci -q delete $vlandev_sec
+	done
 
 	if [ -n "$wandev" ] && echo "$NETMODE_vlanid" | grep -Eq '^[0-9]+$' && [ "$NETMODE_vlanid" -ge 1 ]; then
-		uci -q set network.vlan_${NETMODE_vlanid}=device
-		uci -q set network.vlan_${NETMODE_vlanid}.type="8021q"
-		uci -q set network.vlan_${NETMODE_vlanid}.name="$wandev.$NETMODE_vlanid"
-		uci -q set network.vlan_${NETMODE_vlanid}.ifname="$wandev"
-		uci -q set network.vlan_${NETMODE_vlanid}.vid=$NETMODE_vlanid
+		vlandev="$wandev.$NETMODE_vlanid"
+		vlandev_sec=$(echo $vlandev | tr '.' '_')
+		uci -q set network.${vlandev_sec}=device
+		uci -q set network.${vlandev_sec}.type="8021q"
+		uci -q set network.${vlandev_sec}.name="$vlandev"
+		uci -q set network.${vlandev_sec}.ifname="$wandev"
+		uci -q set network.${vlandev_sec}.vid=$NETMODE_vlanid
 
-		wandev="$wandev.$NETMODE_vlanid"
+		wandev="$vlandev"
 	fi
 
 	uci -q set network.wan.device="$wandev"
-	uci -q set network.wan6.device="$wandev"
 
 	uci -q set network.WAN.mtu="$NETMODE_mtu"
 
@@ -117,12 +123,3 @@ l3_network_pppoe_config() {
 
 l3_network_pppoe_config
 l3_mcast_config
-
-# If device is already boot-up, assume netmode changed during runtime
-if [ -f /var/run/boot_complete ]; then
-	/etc/init.d/odhcpd restart 2>/dev/null
-	for config in network dhcp ssdpd cwmp gateway firewall mcast; do
-		ubus call uci commit "{\"config\":\"$config\"}"
-		sleep 1
-	done
-fi

netmode/files/etc/netmodes/routed-static/scripts/10-routed-static

@@ -43,20 +43,26 @@ l3_network_config() {
 	uci -q delete network.wan.username
 	uci -q delete network.wan.password
 
-	uci -q set network.wan6.disabled='1'
+	uci -q delete network.wan6
+
+	# Delete all VLAN sections; new ones will be created in next function if required
+	for vlandev_sec in $(uci show network | grep "type=.*8021q" | cut -d'.' -f1,2); do
+		uci -q delete $vlandev_sec
+	done
 
 	if [ -n "$wandev" ] && echo "$NETMODE_vlanid" | grep -Eq '^[0-9]+$' && [ "$NETMODE_vlanid" -ge 1 ]; then
-		uci -q set network.vlan_${NETMODE_vlanid}=device
-		uci -q set network.vlan_${NETMODE_vlanid}.type="8021q"
-		uci -q set network.vlan_${NETMODE_vlanid}.name="$wandev.$NETMODE_vlanid"
-		uci -q set network.vlan_${NETMODE_vlanid}.ifname="$wandev"
-		uci -q set network.vlan_${NETMODE_vlanid}.vid=$NETMODE_vlanid
+		vlandev="$wandev.$NETMODE_vlanid"
+		vlandev_sec=$(echo $vlandev | tr '.' '_')
+		uci -q set network.${vlandev_sec}=device
+		uci -q set network.${vlandev_sec}.type="8021q"
+		uci -q set network.${vlandev_sec}.name="$vlandev"
+		uci -q set network.${vlandev_sec}.ifname="$wandev"
+		uci -q set network.${vlandev_sec}.vid=$NETMODE_vlanid
 
-		wandev="$wandev.$NETMODE_vlanid"
+		wandev="$vlandev"
 	fi
 
 	uci -q set network.wan.device="$wandev"
-	uci -q set network.wan6.device="$wandev"
 
 	uci -q set network.WAN.mtu="$NETMODE_mtu"
 
@@ -118,12 +124,3 @@ l3_network_config() {
 
 l3_network_config
 l3_mcast_config
-
-# If device is already boot-up, assume netmode changed during runtime
-if [ -f /var/run/boot_complete ]; then
-	/etc/init.d/odhcpd restart 2>/dev/null
-	for config in network dhcp ssdpd cwmp gateway firewall mcast; do
-		ubus call uci commit "{\"config\":\"$config\"}"
-		sleep 1
-	done
-fi

netmode/files/etc/uci-defaults/40_netmode_set_default_netmode

@@ -1,7 +1,28 @@
 #!/bin/sh
 
 enabled="$(uci -q get netmode.global.enabled)"
-[ "$enabled" == "1" ] || exit 0
+if [ "$enabled" != "1" ]; then
+	exit 0
+fi
+
+opconf_file="/opconf/opconf.json"
+[ -f $opconf_file ] || opconf_file="/usr_data/opconf/opconf.json"
+
+# Check if netmode getting provisioned from opconf, in case of opconf
+# provisioning, mode setting not required
+mode="$(jsonfilter -i $opconf_file -e @.netmode.mode 2>/dev/null)"
+if [ -n "${mode}" ]; then
+	exit 0
+fi
+
+# Check if opconf has wan provisioning enabled, if yes, get the proto/mode from opconf
+proto="$(jsonfilter -i $opconf_file -e '@.network.wan[@.name="wan"].proto' 2>/dev/null)"
+if [ -n "${proto}" ]; then
+	mode="routed-${proto}"
+	uci -q set netmode.global.mode="${mode}"
+	echo "${mode}" > /etc/netmodes/.last_mode
+	exit 0
+fi
 
 mode="$(uci -q get netmode.global.mode)"
 wanproto=$(uci -q get network.wan.proto)
@@ -13,7 +34,9 @@ if [ -n "$mode" ]; then
 	fi
 fi
 
-[ -f /etc/netmodes/supported_modes.json ] || exit 0
+if [ ! -f "/etc/netmodes/supported_modes.json" ]; then
+	exit 0
+fi
 
 # NetMode is enabled without a Mode being set
 # Figure out the current mode from network config
@@ -26,10 +49,12 @@ esac
 
 found=0
 for md in $(jsonfilter -i /etc/netmodes/supported_modes.json -e "@.supported_modes.*.name"); do
-	[ "$md" == "$curmode" ] && found=1
+	[ "$md" = "$curmode" ] && found=1
 done
 
 if [ $found -eq 1 ]; then
 	uci -q set netmode.global.mode="$curmode"
 	echo "$curmode" > /etc/netmodes/.last_mode
+else
+	exit 1
 fi

netmode/files/lib/netmode/post/datamodel_init.sh

@@ -1,11 +1,21 @@
 #!/bin/sh
 
-# This script is to restart related datamodel microservices
-# when wan mode changes
-
-
 if [ ! -f /var/run/boot_complete ]; then
-	return 0
+	exit 0
 fi
 
-reboot &
+if [ -f /etc/bbfdm/dmmap/PPP ]; then
+	rm -f /etc/bbfdm/dmmap/PPP
+fi
+
+if [ -f /etc/bbfdm/dmmap/IP ]; then
+	rm -f /etc/bbfdm/dmmap/IP
+fi
+
+if [ -f /etc/bbfdm/dmmap/Ethernet ]; then
+	rm -f /etc/bbfdm/dmmap/Ethernet
+fi
+
+sleep 5
+
+reboot -f

obuspa/Makefile

@@ -5,13 +5,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=obuspa
-PKG_VERSION:=10.0.7.7
+PKG_VERSION:=10.0.7.10
 
 LOCAL_DEV:=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/bbf/obuspa.git
-PKG_SOURCE_VERSION:=f3b5b79476adadc55830de9466361c0eeced473e
+PKG_SOURCE_VERSION:=c3b7c7653edb63326e7070b6891a95ad6cf7a2ee
 PKG_MAINTAINER:=Vivek Dutta <vivek.dutta@iopsys.eu>
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_MIRROR_HASH:=skip

obuspa/patches/1000-SecuredRole-bbfdm.patch

@@ -1,176 +0,0 @@
-Index: obuspa-10.0.5.0/src/core/device.h
-===================================================================
---- obuspa-10.0.5.0.orig/src/core/device.h
-+++ obuspa-10.0.5.0/src/core/device.h
-@@ -311,6 +311,9 @@ int DEVICE_CTRUST_InstSelToRoleInstance(
- char *DEVICE_CTRUST_InstSelToPermTarget(int role_index, void *is, int *perm_instance);
- int DEVICE_CTRUST_SetRoleParameter(int instance, char *param_name, char *new_value);
- int DEVICE_CTRUST_SetPermissionParameter(int instance1, int instance2, char *param_name, char *new_value);
-+
-+bool DEVICE_CTRUST_IsControllerSecured(void);
-+
- int DEVICE_CTRUST_DumpPermissionSelectors(int role_instance, char *path);
- int DEVICE_REQUEST_Init(void);
- int DEVICE_REQUEST_Add(char *path, char *command_key, int *instance);
-Index: obuspa-10.0.5.0/src/core/device_ctrust.c
-===================================================================
---- obuspa-10.0.5.0.orig/src/core/device_ctrust.c
-+++ obuspa-10.0.5.0/src/core/device_ctrust.c
-@@ -246,6 +246,7 @@ credential_t *FindCredentialByCertInstan
- int Get_CredentialRole(dm_req_t *req, char *buf, int len);
- int Get_CredentialCertificate(dm_req_t *req, char *buf, int len);
- int Get_CredentialNumEntries(dm_req_t *req, char *buf, int len);
-+int Validate_SecuredRoles(dm_req_t *req, char *value);
- void ApplySearchExpressionPermissions(char *path, inst_sel_t *sel);
- bool ValidateDataModelPathSegment(char *segment, bool is_last, char *path);
- 
-@@ -293,6 +294,9 @@ int DEVICE_CTRUST_Init(void)
-     // Create a timer which will be used to apply all modified permissions to the data model, after processing a USP Message
-     SYNC_TIMER_Add(ApplyModifiedPermissions, 0, END_OF_TIME);
- 
-+    // Register Device.LocalAgent.ControllerTrust.SecuredRoles parameter
-+    err |= USP_REGISTER_DBParam_ReadWrite(DEVICE_CTRUST_ROOT ".SecuredRoles", "", Validate_SecuredRoles, NULL, DM_STRING);
-+
-     // Register parameters implemented by this component
-     // Device.LocalAgent.ControllerTrust.Role.{i}
-     err |= USP_REGISTER_Object(DEVICE_ROLE_ROOT, ValidateAdd_CTrustRole, NULL, Notify_CTrustRoleAdded,
-@@ -3533,3 +3537,139 @@ exit:
-     return err;
- }
- #endif // REMOVE_DEVICE_SECURITY
-+
-+
-+/*********************************************************************//**
-+**
-+** Validate_SecuredRoles
-+**
-+** Validates Device.LocalAgent.ControllerTrust.SecuredRoles
-+** Each list item MUST be the Path Name of a row in the Device.LocalAgent.ControllerTrust.Role table
-+**
-+** \param   req - pointer to structure identifying the parameter
-+** \param   value - value that the controller would like to set the parameter to
-+**
-+** \return  USP_ERR_OK if successful
-+**
-+**************************************************************************/
-+int Validate_SecuredRoles(dm_req_t *req, char *value)
-+{
-+    char *role_path;
-+    char *saveptr;
-+    char *str;
-+    char temp[MAX_DM_PATH];
-+    int role_instance;
-+    int err;
-+
-+    // Empty string is valid
-+    if (*value == '\0')
-+    {
-+        return USP_ERR_OK;
-+    }
-+
-+    // Copy the value as strtok_r modifies the string
-+    USP_STRNCPY(temp, value, sizeof(temp));
-+
-+    // Iterate through comma-separated list
-+    str = temp;
-+    role_path = strtok_r(str, ",", &saveptr);
-+    while (role_path != NULL)
-+    {
-+        // Trim whitespace
-+        role_path = TEXT_UTILS_TrimBuffer(role_path);
-+
-+        // Verify that this path exists in the Role table using DM_ACCESS_ValidateReference
-+        err = DM_ACCESS_ValidateReference(role_path, "Device.LocalAgent.ControllerTrust.Role.{i}", &role_instance);
-+        if (err != USP_ERR_OK)
-+        {
-+            USP_ERR_SetMessage("%s: Role path '%s' does not exist in Device.LocalAgent.ControllerTrust.Role table", __FUNCTION__, role_path);
-+            return USP_ERR_INVALID_VALUE;
-+        }
-+
-+        role_path = strtok_r(NULL, ",", &saveptr);
-+    }
-+
-+    return USP_ERR_OK;
-+}
-+
-+/*********************************************************************//**
-+**
-+** DEVICE_CTRUST_IsControllerSecured
-+**
-+** Determines whether the specified controller has a secured role
-+**
-+** \param   combined_role - pointer to structure containing the role indexes for this controller
-+**
-+** \return  true if the controller has a secured role, false otherwise
-+**
-+**************************************************************************/
-+bool DEVICE_CTRUST_IsControllerSecured()
-+{
-+    char secured_roles[MAX_DM_PATH];
-+    char *role_path;
-+    char *saveptr;
-+    char *str;
-+    char temp[MAX_DM_PATH];
-+    int err;
-+    role_t *role;
-+    int role_instance;
-+    combined_role_t combined_role;
-+    controller_info_t ci;
-+
-+    // Exit if unable to get the secured roles
-+    err = DATA_MODEL_GetParameterValue("Device.LocalAgent.ControllerTrust.SecuredRoles", secured_roles, sizeof(secured_roles), 0);
-+    if (err != USP_ERR_OK)
-+    {
-+        return false;
-+    }
-+
-+    // Empty string means no secured roles
-+    if (*secured_roles == '\0')
-+    {
-+        return false;
-+    }
-+
-+    MSG_HANDLER_GetControllerInfo(&ci);
-+    if (ci.endpoint_id == NULL)
-+    {
-+        return false;
-+    }
-+    if(strlen(ci.endpoint_id) == 0)
-+    {
-+        return false;
-+    }
-+
-+    MSG_HANDLER_GetMsgRole(&combined_role);
-+    // Copy the value as strtok_r modifies the string
-+    USP_STRNCPY(temp, secured_roles, sizeof(temp));
-+
-+    // Iterate through comma-separated list
-+    str = temp;
-+    role_path = strtok_r(str, ",", &saveptr);
-+    while (role_path != NULL)
-+    {
-+        // Trim whitespace
-+        role_path = TEXT_UTILS_TrimBuffer(role_path);
-+
-+        // Extract the instance number from the role path
-+        err = DM_ACCESS_ValidateReference(role_path, "Device.LocalAgent.ControllerTrust.Role.{i}", &role_instance);
-+        if (err == USP_ERR_OK)
-+        {
-+            // Find the role in our internal array
-+            role = FindRoleByInstance(role_instance);
-+            if (role != NULL)
-+            {
-+                // Check if this role matches either the inherited or assigned role
-+                if ((role - roles == combined_role.inherited_index) ||
-+                    (role - roles == combined_role.assigned_index))
-+                {
-+                    return true;
-+                }
-+            }
-+        }
-+
-+        role_path = strtok_r(NULL, ",", &saveptr);
-+    }
-+
-+    return false;
-+}

parental-control/Makefile

@@ -5,13 +5,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=parental-control
-PKG_VERSION:=1.4.4
+PKG_VERSION:=1.4.6
 
 LOCAL_DEV:=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/network/parental-control.git
-PKG_SOURCE_VERSION:=d0eabdda9790d1df3cec30589c97214731108367
+PKG_SOURCE_VERSION:=11777ff069888fc543c2501110313b654bbbfbc9
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_MIRROR_HASH:=skip
 endif
@@ -27,7 +27,7 @@ define Package/parental-control
   CATEGORY:=Utilities
   TITLE:=URL filter
   DEPENDS:=+libuci +libnetfilter-queue +libnfnetlink +iptables-mod-nfqueue +libpthread
-  DEPENDS+=+libubox +ubus +conntrack +libcurl +cmph
+  DEPENDS+=+libubox +ubus +conntrack +libcurl +cmph +libjson-c
   DEPENDS+=+libbbfdm-api +libbbfdm-ubus +dm-service
 endef
 
@@ -87,11 +87,10 @@ define Package/parental-control/install
 
 	$(INSTALL_DATA) ./files/etc/uci-defaults/40-parental_control_update_bundle_path $(1)/etc/uci-defaults/
 ifeq ($(CONFIG_PARENTAL_CONTROL_URLFILTERING),y)
-	$(INSTALL_DATA) ./files/etc/uci-defaults/50-parental_control_add_bundles $(1)/etc/uci-defaults/
-	$(CP) ./files/urlbundle_override.json $(1)/etc/parentalcontrol/
+	$(INSTALL_DATA) ./files/etc/parentalcontrol/url_bundles.json $(1)/etc/parentalcontrol/
+	$(INSTALL_DATA) ./files/etc/parentalcontrol/urlbundle_override.json $(1)/etc/parentalcontrol/
 else
 	$(BBFDM_INSTALL_MS_PLUGIN) -v ${VENDOR_PREFIX} ./files/urlbundle_override.json $(1) parentalcontrol
-	$(INSTALL_DATA) ./files/etc/uci-defaults/50-parental_control_disable_urlfilter $(1)/etc/uci-defaults/
 endif
 endef
 

parental-control/files/etc/config/parentalcontrol

@@ -1,3 +1,4 @@
 config globals 'globals'
     option enable '1'
     option loglevel '3'
+    option urlfilter '0'

parental-control/files/etc/parentalcontrol/url_bundles.json

@@ -0,0 +1,76 @@
+{
+    "urlBundles": [
+        {
+            "url": "https://blocklistproject.github.io/Lists/alt-version/abuse-nl.txt",
+            "name": "Abuse"
+        },
+        {
+            "url": "https://blocklistproject.github.io/Lists/alt-version/ads-nl.txt",
+            "name": "Ads"
+        },
+        {
+            "url": "https://blocklistproject.github.io/Lists/alt-version/crypto-nl.txt",
+            "name": "Crypto"
+        },
+        {
+            "url": "https://blocklistproject.github.io/Lists/alt-version/drugs-nl.txt",
+            "name": "Drugs"
+        },
+        {
+            "url": "https://blocklistproject.github.io/Lists/alt-version/everything-nl.txt",
+            "name": "Everything else"
+        },
+        {
+            "url": "https://blocklistproject.github.io/Lists/alt-version/facebook-nl.txt",
+            "name": "Facebook/Instagram"
+        },
+        {
+            "url": "https://blocklistproject.github.io/Lists/alt-version/fraud-nl.txt",
+            "name": "Fraud"
+        },
+        {
+            "url": "https://blocklistproject.github.io/Lists/alt-version/gambling-nl.txt",
+            "name": "Gambling"
+        },
+        {
+            "url": "https://blocklistproject.github.io/Lists/alt-version/malware-nl.txt",
+            "name": "Malware"
+        },
+        {
+            "url": "https://blocklistproject.github.io/Lists/alt-version/phishing-nl.txt",
+            "name": "Phishing"
+        },
+        {
+            "url": "https://blocklistproject.github.io/Lists/alt-version/piracy-nl.txt",
+            "name": "Piracy"
+        },
+        {
+            "url": "https://blocklistproject.github.io/Lists/alt-version/porn-nl.txt",
+            "name": "Porn"
+        },
+        {
+            "url": "https://blocklistproject.github.io/Lists/alt-version/ransomware-nl.txt",
+            "name": "Ransomware"
+        },
+        {
+            "url": "https://blocklistproject.github.io/Lists/alt-version/redirect-nl.txt",
+            "name": "Redirect"
+        },
+        {
+            "url": "https://blocklistproject.github.io/Lists/alt-version/scam-nl.txt",
+            "name": "Scam"
+        },
+        {
+            "url": "https://blocklistproject.github.io/Lists/alt-version/tiktok-nl.txt",
+            "name": "TikTok"
+        },
+        {
+            "url": "https://blocklistproject.github.io/Lists/alt-version/torrent-nl.txt",
+            "name": "Torrent"
+        },
+        {
+            "url": "https://blocklistproject.github.io/Lists/alt-version/tracking-nl.txt",
+            "name": "Tracking"
+        }
+    ]
+}

parental-control/files/etc/uci-defaults/40-parental_control_update_bundle_path

@@ -25,14 +25,6 @@ check_mounted_app_partition() {
 
 if check_mounted_app_partition; then
 	uci -q set parentalcontrol.globals.bundle_path="${APPS_DIR}/parentalcontrol"
-
-	# configure the urlfilter if not configured
-	urlfilter="$(uci -q get parentalcontrol.globals.urlfilter)"
-	if [ -z "${urlfilter}" ]; then
-		uci -q set parentalcontrol.globals.urlfilter='1'
-	fi
-else
-	uci -q set parentalcontrol.globals.urlfilter='0'
 fi
 
 exit 0

parental-control/files/etc/uci-defaults/50-parental_control_add_bundles

@@ -1,43 +0,0 @@
-#!/bin/sh
-
-[ ! -f "/etc/config/parentalcontrol" ] && exit 0
-
-COUNT=1
-
-add_urlbundle()
-{
-	local name url
-
-	url="${1}"; shift
-	name="$*"
-
-	uci -q set parentalcontrol.urlbundle_${COUNT}=urlbundle
-	uci -q set parentalcontrol.urlbundle_${COUNT}.name="${name}"
-	uci -q set parentalcontrol.urlbundle_${COUNT}.download_url="${url}"
-
-	COUNT="$((COUNT+1))"
-}
-
-urlfilter="$(uci -q get parentalcontrol.globals.urlfilter)"
-if [ "${urlfilter}" -eq "1" ]; then
-	add_urlbundle "https://blocklistproject.github.io/Lists/alt-version/abuse-nl.txt" "Abuse"
-	add_urlbundle "https://blocklistproject.github.io/Lists/alt-version/ads-nl.txt" "Ads"
-	add_urlbundle "https://blocklistproject.github.io/Lists/alt-version/crypto-nl.txt" "Crypto"
-	add_urlbundle "https://blocklistproject.github.io/Lists/alt-version/drugs-nl.txt" "Drugs"
-	add_urlbundle 'https://blocklistproject.github.io/Lists/alt-version/everything-nl.txt' "Everything else"
-	add_urlbundle 'https://blocklistproject.github.io/Lists/alt-version/facebook-nl.txt' 'Facebook/Instagram'
-	add_urlbundle 'https://blocklistproject.github.io/Lists/alt-version/fraud-nl.txt' 'Fraud'
-	add_urlbundle 'https://blocklistproject.github.io/Lists/alt-version/gambling-nl.txt' 'Gambling'
-	add_urlbundle 'https://blocklistproject.github.io/Lists/alt-version/malware-nl.txt' 'Malware'
-	add_urlbundle 'https://blocklistproject.github.io/Lists/alt-version/phishing-nl.txt' 'Phishing'
-	add_urlbundle 'https://blocklistproject.github.io/Lists/alt-version/piracy-nl.txt' 'Piracy'
-	add_urlbundle 'https://blocklistproject.github.io/Lists/alt-version/porn-nl.txt' 'Porn'
-	add_urlbundle 'https://blocklistproject.github.io/Lists/alt-version/ransomware-nl.txt' 'Ransomware'
-	add_urlbundle 'https://blocklistproject.github.io/Lists/alt-version/redirect-nl.txt' 'Redirect'
-	add_urlbundle 'https://blocklistproject.github.io/Lists/alt-version/scam-nl.txt' 'Scam'
-	add_urlbundle 'https://blocklistproject.github.io/Lists/alt-version/tiktok-nl.txt' 'TikTok'
-	add_urlbundle 'https://blocklistproject.github.io/Lists/alt-version/torrent-nl.txt' 'Torrent'
-	add_urlbundle 'https://blocklistproject.github.io/Lists/alt-version/tracking-nl.txt' 'Tracking'
-fi
-
-exit 0

parental-control/files/etc/uci-defaults/50-parental_control_disable_urlfilter

@@ -1,14 +0,0 @@
-#!/bin/sh
-
-. /lib/functions.sh
-
-[ ! -f "/etc/config/parentalcontrol" ] && exit 0
-
-uci -q set parentalcontrol.globals.urlfilter='0'
-
-_delete_urlbundle() {
-	uci_remove parentalcontrol "${1}"
-}
-
-config_load "parentalcontrol"
-config_foreach _delete_urlbundle urlbundle

parental-control/files/lib/parentalcontrol/sync_bundles.sh

@@ -1,10 +1,12 @@
 #!/bin/sh
 
 . /lib/functions.sh
+. /usr/share/libubox/jshn.sh
 
 LOCKFILE="/tmp/sync_bundles.lock"
 log_level="$(uci -q get parentalcontrol.globals.loglevel)"
 log_level="${log_level:-1}"
+URLBUNDLE_JSON="/etc/parentalcontrol/url_bundles.json"
 DEBUG=0
 
 log_err() {
@@ -85,6 +87,7 @@ update_bundle_file_from_url() {
 		local success=0
 		while [ $attempt -le 3 ]; do
 			if curl -s -o "$temp_file" "$download_url"; then
+				log_info "Download successful for $download_url"
 				success=1
 				break
 			else
@@ -218,24 +221,33 @@ cleanup_bundle_files() {
 	# Collect all download_url entries using config_foreach
 	local urls=""
 	get_download_url() {
-		local section="$1"
-		config_get url "$section" download_url
-		config_get_bool enable "$1" enable 1
+		local enable url
+
+		json_select "${2}"
+
+		json_get_var url url
+		json_get_var enable enable
+		enable="${enable:-1}"
 
 		if [ "${enable}" -eq 0 ]; then
-			# bundle is disabled
+			log_info "get_download_url: Skipping bundle ${name} not enabled"
+			json_select ..
 			return 0
 		fi
+
 		url="${url#file://}"
 		url="${url#https://}"
 		url="${url#http://}"
 
 		url="${url##*/}" # Get everything after the last '/'
 		urls="$urls $url"
+		json_select ..
 	}
 
-	config_load parentalcontrol
-	config_foreach get_download_url urlbundle
+	json_init
+	json_load_file "${URLBUNDLE_JSON}"
+
+	json_for_each_item get_download_url "urlBundles"
 
 	# Loop through all files in the directory
 	for file in "$dir"/*; do
@@ -294,30 +306,29 @@ handle_filter_for_bundles() {
 	fi
 
 	check_bundle_exists() {
-		local enable download_url name cfg
+		local enable url name
 
-		cfg="$1"
-		config_get name "$cfg" name
-		config_get_bool enable "$cfg" enable 1
-		config_get download_url "$cfg" download_url
+		json_select "${2}"
+
+		json_get_var name name
+		json_get_var url url
+		json_get_var enable enable
+		enable="${enable:-1}"
 
 		if [ "${enable}" -eq 0 ]; then
-			log_info "Skipping bundle ${name} not enabled"
+			log_info "check_bundle_exists: Skipping bundle ${name} not enabled"
+			json_select ..
 			return 0
 		fi
 
-		handle_download_url "$download_url" "$name"
-		local exit_status=$?
-		if [ "$exit_status" -eq 1 ]; then
-			uci -q set "parentalcontrol.${cfg}.status"="Error"
-		else
-			uci -q set "parentalcontrol.${cfg}.status"=""
-		fi
-
-		uci commit parentalcontrol
+		handle_download_url "${url}" "${name}"
+		json_select ..
 	}
 
-	config_foreach check_bundle_exists urlbundle
+	json_init
+	json_load_file "${URLBUNDLE_JSON}"
+
+	json_for_each_item check_bundle_exists "urlBundles"
 }
 
 # Open file descriptor 200 for locking

sshmngr/Config.in

@@ -28,4 +28,15 @@ config SSHMNGR_SFTP
 	default y
 	help
 	   Enable this option to support the SFTP protocol.
+
+config SSHMNGR_SECURITY_MFA
+	bool "MFA using PAM and Google authenticator"
+	depends on SSHMNGR_BACKEND_OPENSSH_PAM
+	default n
+	help
+	   Enable this option to use MFA with PAM based Google authenticator.
+
+config SSHMNGR_VENDOR_PREFIX
+	string "Package specific datamodel Vendor Prefix for TR181 extensions"
+	default ""
 endif

sshmngr/Makefile

@@ -34,6 +34,7 @@ define Package/sshmngr
   DEPENDS+=+SSHMNGR_BACKEND_OPENSSH_PAM:openssh-server-pam +SSHMNGR_BACKEND_OPENSSH_PAM:openssh-client-utils
   DEPENDS+=+SSHMNGR_BACKEND_DROPBEAR:dropbear
   DEPENDS+=+SSHMNGR_SFTP:openssh-sftp-server
+  DEPENDS+=+SSHMNGR_SECURITY_MFA:google-authenticator-libpam
 endef
 
 define Package/sshmngr/description
@@ -44,6 +45,13 @@ define Package/$(PKG_NAME)/config
         source "$(SOURCE)/Config.in"
 endef
 
+ifeq ($(CONFIG_SSHMNGR_VENDOR_PREFIX),"")
+VENDOR_PREFIX = $(CONFIG_BBF_VENDOR_PREFIX)
+else
+VENDOR_PREFIX = $(CONFIG_SSHMNGR_VENDOR_PREFIX)
+endif
+
+
 ifeq ($(LOCAL_DEV),1)
 define Build/Prepare
 	$(CP) -rf ./sshmngr/* $(PKG_BUILD_DIR)/
@@ -67,6 +75,16 @@ endif
 	$(BBFDM_REGISTER_SERVICES) ./bbfdm_service.json $(1) $(PKG_NAME)
 	$(BBFDM_INSTALL_MS_DM) $(PKG_BUILD_DIR)/src/libsshmngr.so $(1) $(PKG_NAME)
 
+ifeq ($(CONFIG_SSHMNGR_BACKEND_OPENSSH_PAM),y)
+	$(INSTALL_DIR) $(1)/etc/uci-defaults
+	$(INSTALL_DATA) ./files/openssh_backend/lib/sshmngr/pam_config.sh $(1)/lib/sshmngr/
+	$(INSTALL_BIN) ./files/openssh_backend/etc/uci-defaults/91-set-sshd-pam $(1)/etc/uci-defaults/
+ifeq ($(CONFIG_SSHMNGR_SECURITY_MFA),y)
+	$(INSTALL_BIN) ./files/openssh_backend/etc/uci-defaults/92-set-ssh-mfa $(1)/etc/uci-defaults/
+	$(BBFDM_INSTALL_MS_PLUGIN) -v ${VENDOR_PREFIX} ./files/openssh_backend/ssh_mfa_override.json $(1) $(PKG_NAME)
+endif
+endif
+
 ifeq ($(CONFIG_PACKAGE_fail2ban),y)
 	$(INSTALL_DIR) $(1)/etc/fail2ban/jail.d
 	$(INSTALL_DIR) $(1)/etc/fail2ban/filter.d/

sshmngr/files/common/usr/libexec/rpcd/sshmngr

@@ -3,6 +3,8 @@
 . /usr/share/libubox/jshn.sh
 . /lib/sshmngr/backend.sh
 
+MFA_SECRET_FILE="/etc/security/mfa_secret"
+
 add_server_name()
 {
 	local server_sec="${1}"
@@ -44,7 +46,7 @@ get_pid()
 
 case "$1" in
 	list)
-		echo '{ "dump" : {"server_name":"string"}, "kill_session" : {"session_pid":"string","server_name":"string"}, "list_keys" : {}, "add_pubkey" : {"current_key":"string","new_key":"string"}, "remove_pubkey" : {"key":"string"} }'
+		echo '{ "dump" : {"server_name":"string"}, "kill_session" : {"session_pid":"string","server_name":"string"}, "list_keys" : {}, "add_pubkey" : {"current_key":"string","new_key":"string"}, "remove_pubkey" : {"key":"string"}, "get_mfa_key" : {}, "get_mfa_recovery" : {} }'
 	;;
 	call)
 		case "$2" in
@@ -221,6 +223,31 @@ case "$1" in
 				fi
 				echo '{}'
 			;;
+
+			get_mfa_key)
+				mfa_key=""
+				if [ -f "${MFA_SECRET_FILE}" ]; then
+					mfa_key="$(head -n 1 "$MFA_SECRET_FILE" 2>/dev/null)"
+				fi
+
+				json_init
+				json_add_string "mfa_key" "${mfa_key}"
+				json_dump
+			;;
+
+			get_mfa_recovery)
+				mfa_recovery_codes=""
+
+				if [ -f "${MFA_SECRET_FILE}" ]; then
+					mfa_recovery_codes="$(tail -n 3 "$MFA_SECRET_FILE" 2>/dev/null | tr '\n' ',')"
+					# remove trailing comma
+					mfa_recovery_codes="${mfa_recovery_codes%,}"
+				fi
+
+				json_init
+				json_add_string "recovery_codes" "${mfa_recovery_codes}"
+				json_dump
+			;;
 		esac
 	;;
 esac

sshmngr/files/openssh_backend/etc/uci-defaults/91-set-sshd-pam

@@ -0,0 +1,36 @@
+#!/bin/sh
+
+# create or over-write our desired file
+# /etc/pam.d/sshd
+cat << 'EOF' > /etc/pam.d/sshd
+auth       required     pam_env.so
+auth       include      sshd-auth
+account    required     pam_nologin.so
+account    include      sshd-account
+session    include      common-session
+session    required     pam_limits.so
+password   include      sshd-password
+EOF
+
+# /etc/pam.d/sshd-auth
+cat << 'EOF' > /etc/pam.d/sshd-auth
+auth    [success=1 default=ignore]    pam_unix.so nullok_secure
+auth    requisite                     pam_deny.so
+auth    required                      pam_permit.so
+EOF
+
+# /etc/pam.d/sshd-password
+cat << 'EOF' > /etc/pam.d/sshd-password
+password    [success=1 default=ignore]    pam_unix.so sha512
+password    requisite                     pam_deny.so
+password    required                      pam_permit.so
+EOF
+
+# /etc/pam.d/sshd-account
+cat << 'EOF' > /etc/pam.d/sshd-account
+account    [success=1 new_authtok_reqd=done default=ignore]    pam_unix.so
+account    requisite                                            pam_deny.so
+account    required                                             pam_permit.so
+EOF
+
+exit 0

sshmngr/files/openssh_backend/etc/uci-defaults/92-set-ssh-mfa

@@ -0,0 +1,10 @@
+#!/bin/sh
+
+if [ -f /etc/config/sshd ]; then
+	# make sure not to change already existing setting
+	if ! uci -q get sshd.@sshd[0].UseMFA 2>&1 > /dev/null; then
+		uci -q set sshd.@sshd[0].UseMFA=1
+	fi
+fi
+
+exit 0

sshmngr/files/openssh_backend/lib/sshmngr/pam_config.sh

@@ -0,0 +1,228 @@
+#!/bin/sh
+
+# List of required .so files
+REQUIRED_MODULES="
+/usr/lib/security/pam_faildelay.so
+/usr/lib/security/pam_faillock.so
+/usr/lib/security/pam_unix.so
+/usr/lib/security/pam_deny.so
+/usr/lib/security/pam_permit.so
+/usr/lib/security/pam_passwdqc.so
+"
+
+MFA_APP="google-authenticator"
+MFA_LIB="/usr/lib/security/pam_google_authenticator.so"
+MFA_DIR="/etc/security"
+MFA_SECRET_FILE="${MFA_DIR}/mfa_secret"
+MFA_QR_FILE="${MFA_DIR}/mfa_qr"
+
+log() {
+	echo "$*" | logger -t sshd.init -p info
+}
+
+log_err() {
+	echo "$*" | logger -t sshd.init -p err
+}
+
+check_required_modules() {
+	for mod in $REQUIRED_MODULES; do
+		if [ ! -f "$mod" ]; then
+			log_err "ERROR: Cannot setup security policy, missing PAM module: $mod"
+			return 1
+		fi
+	done
+
+	return 0
+}
+
+write_line() {
+	local filepath="$1"
+	local line="$2"
+
+	echo "$line" >> "$filepath"
+}
+
+compare_and_replace() {
+	local src dst
+	src="$1"
+	dst="$2"
+
+	if [ ! -f "$dst" ] || ! cmp -s "$src" "$dst"; then
+		cp "$src" "$dst"
+		log "Updated $dst"
+	fi
+}
+
+setup_mfa() {
+	mkdir -p "$MFA_DIR"
+
+	if [ -f "${MFA_SECRET_FILE}" ] && [ -f "${MFA_QR_FILE}" ]; then
+		log "Not updating MFA files, they already exist"
+		return
+	fi
+
+	touch "$MFA_SECRET_FILE"
+	touch "$MFA_QR_FILE"
+	chmod 600 "$MFA_SECRET_FILE"
+	chmod 600 "$MFA_QR_FILE"
+
+	local cmd="$MFA_APP -f -s $MFA_SECRET_FILE -C -t -d -r 3 -R 30 -w 3 -Q UTF8 -e 3"
+
+	log "Running MFA app: $cmd"
+	# if the google-authenticator senses that the output is not going to a terminal
+	# then it does not print out the QR, so simple redirection does not work
+	# we have to run the command inside a pseudo-terminal using script command
+	# and then redirect that output to a file
+	cmd="script -q -c \"$cmd\" $MFA_QR_FILE > /dev/null"
+	eval "$cmd"
+}
+
+update_auth() {
+	# Write /etc/pam.d/sshd-auth
+	local tmp_file pam_file
+	tmp_file="/tmp/sshd-auth"
+	pam_file="/etc/pam.d/sshd-auth"
+
+	local auth_enabled="${1}"
+	local enabled="${2}"
+	local mfa_enabled="${3}"
+
+	local faildelay="$(uci -q get users.authentication_policy.fail_delay || echo 3)"
+	local faillock_lockout_time="$(uci -q get users.authentication_policy.faillock_lockout_time || echo 300)"
+	local faillock_attempts="$(uci -q get users.authentication_policy.faillock_attempts || echo 6)"
+
+	# Convert seconds to microseconds for pam_faildelay
+	local faildelay_usec=$((faildelay * 1000000))
+
+	rm -f "$tmp_file"
+	touch "$tmp_file"
+
+	if [ "${auth_enabled}" -eq 1 ] && [ "${enabled}" -eq 1 ]; then
+		write_line "$tmp_file" "auth	optional	pam_faildelay.so delay=$faildelay_usec"
+		write_line "$tmp_file" "auth	required	pam_faillock.so preauth deny=$faillock_attempts even_deny_root unlock_time=$faillock_lockout_time"
+	fi
+
+	write_line "$tmp_file" "auth	[success=1 default=bad]	pam_unix.so nullok_secure"
+	write_line "$tmp_file" "auth	[default=die]	pam_faillock.so authfail audit deny=$faillock_attempts even_deny_root unlock_time=$faillock_lockout_time"
+
+	if [ "$mfa_enabled" -eq 1 ]; then
+		write_line "$tmp_file" "auth	[success=1 default=bad]	pam_google_authenticator.so secret=$MFA_SECRET_FILE"
+		write_line "$tmp_file" "auth	[default=die]	pam_faillock.so authfail audit deny=$faillock_attempts even_deny_root unlock_time=$faillock_lockout_time"
+	fi
+
+	write_line "$tmp_file" "auth	sufficient	pam_faillock.so authsucc audit deny=$faillock_attempts even_deny_root unlock_time=$faillock_lockout_time"
+
+	write_line "$tmp_file" "auth	requisite	pam_deny.so"
+
+	compare_and_replace "$tmp_file" "$pam_file"
+}
+
+build_pam_passwdqc_line() {
+	local base="password requisite pam_passwdqc.so"
+	local k v line
+
+	for line in $(uci show users.passwdqc 2>/dev/null); do
+		case "$line" in
+			users.passwdqc=*) continue ;;
+			users.passwdqc.enabled=*) continue ;;
+		esac
+
+		k="${line%%=*}"
+		k="${k#users.passwdqc.}"
+		v="${line#*=}"
+		v="${v%\'}"
+		v="${v#\'}"
+		base="$base $k=$v"
+	done
+
+	base="$base match=0"
+
+	echo "$base"
+}
+
+# NOTE:
+# for some reason setting min 8 makes passwdqc accept minimum 12 letter password with this configuration
+# if we set it to 12 then we need atleast 16 characters and so on
+# passphrase = 0 means no space separated words
+# passphrase = N means the number of words required for a passphrase or 0 to disable the support for user-chosen passphrases.
+# rest can be figured out from passwdqc man page
+update_password() {
+	local tmp_file pam_file enabled line
+	tmp_file="/tmp/sshd-password"
+	pam_file="/etc/pam.d/sshd-password"
+
+	local auth_enabled="${1}"
+
+	rm -f "$tmp_file"
+	touch "$tmp_file"
+
+	# Check if section exists
+	if uci -q get users.passwdqc >/dev/null 2>&1; then
+		# if enabled is not present it is assumed to be 0
+		enabled=$(uci -q get users.passwdqc.enabled || echo "0")
+		if [ "${auth_enabled}" -eq 1 ] && [ "${enabled}" -eq 1 ]; then
+			line="$(build_pam_passwdqc_line)"
+			write_line "$tmp_file" "$line"
+		fi
+	fi
+
+	write_line "$tmp_file" "password	[success=1 default=ignore]	pam_unix.so sha512"
+	write_line "$tmp_file" ""
+	write_line "$tmp_file" "password	requisite			pam_deny.so"
+	write_line "$tmp_file" "password	required			pam_permit.so"
+
+	compare_and_replace "$tmp_file" "$pam_file"
+}
+
+update_account() {
+	# Write /etc/pam.d/sshd-account
+	local tmp_file pam_file
+	tmp_file="/tmp/sshd-account"
+	pam_file="/etc/pam.d/sshd-account"
+
+	local auth_enabled="${1}"
+	local enabled="${2}"
+
+	rm -f "$tmp_file"
+	touch "$tmp_file"
+
+	if [ "${auth_enabled}" -eq 1 ] && [ "${enabled}" -eq 1 ]; then
+		write_line "$tmp_file" "account 	required       		pam_faillock.so"
+	fi
+
+	write_line "$tmp_file" "account		[success=1 new_authtok_reqd=done default=ignore]	pam_unix.so"
+	write_line "$tmp_file" ""
+	write_line "$tmp_file" "account		requisite		pam_deny.so"
+	write_line "$tmp_file" "account		required		pam_permit.so"
+
+	compare_and_replace "$tmp_file" "$pam_file"
+}
+
+handle_security_policy() {
+	local auth_enabled enabled
+	local use_mfa mfa_enabled
+
+	# Read UCI values
+	auth_enabled="$(uci -q get users.users.auth_policy_enable || echo 0)"
+	enabled="$(uci -q get users.authentication_policy.enabled || echo 0)"
+	use_mfa="$(uci -q get sshd.@sshd[0].UseMFA || echo 0)"
+
+	# if any .so files are missing, then we cannot setup security
+	if ! check_required_modules; then
+		return
+	fi
+
+	# Detect and enable MFA only if requested and module exists
+	if which "$MFA_APP" > /dev/null 2>&1 && [ "$use_mfa" = "1" ] && [ -f "$MFA_LIB" ]; then
+		mfa_enabled=1
+		setup_mfa
+	else
+		rm -rf "${MFA_QR_FILE}"
+		rm -rf "${MFA_SECRET_FILE}"
+		mfa_enabled=0
+	fi
+
+	update_auth "${auth_enabled}" "${enabled}" "${mfa_enabled}"
+	update_account "${auth_enabled}" "${enabled}"
+	update_password "${auth_enabled}"
+}

sshmngr/files/openssh_backend/ssh_mfa_override.json

@@ -0,0 +1,68 @@
+{
+    "json_plugin_version": 2,
+    "Device.SSH.Server.{i}.": {
+        "type": "object",
+        "protocols": [
+            "cwmp",
+            "usp"
+        ],
+        "access": false,
+        "array": false,
+	"{BBF_VENDOR_PREFIX}UseMFA": {
+            "type": "boolean",
+            "read": true,
+            "write": true,
+            "protocols": [
+                "cwmp",
+                "usp"
+            ],
+	    "mapping": [
+		{
+			"data": "@Parent",
+			"type": "uci_sec",
+			"key": "UseMFA"
+		}
+	    ]
+	},
+	"{BBF_VENDOR_PREFIX}MFA_Key": {
+            "type": "string",
+            "read": true,
+            "write": false,
+            "protocols": [
+                "cwmp",
+                "usp"
+            ],
+	    "mapping": [
+		{
+			"type": "ubus",
+			"ubus": {
+				"object": "sshmngr",
+				"method": "get_mfa_key",
+				"args": {},
+				"key": "mfa_key"
+			}
+		}
+	    ]
+	},
+	"{BBF_VENDOR_PREFIX}MFA_Recovery_Codes": {
+            "type": "string",
+            "read": true,
+            "write": false,
+            "protocols": [
+                "cwmp",
+                "usp"
+            ],
+	    "mapping": [
+		{
+			"type": "ubus",
+			"ubus": {
+				"object": "sshmngr",
+				"method": "get_mfa_recovery",
+				"args": {},
+				"key": "recovery_codes"
+			}
+		}
+	    ]
+        }
+    }
+}

sulu/sulu-base/Makefile

@@ -5,11 +5,11 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=sulu-base
-PKG_VERSION:=5.3.0
+PKG_VERSION:=5.3.10
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/websdk/sulu.git
-PKG_SOURCE_VERSION:=e282df789259a4ed1812e72a91e1b8d4373189db
+PKG_SOURCE_VERSION:=15f36f48dee8a675d7829181bf508a75c0a66a8a
 PKG_MIRROR_HASH:=skip
 
 SULU_MOD:=core

sulu/sulu-builder/Makefile

@@ -5,12 +5,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=sulu-builder
-PKG_VERSION:=5.3.0
+PKG_VERSION:=5.3.10
 PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/websdk/sulu-builder.git
-PKG_SOURCE_VERSION:=4cdc7d7cf4e566256be2608d1b70af5e489ec3bc
+PKG_SOURCE_VERSION:=6a82c845c5203a7e33737d668659e60203f9f68f
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_SOURCE_VERSION)
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_BUILD_DIR:=$(BUILD_DIR)/sulu-$(PKG_VERSION)/sulu-builder-$(PKG_SOURCE_VERSION)

sulu/sulu-builder/files/etc/sulu/sulu.sh

@@ -126,6 +126,8 @@ create_mosquitto_acl() {
 			} >> "${SULU_ACL_FILE}"
 		fi
 	done
+	chown mosquitto:mosquitto "${SULU_ACL_FILE}"
+	chmod 640 "${SULU_ACL_FILE}"
 }
 
 get_sulu_roles() {

sulu/sulu-theme-genexis/Makefile

@@ -5,7 +5,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=sulu-theme-genexis
-PKG_VERSION:=5.3.0
+PKG_VERSION:=5.3.10
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/gnx/sulu-theme-genexis

sysmngr/Makefile

@@ -5,13 +5,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=sysmngr
-PKG_VERSION:=1.1.3
+PKG_VERSION:=1.1.6
 
 LOCAL_DEV:=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/system/sysmngr.git
-PKG_SOURCE_VERSION:=2643356bde5bc45c79f46c7e8969a085d2f3e39d
+PKG_SOURCE_VERSION:=9e5cbc3c00e4e8ab1678baf5d8ff369a9345da09
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_MIRROR_HASH:=skip
 endif
@@ -112,16 +112,6 @@ define Package/$(PKG_NAME)/install
 	$(BBFDM_REGISTER_SERVICES) ./bbfdm_service.json $(1) $(PKG_NAME)
 	
 	$(INSTALL_BIN) ./files/etc/sysmngr/fwbank $(1)/etc/sysmngr/fwbank
-
-ifeq ($(CONFIG_SYSMNGR_TEMPERATURE_STATUS),y)
-	$(INSTALL_DIR) $(1)/etc/sysmngr
-ifeq ($(CONFIG_TARGET_brcmbca),y)
-	$(INSTALL_BIN) ./files/etc/sysmngr/broadcom.sh $(1)/etc/sysmngr/temperature.sh
-else
-	$(INSTALL_BIN) ./files/etc/sysmngr/default.sh $(1)/etc/sysmngr/temperature.sh
-endif
-endif
-
 endef
 
 $(eval $(call BuildPackage,$(PKG_NAME)))

sysmngr/files/etc/sysmngr/broadcom.sh

@@ -1,84 +0,0 @@
-#!/bin/sh
-
-. /usr/share/libubox/jshn.sh
-. /lib/functions.sh
-
-function get_wlan_temperature()
-{
-  add_wlan_temp() {
-    local temp="$(wlctl -i "$1" phy_tempsense)"
-    [ -n "$temp" ] || temp='-274'
-
-    json_add_object
-    json_add_string "name" "wlan-$1"
-    json_add_int "temperature" "$temp"
-    json_close_object
-  }
-
-  config_load wireless
-  config_foreach add_wlan_temp wifi-device
-}
-
-function get_sfp_temperature()
-{
-  local temp=""
-  local sfp="$(ubus call sfp.ddm get-temperature)"
-
-  json_load "$sfp"
-  json_get_var temp temperature
-
-  [ -n "$temp" ] || temp='-274'
-
-  echo "$temp"
-}
-
-function get_cpu_temperature()
-{
-  local cpu="$(cat /sys/devices/virtual/thermal/thermal_zone0/temp 2>/dev/null)"
-  [ -n "$cpu" ] || cpu='-274000'
-
-  echo "${cpu:0:-3}"
-}
-
-function get_temperature_status()
-{
-  local hasSfp="$(db -q get hw.board.hasSfp)"
-
-  json_init
-
-  json_add_array "status"
-
-  json_add_object
-  json_add_string "name" "cpu"
-  json_add_int "temperature" "$(get_cpu_temperature)"
-  json_close_object
-
-  [ -s /etc/config/wireless ] && get_wlan_temperature
-
-  [ "$hasSfp" = "1" ] && {
-	  json_add_object
-	  json_add_string "name" "sfp"
-	  json_add_int "temperature" "$(get_sfp_temperature)"
-	  json_close_object
-  }
-
-  json_close_array
-
-  json_dump
-}
-
-function dump_invalid()
-{
-  json_init
-  json_add_string "fault" "invalid request"
-  json_dump
-}
-
-case "$1" in
-    status)
-        get_temperature_status
-        ;;
-    *)
-        dump_invalid
-        ;;
-esac

sysmngr/files/etc/sysmngr/default.sh

@@ -1,62 +0,0 @@
-#!/bin/sh
-
-. /usr/share/libubox/jshn.sh
-. /lib/functions.sh
-
-function get_wlan_temperature()
-{
-  :
-}
-
-function get_sfp_temperature()
-{
-  echo "-274"
-}
-
-function get_cpu_temperature()
-{
-  echo "-274"
-}
-
-function get_temperature_status()
-{
-  local hasSfp="$(db -q get hw.board.hasSfp)"
-
-  json_init
-
-  json_add_array "status"
-
-  json_add_object
-  json_add_string "name" "cpu"
-  json_add_int "temperature" "$(get_cpu_temperature)"
-  json_close_object
-
-  [ -s /etc/config/wireless ] && get_wlan_temperature
-
-  [ "$hasSfp" = "1" ] && {
-	  json_add_object
-	  json_add_string "name" "sfp"
-	  json_add_int "temperature" "$(get_sfp_temperature)"
-	  json_close_object
-  }
-
-  json_close_array
-
-  json_dump
-}
-
-function dump_invalid()
-{
-  json_init
-  json_add_string "fault" "invalid request"
-  json_dump
-}
-
-case "$1" in
-    status)
-        get_temperature_status
-        ;;
-    *)
-        dump_invalid
-        ;;
-esac

tr143/Makefile

@@ -5,13 +5,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=tr143
-PKG_VERSION:=1.1.8
+PKG_VERSION:=1.1.13
 
 LOCAL_DEV:=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/bbf/tr143d.git
-PKG_SOURCE_VERSION:=5f8404e01e5e4478de528027fa12717c1a2256f3
+PKG_SOURCE_VERSION:=be8ee7b6c52817914f66875d36061f2f62b80af8
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_MIRROR_HASH:=skip
 endif
@@ -36,16 +36,20 @@ endef
 MAKE_PATH:=src
 
 define Package/tr143/install
+	$(INSTALL_DIR) $(1)/etc/uci-defaults
 	$(BBFDM_INSTALL_MS_PLUGIN) $(PKG_BUILD_DIR)/src/libtr143d.so $(1) netmngr 11
 
 ifeq ($(CONFIG_TARGET_SUBTARGET),"an7581")
 	$(BBFDM_INSTALL_SCRIPT) $(PKG_BUILD_DIR)/airoha/scripts/download $(1)
+	$(BBFDM_INSTALL_SCRIPT) $(PKG_BUILD_DIR)/airoha/scripts/upload $(1)
+	$(INSTALL_DATA) ./files/an7581/etc/uci-defaults/* $(1)/etc/uci-defaults/
 else
 	$(BBFDM_INSTALL_SCRIPT) $(PKG_BUILD_DIR)/scripts/download $(1)
+	$(BBFDM_INSTALL_SCRIPT) $(PKG_BUILD_DIR)/scripts/upload $(1)
+	$(INSTALL_DATA) ./files/other/etc/uci-defaults/* $(1)/etc/uci-defaults/
 endif
 
 	$(BBFDM_INSTALL_SCRIPT) $(PKG_BUILD_DIR)/scripts/traceroute $(1)
-	$(BBFDM_INSTALL_SCRIPT) $(PKG_BUILD_DIR)/scripts/upload $(1)
 	$(BBFDM_INSTALL_SCRIPT) -d $(PKG_BUILD_DIR)/scripts/bbf_diag/ipping $(1)
 	$(BBFDM_INSTALL_SCRIPT) -d $(PKG_BUILD_DIR)/scripts/bbf_diag/serverselection $(1)
 	$(BBFDM_INSTALL_SCRIPT) -d $(PKG_BUILD_DIR)/scripts/bbf_diag/udpecho $(1)

tr143/files/an7581/etc/uci-defaults/20_tr143_enforce_vendor_defaults

@@ -0,0 +1,19 @@
+#!/bin/sh
+
+set_tr143_diagnostic_defaults() {
+	if [ ! -f /etc/bbfdm/dmmap/dmmap_diagnostics ]; then
+		touch /etc/bbfdm/dmmap/dmmap_diagnostics
+	fi
+
+	uci -q -c /etc/bbfdm/dmmap set dmmap_diagnostics.download='download'
+	uci -q -c /etc/bbfdm/dmmap set dmmap_diagnostics.download.DefaultNumberOfConnections='4'
+	uci -q -c /etc/bbfdm/dmmap set dmmap_diagnostics.download.DownloadDiagnosticMaxConnections='8'
+
+	uci -q -c /etc/bbfdm/dmmap set dmmap_diagnostics.upload='upload'
+	uci -q -c /etc/bbfdm/dmmap set dmmap_diagnostics.upload.DefaultNumberOfConnections='1'
+	uci -q -c /etc/bbfdm/dmmap set dmmap_diagnostics.upload.UploadDiagnosticMaxConnections='8'
+
+	uci -q -c /etc/bbfdm/dmmap commit dmmap_diagnostics
+}
+
+set_tr143_diagnostic_defaults

tr143/files/other/etc/uci-defaults/30_tr143_enforce_defaults

@@ -0,0 +1,19 @@
+#!/bin/sh
+
+set_tr143_diagnostic_defaults() {
+	if [ ! -f /etc/bbfdm/dmmap/dmmap_diagnostics ]; then
+		touch /etc/bbfdm/dmmap/dmmap_diagnostics
+	fi
+
+	uci -q -c /etc/bbfdm/dmmap set dmmap_diagnostics.download='download'
+	uci -q -c /etc/bbfdm/dmmap set dmmap_diagnostics.download.DefaultNumberOfConnections='1'
+	uci -q -c /etc/bbfdm/dmmap set dmmap_diagnostics.download.DownloadDiagnosticMaxConnections='1'
+
+	uci -q -c /etc/bbfdm/dmmap set dmmap_diagnostics.upload='upload'
+	uci -q -c /etc/bbfdm/dmmap set dmmap_diagnostics.upload.DefaultNumberOfConnections='1'
+	uci -q -c /etc/bbfdm/dmmap set dmmap_diagnostics.upload.UploadDiagnosticMaxConnections='1'
+
+	uci -q -c /etc/bbfdm/dmmap commit dmmap_diagnostics
+}
+
+set_tr143_diagnostic_defaults

userinterface/Makefile

@@ -5,13 +5,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=userinterface
-PKG_VERSION:=1.1.9
+PKG_VERSION:=1.1.10
 
 LOCAL_DEV:=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/bbf/userinterface.git
-PKG_SOURCE_VERSION:=52f8bff5941c5e91d7ed8eed33cf5adf364960c5
+PKG_SOURCE_VERSION:=70733fcc20b099309a79f0404e6dd799d6b1005d
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_MIRROR_HASH:=skip
 endif

usp-js/Makefile

@@ -6,16 +6,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=usp-js
-PKG_VERSION:=1.2.9
+PKG_VERSION:=1.2.10
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/websdk/usp-js.git
-PKG_SOURCE_VERSION:=31d652f91e8581d19840a8fdde1f87b0acca44ed
-PKG_SOURCE:=$(PKG_NAME)-$(PKG_SOURCE_VERSION).tar.gz
+PKG_SOURCE_VERSION:=5faa585dff45ceba99f6e8a89a47b1ca34fa5bf3
 PKG_MIRROR_HASH:=skip
 
-PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_SOURCE_VERSION)
-
 PKG_LICENSE:=BSD-3-Clause
 PKG_LICENSE_FILES:=LICENSE
 

wifidmd/Makefile

@@ -5,13 +5,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=wifidmd
-PKG_VERSION:=1.4.5
+PKG_VERSION:=1.4.7
 
 LOCAL_DEV:=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/bbf/wifidmd.git
-PKG_SOURCE_VERSION:=bf8d314d121bf644c3e22dc75ccd55abd524ad37
+PKG_SOURCE_VERSION:=3e91a3d96480ad796e037a1d85b98e6e530e85a9
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_MIRROR_HASH:=skip
 endif

wifidmd/files/etc/wifidmd/bbf_config_reload.sh

@@ -107,6 +107,63 @@ wait_for_wifi_reload() {
 	return 1
 }
 
+###############################################################################
+# mark_ap_instances_applied
+#
+# Description:
+#   Finalizes newly created WiFi AccessPoint instances in the dmmap WiFi
+#   configuration.
+#
+#   An AccessPoint instance is considered a *new instance* when the option
+#   __is_new__ exists and its value is "1".
+#
+#   New instance handling logic:
+#
+#     • The AccessPoint's controller-side section name is obtained from
+#       the __section_name__ option (e.g., "mapcontroller.xxx" or "wireless.xxx").
+#
+#     • For new instances where __section_name__ begins with "mapcontroller.":
+#           - Remove __is_new__
+#           - No additional actions required
+#
+#     • For new instances where __section_name__ begins with "wireless.":
+#           - Set mapcontroller=0 (indicates mapcontroller reload is not required)
+#           - Remove __is_new__
+#
+#     • For all other prefixes:
+#           - Remove __is_new__ only
+#
+#   After all new instances are processed, the dmmap WiFi configuration is committed.
+###############################################################################
+mark_ap_instances_applied() {
+	for sec in $(uci -q -c /etc/bbfdm/dmmap show WiFi | grep "=AccessPoint" | cut -d. -f2 | cut -d= -f1); do
+		is_new=$(uci -q -c /etc/bbfdm/dmmap get WiFi.${sec}.__is_new__)
+
+		if [ "${is_new}" = "1" ]; then
+			config_sec_name=$(uci -q -c /etc/bbfdm/dmmap get WiFi.${sec}.__section_name__)
+			case "${config_sec_name}" in
+				mapcontroller.*)
+					# New mapcontroller AP instance — remove creation flag only
+					uci -q -c /etc/bbfdm/dmmap delete WiFi.${sec}.__is_new__
+					;;
+
+				wireless.*)
+					# New wireless AP instance — skip mapcontroller reload
+					mapcontroller=0
+					uci -q -c /etc/bbfdm/dmmap delete WiFi.${sec}.__is_new__
+					;;
+
+				*)
+					# Other AP instance types — remove creation flag only
+					uci -q -c /etc/bbfdm/dmmap delete WiFi.${sec}.__is_new__
+					;;
+			esac
+		fi
+	done
+
+	uci -q -c /etc/bbfdm/dmmap commit WiFi
+}
+
 # Define function to reload mapcontroller
 reload_mapcontroller() {
 	pid=$(pidof mapcontroller)
@@ -126,6 +183,9 @@ commit_wireless_config() {
 	wait_for_wifi_reload
 }
 
+# Finalize newly created AP AccessPoint instances
+mark_ap_instances_applied
+
 # Apply logic based on flags
 if [ "$mapcontroller" -eq 1 ]; then
 	reload_mapcontroller