dhcpmngr: 1.0.8

(cherry picked from commit a0ba20647d)

Co-authored-by: Vivek Kumar Dutta <vivek.dutta@iopsys.eu>

bbfdm/Makefile

@@ -5,13 +5,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=bbfdm
-PKG_VERSION:=1.16.6.2
+PKG_VERSION:=1.16.6.4
 
 USE_LOCAL:=0
 ifneq ($(USE_LOCAL),1)
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/bbf/bbfdm.git
-PKG_SOURCE_VERSION:=aa480554461c82e6f6f44ee6c23108d3e44fce21
+PKG_SOURCE_VERSION:=a707ed46b0cf913aaf87a1635fc2907914330905
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_MIRROR_HASH:=skip
 endif

decollector/Makefile

@@ -6,12 +6,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=decollector
-PKG_VERSION:=6.2.1.8
+PKG_VERSION:=6.2.1.12
 
 LOCAL_DEV=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_VERSION:=b7e294d7c610adfd80cf40a0628c189695dc5156
+PKG_SOURCE_VERSION:=3fbd4b65d250f5a9f048c24ac1318e52716c6eed
 PKG_SOURCE_URL:=https://dev.iopsys.eu/multi-ap/decollector.git
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_MIRROR_HASH:=skip

dhcpmngr/Makefile

@@ -5,13 +5,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=dhcpmngr
-PKG_VERSION:=1.0.6
+PKG_VERSION:=1.0.8
 
 LOCAL_DEV:=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/network/dhcpmngr.git
-PKG_SOURCE_VERSION:=986f66608959f4f589009d580b046e250d8c620d
+PKG_SOURCE_VERSION:=4c72eaf8af58e273f08b03090ccc7c9a61a7fde9
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_MIRROR_HASH:=skip
 endif

dmcli-plugins/Makefile

@@ -0,0 +1,48 @@
+#
+# Copyright (c) 2023 Genexis Netherlands B.V. All rights reserved.
+# This Software and its content are protected by the Dutch Copyright Act
+# ('Auteurswet'). All and any copying and distribution of the software
+# and its content without authorization by Genexis Netherlands B.V. is
+# prohibited. The prohibition includes every form of reproduction and
+# distribution.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=dmcli-plugins
+PKG_LICENSE:=PROPRIETARY GENEXIS
+PKG_VERSION:=2.2.6
+
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_URL:=https://dev.iopsys.eu/gnx/dmcli-plugin-easydm.git
+PKG_SOURCE_VERSION:=bc8b8527e8a41bdba73cb277a3c6c3b42b045153
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.xz
+PKG_MIRROR_HASH:=skip
+
+PKG_BUILD_PARALLEL:=1
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/dmcli-plugins
+  SECTION:=tools
+  CATEGORY:=Genexis
+  TITLE:=Easy-to-use data model on top of TR181
+  URL:=http://genexis.eu
+  DEPENDS:=+dmcli
+endef
+
+define Package/dmcli-plugins/description
+  EasyDM offers a user-friendly approach to configuring TR-181
+  simplifying the process with its intuitive interface.
+endef
+
+define Build/Compile
+	true
+endef
+
+define Package/dmcli-plugins/install
+	$(INSTALL_DIR) $(1)/usr/lib/dmcli/plugins
+	$(CP) $(PKG_BUILD_DIR)/src/*.js $(1)/usr/lib/dmcli/plugins/
+endef
+
+$(eval $(call BuildPackage,dmcli-plugins))

dmcli/Config.in

@@ -0,0 +1,9 @@
+if PACKAGE_dmcli
+
+config DMCLI_REMOTE_CONNECTION
+        bool "Add dmcli remote controller configuration"
+        default n
+        help
+                This adds a usp controller configuration for dmcli remote connection from different machine/laptop/server.
+
+endif

dmcli/Makefile

@@ -0,0 +1,75 @@
+#
+# Copyright (c) 2021 Genexis Netherlands B.V. All rights reserved.
+# This Software and its content are protected by the Dutch Copyright Act
+# ('Auteurswet'). All and any copying and distribution of the software
+# and its content without authorization by Genexis Netherlands B.V. is
+# prohibited. The prohibition includes every form of reproduction and
+# distribution.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=dmcli
+PKG_LICENSE:=PROPRIETARY GENEXIS
+PKG_VERSION:=1.9.4
+
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_URL:=https://dev.iopsys.eu/gnx/dmcli.git
+PKG_SOURCE_VERSION:=2139e81d0faca09fe1832c503297ef75ea76d6eb
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.xz
+PKG_MIRROR_HASH:=skip
+
+PKG_BUILD_PARALLEL:=1
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/dmcli
+  SECTION:=tools
+  CATEGORY:=Genexis
+  TITLE:=DMCLI (datamodel-based CLI)
+  URL:=http://genexis.eu
+  DEPENDS:=+usp-js +DMCLI_REMOTE_CONNECTION:mosquitto-auth-plugin +shadow-utils +@BUSYBOX_CONFIG_ADDUSER
+endef
+
+define Package/dmcli/description
+  CLI to view and configure datamodels of CPE
+endef
+
+define Package/dmcli/conffiles
+/etc/dmcli/dmcli.conf
+endef
+
+define Package/dmcli/config
+	source "$(SOURCE)/Config.in"
+endef
+
+define Package/dmcli/install
+	$(INSTALL_DIR) $(1)/usr/bin
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/dmcli $(1)/usr/bin/
+
+	$(INSTALL_DIR) $(1)/usr/lib/dmcli
+	$(CP) $(PKG_BUILD_DIR)/common $(1)/usr/lib/dmcli/
+	mv $(1)/usr/lib/dmcli/common/os_qjs.js $(1)/usr/lib/dmcli/common/os.js
+	rm $(1)/usr/lib/dmcli/common/os_node.js
+	$(CP) $(PKG_BUILD_DIR)/core $(1)/usr/lib/dmcli/
+	$(CP) $(PKG_BUILD_DIR)/cli $(1)/usr/lib/dmcli/
+	$(CP) $(PKG_BUILD_DIR)/data $(1)/usr/lib/dmcli/
+	$(CP) $(PKG_BUILD_DIR)/plugins $(1)/usr/lib/dmcli/
+
+	$(INSTALL_DIR) $(1)/etc/uci-defaults
+	$(INSTALL_DATA) ./files/etc/uci-defaults/36-dmcli $(1)/etc/uci-defaults/
+ifeq ($(CONFIG_DMCLI_REMOTE_CONNECTION),y)
+	$(INSTALL_DATA) ./files/etc/uci-defaults/36-dmcli-remote $(1)/etc/uci-defaults/
+else
+	$(INSTALL_DATA) ./files/etc/uci-defaults/36-dmcli-remote-remove $(1)/etc/uci-defaults/
+endif
+
+	$(INSTALL_DIR) $(1)/etc/dmcli
+	$(CP) ./files/etc/dmcli/dmcli.acl $(1)/etc/dmcli/
+	$(CP) ./files/etc/dmcli/dmcli.conf $(1)/etc/dmcli/
+
+	$(INSTALL_DIR) $(1)/etc/users/roles/
+	$(INSTALL_DATA) ./files/etc/users/roles/operator.json $(1)/etc/users/roles/
+endef
+
+$(eval $(call BuildPackage,dmcli))

dmcli/files/etc/dmcli/dmcli.acl

@@ -0,0 +1,4 @@
+user operator
+topic read /usp/operator/controller/reply-to
+topic read /usp/operator/controller
+topic write /usp/operator/endpoint

dmcli/files/etc/dmcli/dmcli.conf

@@ -0,0 +1,45 @@
+{
+   "Settings": {
+      "USP": {
+         "ActiveConnectionProfile": "local",
+         "ConnectionProfile": [
+            {
+               "Name": "local",
+               "Host": "127.0.0.1",
+               "Port": 9002,
+               "Username": "operator",
+               "Protocol": "ws",
+               "FromId": "oui:000F94:device-controller-operator",
+               "PublishEndpoint": "/usp/operator/endpoint",
+               "SubscribeEndpoint": "/usp/operator/controller"
+            }
+         ],
+         "Session": {
+            "AutoStart": false
+         },
+         "Notification": {
+            "LogTo": "console",
+            "Format": "brief",
+            "LogFile": "usp-notification.log"
+         }
+      },
+      "CLI": {
+         "Home": "/",
+         "Color": "true",
+         "Mode": "Command",
+         "ShowCommandTime": false,
+         "SortDMTree": false
+      },
+      "Prompt": {
+         "Auto": true,
+         "Color": "default",
+         "SelectedBackgroundColor": "yellow",
+         "PageSize": "3",
+         "AutoPromptOnEmptyCommand": false,
+         "AutoPromptInstanceNumbers": false
+      },
+      "Log": {
+         "Level": "Error"
+      }
+   }
+}

dmcli/files/etc/uci-defaults/36-dmcli

@@ -0,0 +1,120 @@
+#!/bin/sh
+
+. /lib/functions.sh
+. /lib/functions/iopsys-environment.sh
+. /usr/share/libubox/jshn.sh
+
+DMCLI_CONF="/etc/dmcli/dmcli.conf"
+CONTROLLER_ID='oui:000F94:device-controller-operator'
+DMCLI_RESP_TOPIC="/usp/operator/endpoint"
+DMCLI_CTRL_TOPIC="/usp/operator/controller"
+DMCLI_PORT="9002"
+
+grep -q "^operator:" /etc/passwd || {
+	adduser -g 'Operator' -D -H -s /usr/bin/dmcli --home '/usr/lib/dmcli' 'operator'
+	hash=""
+	if type get_operator_password_hash > /dev/null 2>&1; then
+		hash=$(get_operator_password_hash)
+	fi
+	if [ -z "$hash" ]; then
+		hash='$6$zP4Wk/VQJOLwwofC$teuhnYFQBcA8YUZo/Q0quDMi4SsOHmfBcyvt5VNchPnzgwF1nfNNliC3yBVW22NwmwttPEWeBEBfnMTBB0rYs/'
+	fi
+	echo "operator:${hash}" | chpasswd -e
+}
+
+grep -q "^/usr/bin/dmcli$" /etc/shells || {
+	echo '/usr/bin/dmcli' >> /etc/shells
+}
+
+uci -q del_list sshd.@sshd[0].AllowUsers='operator'
+uci -q add_list sshd.@sshd[0].AllowUsers='operator'
+
+uci -q delete users.operator
+uci -q set users.operator=user
+uci -q set users.operator.enabled=1
+uci -q set users.operator.shell='dmcli'
+uci -q set users.operator.member_roles='operator'
+
+if [ -f "/etc/config/mosquitto" ]; then
+	uci_add mosquitto listener dmcli_local
+	uci_set mosquitto dmcli_local enabled 1
+	uci_set mosquitto dmcli_local port "${DMCLI_PORT}"
+	uci_set mosquitto dmcli_local protocol 'websockets'
+	uci_set mosquitto dmcli_local acl_file '/etc/dmcli/dmcli.acl'
+	uci_set mosquitto dmcli_local no_remote_access '1'
+	uci_set mosquitto dmcli_local allow_anonymous '1'
+fi
+
+if [ -f "/etc/config/obuspa" ]; then
+	uci_add obuspa mqtt mqtt_operator
+	uci_set obuspa mqtt_operator BrokerAddress '127.0.0.1'
+	uci_set obuspa mqtt_operator BrokerPort '1883'
+	uci_set obuspa mqtt_operator TransportProtocol 'TCP/IP'
+
+	uci_add obuspa mtp mtp_operator
+	uci_set obuspa mtp_operator Protocol 'MQTT'
+	uci_set obuspa mtp_operator ResponseTopicConfigured "${DMCLI_RESP_TOPIC}"
+	uci_set obuspa mtp_operator mqtt 'mqtt_operator'
+
+	uci_add obuspa controller controller_operator
+	uci_set obuspa controller_operator EndpointID "${CONTROLLER_ID}"
+	uci_set obuspa controller_operator Protocol 'MQTT'
+	uci_set obuspa controller_operator Topic "${DMCLI_CTRL_TOPIC}"
+	uci_set obuspa controller_operator mqtt 'mqtt_operator'
+	uci_set obuspa controller_operator assigned_role_name 'operator'
+fi
+
+_get_endpoint_id() {
+	local id serial oui
+
+	id="$(uci -q get obuspa.localagent.EndpointID)"
+	if [ -n "${id}" ]; then
+		echo "${id}"
+		return 0
+	fi
+
+	serial="$(db -q get device.deviceinfo.SerialNumber)"
+	oui="$(db -q get device.deviceinfo.ManufacturerOUI)"
+
+	echo "os::${oui}-${serial//+/%2B}"
+}
+
+update_dmcli_conf() {
+	local endpointid confTmpFile
+	local port fromid publish subscribe toid
+
+	if [ -f "${DMCLI_CONF}" ]; then
+		endpointid="$(_get_endpoint_id)"
+		json_load_file "${DMCLI_CONF}" || return
+		json_select "Settings" || return
+			json_select "USP" || return
+				json_select "ConnectionProfile" || return
+					json_select "1" || return
+						json_get_var port "Port"
+						json_get_var fromid "FromId"
+						json_get_var publish "PublishEndpoint"
+						json_get_var subscribe "SubscribeEndpoint"
+						json_get_var toid "ToId"
+
+						json_add_int "Port" "${DMCLI_PORT}"
+						json_add_string "FromId" "${CONTROLLER_ID}"
+						json_add_string "PublishEndpoint" "${DMCLI_RESP_TOPIC}"
+						json_add_string "SubscribeEndpoint" "${DMCLI_CTRL_TOPIC}"
+						json_add_string "ToId" "${endpointid}"
+					json_select ..
+				json_select ..
+			json_select ..
+		json_select ..
+
+		if [ "${port}" != "${DMCLI_PORT}" ] || [ "${fromid}" != "${CONTROLLER_ID}" ] || \
+			[ "${publish}" != "${DMCLI_RESP_TOPIC}" ] || [ "${subscribe}" != "${DMCLI_CTRL_TOPIC}" ] || \
+			[ "${toid}" != "${endpointid}" ]; then
+			confTmpFile="$(mktemp -u -p "$(dirname "$DMCLI_CONF")" "$(basename "$DMCLI_CONF").XXXXXXX")"
+			json_pretty
+			json_dump > "${confTmpFile}" || return
+			mv -f "${confTmpFile}" "${DMCLI_CONF}" || return
+		fi
+	fi
+}
+
+update_dmcli_conf || exit

dmcli/files/etc/uci-defaults/36-dmcli-remote

@@ -0,0 +1,14 @@
+#!/bin/sh
+
+. /lib/functions.sh
+
+if [ -f "/etc/config/mosquitto" ]; then
+	uci_add mosquitto listener dmcli
+	uci_set mosquitto dmcli enabled 1
+	uci_set mosquitto dmcli port '9003'
+	uci_set mosquitto dmcli protocol 'websockets'
+	uci_set mosquitto dmcli auth_plugin '/usr/lib/mosquitto_auth_plugin.so'
+	uci_set mosquitto dmcli acl_file '/etc/dmcli/dmcli.acl'
+fi
+
+exit 0

dmcli/files/etc/uci-defaults/36-dmcli-remote-remove

@@ -0,0 +1,9 @@
+#!/bin/sh
+
+. /lib/functions.sh
+
+if [ -f "/etc/config/mosquitto" ]; then
+	uci_remove mosquitto dmcli
+fi
+
+exit 0

dmcli/files/etc/users/roles/operator.json

@@ -0,0 +1,14 @@
+{
+  "tr181": {
+    "name": "operator",
+    "instance": 6,
+    "permission": [
+      {
+        "object": "Device.",
+        "perm": [
+          "PERMIT_ALL"
+        ]
+      }
+    ]
+  }
+}

dmcli/src/Makefile

@@ -0,0 +1,7 @@
+all: dmcli
+
+dmcli: main.c
+	$(CC) $(CFLAGS) -Wall -Werror -o $@ $^
+
+clean:
+	rm -f dmcli

dmcli/src/main.c

@@ -0,0 +1,32 @@
+/*
+* Copyright (c) 2021 Genexis Netherlands B.V. All rights reserved.
+* This Software and its content are protected by the Dutch Copyright Act
+* ('Auteurswet'). All and any copying and distribution of the software
+* and its content without authorization by Genexis Netherlands B.V. is
+* prohibited. The prohibition includes every form of reproduction and
+* distribution.
+*/
+
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+
+/* C Wrapper for operator to login to the CLI via ssh: the shell in
+ * the passwd file cannot be a script that requires an interpreter. */
+int main(int argc, char *argv[])
+{
+	char *cmd[3 + (argc > 1 ? argc - 1 : 0)];
+
+	cmd[0] = "/usr/bin/qjs";
+	cmd[1] = "/usr/lib/dmcli/cli/main.js";
+	cmd[2] = NULL;
+
+	if (argc > 1) {
+		memcpy(&cmd[2], &argv[1], (argc - 1) * sizeof(char *));
+		cmd[2 + argc - 1] = NULL;
+	}
+
+	execv(cmd[0], cmd);
+	fprintf(stderr, "%s: command not found\n", cmd[0]);
+	return 127;
+}

dnsmngr/Makefile

@@ -5,13 +5,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=dnsmngr
-PKG_VERSION:=1.0.18
+PKG_VERSION:=1.0.19
 
 LOCAL_DEV:=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/network/dnsmngr.git
-PKG_SOURCE_VERSION:=80fa147e6f1f0d9c1a62a62a693ff3adaef45363
+PKG_SOURCE_VERSION:=f22f14c1f1b8b17db99fd87eadbc9fe254b55c7f
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_MIRROR_HASH:=skip
 endif

firewallmngr/Config.in

@@ -8,5 +8,11 @@ config FIREWALLMNGR_PORT_TRIGGER
 	help
 	   Set this option to include support for PortTrigger object.
 
+config FIREWALLMNGR_NAT_INTERFACE_SETTING
+	bool "Include Device.NAT.InterfaceSetting"
+	default y
+	help
+	   Set this option to include support for NAT InterfaceSetting object.
+
 endmenu
 endif

firewallmngr/Makefile

@@ -5,13 +5,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=firewallmngr
-PKG_VERSION:=1.0.9
+PKG_VERSION:=1.0.9.5
 
 LOCAL_DEV:=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/network/firewallmngr.git
-PKG_SOURCE_VERSION:=77ad8425b73a3ac63f6160dc217635394ac87907
+PKG_SOURCE_VERSION:=02dc90c48d996148b68d02632bac13a28d75cf25
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_MIRROR_HASH:=skip
 endif
@@ -52,6 +52,10 @@ ifeq ($(CONFIG_FIREWALLMNGR_PORT_TRIGGER),y)
 	TARGET_CFLAGS += -DINCLUDE_PORT_TRIGGER
 endif
 
+ifeq ($(CONFIG_FIREWALLMNGR_NAT_INTERFACE_SETTING),y)
+	TARGET_CFLAGS += -DINCLUDE_NAT_IF_SETTING
+endif
+
 define Package/firewallmngr/install
 	$(INSTALL_DIR) $(1)/etc/config
 	$(INSTALL_DIR) $(1)/etc/uci-defaults

hostmngr/Makefile

@@ -5,12 +5,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=hostmngr
-PKG_VERSION:=1.3.3
+PKG_VERSION:=1.3.5
 
 LOCAL_DEV=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_VERSION:=fee5bd0067fc1f30498bc2b81e893d170796b459
+PKG_SOURCE_VERSION:=a4635d1866dad41066a6c8fe5e09262f9e5bce00
 PKG_SOURCE_URL:=https://dev.iopsys.eu/iopsys/hostmngr.git
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)_$(PKG_SOURCE_VERSION).tar.xz
 PKG_MIRROR_HASH:=skip

icwmp/Makefile

@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=icwmp
-PKG_VERSION:=9.9.9.4
+PKG_VERSION:=9.9.9.8
 
 LOCAL_DEV:=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/bbf/icwmp.git
-PKG_SOURCE_VERSION:=868f749f3fd61a094cc4792ea842a261443a99ad
+PKG_SOURCE_VERSION:=cef78dc528690386caac5a7ff6c1afca6dd3d315
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_MIRROR_HASH:=skip
 endif
@@ -84,6 +84,7 @@ define Package/icwmp/install
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/icwmpd $(1)/usr/sbin/icwmpd
 	$(INSTALL_DATA) ./files/etc/config/cwmp $(1)/etc/config/cwmp
 	$(INSTALL_BIN) ./files/etc/init.d/icwmpd $(1)/etc/init.d/icwmpd
+	$(INSTALL_BIN) ./files/etc/uci-defaults/50-cwmp-align-keep-config $(1)/etc/uci-defaults/
 	$(INSTALL_BIN) ./files/etc/uci-defaults/85-cwmp-set-userid $(1)/etc/uci-defaults/
 	$(INSTALL_BIN) ./files/etc/uci-defaults/90-cwmpfirewall $(1)/etc/uci-defaults/
 	$(INSTALL_BIN) ./files/etc/uci-defaults/95-set-random-inform-time $(1)/etc/uci-defaults/

icwmp/files/etc/config/cwmp

@@ -43,7 +43,9 @@ config cpe 'cpe'
 	option periodic_notify_interval '10'
 	option incoming_rule 'Port_Only'
 	option active_notif_throttle '0'
-	option fw_upgrade_keep_settings '1'
+	#option KeepConfig '1'
+	#option KeepOpConf '1'
+	#option ConfigScope 'UserOnly'
 	option clock_sync_timeout '128'
 	option disable_datatype_check '0'
 	#list allowed_cr_ip '10.5.1.0/24'

icwmp/files/etc/init.d/icwmpd

@@ -97,7 +97,9 @@ validate_cpe_section()
 		'periodic_notify_enable:bool' \
 		'enable:bool:1' \
 		'periodic_notify_interval:uinteger' \
-		'fw_upgrade_keep_settings:bool'
+		'KeepConfig:bool' \
+		'KeepOpConf:bool' \
+		'ConfigScope:string'
 }
 
 validate_defaults() {
@@ -168,13 +170,21 @@ start_service() {
 
 stop_service()
 {
-	local switch_bank
+	local switch_bank KeepConfig KeepOpConf ConfigScope
 
 	copy_cwmp_varstate_files_to_etc
-	
 	switch_bank=$(uci -q -c /var/state/ get icwmp.cpe.switch_bank)
-	if [ -n "$switch_bank" ] && [ "$switch_bank" = "1" ]; then
-		[ -x /etc/sysmngr/fwbank ] && /etc/sysmngr/fwbank call copy_config
+	if [ "$switch_bank" = "1" ] && [ -x /etc/sysmngr/fwbank ]; then
+		KeepConfig="$(uci -q get cwmp.cpe.KeepConfig)"
+		KeepOpConf="$(uci -q get cwmp.cpe.KeepOpConf)"
+		ConfigScope="$(uci -q get cwmp.cpe.ConfigScope)"
+
+		json_init
+		[ -n "${KeepConfig}" ] && json_add_boolean "keep_config" "${KeepConfig}"
+		[ -n "${KeepOpConf}" ] && json_add_boolean "keep_opconf" "${KeepOpConf}"
+		[ -n "${ConfigScope}" ] && json_add_string "config_scope" "${ConfigScope}"
+
+		json_dump| /etc/sysmngr/fwbank call copy_config
 	fi
 }
 

icwmp/files/etc/uci-defaults/50-cwmp-align-keep-config

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+keep_settings="$(uci -q get cwmp.cpe.fw_upgrade_keep_settings)"
+if [ -n "${keep_settings}" ]; then
+	uci -q delete cwmp.cpe.fw_upgrade_keep_settings
+	uci -q set cwmp.cpe.KeepConfig="${keep_settings}"
+fi

ieee1905/Makefile

@@ -6,12 +6,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=ieee1905
-PKG_VERSION:=8.7.33
+PKG_VERSION:=8.7.37
 
 LOCAL_DEV=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_VERSION:=f28f1c04cae008d7d6448ba02b992506af28448c
+PKG_SOURCE_VERSION:=5b328cea988424f078b4f98d2b2a962b07d672ff
 PKG_SOURCE_URL:=https://dev.iopsys.eu/multi-ap/ieee1905.git
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)_$(PKG_SOURCE_VERSION).tar.xz
 PKG_MIRROR_HASH:=skip

iopsys-analytics/Makefile

@@ -34,6 +34,9 @@ define Package/$(PKG_NAME)
     +@PACKAGE_syslog-ng:SYSLOGNG_LOGROTATE              \
     +PACKAGE_fluent-bit:logrotate                       \
     +@DMCLI_REMOTE_CONNECTION
+  # tools used in development/testing
+  DEPENDS+=                                             \
+    +iperf3
 
 endef
 

libeasy/Makefile

@@ -1,32 +1,28 @@
 #
-# Copyright (C) 2020-2023 Iopsys
+# Copyright (C) 2025 Genexis Sweden AB
 #
 
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=libeasy
-PKG_VERSION:=7.4.6
+PKG_VERSION:=7.5.1
 
 LOCAL_DEV=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_VERSION:=ca7b20068c9d373e41045a2e899a9c697576262c
-PKG_SOURCE_URL:=https://dev.iopsys.eu/iopsys/libeasy.git
-PKG_MAINTAINER:=Anjan Chanda <anjan.chanda@iopsys.eu>
+PKG_SOURCE_VERSION:=b981f7e1bd51f66041cd0c25d15af74ae1e3bc75
+PKG_SOURCE_URL:=https://dev.iopsys.eu/hal/libeasy.git
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)_$(PKG_SOURCE_VERSION).tar.xz
 PKG_MIRROR_HASH:=skip
 endif
 
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)
 PKG_LICENSE:=LGPL-2.1-only
-PKG_LICENSE_FILES:=LICENSE
+PKG_LICENSE_FILES:=
+PKG_MAINTAINER:=Anjan Chanda <anjan.chanda@genexis.eu>
 
 include $(INCLUDE_DIR)/package.mk
-
-TARGET_CFLAGS += \
-	-I$(STAGING_DIR)/usr/include \
-	-I$(STAGING_DIR)/usr/include/openssl \
-	-I$(STAGING_DIR)/usr/include/libnl3
+include $(INCLUDE_DIR)/cmake.mk
 
 ifeq ($(LOCAL_DEV),1)
 define Build/Prepare
@@ -34,9 +30,6 @@ define Build/Prepare
 endef
 endif
 
-MAKE_FLAGS += \
-	CFLAGS="$(TARGET_CFLAGS) -Wall"
-
 define Package/libeasy
   SECTION:=libs
   CATEGORY:=Libraries
@@ -47,7 +40,7 @@ define Package/libeasy
 endef
 
 define Package/libeasy/description
-  Library provides common utility functions
+  This package provides libeasy.so for common utility functions.
 endef
 
 define Build/InstallDev/libeasy
@@ -67,6 +60,7 @@ define Build/InstallDev/libeasy
 endef
 
 define Build/InstallDev
+	$(call Build/InstallDev/cmake,$(1))
 	$(call Build/InstallDev/libeasy,$(1),$(2))
 endef
 

libwifi/Makefile

@@ -5,12 +5,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=libwifi
-PKG_VERSION:=7.13.6
+PKG_VERSION:=7.13.10
 
 LOCAL_DEV=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_VERSION:=d17ad7415a821e95618c4739507bf129df3fdebf
+PKG_SOURCE_VERSION:=5e8d828c01ed7ab2feba9028b603dde9708cb656
 PKG_SOURCE_URL:=https://dev.iopsys.eu/iopsys/libwifi.git
 PKG_MAINTAINER:=Anjan Chanda <anjan.chanda@iopsys.eu>
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)_$(PKG_SOURCE_VERSION).tar.xz
@@ -61,7 +61,7 @@ else
 endif
 
 ifneq ($(CONFIG_PACKAGE_kmod-mt7915e_en7523),)
-  TARGET_CFLAGS=-DMT7915_VENDOR_EXT
+  TARGET_CFLAGS +=-DMT7915_VENDOR_EXT
 endif
 
 PKG_BUILD_DEPENDS:=PACKAGE_kmod-mt7915e_en7523:mt76_en7523

linux-pam/Makefile

@@ -31,8 +31,8 @@ MESON_ARGS += \
 
 define Package/linux-pam/install
 	$(INSTALL_DIR) $(1)/usr/lib/security
-	$(INSTALL_DIR) $(1)/etc/uci-defaults/
-	$(INSTALL_BIN) ./files/pam_faillock.uci_default $(1)/etc/uci-defaults/99-add_pam_faillock
+	$(INSTALL_DIR) $(1)/etc/init.d
+	$(INSTALL_BIN) ./linux_pam.init $(1)/etc/init.d/linux_pam
 endef
 
 $(eval $(call BuildPackage,linux-pam))

linux-pam/files/pam_faillock.uci_default

@@ -1,43 +0,0 @@
-#!/bin/sh
-
-create_faillock_files()
-{
-	# also create files needed by pam_faillock
-	touch /var/log/faillock
-	chmod 700 /var/log/faillock
-	touch /var/log/btmp
-	chmod 700 /var/log/btmp
-}
-
-update_pam_common_auth()
-{
-	local file="/etc/pam.d/common-auth"
-	local deny=6
-	local unlock_time=300
-
-	# update pam_unix.so line
-	sed -i -E 's|^.*pam_unix\.so.*|auth\t sufficient\tpam_unix.so nullok_secure|' "$file"
-
-	# Insert pam_faillock lines before and after pam_unix.so
-	sed -i -E "/pam_unix.so nullok_secure/i auth     required       pam_faillock.so preauth deny=$deny even_deny_root unlock_time=$unlock_time" "$file"
-	sed -i -E "/pam_unix.so nullok_secure/a auth     [default=die]  pam_faillock.so authfail audit deny=$deny even_deny_root unlock_time=$unlock_time" "$file"
-}
-
-update_pam_common_account()
-{
-	# update account file
-	sed -i "/pam_unix.so/ i account  required       pam_faillock.so" /etc/pam.d/common-account
-}
-
-if [ -f "/usr/lib/security/pam_faillock.so" ]; then
-	update_pam_common_auth
-	update_pam_common_account
-	create_faillock_files
-fi
-
-if [ -f /etc/config/sshd ]; then
-	uci -q set sshd.@sshd[0].UsePAM=1
-	uci commit sshd
-fi
-
-exit 0

linux-pam/linux_pam.init

@@ -0,0 +1,18 @@
+#!/bin/sh /etc/rc.common
+
+START=11
+STOP=90
+USE_PROCD=1
+
+create_faillock_files()
+{
+	# also create files needed by pam_faillock
+	touch /var/log/faillock
+	chmod 700 /var/log/faillock
+	touch /var/log/btmp
+	chmod 700 /var/log/btmp
+}
+
+boot() {
+	create_faillock_files
+}

logmngr/files/etc/config/logmngr

@@ -8,7 +8,7 @@ config source 'default_source'
 
 config template 'default_template'
 	option name 'default_template'
-	option expression '{time} {hostname} {ident}: {message}'
+	option expression '{time} {hostname} {ident}[{pid}]: {message}'
 
 config action 'default_action'
 	option name 'default_action'

logmngr/files/etc/uci-defaults/10-logmngr_config_migrate

@@ -11,7 +11,7 @@ fi
 if ! uci -q get logmngr.default_template > /dev/null; then
 	uci -q set logmngr.default_template=template
 	uci -q set logmngr.default_template.name='default_template'
-	uci -q set logmngr.default_template.expression='{time} {hostname} {ident}: {message}'
+	uci -q set logmngr.default_template.expression='{time} {hostname} {ident}[{pid}]: {message}'
 fi
 
 if uci -q get logmngr.a1 >/dev/null; then

logmngr/files/lib/logmngr/fluent-bit.sh

@@ -77,6 +77,12 @@ create_default_filters() {
 	append_conf "    rename          msg     message"
 	append_conf ""
 
+	append_conf "[FILTER]"
+	append_conf "    name            modify"
+	append_conf "    match           *"
+	append_conf "    add             pid     0"
+	append_conf ""
+
 	append_conf "[FILTER]"
 	append_conf "    name            sysinfo"
 	append_conf "    match           *"

map-agent/Config.in

@@ -55,6 +55,10 @@ config AGENT_OPER_CHANNEL_CHANGE_RELAY_MCAST
 config AGENT_USE_LIBDPP
 	bool "Depend on libdpp for DPP EasyConnect"
 
+config AGENT_ZEROTOUCH_DPP
+	bool "Enable Zero-touch DPP bootstrapping. Depends on libztdpp.so"
+	default n
+
 config AGENT_CHECK_PARTIAL_WIFI_RELOAD
 	bool "Option that allow SSID/PSK simple reload"
 	default y

map-agent/Makefile

@@ -1,13 +1,14 @@
 #
-# Copyright (C) 2020-2023 IOPSYS Software Solutions AB
+# Copyright (C) 2020-2024 IOPSYS Software Solutions AB
+# Copyright (C) 2025 Genexis Sweden AB
 #
 
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=map-agent
-PKG_VERSION:=6.3.6.18
+PKG_VERSION:=6.3.7.10
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)
-PKG_SOURCE_VERSION:=c060d1f6b0cd1902f6259811dbeb972e0412051f
+PKG_SOURCE_VERSION:=79d9d0c79b4b5e8b0db77ee08eebd882ba616bba
 PKG_MAINTAINER:=Jakob Olsson <jakob.olsson@iopsys.eu>
 
 PKG_LICENSE:=BSD-3-Clause
@@ -26,7 +27,7 @@ include $(INCLUDE_DIR)/package.mk
 define Package/map-agent
   SECTION:=utils
   CATEGORY:=Utilities
-  TITLE:=WiFi multi-AP Agent (EasyMesh R2)
+  TITLE:=Wi-Fi Multi-AP Agent (EasyMesh R6)
   DEPENDS:=+libwifi +libuci +libubox +ubus +libeasy +libieee1905 +ieee1905 \
 	   +ieee1905-map-plugin +ip-bridge +AGENT_USE_LIBDPP:libdpp \
 	   +uuidgen +openssl-util +!TARGET_brcmbca:ebtables-legacy \
@@ -45,9 +46,12 @@ define Package/dynbhd
 	  +ieee1905-map-plugin +map-agent
 endef
 
+ifeq ($(CONFIG_AGENT_ZEROTOUCH_DPP),y)
+  TARGET_CFLAGS += -DZEROTOUCH_DPP
+endif
 
 define Package/map-agent/description
- This package implements EasyMesh R2 compliant WiFi Agent.
+  This package provides EasyMesh R6 compliant Wi-Fi Multi-AP Agent.
 endef
 
 define Package/dynbhd/description

map-agent/files/etc/init.d/mapagent

@@ -1,6 +1,6 @@
 #!/bin/sh /etc/rc.common
 
-START=98
+START=97
 STOP=20
 
 USE_PROCD=1

map-agent/files/etc/uci-defaults/100-mapagent-config-migrate.sh

@@ -0,0 +1,53 @@
+#!/bin/sh
+. /lib/functions.sh
+
+cfg=mapagent
+config_load $cfg
+
+if uci -q get $cfg.agent.partial_wifi_reload >/dev/null; then
+	uci -q set $cfg.agent.partial_wifi_reload='0'
+fi
+
+if uci -q get $cfg.agent.chan_ch_relay_mcast >/dev/null; then
+	uci -q set $cfg.agent.chan_ch_relay_mcast='0'
+fi
+
+rename_dpp_uri() {
+	local section="$1"
+	local type device ifname band
+	local ch_list=""
+
+	config_get type "$section" type
+	config_get device "$section" device
+	config_get ifname "$section" ifname
+	config_get band "$section" band
+	config_get chirp_interval "$section" chirp_interval
+
+	append_chan() {
+		local val="$1"
+		local chan_num="${val#*/}"
+		ch_list="$ch_list $chan_num"
+	}
+	config_list_foreach "$section" chan append_chan
+
+	new_section=$(uci add "$cfg" dpp_chirp)
+	[ -n "$type" ] && uci set "$cfg.$new_section.type=$type"
+	[ -n "$device" ] && uci set "$cfg.$new_section.device=$device"
+	[ -n "$ifname" ] && uci set "$cfg.$new_section.ifname=$ifname"
+	[ -n "$band" ] && uci set "$cfg.$new_section.band=$band"
+
+	if [ -n "$chirp_interval" ]; then
+		uci set "${cfg}.${new_section}.chirp_interval=$chirp_interval"
+	fi
+
+	for ch in $ch_list; do
+		uci add_list "$cfg.$new_section.channel=$ch"
+	done
+	uci delete "$cfg.$section"
+}
+
+uci -q delete "$cfg.@dpp_controller[0]"
+
+config_foreach rename_dpp_uri dpp_uri
+
+exit 0

map-agent/files/lib/multiap/map_genconfig

@@ -44,19 +44,16 @@ generate_multiap_config() {
 			2g)
 				mode_band=2
 				priority=2
-				dpp_chan="81/1"
 				channels="1 6 11"
 			;;
 			5g)
 				mode_band=5
 				priority=1
-				dpp_chan="128/36"
 				channels="36-64 100-112"
 			;;
 			6g)
 				mode_band=6
 				priority=0
-				dpp_chan="133/49"
 			;;
 		esac
 
@@ -158,13 +155,17 @@ generate_multiap_config() {
 				uci set mapagent.@bsta[-1].band="$mode_band"
 				uci set mapagent.@bsta[-1].priority="$priority"
 
-				#uci add mapagent dpp_uri
-				#uci set mapagent.@dpp_uri[-1].type="qrcode"
-				#uci set mapagent.@dpp_uri[-1].device="$device"
-				#uci set mapagent.@dpp_uri[-1].ifname="$ifname"
-				#uci set mapagent.@dpp_uri[-1].band="$mode_band"
-				#uci set mapagent.@dpp_uri[-1].chirp_interval="10"
-				#uci add_list mapagent.@dpp_uri[-1].dpp_chan="$dpp_chan"
+				# add dpp_chirp section for 2.4GHz bSTA
+				if [ $mode_band -eq 2 ]; then
+					uci add mapagent dpp_chirp
+					uci set mapagent.@dpp_chirp[-1].type="qrcode"
+					uci set mapagent.@dpp_chirp[-1].device="$device"
+					uci set mapagent.@dpp_chirp[-1].ifname="$ifname"
+					uci set mapagent.@dpp_chirp[-1].band="$mode_band"
+					for channel in $channels; do
+						uci add_list mapagent.@dpp_chirp[-1].channel="$channel"
+					done
+				fi
 
 				if [ $generate_wireless_sta_config -eq 1 ]; then
 					secname="default_sta_${device}"

map-controller/Config.in

@@ -39,6 +39,10 @@ config CONTROLLER_EASYMESH_VENDOR_EXT_OUI
 config CONTROLLER_USE_LIBDPP
 	bool "Depend on libdpp for DPP EasyConnect"
 
+config CONTROLLER_ZEROTOUCH_DPP
+	bool "Enable Zero-touch DPP bootstrapping via passphrase."
+	default n
+
 config CONTROLLER_PROPAGATE_PROBE_REQ
 	depends on CONTROLLER_EASYMESH_VENDOR_EXT
 	bool "Enable publishing probe requests vendor specific messages as UBUS events"

map-controller/Makefile

@@ -6,9 +6,9 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=map-controller
-PKG_VERSION:=6.4.2.10
+PKG_VERSION:=6.4.4.13
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)
-PKG_SOURCE_VERSION:=275df712e1a7926af7b3f33e9fdaed473811f224
+PKG_SOURCE_VERSION:=bd0fb2b63830e19038d9495517c03fdc3900cdfa
 PKG_MAINTAINER:=Jakob Olsson <jakob.olsson@genexis.eu>
 
 LOCAL_DEV=0
@@ -36,6 +36,9 @@ ifeq ($(CONFIG_CONTROLLER_USE_LIBDPP),y)
   TARGET_CFLAGS += -DUSE_LIBDPP
 endif
 
+ifeq ($(CONFIG_CONTROLLER_ZEROTOUCH_DPP),y)
+  TARGET_CFLAGS += -DZEROTOUCH_DPP
+endif
 
 define Package/map-controller/description
  This package provides WiFi MultiAP Controller as per the EasyMesh-R2 specs.
@@ -81,6 +84,7 @@ define Build/InstallDev
 	$(CP) $(PKG_BUILD_DIR)/src/cntlr_commands_impl.h $(1)/usr/include/map-controller
 	$(CP) $(PKG_BUILD_DIR)/src/cntlr_commands.h $(1)/usr/include/map-controller
 	$(CP) $(PKG_BUILD_DIR)/src/cntlr_apis.h $(1)/usr/include/map-controller
+	$(CP) $(PKG_BUILD_DIR)/src/cntlr_plugin.h $(1)/usr/include/map-controller
 	$(CP) $(PKG_BUILD_DIR)/src/wifi_opclass.h $(1)/usr/include/map-controller
 	$(CP) $(PKG_BUILD_DIR)/src/steer_module.h $(1)/usr/include/map-controller
 	$(CP) $(PKG_BUILD_DIR)/src/timer.h $(1)/usr/include/map-controller

map-controller/files/etc/config/mapcontroller

@@ -10,10 +10,11 @@ config controller 'controller'
 	option primary_pcp '0'
 	option stale_sta_timeout '30d'
 	option de_collect_interval '60'
+	list plugin 'zerotouch'
 
 config sta_steering 'sta_steering'
 	option enable_sta_steer '1'
-	option enable_bsta_steer '0'
+	option enable_bsta_steer '1'
 	option rcpi_threshold_2g '70'
 	option rcpi_threshold_5g '86'
 	option rcpi_threshold_6g '86'
@@ -23,6 +24,8 @@ config sta_steering 'sta_steering'
 	option plugins_enabled '1'
 	option plugins_policy 'any'
 	list plugins 'rcpi'
+	list plugins 'rate'
+	list plugins 'bsteer'
 
 config channel_plan 'channel_plan'
 	option preclear_dfs '0'

map-controller/files/etc/uci-defaults/100-mapcntlr-config-migrate.sh

@@ -0,0 +1,31 @@
+#!/bin/sh
+
+. /lib/functions.sh
+
+cfg=mapcontroller
+config_load $cfg
+
+uci -q get $cfg.controller.debug >/dev/null 2>&1 && \
+	uci set $cfg.controller.debug='2'
+
+allow_bgdfs=$(uci -q get $cfg.controller.allow_bgdfs || echo "0")
+channel_plan_val=$(uci -q get $cfg.controller.channel_plan || echo "0")
+
+uci -q delete $cfg.controller.allow_bgdfs
+uci -q delete $cfg.controller.channel_plan
+
+uci -q get $cfg.controller.stale_sta_timeout >/dev/null 2>&1 || \
+	uci set $cfg.controller.stale_sta_timeout='30d'
+
+if [ -f /usr/lib/mapcontroller/zerotouch.so ]; then
+	uci -q del_list $cfg.controller.plugin='zerotouch'
+	uci -q add_list $cfg.controller.plugin='zerotouch'
+fi
+
+if ! uci show $cfg 2>/dev/null | grep -q "=channel_plan"; then
+	section=$(uci add $cfg channel_plan)
+	uci set $cfg.$section.preclear_dfs="$allow_bgdfs"
+	uci set $cfg.$section.acs="$channel_plan_val"
+fi
+
+exit 0

map-controller/files/etc/uci-defaults/99-mapcontroller-sta-steering

@@ -21,9 +21,21 @@ adapt_sta_steering() {
 	uci -q del $cfg.@sta_steering[0].use_usta_metrics
 	uci -q del $cfg.@sta_steering[0].bandsteer
 	uci -q del $cfg.@sta_steering[0].diffsnr
+	if [ -f /usr/lib/mapcontroller/rcpi.so ]; then
+		uci -q del_list $cfg.@sta_steering[0].plugins="rcpi"
+		uci -q add_list $cfg.@sta_steering[0].plugins="rcpi"
+	fi
+
+	if [ -f /usr/lib/mapcontroller/rate.so ]; then
+		uci -q del_list $cfg.@sta_steering[0].plugins="rate"
+		uci -q add_list $cfg.@sta_steering[0].plugins="rate"
+	fi
+
+	if [ -f /usr/lib/mapcontroller/bsteer.so ]; then
+		uci -q del_list $cfg.@sta_steering[0].plugins="bsteer"
+		uci -q add_list $cfg.@sta_steering[0].plugins="bsteer"
+	fi
 
-	uci del_list $cfg.@sta_steering[0].plugins="rcpi"
-	uci add_list $cfg.@sta_steering[0].plugins="rcpi"
 	uci -q set $cfg.@sta_steering[0].plugins_enabled="1"
 	uci -q set $cfg.@sta_steering[0].plugins_policy="any"
 

map-plugins/Makefile

@@ -5,12 +5,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=map-plugins
-PKG_VERSION:=1.0.32
+PKG_VERSION:=1.2.6
 
 LOCAL_DEV=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_VERSION:=d8b310edad1b9777aed805682394e3f9bb300d81
+PKG_SOURCE_VERSION:=dd873ca4e2cb321302dae1955da24d1be271b2b1
 PKG_SOURCE_URL:=https://dev.iopsys.eu/multi-ap/map-plugins.git
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)_$(PKG_SOURCE_VERSION).tar.xz
 PKG_MIRROR_HASH:=skip
@@ -27,12 +27,18 @@ include $(INCLUDE_DIR)/package.mk
 
 include $(wildcard plugins/*.mk)
 
+TARGET_CFLAGS += \
+	-I$(STAGING_DIR)/usr/include \
+	-I$(STAGING_DIR)/usr/include/libnl3 \
+	-D_GNU_SOURCE
+
 MAKE_FLAGS += \
 	CFLAGS="$(TARGET_CFLAGS) -Wall"
 
 plugins := \
 	$(if $(CONFIG_PACKAGE_map-plugins-steer-rate),steer-rate)   \
-	$(if $(CONFIG_PACKAGE_map-plugins-bsteer),bsteer)
+	$(if $(CONFIG_PACKAGE_map-plugins-bsteer),bsteer) \
+	$(if $(CONFIG_PACKAGE_map-plugins-zero-touch),zero-touch)
 
 ppkg:=$(patsubst plugins/%.mk,map-plugins-%,$(wildcard plugins/*.mk))
 

map-plugins/plugins/zero-touch.mk

@@ -0,0 +1,22 @@
+define Package/map-plugins-zero-touch
+	$(call Package/map-plugins/Default)
+	TITLE:=Full Zero-touch bootstrapping of Wi-Fi Repeater device(s)
+	DEPENDS= +libubox +libuci +libubus +libeasy +libnl-genl \
+		 +libjson-c +libblobmsg-json +map-controller \
+		 +map-plugins
+endef
+
+define Package/map-plugins-zero-touch/install
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(INSTALL_DIR) $(1)/usr/lib/mapcontroller
+	$(CP) $(PKG_BUILD_DIR)/zero-touch/zerotouch.so $(1)/usr/lib/mapcontroller/zerotouch.so
+	$(CP) $(PKG_BUILD_DIR)/zero-touch/libztdpp.so $(1)/usr/lib/libztdpp.so
+
+endef
+
+define Build/Compile/map-plugins-zero-touch
+	$(MAKE) -C $(PKG_BUILD_DIR)/zero-touch \
+		CC="$(TARGET_CC)" \
+		CFLAGS="$(TARGET_CFLAGS)" \
+		LDFLAGS="$(TARGET_LDFLAGS)";
+endef

mosquitto-auth-plugin/Config.in

@@ -0,0 +1,7 @@
+if PACKAGE_mosquitto-auth-plugin
+
+config MOSQUITTO_AUTH_PAM_SUPPORT
+	bool "Enable support of Linux PAM module for Authentication"
+	default y
+
+endif

mosquitto-auth-plugin/Makefile

@@ -13,33 +13,42 @@
 
 include $(TOPDIR)/rules.mk
 
-PKG_NAME:=mosquitto-auth-shadow
-PKG_VERSION:=1.0.1
+PKG_NAME:=mosquitto-auth-plugin
+PKG_VERSION:=1.2.0
 
 PKG_MAINTAINER:=Erik Karlsson <erik.karlsson@genexis.eu>
 PKG_LICENSE:=EPL-2.0
 
 PKG_BUILD_PARALLEL:=1
+PKG_CONFIG_DEPENDS:=CONFIG_MOSQUITTO_AUTH_PAM_SUPPORT
 
 include $(INCLUDE_DIR)/package.mk
 
-define Package/mosquitto-auth-shadow
+define Package/mosquitto-auth-plugin
   SECTION:=net
   CATEGORY:=Network
   TITLE:=mosquitto - /etc/shadow authentication plugin
-  DEPENDS:=+mosquitto-ssl
+  DEPENDS:=+mosquitto-ssl +MOSQUITTO_AUTH_PAM_SUPPORT:libpam
   USERID:=mosquitto=200:mosquitto=200 mosquitto=200:shadow=11
 endef
 
-define Package/mosquitto-auth-shadow/description
+define Package/mosquitto-auth-plugin/description
   Plugin for the mosquitto MQTT message broker that authenticates
   users using /etc/shadow
 endef
 
-define Package/mosquitto-auth-shadow/install
+define Package/mosquitto-auth-plugin/config
+	source "$(SOURCE)/Config.in"
+endef
+
+ifeq ($(CONFIG_MOSQUITTO_AUTH_PAM_SUPPORT),y)
+TARGET_CFLAGS+=-DENABLE_PAM_SUPPORT
+endif
+
+define Package/mosquitto-auth-plugin/install
 	$(INSTALL_DIR) $(1)/usr/lib
-	$(INSTALL_BIN) $(PKG_BUILD_DIR)/mosquitto_auth_shadow.so $(1)/usr/lib/
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/mosquitto_auth_plugin.so $(1)/usr/lib/
 	$(CP) ./files/* $(1)/
 endef
 
-$(eval $(call BuildPackage,mosquitto-auth-shadow))
+$(eval $(call BuildPackage,mosquitto-auth-plugin))

mosquitto-auth-plugin/src/Makefile

@@ -11,15 +11,15 @@
 #   Erik Karlsson - initial implementation
 #
 
-TARGETS = mosquitto_auth_shadow.so
+TARGETS = mosquitto_auth_plugin.so
 
 all: $(TARGETS)
 
 %.pic.o: %.c
 	$(CC) $(CFLAGS) -Wall -Werror -fPIC -c -o $@ $<
 
-mosquitto_auth_shadow.so: mosquitto_auth_shadow.pic.o
-	$(CC) $(LDFLAGS) -shared -o $@ $^
+mosquitto_auth_plugin.so: mosquitto_auth_plugin.pic.o
+	$(CC) $(LDFLAGS) -shared -o $@ $^ $(if $(filter -DENABLE_PAM_SUPPORT,$(CFLAGS)),-lpam)
 
 clean:
 	rm -f *.o $(TARGETS)

mosquitto-auth-plugin/src/mosquitto_auth_plugin.c

@@ -0,0 +1,616 @@
+/*
+ * Copyright (c) 2022 Genexis B.V.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0/
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *
+ * Contributors:
+ *   Erik Karlsson - initial implementation
+ */
+
+#define _GNU_SOURCE
+#include <stdio.h>
+#include <string.h>
+#include <shadow.h>
+#include <crypt.h>
+#include <stdlib.h>
+#include <arpa/inet.h>
+#include <mosquitto.h>
+#include <mosquitto_broker.h>
+#include <mosquitto_plugin.h>
+
+#ifdef ENABLE_PAM_SUPPORT
+#include <security/pam_appl.h>
+#endif
+
+#define MAX_USERS 256
+#define MAX_SUBNETS_PER_USER 32
+
+typedef struct {
+	union {
+		uint32_t ipv4_network;
+		uint8_t ipv6_network[16];
+	};
+	union {
+		uint32_t ipv4_netmask;
+		uint8_t ipv6_netmask[16];
+	};
+	int is_ipv6;
+} subnet_t;
+
+typedef struct {
+	char username[64];
+	subnet_t allow_subnets[MAX_SUBNETS_PER_USER];
+	int allow_count;
+	subnet_t deny_subnets[MAX_SUBNETS_PER_USER];
+	int deny_count;
+} user_acl_t;
+
+typedef struct {
+	user_acl_t users[MAX_USERS];
+	int user_count;
+	mosquitto_plugin_id_t *identifier;
+} plugin_data_t;
+
+/* Parse CIDR notation for IPv4 or IPv6 (e.g., "192.168.1.0/24" or "2001:db8::/32") */
+static int parse_subnet(const char *cidr, subnet_t *subnet)
+{
+	char ip_str[128];
+	char *slash;
+	int prefix_len;
+	struct in_addr addr4;
+	struct in6_addr addr6;
+
+	strncpy(ip_str, cidr, sizeof(ip_str) - 1);
+	ip_str[sizeof(ip_str) - 1] = '\0';
+
+	slash = strchr(ip_str, '/');
+	if (slash != NULL) {
+		*slash = '\0';
+		prefix_len = atoi(slash + 1);
+	}
+
+	/* Try IPv4 first */
+	if (inet_pton(AF_INET, ip_str, &addr4) == 1) {
+		subnet->is_ipv6 = 0;
+		if (slash == NULL)
+			prefix_len = 32;
+		if (prefix_len < 0 || prefix_len > 32)
+			return -1;
+
+		subnet->ipv4_network = ntohl(addr4.s_addr);
+		subnet->ipv4_netmask = prefix_len == 0 ? 0 : (~0U << (32 - prefix_len));
+		subnet->ipv4_network &= subnet->ipv4_netmask;
+		return 0;
+	}
+
+	/* Try IPv6 */
+	if (inet_pton(AF_INET6, ip_str, &addr6) == 1) {
+		subnet->is_ipv6 = 1;
+		if (slash == NULL)
+			prefix_len = 128;
+		if (prefix_len < 0 || prefix_len > 128)
+			return -1;
+
+		/* Copy network address */
+		memcpy(subnet->ipv6_network, addr6.s6_addr, 16);
+
+		/* Generate netmask */
+		memset(subnet->ipv6_netmask, 0, 16);
+		for (int i = 0; i < prefix_len / 8; i++)
+			subnet->ipv6_netmask[i] = 0xff;
+		if (prefix_len % 8)
+			subnet->ipv6_netmask[prefix_len / 8] = ~((1 << (8 - (prefix_len % 8))) - 1);
+
+		/* Apply netmask to network address */
+		for (int i = 0; i < 16; i++)
+			subnet->ipv6_network[i] &= subnet->ipv6_netmask[i];
+
+		return 0;
+	}
+
+	return -1;
+}
+
+/* Check if IPv4 address is in subnet */
+static int ipv4_in_subnet(uint32_t ip, const subnet_t *subnet)
+{
+	if (subnet->is_ipv6)
+		return 0;
+	return (ip & subnet->ipv4_netmask) == subnet->ipv4_network;
+}
+
+/* Check if IPv6 address is in subnet */
+static int ipv6_in_subnet(const uint8_t *ip, const subnet_t *subnet)
+{
+	if (!subnet->is_ipv6)
+		return 0;
+	for (int i = 0; i < 16; i++) {
+		if ((ip[i] & subnet->ipv6_netmask[i]) != subnet->ipv6_network[i])
+			return 0;
+	}
+	return 1;
+}
+
+/* Check if IP is in any subnet in the list */
+static int ip_in_subnet_list(const char *client_address, const subnet_t *subnets, int count)
+{
+	struct in_addr addr4;
+	struct in6_addr addr6;
+	uint32_t ipv4;
+
+	/* Try IPv4 */
+	if (inet_pton(AF_INET, client_address, &addr4) == 1) {
+		ipv4 = ntohl(addr4.s_addr);
+		for (int i = 0; i < count; i++) {
+			if (ipv4_in_subnet(ipv4, &subnets[i]))
+				return 1;
+		}
+		return 0;
+	}
+
+	/* Try IPv6 */
+	if (inet_pton(AF_INET6, client_address, &addr6) == 1) {
+		for (int i = 0; i < count; i++) {
+			if (ipv6_in_subnet(addr6.s6_addr, &subnets[i]))
+				return 1;
+		}
+		return 0;
+	}
+
+	return 0;
+}
+
+/* Find or create user ACL entry */
+static user_acl_t* find_or_create_user_acl(plugin_data_t *pdata, const char *username)
+{
+	user_acl_t *user;
+
+	/* Find existing user */
+	for (int i = 0; i < pdata->user_count; i++) {
+		if (strcmp(pdata->users[i].username, username) == 0)
+			return &pdata->users[i];
+	}
+
+	/* Create new user if not found */
+	if (pdata->user_count >= MAX_USERS) {
+		mosquitto_log_printf(MOSQ_LOG_ERR,
+			"subnet_acl: Max users exceeded");
+		return NULL;
+	}
+
+	user = &pdata->users[pdata->user_count];
+	strncpy(user->username, username, sizeof(user->username) - 1);
+	user->username[sizeof(user->username) - 1] = '\0';
+	user->allow_count = 0;
+	user->deny_count = 0;
+	pdata->user_count++;
+
+	return user;
+}
+
+/* Parse subnet ACL file with simplified format
+ * Format:
+ * # Comment lines
+ * subnet allow <username> <cidr>
+ * subnet deny <username> <cidr>
+ */
+static int load_subnet_acl_config(plugin_data_t *pdata, const char *config_file)
+{
+	FILE *fp;
+	char line[512];
+	int line_num = 0;
+
+	/* Initialize user count */
+	pdata->user_count = 0;
+
+	/* Config file is optional - if not provided, no subnet filtering */
+	if (config_file == NULL) {
+		mosquitto_log_printf(MOSQ_LOG_INFO,
+			"subnet_acl: No subnet ACL file specified, subnet filtering disabled");
+		return 0;
+	}
+
+	/* If config file is specified but cannot be opened, this is a fatal error */
+	fp = fopen(config_file, "r");
+	if (fp == NULL) {
+		mosquitto_log_printf(MOSQ_LOG_ERR,
+			"subnet_acl: Failed to open subnet ACL file '%s'", config_file);
+		return -1;
+	}
+
+	while (fgets(line, sizeof(line), fp) != NULL) {
+		char *token, *saveptr;
+		char *action, *username, *cidr;
+		user_acl_t *user;
+		subnet_t subnet;
+
+		line_num++;
+
+		/* Remove newline and comments */
+		line[strcspn(line, "\r\n")] = '\0';
+		char *comment = strchr(line, '#');
+		if (comment)
+			*comment = '\0';
+
+		/* Trim leading whitespace */
+		char *line_start = line;
+		while (*line_start == ' ' || *line_start == '\t')
+			line_start++;
+
+		/* Skip empty lines */
+		if (*line_start == '\0')
+			continue;
+
+		/* Parse: subnet allow|deny <username> <cidr> */
+		token = strtok_r(line_start, " \t", &saveptr);
+		if (token == NULL)
+			continue;
+
+		/* Must start with "subnet" */
+		if (strcmp(token, "subnet") != 0) {
+			mosquitto_log_printf(MOSQ_LOG_ERR,
+				"subnet_acl: Invalid directive '%s' at line %d (expected 'subnet')",
+				token, line_num);
+			fclose(fp);
+			return -1;
+		}
+
+		/* Get allow/deny */
+		action = strtok_r(NULL, " \t", &saveptr);
+		if (action == NULL) {
+			mosquitto_log_printf(MOSQ_LOG_ERR,
+				"subnet_acl: Missing allow/deny at line %d", line_num);
+			fclose(fp);
+			return -1;
+		}
+
+		if (strcmp(action, "allow") != 0 && strcmp(action, "deny") != 0) {
+			mosquitto_log_printf(MOSQ_LOG_ERR,
+				"subnet_acl: Invalid action '%s' at line %d (use 'allow' or 'deny')",
+				action, line_num);
+			fclose(fp);
+			return -1;
+		}
+
+		/* Get username */
+		username = strtok_r(NULL, " \t", &saveptr);
+		if (username == NULL) {
+			mosquitto_log_printf(MOSQ_LOG_ERR,
+				"subnet_acl: Missing username at line %d", line_num);
+			fclose(fp);
+			return -1;
+		}
+
+		/* Get CIDR */
+		cidr = strtok_r(NULL, " \t", &saveptr);
+		if (cidr == NULL) {
+			mosquitto_log_printf(MOSQ_LOG_ERR,
+				"subnet_acl: Missing CIDR at line %d", line_num);
+			fclose(fp);
+			return -1;
+		}
+
+		/* Parse subnet */
+		if (parse_subnet(cidr, &subnet) != 0) {
+			mosquitto_log_printf(MOSQ_LOG_ERR,
+				"subnet_acl: Invalid CIDR '%s' at line %d", cidr, line_num);
+			fclose(fp);
+			return -1;
+		}
+
+		/* Find or create user */
+		user = find_or_create_user_acl(pdata, username);
+		if (user == NULL) {
+			mosquitto_log_printf(MOSQ_LOG_ERR,
+				"subnet_acl: Max users (%d) exceeded at line %d", MAX_USERS, line_num);
+			fclose(fp);
+			return -1;
+		}
+
+		/* Add to appropriate list */
+		if (strcmp(action, "allow") == 0) {
+			if (user->allow_count >= MAX_SUBNETS_PER_USER) {
+				mosquitto_log_printf(MOSQ_LOG_ERR,
+					"subnet_acl: Max allow subnets (%d) exceeded for user '%s' at line %d",
+					MAX_SUBNETS_PER_USER, user->username, line_num);
+				fclose(fp);
+				return -1;
+			}
+			user->allow_subnets[user->allow_count] = subnet;
+			user->allow_count++;
+
+			mosquitto_log_printf(MOSQ_LOG_DEBUG,
+				"subnet_acl: User '%s' allow subnet %s",
+				user->username, cidr);
+
+		} else { /* deny */
+			if (user->deny_count >= MAX_SUBNETS_PER_USER) {
+				mosquitto_log_printf(MOSQ_LOG_ERR,
+					"subnet_acl: Max deny subnets (%d) exceeded for user '%s' at line %d",
+					MAX_SUBNETS_PER_USER, user->username, line_num);
+				fclose(fp);
+				return -1;
+			}
+			user->deny_subnets[user->deny_count] = subnet;
+			user->deny_count++;
+
+			mosquitto_log_printf(MOSQ_LOG_DEBUG,
+				"subnet_acl: User '%s' deny subnet %s",
+				user->username, cidr);
+		}
+	}
+
+	fclose(fp);
+
+	/* Log summary */
+	for (int i = 0; i < pdata->user_count; i++) {
+		user_acl_t *user = &pdata->users[i];
+		if (user->allow_count > 0 || user->deny_count > 0) {
+			mosquitto_log_printf(MOSQ_LOG_INFO,
+				"subnet_acl: User '%s' has %d allow and %d deny subnet rules",
+				user->username, user->allow_count, user->deny_count);
+		}
+	}
+
+	mosquitto_log_printf(MOSQ_LOG_NOTICE,
+		"subnet_acl: Loaded subnet restrictions for %d user(s)", pdata->user_count);
+
+	return 0;
+}
+
+/* Find user ACL entry */
+static const user_acl_t* find_user_acl(const plugin_data_t *pdata, const char *username)
+{
+	for (int i = 0; i < pdata->user_count; i++) {
+		if (strcmp(pdata->users[i].username, username) == 0)
+			return &pdata->users[i];
+	}
+	return NULL;
+}
+
+/* Check subnet access on authentication (connection time)
+ * Returns: MOSQ_ERR_SUCCESS if allowed, MOSQ_ERR_AUTH if denied
+ */
+static int check_subnet_on_auth(plugin_data_t *pdata, struct mosquitto_evt_basic_auth *ed)
+{
+	const user_acl_t *user_acl;
+	const char *client_address;
+
+	/* Skip if no subnet config loaded */
+	if (pdata == NULL || pdata->user_count == 0)
+		return MOSQ_ERR_SUCCESS;
+
+	/* Skip anonymous users */
+	if (ed->username == NULL)
+		return MOSQ_ERR_SUCCESS;
+
+	/* Find user's subnet ACL */
+	user_acl = find_user_acl(pdata, ed->username);
+
+	/* If user not in config or has no subnet rules, allow */
+	if (user_acl == NULL || (user_acl->allow_count == 0 && user_acl->deny_count == 0))
+		return MOSQ_ERR_SUCCESS;
+
+	/* Get client IP address */
+	client_address = mosquitto_client_address(ed->client);
+	if (client_address == NULL) {
+		mosquitto_log_printf(MOSQ_LOG_WARNING,
+			"subnet_acl: Could not get client address for user '%s', denying connection",
+			ed->username);
+		return MOSQ_ERR_AUTH;
+	}
+
+	/* Check deny list first - deny takes precedence */
+	if (user_acl->deny_count > 0) {
+		if (ip_in_subnet_list(client_address, user_acl->deny_subnets, user_acl->deny_count)) {
+			mosquitto_log_printf(MOSQ_LOG_NOTICE,
+				"subnet_acl: User '%s' from %s DENIED by deny rule",
+				ed->username, client_address);
+			return MOSQ_ERR_AUTH;
+		}
+	}
+
+	/* If there are allow rules, IP must match one of them */
+	if (user_acl->allow_count > 0) {
+		if (ip_in_subnet_list(client_address, user_acl->allow_subnets, user_acl->allow_count)) {
+			mosquitto_log_printf(MOSQ_LOG_DEBUG,
+				"subnet_acl: User '%s' from %s allowed by allow rule",
+				ed->username, client_address);
+			return MOSQ_ERR_SUCCESS;
+		} else {
+			mosquitto_log_printf(MOSQ_LOG_NOTICE,
+				"subnet_acl: User '%s' from %s DENIED (not in allowed subnets)",
+				ed->username, client_address);
+			return MOSQ_ERR_AUTH;
+		}
+	}
+
+	/* No subnet rules for this user - allow */
+	return MOSQ_ERR_SUCCESS;
+}
+
+#ifdef ENABLE_PAM_SUPPORT
+static int pam_conversation(int num_msg, const struct pam_message **msg, struct pam_response **resp, void *appdata_ptr)
+{
+	int i;
+	const char *pass = (const char *)appdata_ptr;
+
+	*resp = calloc(num_msg, sizeof(struct pam_response));
+	if (*resp == NULL) {
+		mosquitto_log_printf(MOSQ_LOG_ERR, "pam failed to allocate buffer for validation");
+		return PAM_BUF_ERR;
+	}
+
+	if (pass == NULL)
+		return PAM_SUCCESS;
+
+	for (i = 0; i < num_msg; ++i) {
+		if (msg[i]->msg_style == PAM_PROMPT_ECHO_OFF) {
+			(*resp)[i].resp = strdup(pass);
+			if ((*resp)[i].resp == NULL) {
+				for (int j = 0; j < i ; j++)
+					free((*resp)[j].resp);
+
+				free(*resp);
+				*resp = NULL;
+				mosquitto_log_printf(MOSQ_LOG_ERR, "pam failed in strdup");
+				return PAM_BUF_ERR;
+			}
+		}
+	}
+	return PAM_SUCCESS;
+}
+
+static int process_pam_auth_callback(struct mosquitto_evt_basic_auth *ed)
+{
+	struct pam_conv conv;
+	int retval;
+	pam_handle_t *pamh = NULL;
+
+	conv.conv = pam_conversation;
+	conv.appdata_ptr = (void *)ed->password;
+
+	retval = pam_start("mosquitto", ed->username, &conv, &pamh);
+	if (retval != PAM_SUCCESS) {
+		mosquitto_log_printf(MOSQ_LOG_ERR, "pam start failed: %s", pam_strerror(pamh, retval));
+		return MOSQ_ERR_AUTH;
+	}
+
+	retval = pam_authenticate(pamh, 0);
+	pam_end(pamh, retval);
+	if (retval == PAM_SUCCESS) {
+		mosquitto_log_printf(MOSQ_LOG_NOTICE, "pam user [%s] logged in", ed->username);
+		return MOSQ_ERR_SUCCESS;
+	}
+
+	mosquitto_log_printf(MOSQ_LOG_NOTICE, "pam user [%s] failed authentication, err [%s]", ed->username, pam_strerror(pamh, retval));
+	return MOSQ_ERR_AUTH;
+}
+#else
+static int process_shadow_auth_callback(struct mosquitto_evt_basic_auth *ed)
+{
+	struct spwd spbuf, *sp = NULL;
+	char buf[256];
+	struct crypt_data data;
+	char *hash;
+
+	getspnam_r(ed->username, &spbuf, buf, sizeof(buf), &sp);
+
+	if (sp == NULL || sp->sp_pwdp == NULL)
+		return MOSQ_ERR_AUTH;
+
+	/* Empty string as hash means password is not required */
+	if (sp->sp_pwdp[0] == 0)
+		return MOSQ_ERR_SUCCESS;
+
+	if (ed->password == NULL)
+		return MOSQ_ERR_AUTH;
+
+	memset(&data, 0, sizeof(data));
+	hash = crypt_r(ed->password, sp->sp_pwdp, &data);
+
+	if (hash == NULL)
+		return MOSQ_ERR_AUTH;
+
+	if (strcmp(hash, sp->sp_pwdp) == 0)
+		return MOSQ_ERR_SUCCESS;
+
+	return MOSQ_ERR_AUTH;
+}
+#endif
+
+static int basic_auth_callback(int event, void *event_data, void *userdata)
+{
+	struct mosquitto_evt_basic_auth *ed = event_data;
+	plugin_data_t *pdata = userdata;
+	int auth_result;
+
+	/* Let other plugins or broker decide about anonymous login */
+	if (ed->username == NULL)
+		return MOSQ_ERR_PLUGIN_DEFER;
+
+	/* First check username/password authentication */
+#ifdef ENABLE_PAM_SUPPORT
+	auth_result = process_pam_auth_callback(ed);
+#else
+	auth_result = process_shadow_auth_callback(ed);
+#endif
+
+	/* If authentication failed, reject immediately */
+	if (auth_result != MOSQ_ERR_SUCCESS)
+		return auth_result;
+
+	/* Authentication succeeded, now check subnet restrictions */
+	return check_subnet_on_auth(pdata, ed);
+}
+
+int mosquitto_plugin_version(int supported_version_count,
+			     const int *supported_versions)
+{
+	return 5;
+}
+
+int mosquitto_plugin_init(mosquitto_plugin_id_t *identifier,
+			  void **user_data,
+			  struct mosquitto_opt *opts, int opt_count)
+{
+	plugin_data_t *pdata;
+	const char *config_file = NULL;
+	int rc;
+
+	/* Find subnet config file option */
+	for (int i = 0; i < opt_count; i++) {
+		if (strcmp(opts[i].key, "subnet_acl_file") == 0) {
+			config_file = opts[i].value;
+			break;
+		}
+	}
+
+	pdata = calloc(1, sizeof(plugin_data_t));
+	if (pdata == NULL)
+		return MOSQ_ERR_NOMEM;
+
+	pdata->identifier = identifier;
+
+	/* Load subnet ACL configuration */
+	if (load_subnet_acl_config(pdata, config_file) != 0) {
+		free(pdata);
+		return MOSQ_ERR_UNKNOWN;
+	}
+
+	/* Register authentication callback only - subnet check is done during auth */
+	rc = mosquitto_callback_register(identifier, MOSQ_EVT_BASIC_AUTH,
+	                                 basic_auth_callback, NULL, pdata);
+	if (rc != MOSQ_ERR_SUCCESS) {
+		mosquitto_log_printf(MOSQ_LOG_ERR,
+			"subnet_acl: Failed to register authentication callback");
+		free(pdata);
+		return rc;
+	}
+
+	mosquitto_log_printf(MOSQ_LOG_INFO,
+		"subnet_acl: Plugin initialized with %d user(s)", pdata->user_count);
+
+	/* Only assign user_data after all possible error paths */
+	*user_data = pdata;
+
+	return MOSQ_ERR_SUCCESS;
+}
+
+int mosquitto_plugin_cleanup(void *user_data,
+			     struct mosquitto_opt *opts, int opt_count)
+{
+	plugin_data_t *pdata = user_data;
+
+	if (pdata) {
+		mosquitto_callback_unregister(pdata->identifier, MOSQ_EVT_BASIC_AUTH,
+		                              basic_auth_callback, NULL);
+		free(pdata);
+	}
+
+	return MOSQ_ERR_SUCCESS;
+}

mosquitto-auth-shadow/src/mosquitto_auth_shadow.c

@@ -1,81 +0,0 @@
-/*
- * Copyright (c) 2022 Genexis B.V.
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License 2.0 which is available at
- * https://www.eclipse.org/legal/epl-2.0/
- *
- * SPDX-License-Identifier: EPL-2.0
- *
- * Contributors:
- *   Erik Karlsson - initial implementation
- */
-
-#define _GNU_SOURCE
-#include <string.h>
-#include <shadow.h>
-#include <crypt.h>
-#include <mosquitto.h>
-#include <mosquitto_broker.h>
-#include <mosquitto_plugin.h>
-
-static int basic_auth_callback(int event, void *event_data, void *userdata)
-{
-	struct mosquitto_evt_basic_auth *ed = event_data;
-	struct spwd spbuf, *sp = NULL;
-	char buf[256];
-	struct crypt_data data;
-	char *hash;
-
-	/* Let other plugins or broker decide about anonymous login */
-	if (ed->username == NULL)
-		return MOSQ_ERR_PLUGIN_DEFER;
-
-	getspnam_r(ed->username, &spbuf, buf, sizeof(buf), &sp);
-
-	if (sp == NULL || sp->sp_pwdp == NULL)
-		return MOSQ_ERR_AUTH;
-
-	/* Empty string as hash means password is not required */
-	if (sp->sp_pwdp[0] == 0)
-		return MOSQ_ERR_SUCCESS;
-
-	if (ed->password == NULL)
-		return MOSQ_ERR_AUTH;
-
-	memset(&data, 0, sizeof(data));
-	hash = crypt_r(ed->password, sp->sp_pwdp, &data);
-
-	if (hash == NULL)
-		return MOSQ_ERR_AUTH;
-
-	if (strcmp(hash, sp->sp_pwdp) == 0)
-		return MOSQ_ERR_SUCCESS;
-
-	return MOSQ_ERR_AUTH;
-}
-
-int mosquitto_plugin_version(int supported_version_count,
-			     const int *supported_versions)
-{
-	return 5;
-}
-
-int mosquitto_plugin_init(mosquitto_plugin_id_t *identifier,
-			  void **user_data,
-			  struct mosquitto_opt *opts, int opt_count)
-{
-	*user_data = identifier;
-
-	return mosquitto_callback_register(identifier, MOSQ_EVT_BASIC_AUTH,
-					   basic_auth_callback, NULL, NULL);
-}
-
-int mosquitto_plugin_cleanup(void *user_data,
-			     struct mosquitto_opt *opts, int opt_count)
-{
-	mosquitto_plugin_id_t *identifier = user_data;
-
-	return mosquitto_callback_unregister(identifier, MOSQ_EVT_BASIC_AUTH,
-					     basic_auth_callback, NULL);
-}

netmode/Makefile

@@ -8,7 +8,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=netmode
-PKG_VERSION:=1.1.5
+PKG_VERSION:=1.1.9
 PKG_RELEASE:=1
 PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)
 PKG_LICENSE:=GPL-2.0-only
@@ -18,6 +18,7 @@ include $(TOPDIR)/feeds/iopsys/bbfdm/bbfdm.mk
 define Package/netmode
   CATEGORY:=Utilities
   TITLE:=Network Modes and Utils
+  DEPENDS:=+dm-service
 endef
 
 define Package/netmode/description

netmode/files/etc/config/netmode

@@ -1,2 +1,2 @@
 config netmode global
-	option enabled 0
+	option enabled 1

netmode/files/etc/netmodes/routed-dhcp/scripts/10-routed-dhcp

@@ -17,6 +17,8 @@ l3_mcast_config() {
 l3_network_config() {
 	logger -s -p user.info -t "netmode" "Generating L3 network configuration"
 
+	wandev="$(uci -q get network.WAN.ifname)"
+
 	# Configure L3 Network Mode
 	uci -q set network.lan=interface
 	uci -q set network.lan.device='br-lan'
@@ -36,11 +38,37 @@ l3_network_config() {
 	uci -q delete network.wan.disabled
 	uci -q delete network.wan.username
 	uci -q delete network.wan.password
+	uci -q delete network.wan.ipaddr
+	uci -q delete network.wan.gateway
+	uci -q delete network.wan.netmask
 
 	uci -q set network.wan6=interface
 	uci -q set network.wan6.proto='dhcpv6'
 	uci -q delete network.wan6.disabled
 
+	if [ -n "$wandev" ] && echo "$NETMODE_vlanid" | grep -Eq '^[0-9]+$' && [ "$NETMODE_vlanid" -ge 1 ]; then
+		uci -q set network.vlan_${NETMODE_vlanid}=device
+		uci -q set network.vlan_${NETMODE_vlanid}.type="8021q"
+		uci -q set network.vlan_${NETMODE_vlanid}.name="$wandev.$NETMODE_vlanid"
+		uci -q set network.vlan_${NETMODE_vlanid}.ifname="$wandev"
+		uci -q set network.vlan_${NETMODE_vlanid}.vid=$NETMODE_vlanid
+
+		wandev="$wandev.$NETMODE_vlanid"
+	fi
+
+	uci -q set network.wan.device="$wandev"
+	uci -q set network.wan6.device="$wandev"
+
+	uci -q set network.WAN.mtu="$NETMODE_mtu"
+
+	uci -q delete network.wan.dns
+	if [ -n "$NETMODE_dns_servers" ]; then
+		dns_servers="$(echo $NETMODE_dns_servers | tr ',' ' ')"
+		for server in $dns_servers; do
+		    uci -q add_list network.wan.dns=$server
+		done
+	fi
+
 	uci -q delete network.br_lan.ports
 	uci -q set network.br_lan.bridge_empty='1'
 
@@ -61,12 +89,6 @@ l3_network_config() {
 			[ -n "$device" ] && uci add_list network.br_lan.ports="$device"
 		fi
 		json_select ..
-		json_select wan 2>/dev/null
-		json_get_var device device
-		if [ -n "$device" ]; then
-			uci -q set network.wan.device="$device"
-			uci -q set network.wan6.device="$device"
-		fi
 		json_cleanup
 	fi
 

netmode/files/etc/netmodes/routed-pppoe/scripts/10-routed-pppoe

@@ -17,6 +17,8 @@ l3_mcast_config() {
 l3_network_pppoe_config() {
 	logger -s -p user.info -t "netmode" "Generating L3 network configuration"
 
+	wandev="$(uci -q get network.WAN.ifname)"
+
 	# Configure L3 Network Mode
 	uci -q set network.lan=interface
 	uci -q set network.lan.device='br-lan'
@@ -36,9 +38,35 @@ l3_network_pppoe_config() {
 	uci -q set network.wan.username="$NETMODE_username"
 	uci -q set network.wan.password="$NETMODE_password"
 	uci -q delete network.wan.disabled
+	uci -q delete network.wan.ipaddr
+	uci -q delete network.wan.gateway
+	uci -q delete network.wan.netmask
 
 	uci -q set network.wan6.disabled='1'
 
+	if [ -n "$wandev" ] && echo "$NETMODE_vlanid" | grep -Eq '^[0-9]+$' && [ "$NETMODE_vlanid" -ge 1 ]; then
+		uci -q set network.vlan_${NETMODE_vlanid}=device
+		uci -q set network.vlan_${NETMODE_vlanid}.type="8021q"
+		uci -q set network.vlan_${NETMODE_vlanid}.name="$wandev.$NETMODE_vlanid"
+		uci -q set network.vlan_${NETMODE_vlanid}.ifname="$wandev"
+		uci -q set network.vlan_${NETMODE_vlanid}.vid=$NETMODE_vlanid
+
+		wandev="$wandev.$NETMODE_vlanid"
+	fi
+
+	uci -q set network.wan.device="$wandev"
+	uci -q set network.wan6.device="$wandev"
+
+	uci -q set network.WAN.mtu="$NETMODE_mtu"
+
+	uci -q delete network.wan.dns
+	if [ -n "$NETMODE_dns_servers" ]; then
+		dns_servers="$(echo $NETMODE_dns_servers | tr ',' ' ')"
+		for server in $dns_servers; do
+		    uci -q add_list network.wan.dns=$server
+		done
+	fi
+
 	uci -q delete network.br_lan.ports
 	uci -q set network.br_lan.bridge_empty='1'
 
@@ -59,12 +87,6 @@ l3_network_pppoe_config() {
 			[ -n "$device" ] && uci add_list network.br_lan.ports="$device"
 		fi
 		json_select ..
-		json_select wan 2>/dev/null
-		json_get_var device device
-		if [ -n "$device" ]; then
-			uci -q set network.wan.device="$device"
-			uci -q set network.wan6.device="$device"
-		fi
 		json_cleanup
 	fi
 

netmode/files/etc/netmodes/routed-static/scripts/10-routed-static

@@ -0,0 +1,129 @@
+#!/bin/sh
+
+. /lib/functions.sh
+. /usr/share/libubox/jshn.sh
+
+source "/etc/device_info"
+
+l3_mcast_config() {
+	# configure L3 mcast config
+	logger -s -p user.info -t "netmode" "Generating L3 mcast configuration"
+
+	rm -f /etc/config/mcast
+	sh /rom/etc/uci-defaults/61-mcast_config_generate
+	uci -q commit mcast
+}
+
+l3_network_config() {
+	logger -s -p user.info -t "netmode" "Generating L3 network configuration"
+
+	wandev="$(uci -q get network.WAN.ifname)"
+
+	# Configure L3 Network Mode
+	uci -q set network.lan=interface
+	uci -q set network.lan.device='br-lan'
+	uci -q set network.lan.proto='static'
+	uci -q set network.lan.ipaddr='192.168.1.1'
+	uci -q set network.lan.netmask='255.255.255.0'
+	uci -q set network.lan.ip6assign='60'
+	uci -q delete network.lan.vendorid
+	uci -q delete network.lan.clientid
+	uci -q delete network.lan.reqopts
+	uci -q delete network.lan.sendopts
+
+	uci -q delete network.lan6	
+
+	uci -q set network.wan=interface
+	uci -q set network.wan.device="$wandev"
+	uci -q set network.wan.proto='static'
+	uci -q set network.wan.ipaddr="$NETMODE_ipaddr"
+	uci -q set network.wan.gateway="$NETMODE_gateway"
+	uci -q set network.wan.netmask="$NETMODE_netmask"
+	uci -q delete network.wan.disabled
+	uci -q delete network.wan.username
+	uci -q delete network.wan.password
+
+	uci -q set network.wan6.disabled='1'
+
+	if [ -n "$wandev" ] && echo "$NETMODE_vlanid" | grep -Eq '^[0-9]+$' && [ "$NETMODE_vlanid" -ge 1 ]; then
+		uci -q set network.vlan_${NETMODE_vlanid}=device
+		uci -q set network.vlan_${NETMODE_vlanid}.type="8021q"
+		uci -q set network.vlan_${NETMODE_vlanid}.name="$wandev.$NETMODE_vlanid"
+		uci -q set network.vlan_${NETMODE_vlanid}.ifname="$wandev"
+		uci -q set network.vlan_${NETMODE_vlanid}.vid=$NETMODE_vlanid
+
+		wandev="$wandev.$NETMODE_vlanid"
+	fi
+
+	uci -q set network.wan.device="$wandev"
+	uci -q set network.wan6.device="$wandev"
+
+	uci -q set network.WAN.mtu="$NETMODE_mtu"
+
+	uci -q delete network.wan.dns
+	if [ -n "$NETMODE_dns_servers" ]; then
+		dns_servers="$(echo $NETMODE_dns_servers | tr ',' ' ')"
+		for server in $dns_servers; do
+		    uci -q add_list network.wan.dns=$server
+		done
+	fi
+
+	uci -q delete network.br_lan.ports
+	uci -q set network.br_lan.bridge_empty='1'
+
+	add_port_to_br_lan() {
+		port="$1"
+		[ -n "$port" -a -d /sys/class/net/$port ] || continue
+		uci add_list network.br_lan.ports="$port"
+	}
+
+	if [ -f /etc/board.json ]; then
+		json_load_file /etc/board.json
+		json_select network
+		json_select lan
+		if json_is_a ports array; then
+			json_for_each_item add_port_to_br_lan ports
+		else
+			json_get_var device device
+			[ -n "$device" ] && uci add_list network.br_lan.ports="$device"
+		fi
+		json_select ..
+		json_cleanup
+	fi
+
+	uci -q commit network
+
+	# Enable DHCP Server
+	uci -q set dhcp.lan.ignore=0
+	uci -q set dhcp.wan.ignore=1
+	uci -q commit dhcp
+	/etc/init.d/odhcpd enable
+
+	# Enable SSDPD
+	uci -q set ssdpd.ssdp.enabled="1"
+	uci -q commit ssdpd
+
+	# Update CWMP Agent WAN Interface
+	uci -q set cwmp.cpe.default_wan_interface="wan"
+	uci -q commit cwmp
+
+	# Update gateway WAN Interface
+	uci -q set gateway.global.wan_interface="wan"
+	uci -q commit gateway
+
+	# Enable firewall
+	uci -q set firewall.globals.enabled="1"
+	uci -q commit firewall
+}
+
+l3_network_config
+l3_mcast_config
+
+# If device is already boot-up, assume netmode changed during runtime
+if [ -f /var/run/boot_complete ]; then
+	/etc/init.d/odhcpd restart 2>/dev/null
+	for config in network dhcp ssdpd cwmp gateway firewall mcast; do
+		ubus call uci commit "{\"config\":\"$config\"}"
+		sleep 1
+	done
+fi

netmode/files/etc/netmodes/supported_modes.json

@@ -3,25 +3,96 @@
   "supported_modes": [
     {
       "name": "routed-dhcp",
-      "description": "WAN with DHCP proto (Layer 3)"
+      "description": "DHCP",
+      "supported_args": [
+        {
+          "name": "vlanid",
+          "description": "VLAN ID",
+          "required": false,
+          "type": "integer"
+        },
+        {
+          "name": "dns_servers",
+          "description": "DNS Servers",
+          "required": false,
+          "type": "string"
+        }
+      ]
     },
     {
       "name": "routed-pppoe",
-      "description": "WAN with PPPoE (Layer 3)",
+      "description": "PPPoE",
       "supported_args": [
         {
           "name": "username",
-          "description": "PPPoE username",
+          "description": "PPPoE Username",
           "required": true,
-	  "type": "string",
+          "type": "string",
           "#value": "TestUser"
         },
         {
           "name": "password",
-          "description": "PPPoE password",
+          "description": "PPPoE Password",
           "required": true,
-	  "type": "string",
+          "type": "string",
           "#value": "TestPassword"
+        },
+        {
+          "name": "vlanid",
+          "description": "VLAN ID",
+          "required": false,
+          "type": "integer"
+        },
+        {
+          "name": "mtu",
+          "description": "MTU",
+          "required": false,
+          "type": "integer"
+        },
+        {
+          "name": "dns_servers",
+          "description": "DNS Servers",
+          "required": false,
+          "type": "string"
+        }
+      ]
+    },
+    {
+      "name": "routed-static",
+      "description": "Static",
+      "supported_args": [
+        {
+          "name": "ipaddr",
+          "description": "IP Address",
+          "required": true,
+          "type": "string",
+          "#value": "93.21.0.104"
+        },
+        {
+          "name": "netmask",
+          "description": "Subnet Mask",
+          "required": true,
+          "type": "string",
+          "#value": "255.255.255.0"
+        },
+        {
+          "name": "gateway",
+          "description": "Default Gateway",
+          "required": true,
+          "type": "string",
+          "#value": "93.21.0.1"
+        },
+        {
+          "name": "vlanid",
+          "description": "VLAN ID",
+          "required": false,
+          "type": "integer"
+        },
+        {
+          "name": "dns_servers",
+          "description": "DNS Servers",
+          "required": false,
+          "type": "string"
         }
       ]
     }

netmode/files/etc/uci-defaults/40_netmode_set_default_netmode

@@ -0,0 +1,35 @@
+#!/bin/sh
+
+enabled="$(uci -q get netmode.global.enabled)"
+[ "$enabled" == "1" ] || exit 0
+
+mode="$(uci -q get netmode.global.mode)"
+wanproto=$(uci -q get network.wan.proto)
+
+if [ -n "$mode" ]; then
+	# check if wanproto and mode aligned
+	if [ "${mode}" = "routed-${wanproto}" ]; then
+		exit 0
+	fi
+fi
+
+[ -f /etc/netmodes/supported_modes.json ] || exit 0
+
+# NetMode is enabled without a Mode being set
+# Figure out the current mode from network config
+curmode=""
+case "$wanproto" in
+	dhcp) curmode="routed-dhcp" ;;
+	pppoe) curmode="routed-pppoe" ;;
+	static) curmode="routed-static" ;;
+esac
+
+found=0
+for md in $(jsonfilter -i /etc/netmodes/supported_modes.json -e "@.supported_modes.*.name"); do
+	[ "$md" == "$curmode" ] && found=1
+done
+
+if [ $found -eq 1 ]; then
+	uci -q set netmode.global.mode="$curmode"
+	echo "$curmode" > /etc/netmodes/.last_mode
+fi

netmode/files/lib/netmode/post/datamodel_init.sh

@@ -1,25 +1,11 @@
 #!/bin/sh
 
-# This script is to cleanup dmmap and restart datamodel related services
+# This script is to restart related datamodel microservices
 # when wan mode changes
 
-if [ -d "/etc/bbfdm/dmmap/" ]; then
-	rm -rf /etc/bbfdm/dmmap/*
-fi
 
-# If device is booting up, no need to restart services
 if [ ! -f /var/run/boot_complete ]; then
 	return 0
 fi
 
-if [ -x "/etc/init.d/bbfdm.services" ]; then
-	/etc/init.d/bbfdm.services restart
-fi
-
-if [ -x "/etc/init.d/bbfdmd" ]; then
-	/etc/init.d/bbfdmd restart
-fi
-
-if [ -x "/etc/init.d/obuspa" ]; then
-	/etc/init.d/obuspa restart
-fi
+reboot &

netmode/files/lib/upgrade/keep.d/netmode

@@ -0,0 +1 @@
+/etc/netmodes/.last_mode

obuspa/Makefile

@@ -5,13 +5,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=obuspa
-PKG_VERSION:=10.0.0.16
+PKG_VERSION:=10.0.0.18
 
 LOCAL_DEV:=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/bbf/obuspa.git
-PKG_SOURCE_VERSION:=479ffb3582aa245a84829502d9412ca2539eefca
+PKG_SOURCE_VERSION:=8f0f8cfc2c4048bfed674163030d0b06f96f2da1
 PKG_MAINTAINER:=Vivek Dutta <vivek.dutta@iopsys.eu>
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_MIRROR_HASH:=skip
@@ -32,8 +32,9 @@ define Package/obuspa
   SUBMENU:=TRx69
   TITLE:=USP agent
   MENU:=1
-  DEPENDS:=+libopenssl +libuci +libblobmsg-json +libcurl +libsqlite3 +libubox +libubus +libmosquitto-ssl +libwebsockets-openssl +ca-certificates \
-		+OBUSPA_LOCAL_MQTT_LISTENER:mosquitto-ssl +libjson-c
+  DEPENDS:=+libopenssl +libcurl +libsqlite3 +libmosquitto-ssl +libwebsockets-openssl
+  DEPENDS+=+libjson-c +libubox +libubus +libuci +libblobmsg-json
+  DEPENDS+=+ca-certificates +OBUSPA_LOCAL_MQTT_LISTENER:mosquitto-ssl
   DEPENDS+=+libbbfdm-api +libbbfdm-ubus +dm-service
 endef
 

obuspa/files/etc/init.d/obuspa

@@ -6,19 +6,18 @@ USE_PROCD=1
 
 PROG=/usr/sbin/obuspa
 CONFIGURATION=obuspa
-
 ENV_PROFILE="/root/.profile"
 KEEP_FILE="/lib/upgrade/keep.d/obuspa"
 
 RESET_FILE="/tmp/obuspa/fw_defaults"
-SQL_DB_FILE="/tmp/obuspa/usp.db"
-DB_DUMP="/tmp/obuspa/usp.dump_$(date +%s)"
+
+OBUSPA_BOOT_MARKER="/etc/obuspa/.boot"
 
 BASEPATH=""
 INSTANCE_COUNT=0
+CLIENT_ID_PREFIX=""
 
 . /lib/functions/network.sh
-. /usr/share/libubox/jshn.sh
 . /etc/obuspa/usp_utils.sh
 
 global_init()
@@ -30,6 +29,7 @@ global_init()
 log()
 {
 	echo "$*"|logger -t obuspa.init -p debug
+	echo "$*" >/dev/console
 }
 
 db_set_reset_file()
@@ -47,37 +47,9 @@ db_set_reset_file()
 	fi
 }
 
-db_set_sql()
-{
-	local param value
-
-	param="${1}"
-	shift
-	value="$*"
-
-	if [ -n "${param}" ] && [ -n "${value}" ]; then
-		if grep -q "${param} " ${DB_DUMP}; then
-			value="${value//\//\\/}"
-			sed -i "s/${param} .*/${param} \"${value}\"/g" ${DB_DUMP}
-		else
-			echo "${param} \"${value}\"" >> ${DB_DUMP}
-		fi
-	fi
-}
-
 db_set()
 {
-	# if sql db dump file present, update it
-	if [ -f "${DB_DUMP}" ]; then
-		db_set_sql "$@"
-	else
-		db_set_reset_file "$@"
-	fi
-}
-
-dump_db()
-{
-	${PROG} -v0 -f ${SQL_DB_FILE} -c show database |grep "^Internal.\|^Device."|sed '{s/=> /"/g;s/$/"/g}' | sort  > ${DB_DUMP}
+	db_set_reset_file "$@"
 }
 
 # if db present then check if it matches with existing instances
@@ -92,21 +64,6 @@ get_base_path()
 	path=""
 	count=0
 
-	if [ -f "${DB_DUMP}" ]; then
-		path=$(grep -E "${refpath}\d+.Alias \"${value}\"" ${DB_DUMP})
-		path=${path%.*}
-		if [ -z "${path}" ]; then
-			path=$(grep -oE "${refpath}\d+" ${DB_DUMP} |sort -r|head -n 1)
-			if [ -n "${path}" ]; then
-				count=${path##*.}
-				count=$(( count + 1 ))
-			else
-				count=1
-			fi
-			path="${refpath}${count}"
-		fi
-	fi
-
 	if [ -z "${path}" ]; then
 		INSTANCE_COUNT=$(( INSTANCE_COUNT + 1 ))
 		path="${refpath}${INSTANCE_COUNT}"
@@ -122,9 +79,7 @@ get_refrence_path()
 	value="${2}"
 	path=""
 
-	if [ -f "${DB_DUMP}" ]; then
-		path=$(grep -E "${dmref}\d+.Alias " ${DB_DUMP}|grep -w "${value}")
-	elif [ -f "${RESET_FILE}" ]; then
+	if [ -f "${RESET_FILE}" ]; then
 		path=$(grep -E "${dmref}\d+.Alias " ${RESET_FILE}|grep -w "${value}")
 	fi
 	path=${path%.*}
@@ -136,7 +91,7 @@ update_keep()
 	file=${1}
 
 	if [ -z "${file}" ]; then
-		return;
+		return 0
 	fi
 
 	if [ ! -f "${KEEP_FILE}" ]; then
@@ -263,7 +218,7 @@ configure_localagent()
 
 	validate_localagent_section "${1}" || {
 		log "Validation of localagent section failed"
-		return 0;
+		return 0
 	}
 
 	db_set Device.LocalAgent.EndpointID "${EndpointID}"
@@ -271,7 +226,7 @@ configure_localagent()
 
 update_reset_reason()
 {
-	[ -f "/tmp/reset_reason" ] || return 0;
+	[ -f "/tmp/reset_reason" ] || return 0
 
 	if grep -qwi "defaultreset" /tmp/reset_reason; then
 		db_set Internal.Reboot.Cause "FactoryReset"
@@ -310,10 +265,6 @@ get_role_index()
 		val="$(grep "Device.LocalAgent.ControllerTrust.Role.\d.Name" ${CTRUST_RESET_FILE} |grep $name)"
 		val="$(echo ${val/.Name /,}|cut -d, -f 1)"
 		echo "$val"
-	elif [ -f "${DB_DUMP}" ]; then
-		val="$(grep "Device.LocalAgent.ControllerTrust.Role.\d.Name" ${DB_DUMP} |grep $name)"
-		val="$(echo ${val/.Name /,}|cut -d, -f 1)"
-		echo "$val"
 	else
 		log "Not able to get role ${name}, use Untrusted role"
 		echo "${drole}"
@@ -331,19 +282,19 @@ configure_controller()
 	sec="${1}"
 	validate_controller_section "${1}" || {
 		log "Validation of controller section failed"
-		return 1;
+		return 1
 	}
 
 	sec="${sec/controller_/cpe-}"
 	get_base_path "Device.LocalAgent.Controller." "${sec}"
 	if [ -z "${BASEPATH}" ]; then
 		log "Failed to get path [$BASEPATH]"
-		return 1;
+		return 1
 	fi
 
 	if [ -z "${Protocol}" ]; then
 		log "controller:: Protocol cannot be empty"
-		return 1;
+		return 1
 	fi
 
 	dm_ref=""
@@ -439,14 +390,14 @@ configure_subscription()
 	sec="${1}"
 	validate_subscription_section "${1}" || {
 		log "Validation of subscription section failed"
-		return 1;
+		return 1
 	}
 
 	sec="${sec/sub_/cpe-}"
 	get_base_path "Device.LocalAgent.Subscription." "sub_${1}"
 	if [ -z "${BASEPATH}" ]; then
 		log "Failed to get path [$BASEPATH]"
-		return 1;
+		return 1
 	fi
 
 	if [ -n "${controller}" ]; then
@@ -483,12 +434,12 @@ configure_challenges()
 	get_base_path "Device.LocalAgent.ControllerTrust.Challenge." "${sec}"
 	if [ -z "${BASEPATH}" ]; then
 		log "Failed to get path [$BASEPATH]"
-		return 1;
+		return 1
 	fi
 
 	if [ -z "${role_name}" ] && [ -z "${Role}" ]; then
-		log "Either role_name or Role must defined for a challenge";
-		return 1;
+		log "Either role_name or Role must defined for a challenge"
+		return 1
 	fi
 
 	db_set "${BASEPATH}.Alias" "${sec}"
@@ -515,18 +466,18 @@ configure_mtp() {
 	sec="${1}"
 	validate_mtp_section "${1}" || {
 		log "Validation of mtp section failed"
-		return 1;
+		return 1
 	}
 	sec="${sec/mtp_/cpe-}"
 	get_base_path "Device.LocalAgent.MTP." "${sec}"
 	if [ -z "${BASEPATH}" ]; then
 		log "Failed to get path [$BASEPATH]"
-		return 1;
+		return 1
 	fi
 
 	if [ -z "${Protocol}" ]; then
 		log "Protocol not defined for the mtp[${1}] section"
-		return 1;
+		return 1
 	fi
 
 	dm_ref=""
@@ -584,14 +535,14 @@ configure_stomp_connection() {
 	sec="${1}"
 	validate_stomp_connection_section "${1}" || {
 		log "Validation of stomp section failed"
-		return 1;
+		return 1
 	}
 
 	sec="${sec/stomp_/cpe-}"
 	get_base_path "Device.STOMP.Connection." "${sec}"
 	if [ -z "${BASEPATH}" ]; then
 		log "Failed to get path [$BASEPATH]"
-		return 1;
+		return 1
 	fi
 
 	db_set "${BASEPATH}.Alias" "${sec}"
@@ -614,14 +565,18 @@ configure_mqtt_client() {
 	sec="${1}"
 	validate_mqtt_client_section "${1}" || {
 		log "Validation of mqtt section failed"
-		return 1;
+		return 1
 	}
 
 	sec="${sec/mqtt_/cpe-}"
 	get_base_path "Device.MQTT.Client." "${sec}"
 	if [ -z "${BASEPATH}" ]; then
 		log "Failed to get path [$BASEPATH]"
-		return 1;
+		return 1
+	fi
+
+	if [ -z "${ClientID}" ]; then
+		ClientID="${CLIENT_ID_PREFIX}-${sec}"
 	fi
 
 	db_set "${BASEPATH}.Alias" "${sec}"
@@ -648,6 +603,9 @@ configure_obuspa() {
 	fi
 
 	if [ -n "${log_level}" ]; then
+		if [ "${log_level}" -gt "4" ]; then
+			log_level="4"
+		fi
 		procd_append_param command -v "${log_level}"
 	fi
 
@@ -676,13 +634,13 @@ configure_obuspa() {
 
 	if [ -n "${db_file}" ]; then
 		update_keep "${db_file}"
-		procd_append_param command -f "${SQL_DB_FILE}"
+		procd_append_param command -f "${db_file}"
+		if [ -f "${db_file}-journal" ]; then
+			log "SQL Journal detected ..."
+		fi
 	fi
 
 	if [ -f "${RESET_FILE}" ]; then
-		if [ -f "${SQL_DB_FILE}" ]; then
-			mv ${SQL_DB_FILE} ${SQL_DB_FILE}.old
-		fi
 		procd_append_param command -r ${RESET_FILE}
 	fi
 
@@ -691,6 +649,11 @@ configure_obuspa() {
 		if [ -f "${trust_cert}" ]; then
 			procd_append_param command -t "${trust_cert}"
 		fi
+	else
+		# Use default CA, if trust store not defined
+		if [ -f "/etc/ssl/cert.pem" ]; then
+			procd_append_param command -t "/etc/ssl/cert.pem"
+		fi
 	fi
 
 	if [ -n "${client_cert}" ]; then
@@ -701,301 +664,34 @@ configure_obuspa() {
 	fi
 }
 
-get_instances_from_db_dump()
-{
-	local obj inst
-
-	obj="${1}\d+"
-	if [ ! -f "${DB_DUMP}" ]; then
-		echo ""
-		return 0;
-	fi
-
-	inst="$(grep -oE "${obj}" "${DB_DUMP}"|uniq)"
-	echo "$inst"
-}
-
-get_param_value_from_dump()
-{
-	local param value
-
-	param="${1}"
-
-	if [ -z "${param}" ] || [ ! -f "${DB_DUMP}" ]; then
-		log "error getting param"
-		echo ""
-		return 0
-	fi
-
-	value="$(grep "^${param} " ${DB_DUMP}|awk '{print $2}')"
-
-	echo "${value//\"/}"
-}
-
-update_uci_sec()
-{
-	local sec tmp
-
-	sec="${1}"
-	stype="${2}"
-	if [ -z "$sec" ] || [ -z "$stype" ]; then
-		log "No section name, error"
-		return 0
-	fi
-
-	tmp="$(uci_get obuspa "${sec}")"
-	if [ "$tmp" != "$stype" ]; then
-		uci_add obuspa "${stype}" "${sec}"
-	fi
-}
-
-sync_db_controller()
-{
-	local cntrs copts sec pvalue protocol
-
-	copts="Enable EndpointID PeriodicNotifInterval"
-	popts="Destination Topic Host Port Path EnableEncryption"
-
-	cntrs="$(get_instances_from_db_dump Device.LocalAgent.Controller.)"
-	for cntr in $cntrs; do
-		sec="$(get_param_value_from_dump "${cntr}".Alias)"
-		sec="${sec/cpe-/controller_}"
-		sec="${sec/-/_}"
-
-		update_uci_sec "${sec}" controller
-		for param in ${copts}; do
-			pvalue="$(get_param_value_from_dump "${cntr}"."${param}")"
-			uci_set obuspa "${sec}" "${param}" "${pvalue}"
-		done
-		uci_set obuspa "${sec}" "_sync" "1"
-
-		protocol="$(get_param_value_from_dump "${cntr}".MTP.1.Protocol)"
-		if [ -z "${protocol}" ]; then
-			break;
-		fi
-		uci_set obuspa "${sec}" "Protocol" "${protocol}"
-		for param in ${popts}; do
-			pvalue="$(get_param_value_from_dump "${cntr}".MTP.1."${protocol}"."${param}")"
-			uci_set obuspa "${sec}" "${param}" "${pvalue}"
-		done
-	done
-}
-
-sync_db_localagent_mtp()
-{
-	local mtps opts popts sec pvalue protocol
-
-	opts="Enable"
-	popts="ResponseTopicConfigured Destination Port Path EnableEncryption PublishQoS"
-
-	mtps="$(get_instances_from_db_dump Device.LocalAgent.MTP.)"
-	for inst in $mtps; do
-		sec="$(get_param_value_from_dump "${inst}".Alias)"
-		sec="${sec/cpe-/mtp_}"
-		sec="${sec/-/_}"
-		update_uci_sec "${sec}" mtp
-		for param in ${opts}; do
-			pvalue="$(get_param_value_from_dump "${inst}"."${param}")"
-			uci_set obuspa "${sec}" "${param}" "${pvalue}"
-		done
-		uci_set obuspa "${sec}" "_sync" "1"
-
-		protocol="$(get_param_value_from_dump "${inst}".Protocol)"
-		if [ -z "${protocol}" ]; then
-			break;
-		fi
-		uci_set obuspa "${sec}" "Protocol" "${protocol}"
-		for param in ${popts}; do
-			pvalue="$(get_param_value_from_dump "${inst}"."${protocol}"."${param}")"
-			uci_set obuspa "${sec}" "${param}" "${pvalue}"
-		done
-	done
-}
-
-
-sync_db_mqtt_client()
-{
-	local mtps copts sec pvalue protocol
-
-	opts="Enable BrokerAddress BrokerPort Username ProtocolVersion TransportProtocol ClientID"
-
-	mtps="$(get_instances_from_db_dump Device.MQTT.Client.)"
-	for inst in $mtps; do
-		sec="$(get_param_value_from_dump "${inst}".Alias)"
-		sec="${sec/cpe-/mqtt_}"
-		sec="${sec/-/_}"
-		update_uci_sec "${sec}" mqtt
-		for param in ${opts}; do
-			pvalue="$(get_param_value_from_dump "${inst}"."${param}")"
-			uci_set obuspa "${sec}" "${param}" "${pvalue}"
-		done
-		uci_set obuspa "${sec}" "_sync" "1"
-	done
-}
-
-sync_db_stomp_connection()
-{
-	local mtps copts sec pvalue protocol
-
-	opts="Enable Host Port Username EnableEncryption EnableHeartbeats VirtualHost"
-
-	mtps="$(get_instances_from_db_dump Device.STOMP.Connection.)"
-	for inst in $mtps; do
-		sec="$(get_param_value_from_dump "${inst}".Alias)"
-		sec="${sec/cpe-/stomp_}"
-		sec="${sec/-/_}"
-		update_uci_sec "${sec}" stomp
-		for param in ${opts}; do
-			pvalue="$(get_param_value_from_dump "${inst}"."${param}")"
-			uci_set obuspa "${sec}" "${param}" "${pvalue}"
-		done
-		uci_set obuspa "${sec}" "_sync" "1"
-	done
-}
-
-sync_update_sec()
-{
-	local _sync
-	config_get _sync "${1}" _sync ""
-	if [ -z "${_sync}" ]; then
-		uci_remove obuspa "${1}"
-		log "Deleting obuspa.${1} section ..."
-	else
-		uci_remove obuspa "${1}" _sync
-	fi
-}
-
-sync_uci_with_db()
-{
-	if [ ! -f "${DB_DUMP}" ]; then
-		return 0;
-	fi
-
-	config_load obuspa
-	sync_db_controller
-	sync_db_localagent_mtp
-	sync_db_mqtt_client
-	sync_db_stomp_connection
-	uci_commit obuspa
-
-	config_load obuspa
-	config_foreach sync_update_sec controller
-	config_foreach sync_update_sec mtp
-	config_foreach sync_update_sec mqtt
-	config_foreach sync_update_sec stomp
-	uci_commit obuspa
-}
-
-delete_sql_db_entry_with_pattern()
-{
-	local params pattern
-
-	pattern="${1}"
-	if [ ! -f "${DB_DUMP}" ]; then
-		return 0;
-	fi
-
-	if [ "${#pattern}" -lt 7 ]; then
-		return 0;
-	fi
-
-	#log "Deleting with pattern [${pattern}] from ${DB_DUMP}"
-	sed -i "/${pattern}/d" ${DB_DUMP}
-}
-
-check_n_delete_db()
-{
-	local sec t r path
-
-	sec="${1}"
-	if uci -q get obuspa."${sec}" >/dev/null 2>&1; then
-		return 0
-	fi
-
-	t="${2}"
-	r="${3}"
-	sec="${sec/${t}_/cpe-}"
-
-	path=$(grep -E "${r}\d+.Alias \"${sec}\"" ${DB_DUMP})
-	path=${path%.*}
-
-	delete_sql_db_entry_with_pattern "${path}"
-}
-
-workaround_remove_download_pattern()
-{
-	local inst
-
-	inst="$(cat ${DB_DUMP} |grep -E "Device.DeviceInfo.FirmwareImage.\d.Download()"|grep -oE "Device.LocalAgent.Request.\d.")"
-
-	if [ -n "${inst}" ]; then
-		log "Workaround to remove the old download Request [$inst]"
-		delete_sql_db_entry_with_pattern "${inst}"
-	fi
-}
-
-reverse_update_db_with_uci()
-{
-	if [ ! -f "${DB_DUMP}" ]; then
-		return 0;
-	fi
-
-	export UCI_CONFIG_DIR="/tmp/obuspa"
-	config_load obuspa
-	config_foreach check_n_delete_db controller controller "Device.LocalAgent.Controller."
-	config_foreach check_n_delete_db mtp mtp "Device.LocalAgent.MTP."
-	config_foreach check_n_delete_db mqtt mqtt "Device.MQTT.Client."
-	config_foreach check_n_delete_db stomp stomp "Device.STOMP.Connection."
-	unset UCI_CONFIG_DIR
-}
-
 # Create factory reset file
 db_init()
 {
-	local reason role_file
+	local reason
 
 	reason="${1}"
-	mkdir -p /tmp/obuspa/
-
-	# Load configuration
-	config_load $CONFIGURATION
-	config_get SQL_DB_FILE global db_file "/tmp/obuspa/usp.db"
-	config_get role_file global role_file ""
-
-	if [ -f "${SQL_DB_FILE}.old" ] && [ ! -f "${SQL_DB_FILE}" ]; then
-		log "Copying old db, since new db not present ..."
-		mv ${SQL_DB_FILE}.old ${SQL_DB_FILE}
+	# remove usp.db, in case of reload
+	if [ -f "${OBUSPA_BOOT_MARKER}" ] && [ "${reason}" = "update" ]; then
+		log "Deleting ${OBUSPA_BOOT_MARKER} in order to enforce values from UCI..."
+		rm -f "${OBUSPA_BOOT_MARKER}"
 	fi
 
-	# Dump datamodel parameters from DB
-	if [ -f "${SQL_DB_FILE}" ]; then
-		dump_db
-	fi
-
-	# In case of Reboot or service restart update the uci
-        # from usp.db file
-	if [ -f "${DB_DUMP}" ] && [ "${reason}" != "update" ]; then
-		# Only do this if db have reasonable data
-		val="$(awk 'END{print NR}' ${DB_DUMP})"
-		if [ "$val" -gt 15 ]; then
-			log "Syncing obuspa uci with usp.db ...."
-			sync_uci_with_db
-		fi
-	fi
-
-	# remove entries from db if deleted from uci, only in case of reload
-	if [ -f "${DB_DUMP}" ] && [ "${reason}" = "update" ] && [ -f "/tmp/obuspa/obuspa" ]; then
-		log "Deleting entries from usp.db if uci not present ...."
-		reverse_update_db_with_uci
+	if [ -f "${OBUSPA_BOOT_MARKER}" ]; then
+		return 0
 	fi
 
 	# Remove reset file if present
-	[ -f "${RESET_FILE}" ] && mv ${RESET_FILE} ${RESET_FILE}.old
+	[ -f "${RESET_FILE}" ] && rm ${RESET_FILE}
+
+	CLIENT_ID_PREFIX="$(db -q get device.deviceinfo.ManufacturerOUI)"
+	CLIENT_ID_PREFIX="${CLIENT_ID_PREFIX}-$(db -q get device.deviceinfo.SerialNumber)"
+	CLIENT_ID_PREFIX="${CLIENT_ID_PREFIX//+/%2b}"
 
 	#log "Create reset file ...."
 	config_load $CONFIGURATION
 	config_get dualstack_pref global dualstack_pref "IPv6"
 
+	log "Enforcing UCI values, no boot marker found."
 	global_init
 	config_foreach configure_localagent localagent
 	global_init
@@ -1011,21 +707,12 @@ db_init()
 	global_init
 	config_foreach configure_challenges challenge
 
+	# enforce ctrust only on upgrades, not on reloads
+	if [ -f "${CTRUST_RESET_FILE}" ] && [ -z "${reason}" ]; then
+		cat ${CTRUST_RESET_FILE} >> ${RESET_FILE}
+	fi
 	update_reset_reason
 	update_dual_stack_pref "${dualstack_pref}"
-
-	uci_commit ${CONFIGURATION}
-
-	cp /etc/config/obuspa /tmp/obuspa/
-	if [ -f "${DB_DUMP}" ]; then
-		workaround_remove_download_pattern
-		mv ${DB_DUMP} ${RESET_FILE}
-	fi
-
-	if [ -f "${CTRUST_RESET_FILE}" ]; then
-		cat ${CTRUST_RESET_FILE} >> ${RESET_FILE}
-		rm ${CTRUST_RESET_FILE}
-	fi
 }
 
 start_service() {
@@ -1033,25 +720,22 @@ start_service() {
 
 	mkdir -p /tmp/obuspa/
 	config_load obuspa
-	config_get_bool enabled global enabled 0
+	config_get_bool enabled global enabled 1
 
 	procd_open_instance ${CONFIGURATION}
 	if [ "${enabled}" -eq 1 ]; then
-		db_init "${1}"
 		procd_set_param command ${PROG}
+		db_init "${1}"
 		configure_obuspa
 		procd_set_param respawn \
 			"${respawn_threshold:-10}" \
 			"${respawn_timeout:-10}" "${respawn_retry:-5}"
-		#procd_set_param limits core="unlimited"
 	fi
 	procd_close_instance ${CONFIGURATION}
 }
 
 stop_service() {
-	if command -v timeout >/dev/null 2>&1; then
-		timeout 5 ${PROG} -c stop
-	fi
+	${PROG} -c stop
 }
 
 reload_service() {
@@ -1060,5 +744,6 @@ reload_service() {
 }
 
 service_triggers() {
+	export PROCD_RELOAD_DELAY=3000
 	procd_add_reload_trigger "obuspa"
 }

obuspa/files/etc/obuspa/usp_utils.sh

@@ -1,10 +1,12 @@
 #!/bin/sh
 
-CTRUST_RESET_FILE="/tmp/obuspa/ctrust_reset"
+CTRUST_RESET_FILE="/etc/obuspa/ctrust_reset"
 VENDOR_PREFIX_FILE="/etc/obuspa/vendor_prefix"
 FW_DEFAULT_ROLE_DIR="/etc/users/roles"
 SECURE_ROLES=""
 
+CTRUST_RESET_FILE_TEMP="/tmp/obuspa/ctrust_reset"
+
 mkdir -p /tmp/obuspa/
 
 # include jshn.sh
@@ -23,9 +25,9 @@ db_add()
 	value="$*"
 
 	if [ -n "${param}" ] && [ -n "${value}" ]; then
-		echo "${param} \"${value}\"">>${CTRUST_RESET_FILE}
+		echo "${param} \"${value}\"">>${CTRUST_RESET_FILE_TEMP}
 	else
-		echo >>${CTRUST_RESET_FILE}
+		echo >>${CTRUST_RESET_FILE_TEMP}
 	fi
 }
 
@@ -252,7 +254,10 @@ configure_ctrust_role()
 	if [ -n "${SECURE_ROLES}" ]; then
 		db_add Device.LocalAgent.ControllerTrust.SecuredRoles "${SECURE_ROLES}"
 	fi
+
+	if [ -f "${CTRUST_RESET_FILE_TEMP}" ]; then
+		mv -f "${CTRUST_RESET_FILE_TEMP}" "${CTRUST_RESET_FILE}"
+	fi
 }
 
 # configure_ctrust_role "${@}"
-

obuspa/files/etc/uci-defaults/61-override-ct-roles

@@ -4,5 +4,3 @@
 . /etc/obuspa/usp_utils.sh
 
 configure_ctrust_role
-
-exit 0

obuspa/files/etc/udhcpc.user.d/udhcpc_obuspa_opt125.user

@@ -8,6 +8,7 @@ RETRY_MIN_INTERVAL="5"
 RETRY_INTERVAL_MUL="2000"
 ENDPOINT_ID=""
 CONTROLLER_DISCOVERED=0
+OBUSPA_BOOT_MARKER="/etc/obuspa/.boot"
 
 log()
 {
@@ -57,18 +58,18 @@ get_vivsoi() {
 
 	data="${opt125}"
 	rem_len="${len}"
-	while [ $rem_len -gt 0 ]; do
+	while [ "${rem_len}" -gt 0 ]; do
 		ent_id=${data:0:8}
 		ent_id=$(printf "%d\n" "0x$ent_id")
 
-		if [ $ent_id -ne  3561 ]; then
+		if [ "${ent_id}" -ne  3561 ]; then
 			len_val=${data:8:2}
 			data_len=$(printf "%d\n" "0x$len_val")
 			# add 4 byte for ent_id and 1 byte for len
 			data_len=$(( data_len * 2 + 10 ))
 			# move ahead data to next enterprise id
 			data=${data:"${data_len}":"${rem_len}"}
-			rem_len=$(( rem_len - $data_len ))
+			rem_len=$(( rem_len - data_len ))
 			continue
 		fi
 
@@ -79,7 +80,7 @@ get_vivsoi() {
 		data_len=$(( data_len * 2 + 10 ))
 
 		opt_len=$(printf "%d\n" "0x$len_val")
-		[ $opt_len -eq 0 ] && return
+		[ "${opt_len}" -eq 0 ] && return
 
 		# populate the option data of enterprise id
 		sub_data_len=$(( opt_len * 2))
@@ -98,28 +99,28 @@ get_vivsoi() {
 			sub_opt_len=$(( sub_opt_len * 2 ))
 
 			# get the value of sub option starting 4 means starting after length
-			sub_opt_val=${sub_data:4:${sub_opt_len}}
+			sub_opt_val=${sub_data:4:"${sub_opt_len}"}
 
 			# assign the value found in sub option
 			case "${sub_opt_id}" in
 				"25")
-					URL=$(echo -n $sub_opt_val | sed 's/\([0-9A-F]\{2\}\)/\\\\\\x\1/gI' | xargs printf && echo '')
+					URL=$(echo -n "${sub_opt_val}" | sed 's/\([0-9A-F]\{2\}\)/\\\\\\x\1/gI' | xargs printf && echo '')
 					CONTROLLER_DISCOVERED=1
 				;;
 				"26")
-					PROV_CODE=$(echo -n $sub_opt_val | sed 's/\([0-9A-F]\{2\}\)/\\\\\\x\1/gI' | xargs printf && echo '')
+					PROV_CODE=$(echo -n "${sub_opt_val}" | sed 's/\([0-9A-F]\{2\}\)/\\\\\\x\1/gI' | xargs printf && echo '')
 					CONTROLLER_DISCOVERED=1
 				;;
 				"27")
-					RETRY_MIN_INTERVAL=$(echo -n $sub_opt_val | sed 's/\([0-9A-F]\{2\}\)/\\\\\\x\1/gI' | xargs printf && echo '')
+					RETRY_MIN_INTERVAL=$(echo -n "${sub_opt_val}" | sed 's/\([0-9A-F]\{2\}\)/\\\\\\x\1/gI' | xargs printf && echo '')
 					CONTROLLER_DISCOVERED=1
 				;;
 				"28")
-					RETRY_INTERVAL_MUL=$(echo -n $sub_opt_val | sed 's/\([0-9A-F]\{2\}\)/\\\\\\x\1/gI' | xargs printf && echo '')
+					RETRY_INTERVAL_MUL=$(echo -n "${sub_opt_val}" | sed 's/\([0-9A-F]\{2\}\)/\\\\\\x\1/gI' | xargs printf && echo '')
 					CONTROLLER_DISCOVERED=1
 				;;
 				"29")
-					ENDPOINT_ID=$(echo -n $sub_opt_val | sed 's/\([0-9A-F]\{2\}\)/\\\\\\x\1/gI' | xargs printf && echo '')
+					ENDPOINT_ID=$(echo -n "${sub_opt_val}" | sed 's/\([0-9A-F]\{2\}\)/\\\\\\x\1/gI' | xargs printf && echo '')
 					CONTROLLER_DISCOVERED=1
 				;;
 			esac
@@ -131,7 +132,7 @@ get_vivsoi() {
 			sub_data_len=$((sub_data_len - sub_opt_end))
 
 			# fetch next sub option hex string
-			sub_data=${sub_data:${sub_opt_end}:${sub_data_len}}
+			sub_data=${sub_data:"${sub_opt_end}":"${sub_data_len}"}
 		done
 
 		# move ahead data to next enterprise id
@@ -146,7 +147,7 @@ get_access_role()
 
 	lan_proto="$(uci -q get network.lan.proto)"
 
-	if [ "${lan_proto}" == "dhcp" ]; then
+	if [ "${lan_proto}" = "dhcp" ]; then
 		mode="extender"
 	else
 		mode="full_access"
@@ -174,7 +175,7 @@ config_get_bool enable_obuspa global enabled 1
 config_get wan_intf global interface
 config_get_bool dhcp_discovery global dhcp_discovery 1
 
-if [ "$enable_obuspa" = "0" ] || [ "$dhcp_discovery" = "0" ]; then
+if [ "${enable_obuspa}" -eq 0 ] || [ "${dhcp_discovery}" -eq 0 ]; then
 	return 0
 fi
 
@@ -190,9 +191,9 @@ if [ -z "${wan_intf}" ]; then
 	fi
 fi
 
-if [ "${wan_intf}" == "${INTERFACE}" ]; then
+if [ "${wan_intf}" = "${INTERFACE}" ]; then
 	if [ -n "$opt125" ]; then
-		len=$(printf "$opt125"|wc -c)
+		len=$(echo -n "${opt125}"|wc -c)
 		get_vivsoi "$opt125" "$len"
 	fi
 
@@ -228,10 +229,10 @@ if [ "${wan_intf}" == "${INTERFACE}" ]; then
 				;;
 			*)
 				# This is an FQDN, perform DNS query
-				nslookup $URL > /tmp/fqdn_ip
-				nslookup -type=ptr $URL > /tmp/fqdn_ptr
-				nslookup -type=srv $URL > /tmp/fqdn_srv
-				nslookup -type=txt $URL > /tmp/fqdn_srv
+				nslookup "${URL}" > /tmp/fqdn_ip
+				nslookup -type=ptr "${URL}" > /tmp/fqdn_ptr
+				nslookup -type=srv "${URL}" > /tmp/fqdn_srv
+				nslookup -type=txt "${URL}" > /tmp/fqdn_srv
 
 				# TODO extend to collect information from dns-sd records
 				;;
@@ -247,16 +248,16 @@ if [ "${wan_intf}" == "${INTERFACE}" ]; then
 		fi
 	fi
 
-	if [ "${proto}" == "mqtt" ] || [ "${proto}" == "mqtts" ]; then
+	if [ "${proto}" = "mqtt" ] || [ "${proto}" = "mqtts" ]; then
 		offered_proto="MQTT"
-		if [ "${proto}" == "mqtt" ]; then
+		if [ "${proto}" = "mqtt" ]; then
 			mtp_encrypt="TCP/IP"
 		else
 			mtp_encrypt="TLS"
 		fi
-	elif [ "${proto}" == "ws" ] || [ "${proto}" == "wss" ]; then
+	elif [ "${proto}" = "ws" ] || [ "${proto}" = "wss" ]; then
 		offered_proto="WebSocket"
-		if [ "${proto}" == "wss" ]; then
+		if [ "${proto}" = "wss" ]; then
 			mtp_encrypt="1"
 		else
 			mtp_encrypt="0"
@@ -265,35 +266,46 @@ if [ "${wan_intf}" == "${INTERFACE}" ]; then
 
 	controllers=$(uci -q show obuspa | grep "=controller" | cut -d'=' -f1 | cut -d'.' -f2)
 	for controller in $controllers; do
-		dhcp_disc=$(uci -q get obuspa.$controller.dhcp_discovered)
+		dhcp_disc=$(uci -q get obuspa."${controller}".dhcp_discovered)
 		if [ "${dhcp_disc}" -eq 1 ]; then
 			dhcp_controller="${controller}"
 			break
 		fi
 	done
 
+	# Check if any of the existing controller section matches with the endpointid
+	if [ -z "${dhcp_controller}" ] && [ -n "${ENDPOINT_ID}" ]; then
+		for controller in $controllers; do
+			endpointid=$(uci -q get obuspa."${controller}".EndpointID)
+			if [ "${endpointid}" = "${ENDPOINT_ID}" ]; then
+				dhcp_controller="${controller}"
+				break
+			fi
+		done
+	fi
+
 	if [ -n "${dhcp_controller}" ]; then
-		cont_proto="$(uci -q get obuspa.$dhcp_controller.Protocol)"
-		if [ "${cont_proto}" == "MQTT" ]; then
-			dhcp_mqtt="$(uci -q get obuspa.$dhcp_controller.mqtt)"
+		cont_proto=$(uci -q get obuspa."${dhcp_controller}".Protocol)
+		if [ "${cont_proto}" = "MQTT" ]; then
+			dhcp_mqtt=$(uci -q get obuspa."${dhcp_controller}".mqtt)
 
 			mtps=$(uci -q show obuspa | grep "=mtp" | cut -d'=' -f1 | cut -d'.' -f2)
 			for mtp in $mtps; do
-				mtp_mqtt="$(uci -q get obuspa.$mtp.mqtt)"
-				if [ "${mtp_mqtt}" == "${dhcp_mqtt}" ]; then
+				mtp_mqtt=$(uci -q get obuspa."${mtp}".mqtt)
+				if [ "${mtp_mqtt}" = "${dhcp_mqtt}" ]; then
 					dhcp_mtp="${mtp}"
 					break
 				fi
 			done
-		elif [ "${cont_proto}" == "WebSocket" ]; then
-			cont_port="$(uci -q get obuspa.$dhcp_controller.Port)"
-			cont_encr="$(uci -q get obuspa.$dhcp_controller.EnableEncryption)"
+		elif [ "${cont_proto}" = "WebSocket" ]; then
+			cont_port=$(uci -q get obuspa."${dhcp_controller}".Port)
+			cont_encr=$(uci -q get obuspa."${dhcp_controller}".EnableEncryption)
 
 			mtps=$(uci -q show obuspa | grep "=mtp" | cut -d'=' -f1 | cut -d'.' -f2)
 			for mtp in $mtps; do
-				mtp_port="$(uci -q get obuspa.$mtp.Port)"
-				mtp_encr="$(uci -q get obuspa.$mtp.EnableEncryption)"
-				if [ "${mtp_port}" == "${cont_port}" ] && [ "${mtp_encr}" == "${cont_encr}" ]; then
+				mtp_port=$(uci -q get obuspa."${mtp}".Port)
+				mtp_encr=$(uci -q get obuspa."${mtp}".EnableEncryption)
+				if [ "${mtp_port}" = "${cont_port}" ] && [ "${mtp_encr}" = "${cont_encr}" ]; then
 					dhcp_mtp="${mtp}"
 					break
 				fi
@@ -306,43 +318,43 @@ if [ "${wan_intf}" == "${INTERFACE}" ]; then
 
 	if [ -n "${dhcp_controller}" ]; then
 		## Handling of controller section
-		ct_endpoint=$(uci -q get obuspa.$dhcp_controller.EndpointID)
-		ct_proto=$(uci -q get obuspa.$dhcp_controller.Protocol)
-		ct_prov=$(uci -q get obuspa.$dhcp_controller.ProvisioningCode)
+		ct_endpoint=$(uci -q get obuspa."${dhcp_controller}".EndpointID)
+		ct_proto=$(uci -q get obuspa."${dhcp_controller}".Protocol)
+		ct_prov=$(uci -q get obuspa."${dhcp_controller}".ProvisioningCode)
 
 		if [ "${ct_proto}" = "MQTT" ]; then
-			ct_topic=$(uci -q get obuspa.$dhcp_controller.Topic)
+			ct_topic=$(uci -q get obuspa."${dhcp_controller}".Topic)
 		else
-			ct_topic=$(uci -q get obuspa.$dhcp_controller.Path)
+			ct_topic=$(uci -q get obuspa."${dhcp_controller}".Path)
 		fi
 
 		if [ -n "${ENDPOINT_ID}" ] && [ "${ct_endpoint}" != "${ENDPOINT_ID}" ]; then
-			uci -q set obuspa.$dhcp_controller.EndpointID="${ENDPOINT_ID}"
+			uci -q set obuspa."${dhcp_controller}".EndpointID="${ENDPOINT_ID}"
 			uci_change=1
 		fi
 
 		if [ -n "${offered_proto}" ] && [ "${ct_proto}" != "${offered_proto}" ]; then
-			uci -q set obuspa.$dhcp_controller.Protocol="${offered_proto}"
+			uci -q set obuspa."${dhcp_controller}".Protocol="${offered_proto}"
 			if [ "${offered_proto}" != "MQTT" ]; then
-				uci -q set obuspa.$dhcp_controller.mqtt=""
-				uci -q set obuspa.$dhcp_controller.Topic=""
-				uci -q set obuspa.$dhcp_controller.Host="${ip}"
-				uci -q set obuspa.$dhcp_controller.Port="${port}"
-				uci -q set obuspa.$dhcp_controller.Path="${ct_topic}"
-				uci -q set obuspa.$dhcp_controller.EnableEncryption="${mtp_encrypt}"
+				uci -q delete obuspa."${dhcp_controller}".mqtt
+				uci -q delete obuspa."${dhcp_controller}".Topic
+				uci -q set obuspa."${dhcp_controller}".Host="${ip}"
+				uci -q set obuspa."${dhcp_controller}".Port="${port}"
+				uci -q set obuspa."${dhcp_controller}".Path="${ct_topic}"
+				uci -q set obuspa."${dhcp_controller}".EnableEncryption="${mtp_encrypt}"
 			else
-				uci -q set obuspa.$dhcp_controller.EnableEncryption=""
-				uci -q set obuspa.$dhcp_controller.Path=""
-				uci -q set obuspa.$dhcp_controller.Host=""
-				uci -q set obuspa.$dhcp_controller.Port=""
+				uci -q delete obuspa."${dhcp_controller}".EnableEncryption
+				uci -q delete obuspa."${dhcp_controller}".Path
+				uci -q delete obuspa."${dhcp_controller}".Host
+				uci -q delete obuspa."${dhcp_controller}".Port
 
 				if [ -z "${dhcp_mqtt}" ]; then
-					uci -q set obuspa.$dhcp_controller.mqtt='dhcpmqtt'
+					uci -q set obuspa."${dhcp_controller}".mqtt='dhcpmqtt'
 				else
-					uci -q set obuspa.$dhcp_controller.mqtt="${dhcp_mqtt}"
+					uci -q set obuspa."${dhcp_controller}".mqtt="${dhcp_mqtt}"
 				fi
 
-				uci -q set obuspa.$dhcp_controller.Topic="${ct_topic}"
+				uci -q set obuspa."${dhcp_controller}".Topic="${ct_topic}"
 			fi
 
 			proto_changed=1
@@ -355,38 +367,37 @@ if [ "${wan_intf}" == "${INTERFACE}" ]; then
 				protocol="${offered_proto}"
 			fi
 
-			if [ "${protocol}" == "MQTT" ]; then
-				uci -q set obuspa.$dhcp_controller.Topic="${topic}"
+			if [ "${protocol}" = "MQTT" ]; then
+				uci -q set obuspa."${dhcp_controller}".Topic="${topic}"
 			else
-				uci -q set obuspa.$dhcp_controller.Path="${topic}"
+				uci -q set obuspa."${dhcp_controller}".Path="${topic}"
 			fi
 
 			uci_change=1
 		fi
 
 		if [ -n "${PROV_CODE}" ] && [ "${ct_prov}" != "${PROV_CODE}" ]; then
-			uci -q set obuspa.$dhcp_controller.ProvisioningCode="${PROV_CODE}"
+			uci -q set obuspa."${dhcp_controller}".ProvisioningCode="${PROV_CODE}"
 			uci_change=1
 		fi
 
 		if [ "${proto_changed}" -eq 1 ]; then
-			if [ "${offered_proto}" == "WebSocket" ]; then
+			if [ "${offered_proto}" = "WebSocket" ]; then
 				if [ -n "${dhcp_mqtt}" ]; then
-					uci -q del obuspa.$dhcp_mqtt
+					uci -q delete obuspa."${dhcp_mqtt}"
 				fi
 
 				if [ -z "${dhcp_mtp}" ]; then
-					sec=$(uci -q add obuspa mtp)
-					uci -q rename obuspa."${sec}"='dhcpmtp'
+					uci -q set obuspa.dhcpmtp="mtp"
 					dhcp_mtp="dhcpmtp"
-					uci -q set obuspa.$dhcp_mtp.Enable='1'
+					uci -q set obuspa."${dhcp_mtp}".Enable='1'
 				fi
 
-				uci -q set obuspa.$dhcp_mtp.mqtt=''
-				uci -q set obuspa.$dhcp_mtp.ResponseTopicConfigured=''
-				uci -q set obuspa.$dhcp_mtp.Protocol='WebSocket'
-				uci -q set obuspa.$dhcp_mtp.Port="${port}"
-				uci -q set obuspa.$dhcp_mtp.EnableEncryption="${mtp_encrypt}"
+				uci -q set obuspa."${dhcp_mtp}".mqtt=''
+				uci -q set obuspa."${dhcp_mtp}".ResponseTopicConfigured=''
+				uci -q set obuspa."${dhcp_mtp}".Protocol='WebSocket'
+				uci -q set obuspa."${dhcp_mtp}".Port="${port}"
+				uci -q set obuspa."${dhcp_mtp}".EnableEncryption="${mtp_encrypt}"
 
 				uci_change=1
 			else
@@ -394,137 +405,135 @@ if [ "${wan_intf}" == "${INTERFACE}" ]; then
 					user="$(uci -q get obuspa.global.username)"
 					pass="$(uci -q get obuspa.global.password)"
 
-					sec=$(uci -q add obuspa mqtt)
-					uci -q rename obuspa."${sec}"='dhcpmqtt'
+					uci -q set obuspa.dhcpmqtt="mqtt"
 					dhcp_mqtt="dhcpmqtt"
-					uci -q set obuspa.$dhcp_mqtt.Enable='1'
-					uci -q set obuspa.$dhcp_mqtt.Username="${user}"
-					uci -q set obuspa.$dhcp_mqtt.Password="${pass}"
+					uci -q set obuspa."${dhcp_mqtt}".Enable='1'
+					uci -q set obuspa."${dhcp_mqtt}".Username="${user}"
+					uci -q set obuspa."${dhcp_mqtt}".Password="${pass}"
 				fi
 
-				uci -q set obuspa.$dhcp_mqtt.BrokerAddress="${ip}"
-				uci -q set obuspa.$dhcp_mqtt.BrokerPort="${port}"
-				uci -q set obuspa.$dhcp_mqtt.TransportProtocol="${mtp_encrypt}"
-				uci -q set obuspa.$dhcp_mqtt.ProtocolVersion='5.0'
+				uci -q set obuspa."${dhcp_mqtt}".BrokerAddress="${ip}"
+				uci -q set obuspa."${dhcp_mqtt}".BrokerPort="${port}"
+				uci -q set obuspa."${dhcp_mqtt}".TransportProtocol="${mtp_encrypt}"
+				uci -q set obuspa."${dhcp_mqtt}".ProtocolVersion='5.0'
 
 				if [ -z "${dhcp_mtp}" ]; then
-					sec=$(uci -q add obuspa mtp)
-					uci -q rename obuspa."${sec}"='dhcpmtp'
+					uci -q set obuspa.dhcpmtp="mtp"
 					dhcp_mtp="dhcpmtp"
-					uci -q set obuspa.$dhcp_mtp.Enable='1'
+					uci -q set obuspa."${dhcp_mtp}".Enable='1'
 				fi
 
 				agent_topic=$(get_agent_topic)
-				uci -q set obuspa.$dhcp_mtp.Port=""
-				uci -q set obuspa.$dhcp_mtp.EnableEncryption=""
-				uci -q set obuspa.$dhcp_mtp.Protocol='MQTT'
-				uci -q set obuspa.$dhcp_mtp.ResponseTopicConfigured="${agent_topic}"
-				uci -q set obuspa.$dhcp_mtp.mqtt="${dhcp_mqtt}"
+				uci -q delete obuspa."${dhcp_mtp}".Port
+				uci -q delete obuspa."${dhcp_mtp}".EnableEncryption
+				uci -q set obuspa."${dhcp_mtp}".Protocol='MQTT'
+				uci -q set obuspa."${dhcp_mtp}".ResponseTopicConfigured="${agent_topic}"
+				uci -q set obuspa."${dhcp_mtp}".mqtt="${dhcp_mqtt}"
 
 				uci_change=1
 			fi
 		else
-			if [ "${ct_proto}" == "WebSocket" ]; then
-				conf_ip="$(uci -q get obuspa.$dhcp_controller.Host)"
-				conf_port="$(uci -q get obuspa.$dhcp_mtp.Port)"
-				conf_encr="$(uci -q get obuspa.$dhcp_mtp.EnableEncryption)"
+			if [ "${ct_proto}" = "WebSocket" ]; then
+				conf_ip="$(uci -q get obuspa."${dhcp_controller}".Host)"
+				conf_port="$(uci -q get obuspa."${dhcp_mtp}".Port)"
+				conf_encr="$(uci -q get obuspa."${dhcp_mtp}".EnableEncryption)"
 
 				if [ -n "${ip}" ] && [ "${conf_ip}" != "${ip}" ]; then
-					uci -q set obuspa.$dhcp_controller.Host="${ip}"
+					uci -q set obuspa."${dhcp_controller}".Host="${ip}"
 					uci_change=1
 				fi
 
 				if [ -n "${port}" ] && [ "${conf_port}" != "${port}" ]; then
-					uci -q set obuspa.$dhcp_mtp.Port="${port}"
-					uci -q set obuspa.$dhcp_controller.Port="${port}"
+					uci -q set obuspa."${dhcp_mtp}".Port="${port}"
+					uci -q set obuspa."${dhcp_controller}".Port="${port}"
 					uci_change=1
 				fi
 
 				if [ -n "${mtp_encrypt}" ] && [ "${conf_encr}" != "${mtp_encrypt}" ]; then
-					uci -q set obuspa.$dhcp_mtp.EnableEncryption="${mtp_encrypt}"
-					uci -q set obuspa.$dhcp_controller.EnableEncryption="${mtp_encrypt}"
+					uci -q set obuspa."${dhcp_mtp}".EnableEncryption="${mtp_encrypt}"
+					uci -q set obuspa."${dhcp_controller}".EnableEncryption="${mtp_encrypt}"
 					uci_change=1
 				fi
 			else
-				conf_ip="$(uci -q get obuspa.$dhcp_mqtt.BrokerAddress)"
-				conf_port="$(uci -q get obuspa.$dhcp_mqtt.BrokerPort)"
-				conf_encr="$(uci -q get obuspa.$dhcp_mqtt.TransportProtocol)"
+				conf_ip=$(uci -q get obuspa."${dhcp_mqtt}".BrokerAddress)
+				conf_port=$(uci -q get obuspa."${dhcp_mqtt}".BrokerPort)
+				conf_encr=$(uci -q get obuspa."${dhcp_mqtt}".TransportProtocol)
 
 				if [ -n "${port}" ] && [ "${conf_port}" != "${port}" ]; then
-					uci -q set obuspa.$dhcp_mqtt.BrokerPort="${port}"
+					uci -q set obuspa."${dhcp_mqtt}".BrokerPort="${port}"
 					uci_change=1
 				fi
 
 				if [ -n "${mtp_encrypt}" ] && [ "${conf_encr}" != "${mtp_encrypt}" ]; then
-					uci -q set obuspa.$dhcp_mqtt.TransportProtocol="${mtp_encrypt}"
+					uci -q set obuspa."${dhcp_mqtt}".TransportProtocol="${mtp_encrypt}"
 					uci_change=1
 				fi
 
 				if [ -n "${ip}" ] && [ "${conf_ip}" != "${ip}" ]; then
-					uci -q set obuspa.$dhcp_mqtt.BrokerAddress="${ip}"
+					uci -q set obuspa."${dhcp_mqtt}".BrokerAddress="${ip}"
 					uci_change=1
 				fi
 			fi
 		fi
 	else
-		uci -q del obuspa.dhcpmtp
-		uci -q del obuspa.dhcpmqtt
+		# Only setup a new controller, only if mandatory param present
+		if [ -n "${ENDPOINT_ID}" ] && [ -n "${URL}" ]; then
+			uci -q delete obuspa.dhcpmtp
+			uci -q delete obuspa.dhcpmqtt
 
-		sec=$(uci -q add obuspa controller)
-		uci -q rename obuspa."${sec}"='dhcpcontroller'
-		uci -q set obuspa.dhcpcontroller.dhcp_discovered="1"
-		uci -q set obuspa.dhcpcontroller.EndpointID="${ENDPOINT_ID}"
-		uci -q set obuspa.dhcpcontroller.ProvisioningCode="${PROV_CODE}"
-		uci -q set obuspa.dhcpcontroller.Protocol="${offered_proto}"
-		uci -q set obuspa.dhcpcontroller.assigned_role_name="$(get_access_role)"
-		uci -q set obuspa.dhcpcontroller.Enable='1'
+			uci -q set obuspa.dhcpcontroller="controller"
+			uci -q set obuspa.dhcpcontroller.dhcp_discovered="1"
+			uci -q set obuspa.dhcpcontroller.EndpointID="${ENDPOINT_ID}"
+			uci -q set obuspa.dhcpcontroller.ProvisioningCode="${PROV_CODE}"
+			uci -q set obuspa.dhcpcontroller.Protocol="${offered_proto}"
+			uci -q set obuspa.dhcpcontroller.assigned_role_name="$(get_access_role)"
+			uci -q set obuspa.dhcpcontroller.Enable='1'
 
-		if [ -n "${offered_proto}" ]; then
-			if [ "${offered_proto}" == "MQTT" ]; then
-				user="$(uci -q get obuspa.global.username)"
-				pass="$(uci -q get obuspa.global.password)"
+			if [ -n "${offered_proto}" ]; then
+				if [ "${offered_proto}" = "MQTT" ]; then
+					user="$(uci -q get obuspa.global.username)"
+					pass="$(uci -q get obuspa.global.password)"
 
-				uci -q set obuspa.dhcpcontroller.Topic="${topic}"
-				uci -q set obuspa.dhcpcontroller.mqtt='dhcpmqtt'
+					uci -q set obuspa.dhcpcontroller.Topic="${topic}"
+					uci -q set obuspa.dhcpcontroller.mqtt='dhcpmqtt'
 
-				sec=$(uci -q add obuspa mqtt)
-				uci -q rename obuspa."${sec}"='dhcpmqtt'
-				uci -q set obuspa.dhcpmqtt.BrokerAddress="${ip}"
-				uci -q set obuspa.dhcpmqtt.BrokerPort="${port}"
-				uci -q set obuspa.dhcpmqtt.TransportProtocol="${mtp_encrypt}"
-				uci -q set obuspa.dhcpmqtt.Enable='1'
-				uci -q set obuspa.dhcpmqtt.ProtocolVersion='5.0'
-				uci -q set obuspa.dhcpmqtt.Username="${user}"
-				uci -q set obuspa.dhcpmqtt.Password="${pass}"
+					uci -q set obuspa.dhcpmqtt="mqtt"
+					uci -q set obuspa.dhcpmqtt.BrokerAddress="${ip}"
+					uci -q set obuspa.dhcpmqtt.BrokerPort="${port}"
+					uci -q set obuspa.dhcpmqtt.TransportProtocol="${mtp_encrypt}"
+					uci -q set obuspa.dhcpmqtt.Enable='1'
+					uci -q set obuspa.dhcpmqtt.ProtocolVersion='5.0'
+					uci -q set obuspa.dhcpmqtt.Username="${user}"
+					uci -q set obuspa.dhcpmqtt.Password="${pass}"
 
 
-				agent_topic=$(get_agent_topic)
-				sec=$(uci -q add obuspa mtp)
-				uci -q rename obuspa."${sec}"='dhcpmtp'
-				uci -q set obuspa.dhcpmtp.Protocol='MQTT'
-				uci -q set obuspa.dhcpmtp.ResponseTopicConfigured="${agent_topic}"
-				uci -q set obuspa.dhcpmtp.Enable='1'
-				uci -q set obuspa.dhcpmtp.mqtt='dhcpmqtt'
-			else
-				uci -q set obuspa.dhcpcontroller.Path="${topic}"
-				uci -q set obuspa.dhcpcontroller.Host="${ip}"
-				uci -q set obuspa.dhcpcontroller.Port="${port}"
-				uci -q set obuspa.dhcpcontroller.EnableEncryption="${mtp_encrypt}"
+					agent_topic=$(get_agent_topic)
+					uci -q set obuspa.dhcpmtp="mtp"
+					uci -q set obuspa.dhcpmtp.Protocol='MQTT'
+					uci -q set obuspa.dhcpmtp.ResponseTopicConfigured="${agent_topic}"
+					uci -q set obuspa.dhcpmtp.Enable='1'
+					uci -q set obuspa.dhcpmtp.mqtt='dhcpmqtt'
+				else
+					uci -q set obuspa.dhcpcontroller.Path="${topic}"
+					uci -q set obuspa.dhcpcontroller.Host="${ip}"
+					uci -q set obuspa.dhcpcontroller.Port="${port}"
+					uci -q set obuspa.dhcpcontroller.EnableEncryption="${mtp_encrypt}"
 
-				sec=$(uci -q add obuspa mtp)
-				uci -q rename obuspa."${sec}"='dhcpmtp'
-
-				uci -q set obuspa.dhcpmtp.Protocol='WebSocket'
-				uci -q set obuspa.dhcpmtp.Port="${port}"
-				uci -q set obuspa.dhcpmtp.Enable='1'
-				uci -q set obuspa.dhcpmtp.EnableEncryption="${mtp_encrypt}"
+					uci -q set obuspa.dhcpmtp="mtp"
+					uci -q set obuspa.dhcpmtp.Protocol='WebSocket'
+					uci -q set obuspa.dhcpmtp.Port="${port}"
+					uci -q set obuspa.dhcpmtp.Enable='1'
+					uci -q set obuspa.dhcpmtp.EnableEncryption="${mtp_encrypt}"
+				fi
 			fi
+			uci_change=1
 		fi
-
-		uci_change=1
 	fi
 
 	if [ ${uci_change} -eq 1 ]; then
+		if [ -f "${OBUSPA_BOOT_MARKER}" ]; then
+			rm -f "${OBUSPA_BOOT_MARKER}"
+		fi
 		log "# Reloading obuspa as dhcp config changed"
 		ubus call uci commit '{"config":"obuspa"}'
 	fi

obuspa/patches/2005-set-sql-journal-mode.patch

@@ -0,0 +1,28 @@
+diff --git a/src/core/database.c b/src/core/database.c
+index 7ad9dae..edebd7c 100644
+--- a/src/core/database.c
++++ b/src/core/database.c
+@@ -955,6 +955,7 @@ void DATABASE_Dump(void)
+ int OpenUspDatabase(char *db_file)
+ {
+     int err;
++    char *err_msg = 0;
+ 
+     // Exit if unable to open the database
+     err = sqlite3_open(db_file, &db_handle);
+@@ -965,6 +966,15 @@ int OpenUspDatabase(char *db_file)
+         return USP_ERR_INTERNAL_ERROR;
+     }
+ 
++    // Execute the PRAGMA statement
++    const char *sql = "PRAGMA journal_mode = MEMORY;";
++    err = sqlite3_exec(db_handle, sql, 0, 0, &err_msg);
++    if (err != SQLITE_OK) {
++        USP_LOG_Error("%s: Failed to set journal_mode: %s", __func__, err_msg);
++        sqlite3_free(err_msg);
++        return USP_ERR_INTERNAL_ERROR;
++    }
++
+     // Exit if unable to create the data model parameter table (if it does not already exist)
+     #define CREATE_TABLE_STR "create table if not exists data_model (hash integer, instances text, value text, primary key (hash, instances));"
+     err = sqlite3_exec(db_handle, CREATE_TABLE_STR, NULL, NULL, NULL);

obuspa/patches/2006-force-db-update.patch

@@ -0,0 +1,23 @@
+diff --git a/src/core/database.c b/src/core/database.c
+index 7ad9dae..0bf9c90 100644
+--- a/src/core/database.c
++++ b/src/core/database.c
+@@ -1479,3 +1479,7 @@ int GetAllEntriesForParameter(db_hash_t hash, kv_vector_t *kvv)
+     return result;
+ }
+ 
++void DATABASE_force_reset_file()
++{
++    schedule_factory_reset_init = true;
++}
+diff --git a/src/core/database.h b/src/core/database.h
+index c88cf3a..376aa7a 100644
+--- a/src/core/database.h
++++ b/src/core/database.h
+@@ -67,5 +67,6 @@ void DATABASE_Dump(void);
+ int DATABASE_ReadDataModelInstanceNumbers(bool remove_unknown_params);
+ db_hash_t DATABASE_GetMigratedHash(db_hash_t hash);
+ 
++void DATABASE_force_reset_file();
+ #endif
+ 

parental-control/Makefile

@@ -5,13 +5,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=parental-control
-PKG_VERSION:=1.3.1
+PKG_VERSION:=1.4.4
 
 LOCAL_DEV:=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/network/parental-control.git
-PKG_SOURCE_VERSION:=b1e5b3f81f08271bdaf9cb4bda8a7696a27be3c6
+PKG_SOURCE_VERSION:=8e0a198cee43ae66b26ed5b50274831bb4f55db1
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_MIRROR_HASH:=skip
 endif
@@ -83,9 +83,6 @@ define Package/parental-control/install
 	$(INSTALL_DATA) ./files/etc/uci-defaults/95-firewall_parentalcontrol.ucidefaults $(1)/etc/uci-defaults/
 	$(INSTALL_DATA) ./files/etc/uci-defaults/35-migrate_urlfilter.ucidefaults $(1)/etc/uci-defaults/
 
-	$(INSTALL_DIR) $(1)/lib/upgrade/keep.d
-	$(INSTALL_DATA) ./files/lib/upgrade/keep.d/parentalcontrol $(1)/lib/upgrade/keep.d/parentalcontrol
-
 	$(BBFDM_REGISTER_SERVICES) -v ${VENDOR_PREFIX} ./bbfdm_service.json $(1) parentalcontrol
 
 	$(INSTALL_DATA) ./files/etc/uci-defaults/40-parental_control_update_bundle_path $(1)/etc/uci-defaults/

parental-control/files/etc/init.d/parentalcontrol

@@ -12,7 +12,9 @@ validate_global_section() {
 	uci_validate_section parentalcontrol globals globals \
 	    'enable:bool:1' \
 	    'loglevel:uinteger:3' \
+	    'queue_num:uinteger:53' \
 	    'bundle_path:string' \
+	    'default_wan_interface:string:wan' \
 	    'urlfilter:bool'
 }
 
@@ -24,11 +26,12 @@ remove_fw_rules() {
 }
 
 configure_fw_rules() {
-	local enable urlfilter
+	local enable urlfilter queue_num
 
 	config_load parentalcontrol
 	config_get_bool enable globals enable 0
 	config_get_bool urlfilter globals urlfilter 0
+	config_get queue_num globals queue_num 53
 
 	remove_fw_rules
 
@@ -37,6 +40,11 @@ configure_fw_rules() {
 		return 0
 	fi
 
+	if [ "${queue_num}" -lt 0 ] || [ "${queue_num}" -gt 65535 ]; then
+	        log "ERROR: queue_num not in 0-65535"
+		return 1
+	fi
+
 	if [ "${urlfilter}" -eq "1" ]; then
 		if [ ! -f "${OVERRIDE_JSON}" ]; then
 			# throw error
@@ -48,11 +56,11 @@ configure_fw_rules() {
 				hw_nat -! > /dev/null 2>&1
 			fi
 			if which conntrack > /dev/null 2>&1; then
-				conntrack -F > /dev/null 2>&1
+				flush_conntrack_for_hosts
 			fi
 
 			# this is for urlfilter daemon
-			add_iptables_nfqueue_rules
+			add_iptables_nfqueue_rules "$queue_num"
 		fi
 	fi
 
@@ -107,7 +115,7 @@ start_service() {
 
 	procd_open_instance "parentalcontrol"
 	procd_set_param command nice -n 10 "${PROG}"  # Lower priority
-	procd_append_param command -l ${loglevel}
+	procd_append_param command -l "${loglevel}"
 	procd_set_param respawn
 	procd_close_instance
 }
@@ -120,11 +128,19 @@ stop_service() {
 }
 
 reload_service() {
+	local arg="$1"
+
 	ret=$(ubus call service list '{"name":"parentalcontrol"}' | jsonfilter -qe '@.parentalcontrol.instances.parentalcontrol.running')
 	if [ "$ret" != "true" ]; then
 		stop
 		start
 	else
+		if [ "$arg" = "network" ]; then
+			pidof_sync="$(pidof sync_bundles.sh)"
+			[ -n "$pidof_sync" ] && kill "$pidof_sync"
+			sleep 5
+		fi
+
 		configure_fw_rules
 		copy_dhcp_leases
 		ubus send parentalcontrol.reload
@@ -132,6 +148,19 @@ reload_service() {
 }
 
 service_triggers() {
+	local enable urlfilter default_wan_interface
+
+	validate_global_section || {
+		return 1
+	}
+
+	if [ "${urlfilter}" = "1" ] && [ "$enable" = "1" ] && [ -n "$default_wan_interface" ]; then
+		log "Adding interface trigger for $default_wan_interface"
+		procd_open_trigger
+		procd_add_interface_trigger "interface.*.up" "$default_wan_interface" /etc/init.d/parentalcontrol reload "network"
+		procd_close_trigger
+	fi
+
 	procd_add_reload_trigger "parentalcontrol"
 	procd_add_reload_trigger "schedules"
 }

parental-control/files/lib/parentalcontrol/parentalcontrol.sh

@@ -311,31 +311,6 @@ handle_schedule() {
 	generate_ip_rule "$utc_start_relative_day" "$utc_end_relative_day" "$utc_start_time" "$utc_stop_time" "$target"
 }
 
-# Function that parses input for MAC addresses or hostnames
-parse_macs_or_hostnames() {
-	local input="$1"
-	local lease_file="/tmp/dhcp.leases"
-
-	[ -f "$lease_file" ] || lease_file="/etc/parentalcontrol/dhcp.leases"
-	[ -f "$lease_file" ] || { log "Error: No DHCP lease file found."; return 1; }
-
-	for item in $input; do
-		case "$item" in
-			??:??:??:??:??:??)
-				# It's a MAC address, print it as is
-				echo "$item"
-				;;
-			*)
-				# Assume it's a hostname and search for its MAC address in the leases file
-				mac=$(awk -v hostname="$item" '$4 == hostname {print $2}' "$lease_file")
-				if [ -n "$mac" ]; then
-					echo "$mac"
-				fi
-				;;
-		esac
-	done
-}
-
 handle_bedtime() {
 	local mac_addresses="$1"
 	local mac
@@ -370,38 +345,61 @@ handle_internet_break() {
 	done
 }
 
+parse_macs() {
+	local maclist="$1"
+	local m mac
+
+	for m in $maclist; do
+		# trim whitespace
+		mac="$(echo "$m" | tr -d ' \t\r\n')"
+
+		# validate format
+		if echo "$mac" | grep -qE '^[0-9A-Fa-f]{2}(:[0-9A-Fa-f]{2}){5}$'; then
+			echo "$mac"
+		else
+			log "parse_macs(): Invalid MAC in mac list: '$mac'"
+		fi
+	done
+}
+
 handle_profile() {
 	local profile_section="$1"
-	local internet_break_enable bedtime_enable hostlist
+	local internet_break_enable bedtime_enable hostlist maclist
 
-	config_get hostlist "$profile_section" "host"
+        config_get_bool internet_break_enable "$profile_section" "internet_break_enable" 0
+        config_get_bool bedtime_enable "$profile_section" "bedtime_enable" 0
 
-	if [ -z "$hostlist" ]; then
+        if [ $internet_break_enable -eq 0 ] && [ $bedtime_enable -eq 0 ]; then
 		return
 	fi
 
-	ACCESS_RULE=""
+        config_get hostlist "$profile_section" "host"
+        config_get maclist  "$profile_section" "mac"
 
-	# convert hostnames to mac addresses if needed
-	# and replace newlines with space because it messes up the for loops in
-	# handle_internet_break and handle_bedtime functions
-	local mac_addresses="$(parse_macs_or_hostnames "${hostlist}" | tr '\n' ' ')"
+        # If both lists are empty, nothing to do
+        if [ -z "$hostlist" ] && [ -z "$maclist" ]; then
+                return
+        fi
 
-	# default value of Hosts.AccessControl.{i}.Enable is false,
-	# so, if not defined in uci as 1, assume 0
-	config_get_bool internet_break_enable "$profile_section" "internet_break_enable" 0
-	if [ $internet_break_enable -gt 0 ]; then
-		handle_internet_break "${mac_addresses}"
-		# handle_internet_break may have loaded schedules uci
-		# so, reload parentalcontrol
-		config_load "parentalcontrol"
-	fi
+        ACCESS_RULE=""
 
-	config_get_bool bedtime_enable "$profile_section" "bedtime_enable" 0
-	if [ $bedtime_enable -gt 0 ]; then
-		handle_bedtime "${mac_addresses}"
-	fi
+	# both uci options contain mac addresses
+	# one is given directly by the user
+	# other is resolved by the data model from Hosts.Host object
+        local mac_addresses="$(parse_macs "${hostlist} ${maclist}" | awk '{ if (NF && !seen[$0]++) { print $0 } }' | tr '\n' ' ')"
 
+        # default value of Hosts.AccessControl.{i}.Enable is false,
+        # so, if not defined in uci as 1, assume 0
+        if [ $internet_break_enable -gt 0 ]; then
+                handle_internet_break "${mac_addresses}"
+                # handle_internet_break may have loaded schedules uci
+                # so, reload parentalcontrol
+                config_load "parentalcontrol"
+        fi
+
+        if [ $bedtime_enable -gt 0 ]; then
+                handle_bedtime "${mac_addresses}"
+        fi
 }
 
 add_internet_schedule_rules() {
@@ -438,102 +436,118 @@ add_internet_schedule_rules() {
 }
 
 add_iptables_nfqueue_rules() {
-	local filter_used
+    local queue_num="$1"
 
-	# Check if urlfilter used
-	if ! uci show parentalcontrol | grep -q profile_urlfilter; then
-		return
-	fi
+    # Check if urlfilter used
+    if ! uci show parentalcontrol | grep -q profile_urlfilter; then
+        return
+    fi
 
-	# IPv4 rules
-	iptables -w -nL FORWARD | grep -iqE "NFQUEUE"
-	if [ "$?" -ne 0 ]; then
-		# capture DNS responses (UDP/TCP sport 53) in FORWARD
-		iptables -w -I FORWARD 1 -p tcp --sport 53 -j NFQUEUE --queue-num 0 --queue-bypass
-		iptables -w -I FORWARD 1 -p udp --sport 53 -j NFQUEUE --queue-num 0 --queue-bypass
+    # IPv4
+    # FORWARD
+    if ! iptables -w -nL | grep -q "URLFILTER_FORWARD"; then
+        iptables -w -N URLFILTER_FORWARD
+        iptables -w -I FORWARD 1 -j URLFILTER_FORWARD
 
-		# INPUT: DNS replies to router, skip loopback
-		iptables -w -I INPUT 1 -p tcp --sport 53 ! -i lo -j NFQUEUE --queue-num 0 --queue-bypass
-		iptables -w -I INPUT 1 -p udp --sport 53 ! -i lo -j NFQUEUE --queue-num 0 --queue-bypass
+        # capture DNS responses (sport 53)
+        iptables -w -A URLFILTER_FORWARD -p tcp --sport 53 -j NFQUEUE --queue-num $queue_num --queue-bypass
+        iptables -w -A URLFILTER_FORWARD -p udp --sport 53 -j NFQUEUE --queue-num $queue_num --queue-bypass
 
-		# OUTPUT: DNS replies from router, skip loopback
-		iptables -w -I OUTPUT 1 -p tcp --sport 53 ! -o lo -j NFQUEUE --queue-num 0 --queue-bypass
-		iptables -w -I OUTPUT 1 -p udp --sport 53 ! -o lo -j NFQUEUE --queue-num 0 --queue-bypass
+        # HTTP/HTTPS flows
+        iptables -w -A URLFILTER_FORWARD -p tcp --match multiport --ports 80,443 -j NFQUEUE --queue-num $queue_num --queue-bypass
+        iptables -w -A URLFILTER_FORWARD -p udp --match multiport --ports 80,443 -j NFQUEUE --queue-num $queue_num --queue-bypass
+    fi
 
-		# HTTP/HTTPS flows for urlfilter
-		iptables -w -I FORWARD 1 -p tcp --match multiport --ports 80,443 -j NFQUEUE --queue-num 0 --queue-bypass
-		iptables -w -I FORWARD 1 -p udp --match multiport --ports 80,443 -j NFQUEUE --queue-num 0 --queue-bypass
+    # INPUT
+    if ! iptables -w -nL | grep -q "URLFILTER_INPUT"; then
+        iptables -w -N URLFILTER_INPUT
+        iptables -w -I INPUT 1 -j URLFILTER_INPUT
 
-		# disable acceleration for https packet so that they can be read by urlfilter
-		ebtables --concurrent -A FORWARD -p ip --ip-protocol 6 --ip-destination-port 443 -j SKIPLOG 2> /dev/null
-		ebtables --concurrent -A FORWARD -p ip --ip-protocol 6 --ip-source-port 53 -j SKIPLOG 2> /dev/null
-		ebtables --concurrent -A FORWARD -p ip --ip-protocol 17 --ip-source-port 53 -j SKIPLOG 2> /dev/null
-	fi
+        iptables -w -A URLFILTER_INPUT -p tcp --sport 53 ! -i lo -j NFQUEUE --queue-num $queue_num --queue-bypass
+        iptables -w -A URLFILTER_INPUT -p udp --sport 53 ! -i lo -j NFQUEUE --queue-num $queue_num --queue-bypass
+    fi
 
-	# IPv6 rules
-	ip6tables -w -nL FORWARD | grep -iqE "NFQUEUE"
-	if [ "$?" -ne 0 ]; then
-		# capture DNS responses (UDP/TCP sport 53) in FORWARD
-		ip6tables -w -I FORWARD 1 -p tcp --sport 53 -j NFQUEUE --queue-num 0 --queue-bypass
-		ip6tables -w -I FORWARD 1 -p udp --sport 53 -j NFQUEUE --queue-num 0 --queue-bypass
+    # OUTPUT
+    if ! iptables -w -nL | grep -q "URLFILTER_OUTPUT"; then
+        iptables -w -N URLFILTER_OUTPUT
+        iptables -w -I OUTPUT 1 -j URLFILTER_OUTPUT
 
-		# INPUT: DNS replies to router, skip loopback
-		ip6tables -w -I INPUT 1 -p tcp --sport 53 ! -i lo -j NFQUEUE --queue-num 0 --queue-bypass
-		ip6tables -w -I INPUT 1 -p udp --sport 53 ! -i lo -j NFQUEUE --queue-num 0 --queue-bypass
+        iptables -w -A URLFILTER_OUTPUT -p tcp --sport 53 ! -o lo -j NFQUEUE --queue-num $queue_num --queue-bypass
+        iptables -w -A URLFILTER_OUTPUT -p udp --sport 53 ! -o lo -j NFQUEUE --queue-num $queue_num --queue-bypass
+    fi
 
-		# OUTPUT: DNS replies from router, skip loopback
-		ip6tables -w -I OUTPUT 1 -p tcp --sport 53 ! -o lo -j NFQUEUE --queue-num 0 --queue-bypass
-		ip6tables -w -I OUTPUT 1 -p udp --sport 53 ! -o lo -j NFQUEUE --queue-num 0 --queue-bypass
+    # ebtables bypass for IPv4
+    ebtables --concurrent -A FORWARD -p ip --ip-protocol 6  --ip-destination-port 443 -j SKIPLOG 2>/dev/null
+    ebtables --concurrent -A FORWARD -p ip --ip-protocol 6  --ip-source-port 53    -j SKIPLOG 2>/dev/null
+    ebtables --concurrent -A FORWARD -p ip --ip-protocol 17 --ip-source-port 53    -j SKIPLOG 2>/dev/null
 
-		# HTTP/HTTPS flows for urlfilter
-		ip6tables -w -I FORWARD 1 -p tcp --match multiport --ports 80,443 -j NFQUEUE --queue-num 0 --queue-bypass
-		ip6tables -w -I FORWARD 1 -p udp --match multiport --ports 80,443 -j NFQUEUE --queue-num 0 --queue-bypass
+    # IPv6
+    # FORWARD
+    if ! ip6tables -w -nL | grep -q "URLFILTER_FORWARD6"; then
+        ip6tables -w -N URLFILTER_FORWARD6
+        ip6tables -w -I FORWARD 1 -j URLFILTER_FORWARD6
 
-		# disable acceleration for https packet so that they can be read by urlfilter
-		ebtables --concurrent -A FORWARD -p ip6 --ip6-protocol 6 --ip6-destination-port 443 -j SKIPLOG 2> /dev/null
-		ebtables --concurrent -A FORWARD -p ip6 --ip6-protocol 6 --ip6-source-port 53 -j SKIPLOG 2> /dev/null
-		ebtables --concurrent -A FORWARD -p ip6 --ip6-protocol 17 --ip6-source-port 53 -j SKIPLOG 2> /dev/null
-	fi
+        ip6tables -w -A URLFILTER_FORWARD6 -p tcp --sport 53 -j NFQUEUE --queue-num $queue_num --queue-bypass
+        ip6tables -w -A URLFILTER_FORWARD6 -p udp --sport 53 -j NFQUEUE --queue-num $queue_num --queue-bypass
+
+        ip6tables -w -A URLFILTER_FORWARD6 -p tcp --match multiport --ports 80,443 -j NFQUEUE --queue-num $queue_num --queue-bypass
+        ip6tables -w -A URLFILTER_FORWARD6 -p udp --match multiport --ports 80,443 -j NFQUEUE --queue-num $queue_num --queue-bypass
+    fi
+
+    # INPUT
+    if ! ip6tables -w -nL | grep -q "URLFILTER_INPUT6"; then
+        ip6tables -w -N URLFILTER_INPUT6
+        ip6tables -w -I INPUT 1 -j URLFILTER_INPUT6
+
+        ip6tables -w -A URLFILTER_INPUT6 -p tcp --sport 53 ! -i lo -j NFQUEUE --queue-num $queue_num --queue-bypass
+        ip6tables -w -A URLFILTER_INPUT6 -p udp --sport 53 ! -i lo -j NFQUEUE --queue-num $queue_num --queue-bypass
+    fi
+
+    # OUTPUT
+    if ! ip6tables -w -nL | grep -q "URLFILTER_OUTPUT6"; then
+        ip6tables -w -N URLFILTER_OUTPUT6
+        ip6tables -w -I OUTPUT 1 -j URLFILTER_OUTPUT6
+
+        ip6tables -w -A URLFILTER_OUTPUT6 -p tcp --sport 53 ! -o lo -j NFQUEUE --queue-num $queue_num --queue-bypass
+        ip6tables -w -A URLFILTER_OUTPUT6 -p udp --sport 53 ! -o lo -j NFQUEUE --queue-num $queue_num --queue-bypass
+    fi
+
+    # ebtables bypass for IPv6
+    ebtables --concurrent -A FORWARD -p ip6 --ip6-protocol 6  --ip6-destination-port 443 -j SKIPLOG 2>/dev/null
+    ebtables --concurrent -A FORWARD -p ip6 --ip6-protocol 6  --ip6-source-port 53    -j SKIPLOG 2>/dev/null
+    ebtables --concurrent -A FORWARD -p ip6 --ip6-protocol 17 --ip6-source-port 53    -j SKIPLOG 2>/dev/null
 }
 
 remove_iptables_nfqueue_rules() {
-	iptables -w -nL FORWARD | grep -iqE "NFQUEUE"
-	if [ "$?" -eq 0 ]; then
-		# DNS response rules
-		iptables -w -D FORWARD -p tcp --sport 53 -j NFQUEUE --queue-num 0 --queue-bypass
-		iptables -w -D FORWARD -p udp --sport 53 -j NFQUEUE --queue-num 0 --queue-bypass
-		iptables -w -D INPUT  -p tcp --sport 53 ! -i lo -j NFQUEUE --queue-num 0 --queue-bypass
-		iptables -w -D INPUT  -p udp --sport 53 ! -i lo -j NFQUEUE --queue-num 0 --queue-bypass
-		iptables -w -D OUTPUT -p tcp --sport 53 ! -o lo -j NFQUEUE --queue-num 0 --queue-bypass
-		iptables -w -D OUTPUT -p udp --sport 53 ! -o lo -j NFQUEUE --queue-num 0 --queue-bypass
+    # IPv4
+    for chain in URLFILTER_FORWARD URLFILTER_INPUT URLFILTER_OUTPUT; do
+        if iptables -w -nL | grep -q "$chain"; then
+            iptables -w -D FORWARD -j $chain 2>/dev/null
+            iptables -w -D INPUT   -j $chain 2>/dev/null
+            iptables -w -D OUTPUT  -j $chain 2>/dev/null
+            iptables -w -F $chain
+            iptables -w -X $chain
+        fi
+    done
 
-		# HTTP/HTTPS
-		iptables -w -D FORWARD -p tcp --match multiport --ports 80,443 -j NFQUEUE --queue-num 0 --queue-bypass
-		iptables -w -D FORWARD -p udp --match multiport --ports 80,443 -j NFQUEUE --queue-num 0 --queue-bypass
+    ebtables --concurrent -D FORWARD -p ip --ip-protocol 6  --ip-destination-port 443 -j SKIPLOG 2>/dev/null
+    ebtables --concurrent -D FORWARD -p ip --ip-protocol 6  --ip-source-port 53    -j SKIPLOG 2>/dev/null
+    ebtables --concurrent -D FORWARD -p ip --ip-protocol 17 --ip-source-port 53    -j SKIPLOG 2>/dev/null
 
-		ebtables --concurrent -D FORWARD -p ip --ip-protocol 6 --ip-destination-port 443 -j SKIPLOG 2> /dev/null
-		ebtables --concurrent -D FORWARD -p ip --ip-protocol 6 --ip-source-port 53 -j SKIPLOG 2> /dev/null
-		ebtables --concurrent -D FORWARD -p ip --ip-protocol 17 --ip-source-port 53 -j SKIPLOG 2> /dev/null
-	fi
+    # IPv6
+    for chain in URLFILTER_FORWARD6 URLFILTER_INPUT6 URLFILTER_OUTPUT6; do
+        if ip6tables -w -nL | grep -q "$chain"; then
+            ip6tables -w -D FORWARD -j $chain 2>/dev/null
+            ip6tables -w -D INPUT   -j $chain 2>/dev/null
+            ip6tables -w -D OUTPUT  -j $chain 2>/dev/null
+            ip6tables -w -F $chain
+            ip6tables -w -X $chain
+        fi
+    done
 
-	ip6tables -w -nL FORWARD | grep -iqE "NFQUEUE"
-	if [ "$?" -eq 0 ]; then
-		# DNS response rules
-		ip6tables -w -D FORWARD -p tcp --sport 53 -j NFQUEUE --queue-num 0 --queue-bypass
-		ip6tables -w -D FORWARD -p udp --sport 53 -j NFQUEUE --queue-num 0 --queue-bypass
-		ip6tables -w -D INPUT  -p tcp --sport 53 ! -i lo -j NFQUEUE --queue-num 0 --queue-bypass
-		ip6tables -w -D INPUT  -p udp --sport 53 ! -i lo -j NFQUEUE --queue-num 0 --queue-bypass
-		ip6tables -w -D OUTPUT -p tcp --sport 53 ! -o lo -j NFQUEUE --queue-num 0 --queue-bypass
-		ip6tables -w -D OUTPUT -p udp --sport 53 ! -o lo -j NFQUEUE --queue-num 0 --queue-bypass
-
-		# HTTP/HTTPS
-		ip6tables -w -D FORWARD -p tcp --match multiport --ports 80,443 -j NFQUEUE --queue-num 0 --queue-bypass
-		ip6tables -w -D FORWARD -p udp --match multiport --ports 80,443 -j NFQUEUE --queue-num 0 --queue-bypass
-
-		ebtables --concurrent -D FORWARD -p ip6 --ip6-protocol 6 --ip6-destination-port 443 -j SKIPLOG 2> /dev/null
-		ebtables --concurrent -D FORWARD -p ip6 --ip6-protocol 6 --ip6-source-port 53 -j SKIPLOG 2> /dev/null
-		ebtables --concurrent -D FORWARD -p ip6 --ip6-protocol 17 --ip6-source-port 53 -j SKIPLOG 2> /dev/null
-	fi
+    ebtables --concurrent -D FORWARD -p ip6 --ip6-protocol 6  --ip6-destination-port 443 -j SKIPLOG 2>/dev/null
+    ebtables --concurrent -D FORWARD -p ip6 --ip6-protocol 6  --ip6-source-port 53    -j SKIPLOG 2>/dev/null
+    ebtables --concurrent -D FORWARD -p ip6 --ip6-protocol 17 --ip6-source-port 53    -j SKIPLOG 2>/dev/null
 }
 
 remove_internet_schedule_rules() {
@@ -551,6 +565,68 @@ remove_internet_schedule_rules() {
 	fi
 }
 
+get_host_ip_from_mac() {
+	local mac="$1"
+	local ip=""
+
+	# Validate MAC format
+	if ! echo "$mac" | grep -qE '^([0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}$'; then
+		log "get_host_ip_from_mac(): Invalid MAC address format '$mac'"
+		return 1
+	fi
+
+	# Try to find IP from ARP table
+	ip="$(cat /proc/net/arp | awk -v mac="$mac" 'tolower($4) == tolower(mac) {print $1; exit}')"
+
+	if [ -n "$ip" ]; then
+		URLFILTER_IPS="${URLFILTER_IPS} ${ip}"
+		return 0
+	else
+		log "get_host_ip_from_mac(): No IP found for MAC $mac in ARP table"
+		return 1
+	fi
+}
+
+# Global array for resolved IPs
+URLFILTER_IPS=""
+
+resolve_profile_hosts() {
+	local section="$1"
+	local hostlist maclist h m
+
+	config_get hostlist "$section" host
+	config_get maclist  "$section" mac
+
+	for h in $hostlist; do
+		get_host_ip_from_mac "$h"
+	done
+
+	for m in $maclist; do
+		get_host_ip_from_mac "$m"
+	done
+}
+
+# Main function to collect IPs and delete conntrack entries
+flush_conntrack_for_hosts() {
+	URLFILTER_IPS=""
+	local count max
+
+	config_foreach resolve_profile_hosts profile
+
+	URLFILTER_IPS="$(echo "$URLFILTER_IPS" | tr ' ' '\n' | sort -u | xargs)"
+	for ip in $URLFILTER_IPS; do
+		count=0
+		max=1000
+		while conntrack -D -s "$ip" >/dev/null 2>&1; do
+			count=$((count+1))
+			if [ $count -ge $max ]; then
+				log "Warning: Forced to stop conntrack delete after $max deletions for $ip (possible loop)"
+				break
+			fi
+		done
+	done
+}
+
 OVERRIDE_JSON="/etc/parentalcontrol/urlbundle_override.json"
 DM_PLUGIN_PATH="/usr/share/bbfdm/micro_services/parentalcontrol/urlbundle_override.json"
 

parental-control/files/lib/parentalcontrol/sync_bundles.sh

@@ -161,7 +161,23 @@ handle_download_url() {
 		# If the URL is HTTP, fetch the file size
 		local bundle_file_size
 		if echo "$sanitized_url" | grep -qE "^https?://"; then
-			bundle_file_size="$(curl -I "$sanitized_url" 2>&1 | grep -i 'content-length' | cut -d: -f2 | xargs)"
+			bundle_file_header="$(curl -Is --max-time 30 "$sanitized_url" 2>/var/log/urlfilter_curl_err.log)"
+			curl_rc=$?
+
+			case $curl_rc in
+				0)
+					# Success
+					;;
+				6|7|28|35|52|55|56)
+					log_info "handle_download_url: URL not reachable (curl rc=$curl_rc): ${sanitized_url}"
+					return 1
+					;;
+				*)
+					log_info "handle_download_url: unexpected curl rc=$curl_rc for ${sanitized_url}"
+					;;
+			esac
+
+			bundle_file_size="$(echo "$bundle_file_header" | grep -i 'content-length' | cut -d: -f2 | xargs)"
 			[ -z "$bundle_file_size" ] && bundle_file_size=0
 		else
 			# If it's a file:// URL, get the file size from the filesystem

parental-control/files/lib/upgrade/keep.d/parentalcontrol

@@ -1 +0,0 @@
-/etc/parentalcontrol/dhcp.leases

passwdqc/Makefile

@@ -30,7 +30,7 @@ define Build/Compile
 	$(MAKE) -C $(PKG_BUILD_DIR) \
 		CC="$(TARGET_CC)" \
 		LDFLAGS="$(TARGET_LDFLAGS)" \
-		pam_wrapped
+		all_wrapped
 endef
 
 define Package/$(PKG_NAME)/install
@@ -40,8 +40,8 @@ define Package/$(PKG_NAME)/install
 	$(INSTALL_DIR) $(1)/usr/lib/security
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/pam_passwdqc.so $(1)/usr/lib/security/
 
-	$(INSTALL_DIR) $(1)/etc/uci-defaults/
-	$(INSTALL_BIN) ./files/passwdqc.uci_default $(1)/etc/uci-defaults/99-add_passwdqc_pam
+	$(INSTALL_DIR) $(1)/usr/sbin
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/pwqcheck $(1)/usr/sbin/
 endef
 
 $(eval $(call BuildPackage,$(PKG_NAME)))

passwdqc/files/passwdqc.uci_default

@@ -1,19 +0,0 @@
-#!/bin/sh
-
-CONFIG_FILE="/etc/pam.d/common-password"
-# for some reason setting to 8 makes passwdqc accept minimum 12 letter password with this configuration
-# if we set it to 12 then we need atleast 16 characters and so on
-# passphrase = 0 means no space separated words
-# rest can be figured out from passwdqc man page
-MODULE_LINE="password requisite pam_passwdqc.so min=disabled,disabled,disabled,disabled,8 max=20 passphrase=0 retry=3 enforce=everyone"
-
-# Ensure the file exists before modifying
-[ -f "$CONFIG_FILE" ] || exit 0
-
-# Check if pam_passwdqc is already in the file
-if ! grep -q "pam_passwdqc.so" "$CONFIG_FILE"; then
-    # Insert before pam_unix.so
-    sed -i "/pam_unix.so/ i\\$MODULE_LINE" "$CONFIG_FILE"
-fi
-
-exit 0

qosmngr/files/airoha/lib/qos/airoha.sh

@@ -406,33 +406,35 @@ hw_commit_all() {
         /userfs/bin/qosrule discpline Enable 0
     fi
 
-    if [ -x /userfs/bin/blapi_cmd ]; then
-        echo 1 > /proc/ifc_send_to_ppe
-        for tc in $(seq 0 7); do
-            if [ -s "/tmp/qos/dscp_values_${tc}_4" ]; then
-                sort -un "/tmp/qos/dscp_values_${tc}_4" | awk 'NR==1{first=$1;last=$1;next}
-                                                               $1 == last+1 {last=$1;next}
-                                                               {system("/userfs/bin/blapi_cmd traffic set_traffic_class DSCP " first*4 " " or(last*4, 0x3) " 1");first=$1;last=first}
-                                                               END{system("/userfs/bin/blapi_cmd traffic set_traffic_class DSCP " first*4 " " or(last*4, 0x3) " 1")}'
-            fi
-            if [ -s "/tmp/qos/dscp_values_${tc}_6" ]; then
-                [ -s "/tmp/qos/dscp_values_${tc}_4" ] && sort -un "/tmp/qos/dscp_values_${tc}_6" | awk 'NR==1{first=$1;last=$1;next}
-                                                                                                        $1 == last+1 {last=$1;next}
-                                                                                                        {system("/userfs/bin/blapi_cmd traffic set_traffic_class DSCP " first*4 " " or(last*4, 0x3) " 0");first=$1;last=first}
-                                                                                                        END{system("/userfs/bin/blapi_cmd traffic set_traffic_class DSCP " first*4 " " or(last*4, 0x3) " 0")}'
-                sort -un "/tmp/qos/dscp_values_${tc}_6" | awk 'NR==1{first=$1;last=$1;next}
-                                                               $1 == last+1 {last=$1;next}
-                                                               {system("/userfs/bin/blapi_cmd traffic set_traffic_class DSCP " first*4 " " or(last*4, 0x3) " 1");first=$1;last=first}
-                                                               END{system("/userfs/bin/blapi_cmd traffic set_traffic_class DSCP " first*4 " " or(last*4, 0x3) " 1")}'
-            fi
-        done
-    fi
+    if ! strings /proc/device-tree/compatible | grep -qFx econet,en7523; then
+        if [ -x /userfs/bin/blapi_cmd ]; then
+            echo 1 > /proc/ifc_send_to_ppe
+            for tc in $(seq 0 7); do
+                if [ -s "/tmp/qos/dscp_values_${tc}_4" ]; then
+                    sort -un "/tmp/qos/dscp_values_${tc}_4" | awk 'NR==1{first=$1;last=$1;next}
+                                                                   $1 == last+1 {last=$1;next}
+                                                                   {system("/userfs/bin/blapi_cmd traffic set_traffic_class DSCP " first*4 " " or(last*4, 0x3) " 1");first=$1;last=first}
+                                                                   END{system("/userfs/bin/blapi_cmd traffic set_traffic_class DSCP " first*4 " " or(last*4, 0x3) " 1")}'
+                fi
+                if [ -s "/tmp/qos/dscp_values_${tc}_6" ]; then
+                    [ -s "/tmp/qos/dscp_values_${tc}_4" ] && sort -un "/tmp/qos/dscp_values_${tc}_6" | awk 'NR==1{first=$1;last=$1;next}
+                                                                                                            $1 == last+1 {last=$1;next}
+                                                                                                            {system("/userfs/bin/blapi_cmd traffic set_traffic_class DSCP " first*4 " " or(last*4, 0x3) " 0");first=$1;last=first}
+                                                                                                            END{system("/userfs/bin/blapi_cmd traffic set_traffic_class DSCP " first*4 " " or(last*4, 0x3) " 0")}'
+                    sort -un "/tmp/qos/dscp_values_${tc}_6" | awk 'NR==1{first=$1;last=$1;next}
+                                                                   $1 == last+1 {last=$1;next}
+                                                                   {system("/userfs/bin/blapi_cmd traffic set_traffic_class DSCP " first*4 " " or(last*4, 0x3) " 1");first=$1;last=first}
+                                                                   END{system("/userfs/bin/blapi_cmd traffic set_traffic_class DSCP " first*4 " " or(last*4, 0x3) " 1")}'
+                fi
+            done
+        fi
 
-    if [ -x /userfs/bin/ifc ]; then
-        echo 1 > /proc/ifc_send_to_ppe
-        for pbit in $(seq 0 7); do
-            /userfs/bin/ifc add vip pbit $pbit
-        done
+        if [ -x /userfs/bin/ifc ]; then
+            echo 1 > /proc/ifc_send_to_ppe
+            for pbit in $(seq 0 7); do
+                /userfs/bin/ifc add vip pbit $pbit
+            done
+        fi
     fi
 
     hw_nat -! > /dev/null 2>&1

sshmngr/Config.in

@@ -1,7 +1,7 @@
 if PACKAGE_sshmngr
 choice
 	prompt "Select backend for SSH management"
-	default SSHMNGR_BACKEND_OPENSSH
+	default SSHMNGR_BACKEND_OPENSSH_PAM
 	depends on PACKAGE_sshmngr
 	help
 		Select which backend daemon to use for SSH

sulu/sulu-base/Makefile

@@ -5,11 +5,11 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=sulu-base
-PKG_VERSION:=5.1.5
+PKG_VERSION:=5.2.12
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/websdk/sulu.git
-PKG_SOURCE_VERSION:=6a307369a168d5bb94917c80116ab04c122bf45a
+PKG_SOURCE_VERSION:=1bfd46359a473d21ef91f7304bb073b11795a069
 PKG_MIRROR_HASH:=skip
 
 SULU_MOD:=core

sulu/sulu-builder/Makefile

@@ -5,12 +5,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=sulu-builder
-PKG_VERSION:=5.1.5
+PKG_VERSION:=5.2.12
 PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/websdk/sulu-builder.git
-PKG_SOURCE_VERSION:=5a0feada4653992eb981a1ccf922178f12590929
+PKG_SOURCE_VERSION:=b99fb49b11574daa57c90a0ab2d9a42160e34e97
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_SOURCE_VERSION)
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_BUILD_DIR:=$(BUILD_DIR)/sulu-$(PKG_VERSION)/sulu-builder-$(PKG_SOURCE_VERSION)
@@ -28,7 +28,7 @@ define Package/sulu/default
 	CATEGORY:=Utilities
 	SUBMENU:=SULU
 	TITLE:=SULU-CE
-	DEPENDS:=+mosquitto-auth-shadow +usermngr +userinterface +obuspa +sulu-vendorext
+	DEPENDS:=+mosquitto-auth-plugin +usermngr +userinterface +obuspa
 	DEPENDS+=+@OBUSPA_LOCAL_MQTT_LISTENER
 	EXTRA_DEPENDS:=nginx
 endef

sulu/sulu-builder/files/etc/sulu/nginx.locations

@@ -20,7 +20,7 @@ location /wss {
 	proxy_set_header Connection $connection_upgrade;
 	proxy_set_header    Host               $host;
 	proxy_set_header    X-Real-IP          $remote_addr;
-	proxy_set_header    X-Forwarded-For    $proxy_add_x_forwarded_for;
+	proxy_set_header    X-Forwarded-For    $remote_addr;
 	proxy_set_header    X-Forwarded-Host   $host;
 	proxy_set_header    X-Forwarded-Server $host;
 	proxy_set_header    X-Forwarded-Port   $server_port;

sulu/sulu-builder/files/etc/sulu/sulu.sh

@@ -4,10 +4,10 @@
 
 . /lib/functions.sh
 . /usr/share/libubox/jshn.sh
-#. /lib/functions/iopsys-environment.sh
 
-RESTART_REQ=0
-_RESTART_SERVICES="0"
+SULU_CON_CONFIG="/sulu/presets/connection-config.json"
+SULU_ACL_FILE=""
+SULU_CON_ROLES=""
 
 slog() {
 	echo "$*" | logger -t sulu.sh -p debug
@@ -28,49 +28,21 @@ _get_agent_id() {
 	fi
 }
 
-_get_sulu_user_roles() {
-	roles=$(uci -q get userinterface._sulu_s.role)
-
-	for role in ${roles}; do
-		sulu_user_roles="${sulu_user_roles} ${role}"
-	done
-
-	if [ -n "${sulu_user_roles}" ]; then
-		sulu_user_roles=$(echo -e "${sulu_user_roles// /\\n}" | sort | uniq)
-	fi
-
-	echo "${sulu_user_roles}"
-}
-
-_get_sulu_root() {
-	local root
-
-	root="$(uci -q get nginx._sulu_s.root)"
-	echo "${root:-/sulu}"
-}
-
-_get_sulu_connection_config() {
-	local config
-
-	config="$(_get_sulu_root)/presets/connection-config.json"
-	echo "${config}"
-}
-
-_get_sulu_session_mode() {
-	uci -q get sulu.global.SessionMode
-}
-
 _get_sulu_acl_file() {
 	uci -q get mosquitto.sulu.acl_file
 }
 
+_sulu_conn_config_users() {
+	for user in ${SULU_CON_ROLES}; do
+		json_add_object "${user}"
+		json_add_string 'fromId' "self::sulu-${user}"
+		json_add_string 'publishEndpoint' "/usp/$(_get_agent_id)/${user}/endpoint"
+		json_add_string 'subscribeEndpoint' "/usp/$(_get_agent_id)/${user}/controller"
+		json_close_object
+	done
+}
+
 generate_sulu_conn_config() {
-	local users SCONFIG session
-
-	users="$(_get_sulu_user_roles)"
-	session="$(_get_sulu_session_mode)"
-	SCONFIG="$(_get_sulu_connection_config)"
-
 	json_init
 	json_add_string 'Current-connection' 'main'
 	json_add_object 'Connections'
@@ -80,41 +52,25 @@ generate_sulu_conn_config() {
 			json_add_string 'toId' "os::$(_get_agent_id)"
 			json_add_string 'port' "auto"
 			json_add_string 'path' "/wss"
-
-			if [ "${session}" = "Require" ]; then
-				json_add_boolean 'useSession' 1
-			fi
-
 			json_add_string 'protocol' 'autoWs'
+
 			json_add_object 'overrides'
 			{
-				for user in ${users}; do
-					json_add_object "${user}"
-					{
-						json_add_string 'fromId' "self::sulu-${user}"
-						json_add_string 'publishEndpoint' "/usp/$(_get_agent_id)/${user}/endpoint"
-						json_add_string 'subscribeEndpoint' "/usp/$(_get_agent_id)/${user}/controller"
-						json_close_object
-					}
-				done
+				_sulu_conn_config_users
 				json_close_object
 			}
 			json_close_object
 		}
 		json_close_object
 	}
-
-	json_dump >"${SCONFIG}"
+	json_dump >"${SULU_CON_CONFIG}"
 }
 
-_update_obuspa_config_rbac() {
-	local agent users session
+update_obuspa_config() {
+	local agent
 
 	agent="$(_get_agent_id)"
-	users="$(_get_sulu_user_roles)"
-	session="$(_get_sulu_session_mode)"
-
-	for user in ${users}; do
+	for user in ${SULU_CON_ROLES}; do
 		local section
 
 		# Add mqtt
@@ -124,7 +80,6 @@ _update_obuspa_config_rbac() {
 			uci_set obuspa "${section}" BrokerAddress "127.0.0.1"
 			uci_set obuspa "${section}" BrokerPort "1883"
 			uci_set obuspa "${section}" TransportProtocol "TCP/IP"
-			RESTART_REQ=1
 		fi
 
 		# Add mtp
@@ -134,7 +89,6 @@ _update_obuspa_config_rbac() {
 			uci_set obuspa "${section}" Protocol "MQTT"
 			uci_set obuspa "${section}" ResponseTopicConfigured "/usp/${agent}/${user}/endpoint"
 			uci_set obuspa "${section}" mqtt "mqtt_sulu_$user"
-			RESTART_REQ=1
 		fi
 
 		# Add controller
@@ -146,88 +100,59 @@ _update_obuspa_config_rbac() {
 			uci_set obuspa "${section}" Topic "/usp/${agent}/${user}/controller"
 			uci_set obuspa "${section}" mqtt "mqtt_sulu_$user"
 			uci_set obuspa "${section}" assigned_role_name "$user"
-			RESTART_REQ=1
-		fi
-
-		obMode="$(uci_get obuspa "${section}" SessionMode)"
-		if [ "${session}" != "${obMode}" ]; then
-			uci_set obuspa "${section}" SessionMode "${session}"
-			RESTART_REQ=1
 		fi
 	done
 }
 
-_create_mosquitto_acl() {
-	local agentid users
-	local ACL_FILE acl_users
+create_mosquitto_acl() {
+	local agentid
+	local acl_users
 
-	RESTART_REQ="0"
-
-	ACL_FILE="$(_get_sulu_acl_file)"
-	if [ -z "${ACL_FILE}" ]; then
+	SULU_ACL_FILE="$(_get_sulu_acl_file)"
+	if [ -z "${SULU_ACL_FILE}" ]; then
 		return 0
 	fi
 
-	users="$(_get_sulu_user_roles)"
-	if [ -f "${ACL_FILE}" ]; then
-		acl_users="$(awk '/^user/ {print $2}' "${ACL_FILE}")"
-		for user in ${users}; do
-			if ! grep -q "$user" "${acl_users}"; then
-				rm -f "${ACL_FILE}"
-			fi
-		done
-	fi
-	touch "${ACL_FILE}"
-
+	echo > "${SULU_ACL_FILE}"
 	agentid="$(_get_agent_id)"
-	for user in ${users}; do
-		if ! grep -q "user $user" "${ACL_FILE}"; then
+	for user in ${SULU_CON_ROLES}; do
+		if ! grep -qxF "user $user" "${SULU_ACL_FILE}"; then
 			{
 				echo "user ${user}"
 				echo "topic read  /usp/${agentid}/${user}/controller/reply-to"
 				echo "topic write /usp/${agentid}/${user}/endpoint"
 				echo "topic read  /usp/${agentid}/${user}/controller"
 				echo ""
-			} >> "${ACL_FILE}"
-			RESTART_REQ="1"
+			} >> "${SULU_ACL_FILE}"
 		fi
 	done
+}
 
-	if [ "${_RESTART_SERVICES}" -eq "1" ] && [ "${RESTART_REQ}" -gt "0" ]; then
-		slog "Restarting mosquitto..."
-		ubus call uci commit '{"config":"mosquitto"}'
+get_sulu_roles() {
+	local sec path_prefix redirect role
+
+	sec="${1}"
+
+	config_get path_prefix "${sec}" path_prefix ""
+	config_get redirect "${sec}" redirect ""
+	config_get role "${sec}" role ""
+
+	if [ -n "${redirect}" ]; then
+		return 0
+	fi
+
+	if [ "${path_prefix}" != "/sulu" ]; then
+		return 0
+	fi
+
+	if [ -n "${role}" ]; then
+		SULU_CON_ROLES="${SULU_CON_ROLES} ${role}"
 	fi
 }
 
-update_obuspa_config() {
+config_load userinterface
+config_foreach get_sulu_roles http_access
 
-	RESTART_REQ=0
-	uci_load obuspa
-	_update_obuspa_config_rbac
-	uci_commit obuspa
-
-	if [ "${_RESTART_SERVICES}" -eq "1" ] && [ "${RESTART_REQ}" -gt "0" ]; then
-		slog "Restarting obuspa..."
-		ubus call uci commit '{"config":"obuspa"}'
-	fi
-}
-
-configure_sulu() {
-	_create_mosquitto_acl
-	update_obuspa_config
-	generate_sulu_conn_config
-}
-
-while getopts ":rq" opt; do
-	case ${opt} in
-	r)
-		_RESTART_SERVICES="1"
-		;;
-	*)
-		slog "Invalid option: ${OPTARG}"
-		exit 1
-		;;
-	esac
-done
-
-configure_sulu
+generate_sulu_conn_config
+create_mosquitto_acl
+update_obuspa_config

sulu/sulu-builder/files/etc/uci-defaults/40-add-sulu-config

@@ -1,15 +1,16 @@
 #!/bin/sh
 
+. /lib/functions.sh
 UCI_TEMPLATE="/etc/nginx/uci.conf.template"
 
 if [ ! -f "/etc/config/mosquitto" ]; then
-	echo "Local mosquitto broker not available"
-	return 0
+	logger -t sulu.ucidefault "Local mosquitto broker not available"
+	return 1
 fi
 
 if [ ! -f "${UCI_TEMPLATE}" ]; then
-	echo "nginx utils not installed, sulu can't run"
-	return 0
+	logger -t sulu.ucidefault "nginx utils not installed, sulu can't run"
+	return 1
 fi
 
 update_nginx_uci_template()
@@ -19,7 +20,7 @@ update_nginx_uci_template()
 	port="$(uci -q get mosquitto.sulu.port)"
 	port="${port:-9009}"
 
-	if ! grep -q "upstream websocket" ${UCI_TEMPLATE}; then
+	if ! grep -w "upstream websocket" ${UCI_TEMPLATE} | grep -wq "127.0.0.1:${port}"; then
 		sed -i '/#UCI_HTTP_CONFIG$/i\   map $http_upgrade $connection_upgrade { default upgrade; "" close; }' ${UCI_TEMPLATE}
 		sed -i "/#UCI_HTTP_CONFIG$/i\   upstream websocket { server 127.0.0.1:${port}; }" ${UCI_TEMPLATE}
 	fi
@@ -27,37 +28,31 @@ update_nginx_uci_template()
 
 add_sulu_config_to_mosquitto()
 {
-	if ! uci_get mosquitto sulu >/dev/null 2>&1; then
-		uci_add mosquitto listener sulu
-		uci_set mosquitto sulu enabled 1
-		uci_set mosquitto sulu port '9009'
-		uci_set mosquitto sulu no_remote_access '1'
-		uci_set mosquitto sulu protocol 'websockets'
-		uci_set mosquitto sulu auth_plugin '/usr/lib/mosquitto_auth_shadow.so'
-		uci_set mosquitto sulu acl_file '/etc/sulu/mqtt.acl'
-	fi
+	uci_add mosquitto listener sulu
+	uci_set mosquitto sulu enabled 1
+	uci_set mosquitto sulu port '9009'
+	uci_set mosquitto sulu no_remote_access '1'
+	uci_set mosquitto sulu protocol 'websockets'
+	uci_set mosquitto sulu auth_plugin '/usr/lib/mosquitto_auth_plugin.so'
+	uci_set mosquitto sulu acl_file '/etc/sulu/mqtt.acl'
 }
 
 add_sulu_userinterface_uci()
 {
-	uci_load userinterface
-
-	if ! uci_get userinterface _sulu_s >/dev/null 2>&1; then
+	# check if sulu already configured
+	if ! uci show userinterface| grep -q "path_prefix='/sulu'"; then
 		uci_add userinterface http_access _sulu_s
 		uci_set userinterface _sulu_s path_prefix '/sulu'
 		uci_set userinterface _sulu_s port '8443'
-		uci_add_list userinterface _sulu_s _nginx_include '/etc/sulu/nginx.locations'
+		uci_set userinterface _sulu_s _nginx_include '/etc/sulu/nginx.locations'
 		uci_set userinterface _sulu_s _nginx_uci_manage_ssl 'self-signed'
 		uci_set userinterface _sulu_s _nginx_ssl_certificate '/etc/nginx/conf.d/_lan.crt'
 		uci_set userinterface _sulu_s _nginx_ssl_certificate_key '/etc/nginx/conf.d/_lan.key'
 		uci_set userinterface _sulu_s _nginx_ssl_session_cache 'none'
 		uci_set userinterface _sulu_s _nginx_error_page '503 /maintenance.html'
 		uci_set userinterface _sulu_s protocol 'HTTPS'
-		uci_add_list userinterface _sulu_s role 'admin'
-		uci_add_list userinterface _sulu_s role 'user'
-	fi
+		uci_set userinterface _sulu_s role 'admin user'
 
-	if ! uci_get userinterface _suluredirect >/dev/null 2>&1; then
 		uci_add userinterface http_access _suluredirect
 		uci_set userinterface _suluredirect redirect '_sulu_s'
 		uci_set userinterface _suluredirect protocol 'HTTP'

sulu/sulu-builder/files/etc/uci-defaults/41-make-sulu-default-ui

@@ -2,23 +2,16 @@
 
 . /lib/functions.sh
 
-uci_load nginx
-# this is to make sure to not mess up existing config
-if uci_get nginx _sulu_s >/dev/null 2>&1; then
-  exit 0
-fi
-
 update_default_nginx_listner() {
-
-  if [ ! -f /etc/config/nginx ]; then
-    return
+  if [ ! -f "/etc/config/nginx" ]; then
+    return 0
   fi
 
   if ! uci_get nginx _lan >/dev/null 2>&1; then
-    return
+    return 0
   fi
 
-  if ! opkg list-installed |grep -q "luci "; then
+  if ! opkg list-installed | grep -q "^luci "; then
     echo "Luci not installed, removing luci config"
     uci_remove nginx _lan
     uci_remove nginx _redirect2ssl
@@ -28,7 +21,7 @@ update_default_nginx_listner() {
     uci_add_list nginx _lan listen "[::]:8443 ssl default_server"
 
     if ! uci_get nginx _redirect2ssl >/dev/null 2>&1; then
-        return
+        return 0
     fi
 
     uci_remove nginx _redirect2ssl listen
@@ -39,17 +32,19 @@ update_default_nginx_listner() {
 }
 
 move_sulu_to_443_and_80() {
-  uci_load userinterface
-  if [ ! -f /etc/config/userinterface ]; then
-    return
+  if ! config_load userinterface; then
+    return 0
   fi
 
   set_port() {
-    local protocol
+    local protocol port
+
     config_get protocol "$1" protocol
-    if [ "$protocol" == "HTTPS" ]; then
+    config_get port "$1" port
+
+    if [ "$protocol" == "HTTPS" ] && [ "${port}" -eq "8443" ]; then
       uci_set userinterface "$1" port "443"
-    elif [ "$protocol" == "HTTP" ]; then
+    elif [ "$protocol" == "HTTP" ] && [ "${port}" -eq "8080" ]; then
       uci_set userinterface "$1" port "80"
     fi
   }

sulu/sulu-builder/files/etc/users/roles/user.json

@@ -7,6 +7,14 @@
       {
         "object": "Device.",
         "perm": ["PERMIT_ALL"]
+      },
+      {
+        "object": "Device.Firewall.Enable",
+        "perm": ["PERMIT_GET", "PERMIT_SUBS_VAL_CHANGE", "PERMIT_OBJ_INFO"]
+      },
+      {
+        "object": "Device.Firewall.Chain.*.Rule.",
+        "perm": ["PERMIT_NONE"]
       }
     ]
   }

sulu/sulu-theme-genexis/Makefile

@@ -5,7 +5,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=sulu-theme-genexis
-PKG_VERSION:=5.1.5
+PKG_VERSION:=5.2.12
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/gnx/sulu-theme-genexis

sulu/sulu-vendorext/Makefile

@@ -1,36 +0,0 @@
-include $(TOPDIR)/rules.mk
-
-PKG_NAME:=sulu-vendorext
-PKG_VERSION:=0.0.4
-
-PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)
-
-PKG_LICENSE:=BSD-3-Clause
-PKG_LICENSE_FILES:=none
-
-include $(INCLUDE_DIR)/package.mk
-include $(TOPDIR)/feeds/iopsys/bbfdm/bbfdm.mk
-
-
-define Package/sulu-vendorext
-  SECTION:=utils
-  CATEGORY:=Utilities
-  TITLE:=Adds sulu-vendorext extensions
-endef
-
-define Build/Compile
-endef
-
-define Package/sulu-vendorext/install
-	$(BBFDM_INSTALL_MS_PLUGIN) ./extn/X_GENEXIS_EU_firewall.json $(1) firewallmngr
-
-	$(BBFDM_INSTALL_MS_PLUGIN) ./extn/X_GENEXIS_EU.json $(1) sysmngr
-	$(BBFDM_INSTALL_MS_PLUGIN) ./extn/X_GENEXIS_EU_wan.json $(1) sysmngr
-
-	$(BBFDM_REGISTER_SERVICES) ./bbfdm_service.json $(1) suluvendorext
-	$(BBFDM_INSTALL_MS_DM) ./extn/X_IOWRT_EU_MAPController.json $(1) suluvendorext
-
-	$(CP) ./files/* $(1)/
-endef
-
-$(eval $(call BuildPackage,sulu-vendorext))

sulu/sulu-vendorext/bbfdm_service.json

@@ -1,16 +0,0 @@
-{
-  "daemon": {
-    "enable": "1",
-    "service_name": "suluvendorext",
-    "unified_daemon": false,
-    "services": [
-      {
-        "parent_dm": "Device.",
-        "object": "X_IOWRT_EU_MAPController"
-      }
-    ],
-    "config": {
-      "loglevel": "3"
-    }
-  }
-}

sulu/sulu-vendorext/extn/X_GENEXIS_EU.json

@@ -1,140 +0,0 @@
-{
-        "Device.DeviceInfo.X_GENEXIS_EU.": {
-                "type": "object",
-                "version": "1.00",
-                "protocols": [
-                        "cwmp",
-                        "usp"
-                ],
-                "access": false,
-                "array": false,
-                "is_primary_node": {
-                        "type": "boolean",
-                        "version": "1.00",
-                        "read": true,
-                        "write": false,
-                        "protocols": [
-                                "cwmp",
-                                "usp"
-                        ],
-                        "mapping": [
-                                {
-                                        "type": "uci",
-                                        "uci": {
-                                                "file": "heimgard",
-                                                "section": {
-                                                        "name": "routeragent"
-                                                },
-                                                "option": {
-                                                        "name": "is_master"
-                                                }
-                                        }
-                                }
-                        ]
-                },
-                "meshmode": {
-                        "type": "string",
-                        "version": "1.00",
-                        "read": true,
-                        "write": true,
-                        "protocols": [
-                                "cwmp",
-                                "usp"
-                        ],
-                        "mapping": [
-                                {
-                                        "rpc": "get",
-                                        "type": "ubus",
-                                        "ubus": {
-                                                "object": "meshmode",
-                                                "method": "status",
-                                                "key": "mode"
-                                        }
-                                },
-                                {
-                                        "rpc": "set",
-                                        "type": "ubus",
-                                        "ubus": {
-                                                "object": "meshmode",
-                                                "method": "change_meshmode",
-                                                "args": {
-                                                        "mode": "@Value"
-                                                }
-                                        }
-                                }
-                        ]
-                },
-                "wizardHasBeenUsed": {
-                        "type": "boolean",
-                        "version": "1.00",
-                        "read": true,
-                        "write": true,
-                        "protocols": [
-                                "cwmp",
-                                "usp"
-                        ],
-                        "mapping": [
-                                {
-                                        "type": "uci",
-                                        "uci": {
-                                                "file": "heimgard",
-                                                "section": {
-                                                        "name": "settings"
-                                                },
-                                                "option": {
-                                                        "name": "wizard_executed"
-                                                }
-                                        }
-                                }
-                        ]
-                },
-                "LocalTimeZone": {
-                        "type": "string",
-                        "version": "1.00",
-                        "read": true,
-                        "write": true,
-                        "protocols": [
-                                "cwmp",
-                                "usp"
-                        ],
-                        "mapping": [
-                                {
-                                        "type": "uci",
-                                        "uci": {
-                                                "file": "system",
-                                                "section": {
-                                                        "name": "@system[0]"
-                                                },
-                                                "option": {
-                                                        "name": "timezone"
-                                                }
-                                        }
-                                }
-                        ]
-                },
-                "LocalTimeZoneName": {
-                        "type": "string",
-                        "version": "1.00",
-                        "read": true,
-                        "write": true,
-                        "protocols": [
-                                "cwmp",
-                                "usp"
-                        ],
-                        "mapping": [
-                                {
-                                        "type": "uci",
-                                        "uci": {
-                                                "file": "system",
-                                                "section": {
-                                                        "name": "@system[0]"
-                                                },
-                                                "option": {
-                                                        "name": "zonename"
-                                                }
-                                        }
-                                }
-                        ]
-                }
-        }
-}

sulu/sulu-vendorext/extn/X_GENEXIS_EU_firewall.json

@@ -1,723 +0,0 @@
-{
-        "Device.Firewall.X_GENEXIS_EU.": {
-                "type": "object",
-                "protocols": [
-                        "cwmp",
-                        "usp"
-                ],
-                "access": false,
-                "array": false,
-                "Mode": {
-                        "type": "string",
-			"enumerations": [
-				"Low",
-				"low",
-				"Medium",
-				"medium",
-				"High",
-				"high",
-				"Custom",
-				"custom"
-			],
-                        "read": true,
-                        "write": true,
-                        "protocols": [
-                                "cwmp",
-                                "usp"
-                        ],
-                        "datatype": "string",
-                        "mapping": [
-                                {
-                                        "rpc": "get",
-                                        "type": "ubus",
-                                        "ubus": {
-                                                "object": "firewall_mode",
-                                                "method": "get",
-                                                "key": "mode"
-                                        }
-                                },
-                                {
-                                        "rpc": "set",
-                                        "type": "ubus",
-                                        "ubus": {
-                                                "object": "firewall_mode",
-                                                "method": "set",
-                                                "args": {
-                                                        "mode": "@Value"
-                                                }
-                                        }
-                                }
-                        ]
-		},
-		"Input": {
-			"type": "string",
-			"enumerations": [
-				"ACCEPT",
-				"REJECT",
-				"DROP"
-			],
-                        "read": true,
-                        "write": true,
-                        "protocols": [
-                                "cwmp",
-                                "usp"
-                        ],
-                        "datatype": "string",
-                        "mapping": [
-                                {
-                                        "type": "uci",
-                                        "uci": {
-                                                "file": "firewall",
-                                                "section": {
-                                                        "name": "@defaults[0]"
-                                                },
-                                                "option": {
-                                                        "name": "input"
-                                                }
-                                        }
-                                }
-                        ]
-		},
-		"Forward": {
-			"type": "string",
-			"enumerations": [
-				"ACCEPT",
-				"REJECT",
-				"DROP"
-			],
-                        "read": true,
-                        "write": true,
-                        "protocols": [
-                                "cwmp",
-                                "usp"
-                        ],
-                        "datatype": "string",
-                        "mapping": [
-                                {
-                                        "type": "uci",
-                                        "uci": {
-                                                "file": "firewall",
-                                                "section": {
-                                                        "name": "@defaults[0]"
-                                                },
-                                                "option": {
-                                                        "name": "forward"
-                                                }
-                                        }
-                                }
-                        ]
-                },
-		"Output": {
-			"type": "string",
-			"enumerations": [
-				"ACCEPT",
-				"REJECT",
-				"DROP"
-			],
-                        "read": true,
-                        "write": true,
-                        "protocols": [
-                                "cwmp",
-                                "usp"
-                        ],
-                        "datatype": "string",
-                        "mapping": [
-                                {
-                                        "type": "uci",
-                                        "uci": {
-                                                "file": "firewall",
-                                                "section": {
-                                                        "name": "@defaults[0]"
-                                                },
-                                                "option": {
-                                                        "name": "output"
-                                                }
-                                        }
-                                }
-                        ]
-		},
-		"Drop_invalid": {
-			"type": "boolean",
-                        "read": true,
-                        "write": true,
-                        "protocols": [
-                                "cwmp",
-                                "usp"
-                        ],
-			"datatype": "boolean",
-                        "mapping": [
-                                {
-                                        "type": "uci",
-                                        "uci": {
-                                                "file": "firewall",
-                                                "section": {
-                                                        "name": "@defaults[0]"
-                                                },
-                                                "option": {
-                                                        "name": "drop_invalid"
-                                                }
-                                        }
-                                }
-                        ]
-		},
-		"Synflood_protect": {
-			"type": "boolean",
-                        "read": true,
-                        "write": true,
-                        "protocols": [
-                                "cwmp",
-                                "usp"
-                        ],
-			"datatype": "boolean",
-                        "mapping": [
-                                {
-                                        "type": "uci",
-                                        "uci": {
-                                                "file": "firewall",
-                                                "section": {
-                                                        "name": "@defaults[0]"
-                                                },
-                                                "option": {
-                                                        "name": "synflood_protect"
-                                                }
-                                        }
-                                }
-                        ]
-		},
-		"ZoneNumberOfEntries": {
-			"type": "unsignedInt",
-			"protocols": [
-				"cwmp",
-				"usp"
-			],
-			"read": true,
-			"write": false,
-			"mapping": [
-				{
-					"type": "uci",
-					"uci": {
-						"file": "firewall",
-						"section": {
-							"type": "zone"
-						},
-						"option": {
-							"name": "@Count"
-						}
-					}
-				}
-			]
-		},
-		"Device.Firewall.X_GENEXIS_EU.Zone.{i}.": {
-			"type": "object",
-			"protocols": [
-				"cwmp",
-				"usp"
-			],
-			"access": true,
-			"array": true,
-			"mapping": {
-				"type": "uci",
-				"uci": {
-					"file": "firewall",
-					"section": {
-						"type": "zone"
-					},
-					"dmmapfile": "dmmap_firewall"
-				}
-			},
-			"Name": {
-				"type": "string",
-				"read": true,
-				"write": true,
-				"protocols": [
-					"cwmp",
-					"usp"
-				],
-				"datatype": "string",
-				"mapping": [
-					{
-						"type": "uci",
-						"uci": {
-							"file": "firewall",
-							"section": {
-								"type": "zone",
-								"index": "@i-1"
-							},
-							"option": {
-								"name": "name"
-							}
-						}
-					}
-				]
-			},
-			"Network": {
-				"type": "string",
-				"read": true,
-				"write": true,
-				"protocols": [
-					"cwmp",
-					"usp"
-				],
-				"list": {
-					"datatype": "string"
-				},
-				"mapping": [
-					{
-						"type": "uci",
-						"uci": {
-							"file": "firewall",
-							"section": {
-								"type": "zone",
-								"index": "@i-1"
-							},
-							"option": {
-								"name": "network"
-							}
-						}
-					}
-				]
-			},
-			"Masq": {
-				"type": "boolean",
-				"read": true,
-				"write": true,
-				"protocols": [
-					"cwmp",
-					"usp"
-				],
-				"datatype": "boolean",
-				"mapping": [
-					{
-						"type": "uci",
-						"uci": {
-							"file": "firewall",
-							"section": {
-								"type": "zone",
-								"index": "@i-1"
-							},
-							"option": {
-								"name": "masq"
-							}
-						}
-					}
-				]
-			},
-			"Masq_src": {
-				"type": "string",
-				"read": true,
-				"write": true,
-				"protocols": [
-					"cwmp",
-					"usp"
-				],
-				"list": {
-					"datatype": "string"
-				},
-				"mapping": [
-					{
-						"type": "uci",
-						"uci": {
-							"file": "firewall",
-							"section": {
-								"type": "zone",
-								"index": "@i-1"
-							},
-							"option": {
-								"name": "masq_src"
-							}
-						}
-					}
-				]
-			},
-			"Masq_dest": {
-				"type": "string",
-				"read": true,
-				"write": true,
-				"protocols": [
-					"cwmp",
-					"usp"
-				],
-				"list": {
-					"datatype": "string"
-				},
-				"mapping": [
-					{
-						"type": "uci",
-						"uci": {
-							"file": "firewall",
-							"section": {
-								"type": "zone",
-								"index": "@i-1"
-							},
-							"option": {
-								"name": "masq_dest"
-							}
-						}
-					}
-				]
-			},
-			"Masq_allow_invalid": {
-				"type": "boolean",
-				"read": true,
-				"write": true,
-				"protocols": [
-					"cwmp",
-					"usp"
-				],
-				"datatype": "boolean",
-				"mapping": [
-					{
-						"type": "uci",
-						"uci": {
-							"file": "firewall",
-							"section": {
-								"type": "zone",
-								"index": "@i-1"
-							},
-							"option": {
-								"name": "masq_allow_invalid"
-							}
-						}
-					}
-				]
-			},
-			"Mtu_fix": {
-				"type": "boolean",
-				"read": true,
-				"write": true,
-				"protocols": [
-					"cwmp",
-					"usp"
-				],
-				"description": "MSS clamping",
-				"datatype": "boolean",
-				"mapping": [
-					{
-						"type": "uci",
-						"uci": {
-							"file": "firewall",
-							"section": {
-								"type": "zone",
-								"index": "@i-1"
-							},
-							"option": {
-								"name": "mtu_fix"
-							}
-						}
-					}
-				]
-			},
-			"Input": {
-				"type": "string",
-				"enumerations": [
-					"ACCEPT",
-					"REJECT",
-					"DROP"
-				],
-				"read": true,
-				"write": true,
-				"protocols": [
-					"cwmp",
-					"usp"
-				],
-				"datatype": "string",
-				"mapping": [
-					{
-						"type": "uci",
-						"uci": {
-							"file": "firewall",
-							"section": {
-								"type": "zone",
-								"index": "@i-1"
-							},
-							"option": {
-								"name": "input"
-							}
-						}
-					}
-				]
-			},
-			"Forward": {
-				"type": "string",
-				"enumerations": [
-					"ACCEPT",
-					"REJECT",
-					"DROP"
-				],
-				"read": true,
-				"write": true,
-				"protocols": [
-					"cwmp",
-					"usp"
-				],
-				"datatype": "string",
-				"mapping": [
-					{
-						"type": "uci",
-						"uci": {
-							"file": "firewall",
-							"section": {
-								"type": "zone",
-								"index": "@i-1"
-							},
-							"option": {
-								"name": "forward"
-							}
-						}
-					}
-				]
-			},
-			"Output": {
-				"type": "string",
-				"enumerations": [
-					"ACCEPT",
-					"REJECT",
-					"DROP"
-				],
-				"read": true,
-				"write": true,
-				"protocols": [
-					"cwmp",
-					"usp"
-				],
-				"datatype": "string",
-				"mapping": [
-					{
-						"type": "uci",
-						"uci": {
-							"file": "firewall",
-							"section": {
-								"type": "zone",
-								"index": "@i-1"
-							},
-							"option": {
-								"name": "output"
-							}
-						}
-					}
-				]
-			},
-			"Family": {
-				"type": "string",
-				"read": true,
-				"write": true,
-				"protocols": [
-					"cwmp",
-					"usp"
-				],
-				"datatype": "string",
-				"mapping": [
-					{
-						"type": "uci",
-						"uci": {
-							"file": "firewall",
-							"section": {
-								"type": "zone",
-								"index": "@i-1"
-							},
-							"option": {
-								"name": "family"
-							}
-						}
-					}
-				]
-			},
-			"Log": {
-				"type": "unsignedInt",
-				"read": true,
-				"write": true,
-				"protocols": [
-					"cwmp",
-					"usp"
-				],
-				"datatype": "unsignedInt",
-				"mapping": [
-					{
-						"type": "uci",
-						"uci": {
-							"file": "firewall",
-							"section": {
-								"type": "zone",
-								"index": "@i-1"
-							},
-							"option": {
-								"name": "log"
-							}
-						}
-					}
-				]
-			},
-			"Device": {
-				"type": "string",
-				"read": true,
-				"write": true,
-				"protocols": [
-					"cwmp",
-					"usp"
-				],
-				"list": {
-					"datatype": "string"
-				},
-				"mapping": [
-					{
-						"type": "uci",
-						"uci": {
-							"file": "firewall",
-							"section": {
-								"type": "zone",
-								"index": "@i-1"
-							},
-							"option": {
-								"name": "device"
-							}
-						}
-					}
-				]
-			},
-			"Subnet": {
-				"type": "string",
-				"read": true,
-				"write": true,
-				"protocols": [
-					"cwmp",
-					"usp"
-				],
-				"list": {
-					"datatype": "string"
-				},
-				"mapping": [
-					{
-						"type": "uci",
-						"uci": {
-							"file": "firewall",
-							"section": {
-								"type": "zone",
-								"index": "@i-1"
-							},
-							"option": {
-								"name": "subnet"
-							}
-						}
-					}
-				]
-			},
-			"Auto_helper": {
-				"type": "boolean",
-				"read": true,
-				"write": true,
-				"protocols": [
-					"cwmp",
-					"usp"
-				],
-				"datatype": "boolean",
-				"mapping": [
-					{
-						"type": "uci",
-						"uci": {
-							"file": "firewall",
-							"section": {
-								"type": "zone",
-								"index": "@i-1"
-							},
-							"option": {
-								"name": "auto_helper"
-							}
-						}
-					}
-				]
-			}
-		},
-		"ForwardingNumberOfEntries": {
-			"type": "unsignedInt",
-			"protocols": [
-				"cwmp",
-				"usp"
-			],
-			"read": true,
-			"write": false,
-			"mapping": [
-				{
-					"type": "uci",
-					"uci": {
-						"file": "firewall",
-						"section": {
-							"type": "forwarding"
-						},
-						"option": {
-							"name": "@Count"
-						}
-					}
-				}
-			]
-		},
-		"Device.Firewall.X_GENEXIS_EU.Forwarding.{i}.": {
-			"type": "object",
-			"protocols": [
-				"cwmp",
-				"usp"
-			],
-			"access": true,
-			"array": true,
-			"mapping": {
-				"type": "uci",
-				"uci": {
-					"file": "firewall",
-					"section": {
-						"type": "forwarding"
-					},
-					"dmmapfile": "dmmap_firewall"
-				}
-			},
-			"Src": {
-				"type": "string",
-				"read": true,
-				"write": true,
-				"protocols": [
-					"cwmp",
-					"usp"
-				],
-				"datatype": "string",
-				"mapping": [
-					{
-						"type": "uci",
-						"uci": {
-							"file": "firewall",
-							"section": {
-								"type": "forwarding",
-								"index": "@i-1"
-							},
-							"option": {
-								"name": "src"
-							}
-						}
-					}
-				]
-			},
-			"Dest": {
-				"type": "string",
-				"read": true,
-				"write": true,
-				"protocols": [
-					"cwmp",
-					"usp"
-				],
-				"datatype": "string",
-				"mapping": [
-					{
-						"type": "uci",
-						"uci": {
-							"file": "firewall",
-							"section": {
-								"type": "forwarding",
-								"index": "@i-1"
-							},
-							"option": {
-								"name": "dest"
-							}
-						}
-					}
-				]
-			}
-		}
-	}
-}

sulu/sulu-vendorext/extn/X_GENEXIS_EU_wan.json

@@ -1,487 +0,0 @@
-{
-    "Device.DeviceInfo.X_GENEXIS_EU.Wan.": {
-        "type": "object",
-        "version": "1.00",
-        "protocols": [
-            "cwmp",
-            "usp"
-        ],
-        "access": false,
-        "array": false,
-        "proto": {
-            "type": "string",
-            "version": "1.00",
-            "read": true,
-            "write": true,
-            "protocols": [
-                "cwmp",
-                "usp"
-            ],
-            "mapping": [
-                {
-                    "rpc": "get",
-                    "type": "ubus",
-                    "ubus": {
-                        "object": "genexis.wan",
-                        "method": "get",
-                        "args": {
-                            "param": "proto"
-                        },
-                        "key": "proto"
-                    }
-                },
-                {
-                    "rpc": "set",
-                    "type": "ubus",
-                    "ubus": {
-                        "object": "genexis.wan",
-                        "method": "set",
-                        "args": {
-                            "param": "proto",
-                            "value": "@Value"
-                        }
-                    }
-                }
-            ]
-        },
-        "ipaddr": {
-            "type": "string",
-            "version": "1.00",
-            "read": true,
-            "write": true,
-            "protocols": [
-                "cwmp",
-                "usp"
-            ],
-            "mapping": [
-                {
-                    "rpc": "get",
-                    "type": "ubus",
-                    "ubus": {
-                        "object": "genexis.wan",
-                        "method": "status",
-                        "args": {},
-                        "key": "ipaddr"
-                    }
-                },
-                {
-                    "rpc": "set",
-                    "type": "uci",
-                    "uci": {
-                        "file": "network",
-                        "section": {
-                            "name": "wan"
-                        },
-                        "option": {
-                            "name": "ipaddr"
-                        }
-                    }
-                }
-            ]
-        },
-        "netmask": {
-            "type": "string",
-            "version": "1.00",
-            "read": true,
-            "write": true,
-            "protocols": [
-                "cwmp",
-                "usp"
-            ],
-            "mapping": [
-                {
-                    "rpc": "get",
-                    "type": "ubus",
-                    "ubus": {
-                        "object": "genexis.wan",
-                        "method": "status",
-                        "args": {},
-                        "key": "netmask"
-                    }
-                },
-                {
-                    "type": "uci",
-                    "uci": {
-                        "file": "network",
-                        "section": {
-                            "name": "wan"
-                        },
-                        "option": {
-                            "name": "netmask"
-                        }
-                    }
-                }
-            ]
-        },
-        "gateway": {
-            "type": "string",
-            "version": "1.00",
-            "read": true,
-            "write": true,
-            "protocols": [
-                "cwmp",
-                "usp"
-            ],
-            "mapping": [
-                {
-                    "rpc": "get",
-                    "type": "ubus",
-                    "ubus": {
-                        "object": "genexis.wan",
-                        "method": "status",
-                        "args": {},
-                        "key": "gateway"
-                    }
-                },
-                {
-                    "type": "uci",
-                    "uci": {
-                        "file": "network",
-                        "section": {
-                            "name": "wan"
-                        },
-                        "option": {
-                            "name": "gateway"
-                        }
-                    }
-                }
-            ]
-        },
-        "peerdns": {
-            "type": "boolean",
-            "version": "1.00",
-            "read": true,
-            "write": true,
-            "protocols": [
-                "cwmp",
-                "usp"
-            ],
-            "mapping": [
-                {
-                    "type": "uci",
-                    "uci": {
-                        "file": "network",
-                        "section": {
-                            "name": "wan"
-                        },
-                        "option": {
-                            "name": "peerdns"
-                        }
-                    }
-                }
-            ]
-        },
-        "dns": {
-            "type": "string",
-            "version": "1.00",
-            "read": true,
-            "write": true,
-            "protocols": [
-                "cwmp",
-                "usp"
-            ],
-            "mapping": [
-                {
-                    "type": "uci",
-                    "uci": {
-                        "file": "network",
-                        "section": {
-                            "name": "wan"
-                        },
-                        "option": {
-                            "name": "dns"
-                        }
-                    }
-                }
-            ]
-        },
-        "hostname": {
-            "type": "string",
-            "version": "1.00",
-            "read": true,
-            "write": true,
-            "protocols": [
-                "cwmp",
-                "usp"
-            ],
-            "mapping": [
-                {
-                    "type": "uci",
-                    "uci": {
-                        "file": "network",
-                        "section": {
-                            "name": "wan"
-                        },
-                        "option": {
-                            "name": "hostname"
-                        }
-                    }
-                }
-            ]
-        },
-        "NAT": {
-            "type": "string",
-            "version": "1.00",
-            "read": true,
-            "write": true,
-            "protocols": [
-                "cwmp",
-                "usp"
-            ],
-            "mapping": [
-                {
-                    "type": "uci",
-                    "uci": {
-                        "file": "firewall",
-                        "section": {
-                            "name": "wan"
-                        },
-                        "option": {
-                            "name": "masq"
-                        }
-                    }
-                }
-            ]
-        },
-        "mtu": {
-            "type": "unsignedInt",
-            "version": "1.00",
-            "read": true,
-            "write": true,
-            "protocols": [
-                "cwmp",
-                "usp"
-            ],
-            "mapping": [
-                {
-                    "type": "uci",
-                    "uci": {
-                        "file": "network",
-                        "section": {
-                            "name": "wan"
-                        },
-                        "option": {
-                            "name": "mtu"
-                        }
-                    }
-                }
-            ]
-        },
-        "vid": {
-            "type": "unsignedInt",
-            "version": "1.00",
-            "read": true,
-            "write": true,
-            "protocols": [
-                "cwmp",
-                "usp"
-            ],
-            "mapping": [
-                {
-                    "rpc": "get",
-                    "type": "ubus",
-                    "ubus": {
-                        "object": "genexis.wan",
-                        "method": "get",
-                        "args": {
-                            "param": "vid"
-                        },
-                        "key": "vid"
-                    }
-                },
-                {
-                    "rpc": "set",
-                    "type": "ubus",
-                    "ubus": {
-                        "object": "genexis.wan",
-                        "method": "set",
-                        "args": {
-                            "param": "vid",
-                            "value": "@Value"
-                        }
-                    }
-                }
-            ]
-        },
-        "username": {
-            "type": "string",
-            "version": "1.00",
-            "read": true,
-            "write": true,
-            "protocols": [
-                "cwmp",
-                "usp"
-            ],
-            "mapping": [
-                {
-                    "rpc": "get",
-                    "type": "ubus",
-                    "ubus": {
-                        "object": "genexis.wan",
-                        "method": "get",
-                        "args": {
-                            "param": "username"
-                        },
-                        "key": "username"
-                    }
-                },
-                {
-                    "rpc": "set",
-                    "type": "ubus",
-                    "ubus": {
-                        "object": "genexis.wan",
-                        "method": "set",
-                        "args": {
-                            "param": "username",
-                            "value": "@Value"
-                        }
-                    }
-                }
-            ]
-        },
-        "password": {
-            "type": "string",
-            "version": "1.00",
-            "read": true,
-            "write": true,
-            "protocols": [
-                "cwmp",
-                "usp"
-            ],
-            "mapping": [
-                {
-                    "rpc": "get",
-                    "type": "ubus",
-                    "ubus": {
-                        "object": "genexis.wan",
-                        "method": "get",
-                        "args": {
-                            "param": "password"
-                        },
-                        "key": "password"
-                    }
-                },
-                {
-                    "rpc": "set",
-                    "type": "ubus",
-                    "ubus": {
-                        "object": "genexis.wan",
-                        "method": "set",
-                        "args": {
-                            "param": "password",
-                            "value": "@Value"
-                        }
-                    }
-                }
-            ]
-        },
-        "service": {
-            "type": "string",
-            "version": "1.00",
-            "read": true,
-            "write": true,
-            "protocols": [
-                "cwmp",
-                "usp"
-            ],
-            "mapping": [
-                {
-                    "rpc": "get",
-                    "type": "ubus",
-                    "ubus": {
-                        "object": "genexis.wan",
-                        "method": "get",
-                        "args": {
-                            "param": "service"
-                        },
-                        "key": "service"
-                    }
-                },
-                {
-                    "rpc": "set",
-                    "type": "ubus",
-                    "ubus": {
-                        "object": "genexis.wan",
-                        "method": "set",
-                        "args": {
-                            "param": "service",
-                            "value": "@Value"
-                        }
-                    }
-                }
-            ]
-        },
-        "ac": {
-            "type": "string",
-            "version": "1.00",
-            "read": true,
-            "write": true,
-            "protocols": [
-                "cwmp",
-                "usp"
-            ],
-            "mapping": [
-                {
-                    "rpc": "get",
-                    "type": "ubus",
-                    "ubus": {
-                        "object": "genexis.wan",
-                        "method": "get",
-                        "args": {
-                            "param": "ac"
-                        }
-                    },
-                    "key": "ac"
-                },
-                {
-                    "rpc": "set",
-                    "type": "ubus",
-                    "ubus": {
-                        "object": "genexis.wan",
-                        "method": "set",
-                        "args": {
-                            "param": "ac",
-                            "value": "@Value"
-                        }
-                    }
-                }
-            ]
-        },
-        "keepalive": {
-            "type": "string",
-            "version": "1.00",
-            "read": true,
-            "write": true,
-            "protocols": [
-                "cwmp",
-                "usp"
-            ],
-            "mapping": [
-                {
-                    "rpc": "get",
-                    "type": "ubus",
-                    "ubus": {
-                        "object": "genexis.wan",
-                        "method": "get",
-                        "args": {
-                            "param": "keepalive"
-                        },
-                        "key": "keepalive"
-                    }
-                },
-                {
-                    "rpc": "set",
-                    "type": "ubus",
-                    "ubus": {
-                        "object": "genexis.wan",
-                        "method": "set",
-                        "args": {
-                            "param": "keepalive",
-                            "value": "@Value"
-                        }
-                    }
-                }
-            ]
-        }
-    }
-}

sulu/sulu-vendorext/extn/X_IOWRT_EU_MAPController.json

@@ -1,353 +0,0 @@
-{
-  "json_plugin_version": 2,
-  "Device.X_IOWRT_EU_MAPController.": {
-    "type": "object",
-    "protocols": [
-      "usp"
-    ],
-    "access": false,
-    "array": false,
-    "Device.X_IOWRT_EU_MAPController.Controller.": {
-      "type": "object",
-      "protocols": [
-        "usp"
-      ],
-      "access": false,
-      "array": false,
-      "dependency": "file:/etc/config/mapcontroller",
-      "Enable": {
-        "type": "boolean",
-        "read": true,
-        "write": true,
-        "protocols": [
-          "usp"
-        ],
-        "default": true,
-        "mapping": [
-          {
-            "type": "uci",
-            "uci": {
-              "file": "mapcontroller",
-              "section": {
-                "name": "controller"
-              },
-              "option": {
-                "name": "enabled"
-              }
-            }
-          }
-        ]
-      },
-      "ChannelPlan": {
-        "type": "unsignedInt",
-        "read": true,
-        "write": true,
-        "protocols": [
-          "usp"
-        ],
-        "mapping": [
-          {
-            "type": "uci",
-            "uci": {
-              "file": "mapcontroller",
-              "section": {
-                "name": "controller"
-              },
-              "option": {
-                "name": "channel_plan_interval"
-              }
-            }
-          }
-        ]
-      },
-      "AllowBackgroundDFS": {
-        "type": "unsignedInt",
-        "read": true,
-        "write": true,
-        "protocols": [
-          "usp"
-        ],
-        "mapping": [
-          {
-            "type": "uci",
-            "uci": {
-              "file": "mapcontroller",
-              "section": {
-                "name": "controller"
-              },
-              "option": {
-                "name": "bgdfs_interval"
-              }
-            }
-          }
-        ]
-      },
-      "TrafficSeparation": {
-        "type": "boolean",
-        "read": true,
-        "write": true,
-        "protocols": [
-          "usp"
-        ],
-        "mapping": [
-          {
-            "type": "uci",
-            "uci": {
-              "file": "mapcontroller",
-              "section": {
-                "name": "controller"
-              },
-              "option": {
-                "name": "traffic_separation"
-              }
-            }
-          }
-        ]
-      },
-      "InitialChannelScan": {
-        "type": "boolean",
-        "read": true,
-        "write": true,
-        "protocols": [
-          "usp"
-        ],
-        "mapping": [
-          {
-            "type": "uci",
-            "uci": {
-              "file": "mapcontroller",
-              "section": {
-                "name": "controller"
-              },
-              "option": {
-                "name": "initial_scan"
-              }
-            }
-          }
-        ]
-      }
-    },
-    "Device.X_IOWRT_EU_MAPController.AccessPoint.{i}.": {
-      "type": "object",
-      "protocols": [
-        "usp"
-      ],
-      "access": true,
-      "array": true,
-      "mapping": [
-        {
-          "type": "uci",
-          "uci": {
-            "file": "mapcontroller",
-            "section": {
-              "type": "ap"
-            },
-            "dmmapfile": "dmmap_mapcontroller"
-          }
-        }
-      ],
-      "Band": {
-        "type": "string",
-        "read": true,
-        "write": true,
-        "protocols": [
-          "usp"
-        ],
-        "mapping": [
-          {
-            "type": "uci_sec",
-            "data": "@Parent",
-            "key": "band"
-          }
-        ]
-      },
-      "SSID": {
-        "type": "string",
-        "read": true,
-        "write": true,
-        "protocols": [
-          "usp"
-        ],
-        "mapping": [
-          {
-            "type": "uci_sec",
-            "data": "@Parent",
-            "key": "ssid"
-          }
-        ]
-      },
-      "Encryption": {
-        "type": "string",
-        "read": true,
-        "write": true,
-        "protocols": [
-          "usp"
-        ],
-        "mapping": [
-          {
-            "type": "uci_sec",
-            "data": "@Parent",
-            "key": "encryption"
-          }
-        ]
-      },
-      "Key": {
-        "type": "string",
-        "read": true,
-        "write": true,
-        "protocols": [
-          "usp"
-        ],
-        "flags": [
-          "Secure"
-        ],
-        "mapping": [
-          {
-            "type": "uci_sec",
-            "data": "@Parent",
-            "key": "key"
-          }
-        ]
-      },
-      "HaulType": {
-        "type": "string",
-        "read": true,
-        "write": true,
-        "protocols": [
-          "usp"
-        ],
-        "default": "fronthaul",
-        "mapping": [
-          {
-            "type": "uci_sec",
-            "data": "@Parent",
-            "key": "type"
-          }
-        ]
-      },
-      "NetworkType": {
-        "type": "string",
-        "read": true,
-        "write": true,
-        "protocols": [
-          "usp"
-        ],
-        "default": "Primary",
-        "mapping": [
-          {
-            "type": "uci_sec",
-            "data": "@Parent",
-            "key": "network_type"
-          }
-        ]
-      },
-      "VID": {
-        "type": "unsignedInt",
-        "read": true,
-        "write": true,
-        "protocols": [
-          "usp"
-        ],
-        "default": 1,
-        "mapping": [
-          {
-            "type": "uci_sec",
-            "data": "@Parent",
-            "key": "vid"
-          }
-        ]
-      },
-      "Enable": {
-        "type": "boolean",
-        "read": true,
-        "write": true,
-        "protocols": [
-          "usp"
-        ],
-        "default": true,
-        "mapping": [
-          {
-            "type": "uci_sec",
-            "data": "@Parent",
-            "key": "enabled"
-          }
-        ]
-      }
-    },
-    "Device.X_IOWRT_EU_MAPController.STASteering.": {
-      "type": "object",
-      "protocols": [
-        "usp"
-      ],
-      "access": false,
-      "array": false,
-      "dependency": "file:/etc/config/mapcontroller",
-      "STASteering": {
-        "type": "boolean",
-        "read": true,
-        "write": true,
-        "protocols": [
-          "usp"
-        ],
-        "mapping": [
-          {
-            "type": "uci",
-            "uci": {
-              "file": "mapcontroller",
-              "section": {
-                "name": "sta_steering"
-              },
-              "option": {
-                "name": "enable_sta_steer"
-              }
-            }
-          }
-        ]
-      },
-      "BackhaulSTASteering": {
-        "type": "boolean",
-        "read": true,
-        "write": true,
-        "protocols": [
-          "usp"
-        ],
-        "mapping": [
-          {
-            "type": "uci",
-            "uci": {
-              "file": "mapcontroller",
-              "section": {
-                "name": "sta_steering"
-              },
-              "option": {
-                "name": "enable_bsta_steer"
-              }
-            }
-          }
-        ]
-      },
-      "BandSteering": {
-        "type": "boolean",
-        "read": true,
-        "write": true,
-        "protocols": [
-          "usp"
-        ],
-        "mapping": [
-          {
-            "type": "uci",
-            "uci": {
-              "file": "mapcontroller",
-              "section": {
-                "name": "sta_steering"
-              },
-              "option": {
-                "name": "bandsteer"
-              }
-            }
-          }
-        ]
-      }
-    }
-  }
-}

sulu/sulu-vendorext/files/etc/config/heimgard

@@ -1,36 +0,0 @@
-config ota 'ota'
-  # Allow firmware upgrades, defaults true
-  option firmware 'true'
-  # Allow download of arbituary files
-  option file_download 'true'
-  # Allow to download software packages
-  option software 'false'
-  # Allow to download personalization files (isp/customer settings)
-  option customer_settings 'false'
-  option mirror_url '$fwenv$upgrade_ota_url|https://upgradeserver$'
-  option crontab_entry "$(date +%M) * * * *"
-  list softwarelist 'ping_container'
-  list softwarelist 'pingcom_ota'
-  option interval 'nightly'
-  option registry_service_enabled '$fwenv$registry_service_enabled|1$'
-  option registry_service_url '$fwenv$registry_service_url|https://registry.hc-apis.com$'
-  option verbose_level '6'
-
-config routeragent 'routeragent'
-  option is_master 'false'
-  option onboarded 'false'
-
-config containers 'containers'
-  list 'cnt_list' 'f-secure'
-  list 'cnt_list' 'lxc_hello_world'
-
-config services 'state'
-  option mwan3 'disable'
- 
-config links 'help_support'
-	option support_link 'https://genexis.eu/solutions/support-services/'
-	option faq_link ''
-	option contact_link 'https://genexis.eu/contact'
-	option contact_phone ''
-	option livechat_link ''
-	option contact_times 'Monday – Friday from 09:00 – 17:00'

sulu/sulu-vendorext/files/etc/init.d/hmg_ap_to_mld_creds_sync

@@ -1,92 +0,0 @@
-#!/bin/sh /etc/rc.common
-
-START=97
-USE_PROCD=1
-
-start_service() {
-	# --- STEP 1: process fronthaul APs with mld_id ---
-	mld_ids=$(uci show mapcontroller | grep "^mapcontroller.@ap\[" | cut -d'=' -f1 | while read -r ap; do
-		[ "$(uci -q get "$ap.type")" = "fronthaul" ] || continue
-		uci -q get "$ap.mld_id"
-	done | sort -u | grep -v '^$')
-
-	for mld_id in $mld_ids; do
-		ap_list=""
-		ssid_ref=""
-		key_ref=""
-		ssid_mismatch=0
-
-		# collect all fronthaul APs with this mld_id
-		for ap in $(uci show mapcontroller | grep "^mapcontroller.@ap\[" | cut -d'=' -f1); do
-			[ "$(uci -q get "$ap.type")" = "fronthaul" ] || continue
-			cur_id=$(uci -q get "$ap.mld_id")
-			[ "$cur_id" = "$mld_id" ] || continue
-
-			cur_ssid=$(uci -q get "$ap.ssid")
-			cur_key=$(uci -q get "$ap.key")
-
-			ap_list="$ap_list $ap"
-
-			if [ -z "$ssid_ref" ]; then
-				ssid_ref="$cur_ssid"
-				key_ref="$cur_key"
-			elif [ "$cur_ssid" != "$ssid_ref" ]; then
-				ssid_mismatch=1
-			fi
-		done
-
-		if [ "$ssid_mismatch" -eq 1 ]; then
-			for ap in $ap_list; do
-				logger -t mldsync "Removing mld_id from $ap due to SSID mismatch"
-				uci -q delete "$ap.mld_id"
-			done
-		else
-			for mld in $(uci show mapcontroller | grep "^mapcontroller.@mld\[" | cut -d'=' -f1); do
-				[ "$(uci -q get "$mld.id")" = "$mld_id" ] || continue
-				logger -t mldsync "Updating $mld with ssid=$ssid_ref and key=$key_ref"
-				uci -q set "$mld.ssid=$ssid_ref"
-				uci -q set "$mld.key=$key_ref"
-			done
-		fi
-	done
-
-	# --- STEP 2: handle fronthaul APs with no mld_id but same SSID ---
-	for ssid in $(uci show mapcontroller | grep "^mapcontroller.@ap\[" | cut -d'=' -f1 | while read -r ap; do
-		[ "$(uci -q get "$ap.type")" = "fronthaul" ] || continue
-		[ -z "$(uci -q get "$ap.mld_id")" ] || continue
-		uci -q get "$ap.ssid"
-	done | sort | uniq); do
-		ap_group=""
-		key_ref=""
-		count=0
-
-		for ap in $(uci show mapcontroller | grep "^mapcontroller.@ap\[" | cut -d'=' -f1); do
-			[ "$(uci -q get "$ap.type")" = "fronthaul" ] || continue
-			[ "$(uci -q get "$ap.ssid")" = "$ssid" ] || continue
-			[ -z "$(uci -q get "$ap.mld_id")" ] || continue
-			ap_group="$ap_group $ap"
-			key_ref=$(uci -q get "$ap.key")
-			count=$((count + 1))
-		done
-
-		[ "$count" -lt 2 ] && continue
-
-		for ap in $ap_group; do
-			logger -t mldsync "Assigning mld_id=1 to $ap (ssid=$ssid)"
-			uci -q set "$ap.mld_id=1"
-		done
-
-		for mld in $(uci show mapcontroller | grep "^mapcontroller.@mld\[" | cut -d'=' -f1); do
-			[ "$(uci -q get "$mld.id")" = "1" ] || continue
-			logger -t mldsync "Updating $mld with ssid=$ssid and key=$key_ref (from unassigned group)"
-			uci -q set "$mld.ssid=$ssid"
-			uci -q set "$mld.key=$key_ref"
-		done
-	done
-
-	uci -q commit mapcontroller
-}
-
-service_triggers() {
-	procd_add_reload_trigger "mapcontroller"
-}

sulu/sulu-vendorext/files/etc/init.d/sulu_widgets

@@ -1,63 +0,0 @@
-#!/bin/sh /etc/rc.common
-#
-# This script will hide sulu widgets depending on router mode.
-# This is achieved by creating a widget-presets.json file
-# overriding the visibilityControl for each hidden widget.
-#
-# Note: widget names must be unique!
-#
-
-START=61
-
-HIDDEN_WIDGETS_PPPOE=""
-HIDDEN_WIDGETS_BRIDGE="wan-dash wan heimgard-dhcp heimgard-static-lease heimgard-firewall heimgard-internet-access heimgard-upnp"
-HIDDEN_WIDGETS_ROUTER=""
-
-output_file="/sulu/widget-presets/widget-presets.json"
-
-start() {
-	local mode hidden_widgets
-
-	mode=$(ubus call meshmode status | jsonfilter -e '@.mode')
-
-	case "$mode" in
-		pppoe)
-			hidden_widgets=$HIDDEN_WIDGETS_PPPOE
-		;;
-		bridge)
-			hidden_widgets=$HIDDEN_WIDGETS_BRIDGE
-		;;
-		router)
-			hidden_widgets=$HIDDEN_WIDGETS_ROUTER
-		;;
-		default)
-			logger -t "Sulu widgets" "Unable to determine device mode"
-			return 1
-		;;
-	esac
-
-	output_dir=$(dirname "$output_file")
-	if [ ! -d "$output_dir" ]; then
-		mkdir -p "$output_dir"
-	fi
-
-	echo "{" > "$output_file"
-
-	first=1
-	for widget in $hidden_widgets; do
-		if [ $first -eq 0 ]; then
-			echo "  ," >> "$output_file"
-		fi
-		first=0
-
-		echo '  "'$widget'": {' >> "$output_file"
-		echo '    "visibilityControl": "hide"' >> "$output_file"
-		echo '  }' >> "$output_file"
-	done
-
-	echo "}" >> "$output_file"
-}
-
-reload() {
-        start
-}

sulu/sulu-vendorext/files/lib/sulu_functions.sh

@@ -1,198 +0,0 @@
-#!/bin/sh
-# shellcheck disable=SC1091,SC3043,SC3043
-
-. /usr/share/libubox/jshn.sh
-. /lib/functions/network.sh
-
-persistent_file="/tmp/sulu.json"
-
-init_json() {
-	json_init
-	[ -f "${persistent_file}" ] && json_load_file "${persistent_file}"
-	json_add_int "schema_version" "1"
-	if ! json_select "network" >/dev/null; then
-		json_add_object "network"
-	fi
-
-	if ! json_select "wan" >/dev/null; then
-		local current_dev=""
-		local current_proto=""
-		local current_vid=""
-		local current_mtu=""
-		local current_username=""
-		local current_password=""
-		local default_gw_interface=""
-		# Load current settings
-		network_find_wan default_gw_interface
-		[ -z "${default_gw_interface}" ] && default_gw_interface="wan"
-		current_dev="$(uci -q get network."${default_gw_interface}".device)"
-		current_proto="$(uci -q get network."${default_gw_interface}".proto || echo "dhcp")"
-		current_vid="$(uci -q get network."${current_dev}".vid)"
-		current_mtu="$(uci -q get network."${default_gw_interface}".mtu)"
-		if [ "pppoe" = "${current_proto}" ]; then
-			current_username="$(uci -q get network."${default_gw_interface}".username)"
-			current_password="$(uci -q get network."${default_gw_interface}".password)"
-		fi
-		json_add_array "wan"
-		json_add_object
-		json_add_string "name" "wan"
-		json_add_string "proto" "${current_proto}"
-		[ -n "${current_vid}" ] && json_add_int "vlan_id" "${current_vid}"
-		[ -n "${current_mtu}" ] && json_add_int "mtu" "${current_mtu}"
-		[ -n "${current_username}" ] && json_add_string "username" "${current_username}"
-		[ -n "${current_password}" ] && json_add_string "password" "${current_password}"
-		json_close_object
-	fi
-	json_close_object
-	json_close_object
-	if ! json_select "netmode" >/dev/null; then
-		json_add_object "netmode"
-	fi
-	json_close_object
-}
-
-save_and_exit() {
-	json_dump >"${persistent_file}"
-	exit 0
-}
-
-save_userconf() {
-	json_dump >"${persistent_file}"
-	# reload opconf to apply changes from persistent file, discarding output
-	opconf "${persistent_file}" > /dev/null 2>&1
-	# Commit network changes
-	ubus call uci commit '{"config": "network"}'
-}
-
-# Create skeleton file if it doesn't exists after that load in $persistent_file
-init_json
-
-go_L2() {
-	logger -s -p user.info -t "netmode" "User has manually chosen L2; switching to Layer2 mode"
-	local old_cb
-	json_set_namespace set_wan_param old_cb
-	init_json
-	json_select "netmode"
-	json_add_string "current" "layer2"
-	json_select ..
-	save_userconf
-	json_set_namespace old_cb
-}
-
-# Set netmode in uboot to correct mode, remove marker so network config is regenerated and reboot
-go_L3() {
-	logger -p user.info -t "netmode" "User has manually chosen L3; switching to Layer3/Full mode"
-	local old_cb
-	json_set_namespace set_wan_param old_cb
-	init_json
-	json_select "network"
-	json_select "wan"
-	if ! json_is_a 1 object; then
-		json_add_object
-	else
-		json_select 1
-	fi
-	json_add_string "name" "wan"
-	json_add_string "proto" "dhcp"
-	json_add_int "vlan_id" 0
-	json_close_object
-	json_select ..
-	json_select ..
-	json_select "netmode"
-	json_add_string "current" "layer3"
-	json_select ..
-	save_userconf
-	json_set_namespace old_cb
-}
-
-go_pppoe() {
-	local username="${1}"
-	local password="${2}"
-	local enable_vid="${3:-1}"
-	local vid="${4:-0}"
-	local mtu="${5:-1500}"
-	local old_cb
-	json_set_namespace set_wan_param old_cb
-	init_json
-	logger -p user.info -t "netmode" "User has manually chosen pppoe; switching to pppoe mode"
-	logger -p user.info -t "netmode" "params - username:${username} password:${password} enable:${enable_vid} vid:${vid} mtu:${mtu}"
-	json_select "network"
-	json_select "wan"
-	if ! json_is_a 1 object; then
-		json_add_object
-	else
-		json_select 1
-	fi
-	json_add_string "name" "wan"
-	json_add_string "proto" "pppoe"
-	json_add_int "vlan_id" "${vid}"
-	json_add_string "username" "${username}"
-	json_add_string "password" "${password}"
-	json_add_int "mtu" "${mtu}"
-	json_close_object
-	json_select ..
-	json_select ..
-	json_select "netmode"
-	json_add_string "current" "pppoe"
-	save_userconf
-	json_set_namespace old_cb
-}
-
-# shellcheck disable=SC3043
-set_wan_param() {
-	local name="${1:?}"
-	local value="${2:?}"
-	# shellcheck disable=SC2034
-	local old_cb
-	json_set_namespace set_wan_param old_cb
-	init_json
-	json_select "network"
-	json_select "wan"
-	if ! json_is_a 1 object; then
-		json_add_object
-	else
-		json_select 1
-	fi
-	json_add_string "name" "wan"
-	case "${name}" in
-	proto | username | password)
-		json_add_string "${name}" "${value}"
-		;;
-	vid | vland_id)
-		json_add_int "vlan_id" "${value}"
-		;;
-	mtu)
-		json_add_int "mtu" "${value}"
-		;;
-	*)
-		logger "sulu_functions: Unkown name '${name}' in set_wan_param"
-		;;
-	esac
-	json_close_object
-	json_select ..
-	json_select ..
-	logger -s "sulu_functions Name: '${name}'='${value}'"
-	save_userconf
-	json_set_namespace old_cb
-}
-# shellcheck disable=SC3043
-# Parses all jsons in /opconf, returns active variable_name
-get_wan_value() {
-	local variable_name="${1:?}"
-	local value_from_opconf=""
-	local final_config=""
-	local json_file=""
-
-	case "${variable_name}" in
-	"vid")
-		variable_name="vlan_id"
-		;;
-	*) ;;
-	esac
-
-	for json_file in /opconf/*.json ${persistent_file}; do
-		value_from_opconf="$(jsonfilter -e "@.network.wan[@.name='wan'].${variable_name}" <"${json_file}")"
-		[ -n "${value_from_opconf}" ] && final_config="${value_from_opconf}"
-	done
-	echo "${final_config}"
-}

sulu/sulu-vendorext/files/usr/libexec/rpcd/firewall_mode

@@ -1,147 +0,0 @@
-#!/bin/sh
-
-. /usr/share/libubox/jshn.sh
-
-get_fwmode() {
-	uci -q get firewall.globals.mode || echo "custom"
-}
-
-set_fwmode() {
-	local mode=$1
-	local allow_gw_rule="allow_gw_in"
-	local services="http https smtp pop3 imap ssh"
-	local ports="80 443 25 110 143 22"
-
-	uci set firewall.globals.mode="$mode"
-
-	# Set some defaults and start from a clean slate
-	uci set firewall.lan.input='ACCEPT'
-	uci set firewall.lan.output='ACCEPT'
-	uci set firewall.lan.forward='ACCEPT'
-
-	uci set firewall.wan.input='REJECT'
-	uci set firewall.wan.output='ACCEPT'
-	uci set firewall.wan.forward='REJECT'
-
-	# remove rules from low mode
-	uci -q delete firewall.${allow_gw_rule}
-
-	# remove rules from high mode
-	for service in $services; do
-		uci -q delete firewall.allow_${service}_out
-	done
-
-	# handle any custom zones and forwardings
-	for zone in $(uci show firewall | grep "=zone" | cut -d'.' -f2 | cut -d'=' -f1); do
-		if [ "$zone" == "lan" ] || [ "$zone" == "wan" ]; then
-			continue
-		fi
-		if [ "$mode" == "custom" ]; then
-			uci set firewall.${zone}.enabled=1
-		else
-			uci set firewall.${zone}.enabled=0
-		fi
-	done
-	for forwarding in $(uci show firewall | grep "=forwarding" | cut -d'.' -f2 | cut -d'=' -f1); do
-		if [ "$forwarding" == "default_fwd_1" ]; then
-			continue
-		fi
-		if [ "$mode" == "custom" ]; then
-			uci set firewall.${forwarding}.enabled=1
-		else
-			uci set firewall.${forwarding}.enabled=0
-		fi
-	done
-
-	# Now set mode specific presets
-	case "$mode" in
-	low)
-		# add rule for incoming gateway
-		json_init
-		json_load "$(ubus -S call genexis.wan status)"
-		json_get_var gateway gateway
-
-		if [ -n "$gateway" ]; then
-			uci set firewall.${allow_gw_rule}=rule
-			uci set firewall.${allow_gw_rule}.name='Allow-Gateway-In'
-			uci set firewall.${allow_gw_rule}.src='wan'
-			uci set firewall.${allow_gw_rule}.src_ip="$gateway"
-			uci set firewall.${allow_gw_rule}.target='ACCEPT'
-			uci reorder firewall.${allow_gw_rule}=1
-		fi
-		;;
-	medium)
-		uci set firewall.wan.input='DROP'
-		uci set firewall.wan.forward='DROP'
-		;;
-	high)
-		uci set firewall.wan.input='DROP'
-		uci set firewall.wan.output='REJECT'
-		uci set firewall.wan.forward='DROP'
-
-		# add rules for outgoing services
-		i=1
-		for service in $services; do
-			port=$(echo $ports | cut -d' ' -f$i)
-			uci set firewall.allow_${service}_out=rule
-			uci set firewall.allow_${service}_out.name="Allow-${service}-Out"
-			uci set firewall.allow_${service}_out.src='lan'
-			uci set firewall.allow_${service}_out.dest='wan'
-			uci set firewall.allow_${service}_out.proto='tcp'
-			uci set firewall.allow_${service}_out.dest_port="$port"
-			uci set firewall.allow_${service}_out.target='ACCEPT'
-			uci reorder firewall.allow_${service}_out=1
-			i=$((i + 1))
-		done
-		;;
-	custom)
-		uci -q delete firewall.globals.mode # keep or not keep?
-		# in custom mode we will get additional usp calls to set config directly towards uci
-		;;
-	esac
-
-	ubus call uci commit '{"config": "firewall"}'
-	logger -t "firewall.ubus" "Commited and applied new firewall config"
-}
-
-fwmode="$(get_fwmode)"
-
-case "$1" in
-list)
-	echo '{ "get" : {}, "set" : {"mode":"String"}}'
-	;;
-call)
-	case "$2" in
-	get)
-
-		if [ -n "$fwmode" ]; then
-			echo '{"mode": "'"$fwmode"'"}'
-		else
-			echo '{"error": "Could not detect mode"}'
-		fi
-		;;
-	set)
-		# Read the JSON object provided for the arguments
-		read -r input
-
-		json_load "${input}"
-		json_get_var mode mode
-
-		mode=$(echo "$mode" | tr 'A-Z' 'a-z')
-		case "$mode" in
-		low | medium | high | custom)
-			if [ "$mode" == "$fwmode" ]; then
-				echo '{"status": "No change"}'
-				return
-			fi
-			set_fwmode "$mode"
-			echo '{"status": "Ok"}'
-			;;
-		*)
-			echo '{"error": "Incorrect mode ('"$mode"')"}'
-			;;
-		esac
-		;;
-	esac
-	;;
-esac

sulu/sulu-vendorext/files/usr/libexec/rpcd/genexis.wan

@@ -1,110 +0,0 @@
-#!/bin/sh
-# shellcheck disable=SC3043,SC1091,SC2140
-. /usr/share/libubox/jshn.sh
-. /lib/functions/network.sh
-. /lib/sulu_functions.sh
-
-cidr_to_netmask() {
-    value=$((0xffffffff ^ ((1 << (32 - $1)) - 1)))
-    echo "$(((value >> 24) & 0xff)).$(((value >> 16) & 0xff)).$(((value >> 8) & 0xff)).$((value & 0xff))"
-}
-
-# setValue() - Set the value of the given WAN parameter.
-#
-# Args:
-#  $1 - The parameter name.
-#  $2 - The new value of the parameter.
-#
-# Notes:
-#  If the parameter name is "vid", the value of the "vid" option is read from
-#  the appropriate section (based on the value of the "device" option in the
-#  "network.wan" section). Otherwise, the value of the parameter is read from
-#  the "network.wan" section.
-#
-#  If the parameter name is "vid", it is checked if the value is 0, 1 or empty.
-#  If so, it does not create a new vlan interface. Otherwise, it creates a new
-#  vlan interface with the given vid.
-setValue() {
-    local paramName="${1}"
-    local paramValue="${2}"
-    local default_gw_interface=""
-    network_find_wan default_gw_interface
-    if [ -z "${default_gw_interface}" ]; then
-        default_gw_interface=wan
-    fi
-    case "$paramName" in
-    "vid")
-        set_wan_param "vid" "$paramValue"
-        ;;
-    "username")
-        set_wan_param "username" "$paramValue"
-        ;;
-    "password")
-		set_wan_param "password" "$paramValue"
-        ;;
-    "mtu")
-		set_wan_param "mtu" "$paramValue"
-        ;;
-     "proto")
-		set_wan_param "proto" "${paramValue}"
-        touch /tmp/netmode_changed
-        ;;
-    *)
-        ;;
-    esac
-}
-
-case "$1" in
-list)
-    json_init
-    json_add_object "status"
-    json_close_object
-    json_add_object "get"
-    json_add_string "param" ""
-    json_close_object
-    json_add_object "set"
-    json_add_string "param" ""
-    json_close_object
-    json_dump
-
-    ;;
-call)
-    case "$2" in
-    status)
-        network_find_wan default_gw_interface
-        wan_json="$(ubus call network.interface."${default_gw_interface}" status)"
-        ipaddr="$(echo "$wan_json" | jsonfilter -e '@["ipv4-address"][0].address')"
-        netmask="$(echo "$wan_json" | jsonfilter -e '@["ipv4-address"][0].mask')"
-        gateway="$(echo "$wan_json" | jsonfilter -e '@["route"][0].nexthop')"
-        if [ -n "$netmask" ]; then
-            netmask=$(cidr_to_netmask "$netmask")
-        fi
-        json_init
-        json_add_string ipaddr "$ipaddr"
-        json_add_string netmask "$netmask"
-        json_add_string gateway "$gateway"
-        json_dump
-        ;;
-    get)
-        read -r input
-        _param=$(echo "$input" | jsonfilter -e '@.param')
-        value="$(get_wan_value "$_param")"
-
-        json_init
-        json_add_string "$_param" "${value}"
-        json_dump
-        ;;
-
-    set)
-        read -r input
-        _param="$(echo "$input" | jsonfilter -e '@.param')"
-        value="$(echo "$input" | jsonfilter -e '@.value')"
-        logger -t "genexis.wan" "_param: ${_param} value: ${value}"
-        json_init
-        reply="$(set_wan_param "$_param" "$value")"
-        json_add_string "status" "${reply}"
-        json_dump
-        ;;
-    esac
-    ;;
-esac

sulu/sulu-vendorext/files/usr/libexec/rpcd/meshmode

@@ -1,93 +0,0 @@
-#!/bin/sh
-# shellcheck disable=SC3043,SC1091
-. /usr/share/libubox/jshn.sh
-. /lib/sulu_functions.sh
-
-init_json
-
-get_netmode() {
-	local _netmode
-	if [ -f "${persistent_file}" ]; then
-		json_init
-		json_load_file "${persistent_file}"
-		if json_select netmode; then
-			json_get_var _netmode current "unknown"
-			json_select ..
-		fi
-	else
-		_netmode="unknown"
-	fi
-
-	case "${_netmode}" in
-	extender | layer2)
-		echo "bridge"
-		;;
-	layer3)
-		echo "router"
-		;;
-	pppoe)
-		echo "pppoe"
-		;;
-	*)
-		ifstatus wan >/dev/null 2>&1 && echo "router" || echo "unknown"
-		;;
-	esac
-}
-
-netmode="$(get_netmode)"
-
-case "$1" in
-list)
-	echo '{ "status" : {}, "change_meshmode" : {"mode":"String"}}'
-	;;
-call)
-	mode=""
-	case "$2" in
-	status)
-		if [ -z "${netmode}" ]; then
-			echo "{\"status\":\"Mode unknown\"}"
-		else
-			echo "{\"mode\":\"${netmode}\"}"
-		fi
-		;;
-	change_meshmode)
-		# Read the JSON object provided for the arguments
-		read -r input
-
-		json_load "${input}"
-
-		json_get_var mode mode
-
-		if [ "${mode}" = "${netmode}" ] && [ "${mode}" != "pppoe" ] && [ ! -f /tmp/netmode_changed ]; then
-			echo '{"status":"no_change"}' && return
-		fi
-
-		if [ "${mode}" = "bridge" ]; then
-			echo '{"status": "ok"}'
-			go_L2
-		elif [ "${mode}" = "router" ]; then
-			echo '{"status": "ok"}'
-			go_L3
-		elif [ "${mode}" = "pppoe" ]; then
-			username="$(get_wan_value "username")"
-			password="$(get_wan_value "password")"
-			vid="$(get_wan_value "vlan_id")"
-			mtu="$(get_wan_value "mtu")"
-
-			enable=0
-			if [ "${vid}" -gt 0 ]; then
-				enable=1
-			fi
-
-			echo '{"status": "ok"}'
-			logger "'${username}' '${password}' '${enable}' '${vid}' '${mtu}'"
-			go_pppoe "${username}" "${password}" "${enable}" "${vid}" "${mtu}"
-		else
-			echo '{"status":"Wrong value"}'
-		fi
-		;;
-	*) ;;
-	esac
-	;;
-*) ;;
-esac

sulu/sulu-vendorext/files/usr/libexec/rpcd/voip

@@ -1,32 +0,0 @@
-#!/bin/sh
-. /usr/share/libubox/jshn.sh
-
-case "$1" in
-        list)
-                echo '{ "reset" : {"sip": "string"} }'
-        ;;
-        call)
-                case "$2" in
-                        reset)
-                                read input;
-                                sip=`echo $input | jsonfilter -e '@.sip'`
-                                
-				if [ "$sip" == "" ] || [ ! $(uci -q get asterisk.$sip) ]; then
-					result="incorrect parameter $input"
-				else
-					ubus call uci set '{"config":"asterisk", "section":"'$sip'", "values": {"enable":"0"}}'
-					ubus call uci commit '{"config":"asterisk"}'
-					ubus call uci set '{"config":"asterisk", "section":"'$sip'", "values": {"enable":"1"}}'
-					ubus call uci commit '{"config":"asterisk"}'
-					result="ok"
-				fi
-
-                                json_init
-                                json_add_string "status" "$result"
-                                json_dump
-                        ;;
-
-                esac
-        ;;
-esac
-

sysmngr/Makefile

@@ -5,13 +5,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=sysmngr
-PKG_VERSION:=1.0.28
+PKG_VERSION:=1.0.28.4
 
 LOCAL_DEV:=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/system/sysmngr.git
-PKG_SOURCE_VERSION:=5a3b6d0cbb023353c1b16069d68f203589b77e27
+PKG_SOURCE_VERSION:=d3a1696735f520dd853b13afbbc7aadd3c749c42
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_MIRROR_HASH:=skip
 endif

sysmngr/files/etc/sysmngr/fwbank

@@ -22,7 +22,30 @@ fwbank_get_bootbank() {
 
 case "$1" in
 	list)
-		echo '{ "dump" : {}, "set_bootbank" : {"bank":32}, "copy_config" : {}, "upgrade": {"path":"String","auto_activate":true,"bank":32,"keep_settings":true}}'
+		json_init
+		json_add_object "dump"
+		json_close_object
+
+		json_add_object "set_bootbank"
+		json_add_int "bank" 32
+		json_close_object
+
+		json_add_object "copy_config"
+		json_add_boolean "keep_settings" 1
+		json_add_boolean "keep_opconf" 1
+		json_add_string "config_scope" "String"
+		json_close_object
+
+		json_add_object "upgrade"
+		json_add_string "path" "String"
+		json_add_boolean "auto_activate" 1
+		json_add_int "bank" 32
+		json_add_boolean "keep_settings" 1
+		json_add_boolean "keep_opconf" 1
+		json_add_string "config_scope" "String"
+		json_add_boolean "reboot" 1
+		json_close_object
+		json_dump
 	;;
 	call)
 		case "$2" in
@@ -125,19 +148,44 @@ case "$1" in
 				fi
 			;;
 			copy_config)
-				if [ -z "$UPGRADE_BACKUP" ]; then
-					UPGRADE_BACKUP=/tmp/sysupgrade.tgz
+				read -r input
+				json_load "${input}"
+				json_get_var keep_settings keep_settings
+				json_get_var keep_opconf keep_opconf
+				json_get_var config_scope config_scope
+
+				# Set the default value for keep_settings
+				keep_settings=${keep_settings:-1}
+
+				if command -v "opconf_conf_handler" >/dev/null 2>&1; then
+					if ! mountpoint -q /usr_data; then
+						logger -t sysmngr.fwbank "copy_config: usr_data partition not present"
+						config_scope="All"
+					fi
+
+					arg="-k ${keep_settings}"
+					[ -n  "${keep_opconf}" ] && arg="${arg} -o ${keep_opconf}"
+					[ -n  "${config_scope}" ] && arg="${arg} -s ${config_scope}"
+
+					opconf_conf_handler ${arg}
+				else
+					# Fallback to default old behaviour in case opconf not present
+					config_scope="All"
 				fi
 
 				ret=0
+				if [ "${keep_settings}" -eq "1" ] && [ "${config_scope}" = "All" ]; then
+					if [ -z "$UPGRADE_BACKUP" ]; then
+						UPGRADE_BACKUP=/tmp/sysupgrade.tgz
+					fi
 
-				sysupgrade -b "$UPGRADE_BACKUP" || ret=1
-
-				if [ "$ret" -eq 0 ]; then
-					if command -v platform_copy_config >/dev/null 2>&1; then
-						platform_copy_config 1>&2 || ret=1
-					else
-						ret=1
+					sysupgrade -b "$UPGRADE_BACKUP" || ret=1
+					if [ "$ret" -eq 0 ]; then
+						if command -v platform_copy_config >/dev/null 2>&1; then
+							platform_copy_config 1>&2 || ret=1
+						else
+							ret=1
+						fi
 					fi
 				fi
 
@@ -157,6 +205,9 @@ case "$1" in
 				json_get_var auto_activate auto_activate
 				json_get_var bank bank
 				json_get_var keep_settings keep_settings
+				json_get_var keep_opconf keep_opconf
+				json_get_var config_scope config_scope
+				json_get_var reboot reboot
 
 				ret=0
 
@@ -180,6 +231,7 @@ case "$1" in
 
 				# Set the default value for keep_settings
 				keep_settings=${keep_settings:-1}
+				reboot=${reboot:-0}
 
 				# This ubus call does not reboot the system at any one time.
 				# Although, the newly upgraded bank is activated by default.
@@ -187,14 +239,36 @@ case "$1" in
 				# "--no-activate" otherwise.
 				sysupgrade_flag=""
 				if [ "${auto_activate}" -eq 1 ]; then
-					sysupgrade_flag="--no-reboot"
+					if [ "${reboot}" -eq 0 ]; then
+						sysupgrade_flag="--no-reboot"
+					fi
 				else
 					sysupgrade_flag="--no-activate"
 				fi
 
+				if command -v "opconf_conf_handler" >/dev/null 2>&1; then
+					if ! mountpoint -q /usr_data; then
+						logger -t sysmngr.fwbank "upgrade: usr_data partition not present"
+						config_scope="All"
+					fi
+
+					arg="-k ${keep_settings}"
+					[ -n  "${keep_opconf}" ] && arg="${arg} -o ${keep_opconf}"
+					[ -n  "${config_scope}" ] && arg="${arg} -s ${config_scope}"
+
+					opconf_conf_handler ${arg}
+				else
+					# Fallback to default old behaviour in case opconf not present
+					config_scope="All"
+				fi
+
 				# Set the flag to do not save configuration over reflash
 				if [ "${keep_settings}" -eq 0 ]; then
 					sysupgrade_flag="${sysupgrade_flag} -n"
+				elif [ "${keep_settings}" -eq 1 ]; then
+					if [ "${config_scope}" != "All" ]; then
+						sysupgrade_flag="${sysupgrade_flag} -n"
+					fi
 				fi
 
 				# Call sysupgrade synchonously. It should not time out the ubus call,