Draft: datamodel for shell exec

Remove peripheral_manager, it is no longer used or maintainted.

Signed-off-by: Andreas Gnau <andreas.gnau@iopsys.eu>

bbfdm/Makefile

@@ -5,13 +5,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=bbfdm
-PKG_VERSION:=1.17.1
+PKG_VERSION:=1.18.2
 
 USE_LOCAL:=0
 ifneq ($(USE_LOCAL),1)
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/bbf/bbfdm.git
-PKG_SOURCE_VERSION:=d4bc6eea946d994f27758478d3b0a1d4a9298850
+PKG_SOURCE_VERSION:=786863cf0ef48dd70610598cdf8e2bbc0462a504
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_MIRROR_HASH:=skip
 endif
@@ -55,7 +55,7 @@ define Package/dm-service
   CATEGORY:=Utilities
   SUBMENU:=TRx69
   TITLE:=Datamodel ubus backend to expose micro-service tree
-  DEPENDS:=+libuci +libubox +libubus +libblobmsg-json +libjson-c +libbbfdm-api +libbbfdm-ubus +bbf_configmngr
+  DEPENDS:=+libuci +libubox +libubus +libblobmsg-json +libjson-c +libbbfdm-api +libbbfdm-ubus +bbf_configmngr +libeasy
 endef
 
 define Package/bbf_configmngr
@@ -183,6 +183,7 @@ define Package/bbf_configmngr/install
 
 	$(INSTALL_BIN) ./files/etc/init.d/bbf_configd $(1)/etc/init.d/bbf_configd
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/utilities/files/usr/share/bbfdm/scripts/bbf_config_notify.sh $(1)/usr/share/bbfdm/scripts/
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/utilities/files/usr/share/bbfdm/scripts/bbf_default_reload.sh $(1)/etc/bbfdm/
 	$(INSTALL_DATA) ./files/etc/bbfdm/critical_services.json $(1)/etc/bbfdm/
 endef
 

bbfdm/files/etc/bbfdm/critical_services.json

@@ -1,23 +1,51 @@
 {
 	"usp": [
-			"firewall",
-			"network",
-			"dhcp",
-			"time",
-			"wireless",
-			"ieee1905",
-			"mapcontroller",
-			"mosquitto",
-			"nginx",
-			"netmode"
+			"/etc/config/firewall",
+			"/etc/bbfdm/dmmap/dmmap_firewall",
+			"/etc/config/network",
+			"/etc/bbfdm/dmmap/IP",
+			"/etc/bbfdm/dmmap/Ethernet",
+			"/etc/bbfdm/dmmap/GRE",
+			"/etc/bbfdm/dmmap/IPv6rd",
+			"/etc/bbfdm/dmmap/PPP",
+			"/etc/bbfdm/dmmap/Routing",
+			"/etc/config/dhcp",
+			"/etc/bbfdm/dmmap/dmmap_dhcp",
+			"/etc/bbfdm/dmmap/dmmap_dhcp_client",
+			"/etc/bbfdm/dmmap/dmmap_dhcp_relay",
+			"/etc/bbfdm/dmmap/dmmap_dhcpv6",
+			"/etc/config/time",
+			"/etc/bbfdm/dmmap/dmmap_time",
+			"/etc/config/mapcontroller",
+			"/etc/config/wireless",
+			"/etc/bbfdm/dmmap/WiFi",
+			"/etc/config/ieee1905",
+			"/etc/config/mosquitto",
+			"/etc/config/nginx",
+			"/etc/config/netmode",
+			"/etc/bbfdm/dmmap/dmmap_netmode"
 	],
 	"cwmp": [
-			"firewall",
-			"network",
-			"dhcp",
-			"mapcontroller",
-			"wireless",
-			"time",
-			"netmode"
+			"/etc/config/firewall",
+			"/etc/bbfdm/dmmap/dmmap_firewall",
+			"/etc/config/network",
+			"/etc/bbfdm/dmmap/IP",
+			"/etc/bbfdm/dmmap/Ethernet",
+			"/etc/bbfdm/dmmap/GRE",
+			"/etc/bbfdm/dmmap/IPv6rd",
+			"/etc/bbfdm/dmmap/PPP",
+			"/etc/bbfdm/dmmap/Routing",
+			"/etc/config/dhcp",
+			"/etc/bbfdm/dmmap/dmmap_dhcp",
+			"/etc/bbfdm/dmmap/dmmap_dhcp_client",
+			"/etc/bbfdm/dmmap/dmmap_dhcp_relay",
+			"/etc/bbfdm/dmmap/dmmap_dhcpv6",
+			"/etc/config/mapcontroller",
+			"/etc/config/wireless",
+			"/etc/bbfdm/dmmap/WiFi",
+			"/etc/config/time",
+			"/etc/bbfdm/dmmap/dmmap_time",
+			"/etc/config/netmode",
+			"/etc/bbfdm/dmmap/dmmap_netmode"
 	]
 }

bbfdm/files/etc/init.d/bbf_configd

@@ -27,6 +27,6 @@ start_service()
 service_triggers() {
 	for config_file in /etc/config/*; do
 		config_name=$(basename "$config_file")
-		procd_add_config_trigger "config.change" "$config_name" /usr/share/bbfdm/scripts/bbf_config_notify.sh
+		procd_add_config_trigger "config.change" "$config_name" /usr/share/bbfdm/scripts/bbf_config_notify.sh "$config_name"
 	done
 }

decollector/Makefile

@@ -6,12 +6,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=decollector
-PKG_VERSION:=6.2.1.8
+PKG_VERSION:=6.2.1.12
 
 LOCAL_DEV=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_VERSION:=6ea13241f76c6dde663dec58c3facb50f81906b6
+PKG_SOURCE_VERSION:=ce738316065e4608811312f0a254d1fee22fa343
 PKG_SOURCE_URL:=https://dev.iopsys.eu/multi-ap/decollector.git
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_MIRROR_HASH:=skip

dmexec/Makefile

@@ -0,0 +1,44 @@
+#
+# Copyright (C) 2025 iopsys Software Solutions AB
+#
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=dmexec
+PKG_VERSION:=0.0.1
+PKG_RELEASE:=1
+PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)
+PKG_LICENSE:=GPL-2.0-only
+
+include $(INCLUDE_DIR)/package.mk
+include $(TOPDIR)/feeds/iopsys/bbfdm/bbfdm.mk
+
+define Package/dmexec
+  SECTION:=utils
+  CATEGORY:=Utilities
+  TITLE:=Datamodel for shell exec
+  DEPENDS:=+dm-service
+endef
+
+define Package/dmexec/description
+  datamodel extension for running shell commands.
+endef
+
+define Build/Compile
+	# pass
+endef
+
+define Package/dmexec/install
+	$(INSTALL_DIR) $(1)/etc/config
+	$(INSTALL_DIR) $(1)/etc/init.d
+
+	$(INSTALL_DATA) ./files/etc/config/dmexec $(1)/etc/config/
+	$(INSTALL_BIN) ./files/etc/init.d/dmexec $(1)/etc/init.d/
+
+	$(BBFDM_REGISTER_SERVICES) ./bbfdm_service.json $(1) $(PKG_NAME)
+	$(BBFDM_INSTALL_MS_DM) ./files/dm_exec.json $(1) $(PKG_NAME)
+endef
+
+$(eval $(call BuildPackage,dmexec))

dmexec/bbfdm_service.json

@@ -0,0 +1,16 @@
+{
+  "daemon": {
+    "enable": "1",
+    "service_name": "dmexec",
+    "unified_daemon": false,
+    "services": [
+      {
+        "parent_dm": "Device.",
+        "object": "X_GENEXIS_EU_CLI"
+      }
+    ],
+    "config": {
+      "loglevel": "7"
+    }
+  }
+}

dmexec/files/dm_exec.json

@@ -0,0 +1,81 @@
+{
+  "json_plugin_version": 2,
+  "Device.X_GENEXIS_EU_CLI.": {
+    "type": "object",
+    "protocols": [
+      "cwmp",
+      "usp"
+    ],
+    "access": false,
+    "array": false,
+    "Enable": {
+      "type": "boolean",
+      "read": true,
+      "write": true,
+      "protocols": [
+        "cwmp",
+        "usp"
+      ],
+      "mapping": [
+        {
+          "type": "uci",
+          "uci": {
+            "file": "dmexec",
+            "section": {
+              "name": "dmexec"
+            },
+            "option": {
+              "name": "enable"
+            }
+          }
+        }
+      ]
+    },
+    "REQUEST": {
+      "type": "string",
+      "read": true,
+      "write": true,
+      "protocols": [
+        "cwmp",
+        "usp"
+      ],
+      "mapping": [
+        {
+          "type": "uci",
+          "uci": {
+            "file": "dmexec",
+            "section": {
+              "name": "dmexec"
+            },
+            "option": {
+              "name": "cmd"
+            }
+          }
+        }
+      ]
+    },
+    "RESULT": {
+      "type": "string",
+      "read": true,
+      "write": false,
+      "protocols": [
+        "cwmp",
+	"usp"
+      ],
+      "mapping": [
+        {
+          "type": "uci",
+          "uci": {
+            "file": "dmexec",
+            "section": {
+              "name": "dmexec"
+            },
+            "option": {
+              "name": "result"
+            }
+          }
+        }
+      ]
+    }
+  }
+}

dmexec/files/etc/config/dmexec

@@ -0,0 +1,3 @@
+config dmexec 'dmexec'
+	option enable '0'
+

dmexec/files/etc/init.d/dmexec

@@ -0,0 +1,40 @@
+#!/bin/sh /etc/rc.common
+
+START=99
+STOP=01
+
+USE_PROCD=1
+
+log() {
+	logger -t dmexec.init "$*"
+}
+
+start_service() {
+	procd_open_instance
+	procd_close_instance
+}
+
+reload_service() {
+	local cmd result enable
+
+	enable="$(uci -q get dmexec.dmexec.enable)"
+	enable="${enable:-0}"
+
+	if [ "${enable}" -eq "0" ]; then
+		log "dmexec is disabled"
+	fi
+
+	uci -q set dmexec.dmexec.result=""
+	cmd="$(uci -q get dmexec.dmexec.cmd)"
+	if [ -n "${cmd}" ]; then
+		log "Executing [${cmd}]"
+		result="$(eval $cmd 2>&1 |head -n 1 |head -c 256)"
+		result="${result//\'/}"
+		uci -q set dmexec.dmexec.result="${result}"
+		uci commit dmexec
+	fi
+}
+
+service_triggers() {
+	procd_add_reload_trigger dmexec
+}

fluent-bit/patches/0002-add_hostname_to_log_dump.patch

@@ -1,45 +0,0 @@
-diff --git a/plugins/out_file/file.c b/plugins/out_file/file.c
-index 2e47c9666..95d28e438 100644
---- a/plugins/out_file/file.c
-+++ b/plugins/out_file/file.c
-@@ -27,6 +27,7 @@
- #include <msgpack.h>
- 
- #include <stdio.h>
-+#include <unistd.h>
- #include <sys/types.h>
- #include <sys/stat.h>
- #include <fcntl.h>
-@@ -55,6 +56,7 @@ struct flb_file_conf {
-     int csv_column_names;
-     int mkdir;
-     struct flb_output_instance *ins;
-+    char hostname[256];
- };
- 
- static char *check_delimiter(const char *str)
-@@ -141,6 +143,9 @@ static int cb_file_init(struct flb_output_instance *ins,
-         }
-     }
- 
-+    if (gethostname(ctx->hostname, sizeof(ctx->hostname)) != 0)
-+	    snprintf(ctx->hostname, sizeof(ctx->hostname), "%s", "localhost");
-+
-     tmp = flb_output_get_property("delimiter", ins);
-     ret_str = check_delimiter(tmp);
-     if (ret_str != NULL) {
-@@ -233,12 +238,8 @@ static int template_output_write(struct flb_file_conf *ctx,
-     int i;
-     msgpack_object_kv *kv;
- 
--    /*
--     * Right now we treat "{time}" specially and fill the placeholder
--     * with the metadata timestamp (formatted as float).
--     */
--    if (!strncmp(key, "time", size)) {
--        fprintf(fp, "%f", flb_time_to_double(tm));
-+    if (!strncmp(key, "hostname", size)) {
-+        fprintf(fp, "%s", ctx->hostname);
-         return 0;
-     }
- 

fluent-bit/patches/0002-file_out_time.patch

@@ -0,0 +1,27 @@
+diff --git a/plugins/out_file/file.c b/plugins/out_file/file.c
+index 77baf6be8..04c519d5a 100644
+--- a/plugins/out_file/file.c
++++ b/plugins/out_file/file.c
+@@ -238,10 +238,20 @@ static int template_output_write(struct flb_file_conf *ctx,
+ 
+     /*
+      * Right now we treat "{time}" specially and fill the placeholder
+-     * with the metadata timestamp (formatted as float).
++     * with the metadata timestamp.
+      */
+     if (!strncmp(key, "time", size)) {
+-        fprintf(fp, "%f", flb_time_to_double(tm));
++        struct tm tm_local;
++        char buf[32];
++        if (localtime_r(&tm->tm.tv_sec, &tm_local) == NULL) {
++            flb_plg_error(ctx->ins, "localtime_r failed");
++            return -1;
++        }
++        if (strftime(buf, sizeof(buf), "%b %d %H:%M:%S", &tm_local) == 0) {
++            flb_plg_error(ctx->ins, "strftime failed");
++            return -1;
++        }
++        fputs(buf, fp);
+         return 0;
+     }
+ 

fluent-bit/patches/0005-kmsg_log.patch

@@ -1,37 +0,0 @@
-diff --git a/plugins/in_kmsg/in_kmsg.c b/plugins/in_kmsg/in_kmsg.c
-index cd5c4cd17..63d61405e 100644
---- a/plugins/in_kmsg/in_kmsg.c
-+++ b/plugins/in_kmsg/in_kmsg.c
-@@ -165,6 +165,15 @@ static inline int process_line(const char *line,
- 
-     flb_time_set(&ts, ctx->boot_time.tv_sec + tv.tv_sec, tv.tv_usec * 1000);
- 
-+    /* Format syslog timestamp: "Jul 03 10:31:53" */
-+    time_t real_time = ctx->boot_time.tv_sec + tv.tv_sec;
-+    struct tm tm_info;
-+    char syslog_ts[32];
-+
-+    localtime_r(&real_time, &tm_info);
-+    strftime(syslog_ts, sizeof(syslog_ts), "%b %d %H:%M:%S", &tm_info);
-+    int syslog_ts_len = strlen(syslog_ts);
-+
-     /* Now process the human readable message */
-     p = strchr(p, ';');
-     if (!p) {
-@@ -197,8 +206,14 @@ static inline int process_line(const char *line,
-                 FLB_LOG_EVENT_CSTRING_VALUE("usec"),
-                 FLB_LOG_EVENT_UINT64_VALUE(tv.tv_usec),
- 
--                FLB_LOG_EVENT_CSTRING_VALUE("msg"),
--                FLB_LOG_EVENT_STRING_VALUE((char *) p, line_len - 1));
-+                FLB_LOG_EVENT_CSTRING_VALUE("ident"),
-+                FLB_LOG_EVENT_STRING_VALUE("kernel", 6),
-+
-+                FLB_LOG_EVENT_CSTRING_VALUE("message"),
-+                FLB_LOG_EVENT_STRING_VALUE((char *) p, line_len - 1),
-+
-+                FLB_LOG_EVENT_CSTRING_VALUE("time"),
-+                FLB_LOG_EVENT_STRING_VALUE(syslog_ts, syslog_ts_len));
-     }
- 
-     if (ret == FLB_EVENT_ENCODER_SUCCESS) {

fluent-bit/patches/0020-fix_kmsg.patch

@@ -0,0 +1,73 @@
+diff --git a/plugins/in_kmsg/in_kmsg.c b/plugins/in_kmsg/in_kmsg.c
+index cd5c4cd17..15f105451 100644
+--- a/plugins/in_kmsg/in_kmsg.c
++++ b/plugins/in_kmsg/in_kmsg.c
+@@ -36,7 +36,6 @@
+ #include <sys/stat.h>
+ #include <sys/time.h>
+ #include <inttypes.h>
+-#include <time.h>
+ 
+ #include "in_kmsg.h"
+ 
+@@ -123,12 +122,17 @@ static inline int process_line(const char *line,
+     ctx->buffer_id++;
+ 
+     errno = 0;
+-    val = strtol(p, &end, 10);
+-    if ((errno == ERANGE && (val == INT_MAX || val == INT_MIN))
++    val = strtoul(p, &end, 10);
++    if ((errno == ERANGE && val == ULONG_MAX)
+         || (errno != 0 && val == 0)) {
+         goto fail;
+     }
+ 
++    /* ensure something was consumed */
++    if (end == p) {
++        goto fail;
++    }
++
+     /* Priority */
+     priority = FLB_KLOG_PRI(val);
+ 
+@@ -144,24 +148,35 @@ static inline int process_line(const char *line,
+     }
+     p++;
+ 
+-    val = strtoul(p, &end, 10);
+-    if ((errno == ERANGE && (val == INT_MAX || val == INT_MIN))
++    val = strtoull(p, &end, 10);
++    if ((errno == ERANGE && val == ULLONG_MAX)
+         || (errno != 0 && val == 0)) {
+         goto fail;
+     }
+ 
++    /* make sure strtoull consumed something */
++    /* after the sequence number, the next char must be ',' */
++    if (end == p || *end != ',') {
++        goto fail;
++    }
++
+     sequence = val;
+     p = ++end;
+ 
+     /* Timestamp */
+-    val = strtoul(p, &end, 10);
+-    if ((errno == ERANGE && (val == INT_MAX || val == INT_MIN))
++    val = strtoull(p, &end, 10);
++    if ((errno == ERANGE && val == ULLONG_MAX)
+         || (errno != 0 && val == 0)) {
+         goto fail;
+     }
+ 
++    /* ensure something was consumed */
++    if (end == p) {
++        goto fail;
++    }
++
+     tv.tv_sec  = val/1000000;
+-    tv.tv_usec = val - (tv.tv_sec * 1000000);
++    tv.tv_usec = val - ((uint64_t)tv.tv_sec * 1000000);
+ 
+     flb_time_set(&ts, ctx->boot_time.tv_sec + tv.tv_sec, tv.tv_usec * 1000);
+ 

icwmp/Makefile

@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=icwmp
-PKG_VERSION:=9.10.0
+PKG_VERSION:=9.10.1
 
 LOCAL_DEV:=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/bbf/icwmp.git
-PKG_SOURCE_VERSION:=b4db243c1d057d0242a4badae53e9c57e442d27a
+PKG_SOURCE_VERSION:=c4b0fa4272ab44a8c78462d5cc8df6501acbeb55
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_MIRROR_HASH:=skip
 endif

ieee1905/Makefile

@@ -6,12 +6,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=ieee1905
-PKG_VERSION:=8.7.34
+PKG_VERSION:=8.7.37
 
 LOCAL_DEV=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_VERSION:=81c99af824bd5bd217213e4e731798a6469157b8
+PKG_SOURCE_VERSION:=c711e1e132478d6443ffb5aad15d12b90f0d59b5
 PKG_SOURCE_URL:=https://dev.iopsys.eu/multi-ap/ieee1905.git
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)_$(PKG_SOURCE_VERSION).tar.xz
 PKG_MIRROR_HASH:=skip

iopsys-analytics/Makefile

@@ -33,6 +33,7 @@ define Package/$(PKG_NAME)
   DEPENDS+=                                             \
     +@PACKAGE_syslog-ng:SYSLOGNG_LOGROTATE              \
     +PACKAGE_fluent-bit:logrotate                       \
+    +@DMCLI_REMOTE_CONNECTION
 
 endef
 

libeasy/Makefile

@@ -1,32 +1,28 @@
 #
-# Copyright (C) 2020-2023 Iopsys
+# Copyright (C) 2025 Genexis Sweden AB
 #
 
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=libeasy
-PKG_VERSION:=7.4.6
+PKG_VERSION:=7.5.0
 
 LOCAL_DEV=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_VERSION:=ca7b20068c9d373e41045a2e899a9c697576262c
-PKG_SOURCE_URL:=https://dev.iopsys.eu/iopsys/libeasy.git
-PKG_MAINTAINER:=Anjan Chanda <anjan.chanda@iopsys.eu>
+PKG_SOURCE_VERSION:=18f93677bb4d33ebb6249324a5043294f0eae16c
+PKG_SOURCE_URL:=https://dev.iopsys.eu/hal/libeasy.git
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)_$(PKG_SOURCE_VERSION).tar.xz
 PKG_MIRROR_HASH:=skip
 endif
 
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)
 PKG_LICENSE:=LGPL-2.1-only
-PKG_LICENSE_FILES:=LICENSE
+PKG_LICENSE_FILES:=
+PKG_MAINTAINER:=Anjan Chanda <anjan.chanda@genexis.eu>
 
 include $(INCLUDE_DIR)/package.mk
-
-TARGET_CFLAGS += \
-	-I$(STAGING_DIR)/usr/include \
-	-I$(STAGING_DIR)/usr/include/openssl \
-	-I$(STAGING_DIR)/usr/include/libnl3
+include $(INCLUDE_DIR)/cmake.mk
 
 ifeq ($(LOCAL_DEV),1)
 define Build/Prepare
@@ -34,9 +30,6 @@ define Build/Prepare
 endef
 endif
 
-MAKE_FLAGS += \
-	CFLAGS="$(TARGET_CFLAGS) -Wall"
-
 define Package/libeasy
   SECTION:=libs
   CATEGORY:=Libraries
@@ -47,7 +40,7 @@ define Package/libeasy
 endef
 
 define Package/libeasy/description
-  Library provides common utility functions
+  This package provides libeasy.so for common utility functions.
 endef
 
 define Build/InstallDev/libeasy
@@ -67,6 +60,7 @@ define Build/InstallDev/libeasy
 endef
 
 define Build/InstallDev
+	$(call Build/InstallDev/cmake,$(1))
 	$(call Build/InstallDev/libeasy,$(1),$(2))
 endef
 

libwifi/Makefile

@@ -5,12 +5,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=libwifi
-PKG_VERSION:=7.13.8
+PKG_VERSION:=7.14.0
 
 LOCAL_DEV=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_VERSION:=2760432a5aa4fd7f90f126d0a07ff35a105938fb
+PKG_SOURCE_VERSION:=b4b8f524a93d03fd1f89d4c32b8eaca90d9ccc1a
 PKG_SOURCE_URL:=https://dev.iopsys.eu/iopsys/libwifi.git
 PKG_MAINTAINER:=Anjan Chanda <anjan.chanda@iopsys.eu>
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)_$(PKG_SOURCE_VERSION).tar.xz

logmngr/Config.in

@@ -1,4 +1,5 @@
 if PACKAGE_logmngr
+
 choice
 	prompt "Select backend for syslog management"
 	default LOGMNGR_BACKEND_FLUENTBIT
@@ -8,7 +9,6 @@ choice
 
 config LOGMNGR_BACKEND_FLUENTBIT
 	bool "Use fluent-bit for log management"
-	default y
 	help
 		Enable this option to use fluent-bit for log management.
 

logmngr/Makefile

@@ -5,13 +5,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=logmngr
-PKG_VERSION:=1.1.0
+PKG_VERSION:=1.1.4
 
 LOCAL_DEV:=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/system/logmngr.git
-PKG_SOURCE_VERSION:=ad043d5d2e96c1b203a9c5b22ad6e6e1488ad8f2
+PKG_SOURCE_VERSION:=62441fdfe14a39bff8fff7c62307bd7b54d7240f
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_MIRROR_HASH:=skip
 endif
@@ -55,8 +55,9 @@ define Package/logmngr/install
 	$(INSTALL_DIR) $(1)/etc/config
 	$(INSTALL_DIR) $(1)/etc/uci-defaults
 
-	$(INSTALL_BIN) ./files/etc/init.d/logmngr $(1)/etc/init.d/logmngr
-	$(INSTALL_BIN) ./files/etc/config/logmngr $(1)/etc/config/logmngr
+	$(INSTALL_BIN) ./files/etc/init.d/logmngr $(1)/etc/init.d/
+	$(INSTALL_DATA) ./files/etc/config/logmngr $(1)/etc/config/
+	$(INSTALL_DATA) ./files/etc/uci-defaults/10-logmngr_config_migrate $(1)/etc/uci-defaults/
 
 	$(BBFDM_INSTALL_MS_PLUGIN) $(PKG_BUILD_DIR)/bbf_plugin/libbbfsyslog.so $(1) core 10
 
@@ -64,17 +65,15 @@ define Package/logmngr/install
 	$(INSTALL_DIR) $(1)/lib/logmngr
 ifeq ($(CONFIG_LOGMNGR_BACKEND_FLUENTBIT),y)
 	$(INSTALL_DIR) $(1)/sbin
-
 	$(INSTALL_BIN) ./files/logread $(1)/sbin/
 	$(INSTALL_DATA) ./files/lib/logmngr/fluent-bit.sh $(1)/lib/logmngr/
-	$(INSTALL_BIN) ./files/etc/uci-defaults/10-logmngr_config_migrate $(1)/etc/uci-defaults/
 else ifeq ($(CONFIG_LOGMNGR_BACKEND_SYSLOG_NG),y)
 	$(INSTALL_DATA) ./files/lib/logmngr/syslog-ng.sh $(1)/lib/logmngr/
 endif
 
 ifeq ($(CONFIG_LOGMNGR_LOGROTATE),y)
 	$(INSTALL_DATA) ./files/lib/logmngr/logrotate.sh $(1)/lib/logmngr/
-	$(INSTALL_BIN) .//files/etc/uci-defaults/11-logmngr_logrotate_syslog $(1)/etc/uci-defaults/
+	$(INSTALL_DATA) ./files/etc/uci-defaults/11-logmngr_logrotate_syslog $(1)/etc/uci-defaults/
 	$(BBFDM_INSTALL_MS_PLUGIN) $(PKG_BUILD_DIR)/bbf_plugin/libbbflogrotate.so $(1) sysmngr 11
 endif
 

logmngr/files/etc/uci-defaults/10-logmngr_config_migrate

@@ -1,7 +1,5 @@
 #!/bin/sh
 
-. /lib/functions.sh
-
 # check if this is a new type UCI or old type UCI
 if ! uci -q get logmngr.default_source > /dev/null; then
 	uci -q set logmngr.default_source=source
@@ -10,7 +8,6 @@ if ! uci -q get logmngr.default_source > /dev/null; then
 	uci -q set logmngr.default_source.kernel_messages='1'
 fi
 
-
 if ! uci -q get logmngr.default_template > /dev/null; then
 	uci -q set logmngr.default_template=template
 	uci -q set logmngr.default_template.name='default_template'

logmngr/files/lib/logmngr/fluent-bit.sh

@@ -69,17 +69,29 @@ create_service_section() {
 	append_conf ""
 }
 
+create_default_filters() {
+	append_conf "[FILTER]"
+	append_conf "    name            modify"
+	append_conf "    match           KM*"
+	append_conf "    add             ident   kernel"
+	append_conf "    rename          msg     message"
+	append_conf ""
+
+	append_conf "[FILTER]"
+	append_conf "    name            sysinfo"
+	append_conf "    match           *"
+	append_conf "    hostname_key    hostname"
+	append_conf ""
+}
+
 create_input_section() {
 	local tag="$1"
 
-	[ -z "$tag" ] && return 
+	[ -z "$tag" ] && return
 
 	# check if this source section has already been processed
 	syslog_tag_already_processed "$tag" && return
 
-	# the input in our case is always syslog, hence, this section of the
-	# fluent-bit.conf file has hardcoded values as well that do not depend
-	# on any uci value
 	append_conf "[INPUT]"
 	append_conf "    name        syslog"
 	append_conf "    tag         $tag"
@@ -87,147 +99,172 @@ create_input_section() {
 	append_conf ""
 }
 
+populate_allowed_logs() {
+	local facility_level sev_level
+	local section="$1"
+
+	[ -z "$section" ] && return
+
+	# reset
+	match_pattern=""
+	facilities=""
+	all_facilities=0
+	kern_facility=0
+	severities=""
+	sev_compare=1
+	sev_action=0
+
+	# read config
+	config_get match_pattern $section pattern_match
+
+	config_get facility_level $section facility_level
+	config_get sev_level $section severity_level
+	config_get sev_compare $section severity_compare 1
+	config_get sev_action $section severity_action 0
+
+	# normalize facilities
+	if [ -n "$facility_level" ]; then
+		for f in $facility_level; do
+			if [ "$f" = "24" ]; then
+				all_facilities=1
+				# xargs is used to convert from new line separated numbers to space separated numbers
+				facilities="$(seq 0 23 | xargs)"
+				break
+			fi
+
+			if [ "$f" = "0" ]; then
+				kern_facility=1
+			fi
+		done
+
+		if [ "$all_facilities" -eq 0 ]; then
+			facilities="$facility_level"
+		fi
+	else
+		# default to "all facilities" when unset
+        	all_facilities=1
+	        facilities="$(seq 0 23 | xargs)"
+	fi
+
+	# normalize severities
+	case "$sev_level" in
+		8)  	# all severities
+			severities="$(seq 0 7 | xargs)"
+			;;
+		9)  	# none
+			severities="none"
+			;;
+		"") 	# unset, treat as "all"
+			severities="$(seq 0 7 | xargs)"
+			;;
+		*)
+			if [ "$sev_compare" = "0" ]; then
+				# equal
+				severities="$sev_level"
+			else
+				# equl or higher
+				severities="$(seq 0 $sev_level | xargs)"
+			fi
+			;;
+	esac
+}
+
+create_filter_section() {
+	local match_regex="$1"
+	local pattern="$2"
+
+	[ -z "$match_regex" ] && return
+
+	append_conf "[FILTER]"
+	append_conf "    name        grep"
+	append_conf "    match_regex       $match_regex"
+
+	# we need "logical_op or" only in non-pattern sections
+	if [ "$pattern" = "0" ]; then
+		append_conf "    logical_op  or" # handle multiple filters
+	fi
+}
+
 create_kmsg_input_section() {
 	local tag="$1"
+	local max_sev=7
 
-	[ -z "$tag" ] && return 
-
-	# check if this source section has already been processed
+	[ -z "$tag" ] && return
 	kmsg_tag_already_processed "$tag" && return
 
 	if [ -c "/dev/kmsg" ]; then
 		append_conf "[INPUT]"
 		append_conf "    name       kmsg"
 		append_conf "    tag        $tag"
+
+		# check kern facility (0)
+		if [ "$all_facilities" -eq 1 ] || [ "$kern_facility" -eq 1 ]; then
+			if [ "$severities" != "none" ]; then
+				# severity filtering
+				# only EqualOrHigher is supported by Prio_Level
+				# and only Log action is supported
+				# so set Prio_Level = max severity
+				if [ "$sev_action" = "0" ] && [ "$sev_compare" = "1" ]; then
+					if [ -n "$severities" ]; then
+						max_sev=$(echo $severities | tr ' ' '\n' | sort -n | tail -1)
+					fi
+
+					append_conf "    prio_level $max_sev"
+				fi
+			fi
+		fi
+
 		append_conf ""
+
+		# if severities is none, or
+		# if kern facility has been excluded
+		# then we need to stop kernel logs
+		# sev_action and sev_compare is being checked because we don't want to work with rules that exclude logs
+		if [ "$severities" = "none" ] || { [ "$kern_facility" -eq 0 ] && [ "$all_facilities" -eq 0 ] && [ "$sev_action" = "0" ] && [ "$sev_compare" = "1" ]; }; then
+			# block all
+			# create a filter section that matches on KM* tag
+			# and excludes all messages
+			create_filter_section "KM*" "0"
+			append_conf "    exclude    message ^.*$"
+			append_conf ""
+		fi
 	fi
 }
 
-generate_facility_regex() {
-	local facility_level=$1
-	local pri=0
+generate_syslog_filter() {
+	local param="regex"
 
-	if [ "$facility_level" == "24" ]; then
-		# value 24 means all facility level, which is as good as not
-		# generating a filter section, so return
+	[ "$sev_action" = "1" ] && param="exclude"
+
+	# start adding the fluent-bit filter section
+	create_filter_section "SL*" "0"
+
+	if [ "$severities" = "none" ]; then
+		append_conf "    exclude    pri ^.*$"
 		return
 	fi
 
-	# facility_level is a list value, hence, generate regex for
-	# each value
-	IFS=" "
-	for val in $facility_level; do
-		# as per rfc 5424 and 3164, pri in syslog msg is
-		# facility*8+severity. Severity value can range from 0-7 hence
-		# generate regex for each.
-		for sval in 0 1 2 3 4 5 6 7; do
-			pri=`expr $val \* 8 + $sval`
-			append_conf "    regex        pri $pri"
+	for fval in $facilities; do
+		for sval in $severities; do
+			local pri=$((fval * 8 + sval))
+			append_conf "    $param        pri ^${pri}$"
 		done
 	done
+
+	append_conf ""
 }
 
-generate_severity_regex() {
-	local sev_level="$1"
-	local sev_compare="$2"
-	local sev_action="$3"
-
-	local pri=0
-	local param="exclude"
-
-	if [ "$sev_action" == "0" ]; then
-		param="regex"
-	fi
-
-	local fval=0
-	if [ "$sev_compare" == "0" ]; then
-		# generate regex for all facility values, with severity=sev_level
-		while [ $fval -le 23 ] ; do
-			pri=`expr $fval \* 8 + $sev_level`
-			append_conf "    $param        pri $pri"
-			fval=$((fval + 1))
-		done
-	elif [ "$sev_compare" == "1" ]; then
-		# generate regex for all severity value greater than or equal to
-		# sev_level. please, lower value have higher precedence, so sev_level
-		# 0 which is emergency has higher precedence than error which is 3
-		while [ $fval -le 23 ] ; do
-			sval=0
-			while [ $sev_level -ge $sval ]; do
-				pri=`expr $fval \* 8 + $sval`
-				append_conf "    $param        pri $pri"
-				sval=$((sval + 1))
-			done
-			fval=$((fval + 1))
-		done
-	fi
-}
-
-handle_filter_conf() {
-	local section="$1" # config filter
-	local filter_name="$2"
-	local name
-
-	# no need to proceed if name of filter section is not one of the values
-	# listed in option filter in config action section
-	config_get name $section name
-	if [ "$name" != "$filter_name" ]; then
-		return
-	fi
-
-	# as per data model, at a time either facility_level or severity_level can
-	# be specified along with pattern_match. hence, first process and generate
-	# regex for pattern_match which is common in both condition. Next, we will
-	# process facility_level and return if facility level is defined and not
-	# process severity related params at all.
-
-	local pattern_match
-	config_get pattern_match $section pattern_match
-	if [ -n "$pattern_match" ]; then
-		append_conf "    regex        $pattern_match"
-	fi
-
-	local facility_level
-	config_get facility_level $section facility_level
-
-	if [ -n "$facility_level" ]; then
-		generate_facility_regex $facility_level
-		# return from here since if facility_level is defined, then no
-		# need to process severity_level
-		return
-	fi
-
-	local sev_level
-	local sev_compare
-	local sev_action
-	config_get sev_level $section severity_level
-
-	if [ -n "$sev_level" ]; then
-		# value 1 of severity compare corresponds to data model
-		# and system default which is EqualorHigher
-		config_get sev_compare $section severity_compare 1
-		# value 0 of severity action corresponds to data model
-		# and system default that is log
-		config_get sev_action $section severity_action 0
-
-		generate_severity_regex $sev_level $sev_compare $sev_action
-	fi
-}
-
-create_filter_section() {
+generate_pattern_filter() {
 	local match_regex="$1"
+	local match_pattern="$2"
 
-	[ -z "$match_regex" ] && return 
+	[ -z "$match_regex" ] && return
+	[ -z "$match_pattern" ] && return
 
-	append_conf "[FILTER]"
-	append_conf "    name        grep"
-	append_conf "    match_regex       $match_regex"
-	append_conf "    logical_op  or" # handle multiple filters
-}
-
-handle_filter_ref() {
-	local filter_name="$1"
-	config_foreach handle_filter_conf filter "$filter_name"
+	# start adding the fluent-bit filter section
+	create_filter_section "$match_regex" "1"
+	append_conf "    regex        message $match_pattern"
+	append_conf ""
 }
 
 handle_log_file() {
@@ -256,9 +293,11 @@ handle_log_file() {
 
 	append_conf "[OUTPUT]"
 	append_conf "    name         file"
+	append_conf "    workers      2"
 	append_conf "    match_regex  $match_regex"
 	append_conf "    file         $file"
 
+
 	if [ -n "$template" ]; then
 		append_conf "    format       template"
 		append_conf "    template     ${template}"
@@ -297,11 +336,7 @@ handle_log_remote() {
 	append_conf "    syslog_appname_key   ident"
 	append_conf "    syslog_procid_key    pid"
 	append_conf "    syslog_message_key   message"
-
-	local hostname="$(uci -q get 'system.@system[0].hostname')"
-	if [ -n "${hostname}" ]; then
-		append_conf "    syslog_hostname_preset    ${hostname}"
-	fi
+	append_conf "    syslog_hostname_key  hostname"
 
 	local proto # holds value tcp or udp
 	config_get proto ${section} proto
@@ -337,7 +372,7 @@ handle_log_remote() {
 resolve_source_section() {
 	local src_section="$1"
 	local linker="$2"
-	local src_name syslog_en kernel_en source_tag_syslog source_tag_kmsg
+	local src_name syslog_en kernel_en
 
 	config_get src_name "$src_section" name
 	[ "$src_name" = "$linker" ] || return
@@ -352,13 +387,11 @@ resolve_source_section() {
 	if [ "$syslog_en" = "1" ]; then
 		source_tag_syslog="SL$src_name"
 		create_input_section "$source_tag_syslog"
-		action_tags="$source_tag_syslog $action_tags"
 	fi
 
 	if [ "$kernel_en" = "1" ]; then
 		source_tag_kmsg="KM$src_name"
 		create_kmsg_input_section "$source_tag_kmsg"
-		action_tags="$source_tag_kmsg $action_tags"
 	fi
 }
 
@@ -394,10 +427,30 @@ build_match_regex() {
 	echo "$regex"
 }
 
+handle_filter_conf() {
+	local section="$1" # config filter
+	local filter_name="$2"
+	local name
+
+	config_get name $section name
+	[ "$name" = "$filter_name" ] || return
+
+	populate_allowed_logs "$filter_name"
+}
+
 handle_action() {
-	local tag_regex filter source_ref template_ref source_sec log_template
+	local tag_regex filter source_ref template_ref source_sec log_template finst
 	local action_section="$1"
-	local action_tags=""
+	local source_tag_syslog source_tag_kmsg
+
+	# shared variables set by populate_allowed_logs
+	match_pattern=""
+	facilities=""
+	all_facilities=0
+	kern_facility=1
+	severities=""
+	sev_compare=1
+	sev_action=0
 
 	config_get action_name "$action_section" name
 	config_get filter "$action_section" filter
@@ -407,27 +460,26 @@ handle_action() {
 	[ -z "$action_name" ] && return
 	[ -z "$source_ref" ] && return
 
+	# read filter section and populate relevant variables
+	# these variables will be used by create_kmsg_input_section
+	# generate_syslog_filter, and generate_pattern_filter functions
+	if [ -n "$filter" ]; then
+		for finst in $filter; do
+			config_foreach handle_filter_conf filter "$finst"
+		done
+	fi
+
 	# Resolve referenced source sections
 	for source_sec in $source_ref; do
 		config_foreach resolve_source_section source "$source_sec"
 	done
 
 	# build a regex that will match all the sources for this action
-	tag_regex=$(build_match_regex "$action_tags")
+	tag_regex=$(build_match_regex "$source_tag_syslog $source_tag_kmsg")
 
 	if [ -n "$filter" ]; then
-		# the only fluentbit filter that is useful for the datamodel is
-		# grep. Also, fluentbit does not seem to handle multiple instances
-		# of FILTER of same kind. Hence, each filter section corresponding
-		# to an action entry in the uci would translate for us into a set of
-		# regex/exclude values instead of individual FILTER section per uci
-		# section filter is a list, treat according
-		create_filter_section "$tag_regex"
-
-		IFS=" "
-		for finst in $filter; do
-			handle_filter_ref $finst
-		done
+		generate_pattern_filter "$tag_regex" "$match_pattern"
+		generate_syslog_filter
 	fi
 
 	# get the template expression if any is present
@@ -453,6 +505,7 @@ logmngr_init() {
 
 	create_config_file
 	create_service_section
+	create_default_filters
 	handle_action_section
 
 	if [ -f /lib/logmngr/logrotate.sh ]; then

map-agent/Makefile

@@ -5,9 +5,9 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=map-agent
-PKG_VERSION:=6.4.0.2
+PKG_VERSION:=6.4.1.11
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)
-PKG_SOURCE_VERSION:=517dddc0a84be1e252b9d6cbdc046e87c4f7111a
+PKG_SOURCE_VERSION:=671bb0e693adbeb3e06b967350ce7f96ee91321b
 PKG_MAINTAINER:=Jakob Olsson <jakob.olsson@iopsys.eu>
 
 PKG_LICENSE:=BSD-3-Clause

map-controller/Makefile

@@ -6,9 +6,9 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=map-controller
-PKG_VERSION:=6.4.0.14
+PKG_VERSION:=6.4.2.6
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)
-PKG_SOURCE_VERSION:=ece0f91a51fb3498e4a6ac6d85f9a6b36aaacdfa
+PKG_SOURCE_VERSION:=5e93ea36c4fb93dd473b233b098ecacf6395a20c
 PKG_MAINTAINER:=Jakob Olsson <jakob.olsson@genexis.eu>
 
 LOCAL_DEV=0

map-controller/files/etc/config/mapcontroller

@@ -2,13 +2,13 @@ config controller 'controller'
 	option enabled '1'	# may be modified by other package start-up scripts (i.e. map-agent)
 	option profile '3'
 	option registrar '2 5 6'
-	option debug '0'
+	option debug '2'
 	option bcn_metrics_max_num '10'
 	option initial_channel_scan '0'
 	option enable_ts '0'
 	option primary_vid '1'
 	option primary_pcp '0'
-	option stale_sta_timeout '30d'
+	option stale_sta_timeout '20d'
 	option de_collect_interval '60'
 
 config sta_steering

map-plugins/Makefile

@@ -5,12 +5,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=map-plugins
-PKG_VERSION:=0.0.4
+PKG_VERSION:=1.0.31
 
 LOCAL_DEV=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_VERSION:=74bf151851112ecee731d447af016c8dc668adcf
+PKG_SOURCE_VERSION:=565cade8fe08807b345404c567243fbdfdcb96c8
 PKG_SOURCE_URL:=https://dev.iopsys.eu/multi-ap/map-plugins.git
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)_$(PKG_SOURCE_VERSION).tar.xz
 PKG_MIRROR_HASH:=skip
@@ -31,7 +31,8 @@ MAKE_FLAGS += \
 	CFLAGS="$(TARGET_CFLAGS) -Wall"
 
 plugins := \
-	$(if $(CONFIG_PACKAGE_map-plugins-steer-rate),steer-rate)
+	$(if $(CONFIG_PACKAGE_map-plugins-steer-rate),steer-rate)   \
+	$(if $(CONFIG_PACKAGE_map-plugins-bsteer),bsteer)
 
 ppkg:=$(patsubst plugins/%.mk,map-plugins-%,$(wildcard plugins/*.mk))
 
@@ -52,7 +53,7 @@ define Package/map-plugins
 endef
 
 define Package/map-plugins/description
-	Provides extra Multi-AP services viz. steering, channel-planning etc.
+	Provides extra Multi-AP services viz. steering, channel-planning, self-organizing network etc.
 endef
 
 define Package/map-plugins/install
@@ -60,9 +61,8 @@ define Package/map-plugins/install
 endef
 
 define Build/Compile
-	$(foreach p,$(ppkg),$(call Build/Compile/$(p),$(1)))
+	$(foreach p,$(plugins),$(call Build/Compile/map-plugins-$(p), $(1)))
 endef
 
-
 $(eval $(call BuildPackage,map-plugins))
 $(eval $(foreach p,$(ppkg),$(call BuildPackage,$(p))))

map-plugins/plugins/bsteer.mk

@@ -0,0 +1,20 @@
+define Package/map-plugins-bsteer
+	$(call Package/map-plugins/Default)
+	TITLE:=Wi-Fi backhaul steering plugin based on maximizing backhaul throughput
+	DEPENDS= +libubox +libuci +libubus +libeasy +libnl-genl \
+		 +libjson-c +libblobmsg-json +map-controller \
+		 +map-plugins
+endef
+
+define Package/map-plugins-bsteer/install
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(INSTALL_DIR) $(1)/usr/lib/mapcontroller
+	$(CP) $(PKG_BUILD_DIR)/steer/bsteer/bsteer.so $(1)/usr/lib/mapcontroller/bsteer.so
+endef
+
+define Build/Compile/map-plugins-bsteer
+	$(MAKE) -C $(PKG_BUILD_DIR)/steer/bsteer \
+		CC="$(TARGET_CC)" \
+		CFLAGS="$(TARGET_CFLAGS)" \
+		LDFLAGS="$(TARGET_LDFLAGS)";
+endef

map-plugins/plugins/steer-rate.mk

@@ -16,5 +16,5 @@ define Build/Compile/map-plugins-steer-rate
 	$(MAKE) -C $(PKG_BUILD_DIR)/steer/rate \
 		CC="$(TARGET_CC)" \
 		CFLAGS="$(TARGET_CFLAGS)" \
-		LDFLAGS="$(TARGET_LDFLAGS)"
+		LDFLAGS="$(TARGET_LDFLAGS)";
 endef

mosquitto-auth-shadow/Config.in

@@ -0,0 +1,7 @@
+if PACKAGE_mosquitto-auth-shadow
+
+config MOSQUITTO_AUTH_PAM_SUPPORT
+	bool "Enable support of Linux PAM module for Authentication"
+	default y
+
+endif

mosquitto-auth-shadow/Makefile

@@ -14,12 +14,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=mosquitto-auth-shadow
-PKG_VERSION:=1.0.1
+PKG_VERSION:=1.1.0
 
 PKG_MAINTAINER:=Erik Karlsson <erik.karlsson@genexis.eu>
 PKG_LICENSE:=EPL-2.0
 
 PKG_BUILD_PARALLEL:=1
+PKG_CONFIG_DEPENDS:=CONFIG_MOSQUITTO_AUTH_PAM_SUPPORT
 
 include $(INCLUDE_DIR)/package.mk
 
@@ -27,7 +28,7 @@ define Package/mosquitto-auth-shadow
   SECTION:=net
   CATEGORY:=Network
   TITLE:=mosquitto - /etc/shadow authentication plugin
-  DEPENDS:=+mosquitto-ssl
+  DEPENDS:=+mosquitto-ssl +MOSQUITTO_AUTH_PAM_SUPPORT:libpam
   USERID:=mosquitto=200:mosquitto=200 mosquitto=200:shadow=11
 endef
 
@@ -36,6 +37,14 @@ define Package/mosquitto-auth-shadow/description
   users using /etc/shadow
 endef
 
+define Package/mosquitto-auth-shadow/config
+	source "$(SOURCE)/Config.in"
+endef
+
+ifeq ($(CONFIG_MOSQUITTO_AUTH_PAM_SUPPORT),y)
+TARGET_CFLAGS+=-DENABLE_PAM_SUPPORT
+endif
+
 define Package/mosquitto-auth-shadow/install
 	$(INSTALL_DIR) $(1)/usr/lib
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/mosquitto_auth_shadow.so $(1)/usr/lib/

mosquitto-auth-shadow/src/Makefile

@@ -19,7 +19,7 @@ all: $(TARGETS)
 	$(CC) $(CFLAGS) -Wall -Werror -fPIC -c -o $@ $<
 
 mosquitto_auth_shadow.so: mosquitto_auth_shadow.pic.o
-	$(CC) $(LDFLAGS) -shared -o $@ $^
+	$(CC) $(LDFLAGS) -shared -o $@ $^ $(if $(filter -DENABLE_PAM_SUPPORT,$(CFLAGS)),-lpam)
 
 clean:
 	rm -f *.o $(TARGETS)

mosquitto-auth-shadow/src/mosquitto_auth_shadow.c

@@ -15,22 +15,78 @@
 #include <string.h>
 #include <shadow.h>
 #include <crypt.h>
+#include <stdlib.h>
 #include <mosquitto.h>
 #include <mosquitto_broker.h>
 #include <mosquitto_plugin.h>
 
-static int basic_auth_callback(int event, void *event_data, void *userdata)
+#ifdef ENABLE_PAM_SUPPORT
+#include <security/pam_appl.h>
+
+static int pam_conversation(int num_msg, const struct pam_message **msg, struct pam_response **resp, void *appdata_ptr)
+{
+	int i;
+	const char *pass = (const char *)appdata_ptr;
+
+	*resp = calloc(num_msg, sizeof(struct pam_response));
+	if (*resp == NULL) {
+		mosquitto_log_printf(MOSQ_LOG_ERR, "pam failed to allocate buffer for validation");
+		return PAM_BUF_ERR;
+	}
+
+	if (pass == NULL)
+		return PAM_SUCCESS;
+
+	for (i = 0; i < num_msg; ++i) {
+		if (msg[i]->msg_style == PAM_PROMPT_ECHO_OFF) {
+			(*resp)[i].resp = strdup(pass);
+			if ((*resp)[i].resp == NULL) {
+				for (int j = 0; j < i ; j++)
+					free((*resp)[j].resp);
+
+				free(*resp);
+				*resp = NULL;
+				mosquitto_log_printf(MOSQ_LOG_ERR, "pam failed in strdup");
+				return PAM_BUF_ERR;
+			}
+		}
+	}
+	return PAM_SUCCESS;
+}
+
+static int process_pam_auth_callback(struct mosquitto_evt_basic_auth *ed)
+{
+	struct pam_conv conv;
+	int retval;
+	pam_handle_t *pamh = NULL;
+
+	conv.conv = pam_conversation;
+	conv.appdata_ptr = (void *)ed->password;
+
+	retval = pam_start("mosquitto", ed->username, &conv, &pamh);
+	if (retval != PAM_SUCCESS) {
+		mosquitto_log_printf(MOSQ_LOG_ERR, "pam start failed: %s", pam_strerror(pamh, retval));
+		return MOSQ_ERR_AUTH;
+	}
+
+	retval = pam_authenticate(pamh, 0);
+	pam_end(pamh, retval);
+	if (retval == PAM_SUCCESS) {
+		mosquitto_log_printf(MOSQ_LOG_NOTICE, "pam user [%s] logged in", ed->username);
+		return MOSQ_ERR_SUCCESS;
+	}
+
+	mosquitto_log_printf(MOSQ_LOG_NOTICE, "pam user [%s] failed authentication, err [%s]", ed->username, pam_strerror(pamh, retval));
+	return MOSQ_ERR_AUTH;
+}
+#else
+static int process_shadow_auth_callback(struct mosquitto_evt_basic_auth *ed)
 {
-	struct mosquitto_evt_basic_auth *ed = event_data;
 	struct spwd spbuf, *sp = NULL;
 	char buf[256];
 	struct crypt_data data;
 	char *hash;
 
-	/* Let other plugins or broker decide about anonymous login */
-	if (ed->username == NULL)
-		return MOSQ_ERR_PLUGIN_DEFER;
-
 	getspnam_r(ed->username, &spbuf, buf, sizeof(buf), &sp);
 
 	if (sp == NULL || sp->sp_pwdp == NULL)
@@ -54,6 +110,22 @@ static int basic_auth_callback(int event, void *event_data, void *userdata)
 
 	return MOSQ_ERR_AUTH;
 }
+#endif
+
+static int basic_auth_callback(int event, void *event_data, void *userdata)
+{
+	struct mosquitto_evt_basic_auth *ed = event_data;
+
+	/* Let other plugins or broker decide about anonymous login */
+	if (ed->username == NULL)
+		return MOSQ_ERR_PLUGIN_DEFER;
+
+#ifdef ENABLE_PAM_SUPPORT
+	return process_pam_auth_callback(ed);
+#else
+	return process_shadow_auth_callback(ed);
+#endif
+}
 
 int mosquitto_plugin_version(int supported_version_count,
 			     const int *supported_versions)

obuspa/Config.in

@@ -19,13 +19,8 @@ config OBUSPA_CONTROLLER_MTP_VERIFY
 	bool "Enable verification of controller MTP before processing the message"
 	default n
 
-config OBUSPA_ENABLE_TEST_CONTROLLER
-	bool "Adds a test controller by default"
-	default n
-	select OBUSPA_ENABLE_TEST_CONTROLLER_LOCAL
-
-config OBUSPA_ENABLE_TEST_CONTROLLER_LOCAL
-	bool "Adds a test controller by default (local access only)"
+config OBUSPA_LOCAL_MQTT_LISTENER
+	bool "Configures local mqtt broker for local usp connections"
 	default n
 
 config OBUSPA_MAX_CONTROLLERS_NUM

obuspa/Makefile

@@ -5,13 +5,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=obuspa
-PKG_VERSION:=10.0.6.1
+PKG_VERSION:=10.0.7.4
 
 LOCAL_DEV:=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/bbf/obuspa.git
-PKG_SOURCE_VERSION:=9bf15af88a0f8ee19c2bbf40adcb0fb4850a2f3a
+PKG_SOURCE_VERSION:=84d5ae575134d501b8ca171a5a65c6f410f01d08
 PKG_MAINTAINER:=Vivek Dutta <vivek.dutta@iopsys.eu>
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_MIRROR_HASH:=skip
@@ -33,8 +33,7 @@ define Package/obuspa
   TITLE:=USP agent
   MENU:=1
   DEPENDS:=+libopenssl +libuci +libblobmsg-json +libcurl +libsqlite3 +libubox +libubus +libmosquitto-ssl +libwebsockets-openssl +ca-certificates \
-		+OBUSPA_ENABLE_TEST_CONTROLLER_LOCAL:mosquitto-ssl +OBUSPA_ENABLE_TEST_CONTROLLER_LOCAL:mosquitto-client-ssl \
-		+OBUSPA_ENABLE_TEST_CONTROLLER:mosquitto-auth-shadow +libjson-c
+		+OBUSPA_LOCAL_MQTT_LISTENER:mosquitto-ssl +libjson-c
   DEPENDS+=+libbbfdm-api +libbbfdm-ubus +dm-service
 endef
 
@@ -132,27 +131,23 @@ define Package/obuspa/install
 	$(INSTALL_DATA) ./files/etc/users/roles/*.json $(1)/etc/users/roles/
 	$(INSTALL_DATA) ./files/etc/obuspa/usp_utils.sh $(1)/etc/obuspa/
 	echo "$(VENDOR_PREFIX)" > $(1)/etc/obuspa/vendor_prefix
-	$(INSTALL_BIN) ./files/etc/uci-defaults/01-fix-upgrade-uci $(1)/etc/uci-defaults/
-	$(INSTALL_BIN) ./files/etc/uci-defaults/60-generate-ctrust-defaults $(1)/etc/uci-defaults/
-	$(INSTALL_BIN) ./files/etc/uci-defaults/obuspa-set-dhcp-option $(1)/etc/uci-defaults/
-	$(INSTALL_BIN) ./files/etc/uci-defaults/92-obuspa_firewall $(1)/etc/uci-defaults/
-	$(INSTALL_BIN) ./files/etc/uci-defaults/93-obuspa_mdns_adv $(1)/etc/uci-defaults/
-	$(INSTALL_BIN) ./files/etc/uci-defaults/94-obuspa_set_credential $(1)/etc/uci-defaults/
+	$(INSTALL_DATA) ./files/etc/uci-defaults/01-fix-upgrade-uci $(1)/etc/uci-defaults/
+	$(INSTALL_DATA) ./files/etc/uci-defaults/60-generate-ctrust-defaults $(1)/etc/uci-defaults/
+	$(INSTALL_DATA) ./files/etc/uci-defaults/obuspa-set-dhcp-option $(1)/etc/uci-defaults/
+	$(INSTALL_DATA) ./files/etc/uci-defaults/92-obuspa_firewall $(1)/etc/uci-defaults/
+	$(INSTALL_DATA) ./files/etc/uci-defaults/93-obuspa_mdns_adv $(1)/etc/uci-defaults/
+	$(INSTALL_DATA) ./files/etc/uci-defaults/94-obuspa_set_credential $(1)/etc/uci-defaults/
 	$(INSTALL_BIN) ./files/etc/firewall.usp $(1)/etc/
-	$(INSTALL_BIN) ./files/etc/udhcpc.user.d/udhcpc_obuspa_opt125.user $(1)/etc/udhcpc.user.d/udhcpc_obuspa_opt125.user
+	$(INSTALL_BIN) ./files/etc/udhcpc.user.d/udhcpc_obuspa_opt125.user $(1)/etc/udhcpc.user.d/
 ifeq ($(CONFIG_OBUSPA_CWMP_DATAMODEL_SUPPORT),y)
 	$(BBFDM_REGISTER_SERVICES) ./bbfdm_service.json $(1) $(PKG_NAME)
 	$(BBFDM_INSTALL_MS_DM) $(PKG_BUILD_DIR)/libuspagentdm.so $(1) $(PKG_NAME)
 endif
-ifeq ($(CONFIG_OBUSPA_ENABLE_TEST_CONTROLLER),y)
-	$(INSTALL_BIN) ./files/etc/uci-defaults/54-test-usp-remote $(1)/etc/uci-defaults/
-endif
-ifeq ($(CONFIG_OBUSPA_ENABLE_TEST_CONTROLLER_LOCAL),y)
-	$(INSTALL_BIN) ./files/etc/init.d/usptest $(1)/etc/init.d/
-	$(INSTALL_BIN) ./files/etc/uci-defaults/55-test-usp-controller $(1)/etc/uci-defaults/
+ifeq ($(CONFIG_OBUSPA_LOCAL_MQTT_LISTENER),y)
+	$(INSTALL_DATA) ./files/etc/uci-defaults/55-obuspa-local-mqtt-usp-connection $(1)/etc/uci-defaults/
 endif
 ifeq ($(CONFIG_OBUSPA_OVERRIDE_CT_ROLE),y)
-	$(INSTALL_BIN) ./files/etc/uci-defaults/61-override-ct-roles $(1)/etc/uci-defaults/
+	$(INSTALL_DATA) ./files/etc/uci-defaults/61-override-ct-roles $(1)/etc/uci-defaults/
 endif
 endef
 

obuspa/files/etc/init.d/usptest

@@ -1,75 +0,0 @@
-#!/bin/sh /etc/rc.common
-
-START=99
-STOP=01
-USE_PROCD=1
-
-log()
-{
-	echo "$*"|logger -t usptest -p debug
-}
-
-get_oui_from_db()
-{
-	db -q get device.deviceinfo.ManufacturerOUI
-}
-
-get_serial_from_db()
-{
-	db -q get device.deviceinfo.SerialNumber
-}
-
-publish_endpoint()
-{
-	local AgentEndpointID serial oui user pass
-
-	if ! uci -q get obuspa.testmqtt; then
-		return 0;
-	fi
-
-	# return if mosquitto_pub is not present
-	if [ ! "$(command -v mosquitto_pub)" ]; then
-		log "mosquitto_pub not present can't publish EndpointID"
-		return 0;
-	fi
-
-	sleep 2
-	# Get endpoint id from obuspa config first
-	config_load obuspa
-	config_get AgentEndpointID localagent EndpointID ""
-	if [ -z "${AgentEndpointID}" ]; then
-		serial=$(get_serial_from_db)
-		oui=$(get_oui_from_db)
-		AgentEndpointID="os::${oui}-${serial//+/%2B}"
-	fi
-
-	config_get user testmqtt Username ""
-	config_get pass testmqtt Password ""
-
-	# publish Agent's EndpointID in mosquito broker for discovery by usp-js
-	# This is a work around till obuspa adds supports for mDNS discovery
-	if [ -n "${user}" ] && [ -n "${pass}" ]; then
-		log "Publishing EndpointID ${AgentEndpointID} to local mqtt broker with username, password"
-		mosquitto_pub -r -t "obuspa/EndpointID" -m "${AgentEndpointID}" -u "${user}" -P "${pass}"
-	elif [ -n "${user}" ]; then
-		log "Publishing EndpointID ${AgentEndpointID} to local mqtt broker with username only"
-		mosquitto_pub -r -t "obuspa/EndpointID" -m "${AgentEndpointID}" -u "${user}"
-	else
-		log "Publishing EndpointID ${AgentEndpointID} to local mqtt broker"
-		mosquitto_pub -r -t "obuspa/EndpointID" -m "${AgentEndpointID}"
-	fi
-}
-
-start_service() {
-	procd_open_instance usptest
-	publish_endpoint
-	procd_close_instance
-}
-
-reload_service() {
-	publish_endpoint
-}
-
-service_triggers() {
-	procd_add_reload_trigger "mosquitto" "obuspa"
-}

obuspa/files/etc/uci-defaults/54-test-usp-remote

@@ -1,20 +0,0 @@
-#!/bin/sh
-
-. /lib/functions.sh
-
-if [ ! -f "/etc/config/mosquitto" ]; then
-	echo "Local mosquitto broker not available"
-	return 0
-fi
-
-add_usp_test()
-{
-	uci_add mosquitto listener usptest
-	uci_set mosquitto usptest enabled 1
-	uci_set mosquitto usptest port '9004'
-	uci_set mosquitto usptest protocol 'websockets'
-	uci_set mosquitto usptest auth_plugin '/usr/lib/mosquitto_auth_shadow.so'
-}
-
-# Install test MQTT over WS listener
-add_usp_test

obuspa/files/etc/uci-defaults/55-obuspa-local-mqtt-usp-connection

@@ -0,0 +1,21 @@
+#!/bin/sh
+
+. /lib/functions.sh
+
+if [ ! -f "/etc/config/mosquitto" ]; then
+	echo "Local mosquitto broker not available"
+	return 0
+fi
+
+add_mqtt_obuspa_listener()
+{
+	uci_add mosquitto listener obuspa
+	uci_set mosquitto obuspa enabled 1
+	uci_set mosquitto obuspa port '1883'
+	uci_set mosquitto obuspa no_remote_access '1'
+	uci_set mosquitto obuspa allow_anonymous '1'
+}
+
+# Add mosquitto listener for obuspa connection
+# apps/controller should add controller definitions separately
+add_mqtt_obuspa_listener

obuspa/files/etc/uci-defaults/55-test-usp-controller

@@ -1,57 +0,0 @@
-#!/bin/sh
-
-. /lib/functions.sh
-
-if [ ! -f "/etc/config/obuspa" ]; then
-	echo "Local obuspa not available"
-	return 0
-fi
-
-if [ ! -f "/etc/config/mosquitto" ]; then
-	echo "Local mosquitto broker not available"
-	return 0
-fi
-
-add_obuspa_test_mtp()
-{
-	uci_add obuspa mtp test_mtp
-	uci_set obuspa test_mtp Protocol 'MQTT'
-	uci_set obuspa test_mtp ResponseTopicConfigured '/usp/endpoint'
-	uci_set obuspa test_mtp mqtt 'testmqtt'
-}
-
-add_obuspa_test_mqtt()
-{
-	# Adds Device.MQTT.Client.
-	uci_add obuspa mqtt testmqtt
-	uci_set obuspa testmqtt BrokerAddress '127.0.0.1'
-	uci_set obuspa testmqtt BrokerPort '1883'
-	uci_set obuspa testmqtt TransportProtocol 'TCP/IP'
-}
-
-add_obuspa_test_controller()
-{
-	# Adds Device.LocalAgent.Controller.
-	uci_add obuspa controller testcontroller
-	uci_set obuspa testcontroller EndpointID 'proto::interop-usp-controller'
-	uci_set obuspa testcontroller Protocol 'MQTT'
-	uci_set obuspa testcontroller Topic '/usp/controller'
-	uci_set obuspa testcontroller mqtt 'testmqtt'
-	uci_set obuspa testcontroller assigned_role_name 'full_access'
-}
-
-add_obuspa_config()
-{
-	uci_add mosquitto listener obuspa
-	uci_set mosquitto obuspa enabled 1
-	uci_set mosquitto obuspa port '1883'
-	uci_set mosquitto obuspa no_remote_access '1'
-	uci_set mosquitto obuspa allow_anonymous '1'
-}
-
-# Install test usp controller config
-add_obuspa_config
-
-add_obuspa_test_mtp
-add_obuspa_test_mqtt
-add_obuspa_test_controller

obuspa/patches/1000-suppress-logs.patch

@@ -1,8 +1,8 @@
-Index: obuspa-10.0.6.0/src/core/cli_server.c
+Index: obuspa-10.0.7.0/src/core/cli_server.c
 ===================================================================
---- obuspa-10.0.6.0.orig/src/core/cli_server.c
-+++ obuspa-10.0.6.0/src/core/cli_server.c
-@@ -725,10 +725,6 @@ int ExecuteCli_Get(str_vector_t *args)
+--- obuspa-10.0.7.0.orig/src/core/cli_server.c
++++ obuspa-10.0.7.0/src/core/cli_server.c
+@@ -726,10 +726,6 @@ int ExecuteCli_Get(str_vector_t *args)
              USP_ASSERT(gge->value != NULL);
              SendCliResponse("%s => %s\n", gge->path, gge->value);
          }
@@ -13,10 +13,10 @@ Index: obuspa-10.0.6.0/src/core/cli_server.c
      }
  
      GROUP_GET_VECTOR_Destroy(&ggv);
-Index: obuspa-10.0.6.0/src/core/data_model.c
+Index: obuspa-10.0.7.0/src/core/data_model.c
 ===================================================================
---- obuspa-10.0.6.0.orig/src/core/data_model.c
-+++ obuspa-10.0.6.0/src/core/data_model.c
+--- obuspa-10.0.7.0.orig/src/core/data_model.c
++++ obuspa-10.0.7.0/src/core/data_model.c
 @@ -1398,7 +1398,7 @@ int DATA_MODEL_NotifyInstanceAdded(char
      // Exit if instance already exists - nothing to do
      if (exists)
@@ -35,11 +35,11 @@ Index: obuspa-10.0.6.0/src/core/data_model.c
          return USP_ERR_OBJECT_DOES_NOT_EXIST;
      }
  
-Index: obuspa-10.0.6.0/src/core/mqtt.c
+Index: obuspa-10.0.7.0/src/core/mqtt.c
 ===================================================================
---- obuspa-10.0.6.0.orig/src/core/mqtt.c
-+++ obuspa-10.0.6.0/src/core/mqtt.c
-@@ -4059,7 +4059,7 @@ void MessageV5Callback(struct mosquitto
+--- obuspa-10.0.7.0.orig/src/core/mqtt.c
++++ obuspa-10.0.7.0/src/core/mqtt.c
+@@ -4070,7 +4070,7 @@ void MessageV5Callback(struct mosquitto
      if (mosquitto_property_read_string(props, RESPONSE_TOPIC,
              &response_info_ptr, false) == NULL)
      {

obuspa/patches/1001-use-datamodel-caching.patch

@@ -4,11 +4,11 @@ Date:   Wed Apr 30 17:18:27 2025 +0530
 
     1001-use-datamodel-caching.patch
 
-Index: obuspa-10.0.6.0/src/core/cli_server.c
+Index: obuspa-10.0.7.0/src/core/cli_server.c
 ===================================================================
---- obuspa-10.0.6.0.orig/src/core/cli_server.c
-+++ obuspa-10.0.6.0/src/core/cli_server.c
-@@ -512,6 +512,7 @@ int CLI_SERVER_ExecuteCliCommand(char *c
+--- obuspa-10.0.7.0.orig/src/core/cli_server.c
++++ obuspa-10.0.7.0/src/core/cli_server.c
+@@ -513,6 +513,7 @@ int CLI_SERVER_ExecuteCliCommand(char *c
          SendCliResponse("WARNING: Discarding unused args: %s\n", args.vector[cli_cmd->max_args+1]);
      }
  
@@ -16,7 +16,7 @@ Index: obuspa-10.0.6.0/src/core/cli_server.c
      // Process command
      err = cli_cmd->exec_cmd(&args);
      print_help = false;
-@@ -671,6 +672,11 @@ int ExecuteCli_Version(str_vector_t *arg
+@@ -672,6 +673,11 @@ int ExecuteCli_Version(str_vector_t *arg
  int ExecuteCli_Get(str_vector_t *args)
  {
      combined_role_t *combined_role;
@@ -28,10 +28,10 @@ Index: obuspa-10.0.6.0/src/core/cli_server.c
  #ifndef REMOVE_USP_BROKER
      char *arg1;
  
-Index: obuspa-10.0.6.0/src/core/data_model.h
+Index: obuspa-10.0.7.0/src/core/data_model.h
 ===================================================================
---- obuspa-10.0.6.0.orig/src/core/data_model.h
-+++ obuspa-10.0.6.0/src/core/data_model.h
+--- obuspa-10.0.7.0.orig/src/core/data_model.h
++++ obuspa-10.0.7.0/src/core/data_model.h
 @@ -417,5 +417,6 @@ int DM_PRIV_ReRegister_DBParam_Default(c
  bool DM_PRIV_IsChildNodeOf(dm_node_t *node, dm_node_t *parent_node);
  void DM_PRIV_GetAllEventsAndCommands(dm_node_t *node, str_vector_t *events, str_vector_t *commands);
@@ -39,10 +39,10 @@ Index: obuspa-10.0.6.0/src/core/data_model.h
 +int vendor_create_dm_cache(char *paths[], int num_paths);
  #endif
  
-Index: obuspa-10.0.6.0/src/core/handle_get.c
+Index: obuspa-10.0.7.0/src/core/handle_get.c
 ===================================================================
---- obuspa-10.0.6.0.orig/src/core/handle_get.c
-+++ obuspa-10.0.6.0/src/core/handle_get.c
+--- obuspa-10.0.7.0.orig/src/core/handle_get.c
++++ obuspa-10.0.7.0/src/core/handle_get.c
 @@ -129,6 +129,7 @@ void MSG_HANDLER_HandleGet(Usp__Msg *usp
          goto exit;
      }
@@ -51,10 +51,10 @@ Index: obuspa-10.0.6.0/src/core/handle_get.c
      // Calculate the number of hierarchical levels to traverse in the data model when performing partial path resolution
      // NOTE: protocol buffer has depth as an unsigned quantity, but internally we use a signed number, so limit range to that of a signed number
      depth = usp->body->request->get->max_depth;
-Index: obuspa-10.0.6.0/src/core/msg_handler.c
+Index: obuspa-10.0.7.0/src/core/msg_handler.c
 ===================================================================
---- obuspa-10.0.6.0.orig/src/core/msg_handler.c
-+++ obuspa-10.0.6.0/src/core/msg_handler.c
+--- obuspa-10.0.7.0.orig/src/core/msg_handler.c
++++ obuspa-10.0.7.0/src/core/msg_handler.c
 @@ -987,6 +987,8 @@ int HandleUspMessage(Usp__Msg *usp, char
                  MSG_HANDLER_UspMsgTypeToString(usp->header->msg_type),
                  iso8601_cur_time(buf, sizeof(buf)) );

obuspa/patches/1003-ct-full-access-rename.patch

@@ -1,8 +1,8 @@
-Index: obuspa-10.0.6.0/src/core/data_model.c
+Index: obuspa-10.0.7.0/src/core/data_model.c
 ===================================================================
---- obuspa-10.0.6.0.orig/src/core/data_model.c
-+++ obuspa-10.0.6.0/src/core/data_model.c
-@@ -5516,7 +5516,7 @@ int RegisterDefaultControllerTrust(void)
+--- obuspa-10.0.7.0.orig/src/core/data_model.c
++++ obuspa-10.0.7.0/src/core/data_model.c
+@@ -5519,7 +5519,7 @@ int RegisterDefaultControllerTrust(void)
      int err = USP_ERR_OK;
  
      // Register 'Full Access' role

obuspa/patches/2004-mqtt-dualstack-fallback.patch

@@ -1,7 +1,7 @@
-Index: obuspa-10.0.6.0/src/core/mqtt.c
+Index: obuspa-10.0.7.0/src/core/mqtt.c
 ===================================================================
---- obuspa-10.0.6.0.orig/src/core/mqtt.c
-+++ obuspa-10.0.6.0/src/core/mqtt.c
+--- obuspa-10.0.7.0.orig/src/core/mqtt.c
++++ obuspa-10.0.7.0/src/core/mqtt.c
 @@ -53,6 +53,7 @@
  #include <openssl/bio.h>
  #include <openssl/err.h>

obuspa/patches/2005-revert-mqtt-sub-error.patch

@@ -1,15 +0,0 @@
-Index: obuspa-10.0.6.0/src/core/mqtt.c
-===================================================================
---- obuspa-10.0.6.0.orig/src/core/mqtt.c
-+++ obuspa-10.0.6.0/src/core/mqtt.c
-@@ -3447,8 +3447,8 @@ void SubscribeToAll(mqtt_client_t *clien
-         // Exit if no agent response topic configured (or set by the CONNACK)
-         USP_SNPRINTF(buf, sizeof(buf), "%s: No response topic configured (or set by the CONNACK)", __FUNCTION__);
-         USP_LOG_Error("%s", buf);
--        HandleMqttError(client, kMqttFailure_Misconfigured, buf);
--        return;
-+        //HandleMqttError(client, kMqttFailure_Misconfigured, buf);
-+        //return;
-     }
- 
-     // Subscribe to all subscriptions configured in Device.MQTT.Client.{i}.Subscription.{i}

packet-capture-diagnostics/files/scripts/packetcapture

@@ -97,15 +97,13 @@ packet_capture_launch() {
 	fi
 
 	if [ -n "${interface}" ]; then
-		intf=$(ifstatus "${interface}" | jq ".l3_device")
+		intf=$(ifstatus "${interface}" | jsonfilter -e '$.l3_device')
 
 		if [ -z "${intf}" ]; then
 			# Error
 			packet_capture_error "Error_Internal" "${proto}"
 			return
 		fi
-
-		intf=$(eval echo "${intf}")
 	fi
 
 	cmd="timeout ${duration} tcpdump -w ${filename}"

parental-control/Makefile

@@ -5,13 +5,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=parental-control
-PKG_VERSION:=1.2.1
+PKG_VERSION:=1.3.2
 
 LOCAL_DEV:=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/network/parental-control.git
-PKG_SOURCE_VERSION:=120dbcd6508b817d2ce3d579a1bfbd5bfd1a44cb
+PKG_SOURCE_VERSION:=7ae6eaa6cc946ed05693bc84c61edbb16b1727bd
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_MIRROR_HASH:=skip
 endif
@@ -81,19 +81,20 @@ define Package/parental-control/install
 
 	$(INSTALL_DIR) $(1)/etc/uci-defaults
 	$(INSTALL_DATA) ./files/etc/uci-defaults/95-firewall_parentalcontrol.ucidefaults $(1)/etc/uci-defaults/
-	$(INSTALL_DATA) ./files/etc/uci-defaults/95-migrate_urlfilter.ucidefaults $(1)/etc/uci-defaults/
+	$(INSTALL_DATA) ./files/etc/uci-defaults/35-migrate_urlfilter.ucidefaults $(1)/etc/uci-defaults/
 
 	$(INSTALL_DIR) $(1)/lib/upgrade/keep.d
 	$(INSTALL_DATA) ./files/lib/upgrade/keep.d/parentalcontrol $(1)/lib/upgrade/keep.d/parentalcontrol
 
 	$(BBFDM_REGISTER_SERVICES) -v ${VENDOR_PREFIX} ./bbfdm_service.json $(1) parentalcontrol
 
+	$(INSTALL_DATA) ./files/etc/uci-defaults/40-parental_control_update_bundle_path $(1)/etc/uci-defaults/
 ifeq ($(CONFIG_PARENTAL_CONTROL_URLFILTERING),y)
-	$(INSTALL_DATA) ./files/etc/uci-defaults/55-add-default-bundles $(1)/etc/uci-defaults/
+	$(INSTALL_DATA) ./files/etc/uci-defaults/50-parental_control_add_bundles $(1)/etc/uci-defaults/
 	$(CP) ./files/urlbundle_override.json $(1)/etc/parentalcontrol/
 else
 	$(BBFDM_INSTALL_MS_PLUGIN) -v ${VENDOR_PREFIX} ./files/urlbundle_override.json $(1) parentalcontrol
-	$(INSTALL_DATA) ./files/etc/uci-defaults/50-parental_control_urlfilter $(1)/etc/uci-defaults/
+	$(INSTALL_DATA) ./files/etc/uci-defaults/50-parental_control_disable_urlfilter $(1)/etc/uci-defaults/
 endif
 endef
 

parental-control/files/etc/config/parentalcontrol

@@ -1,4 +1,3 @@
 config globals 'globals'
-    option enable '0'
+    option enable '1'
     option loglevel '3'
-    option urlfilter '1'

parental-control/files/etc/firewall.parentalcontrol

@@ -16,8 +16,5 @@ if [ "${enabled}" -eq "1" ]; then
 else
 	# remove internet_access and profile_bedtime_schedule rules
 	remove_internet_schedule_rules
-	# remove urlfilter daemon rules
-	if [ "${urlfilter}" -eq "1" ]; then
-		remove_iptables_nfqueue_rules
-	fi
+	remove_iptables_nfqueue_rules
 fi

parental-control/files/etc/init.d/parentalcontrol

@@ -44,9 +44,11 @@ configure_fw_rules() {
 		else
 			# Now flush the existing connections, otherwise,
 			# URL filtering cannot be performed on already open sites.
-			if [ -n "$(which conntrack)" ]; then
-				sleep 5
-				conntrack -F
+			if which hw_nat > /dev/null 2>&1; then
+				hw_nat -! > /dev/null 2>&1
+			fi
+			if which conntrack > /dev/null 2>&1; then
+				flush_conntrack_for_hosts
 			fi
 
 			# this is for urlfilter daemon
@@ -86,7 +88,7 @@ start_service() {
 	# add firewall rules
 	configure_fw_rules
 
-	if [ "${urlfilter}" -eq "1" ] && [ -d "/apps" ]; then
+	if [ "${urlfilter}" -eq "1" ]; then
 		# add default bundles
 		[ -n "${bundle_path}" ] && mkdir -p ${bundle_path}
 		process_default_bundles

parental-control/files/etc/uci-defaults/35-migrate_urlfilter.ucidefaults

@@ -2,6 +2,8 @@
 
 . /lib/functions.sh
 
+[ ! -f "/etc/config/urlfilter" ] && exit 0
+
 # Convert URL filter to parental control format
 urlfilter_config="/etc/config/urlfilter"
 parentalcontrol_config="/etc/config/parentalcontrol"

parental-control/files/etc/uci-defaults/40-parental_control_update_bundle_path

@@ -0,0 +1,38 @@
+#!/bin/sh
+
+[ ! -f "/etc/config/parentalcontrol" ] && exit 0
+
+APPS_DIR="/apps"
+
+check_mounted_app_partition() {
+	local free
+
+	if [ ! -d "${APPS_DIR}" ]; then
+		return 1
+	fi
+
+	# Check free space in disk
+	free="$(df -P "${APPS_DIR}"|tail -n 1|awk '{print $4}')"
+
+	# disable if free storage is less then 300M
+	if [ "${free}" -lt 307200 ]; then
+		return 1
+	fi
+
+	return 0
+}
+
+
+if check_mounted_app_partition; then
+	uci -q set parentalcontrol.globals.bundle_path="${APPS_DIR}/parentalcontrol"
+
+	# configure the urlfilter if not configured
+	urlfilter="$(uci -q get parentalcontrol.globals.urlfilter)"
+	if [ -z "${urlfilter}" ]; then
+		uci -q set parentalcontrol.globals.urlfilter='1'
+	fi
+else
+	uci -q set parentalcontrol.globals.urlfilter='0'
+fi
+
+exit 0

parental-control/files/etc/uci-defaults/50-parental_control_add_bundles

@@ -0,0 +1,43 @@
+#!/bin/sh
+
+[ ! -f "/etc/config/parentalcontrol" ] && exit 0
+
+COUNT=1
+
+add_urlbundle()
+{
+	local name url
+
+	url="${1}"; shift
+	name="$*"
+
+	uci -q set parentalcontrol.urlbundle_${COUNT}=urlbundle
+	uci -q set parentalcontrol.urlbundle_${COUNT}.name="${name}"
+	uci -q set parentalcontrol.urlbundle_${COUNT}.download_url="${url}"
+
+	COUNT="$((COUNT+1))"
+}
+
+urlfilter="$(uci -q get parentalcontrol.globals.urlfilter)"
+if [ "${urlfilter}" -eq "1" ]; then
+	add_urlbundle "https://blocklistproject.github.io/Lists/alt-version/abuse-nl.txt" "Abuse"
+	add_urlbundle "https://blocklistproject.github.io/Lists/alt-version/ads-nl.txt" "Ads"
+	add_urlbundle "https://blocklistproject.github.io/Lists/alt-version/crypto-nl.txt" "Crypto"
+	add_urlbundle "https://blocklistproject.github.io/Lists/alt-version/drugs-nl.txt" "Drugs"
+	add_urlbundle 'https://blocklistproject.github.io/Lists/alt-version/everything-nl.txt' "Everything else"
+	add_urlbundle 'https://blocklistproject.github.io/Lists/alt-version/facebook-nl.txt' 'Facebook/Instagram'
+	add_urlbundle 'https://blocklistproject.github.io/Lists/alt-version/fraud-nl.txt' 'Fraud'
+	add_urlbundle 'https://blocklistproject.github.io/Lists/alt-version/gambling-nl.txt' 'Gambling'
+	add_urlbundle 'https://blocklistproject.github.io/Lists/alt-version/malware-nl.txt' 'Malware'
+	add_urlbundle 'https://blocklistproject.github.io/Lists/alt-version/phishing-nl.txt' 'Phishing'
+	add_urlbundle 'https://blocklistproject.github.io/Lists/alt-version/piracy-nl.txt' 'Piracy'
+	add_urlbundle 'https://blocklistproject.github.io/Lists/alt-version/porn-nl.txt' 'Porn'
+	add_urlbundle 'https://blocklistproject.github.io/Lists/alt-version/ransomware-nl.txt' 'Ransomware'
+	add_urlbundle 'https://blocklistproject.github.io/Lists/alt-version/redirect-nl.txt' 'Redirect'
+	add_urlbundle 'https://blocklistproject.github.io/Lists/alt-version/scam-nl.txt' 'Scam'
+	add_urlbundle 'https://blocklistproject.github.io/Lists/alt-version/tiktok-nl.txt' 'TikTok'
+	add_urlbundle 'https://blocklistproject.github.io/Lists/alt-version/torrent-nl.txt' 'Torrent'
+	add_urlbundle 'https://blocklistproject.github.io/Lists/alt-version/tracking-nl.txt' 'Tracking'
+fi
+
+exit 0

parental-control/files/etc/uci-defaults/50-parental_control_disable_urlfilter

@@ -0,0 +1,14 @@
+#!/bin/sh
+
+. /lib/functions.sh
+
+[ ! -f "/etc/config/parentalcontrol" ] && exit 0
+
+uci -q set parentalcontrol.globals.urlfilter='0'
+
+_delete_urlbundle() {
+	uci_remove parentalcontrol "${1}"
+}
+
+config_load "parentalcontrol"
+config_foreach _delete_urlbundle urlbundle

parental-control/files/etc/uci-defaults/50-parental_control_urlfilter

@@ -1,7 +0,0 @@
-#!/bin/sh
-
-. /lib/functions.sh
-
-[ ! -f "/etc/config/parentalcontrol" ] && exit 0
-
-uci -q set parentalcontrol.globals.urlfilter='0'

parental-control/files/etc/uci-defaults/55-add-default-bundles

@@ -1,43 +0,0 @@
-#!/bin/sh
-
-# if /apps partition is not present then we don't support urlfiltering
-[ -d "/apps" ] || exit 0
-
-COUNT=1
-
-add_urlbundle()
-{
-	local enabled name url
-
-	enabled="${1}"; shift
-	url="${1}"; shift
-	name="${@}"
-
-	uci -q set parentalcontrol.urlbundle_${COUNT}=urlbundle
-	uci -q set parentalcontrol.urlbundle_${COUNT}.enable="${enabled}"
-	uci -q set parentalcontrol.urlbundle_${COUNT}.name="${name}"
-	uci -q set parentalcontrol.urlbundle_${COUNT}.download_url="${url}"
-
-	COUNT="$((COUNT+1))"
-}
-
-add_urlbundle "0" "https://blocklistproject.github.io/Lists/alt-version/abuse-nl.txt" "Abuse"
-add_urlbundle "0" "https://blocklistproject.github.io/Lists/alt-version/ads-nl.txt" "Ads"
-add_urlbundle "0" "https://blocklistproject.github.io/Lists/alt-version/crypto-nl.txt" "Crypto"
-add_urlbundle "1" "https://blocklistproject.github.io/Lists/alt-version/drugs-nl.txt" "Drugs"
-add_urlbundle "0" 'https://blocklistproject.github.io/Lists/alt-version/everything-nl.txt' "Everything else"
-add_urlbundle "1" 'https://blocklistproject.github.io/Lists/alt-version/facebook-nl.txt' 'Facebook/Instagram'
-add_urlbundle "1" 'https://blocklistproject.github.io/Lists/alt-version/fraud-nl.txt' 'Fraud'
-add_urlbundle "1" 'https://blocklistproject.github.io/Lists/alt-version/gambling-nl.txt' 'Gambling'
-add_urlbundle "0" 'https://blocklistproject.github.io/Lists/alt-version/malware-nl.txt' 'Malware'
-add_urlbundle "1" 'https://blocklistproject.github.io/Lists/alt-version/phishing-nl.txt' 'Phishing'
-add_urlbundle "1" 'https://blocklistproject.github.io/Lists/alt-version/piracy-nl.txt' 'Piracy'
-add_urlbundle "0" 'https://blocklistproject.github.io/Lists/alt-version/porn-nl.txt' 'Porn'
-add_urlbundle "1" 'https://blocklistproject.github.io/Lists/alt-version/ransomware-nl.txt' 'Ransomware'
-add_urlbundle "0" 'https://blocklistproject.github.io/Lists/alt-version/redirect-nl.txt' 'Redirect'
-add_urlbundle "1" 'https://blocklistproject.github.io/Lists/alt-version/scam-nl.txt' 'Scam'
-add_urlbundle "0" 'https://blocklistproject.github.io/Lists/alt-version/tiktok-nl.txt' 'TikTok'
-add_urlbundle "0" 'https://blocklistproject.github.io/Lists/alt-version/torrent-nl.txt' 'Torrent'
-add_urlbundle "0" 'https://blocklistproject.github.io/Lists/alt-version/tracking-nl.txt' 'Tracking'
-
-exit 0

parental-control/files/lib/parentalcontrol/parentalcontrol.sh

@@ -13,7 +13,10 @@ IP_RULE=""
 ACL_FILE=""
 parentalcontrol_ipv4_forward=""
 parentalcontrol_ipv6_forward=""
-default_bundle_dir="/apps/parentalcontrol/default/"
+
+bundle_path="$(uci -q get parentalcontrol.globals.bundle_path)"
+
+default_bundle_dir="${bundle_path}/default/"
 bundle_archive="/etc/parentalcontrol/urlbundles.tar.xz"
 
 log() {
@@ -255,7 +258,9 @@ handle_schedule() {
 			schedule_added="1"
 		fi
 
-		target="ACCEPT"
+		# internet_access has been updated to be internet_break
+		# so drop traffic during the schedule, and allow outside the schedule
+		target="DROP"
 
 		config_get local_start_time "$schedule_section" "start_time" "00:00"
 		config_get duration "$schedule_section" "duration"
@@ -362,11 +367,6 @@ handle_internet_break() {
 			config_load "schedules"
 			config_foreach handle_schedule schedule "schedule" "$schedule_ref"
 		fi
-
-		# for access rule to work, need to have default drop rule as last rule
-		if [ "$schedule_added" = "1" ]; then
-			add_access_rule "$ACCESS_RULE" "" "" "" "DROP"
-		fi
 	done
 }
 
@@ -438,15 +438,31 @@ add_internet_schedule_rules() {
 }
 
 add_iptables_nfqueue_rules() {
-	iptables -w -nL FORWARD|grep -iqE "NFQUEUE"
-	if [ "$?" -ne 0 ]; then
-		# setup netfilter queue 0, use queue bypass so that if no application is
-		# listening to this queue then traffic is unaffected.
-		iptables -w -I FORWARD 1 -p tcp --match multiport --ports 80,443,53 -j NFQUEUE --queue-num 0 --queue-bypass
-		iptables -w -I FORWARD 1 -p udp --match multiport --ports 80,443,53 -j NFQUEUE --queue-num 0 --queue-bypass
+	local filter_used
 
-		iptables -w -I INPUT 1 -p tcp --match multiport --ports 53 -j NFQUEUE --queue-num 0 --queue-bypass
-		iptables -w -I INPUT 1 -p udp --match multiport --ports 53 -j NFQUEUE --queue-num 0 --queue-bypass
+	# Check if urlfilter used
+	if ! uci show parentalcontrol | grep -q profile_urlfilter; then
+		return
+	fi
+
+	# IPv4 rules
+	iptables -w -nL FORWARD | grep -iqE "NFQUEUE"
+	if [ "$?" -ne 0 ]; then
+		# capture DNS responses (UDP/TCP sport 53) in FORWARD
+		iptables -w -I FORWARD 1 -p tcp --sport 53 -j NFQUEUE --queue-num 0 --queue-bypass
+		iptables -w -I FORWARD 1 -p udp --sport 53 -j NFQUEUE --queue-num 0 --queue-bypass
+
+		# INPUT: DNS replies to router, skip loopback
+		iptables -w -I INPUT 1 -p tcp --sport 53 ! -i lo -j NFQUEUE --queue-num 0 --queue-bypass
+		iptables -w -I INPUT 1 -p udp --sport 53 ! -i lo -j NFQUEUE --queue-num 0 --queue-bypass
+
+		# OUTPUT: DNS replies from router, skip loopback
+		iptables -w -I OUTPUT 1 -p tcp --sport 53 ! -o lo -j NFQUEUE --queue-num 0 --queue-bypass
+		iptables -w -I OUTPUT 1 -p udp --sport 53 ! -o lo -j NFQUEUE --queue-num 0 --queue-bypass
+
+		# HTTP/HTTPS flows for urlfilter
+		iptables -w -I FORWARD 1 -p tcp --match multiport --ports 80,443 -j NFQUEUE --queue-num 0 --queue-bypass
+		iptables -w -I FORWARD 1 -p udp --match multiport --ports 80,443 -j NFQUEUE --queue-num 0 --queue-bypass
 
 		# disable acceleration for https packet so that they can be read by urlfilter
 		ebtables --concurrent -A FORWARD -p ip --ip-protocol 6 --ip-destination-port 443 -j SKIPLOG 2> /dev/null
@@ -454,14 +470,24 @@ add_iptables_nfqueue_rules() {
 		ebtables --concurrent -A FORWARD -p ip --ip-protocol 17 --ip-source-port 53 -j SKIPLOG 2> /dev/null
 	fi
 
-	ip6tables -w -nL FORWARD|grep -iqE "NFQUEUE"
+	# IPv6 rules
+	ip6tables -w -nL FORWARD | grep -iqE "NFQUEUE"
 	if [ "$?" -ne 0 ]; then
-		#ip6table rules
-		ip6tables -w -I FORWARD 1 -p tcp --match multiport --ports 80,443,53 -j NFQUEUE --queue-num 0 --queue-bypass
-		ip6tables -w -I FORWARD 1 -p udp --match multiport --ports 80,443,53 -j NFQUEUE --queue-num 0 --queue-bypass
+		# capture DNS responses (UDP/TCP sport 53) in FORWARD
+		ip6tables -w -I FORWARD 1 -p tcp --sport 53 -j NFQUEUE --queue-num 0 --queue-bypass
+		ip6tables -w -I FORWARD 1 -p udp --sport 53 -j NFQUEUE --queue-num 0 --queue-bypass
 
-		ip6tables -w -I INPUT 1 -p tcp --match multiport --ports 53 -j NFQUEUE --queue-num 0 --queue-bypass
-		ip6tables -w -I INPUT 1 -p udp --match multiport --ports 53 -j NFQUEUE --queue-num 0 --queue-bypass
+		# INPUT: DNS replies to router, skip loopback
+		ip6tables -w -I INPUT 1 -p tcp --sport 53 ! -i lo -j NFQUEUE --queue-num 0 --queue-bypass
+		ip6tables -w -I INPUT 1 -p udp --sport 53 ! -i lo -j NFQUEUE --queue-num 0 --queue-bypass
+
+		# OUTPUT: DNS replies from router, skip loopback
+		ip6tables -w -I OUTPUT 1 -p tcp --sport 53 ! -o lo -j NFQUEUE --queue-num 0 --queue-bypass
+		ip6tables -w -I OUTPUT 1 -p udp --sport 53 ! -o lo -j NFQUEUE --queue-num 0 --queue-bypass
+
+		# HTTP/HTTPS flows for urlfilter
+		ip6tables -w -I FORWARD 1 -p tcp --match multiport --ports 80,443 -j NFQUEUE --queue-num 0 --queue-bypass
+		ip6tables -w -I FORWARD 1 -p udp --match multiport --ports 80,443 -j NFQUEUE --queue-num 0 --queue-bypass
 
 		# disable acceleration for https packet so that they can be read by urlfilter
 		ebtables --concurrent -A FORWARD -p ip6 --ip6-protocol 6 --ip6-destination-port 443 -j SKIPLOG 2> /dev/null
@@ -471,26 +497,38 @@ add_iptables_nfqueue_rules() {
 }
 
 remove_iptables_nfqueue_rules() {
-	iptables -w -nL FORWARD|grep -iqE "NFQUEUE"
+	iptables -w -nL FORWARD | grep -iqE "NFQUEUE"
 	if [ "$?" -eq 0 ]; then
-		iptables -w -D FORWARD -p tcp --match multiport --ports 80,443,53 -j NFQUEUE --queue-num 0 --queue-bypass
-		iptables -w -D FORWARD -p udp --match multiport --ports 80,443,53 -j NFQUEUE --queue-num 0 --queue-bypass
+		# DNS response rules
+		iptables -w -D FORWARD -p tcp --sport 53 -j NFQUEUE --queue-num 0 --queue-bypass
+		iptables -w -D FORWARD -p udp --sport 53 -j NFQUEUE --queue-num 0 --queue-bypass
+		iptables -w -D INPUT  -p tcp --sport 53 ! -i lo -j NFQUEUE --queue-num 0 --queue-bypass
+		iptables -w -D INPUT  -p udp --sport 53 ! -i lo -j NFQUEUE --queue-num 0 --queue-bypass
+		iptables -w -D OUTPUT -p tcp --sport 53 ! -o lo -j NFQUEUE --queue-num 0 --queue-bypass
+		iptables -w -D OUTPUT -p udp --sport 53 ! -o lo -j NFQUEUE --queue-num 0 --queue-bypass
 
-		iptables -w -D INPUT -p tcp --match multiport --ports 53 -j NFQUEUE --queue-num 0 --queue-bypass
-		iptables -w -D INPUT -p udp --match multiport --ports 53 -j NFQUEUE --queue-num 0 --queue-bypass
+		# HTTP/HTTPS
+		iptables -w -D FORWARD -p tcp --match multiport --ports 80,443 -j NFQUEUE --queue-num 0 --queue-bypass
+		iptables -w -D FORWARD -p udp --match multiport --ports 80,443 -j NFQUEUE --queue-num 0 --queue-bypass
 
 		ebtables --concurrent -D FORWARD -p ip --ip-protocol 6 --ip-destination-port 443 -j SKIPLOG 2> /dev/null
 		ebtables --concurrent -D FORWARD -p ip --ip-protocol 6 --ip-source-port 53 -j SKIPLOG 2> /dev/null
 		ebtables --concurrent -D FORWARD -p ip --ip-protocol 17 --ip-source-port 53 -j SKIPLOG 2> /dev/null
 	fi
-	ip6tables -w -nL FORWARD|grep -iqE "NFQUEUE"
-	if [ "$?" -eq 0 ]; then
-		#ip6table rules
-		ip6tables -w -D FORWARD -p tcp --match multiport --ports 80,443,53 -j NFQUEUE --queue-num 0 --queue-bypass
-		ip6tables -w -D FORWARD -p udp --match multiport --ports 80,443,53 -j NFQUEUE --queue-num 0 --queue-bypass
 
-		ip6tables -w -D INPUT -p tcp --match multiport --ports 53 -j NFQUEUE --queue-num 0 --queue-bypass
-		ip6tables -w -D INPUT -p udp --match multiport --ports 53 -j NFQUEUE --queue-num 0 --queue-bypass
+	ip6tables -w -nL FORWARD | grep -iqE "NFQUEUE"
+	if [ "$?" -eq 0 ]; then
+		# DNS response rules
+		ip6tables -w -D FORWARD -p tcp --sport 53 -j NFQUEUE --queue-num 0 --queue-bypass
+		ip6tables -w -D FORWARD -p udp --sport 53 -j NFQUEUE --queue-num 0 --queue-bypass
+		ip6tables -w -D INPUT  -p tcp --sport 53 ! -i lo -j NFQUEUE --queue-num 0 --queue-bypass
+		ip6tables -w -D INPUT  -p udp --sport 53 ! -i lo -j NFQUEUE --queue-num 0 --queue-bypass
+		ip6tables -w -D OUTPUT -p tcp --sport 53 ! -o lo -j NFQUEUE --queue-num 0 --queue-bypass
+		ip6tables -w -D OUTPUT -p udp --sport 53 ! -o lo -j NFQUEUE --queue-num 0 --queue-bypass
+
+		# HTTP/HTTPS
+		ip6tables -w -D FORWARD -p tcp --match multiport --ports 80,443 -j NFQUEUE --queue-num 0 --queue-bypass
+		ip6tables -w -D FORWARD -p udp --match multiport --ports 80,443 -j NFQUEUE --queue-num 0 --queue-bypass
 
 		ebtables --concurrent -D FORWARD -p ip6 --ip6-protocol 6 --ip6-destination-port 443 -j SKIPLOG 2> /dev/null
 		ebtables --concurrent -D FORWARD -p ip6 --ip6-protocol 6 --ip6-source-port 53 -j SKIPLOG 2> /dev/null
@@ -513,6 +551,62 @@ remove_internet_schedule_rules() {
 	fi
 }
 
+# Global array for resolved IPs
+URLFILTER_IPS=""
+
+# Resolve hostname or MAC to IP from lease_file
+get_host_ip() {
+	local host="$1"
+	local ip
+	local lease_file="/tmp/dhcp.leases"
+
+	[ -f "$lease_file" ] || lease_file="/etc/parentalcontrol/dhcp.leases"
+	[ -f "$lease_file" ] || { log "Error: get_host_ip(): No DHCP lease file found."; return 1; }
+
+	# try DHCP lease lookup
+	ip="$(awk -v h="$host" '
+	{
+		mac=$2; ipaddr=$3; name=$4
+		if (h == name || h == mac) { print ipaddr; exit }
+	}' "$lease_file")"
+
+	[ -n "$ip" ] && URLFILTER_IPS="$URLFILTER_IPS $ip"
+}
+
+# Process each profile section
+resolve_profile_hosts() {
+	local section="$1"
+	local hostlist
+
+	config_get hostlist "$section" host
+	[ -z "$hostlist" ] && return
+
+	for h in $hostlist; do
+		get_host_ip "$h"
+	done
+}
+
+# Main function to collect IPs and delete conntrack entries
+flush_conntrack_for_hosts() {
+	URLFILTER_IPS=""
+	local count max
+
+	config_foreach resolve_profile_hosts profile
+
+	URLFILTER_IPS="$(echo "$URLFILTER_IPS" | tr ' ' '\n' | sort -u | xargs)"
+	for ip in $URLFILTER_IPS; do
+		count=0
+		max=1000
+		while conntrack -D -s "$ip" >/dev/null 2>&1; do
+			count=$((count+1))
+			if [ $count -ge $max ]; then
+				log "Warning: Forced to stop conntrack delete after $max deletions for $ip (possible loop)"
+				break
+			fi
+		done
+	done
+}
+
 OVERRIDE_JSON="/etc/parentalcontrol/urlbundle_override.json"
 DM_PLUGIN_PATH="/usr/share/bbfdm/micro_services/parentalcontrol/urlbundle_override.json"
 

parental-control/files/lib/parentalcontrol/sync_bundles.sh

@@ -3,12 +3,31 @@
 . /lib/functions.sh
 
 LOCKFILE="/tmp/sync_bundles.lock"
+log_level="$(uci -q get parentalcontrol.globals.loglevel)"
+log_level="${log_level:-1}"
+DEBUG=0
+
+log_err() {
+	logger -t urlfilter.sync -p error "$*"
+	if [ "${DEBUG}" -eq "1" ]; then
+		echo "#ERR# $* #" >/dev/console
+	fi
+}
+
+log_info() {
+	if [ "${log_level}" -gt 3 ]; then
+		logger -t urlfilter.sync -p info "$*"
+	fi
+	if [ "${DEBUG}" -eq "1" ]; then
+		echo "#INFO# $* #" >/dev/console
+	fi
+}
 
 # this script handles syncing bundles
 # if its a remote file, then it would be downloaded and placed in bundle_dir
 bundle_path="$(uci -q get parentalcontrol.globals.bundle_path)"
 if [ -z "${bundle_path}" ]; then
-	bundle_path="/apps/parentalcontrol"
+	return 0
 fi
 
 stringstore_dir="${bundle_path}/stringstore"
@@ -38,15 +57,15 @@ update_bundle_file_from_url() {
 
 	available_memory=$(df "$bundle_dir" | tail -n 1 | awk '{print $(NF-2)}') # Available memory in 1K blocks
 	local needed_blocks=$((bundle_file_size / 1024)) # Convert bundle_file_size to 1K blocks
-	local max_size=$((10 * 1024 * 1024)) # 10MB in bytes
+	local max_size=$((50 * 1024 * 1024)) # 50MB in bytes
 
 	if [ "$available_memory" -le "$needed_blocks" ]; then
-		logger -p info "Error: Not enough disk space for bundle: ${bundle_name}"
+		log_info "Error: Not enough disk space for bundle: ${bundle_name}"
 		return 1
 	fi
 
 	if [ "$bundle_file_size" -gt "$max_size" ]; then
-		logger -p info "update_bundle_file_from_url: Error: File size for ${bundle_name} exceeds 10MB"
+		log_info "update_bundle_file_from_url: Error: File size for ${bundle_name} exceeds 10MB"
 		return 1
 	fi
 
@@ -57,7 +76,7 @@ update_bundle_file_from_url() {
 	else
 		# Random delay (0-5s) before starting the download
 		local delay=$((RANDOM % 6))
-		logger -p info "update_bundle_file_from_url: Waiting ${delay}s before downloading..."
+		log_info "update_bundle_file_from_url: Waiting ${delay}s before downloading..."
 		sleep "$delay"
 
 		# Retry logic with exponential backoff
@@ -65,12 +84,11 @@ update_bundle_file_from_url() {
 		local attempt=1
 		local success=0
 		while [ $attempt -le 3 ]; do
-			curl -s -o "$temp_file" "$download_url"
-			if [ $? -eq 0 ]; then
+			if curl -s -o "$temp_file" "$download_url"; then
 				success=1
 				break
 			else
-				logger -p info "update_bundle_file_from_url: Download failed. Retrying $attempt ..."
+				log_info "update_bundle_file_from_url: Download failed. Retrying $attempt ..."
 				local backoff=$(( (2 ** attempt) + (RANDOM % 3) )) # Exponential backoff + 0-2s jitter
 				sleep "$backoff"
 			fi
@@ -78,7 +96,7 @@ update_bundle_file_from_url() {
 		done
 
 		if [ $success -ne 1 ]; then
-			logger -p info "update_bundle_file_from_url: Failed to download bundle: ${bundle_name}"
+			log_info "update_bundle_file_from_url: Failed to download bundle: ${bundle_name}"
 			rm -f "$temp_file"
 			return 1
 		fi
@@ -89,7 +107,7 @@ update_bundle_file_from_url() {
 	local final_path="${bundle_dir}/${bundle_file_name}"
 	if [[ "$file_path" =~ \.xz$ ]]; then
 		if ! xz -dc "$file_path" > "$final_path"; then
-			logger -p info "update_bundle_file_from_url: Decompression failed."
+			log_info "update_bundle_file_from_url: Decompression failed."
 			rm -f "$final_path"
 			rm -f "$file_path"
 			return 1
@@ -98,7 +116,7 @@ update_bundle_file_from_url() {
 		rm -f "$file_path"
 	elif [[ "$file_path" =~ \.gz$ ]]; then
 		if ! gzip -dc "$file_path" > "$final_path"; then
-			logger -p info "update_bundle_file_from_url: Decompression failed."
+			log_info "update_bundle_file_from_url: Decompression failed."
 			rm -f "$final_path"
 			rm -f "$file_path"
 			return 1
@@ -134,7 +152,6 @@ handle_download_url() {
 	local file_name="${sanitized_url##*/}" # Get everything after the last '/'
 
 	local bundle_file_name="${file_name}.urlbundle"
-	local unprocessed_file=0
 	local file_path="${sanitized_url#file://}"
 
 	if echo "$sanitized_url" | grep -qE "^https?://|^file://"; then
@@ -153,7 +170,7 @@ handle_download_url() {
 		fi
 
 		if [ -n "$previous_bundle_size" ] && [ "$bundle_file_size" -eq "$previous_bundle_size" ]; then
-			return
+			return 0
 		fi
 
 		if echo "$sanitized_url" | grep -q "^file://" && ! echo "$sanitized_url" | grep -Eq "\.(xz|gz)$"; then
@@ -161,7 +178,7 @@ handle_download_url() {
 			sed -i "/^${bundle_file_name} /d" "$bundle_sizes"
 			echo "$bundle_file_name $bundle_file_size" >> "$bundle_sizes"
 			ubus send "parentalcontrol.bundle.update" "{\"bundle_file_path\":\"${file_path}\",\"bundle_name\":\"${bundle_name}\"}"
-			return
+			return 0
 		fi
 
 		# Remove existing entries
@@ -173,11 +190,9 @@ handle_download_url() {
 		update_bundle_file_from_url "$sanitized_url" "$bundle_file_name" "$bundle_file_size" "$bundle_name" "$file_name"
 		return $?
 	else
-		logger -p info "Error: Unsupported URL format for ${bundle_file_name}"
+		log_info "Error: Unsupported URL format for ${bundle_file_name}"
 		return 1
 	fi
-
-	return 0
 }
 
 cleanup_bundle_files() {
@@ -189,7 +204,7 @@ cleanup_bundle_files() {
 	get_download_url() {
 		local section="$1"
 		config_get url "$section" download_url
-		config_get_bool enable "$1" enable 0
+		config_get_bool enable "$1" enable 1
 
 		if [ "${enable}" -eq 0 ]; then
 			# bundle is disabled
@@ -222,46 +237,56 @@ cleanup_bundle_files() {
 	done
 }
 
+cleanup_bundle_sizes() {
+	downloaded_bundle_names="$(cat "$bundle_sizes" | cut -d '.' -f 1)"
+
+	for name in $downloaded_bundle_names; do
+		if ls ${stringstore_dir}/${name}* 2>&1 | grep -qF '.store'; then
+			if ls ${stringstore_dir}/${name}* 2>&1 | grep -q cmph; then
+				continue
+			fi
+		fi
+
+		sed -i "/$name/d" "$bundle_sizes"
+	done
+}
+
 # Main handler for all profile URL bundles
 handle_filter_for_bundles() {
 	local urlfilter
 
 	urlfilter="$(uci -q get parentalcontrol.globals.urlfilter)"
-	# if urlfilter is not enabled or apps partition is not present, then return
-	if [ "${urlfilter}" -ne "1" ] || [ ! -d "/apps" ]; then
-		return
-	fi
-
-	ubus -t 20 wait_for bbfdm.parentalcontrol
-
-	if [ "$?" -ne 0 ]; then
-		logger -p error "bbfdm.parentalcontrol object not found"
-		return
+	# if urlfilter is not enabled, then return
+	if [ "${urlfilter}" -ne "1" ]; then
+		log_info "urlfilter feature not enabled"
+		return 0
 	fi
 
 	initialize_environment
 
 	cleanup_bundle_files "$bundle_dir"
 	cleanup_bundle_files "$stringstore_dir"
+	cleanup_bundle_sizes
 
 	config_load parentalcontrol
 
 	config_get_bool enable globals enable 0
 	if [ "${enable}" -eq 0 ]; then
+		log_info "parental-control feature not enabled"
 		# Parental control is disabled
 		return 0
 	fi
 
-	local profile enable bundles bundle_name download_url
-
 	check_bundle_exists() {
-		local cfg="$1"
+		local enable download_url name cfg
+
+		cfg="$1"
 		config_get name "$cfg" name
-		config_get_bool enable "$cfg" enable 0
+		config_get_bool enable "$cfg" enable 1
 		config_get download_url "$cfg" download_url
 
 		if [ "${enable}" -eq 0 ]; then
-			# bundle is disabled
+			log_info "Skipping bundle ${name} not enabled"
 			return 0
 		fi
 
@@ -282,6 +307,6 @@ handle_filter_for_bundles() {
 # Open file descriptor 200 for locking
 exec 200>"$LOCKFILE"
 # Try to acquire an exclusive lock; exit if another instance is running
-flock -n 200 || { logger -p info "sync_bundles.sh is already running, exiting."; exit 1; }
+flock -n 200 || { log_info "sync_bundles.sh is already running, exiting."; exit 1; }
 
 handle_filter_for_bundles

periodicstats/Makefile

@@ -5,13 +5,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=periodicstats
-PKG_VERSION:=1.5.18
+PKG_VERSION:=1.6.0
 
 LOCAL_DEV:=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/bbf/periodicstats.git
-PKG_SOURCE_VERSION:=2772d77bd477adfdf513499fda11397107996d21
+PKG_SOURCE_VERSION:=63c65f55d00442f5bc1f5a3100abf94e52cd0075
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_MIRROR_HASH:=skip
 endif

peripheral_manager/Makefile

@@ -1,60 +0,0 @@
-#
-# Copyright (C) 2019 iopsys
-#
-# This is free software, licensed under the GNU General Public License v2.
-# See /LICENSE for more information.
-#
-
-include $(TOPDIR)/rules.mk
-include $(INCLUDE_DIR)/kernel.mk
-
-PKG_NAME:=peripheral_manager
-PKG_VERSION:=1.0.6
-PKG_RELEASE:=1
-
-PKG_SOURCE_VERSION:=21522c2003b8c61904acc61ff97e54fc9b0c3c92
-PKG_SOURCE_PROTO:=git
-PKG_SOURCE_URL:=https://dev.iopsys.eu/iopsys/peripheral-manager
-
-PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_RELEASE)-$(PKG_SOURCE_VERSION).tar.gz
-PKG_MIRROR_HASH:=skip
-PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
-PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)
-
-PKG_LICENSE:=GPLv2
-PKG_LICENSE_FILES:=LICENSE
-
-# support parallel build
-PKG_BUILD_PARALLEL:=1
-
-# run install target when cross compiling. basically, make install DESTDIR=$(PKG_INSTALL_DIR)
-# this way we don't need to pick out the resulting files from the build dir.
-PKG_INSTALL:=1
-
-include $(INCLUDE_DIR)/package.mk
-include $(INCLUDE_DIR)/cmake.mk
-
-define Package/peripheral_manager
-	CATEGORY:=Utilities
-	TITLE:=Application deamon for handling of peripheral
-	URL:=
-	DEPENDS:=+libuci +libubus +libblobmsg-json
-endef
-
-define Package/peripheral_manager/description
-	Application handling peripheral
-endef
-
-CMAKE_OPTIONS +=  \
-		-DCMAKE_BUILD_TYPE:String="Release" \
-
-define Package/peripheral_manager/install
-	$(CP) ./files/* $(1)/
-	$(INSTALL_DIR) $(1)/etc/
-	$(INSTALL_DIR) $(1)/etc/init.d/
-	$(INSTALL_DIR) $(1)/sbin
-	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/peripheral_manager $(1)/sbin/
-#	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/gpio_test $(1)/sbin/
-endef
-
-$(eval $(call BuildPackage,peripheral_manager))

peripheral_manager/files/etc/init.d/ledmngr

@@ -1,62 +0,0 @@
-#!/bin/sh /etc/rc.common
-
-START=20
-USE_PROCD=1
-
-setled() {
-	local enable
-	local brightness
-
-	config_get_bool enable $1 enable 1
-	config_get brightness $1 brightness 100
-	ubus call led.$1 set "{\"enable\":$enable,\"brightness\":$brightness}"
-}
-
-start_service() {
-	local enable
-
-	config_load leds
-	config_foreach setled led
-	config_get_bool enable leds enable 1
-
-	if [ "$enable" == "0" ]; then
-		ubus call leds set  '{"state" : "alloff"}'
-	else
-		ubus call leds set  '{"state" : "normal"}'
-	fi
-}
-
-boot() {
-	local led ledname
-
-	ubus list led* >/dev/null || sleep 1
-	ubus list led* >/dev/null || sleep 1
-
-	[ -f /etc/config/leds ] || touch /etc/config/leds
-
-	if ! uci -q get leds.leds >/dev/null; then
-		uci set leds.leds=leds
-		uci set leds.leds.enable=1
-	fi
-
-	for led in $(ubus list led.*); do
-		ledname=${led:4}
-		case $ledname in
-			*phy*) continue ;;
-		esac
-		if ! uci -q  get leds.$ledname >/dev/null; then
-			uci set leds.$ledname=led
-			uci set leds.$ledname.enable=1
-		fi
-	done
-
-	uci commit leds
-
-	start
-}
-
-service_triggers()
-{
-	procd_add_reload_trigger "leds"
-}
-

peripheral_manager/files/etc/init.d/peripheral_manager

@@ -1,25 +0,0 @@
-#!/bin/sh /etc/rc.common
-
-START=12
-STOP=89
-
-USE_PROCD=1
-NAME=peripheral_manager
-PROG=/sbin/peripheral_manager
-
-start_service() {
-	procd_open_instance
-	procd_set_param command "$PROG" -f
-	procd_set_param respawn
-	procd_close_instance
-}
-
-service_running() {
-	ubus -t 2 wait_for led.status
-	ubus call led.status set '{"state":"notice"}'
-	ubus -t 2 wait_for buttons
-}
-
-stop_service() {
-    ubus call leds set '{"state":"alloff"}'
-}

peripheral_manager/files/sbin/ledctl

@@ -1,19 +0,0 @@
-#!/bin/sh
-
-usage () {
-	echo "Usage: ledctl [normal|test|allon|alloff|production]"
-	exit 1
-}
-
-[ $# -ne 1 ] && usage
-ledstate=$(echo $1 | tr 'A-Z' 'a-z')
-
-case $ledstate in
-	normal|test|allon|alloff|production)
-		ubus call leds set "{\"state\" : \"$ledstate\"}"
-	;;
-	*)
-		usage
-	;;
-esac
-

qosmngr/files/airoha/lib/qos/airoha.sh

@@ -114,6 +114,7 @@ hw_init_all() {
     export TMP_HW_QUEUE_LIST=""
     echo clear > /proc/ifc_debug
     echo reinit > /proc/ifc_debug
+    echo 'set mode 0 2' 2> /dev/null > /proc/tc3162/fe_acnt_mapping # Accounter #2 is used for meter #0, so we need re-assign IP flow accounting mode (mode 0) to #2.
 
     for tc in $(seq 0 7); do
         rm -rf "/tmp/qos/dscp_values_${tc}_4"

qosmngr/files/airoha/lib/qos/policer.sh

@@ -98,7 +98,7 @@ handle_policer() {
 # Configure policer based on UCI subtree 'qos.policer'
 configure_policer() {
     # initialize ratelimit params
-    /userfs/bin/femgr ratelimit set rx_mode 1 2
+    /userfs/bin/femgr ratelimit set rx_mode 1 2 0
     /userfs/bin/qdmamgr_wan set general_rx_init enable trtcm 8 125
 
     for intf in $(jsonfilter -i /etc/board.json -e @.network.lan.ports[*] -e @.network.lan.device -e @.network.wan.device | xargs); do

qosmngr/files/airoha/lib/qos/shaper.sh

@@ -42,7 +42,7 @@ handle_shaper() {
 # Configure shaper based on options saved to UCI tree 'qos.shaper'
 configure_shaper() {
     # initialize ratelimit params
-    /userfs/bin/femgr ratelimit set rx_mode 0 2
+    /userfs/bin/femgr ratelimit set rx_mode 0 2 0
     /userfs/bin/qdmamgr_lan set general_rx_init enable trtcm 8 125
 
     # Delete existing shaper

quickjs/Makefile

@@ -5,7 +5,7 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/bellard/quickjs.git
-PKG_SOURCE_DATE:=2025-07-22
+PKG_SOURCE_DATE:=2025-07-09
 PKG_SOURCE_VERSION:=1fdc768fdc8571300755cdd3e4654ce99c0255ce
 PKG_MIRROR_HASH:=skip
 PKG_LICENSE:=MIT
@@ -31,8 +31,7 @@ define Package/quickjs/description
 endef
 
 MAKE_FLAGS = \
-	prefix=/usr \
-	CONFIG_SMALL=y \
+	PREFIX=/usr \
 	EXTRA_LIBS="-latomic" \
 	CROSS_PREFIX="$(TARGET_CROSS)"
 
@@ -42,12 +41,10 @@ define Build/Compile
 	# the host tools ('host-qjsc', 'unicode_gen') with the host compiler
 	# and flags.
 	# We still pass MAKE_FLAGS so the upstream Makefile knows we're cross-compiling.
-	# We have to manually add DEFINES from the upstream Makefile to HOST_CFLAGS
-	# because we are overriding CFLAGS.
+	CFLAGS="$(HOST_CFLAGS)" \
+	LDFLAGS="$(HOST_LDFLAGS)" \
 	$(MAKE) -C $(PKG_BUILD_DIR) \
 		$(MAKE_FLAGS) \
-		CFLAGS="$(HOST_CFLAGS) -D_GNU_SOURCE -DCONFIG_VERSION='\"$(shell cat $(PKG_BUILD_DIR)/VERSION | tr -d '\n')\"'" \
-		LDFLAGS="$(HOST_LDFLAGS)" \
 		host-qjsc unicode_gen
 
 	# Then we proceed with the default build process for the target binaries.
@@ -56,17 +53,16 @@ define Build/Compile
 endef
 
 define Build/InstallDev
-	$(INSTALL_DIR) $(1)/usr/lib/quickjs
-	$(CP) $(PKG_INSTALL_DIR)/usr/local/lib/quickjs/libquickjs.a $(1)/usr/lib/
-	# $(CP) $(PKG_INSTALL_DIR)/usr/local/lib/quickjs/libquickjs.lto.a $(1)/usr/lib/
+	$(INSTALL_DIR) $(1)/usr/lib
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/quickjs/libquickjs.a $(1)/usr/lib/
 	$(INSTALL_DIR) $(1)/usr/include/quickjs
-	$(CP) $(PKG_INSTALL_DIR)/usr/local/include/quickjs/quickjs.h $(1)/usr/include/quickjs/
-	$(CP) $(PKG_INSTALL_DIR)/usr/local/include/quickjs/quickjs-libc.h $(1)/usr/include/quickjs/
+	$(CP) $(PKG_INSTALL_DIR)/usr/include/quickjs/quickjs.h $(1)/usr/include/quickjs/
+	$(CP) $(PKG_INSTALL_DIR)/usr/include/quickjs/quickjs-libc.h $(1)/usr/include/quickjs/
 endef
 
 define Package/quickjs/install
 	$(INSTALL_DIR) $(1)/usr/bin
-	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/local/bin/qjs $(1)/usr/bin/
+	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/qjs $(1)/usr/bin/
 endef
 
 $(eval $(call BuildPackage,quickjs))

quickjs/patches/000-fix_std_loadFile.patch

@@ -1,12 +1,12 @@
-Index: quickjs-2025-07-22-1fdc768f/quickjs-libc.c
-===================================================================
---- quickjs-2025-07-22-1fdc768f.orig/quickjs-libc.c
-+++ quickjs-2025-07-22-1fdc768f/quickjs-libc.c
-@@ -385,20 +385,94 @@ fail:
+diff --git a/quickjs-libc.c b/quickjs-libc.c
+index 54a7a15..a64c4d6 100644
+--- a/quickjs-libc.c
++++ b/quickjs-libc.c
+@@ -385,12 +385,86 @@ fail:
      return JS_EXCEPTION;
  }
  
-+#define  READALL_CHUNK  10*1024
++#define READALL_CHUNK (10*1024)
 +
 +static int readall(FILE *f, JSContext *ctx, uint8_t **dataptr, size_t *sizeptr)
 +{
@@ -86,12 +86,11 @@ Index: quickjs-2025-07-22-1fdc768f/quickjs-libc.c
      uint8_t *buf;
      size_t buf_len;
 -    long lret;
--
 +    long lret = 0;
-+    
+ 
      f = fopen(filename, "rb");
      if (!f)
-         return NULL;
+@@ -398,7 +472,7 @@ uint8_t *js_load_file(JSContext *ctx, size_t *pbuf_len, const char *filename)
      if (fseek(f, 0, SEEK_END) < 0)
          goto fail;
      lret = ftell(f);
@@ -100,7 +99,7 @@ Index: quickjs-2025-07-22-1fdc768f/quickjs-libc.c
          goto fail;
      /* XXX: on Linux, ftell() return LONG_MAX for directories */
      if (lret == LONG_MAX) {
-@@ -414,13 +488,19 @@ uint8_t *js_load_file(JSContext *ctx, si
+@@ -414,13 +488,19 @@ uint8_t *js_load_file(JSContext *ctx, size_t *pbuf_len, const char *filename)
          buf = malloc(buf_len + 1);
      if (!buf)
          goto fail;

self-diagnostics/files/usr/share/self-diagnostics/helper/wifi_assoclist.sh

@@ -1,11 +1,30 @@
-interfaces=$(uci show wireless | grep "ifname=" |  awk -F'[.,=]' '{print$2}')
-for int in $interfaces; do
-	mode=$(uci get "wireless.${int}.mode")
+. /lib/functions.sh
+
+handle_interface() {
+	local config="${1}"
+	local prefix="${2}"
+
+	config_get ifname "${config}" ifname
+	config_get mode ${config} mode
+
 	if [ "$mode" = "ap" ] ; then
-		ap_int=$(uci get "wireless.${int}.ifname")
-		echo "Get assoc list for ${ap_int}"
-		ubus call "wifi.ap.${ap_int}" assoclist
-		echo "Get station info for ${ap_int}"
-		ubus call "wifi.ap.${ap_int}" stations
+		echo "Get assoc list for ${ifname}"
+		ubus call "${prefix}.${ifname}" assoclist
+		echo "Get station info for ${ifname}"
+		ubus call "${prefix}.${ifname}" stations
 	fi
-done
+}
+
+handle_wifi_interface() {
+	handle_interface "$1" "wifi.ap"
+}
+
+handle_mld_interface() {
+	handle_interface "$1" "wifi.apmld"
+}
+
+config_load wireless
+echo "Get associated stations information for non-MLD interfaces"
+config_foreach handle_wifi_interface wifi-iface
+echo "Get associated stations information for MLD interfaces"
+config_foreach handle_mld_interface wifi-mld

self-diagnostics/files/usr/share/self-diagnostics/helper/wifi_sta.sh

@@ -22,3 +22,4 @@ handle_interface() {
 
 config_load wireless
 config_foreach handle_interface wifi-iface
+config_foreach handle_interface wifi-mld

self-diagnostics/files/usr/share/self-diagnostics/helper/wifi_status.sh

@@ -0,0 +1,36 @@
+. /lib/functions.sh
+
+handle_interface() {
+	local config="${1}"
+	local prefix="${2}"
+
+	config_get ifname "${config}" ifname
+	config_get mode ${config} mode
+
+	if [ "$mode" = "ap" ] ; then
+		echo "Get status for ${ifname}"
+		ubus call "${prefix}.${ifname}" status
+	elif [ "$mode" = "sta" ] ; then
+		echo "Get status for bSTA ${ifname}"
+		ubus call "wifi.bsta.${ifname}" status
+	fi
+}
+
+handle_wifi_interface() {
+	handle_interface "$1" "wifi.ap"
+}
+
+handle_mld_interface() {
+	handle_interface "$1" "wifi.apmld"
+}
+
+config_load wireless
+echo "Get wifi status"
+ubus call wifi status
+
+echo "Get wifi status for ap & bsta interfaces"
+config_foreach handle_wifi_interface wifi-iface
+
+echo "Get wifi status for apmld interfaces"
+config_foreach handle_mld_interface wifi-mld
+

self-diagnostics/files/usr/share/self-diagnostics/spec/wifi.json

@@ -13,7 +13,8 @@
 		},
 		{
 			"description": "WiFi Status",
-			"cmd": "ubus call wifi status"
+			"cmd": "sh /usr/share/self-diagnostics/helper/wifi_status.sh",
+			"timeout": 10
 		},
 		{
 			"description": "WiFi Radio Status",

sshmngr/Makefile

@@ -5,13 +5,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=sshmngr
-PKG_VERSION:=1.0.6
+PKG_VERSION:=1.1.1
 
 LOCAL_DEV:=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/network/sshmngr.git
-PKG_SOURCE_VERSION:=0c7d58a51d6f5eb4ad33e03630206bbb4e559779
+PKG_SOURCE_VERSION:=dc0e3933231680aec844d587d49fefbc0cc7f8d7
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_MIRROR_HASH:=skip
 endif

sulu/sulu-base/Makefile

@@ -5,11 +5,11 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=sulu-base
-PKG_VERSION:=5.0.4
+PKG_VERSION:=5.1.1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/websdk/sulu.git
-PKG_SOURCE_VERSION:=47f52fb0fe4a9824590c8be9ee7b8985631c39cf
+PKG_SOURCE_VERSION:=08195779cbc2d1d7410cb324b9e35692b0579a7e
 PKG_MIRROR_HASH:=skip
 
 SULU_MOD:=core

sulu/sulu-builder/Makefile

@@ -5,12 +5,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=sulu-builder
-PKG_VERSION:=5.0.5
+PKG_VERSION:=5.1.1
 PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/websdk/sulu-builder.git
-PKG_SOURCE_VERSION:=ef5345ea0275e632f021dfcf3b62c8d09fbb5800
+PKG_SOURCE_VERSION:=7f646ecf643967f4b4b2c545a31bbef0514b34bc
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_SOURCE_VERSION)
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_BUILD_DIR:=$(BUILD_DIR)/sulu-$(PKG_VERSION)/sulu-builder-$(PKG_SOURCE_VERSION)
@@ -28,7 +28,8 @@ define Package/sulu/default
 	CATEGORY:=Utilities
 	SUBMENU:=SULU
 	TITLE:=SULU-CE
-	DEPENDS:=+mosquitto-auth-shadow +usermngr +jq +userinterface +obuspa
+	DEPENDS:=+mosquitto-auth-shadow +usermngr +userinterface +obuspa
+	DEPENDS+=+@OBUSPA_LOCAL_MQTT_LISTENER
 	EXTRA_DEPENDS:=nginx
 endef
 
@@ -95,13 +96,8 @@ endef
 
 define Package/sulu/install/Default
 	$(INSTALL_DIR) $(1)/sulu/
-	$(INSTALL_DIR) $(1)/etc/config
-	$(INSTALL_BIN) ./files/etc/config/sulu $(1)/etc/config/sulu
-
-	$(INSTALL_DIR) $(1)/etc/init.d
-	$(INSTALL_BIN) ./files/etc/init.d/sulu $(1)/etc/init.d/sulu
-
 	$(INSTALL_DIR) $(1)/etc/sulu
+
 	$(INSTALL_BIN) ./files/etc/sulu/sulu.sh $(1)/etc/sulu/
 	$(INSTALL_DATA) ./files/etc/sulu/nginx.locations $(1)/etc/sulu/
 
@@ -109,9 +105,9 @@ define Package/sulu/install/Default
 	$(INSTALL_DATA) ./files/etc/users/roles/*.json $(1)/etc/users/roles/
 
 	$(INSTALL_DIR) $(1)/etc/uci-defaults
-	$(INSTALL_BIN) ./files/etc/uci-defaults/40-add-sulu-config $(1)/etc/uci-defaults/
+	$(INSTALL_DATA) ./files/etc/uci-defaults/40-add-sulu-config $(1)/etc/uci-defaults/
 ifneq ($(CONFIG_SULU_DEFAULT_UI)$(CONFIG_SULU_BUILDER_DEFAULT_UI),)
-	$(INSTALL_BIN) ./files/etc/uci-defaults/41-make-sulu-default-ui $(1)/etc/uci-defaults/
+	$(INSTALL_DATA) ./files/etc/uci-defaults/41-make-sulu-default-ui $(1)/etc/uci-defaults/
 endif
 endef
 
@@ -128,7 +124,6 @@ define Package/sulu/install
 	$(Package/sulu/install/Post)
 endef
 
-
 define Package/sulu-builder/install
 	$(Package/sulu/install/Default)
 	$(INSTALL_DIR) $(1)/sulu/presets

sulu/sulu-builder/files/etc/config/sulu

@@ -1,2 +0,0 @@
-config global 'global'
-	option enabled '1'

sulu/sulu-builder/files/etc/init.d/sulu

@@ -1,47 +0,0 @@
-#!/bin/sh /etc/rc.common
-
-USE_PROCD=1
-
-START=90
-STOP=01
-
-. /lib/functions.sh
-
-log() {
-	echo "${@}" | logger -t sulu.init -p debug
-}
-
-validate_sulu_global_section() {
-	uci_validate_section sulu global global \
-		'enabled:bool:1'
-}
-
-start_service() {
-	local enabled
-
-	config_load sulu
-	procd_open_instance sulu
-
-	validate_sulu_global_section || return 0
-	# append sulu connection injection
-	if [ "${enabled}" -eq "0" ]; then
-		procd_close_instance
-		return 0
-	fi
-
-	if [ "${1}" = "update" ]; then
-		log "Reloading related services"
-		/etc/sulu/sulu.sh -r
-	fi
-	procd_close_instance
-}
-
-reload_service() {
-	stop
-	start update
-}
-
-service_triggers() {
-	procd_add_reload_trigger "sulu" "userinterface" "mosquitto"
-	procd_add_reload_trigger "config.change" "mapcontroller" /etc/sulu/sulu.sh -q
-}

sulu/sulu-builder/files/etc/sulu/nginx.locations

@@ -23,7 +23,9 @@ location /wss {
 	proxy_set_header    X-Forwarded-Proto  $scheme;
 	add_header          Cache-Control 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
 	add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
+	add_header Pragma 'no-cache';
 	add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,Content-Type,Range' always;
+	expires 0;
 	proxy_pass http://websocket;
 }
 
@@ -44,6 +46,7 @@ location / {
 		add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,Content-Type,Range' always;
 		add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range' always;
 	}
-	expires -1;
 	add_header Cache-Control 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
+	add_header Pragma 'no-cache';
+	expires 0;
 }

sulu/sulu-builder/files/etc/sulu/sulu.sh

@@ -4,18 +4,16 @@
 
 . /lib/functions.sh
 . /usr/share/libubox/jshn.sh
-. /lib/functions/iopsys-environment.sh
+#. /lib/functions/iopsys-environment.sh
 
 RESTART_REQ=0
 _RESTART_SERVICES="0"
 
-mkdir -p /tmp/sulu/
-
-function slog() {
+slog() {
 	echo "$*" | logger -t sulu.sh -p debug
 }
 
-function _get_agent_id() {
+_get_agent_id() {
 	local oui serial endpointid
 
 	endpointid="$(uci_get obuspa localagent EndpointID)"
@@ -30,7 +28,7 @@ function _get_agent_id() {
 	fi
 }
 
-function _get_sulu_user_roles() {
+_get_sulu_user_roles() {
 	roles=$(uci -q get userinterface._sulu_s.role)
 
 	for role in ${roles}; do
@@ -41,35 +39,32 @@ function _get_sulu_user_roles() {
 		sulu_user_roles=$(echo -e "${sulu_user_roles// /\\n}" | sort | uniq)
 	fi
 
-	echo ${sulu_user_roles}
+	echo "${sulu_user_roles}"
 }
 
-function _get_sulu_root() {
+_get_sulu_root() {
 	local root
 
 	root="$(uci -q get nginx._sulu_s.root)"
 	echo "${root:-/sulu}"
 }
 
-function _get_sulu_connection_config() {
+_get_sulu_connection_config() {
 	local config
 
 	config="$(_get_sulu_root)/presets/connection-config.json"
 	echo "${config}"
 }
 
-function _get_sulu_session_mode() {
-	echo "$(uci -q get sulu.global.SessionMode)"
+_get_sulu_session_mode() {
+	uci -q get sulu.global.SessionMode
 }
 
-function _get_sulu_acl_file() {
-	local file
-
-	file="$(uci -q get mosquitto.sulu.acl_file)"
-	echo "${file}"
+_get_sulu_acl_file() {
+	uci -q get mosquitto.sulu.acl_file
 }
 
-function generate_sulu_conn_config() {
+generate_sulu_conn_config() {
 	local users SCONFIG session
 
 	users="$(_get_sulu_user_roles)"
@@ -109,10 +104,10 @@ function generate_sulu_conn_config() {
 		json_close_object
 	}
 
-	json_dump >${SCONFIG}
+	json_dump >"${SCONFIG}"
 }
 
-function _update_obuspa_config_rbac() {
+_update_obuspa_config_rbac() {
 	local agent users session
 
 	agent="$(_get_agent_id)"
@@ -124,45 +119,45 @@ function _update_obuspa_config_rbac() {
 
 		# Add mqtt
 		section="mqtt_sulu_${user}"
-		if ! uci_get obuspa ${section} >/dev/null 2>&1; then
-			uci_add obuspa mqtt ${section}
-			uci_set obuspa ${section} BrokerAddress "127.0.0.1"
-			uci_set obuspa ${section} BrokerPort "1883"
-			uci_set obuspa ${section} TransportProtocol "TCP/IP"
+		if ! uci_get obuspa "${section}" >/dev/null 2>&1; then
+			uci_add obuspa mqtt "${section}"
+			uci_set obuspa "${section}" BrokerAddress "127.0.0.1"
+			uci_set obuspa "${section}" BrokerPort "1883"
+			uci_set obuspa "${section}" TransportProtocol "TCP/IP"
 			RESTART_REQ=1
 		fi
 
 		# Add mtp
 		section="mtp_sulu_${user}"
-		if ! uci_get obuspa ${section} >/dev/null 2>&1; then
-			uci_add obuspa mtp ${section}
-			uci_set obuspa ${section} Protocol "MQTT"
-			uci_set obuspa ${section} ResponseTopicConfigured "/usp/${agent}/${user}/endpoint"
-			uci_set obuspa ${section} mqtt "mqtt_sulu_$user"
+		if ! uci_get obuspa "${section}" >/dev/null 2>&1; then
+			uci_add obuspa mtp "${section}"
+			uci_set obuspa "${section}" Protocol "MQTT"
+			uci_set obuspa "${section}" ResponseTopicConfigured "/usp/${agent}/${user}/endpoint"
+			uci_set obuspa "${section}" mqtt "mqtt_sulu_$user"
 			RESTART_REQ=1
 		fi
 
 		# Add controller
 		section="controller_sulu_${user}"
-		if ! uci_get obuspa ${section} >/dev/null 2>&1; then
-			uci_add obuspa controller ${section}
-			uci_set obuspa ${section} EndpointID "self::sulu-${user}"
-			uci_set obuspa ${section} Protocol "MQTT"
-			uci_set obuspa ${section} Topic "/usp/${agent}/${user}/controller"
-			uci_set obuspa ${section} mqtt "mqtt_sulu_$user"
-			uci_set obuspa ${section} assigned_role_name "$user"
+		if ! uci_get obuspa "${section}" >/dev/null 2>&1; then
+			uci_add obuspa controller "${section}"
+			uci_set obuspa "${section}" EndpointID "self::sulu-${user}"
+			uci_set obuspa "${section}" Protocol "MQTT"
+			uci_set obuspa "${section}" Topic "/usp/${agent}/${user}/controller"
+			uci_set obuspa "${section}" mqtt "mqtt_sulu_$user"
+			uci_set obuspa "${section}" assigned_role_name "$user"
 			RESTART_REQ=1
 		fi
 
-		obMode="$(uci_get obuspa ${section} SessionMode)"
+		obMode="$(uci_get obuspa "${section}" SessionMode)"
 		if [ "${session}" != "${obMode}" ]; then
-			uci_set obuspa ${section} SessionMode "${session}"
+			uci_set obuspa "${section}" SessionMode "${session}"
 			RESTART_REQ=1
 		fi
 	done
 }
 
-function _create_mosquitto_acl() {
+_create_mosquitto_acl() {
 	local agentid users
 	local ACL_FILE acl_users
 
@@ -175,9 +170,9 @@ function _create_mosquitto_acl() {
 
 	users="$(_get_sulu_user_roles)"
 	if [ -f "${ACL_FILE}" ]; then
-		acl_users="$(awk '/^user/ {print $2}' ${ACL_FILE})"
+		acl_users="$(awk '/^user/ {print $2}' "${ACL_FILE}")"
 		for user in ${users}; do
-			if ! grep -q "$user" ${acl_users}; then
+			if ! grep -q "$user" "${acl_users}"; then
 				rm -f "${ACL_FILE}"
 			fi
 		done
@@ -186,36 +181,38 @@ function _create_mosquitto_acl() {
 
 	agentid="$(_get_agent_id)"
 	for user in ${users}; do
-		if ! grep -q "user $user" ${ACL_FILE}; then
-			echo "user ${user}" >>${ACL_FILE}
-			echo "topic read  /usp/${agentid}/${user}/controller/reply-to/#" >>${ACL_FILE}
-			echo "topic write /usp/${agentid}/${user}/endpoint/#" >>${ACL_FILE}
-			echo "topic read  /usp/${agentid}/${user}/controller/#" >>${ACL_FILE}
-			echo "" >>${ACL_FILE}
+		if ! grep -q "user $user" "${ACL_FILE}"; then
+			{
+				echo "user ${user}"
+				echo "topic read  /usp/${agentid}/${user}/controller/reply-to"
+				echo "topic write /usp/${agentid}/${user}/endpoint"
+				echo "topic read  /usp/${agentid}/${user}/controller"
+				echo ""
+			} >> "${ACL_FILE}"
 			RESTART_REQ="1"
 		fi
 	done
 
-	if [ "${_RESTART_SERVICES}" -eq "1" -a "${RESTART_REQ}" -gt "0" ]; then
+	if [ "${_RESTART_SERVICES}" -eq "1" ] && [ "${RESTART_REQ}" -gt "0" ]; then
 		slog "Restarting mosquitto..."
 		ubus call uci commit '{"config":"mosquitto"}'
 	fi
 }
 
-function update_obuspa_config() {
+update_obuspa_config() {
 
 	RESTART_REQ=0
 	uci_load obuspa
 	_update_obuspa_config_rbac
 	uci_commit obuspa
 
-	if [ "${_RESTART_SERVICES}" -eq "1" -a "${RESTART_REQ}" -gt "0" ]; then
+	if [ "${_RESTART_SERVICES}" -eq "1" ] && [ "${RESTART_REQ}" -gt "0" ]; then
 		slog "Restarting obuspa..."
 		ubus call uci commit '{"config":"obuspa"}'
 	fi
 }
 
-function configure_sulu() {
+configure_sulu() {
 	_create_mosquitto_acl
 	update_obuspa_config
 	generate_sulu_conn_config

sulu/sulu-builder/files/etc/uci-defaults/40-add-sulu-config

@@ -12,23 +12,17 @@ if [ ! -f "${UCI_TEMPLATE}" ]; then
 	return 0
 fi
 
-function _get_usp_upstream_port() {
-	local port
-
-	port="$(uci -q get mosquitto.sulu.port)"
-	echo "${port:-9009}"
-}
-
 update_nginx_uci_template()
 {
 	local port
 
-	UCI_TEMPLATE="/etc/nginx/uci.conf.template"
-	port="$(_get_usp_upstream_port)"
-        if ! grep -q "upstream websocket" ${UCI_TEMPLATE}; then
+	port="$(uci -q get mosquitto.sulu.port)"
+	port="${port:-9009}"
+
+	if ! grep -q "upstream websocket" ${UCI_TEMPLATE}; then
 		sed -i '/#UCI_HTTP_CONFIG$/i\   map $http_upgrade $connection_upgrade { default upgrade; "" close; }' ${UCI_TEMPLATE}
 		sed -i "/#UCI_HTTP_CONFIG$/i\   upstream websocket { server 127.0.0.1:${port}; }" ${UCI_TEMPLATE}
-        fi
+	fi
 }
 
 add_sulu_config_to_mosquitto()
@@ -39,24 +33,11 @@ add_sulu_config_to_mosquitto()
 		uci_set mosquitto sulu port '9009'
 		uci_set mosquitto sulu no_remote_access '1'
 		uci_set mosquitto sulu protocol 'websockets'
-		uci_set mosquitto sulu require_certificates '0'
 		uci_set mosquitto sulu auth_plugin '/usr/lib/mosquitto_auth_shadow.so'
 		uci_set mosquitto sulu acl_file '/etc/sulu/mqtt.acl'
 	fi
 }
 
-add_obuspa_config_to_mosquitto()
-{
-	uci_load mosquitto
-	if ! uci_get mosquitto obuspa >/dev/null 2>&1; then
-		uci_add mosquitto listener obuspa
-		uci_set mosquitto obuspa enabled 1
-		uci_set mosquitto obuspa port '1883'
-		uci_set mosquitto obuspa no_remote_access '1'
-		uci_set mosquitto obuspa allow_anonymous '1'
-	fi
-}
-
 add_sulu_userinterface_uci()
 {
 	uci_load userinterface
@@ -67,10 +48,10 @@ add_sulu_userinterface_uci()
 		uci_set userinterface _sulu_s port '8443'
 		uci_add_list userinterface _sulu_s _nginx_include '/etc/sulu/nginx.locations'
 		uci_set userinterface _sulu_s _nginx_uci_manage_ssl 'self-signed'
-        	uci_set userinterface _sulu_s _nginx_ssl_certificate '/etc/nginx/conf.d/_lan.crt'
-	        uci_set userinterface _sulu_s _nginx_ssl_certificate_key '/etc/nginx/conf.d/_lan.key'
-	        uci_set userinterface _sulu_s _nginx_ssl_session_cache 'none'
-	        uci_set userinterface _sulu_s protocol 'HTTPS'
+		uci_set userinterface _sulu_s _nginx_ssl_certificate '/etc/nginx/conf.d/_lan.crt'
+		uci_set userinterface _sulu_s _nginx_ssl_certificate_key '/etc/nginx/conf.d/_lan.key'
+		uci_set userinterface _sulu_s _nginx_ssl_session_cache 'none'
+		uci_set userinterface _sulu_s protocol 'HTTPS'
 		uci_add_list userinterface _sulu_s role 'admin'
 		uci_add_list userinterface _sulu_s role 'user'
 	fi
@@ -78,14 +59,13 @@ add_sulu_userinterface_uci()
 	if ! uci_get userinterface _suluredirect >/dev/null 2>&1; then
 		uci_add userinterface http_access _suluredirect
 		uci_set userinterface _suluredirect redirect '_sulu_s'
-	        uci_set userinterface _suluredirect protocol 'HTTP'
+		uci_set userinterface _suluredirect protocol 'HTTP'
 		uci_set userinterface _suluredirect port "8080"
 	fi
 }
 
-add_obuspa_config_to_mosquitto
 add_sulu_config_to_mosquitto
-update_nginx_uci_template
 add_sulu_userinterface_uci
+update_nginx_uci_template
 
 /etc/sulu/sulu.sh

sulu/sulu-theme-genexis/Makefile

@@ -5,7 +5,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=sulu-theme-genexis
-PKG_VERSION:=5.0.3
+PKG_VERSION:=5.1.1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/gnx/sulu-theme-genexis

swmodd/Makefile

@@ -33,7 +33,7 @@ define Package/swmodd
   DEPENDS:=+libuci +libubox +ubus +libuuid +opkg +libcurl \
 	    +PACKAGE_lxc:lxc +PACKAGE_lxc:liblxc +@BUSYBOX_CONFIG_BUSYBOX \
 	    +@BUSYBOX_CONFIG_FEATURE_SHOW_SCRIPT +@BUSYBOX_CONFIG_SCRIPT \
-	    +jq +@CONFIG_KERNEL_CGROUPS +SWMODD_LEGACY_CGROUPS:swmodd-cgroup
+	    +jsonfilter +@CONFIG_KERNEL_CGROUPS +SWMODD_LEGACY_CGROUPS:swmodd-cgroup
   DEPENDS+=+libbbfdm-api +libbbfdm-ubus +dm-service
 endef
 

swmodd/files/etc/init.d/crun

@@ -101,17 +101,17 @@ configure_crun_container() {
 		uci_set ocicontainer "${1}" password ""
 		result=$(${RUNNER} -b "${BUNDLE}" -n "${name}" -r "${url}" -l "${username}:${password}" -t "${TIMEOUT}")
 		if [ "$?" -eq 0 ]; then
-			result=$(cat ${BUNDLE}/${name}/config.json |jq ".annotations.org_opencontainers_image_description")
+			result="$(cat ${BUNDLE}/${name}/config.json |jsonfilter -e "@.annotations.org_opencontainers_image_description")"
 			if [ "${result}" != "null" ]; then
 				uci_set ocicontainer "${1}" description "${result}"
 			fi
 
-			result=$(cat ${BUNDLE}/${name}/config.json |jq ".annotations.org_opencontainers_image_vendor")
+			result="$(cat ${BUNDLE}/${name}/config.json |jsonfilter -e "@.annotations.org_opencontainers_image_vendor")"
 			if [ "${result}" != "null" ]; then
 				uci_set ocicontainer "${1}" vendor "${result}"
 			fi
 
-			result=$(cat ${BUNDLE}/${name}/config.json |jq ".annotations.org_opencontainers_image_version")
+			result="$(cat ${BUNDLE}/${name}/config.json |jsonfilter -e "@.annotations.org_opencontainers_image_version")"
 			if [ "${result}" != "null" ]; then
 				uci_set ocicontainer "${1}" version "${result}"
 			fi
@@ -159,17 +159,17 @@ configure_crun_container() {
 	if [ "${BOOT}" -eq "1" ]; then
 		if [ "${autostart}" -eq 1 ]; then
 			${RUNNER} -U -b "${BUNDLE}" -n "${name}" -e "${envlist}" ${PERM}
-			result=$(cat ${BUNDLE}/${name}/config.json |jq ".annotations.org_opencontainers_image_description")
+			result="$(cat ${BUNDLE}/${name}/config.json |jsonfilter -e "@.annotations.org_opencontainers_image_description")"
 			if [ "${result}" != "null" ]; then
 				uci_set ocicontainer "${1}" description "${result}"
 			fi
 
-			result=$(cat ${BUNDLE}/${name}/config.json |jq ".annotations.org_opencontainers_image_vendor")
+			result="$(cat ${BUNDLE}/${name}/config.json |jsonfilter -e "@.annotations.org_opencontainers_image_vendor")"
 			if [ "${result}" != "null" ]; then
 				uci_set ocicontainer "${1}" vendor "${result}"
 			fi
 
-			result=$(cat ${BUNDLE}/${name}/config.json |jq ".annotations.org_opencontainers_image_version")
+			result="$(cat ${BUNDLE}/${name}/config.json |jsonfilter -e "@.annotations.org_opencontainers_image_version")"
 			if [ "${result}" != "null" ]; then
 				uci_set ocicontainer "${1}" version "${result}"
 			fi
@@ -192,17 +192,17 @@ configure_crun_container() {
 				crun resume "${name}"
 			else
 				${RUNNER} -U -b "${BUNDLE}" -n "${name}" -e "${envlist}" ${PERM}
-				result=$(cat ${BUNDLE}/${name}/config.json |jq ".annotations.org_opencontainers_image_description")
+				result="$(cat ${BUNDLE}/${name}/config.json |jsonfilter -e "@.annotations.org_opencontainers_image_description")"
 				if [ "${result}" != "null" ]; then
 					uci_set ocicontainer "${1}" description "${result}"
 				fi
 
-				result=$(cat ${BUNDLE}/${name}/config.json |jq ".annotations.org_opencontainers_image_vendor")
+				result="$(cat ${BUNDLE}/${name}/config.json |jsonfilter "@.annotations.org_opencontainers_image_vendor")"
 				if [ "${result}" != "null" ]; then
 					uci_set ocicontainer "${1}" vendor "${result}"
 				fi
 
-				result=$(cat ${BUNDLE}/${name}/config.json |jq ".annotations.org_opencontainers_image_version")
+				result="$(cat ${BUNDLE}/${name}/config.json |jsonfilter -e "@.annotations.org_opencontainers_image_version")"
 				if [ "${result}" != "null" ]; then
 					uci_set ocicontainer "${1}" version "${result}"
 				fi

swmodd/files/etc/swmodd/run.sh

@@ -86,7 +86,7 @@ run_container() {
 	fi
 
 	# Only do the network setup if defined in config
-	network="$(cat ${BUNDLE}/${NAME}/config.json |jq '.linux.namespaces[] |select (.type == "network")')"
+	network="$(cat ${BUNDLE}/${NAME}/config.json |jsonfilter -e '@.linux.namespaces[@.type="network"]')"
 	if [ -n "${network}" ] ; then
 		setup_container_network "${name}" "${bridge}"
 	else
@@ -128,7 +128,7 @@ update_config_json() {
 		exit 1;
 	fi
 	cd "${BUNDLE}/${NAME}"
-	if cat config.json |jq '.linux.namespaces[] |select (.type == "network") |.path' |grep -q ${NAME}; then
+	if cat config.json |jsonfilter -e '@.linux.namespaces[@.type="network"].path' |grep -q ${NAME}; then
 		# If netns already configured and no additional permission bit assigned, exit from here
 		if [ -z "${PERM}" ]; then
 			exit 0;

tr104/Makefile

@@ -5,13 +5,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=tr104
-PKG_VERSION:=1.0.38
+PKG_VERSION:=1.0.39
 
 LOCAL_DEV:=0
 ifeq ($(LOCAL_DEV),0)
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/voice/tr104.git
-PKG_SOURCE_VERSION:=6d4a62fb133a1ba1e229425a0156f19d75c5cf90
+PKG_SOURCE_VERSION:=6ce4823424f856f8225a068e7f61f4f69ba8cb04
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_MIRROR_HASH:=skip
 endif

userinterface/Makefile

@@ -5,13 +5,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=userinterface
-PKG_VERSION:=1.1.7
+PKG_VERSION:=1.1.8
 
 LOCAL_DEV:=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/bbf/userinterface.git
-PKG_SOURCE_VERSION:=02bedd40e083cc456b2abed8f711b45c93061815
+PKG_SOURCE_VERSION:=a5970a83b8ac79c4577edc6a994b850cdbe1c82f
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_MIRROR_HASH:=skip
 endif

usermngr/Makefile

@@ -5,13 +5,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=usermngr
-PKG_VERSION:=1.3.11
+PKG_VERSION:=1.4.0
 
 LOCAL_DEV:=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/bbf/usermngr.git
-PKG_SOURCE_VERSION:=37db3e216e508b19228479f39b935caa61815d06
+PKG_SOURCE_VERSION:=4023f2045dbf498e332200eb1ee275b4a129483b
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_MIRROR_HASH:=skip
 endif

usermngr/files/etc/config/users

@@ -6,7 +6,7 @@ config security_policy 'security_policy'
 
 config passwdqc 'passwdqc'
 	option enabled '1'
-	option min 'disabled,disabled,disabled,disabled,8'
+	option min 'disabled,disabled,disabled,8,8'
 	option max '20'
 	option passphrase '0'
 	option retry '3'

usermngr/files/etc/uci-defaults/91-security-hardening

@@ -13,7 +13,7 @@ fi
 if ! uci -q get users.passwdqc; then
 	uci -q set users.passwdqc='passwdqc'
 	uci -q set users.passwdqc.enabled='1'
-	uci -q set users.passwdqc.min='disabled,disabled,disabled,disabled,8'
+	uci -q set users.passwdqc.min='disabled,disabled,disabled,8,8'
 	uci -q set users.passwdqc.max='20'
 	uci -q set users.passwdqc.passphrase='0'
 	uci -q set users.passwdqc.retry='3'

usp-js/Makefile

@@ -6,14 +6,16 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=usp-js
-PKG_VERSION:=1.2.7
+PKG_VERSION:=1.2.9
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/websdk/usp-js.git
-PKG_SOURCE_VERSION:=a4be8f6d8442d56c632514abb16f3de0817fb22f
-PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz
+PKG_SOURCE_VERSION:=31d652f91e8581d19840a8fdde1f87b0acca44ed
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_MIRROR_HASH:=skip
 
+PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_SOURCE_VERSION)
+
 PKG_LICENSE:=BSD-3-Clause
 PKG_LICENSE_FILES:=LICENSE
 
@@ -23,7 +25,7 @@ define Package/usp-js
   SECTION:=libs
   CATEGORY:=Libraries
   TITLE:=A JS library for USP(TR369) protocol
-  DEPENDS:=+quickjs +quickjs-websocket +@OBUSPA_ENABLE_TEST_CONTROLLER_LOCAL
+  DEPENDS:=+quickjs +quickjs-websocket +@OBUSPA_LOCAL_MQTT_LISTENER
   EXTRA_DEPENDS:=obuspa mosquitto-ssl
 endef
 
@@ -32,7 +34,7 @@ define Package/usp-js/description
 endef
 
 define Build/Compile
-	cd $(PKG_BUILD_DIR) && yarn install && yarn qjs
+	cd $(PKG_BUILD_DIR) && [ -d "./qjs" ] || (yarn install && yarn qjs)
 endef
 
 define Package/usp-js/install

wifidmd/Makefile

@@ -5,13 +5,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=wifidmd
-PKG_VERSION:=1.3.3
+PKG_VERSION:=1.3.9
 
 LOCAL_DEV:=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://dev.iopsys.eu/bbf/wifidmd.git
-PKG_SOURCE_VERSION:=49adedbaa22b79b0a5e4c176597215560655bc97
+PKG_SOURCE_VERSION:=f142eb300da9c0cc772bcc3f10cdcf98d2eecd29
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz
 PKG_MIRROR_HASH:=skip
 endif

wifidmd/bbfdm_service.json

@@ -11,6 +11,17 @@
     ],
     "config": {
       "loglevel": "3"
+    },
+    "apply_handler": {
+      "uci": [
+        {
+          "file": [
+            "wireless",
+            "mapcontroller"
+          ],
+          "external_handler": "/etc/wifidmd/bbf_config_reload.sh"
+        }
+      ]
     }
   }
 }

wifidmd/files/etc/wifidmd/bbf_config_reload.sh

@@ -2,27 +2,25 @@
 
 # Script: bbf_config_reload.sh
 # Description:
-#   This script reloads WiFi Configs based on JSON input.
-#   Input should be a JSON string with boolean-like values (0 or 1) for:
+#   This script reloads WiFi Configs based on input args.
+#   Input args should be one of the below or both with space separate
 #     - "wireless"
 #     - "mapcontroller"
 #
 # Usage:
-#   sh bbf_config_reload.sh '{"wireless":"1","mapcontroller":"0"}'
+#   sh bbf_config_reload.sh wireless mapcontroller
 #
 # Actions:
-#   - If wireless == 1 and mapcontroller == 1 → Reload mapcontroller (SIGHUP)
-#   - If wireless == 1 and mapcontroller == 0 → Commit wireless config via ubus
-#   - If wireless == 0 and mapcontroller == 1 → Reload mapcontroller (SIGHUP)
+#   - If both wireless and mapcontroller → Reload mapcontroller (SIGHUP)
+#   - If only wireless → Commit wireless config via ubus
+#   - If only mapcontroller → Reload mapcontroller (SIGHUP)
 #   - Otherwise → Do nothing
 
-. /usr/share/libubox/jshn.sh
-
 log() {
 	echo "${@}"|logger -t bbf.config.wifi.reload -p info
 }
 
-input="$1"
+input="$@"
 
 # Validate input
 if [ -z "$input" ]; then
@@ -30,18 +28,19 @@ if [ -z "$input" ]; then
 	exit 1
 fi
 
-# Parse JSON input
-json_load "$input" || {
-	log "Error: Failed to parse JSON input"
-	exit 1
-}
-
-json_get_var wireless wireless
-json_get_var mapcontroller mapcontroller
-
 # Normalize inputs (default to 0 if not set)
-wireless=${wireless:-0}
-mapcontroller=${mapcontroller:-0}
+wireless=0
+mapcontroller=0
+
+for arg in ${input}; do
+	if [ "${arg}" == "wireless" ]; then
+		wireless=1
+	fi
+
+	if [ "${arg}" == "mapcontroller" ]; then
+		mapcontroller=1
+	fi
+done
 
 # Define function to reload mapcontroller
 reload_mapcontroller() {
@@ -65,9 +64,4 @@ else
 	exit 1
 fi
 
-# Output success as JSON
-json_init
-json_add_boolean "Success" 1
-json_dump
-
 exit 0

wifimngr/Makefile

@@ -1,26 +1,26 @@
 #
-# Copyright (C) 2020-2023 Iopsys
-# Copyright (C) 2025 Genexis AB
+# Copyright (C) 2020-2024 Iopsys
+# Copyright (C) 2025 Genexis Sweden AB
 #
 
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=wifimngr
-PKG_VERSION:=17.7.7
+PKG_VERSION:=20.0.0
 
 LOCAL_DEV=0
 ifneq ($(LOCAL_DEV),1)
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_VERSION:=eb27090c116b678304c1e2638c0e9165f700666e
+PKG_SOURCE_VERSION:=5b1a033db5fc372a7e21bc896888ecbafb406d13
 PKG_SOURCE_URL:=https://dev.iopsys.eu/hal/wifimngr.git
-PKG_MAINTAINER:=Anjan Chanda <anjan.chanda@genexis.eu>
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)_$(PKG_SOURCE_VERSION).tar.xz
 PKG_MIRROR_HASH:=skip
 endif
 
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)
 PKG_LICENSE:=GPL-2.0-only
-PKG_LICENSE_FILES:=LICENSE
+PKG_LICENSE_FILES:=
+PKG_MAINTAINER:=Anjan Chanda <anjan.chanda@genexis.eu>
 
 PKG_CONFIG_DEPENDS := \
 		     CONFIG_PACKAGE_libwifiutils \
@@ -29,12 +29,13 @@ PKG_CONFIG_DEPENDS := \
 PKG_BUILD_DEPENDS := libwifi
 
 include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/cmake.mk
 
 define Package/wifimngr
-  SECTION:=utils
-  CATEGORY:=Utilities
-  TITLE:=WiFi status and configration utility
-  DEPENDS:=+libwifiutils +libwifi +libuci +libubox +ubus +libnl-genl
+	SECTION:=utils
+	CATEGORY:=Utilities
+	TITLE:=WiFi status and configration utility
+	DEPENDS:=+libwifiutils +libwifi +libuci +libubox +ubus +libnl-genl
 endef
 
 define Package/wifimngr/description
@@ -44,15 +45,6 @@ define Package/wifimngr/description
  exposed by the libwifi library.
 endef
 
-TARGET_CFLAGS += \
-	-I$(STAGING_DIR)/usr/include \
-	-I$(STAGING_DIR)/usr/include/libnl3 \
-	-D_GNU_SOURCE
-
-ifeq ($(CONFIG_WIFIMNGR_CACHE_SCANRESULTS),y)
-TARGET_CFLAGS += -DWIFI_CACHE_SCANRESULTS
-endif
-
 ifeq ($(LOCAL_DEV),1)
 define Build/Prepare
   rsync -r --exclude=.* ~/git/wifimngr/ $(PKG_BUILD_DIR)/

xmppc/files/etc/init.d/xmppc

@@ -13,7 +13,7 @@ start_service() {
 }
 
 reload_service() {
-	xmpp_running="$(ubus call service list '{"name":"xmppc"}' | jq ".xmppc.instances.instance1.running")"
+	xmpp_running="$(ubus call service list '{"name":"xmppc"}' | jsonfilter -e '$.xmppc.instances.instance1.running')"
 	if [ "${xmpp_running}" = "true" ]; then
 		procd_send_signal xmppc '*' SIGKILL
 	fi