Fix forward rule checking underflow in cabud on race conditions.
Fix a race condition in dylan which could result in wifi interfaces not being correctly renamed.
Fix race condition in cabud which resulted in duplicated CAN forward rules being installed.
Fix handling of datagram socket poll errors and conntrack event buffer overflows to prevent tamara from falling into busy loops or consuming excessive memory resources.
Fix configuring multiple cluster configurations in tamara if traffic rebalancing is enabled on more than one cluster.
In ester, add an authorization option to allow issuing certificates with a lifetime exceeding the CA certificate lifetime.
Extend rapid REST API to include netconfig version in system handler.
Add hardcoded APN configuration for NexCon.io, Denmark.
Fix syntia synchronizing to times a few minutes off under specific network and timing conditions on x86-64 targets.
Fix continued GNSS receiver reset on the Telit LN920 if the system time is slightly out of sync.
In ester, raise expiration notifications only for non-revoked/renewed certs.
Fix handling of multiple queued image updates and a potential crash in pius.
Remove stale strongSwan PID files to fix startup on ISA.
Backport several memory leak fixes detected by new static analyzer.
Force termination of established connections on tunnel unload in tamara.
Add hardcoded APN configurations for EE LTD UK.
Fix repeated expiration checks in ester on exact certificate expiration second.
Two issues were fixed in the vpn-events where in some corner cases events would not be reported via embus and were thus also missing in telemetry events.
Tamara compares the effective link throughput versus the estimated uplink quality to detect links with good latency but rate-limited throughput. This allows the detection of operator limited modem connections or other links with administrative traffic policing and degrade such uplinks for load balancing purposes.
Tamara calculates the base uplink quality of WiFi client links using the WiFi connection MCS index. This allows for better uplink quality estimation when using a WiFi uplink in a load-balanced uplink group.
Add a new vpn-tunnel telemetry source to ursula, combining tunnel information with per-uplink send/receive counters. Further, it includes a normalized uplink rating and an per-uplink error reason on non-working tunnels.
The vpn-events telemetry source provides similar information as the vpn-tunnel source (excluding counters), but works in eventing instead of interval mode to notify the backend immediately about tunnel state changes.
In georg, add a new geofencing pseudo-zone called no-fix. It is similar to awaiting-fix, but the zone is re-entered when losing a previous available GNSS position fix.
The new geofencing telemetry in ursula reports the active geofencing zones to the backend, either in interval or in eventing mode.
Extend theo to monitor cooling fan status and speed, and add a fan telemetry source to ursula for monitoring fan health in the backend.
In conrad, introduce a new condition called remote, which can be controlled over a stable remote service by the backend. This allows the backend to toggle netconfig sections and interactively change the router configuration. This can be used in a wide range of cases, for example to manually activate WiFi connections or set the PoE state of Ethernet ports.
The new io state netconfig section allows configuring digital I/O state via netconfig. When used in netconfig conditional sections, this allows driving I/O lines based on system state or other conditions, for example the new remote condition mentioned above.
Optimize memory usage in bastard by reducing zlib memory usage level and creating compression contexts on-demand. This can reduce the memory usage for a typical rumpl client session from 1.7MB down to 350KB.
Introduce a framework for coverage guided fuzzing, and add fuzz tests and corpora for all network-exposed protocol parsers. The use of the libmxml dependency for XML parsing has been reconsidered during fuzzing, and has been replaced by the more robust libexpat.
Add support for Untethered Dead Reckoning (UDR) on the Ublox M8U and ZED F9R receivers. After a short auto-calibration phase, receivers provide continued positioning information based on IMU sensor data if GNSS signals become unavailable. The IMU sensor may require axis configuration depending on the router orientation in a vehicle.
On the ZED F9R, add additional support for Automotive Dead Reckoning (ADR) to improve Dead Reckoning accuracy compared to UDR. Vehicle speed input can be provided from external applications via REST API or can be read from a CAN bus using the FMS protocol. The configurable automotive and scooter dead reckoning models may work in ADR or UDR mode, but the railway model explicitly requires external vehicle speed input.
In addition to SATA disks, S.M.A.R.T. data readings are supported on NVME disks. This information can reported in the disk health telemetry, and disk temperature readings are provided to the temperature telemetry source.
Add a new neighbour table telemetry source, reporting Layer 2/3 addresses per network interface from the system IPv4 ARP and IPv6 neighbour database. The source can report neighbour tables periodically or on changes.
Support configuring PoE PSE powering configuration per Ethernet port on NetModule 1810 PoE-capable devices. PoE powering can be selective disabled, and using netconfig conditionals allows dynamic PoE PSE activation based on Geofencing zones or other conditions.
Add compatibility for the ITxPT Linden release.
Introduce geofencing functionality on the router using the current GNSS position and a set of geometries read from bundles. Entering polygons or nearing line/point geometries can trigger conditional netconfig sections to change the router configuration based on its geofenced position.
Netconfig conditions can now be nested, chaining multiple conditions to enable netconfig sections dynamically.
Extend the cabud daemon to interpret CAN data according to many properties defines in the FMS standard. Translated FMS data can be sent to the backend using a dedicated telemetry source, or local users can consume FMS data via the REST API.
A new local CAN gateway can forward CAN frames from a physical CAN interface to virtual CAN interfaces created in containers or virtual machines. Compared to the existing mechanism of moving physical CAN interfaces to containers, this allows multiple consumers of CAN data received on a single interface.
Add preliminary support for the new NetModule Nitroc 3900 hardware. Beside basic target support, this includes board descriptor parsing with CBOR and bootloader upgrades.
Introduce a framework to support virtual SIM cards through the osmocom cardem firmware running on a dedicated USB-connected controller, and interface with pcscd to access physical SIM cards. On the NetModule 3900 target, this is used to dynamically map SIM cards in USB card readers to virtual SIM cards provided to modems by exchanging SIM card APDUs through the host.
Add support for S.M.A.R.T. readings on supported SATA disks and add a telemetry source to report a selected set of attributes to the backend.
Introduce the new theo daemon to measure system temperature from different sensors, currently supporting hwmon, thermal zone and S.M.A.R.T. disk temperature sensors. Create abstractions for the different hardware targets, and report temperature readings from multiple sensors via a new telemetry source to the backend.
Add support for ignition voltage management on the G028 target to support graceful system shutdown. Further, the G028 supports a LED hello pattern on startup and uses the grub2 bootloader for fallback image management.
Implement generic command line completion under bash for options in most daemons and tools.
Introduce support for bulk transfers in the rumpl management protocol. Bulk transfers implement a reliable stream based transport for different applications on top of the UDP based rumpl protocol with flow and congestion control. Bulk streams provide encryption and can be migrated between multiple uplinks.
Extend the bastard API to support opening and managing rumpl bulk streams, optionally supporting file descriptor passing over Unix sockets for efficient data exchanges between a management application and routers via bastard.
Add SSE/AVX optimized SIMD implementations for ChaCha20 and Poly1305 and SHA-NI accelerated SHA1 to speed up cryptographic operations on x86-64. Bulk streams in rumpl and bundle hashing in busyd can significantly benefit from these optimizations.
The brush remote shell utility can upload and download files to/from routers using rumpl bulk transfers.
The Virtual Machine manager virma can provide screendumps of running VMs and forward VNC sessions over rumpl bulk transfers to the backend.
pius can alternatively use rumpl bulk streams instead of HTTP for image and patch downloads. Further, it has been extended to perform image operations asynchronously to stay interactive while disk or CPU intensive operations are in progress.
busyd can alternatively use rumpl bulk streams instead of HTTP for rsum and bundle downloads, using range requests to fetch missing bundle parts. rsum received some performance improvements and busyd can resume an incomplete bundle sync process.
The progress of image and bundle updates is reported continuously to the backend image and bundle services, if requested.
Add support for the ISA target, running an almost full CarlOS in a Docker container. The new target specific isabel daemon communicates with the ISA API server Eagle. The CarlOS stack has been adopted to run properly on RHEL9 5.14 kernels.
The new io-state netconfig condition can conditionally enable configuration sections based on Digital I/O states.
Extend tamara to install TCP MSS clamping rules for IPsec tunnels, calculating the MSS based on the tunnel uplink MTU and the required IPsec overhead. For non-IPsec forwarding, a distinct set of MSS clamping rules is installed based on the uplink MTU. For Ethernet uplinks, the MTU can be adjusted via netconfig.
The DHCP client includes the system hostname in DHCP requests, or alternatively can include a configurable hostname. The DHCP server gained support for supplying DHCP option 42 NTP servers to clients.
A new stable remote-service is exposed to the backend to inspect and manage containers running on routers.
The Duagon G28 target received several updates regarding dynamic device and interface discovery and can support different system configurations through geographical CompactPCI addressing. The support for the G403 digital I/O card has been improved.
ida reports additional hardware information specific to a target, such as the production date, model variant and configuration. The new hw-info telemetry source can push this information to the backend.
Add support for the new Hirschmann device serial format on NetModule routers.
Add additional work-arounds to unstuck GNSS receivers in the Telit LN920 and Sierra MC7455 modems.
In ester, implicitly add KeyUsage Extension bits based on the Extended KeyUsage extension OID for issued certificates.
Introduce stable remote-services that expose local embus services to the backend using stable APIs. The backend can issue call requests to router services or register to them using registrations with notify filters.
Under the new stable remote-services framework, some initial services are exposed for GNSS information, system reboot/factory-reset and Virtual Machine management.
Stable remote-services are documented using an OpenAPI specification. The existing backend-services documentation has been migrated to OpenAPI, including the full netconfig definition and telemetry data formats.
Implement the ITxPT time service in patrick, announcing a local or foreign NTP service to ITxPT compatible clients.
A new telemetry source has been added to ursula, providing IP address information using interval or event based reporting.
The behavior of ICMP echo request filtering can be controlled using a system-wide policy, either allowing them, dropping them or allowing them within the same VRF (the default and previously used behavior).
IPsec gateway clusters in tamara now respond to ICMP echo requests on the virtual cluster IP address. The echo request is handled by the node that is responsible for forwarding traffic of the requesting client.
Bypass rules for IPsec gateway cluster sync traffic are now created implicitly, dropping the requirement for explicit configuration.
Reduce maximum packet size of rumpl datagrams to 1232 UDP payload bytes, ensuring that rumpl can communicate reliably over uplinks having a limited MTU of 1280 bytes.
Support configuring custom MTUs for specific APNs, and set the default MTU on the Swisscom m2m APN to 1280 bytes.
Implement the ITxPT Automatic Passenger Count service as a client, collecting passenger counters from sensors on the local network. The collected counters are provided to applications via the REST router API.
Support adding the DHCP relay agent option 82 with circuit/remote-id in the IPv4 DHCP relay agent. As a DHCP server, allow matching option 82 properties to select a fixed IP to assign to a client.
Introduce dino, the Digital Input aNd Output daemon. It allows reading and controlling digital I/O on the G403 extension found on the Duagon target.
In frida, add support for matching port ranges in FORWARD/SNAT/DNAT rules, and support translating ports to ranges in NAT rules. For DNAT, offset based 1:1 port translation is supported to allow port-forwarding of ranges of ports.
Add a onway-vm-runtime utility for creating and testing virtual machines to run on onway routers. Support running VMs/containers/web content in onway-vm-runtime, onway-container-runtime and onway-media-server directly from bundles generated by the new onway-bundle-builder tool.
Use separate conntrack entries in each VRF using conntrack zones, allowing NAT translations in any VRF if a connection crosses multiple VRF domains.
Support static routes defining an output interface instead of or in addition to a nexthop gateway address. This can be used, for example, to create simple VRF crossing routes not requiring the complexity of inter-VRF routing interfaces.
Increase baud rate on u-blox GNSS receivers to handle the data flow correctly when many satellites are in view. Add some other GNSS fixes, including those related to the Telit LN920 module.
Print configured IP addresses and Ethernet link state in netti.
Add new router API REST endpoints to rapid for querying system memory, CPU and disk usage, SIM card information and link usage statistics. Migrate documentation of the REST APIs to OpenAPI.
Add support for virtual machine management via embus and on console, including operations to pause/resume, shutdown and reset VMs. Further, disk overlays can be purged to restore VMs to their fresh base image state.
Support console logins to running containers, and support stopping, starting and restarting containers via embus and on console.
Implement container syslog redirection to per-container log ringbuffers instead of polluting the host system log.
Configure POSIX message queue limits that allows containers to make use of this IPC mechanism.
Support the on1810 router 5G variant and FN980 firmware version 38.03.xxx.
Add mitigations to the Blast-RADIUS protocol vulnerability and optionally enforce Message-Authenticator attribute verification for MAB.
Support sending DHCP option 43 attributes as DHCP server, selected on the DHCP option 60 received from the client. This for example allows configuring access points with their WLC, even in mixed vendor setups.
Request required DHCP options as DHCP client in Option 55, improving compatibility with some DHCP servers, such as hotspots on Apple iOS.
Fix and improve various telemetry sources to include Ethernet DSA slave ports in MAC reports, include AP state along with associated WiFi stations, fixed BSSID encoding, complete events for modem state changes and others. Better document which fields are optional in telemetry data.
Support static DNS entries in netconfig to use by the local router system, for example to override DNS entries used for service-check URLs.
Introduce the gepeto command line tool to test/monitor rumpl server redirections.
Adapt patrick to send ITxPT location data even if no receiver has a fix, keeping the Latitude and Longitude fields empty.
Stop using mobile network operator time information from modems for synchronizing system time, as this time source can be rather inaccurate.
Introduce esmond, the External Service MONitoring Daemon. This allows querying the state of external services over ICMP, HTTP(S), and SNMP. The reporting events are collected by ursula who sends them to the backend telemetry service.
Process gpsd messages in gina with double buffering to ensure that location, velocity and satview data is complete during an update cycle from a receiver.
Fix running multiple ITxPT GNSSLocation instances on different interfaces.
Enable TCP keepalives on all HTTP client connections to recover more quickly from stalled TCP downloads due to changed uplink routing on multi-homed routers.
gina received an ovehaul in its gpsd JSON data output. The data is now consolidated over a receiver cycle and then passed to consumers. This avoids sending multiple incomplete embus messages.
escord runs the container main process under PID 1 and provides a cgroup filesystem. Along with other changes, this allows running the systemd init system in containers, allowing escord to host containers running a service manager with multiple processes.
Invoke the minit init system in pytestenv from the chroot instead of embedding minit directly in pytestenv. This allows running intests with the minit version from the build, including any changes to minit services.
ester gained support for the /simplereenroll EST operation to renew or rekey existing certificates by authenticating with such a certificate in TLS. Further, client certificate authentication can be used to list and revoke own certificates if the authorization rules allow it.
Extend netti to show VPN tunnel state information.
Add support for the Duagon G28 CompactPCI based x86_64 railway system and its Sierra Wireless EM9191 5G modem.
Add basic RFC4188 SNMP bridge MIB support and expose port tables and FDB entries for bridges. This functionality is implemented in a custom SNMP proxy agent called snape.
Add the new netti command line utility, providing an overview about the network topology and its VRF and bridging hierarchy on CarlOS. Currently it features additional information for modem uplinks and WiFi interfaces both in station and AP mode.
The DNS forwarder in dolores can now serve a single configuration over multiple interfaces in the default or a specific VRF by omitting the listen interface or by specifying a VRF listen interface. Also, it can serve static records by matching configured DNS wildcard entries.
The DHCP server can now assign statically configured addresses to clients by matching DHCP option 12 hostname options in DHCP requests.
The link configuration allows setting arbitrary interface alias names, and these alias names are exposed through SNMP to give more descriptive context in monitoring tools.
The Mobile Virtual Network Operator name with a textual description of the home network operator is now read from the modem and is reported in telemetry data.
Introduce a new daemon called mulrud, currently featuring multicast reflection of potentially non-routable multicast packets between different layer 2 interfaces. This allows exposing mDNS traffic beyond layer 2 boundaries, announcing ITxPT discovery and announcements between subnets.
Implement the ITxPT GNSS location support for patrick. This service multicasts GNSS location data in XML and additional auxiliary information via mDNS. Optional dilution of precision information is included if provided by the GNSS receiver.
Add support for TCP-MD5 authentication in the BGP base library and expose configuring an auth-key property for neighbours in the rudie JSON API.
Extend ester to support challenging requested subjectAltNames using challenge tokens by invoking a script to send the token to the user. Further, support request approval and management, and add client certificate authentication using X.509 trustchain validation with CRL checking.
In ester, add support for serving static files configured per CA policy. This allows serving client-side applications to provide an EST client frontend.
Add a –csrgen command to ester to create new CA configurations and an associated private key, and produce a certificate request to enrol the CA certificate over an upstream CA.
Extend the OS telemetry source with fallback and uptime information. This source now not only reports the OS version of the running firmware image, but also if the system is in active or fallback state. Additionally, the UNIX epoch timestamp of the last/current system startup is provided as well.
Add a disk usage telemetry source, reporting disk partition usage information for mounted partitions.
Add a physical link state telemetry source. This telemetry source reports the link state (lower-up, link speed and duplex) of physical Ethernet or SFP interfaces.
Add a fix to the Telit FN990 modem to reset the PDP context via AT command at startup. This is required for this modem when operating in the Vodafone Italy network.
Add hardcoded APN configurations for Vodafone/TIM Italy.
Add support for configuring per-VM DMI/SMBIOS variables in virma. This allows passing per-instance variables to VMs, which can be used for VM provisioning via cloud-init or similar mechanisms.
Add a system handler in conrad to configure a global hostname to use by the system and provide as default for the logging, snmp and lldp hostname configuration options.
Add a fix for radium to send Router Advertisements during the defined time conditions.
Introduce support for SMS sending by implementing the WMS service for QMI based modems. Expose SMS sending over embus, and implement a REST API handler in rapid to allow external applications to send SMS.
Improve source address selection in DNS forwarder to better support operating it on anycast addresses.
Add support for building, running and testing against Linux 6.1 LTS and 6.2 Ubuntu kernels. Migrate the escord container runtime to use id-mapped mounts, replacing the old container UID/GID separation using shiftfs.
Add support for the Nexcom nROK7251 target. It uses a dedicated library to communicate with the proprietary MCU to control SIM slot assignments, LED control, ignition state and voltage measurement and feed the watchdog. Support the u-blox NEO-M8 GNSS receiver and the Telit FN990 5G modem.
Add a DNS forwarding service for non-local clients to dolores. It supports multiple forwarder instances, each with a list of upstream DNS resolvers to forward to. Further, support static domain name RR configuration to serve locally instead of forwarding to a recursive resolver.
Support sending NMEA sentences in gina via UDP to a configurable server address and port. The data format is compatible to that of the gps2udp tool provided with gpsd.
Extend rapid by a VPN state REST API to allow external application to query tunnel and tunnel uplink state information.
Add support to include the NAS-IP-Address attribute in RADIUS Access-Request messages sent by the NAC daemon nacho. Properly support using multiple RADIUS servers; Non-responsive servers get degraded for a configurable amount of time, and receive less priority in server selection.
Extend the anton network test framework to support explicit interface/address binding in clients and servers. Extend the cast service to support server instances.
Add a new bastard API call to flush all configured redirection targets. Improve address agility for corner cases in rumpl when the client switches uplinks.
Improve NAT rule management in tamara to consider all rule matches when marking traffic subject to IPsec uplink routing.
Add support for certificate expiration warnings in the EST CA daemon ester. Extend RFC3779 address blocks to support address ranges.
Extend support for the NetModule 1800 target with PoE and CAT-12 modems. Drop support for the unmaintained GW5310, MEN BL50W and BC50M targets.
Introduce virma, the VIrtual Machine Agent running virtual machines with the help of QEMU and KVM. Currently it is supported on the APU6 target and runs guests using the x86-64 architecture. Virtual machine images can be provided via bundles using read-only RAW base images, stacking Copy-On-Write overlays on top and adding additional plain disks. VMs can be managed via serial console or via VNC, and are integrated in the host network via TAP interfaces.
Support the secondary Ethernet port on the on1810 router, which is shared with the SFP port. If an SFP module is inserted, the router automatically restarts to provide the sfp0 network interface, if the module is removed the router restarts with a lan1 network interface.
Add support for shared mounts in escord. This allows configuring paths in container filesystems that are persisted across container or router restarts.
Support arbitrary IMSI prefixes for modem APN configurations, and add a hardcoded APN configuration for Swisscom M2M SIM cards. This allows bootstrapping configuration over such SIMs using the shared.m2m.ch APN.
If supported by the VPN gateway, tamara uses latency probes in addition to IKEv2 liveness/DPD checks to detect and restart unusable tunnels.
Support proper interface name mapping for lldp alias name support on all targets.
Add a fix to gina to be able to use simulated GPS signals for staging.
Refactor cmdopts command line parsing and drop old and unused functionality. Introduce an application framework that combines the functionality usually required to set up and run asynchronous command line applications with libcafli.
Add support for SIM unlocking using PINs for all QMI based modems and the AT based U-Blox modem. PINs can be configured per SIM ICCID or per SIM slot number.
Improve support for Telit LN920A12 and FN980 modems, and add support for modem specific reset durations on all targets.
Introduce the routing daemon rudie. The daemon designed for backend servers, implements the BGP routing protocol and is controlled via a powerful JSON based IPC API.
Add support for per-uplink nameserver configuration in dolores. Such nameservers are preferred over the global hardcoded nameservers when resolving hostnames over that uplink. If enabled, nameservers can be learned by the DHCP client or from the network operator on modems.
Add a fallback mechanism for netconfigs in conrad. If a new netconfig is unable to get online, the fallback is applied to recover from broken netconfigs.
The new factory reset daemon fared implements reboot and factory reset mechanisms triggered by short and long (5s) presses of the push button found on all targets devices.
Introduce the new Certificate Authority PKI server exposing an EST (RFC7030) frontend to enroll, manage and revoke X.509 certificates. The new daemon is called ester.
Add support for the Telit LE910C4-EU QMI modem, which will replace the EOL U-Blox CAT-4 modem on NetModule routers. The Telit FN980 5G modem has gained support for the built-in GNSS receiver. Further, preliminary support for the Telit LN920A12-WW LTE CAT-12 modem has been added, replacing the EOL Sierra Wireless MC7455 CAT-6 modem in NetModule routers.
The nacho NAC daemon now includes the NAS-Port-ID attribute containing the NAC access port interface name in RADIUS Access-Request messages. SFP interfaces have been whitelisted to get used as NAC access ports, and the NAC policy can be explicitly limited to either EAP (802.1x) or MAB.
The LLDP daemon now includes port descriptions for physical interfaces and supports configuration an explicit hostname.
The SNMP daemon now supports configuration an explicit hostname.
The escord container runtime may allow containers to access specific device files under /dev. The Mobi-Solutions IBIS serial converter is detected and renamed to /dev/ibis for this purpose.
The administrative interface state and link mode settings (speed, duplex and autonegotiation) of Ethernet interfaces can now be configured through lars.
Added a conrad handler which manages LLDP services to enable Link Layer Discovery Protocol communication. The conrad handler can configure multiple services, each running on a set of interfaces.
Our crypto library received the following new implementations:
Add support for parsing PKCS#10 certificate requests, including requested subjectAltNames and RFC3770 addrblock extensions.
Add support for parsing X.509 CRL distribution point, Extended Key Usage and RFC3779 address block extensions. Add support for generating and signing X.509 certificates, including the mentioned extensions.
Implement support for parsing and generating X.509 CRLs.
Implement support for parsing and generating basic PKCS#7 “cert-only” signedData, as used by EST.
Libwebby received optional TLS support using its GnuTLS backend. Include support for TLS client certificate validation using our own X.509 infrastructure.
Extend the servus daemon with the possibility to register mDNS browser services. The mDNS browser services produce embus events if the registered service events occur.
Add support for configuring IPv6 addr-gen-mode via Netlink in linkcfg, and migrate the xfrmi management user in tamara. In netmaid, use it to install xfrm interfaces without link-local IPv6 addresses, fixing source selection issues in vpnconf.
Introduced an new (default) alternative log file format for linda, not including any connection destination addresses/ports.
Mobrod gained support for configuring an explicit custom APN authentication method to use (PAP/CHAP).
Added a conrad snmpd handler which manages net-snmp snmpd agents. These agents are configured per interface with read-only users, with or without password authentication.
Added a conrad handler which manages local Unix users on targets. These users can log in via serial console or SSH, and can gain root privileges using sudo.
Extended syntia with RTC support. Targets with a battery bufferd RTC will keep the time over a shutdown. Targets with an unbuffered RTC will have a continuous timestamp over a reboot cycle, with correct timestamps in the boot log.
Permanent redirection support in rumpl, rustie and bastard has been added. A client receiving a permanent redirect will store it persistently, and will skip initiating a future session to the redirecting server. Instead, it will directly initiate to the redirected-to server. Only if a direct connection fails, the client will retry initiating to the redirecting server.
Support for the PCEngines APU6 target has been introduced.
Adding or changing NAT rules in frida flushes conntrack, so that existing connections reconsider the NAT ruleset upon changes.
Netmaid supports an advanced syntax for installing layer 3 addresses, and supports passing address lifetimes and disabling Duplicate Address Detection for IPv6 addresses.
Tamara gained optimized tunnel failure detection by using more aggressive latency probe sending and DPD timeouts.
With the help of a new logging infrastructure, the tamara, nacho and DHCP relay services added some initial debug logging over syslog. All daemons have been migrated to syslog logging, allowing loana to filter and control log verbosity.
Added basic support for IPv6 in tunnels negotiated by tamara. This allows for tunneling of IPv6 traffic over IPv4 networks. QoS, Cluster mode and tunnel-outer IPv6 are not supported for this first iteration.
The dhcs DHCP relay gained an implementation of the DHCPv6 protocol, supporting relaying of DHCPv6 messages from multicasting clients to unicasting DHCPv6 backend servers. Relaying works over IPsec tunnels and within isolated VRFs.
The new radium daemon adds support for sending IPv6 router advertisements. It configures client routing and optionally assigns prefixes for SLAAC automatic address assignment.
The firewall daemon frida has been refactored to work in a more address family agnostic way, and the INPUT and FORWARD rule configurations now can handle IPv6 rulesets, excluding any NAT support.
Firewall rulesets now support SNAT rules for IPv4. Compared to the existing MASQUERADE rules, this allows more flexible subnet-to-subnet mapping and packet matching, and works for SNAT-before-IPsec configurations.
Introduce the new loana daemon as a configurable syslog server, which supports logging to standard or custom log files and logging to remote syslog servers via UDP. Log verbosity of individual daemons gets configurable, and all daemons have been migrated to log through the syslog infrastructure.
The ursula telemetry agent added support for a new vpn-state telemetry source, providing VPN tunnel state and uplink load sharing information.
Extend the modem stack to provide frequency band information used by the connected cell on QMI based modems, and include it in telemetry data.
WiFi client connections can now authenticate with EAP-TLS against a set of AAA server identities, supporting redundant RADIUS setups using different identities. Also, WiFi client roaming has been improved regarding optimistic DHCP renewal and tunnel re-establishment behavior.
The REST/JSON API daemon rapid added support for a system handler, providing system identity and versioning information to clients.
The tricia CI build agent can now list build artifacts in JSON format and instantiate build plan jobs based on tag/branch name matches.
Unit-tests have been made more reliable and have been migrated to support Linux 5.15.
Hardware Integration Testing has been extended by a wide range of tests, new devices and new functionality.
Add support for cluster gateway operation for IPsec tunnels, where multiple physical nodes on the same layer 2 network operate as a virtual cluster using a shared gateway address. Multiple uplinks of each physical node can be combined in the cluster, providing redundancy and uplink bundling beyond a single node. In the default mode, a single client sends all traffic over the same cluster node, similar to Cisco GLBP.
In the new gateway cluster functionality, the optional rebalancing mode can distribute the traffic of a single client over multiple cluster nodes, so a single client (or a router with multiple clients) can make use of the aggregated bandwidth provided by the full cluster. This requires forwarding of client traffic between nodes, which is efficiently implemented on the nodes using an XDP eBPF program.
Introduce libradius, a simple self-contained RADIUS client library. It supports message authentication and password encryption using the newly added MD5 hasher and the HMAC crypto primitive.
The linkcfg network helper can create source mode based MACVLANs, its nodst option and can manage source MACs on such interfaces.
Introduce nacho, the Network Access Control Helper and Orchestrator. It implements a fully-featured NAC service to authenticate clients on Ethernet ports using MAC Authentication Bypass or with EAP using 802.1x. It delegates authentication to a RADIUS backend server. Based on the authentication verdict, clients get elevated to Reject, Accept or VLAN-ID specific MACVLAN interfaces operating in source mode. These interfaces can be bridged to a layer 2 network or associated to a layer 3 VRF routing domain using the existing bridging and VRF mechanisms.
bastard has been extended to serve its JSON API over a Unix socket, providing user/group permission security. It further can now better handle back-pressure with unresponsive management applications to avoid queuing too many requests.
The brush utility has been extended to use Unix socket connections automatically, if enabled. It properly forwards exit codes from invoked commands, and supports a –wait option to wait for targets to appear before executing a given command.
The ursula telemetry service now can send telemetry updates on changes instead of periodically. This event-based mode is configured with a reporting interval of zero, and is supported for the os-version, mac-addr, modem-connection, modem-info and modem-sim sources.
The gina NMEA proxy service now uses the best available GNSS receiver only, not including any sentences from secondary receivers without a fix.
Add basic support for the Telit FN980 Sub-6GHz 5G modem. The modem framework is extended to support 5G NSA modes in QMI and in telemetry data.
The tricia CI build agent now groups build jobs for the same version under a build group, and build (group) listing can now produce a JSON format for consumption by scripts or other tools.
Introduce patrick, the ITxPT daemon implementing the inventory service with HTTP/XML transport. It builds upon servus for DNS-SD service announcements.
Add initial support for the PCEngines APU4 target.
Add support for inertial measurement units (IMU), providing access to accelerometer and gyroscope data. As a first device, support the u-blox M8U GNSS module found on NetModule devices with dead reckoning.
IP traffic can now traverse VRF domains by using VRF interconnects configured through lars. Standard routing and firewalling rules must explicitly allow traffic on such interconnects. ICMP by default is blocked for VRF interconnects, but can be opened up using the new ICMP traffic matching in frida.
When not acting as a VPN uplink, modems can now be associated to explicit VRF domains. This allows a VRF domain to get a dedicated modem as an uplink instead of terminating a VPN tunnel into a VRF.
APN configurations can now be specified for specific modems in addition to IMSI specific configurations. Custom routes can be specified for private APNs if only certain networks are reachable.
Before assigning new leases, the DHCP server verifies that the lease IP address is not used by any host on the network by issuing ARP requests. This avoids reassigning a DHCP address after a server reboot or if an address is used by a statically configured client.
In addition to veth links, containers can receive a full physical network interface to directly interact with a physical network, including CAN. Additionally, container logging has been improved and can be traced.
Add support for working with eBPF programs. Programs can be transpiled from C to eBPF instructions, and then loaded to the kernel. A basic set of helpers provide map operations from eBPF and from userspace. As a first user, XDP programs can be attached to interfaces.
The rapid public router REST/JSON API now provides calendar time, modem signal info and IMU handlers.
The embus tool added support for monitoring mode to trace and filter embus communication for debugging purposes.
The new cabud CAN bus daemon configures CAN interfaces and sets up packet sniffing sockets. Collected CAN frames can be correlated in ursula and uploaded to the backend for further analyzation.
The new servus daemon implements a mDNS/DNS-SD service responder to announce arbitrary services in the local mDNS. It builds upon libavahi-core, and can be configured by other daemons using embus.
The tamara traffic steering mechanism has been complete reworked. It uses a new NFQUEUE helper to pass packets for steering decisions to userspace. By considering the NAT configuration in tamara, both SNAT- and DNAT-before-IPsec scenarios can be properly implemented, without the need for negotiating extra traffic selectors.
mobrod can now use custom APNs configured by conrad. As custom APNs can not be applied over a modem connection requiring that APN, the configuration must be applied over a different uplink or out-of-band, though.
wifid and mobrod can collect per-antenna signal strength information, and ursula includes these measurements in telemetry data. Further, ursula gained a new MAC address telemetry source to report MAC addresses of physical interfaces to the backend.
The new cast daemon configures and runs anton scheme tests. Cast takes care if an interface is ready or not and starts/stops the tests accordingly. The results of these tests are collected in ursula and uploaded to the backend server.
anton has been extended by a new icmp ping scheme. It is similar to the existing UDP based ping scheme, but can target an arbitrary ICMP host. The scheme can also bind to a specific interface to test individual uplinks.
minit and pius mount filesystems with the discard option where appropriate. This allows the flash layer to discard unused blocks. It may slightly reduce I/O performance in the short term, but can be helpful for overall flash health.
rapid provides a new LED state handler, so third party application can query system state over REST/JSON based on simple LED states.
snoopy includes the relay agent address in JSON events if the DHCP message has been relayed by a relay agent.
Tamara has been extended to measure One Way Delays with latency probes. Based on the measured upstream latency and a per-uplink configurable target latency, the mobile agent dynamically adjusts uplink send rates to not exceed the targeted latency. This works around buffer bloat seen in many (mobile) transport networks on highly loaded links.
The tamara mobile agent also calculates rates to reduce the downstream latency, and includes the target rate in latency probes. The ground agent enforces this latency per tunnel to keep latency near the target by adjusting the send rate accordingly. The use of additional CoDel queues both on mobile and ground agent further improves packet scheduling based on local queue packet sojourn time.
On top of the tamara classless QoS mechanism reducing latency and buffer bloat, a classful mechanism can prioritize and reserve bandwidth for certain traffic classes. Traffic is identified using layer 3 and layer 4 selectors, and separated to classes that are dynamically adjusted based on the available uplink capacity. QoS class information is embedded in latency probes, so the mobile agent configuration is sufficient to deploy a full QoS scheme across all traffic sent over VPNs.
libcafli has been extended by the codel and fq-codel netsched queueing disciplines and the hash:ip,mark and hash:net,port,net ipsets.
Access points authenticating clients with WPA-Enterprise can now operate the RADIUS client in a specific VRF domain. This requires a patched hostapd.
The behavior of DHCP client and server has been improved to better handle layer 2 roaming by keeping IP addresses installed.
The Gateworks GW5910 has gained support for proper (but limited) LED support.
Basic support for the LLVM scan-build static analyzer has been added, and integrated into CI, revealing some bugs.
The stack has been ported to Ubuntu 20.04 focal support for the updated tooling and unit test fixes.
The use of XFRM interfaces in tamara has been made mandatory. All IPsec tunnels are now required to terminate into an explicit XFRM interface, even when not using VRFs. This makes configurations more consistent and debugging and sniffing traffic flows more convenient.
Based on a new X.509 certificate parser, the identity and credential service ida has been extended with a more advanced credential store. It provides an embus interface to select and fetch available certificates and private keys. Tamara has been refactored to make use of that new API, and additionally can enforce identity based CA constraints for server certificates.
The wifid daemon gained client support for WPA2-Enterprise authentication. EAP-PEAP or EAP-TTLS combines server side certificate authentication and tunneled EAP-MSCHAPv2 client side password authentication, whereas EAP-TLS uses mutual certificate based authentication for client and server. Credentials are dynamically fetched from the ida credential store.
In Access Point configurations, wifid can delegate WPA2-Enterprise EAP authentication to AAA servers over RADIUS.
wifid now supports connecting to hidden SSIDs as a client by doing active scans or to operate access points with hidden SSIDs. Also, MAC addresses for secondary virtual WiFi interfaces acting as AP or in mesh networks can be generated dynamically.
The new wipras backend daemon implements an analysis service for collected WiFi probe requests. It is fed over an dedicated IPC interface with probes, classifies them and identifies devices per collection site. It uses payload and sequence number based heuristics to counter MAC randomization efforts and produces simple appear/disappear events for identified devices.
Modem roaming policy configuration support was extended to specify rules not only per SIM/IMSI prefix, but also per modem interface name.
pytestenv userspace routing for simulated modems now can add packet latency to links and limit forwarding bandwidth. Also, it can simulate buffer-bloat, as often seen in mobile networks, where increased link usage leads to high packet latencies.
The new sidd Simple Interrupt Distribution Daemon dynamically distributes IRQs to CPU cores by monitoring the interrupts per device. It replaces the static interrupt SMP affinity assignments done in minit, providing a more versatile solution not bound to specific use-cases.
The syntia time synchronization agent can now forward a synchronized time to clients by providing a simple NTP service on a list of interfaces. Also, syntia now runs in unprivileged mode to harden system security.
Netfilter INPUT and FORWARD filtering in frida has been adjusted to use the custom slavedev Netfilter match instead of the rather unelegant Linux patches used previously.
The escord container runtime now can use per-instance environment variables to configure containers dynamically on individual hosts.
The new escord daemon provides a container runtime that can run Open Container Initiative compatible container images. These images can be provided by removable media or from busyd bundles. The runtime is built on libcafli containers, and uses zram copy-on-write filesystem overlays, user namespaces with per-container UID/GID ranges, and veth based networking for smooth integration into CarlOS networking.
Add initial support for the Gateworks targets GW5310 and GW5910, including ida identification, pius updates, minit hardware support and a mobro devctl backend. As modem reset is limited on these platforms, introduce fallback recovery strategies using modem driver based reboots.
Add support for the SIMcom SIM7600 modem series. This Qualcomm based modem is handled over QMI and requires the usual AT magic to configure the GPS NMEA stream. SIM management is handled over the QMI UIM service instead of DMS.
The DHCP server dhcs has been extended to send arbitrary strings in DHCP vendor extensions wrapped in DHCP option 125.
Tamara has been refactored to use XFRM SA set-marks to avoid the complex pre-decapsulation marking. The SA can match solely on SPIs and implicitly set marks on the packets to match the associated policy. Tamara has also learned to answer probe requests on the responder gateway on each VRF, allowing strongSwan to terminate tunnels into dedicated VRF domains.
The netmaid daemon learned to manage XFRM and VRF interfaces, and to set interface master devices to move interfaces into VRF domains.
Add support for building and testing on Ubuntu 19.10 eoan.
The gina daemon added support for a NMEA TCP proxy service, as known from mrd. If configured, clients connecting to that port receive a raw NMEA stream forwarded from gpsd. gina has been refactored to use a shared gpsd connection helper.
The new busyd bundle synchronization daemon automatically synchronizes SquashFS filesystem bundles from the backend to local storage devices. It uses the new rsum file synchronization framework for efficient delta updates, and mounts swapable bundles via memo. The HTTP server heico can use such bundles as a backend to serve content and templates from.
The libmobro modem discovery has been re-implemented using our own sysfs/kobject based USB device layer instead of libusb. The dependency on libusb has been dropped.
Modem simulation in pytestenv has been reworked to a simplified communication infrastructure. Test cases now use embus calls from the host system into a special embus service to control modems. The data plane between modems and APNs uses a generic TAP based userspace routing service embedded into libtestenv.
pytestenv test cases have been adjusted to work without the no longer supported splitbrain RPyC extension, and now all tests work fine under clang 4+ address sanitizer. Issues with running against Ubuntu 19.04 kernels have been addressed and all Python code has been migrated to Python 3.
A new HTTP content and media server, heico, has been added to our software stack. This server delivers content files to local users and can act as media or (caching) content server. It can render templates to provide a a simple frontend to end users for navigation through media files. The storage needed for the content is provided by removable devices which are controlled by memo.
The new memo daemon has been added, it is responsible for automounting block device partitions. Either detected at boot time or at run time. It also informs if partitions disappear. Additionally, memo supports the usb autorun feature. The minit usbrun service has been obsoleted with this feature.
libcafli gained a block device handler. This handler keeps track of block devices and informs about appearance and disappearence of such.
The obsolete mrd daemon has been dropped from the repository, along with misc CAR-A-WAN tools, outdated scripts and documentation. The autotools project has been renamed to carlos, and some general housekeeping has taken place to keep the project clean.
pius has been extended by a FPGA logic file updater, very similar to the bootloader upgrader. The 1800/2800/3800 targets can apply FPGA updates using this infrastructure.
embus has been opened to unprivileged users, so such users can connect to the broker. Providing or using services requires privileges, though, which can be explicitly granted to unprivileged processes.
minit can spawn service processes under unprivileged users, but pass them certain Linux capabilities to fulfill their task. The dolores DNS resolver as first user has been migrated to run in upriviliged mode.
The new rapid daemon has been added, exposing the CarlOS customer facing REST/JSON API over HTTP. Based on libmicrohttpd and webby, it exposes a stable API that can be used over the network by third party applications. Part of this initial version are API calls for GNSS information, forwarding location/velocity queries to gina. rapid runs with reduced privileged and can be configured through conrad.
libcafli gained a new USB device, interface and driver discovery mechanism independent of libusb. gina has been migrated to discover USB based GPS receiver using this new infrastructure.
Extend ursula to allow uploads triggered by its telemetry source. In the WiFi probe source, this can be used to upload probes based on the accumulated data volume, preventing the upload playoad to exceed certain size limites.
Add support for virtual routing domains using VRF master devices as provided by newer Linux releases. By enslaving other devices to a VRF master, these devices create an isolated routing domain. DHCP client, relay and server have been adopted to work within such VRF domains.
tamara now can associate XFRM interfaces to tunnels. Any traffic routed through such an interface must leave IPsec-secured, and received IPsec traffic appears from that interface. XFRM interfaces can be enslaved to VRF master devices, effectively terminating IPsec tunnels into VRF domains. The usual tamara uplink load-balancing and redundancy mechanisms can still be used, as redundant tunnels are terminated over a shared XFRM interface.
wifid now can create additional virtual WiFi interfaces on a shared physical device, allowing the same hardware to operate simultaneously in different modes. Possible use cases are multi-SSID APs, or concurrent operation of client and mesh modes on the same interface as an access point. Hardware limitations usually restrict what actually is possible, and a single WiFi module can operate on a single frequency, only.
wifid can now configure (virtual) WiFi interfaces into monitoring mode to capture traffic, filtering it by certain criteria. A first filter is for Probe Request packets to get a view of unassociated clients nearby. ursula correlates these Probe Requests in the new wifi-probes telemetry sources, and can periodically deliver these collections to the backend for further analyzation.
Add preliminary support for the Netmodule 1800 target, currently featuring the model with the Ethernet switch extension. The switch and also the SFP are fully supported, along with the same feature-set available on 2800 and 3800 targets.
rustie learned to try fallback routes if the primary route fails to establish a rumpl session. This highly increases the chance that we can see and manage routers that have multiple uplinks, but the primary (wired) uplink fails beyond the visibility of a device or is restricted by a firewall.
In a similar fashion, DNS lookups are retried on alternative routes, so rustie but also other services (such as strongSwan) can create sessions even if DNS lookups are failing on the primary uplink. The DNS fallback logic is implemented in the new local DNS proxy service dolores, allowing any service using that local DNS service to make use of that feature.
gina received a device control framework which allows to manage different GNSS receivers. We now support the known gps receivers on the Sierra and Huawei modems. New support has been added for the Netmodule u-blox GNSS receiver which is placed on the Netmodule modem.
mobrod now supports the new u-blox based Netmodule modems which are available with and without GNSS module.
wifid can steer the verbosity of the hostap logging facility. This can be done via embus interface.
rustie allows to enable/disable rumpl message tracing.
Introduce tricia, a trivial CI agent. This daemon uses build plans and associated scripts provided by a project to run arbitrary build jobs. A trivial web interface provides build results and artifacts.
Based on tricia, continuous integration testing has been added. We can now run unit-tests after each commit on a build server. Unit-tests have been optimized to better run in parallel.
pius gained the ability to verify and apply U-Boot upgrades shipped on the embedded root filesystem on NetModule targets.
The automake based buildsystem has been mostly migrated from recursive make invocations to an include based approach. This allows make to track dependencies project wide, better parallelize builds and run unit-tests under a single automake test-runner instance.
The whole software stack can be built with mrd disabled and a hardcoded GEP for rustie. This completely eliminates the old REST communication infrastructure in favour of rumpl/stilz, binging all the goodness that have been lingering.
wifid now can configure mesh networks according to IEEE802.11s, either plain or encrypted. Conrad takes care of configuring such interfaces, and ursula can collect mesh peer statistics to provide to the backend.
rumpl gained support for the rush rumpl remote shell application. It allows running commands and shells remotely from the backend, without the need for any VPN connectivity. The new rush utility provides a powerful backend command line tool to make use of this functionality, acting as a client for bastard.
mobrod learned to handle multiple SIM slot assignments per modem. Slots are selected based on SIM availability, and are cycled through if modem monitoring resets a modem due to connectivity issues. This feature can be used to implement a trivial way of SIM selection if some SIMs are not allowed to roam.
odissa now includes hardcoded target specific default configs to serve on factory-new devices. This config enables DHCP on all LAN interfaces, enabling an uplink to get the real device config.
Ursula exposes an embus interface to do measurements on the configured sources, and now collects all information we need to emulate rms-push functionality on the backend server.
Introduce the new Lars daemon, a Link, Address and Route management Service. Lars is responsible for installing and maintaining static network items and is controlled over embus. For now it handles IP addresses, routes, VLAN/VXLAN and bridge interfaces.
The new conrad network CONfiguRAtion Daemon acts as a new configuration entity to set up and maintain all networking aspects of a CarlOS router. It uses a rumpl backend service to get configuration (updates) from and applies changes with minimal downtime by building deltas over the old and the new configuration version. It delegates configuration to other daemons over embus, namely lars, dhcc/dhcs, wifid, mobrod, tamara, frida and others.
Introduce Ursula, a Unified Remote Sensoring UpLoad Agent. Ursula collects system statistics from various sources. It is configured through and delivers results via a rumpl backend service. It acts as a replacement for the upload framework that mrd provided, and currently features memory/cpu usage and link statistics, GPS and voltage data, VPN statistics and WiFi connection and various modem information sources.
The new Odissa On-DIsk Structured Storage Agent takes care of the persistent storage of structured data to disk. Other daemons may use it’s embus API for configuration storage, and both conrad and ursula make use of it.
The dhcs based DHCP relay server now supports multiple servers where each client request is forwarded to all servers. Further, requests can alternatively be re-broadcasted to a specified interface instead of sending it to an explicit DHCP server IP.
Tamara gained support for per-tunnel uplink configuration, and modem interfaces can be configured explicitly and with specific priority groups. This allows basic cost-control mechanisms per individual tunnel. Further, tamara improved interoperability with third party IPsec VPN gateways by adding support for non-AEAD proposals and traffic-selectors, and now implicitly does TCP MSS-clamping on the client to work-around path MTU discovery issues.
pytestenv now can simulate GPS positioning by injecting NMEA sentences from a pseudo character device associated to testing modems.
minit now handles e2fsck failures more gracefully, and reformats unrecoverable data partitions implicitly.
Introduce pius, the Patching Image Update Service. This new daemon gets image version information and update instructions from the backend over the rumpl communication stack, and applies system images in full or using patches. The mrd bz-image module can still be used to fetch image updates, but delegates image application to pius using its embus interface.
The dhcc DHCP client and the mrd dhcp-client module now support the configuration of a DHCP Vendor Class-ID and the RFC 3004 user-class identifier, which can be included as option in any DHCP Discover and Request message.
Frida now supports configuring Netmap rules over its embus interface, similar to the mrd nat-config module. There is currently no configuration mechanism through mrd, which is planned to be exclusive to the new configuration frontend.
wifid now explicitly disable power-save mode for WiFi modules in client mode to avoid latency issues for incoming packets.
Perform CarlOS watchdog feeding from the new wilma daemon, replacing the mrd watchdog module. wilma uses embus service pinging to check overall system health and indirectly trigger system resets if some subsystems got stuck.
Tamara learnt to install bypass rules dynamically by monitoring the subnets attached to local interfaces. Further, tamara now triggers modem resets over embus if establishing tunnels fails after several tries.
The timmy framework and daemon gained support for creating and verifying timestamp signatures using EdDSA signatures. Compared to RSA signatures, this significantly reduces packet size and the cost of creating signatures on a timestamp server.
Time synchronization has been centralized in the new syntia synchronizing time agent. It acts as a timmy client and considers other time sources, such as from the mobile network or rumpl connections. syntia replaces the mrd timmy-sync and system-time modules, and supports DNS timeservers resolving to multiple IPs and concurrent connections to multiple servers.
Extend frida to support installing DNAT rules for simple port forwarding, and add support for OUTPUT interface matching to FORWARD rules. MASQUERADE rules now explicitly exclude packets subject to IPsec encapsulation, as this may produce incorrect conntrack entries.
Add support for assigning nameservers via DHCP to dhcs and the associated mrd module.
Add background scanning support to the WiFi stack to allow faster WiFi roaming to a better BSS in the same or another ESS when the connection falls below a certain signal quality level.
When booting the fallback image, this is indicated by the system LED status and the bash prompt. To no get stuck on fallback if no backend connectivity can get established, the system is rebooted into active after 5 minutes.
Support embedding minit into pytestenv, so we can invoke and better control the full CarlOS stack from an appropriate chroot. Several changes and improvements to the minit logging subsystem allow pytestenv to query these logs and catch process failures.
The new pyintest integration test frameworks introduces the next generation of integration tests. It uses full-stack CarlOS hosts to simulate them completely, and adds several helper classes to simulate all the required infrastructure. A few initial tests demonstrate the framework.
The ida daemon learnt to synchronize IPsec credentials with a bastard backend and persists such credentials locally to disk. It configures these certificates and keys for strongSwan by passing them to the new tamara embus credential interface.
Tamara now configures output SA marks to set for decapsulated traffic. This avoids the need for our own kernel patches for post-decapsulation policy route lookups if the target runs Linux 4.14+.
wifid now maintains the configuration passed over embus, so it can use retry strategies when configuring interfaces temporarily fails.
The handling of random data acquisition in minit and ida has been adapted, because Linux upstream fixes changed how the kernel blocks reads from a uninitialized urandom pool.
Integration testing has been migrated to Ubuntu 18.04 bionic.
minit got improvements for its dependency handling, so we can adjust service requirements per target. Further, service failures are now handled more gracefully by restarting dependent services as well.
Commonly used directories can be set on ./configure using the –with-pid-dir, –with-ipc-dir, –with-data-dir and –sysconfdir options.
Introduce bastard, a rumpl server that provides a JSON API to manage rumpl sessions, operate remote embus services or provide backend services on clients connected via rustie.
Add a rustie client library, simplifying registrations and calls to backend services over rumpl. rumpl, stilz and rustie got many fixes and improvements, and rustie can be configured through a mrd module to run the full stack on experimental setups.
Introduce ida, the identity and credential agent for CarlOS. Ida provides an embus interface to query the router device identity, and it is responsible for generating persistent router private keys during boot.
Tamara gained the ability to handle configured fixed links over Ethernet and WiFi. Such links can be used in addition to modems to create redundant uplinks. The new link priority groups can be used to configure links as hot-stand-by, with such links carrying traffic only if no higher priority links are available.
Consolidate DHCP client code to a libdhcp, and implement an embus controlled DHCP client daemon in dhcc. The mrd dhcp-client module has been migrated to delegate DHCP client functionality to dhcc.
Extend the new libdhcp by generic DHCP server code, and implement a trivial DHCP server with in-memory leases in dhcs. The mrd dhcs-config module has been extended to support DHCP server configurations in addition to relays.
The new sierrafw utility can apply firmware updates for the MC7455 on CarlOS using the libqmi qmi-firmware-update helper tool. A new minit autorunner service can assist in that by running executables found on an inserted USB storage device.
wifid gained support for configuring client connections, and the wpa-supplicant module in mrd delegates WiFi client configuration to wifid.
Add support for the Netfilter CT target to nfjson, and implicitly to netmaid.
Extend frida and the mrd frida-client module for explicit INPUT and simple MASQUERADE rule installation.
Add support for multicast VXLAN devices through the new vxlan-config mrd module. Support WiFi client isolation where WiFi interfaces are bridged to transport interfaces (such as VXLAN) and add support for non-forwarding bridges for client isolation.
Introduce a Diffie-Hellman key exchange interface, and implement it for Curve25519 using public domain code. Based on the that, implement the Ed25519 public key signature scheme. Add a SHA512 hash backend for use in Ed25519.
Introduce a symmetrical cipher interface and an associated Chacha20 cipher, and an AEAD interface with a Chacha20Poly1305 implementation. All this code is portable and based on public domain.
Introduce an asynchronous DNS resolver based on libudns.
Add a heap collection, and use it to implement a scalable task scheduler. The scheduler can handle thousands of timeout jobs using on a single timerfd.
Introduce rumpl, a from-scratch designed client/server protocol for versatile router/backend communication based on UDP. rumpl is designed to be secure, fast, lightweight and very flexible. The new stilz message serialization and compression protocol defines a data representation layer to use within rumpl. It uses efficient encoding and a rolling compression mechanism, using either zlib or null compression. The rustie router daemon combines these parts to connect the router-local embus daemon to the backend, to either provide backend service on the local embus or act from the backend as client on the local embus.
The new gina-client mrd module acts as a drop-in replacement for the gpsd-client module, but uses the gina daemon to get and forward location information within mrd. Gina now also drives LEDs to indicate GPS signal and fix status.
mrdock got a RESTful server API based on webby to expose use-case specific service info and system status information.
Tamara now raises tunnel state events, which mrd hostapd can use to depend on for access point setup. In addition it got some minor fixes and improvements.
Add the gina daemon, acting as a bridge between the gpsd JSON interface and our embus IPC communication layer. It collects GPS location, velocity and satview information and publishes this data over embus, supporting multiple GPS receivers.
The new mobrod mobile broadband modem daemon extracts the modem management from the mrd mobro-modem module to separate this functionality from mrd. Mobrod inherits the mobro-modem embus interfaces, and the mobro-modem module now uses that interface to configure modem management in mobrod.
Similar to mobrod, the wifid dedicated WiFi interface management daemon takes responsibility to manage access points using hostapd. It also has an embus interface with extend status and notification mechanisms. The mrd hostapd module now talks over embus to wifid instead of controlling hostapd directly.
The mrdock Docker container service has been refreshed and now handles all communication needs with Eagle.
The new libwebby web server library based on libmicrohttpd provides a helper that makes implementing web server in any application trivial.
Add support for running the full CarlOS stack including minit within pytestenv. Using the fleetsim companion project, this can be used to simulate hundreds of full-stack routers to stress-test the backend systems and the overall system behavior.
Netmodule targets now configure the CPU interrupt affinity to use the second CPU for USB interrupts raised by modem receive activity. Using such a configuration, the seconds CPU is used to process downstream traffic, while the first handles upstream.
mrdock has been refreshed to run within RedHat containers. This requires compatibility to the old but heavily patched Linux 3.10 kernel.
The whole stack got some love for newer (4.13) kernels and compiler (gcc-7) versions.
Frida can be controlled over embus to install a forwarding ruleset, and the mrd frida-client module does so based on its mrd configuration. The existing rule to allow forwarding of traffic from non-modem interfaces is used as a fallback if no explicit rules are configured.
Tamara gained a fast-path for its decapsulation ruleset to avoid the linear ruleset processing when serving many mobile agents. This significantly improves its scaling capabilities in ground mode. Some other improvements make multipath-tunnels more reliable and scalable.
The bridge-config mrd module now can configure MTUs on bridges, which is required for the WLP3800 DSA hardware switch.
To apply firmware updates on the MC7455, mobro-modem can configure firmware preferences and trigger reboots into QDL download mode. In this mode, new firmware images can be downloaded using third-party tools.
Snoopy has been migrated to publish DHCP messages to connected clients over a custom protocol based on plain Unix socket. This allows dropping the (lib)rabbitmq dependency, which now is obsolete in MPP.
Introduce Frida, the Firewall Rule Installation DAemon. It installs a static ruleset with basic default-DROP policies and allows services to open INPUT ports. Forwarding is currently unrestricted on non-modem interfaces.
Add Ignaz, the ignition monitoring daemon. It monitors supply and ignition voltages and can trigger delayed device shutdowns if a vehicle stopped running. Additionally, mrd can upload voltage statistics to the backend.
Tamara sends active latency probes over the modem-specific tunnels to estimate link quality vs. link usage. This allows her to balance more load over modems with free capacity. Also, tamara now can bypass configured subnets from IPsec processing to route between local networks.
Introduce a flush operation on netmaid conntrack, which can filter in-kernel for address families and marks for better performance.
Add support for the hash:net,port ipset and support additional protocols in the port sets, namely ICMP and layer 4 protocols actually not having ports.
Migrate fd-watcher from poll(2) to epoll(7). With many file descriptors or frequent dispatch invocations, this can significantly improve dispatching performance.
Introduce dynamic modem configuration discovery on Netmodule hardware by reading the EEPROM board describtor using the new libbdesc helper library.
mrd introduces two new modules: The link-config module to configure Ethernet ports and the route-config module to install static routes.
Add many fixes and improvements to the anton traffic testing framework and pytestenv. The latter got major refactorings by using a generic RPC helper to communicate between containers.
Fix GPS on Sierra Wireless modems with newer firmwares by sending $GPS_START on the NMEA channel.
Add generic conntrack mark support to netmaid, and implement kernel-assisted conntrack entry filtering using marks. Netmaid gained support for a flush operation, optionally filtering on marks as well.
Migrate all the network management operations in pytestenv to native Netlink APIs. This can improve performance by eliminating the overhead for invoking the ip and brctl utilities.
pytestenv hosts gained a built-in lightweit DHCP client, Netlink based address management and experimental support to issue HTTP requests.
Introduce anton, the Advanced Network Testing framework yet Ohne Namen. It can simulate typical network applications by exchanging traffic with the dedicated antonius test server. All traffic schemes produce measurement results to quantify the quality of a network that is tested. Anton has been fully integrated into pytestenv to simulate hundreds of users generating traffic.
Introduce a Linux chardev based GPIO control API, and migrate the mobro-devctl backend for Netmodule devices to it.
The mobro-devctl Netmodule backend now supports SIM slot events, allowing mobro-modem to reset modems up SIM insertion automatically.
Netmaid gained support for a route get command, and supports the Netfilter conntrack match.
By adjusting libcafli initialization and linking, now only components that actually make use of optional libraries have them linked in. This significantly reduces the footprint of some tools.
Timmy gained proper support for listening on loopback addresses and got some other fixes for time handling.
Netmaid got many improvements and fixes, including a selecting get operation for ipset, conntrack entry inverse matching and an option to not resolve service port names.
Migrated Tamara LED control to the embus-controlled Leddy daemon, and added initial LED control support to mobro-modem to indicate modem status.
Support triggered hot-reloading of configurations in mrd using –reload.
Add initial support for the Sierra Wireless MC7455 LTE-A modem, including NMEA GPS streams.
Add some additional APN definitions for Germany and Austria.
Include a hardcoded default mrd config for NB2800 devices, configuring Timmy and SIM slots to successfully contact the gep/cep services.
Introduce Leddy, the LED control daemon. Currently it just says hello during boot, giving production an indication that CarlOS is running.
Introduce dhcs, a stand-alon DHCP service controlled over embus. Currently it implements a DHCP relay, configured through the dhcs-config mrd module. The dhcs service replaces the dhcp-relay mrd module.
Add many fixes and improvements to the tamara multipath tunneling agent, making it usable for real-world use.
Implement support to configure 40MHz wide channels for 802.11n and ac access points, both in the 2.4GHz and 5GHz bands.
Add a trivial spdhthresh utility to configure XFRM policy hashing thresholds.
Add embus, the embedded messaging bus for intra-system communication on embedded devices. The Unix socket based messaging bus features a central broker, service registration and announcement, request/response commands and notifications. Along with a simple but powerful data serializer it is a nice fit for all communication needs between microservices.
Introduce Tamara, the tunneled multipath routing agent, as an experimental preview. It runs both in the backend as ground agent and on the router as mobile agent to establish redundant tunnels over multiple modems. It uses policy routing and some Netfilter magic with marks to distribute and migrate traffic over the available uplinks.
Add support for the hash:net,net two-dimensional ipset, including JSON encoding/decoding of elements.
Introduce flowie, a UDP based bandwidth testing protocol, framework and command line utility. The flower mrd module implements the same protocol and automatically runs Flowie tests, reporting to the backend.
Sort module entries in rms-push by modem interface names to have a consistent array element ordering.
Add client isolation, regulatory domain and TX power limiting options to the hostapd mrd WiFi access point module.
Introduce an experimental multipath route setup option to the mobro-modem mrd module. At this time this is incompatible with strongSwan IPsec tunnels, as strongSwan can’t handle true multipath routes very well.
Add support for the Netmodule NB3800 target running CarlOS.
Implement simple bridge management in the mrd bridge-config module, linking together multiple physical interfaces to a single bridge. The main use-case for now is multi-band Wireless where we form a Layer two over a 2.4GHz and a 5GHz WiFi interface.
Add RSA private key parsing and signing capabilities based on libgmp.
Define timmy, the authenticated time synchronization protocol, and provide a standalone server implementation and a timmy-sync mrd module client to synchronize time over untrusted networks.
Add a dhcp_client module to mrd, configuring Ethernet and WiFi interfaces dynamically over DHCP with addresses and routes using our own DHCP handling code.
Implement a vlan_config mrd module to add VLAN interfaces on top of physical Ethernet interfaces.
Add initial support to run on Netmodule NB2800 devices on our custom OS.
Add support for the U-Boot based NB2800 devices to bz_image, updating ARM zImages and implementing fail-safe booting.
Implement a mrd watchdog module to feed a hardware watchdog through our the mrd event loop.
Introduce a first version of libmemprof, a LD_PRELOADable library that dumps memory allocation with backtraces to find memory leaks.
Add libwifi, a full-blown WiFi management API using hostapd and wpa_supplicant as backend to configure access points and client connections.
Based on libwifi, implement a wpa_supplicant mrd module to configure WiFi client connections. The existing hostapd module got migrated to libwifi as well, and gained support for multiple access points.
Add a kobject listener reporting hardware hotplug events raised by the Linux kernel.
Introduce minit, a pure and minimalistic PID 1 init system and service manager for mrd and associated processes. It takes care of bringing up an embedded system from the kernel to mrd in an asynchronous and reliable way.
Add a sysctl module in mrd to configure Linux kernel options over the /proc/sys interface.
Add some self-debugging capabilities to mrd by catching critical signals and dumping backtraces with the help of libunwind and libbfd.
Make the libcurl and the libjansson interface more abstract, and add compile switches to disable these dependencies.
Add a basic nl80211 API for managing wireless radios and interfaces, and interface the mac80211_hwsim driver that can be used from pytestenv to create virtual WiFi radios in test hosts.
Introduce a mrd hostapd module, which launches hostapd based on VPN tunnels to create access points.
Consolidate all DHCP handling code, and implement a mrd dhcp-relay module to work together with the hostapd module to assign DHCP leases.
Introduce new collection types in libcafli, namely the Linux list style chains and based on the same concept a hashtable named dict. The siphash algorithm is provided for fast hashing of keys.
Add Python3 support to pytestenv, and support for shutting down pytestenv hosts.
Introduce a libcafli public key interface, and RSA public key signature verification based on the optional libgmp dependency. This functionality is supported by a new rule based ASN.1 parser, an OID database and a SHA256 hash backend.
The new libcafli compress API defines a generic compression/decompression interface, currently implemented for bzip2 based on the optional libbz2.
Implement a binary diff file patching utility using the bsdiff/bspatch format, and based on it a mrd module that updates image files based on our extended and cryptographically signed bzImage format. Add a grub specific backend to implement fallback image booting.
Add a framework for modem related device control to powercycle modems and associate SIM slots. Provide an I2C based backend for the Men BL50W and a iomapped FPGA backend for the BC50M.
Introduce a QMI based modem driver for the Sierra Wireless MC7304, currently without GPS support.
Add a new mobro-modem module to mrd, creating uplinks using libmobro and maintaining a default route over the modem with the best connection.
libmobro modems now export the mobile network time connected to, and mobro-modem feeds that time to the mrd system-time module to apply it to the system.
Add a virtual modem test device, and a framework to inject and control virtual modem instances in libmobro based applications. The pytestenv integration allows a test to freely manipulate simulated modems, to test any software stack building upon libmobro.
Extend libeqmi by PIN and Voice call management and expose these functions through libmobro. An enhanced QMI protocol parser and generator makes the whole libeqmi codebase more readable and simpler to extend.
The new carapush tool for CAR-A-WANs pushes device, modem and GPS information periodically to a legacy backend service.
The rms_push module implements the same JSON/REST push service as carapush, but uses mrd data sources where appropriate. It can be configured to push information periodically to a dedicated legacy RMS system.
Introduce mrdock, a docker management process acting as PID 1 in the container, spawning mrd and strongSwan for the docker environment. The isa_info and isa_gps modules provide device and GPS information in mrd using a REST service on the docker host.
The new netsched framework implements an interface to the Linux packet scheduling and traffic control framework to manage qdiscs and classes. Currently supported is the HTB qdisc, including jsonification and netmaid support.
Introduce libeqmi, a QMI host side library to control broadband modems using Qualcomm chips.
Introduce libeat, a (yet) trivial AT command helper library to talk with AT based modem control channels.
Introduce a higher level broadband modem library called libmobro. It helps in discovering, configuring, and managing broadband modems up to IP connectivity. Based on libeqmi (and libeat), it currently features a driver for the Huawei ME909-521 USB modem. It relies on libusb for discovering and configuring USB modems.
Implement ipset management using Netlink in libcafli, including JSON encoding of sets and elements. Currently implemented are the hash:ip, hash:net and hash:ip,port IP sets.
Implement Linux conntrack event listening and listing/deleting conntrack entries in the kernel using Netlink.
Implement support for user-defined chains in the libcafli Netfilter backend, and bring support for jsonificating some additional match and target extensions.
Add linda, the MPP Lawful INterception DAemon that implements connection data retention services based on conntrack events.
Add snoopy, the MPP DHCP snooper, sniffing DHCP packets on the system and publishes associated JSON information to an AMQP exchange.
Add netmaid, the MPP NETwork MAnagement Interface Daemon that exposes the powerful libcafli network configuration stack using a generic JSON interface.
Add support for JSON encoding Netfilter rules with a limited set of matches and targets.
Add a nfjson utility to save and restore Netfilter rules very similar to iptables-save/restore, but using our JSON rule encoding.
The new firewall mrd module that applies a backend-provided Netfilter configuration in JSON to both the IPv4 and the IPv6 Netfilter ruleset.
Add an addrcfg, a routecfg and a routing rulecfg network administration API similar to the previously added linkcfg interface.
Add a netmon utility that demonstrates and tests the use of the networking administration interfaces.
Add a new arp-proxy module responding to ARP queries for a specified set of addresses.
Implement a low-level Netlink communication interface to provide a common base for all Netlink-related configuration needs.
Add a new link-stats module collecting network interface statistics, providing them to the uploader module.
Add a low-level Netfilter API to manage Netfilter rules.
Fixed the file-config module to properly update remotely changed files during the non-initial run.
The new pki module fetches pki credentials from the backend and provides it to other modules.
The new strongswan module configures strongSwan over vici using credentials provided by the pki module, and tunnel and shunt configurations provided in the module config. It periodically checks the tunnels and re-establishes them when needed.
gpsd-client supports a proxy mode to serve raw NMEA streams to clients connecting to a port.
The rebooter module listens for configuration update events raised by other modules, a triggers a system reboot based on its module configuration after all updates have completed.
The mrd –stop option now waits for the stopped client to exit, and forwards its exit code to catch any address sanitizer errors in integration tests.
The new uploader module implements configurable multi-queue data uploading with caching during network outages.
Add a gpsd-client module registering to a gpsd JSON interface. Collects GPS measurement data and provides it to other modules, such as the uploader.
The two modules cpu-usage and mem-usage provide system wide usages statistics and make them available to the uploader.
Migrated all integration tests to Python using pytestenv. Add RPyC remote procedure call support including splitbrain to test hosts for simplified scripting.
Refactored bootstrapping and configuration management to work in offline environments and periodically check for bootstrap and configuration changes.
Introduce an error tracing framework to get better error reports using exception-like traces.
Include our root CA and use the https:// secured gep.wlp.is global entry point.
Introduce JSON payloads for RESTful communication with the backend. All existing controllers have been migrated to JSON using the jansson JSON library.
Add a ospf_peering module establishing Ethernet Point-to-Point link peer relationships using OSPFv2 Hello packets.
Put some love in the file_config controller: Fix some issues with incomplete file downloads, reduce CPU usage by comparing file mtimes and add support for distributing symlinks.
Add basic support for IPmotion devices.
Introduce a md_doc_pytestenv using language bindings for libtestenv. This allows the dynamic creation of virtual network test environments with many hosts.
Add a readsim tool to extract basic modem/SIM card information using Hayes AT commands, uploading the result using JSON over REST.
A prototype RMS testing server has been added based on a Java Spring Boot application, used for integration testing.
Devices identify themself using a Manufacturer/Model/Serial triple against the backend service.
A bootstrap procedure fetches backend URL and other configuration options during startup.
The new liveness controller periodically reports device liveness to backend.
A new nm_image controller checks for new NetModule software image versions and performs updates.
The cspawn tool exports the container functionality to a user application for performance and reliability testing.