- IPFire-3.x
- Update from version 8.0.1184-3 to 9.0.1916-1
- Patches directory removed as the patch that was in there has now been included
into the vim tarball
- Changelog is the github commits at
https://github.com/vim/vim/commits/master
Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org>
---
vim/patches/vim-8.0-rhbz1365258.patch | 12 ------------
vim/vim.nm | 6 +++---
2 files changed, 3 insertions(+), 15 deletions(-)
delete mode 100644 vim/patches/vim-8.0-rhbz1365258.patch
diff --git a/vim/patches/vim-8.0-rhbz1365258.patch b/vim/patches/vim-8.0-rhbz1365258.patch
deleted file mode 100644
index 85498dba2..000000000
--- a/vim/patches/vim-8.0-rhbz1365258.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -up vim80/runtime/syntax/fstab.vim.1365258 vim80/runtime/syntax/fstab.vim
---- vim80/runtime/syntax/fstab.vim.1365258 2016-12-15 10:56:25.822410344 +0100
-+++ vim80/runtime/syntax/fstab.vim 2016-12-15 10:56:52.161519612 +0100
-@@ -36,6 +36,8 @@ syn match fsOperator /[,=:#]/
- syn cluster fsDeviceCluster contains=fsOperator,fsDeviceKeyword,fsDeviceError
- syn match fsDeviceError /\%([^a-zA-Z0-9_\/#@:\.-]\|^\w\{-}\ze\W\)/ contained
- syn keyword fsDeviceKeyword contained none proc linproc tmpfs devpts devtmpfs sysfs usbfs
-+syn keyword fsDeviceKeyword contained PARTLABEL nextgroup=fsDeviceLabel
-+syn keyword fsDeviceKeyword contained PARTUUID nextgroup=fsDeviceUUID
- syn keyword fsDeviceKeyword contained LABEL nextgroup=fsDeviceLabel
- syn keyword fsDeviceKeyword contained UUID nextgroup=fsDeviceUUID
- syn keyword fsDeviceKeyword contained sshfs nextgroup=fsDeviceSshfs
diff --git a/vim/vim.nm b/vim/vim.nm
index 71596efb7..2001bb322 100644
--- a/vim/vim.nm
+++ b/vim/vim.nm
@@ -4,11 +4,11 @@
###############################################################################
name = vim
-major_ver = 8
+major_ver = 9
minor_ver = 0
-patchlevel = 1184
+patchlevel = 1916
version = %{major_ver}.%{minor_ver}.%{patchlevel}
-release = 3
+release = 1
groups = Applications/Editors
url = http://www.vim.org
--
2.42.0
1
0
- IPFire-3.x
- Update from version 5.2.8 to 5.4.4
- Changelog is too large to include here. Details can be found at
https://github.com/tukaani-project/xz/releases
Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org>
---
xz/xz.nm | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/xz/xz.nm b/xz/xz.nm
index 196fee902..b10590293 100644
--- a/xz/xz.nm
+++ b/xz/xz.nm
@@ -4,7 +4,7 @@
###############################################################################
name = xz
-version = 5.2.8
+version = 5.4.4
release = 1
groups = Applications/Compression
--
2.42.0
2
1
As there is not a new release we apply 300 something patches.
Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org>
---
network/network.nm | 5 +-
.../patches/0001-Bump-version-to-011.patch | 26 +
...Check-input-and-return-useful-errors.patch | 144 ++
.../0003-bridge-Fix-assertion-for-MTU.patch | 32 +
...rder-functions-into-the-common-order.patch | 127 ++
.../0005-bridge-Set-proper-defaults.patch | 78 +
...rder-arguments-in-alphabetical-order.patch | 46 +
...ge-Add-option-to-missing-stp-max-age.patch | 33 +
.../patches/0008-Remove-unused-function.patch | 29 +
...ding-Validate-any-MAC-address-passed.patch | 33 +
...-ip-tunnel-Set-TTL-to-255-by-default.patch | 34 +
...-Add-some-generic-configuration-file.patch | 107 ++
...c-routes-instead-of-doing-that-manua.patch | 146 ++
...-configuration-when-network-is-initi.patch | 28 +
.../0014-dns-Always-enable-EDNS0.patch | 32 +
...automatic-channel-selection-ACS-by-d.patch | 27 +
...llow-to-disable-DFS-in-configuration.patch | 102 ++
...DFS-automatically-when-not-supported.patch | 99 +
...-ap-Add-CLI-to-set-channel-bandwidth.patch | 87 +
...ot-to-add-configuration-variables-to.patch | 29 +
...y-channel-bandwidth-to-configuration.patch | 109 ++
...s-ap-Enable-ACS-only-for-ath-devices.patch | 117 ++
...w-setting-the-wireless-environment-i.patch | 164 ++
...3-hostapd-Remove-now-useless-comment.patch | 26 +
...Always-enable-Transmit-Power-Control.patch | 30 +
...025-hostapd-Set-default-WMM-settings.patch | 72 +
...-Kick-stations-that-are-too-far-away.patch | 27 +
.../0027-hostapd-Always-qoute-SSID.patch | 34 +
...w-to-enable-disable-802.11w-Manageme.patch | 130 ++
...network-Show-when-a-PHY-supports-ACS.patch | 26 +
...i_device_status_phy-to-functions.phy.patch | 112 ++
...stapd-Dump-config-file-in-debug-mode.patch | 52 +
...matically-enable-all-supported-ciphe.patch | 519 ++++++
...nable-WPA-authentication-with-SHA256.patch | 26 +
...ally-set-defaults-for-all-port-hooks.patch | 98 +
...oks-Import-zone-default-settings-too.patch | 176 ++
...-Convert-HOOK_SETTINGS-into-an-array.patch | 628 +++++++
.../0037-settings-Some-code-refactoring.patch | 133 ++
...38-ports-Drop-HOOK_SETTINGS-variable.patch | 239 +++
...multiple-copies-of-the-same-function.patch | 162 ++
...0-wireless-ap-Remove-support-for-WPA.patch | 58 +
...dd-support-for-WPA3-and-rewrite-WPA2.patch | 280 +++
...-hotplug-rename-Drop-unused-variable.patch | 27 +
...WPA2-authentication-only-with-SHA256.patch | 29 +
...ireless-ap-Enable-802.11w-by-default.patch | 31 +
...t_bool-convenience-function-where-ev.patch | 100 +
...OOK_CONFIG_SETTINGS-to-HOOK_SETTINGS.patch | 196 ++
...nabled-from-configuration-parameters.patch | 99 +
...dhcp-Fix-syntax-error-in-last-commit.patch | 30 +
...NIQUE-which-stops-us-from-creating-m.patch | 158 ++
...k-that-secret-has-the-correct-length.patch | 105 ++
.../0051-Drop-old-locking-functions.patch | 235 +++
...nnel-Enable-support-for-6in4-tunnels.patch | 26 +
.../0053-lock-Cleanup-lock-files.patch | 37 +
...quire-MFP-for-SAE-when-it-is-enabled.patch | 45 +
...6-router-advertisement-configuration.patch | 117 ++
.../patches/0056-Drop-code-for-radvd.patch | 314 ++++
...57-.gitignore-Ignore-vim-s-swp-files.patch | 25 +
...ke-sure-the-daemon-is-always-running.patch | 73 +
.../0059-configure-Require-asciidoc.patch | 28 +
.../0060-man-Add-test-page-for-asciidoc.patch | 94 +
...idoc-to-generate-HTML-pages-directly.patch | 86 +
...-man-Add-asciidoc-configuration-file.patch | 62 +
...t-network-8-from-docbook-to-asciidoc.patch | 503 +++++
...-Convert-network-color-8-to-asciidoc.patch | 152 ++
network/patches/0065-man-Drop-test-page.patch | 44 +
.../0066-man-network-color-Add-synopsis.patch | 32 +
...onvert-firewall-settings-to-asciidoc.patch | 409 +++++
...rt-network-description-8-to-asciidoc.patch | 144 ++
...Convert-network-device-8-to-asciidoc.patch | 254 +++
...n-Convert-network-dhcp-8-to-asciidoc.patch | 217 +++
...ert-network-dns-server-8-to-asciidoc.patch | 306 ++++
...ork-performance-tuning-8-to-asciidoc.patch | 135 ++
...n-Convert-network-port-8-to-asciidoc.patch | 370 ++++
...ng-network-quick-start-8-to-asciidoc.patch | 275 +++
...5-man-Use-include-for-color-commands.patch | 55 +
...an-Drop-old-network-color-8-man-page.patch | 72 +
.../patches/0077-man-Fix-page-headers.patch | 38 +
...-Convert-network-route-8-to-asciidoc.patch | 157 ++
.../0079-.gitignore-Ignore-DS_Store.patch | 26 +
...t-network-route-static-8-to-asciidoc.patch | 280 +++
...nvert-network-settings-8-to-asciidoc.patch | 190 ++
...an-Convert-network-vpn-8-to-asciidoc.patch | 135 ++
...ork-vpn-security-policies-8-to-ascii.patch | 453 +++++
...n-Convert-network-zone-8-to-asciidoc.patch | 375 ++++
...rt-network-zone-bridge-8-to-asciidoc.patch | 255 +++
...ork-zone-config-pppoe-server-8-to-as.patch | 222 +++
...network-zone-ip-tunnel-8-to-asciidoc.patch | 184 ++
...ert-network-zone-modem-8-to-asciidoc.patch | 329 ++++
...ert-network-zone-pppoe-8-to-asciidoc.patch | 266 +++
...-network-zone-wireless-8-to-asciidoc.patch | 167 ++
.../patches/0091-man-Cleanup-XML-files.patch | 43 +
.../0092-man-Make-distcheck-happy.patch | 54 +
...man-Include-include-files-in-tarball.patch | 28 +
...94-man-network-route-static-Fix-name.patch | 26 +
...-Add-target-to-upload-HTML-man-pages.patch | 28 +
...ate-HTML-documentation-in-normal-bui.patch | 29 +
.../0097-man-Fix-authorship-warnings.patch | 205 +++
...tax-format-more-similar-across-files.patch | 583 ++++++
...itable-function-to-determine-the-por.patch | 53 +
...t-hook-to-use-parse_cmdline-function.patch | 76 +
...-Validate-and-always-set-MAC-address.patch | 42 +
...nknown-command-line-parameters-are-b.patch | 29 +
...-Rename-PARENT_DEVICE-to-PARENT_PORT.patch | 102 ++
...rent-device-exists-before-bringing-i.patch | 35 +
.../0105-vlan-Simplify-vlan_remove.patch | 32 +
.../0106-vlan-Refactor-vlan_create.patch | 146 ++
...lan-Create-partent-port-if-necessary.patch | 30 +
.../0108-vlan-Drop-ebtables-stuff.patch | 49 +
.../patches/0109-vlan-Rename-tag-to-id.patch | 159 ++
network/patches/0110-vlan-Validate-ID.patch | 110 ++
...hich-will-stop-the-program-immediate.patch | 48 +
...12-vlan-Add-support-for-802.1ad-QinQ.patch | 139 ++
...ry-to-start-Bird-during-boot-process.patch | 57 +
...-Break-when-asciidoc-cannot-be-found.patch | 27 +
.../0115-Fix-creating-new-configs.patch | 29 +
.../0116-inetcalc-Fix-compiler-warnings.patch | 30 +
...p-separate-scripts-for-IPv6-and-IPv4.patch | 70 +
...stemd-Remove-double-firewall-scripts.patch | 76 +
...ewall-Add-init-action-to-main-script.patch | 54 +
...ll-Drop-initialisation-helper-script.patch | 79 +
...ert-firewall-Disable-PMTU-by-default.patch | 28 +
...irewall-Fix-reading-writing-settings.patch | 147 ++
...rewall-config-command-in-favour-of-f.patch | 80 +
...attempt-DFS-when-reg-domain-is-set-t.patch | 30 +
...ce-when-needed-and-not-already-runni.patch | 42 +
...unnel-Support-setting-MTU-on-tunnels.patch | 60 +
...firewall-Fix-generating-systemd-file.patch | 33 +
...8-Make-generating-man-pages-optional.patch | 69 +
...-Add-documentation-for-the-IPsec-VPN.patch | 135 ++
...130-Makefile-Add-network-vpn-ipsec-8.patch | 25 +
...icies-performance-Remove-CBC-ciphers.patch | 23 +
.../0132-IPsec-Add-support-for-Curve448.patch | 65 +
network/patches/0133-Disable-copybreak.patch | 112 ++
.../0134-configure-Check-for-libsystemd.patch | 25 +
...akefile-Add-scaffolding-for-networkd.patch | 93 +
.../0136-networkd-Link-against-systemd.patch | 34 +
...Tell-systemd-about-the-daemon-status.patch | 47 +
...etworkd-Create-a-simple-daemon-class.patch | 170 ++
.../0139-networkd-Create-an-event-loop.patch | 147 ++
...networkd-Enable-the-service-watchdog.patch | 31 +
...etworkd-Add-some-very-simple-logging.patch | 104 ++
...workd-Register-SIGTERM-SIGINT-SIGHUP.patch | 90 +
...Add-scaffolding-to-reload-the-daemon.patch | 93 +
...-system-extensions-to-define-_GNU_SO.patch | 27 +
...d-Add-scaffolding-to-connect-to-dbus.patch | 255 +++
...d-Add-scaffolding-for-config-objects.patch | 131 ++
...ffolding-to-read-configuration-files.patch | 94 +
...plement-setting-configuration-values.patch | 283 +++
...plement-reading-configuration-values.patch | 55 +
...mplement-writing-configuration-files.patch | 79 +
...etworkd-Read-main-configuration-file.patch | 54 +
...onfiguration-path-from-build-scripts.patch | 41 +
...3-networkd-Add-scaffolding-for-zones.patch | 192 ++
...networkd-Install-a-dbus-service-file.patch | 82 +
.../0155-networkd-Install-a-dbus-policy.patch | 87 +
...onfigure-Tidy-up-dbus-path-detection.patch | 53 +
...on-sensical-CFLAGS-and-add-more-warn.patch | 77 +
...ork-Fix-prototype-of-network_version.patch | 26 +
...stemd-notifications-into-daemon-obje.patch | 104 ++
...Fix-incorrect-name-on-IPsec-man-page.patch | 45 +
...Install-some-simple-PolicyKit-policy.patch | 94 +
...nction-when-we-are-connected-to-dbus.patch | 51 +
...workd-Install-a-systemd-service-file.patch | 116 ++
...lly-implement-bus-handler-for-Reload.patch | 32 +
...d-Asynchronously-register-to-the-bus.patch | 28 +
...Split-flushing-all-entries-into-a-fu.patch | 71 +
...config-read-functions-to-not-create-.patch | 70 +
...he-path-with-the-configuration-objec.patch | 200 ++
...ry-to-read-configuration-automatical.patch | 137 ++
...kd-Read-all-zones-from-configuration.patch | 201 ++
...ate-a-unified-function-to-register-a.patch | 128 ++
...a-dummy-bus-implementation-for-zones.patch | 99 +
...emon-to-all-functions-called-by-the-.patch | 66 +
...kd-Move-zone-list-into-an-own-object.patch | 493 +++++
...plement-enumerating-zones-on-the-bus.patch | 238 +++
...zone-when-it-is-being-accessed-by-it.patch | 159 ++
...aemon-bus-implementation-into-a-sepa.patch | 175 ++
...d-a-test-bus-property-to-set-the-MTU.patch | 201 ++
.../0179-networkd-Connect-to-udev.patch | 203 +++
...-to-a-non-privileged-user-right-away.patch | 105 ++
...l-capabilities-except-a-few-we-would.patch | 195 ++
...ct-to-the-kernel-s-netlink-interface.patch | 95 +
...183-networkd-Link-against-libnetwork.patch | 25 +
.../0184-networkd-Add-a-link-object.patch | 145 ++
...5-networkd-Add-a-container-for-links.patch | 303 +++
...workd-Enumerate-all-links-on-startup.patch | 172 ++
...ate-a-link-object-for-each-interface.patch | 362 ++++
...workd-Only-add-link-if-we-created-it.patch | 38 +
.../0189-networkd-Import-interface-name.patch | 106 ++
.../patches/0190-networkd-Read-link-MTU.patch | 96 +
...Actually-return-entry-instead-of-fre.patch | 27 +
...Implement-reading-configuration-file.patch | 139 ++
...3-networkd-Add-scaffolding-for-ports.patch | 159 ++
.../0194-networkd-Add-port-container.patch | 240 +++
...-networkd-Enumerate-ports-on-startup.patch | 247 +++
...erform-port-setup-from-configuration.patch | 147 ++
...-Ethernet-address-from-configuration.patch | 145 ++
...e-a-random-Ethernet-address-for-port.patch | 93 +
...ce-address-flags-for-better-readabil.patch | 43 +
...f-Ethernet-addresses-from-config-are.patch | 46 +
...0201-networkd-Export-ports-over-dbus.patch | 347 ++++
...-Fix-buffer-to-Ethernet-address-stri.patch | 27 +
...ts-Export-Ethernet-address-over-dbus.patch | 102 ++
...hod-to-fetch-corresponding-link-to-p.patch | 201 ++
...e-typedef-to-keep-type-names-shorter.patch | 1617 +++++++++++++++++
...re-a-reference-to-the-daemon-in-zone.patch | 180 ++
...-networkd-Refactor-enumerating-zones.patch | 231 +++
...-configuration-when-the-daemon-exits.patch | 239 +++
.../0209-networkd-Store-any-flags.patch | 69 +
.../0210-networkd-Store-operstate-too.patch | 59 +
...ction-to-check-whether-a-link-has-a-.patch | 96 +
...hods-to-check-zones-ports-for-carrie.patch | 92 +
.../0213-networkd-Log-to-journald.patch | 137 ++
...-networkd-Install-in-usr-lib-network.patch | 49 +
...5-networkctl-Create-some-scaffolding.patch | 94 +
...networkctl-Connect-to-the-system-bus.patch | 45 +
...-Add-some-help-and-version-arguments.patch | 94 +
...Implement-a-basic-command-dispatcher.patch | 172 ++
...orkd-Implement-ListZones-bus-command.patch | 169 ++
...tworkctl-Implement-zone-list-command.patch | 188 ++
...1-networkd-Fix-finding-links-by-name.patch | 56 +
...-Keep-a-permanent-reference-to-links.patch | 81 +
...-Keep-a-permanent-reference-to-links.patch | 89 +
...Add-functions-to-handle-boolean-valu.patch | 63 +
...reconfigure-all-ports-and-zones-on-s.patch | 210 +++
...26-networkd-Implement-deleting-links.patch | 147 ++
...ically-reference-dereference-links-t.patch | 368 ++++
...reate-dummy-function-to-create-links.patch | 46 +
...mon-Correctly-store-reference-to-bus.patch | 157 ++
...-stats-regulary-and-emit-them-on-dbu.patch | 667 +++++++
...ut-buffer-size-when-formatting-MAC-a.patch | 27 +
...-if-there-is-garbage-after-intergers.patch | 42 +
...oid-adding-empty-line-after-integers.patch | 26 +
...-Require-type-to-be-set-at-all-times.patch | 133 ++
...lement-reading-writing-VLAN-settings.patch | 287 +++
...36-ports-Implement-destroying-a-port.patch | 193 ++
...te-scaffolding-for-operations-struct.patch | 156 ++
...ts-Move-VLAN-stuff-into-its-own-file.patch | 591 ++++++
...-Implement-creating-links-from-ports.patch | 294 +++
...-ops-struct-as-we-will-need-to-store.patch | 219 +++
...ts-Implement-listing-ports-over-DBus.patch | 256 +++
...n-code-handling-when-listing-ports-z.patch | 56 +
...ect-to-come-back-after-creating-link.patch | 32 +
...nfigure-MAC-address-when-creating-li.patch | 34 +
...rts-Show-message-when-creating-ports.patch | 26 +
.../0246-ports-Constify-info-struct.patch | 80 +
...we-created-a-random-Ethernet-address.patch | 50 +
...-the-most-basic-supports-for-bonding.patch | 309 ++++
...AN-settings-into-its-own-header-file.patch | 64 +
...tworkctl-Fix-typo-in-bus-method-name.patch | 26 +
...a-function-the-generally-fetches-the.patch | 163 ++
...ompare-truthiness-case-insensitively.patch | 26 +
.../0253-configure-Depend-on-JSON-C.patch | 46 +
...thod-to-export-port-information-as-J.patch | 302 +++
...0255-networkctl-Fix-parsing-commands.patch | 52 +
...ment-dump-command-for-ports-which-sh.patch | 94 +
...s-to-easily-define-string-table-look.patch | 70 +
...s-VLAN-Implement-choosing-a-protocol.patch | 156 ++
...e-parser-to-easier-read-write-config.patch | 716 ++++++++
...bonding-Convert-mode-to-string-table.patch | 93 +
...ta-to-value-as-it-holds-a-reference-.patch | 221 +++
...config-Add-data-pointer-to-callbacks.patch | 255 +++
...Define-an-own-type-for-string-tables.patch | 75 +
...t-option-that-looks-up-string-tables.patch | 184 ++
.../0265-ports-Store-the-parent-name.patch | 32 +
...ts-VLAN-Make-all-constants-uppercase.patch | 49 +
network/patches/0267-ports-Unify-type.patch | 440 +++++
...s-Move-VLAN-constants-to-VLAN-header.patch | 46 +
.../0269-ports-Drop-UNKNOWN-type.patch | 48 +
...lement-scaffolding-for-configuration.patch | 74 +
...71-ports-VLAN-Validate-configuration.patch | 53 +
...rash-when-a-port-could-not-be-loaded.patch | 40 +
...functions-return-negative-values-on-.patch | 33 +
...etworkd-Parse-command-line-arguments.patch | 132 ++
...nfig-directory-and-keep-a-handle-to-.patch | 163 ++
...old-a-file-descriptor-instead-of-DIR.patch | 99 +
...tworkd-Add-a-simple-test-environment.patch | 197 ++
...nk-to-show-the-status-of-the-environ.patch | 48 +
...minate-after-showing-help-or-version.patch | 64 +
...ient-if-networkd-does-not-want-to-te.patch | 84 +
...etworkd-as-root-in-its-own-namespace.patch | 26 +
...282-ports-Refactor-enumerating-ports.patch | 636 +++++++
...st-that-creates-two-dummy-interfaces.patch | 67 +
...84-tests-Always-dump-the-environment.patch | 47 +
...re-information-from-test-environment.patch | 26 +
...ts-bonding-Use-correct-enum-for-mode.patch | 38 +
.../0287-networkd-json-Include-string.h.patch | 25 +
.../0288-ports-Add-support-for-VETH.patch | 228 +++
.../0289-config-Add-string-buffer-type.patch | 264 +++
.../0290-networkctl-Add-color-functions.patch | 176 ++
...l-Move-describe-into-an-own-function.patch | 106 ++
...-Implement-scaffolding-to-show-ports.patch | 145 ++
...-ports-Add-link-stuff-to-JSON-output.patch | 82 +
...link-Add-device-stuff-to-JSON-output.patch | 185 ++
...lding-for-physical-Ethernet-interfac.patch | 246 +++
.../0296-logging-Add-WARNING-log-level.patch | 25 +
...etworkd-Handle-any-uevents-for-links.patch | 148 ++
...e-udev-device-when-links-are-created.patch | 83 +
...p-uevent-when-the-device-is-renaming.patch | 60 +
...nt-smarter-handling-of-the-configura.patch | 951 ++++++++++
...ones-Move-struct-nw_zone-into-header.patch | 115 ++
...Drop-unused-configuration-file-paths.patch | 40 +
network/patches/0303-util-Drop-nw_ftw.patch | 77 +
...4-Makefile-Fix-typo-in-localstatedir.patch | 26 +
network/patches/network-fix-logdir-path.patch | 23 -
306 files changed, 40819 insertions(+), 24 deletions(-)
create mode 100644 network/patches/0001-Bump-version-to-011.patch
create mode 100644 network/patches/0002-bridge-Check-input-and-return-useful-errors.patch
create mode 100644 network/patches/0003-bridge-Fix-assertion-for-MTU.patch
create mode 100644 network/patches/0004-bridge-Reorder-functions-into-the-common-order.patch
create mode 100644 network/patches/0005-bridge-Set-proper-defaults.patch
create mode 100644 network/patches/0006-bridge-Order-arguments-in-alphabetical-order.patch
create mode 100644 network/patches/0007-bridge-Add-option-to-missing-stp-max-age.patch
create mode 100644 network/patches/0008-Remove-unused-function.patch
create mode 100644 network/patches/0009-bonding-Validate-any-MAC-address-passed.patch
create mode 100644 network/patches/0010-ip-tunnel-Set-TTL-to-255-by-default.patch
create mode 100644 network/patches/0011-bird-Add-some-generic-configuration-file.patch
create mode 100644 network/patches/0012-bird-Apply-static-routes-instead-of-doing-that-manua.patch
create mode 100644 network/patches/0013-bird-Re-generate-configuration-when-network-is-initi.patch
create mode 100644 network/patches/0014-dns-Always-enable-EDNS0.patch
create mode 100644 network/patches/0015-wireless-ap-Use-automatic-channel-selection-ACS-by-d.patch
create mode 100644 network/patches/0016-wireless-ap-Allow-to-disable-DFS-in-configuration.patch
create mode 100644 network/patches/0017-hostapd-Disable-DFS-automatically-when-not-supported.patch
create mode 100644 network/patches/0018-wireless-ap-Add-CLI-to-set-channel-bandwidth.patch
create mode 100644 network/patches/0019-wireless-ap-Forgot-to-add-configuration-variables-to.patch
create mode 100644 network/patches/0020-hostapd-Apply-channel-bandwidth-to-configuration.patch
create mode 100644 network/patches/0021-wireless-ap-Enable-ACS-only-for-ath-devices.patch
create mode 100644 network/patches/0022-wireless-ap-Allow-setting-the-wireless-environment-i.patch
create mode 100644 network/patches/0023-hostapd-Remove-now-useless-comment.patch
create mode 100644 network/patches/0024-hostapd-Always-enable-Transmit-Power-Control.patch
create mode 100644 network/patches/0025-hostapd-Set-default-WMM-settings.patch
create mode 100644 network/patches/0026-hostapd-Kick-stations-that-are-too-far-away.patch
create mode 100644 network/patches/0027-hostapd-Always-qoute-SSID.patch
create mode 100644 network/patches/0028-wireless-ap-Allow-to-enable-disable-802.11w-Manageme.patch
create mode 100644 network/patches/0029-network-Show-when-a-PHY-supports-ACS.patch
create mode 100644 network/patches/0030-Move-cli_device_status_phy-to-functions.phy.patch
create mode 100644 network/patches/0031-hostapd-Dump-config-file-in-debug-mode.patch
create mode 100644 network/patches/0032-wireless-ap-Automatically-enable-all-supported-ciphe.patch
create mode 100644 network/patches/0033-hostapd-Enable-WPA-authentication-with-SHA256.patch
create mode 100644 network/patches/0034-hooks-Automatically-set-defaults-for-all-port-hooks.patch
create mode 100644 network/patches/0035-hooks-Import-zone-default-settings-too.patch
create mode 100644 network/patches/0036-Convert-HOOK_SETTINGS-into-an-array.patch
create mode 100644 network/patches/0037-settings-Some-code-refactoring.patch
create mode 100644 network/patches/0038-ports-Drop-HOOK_SETTINGS-variable.patch
create mode 100644 network/patches/0039-hotplug-Remove-multiple-copies-of-the-same-function.patch
create mode 100644 network/patches/0040-wireless-ap-Remove-support-for-WPA.patch
create mode 100644 network/patches/0041-wireless-ap-Add-support-for-WPA3-and-rewrite-WPA2.patch
create mode 100644 network/patches/0042-hotplug-rename-Drop-unused-variable.patch
create mode 100644 network/patches/0043-hostapd-Allow-WPA2-authentication-only-with-SHA256.patch
create mode 100644 network/patches/0044-wireless-ap-Enable-802.11w-by-default.patch
create mode 100644 network/patches/0045-hooks-Use-cli_get_bool-convenience-function-where-ev.patch
create mode 100644 network/patches/0046-hook-Rename-HOOK_CONFIG_SETTINGS-to-HOOK_SETTINGS.patch
create mode 100644 network/patches/0047-dhcp-Rename-enabled-from-configuration-parameters.patch
create mode 100644 network/patches/0048-dhcp-Fix-syntax-error-in-last-commit.patch
create mode 100644 network/patches/0049-hooks-Add-HOOK_UNIQUE-which-stops-us-from-creating-m.patch
create mode 100644 network/patches/0050-wireless-ap-Check-that-secret-has-the-correct-length.patch
create mode 100644 network/patches/0051-Drop-old-locking-functions.patch
create mode 100644 network/patches/0052-ip-tunnel-Enable-support-for-6in4-tunnels.patch
create mode 100644 network/patches/0053-lock-Cleanup-lock-files.patch
create mode 100644 network/patches/0054-hostapd-Require-MFP-for-SAE-when-it-is-enabled.patch
create mode 100644 network/patches/0055-bird-Write-IPv6-router-advertisement-configuration.patch
create mode 100644 network/patches/0056-Drop-code-for-radvd.patch
create mode 100644 network/patches/0057-.gitignore-Ignore-vim-s-swp-files.patch
create mode 100644 network/patches/0058-bird-Make-sure-the-daemon-is-always-running.patch
create mode 100644 network/patches/0059-configure-Require-asciidoc.patch
create mode 100644 network/patches/0060-man-Add-test-page-for-asciidoc.patch
create mode 100644 network/patches/0061-man-Use-asciidoc-to-generate-HTML-pages-directly.patch
create mode 100644 network/patches/0062-man-Add-asciidoc-configuration-file.patch
create mode 100644 network/patches/0063-man-Convert-network-8-from-docbook-to-asciidoc.patch
create mode 100644 network/patches/0064-man-Convert-network-color-8-to-asciidoc.patch
create mode 100644 network/patches/0065-man-Drop-test-page.patch
create mode 100644 network/patches/0066-man-network-color-Add-synopsis.patch
create mode 100644 network/patches/0067-man-Convert-firewall-settings-to-asciidoc.patch
create mode 100644 network/patches/0068-man-Convert-network-description-8-to-asciidoc.patch
create mode 100644 network/patches/0069-man-Convert-network-device-8-to-asciidoc.patch
create mode 100644 network/patches/0070-man-Convert-network-dhcp-8-to-asciidoc.patch
create mode 100644 network/patches/0071-man-Convert-network-dns-server-8-to-asciidoc.patch
create mode 100644 network/patches/0072-man-Convert-network-performance-tuning-8-to-asciidoc.patch
create mode 100644 network/patches/0073-man-Convert-network-port-8-to-asciidoc.patch
create mode 100644 network/patches/0074-man-Converting-network-quick-start-8-to-asciidoc.patch
create mode 100644 network/patches/0075-man-Use-include-for-color-commands.patch
create mode 100644 network/patches/0076-man-Drop-old-network-color-8-man-page.patch
create mode 100644 network/patches/0077-man-Fix-page-headers.patch
create mode 100644 network/patches/0078-man-Convert-network-route-8-to-asciidoc.patch
create mode 100644 network/patches/0079-.gitignore-Ignore-DS_Store.patch
create mode 100644 network/patches/0080-man-Convert-network-route-static-8-to-asciidoc.patch
create mode 100644 network/patches/0081-man-Convert-network-settings-8-to-asciidoc.patch
create mode 100644 network/patches/0082-man-Convert-network-vpn-8-to-asciidoc.patch
create mode 100644 network/patches/0083-man-Convert-network-vpn-security-policies-8-to-ascii.patch
create mode 100644 network/patches/0084-man-Convert-network-zone-8-to-asciidoc.patch
create mode 100644 network/patches/0085-man-Convert-network-zone-bridge-8-to-asciidoc.patch
create mode 100644 network/patches/0086-man-Convert-network-zone-config-pppoe-server-8-to-as.patch
create mode 100644 network/patches/0087-man-Convert-network-zone-ip-tunnel-8-to-asciidoc.patch
create mode 100644 network/patches/0088-man-Convert-network-zone-modem-8-to-asciidoc.patch
create mode 100644 network/patches/0089-man-Convert-network-zone-pppoe-8-to-asciidoc.patch
create mode 100644 network/patches/0090-man-Convert-network-zone-wireless-8-to-asciidoc.patch
create mode 100644 network/patches/0091-man-Cleanup-XML-files.patch
create mode 100644 network/patches/0092-man-Make-distcheck-happy.patch
create mode 100644 network/patches/0093-man-Include-include-files-in-tarball.patch
create mode 100644 network/patches/0094-man-network-route-static-Fix-name.patch
create mode 100644 network/patches/0095-Makefile-Add-target-to-upload-HTML-man-pages.patch
create mode 100644 network/patches/0096-man-Do-not-generate-HTML-documentation-in-normal-bui.patch
create mode 100644 network/patches/0097-man-Fix-authorship-warnings.patch
create mode 100644 network/patches/0098-man-Make-syntax-format-more-similar-across-files.patch
create mode 100644 network/patches/0099-hooks-Add-overwritable-function-to-determine-the-por.patch
create mode 100644 network/patches/0100-vlan-Convert-hook-to-use-parse_cmdline-function.patch
create mode 100644 network/patches/0101-vlan-Validate-and-always-set-MAC-address.patch
create mode 100644 network/patches/0102-vlan-Fail-when-unknown-command-line-parameters-are-b.patch
create mode 100644 network/patches/0103-vlan-Rename-PARENT_DEVICE-to-PARENT_PORT.patch
create mode 100644 network/patches/0104-vlan-Check-if-parent-device-exists-before-bringing-i.patch
create mode 100644 network/patches/0105-vlan-Simplify-vlan_remove.patch
create mode 100644 network/patches/0106-vlan-Refactor-vlan_create.patch
create mode 100644 network/patches/0107-vlan-Create-partent-port-if-necessary.patch
create mode 100644 network/patches/0108-vlan-Drop-ebtables-stuff.patch
create mode 100644 network/patches/0109-vlan-Rename-tag-to-id.patch
create mode 100644 network/patches/0110-vlan-Validate-ID.patch
create mode 100644 network/patches/0111-util-Add-abort-which-will-stop-the-program-immediate.patch
create mode 100644 network/patches/0112-vlan-Add-support-for-802.1ad-QinQ.patch
create mode 100644 network/patches/0113-Do-not-try-to-start-Bird-during-boot-process.patch
create mode 100644 network/patches/0114-configure-Break-when-asciidoc-cannot-be-found.patch
create mode 100644 network/patches/0115-Fix-creating-new-configs.patch
create mode 100644 network/patches/0116-inetcalc-Fix-compiler-warnings.patch
create mode 100644 network/patches/0117-firewall-Drop-separate-scripts-for-IPv6-and-IPv4.patch
create mode 100644 network/patches/0118-systemd-Remove-double-firewall-scripts.patch
create mode 100644 network/patches/0119-firewall-Add-init-action-to-main-script.patch
create mode 100644 network/patches/0120-firewall-Drop-initialisation-helper-script.patch
create mode 100644 network/patches/0121-Revert-firewall-Disable-PMTU-by-default.patch
create mode 100644 network/patches/0122-firewall-Fix-reading-writing-settings.patch
create mode 100644 network/patches/0123-firewall-Drop-firewall-config-command-in-favour-of-f.patch
create mode 100644 network/patches/0124-wireless-Do-not-attempt-DFS-when-reg-domain-is-set-t.patch
create mode 100644 network/patches/0125-bird-Start-service-when-needed-and-not-already-runni.patch
create mode 100644 network/patches/0126-ip-tunnel-Support-setting-MTU-on-tunnels.patch
create mode 100644 network/patches/0127-firewall-Fix-generating-systemd-file.patch
create mode 100644 network/patches/0128-Make-generating-man-pages-optional.patch
create mode 100644 network/patches/0129-Add-documentation-for-the-IPsec-VPN.patch
create mode 100644 network/patches/0130-Makefile-Add-network-vpn-ipsec-8.patch
create mode 100644 network/patches/0131-security-policies-performance-Remove-CBC-ciphers.patch
create mode 100644 network/patches/0132-IPsec-Add-support-for-Curve448.patch
create mode 100644 network/patches/0133-Disable-copybreak.patch
create mode 100644 network/patches/0134-configure-Check-for-libsystemd.patch
create mode 100644 network/patches/0135-Makefile-Add-scaffolding-for-networkd.patch
create mode 100644 network/patches/0136-networkd-Link-against-systemd.patch
create mode 100644 network/patches/0137-networkd-Tell-systemd-about-the-daemon-status.patch
create mode 100644 network/patches/0138-networkd-Create-a-simple-daemon-class.patch
create mode 100644 network/patches/0139-networkd-Create-an-event-loop.patch
create mode 100644 network/patches/0140-networkd-Enable-the-service-watchdog.patch
create mode 100644 network/patches/0141-networkd-Add-some-very-simple-logging.patch
create mode 100644 network/patches/0142-networkd-Register-SIGTERM-SIGINT-SIGHUP.patch
create mode 100644 network/patches/0143-networkd-Add-scaffolding-to-reload-the-daemon.patch
create mode 100644 network/patches/0144-configure-Enable-system-extensions-to-define-_GNU_SO.patch
create mode 100644 network/patches/0145-networkd-Add-scaffolding-to-connect-to-dbus.patch
create mode 100644 network/patches/0146-networkd-Add-scaffolding-for-config-objects.patch
create mode 100644 network/patches/0147-networkd-Add-scaffolding-to-read-configuration-files.patch
create mode 100644 network/patches/0148-networkd-Implement-setting-configuration-values.patch
create mode 100644 network/patches/0149-networkd-Implement-reading-configuration-values.patch
create mode 100644 network/patches/0150-networkd-Implement-writing-configuration-files.patch
create mode 100644 network/patches/0151-networkd-Read-main-configuration-file.patch
create mode 100644 network/patches/0152-networkd-Set-configuration-path-from-build-scripts.patch
create mode 100644 network/patches/0153-networkd-Add-scaffolding-for-zones.patch
create mode 100644 network/patches/0154-networkd-Install-a-dbus-service-file.patch
create mode 100644 network/patches/0155-networkd-Install-a-dbus-policy.patch
create mode 100644 network/patches/0156-configure-Tidy-up-dbus-path-detection.patch
create mode 100644 network/patches/0157-configure-Drop-non-sensical-CFLAGS-and-add-more-warn.patch
create mode 100644 network/patches/0158-libnetwork-Fix-prototype-of-network_version.patch
create mode 100644 network/patches/0159-networkd-Move-systemd-notifications-into-daemon-obje.patch
create mode 100644 network/patches/0160-man-Fix-incorrect-name-on-IPsec-man-page.patch
create mode 100644 network/patches/0161-networkd-Install-some-simple-PolicyKit-policy.patch
create mode 100644 network/patches/0162-networkd-Call-function-when-we-are-connected-to-dbus.patch
create mode 100644 network/patches/0163-networkd-Install-a-systemd-service-file.patch
create mode 100644 network/patches/0164-networkd-Fully-implement-bus-handler-for-Reload.patch
create mode 100644 network/patches/0165-networkd-Asynchronously-register-to-the-bus.patch
create mode 100644 network/patches/0166-networkd-config-Split-flushing-all-entries-into-a-fu.patch
create mode 100644 network/patches/0167-networkd-Change-config-read-functions-to-not-create-.patch
create mode 100644 network/patches/0168-networkd-Store-the-path-with-the-configuration-objec.patch
create mode 100644 network/patches/0169-networkd-zones-Try-to-read-configuration-automatical.patch
create mode 100644 network/patches/0170-networkd-Read-all-zones-from-configuration.patch
create mode 100644 network/patches/0171-networkd-bus-Create-a-unified-function-to-register-a.patch
create mode 100644 network/patches/0172-networkd-Add-a-dummy-bus-implementation-for-zones.patch
create mode 100644 network/patches/0173-networkd-Pass-daemon-to-all-functions-called-by-the-.patch
create mode 100644 network/patches/0174-networkd-Move-zone-list-into-an-own-object.patch
create mode 100644 network/patches/0175-networkd-Implement-enumerating-zones-on-the-bus.patch
create mode 100644 network/patches/0176-networkd-Return-zone-when-it-is-being-accessed-by-it.patch
create mode 100644 network/patches/0177-networkd-Split-daemon-bus-implementation-into-a-sepa.patch
create mode 100644 network/patches/0178-networkd-Add-a-test-bus-property-to-set-the-MTU.patch
create mode 100644 network/patches/0179-networkd-Connect-to-udev.patch
create mode 100644 network/patches/0180-networkd-Change-to-a-non-privileged-user-right-away.patch
create mode 100644 network/patches/0181-networkd-Drop-all-capabilities-except-a-few-we-would.patch
create mode 100644 network/patches/0182-networkd-Connect-to-the-kernel-s-netlink-interface.patch
create mode 100644 network/patches/0183-networkd-Link-against-libnetwork.patch
create mode 100644 network/patches/0184-networkd-Add-a-link-object.patch
create mode 100644 network/patches/0185-networkd-Add-a-container-for-links.patch
create mode 100644 network/patches/0186-networkd-Enumerate-all-links-on-startup.patch
create mode 100644 network/patches/0187-networkd-Create-a-link-object-for-each-interface.patch
create mode 100644 network/patches/0188-networkd-Only-add-link-if-we-created-it.patch
create mode 100644 network/patches/0189-networkd-Import-interface-name.patch
create mode 100644 network/patches/0190-networkd-Read-link-MTU.patch
create mode 100644 network/patches/0191-networkd-config-Actually-return-entry-instead-of-fre.patch
create mode 100644 network/patches/0192-networkd-config-Implement-reading-configuration-file.patch
create mode 100644 network/patches/0193-networkd-Add-scaffolding-for-ports.patch
create mode 100644 network/patches/0194-networkd-Add-port-container.patch
create mode 100644 network/patches/0195-networkd-Enumerate-ports-on-startup.patch
create mode 100644 network/patches/0196-networkd-Perform-port-setup-from-configuration.patch
create mode 100644 network/patches/0197-networkd-Read-Ethernet-address-from-configuration.patch
create mode 100644 network/patches/0198-networkd-Generate-a-random-Ethernet-address-for-port.patch
create mode 100644 network/patches/0199-networkd-Introduce-address-flags-for-better-readabil.patch
create mode 100644 network/patches/0200-networkd-Check-if-Ethernet-addresses-from-config-are.patch
create mode 100644 network/patches/0201-networkd-Export-ports-over-dbus.patch
create mode 100644 network/patches/0202-networkd-address-Fix-buffer-to-Ethernet-address-stri.patch
create mode 100644 network/patches/0203-networkd-ports-Export-Ethernet-address-over-dbus.patch
create mode 100644 network/patches/0204-networkd-Add-method-to-fetch-corresponding-link-to-p.patch
create mode 100644 network/patches/0205-networkd-Use-typedef-to-keep-type-names-shorter.patch
create mode 100644 network/patches/0206-networkd-Store-a-reference-to-the-daemon-in-zone.patch
create mode 100644 network/patches/0207-networkd-Refactor-enumerating-zones.patch
create mode 100644 network/patches/0208-networkd-Save-configuration-when-the-daemon-exits.patch
create mode 100644 network/patches/0209-networkd-Store-any-flags.patch
create mode 100644 network/patches/0210-networkd-Store-operstate-too.patch
create mode 100644 network/patches/0211-networkd-Add-function-to-check-whether-a-link-has-a-.patch
create mode 100644 network/patches/0212-networkd-Add-methods-to-check-zones-ports-for-carrie.patch
create mode 100644 network/patches/0213-networkd-Log-to-journald.patch
create mode 100644 network/patches/0214-networkd-Install-in-usr-lib-network.patch
create mode 100644 network/patches/0215-networkctl-Create-some-scaffolding.patch
create mode 100644 network/patches/0216-networkctl-Connect-to-the-system-bus.patch
create mode 100644 network/patches/0217-networkctl-Add-some-help-and-version-arguments.patch
create mode 100644 network/patches/0218-networkctl-Implement-a-basic-command-dispatcher.patch
create mode 100644 network/patches/0219-networkd-Implement-ListZones-bus-command.patch
create mode 100644 network/patches/0220-networkctl-Implement-zone-list-command.patch
create mode 100644 network/patches/0221-networkd-Fix-finding-links-by-name.patch
create mode 100644 network/patches/0222-networkd-ports-Keep-a-permanent-reference-to-links.patch
create mode 100644 network/patches/0223-networkd-zones-Keep-a-permanent-reference-to-links.patch
create mode 100644 network/patches/0224-networkd-config-Add-functions-to-handle-boolean-valu.patch
create mode 100644 network/patches/0225-networkd-Try-to-reconfigure-all-ports-and-zones-on-s.patch
create mode 100644 network/patches/0226-networkd-Implement-deleting-links.patch
create mode 100644 network/patches/0227-networkd-Automatically-reference-dereference-links-t.patch
create mode 100644 network/patches/0228-networkd-ports-Create-dummy-function-to-create-links.patch
create mode 100644 network/patches/0229-networkd-daemon-Correctly-store-reference-to-bus.patch
create mode 100644 network/patches/0230-networkd-Collect-stats-regulary-and-emit-them-on-dbu.patch
create mode 100644 network/patches/0231-address-Fix-output-buffer-size-when-formatting-MAC-a.patch
create mode 100644 network/patches/0232-config-Fail-if-there-is-garbage-after-intergers.patch
create mode 100644 network/patches/0233-config-Avoid-adding-empty-line-after-integers.patch
create mode 100644 network/patches/0234-ports-Require-type-to-be-set-at-all-times.patch
create mode 100644 network/patches/0235-port-Implement-reading-writing-VLAN-settings.patch
create mode 100644 network/patches/0236-ports-Implement-destroying-a-port.patch
create mode 100644 network/patches/0237-ports-Create-scaffolding-for-operations-struct.patch
create mode 100644 network/patches/0238-ports-Move-VLAN-stuff-into-its-own-file.patch
create mode 100644 network/patches/0239-ports-Implement-creating-links-from-ports.patch
create mode 100644 network/patches/0240-ports-Rename-the-ops-struct-as-we-will-need-to-store.patch
create mode 100644 network/patches/0241-ports-Implement-listing-ports-over-DBus.patch
create mode 100644 network/patches/0242-daemon-Fix-return-code-handling-when-listing-ports-z.patch
create mode 100644 network/patches/0243-ports-Do-not-expect-to-come-back-after-creating-link.patch
create mode 100644 network/patches/0244-ports-Set-the-configure-MAC-address-when-creating-li.patch
create mode 100644 network/patches/0245-ports-Show-message-when-creating-ports.patch
create mode 100644 network/patches/0246-ports-Constify-info-struct.patch
create mode 100644 network/patches/0247-ports-Log-when-we-created-a-random-Ethernet-address.patch
create mode 100644 network/patches/0248-ports-Add-the-most-basic-supports-for-bonding.patch
create mode 100644 network/patches/0249-ports-Move-VLAN-settings-into-its-own-header-file.patch
create mode 100644 network/patches/0250-networkctl-Fix-typo-in-bus-method-name.patch
create mode 100644 network/patches/0251-ports-Implement-a-function-the-generally-fetches-the.patch
create mode 100644 network/patches/0252-config-Compare-truthiness-case-insensitively.patch
create mode 100644 network/patches/0253-configure-Depend-on-JSON-C.patch
create mode 100644 network/patches/0254-ports-Add-bus-method-to-export-port-information-as-J.patch
create mode 100644 network/patches/0255-networkctl-Fix-parsing-commands.patch
create mode 100644 network/patches/0256-networkctl-Implement-dump-command-for-ports-which-sh.patch
create mode 100644 network/patches/0257-string-Add-macros-to-easily-define-string-table-look.patch
create mode 100644 network/patches/0258-ports-VLAN-Implement-choosing-a-protocol.patch
create mode 100644 network/patches/0259-config-Extend-the-parser-to-easier-read-write-config.patch
create mode 100644 network/patches/0260-ports-bonding-Convert-mode-to-string-table.patch
create mode 100644 network/patches/0261-config-Rename-data-to-value-as-it-holds-a-reference-.patch
create mode 100644 network/patches/0262-config-Add-data-pointer-to-callbacks.patch
create mode 100644 network/patches/0263-string-Define-an-own-type-for-string-tables.patch
create mode 100644 network/patches/0264-config-Implement-option-that-looks-up-string-tables.patch
create mode 100644 network/patches/0265-ports-Store-the-parent-name.patch
create mode 100644 network/patches/0266-ports-VLAN-Make-all-constants-uppercase.patch
create mode 100644 network/patches/0267-ports-Unify-type.patch
create mode 100644 network/patches/0268-ports-Move-VLAN-constants-to-VLAN-header.patch
create mode 100644 network/patches/0269-ports-Drop-UNKNOWN-type.patch
create mode 100644 network/patches/0270-ports-Implement-scaffolding-for-configuration.patch
create mode 100644 network/patches/0271-ports-VLAN-Validate-configuration.patch
create mode 100644 network/patches/0272-daemon-Don-t-crash-when-a-port-could-not-be-loaded.patch
create mode 100644 network/patches/0273-string-Have-all-functions-return-negative-values-on-.patch
create mode 100644 network/patches/0274-networkd-Parse-command-line-arguments.patch
create mode 100644 network/patches/0275-networkd-Open-config-directory-and-keep-a-handle-to-.patch
create mode 100644 network/patches/0276-networkd-Hold-a-file-descriptor-instead-of-DIR.patch
create mode 100644 network/patches/0277-networkd-Add-a-simple-test-environment.patch
create mode 100644 network/patches/0278-test-Run-ip-d-link-to-show-the-status-of-the-environ.patch
create mode 100644 network/patches/0279-networkctl-Terminate-after-showing-help-or-version.patch
create mode 100644 network/patches/0280-test-Be-less-patient-if-networkd-does-not-want-to-te.patch
create mode 100644 network/patches/0281-test-Run-networkd-as-root-in-its-own-namespace.patch
create mode 100644 network/patches/0282-ports-Refactor-enumerating-ports.patch
create mode 100644 network/patches/0283-tests-Add-new-test-that-creates-two-dummy-interfaces.patch
create mode 100644 network/patches/0284-tests-Always-dump-the-environment.patch
create mode 100644 network/patches/0285-test-Collect-more-information-from-test-environment.patch
create mode 100644 network/patches/0286-ports-bonding-Use-correct-enum-for-mode.patch
create mode 100644 network/patches/0287-networkd-json-Include-string.h.patch
create mode 100644 network/patches/0288-ports-Add-support-for-VETH.patch
create mode 100644 network/patches/0289-config-Add-string-buffer-type.patch
create mode 100644 network/patches/0290-networkctl-Add-color-functions.patch
create mode 100644 network/patches/0291-networkctl-Move-describe-into-an-own-function.patch
create mode 100644 network/patches/0292-networkctl-Implement-scaffolding-to-show-ports.patch
create mode 100644 network/patches/0293-ports-Add-link-stuff-to-JSON-output.patch
create mode 100644 network/patches/0294-link-Add-device-stuff-to-JSON-output.patch
create mode 100644 network/patches/0295-ports-Add-scaffolding-for-physical-Ethernet-interfac.patch
create mode 100644 network/patches/0296-logging-Add-WARNING-log-level.patch
create mode 100644 network/patches/0297-networkd-Handle-any-uevents-for-links.patch
create mode 100644 network/patches/0298-links-Initialize-udev-device-when-links-are-created.patch
create mode 100644 network/patches/0299-link-Skip-uevent-when-the-device-is-renaming.patch
create mode 100644 network/patches/0300-networkd-Implement-smarter-handling-of-the-configura.patch
create mode 100644 network/patches/0301-zones-Move-struct-nw_zone-into-header.patch
create mode 100644 network/patches/0302-Drop-unused-configuration-file-paths.patch
create mode 100644 network/patches/0303-util-Drop-nw_ftw.patch
create mode 100644 network/patches/0304-Makefile-Fix-typo-in-localstatedir.patch
delete mode 100644 network/patches/network-fix-logdir-path.patch
diff --git a/network/network.nm b/network/network.nm
index 85a9d15b3..2df8135b2 100644
--- a/network/network.nm
+++ b/network/network.nm
@@ -5,7 +5,7 @@
name = network
version = 010
-release = 5
+release = 6
maintainer = Michael Tremer <michael.tremer(a)ipfire.org>
groups = Base Networking/Tools
@@ -24,9 +24,12 @@ source_dl = https://source.ipfire.org/releases/network/
build
requires
+ asciidoc
autoconf
automake
docbook-xsl
+ json-c-devel
+ libcap-devel
libnl3-devel
libxslt
systemd-devel
diff --git a/network/patches/0001-Bump-version-to-011.patch b/network/patches/0001-Bump-version-to-011.patch
new file mode 100644
index 000000000..2b9422662
--- /dev/null
+++ b/network/patches/0001-Bump-version-to-011.patch
@@ -0,0 +1,26 @@
+From af91a344198a1f3c47dc18905870818a0758d427 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 24 Sep 2018 21:55:51 +0100
+Subject: [PATCH 001/304] Bump version to 011
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ configure.ac | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/configure.ac b/configure.ac
+index 9baab31..08e9089 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -21,7 +21,7 @@
+ AC_PREREQ([2.64])
+
+ AC_INIT([network],
+- [010],
++ [011],
+ [info(a)ipfire.org],
+ [network],
+ [http://www.ipfire.org/])
+--
+2.39.2
+
diff --git a/network/patches/0002-bridge-Check-input-and-return-useful-errors.patch b/network/patches/0002-bridge-Check-input-and-return-useful-errors.patch
new file mode 100644
index 000000000..91cbdec60
--- /dev/null
+++ b/network/patches/0002-bridge-Check-input-and-return-useful-errors.patch
@@ -0,0 +1,144 @@
+From b99bbd83b94d380bd07dcace8fb0e95b76b01e9f Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 24 Sep 2018 23:13:22 +0200
+Subject: [PATCH 002/304] bridge: Check input and return useful errors
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/hooks/zones/bridge | 80 +++++++++++++++++++++++++++++++++---------
+ 1 file changed, 63 insertions(+), 17 deletions(-)
+
+diff --git a/src/hooks/zones/bridge b/src/hooks/zones/bridge
+index 38b2b5f..838a513 100644
+--- a/src/hooks/zones/bridge
++++ b/src/hooks/zones/bridge
+@@ -23,13 +23,12 @@
+
+ HOOK_MANPAGE="network-zone-bridge"
+
+-HOOK_SETTINGS="HOOK STP STP_FORWARD_DELAY STP_HELLO STP_MAXAGE"
+-HOOK_SETTINGS="${HOOK_SETTINGS} STP_PRIORITY MAC MTU"
++HOOK_SETTINGS="HOOK ADDRESS STP STP_FORWARD_DELAY STP_HELLO STP_MAXAGE"
++HOOK_SETTINGS="${HOOK_SETTINGS} STP_PRIORITY MTU"
+
+ HOOK_PORT_SETTINGS="COST PRIORITY"
+
+ # Default values
+-MAC=""
+ MTU=1500
+ STP="on"
+ STP_FORWARD_DELAY=0
+@@ -38,7 +37,9 @@ STP_MAXAGE=20
+ STP_PRIORITY=512
+
+ hook_check_settings() {
+- assert ismac MAC
++ assert ismac ADDRESS
++
++ # Spanning Tree Protocol
+ assert isbool STP
+ assert isinteger STP_HELLO
+ assert isinteger STP_FORWARD_DELAY
+@@ -49,33 +50,78 @@ hook_check_settings() {
+ hook_parse_cmdline() {
+ while [ $# -gt 0 ]; do
+ case "${1}" in
++ --address=*)
++ ADDRESS="$(cli_get_val "${1}")"
++
++ if ! mac_is_valid "${ADDRESS}"; then
++ error "Invalid MAC address: ${ADDRESS}"
++ return ${EXIT_ERROR}
++ fi
++ ;;
++
++ --mtu=*)
++ MTU="$(cli_get_val "${1}")"
++
++ if ! mtu_is_valid "ethernet" "${MTU}"; then
++ error "Invalid MTU: ${MTU}"
++ return ${EXIT_ERROR}
++ fi
++ ;;
++
+ --stp=*)
+- STP=${1#--stp=}
++ STP="$(cli_get_val "${1}")"
++
++ if enabled STP; then
++ STP="on"
++ elif disabled STP; then
++ STP="off"
++ else
++ error "Invalid value for STP: ${STP}"
++ return ${EXIT_ERROR}
++ fi
+ ;;
++
+ --stp-hello=*)
+- STP_HELLO=${1#--stp-hello=}
++ STP_HELLO="$(cli_get_val "${1}")"
++
++ if ! isinteger STP_HELLO; then
++ error "Invalid STP hello time: ${STP_HELLO}"
++ return ${EXIT_ERROR}
++ fi
+ ;;
++
+ --stp-forward-delay=*)
+- STP_FORWARD_DELAY=${1#--stp-forward-delay=}
++ STP_FORWARD_DELAY="$(cli_get_val "${1}")"
++
++ if ! isinteger STP_FORWARD_DELAY; then
++ error "Invalid STP forwarding delay: ${STP_FORWARD_DELAY}"
++ return ${EXIT_ERROR}
++ fi
+ ;;
++
+ --stp-priority=*)
+- STP_PRIORITY=${1#--stp-priority=}
+- ;;
+- --mtu=*)
+- MTU=${1#--mtu=}
+- ;;
+- --mac=*)
+- MAC=${1#--mac=}
++ STP_PRIORITY="$(cli_get_val "${1}")"
++
++ if ! isinteger STP_PRIORITY; then
++ error "Invalid STP priority: ${STP_PRIORITY}"
++ return ${EXIT_ERROR}
++ fi
+ ;;
++
+ *)
+- warning "Ignoring unknown option '${1}'"
++ error "Unknown argument: ${1}"
++ return ${EXIT_ERROR}
+ ;;
+ esac
+ shift
+ done
+
+ # Generate a random MAC address if the user passed no one
+- isset MAC || MAC="$(mac_generate)"
++ if isset ADDRESS; then
++ ADDRESS="$(mac_generate)"
++ fi
++
++ return ${EXIT_OK}
+ }
+
+ hook_up() {
+@@ -87,7 +133,7 @@ hook_up() {
+ # Create the bridge if it does not already exist.
+ if ! device_exists "${zone}"; then
+ bridge_create "${zone}" \
+- --address="${MAC}" \
++ --address="${ADDRESS}" \
+ --mtu="${MTU}"
+ fi
+
+--
+2.39.2
+
diff --git a/network/patches/0003-bridge-Fix-assertion-for-MTU.patch b/network/patches/0003-bridge-Fix-assertion-for-MTU.patch
new file mode 100644
index 000000000..ce712991d
--- /dev/null
+++ b/network/patches/0003-bridge-Fix-assertion-for-MTU.patch
@@ -0,0 +1,32 @@
+From d95e2fdc65aeeca72ef326102f26727199b27b95 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 24 Sep 2018 23:15:26 +0200
+Subject: [PATCH 003/304] bridge: Fix assertion for MTU
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/hooks/zones/bridge | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/hooks/zones/bridge b/src/hooks/zones/bridge
+index 838a513..d610814 100644
+--- a/src/hooks/zones/bridge
++++ b/src/hooks/zones/bridge
+@@ -38,13 +38,13 @@ STP_PRIORITY=512
+
+ hook_check_settings() {
+ assert ismac ADDRESS
++ assert isset MTU && assert mtu_is_valid "ethernet" "${MTU}"
+
+ # Spanning Tree Protocol
+ assert isbool STP
+ assert isinteger STP_HELLO
+ assert isinteger STP_FORWARD_DELAY
+ assert isinteger STP_PRIORITY
+- assert isinteger MTU
+ }
+
+ hook_parse_cmdline() {
+--
+2.39.2
+
diff --git a/network/patches/0004-bridge-Reorder-functions-into-the-common-order.patch b/network/patches/0004-bridge-Reorder-functions-into-the-common-order.patch
new file mode 100644
index 000000000..d2a3d3810
--- /dev/null
+++ b/network/patches/0004-bridge-Reorder-functions-into-the-common-order.patch
@@ -0,0 +1,127 @@
+From 1fc4b3cac15c709b3a6f4a3171265a5cff793f47 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 24 Sep 2018 23:17:30 +0200
+Subject: [PATCH 004/304] bridge: Reorder functions into the common order
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/hooks/zones/bridge | 96 +++++++++++++++++++++---------------------
+ 1 file changed, 49 insertions(+), 47 deletions(-)
+
+diff --git a/src/hooks/zones/bridge b/src/hooks/zones/bridge
+index d610814..fb81673 100644
+--- a/src/hooks/zones/bridge
++++ b/src/hooks/zones/bridge
+@@ -172,53 +172,6 @@ hook_up() {
+ exit ${EXIT_OK}
+ }
+
+-hook_hotplug() {
+- local zone="${1}"
+- assert isset zone
+-
+- case "$(hotplug_action)" in
+- add)
+- # Attach all ports when zone is coming up
+- if hotplug_event_interface_is_zone "${zone}"; then
+- # Bring up all ports
+- local port
+- for port in $(zone_get_ports "${zone}"); do
+- log DEBUG "Trying to attach port ${port} to ${zone}"
+-
+- hook_port_up "${zone}" "${port}"
+- done
+-
+- # Handle ports of this zone that have just been added
+- elif hotplug_event_interface_is_port_of_zone "${zone}"; then
+- # Attach the device if the parent bridge is up
+- if zone_is_active "${zone}"; then
+- hook_port_up "${zone}" "${INTERFACE}"
+- fi
+- fi
+- ;;
+- remove)
+- if hotplug_event_interface_is_zone "${zone}"; then
+- # Bring down/destroy all ports
+- local port
+- for port in $(zone_get_ports "${zone}"); do
+- log DEBUG "Trying to detach port ${port} from ${zone}"
+-
+- hook_port_down "${zone}" "${port}"
+- done
+-
+- # Handle ports of this zone that have just been removed
+- elif hotplug_event_interface_is_port_of_zone "${zone}"; then
+- hook_port_down "${zone}" "${INTERFACE}"
+- fi
+- ;;
+- *)
+- exit ${EXIT_NOT_HANDLED}
+- ;;
+- esac
+-
+- exit ${EXIT_OK}
+-}
+-
+ hook_down() {
+ local zone="${1}"
+ assert isset zone
+@@ -294,6 +247,55 @@ hook_status() {
+ exit ${EXIT_OK}
+ }
+
++hook_hotplug() {
++ local zone="${1}"
++ assert isset zone
++
++ case "$(hotplug_action)" in
++ add)
++ # Attach all ports when zone is coming up
++ if hotplug_event_interface_is_zone "${zone}"; then
++ # Bring up all ports
++ local port
++ for port in $(zone_get_ports "${zone}"); do
++ log DEBUG "Trying to attach port ${port} to ${zone}"
++
++ hook_port_up "${zone}" "${port}"
++ done
++
++ # Handle ports of this zone that have just been added
++ elif hotplug_event_interface_is_port_of_zone "${zone}"; then
++ # Attach the device if the parent bridge is up
++ if zone_is_active "${zone}"; then
++ hook_port_up "${zone}" "${INTERFACE}"
++ fi
++ fi
++ ;;
++
++ remove)
++ if hotplug_event_interface_is_zone "${zone}"; then
++ # Bring down/destroy all ports
++ local port
++ for port in $(zone_get_ports "${zone}"); do
++ log DEBUG "Trying to detach port ${port} from ${zone}"
++
++ hook_port_down "${zone}" "${port}"
++ done
++
++ # Handle ports of this zone that have just been removed
++ elif hotplug_event_interface_is_port_of_zone "${zone}"; then
++ hook_port_down "${zone}" "${INTERFACE}"
++ fi
++ ;;
++
++ *)
++ exit ${EXIT_NOT_HANDLED}
++ ;;
++ esac
++
++ exit ${EXIT_OK}
++}
++
+ hook_check_port_settings() {
+ if isset COST; then
+ assert isinteger COST
+--
+2.39.2
+
diff --git a/network/patches/0005-bridge-Set-proper-defaults.patch b/network/patches/0005-bridge-Set-proper-defaults.patch
new file mode 100644
index 000000000..adbe32bea
--- /dev/null
+++ b/network/patches/0005-bridge-Set-proper-defaults.patch
@@ -0,0 +1,78 @@
+From c259c985bc98ad89350f81b68db58925163a43eb Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 24 Sep 2018 23:29:25 +0200
+Subject: [PATCH 005/304] bridge: Set proper defaults
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.hook | 12 ++++++++++++
+ src/hooks/zones/bridge | 20 +++++++++++++-------
+ 2 files changed, 25 insertions(+), 7 deletions(-)
+
+diff --git a/src/functions/functions.hook b/src/functions/functions.hook
+index ad51ad5..2f3ced0 100644
+--- a/src/functions/functions.hook
++++ b/src/functions/functions.hook
+@@ -124,6 +124,18 @@ hook_help() {
+ exit $?
+ }
+
++# Sets all settings in HOOK_SETTINGS to their DEFAULT_* values
++hook_set_defaults() {
++ local setting
++ for setting in ${HOOK_SETTINGS}; do
++ local default="DEFAULT_${setting}"
++
++ if isset ${default}; then
++ assign "${setting}" "${!default}"
++ fi
++ done
++}
++
+ config_get_hook() {
+ local config=${1}
+
+diff --git a/src/hooks/zones/bridge b/src/hooks/zones/bridge
+index fb81673..1144ba0 100644
+--- a/src/hooks/zones/bridge
++++ b/src/hooks/zones/bridge
+@@ -29,12 +29,10 @@ HOOK_SETTINGS="${HOOK_SETTINGS} STP_PRIORITY MTU"
+ HOOK_PORT_SETTINGS="COST PRIORITY"
+
+ # Default values
+-MTU=1500
+-STP="on"
+-STP_FORWARD_DELAY=0
+-STP_HELLO=2
+-STP_MAXAGE=20
+-STP_PRIORITY=512
++DEFAULT_STP_FORWARD_DELAY=0
++DEFAULT_STP_HELLO=2
++DEFAULT_STP_MAXAGE=20
++DEFAULT_STP_PRIORITY=512
+
+ hook_check_settings() {
+ assert ismac ADDRESS
+@@ -117,10 +115,18 @@ hook_parse_cmdline() {
+ done
+
+ # Generate a random MAC address if the user passed no one
+- if isset ADDRESS; then
++ if ! isset ADDRESS; then
+ ADDRESS="$(mac_generate)"
+ fi
+
++ # Enable Spanning Tree Protocol by default
++ if ! isset STP; then
++ STP="on"
++ fi
++
++ # Set all other defaults
++ hook_set_defaults
++
+ return ${EXIT_OK}
+ }
+
+--
+2.39.2
+
diff --git a/network/patches/0006-bridge-Order-arguments-in-alphabetical-order.patch b/network/patches/0006-bridge-Order-arguments-in-alphabetical-order.patch
new file mode 100644
index 000000000..95f14cad5
--- /dev/null
+++ b/network/patches/0006-bridge-Order-arguments-in-alphabetical-order.patch
@@ -0,0 +1,46 @@
+From b76b7d88a5fc7271e9a16d4acb531cdfe45f3957 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 24 Sep 2018 23:31:43 +0200
+Subject: [PATCH 006/304] bridge: Order arguments in alphabetical order
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/hooks/zones/bridge | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/src/hooks/zones/bridge b/src/hooks/zones/bridge
+index 1144ba0..98aaef8 100644
+--- a/src/hooks/zones/bridge
++++ b/src/hooks/zones/bridge
+@@ -79,20 +79,20 @@ hook_parse_cmdline() {
+ fi
+ ;;
+
+- --stp-hello=*)
+- STP_HELLO="$(cli_get_val "${1}")"
++ --stp-forward-delay=*)
++ STP_FORWARD_DELAY="$(cli_get_val "${1}")"
+
+- if ! isinteger STP_HELLO; then
+- error "Invalid STP hello time: ${STP_HELLO}"
++ if ! isinteger STP_FORWARD_DELAY; then
++ error "Invalid STP forwarding delay: ${STP_FORWARD_DELAY}"
+ return ${EXIT_ERROR}
+ fi
+ ;;
+
+- --stp-forward-delay=*)
+- STP_FORWARD_DELAY="$(cli_get_val "${1}")"
++ --stp-hello=*)
++ STP_HELLO="$(cli_get_val "${1}")"
+
+- if ! isinteger STP_FORWARD_DELAY; then
+- error "Invalid STP forwarding delay: ${STP_FORWARD_DELAY}"
++ if ! isinteger STP_HELLO; then
++ error "Invalid STP hello time: ${STP_HELLO}"
+ return ${EXIT_ERROR}
+ fi
+ ;;
+--
+2.39.2
+
diff --git a/network/patches/0007-bridge-Add-option-to-missing-stp-max-age.patch b/network/patches/0007-bridge-Add-option-to-missing-stp-max-age.patch
new file mode 100644
index 000000000..0a48d11c1
--- /dev/null
+++ b/network/patches/0007-bridge-Add-option-to-missing-stp-max-age.patch
@@ -0,0 +1,33 @@
+From 0f8d47058e6dedc5f20caf367a5296647ec950d1 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 24 Sep 2018 23:32:40 +0200
+Subject: [PATCH 007/304] bridge: Add option to missing --stp-max-age=
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/hooks/zones/bridge | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/src/hooks/zones/bridge b/src/hooks/zones/bridge
+index 98aaef8..93a3a31 100644
+--- a/src/hooks/zones/bridge
++++ b/src/hooks/zones/bridge
+@@ -97,6 +97,15 @@ hook_parse_cmdline() {
+ fi
+ ;;
+
++ --stp-max-age=*)
++ STP_MAXAGE="$(cli_get_val "${1}")"
++
++ if ! isinteger STP_MAXAGE; then
++ error "Invalid STP max age: ${STP_MAXAGE}"
++ return ${EXIT_ERROR}
++ fi
++ ;;
++
+ --stp-priority=*)
+ STP_PRIORITY="$(cli_get_val "${1}")"
+
+--
+2.39.2
+
diff --git a/network/patches/0008-Remove-unused-function.patch b/network/patches/0008-Remove-unused-function.patch
new file mode 100644
index 000000000..90cdc0976
--- /dev/null
+++ b/network/patches/0008-Remove-unused-function.patch
@@ -0,0 +1,29 @@
+From 5b29153cd4527392d6ca4bf8d3cba491db8d490e Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 1 Oct 2018 00:07:37 +0200
+Subject: [PATCH 008/304] Remove unused function
+
+Fixes: #11423
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.zone | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/src/functions/functions.zone b/src/functions/functions.zone
+index b9d475f..57e0b71 100644
+--- a/src/functions/functions.zone
++++ b/src/functions/functions.zone
+@@ -619,10 +619,6 @@ zone_config_list() {
+ done
+ }
+
+-zone_config_show() {
+- zone_config_cmd "show" "$@"
+-}
+-
+ # Returns a list of all used ids for a zone
+ zone_config_list_ids() {
+ assert [ $# -eq 1 ]
+--
+2.39.2
+
diff --git a/network/patches/0009-bonding-Validate-any-MAC-address-passed.patch b/network/patches/0009-bonding-Validate-any-MAC-address-passed.patch
new file mode 100644
index 000000000..91c45617c
--- /dev/null
+++ b/network/patches/0009-bonding-Validate-any-MAC-address-passed.patch
@@ -0,0 +1,33 @@
+From 7b9557028a381206c573e42a7f5294d20aa0609b Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 1 Oct 2018 01:02:27 +0200
+Subject: [PATCH 009/304] bonding; Validate any MAC address passed
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/hooks/ports/bonding | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/src/hooks/ports/bonding b/src/hooks/ports/bonding
+index 2880a78..40d849f 100644
+--- a/src/hooks/ports/bonding
++++ b/src/hooks/ports/bonding
+@@ -39,8 +39,14 @@ hook_parse_cmdline() {
+ while [ $# -gt 0 ]; do
+ case "${1}" in
+ --address=*)
+- ADDRESS=$(cli_get_val "${1}")
++ ADDRESS="$(cli_get_val "${1}")"
++
++ if ! mac_is_valid "${ADDRESS}"; then
++ error "Invalid MAC address: ${ADDRESS}"
++ return ${EXIT_ERROR}
++ fi
+ ;;
++
+ --miimon=*)
+ MIIMON=$(cli_get_val "${1}")
+ ;;
+--
+2.39.2
+
diff --git a/network/patches/0010-ip-tunnel-Set-TTL-to-255-by-default.patch b/network/patches/0010-ip-tunnel-Set-TTL-to-255-by-default.patch
new file mode 100644
index 000000000..6f8a943c4
--- /dev/null
+++ b/network/patches/0010-ip-tunnel-Set-TTL-to-255-by-default.patch
@@ -0,0 +1,34 @@
+From ae2c5b2b954bfc5282f0ef359d0960a2cd610e14 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 3 Dec 2018 13:38:13 +0100
+Subject: [PATCH 010/304] ip-tunnel: Set TTL to 255 by default
+
+By default, the Linux kernel inherits the TTL of the transported
+packet. Usually with BGP, the TTL is deliberately set to 1 or very
+low numbers which causes the packet to be dropped after the first
+hop.
+
+Since the tunnel should be routed, we set this to a default value
+of 255 and ignore the TTL of the encapsulated packet.
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.ip-tunnel | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/functions/functions.ip-tunnel b/src/functions/functions.ip-tunnel
+index 1184a84..11eb3c7 100644
+--- a/src/functions/functions.ip-tunnel
++++ b/src/functions/functions.ip-tunnel
+@@ -77,7 +77,7 @@ ip_tunnel_add() {
+ shift
+
+ local mode
+- local ttl
++ local ttl=255
+
+ local address
+ local remote_address
+--
+2.39.2
+
diff --git a/network/patches/0011-bird-Add-some-generic-configuration-file.patch b/network/patches/0011-bird-Add-some-generic-configuration-file.patch
new file mode 100644
index 000000000..d89917387
--- /dev/null
+++ b/network/patches/0011-bird-Add-some-generic-configuration-file.patch
@@ -0,0 +1,107 @@
+From 6a1b0fb170c7d66559935a6a4f8ee0e2bfdbf485 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 16 Dec 2018 17:10:47 +0000
+Subject: [PATCH 011/304] bird: Add some generic configuration file
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 1 +
+ src/functions/functions.bird | 74 ++++++++++++++++++++++++++++++++++++
+ 2 files changed, 75 insertions(+)
+ create mode 100644 src/functions/functions.bird
+
+diff --git a/Makefile.am b/Makefile.am
+index 399652e..0139f95 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -127,6 +127,7 @@ EXTRA_DIST += \
+ dist_network_DATA = \
+ src/functions/functions.at \
+ src/functions/functions.auth \
++ src/functions/functions.bird \
+ src/functions/functions.bonding \
+ src/functions/functions.bridge \
+ src/functions/functions.cli \
+diff --git a/src/functions/functions.bird b/src/functions/functions.bird
+new file mode 100644
+index 0000000..9c8b006
+--- /dev/null
++++ b/src/functions/functions.bird
+@@ -0,0 +1,74 @@
++#!/bin/bash
++###############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2018 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++###############################################################################
++
++BIRD_CONF="/etc/bird.conf"
++
++bird_start() {
++ service_start "bird.service"
++}
++
++bird_stop() {
++ service_stop "bird.service"
++}
++
++bird_reload() {
++ service_reload "bird.service"
++}
++
++bird_generate_config() {
++ log DEBUG "Write BIRD configuration file"
++
++ # Write header
++ config_header "bird" > ${BIRD_CONF}
++
++ # Write some basic settings
++ local proto
++ (
++ print "# Log everything to syslog"
++ print "log syslog all;"
++ print
++
++ print "# Turn on internal watchdog"
++ print "watchdog warning 5s;"
++ print "watchdog timeout 30s;"
++ print
++
++ print "# Define default route tables"
++ print "ipv6 table master6;"
++ print "ipv4 table master4;"
++
++ print "# Enable device configuration"
++ print "protocol device {}"
++ print
++
++ print "# Export all routes to kernel"
++ for proto in ipv6 ipv4; do
++ print "protocol kernel {"
++ print " ${proto} {"
++ print " table ${proto/ipv/master};"
++ print " export all;"
++ print " };"
++ print " learn;"
++ print "}"
++ print
++ done
++ ) >> ${BIRD_CONF}
++}
+--
+2.39.2
+
diff --git a/network/patches/0012-bird-Apply-static-routes-instead-of-doing-that-manua.patch b/network/patches/0012-bird-Apply-static-routes-instead-of-doing-that-manua.patch
new file mode 100644
index 000000000..887df6386
--- /dev/null
+++ b/network/patches/0012-bird-Apply-static-routes-instead-of-doing-that-manua.patch
@@ -0,0 +1,146 @@
+From 0a5787976dd85db212fc5046c85d2aad6c64da5c Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 16 Dec 2018 17:47:57 +0000
+Subject: [PATCH 012/304] bird: Apply static routes instead of doing that
+ manually with ip
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.bird | 52 ++++++++++++++++++++++++++++++++-
+ src/functions/functions.route | 38 +++---------------------
+ src/functions/functions.routing | 3 --
+ 3 files changed, 55 insertions(+), 38 deletions(-)
+
+diff --git a/src/functions/functions.bird b/src/functions/functions.bird
+index 9c8b006..c6fea32 100644
+--- a/src/functions/functions.bird
++++ b/src/functions/functions.bird
+@@ -60,7 +60,7 @@ bird_generate_config() {
+ print
+
+ print "# Export all routes to kernel"
+- for proto in ipv6 ipv4; do
++ for proto in ${IP_SUPPORTED_PROTOCOLS}; do
+ print "protocol kernel {"
+ print " ${proto} {"
+ print " table ${proto/ipv/master};"
+@@ -71,4 +71,54 @@ bird_generate_config() {
+ print
+ done
+ ) >> ${BIRD_CONF}
++
++ # Static routes
++ for proto in ${IP_SUPPORTED_PROTOCOLS}; do
++ print "protocol static {"
++ print " ${proto};"
++ print
++
++ # Read routes for this protocol from configuration
++ __bird_static_routes "${proto}"
++
++ print "}"
++ print
++ done >> ${BIRD_CONF}
++}
++
++__bird_static_routes() {
++ local proto="${1}"
++ assert isset proto
++
++ local ${NETWORK_CONFIG_ROUTES_PARAMS}
++ local line
++ while read line; do
++ route_parse_line "${line}"
++ [ $? -eq ${EXIT_OK} ] || continue
++
++ local type
++ local arg
++ for arg in unreachable prohibit blackhole; do
++ if enabled "${arg}"; then
++ type="${arg}"
++ break
++ fi
++ done
++
++ # Skip all routes of another protocol
++ local _proto="$(ip_detect_protocol "${network}")"
++ if [ "${proto}" != "${_proto}" ]; then
++ continue
++ fi
++
++ case "${type}" in
++ unreachable|prohibit|blackhole)
++ print " route ${network} ${type};"
++ ;;
++
++ *)
++ print " route ${network} via ${gateway};"
++ ;;
++ esac
++ done < ${NETWORK_CONFIG_ROUTES}
+ }
+diff --git a/src/functions/functions.route b/src/functions/functions.route
+index 7ca4f59..e6ea244 100644
+--- a/src/functions/functions.route
++++ b/src/functions/functions.route
+@@ -393,41 +393,11 @@ route_parse_line() {
+ }
+
+ route_apply() {
+- local table="static"
+- local type
++ # Re-generate BIRD configuration
++ bird_generate_config
+
+- log DEBUG "Applying static routes..."
+-
+- # Flush the routing table.
+- route_table_flush ${table}
+-
+- local ${NETWORK_CONFIG_ROUTES_PARAMS}
+- local line
+- while read line; do
+- route_parse_line ${line}
+- [ $? -eq ${EXIT_OK} ] || continue
+-
+- type="unicast"
+- local arg
+- for arg in unreachable prohibit blackhole; do
+- if enabled ${arg}; then
+- type="${arg}"
+- break
+- fi
+- done
+-
+- # Add the route.
+- route_entry_add ${network} --table="static" --proto="static" \
+- --type="${type}" --gateway="${gateway}" --mtu="${mtu}"
+- local ret=$?
+-
+- if [ ${ret} -ne ${EXIT_OK} ]; then
+- log WARNING "Could not set route '${network}'."
+- fi
+- done < ${NETWORK_CONFIG_ROUTES}
+-
+- # Create a lookup rule for the static routing table.
+- route_rule_add --lookup="static" --priority=1000
++ # Reload the daemon
++ bird_reload
+ }
+
+ route_entry_add() {
+diff --git a/src/functions/functions.routing b/src/functions/functions.routing
+index 2436585..c7aac09 100644
+--- a/src/functions/functions.routing
++++ b/src/functions/functions.routing
+@@ -181,7 +181,4 @@ routing_update() {
+ cmd ${routing_cmd}
+
+ cmd ${ip_cmd} rule add from ${local_ip_address} lookup ${table}
+-
+- # Apply all static routes
+- route_apply
+ }
+--
+2.39.2
+
diff --git a/network/patches/0013-bird-Re-generate-configuration-when-network-is-initi.patch b/network/patches/0013-bird-Re-generate-configuration-when-network-is-initi.patch
new file mode 100644
index 000000000..1c3458ec4
--- /dev/null
+++ b/network/patches/0013-bird-Re-generate-configuration-when-network-is-initi.patch
@@ -0,0 +1,28 @@
+From eb6b47dcc7d5d541064ad90787ae55df3c3a8453 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 16 Dec 2018 17:55:25 +0000
+Subject: [PATCH 013/304] bird: (Re-)generate configuration when network is
+ initialised
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/network | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/network b/src/network
+index 69d77d5..b8f734e 100644
+--- a/src/network
++++ b/src/network
+@@ -1410,6 +1410,9 @@ case "${action}" in
+ # Update resolv.conf(5) when initializing the network
+ dns_generate_resolvconf
+
++ # Update bird configuration
++ bird_generate_config
++
+ # Also execute all triggers
+ triggers_execute_all "init"
+ ;;
+--
+2.39.2
+
diff --git a/network/patches/0014-dns-Always-enable-EDNS0.patch b/network/patches/0014-dns-Always-enable-EDNS0.patch
new file mode 100644
index 000000000..bd8ce2427
--- /dev/null
+++ b/network/patches/0014-dns-Always-enable-EDNS0.patch
@@ -0,0 +1,32 @@
+From c27b38b437fa82a2227d554f4855c116395995ce Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Wed, 13 Feb 2019 17:45:05 +0000
+Subject: [PATCH 014/304] dns: Always enable EDNS0
+
+This is for all DNS queries originating from the firewall.
+
+Since we have had DNS Flag Day, we are expecting all DNS servers
+to support this now. If not, then you are very unlucky.
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.dns | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/functions/functions.dns b/src/functions/functions.dns
+index 4cd5cb4..890f1ac 100644
+--- a/src/functions/functions.dns
++++ b/src/functions/functions.dns
+@@ -245,6 +245,9 @@ dns_generate_resolvconf() {
+
+ config_header "resolver configutation file" > ${file}
+
++ # Always enable EDNS0
++ print "option edns0\n" >> "${file}"
++
+ if enabled DNS_RANDOMIZE; then
+ print "option rotate\n" >> ${file}
+ fi
+--
+2.39.2
+
diff --git a/network/patches/0015-wireless-ap-Use-automatic-channel-selection-ACS-by-d.patch b/network/patches/0015-wireless-ap-Use-automatic-channel-selection-ACS-by-d.patch
new file mode 100644
index 000000000..9b6099b56
--- /dev/null
+++ b/network/patches/0015-wireless-ap-Use-automatic-channel-selection-ACS-by-d.patch
@@ -0,0 +1,27 @@
+From 469bc87f91538d668a32f9c38a3d8b1b4679c7ae Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 18 Mar 2019 19:46:06 +0100
+Subject: [PATCH 015/304] wireless-ap: Use automatic channel selection (ACS) by
+ default
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/hooks/ports/wireless-ap | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/hooks/ports/wireless-ap b/src/hooks/ports/wireless-ap
+index 32d1a5a..52ca238 100644
+--- a/src/hooks/ports/wireless-ap
++++ b/src/hooks/ports/wireless-ap
+@@ -28,7 +28,7 @@ HOOK_SETTINGS="${HOOK_SETTINGS} ENCRYPTION KEY"
+
+ ADDRESS=$(mac_generate)
+ BROADCAST_SSID=on
+-CHANNEL=1
++CHANNEL=0
+ ENCRYPTION=""
+ KEY=""
+ SSID=
+--
+2.39.2
+
diff --git a/network/patches/0016-wireless-ap-Allow-to-disable-DFS-in-configuration.patch b/network/patches/0016-wireless-ap-Allow-to-disable-DFS-in-configuration.patch
new file mode 100644
index 000000000..717b30550
--- /dev/null
+++ b/network/patches/0016-wireless-ap-Allow-to-disable-DFS-in-configuration.patch
@@ -0,0 +1,102 @@
+From 7b297fb22fb16db920d68224b232e5acc652688a Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 18 Mar 2019 19:58:25 +0100
+Subject: [PATCH 016/304] wireless-ap: Allow to disable DFS in configuration
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.hostapd | 10 +++++++++-
+ src/helpers/hostapd-config-helper | 1 +
+ src/hooks/ports/wireless-ap | 16 ++++++++++++++++
+ 3 files changed, 26 insertions(+), 1 deletion(-)
+
+diff --git a/src/functions/functions.hostapd b/src/functions/functions.hostapd
+index 3f64e79..e19f9b3 100644
+--- a/src/functions/functions.hostapd
++++ b/src/functions/functions.hostapd
+@@ -36,6 +36,7 @@ hostapd_config_write() {
+ local broadcast_ssid
+ local channel
+ local country_code="$(wireless_get_reg_domain)"
++ local dfs="on"
+ local encryption
+ local key
+ local mode
+@@ -50,6 +51,9 @@ hostapd_config_write() {
+ --channel=*)
+ channel=$(cli_get_val "${1}")
+ ;;
++ --dfs=*)
++ dfs="$(cli_get_val "${1}")"
++ ;;
+ --encryption=*)
+ encryption=$(cli_get_val "${1}")
+ ;;
+@@ -177,7 +181,11 @@ hostapd_config_write() {
+ print "ieee80211d=1"
+
+ # Enable Radar Detection
+- print "ieee80211h=1"
++ if enabled dfs; then
++ print "ieee80211h=1"
++ else
++ print "ieee80211h=0"
++ fi
+
+ print # empty line
+
+diff --git a/src/helpers/hostapd-config-helper b/src/helpers/hostapd-config-helper
+index cb12af0..30d3456 100644
+--- a/src/helpers/hostapd-config-helper
++++ b/src/helpers/hostapd-config-helper
+@@ -40,6 +40,7 @@ case "${action}" in
+ hostapd_config_write ${port} ${config_file} \
+ --broadcast-ssid="${BROADCAST_SSID}" \
+ --channel="${CHANNEL}" \
++ --dfs="${DFS}" \
+ --encryption="${ENCRYPTION}" \
+ --key="${KEY}" \
+ --mode="${MODE}" \
+diff --git a/src/hooks/ports/wireless-ap b/src/hooks/ports/wireless-ap
+index 52ca238..49c0a84 100644
+--- a/src/hooks/ports/wireless-ap
++++ b/src/hooks/ports/wireless-ap
+@@ -33,12 +33,16 @@ ENCRYPTION=""
+ KEY=""
+ SSID=
+
++# Perform radar detection by default when possible
++DFS="on"
++
+ hook_check_settings() {
+ assert isset ADDRESS
+ assert ismac ADDRESS
+ assert isset BROADCAST_SSID
+ assert isbool BROADCAST_SSID
+ assert isset CHANNEL
++ assert isbool DFS
+ assert isset MODE
+ assert isoneof MODE ${HOSTAPD_SUPPORTED_MODES}
+ assert isset PHY
+@@ -63,6 +67,18 @@ hook_parse_cmdline() {
+ --channel=*)
+ CHANNEL=$(cli_get_val "${1}")
+ ;;
++ --dfs=*)
++ DFS="$(cli_get_val "${1}")"
++
++ if enabled DFS; then
++ DFS="on"
++ elif disabled DFS; then
++ DFS="off"
++ else
++ error "Invalid value for DFS: ${DFS}"
++ return ${EXIT_ERROR}
++ fi
++ ;;
+ --encryption=*)
+ ENCRYPTION=$(cli_get_val "${1}")
+ ;;
+--
+2.39.2
+
diff --git a/network/patches/0017-hostapd-Disable-DFS-automatically-when-not-supported.patch b/network/patches/0017-hostapd-Disable-DFS-automatically-when-not-supported.patch
new file mode 100644
index 000000000..a087dc1a1
--- /dev/null
+++ b/network/patches/0017-hostapd-Disable-DFS-automatically-when-not-supported.patch
@@ -0,0 +1,99 @@
+From dc6d97fbf2064365f5b84496a77227b4e3ca03d6 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 18 Mar 2019 20:10:56 +0100
+Subject: [PATCH 017/304] hostapd: Disable DFS automatically when not supported
+ by hardware
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.hostapd | 2 +-
+ src/functions/functions.phy | 22 ++++++++++++++++++++++
+ src/functions/functions.wireless | 13 +++++++++++++
+ src/network | 7 +++++++
+ 4 files changed, 43 insertions(+), 1 deletion(-)
+
+diff --git a/src/functions/functions.hostapd b/src/functions/functions.hostapd
+index e19f9b3..b855994 100644
+--- a/src/functions/functions.hostapd
++++ b/src/functions/functions.hostapd
+@@ -181,7 +181,7 @@ hostapd_config_write() {
+ print "ieee80211d=1"
+
+ # Enable Radar Detection
+- if enabled dfs; then
++ if enabled dfs && wireless_supports_dfs "${device}"; then
+ print "ieee80211h=1"
+ else
+ print "ieee80211h=0"
+diff --git a/src/functions/functions.phy b/src/functions/functions.phy
+index 96287a5..064ca7b 100644
+--- a/src/functions/functions.phy
++++ b/src/functions/functions.phy
+@@ -188,3 +188,25 @@ phy_supports_ht_capability() {
+
+ list_match "${capability}" $(__phy_list_ht_capabilities "${phy}")
+ }
++
++# Returns TRUE if the PHY supports DFS
++phy_supports_dfs() {
++ local phy="${1}"
++ assert isset phy
++
++ local driver="$(phy_get_driver "${phy}")"
++ if ! isset driver; then
++ return ${EXIT_ERROR}
++ fi
++
++ # This is basically a whilelist of drivers which support this
++ # There is no better detection
++ case "${driver}" in
++ ath10k_*|ath9k|ath5k)
++ return ${EXIT_TRUE}
++ ;;
++ *)
++ return ${EXIT_FALSE}
++ ;;
++ esac
++}
+diff --git a/src/functions/functions.wireless b/src/functions/functions.wireless
+index 3608e11..221866e 100644
+--- a/src/functions/functions.wireless
++++ b/src/functions/functions.wireless
+@@ -515,3 +515,16 @@ wireless_get_vht_caps() {
+
+ network-phy-list-vht-caps "${phy}"
+ }
++
++wireless_supports_dfs() {
++ local device="${1}"
++ assert isset device
++
++ local phy="$(device_get_phy "${device}")"
++ if ! isset phy; then
++ log ERROR "Could not determine PHY for ${device}"
++ return ${EXIT_ERROR}
++ fi
++
++ phy_supports_dfs "${phy}"
++}
+diff --git a/src/network b/src/network
+index b8f734e..de2e663 100644
+--- a/src/network
++++ b/src/network
+@@ -277,6 +277,13 @@ cli_device_status_phy() {
+ cli_space
+ fi
+
++ cli_headline 2 "Features"
++
++ cli_print_fmt1 2 "DFS" \
++ "$(phy_supports_dfs "${phy}" && print "Supported" || print "Not Supported")"
++
++ cli_space
++
+ return ${EXIT_OK}
+ }
+
+--
+2.39.2
+
diff --git a/network/patches/0018-wireless-ap-Add-CLI-to-set-channel-bandwidth.patch b/network/patches/0018-wireless-ap-Add-CLI-to-set-channel-bandwidth.patch
new file mode 100644
index 000000000..ef53e6273
--- /dev/null
+++ b/network/patches/0018-wireless-ap-Add-CLI-to-set-channel-bandwidth.patch
@@ -0,0 +1,87 @@
+From 54094fc7ae1bc17e8d8361f7758d9404f1eeff02 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 18 Mar 2019 20:50:44 +0100
+Subject: [PATCH 018/304] wireless-ap: Add CLI to set channel bandwidth
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.wireless | 20 ++++++++++++++++++++
+ src/hooks/ports/wireless-ap | 10 ++++++++++
+ 2 files changed, 30 insertions(+)
+
+diff --git a/src/functions/functions.wireless b/src/functions/functions.wireless
+index 221866e..0437d27 100644
+--- a/src/functions/functions.wireless
++++ b/src/functions/functions.wireless
+@@ -29,6 +29,14 @@ WIRELESS_DEFAULT_ENCRYPTION_MODE="NONE"
+ WIRELESS_VALID_ENCRYPTION_MODES="WPA2-PSK-SHA256 WPA2-PSK \
+ WPA-PSK-SHA256 WPA-PSK NONE"
+
++declare -A WIRELESS_CHANNEL_BANDWIDTHS=(
++ ["802.11ac"]="20 40 80 160 80+80"
++ ["802.11a/n"]="20 40"
++ ["802.11a"]="20 40"
++ ["802.11g/n"]="20 40"
++ ["802.11g"]="20 40"
++)
++
+ cli_wireless() {
+ local action=${1}
+ shift 1
+@@ -309,6 +317,18 @@ wireless_channel_is_valid() {
+ return ${EXIT_FALSE}
+ }
+
++wireless_channel_bandwidth_is_valid() {
++ local mode="${1}"
++ assert isset mode
++
++ local bandwidth="${2}"
++ assert isset bandwidth
++
++ local bandwidths="${WIRELESS_CHANNEL_BANDWIDTHS["${mode}"]}"
++
++ list_match "${bandwidth}" ${bandwidths}
++}
++
+ wireless_channel_is_ht40_plus() {
+ local channel="${1}"
+ assert isinteger channel
+diff --git a/src/hooks/ports/wireless-ap b/src/hooks/ports/wireless-ap
+index 49c0a84..8b626bf 100644
+--- a/src/hooks/ports/wireless-ap
++++ b/src/hooks/ports/wireless-ap
+@@ -29,6 +29,7 @@ HOOK_SETTINGS="${HOOK_SETTINGS} ENCRYPTION KEY"
+ ADDRESS=$(mac_generate)
+ BROADCAST_SSID=on
+ CHANNEL=0
++CHANNEL_BANDWIDTH=
+ ENCRYPTION=""
+ KEY=""
+ SSID=
+@@ -67,6 +68,9 @@ hook_parse_cmdline() {
+ --channel=*)
+ CHANNEL=$(cli_get_val "${1}")
+ ;;
++ --channel-bandwidth=*)
++ CHANNEL_BANDWIDTH="$(cli_get_val "${1}")"
++ ;;
+ --dfs=*)
+ DFS="$(cli_get_val "${1}")"
+
+@@ -121,6 +125,12 @@ hook_parse_cmdline() {
+ return ${EXIT_ERROR}
+ fi
+
++ # Channel bandwidth must match the mode
++ if isset CHANNEL_BANDWIDTH && ! wireless_channel_bandwidth_is_valid "${MODE}" "${CHANNEL_BANDWIDTH}"; then
++ error "Channel Bandwidth '${CHANNEL_BANDWIDTH}' is not supported"
++ return ${EXIT_ERROR}
++ fi
++
+ # Save address of phy do identify it again
+ PHY=$(phy_get ${PHY})
+ PHY=$(phy_get_address ${PHY})
+--
+2.39.2
+
diff --git a/network/patches/0019-wireless-ap-Forgot-to-add-configuration-variables-to.patch b/network/patches/0019-wireless-ap-Forgot-to-add-configuration-variables-to.patch
new file mode 100644
index 000000000..d6a92619a
--- /dev/null
+++ b/network/patches/0019-wireless-ap-Forgot-to-add-configuration-variables-to.patch
@@ -0,0 +1,29 @@
+From 40c95a6b261e8fdadca97f21ff7cd2a11af3bfb3 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 18 Mar 2019 21:21:37 +0100
+Subject: [PATCH 019/304] wireless-ap: Forgot to add configuration variables to
+ file
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/hooks/ports/wireless-ap | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/hooks/ports/wireless-ap b/src/hooks/ports/wireless-ap
+index 8b626bf..5e00014 100644
+--- a/src/hooks/ports/wireless-ap
++++ b/src/hooks/ports/wireless-ap
+@@ -23,8 +23,8 @@
+
+ HOOK_PORT_PATTERN="${PORT_PATTERN_ACCESSPOINT}"
+
+-HOOK_SETTINGS="ADDRESS BROADCAST_SSID CHANNEL MODE PHY SSID"
+-HOOK_SETTINGS="${HOOK_SETTINGS} ENCRYPTION KEY"
++HOOK_SETTINGS="ADDRESS BROADCAST_SSID CHANNEL CHANNEL_BANDWIDTH DFS MODE PHY"
++HOOK_SETTINGS="${HOOK_SETTINGS} ENCRYPTION KEY SSID"
+
+ ADDRESS=$(mac_generate)
+ BROADCAST_SSID=on
+--
+2.39.2
+
diff --git a/network/patches/0020-hostapd-Apply-channel-bandwidth-to-configuration.patch b/network/patches/0020-hostapd-Apply-channel-bandwidth-to-configuration.patch
new file mode 100644
index 000000000..cf9962ddb
--- /dev/null
+++ b/network/patches/0020-hostapd-Apply-channel-bandwidth-to-configuration.patch
@@ -0,0 +1,109 @@
+From f9e980d91e081613e5dcc7899c28fbdfc7a4c172 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 18 Mar 2019 21:24:02 +0100
+Subject: [PATCH 020/304] hostapd: Apply channel bandwidth to configuration
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.hostapd | 26 ++++++++++++++++++++++++++
+ src/helpers/hostapd-config-helper | 1 +
+ src/hooks/ports/wireless-ap | 2 +-
+ 3 files changed, 28 insertions(+), 1 deletion(-)
+
+diff --git a/src/functions/functions.hostapd b/src/functions/functions.hostapd
+index b855994..57f8c1e 100644
+--- a/src/functions/functions.hostapd
++++ b/src/functions/functions.hostapd
+@@ -35,6 +35,7 @@ hostapd_config_write() {
+
+ local broadcast_ssid
+ local channel
++ local channel_bandwidth
+ local country_code="$(wireless_get_reg_domain)"
+ local dfs="on"
+ local encryption
+@@ -51,6 +52,9 @@ hostapd_config_write() {
+ --channel=*)
+ channel=$(cli_get_val "${1}")
+ ;;
++ --channel-bandwidth=*)
++ channel_bandwidth="$(cli_get_val "${1}")"
++ ;;
+ --dfs=*)
+ dfs="$(cli_get_val "${1}")"
+ ;;
+@@ -107,10 +111,17 @@ hostapd_config_write() {
+ assert isset key
+ fi
+
++ # Check channel bandwidth for validity
++ if isset channel_bandwidth && ! wireless_channel_bandwidth_is_valid "${mode}" "${channel_bandwidth}"; then
++ error "Invalid channel bandwidth for ${mode}: ${channel_bandwidth}"
++ return ${EXIT_ERROR}
++ fi
++
+ # 802.11ac/n flags
+ local ieee80211ac
+ local ieee80211n
+ local vht_caps
++ local vht_oper_chwidth="0"
+ local ht_caps
+
+ local hw_mode
+@@ -149,6 +160,18 @@ hostapd_config_write() {
+
+ # Fetch HT caps
+ ht_caps="$(wireless_get_ht_caps "${device}")"
++
++ case "${channel_bandwidth}" in
++ 80)
++ vht_oper_chwidth="1"
++ ;;
++ 160)
++ vht_oper_chwidth="2"
++ ;;
++ 80+80)
++ vht_oper_chwidth="3"
++ ;;
++ esac
+ ;;
+ esac
+
+@@ -221,6 +244,9 @@ hostapd_config_write() {
+ # Enable HT caps
+ print "ht_capab=${ht_caps}"
+
++ # Wider Channels
++ print "vht_oper_chwidth=${vht_oper_chwidth}"
++
+ print
+ ) >> ${file}
+
+diff --git a/src/helpers/hostapd-config-helper b/src/helpers/hostapd-config-helper
+index 30d3456..8af3097 100644
+--- a/src/helpers/hostapd-config-helper
++++ b/src/helpers/hostapd-config-helper
+@@ -40,6 +40,7 @@ case "${action}" in
+ hostapd_config_write ${port} ${config_file} \
+ --broadcast-ssid="${BROADCAST_SSID}" \
+ --channel="${CHANNEL}" \
++ --channel-bandwidth="${CHANNEL_BANDWIDTH}" \
+ --dfs="${DFS}" \
+ --encryption="${ENCRYPTION}" \
+ --key="${KEY}" \
+diff --git a/src/hooks/ports/wireless-ap b/src/hooks/ports/wireless-ap
+index 5e00014..983f0f9 100644
+--- a/src/hooks/ports/wireless-ap
++++ b/src/hooks/ports/wireless-ap
+@@ -127,7 +127,7 @@ hook_parse_cmdline() {
+
+ # Channel bandwidth must match the mode
+ if isset CHANNEL_BANDWIDTH && ! wireless_channel_bandwidth_is_valid "${MODE}" "${CHANNEL_BANDWIDTH}"; then
+- error "Channel Bandwidth '${CHANNEL_BANDWIDTH}' is not supported"
++ error "Channel Bandwidth '${CHANNEL_BANDWIDTH}' is not supported for ${MODE}"
+ return ${EXIT_ERROR}
+ fi
+
+--
+2.39.2
+
diff --git a/network/patches/0021-wireless-ap-Enable-ACS-only-for-ath-devices.patch b/network/patches/0021-wireless-ap-Enable-ACS-only-for-ath-devices.patch
new file mode 100644
index 000000000..2bd7a17f7
--- /dev/null
+++ b/network/patches/0021-wireless-ap-Enable-ACS-only-for-ath-devices.patch
@@ -0,0 +1,117 @@
+From 1b4aa2ca01c5d0bd45213187e6a58b4cc0f57547 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Thu, 21 Mar 2019 20:22:56 +0100
+Subject: [PATCH 021/304] wireless-ap: Enable ACS only for ath* devices
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.hostapd | 6 ++++++
+ src/functions/functions.phy | 22 ++++++++++++++++++++++
+ src/functions/functions.wireless | 13 +++++++++++++
+ src/hooks/ports/wireless-ap | 9 ++++++++-
+ 4 files changed, 49 insertions(+), 1 deletion(-)
+
+diff --git a/src/functions/functions.hostapd b/src/functions/functions.hostapd
+index 57f8c1e..9024ab2 100644
+--- a/src/functions/functions.hostapd
++++ b/src/functions/functions.hostapd
+@@ -111,6 +111,12 @@ hostapd_config_write() {
+ assert isset key
+ fi
+
++ # With channel 0, ACS must be supported
++ if [ ${channel} -eq 0 ] && ! wireless_supports_acs "${device}"; then
++ error "ACS requested, but not supported by ${device}"
++ return ${EXIT_ERROR}
++ fi
++
+ # Check channel bandwidth for validity
+ if isset channel_bandwidth && ! wireless_channel_bandwidth_is_valid "${mode}" "${channel_bandwidth}"; then
+ error "Invalid channel bandwidth for ${mode}: ${channel_bandwidth}"
+diff --git a/src/functions/functions.phy b/src/functions/functions.phy
+index 064ca7b..ee0f2a2 100644
+--- a/src/functions/functions.phy
++++ b/src/functions/functions.phy
+@@ -189,6 +189,28 @@ phy_supports_ht_capability() {
+ list_match "${capability}" $(__phy_list_ht_capabilities "${phy}")
+ }
+
++# Returns TRUE if the PHY supports ACS
++phy_supports_acs() {
++ local phy="${1}"
++ assert isset phy
++
++ local driver="$(phy_get_driver "${phy}")"
++ if ! isset driver; then
++ return ${EXIT_ERROR}
++ fi
++
++ # This is basically a whilelist of drivers which support this
++ # There is no better detection
++ case "${driver}" in
++ ath10k_*|ath9k|ath5k)
++ return ${EXIT_TRUE}
++ ;;
++ *)
++ return ${EXIT_FALSE}
++ ;;
++ esac
++}
++
+ # Returns TRUE if the PHY supports DFS
+ phy_supports_dfs() {
+ local phy="${1}"
+diff --git a/src/functions/functions.wireless b/src/functions/functions.wireless
+index 0437d27..9e72fe0 100644
+--- a/src/functions/functions.wireless
++++ b/src/functions/functions.wireless
+@@ -536,6 +536,19 @@ wireless_get_vht_caps() {
+ network-phy-list-vht-caps "${phy}"
+ }
+
++wireless_supports_acs() {
++ local device="${1}"
++ assert isset device
++
++ local phy="$(device_get_phy "${device}")"
++ if ! isset phy; then
++ log ERROR "Could not determine PHY for ${device}"
++ return ${EXIT_ERROR}
++ fi
++
++ phy_supports_acs "${phy}"
++}
++
+ wireless_supports_dfs() {
+ local device="${1}"
+ assert isset device
+diff --git a/src/hooks/ports/wireless-ap b/src/hooks/ports/wireless-ap
+index 983f0f9..0c42b61 100644
+--- a/src/hooks/ports/wireless-ap
++++ b/src/hooks/ports/wireless-ap
+@@ -28,7 +28,7 @@ HOOK_SETTINGS="${HOOK_SETTINGS} ENCRYPTION KEY SSID"
+
+ ADDRESS=$(mac_generate)
+ BROADCAST_SSID=on
+-CHANNEL=0
++CHANNEL=
+ CHANNEL_BANDWIDTH=
+ ENCRYPTION=""
+ KEY=""
+@@ -125,6 +125,13 @@ hook_parse_cmdline() {
+ return ${EXIT_ERROR}
+ fi
+
++ # Automatically enable ACS if no channel is set and ACS is available
++ if ! isset CHANNEL && phy_supports_acs "${PHY}"; then
++ CHANNEL="0"
++
++ log INFO "Automatic Channel Selection (ACS) enabled"
++ fi
++
+ # Channel bandwidth must match the mode
+ if isset CHANNEL_BANDWIDTH && ! wireless_channel_bandwidth_is_valid "${MODE}" "${CHANNEL_BANDWIDTH}"; then
+ error "Channel Bandwidth '${CHANNEL_BANDWIDTH}' is not supported for ${MODE}"
+--
+2.39.2
+
diff --git a/network/patches/0022-wireless-ap-Allow-setting-the-wireless-environment-i.patch b/network/patches/0022-wireless-ap-Allow-setting-the-wireless-environment-i.patch
new file mode 100644
index 000000000..57c2a889c
--- /dev/null
+++ b/network/patches/0022-wireless-ap-Allow-setting-the-wireless-environment-i.patch
@@ -0,0 +1,164 @@
+From 7842c2ce43d1f185e65bb9f2beead96376e2bd34 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Thu, 21 Mar 2019 22:14:43 +0100
+Subject: [PATCH 022/304] wireless-ap: Allow setting the wireless environment
+ (indoor/outdoor)
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.hostapd | 26 +++++++++++++++++++++++++-
+ src/functions/functions.wireless | 9 +++++++++
+ src/helpers/hostapd-config-helper | 1 +
+ src/hooks/ports/wireless-ap | 14 +++++++++++++-
+ 4 files changed, 48 insertions(+), 2 deletions(-)
+
+diff --git a/src/functions/functions.hostapd b/src/functions/functions.hostapd
+index 9024ab2..94b06db 100644
+--- a/src/functions/functions.hostapd
++++ b/src/functions/functions.hostapd
+@@ -39,6 +39,7 @@ hostapd_config_write() {
+ local country_code="$(wireless_get_reg_domain)"
+ local dfs="on"
+ local encryption
++ local environment="${WIRELESS_DEFAULT_ENVIRONMENT}"
+ local key
+ local mode
+ local ssid
+@@ -61,6 +62,9 @@ hostapd_config_write() {
+ --encryption=*)
+ encryption=$(cli_get_val "${1}")
+ ;;
++ --environment=*)
++ environment="$(cli_get_val "${1}")"
++ ;;
+ --key=*)
+ key=$(cli_get_val "${1}")
+ ;;
+@@ -111,6 +115,12 @@ hostapd_config_write() {
+ assert isset key
+ fi
+
++ # Check wireless environment
++ if ! wireless_environment_is_valid "${environment}"; then
++ error "Invalid wireless environment: ${environment}"
++ return ${EXIT_ERROR}
++ fi
++
+ # With channel 0, ACS must be supported
+ if [ ${channel} -eq 0 ] && ! wireless_supports_acs "${device}"; then
+ error "ACS requested, but not supported by ${device}"
+@@ -208,6 +218,21 @@ hostapd_config_write() {
+
+ # Advertise country code and maximum transmission power
+ print "ieee80211d=1"
++ print "country_code=${country_code}"
++
++ # Wireless Environment
++ case "${environment}" in
++ indoor)
++ print "country3=0x49"
++ country3
++ ;;
++ outdoor)
++ print "country3=0x4f"
++ ;;
++ indoor+outdoor)
++ print "country3=0x20"
++ ;;
++ esac
+
+ # Enable Radar Detection
+ if enabled dfs && wireless_supports_dfs "${device}"; then
+@@ -230,7 +255,6 @@ hostapd_config_write() {
+ fi
+
+ print "channel=${channel}"
+- print "country_code=${country_code}"
+ print "ignore_broadcast_ssid=${ignore_broadcast_ssid}"
+
+ if contains_spaces "${ssid}"; then
+diff --git a/src/functions/functions.wireless b/src/functions/functions.wireless
+index 9e72fe0..12204c0 100644
+--- a/src/functions/functions.wireless
++++ b/src/functions/functions.wireless
+@@ -37,6 +37,9 @@ declare -A WIRELESS_CHANNEL_BANDWIDTHS=(
+ ["802.11g"]="20 40"
+ )
+
++WIRELESS_ENVIRONMENTS=( "indoor+outdoor" "indoor" "outdoor" )
++WIRELESS_DEFAULT_ENVIRONMENT="${WIRELESS_ENVIRONMENTS[0]}"
++
+ cli_wireless() {
+ local action=${1}
+ shift 1
+@@ -561,3 +564,9 @@ wireless_supports_dfs() {
+
+ phy_supports_dfs "${phy}"
+ }
++
++wireless_environment_is_valid() {
++ local environment="${1}"
++
++ list_match "${environment}" "${WIRELESS_ENVIRONMENTS[@]}"
++}
+diff --git a/src/helpers/hostapd-config-helper b/src/helpers/hostapd-config-helper
+index 8af3097..d3292c3 100644
+--- a/src/helpers/hostapd-config-helper
++++ b/src/helpers/hostapd-config-helper
+@@ -43,6 +43,7 @@ case "${action}" in
+ --channel-bandwidth="${CHANNEL_BANDWIDTH}" \
+ --dfs="${DFS}" \
+ --encryption="${ENCRYPTION}" \
++ --environment="${ENVIRONMENT}" \
+ --key="${KEY}" \
+ --mode="${MODE}" \
+ --ssid="${SSID}" \
+diff --git a/src/hooks/ports/wireless-ap b/src/hooks/ports/wireless-ap
+index 0c42b61..6db39b8 100644
+--- a/src/hooks/ports/wireless-ap
++++ b/src/hooks/ports/wireless-ap
+@@ -24,7 +24,7 @@
+ HOOK_PORT_PATTERN="${PORT_PATTERN_ACCESSPOINT}"
+
+ HOOK_SETTINGS="ADDRESS BROADCAST_SSID CHANNEL CHANNEL_BANDWIDTH DFS MODE PHY"
+-HOOK_SETTINGS="${HOOK_SETTINGS} ENCRYPTION KEY SSID"
++HOOK_SETTINGS="${HOOK_SETTINGS} ENCRYPTION ENVIRONMENT KEY SSID"
+
+ ADDRESS=$(mac_generate)
+ BROADCAST_SSID=on
+@@ -37,6 +37,8 @@ SSID=
+ # Perform radar detection by default when possible
+ DFS="on"
+
++ENVIRONMENT="${WIRELESS_DEFAULT_ENVIRONMENT}"
++
+ hook_check_settings() {
+ assert isset ADDRESS
+ assert ismac ADDRESS
+@@ -57,6 +59,8 @@ hook_check_settings() {
+ assert [ ${#KEY} -ge 8 ]
+ assert [ ${#KEY} -le 63 ]
+ fi
++
++ assert wireless_environment_is_valid "${ENVIRONMENT}"
+ }
+
+ hook_parse_cmdline() {
+@@ -86,6 +90,14 @@ hook_parse_cmdline() {
+ --encryption=*)
+ ENCRYPTION=$(cli_get_val "${1}")
+ ;;
++ --environment=*)
++ ENVIRONMENT="$(cli_get_val "${1}")"
++
++ if ! wireless_environment_is_valid "${ENVIRONMENT}"; then
++ error "Invalid wireless environment: ${ENVIRONMENT}"
++ return ${EXIT_ERROR}
++ fi
++ ;;
+ --key=*)
+ KEY=$(cli_get_val "${1}")
+ ;;
+--
+2.39.2
+
diff --git a/network/patches/0023-hostapd-Remove-now-useless-comment.patch b/network/patches/0023-hostapd-Remove-now-useless-comment.patch
new file mode 100644
index 000000000..0e224a2c9
--- /dev/null
+++ b/network/patches/0023-hostapd-Remove-now-useless-comment.patch
@@ -0,0 +1,26 @@
+From 09f00f0df436a3280b93b7570c6b9ae3152cf21e Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 22 Mar 2019 11:40:32 +0100
+Subject: [PATCH 023/304] hostapd: Remove now useless comment
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.hostapd | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/src/functions/functions.hostapd b/src/functions/functions.hostapd
+index 94b06db..eb177fe 100644
+--- a/src/functions/functions.hostapd
++++ b/src/functions/functions.hostapd
+@@ -214,8 +214,6 @@ hostapd_config_write() {
+ fi
+
+ (
+- print "# Default settings"
+-
+ # Advertise country code and maximum transmission power
+ print "ieee80211d=1"
+ print "country_code=${country_code}"
+--
+2.39.2
+
diff --git a/network/patches/0024-hostapd-Always-enable-Transmit-Power-Control.patch b/network/patches/0024-hostapd-Always-enable-Transmit-Power-Control.patch
new file mode 100644
index 000000000..bac1030a2
--- /dev/null
+++ b/network/patches/0024-hostapd-Always-enable-Transmit-Power-Control.patch
@@ -0,0 +1,30 @@
+From 9602617288e200c0935d5888746f58c23b2f7af7 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 22 Mar 2019 11:45:03 +0100
+Subject: [PATCH 024/304] hostapd: Always enable Transmit Power Control
+
+Also advertise this to clients
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.hostapd | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/src/functions/functions.hostapd b/src/functions/functions.hostapd
+index eb177fe..dd52e56 100644
+--- a/src/functions/functions.hostapd
++++ b/src/functions/functions.hostapd
+@@ -232,6 +232,10 @@ hostapd_config_write() {
+ ;;
+ esac
+
++ # Always advertise TPC
++ print "local_pwr_constraint=3"
++ print "spectrum_mgmt_required=1"
++
+ # Enable Radar Detection
+ if enabled dfs && wireless_supports_dfs "${device}"; then
+ print "ieee80211h=1"
+--
+2.39.2
+
diff --git a/network/patches/0025-hostapd-Set-default-WMM-settings.patch b/network/patches/0025-hostapd-Set-default-WMM-settings.patch
new file mode 100644
index 000000000..7e8e2dab1
--- /dev/null
+++ b/network/patches/0025-hostapd-Set-default-WMM-settings.patch
@@ -0,0 +1,72 @@
+From fcdbed86e00c02550682c110d768ff9a557ba8d7 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 22 Mar 2019 12:02:25 +0100
+Subject: [PATCH 025/304] hostapd: Set default WMM settings
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.hostapd | 47 ++++++++++++++++++++++++++++++++-
+ 1 file changed, 46 insertions(+), 1 deletion(-)
+
+diff --git a/src/functions/functions.hostapd b/src/functions/functions.hostapd
+index dd52e56..911a141 100644
+--- a/src/functions/functions.hostapd
++++ b/src/functions/functions.hostapd
+@@ -265,8 +265,53 @@ hostapd_config_write() {
+ print "ssid=${ssid}"
+ fi
+
+- # WMM
++ # WMM & WMM-PS Unscheduled Automatic Power Save Delivery
+ print "wmm_enabled=${wmm}"
++ print "uapsd_advertisement_enabled=1"
++
++ # Low Priority / AC_BK = Background
++ print "wmm_ac_bk_cwmin=4"
++ print "wmm_ac_bk_cwmax=10"
++ print "wmm_ac_bk_aifs=7"
++ print "wmm_ac_bk_txop_limit=0"
++ print "wmm_ac_bk_acm=0"
++ print "tx_queue_data3_aifs=7"
++ print "tx_queue_data3_cwmin=15"
++ print "tx_queue_data3_cwmax=1023"
++ print "tx_queue_data3_burst=0"
++
++ # Normal Priority / AC_BE = Best Effort
++ print "wmm_ac_be_aifs=3"
++ print "wmm_ac_be_cwmin=4"
++ print "wmm_ac_be_cwmax=10"
++ print "wmm_ac_be_txop_limit=0"
++ print "wmm_ac_be_acm=0"
++ print "tx_queue_data2_aifs=3"
++ print "tx_queue_data2_cwmin=15"
++ print "tx_queue_data2_cwmax=63"
++ print "tx_queue_data2_burst=0"
++
++ # High Priority / AC_VI = Video
++ print "wmm_ac_vi_aifs=2"
++ print "wmm_ac_vi_cwmin=3"
++ print "wmm_ac_vi_cwmax=4"
++ print "wmm_ac_vi_txop_limit=94"
++ print "wmm_ac_vi_acm=0"
++ print "tx_queue_data1_aifs=1"
++ print "tx_queue_data1_cwmin=7"
++ print "tx_queue_data1_cwmax=15"
++ print "tx_queue_data1_burst=3.0"
++
++ # Highest Priority / AC_VO = Voice
++ print "wmm_ac_vo_aifs=2"
++ print "wmm_ac_vo_cwmin=2"
++ print "wmm_ac_vo_cwmax=3"
++ print "wmm_ac_vo_txop_limit=47"
++ print "wmm_ac_vo_acm=0"
++ print "tx_queue_data0_aifs=1"
++ print "tx_queue_data0_cwmin=3"
++ print "tx_queue_data0_cwmax=7"
++ print "tx_queue_data0_burst=1.5"
+
+ # Enable VHT caps
+ if isset vht_caps; then
+--
+2.39.2
+
diff --git a/network/patches/0026-hostapd-Kick-stations-that-are-too-far-away.patch b/network/patches/0026-hostapd-Kick-stations-that-are-too-far-away.patch
new file mode 100644
index 000000000..09f16b114
--- /dev/null
+++ b/network/patches/0026-hostapd-Kick-stations-that-are-too-far-away.patch
@@ -0,0 +1,27 @@
+From 4d4bca7eec3d036e1cbed28fc823d06d08008d78 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 22 Mar 2019 12:02:46 +0100
+Subject: [PATCH 026/304] hostapd: Kick stations that are too far away
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.hostapd | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/functions/functions.hostapd b/src/functions/functions.hostapd
+index 911a141..8b281cc 100644
+--- a/src/functions/functions.hostapd
++++ b/src/functions/functions.hostapd
+@@ -265,6 +265,9 @@ hostapd_config_write() {
+ print "ssid=${ssid}"
+ fi
+
++ # Kick stations that are too far away
++ print "disassoc_low_ack=1"
++
+ # WMM & WMM-PS Unscheduled Automatic Power Save Delivery
+ print "wmm_enabled=${wmm}"
+ print "uapsd_advertisement_enabled=1"
+--
+2.39.2
+
diff --git a/network/patches/0027-hostapd-Always-qoute-SSID.patch b/network/patches/0027-hostapd-Always-qoute-SSID.patch
new file mode 100644
index 000000000..9e65758fa
--- /dev/null
+++ b/network/patches/0027-hostapd-Always-qoute-SSID.patch
@@ -0,0 +1,34 @@
+From 4873f3299807fb0fde7c7f71736dd9318c708ca1 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 22 Mar 2019 12:08:08 +0100
+Subject: [PATCH 027/304] hostapd: Always qoute SSID
+
+hostapd has a new parameter that always allows us to set
+the SSID as a quoted UTF8 string
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.hostapd | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/src/functions/functions.hostapd b/src/functions/functions.hostapd
+index 8b281cc..245b4cf 100644
+--- a/src/functions/functions.hostapd
++++ b/src/functions/functions.hostapd
+@@ -259,11 +259,8 @@ hostapd_config_write() {
+ print "channel=${channel}"
+ print "ignore_broadcast_ssid=${ignore_broadcast_ssid}"
+
+- if contains_spaces "${ssid}"; then
+- print "ssid=\"${ssid}\""
+- else
+- print "ssid=${ssid}"
+- fi
++ print "ssid2=\"${ssid}\""
++ print "utf8_ssid=1"
+
+ # Kick stations that are too far away
+ print "disassoc_low_ack=1"
+--
+2.39.2
+
diff --git a/network/patches/0028-wireless-ap-Allow-to-enable-disable-802.11w-Manageme.patch b/network/patches/0028-wireless-ap-Allow-to-enable-disable-802.11w-Manageme.patch
new file mode 100644
index 000000000..dc0872607
--- /dev/null
+++ b/network/patches/0028-wireless-ap-Allow-to-enable-disable-802.11w-Manageme.patch
@@ -0,0 +1,130 @@
+From 34ca39360410ab03c7909494e6291bbb65622e3d Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 22 Mar 2019 12:27:38 +0100
+Subject: [PATCH 028/304] wireless-ap: Allow to enable/disable 802.11w
+ Management Frame Protection
+
+This is disabled by default, because loads of stations have issues
+associating with an AP that has 802.11w enabled.
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.hostapd | 17 +++++++++++++++++
+ src/helpers/hostapd-config-helper | 1 +
+ src/hooks/ports/wireless-ap | 18 ++++++++++++++++++
+ 3 files changed, 36 insertions(+)
+
+diff --git a/src/functions/functions.hostapd b/src/functions/functions.hostapd
+index 245b4cf..bf0c5fc 100644
+--- a/src/functions/functions.hostapd
++++ b/src/functions/functions.hostapd
+@@ -41,6 +41,7 @@ hostapd_config_write() {
+ local encryption
+ local environment="${WIRELESS_DEFAULT_ENVIRONMENT}"
+ local key
++ local mfp="off"
+ local mode
+ local ssid
+ local wmm="1"
+@@ -68,6 +69,9 @@ hostapd_config_write() {
+ --key=*)
+ key=$(cli_get_val "${1}")
+ ;;
++ --mfp=*)
++ mfp="$(cli_get_val "${1}")"
++ ;;
+ --mode=*)
+ mode=$(cli_get_val "${1}")
+
+@@ -133,6 +137,12 @@ hostapd_config_write() {
+ return ${EXIT_ERROR}
+ fi
+
++ # Management Frame Proection
++ if ! isbool mfp; then
++ error "Invalid value for --mfp: ${mfp}"
++ return ${EXIT_ERROR}
++ fi
++
+ # 802.11ac/n flags
+ local ieee80211ac
+ local ieee80211n
+@@ -325,6 +335,13 @@ hostapd_config_write() {
+ print "vht_oper_chwidth=${vht_oper_chwidth}"
+
+ print
++
++ # 802.11w - Management Frame Protection (MFP)
++ if enabled mfp; then
++ print "ieee80211w=2" # required
++ else
++ print "ieee80211w=0"
++ fi
+ ) >> ${file}
+
+ # Control interface.
+diff --git a/src/helpers/hostapd-config-helper b/src/helpers/hostapd-config-helper
+index d3292c3..7af723d 100644
+--- a/src/helpers/hostapd-config-helper
++++ b/src/helpers/hostapd-config-helper
+@@ -45,6 +45,7 @@ case "${action}" in
+ --encryption="${ENCRYPTION}" \
+ --environment="${ENVIRONMENT}" \
+ --key="${KEY}" \
++ --mfp="${MFP}" \
+ --mode="${MODE}" \
+ --ssid="${SSID}" \
+ || exit $?
+diff --git a/src/hooks/ports/wireless-ap b/src/hooks/ports/wireless-ap
+index 6db39b8..7073cbc 100644
+--- a/src/hooks/ports/wireless-ap
++++ b/src/hooks/ports/wireless-ap
+@@ -25,6 +25,7 @@ HOOK_PORT_PATTERN="${PORT_PATTERN_ACCESSPOINT}"
+
+ HOOK_SETTINGS="ADDRESS BROADCAST_SSID CHANNEL CHANNEL_BANDWIDTH DFS MODE PHY"
+ HOOK_SETTINGS="${HOOK_SETTINGS} ENCRYPTION ENVIRONMENT KEY SSID"
++HOOK_SETTINGS="${HOOK_SETTINGS} MFP"
+
+ ADDRESS=$(mac_generate)
+ BROADCAST_SSID=on
+@@ -37,6 +38,10 @@ SSID=
+ # Perform radar detection by default when possible
+ DFS="on"
+
++# 802.11w - Management Frame Protection
++# Disable by default because many clients cannot connect when enabled
++MFP="off"
++
+ ENVIRONMENT="${WIRELESS_DEFAULT_ENVIRONMENT}"
+
+ hook_check_settings() {
+@@ -46,6 +51,7 @@ hook_check_settings() {
+ assert isbool BROADCAST_SSID
+ assert isset CHANNEL
+ assert isbool DFS
++ assert isbool MFP
+ assert isset MODE
+ assert isoneof MODE ${HOSTAPD_SUPPORTED_MODES}
+ assert isset PHY
+@@ -104,6 +110,18 @@ hook_parse_cmdline() {
+ --mac=*)
+ ADDRESS=$(cli_get_val "${1}")
+ ;;
++ --mfp=*)
++ MFP="$(cli_get_val "${1}")"
++
++ if enabled MFP; then
++ MFP="on"
++ elif disabled MFP; then
++ MFP="off"
++ else
++ error "Invalid value for --mfp: ${MFP}"
++ return ${EXIT_ERROR}
++ fi
++ ;;
+ --mode=*)
+ MODE=$(cli_get_val "${1}")
+
+--
+2.39.2
+
diff --git a/network/patches/0029-network-Show-when-a-PHY-supports-ACS.patch b/network/patches/0029-network-Show-when-a-PHY-supports-ACS.patch
new file mode 100644
index 000000000..f18008404
--- /dev/null
+++ b/network/patches/0029-network-Show-when-a-PHY-supports-ACS.patch
@@ -0,0 +1,26 @@
+From 304b20a828e0987943ccda6f1c4321682195a67a Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 29 Mar 2019 18:46:25 +0100
+Subject: [PATCH 029/304] network: Show when a PHY supports ACS
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/network | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/src/network b/src/network
+index de2e663..3535133 100644
+--- a/src/network
++++ b/src/network
+@@ -279,6 +279,8 @@ cli_device_status_phy() {
+
+ cli_headline 2 "Features"
+
++ cli_print_fmt1 2 "Automatic Channel Selection" \
++ "$(phy_supports_acs "${phy}" && print "Supported" || print "Not Supported")"
+ cli_print_fmt1 2 "DFS" \
+ "$(phy_supports_dfs "${phy}" && print "Supported" || print "Not Supported")"
+
+--
+2.39.2
+
diff --git a/network/patches/0030-Move-cli_device_status_phy-to-functions.phy.patch b/network/patches/0030-Move-cli_device_status_phy-to-functions.phy.patch
new file mode 100644
index 000000000..eaf70d3fd
--- /dev/null
+++ b/network/patches/0030-Move-cli_device_status_phy-to-functions.phy.patch
@@ -0,0 +1,112 @@
+From 01648ba604f9d0c922193553cfcb36dae0bfddaf Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 29 Mar 2019 18:47:47 +0100
+Subject: [PATCH 030/304] Move cli_device_status_phy() to functions.phy
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.phy | 38 +++++++++++++++++++++++++++++++++++++
+ src/network | 38 -------------------------------------
+ 2 files changed, 38 insertions(+), 38 deletions(-)
+
+diff --git a/src/functions/functions.phy b/src/functions/functions.phy
+index ee0f2a2..120117c 100644
+--- a/src/functions/functions.phy
++++ b/src/functions/functions.phy
+@@ -21,6 +21,44 @@
+
+ PHY_DIR="/sys/class/ieee80211"
+
++cli_device_status_phy() {
++ local phy="${1}"
++ assert phy_exists "${phy}"
++
++ local address="$(phy_get_address "${phy}")"
++ cli_print_fmt1 1 "Address" "${address}"
++
++ # Show kernel module
++ local driver="$(phy_get_driver "${phy}")"
++ if isset driver; then
++ cli_print_fmt1 1 "Driver" "${driver}"
++ fi
++
++ cli_space
++
++ local devices="$(phy_get_devices "${phy}")"
++ if isset devices; then
++ cli_headline 2 "Soft interfaces"
++
++ local device
++ for device in ${devices}; do
++ cli_print 2 "* %s" "${device}"
++ done
++ cli_space
++ fi
++
++ cli_headline 2 "Features"
++
++ cli_print_fmt1 2 "Automatic Channel Selection" \
++ "$(phy_supports_acs "${phy}" && print "Supported" || print "Not Supported")"
++ cli_print_fmt1 2 "DFS" \
++ "$(phy_supports_dfs "${phy}" && print "Supported" || print "Not Supported")"
++
++ cli_space
++
++ return ${EXIT_OK}
++}
++
+ phy_dir() {
+ local phy=${1}
+
+diff --git a/src/network b/src/network
+index 3535133..300ba94 100644
+--- a/src/network
++++ b/src/network
+@@ -251,44 +251,6 @@ cli_device_status_serial() {
+ fi
+ }
+
+-cli_device_status_phy() {
+- local phy="${1}"
+- assert phy_exists "${phy}"
+-
+- local address="$(phy_get_address "${phy}")"
+- cli_print_fmt1 1 "Address" "${address}"
+-
+- # Show kernel module
+- local driver="$(phy_get_driver "${phy}")"
+- if isset driver; then
+- cli_print_fmt1 1 "Driver" "${driver}"
+- fi
+-
+- cli_space
+-
+- local devices="$(phy_get_devices "${phy}")"
+- if isset devices; then
+- cli_headline 2 "Soft interfaces"
+-
+- local device
+- for device in ${devices}; do
+- cli_print 2 "* %s" "${device}"
+- done
+- cli_space
+- fi
+-
+- cli_headline 2 "Features"
+-
+- cli_print_fmt1 2 "Automatic Channel Selection" \
+- "$(phy_supports_acs "${phy}" && print "Supported" || print "Not Supported")"
+- cli_print_fmt1 2 "DFS" \
+- "$(phy_supports_dfs "${phy}" && print "Supported" || print "Not Supported")"
+-
+- cli_space
+-
+- return ${EXIT_OK}
+-}
+-
+ cli_device_discover() {
+ local device=${1}
+ shift
+--
+2.39.2
+
diff --git a/network/patches/0031-hostapd-Dump-config-file-in-debug-mode.patch b/network/patches/0031-hostapd-Dump-config-file-in-debug-mode.patch
new file mode 100644
index 000000000..26e05b097
--- /dev/null
+++ b/network/patches/0031-hostapd-Dump-config-file-in-debug-mode.patch
@@ -0,0 +1,52 @@
+From 7c91c167d10cbe3d390f0dc8c426eed0abf243b4 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 30 Mar 2019 11:26:38 +0100
+Subject: [PATCH 031/304] hostapd: Dump config file in debug mode
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.hostapd | 3 +++
+ src/functions/functions.util | 13 +++++++++++++
+ 2 files changed, 16 insertions(+)
+
+diff --git a/src/functions/functions.hostapd b/src/functions/functions.hostapd
+index bf0c5fc..737bd1a 100644
+--- a/src/functions/functions.hostapd
++++ b/src/functions/functions.hostapd
+@@ -378,6 +378,9 @@ hostapd_config_write() {
+ ) >> ${file}
+ fi
+
++ # Log configuration file
++ file_to_log DEBUG "${file}"
++
+ return ${EXIT_OK}
+ }
+
+diff --git a/src/functions/functions.util b/src/functions/functions.util
+index b767423..4c1dbb4 100644
+--- a/src/functions/functions.util
++++ b/src/functions/functions.util
+@@ -248,6 +248,19 @@ file_get_age() {
+ return ${EXIT_ERROR}
+ }
+
++file_to_log() {
++ local level="${1}"
++ assert isset level
++
++ local file="${2}"
++ assert file_exists "${file}"
++
++ local line
++ while read line; do
++ log "${level}" "${line}"
++ done < "${file}"
++}
++
+ make_directory() {
+ local path="${1}"
+
+--
+2.39.2
+
diff --git a/network/patches/0032-wireless-ap-Automatically-enable-all-supported-ciphe.patch b/network/patches/0032-wireless-ap-Automatically-enable-all-supported-ciphe.patch
new file mode 100644
index 000000000..7277180b2
--- /dev/null
+++ b/network/patches/0032-wireless-ap-Automatically-enable-all-supported-ciphe.patch
@@ -0,0 +1,519 @@
+From 2e4e3c88ba2543e5bf4bf3f92977990c281a00bb Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 30 Mar 2019 11:27:50 +0100
+Subject: [PATCH 032/304] wireless-ap: Automatically enable all supported
+ ciphers
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 7 ++
+ src/functions/functions.hostapd | 65 +++++++++++-
+ src/functions/functions.phy | 17 +++
+ src/libnetwork/libnetwork.sym | 37 ++++---
+ src/libnetwork/network/phy.h | 22 ++++
+ src/libnetwork/phy.c | 149 +++++++++++++++++++++++++++
+ src/utils/.gitignore | 1 +
+ src/utils/network-phy-list-ciphers.c | 61 +++++++++++
+ 8 files changed, 340 insertions(+), 19 deletions(-)
+ create mode 100644 src/utils/network-phy-list-ciphers.c
+
+diff --git a/Makefile.am b/Makefile.am
+index 0139f95..1b5e7e9 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -301,6 +301,7 @@ EXTRA_DIST += \
+
+ util_PROGRAMS = \
+ src/utils/network-phy-list-channels \
++ src/utils/network-phy-list-ciphers \
+ src/utils/network-phy-list-ht-caps \
+ src/utils/network-phy-list-vht-caps
+
+@@ -310,6 +311,12 @@ src_utils_network_phy_list_channels_SOURCES = \
+ src_utils_network_phy_list_channels_LDADD = \
+ src/libnetwork.la
+
++src_utils_network_phy_list_ciphers_SOURCES = \
++ src/utils/network-phy-list-ciphers.c
++
++src_utils_network_phy_list_ciphers_LDADD = \
++ src/libnetwork.la
++
+ src_utils_network_phy_list_ht_caps_SOURCES = \
+ src/utils/network-phy-list-ht-caps.c
+
+diff --git a/src/functions/functions.hostapd b/src/functions/functions.hostapd
+index 737bd1a..6111457 100644
+--- a/src/functions/functions.hostapd
++++ b/src/functions/functions.hostapd
+@@ -23,6 +23,19 @@ HOSTAPD_CONTROL_INTERFACE_DIR="/run/hostapd/ctrl"
+
+ HOSTAPD_SUPPORTED_MODES="802.11a 802.11a/n 802.11ac 802.11g 802.11g/n"
+
++HOSTAPD_SUPPORTED_PAIRWISE_CIPHERS=(
++ "GCMP-256" # Galois/counter mode protocol with 256 bit key
++ "CCMP-256" # AES in Counter mode with CBC-MAC with 256 bit key
++ "GCMP-128" # Galois/counter mode protocol with 128 bit key
++ "CCMP-128" # AES in Counter mode with CBC-MAC with 128 bit key
++)
++
++# This must be supported by all stations on the network and therefore
++# can effectively only be CCMP
++HOSTAPD_SUPPORTED_GROUP_CIPHERS=(
++ "CCMP-128"
++)
++
+ hostapd_config_write() {
+ local device=${1}
+ assert isset device
+@@ -33,6 +46,16 @@ hostapd_config_write() {
+ # Shift the device and file argument.
+ shift 2
+
++ # Device must exist
++ if ! device_exists "${device}"; then
++ error "Cannot write hostapd configuration for non-existant device: ${device}"
++ return ${EXIT_ERROR}
++ fi
++
++ # Get the phy for device
++ local phy="$(device_get_phy "${device}")"
++ assert isset phy
++
+ local broadcast_ssid
+ local channel
+ local channel_bandwidth
+@@ -201,6 +224,25 @@ hostapd_config_write() {
+ ;;
+ esac
+
++ # Cryptography
++ local cipher
++
++ # Get all supported pairwise ciphers
++ local pairwise_ciphers=()
++ for cipher in ${HOSTAPD_SUPPORTED_PAIRWISE_CIPHERS[*]}; do
++ if phy_supports_cipher "${phy}" "${cipher}"; then
++ pairwise_ciphers+=( "$(hostapd_cipher_name "${cipher}")" )
++ fi
++ done
++
++ # Get all supported group ciphers
++ local group_ciphers=()
++ for cipher in ${HOSTAPD_SUPPORTED_GROUP_CIPHERS[*]}; do
++ if phy_supports_cipher "${phy}" "${cipher}"; then
++ group_ciphers+=( "$(hostapd_cipher_name "${cipher}")" )
++ fi
++ done
++
+ # Create configuration directory.
+ local config_dir=$(dirname ${file})
+ mkdir -p ${HOSTAPD_CONTROL_INTERFACE_DIR} ${config_dir} 2>/dev/null
+@@ -372,8 +414,9 @@ hostapd_config_write() {
+ print "wpa=${encryption_mode}"
+ print "wpa_passphrase=${key}"
+ print "wpa_key_mgmt=WPA-PSK"
+- print "wpa_pairwise=TKIP"
+- print "rsn_pairwise=CCMP"
++ print "wpa_pairwise=${pairwise_ciphers[*]}"
++ print "rsn_pairwise=${pairwise_ciphers[*]}"
++ print "group_cipher=${group_ciphers[*]}"
+ print
+ ) >> ${file}
+ fi
+@@ -407,3 +450,21 @@ hostapd_stop() {
+
+ service_stop "hostapd(a)${device}.service"
+ }
++
++hostapd_cipher_name() {
++ local cipher="${1}"
++
++ case "${cipher}" in
++ CCMP-128)
++ print "CCMP"
++ ;;
++
++ GCMP-128)
++ print "GCMP"
++ ;;
++
++ *)
++ print "${cipher}"
++ ;;
++ esac
++}
+diff --git a/src/functions/functions.phy b/src/functions/functions.phy
+index 120117c..c06389c 100644
+--- a/src/functions/functions.phy
++++ b/src/functions/functions.phy
+@@ -208,6 +208,23 @@ phy_supports_channel() {
+ return ${EXIT_FALSE}
+ }
+
++phy_list_ciphers() {
++ local phy="${1}"
++ assert isset phy
++
++ network-phy-list-ciphers "${phy}"
++}
++
++phy_supports_cipher() {
++ local phy="${1}"
++ assert isset phy
++
++ local cipher="${2}"
++ assert isset cipher
++
++ list_match "${cipher}" $(phy_list_ciphers "${phy}")
++}
++
+ __phy_list_ht_capabilities() {
+ local phy="${1}"
+ assert isset phy
+diff --git a/src/libnetwork/libnetwork.sym b/src/libnetwork/libnetwork.sym
+index 593c4a2..034d43f 100644
+--- a/src/libnetwork/libnetwork.sym
++++ b/src/libnetwork/libnetwork.sym
+@@ -1,21 +1,24 @@
+ LIBNETWORK_0 {
+ global:
+- network_interface_get_name;
+- network_interface_new;
+- network_interface_ref;
+- network_interface_unref;
+- network_new;
+- network_phy_has_ht_capability;
+- network_phy_has_vht_capability;
+- network_phy_list_channels;
+- network_phy_list_ht_capabilities;
+- network_phy_list_vht_capabilities;
+- network_phy_new;
+- network_phy_ref;
+- network_phy_unref;
+- network_ref;
+- network_unref;
+- network_version;
++ network_interface_get_name;
++ network_interface_new;
++ network_interface_ref;
++ network_interface_unref;
++ network_new;
++ network_phy_get_cipher_string;
++ network_phy_has_ht_capability;
++ network_phy_has_vht_capability;
++ network_phy_list_channels;
++ network_phy_list_ciphers;
++ network_phy_list_ht_capabilities;
++ network_phy_list_vht_capabilities;
++ network_phy_supports_cipher;
++ network_phy_new;
++ network_phy_ref;
++ network_phy_unref;
++ network_ref;
++ network_unref;
++ network_version;
+ local:
+- *;
++ *;
+ };
+diff --git a/src/libnetwork/network/phy.h b/src/libnetwork/network/phy.h
+index 9059680..bc6dafb 100644
+--- a/src/libnetwork/network/phy.h
++++ b/src/libnetwork/network/phy.h
+@@ -30,6 +30,25 @@ int network_phy_new(struct network_ctx*, struct network_phy** phy, const char* n
+ struct network_phy* network_phy_ref(struct network_phy* phy);
+ struct network_phy* network_phy_unref(struct network_phy* phy);
+
++enum network_phy_ciphers {
++ NETWORK_PHY_CIPHER_WEP40 = (1 << 0),
++ NETWORK_PHY_CIPHER_TKIP = (1 << 1),
++ NETWORK_PHY_CIPHER_CCMP128 = (1 << 2),
++ NETWORK_PHY_CIPHER_WEP104 = (1 << 3),
++ NETWORK_PHY_CIPHER_CMAC128 = (1 << 4),
++ NETWORK_PHY_CIPHER_GCMP128 = (1 << 5),
++ NETWORK_PHY_CIPHER_GCMP256 = (1 << 6),
++ NETWORK_PHY_CIPHER_CCMP256 = (1 << 7),
++ NETWORK_PHY_CIPHER_GMAC128 = (1 << 8),
++ NETWORK_PHY_CIPHER_GMAC256 = (1 << 9),
++ NETWORK_PHY_CIPHER_CMAC256 = (1 << 10),
++ NETWORK_PHY_CIPHER_WPISMS4 = (1 << 11),
++};
++
++const char* network_phy_get_cipher_string(const enum network_phy_ciphers cipher);
++int network_phy_supports_cipher(struct network_phy* phy, const enum network_phy_ciphers cipher);
++char* network_phy_list_ciphers(struct network_phy* phy);
++
+ enum network_phy_ht_caps {
+ NETWORK_PHY_HT_CAP_RX_LDPC = (1 << 0),
+ NETWORK_PHY_HT_CAP_HT40 = (1 << 1),
+@@ -81,6 +100,9 @@ char* network_phy_list_ht_capabilities(struct network_phy* phy);
+ struct nl_msg* network_phy_make_netlink_message(struct network_phy* phy,
+ enum nl80211_commands cmd, int flags);
+
++#define foreach_cipher(cipher) \
++ for(enum network_phy_ciphers cipher = NETWORK_PHY_CIPHER_WEP40; cipher <= NETWORK_PHY_CIPHER_WPISMS4; cipher <<= 1)
++
+ #define foreach_vht_cap(cap) \
+ for(int cap = NETWORK_PHY_VHT_CAP_VHT160; cap <= NETWORK_PHY_VHT_CAP_TX_ANTENNA_PATTERN; cap <<= 1)
+
+diff --git a/src/libnetwork/phy.c b/src/libnetwork/phy.c
+index 0bf9c81..e3f2aad 100644
+--- a/src/libnetwork/phy.c
++++ b/src/libnetwork/phy.c
+@@ -52,6 +52,7 @@ struct network_phy {
+
+ TAILQ_HEAD(head, network_phy_channel) channels;
+
++ enum network_phy_ciphers ciphers;
+ ssize_t max_mpdu_length;
+ unsigned int vht_caps;
+ unsigned int ht_caps;
+@@ -80,6 +81,81 @@ static int phy_get_index(const char* name) {
+ return atoi(index);
+ }
+
++static void phy_parse_ciphers(struct network_phy* phy, __u32* ciphers, int num) {
++ enum network_phy_ciphers cipher;
++
++ // Reset value
++ phy->ciphers = 0;
++
++ for (int i = 0; i < num; i++) {
++ switch (ciphers[i]) {
++ case 0x000fac01:
++ cipher = NETWORK_PHY_CIPHER_WEP40;
++ break;
++
++ case 0x000fac02:
++ cipher = NETWORK_PHY_CIPHER_TKIP;
++ break;
++
++ case 0x000fac04:
++ cipher = NETWORK_PHY_CIPHER_CCMP128;
++ break;
++
++ case 0x000fac05:
++ cipher = NETWORK_PHY_CIPHER_WEP104;
++ break;
++
++ case 0x000fac06:
++ cipher = NETWORK_PHY_CIPHER_CMAC128;
++ break;
++
++ case 0x000fac08:
++ cipher = NETWORK_PHY_CIPHER_GCMP128;
++ break;
++
++ case 0x000fac09:
++ cipher = NETWORK_PHY_CIPHER_GCMP256;
++ break;
++
++ /*
++ I have no idea what these are. My card reports them but
++ I could not find out anything about them.
++ */
++ case 0x000fac0a:
++ case 0x000fac0b:
++ case 0x000fac0c:
++ case 0x000fac0d:
++ continue;
++
++ case 0x000fac10:
++ cipher = NETWORK_PHY_CIPHER_CCMP256;
++ break;
++
++ case 0x000fac11:
++ cipher = NETWORK_PHY_CIPHER_GMAC128;
++ break;
++
++ case 0x000fac12:
++ cipher = NETWORK_PHY_CIPHER_GMAC256;
++ break;
++
++ case 0x000fac13:
++ cipher = NETWORK_PHY_CIPHER_CMAC256;
++ break;
++
++ case 0x00147201:
++ cipher = NETWORK_PHY_CIPHER_WPISMS4;
++ break;
++
++ default:
++ ERROR(phy->ctx, "Unknown cipher found: %x\n", ciphers[i]);
++ continue;
++ }
++
++ phy->ciphers |= cipher;
++ }
++}
++
+ static void phy_parse_vht_capabilities(struct network_phy* phy, __u32 caps) {
+ // Max MPDU length
+ switch (caps & 0x3) {
+@@ -325,6 +401,13 @@ static int phy_parse_info(struct nl_msg* msg, void* data) {
+ nla_parse(attrs, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
+ genlmsg_attrlen(gnlh, 0), NULL);
+
++ // Ciphers
++ if (attrs[NL80211_ATTR_CIPHER_SUITES]) {
++ int num = nla_len(attrs[NL80211_ATTR_CIPHER_SUITES]) / sizeof(__u32);
++ __u32* ciphers = nla_data(attrs[NL80211_ATTR_CIPHER_SUITES]);
++ phy_parse_ciphers(phy, ciphers, num);
++ }
++
+ if (attrs[NL80211_ATTR_WIPHY_BANDS]) {
+ struct nlattr* nl_band;
+ int i;
+@@ -464,6 +547,72 @@ nla_put_failure:
+ return NULL;
+ }
+
++NETWORK_EXPORT const char* network_phy_get_cipher_string(const enum network_phy_ciphers cipher) {
++ switch (cipher) {
++ case NETWORK_PHY_CIPHER_WEP40:
++ return "WEP40";
++
++ case NETWORK_PHY_CIPHER_TKIP:
++ return "TKIP";
++
++ case NETWORK_PHY_CIPHER_CCMP128:
++ return "CCMP-128";
++
++ case NETWORK_PHY_CIPHER_WEP104:
++ return "WEP-104";
++
++ case NETWORK_PHY_CIPHER_CMAC128:
++ return "CMAC-128";
++
++ case NETWORK_PHY_CIPHER_GCMP128:
++ return "GCMP-128";
++
++ case NETWORK_PHY_CIPHER_GCMP256:
++ return "GCMP-256";
++
++ case NETWORK_PHY_CIPHER_CCMP256:
++ return "CCMP-256";
++
++ case NETWORK_PHY_CIPHER_GMAC128:
++ return "GMAC-128";
++
++ case NETWORK_PHY_CIPHER_GMAC256:
++ return "GMAC-256";
++
++ case NETWORK_PHY_CIPHER_CMAC256:
++ return "CMAC-256";
++
++ case NETWORK_PHY_CIPHER_WPISMS4:
++ return "WPI-SMS4";
++ }
++
++ return NULL;
++}
++
++NETWORK_EXPORT int network_phy_supports_cipher(struct network_phy* phy, const enum network_phy_ciphers cipher) {
++ return phy->ciphers & cipher;
++}
++
++NETWORK_EXPORT char* network_phy_list_ciphers(struct network_phy* phy) {
++ char* buffer = NULL;
++
++ foreach_cipher(cipher) {
++ if (network_phy_supports_cipher(phy, cipher)) {
++ const char* s = network_phy_get_cipher_string(cipher);
++
++ if (!s)
++ continue;
++
++ if (buffer)
++ asprintf(&buffer, "%s %s", buffer, s);
++ else
++ asprintf(&buffer, "%s", s);
++ }
++ }
++
++ return buffer;
++}
++
+ NETWORK_EXPORT int network_phy_has_vht_capability(struct network_phy* phy, const enum network_phy_vht_caps cap) {
+ return phy->vht_caps & cap;
+ }
+diff --git a/src/utils/.gitignore b/src/utils/.gitignore
+index 11cf3b6..df712dc 100644
+--- a/src/utils/.gitignore
++++ b/src/utils/.gitignore
+@@ -1,3 +1,4 @@
+ /network-phy-list-channels
++/network-phy-list-ciphers
+ /network-phy-list-ht-caps
+ /network-phy-list-vht-caps
+diff --git a/src/utils/network-phy-list-ciphers.c b/src/utils/network-phy-list-ciphers.c
+new file mode 100644
+index 0000000..0132c0c
+--- /dev/null
++++ b/src/utils/network-phy-list-ciphers.c
+@@ -0,0 +1,61 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2019 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#include <stdio.h>
++#include <stdlib.h>
++
++#include <network/libnetwork.h>
++#include <network/logging.h>
++#include <network/phy.h>
++
++int main(int argc, char** argv) {
++ struct network_ctx* ctx = NULL;
++ struct network_phy* phy = NULL;
++ int r;
++
++ if (argc < 2) {
++ fprintf(stderr, "No enough arguments\n");
++ r = 2;
++ goto END;
++ }
++
++ // Initialise context
++ r = network_new(&ctx);
++ if (r)
++ return r;
++
++ r = network_phy_new(ctx, &phy, argv[1]);
++ if (r) {
++ fprintf(stderr, "Could not find %s\n", argv[1]);
++ goto END;
++ }
++
++ // Print all supported ciphers
++ char* ciphers = network_phy_list_ciphers(phy);
++ if (ciphers && *ciphers) {
++ printf("%s\n", ciphers);
++ free(ciphers);
++ }
++
++END:
++ network_phy_unref(phy);
++ network_unref(ctx);
++ return r;
++}
+--
+2.39.2
+
diff --git a/network/patches/0033-hostapd-Enable-WPA-authentication-with-SHA256.patch b/network/patches/0033-hostapd-Enable-WPA-authentication-with-SHA256.patch
new file mode 100644
index 000000000..70a50a310
--- /dev/null
+++ b/network/patches/0033-hostapd-Enable-WPA-authentication-with-SHA256.patch
@@ -0,0 +1,26 @@
+From 27380e6e6343faa0b2c1a87234ecf21ecc6f0840 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 30 Mar 2019 12:47:32 +0100
+Subject: [PATCH 033/304] hostapd: Enable WPA authentication with SHA256
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.hostapd | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/functions/functions.hostapd b/src/functions/functions.hostapd
+index 6111457..79fb4db 100644
+--- a/src/functions/functions.hostapd
++++ b/src/functions/functions.hostapd
+@@ -413,7 +413,7 @@ hostapd_config_write() {
+ print "# Encryption settings"
+ print "wpa=${encryption_mode}"
+ print "wpa_passphrase=${key}"
+- print "wpa_key_mgmt=WPA-PSK"
++ print "wpa_key_mgmt=WPA-PSK-SHA256 WPA-PSK"
+ print "wpa_pairwise=${pairwise_ciphers[*]}"
+ print "rsn_pairwise=${pairwise_ciphers[*]}"
+ print "group_cipher=${group_ciphers[*]}"
+--
+2.39.2
+
diff --git a/network/patches/0034-hooks-Automatically-set-defaults-for-all-port-hooks.patch b/network/patches/0034-hooks-Automatically-set-defaults-for-all-port-hooks.patch
new file mode 100644
index 000000000..f2940d01a
--- /dev/null
+++ b/network/patches/0034-hooks-Automatically-set-defaults-for-all-port-hooks.patch
@@ -0,0 +1,98 @@
+From 4637109c42417e34c02631cd8391bccc7f2733cb Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 30 Mar 2019 13:03:59 +0100
+Subject: [PATCH 034/304] hooks: Automatically set defaults for all port hooks
+
+Before, this was broken so that all configuration parameters
+had to be passed all the time.
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.hook | 5 ++---
+ src/header-port | 4 ++++
+ src/hooks/ports/bonding | 5 ++---
+ src/hooks/ports/wireless-ap | 15 +++++----------
+ 4 files changed, 13 insertions(+), 16 deletions(-)
+
+diff --git a/src/functions/functions.hook b/src/functions/functions.hook
+index 2f3ced0..c0ebfcb 100644
+--- a/src/functions/functions.hook
++++ b/src/functions/functions.hook
+@@ -130,9 +130,8 @@ hook_set_defaults() {
+ for setting in ${HOOK_SETTINGS}; do
+ local default="DEFAULT_${setting}"
+
+- if isset ${default}; then
+- assign "${setting}" "${!default}"
+- fi
++ # Sets the default or empty
++ assign "${setting}" "${!default}"
+ done
+ }
+
+diff --git a/src/header-port b/src/header-port
+index ce1c192..141228a 100644
+--- a/src/header-port
++++ b/src/header-port
+@@ -44,6 +44,10 @@ hook_hotplug_rename() {
+
+ hook_default_new() {
+ local ${HOOK_SETTINGS}
++
++ # Import all default variables
++ hook_set_defaults
++
+ if ! hook_parse_cmdline "$@"; then
+ return ${EXIT_ERROR}
+ fi
+diff --git a/src/hooks/ports/bonding b/src/hooks/ports/bonding
+index 40d849f..f0572c3 100644
+--- a/src/hooks/ports/bonding
++++ b/src/hooks/ports/bonding
+@@ -23,9 +23,8 @@
+
+ HOOK_SETTINGS="ADDRESS MIIMON MODE OFFLOADING SLAVES"
+
+-SLAVES=""
+-MIIMON=100
+-MODE="balance-rr"
++DEFAULT_MIIMON=100
++DEFAULT_MODE="balance-rr"
+
+ hook_check_settings() {
+ assert isset ADDRESS
+diff --git a/src/hooks/ports/wireless-ap b/src/hooks/ports/wireless-ap
+index 7073cbc..2bb4977 100644
+--- a/src/hooks/ports/wireless-ap
++++ b/src/hooks/ports/wireless-ap
+@@ -27,22 +27,17 @@ HOOK_SETTINGS="ADDRESS BROADCAST_SSID CHANNEL CHANNEL_BANDWIDTH DFS MODE PHY"
+ HOOK_SETTINGS="${HOOK_SETTINGS} ENCRYPTION ENVIRONMENT KEY SSID"
+ HOOK_SETTINGS="${HOOK_SETTINGS} MFP"
+
+-ADDRESS=$(mac_generate)
+-BROADCAST_SSID=on
+-CHANNEL=
+-CHANNEL_BANDWIDTH=
+-ENCRYPTION=""
+-KEY=""
+-SSID=
++# Broadcast SSID by default
++DEFAULT_BROADCAST_SSID="on"
+
+ # Perform radar detection by default when possible
+-DFS="on"
++DEFAULT_DFS="on"
+
+ # 802.11w - Management Frame Protection
+ # Disable by default because many clients cannot connect when enabled
+-MFP="off"
++DEFAULT_MFP="off"
+
+-ENVIRONMENT="${WIRELESS_DEFAULT_ENVIRONMENT}"
++DEFAULT_ENVIRONMENT="${WIRELESS_DEFAULT_ENVIRONMENT}"
+
+ hook_check_settings() {
+ assert isset ADDRESS
+--
+2.39.2
+
diff --git a/network/patches/0035-hooks-Import-zone-default-settings-too.patch b/network/patches/0035-hooks-Import-zone-default-settings-too.patch
new file mode 100644
index 000000000..c31e8e94d
--- /dev/null
+++ b/network/patches/0035-hooks-Import-zone-default-settings-too.patch
@@ -0,0 +1,176 @@
+From 53e764a73d5a04f653a4fda3c7f8810e8de13ed8 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 30 Mar 2019 13:10:58 +0100
+Subject: [PATCH 035/304] hooks: Import zone default settings, too
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/header-zone | 5 +++++
+ src/hooks/zones/bridge | 11 ++---------
+ src/hooks/zones/ip-tunnel | 8 +-------
+ src/hooks/zones/modem | 12 +-----------
+ src/hooks/zones/pppoe | 20 ++------------------
+ 5 files changed, 11 insertions(+), 45 deletions(-)
+
+diff --git a/src/header-zone b/src/header-zone
+index ead4a32..7ad3e39 100644
+--- a/src/header-zone
++++ b/src/header-zone
+@@ -34,6 +34,11 @@ hook_new() {
+ assert isset zone
+ shift
+
++ local ${HOOK_SETTINGS}
++
++ # Import all default variables
++ hook_set_defaults
++
+ if ! hook_parse_cmdline "$@"; then
+ return ${EXIT_ERROR}
+ fi
+diff --git a/src/hooks/zones/bridge b/src/hooks/zones/bridge
+index 93a3a31..33d5811 100644
+--- a/src/hooks/zones/bridge
++++ b/src/hooks/zones/bridge
+@@ -29,6 +29,7 @@ HOOK_SETTINGS="${HOOK_SETTINGS} STP_PRIORITY MTU"
+ HOOK_PORT_SETTINGS="COST PRIORITY"
+
+ # Default values
++DEFAULT_STP="on"
+ DEFAULT_STP_FORWARD_DELAY=0
+ DEFAULT_STP_HELLO=2
+ DEFAULT_STP_MAXAGE=20
+@@ -123,19 +124,11 @@ hook_parse_cmdline() {
+ shift
+ done
+
+- # Generate a random MAC address if the user passed no one
++ # Generate a random MAC address if the user passed none
+ if ! isset ADDRESS; then
+ ADDRESS="$(mac_generate)"
+ fi
+
+- # Enable Spanning Tree Protocol by default
+- if ! isset STP; then
+- STP="on"
+- fi
+-
+- # Set all other defaults
+- hook_set_defaults
+-
+ return ${EXIT_OK}
+ }
+
+diff --git a/src/hooks/zones/ip-tunnel b/src/hooks/zones/ip-tunnel
+index c9c73ba..e4be361 100644
+--- a/src/hooks/zones/ip-tunnel
++++ b/src/hooks/zones/ip-tunnel
+@@ -26,13 +26,7 @@ SUPPORTED_IP_TUNNEL_MODES="gre vti"
+ HOOK_SETTINGS="HOOK MARK MODE PEER LOCAL_ADDRESS"
+
+ # Default mode of the tunnel
+-MODE="gre"
+-
+-# The IP address of the tunnel endpoint where to connect to
+-PEER=
+-
+-# The local IP address of the tunnel endpoint
+-LOCAL_ADDRESS=
++DEFAULT_MODE="gre"
+
+ hook_check_settings() {
+ assert isset MODE && assert isoneof MODE ${SUPPORTED_IP_TUNNEL_MODES}
+diff --git a/src/hooks/zones/modem b/src/hooks/zones/modem
+index 1b4c3c0..50d43c7 100644
+--- a/src/hooks/zones/modem
++++ b/src/hooks/zones/modem
+@@ -27,47 +27,37 @@ MODEM_ALLOWED_AUTH_METHODS="${PPP_ALLOWED_AUTH_METHODS}"
+ HOOK_SETTINGS="HOOK"
+
+ # Access Point Name.
+-APN=
+ HOOK_SETTINGS="${HOOK_SETTINGS} APN"
+
+ # Sets the authentication algortihm that must be used.
+-AUTH=
+ HOOK_SETTINGS="${HOOK_SETTINGS} AUTH"
+
+ # Baudrate.
+-BAUDRATE=921600
++DEFAULT_BAUDRATE=921600
+ HOOK_SETTINGS="${HOOK_SETTINGS} BAUDRATE"
+
+ # The device name of the serial device.
+ # XXX how can we make sure that this does not change all the time?
+-DEVICE=
+ HOOK_SETTINGS="${HOOK_SETTINGS} DEVICE"
+
+ # A monitor device.
+ # Send AT commands to this device, when the primary device is
+ # connected.
+-MONITOR_DEVICE=
+ HOOK_SETTINGS="${HOOK_SETTINGS} MONITOR_DEVICE"
+
+ # Maximum transmission unit.
+-MTU=
+ HOOK_SETTINGS="${HOOK_SETTINGS} MTU"
+
+ # User credentials.
+-USERNAME=
+-PASSWORD=
+ HOOK_SETTINGS="${HOOK_SETTINGS} USERNAME PASSWORD"
+
+ # PIN code.
+-PIN=
+ HOOK_SETTINGS="${HOOK_SETTINGS} PIN"
+
+ # Phone number.
+-PHONE_NUMBER=
+ HOOK_SETTINGS="${HOOK_SETTINGS} PHONE_NUMBER"
+
+ # IMSI
+-IMSI=
+ HOOK_SETTINGS="${HOOK_SETTINGS} IMSI"
+
+ hook_check_settings() {
+diff --git a/src/hooks/zones/pppoe b/src/hooks/zones/pppoe
+index e113c92..cd3913b 100644
+--- a/src/hooks/zones/pppoe
++++ b/src/hooks/zones/pppoe
+@@ -24,31 +24,15 @@
+ HOOK_SETTINGS="HOOK ACCESS_CONCENTRATOR AUTH USERNAME PASSWORD"
+ HOOK_SETTINGS="${HOOK_SETTINGS} SERVICE_NAME MTU IPV6 PREFIX_DELEGATION"
+
+-# User credentials for the dialin.
+-USERNAME=""
+-PASSWORD=""
+-
+-# Set the authentication mechanism.
+-AUTH=
+-
+-# Access Concentrator.
+-ACCESS_CONCENTRATOR=""
+-
+-# Service name.
+-SERVICE_NAME=""
+-
+-# Maximum Transmission Unit.
+-MTU=
+-
+ # This hook can work with all authentication methods supported by pppd.
+ PPPOE_SUPPORTED_AUTH_METHODS="${PPP_SUPPORTED_AUTH_METHODS}"
+ PPPOE_PLUGIN="rp-pppoe.so"
+
+ # Request an IPv6 address.
+-IPV6="true"
++DEFAULT_IPV6="true"
+
+ # Use IPv6 prefix delegation.
+-PREFIX_DELEGATION="true"
++DEFAULT_PREFIX_DELEGATION="true"
+
+ hook_check_settings() {
+ assert isset USERNAME
+--
+2.39.2
+
diff --git a/network/patches/0036-Convert-HOOK_SETTINGS-into-an-array.patch b/network/patches/0036-Convert-HOOK_SETTINGS-into-an-array.patch
new file mode 100644
index 000000000..ad1fc9ade
--- /dev/null
+++ b/network/patches/0036-Convert-HOOK_SETTINGS-into-an-array.patch
@@ -0,0 +1,628 @@
+From d389e96b6c0a73fefd907bc99401b4ce4021bf97 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 30 Mar 2019 13:49:08 +0100
+Subject: [PATCH 036/304] Convert HOOK_SETTINGS into an array
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.hook | 2 +-
+ src/functions/functions.ports | 4 +--
+ src/functions/functions.zone | 6 ++---
+ src/header-port | 10 ++++----
+ src/header-zone | 2 +-
+ src/hooks/ports/bonding | 20 +++++++++------
+ src/hooks/ports/dummy | 10 +++++---
+ src/hooks/ports/ethernet | 19 +++++++++------
+ src/hooks/ports/ip-tunnel | 16 ++++++++----
+ src/hooks/ports/vlan | 14 +++++++----
+ src/hooks/ports/wireless-ap | 19 ++++++++++++---
+ src/hooks/ports/wireless-mesh | 12 ++++++---
+ src/hooks/zones/bridge | 17 ++++++++++---
+ src/hooks/zones/ip-tunnel | 7 +++++-
+ src/hooks/zones/modem | 46 ++++++++++-------------------------
+ src/hooks/zones/pppoe | 12 +++++++--
+ src/hooks/zones/wireless | 5 +++-
+ 17 files changed, 132 insertions(+), 89 deletions(-)
+
+diff --git a/src/functions/functions.hook b/src/functions/functions.hook
+index c0ebfcb..fb68037 100644
+--- a/src/functions/functions.hook
++++ b/src/functions/functions.hook
+@@ -127,7 +127,7 @@ hook_help() {
+ # Sets all settings in HOOK_SETTINGS to their DEFAULT_* values
+ hook_set_defaults() {
+ local setting
+- for setting in ${HOOK_SETTINGS}; do
++ for setting in ${HOOK_SETTINGS[*]}; do
+ local default="DEFAULT_${setting}"
+
+ # Sets the default or empty
+diff --git a/src/functions/functions.ports b/src/functions/functions.ports
+index f70adf6..fb22715 100644
+--- a/src/functions/functions.ports
++++ b/src/functions/functions.ports
+@@ -85,7 +85,7 @@ port_settings_read() {
+ # Save the HOOK variable.
+ local hook="${HOOK}"
+
+- settings_read "$(port_file "${port}")" ${HOOK_SETTINGS}
++ settings_read "$(port_file "${port}")" ${HOOK_SETTINGS[*]}
+
+ # Restore hook.
+ HOOK="${hook}"
+@@ -100,7 +100,7 @@ port_settings_write() {
+ if function_exists "hook_check_settings"; then
+ list_append args "--check=\"hook_check_settings\""
+ fi
+- list_append args HOOK ${HOOK_SETTINGS}
++ list_append args HOOK ${HOOK_SETTINGS[*]}
+
+ settings_write "$(port_file "${port}")" ${args}
+ }
+diff --git a/src/functions/functions.zone b/src/functions/functions.zone
+index 57e0b71..a0d3cfb 100644
+--- a/src/functions/functions.zone
++++ b/src/functions/functions.zone
+@@ -1248,8 +1248,8 @@ zone_settings_read() {
+ shift
+
+ local args
+- if [ $# -eq 0 ] && [ -n "${HOOK_SETTINGS}" ]; then
+- list_append args ${HOOK_SETTINGS}
++ if [ $# -eq 0 ] && [ -n "${HOOK_SETTINGS[*]}" ]; then
++ list_append args ${HOOK_SETTINGS[*]}
+ else
+ list_append args "$@"
+ fi
+@@ -1271,7 +1271,7 @@ zone_settings_write() {
+ if function_exists "hook_check_settings"; then
+ list_append args "--check=\"hook_check_settings\""
+ fi
+- list_append args ${HOOK_SETTINGS}
++ list_append args HOOK ${HOOK_SETTINGS[*]}
+
+ settings_write "${NETWORK_ZONES_DIR}/${zone}/settings" ${args}
+ }
+diff --git a/src/header-port b/src/header-port
+index 141228a..2d8a820 100644
+--- a/src/header-port
++++ b/src/header-port
+@@ -43,7 +43,7 @@ hook_hotplug_rename() {
+ }
+
+ hook_default_new() {
+- local ${HOOK_SETTINGS}
++ local ${HOOK_SETTINGS[*]}
+
+ # Import all default variables
+ hook_set_defaults
+@@ -57,7 +57,7 @@ hook_default_new() {
+ local port=$(port_find_free ${HOOK_PORT_PATTERN})
+ assert isset port
+
+- port_settings_write "${port}" ${HOOK_SETTINGS}
++ port_settings_write "${port}" ${HOOK_SETTINGS[*]}
+
+ exit ${EXIT_OK}
+ }
+@@ -72,7 +72,7 @@ hook_default_edit() {
+ shift
+
+ # Read settings
+- if ! port_settings_read "${port}" ${HOOK_SETTINGS}; then
++ if ! port_settings_read "${port}" ${HOOK_SETTINGS[*]}; then
+ error "Could not read settings for port ${port}"
+ return ${EXIT_ERROR}
+ fi
+@@ -83,7 +83,7 @@ hook_default_edit() {
+ fi
+
+ # Save settings
+- if ! port_settings_write "${port}" ${HOOK_SETTINGS}; then
++ if ! port_settings_write "${port}" ${HOOK_SETTINGS[*]}; then
+ error "Could not write settings for port ${port}"
+ return ${EXIT_ERROR}
+ fi
+@@ -102,7 +102,7 @@ hook_edit() {
+ hook_children() {
+ local port="${1}"
+
+- if ! port_settings_read "${port}" ${HOOK_SETTINGS}; then
++ if ! port_settings_read "${port}" ${HOOK_SETTINGS[*]}; then
+ log ERROR "Could not read port settings: ${port}"
+ return ${EXIT_OK}
+ fi
+diff --git a/src/header-zone b/src/header-zone
+index 7ad3e39..2174b01 100644
+--- a/src/header-zone
++++ b/src/header-zone
+@@ -34,7 +34,7 @@ hook_new() {
+ assert isset zone
+ shift
+
+- local ${HOOK_SETTINGS}
++ local ${HOOK_SETTINGS[*]}
+
+ # Import all default variables
+ hook_set_defaults
+diff --git a/src/hooks/ports/bonding b/src/hooks/ports/bonding
+index f0572c3..09fb74f 100644
+--- a/src/hooks/ports/bonding
++++ b/src/hooks/ports/bonding
+@@ -21,7 +21,13 @@
+
+ . /usr/lib/network/header-port
+
+-HOOK_SETTINGS="ADDRESS MIIMON MODE OFFLOADING SLAVES"
++HOOK_SETTINGS=(
++ "ADDRESS"
++ "MIIMON"
++ "MODE"
++ "OFFLOADING"
++ "SLAVES"
++)
+
+ DEFAULT_MIIMON=100
+ DEFAULT_MODE="balance-rr"
+@@ -110,7 +116,7 @@ hook_new() {
+ assert isset port
+
+ # Save configuration
+- if port_settings_write "${port}" ${HOOK_SETTINGS}; then
++ if port_settings_write "${port}" ${HOOK_SETTINGS[*]}; then
+ log INFO "New port ${port} has been created"
+ else
+ error "Could not save configuration for ${port}"
+@@ -162,7 +168,7 @@ hook_create() {
+ # Exit silently if the device already exists
+ device_exists "${port}" && exit ${EXIT_OK}
+
+- port_settings_read "${port}" ${HOOK_SETTINGS}
++ port_settings_read "${port}" ${HOOK_SETTINGS[*]}
+
+ # Create the bonding devices
+ bonding_create "${port}" \
+@@ -178,7 +184,7 @@ hook_remove() {
+ local port="${1}"
+ assert isset port
+
+- port_settings_read "${port}" ${HOOK_SETTINGS}
++ port_settings_read "${port}" ${HOOK_SETTINGS[*]}
+
+ # Remove the bonding device
+ if device_exists "${port}"; then
+@@ -190,7 +196,7 @@ hook_up() {
+ local port="${1}"
+ assert isset port
+
+- port_settings_read "${port}" ${HOOK_SETTINGS}
++ port_settings_read "${port}" ${HOOK_SETTINGS[*]}
+
+ # Auto-enable or disable hardware offloading
+ if ! isset OFFLOADING || enabled OFFLOADING; then
+@@ -213,7 +219,7 @@ hook_down() {
+ local port="${1}"
+ assert isset port
+
+- port_settings_read "${port}" ${HOOK_SETTINGS}
++ port_settings_read "${port}" ${HOOK_SETTINGS[*]}
+
+ # Bring down all slaves
+ local slave
+@@ -234,7 +240,7 @@ hook_hotplug() {
+ # Handle events of the same interface
+ if hotplug_event_port_is_interface "${port}"; then
+ # Read configuration
+- port_settings_read "${port}" ${HOOK_SETTINGS}
++ port_settings_read "${port}" ${HOOK_SETTINGS[*]}
+
+ # Bring up all slaves
+ # Attach those which already exist and try to create
+diff --git a/src/hooks/ports/dummy b/src/hooks/ports/dummy
+index 61d2f94..1c4b3c9 100644
+--- a/src/hooks/ports/dummy
++++ b/src/hooks/ports/dummy
+@@ -21,7 +21,9 @@
+
+ . /usr/lib/network/header-port
+
+-HOOK_SETTINGS="ADDRESS"
++HOOK_SETTINGS=(
++ "ADDRESS"
++)
+
+ hook_check_settings() {
+ assert ismac ADDRESS
+@@ -60,7 +62,7 @@ hook_new() {
+ local port=$(port_find_free ${DUMMY_PORT_PATTERN})
+ assert isset port
+
+- if port_settings_write "${port}" ${HOOK_SETTINGS}; then
++ if port_settings_write "${port}" ${HOOK_SETTINGS[*]}; then
+ log INFO "New dummy port '${port}' has been created"
+ fi
+
+@@ -72,7 +74,7 @@ hook_create() {
+ assert isset port
+
+ # Read configuration
+- port_settings_read "${port}" ${HOOK_SETTINGS}
++ port_settings_read "${port}" ${HOOK_SETTINGS[*]}
+
+ # Create the dummy device
+ dummy_create "${port}" "${ADDRESS}"
+@@ -115,7 +117,7 @@ hook_hotplug_rename() {
+ local device=${2}
+ assert isset device
+
+- port_settings_read "${port}" ${HOOK_SETTINGS}
++ port_settings_read "${port}" ${HOOK_SETTINGS[*]}
+
+ if [ "${ADDRESS}" = "$(device_get_address ${device})" ]; then
+ log DEBUG "Device '${device}' equals port '${port}'."
+diff --git a/src/hooks/ports/ethernet b/src/hooks/ports/ethernet
+index 0d9c5cd..f3e3f9f 100644
+--- a/src/hooks/ports/ethernet
++++ b/src/hooks/ports/ethernet
+@@ -21,10 +21,13 @@
+
+ . /usr/lib/network/header-port
+
+-# DEVICE equals the actual MAC address of the device.
+-# If ADDRESS is set, the device will get ADDRESS set for its MAC address.
+-
+-HOOK_SETTINGS="ADDRESS ADVERTISED_LINK_SPEEDS DEVICE OFFLOADING MTU"
++HOOK_SETTINGS=(
++ "ADDRESS"
++ "ADVERTISED_LINK_SPEEDS"
++ "DEVICE"
++ "OFFLOADING"
++ "MTU"
++)
+
+ hook_check_settings() {
+ assert ismac DEVICE
+@@ -114,7 +117,7 @@ hook_new() {
+
+ local DEVICE="$(device_get_address "${device}")"
+
+- if ! port_settings_write "${port}" ${HOOK_SETTINGS}; then
++ if ! port_settings_write "${port}" ${HOOK_SETTINGS[*]}; then
+ log ERROR "Could not write settings for port ${port}"
+ return ${EXIT_ERROR}
+ fi
+@@ -129,8 +132,8 @@ hook_create() {
+ hook_up() {
+ local port="${1}"
+
+- local ${HOOK_SETTINGS}
+- if ! port_settings_read "${port}" ${HOOK_SETTINGS}; then
++ local ${HOOK_SETTINGS[*]}
++ if ! port_settings_read "${port}" ${HOOK_SETTINGS[*]}; then
+ log ERROR "Could not read settings for port ${port}"
+ return ${EXIT_ERROR}
+ fi
+@@ -177,7 +180,7 @@ hook_hotplug_rename() {
+ assert isset device
+
+ # Read in the conifguration file.
+- port_settings_read "${port}" ${HOOK_SETTINGS}
++ port_settings_read "${port}" ${HOOK_SETTINGS[*]}
+
+ # Get the current MAC address of the device.
+ local address=$(device_get_address ${device})
+diff --git a/src/hooks/ports/ip-tunnel b/src/hooks/ports/ip-tunnel
+index 3943e4c..b426963 100644
+--- a/src/hooks/ports/ip-tunnel
++++ b/src/hooks/ports/ip-tunnel
+@@ -23,7 +23,13 @@
+
+ SUPPORTED_IP_TUNNEL_MODES="gretap"
+
+-HOOK_SETTINGS="ADDRESS MARK MODE PEER LOCAL_ADDRESS"
++HOOK_SETTINGS=(
++ "ADDRESS"
++ "MARK"
++ "MODE"
++ "PEER"
++ "LOCAL_ADDRESS"
++)
+
+ hook_check_settings() {
+ assert isset MODE
+@@ -108,8 +114,8 @@ hook_create() {
+ local port="${1}"
+ assert isset port
+
+- local ${HOOK_SETTINGS}
+- if ! port_settings_read "${port}" ${HOOK_SETTINGS}; then
++ local ${HOOK_SETTINGS[*]}
++ if ! port_settings_read "${port}" ${HOOK_SETTINGS[*]}; then
+ log ERROR "Could not read settings for port ${port}"
+ return ${EXIT_ERROR}
+ fi
+@@ -146,8 +152,8 @@ hook_hotplug_rename() {
+ local device="${2}"
+ assert isset device
+
+- local ${HOOK_SETTINGS}
+- if ! port_settings_read "${port}" ${HOOK_SETTINGS}; then
++ local ${HOOK_SETTINGS[*]}
++ if ! port_settings_read "${port}" ${HOOK_SETTINGS[*]}; then
+ log ERROR "Could not read settings for port ${port}"
+ return ${EXIT_ERROR}
+ fi
+diff --git a/src/hooks/ports/vlan b/src/hooks/ports/vlan
+index bc12a9e..e9aa545 100644
+--- a/src/hooks/ports/vlan
++++ b/src/hooks/ports/vlan
+@@ -21,7 +21,11 @@
+
+ . /usr/lib/network/header-port
+
+-HOOK_SETTINGS="ADDRESS PARENT_DEVICE TAG"
++HOOK_SETTINGS=(
++ "ADDRESS"
++ "PARENT_DEVICE"
++ "TAG"
++)
+
+ PORT_PARENTS_VAR="PARENT"
+
+@@ -68,7 +72,7 @@ hook_new() {
+
+ local port="${PARENT_DEVICE}${VLAN_PORT_INTERFIX}${TAG}"
+
+- port_settings_write "${port}" ${HOOK_SETTINGS}
++ port_settings_write "${port}" ${HOOK_SETTINGS[*]}
+
+ exit ${EXIT_OK}
+ }
+@@ -78,7 +82,7 @@ hook_edit() {
+ assert isset port
+ shift
+
+- port_settings_read "${port}" ${HOOK_SETTINGS}
++ port_settings_read "${port}" ${HOOK_SETTINGS[*]}
+
+ while [ $# -gt 0 ]; do
+ case "${1}" in
+@@ -92,7 +96,7 @@ hook_edit() {
+ shift
+ done
+
+- port_settings_write "${port}" ${HOOK_SETTINGS}
++ port_settings_write "${port}" ${HOOK_SETTINGS[*]}
+
+ exit ${EXIT_OK}
+ }
+@@ -104,7 +108,7 @@ hook_create() {
+ device_exists "${port}" && exit ${EXIT_OK}
+
+ # Read configruation
+- port_settings_read "${port}" ${HOOK_SETTINGS}
++ port_settings_read "${port}" ${HOOK_SETTINGS[*]}
+
+ # Create the VLAN device
+ vlan_create "${port}" "${PARENT_DEVICE}" "${TAG}" "${ADDRESS}"
+diff --git a/src/hooks/ports/wireless-ap b/src/hooks/ports/wireless-ap
+index 2bb4977..8d495d2 100644
+--- a/src/hooks/ports/wireless-ap
++++ b/src/hooks/ports/wireless-ap
+@@ -23,9 +23,20 @@
+
+ HOOK_PORT_PATTERN="${PORT_PATTERN_ACCESSPOINT}"
+
+-HOOK_SETTINGS="ADDRESS BROADCAST_SSID CHANNEL CHANNEL_BANDWIDTH DFS MODE PHY"
+-HOOK_SETTINGS="${HOOK_SETTINGS} ENCRYPTION ENVIRONMENT KEY SSID"
+-HOOK_SETTINGS="${HOOK_SETTINGS} MFP"
++HOOK_SETTINGS=(
++ "ADDRESS"
++ "BROADCAST_SSID"
++ "CHANNEL"
++ "CHANNEL_BANDWIDTH"
++ "DFS"
++ "ENCRYPTION"
++ "ENVIRONMENT"
++ "KEY"
++ "MFP"
++ "MODE"
++ "PHY"
++ "SSID"
++)
+
+ # Broadcast SSID by default
+ DEFAULT_BROADCAST_SSID="on"
+@@ -186,7 +197,7 @@ hook_create() {
+
+ device_exists "${port}" && exit ${EXIT_OK}
+
+- port_settings_read "${port}" ${HOOK_SETTINGS}
++ port_settings_read "${port}" ${HOOK_SETTINGS[*]}
+
+ # Check if the PHY is present.
+ local phy=$(phy_get ${PHY})
+diff --git a/src/hooks/ports/wireless-mesh b/src/hooks/ports/wireless-mesh
+index 4fb4dc9..306263d 100644
+--- a/src/hooks/ports/wireless-mesh
++++ b/src/hooks/ports/wireless-mesh
+@@ -23,7 +23,13 @@
+
+ HOOK_PORT_PATTERN="${PORT_PATTERN_MESH}"
+
+-HOOK_SETTINGS="ADDRESS MESH_ID CHANNEL PHY PSK"
++HOOK_SETTINGS=(
++ "ADDRESS"
++ "CHANNEL"
++ "MESH_ID"
++ "PHY"
++ "PSK"
++)
+
+ hook_check_settings() {
+ assert ismac ADDRESS
+@@ -84,7 +90,7 @@ hook_create() {
+ assert isset port
+
+ # Read settings
+- port_settings_read "${port}" ${HOOK_SETTINGS}
++ port_settings_read "${port}" ${HOOK_SETTINGS[*]}
+
+ # Check if the PHY is present.
+ local phy="$(phy_get "${PHY}")"
+@@ -143,7 +149,7 @@ hook_hotplug() {
+ local port="${1}"
+ assert isset port
+
+- port_settings_read "${port}" ${HOOK_SETTINGS}
++ port_settings_read "${port}" ${HOOK_SETTINGS[*]}
+
+ case "$(hotplug_action)" in
+ add)
+diff --git a/src/hooks/zones/bridge b/src/hooks/zones/bridge
+index 33d5811..0b18331 100644
+--- a/src/hooks/zones/bridge
++++ b/src/hooks/zones/bridge
+@@ -23,10 +23,19 @@
+
+ HOOK_MANPAGE="network-zone-bridge"
+
+-HOOK_SETTINGS="HOOK ADDRESS STP STP_FORWARD_DELAY STP_HELLO STP_MAXAGE"
+-HOOK_SETTINGS="${HOOK_SETTINGS} STP_PRIORITY MTU"
+-
+-HOOK_PORT_SETTINGS="COST PRIORITY"
++HOOK_SETTINGS=(
++ "ADDRESS"
++ "STP"
++ "STP_FORWARD_DELAY"
++ "STP_HELLO STP_MAXAGE"
++ "STP_PRIORITY"
++ "MTU"
++)
++
++HOOK_PORT_SETTINGS=(
++ "COST"
++ "PRIORITY"
++)
+
+ # Default values
+ DEFAULT_STP="on"
+diff --git a/src/hooks/zones/ip-tunnel b/src/hooks/zones/ip-tunnel
+index e4be361..634154e 100644
+--- a/src/hooks/zones/ip-tunnel
++++ b/src/hooks/zones/ip-tunnel
+@@ -23,7 +23,12 @@
+
+ SUPPORTED_IP_TUNNEL_MODES="gre vti"
+
+-HOOK_SETTINGS="HOOK MARK MODE PEER LOCAL_ADDRESS"
++HOOK_SETTINGS=(
++ "MARK"
++ "MODE"
++ "PEER"
++ "LOCAL_ADDRESS"
++)
+
+ # Default mode of the tunnel
+ DEFAULT_MODE="gre"
+diff --git a/src/hooks/zones/modem b/src/hooks/zones/modem
+index 50d43c7..e12b104 100644
+--- a/src/hooks/zones/modem
++++ b/src/hooks/zones/modem
+@@ -24,41 +24,21 @@
+ # Modems support all authentication methods, that pppd does support.
+ MODEM_ALLOWED_AUTH_METHODS="${PPP_ALLOWED_AUTH_METHODS}"
+
+-HOOK_SETTINGS="HOOK"
++HOOK_SETTINGS=(
++ "APN"
++ "AUTH"
++ "BAUDRATE"
++ "DEVICE"
++ "MONITOR_DEVICE"
++ "MTU"
++ "USERNAME"
++ "PASSWORD"
++ "PIN"
++ "PHONE_NUMBER"
++ "IMSI"
++)
+
+-# Access Point Name.
+-HOOK_SETTINGS="${HOOK_SETTINGS} APN"
+-
+-# Sets the authentication algortihm that must be used.
+-HOOK_SETTINGS="${HOOK_SETTINGS} AUTH"
+-
+-# Baudrate.
+ DEFAULT_BAUDRATE=921600
+-HOOK_SETTINGS="${HOOK_SETTINGS} BAUDRATE"
+-
+-# The device name of the serial device.
+-# XXX how can we make sure that this does not change all the time?
+-HOOK_SETTINGS="${HOOK_SETTINGS} DEVICE"
+-
+-# A monitor device.
+-# Send AT commands to this device, when the primary device is
+-# connected.
+-HOOK_SETTINGS="${HOOK_SETTINGS} MONITOR_DEVICE"
+-
+-# Maximum transmission unit.
+-HOOK_SETTINGS="${HOOK_SETTINGS} MTU"
+-
+-# User credentials.
+-HOOK_SETTINGS="${HOOK_SETTINGS} USERNAME PASSWORD"
+-
+-# PIN code.
+-HOOK_SETTINGS="${HOOK_SETTINGS} PIN"
+-
+-# Phone number.
+-HOOK_SETTINGS="${HOOK_SETTINGS} PHONE_NUMBER"
+-
+-# IMSI
+-HOOK_SETTINGS="${HOOK_SETTINGS} IMSI"
+
+ hook_check_settings() {
+ assert isset DEVICE
+diff --git a/src/hooks/zones/pppoe b/src/hooks/zones/pppoe
+index cd3913b..4f7ae51 100644
+--- a/src/hooks/zones/pppoe
++++ b/src/hooks/zones/pppoe
+@@ -21,8 +21,16 @@
+
+ . /usr/lib/network/header-zone
+
+-HOOK_SETTINGS="HOOK ACCESS_CONCENTRATOR AUTH USERNAME PASSWORD"
+-HOOK_SETTINGS="${HOOK_SETTINGS} SERVICE_NAME MTU IPV6 PREFIX_DELEGATION"
++HOOK_SETTINGS=(
++ "ACCESS_CONCENTRATOR"
++ "AUTH"
++ "USERNAME"
++ "PASSWORD"
++ "SERVICE_NAME"
++ "MTU"
++ "IPV6"
++ "PREFIX_DELEGATION"
++)
+
+ # This hook can work with all authentication methods supported by pppd.
+ PPPOE_SUPPORTED_AUTH_METHODS="${PPP_SUPPORTED_AUTH_METHODS}"
+diff --git a/src/hooks/zones/wireless b/src/hooks/zones/wireless
+index 553d917..9c52dce 100644
+--- a/src/hooks/zones/wireless
++++ b/src/hooks/zones/wireless
+@@ -21,7 +21,10 @@
+
+ . /usr/lib/network/header-zone
+
+-HOOK_SETTINGS="HOOK ADDRESS PHY"
++HOOK_SETTINGS=(
++ "ADDRESS"
++ "PHY"
++)
+
+ hook_check_settings() {
+ assert ismac ADDRESS
+--
+2.39.2
+
diff --git a/network/patches/0037-settings-Some-code-refactoring.patch b/network/patches/0037-settings-Some-code-refactoring.patch
new file mode 100644
index 000000000..e3f473f0b
--- /dev/null
+++ b/network/patches/0037-settings-Some-code-refactoring.patch
@@ -0,0 +1,133 @@
+From 227d458f4fac10cbf0970515edd3227913fc1bf4 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 30 Mar 2019 14:04:35 +0100
+Subject: [PATCH 037/304] settings: Some code refactoring
+
+No functional changes
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.hook | 13 +++++++++++++
+ src/functions/functions.ports | 10 ++--------
+ src/functions/functions.zone | 32 ++++++++------------------------
+ 3 files changed, 23 insertions(+), 32 deletions(-)
+
+diff --git a/src/functions/functions.hook b/src/functions/functions.hook
+index fb68037..11887cd 100644
+--- a/src/functions/functions.hook
++++ b/src/functions/functions.hook
+@@ -124,6 +124,19 @@ hook_help() {
+ exit $?
+ }
+
++# Dummy functions being overlayed by hooks
++hook_check_settings() {
++ :
++}
++
++hook_check_config_settings() {
++ :
++}
++
++hook_check_port_settings() {
++ :
++}
++
+ # Sets all settings in HOOK_SETTINGS to their DEFAULT_* values
+ hook_set_defaults() {
+ local setting
+diff --git a/src/functions/functions.ports b/src/functions/functions.ports
+index fb22715..d8a9140 100644
+--- a/src/functions/functions.ports
++++ b/src/functions/functions.ports
+@@ -94,15 +94,9 @@ port_settings_read() {
+ port_settings_write() {
+ local port="${1}"
+ assert isset port
+- shift
+-
+- local args
+- if function_exists "hook_check_settings"; then
+- list_append args "--check=\"hook_check_settings\""
+- fi
+- list_append args HOOK ${HOOK_SETTINGS[*]}
+
+- settings_write "$(port_file "${port}")" ${args}
++ settings_write "$(port_file "${port}")" \
++ --check="hook_check_settings" HOOK ${HOOK_SETTINGS[*]}
+ }
+
+ port_file() {
+diff --git a/src/functions/functions.zone b/src/functions/functions.zone
+index a0d3cfb..e81371b 100644
+--- a/src/functions/functions.zone
++++ b/src/functions/functions.zone
+@@ -1267,13 +1267,8 @@ zone_settings_write() {
+ local zone="${1}"
+ assert isset zone
+
+- local args
+- if function_exists "hook_check_settings"; then
+- list_append args "--check=\"hook_check_settings\""
+- fi
+- list_append args HOOK ${HOOK_SETTINGS[*]}
+-
+- settings_write "${NETWORK_ZONES_DIR}/${zone}/settings" ${args}
++ settings_write "${NETWORK_ZONES_DIR}/${zone}/settings" \
++ --check="hook_check_settings" HOOK ${HOOK_SETTINGS[*]}
+ }
+
+ zone_settings_set() {
+@@ -1328,7 +1323,7 @@ zone_config_settings_read() {
+ }
+
+ zone_config_settings_write() {
+- assert [ $# -ge 2 ]
++ assert [ $# -eq 2 ]
+
+ local zone="${1}"
+ local hook="${2}"
+@@ -1336,14 +1331,9 @@ zone_config_settings_write() {
+
+ assert isset id
+
+- local args
+- if function_exists "hook_check_config_settings"; then
+- list_append args "--check=\"hook_check_config_settings\""
+- fi
+- list_append args ${HOOK_CONFIG_SETTINGS}
+-
+ local path="${NETWORK_ZONES_DIR}/${zone}/configs/${hook}.${id}"
+- settings_write "${path}" ${args}
++ settings_write "${path}" \
++ --check="hook_check_config_settings" ${HOOK_CONFIG_SETTINGS[*]}
+ }
+
+ zone_config_settings_destroy() {
+@@ -1416,20 +1406,14 @@ zone_port_settings_read() {
+ }
+
+ zone_port_settings_write() {
+- assert [ $# -ge 2 ]
++ assert [ $# -eq 2 ]
+
+ local zone="${1}"
+ local port="${2}"
+- shift 2
+-
+- local args
+- if function_exists "hook_check_port_settings"; then
+- list_append args "--check=\"hook_check_port_settings\""
+- fi
+- list_append args ${HOOK_PORT_SETTINGS}
+
+ local path="${NETWORK_ZONES_DIR}/${zone}/ports/${port}"
+- settings_write "${path}" ${args}
++ settings_write "${path}" \
++ --check="hook_check_port_settings" ${HOOK_PORT_SETTINGS[*]}
+ }
+
+ zone_port_settings_remove() {
+--
+2.39.2
+
diff --git a/network/patches/0038-ports-Drop-HOOK_SETTINGS-variable.patch b/network/patches/0038-ports-Drop-HOOK_SETTINGS-variable.patch
new file mode 100644
index 000000000..87b3a1f12
--- /dev/null
+++ b/network/patches/0038-ports-Drop-HOOK_SETTINGS-variable.patch
@@ -0,0 +1,239 @@
+From eba9fa9c0b647552d8a43fb6ff5ab00c2ab21402 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 30 Mar 2019 14:14:56 +0100
+Subject: [PATCH 038/304] ports: Drop HOOK_SETTINGS variable
+
+This does not need to be passed to the port_settings_* functions
+any more which makes them more easy to use
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/hooks/ports/bonding | 12 ++++++------
+ src/hooks/ports/dummy | 6 +++---
+ src/hooks/ports/ethernet | 6 +++---
+ src/hooks/ports/ip-tunnel | 4 ++--
+ src/hooks/ports/vlan | 8 ++++----
+ src/hooks/ports/wireless-ap | 2 +-
+ src/hooks/ports/wireless-mesh | 4 ++--
+ 7 files changed, 21 insertions(+), 21 deletions(-)
+
+diff --git a/src/hooks/ports/bonding b/src/hooks/ports/bonding
+index 09fb74f..a0cf5c0 100644
+--- a/src/hooks/ports/bonding
++++ b/src/hooks/ports/bonding
+@@ -116,7 +116,7 @@ hook_new() {
+ assert isset port
+
+ # Save configuration
+- if port_settings_write "${port}" ${HOOK_SETTINGS[*]}; then
++ if port_settings_write "${port}"; then
+ log INFO "New port ${port} has been created"
+ else
+ error "Could not save configuration for ${port}"
+@@ -168,7 +168,7 @@ hook_create() {
+ # Exit silently if the device already exists
+ device_exists "${port}" && exit ${EXIT_OK}
+
+- port_settings_read "${port}" ${HOOK_SETTINGS[*]}
++ port_settings_read "${port}"
+
+ # Create the bonding devices
+ bonding_create "${port}" \
+@@ -184,7 +184,7 @@ hook_remove() {
+ local port="${1}"
+ assert isset port
+
+- port_settings_read "${port}" ${HOOK_SETTINGS[*]}
++ port_settings_read "${port}"
+
+ # Remove the bonding device
+ if device_exists "${port}"; then
+@@ -196,7 +196,7 @@ hook_up() {
+ local port="${1}"
+ assert isset port
+
+- port_settings_read "${port}" ${HOOK_SETTINGS[*]}
++ port_settings_read "${port}"
+
+ # Auto-enable or disable hardware offloading
+ if ! isset OFFLOADING || enabled OFFLOADING; then
+@@ -219,7 +219,7 @@ hook_down() {
+ local port="${1}"
+ assert isset port
+
+- port_settings_read "${port}" ${HOOK_SETTINGS[*]}
++ port_settings_read "${port}"
+
+ # Bring down all slaves
+ local slave
+@@ -240,7 +240,7 @@ hook_hotplug() {
+ # Handle events of the same interface
+ if hotplug_event_port_is_interface "${port}"; then
+ # Read configuration
+- port_settings_read "${port}" ${HOOK_SETTINGS[*]}
++ port_settings_read "${port}"
+
+ # Bring up all slaves
+ # Attach those which already exist and try to create
+diff --git a/src/hooks/ports/dummy b/src/hooks/ports/dummy
+index 1c4b3c9..387c88b 100644
+--- a/src/hooks/ports/dummy
++++ b/src/hooks/ports/dummy
+@@ -62,7 +62,7 @@ hook_new() {
+ local port=$(port_find_free ${DUMMY_PORT_PATTERN})
+ assert isset port
+
+- if port_settings_write "${port}" ${HOOK_SETTINGS[*]}; then
++ if port_settings_write "${port}"; then
+ log INFO "New dummy port '${port}' has been created"
+ fi
+
+@@ -74,7 +74,7 @@ hook_create() {
+ assert isset port
+
+ # Read configuration
+- port_settings_read "${port}" ${HOOK_SETTINGS[*]}
++ port_settings_read "${port}"
+
+ # Create the dummy device
+ dummy_create "${port}" "${ADDRESS}"
+@@ -117,7 +117,7 @@ hook_hotplug_rename() {
+ local device=${2}
+ assert isset device
+
+- port_settings_read "${port}" ${HOOK_SETTINGS[*]}
++ port_settings_read "${port}"
+
+ if [ "${ADDRESS}" = "$(device_get_address ${device})" ]; then
+ log DEBUG "Device '${device}' equals port '${port}'."
+diff --git a/src/hooks/ports/ethernet b/src/hooks/ports/ethernet
+index f3e3f9f..5f76e15 100644
+--- a/src/hooks/ports/ethernet
++++ b/src/hooks/ports/ethernet
+@@ -117,7 +117,7 @@ hook_new() {
+
+ local DEVICE="$(device_get_address "${device}")"
+
+- if ! port_settings_write "${port}" ${HOOK_SETTINGS[*]}; then
++ if ! port_settings_write "${port}"; then
+ log ERROR "Could not write settings for port ${port}"
+ return ${EXIT_ERROR}
+ fi
+@@ -133,7 +133,7 @@ hook_up() {
+ local port="${1}"
+
+ local ${HOOK_SETTINGS[*]}
+- if ! port_settings_read "${port}" ${HOOK_SETTINGS[*]}; then
++ if ! port_settings_read "${port}"; then
+ log ERROR "Could not read settings for port ${port}"
+ return ${EXIT_ERROR}
+ fi
+@@ -180,7 +180,7 @@ hook_hotplug_rename() {
+ assert isset device
+
+ # Read in the conifguration file.
+- port_settings_read "${port}" ${HOOK_SETTINGS[*]}
++ port_settings_read "${port}"
+
+ # Get the current MAC address of the device.
+ local address=$(device_get_address ${device})
+diff --git a/src/hooks/ports/ip-tunnel b/src/hooks/ports/ip-tunnel
+index b426963..fa7193c 100644
+--- a/src/hooks/ports/ip-tunnel
++++ b/src/hooks/ports/ip-tunnel
+@@ -115,7 +115,7 @@ hook_create() {
+ assert isset port
+
+ local ${HOOK_SETTINGS[*]}
+- if ! port_settings_read "${port}" ${HOOK_SETTINGS[*]}; then
++ if ! port_settings_read "${port}"; then
+ log ERROR "Could not read settings for port ${port}"
+ return ${EXIT_ERROR}
+ fi
+@@ -153,7 +153,7 @@ hook_hotplug_rename() {
+ assert isset device
+
+ local ${HOOK_SETTINGS[*]}
+- if ! port_settings_read "${port}" ${HOOK_SETTINGS[*]}; then
++ if ! port_settings_read "${port}"; then
+ log ERROR "Could not read settings for port ${port}"
+ return ${EXIT_ERROR}
+ fi
+diff --git a/src/hooks/ports/vlan b/src/hooks/ports/vlan
+index e9aa545..f511986 100644
+--- a/src/hooks/ports/vlan
++++ b/src/hooks/ports/vlan
+@@ -72,7 +72,7 @@ hook_new() {
+
+ local port="${PARENT_DEVICE}${VLAN_PORT_INTERFIX}${TAG}"
+
+- port_settings_write "${port}" ${HOOK_SETTINGS[*]}
++ port_settings_write "${port}"
+
+ exit ${EXIT_OK}
+ }
+@@ -82,7 +82,7 @@ hook_edit() {
+ assert isset port
+ shift
+
+- port_settings_read "${port}" ${HOOK_SETTINGS[*]}
++ port_settings_read "${port}"
+
+ while [ $# -gt 0 ]; do
+ case "${1}" in
+@@ -96,7 +96,7 @@ hook_edit() {
+ shift
+ done
+
+- port_settings_write "${port}" ${HOOK_SETTINGS[*]}
++ port_settings_write "${port}"
+
+ exit ${EXIT_OK}
+ }
+@@ -108,7 +108,7 @@ hook_create() {
+ device_exists "${port}" && exit ${EXIT_OK}
+
+ # Read configruation
+- port_settings_read "${port}" ${HOOK_SETTINGS[*]}
++ port_settings_read "${port}"
+
+ # Create the VLAN device
+ vlan_create "${port}" "${PARENT_DEVICE}" "${TAG}" "${ADDRESS}"
+diff --git a/src/hooks/ports/wireless-ap b/src/hooks/ports/wireless-ap
+index 8d495d2..e393f5f 100644
+--- a/src/hooks/ports/wireless-ap
++++ b/src/hooks/ports/wireless-ap
+@@ -197,7 +197,7 @@ hook_create() {
+
+ device_exists "${port}" && exit ${EXIT_OK}
+
+- port_settings_read "${port}" ${HOOK_SETTINGS[*]}
++ port_settings_read "${port}"
+
+ # Check if the PHY is present.
+ local phy=$(phy_get ${PHY})
+diff --git a/src/hooks/ports/wireless-mesh b/src/hooks/ports/wireless-mesh
+index 306263d..35f0950 100644
+--- a/src/hooks/ports/wireless-mesh
++++ b/src/hooks/ports/wireless-mesh
+@@ -90,7 +90,7 @@ hook_create() {
+ assert isset port
+
+ # Read settings
+- port_settings_read "${port}" ${HOOK_SETTINGS[*]}
++ port_settings_read "${port}"
+
+ # Check if the PHY is present.
+ local phy="$(phy_get "${PHY}")"
+@@ -149,7 +149,7 @@ hook_hotplug() {
+ local port="${1}"
+ assert isset port
+
+- port_settings_read "${port}" ${HOOK_SETTINGS[*]}
++ port_settings_read "${port}"
+
+ case "$(hotplug_action)" in
+ add)
+--
+2.39.2
+
diff --git a/network/patches/0039-hotplug-Remove-multiple-copies-of-the-same-function.patch b/network/patches/0039-hotplug-Remove-multiple-copies-of-the-same-function.patch
new file mode 100644
index 000000000..ee5f6592e
--- /dev/null
+++ b/network/patches/0039-hotplug-Remove-multiple-copies-of-the-same-function.patch
@@ -0,0 +1,162 @@
+From 12f9c8d2550c8fcab536bb8b971caddfa8ee0c80 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 30 Mar 2019 14:58:12 +0100
+Subject: [PATCH 039/304] hotplug: Remove multiple copies of the same function
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/header-port | 26 ++++++++++++++++++++++++++
+ src/hooks/ports/dummy | 36 +-----------------------------------
+ src/hooks/ports/ethernet | 22 +---------------------
+ src/hooks/ports/ip-tunnel | 23 +----------------------
+ 4 files changed, 29 insertions(+), 78 deletions(-)
+
+diff --git a/src/header-port b/src/header-port
+index 2d8a820..d75fdd8 100644
+--- a/src/header-port
++++ b/src/header-port
+@@ -42,6 +42,32 @@ hook_hotplug_rename() {
+ exit ${EXIT_FALSE}
+ }
+
++hook_hotplug_rename_by_address() {
++ local port="${1}"
++ assert isset port
++
++ local device="${2}"
++ assert isset device
++
++ # Read in the conifguration file.
++ if ! port_settings_read "${port}"; then
++ return ${EXIT_ERROR}
++ fi
++
++ # Get the current MAC address of the device.
++ local address="$(device_get_address "${device}")"
++ assert isset address
++
++ # Check if the address matches with the configuration.
++ if list_match "${address}" "${ADDRESS}" "${DEVICE}"; then
++ log DEBUG "Device '${device}' is port '${port}'"
++ return ${EXIT_OK}
++ fi
++
++ log DEBUG "Device '${device}' is not port '${port}'"
++ return ${EXIT_ERROR}
++}
++
+ hook_default_new() {
+ local ${HOOK_SETTINGS[*]}
+
+diff --git a/src/hooks/ports/dummy b/src/hooks/ports/dummy
+index 387c88b..3688831 100644
+--- a/src/hooks/ports/dummy
++++ b/src/hooks/ports/dummy
+@@ -90,40 +90,6 @@ hook_remove() {
+ dummy_remove "${port}"
+ }
+
+-hook_up() {
+- local port="${1}"
+- assert isset port
+-
+- # Bring up the port.
+- device_set_up ${port}
+-
+- exit ${EXIT_OK}
+-}
+-
+-hook_down() {
+- local port="${1}"
+- assert isset port
+-
+- # Tear down the port.
+- device_set_down ${port}
+-
+- exit ${EXIT_OK}
+-}
+-
+ hook_hotplug_rename() {
+- local port=${1}
+- assert isset port
+-
+- local device=${2}
+- assert isset device
+-
+- port_settings_read "${port}"
+-
+- if [ "${ADDRESS}" = "$(device_get_address ${device})" ]; then
+- log DEBUG "Device '${device}' equals port '${port}'."
+- exit ${EXIT_OK}
+- fi
+-
+- log DEBUG "Device '${device}' does not equal port '${port}'."
+- exit ${EXIT_ERROR}
++ hook_hotplug_rename_by_address "$@"
+ }
+diff --git a/src/hooks/ports/ethernet b/src/hooks/ports/ethernet
+index 5f76e15..82664fa 100644
+--- a/src/hooks/ports/ethernet
++++ b/src/hooks/ports/ethernet
+@@ -173,25 +173,5 @@ hook_remove() {
+ }
+
+ hook_hotplug_rename() {
+- local port=${1}
+- assert isset port
+-
+- local device=${2}
+- assert isset device
+-
+- # Read in the conifguration file.
+- port_settings_read "${port}"
+-
+- # Get the current MAC address of the device.
+- local address=$(device_get_address ${device})
+- assert isset address
+-
+- # Check if the address matches with the configuration.
+- if list_match "${address}" ${DEVICE} ${ADDRESS}; then
+- log DEBUG "Device '${device}' equals port '${port}'."
+- exit ${EXIT_OK}
+- fi
+-
+- log DEBUG "Device '${device}' does not equal port '${port}'."
+- exit ${EXIT_ERROR}
++ hook_hotplug_rename_by_address "$@"
+ }
+diff --git a/src/hooks/ports/ip-tunnel b/src/hooks/ports/ip-tunnel
+index fa7193c..482511e 100644
+--- a/src/hooks/ports/ip-tunnel
++++ b/src/hooks/ports/ip-tunnel
+@@ -146,26 +146,5 @@ hook_remove() {
+ }
+
+ hook_hotplug_rename() {
+- local port="${1}"
+- assert isset port
+-
+- local device="${2}"
+- assert isset device
+-
+- local ${HOOK_SETTINGS[*]}
+- if ! port_settings_read "${port}"; then
+- log ERROR "Could not read settings for port ${port}"
+- return ${EXIT_ERROR}
+- fi
+-
+- # Get the current MAC address of the device.
+- local address="$(device_get_address ${device})"
+- assert isset address
+-
+- # Return OK on match
+- if [ "${ADDRESS}" = "${address}" ]; then
+- return ${EXIT_OK}
+- fi
+-
+- return ${EXIT_ERROR}
++ hook_hotplug_rename_by_address "$@"
+ }
+--
+2.39.2
+
diff --git a/network/patches/0040-wireless-ap-Remove-support-for-WPA.patch b/network/patches/0040-wireless-ap-Remove-support-for-WPA.patch
new file mode 100644
index 000000000..7ec95a7b1
--- /dev/null
+++ b/network/patches/0040-wireless-ap-Remove-support-for-WPA.patch
@@ -0,0 +1,58 @@
+From 66fdbcaf15d3fb7ce4a1e0f7e6299818f4638c84 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 30 Mar 2019 15:02:34 +0100
+Subject: [PATCH 040/304] wireless-ap: Remove support for WPA
+
+This is a deprecated protocol and not secure.
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.hostapd | 8 +-------
+ src/hooks/ports/wireless-ap | 2 +-
+ 2 files changed, 2 insertions(+), 8 deletions(-)
+
+diff --git a/src/functions/functions.hostapd b/src/functions/functions.hostapd
+index 79fb4db..d3eaa74 100644
+--- a/src/functions/functions.hostapd
++++ b/src/functions/functions.hostapd
+@@ -138,7 +138,7 @@ hostapd_config_write() {
+
+ # Check if key is set when encryption is used.
+ if isset encryption; then
+- assert isoneof encryption WPA WPA2 WPA/WPA2
++ assert isoneof encryption WPA2
+ assert isset key
+ fi
+
+@@ -398,15 +398,9 @@ hostapd_config_write() {
+ if isset encryption; then
+ local encryption_mode=0
+ case "${encryption}" in
+- WPA)
+- encryption_mode=1
+- ;;
+ WPA2)
+ encryption_mode=2
+ ;;
+- WPA/WPA2)
+- encryption_mode=3
+- ;;
+ esac
+
+ (
+diff --git a/src/hooks/ports/wireless-ap b/src/hooks/ports/wireless-ap
+index e393f5f..a964fac 100644
+--- a/src/hooks/ports/wireless-ap
++++ b/src/hooks/ports/wireless-ap
+@@ -65,7 +65,7 @@ hook_check_settings() {
+ assert isset SSID
+
+ if isset ENCRYPTION; then
+- assert isoneof ENCRYPTION WPA WPA2 WPA/WPA2
++ assert isoneof ENCRYPTION WPA2
+
+ assert isset KEY
+ assert [ ${#KEY} -ge 8 ]
+--
+2.39.2
+
diff --git a/network/patches/0041-wireless-ap-Add-support-for-WPA3-and-rewrite-WPA2.patch b/network/patches/0041-wireless-ap-Add-support-for-WPA3-and-rewrite-WPA2.patch
new file mode 100644
index 000000000..55b78d002
--- /dev/null
+++ b/network/patches/0041-wireless-ap-Add-support-for-WPA3-and-rewrite-WPA2.patch
@@ -0,0 +1,280 @@
+From 0a4c5abab952ae0d864505f037f46cd0a27d6701 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 30 Mar 2019 16:12:53 +0100
+Subject: [PATCH 041/304] wireless-ap: Add support for WPA3 and rewrite WPA2
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.hostapd | 90 +++++++++++++++++++++----------
+ src/helpers/hostapd-config-helper | 5 +-
+ src/hooks/ports/wireless-ap | 38 +++++++------
+ 3 files changed, 86 insertions(+), 47 deletions(-)
+
+diff --git a/src/functions/functions.hostapd b/src/functions/functions.hostapd
+index d3eaa74..6c2fbd9 100644
+--- a/src/functions/functions.hostapd
++++ b/src/functions/functions.hostapd
+@@ -61,13 +61,14 @@ hostapd_config_write() {
+ local channel_bandwidth
+ local country_code="$(wireless_get_reg_domain)"
+ local dfs="on"
+- local encryption
+ local environment="${WIRELESS_DEFAULT_ENVIRONMENT}"
+- local key
+ local mfp="off"
+ local mode
++ local secret
+ local ssid
+ local wmm="1"
++ local wpa2_personal="off"
++ local wpa3_personal="off"
+
+ while [ $# -gt 0 ]; do
+ case "${1}" in
+@@ -89,9 +90,6 @@ hostapd_config_write() {
+ --environment=*)
+ environment="$(cli_get_val "${1}")"
+ ;;
+- --key=*)
+- key=$(cli_get_val "${1}")
+- ;;
+ --mfp=*)
+ mfp="$(cli_get_val "${1}")"
+ ;;
+@@ -103,6 +101,9 @@ hostapd_config_write() {
+ return ${EXIT_ERROR}
+ fi
+ ;;
++ --secret=*)
++ secret="$(cli_get_val "${1}")"
++ ;;
+ --ssid=*)
+ ssid=$(cli_get_val "${1}")
+ ;;
+@@ -114,6 +115,12 @@ hostapd_config_write() {
+ wmm="0"
+ fi
+ ;;
++ --wpa2-personal=*)
++ wpa2_personal="$(cli_get_bool "${1}")"
++ ;;
++ --wpa3-personal=*)
++ wpa3_personal="$(cli_get_bool "${1}")"
++ ;;
+ *)
+ warning_log "Ignoring unknown argument '${1}'."
+ ;;
+@@ -136,12 +143,6 @@ hostapd_config_write() {
+ assert isset mode
+ assert isset ssid
+
+- # Check if key is set when encryption is used.
+- if isset encryption; then
+- assert isoneof encryption WPA2
+- assert isset key
+- fi
+-
+ # Check wireless environment
+ if ! wireless_environment_is_valid "${environment}"; then
+ error "Invalid wireless environment: ${environment}"
+@@ -166,6 +167,12 @@ hostapd_config_write() {
+ return ${EXIT_ERROR}
+ fi
+
++ # Check if secret is set for personal authentication
++ if ! isset secret && (enabled WPA3_PERSONAL || enabled WPA2_PERSONAL); then
++ error "Secret not set but personal authentication enabled"
++ return ${EXIT_ERROR}
++ fi
++
+ # 802.11ac/n flags
+ local ieee80211ac
+ local ieee80211n
+@@ -394,27 +401,52 @@ hostapd_config_write() {
+ print
+ ) >> ${file}
+
+- # Encryption settings
+- if isset encryption; then
+- local encryption_mode=0
+- case "${encryption}" in
+- WPA2)
+- encryption_mode=2
+- ;;
+- esac
++ # Authentication Settings
++ local wpa
++ local wpa_key_mgmt
++ local wpa_passphrase
++ local sae_password
++ local wpa_strict_rekey
++
++ # WPA3 Personal
++ if enabled WPA3_PERSONAL; then
++ # Enable RSN
++ wpa="2"
++
++ # Add WPA key management
++ list_append wpa_key_mgmt "SAE"
++ sae_password="${secret}"
++ fi
++
++ # WPA2 Personal
++ if enabled WPA2_PERSONAL; then
++ # Enable RSN
++ wpa="2"
++
++ # Add WPA key management
++ list_append wpa_key_mgmt "WPA-PSK-SHA256" "WPA-PSK"
++ wpa_passphrase="${secret}"
+
+- (
+- print "# Encryption settings"
+- print "wpa=${encryption_mode}"
+- print "wpa_passphrase=${key}"
+- print "wpa_key_mgmt=WPA-PSK-SHA256 WPA-PSK"
+- print "wpa_pairwise=${pairwise_ciphers[*]}"
+- print "rsn_pairwise=${pairwise_ciphers[*]}"
+- print "group_cipher=${group_ciphers[*]}"
+- print
+- ) >> ${file}
++ # Enable WPA strict rekey
++ wpa_strict_rekey="1"
+ fi
+
++ # Enable RSN ciphers when RSN is enabled
++ local rsn_pairwise
++ local group_cipher
++ if [ "${wpa}" = "2" ]; then
++ rsn_pairwise="${pairwise_ciphers[*]}"
++ group_cipher="${group_ciphers[*]}"
++ fi
++
++ local var
++ for var in wpa wpa_key_mgmt wpa_passphrase sae_password \
++ rsn_pairwise group_cipher wpa_strict_rekey; do
++ if [ -n "${!var}" ]; then
++ print "${var}=${!var}"
++ fi
++ done >> "${file}"
++
+ # Log configuration file
+ file_to_log DEBUG "${file}"
+
+diff --git a/src/helpers/hostapd-config-helper b/src/helpers/hostapd-config-helper
+index 7af723d..6d9f685 100644
+--- a/src/helpers/hostapd-config-helper
++++ b/src/helpers/hostapd-config-helper
+@@ -42,12 +42,13 @@ case "${action}" in
+ --channel="${CHANNEL}" \
+ --channel-bandwidth="${CHANNEL_BANDWIDTH}" \
+ --dfs="${DFS}" \
+- --encryption="${ENCRYPTION}" \
+ --environment="${ENVIRONMENT}" \
+- --key="${KEY}" \
++ --secret="${SECRET}" \
+ --mfp="${MFP}" \
+ --mode="${MODE}" \
+ --ssid="${SSID}" \
++ --wpa3-personal="${WPA3_PERSONAL}" \
++ --wpa2-personal="${WPA2_PERSONAL}" \
+ || exit $?
+ ;;
+
+diff --git a/src/hooks/ports/wireless-ap b/src/hooks/ports/wireless-ap
+index a964fac..7176ee5 100644
+--- a/src/hooks/ports/wireless-ap
++++ b/src/hooks/ports/wireless-ap
+@@ -29,15 +29,20 @@ HOOK_SETTINGS=(
+ "CHANNEL"
+ "CHANNEL_BANDWIDTH"
+ "DFS"
+- "ENCRYPTION"
+ "ENVIRONMENT"
+- "KEY"
+ "MFP"
+ "MODE"
+ "PHY"
++ "SECRET"
+ "SSID"
++ "WPA3_PERSONAL"
++ "WPA2_PERSONAL"
+ )
+
++# Disable WPA3+2 by default
++DEFAULT_WPA3_PERSONAL="off"
++DEFAULT_WPA2_PERSONAL="off"
++
+ # Broadcast SSID by default
+ DEFAULT_BROADCAST_SSID="on"
+
+@@ -64,14 +69,6 @@ hook_check_settings() {
+ assert ismac PHY
+ assert isset SSID
+
+- if isset ENCRYPTION; then
+- assert isoneof ENCRYPTION WPA2
+-
+- assert isset KEY
+- assert [ ${#KEY} -ge 8 ]
+- assert [ ${#KEY} -le 63 ]
+- fi
+-
+ assert wireless_environment_is_valid "${ENVIRONMENT}"
+ }
+
+@@ -99,9 +96,6 @@ hook_parse_cmdline() {
+ return ${EXIT_ERROR}
+ fi
+ ;;
+- --encryption=*)
+- ENCRYPTION=$(cli_get_val "${1}")
+- ;;
+ --environment=*)
+ ENVIRONMENT="$(cli_get_val "${1}")"
+
+@@ -110,9 +104,6 @@ hook_parse_cmdline() {
+ return ${EXIT_ERROR}
+ fi
+ ;;
+- --key=*)
+- KEY=$(cli_get_val "${1}")
+- ;;
+ --mac=*)
+ ADDRESS=$(cli_get_val "${1}")
+ ;;
+@@ -140,9 +131,18 @@ hook_parse_cmdline() {
+ --phy=*)
+ PHY=$(cli_get_val "${1}")
+ ;;
++ --secret=*)
++ SECRET="$(cli_get_val "${1}")"
++ ;;
+ --ssid=*)
+ SSID=$(cli_get_val "${1}")
+ ;;
++ --wpa2-personal=*)
++ WPA2_PERSONAL="$(cli_get_bool "${1}")"
++ ;;
++ --wpa3-personal=*)
++ WPA3_PERSONAL="$(cli_get_bool "${1}")"
++ ;;
+ *)
+ warning "Ignoring unknown argument '${1}'"
+ ;;
+@@ -174,6 +174,12 @@ hook_parse_cmdline() {
+ return ${EXIT_ERROR}
+ fi
+
++ # Check if SECRET is set when WPA* is enabled
++ if ! isset SECRET && (enabled WPA3_PERSONAL || enabled WPA2_PERSONAL); then
++ error "Secret is not set when PSK authentication is enabled"
++ return ${EXIT_ERROR}
++ fi
++
+ # Save address of phy do identify it again
+ PHY=$(phy_get ${PHY})
+ PHY=$(phy_get_address ${PHY})
+--
+2.39.2
+
diff --git a/network/patches/0042-hotplug-rename-Drop-unused-variable.patch b/network/patches/0042-hotplug-rename-Drop-unused-variable.patch
new file mode 100644
index 000000000..bbf85305c
--- /dev/null
+++ b/network/patches/0042-hotplug-rename-Drop-unused-variable.patch
@@ -0,0 +1,27 @@
+From 729cc3a2518ac4db00dd2ab390f7d253154f3333 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 30 Mar 2019 16:19:24 +0100
+Subject: [PATCH 042/304] hotplug-rename: Drop unused variable
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/udev/network-hotplug-rename | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/src/udev/network-hotplug-rename b/src/udev/network-hotplug-rename
+index 903a07c..5f82f7c 100644
+--- a/src/udev/network-hotplug-rename
++++ b/src/udev/network-hotplug-rename
+@@ -28,9 +28,6 @@ LOG_DISABLE_STDOUT="true"
+ # Read network settings
+ network_settings_read
+
+-# Setup the locking
+-LOCKFILE="${LOCK_DIR}/.network-rename-lock"
+-
+ # Check if the INTERFACE variable is properly set.
+ assert isset INTERFACE
+
+--
+2.39.2
+
diff --git a/network/patches/0043-hostapd-Allow-WPA2-authentication-only-with-SHA256.patch b/network/patches/0043-hostapd-Allow-WPA2-authentication-only-with-SHA256.patch
new file mode 100644
index 000000000..166386eda
--- /dev/null
+++ b/network/patches/0043-hostapd-Allow-WPA2-authentication-only-with-SHA256.patch
@@ -0,0 +1,29 @@
+From 21ef3b742e6031cb40d0da94015aced31fc18be2 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 30 Mar 2019 16:22:45 +0100
+Subject: [PATCH 043/304] hostapd: Allow WPA2 authentication only with SHA256
+
+This experimental change disables support for the legacy WPA2
+authentication that does not support SHA256.
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.hostapd | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/functions/functions.hostapd b/src/functions/functions.hostapd
+index 6c2fbd9..095beb8 100644
+--- a/src/functions/functions.hostapd
++++ b/src/functions/functions.hostapd
+@@ -424,7 +424,7 @@ hostapd_config_write() {
+ wpa="2"
+
+ # Add WPA key management
+- list_append wpa_key_mgmt "WPA-PSK-SHA256" "WPA-PSK"
++ list_append wpa_key_mgmt "WPA-PSK-SHA256"
+ wpa_passphrase="${secret}"
+
+ # Enable WPA strict rekey
+--
+2.39.2
+
diff --git a/network/patches/0044-wireless-ap-Enable-802.11w-by-default.patch b/network/patches/0044-wireless-ap-Enable-802.11w-by-default.patch
new file mode 100644
index 000000000..fd371582c
--- /dev/null
+++ b/network/patches/0044-wireless-ap-Enable-802.11w-by-default.patch
@@ -0,0 +1,31 @@
+From 298a1ffe3f10ec14416c3aed19bb541553de160a Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 30 Mar 2019 16:23:55 +0100
+Subject: [PATCH 044/304] wireless-ap: Enable 802.11w by default
+
+This causes some problems on broken Intel systems, but I
+guess it is better to prefer security than compatibility in the
+default settings.
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/hooks/ports/wireless-ap | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/src/hooks/ports/wireless-ap b/src/hooks/ports/wireless-ap
+index 7176ee5..9676369 100644
+--- a/src/hooks/ports/wireless-ap
++++ b/src/hooks/ports/wireless-ap
+@@ -50,8 +50,7 @@ DEFAULT_BROADCAST_SSID="on"
+ DEFAULT_DFS="on"
+
+ # 802.11w - Management Frame Protection
+-# Disable by default because many clients cannot connect when enabled
+-DEFAULT_MFP="off"
++DEFAULT_MFP="on"
+
+ DEFAULT_ENVIRONMENT="${WIRELESS_DEFAULT_ENVIRONMENT}"
+
+--
+2.39.2
+
diff --git a/network/patches/0045-hooks-Use-cli_get_bool-convenience-function-where-ev.patch b/network/patches/0045-hooks-Use-cli_get_bool-convenience-function-where-ev.patch
new file mode 100644
index 000000000..1b19ff1d9
--- /dev/null
+++ b/network/patches/0045-hooks-Use-cli_get_bool-convenience-function-where-ev.patch
@@ -0,0 +1,100 @@
+From f6659cc56ecdef375fb868a3a44ada37b4cbfc3c Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 30 Mar 2019 16:30:05 +0100
+Subject: [PATCH 045/304] hooks: Use cli_get_bool convenience function where
+ ever possible
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/hooks/ports/bonding | 11 +----------
+ src/hooks/ports/ethernet | 11 +----------
+ src/hooks/ports/wireless-ap | 22 ++--------------------
+ 3 files changed, 4 insertions(+), 40 deletions(-)
+
+diff --git a/src/hooks/ports/bonding b/src/hooks/ports/bonding
+index a0cf5c0..96cb854 100644
+--- a/src/hooks/ports/bonding
++++ b/src/hooks/ports/bonding
+@@ -59,16 +59,7 @@ hook_parse_cmdline() {
+ MODE=$(cli_get_val "${1}")
+ ;;
+ --offloading=*)
+- OFFLOADING="$(cli_get_val "${1}")"
+-
+- if enabled OFFLOADING; then
+- OFFLOADING="on"
+- elif disabled OFFLOADING; then
+- OFFLOADING="off"
+- else
+- error "Invalid value for offloading: ${OFFLOADING}"
+- return ${EXIT_ERROR}
+- fi
++ OFFLOADING="$(cli_get_bool "${1}")"
+ ;;
+ +*)
+ local slave=$(cli_get_val "${1:1}")
+diff --git a/src/hooks/ports/ethernet b/src/hooks/ports/ethernet
+index 82664fa..80b5503 100644
+--- a/src/hooks/ports/ethernet
++++ b/src/hooks/ports/ethernet
+@@ -85,16 +85,7 @@ hook_parse_cmdline() {
+ ;;
+
+ --offloading=*)
+- OFFLOADING="$(cli_get_val "${1}")"
+-
+- if enabled OFFLOADING; then
+- OFFLOADING="on"
+- elif disabled OFFLOADING; then
+- OFFLOADING="off"
+- else
+- error "Invalid value for offloading: ${OFFLOADING}"
+- return ${EXIT_ERROR}
+- fi
++ OFFLOADING="$(cli_get_bool "${1}")"
+ ;;
+
+ *)
+diff --git a/src/hooks/ports/wireless-ap b/src/hooks/ports/wireless-ap
+index 9676369..2528585 100644
+--- a/src/hooks/ports/wireless-ap
++++ b/src/hooks/ports/wireless-ap
+@@ -84,16 +84,7 @@ hook_parse_cmdline() {
+ CHANNEL_BANDWIDTH="$(cli_get_val "${1}")"
+ ;;
+ --dfs=*)
+- DFS="$(cli_get_val "${1}")"
+-
+- if enabled DFS; then
+- DFS="on"
+- elif disabled DFS; then
+- DFS="off"
+- else
+- error "Invalid value for DFS: ${DFS}"
+- return ${EXIT_ERROR}
+- fi
++ DFS="$(cli_get_bool "${1}")"
+ ;;
+ --environment=*)
+ ENVIRONMENT="$(cli_get_val "${1}")"
+@@ -107,16 +98,7 @@ hook_parse_cmdline() {
+ ADDRESS=$(cli_get_val "${1}")
+ ;;
+ --mfp=*)
+- MFP="$(cli_get_val "${1}")"
+-
+- if enabled MFP; then
+- MFP="on"
+- elif disabled MFP; then
+- MFP="off"
+- else
+- error "Invalid value for --mfp: ${MFP}"
+- return ${EXIT_ERROR}
+- fi
++ MFP="$(cli_get_bool "${1}")"
+ ;;
+ --mode=*)
+ MODE=$(cli_get_val "${1}")
+--
+2.39.2
+
diff --git a/network/patches/0046-hook-Rename-HOOK_CONFIG_SETTINGS-to-HOOK_SETTINGS.patch b/network/patches/0046-hook-Rename-HOOK_CONFIG_SETTINGS-to-HOOK_SETTINGS.patch
new file mode 100644
index 000000000..29b8c1a55
--- /dev/null
+++ b/network/patches/0046-hook-Rename-HOOK_CONFIG_SETTINGS-to-HOOK_SETTINGS.patch
@@ -0,0 +1,196 @@
+From 636f1b96fc0b60c47cf5636f95b1ee6c856a701c Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 30 Mar 2019 16:54:04 +0100
+Subject: [PATCH 046/304] hook: Rename HOOK_CONFIG_SETTINGS to HOOK_SETTINGS
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.zone | 8 ++++----
+ src/header-config | 5 ++++-
+ src/hooks/configs/dhcp | 13 +++++++++----
+ src/hooks/configs/ipv6-auto | 15 +++++----------
+ src/hooks/configs/pppoe-server | 24 +++++++++---------------
+ src/hooks/configs/static | 6 +++++-
+ 6 files changed, 36 insertions(+), 35 deletions(-)
+
+diff --git a/src/functions/functions.zone b/src/functions/functions.zone
+index e81371b..28fbecd 100644
+--- a/src/functions/functions.zone
++++ b/src/functions/functions.zone
+@@ -1312,8 +1312,8 @@ zone_config_settings_read() {
+ shift 2
+
+ local args
+- if [ $# -eq 0 ] && [ -n "${HOOK_CONFIG_SETTINGS}" ]; then
+- list_append args ${HOOK_CONFIG_SETTINGS}
++ if [ $# -eq 0 ] && [ -n "${HOOK_SETTINGS[*]}" ]; then
++ list_append args ${HOOK_SETTINGS[*]}
+ else
+ list_append args "$@"
+ fi
+@@ -1323,7 +1323,7 @@ zone_config_settings_read() {
+ }
+
+ zone_config_settings_write() {
+- assert [ $# -eq 2 ]
++ assert [ $# -eq 3 ]
+
+ local zone="${1}"
+ local hook="${2}"
+@@ -1333,7 +1333,7 @@ zone_config_settings_write() {
+
+ local path="${NETWORK_ZONES_DIR}/${zone}/configs/${hook}.${id}"
+ settings_write "${path}" \
+- --check="hook_check_config_settings" ${HOOK_CONFIG_SETTINGS[*]}
++ --check="hook_check_config_settings" HOOK ${HOOK_SETTINGS[*]}
+ }
+
+ zone_config_settings_destroy() {
+diff --git a/src/header-config b/src/header-config
+index 4458eaa..baeca5e 100644
+--- a/src/header-config
++++ b/src/header-config
+@@ -26,6 +26,9 @@ hook_new() {
+ local id=$(zone_config_get_new_id ${zone})
+ log DEBUG "ID for the config is: ${id}"
+
++ # Import all default variables
++ hook_set_defaults
++
+ # Parse command line arguments
+ if ! hook_parse_cmdline "${id}" "$@"; then
+ # Return an error if the parsing of the cmd line fails
+@@ -64,7 +67,7 @@ hook_edit() {
+ fi
+ fi
+
+- local ${HOOK_CONFIG_SETTINGS}
++ local ${HOOK_SETTINGS}
+
+ # If reading the config fails we cannot go on
+ if ! zone_config_settings_read "${zone}" "${config}"; then
+diff --git a/src/hooks/configs/dhcp b/src/hooks/configs/dhcp
+index b643022..1ad0694 100644
+--- a/src/hooks/configs/dhcp
++++ b/src/hooks/configs/dhcp
+@@ -21,11 +21,13 @@
+
+ . /usr/lib/network/header-config
+
+-HOOK_CONFIG_SETTINGS="HOOK ENABLE_IPV6 ENABLE_IPV4"
++HOOK_SETTINGS=(
++ "ENABLE_IPV6"
++ "ENABLE_IPV4"
++)
+
+-# Default settings.
+-ENABLE_IPV6="on"
+-ENABLE_IPV4="on"
++DEFAULT_ENABLE_IPV6="on"
++DEFAULT_ENABLE_IPV4="on"
+
+ hook_check_config_settings() {
+ assert isset ENABLE_IPV6
+@@ -78,6 +80,9 @@ hook_new() {
+ local id=$(zone_config_get_new_id ${zone})
+ log DEBUG "ID for the config is: ${id}"
+
++ # Import defaults
++ hook_set_defaults
++
+ if ! hook_parse_cmdline "${id}" "$@"; then
+ # Return an error if the parsing of the cmd line fails
+ return ${EXIT_ERROR}
+diff --git a/src/hooks/configs/ipv6-auto b/src/hooks/configs/ipv6-auto
+index 8796723..6fd90a5 100644
+--- a/src/hooks/configs/ipv6-auto
++++ b/src/hooks/configs/ipv6-auto
+@@ -21,10 +21,12 @@
+
+ . /usr/lib/network/header-config
+
+-HOOK_CONFIG_SETTINGS="HOOK PRIVACY_EXTENSIONS"
++HOOK_SETTINGS=(
++ "PRIVACY_EXTENSIONS"
++)
+
+ # Privacy Extensions are disabled by default
+-PRIVACY_EXTENSIONS="off"
++DEFAULT_PRIVACY_EXTENSIONS="off"
+
+ hook_check_config_settings() {
+ assert isbool PRIVACY_EXTENSIONS
+@@ -35,17 +37,10 @@ hook_parse_cmdline() {
+ shift
+
+ local arg
+-
+ while read arg; do
+ case "${arg}" in
+ --privacy-extensions=*)
+- local val="$(cli_get_val "${arg}")"
+-
+- if enabled val; then
+- PRIVACY_EXTENSIONS="on"
+- else
+- PRIVACY_EXTENSIONS="off"
+- fi
++ PRIVACY_EXTENSIONS="$(cli_get_bool "${arg}")"
+ ;;
+ esac
+ done <<< "$(args "$@")"
+diff --git a/src/hooks/configs/pppoe-server b/src/hooks/configs/pppoe-server
+index 6a2c014..4d79549 100644
+--- a/src/hooks/configs/pppoe-server
++++ b/src/hooks/configs/pppoe-server
+@@ -21,21 +21,15 @@
+
+ . /usr/lib/network/header-config
+
+-HOOK_CONFIG_SETTINGS="HOOK DNS_SERVERS MTU SERVICE_NAME SUBNET MAX_SESSIONS"
+-
+-# Maximum Transmission Unit.
+-MTU=1492
+-
+-# Service Name.
+-SERVICE_NAME=
+-
+-# A subnet. Addresses from this subnet will be given to the remote hosts.
+-# The net address will be the gateway address for the PPPoE server.
+-SUBNET=
+-
+-# Defines the max. number of sessions per MAC address.
+-# 0 = unlimited.
+-MAX_SESSIONS=0
++HOOK_SETTINGS=(
++ "DNS_SERVERS"
++ "MTU"
++ "SERVICE_NAME"
++ "SUBNET MAX_SESSIONS"
++)
++
++DEFAULT_MTU=1492
++DEFAULT_MAX_SESSIONS=0
+
+ hook_check_config_settings() {
+ assert isset MTU
+diff --git a/src/hooks/configs/static b/src/hooks/configs/static
+index 23ae2d8..6fddc32 100644
+--- a/src/hooks/configs/static
++++ b/src/hooks/configs/static
+@@ -21,7 +21,11 @@
+
+ . /usr/lib/network/header-config
+
+-HOOK_CONFIG_SETTINGS="HOOK ADDRESS PREFIX GATEWAY"
++HOOK_SETTINGS=(
++ "ADDRESS"
++ "PREFIX"
++ "GATEWAY"
++)
+
+ hook_check_config_settings() {
+ local protocol="$(ip_detect_protocol "${ADDRESS}")"
+--
+2.39.2
+
diff --git a/network/patches/0047-dhcp-Rename-enabled-from-configuration-parameters.patch b/network/patches/0047-dhcp-Rename-enabled-from-configuration-parameters.patch
new file mode 100644
index 000000000..a7bf304c6
--- /dev/null
+++ b/network/patches/0047-dhcp-Rename-enabled-from-configuration-parameters.patch
@@ -0,0 +1,99 @@
+From 8ece5c30bf5917d4cd6dfb460207d1e85eb5df73 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 30 Mar 2019 16:57:31 +0100
+Subject: [PATCH 047/304] dhcp: Rename "enabled" from configuration parameters
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/hooks/configs/dhcp | 38 +++++++++++++++-----------------------
+ 1 file changed, 15 insertions(+), 23 deletions(-)
+
+diff --git a/src/hooks/configs/dhcp b/src/hooks/configs/dhcp
+index 1ad0694..1c75193 100644
+--- a/src/hooks/configs/dhcp
++++ b/src/hooks/configs/dhcp
+@@ -22,18 +22,16 @@
+ . /usr/lib/network/header-config
+
+ HOOK_SETTINGS=(
+- "ENABLE_IPV6"
+- "ENABLE_IPV4"
++ "IPV6"
++ "IPV4"
+ )
+
+-DEFAULT_ENABLE_IPV6="on"
+-DEFAULT_ENABLE_IPV4="on"
++DEFAULT_IPV6="on"
++DEFAULT_IPV4="on"
+
+ hook_check_config_settings() {
+- assert isset ENABLE_IPV6
+- assert isbool ENABLE_IPV6
+- assert isset ENABLE_IPV4
+- assert isbool ENABLE_IPV4
++ assert isbool IPV6
++ assert isbool IPV4
+ }
+
+ hook_parse_cmdline() {
+@@ -42,17 +40,11 @@ hook_parse_cmdline() {
+
+ while [ $# -gt 0 ]; do
+ case "${1}" in
+- --enable-ipv6)
+- ENABLE_IPV6="on"
++ --ipv6)
++ IPV6="$(cli_get_bool "${1}")"
+ ;;
+- --disable-ipv6)
+- ENABLE_IPV6="off"
+- ;;
+- --enable-ipv4)
+- ENABLE_IPV4="on"
+- ;;
+- --disable-ipv4)
+- ENABLE_IPV4="off"
++ --ipv4)
++ IPV4="$(cli_get_bool "${1}")"
+ ;;
+ *)
+ warning "Ignoring unknown option '${1}'"
+@@ -62,8 +54,8 @@ hook_parse_cmdline() {
+ done
+
+ # Check if the user disabled ipv6 and ipv4
+- if ! enabled ENABLE_IPV6 && ! enabled ENABLE_IPV4; then
+- log ERROR "You disabled IPv6 and IPv4. At least one must be enabled"
++ if ! enabled IPV6 && ! enabled IPV4; then
++ error "You disabled IPv6 and IPv4. At least one must be enabled"
+ return ${EXIT_ERROR}
+ fi
+ }
+@@ -106,12 +98,12 @@ hook_up() {
+ zone_config_settings_read "${zone}" "${config}"
+
+ # Start dhclient for IPv6 on this zone if enabled.
+- if enabled ENABLE_IPV6; then
++ if enabled IPV6; then
+ dhclient_start ${zone} ipv6
+ fi
+
+ # Start dhclient for IPv4 on this zone if enabled.
+- if enabled ENABLE_IPV4; then
++ if enabled IPV4; then
+ dhclient_start ${zone} ipv4
+ fi
+
+@@ -165,7 +157,7 @@ hook_status() {
+
+ cli_print_fmt1 3 "${proto}"
+
+- if enabled ENABLE_${proto^^}; then
++ if enabled "${proto^^}"; then
+ cli_print_fmt1 4 "Status" "enabled"
+
+ local address="$(db_get "${zone}/${_proto}/local-ip-address")"
+--
+2.39.2
+
diff --git a/network/patches/0048-dhcp-Fix-syntax-error-in-last-commit.patch b/network/patches/0048-dhcp-Fix-syntax-error-in-last-commit.patch
new file mode 100644
index 000000000..1f085d2ed
--- /dev/null
+++ b/network/patches/0048-dhcp-Fix-syntax-error-in-last-commit.patch
@@ -0,0 +1,30 @@
+From e80eb68607dbdad381e3bb113521609c44fa8cd6 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 30 Mar 2019 17:05:44 +0100
+Subject: [PATCH 048/304] dhcp: Fix syntax error in last commit
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/hooks/configs/dhcp | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/hooks/configs/dhcp b/src/hooks/configs/dhcp
+index 1c75193..ba5608a 100644
+--- a/src/hooks/configs/dhcp
++++ b/src/hooks/configs/dhcp
+@@ -40,10 +40,10 @@ hook_parse_cmdline() {
+
+ while [ $# -gt 0 ]; do
+ case "${1}" in
+- --ipv6)
++ --ipv6=*)
+ IPV6="$(cli_get_bool "${1}")"
+ ;;
+- --ipv4)
++ --ipv4=*)
+ IPV4="$(cli_get_bool "${1}")"
+ ;;
+ *)
+--
+2.39.2
+
diff --git a/network/patches/0049-hooks-Add-HOOK_UNIQUE-which-stops-us-from-creating-m.patch b/network/patches/0049-hooks-Add-HOOK_UNIQUE-which-stops-us-from-creating-m.patch
new file mode 100644
index 000000000..d790e6c64
--- /dev/null
+++ b/network/patches/0049-hooks-Add-HOOK_UNIQUE-which-stops-us-from-creating-m.patch
@@ -0,0 +1,158 @@
+From fdd9ac5fdd66b6cbdf014554281a9bb11ed0379d Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 30 Mar 2019 17:05:58 +0100
+Subject: [PATCH 049/304] hooks: Add HOOK_UNIQUE which stops us from creating
+ multiple instances
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/header-config | 9 +++++++++
+ src/hooks/configs/dhcp | 25 -------------------------
+ src/hooks/configs/ipv6-auto | 22 ----------------------
+ src/hooks/configs/pppoe-server | 22 ----------------------
+ src/hooks/configs/static | 3 +++
+ 5 files changed, 12 insertions(+), 69 deletions(-)
+
+diff --git a/src/header-config b/src/header-config
+index baeca5e..c6a775c 100644
+--- a/src/header-config
++++ b/src/header-config
+@@ -19,10 +19,19 @@
+ # #
+ ###############################################################################
+
++# Allow only one instance of this hook
++HOOK_UNIQUE="true"
++
+ hook_new() {
+ local zone="${1}"
+ shift
+
++ # Check if we are allowed to have multiple configurations of $HOOK
++ if enabled HOOK_UNIQUE && zone_config_hook_is_configured "${zone}" "${HOOK}"; then
++ error "You can only have one configuration of type ${HOOK}"
++ return ${EXIT_CONF_ERROR}
++ fi
++
+ local id=$(zone_config_get_new_id ${zone})
+ log DEBUG "ID for the config is: ${id}"
+
+diff --git a/src/hooks/configs/dhcp b/src/hooks/configs/dhcp
+index ba5608a..127ce59 100644
+--- a/src/hooks/configs/dhcp
++++ b/src/hooks/configs/dhcp
+@@ -60,31 +60,6 @@ hook_parse_cmdline() {
+ fi
+ }
+
+-hook_new() {
+- local zone="${1}"
+- shift
+-
+- if zone_config_hook_is_configured ${zone} "dhcp"; then
+- log ERROR "You can configure the dhcp hook only once for a zone"
+- return ${EXIT_ERROR}
+- fi
+-
+- local id=$(zone_config_get_new_id ${zone})
+- log DEBUG "ID for the config is: ${id}"
+-
+- # Import defaults
+- hook_set_defaults
+-
+- if ! hook_parse_cmdline "${id}" "$@"; then
+- # Return an error if the parsing of the cmd line fails
+- return ${EXIT_ERROR}
+- fi
+-
+- zone_config_settings_write "${zone}" "${HOOK}" "${id}"
+-
+- exit ${EXIT_OK}
+-}
+-
+ hook_up() {
+ local zone=${1}
+ local config=${2}
+diff --git a/src/hooks/configs/ipv6-auto b/src/hooks/configs/ipv6-auto
+index 6fd90a5..ecfafcd 100644
+--- a/src/hooks/configs/ipv6-auto
++++ b/src/hooks/configs/ipv6-auto
+@@ -46,28 +46,6 @@ hook_parse_cmdline() {
+ done <<< "$(args "$@")"
+ }
+
+-hook_new() {
+- local zone="${1}"
+- shift
+-
+- if zone_config_hook_is_configured ${zone} "ipv6-auto"; then
+- log ERROR "You can configure the ipv6-auto hook only once for a zone"
+- return ${EXIT_ERROR}
+- fi
+-
+- local id=$(zone_config_get_new_id ${zone})
+- log DEBUG "ID for the config is: ${id}"
+-
+- if ! hook_parse_cmdline "${id}" "$@"; then
+- # Return an error if the parsing of the cmd line fails
+- return ${EXIT_ERROR}
+- fi
+-
+- zone_config_settings_write "${zone}" "${HOOK}" "${id}"
+-
+- exit ${EXIT_OK}
+-}
+-
+ hook_up() {
+ local zone=${1}
+ shift
+diff --git a/src/hooks/configs/pppoe-server b/src/hooks/configs/pppoe-server
+index 4d79549..e800bf4 100644
+--- a/src/hooks/configs/pppoe-server
++++ b/src/hooks/configs/pppoe-server
+@@ -93,28 +93,6 @@ hook_parse_cmdline() {
+ done
+ }
+
+-hook_new() {
+- local zone=${1}
+- shift
+-
+- if zone_config_hook_is_configured ${zone} "pppoe-server"; then
+- log ERROR "You can configure the pppoe-server hook only once for a zone"
+- return ${EXIT_ERROR}
+- fi
+-
+- local id=$(zone_config_get_new_id ${zone})
+- log DEBUG "ID for the config is: ${id}"
+-
+- if ! hook_parse_cmdline "${id}" "$@"; then
+- # Return an error if the parsing of the cmd line fails
+- return ${EXIT_ERROR}
+- fi
+-
+- zone_config_settings_write "${zone}" "${HOOK}" "${id}"
+-
+- exit ${EXIT_OK}
+-}
+-
+ hook_up() {
+ local zone=${1}
+ local config=${2}
+diff --git a/src/hooks/configs/static b/src/hooks/configs/static
+index 6fddc32..046183a 100644
+--- a/src/hooks/configs/static
++++ b/src/hooks/configs/static
+@@ -21,6 +21,9 @@
+
+ . /usr/lib/network/header-config
+
++# Allow multiple instances of this hook
++HOOK_UNIQUE="false"
++
+ HOOK_SETTINGS=(
+ "ADDRESS"
+ "PREFIX"
+--
+2.39.2
+
diff --git a/network/patches/0050-wireless-ap-Check-that-secret-has-the-correct-length.patch b/network/patches/0050-wireless-ap-Check-that-secret-has-the-correct-length.patch
new file mode 100644
index 000000000..00e9e26ba
--- /dev/null
+++ b/network/patches/0050-wireless-ap-Check-that-secret-has-the-correct-length.patch
@@ -0,0 +1,105 @@
+From d695b280e9972311ae8c4bc688c0898ade1281e6 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 30 Mar 2019 18:14:07 +0100
+Subject: [PATCH 050/304] wireless-ap: Check that secret has the correct length
+ and no invalid characters
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.util | 13 +++++++++++++
+ src/functions/functions.wireless | 23 +++++++++++------------
+ src/hooks/ports/wireless-ap | 14 +++++++++++---
+ 3 files changed, 35 insertions(+), 15 deletions(-)
+
+diff --git a/src/functions/functions.util b/src/functions/functions.util
+index 4c1dbb4..7379a98 100644
+--- a/src/functions/functions.util
++++ b/src/functions/functions.util
+@@ -745,6 +745,19 @@ contains_spaces() {
+ return ${EXIT_FALSE}
+ }
+
++contains_non_ascii_characters() {
++ local value="$@"
++
++ # Strip away all ASCII characters
++ local non_ascii="${value//[[:ascii:]]/}"
++
++ if isset non_ascii; then
++ return ${EXIT_TRUE}
++ fi
++
++ return ${EXIT_FALSE}
++}
++
+ string_match() {
+ local match=${1}
+ local string=${2}
+diff --git a/src/functions/functions.wireless b/src/functions/functions.wireless
+index 12204c0..733a356 100644
+--- a/src/functions/functions.wireless
++++ b/src/functions/functions.wireless
+@@ -397,24 +397,23 @@ wireless_set_channel() {
+ }
+
+ wireless_pre_shared_key_is_valid() {
+- local encryption_mode="${1}"
+- local psk="${2}"
++ local psk="${1}"
+
+ # Length of the PSK
+ local l="${#psk}"
+
+- case "${encryption_mode}" in
+- # For WPA*, the key must be between 8 and 63 chars
+- WPA2-PSK|WPA2-PSK-SHA256|WPA-PSK|WPA-PSK-SHA256)
+- if [ ${l} -ge 8 ] && [ ${l} -le 63 ]; then
+- return ${EXIT_TRUE}
+- fi
++ # For WPA*, the key must be between 8 and 63 chars
++ if [ ${l} -lt 8 ] || [ ${l} -gt 63 ]; then
++ return ${EXIT_FALSE}
++ fi
+
+- return ${EXIT_FALSE}
+- ;;
+- esac
++ # Can only contain ASCII chararcters
++ if contains_non_ascii_characters "${psk}"; then
++ return ${EXIT_FALSE}
++ fi
+
+- return ${EXIT_ERROR}
++ # Seems OK
++ return ${EXIT_TRUE}
+ }
+
+ wireless_client_is_connected() {
+diff --git a/src/hooks/ports/wireless-ap b/src/hooks/ports/wireless-ap
+index 2528585..26e14d6 100644
+--- a/src/hooks/ports/wireless-ap
++++ b/src/hooks/ports/wireless-ap
+@@ -156,9 +156,17 @@ hook_parse_cmdline() {
+ fi
+
+ # Check if SECRET is set when WPA* is enabled
+- if ! isset SECRET && (enabled WPA3_PERSONAL || enabled WPA2_PERSONAL); then
+- error "Secret is not set when PSK authentication is enabled"
+- return ${EXIT_ERROR}
++ if enabled WPA3_PERSONAL || enabled WPA2_PERSONAL; then
++ if ! isset SECRET; then
++ error "Secret is not set when PSK authentication is enabled"
++ return ${EXIT_ERROR}
++ fi
++
++ # Check if SECRET is valid
++ if ! wireless_pre_shared_key_is_valid "${SECRET}"; then
++ error "The secret is in an invalid format"
++ return ${EXIT_ERROR}
++ fi
+ fi
+
+ # Save address of phy do identify it again
+--
+2.39.2
+
diff --git a/network/patches/0051-Drop-old-locking-functions.patch b/network/patches/0051-Drop-old-locking-functions.patch
new file mode 100644
index 000000000..4a0ee12cc
--- /dev/null
+++ b/network/patches/0051-Drop-old-locking-functions.patch
@@ -0,0 +1,235 @@
+From d4564f2b7efa20ea025b6918b012656927fd342a Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 30 Mar 2019 18:51:13 +0100
+Subject: [PATCH 051/304] Drop old locking functions
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.device | 12 ++----
+ src/functions/functions.editor | 51 +++++++++--------------
+ src/functions/functions.firewall | 3 +-
+ src/functions/functions.lock | 70 --------------------------------
+ 4 files changed, 26 insertions(+), 110 deletions(-)
+
+diff --git a/src/functions/functions.device b/src/functions/functions.device
+index 48f2440..f52eee5 100644
+--- a/src/functions/functions.device
++++ b/src/functions/functions.device
+@@ -997,15 +997,11 @@ device_get_link_string() {
+ }
+
+ device_auto_configure_smp_affinity() {
+- assert [ $# -eq 1 ]
+-
+- local device=${1}
+-
+- if lock_acquire "smp-affinity" 60; then
+- device_set_smp_affinity ${device} auto
++ local device="${1}"
++ assert isset device
+
+- lock_release "smp-affinity"
+- fi
++ lock "smp-affinity" \
++ device_set_smp_affinity "${device}" "auto"
+ }
+
+ device_set_smp_affinity() {
+diff --git a/src/functions/functions.editor b/src/functions/functions.editor
+index 6edac62..8f0cc0b 100644
+--- a/src/functions/functions.editor
++++ b/src/functions/functions.editor
+@@ -19,17 +19,6 @@
+ # #
+ ###############################################################################
+
+-editor_cleanup() {
+- # Cleanup after a file was edited
+- assert [ $# -eq 2 ]
+-
+- local file=${1}
+- local temp_file=${2}
+-
+- lock_release "${file}.lock"
+- rm -f ${temp_file}
+-}
+-
+ editor_find_best() {
+ # Open a file with the best available editor
+ assert [ $# -eq 1 ]
+@@ -62,31 +51,26 @@ editor_find_best() {
+ }
+
+ editor() {
+- # This function open a file for editing and take care of all preperation and postprocessing
+- assert [ $# -ge 1 ]
++ local file="${1}"
++ assert isset file
+
+- local file=${1}
+ if [ ! -f ${file} ] || [ ! -w ${file} ]; then
+ error "${file} is not valid file or is not writeable"
+ return ${EXIT_ERROR}
+ fi
+
+- local check_func=${2}
++ lock "${file}.lock" __editor "$@"
++}
+
+- # check if the file is locked
+- if lock_exists "${file}.lock"; then
+- error "Cannot edit ${file} because it is locked"
+- return ${EXIT_ERROR}
+- fi
++__editor() {
++ # This function open a file for editing and take care of all preperation and postprocessing
++ assert [ $# -ge 1 ]
+
+- # lock the file
+- if ! lock_acquire "${file}.lock"; then
+- error "Cannot lock file ${file}"
+- return ${EXIT_ERROR}
+- fi
++ local file="${1}"
++ local check_func="${2}"
+
+ # create a temporary file
+- local temp_file=$(mktemp)
++ local temp_file="$(mktemp)"
+
+ if ! [ -f "${temp_file}" ]; then
+ error "Cannot create temporary file"
+@@ -98,21 +82,26 @@ editor() {
+ # edit the file
+ if ! editor_find_best "${temp_file}"; then
+ error "Could not edit ${file}"
+- # cleanup
+- editor_cleanup "${file}" "${temp_file}"
++
++ # Delete temporary file
++ file_delete "${temp_file}"
++
++ return ${EXIT_ERROR}
+ fi
+
+ # run the check if we have one
+ if isset check_func && ! editor_check "${check_func}" "${temp_file}"; then
++ # Delete temporary file
++ file_delete "${temp_file}"
++
+ return ${EXIT_ERROR}
+ fi
+
+ # copy the changes back
+ cp -f "${temp_file}" "${file}"
+
+- # cleanup
+- editor_cleanup "${file}" "${temp_file}"
+-
++ # Delete temporary file
++ file_delete "${temp_file}"
+ }
+
+ editor_check() {
+diff --git a/src/functions/functions.firewall b/src/functions/functions.firewall
+index 347916e..e22576b 100644
+--- a/src/functions/functions.firewall
++++ b/src/functions/functions.firewall
+@@ -269,7 +269,8 @@ firewall_panic() {
+ }
+
+ firewall_lock_acquire() {
+- lock_acquire ${RUN_DIR}/.firewall_lock
++ # XXX DEPRECATED
++ #lock_acquire ${RUN_DIR}/.firewall_lock
+
+ # Make sure the lock is released after the firewall
+ # script has crashed or exited early.
+diff --git a/src/functions/functions.lock b/src/functions/functions.lock
+index 6295a22..fd15e5e 100644
+--- a/src/functions/functions.lock
++++ b/src/functions/functions.lock
+@@ -19,16 +19,6 @@
+ # #
+ ###############################################################################
+
+-__lock_path() {
+- local name=${1}
+-
+- if [ "${name:0:1}" = "/" ]; then
+- echo "${name}"
+- else
+- echo "${LOCK_DIR}/network-${name}"
+- fi
+-}
+-
+ lock() {
+ local lock="${1}"
+ shift
+@@ -65,63 +55,3 @@ lock() {
+ exit ${ret}
+ ) 9>${lock} || exit $?
+ }
+-
+-lock_exists() {
+- local name=${1}
+- assert isset name
+-
+- local lockfile=$(__lock_path ${name})
+-
+- if [ -e "${lockfile}" ]; then
+- return ${EXIT_TRUE}
+- else
+- return ${EXIT_FALSE}
+- fi
+-}
+-
+-lock_acquire() {
+- local name=${1}
+- assert isset name
+-
+- # timeout value in seconds
+- local timeout=${2}
+-
+- if ! isset timeout; then
+- timeout=0
+- fi
+-
+- local lockfile=$(__lock_path ${name})
+-
+- timeout=$(( ${timeout} * 4 ))
+-
+- log DEBUG "Acquiring lock '${name}'"
+-
+- # Wait until lock is available
+- while [ ${timeout} -gt 0 ] && [ -e "${lockfile}" ]; do
+- timeout=$(( ${timeout} - 1 ))
+- sleep 0.25
+- done
+-
+- # If another lock still exists, we return an error
+- if [ -e "${lockfile}" ]; then
+- error "Could not acquire lock '${name}'"
+- return ${EXIT_ERROR}
+- fi
+-
+- # Write out pid to the lockfile and make sure that
+- # nobody else can access it.
+- echo "$$" > ${lockfile}
+- chmod 600 ${lockfile}
+-}
+-
+-lock_release() {
+- local name=${1}
+- assert isset name
+-
+- local lockfile=$(__lock_path ${name})
+-
+- log DEBUG "Releasing lock '${name}'"
+-
+- # Remove the lockfile (okay if it does not exist).
+- rm -f ${lockfile}
+-}
+--
+2.39.2
+
diff --git a/network/patches/0052-ip-tunnel-Enable-support-for-6in4-tunnels.patch b/network/patches/0052-ip-tunnel-Enable-support-for-6in4-tunnels.patch
new file mode 100644
index 000000000..403991b84
--- /dev/null
+++ b/network/patches/0052-ip-tunnel-Enable-support-for-6in4-tunnels.patch
@@ -0,0 +1,26 @@
+From 55dcff454fa68dc2ff82f3dfbbafd75d3799b0ae Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 30 Mar 2019 18:56:04 +0100
+Subject: [PATCH 052/304] ip-tunnel: Enable support for 6in4 tunnels
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/hooks/zones/ip-tunnel | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/hooks/zones/ip-tunnel b/src/hooks/zones/ip-tunnel
+index 634154e..c4a4fb4 100644
+--- a/src/hooks/zones/ip-tunnel
++++ b/src/hooks/zones/ip-tunnel
+@@ -21,7 +21,7 @@
+
+ . /usr/lib/network/header-zone
+
+-SUPPORTED_IP_TUNNEL_MODES="gre vti"
++SUPPORTED_IP_TUNNEL_MODES="gre sit vti"
+
+ HOOK_SETTINGS=(
+ "MARK"
+--
+2.39.2
+
diff --git a/network/patches/0053-lock-Cleanup-lock-files.patch b/network/patches/0053-lock-Cleanup-lock-files.patch
new file mode 100644
index 000000000..44176d537
--- /dev/null
+++ b/network/patches/0053-lock-Cleanup-lock-files.patch
@@ -0,0 +1,37 @@
+From 1ed79f5432d0bd4c4f0c8f8692b488c268e379a4 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 30 Mar 2019 19:03:24 +0100
+Subject: [PATCH 053/304] lock: Cleanup lock files
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.lock | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/src/functions/functions.lock b/src/functions/functions.lock
+index fd15e5e..c01fcf3 100644
+--- a/src/functions/functions.lock
++++ b/src/functions/functions.lock
+@@ -29,6 +29,7 @@ lock() {
+ fi
+
+ local timeout="60"
++ local ret=0
+
+ # Make partent directory
+ make_parent_directory "${lock}"
+@@ -53,5 +54,10 @@ lock() {
+ log DEBUG "Released lock ${lock}"
+
+ exit ${ret}
+- ) 9>${lock} || exit $?
++ ) 9>${lock} || ret=$?
++
++ # Cleanup log file
++ file_delete "${lock}"
++
++ return ${ret}
+ }
+--
+2.39.2
+
diff --git a/network/patches/0054-hostapd-Require-MFP-for-SAE-when-it-is-enabled.patch b/network/patches/0054-hostapd-Require-MFP-for-SAE-when-it-is-enabled.patch
new file mode 100644
index 000000000..2b20f4cbd
--- /dev/null
+++ b/network/patches/0054-hostapd-Require-MFP-for-SAE-when-it-is-enabled.patch
@@ -0,0 +1,45 @@
+From 1ef692c599a77fcb0683e3196b8f4b56f52644da Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 31 Mar 2019 13:10:30 +0200
+Subject: [PATCH 054/304] hostapd: Require MFP for SAE when it is enabled
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.hostapd | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/src/functions/functions.hostapd b/src/functions/functions.hostapd
+index 095beb8..410e6e5 100644
+--- a/src/functions/functions.hostapd
++++ b/src/functions/functions.hostapd
+@@ -407,6 +407,7 @@ hostapd_config_write() {
+ local wpa_passphrase
+ local sae_password
+ local wpa_strict_rekey
++ local sae_require_mfp
+
+ # WPA3 Personal
+ if enabled WPA3_PERSONAL; then
+@@ -416,6 +417,10 @@ hostapd_config_write() {
+ # Add WPA key management
+ list_append wpa_key_mgmt "SAE"
+ sae_password="${secret}"
++
++ if enabled MFP; then
++ sae_require_mfp="1"
++ fi
+ fi
+
+ # WPA2 Personal
+@@ -441,7 +446,7 @@ hostapd_config_write() {
+
+ local var
+ for var in wpa wpa_key_mgmt wpa_passphrase sae_password \
+- rsn_pairwise group_cipher wpa_strict_rekey; do
++ rsn_pairwise group_cipher wpa_strict_rekeyi sae_require_mfp; do
+ if [ -n "${!var}" ]; then
+ print "${var}=${!var}"
+ fi
+--
+2.39.2
+
diff --git a/network/patches/0055-bird-Write-IPv6-router-advertisement-configuration.patch b/network/patches/0055-bird-Write-IPv6-router-advertisement-configuration.patch
new file mode 100644
index 000000000..32dc97ba2
--- /dev/null
+++ b/network/patches/0055-bird-Write-IPv6-router-advertisement-configuration.patch
@@ -0,0 +1,117 @@
+From 7a3747a1b0d2e219600979aa4286e8ffd96d5b59 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 31 Mar 2019 14:14:55 +0200
+Subject: [PATCH 055/304] bird: Write IPv6 router advertisement configuration
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.bird | 89 ++++++++++++++++++++++++++++++++++++
+ 1 file changed, 89 insertions(+)
+
+diff --git a/src/functions/functions.bird b/src/functions/functions.bird
+index c6fea32..950bb78 100644
+--- a/src/functions/functions.bird
++++ b/src/functions/functions.bird
+@@ -84,6 +84,9 @@ bird_generate_config() {
+ print "}"
+ print
+ done >> ${BIRD_CONF}
++
++ # Write IPv6 Router Advertisement configuration
++ __bird_ipv6_radv >> ${BIRD_CONF}
+ }
+
+ __bird_static_routes() {
+@@ -122,3 +125,89 @@ __bird_static_routes() {
+ esac
+ done < ${NETWORK_CONFIG_ROUTES}
+ }
++
++__bird_ipv6_radv() {
++ print "protocol radv {"
++
++ local zone
++ for zone in $(zones_get_local); do
++ log DEBUG "Writing bird radv configuration for ${zone}"
++
++ # Skip if there is no prefix or prefix is link-local.
++ local addr="$(db_get "${zone}/ipv6/local-ip-address")"
++ if [ -z "${addr}" ] || [ "${addr:0:5}" = "fe80:" ]; then
++ continue
++ fi
++
++ # Check if the subnet is configured by the DHCP server.
++ local dhcp="false"
++ local prefix="$(ipv6_get_network "${addr}")"
++ if isset prefix && dhcpd_subnet_match ipv6 "${prefix}"; then
++ dhcp="true"
++ fi
++
++ print " interface \"${zone}\" {"
++ # Failover to other routers within 10s
++ print " max ra interval 10;"
++
++ # Tell clients we are running DHCP
++ if enabled dhcp; then
++ print " managed yes;"
++ print " other config yes;"
++ fi
++
++ if device_exists "${zone}"; then
++ # Announce link MTU
++ local mtu="$(device_get_mtu "${zone}")"
++ print " link mtu ${mtu};"
++ fi
++
++ print # empty line
++
++ # Announce all prefixes
++ print " prefix ::/0 {"
++
++ if enabled dhcp; then
++ print " autonomous off;"
++ fi
++
++ print " };"
++ print " };\n"
++ done
++
++ # Advertise any DNS servers
++ if enabled DNS_ADVERTISE_SERVERS; then
++ # Get a list of all IPv6 name servers
++ local servers=()
++ local server
++ for server in $(dns_server_list_sorted); do
++ # Skip any non-IPv6 servers
++ ipv6_is_valid "${server}" || continue
++
++ servers+=( "${server}" )
++ done
++
++ if isset servers; then
++ print " rdnss {"
++
++ local server
++ for server in ${servers}; do
++ print " ns ${server};"
++ done
++
++ print " };"
++ fi
++ fi
++
++ # DNS Search Domain
++ print " dnssl {"
++
++ local domain
++ for domain in $(dns_get_search_domains); do
++ print " domain \"${domain}\";"
++ done
++
++ print " };"
++
++ print "}\n"
++}
+--
+2.39.2
+
diff --git a/network/patches/0056-Drop-code-for-radvd.patch b/network/patches/0056-Drop-code-for-radvd.patch
new file mode 100644
index 000000000..52241fd28
--- /dev/null
+++ b/network/patches/0056-Drop-code-for-radvd.patch
@@ -0,0 +1,314 @@
+From 1cb20d39b29a1bd73cef2926cc4aae651f653ca7 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 31 Mar 2019 14:20:40 +0200
+Subject: [PATCH 056/304] Drop code for radvd
+
+This is now being replaced by bird.
+
+Bird is running anyways and can do this job just as well.
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 2 -
+ src/functions/functions.bird | 11 +++
+ src/functions/functions.dns | 8 +-
+ src/functions/functions.radvd | 160 --------------------------------
+ src/functions/functions.routing | 4 +-
+ src/network-radvd-config | 35 -------
+ 6 files changed, 17 insertions(+), 203 deletions(-)
+ delete mode 100644 src/functions/functions.radvd
+ delete mode 100644 src/network-radvd-config
+
+diff --git a/Makefile.am b/Makefile.am
+index 1b5e7e9..ce587b7 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -173,7 +173,6 @@ dist_network_DATA = \
+ src/functions/functions.ports \
+ src/functions/functions.ppp \
+ src/functions/functions.pppoe-server \
+- src/functions/functions.radvd \
+ src/functions/functions.route \
+ src/functions/functions.routing \
+ src/functions/functions.serial \
+@@ -193,7 +192,6 @@ dist_network_DATA = \
+ src/functions/functions.wireless-networks \
+ src/functions/functions.wpa_supplicant \
+ src/functions/functions.zone \
+- src/network-radvd-config \
+ src/header-config \
+ src/header-port \
+ src/header-zone
+diff --git a/src/functions/functions.bird b/src/functions/functions.bird
+index 950bb78..55d43b5 100644
+--- a/src/functions/functions.bird
++++ b/src/functions/functions.bird
+@@ -33,6 +33,17 @@ bird_reload() {
+ service_reload "bird.service"
+ }
+
++# Update configuration any apply it in one go
++bird_update() {
++ if ! bird_generate_config; then
++ log ERROR "Could not write Bird configuration"
++ return ${EXIT_ERROR}
++ fi
++
++ # Reload bird
++ bird_reload
++}
++
+ bird_generate_config() {
+ log DEBUG "Write BIRD configuration file"
+
+diff --git a/src/functions/functions.dns b/src/functions/functions.dns
+index 890f1ac..0e058be 100644
+--- a/src/functions/functions.dns
++++ b/src/functions/functions.dns
+@@ -31,8 +31,8 @@ NETWORK_SETTINGS_FILE_PARAMS="${NETWORK_SETTINGS_FILE_PARAMS} DNS_RANDOMIZE"
+ DNS_SEARCH_DOMAINS=""
+ NETWORK_SETTINGS_FILE_PARAMS="${NETWORK_SETTINGS_FILE_PARAMS} DNS_SEARCH_DOMAINS"
+
+-# Set this option to true if the DNS servers should be advertised by
+-# radvd.
++# Set this option to true if the DNS servers should be advertised in
++# IPv6 router advertisements
+ DNS_ADVERTISE_SERVERS="true"
+
+ DNS_SERVER_CONFIG_FILE="${NETWORK_CONFIG_DIR}/dns-servers"
+@@ -234,8 +234,8 @@ dns_server_update() {
+ # Regenerate /etc/resolv.conf
+ dns_generate_resolvconf
+
+- # Restart radvd which propagates IPv6 DNS servers
+- radvd_update
++ # Update bird about IPv6 DNS server changes
++ bird_update
+ }
+
+ dns_generate_resolvconf() {
+diff --git a/src/functions/functions.radvd b/src/functions/functions.radvd
+deleted file mode 100644
+index 1c8b8d0..0000000
+--- a/src/functions/functions.radvd
++++ /dev/null
+@@ -1,160 +0,0 @@
+-#!/bin/bash
+-###############################################################################
+-# #
+-# IPFire.org - A linux based firewall #
+-# Copyright (C) 2010 Michael Tremer & Christian Schmidt #
+-# #
+-# This program is free software: you can redistribute it and/or modify #
+-# it under the terms of the GNU General Public License as published by #
+-# the Free Software Foundation, either version 3 of the License, or #
+-# (at your option) any later version. #
+-# #
+-# This program is distributed in the hope that it will be useful, #
+-# but WITHOUT ANY WARRANTY; without even the implied warranty of #
+-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
+-# GNU General Public License for more details. #
+-# #
+-# You should have received a copy of the GNU General Public License #
+-# along with this program. If not, see <http://www.gnu.org/licenses/>. #
+-# #
+-###############################################################################
+-
+-RADVD_CONFIGFILE="/etc/radvd.conf"
+-
+-radvd_update() {
+- # (Re-)write the configuration file
+- if radvd_write_config; then
+- # Reload the radvd service if it is already running
+- if service_is_active radvd; then
+- service_reload radvd
+- return ${EXIT_OK}
+- fi
+-
+- # Start the radvd service
+- service_start radvd
+- fi
+-}
+-
+-radvd_clear_config() {
+- log DEBUG "Clearing radv daemon configuration file"
+-
+- config_header "radv daemon configuration file" > ${RADVD_CONFIGFILE}
+-
+- return ${EXIT_OK}
+-}
+-
+-radvd_write_config() {
+- radvd_clear_config
+-
+- # Write the configuration for all zones.
+- local zone
+-
+- # The return value determine if radvd is started or not
+- local return_value=${EXIT_FALSE}
+-
+- for zone in $(zones_get_local); do
+- if __radvd_config_interface ${zone}; then
+- # We return TRUE when __radvd_config_interface returns True
+- return_value=${EXIT_TRUE}
+- fi
+- done >> ${RADVD_CONFIGFILE}
+-
+- return ${return_value}
+-}
+-
+-# This function return ${EXIT_FALSE} if no radvd config was written and ${EXIT_TRUE} in all other cases
+-__radvd_config_interface() {
+- local zone=${1}
+- assert isset zone
+-
+- log DEBUG "Writing radvd configuration for ${zone}."
+-
+- # If the interface does not provide any routing information,
+- # we can skip this whole stuff.
+- if ! db_exists "${zone}/ipv6"; then
+- return ${EXIT_FALSE}
+- fi
+-
+- # Skip if zone is not active.
+- local active="$(db_get "${zone}/ipv6/active")"
+- [ "${active}" = "0" ] && return ${EXIT_FALSE}
+-
+- # Skip if there is no prefix or prefix is link-local.
+- local addr="$(db_get "${zone}/ipv6/local-ip-address")"
+- if [ -z "${addr}" ] || [ "${addr:0:5}" = "fe80:" ]; then
+- return ${EXIT_FALSE}
+- fi
+-
+- # Check if the subnet is configured by the DHCP server.
+- local dhcpd="false"
+- local prefix="$(ipv6_get_network "${addr}")"
+- if isset prefix && dhcpd_subnet_match ipv6 "${prefix}"; then
+- dhcpd="true"
+- fi
+-
+- print "interface ${zone} {"
+- print " AdvSendAdvert on;"
+- print " MinRtrAdvInterval 3;"
+- print " MaxRtrAdvInterval 10;"
+- print " IgnoreIfMissing on;"
+-
+- if enabled dhcpd; then
+- print " AdvManagedFlag on;"
+- print " AdvOtherConfigFlag on;"
+- fi
+-
+- print
+- print " prefix ::/64 {"
+- print " AdvOnLink on;"
+-
+- if enabled dhcpd; then
+- print " AdvRouterAddr off;"
+- print " AdvAutonomous off;"
+- else
+- print " AdvRouterAddr on;"
+- print " AdvAutonomous on;"
+- fi
+-
+- print " };"
+- print
+-
+- # Add the DNS configuration.
+- __radvd_config_dns ${zone}
+-
+- print "};"
+- print
+-
+- return ${EXIT_TRUE}
+-}
+-
+-__radvd_config_dns() {
+- local zone=${1}
+-
+- # Do nothing, when this option is not enabled.
+- enabled DNS_ADVERTISE_SERVERS || return ${EXIT_OK}
+-
+- # XXX it is kind of difficult to announce our local
+- # resolver.
+-
+- local server servers
+- for server in $(dns_server_list_sorted); do
+- # Filter out non IPv6 addresses.
+- ipv6_is_valid ${server} || continue
+-
+- servers="${servers} ${server}"
+- done
+-
+- # Remove whitespaces.
+- servers=$(echo ${servers})
+-
+- # If there are no servers to announce, we stop right here.
+- if ! isset servers; then
+- log DEBUG "No servers to announce."
+- return ${EXIT_OK}
+- fi
+-
+- print " RDNSS ${servers} {"
+- print " # Use the defaults here."
+- print " };"
+- print
+-}
+diff --git a/src/functions/functions.routing b/src/functions/functions.routing
+index c7aac09..351cc53 100644
+--- a/src/functions/functions.routing
++++ b/src/functions/functions.routing
+@@ -80,8 +80,8 @@ routing_default_update() {
+ # Remove too much spaces.
+ routes=$(echo ${routes})
+
+- # Reload radvd configuration
+- [[ "${proto}" = "ipv6" ]] && radvd_update
++ # Reload bird configuration
++ [[ "${proto}" = "ipv6" ]] && bird_update
+
+ # Remove all default routes.
+ if [ -z "${routes}" ]; then
+diff --git a/src/network-radvd-config b/src/network-radvd-config
+deleted file mode 100644
+index e9809e1..0000000
+--- a/src/network-radvd-config
++++ /dev/null
+@@ -1,35 +0,0 @@
+-#!/bin/bash
+-###############################################################################
+-# #
+-# IPFire.org - A linux based firewall #
+-# Copyright (C) 2011 Michael Tremer & Christian Schmidt #
+-# #
+-# This program is free software: you can redistribute it and/or modify #
+-# it under the terms of the GNU General Public License as published by #
+-# the Free Software Foundation, either version 3 of the License, or #
+-# (at your option) any later version. #
+-# #
+-# This program is distributed in the hope that it will be useful, #
+-# but WITHOUT ANY WARRANTY; without even the implied warranty of #
+-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
+-# GNU General Public License for more details. #
+-# #
+-# You should have received a copy of the GNU General Public License #
+-# along with this program. If not, see <http://www.gnu.org/licenses/>. #
+-# #
+-###############################################################################
+-
+-. /lib/network/functions
+-
+-case "${1}" in
+- start)
+- # Write the radvd configuration file.
+- radvd_write_config
+- ;;
+- stop)
+- # Clear all contents in the configuration file.
+- radvd_clear_config
+- ;;
+-esac
+-
+-exit ${EXIT_OK}
+--
+2.39.2
+
diff --git a/network/patches/0057-.gitignore-Ignore-vim-s-swp-files.patch b/network/patches/0057-.gitignore-Ignore-vim-s-swp-files.patch
new file mode 100644
index 000000000..4b6f140c7
--- /dev/null
+++ b/network/patches/0057-.gitignore-Ignore-vim-s-swp-files.patch
@@ -0,0 +1,25 @@
+From f116762cf279b39749bea053eca0e873c60e23f1 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 31 Mar 2019 14:21:18 +0200
+Subject: [PATCH 057/304] .gitignore: Ignore vim's swp files
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ .gitignore | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/.gitignore b/.gitignore
+index a6df183..36c85a1 100644
+--- a/.gitignore
++++ b/.gitignore
+@@ -20,6 +20,7 @@
+ *.lo
+ *.o
+ *.stamp
++*.swp
+ *.trs
+ *~
+ .deps
+--
+2.39.2
+
diff --git a/network/patches/0058-bird-Make-sure-the-daemon-is-always-running.patch b/network/patches/0058-bird-Make-sure-the-daemon-is-always-running.patch
new file mode 100644
index 000000000..f8c7758fc
--- /dev/null
+++ b/network/patches/0058-bird-Make-sure-the-daemon-is-always-running.patch
@@ -0,0 +1,73 @@
+From 39beacd0549be57fde9eb350c2c9292094537629 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 31 Mar 2019 14:28:44 +0200
+Subject: [PATCH 058/304] bird: Make sure the daemon is always running
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.bird | 14 ++++++++++++++
+ src/functions/functions.route | 7 ++-----
+ src/network | 4 ++--
+ 3 files changed, 18 insertions(+), 7 deletions(-)
+
+diff --git a/src/functions/functions.bird b/src/functions/functions.bird
+index 55d43b5..1bbac8c 100644
+--- a/src/functions/functions.bird
++++ b/src/functions/functions.bird
+@@ -33,6 +33,20 @@ bird_reload() {
+ service_reload "bird.service"
+ }
+
++bird_enable() {
++ # Generate configuration file
++ if ! bird_generate_config; then
++ log ERROR "Could not write Bird configuration"
++ return ${EXIT_ERROR}
++ fi
++
++ # Enable the service to be automatically started next time
++ service_enable "bird.service"
++
++ # Start it now
++ bird_start
++}
++
+ # Update configuration any apply it in one go
+ bird_update() {
+ if ! bird_generate_config; then
+diff --git a/src/functions/functions.route b/src/functions/functions.route
+index e6ea244..b833822 100644
+--- a/src/functions/functions.route
++++ b/src/functions/functions.route
+@@ -393,11 +393,8 @@ route_parse_line() {
+ }
+
+ route_apply() {
+- # Re-generate BIRD configuration
+- bird_generate_config
+-
+- # Reload the daemon
+- bird_reload
++ # Update bird
++ bird_update
+ }
+
+ route_entry_add() {
+diff --git a/src/network b/src/network
+index 300ba94..be06d8a 100644
+--- a/src/network
++++ b/src/network
+@@ -1381,8 +1381,8 @@ case "${action}" in
+ # Update resolv.conf(5) when initializing the network
+ dns_generate_resolvconf
+
+- # Update bird configuration
+- bird_generate_config
++ # Make sure bird is running
++ bird_enable
+
+ # Also execute all triggers
+ triggers_execute_all "init"
+--
+2.39.2
+
diff --git a/network/patches/0059-configure-Require-asciidoc.patch b/network/patches/0059-configure-Require-asciidoc.patch
new file mode 100644
index 000000000..93e95bae8
--- /dev/null
+++ b/network/patches/0059-configure-Require-asciidoc.patch
@@ -0,0 +1,28 @@
+From 57496df2abdaa620e8ce68abfa5ad65b211a3484 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Wed, 26 Sep 2018 22:14:27 +0200
+Subject: [PATCH 059/304] configure: Require asciidoc
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ configure.ac | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/configure.ac b/configure.ac
+index 08e9089..117850f 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -143,6 +143,10 @@ PKG_CHECK_MODULES([LIBNL], [libnl-3.0 libnl-genl-3.0])
+
+ # ------------------------------------------------------------------------------
+
++AC_CHECK_PROGS(ASCIIDOC, [asciidoc])
++
++# ------------------------------------------------------------------------------
++
+ AC_CONFIG_HEADERS(config.h)
+ AC_CONFIG_FILES([
+ Makefile
+--
+2.39.2
+
diff --git a/network/patches/0060-man-Add-test-page-for-asciidoc.patch b/network/patches/0060-man-Add-test-page-for-asciidoc.patch
new file mode 100644
index 000000000..c50e1903e
--- /dev/null
+++ b/network/patches/0060-man-Add-test-page-for-asciidoc.patch
@@ -0,0 +1,94 @@
+From 8f591cfc10d1876523d608d9643f0a82517c2add Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Wed, 26 Sep 2018 22:42:36 +0200
+Subject: [PATCH 060/304] man: Add test page for asciidoc
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 14 +++++++++++---
+ man/.gitignore | 1 +
+ man/test.txt | 11 +++++++++++
+ 3 files changed, 23 insertions(+), 3 deletions(-)
+ create mode 100644 man/test.txt
+
+diff --git a/Makefile.am b/Makefile.am
+index ce587b7..d01e223 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -89,6 +89,10 @@ INSTALL_EXEC_HOOKS += \
+
+ # ------------------------------------------------------------------------------
+
++AM_V_ASCIIDOC = $(AM_V_ASCIIDOC_$(V))
++AM_V_ASCIIDOC_ = $(AM_V_ASCIIDOC_$(AM_DEFAULT_VERBOSITY))
++AM_V_ASCIIDOC_0 = @echo " ASCIIDOC" $@;
++
+ AM_V_DOWNLOAD = $(AM_V_DOWNLOAD_$(V))
+ AM_V_DOWNLOAD_ = $(AM_V_DOWNLOAD_$(AM_DEFAULT_VERBOSITY))
+ AM_V_DOWNLOAD_0 = @echo " LOAD " $@;
+@@ -449,6 +453,7 @@ INSTALL_DIRS += \
+ # ------------------------------------------------------------------------------
+
+ MANPAGES = \
++ man/test.8 \
+ man/firewall-settings.8 \
+ man/network.8 \
+ man/network-color.8 \
+@@ -472,8 +477,8 @@ MANPAGES = \
+ man/network-zone-pppoe.8 \
+ man/network-zone-wireless.8
+
+-MANPAGES_XML = $(patsubst %.8,%.xml,$(MANPAGES))
+-MANPAGES_HTML = $(patsubst %.xml,%.html,$(MANPAGES_XML))
++MANPAGES_TXT = $(patsubst %.8,%.txt,$(MANPAGES))
++MANPAGES_HTML = $(patsubst %.txt,%.html,$(MANPAGES))
+
+ .PHONY: man
+ man: $(MANPAGES) $(MANPAGES_HTML)
+@@ -489,7 +494,7 @@ CLEANFILES += \
+ $(MANPAGES_HTML)
+
+ EXTRA_DIST += \
+- $(MANPAGES_XML) \
++ $(MANPAGES_TXT) \
+ man/custom-html.xsl
+
+ XSLTPROC_FLAGS = \
+@@ -507,6 +512,9 @@ XSLTPROC_COMMAND_MAN = \
+ XSLTPROC_COMMAND_HTML = \
+ $(AM_V_XSLT)$(XSLTPROC) -o $@ $(XSLTPROC_FLAGS) $(srcdir)/man/custom-html.xsl $<
+
++man/%.xml: man/%.txt
++ $(AM_V_ASCIIDOC)$(ASCIIDOC) -d manpage -b docbook -o $@ $<
++
+ man/%.8: man/%.xml
+ $(XSLTPROC_COMMAND_MAN)
+
+diff --git a/man/.gitignore b/man/.gitignore
+index 237049a..f891826 100644
+--- a/man/.gitignore
++++ b/man/.gitignore
+@@ -1,2 +1,3 @@
+ /*.[13578]
+ /*.html
++/*.xml
+diff --git a/man/test.txt b/man/test.txt
+new file mode 100644
+index 0000000..4c9d35d
+--- /dev/null
++++ b/man/test.txt
+@@ -0,0 +1,11 @@
++test(8)
++=======
++
++NAME
++----
++test - Hello World!
++
++SYNOPSIS
++--------
++[verse]
++'hello world' [<options>] <file>
+--
+2.39.2
+
diff --git a/network/patches/0061-man-Use-asciidoc-to-generate-HTML-pages-directly.patch b/network/patches/0061-man-Use-asciidoc-to-generate-HTML-pages-directly.patch
new file mode 100644
index 000000000..fd2e569ec
--- /dev/null
+++ b/network/patches/0061-man-Use-asciidoc-to-generate-HTML-pages-directly.patch
@@ -0,0 +1,86 @@
+From a7d2fef75b529c8cc10c4d22fca3114e30542394 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Wed, 26 Sep 2018 23:04:35 +0200
+Subject: [PATCH 061/304] man: Use asciidoc to generate HTML pages directly
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 10 +++-------
+ man/custom-html.xsl | 31 -------------------------------
+ 2 files changed, 3 insertions(+), 38 deletions(-)
+ delete mode 100644 man/custom-html.xsl
+
+diff --git a/Makefile.am b/Makefile.am
+index d01e223..c4f8b45 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -494,8 +494,7 @@ CLEANFILES += \
+ $(MANPAGES_HTML)
+
+ EXTRA_DIST += \
+- $(MANPAGES_TXT) \
+- man/custom-html.xsl
++ $(MANPAGES_TXT)
+
+ XSLTPROC_FLAGS = \
+ --nonet \
+@@ -509,17 +508,14 @@ XSLTPROC_COMMAND_MAN = \
+ $(AM_V_XSLT)$(XSLTPROC) -o $@ $(XSLTPROC_FLAGS) \
+ http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl $<
+
+-XSLTPROC_COMMAND_HTML = \
+- $(AM_V_XSLT)$(XSLTPROC) -o $@ $(XSLTPROC_FLAGS) $(srcdir)/man/custom-html.xsl $<
+-
+ man/%.xml: man/%.txt
+ $(AM_V_ASCIIDOC)$(ASCIIDOC) -d manpage -b docbook -o $@ $<
+
+ man/%.8: man/%.xml
+ $(XSLTPROC_COMMAND_MAN)
+
+-man/%.html: man/%.xml man/custom-html.xsl
+- $(XSLTPROC_COMMAND_HTML)
++man/%.html: man/%.txt
++ $(AM_V_ASCIIDOC)$(ASCIIDOC) -b html5 -a icons -a theme=flask -o $@ $<
+
+ # ------------------------------------------------------------------------------
+
+diff --git a/man/custom-html.xsl b/man/custom-html.xsl
+deleted file mode 100644
+index fe2b54e..0000000
+--- a/man/custom-html.xsl
++++ /dev/null
+@@ -1,31 +0,0 @@
+-<?xml version='1.0'?>
+-
+-<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">
+-
+-<xsl:import href="http://docbook.sourceforge.net/release/xsl/current/html/docbook.xsl"/>
+-
+-<!-- translate man page references to links to html pages -->
+-<xsl:template match="citerefentry">
+- <a>
+- <xsl:attribute name="href">
+- <xsl:value-of select="refentrytitle"/><xsl:text>.html</xsl:text>
+- </xsl:attribute>
+- <xsl:call-template name="inline.charseq"/>
+- </a>
+-</xsl:template>
+-
+-<!-- add Index link at top of page -->
+-<xsl:template name="user.header.content">
+- <a>
+- <xsl:attribute name="href">
+- <xsl:text>index.html</xsl:text>
+- </xsl:attribute>
+- <xsl:text>Index</xsl:text>
+- </a>
+- <hr/>
+-</xsl:template>
+-
+-<!-- Switch things to UTF-8, ISO-8859-1 is soo yesteryear -->
+-<xsl:output method="html" encoding="UTF-8" indent="no"/>
+-
+-</xsl:stylesheet>
+--
+2.39.2
+
diff --git a/network/patches/0062-man-Add-asciidoc-configuration-file.patch b/network/patches/0062-man-Add-asciidoc-configuration-file.patch
new file mode 100644
index 000000000..3183ec913
--- /dev/null
+++ b/network/patches/0062-man-Add-asciidoc-configuration-file.patch
@@ -0,0 +1,62 @@
+From baf429f17d664bbc6d141c13ce6ed52091803c3b Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Thu, 27 Sep 2018 00:22:59 +0200
+Subject: [PATCH 062/304] man: Add asciidoc configuration file
+
+This adds a short command to link to other man pages
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 12 ++++++++----
+ man/asciidoc.conf | 12 ++++++++++++
+ 2 files changed, 20 insertions(+), 4 deletions(-)
+ create mode 100644 man/asciidoc.conf
+
+diff --git a/Makefile.am b/Makefile.am
+index c4f8b45..ebf3be7 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -508,14 +508,18 @@ XSLTPROC_COMMAND_MAN = \
+ $(AM_V_XSLT)$(XSLTPROC) -o $@ $(XSLTPROC_FLAGS) \
+ http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl $<
+
+-man/%.xml: man/%.txt
+- $(AM_V_ASCIIDOC)$(ASCIIDOC) -d manpage -b docbook -o $@ $<
++man/%.xml: man/%.txt man/asciidoc.conf
++ $(AM_V_ASCIIDOC)$(ASCIIDOC) \
++ -f man/asciidoc.conf \
++ -d manpage -b docbook -o $@ $<
+
+ man/%.8: man/%.xml
+ $(XSLTPROC_COMMAND_MAN)
+
+-man/%.html: man/%.txt
+- $(AM_V_ASCIIDOC)$(ASCIIDOC) -b html5 -a icons -a theme=flask -o $@ $<
++man/%.html: man/%.txt man/asciidoc.conf
++ $(AM_V_ASCIIDOC)$(ASCIIDOC) \
++ -f man/asciidoc.conf \
++ -b html5 -a icons -a theme=flask -o $@ $<
+
+ # ------------------------------------------------------------------------------
+
+diff --git a/man/asciidoc.conf b/man/asciidoc.conf
+new file mode 100644
+index 0000000..243f81f
+--- /dev/null
++++ b/man/asciidoc.conf
+@@ -0,0 +1,12 @@
++ifdef::backend-docbook[]
++[link-inlinemacro]
++{0%{target}}
++{0#<citerefentry>}
++{0#<refentrytitle>{target}</refentrytitle><manvolnum>{0}</manvolnum>}
++{0#</citerefentry>}
++endif::backend-docbook[]
++
++ifdef::backend-html5[]
++[link-inlinemacro]
++<a href="{target}.html">{target}{0?({0})}</a>
++endif::backend-html5[]
+--
+2.39.2
+
diff --git a/network/patches/0063-man-Convert-network-8-from-docbook-to-asciidoc.patch b/network/patches/0063-man-Convert-network-8-from-docbook-to-asciidoc.patch
new file mode 100644
index 000000000..e5341d529
--- /dev/null
+++ b/network/patches/0063-man-Convert-network-8-from-docbook-to-asciidoc.patch
@@ -0,0 +1,503 @@
+From 44d5ffe94daa496c95bf91860a5211272d8f3ff1 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Thu, 27 Sep 2018 00:25:12 +0200
+Subject: [PATCH 063/304] man: Convert network(8) from docbook to asciidoc
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ man/network.txt | 107 ++++++++++++++
+ man/network.xml | 368 ------------------------------------------------
+ 2 files changed, 107 insertions(+), 368 deletions(-)
+ create mode 100644 man/network.txt
+ delete mode 100644 man/network.xml
+
+diff --git a/man/network.txt b/man/network.txt
+new file mode 100644
+index 0000000..569449e
+--- /dev/null
++++ b/man/network.txt
+@@ -0,0 +1,107 @@
++network(8)
++==========
++
++NAME
++----
++network - IPFire Network Configuration Program
++
++SYNOPSIS
++--------
++[verse]
++'network' [<options>] <command> ...
++
++DESCRIPTION
++-----------
++The 'network' command is a tool which configures the network on every IPFire
++system. It is a fast and versatile way to create, edit and remove configurations,
++review the status of the network and it is working in the background of the
++system make sure that things are running smoothly.
++
++OPTIONS
++-------
++-d::
++--debug::
++ Enabled debugging mode.
++ In this mode, there wll be debug output on the console and written to
++ the log.
++ The debugging mode can be permanently enabled by setting 'DEBUG=1'.
++
++COMMANDS
++--------
++The following commands are understood:
++
++'start' [ZONE]::
++ Starts a zone. That means the zone is being created and brought up.
++ If one or more zones are passed to the command, only these will be
++ started.
++
++'stop' [ZONE]::
++ Stops a zone. This is the inverse of the 'start' command.
++
++'restart' [ZONE]::
++ Restarts a zone.
++
++'status' [ZONE]::
++ Shows an overview of the status of the zone.
++
++'zone' ...::
++ Commands to configure zones. See link:network-zone[8] for details.
++
++'port' ...::
++ Commands to configure ports. See link:network-port[8] for details.
++
++'device' ...::
++ See the status or execute commands to network devices.
++ See link:network-device[8] for details.
++
++'hostname' [HOSTNAME]::
++ Without the optional 'HOSTNAME' argument, this command will print
++ the configured hostname.
++ Passing 'HOSTNAME' will set it as the new hostname.
++
++'settings' ...::
++ Shows and alters global configuration parameters.
++ See link:network-settings[8] for details.
++
++'dns-server' ...::
++ This command allows to configure DNS servers.
++ See link::network-dns-server[8] for details.
++
++'route' ...::
++ This command allows managing static routes.
++ See link:network-route[8] for details.
++
++'vpn' ...::
++ The command allows managing VPN connections.
++ See link:network-vpn[8] for details.
++
++'reset'::
++ This command will reset all network configuration.
++ All zones, ports and other settings will be removed.
++
++'help' ...::
++ Shows this man page.
++
++EXIT CODES
++----------
++The 'network' command will normally exit with code zero.
++If there has been aproblem and the requested action could not be performed,
++the exit code is unequal to zero.
++
++BUGS
++----
++Please report all bugs to the bugtracker at https://bugzilla.ipfire.org/.
++
++AUTHORS
++-------
++Michael Tremer
++
++SEE ALSO
++--------
++link:network-settings[8]
++link:network-device[8]
++link:network-dns-server[8]
++link:network-performance-tuning[8]
++link:network-port[8]
++link:network-quick-start[8]
++link:network-zone[8]
+diff --git a/man/network.xml b/man/network.xml
+deleted file mode 100644
+index 0a97453..0000000
+--- a/man/network.xml
++++ /dev/null
+@@ -1,368 +0,0 @@
+-<?xml version="1.0"?>
+-<!DOCTYPE refentry PUBLIC "-//OASIS/DTD DocBook XML V4.2//EN"
+- "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
+-
+-<refentry id="network">
+- <refentryinfo>
+- <title>network</title>
+- <productname>network</productname>
+-
+- <authorgroup>
+- <author>
+- <contrib>Developer</contrib>
+- <firstname>Michael</firstname>
+- <surname>Tremer</surname>
+- <email>michael.tremer(a)ipfire.org</email>
+- </author>
+- </authorgroup>
+- </refentryinfo>
+-
+- <refmeta>
+- <refentrytitle>network</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </refmeta>
+-
+- <refnamediv>
+- <refname>network</refname>
+- <refpurpose>Network Configuration Control Program</refpurpose>
+- </refnamediv>
+-
+- <refsynopsisdiv>
+- <cmdsynopsis>
+- <command>network</command>
+- <arg choice="opt" rep="repeat">OPTIONS</arg>
+- <arg choice="plain">COMMAND</arg>
+- </cmdsynopsis>
+- </refsynopsisdiv>
+-
+- <refsect1>
+- <title>Description</title>
+-
+- <para>
+- The <command>network</command> command is a tool which configures
+- the network on every IPFire system. It is a fast and versatile
+- way to create, edit and remove configurations, review the status
+- of the network and it is working in the background of the system
+- making sure that things are running smoothly.
+- </para>
+- </refsect1>
+-
+- <refsect1>
+- <title>Options</title>
+-
+- <para>
+- The following options are understood:
+- </para>
+-
+- <variablelist>
+- <varlistentry>
+- <term>
+- <option>-d</option>
+- </term>
+- <term>
+- <option>--debug</option>
+- </term>
+-
+- <listitem>
+- <para>
+- Enables the debugging mode.
+- In this mode, there will be debug output on
+- the console and written to the log.
+- </para>
+- <para>
+- The debugging mode can be permanently enabled by setting
+- <varname>DEBUG=1</varname>
+- </para>
+- </listitem>
+- </varlistentry>
+- </variablelist>
+- </refsect1>
+-
+- <refsect1>
+- <title>Commands</title>
+-
+- <para>
+- The following commands are understood:
+- </para>
+-
+- <variablelist>
+- <varlistentry>
+- <term>
+- <command>start <replaceable>ZONE-NAME</replaceable>...</command>
+- </term>
+-
+- <listitem>
+- <para>
+- Starts a zone. That means the network zone will be created
+- and brought up.
+- If one or more zone names are passed to the command, only
+- these will be started.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command>stop <replaceable>ZONE-NAME</replaceable>...</command>
+- </term>
+-
+- <listitem>
+- <para>
+- Stops a zone. This is the inverse of the <command>start</command>
+- command.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command>restart <replaceable>ZONE-NAME</replaceable>...</command>
+- </term>
+-
+- <listitem>
+- <para>
+- Restarts a zone.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command>status <replaceable>ZONE-NAME</replaceable>...</command>
+- </term>
+-
+- <listitem>
+- <para>
+- Shows a human-readable overview of the status
+- of the network zone.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command>zone ...</command>
+- </term>
+-
+- <listitem>
+- <para>
+- Configure a zone or show status information.
+- See <citerefentry>
+- <refentrytitle>network-zone</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry> for details.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command>port ...</command>
+- </term>
+-
+- <listitem>
+- <para>
+- Configure a port or show status information.
+- See <citerefentry>
+- <refentrytitle>network-port</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry> for details.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command>device ...</command>
+- </term>
+-
+- <listitem>
+- <para>
+- Show status information about network devices.
+- See <citerefentry>
+- <refentrytitle>network-device</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry> for details.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command>config <replaceable><varname>KEY=VALUE</varname></replaceable></command>
+- </term>
+-
+- <listitem>
+- <para>
+- Shows and alters global configuration parameters.
+- See <citerefentry>
+- <refentrytitle>network-settings</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry> for details.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command>help [<replaceable>TYPE</replaceable>
+- <replaceable>HOOK</replaceable>|<replaceable>TYPE</replaceable> list-hooks]</command>
+- </term>
+-
+- <listitem>
+- <para>
+- Calling <command>network help</command> without any
+- arguments will show you this man page.
+- </para>
+- <para>
+- <command>network help <replaceable>TYPE</replaceable> list-hooks</command>
+- will print a list of all hooks of <replaceable>TYPE</replaceable>.
+- </para>
+- <para>
+- You may optionally pass two arguments, to view the help
+- of a certain hook.
+- The type of the hook <replaceable>TYPE</replaceable>
+- needs to be passed as well as the name of the hook
+- <replaceable>HOOK</replaceable>.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command>hostname <replaceable>HOSTNAME</replaceable></command>
+- </term>
+-
+- <listitem>
+- <para>
+- The <command>hostname</command> command will return the
+- currently configured hostname of the system.
+- </para>
+- <para>
+- If a new hostname is added to the command line,
+- it will be configured, but will be set after the next
+- reboot.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command>dns-server ...</command>
+- </term>
+-
+- <listitem>
+- <para>
+- The <command>dns-server</command> command will help you
+- configuring the local DNS servers.
+- See <citerefentry>
+- <refentrytitle>network-dns-server</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry> for details.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command>route ...</command>
+- </term>
+-
+- <listitem>
+- <para>
+- The <command>route</command> command allows managing static routes.
+- See <citerefentry>
+- <refentrytitle>network-route</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry> for details.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command>vpn ...</command>
+- </term>
+-
+- <listitem>
+- <para>
+- The <command>vpn</command> allows managing VPN connections.
+- See <citerefentry>
+- <refentrytitle>network-vpn</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry> for details.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command>reset</command>
+- </term>
+-
+- <listitem>
+- <para>
+- The <command>reset</command> command will reset all
+- network configuration. That means all zone configurations
+- will be removed and there will be no networking after the
+- next reboot.
+- </para>
+- </listitem>
+- </varlistentry>
+- </variablelist>
+- </refsect1>
+-
+- <refsect1>
+- <title>Exit Codes</title>
+-
+- <para>
+- The <command>network</command> command will normally exit with code 0.
+- If there has been a problem and the requested action could not be done,
+- the exit code is unequal to zero.
+- </para>
+- </refsect1>
+-
+- <refsect1>
+- <title>Bugs</title>
+-
+- <para>
+- Please report all bugs to the official bugtracker at
+- http://bugs.ipfire.org/.
+- </para>
+- </refsect1>
+-
+- <refsect1>
+- <title>See Also</title>
+-
+- <para>
+- <citerefentry>
+- <refentrytitle>network-settings</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>,
+- <citerefentry>
+- <refentrytitle>network-device</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>,
+- <citerefentry>
+- <refentrytitle>network-dns-server</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>,
+- <citerefentry>
+- <refentrytitle>network-performance-tuning</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>,
+- <citerefentry>
+- <refentrytitle>network-port</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>,
+- <citerefentry>
+- <refentrytitle>network-quick-start</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>,
+- <citerefentry>
+- <refentrytitle>network-zone</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>
+- </para>
+- </refsect1>
+-</refentry>
+--
+2.39.2
+
diff --git a/network/patches/0064-man-Convert-network-color-8-to-asciidoc.patch b/network/patches/0064-man-Convert-network-color-8-to-asciidoc.patch
new file mode 100644
index 000000000..ff765aa14
--- /dev/null
+++ b/network/patches/0064-man-Convert-network-color-8-to-asciidoc.patch
@@ -0,0 +1,152 @@
+From b2f5dc13f74d0b740885f99a7d1408480da582cf Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Thu, 27 Sep 2018 00:34:35 +0200
+Subject: [PATCH 064/304] man: Convert network-color(8) to asciidoc
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ man/network-color.txt | 33 ++++++++++++++++
+ man/network-color.xml | 91 -------------------------------------------
+ 2 files changed, 33 insertions(+), 91 deletions(-)
+ create mode 100644 man/network-color.txt
+ delete mode 100644 man/network-color.xml
+
+diff --git a/man/network-color.txt b/man/network-color.txt
+new file mode 100644
+index 0000000..7c95e18
+--- /dev/null
++++ b/man/network-color.txt
+@@ -0,0 +1,33 @@
++network-color(8)
++================
++
++NAME
++----
++network-color - IPFire Network Configuration Control Program
++
++DESCRIPTION
++-----------
++The 'color' command helps to manage colors for zones and ports.
++The color is being used to make identification of a zone or port easier on the
++command line and web user interface.
++
++COMMANDS
++--------
++The following commands are understood:
++
++'set' [AABBCC]::
++ The color of a zone or port is set with the 'set' command.
++ It is required to pass a color in hex formatting.
++
++'reset'::
++ Resets the color of a zone or port to blank.
++
++AUTHOR
++------
++Jonatan Schlag
++
++SEE ALSO
++--------
++link:network[8]
++link:network-zone[8]
++link:network-port[8]
+diff --git a/man/network-color.xml b/man/network-color.xml
+deleted file mode 100644
+index caf2349..0000000
+--- a/man/network-color.xml
++++ /dev/null
+@@ -1,91 +0,0 @@
+-<?xml version="1.0"?>
+-<!DOCTYPE refentry PUBLIC "-//OASIS/DTD DocBook XML V4.2//EN"
+- "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
+-
+-<refentry id="network-color">
+- <refentryinfo>
+- <title>networ-color</title>
+- <productname>network</productname>
+-
+- <authorgroup>
+- <author>
+- <contrib>Developer</contrib>
+- <firstname>Jonatan</firstname>
+- <surname>Schlag</surname>
+- <email>jonatan.schlag(a)ipfire.org</email>
+- </author>
+- </authorgroup>
+- </refentryinfo>
+-
+- <refmeta>
+- <refentrytitle>network-color</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </refmeta>
+-
+- <refnamediv>
+- <refname>network-color</refname>
+- <refpurpose>Network Configuration Control Program</refpurpose>
+- </refnamediv>
+-
+- <refsect1>
+- <title>Description</title>
+-
+- <para>
+- The <command>color</command> helps to manage colors for zone and ports.
+- The color is used to make identification of a zone or port easier on the
+- command line or web user interface.
+- </para>
+- </refsect1>
+-
+- <refsect1>
+- <title>Commands</title>
+-
+- <para>
+- The following commands are understood:
+- </para>
+-
+- <variablelist>
+- <varlistentry>
+- <term>
+- <command>set <replaceable>00AABB</replaceable></command>
+- </term>
+-
+- <listitem>
+- <para>
+- The color of a zone or port is set with the <command>set</command> command.
+- It is always required to pass a valid color hex value (e.g. 880400).
+- </para>
+- </listitem>
+- </varlistentry>
+- <varlistentry>
+- <term>
+- <command>reset</command>
+- </term>
+-
+- <listitem>
+- <para>
+- This command resets the color of a zone or port to blank.
+- </para>
+- </listitem>
+- </varlistentry>
+- </variablelist>
+- </refsect1>
+- <refsect1>
+- <title>See Also</title>
+-
+- <para>
+- <citerefentry>
+- <refentrytitle>network</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>,
+- <citerefentry>
+- <refentrytitle>network-zone</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>,
+- <citerefentry>
+- <refentrytitle>network-port</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>
+- </para>
+- </refsect1>
+-</refentry>
+--
+2.39.2
+
diff --git a/network/patches/0065-man-Drop-test-page.patch b/network/patches/0065-man-Drop-test-page.patch
new file mode 100644
index 000000000..5dd0ddc36
--- /dev/null
+++ b/network/patches/0065-man-Drop-test-page.patch
@@ -0,0 +1,44 @@
+From 91305dee4f83ca35758e756903e3324117a26a7d Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Thu, 27 Sep 2018 00:36:02 +0200
+Subject: [PATCH 065/304] man: Drop test page
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 1 -
+ man/test.txt | 11 -----------
+ 2 files changed, 12 deletions(-)
+ delete mode 100644 man/test.txt
+
+diff --git a/Makefile.am b/Makefile.am
+index ebf3be7..55d5d18 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -453,7 +453,6 @@ INSTALL_DIRS += \
+ # ------------------------------------------------------------------------------
+
+ MANPAGES = \
+- man/test.8 \
+ man/firewall-settings.8 \
+ man/network.8 \
+ man/network-color.8 \
+diff --git a/man/test.txt b/man/test.txt
+deleted file mode 100644
+index 4c9d35d..0000000
+--- a/man/test.txt
++++ /dev/null
+@@ -1,11 +0,0 @@
+-test(8)
+-=======
+-
+-NAME
+-----
+-test - Hello World!
+-
+-SYNOPSIS
+---------
+-[verse]
+-'hello world' [<options>] <file>
+--
+2.39.2
+
diff --git a/network/patches/0066-man-network-color-Add-synopsis.patch b/network/patches/0066-man-network-color-Add-synopsis.patch
new file mode 100644
index 000000000..6097f2a90
--- /dev/null
+++ b/network/patches/0066-man-network-color-Add-synopsis.patch
@@ -0,0 +1,32 @@
+From 62191ec375cf7fc957690d88c663ae7ad479a1a4 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Thu, 27 Sep 2018 00:47:19 +0200
+Subject: [PATCH 066/304] man: network-color: Add synopsis
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ man/network-color.txt | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/man/network-color.txt b/man/network-color.txt
+index 7c95e18..f3be474 100644
+--- a/man/network-color.txt
++++ b/man/network-color.txt
+@@ -3,7 +3,13 @@ network-color(8)
+
+ NAME
+ ----
+-network-color - IPFire Network Configuration Control Program
++network-color - Allows assigning a color to a zone or port
++
++SYNOPSIS
++--------
++[verse]
++'network' [zone ZONE|port PORT] color set AABBCC
++'network' [zone ZONE|port PORT] reset
+
+ DESCRIPTION
+ -----------
+--
+2.39.2
+
diff --git a/network/patches/0067-man-Convert-firewall-settings-to-asciidoc.patch b/network/patches/0067-man-Convert-firewall-settings-to-asciidoc.patch
new file mode 100644
index 000000000..8751171af
--- /dev/null
+++ b/network/patches/0067-man-Convert-firewall-settings-to-asciidoc.patch
@@ -0,0 +1,409 @@
+From 66fe74f95f4da254fc1162c591a40012c17aab07 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 30 Sep 2018 21:16:10 +0200
+Subject: [PATCH 067/304] man: Convert firewall-settings to asciidoc
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ man/firewall-settings.txt | 97 +++++++++++++
+ man/firewall-settings.xml | 284 --------------------------------------
+ 2 files changed, 97 insertions(+), 284 deletions(-)
+ create mode 100644 man/firewall-settings.txt
+ delete mode 100644 man/firewall-settings.xml
+
+diff --git a/man/firewall-settings.txt b/man/firewall-settings.txt
+new file mode 100644
+index 0000000..20038e3
+--- /dev/null
++++ b/man/firewall-settings.txt
+@@ -0,0 +1,97 @@
++firewall-settings(8)
++====================
++
++NAME
++----
++firewall-settings - Global firewall settings
++
++SYNOPSIS
++--------
++[verse]
++'firewall settings'
++'firewall settings' KEY=VALUE ...
++
++DESCRIPTION
++-----------
++This command is used to set global firewall settings.
++Please have a look at the individual man pages for more options.
++
++COMMANDS
++--------
++If no argument is given, the configuration will be dumped to the console.
++
++You may set a new value by adding the variable name and the new value to
++the command line.
++
++SETTINGS
++--------
++=== CONNTRACK_MAX_CONNECTIONS = 16384
++Limits the max. number of simultaneous connections.
++
++Modify this if you want to handle a larger number of concurrent
++connections. Every connection will use approx. 16 kBytes of memory.
++
++=== CONNTRACK_UDP_TIMEOUT = 60
++Defines the timeout (in seconds) the kernel will wait until
++a half-assured UDP connection is fully established.
++
++=== FIREWALL_ACCEPT_ICMP_REDIRECTS = [true|false]
++Enable if you want to accept ICMP redirect messages.
++
++=== FIREWALL_CLAMP_PATH_MTU = [true|false]
++If Path MTU Discovery does not work well, enable this option.
++
++It sets the MSS value of a packet so that the remote site would
++never send a packet bigger than the MSS value.
++
++No ICMP packets are needed to make this work, so use this on
++networks with broken ICMP filtering.
++
++=== FIREWALL_DEFAULT_TTL = 64
++Here you can change the default TTL used for sending packets.
++
++The given value must be between 10 and 255.
++Don't mess with this unless you know what you are doing.
++
++=== FIREWALL_LOG_BAD_TCP_FLAGS = [true|false]
++Enable this to log TCP packets with bad flags or options.
++
++=== FIREWALL_LOG_INVALID_ICMP = [true|false]
++Enable this to log INVALID ICMP packets.
++
++=== FIREWALL_LOG_INVALID_TCP = [true|false]
++Enable this to log INVALID TCP packets.
++
++=== FIREWALL_LOG_INVALID_UDP = [true|false]
++Enable this to log INVALID UDP packets.
++
++=== FIREWALL_LOG_MARTIANS = [true|false]
++Enable this to log packets with impossible addresses.
++
++=== FIREWALL_LOG_STEALTH_SCANS = [true|false]
++Enable this to log all stealth scans.
++
++=== FIREWALL_PMTU_DISCOVERY = [true|false]
++Enables Path MTU Discovery.
++
++=== FIREWALL_RP_FILTER = [true|false]
++Enable to drop connection from non-routable IPs,
++e.g. prevent source routing.
++
++=== FIREWALL_SYN_COOKIES = [true|false]
++Enable for SYN-flood protection.
++
++=== FIREWALL_USE_ECN = [true|false]
++Enables the ECN (Explicit Congestion Notification) TCP flag.
++
++Some routers on the Internet still do not support ECN properly.
++When this setting is disabled, ECN is only advertised
++when asked for.
++
++AUTHORS
++-------
++Michael Tremer
++
++SEE ALSO
++--------
++link:firewall[8]
+diff --git a/man/firewall-settings.xml b/man/firewall-settings.xml
+deleted file mode 100644
+index 7357f4c..0000000
+--- a/man/firewall-settings.xml
++++ /dev/null
+@@ -1,284 +0,0 @@
+-<?xml version="1.0"?>
+-<!DOCTYPE refentry PUBLIC "-//OASIS/DTD DocBook XML V4.2//EN"
+- "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
+-
+-<refentry id="firewall-settings">
+- <refentryinfo>
+- <title>firewall-settings</title>
+- <productname>network</productname>
+-
+- <authorgroup>
+- <author>
+- <contrib>Developer</contrib>
+- <firstname>Michael</firstname>
+- <surname>Tremer</surname>
+- <email>michael.tremer(a)ipfire.org</email>
+- </author>
+- </authorgroup>
+- </refentryinfo>
+-
+- <refmeta>
+- <refentrytitle>firewall-settings</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </refmeta>
+-
+- <refnamediv>
+- <refname>firewall-settings</refname>
+- <refpurpose>Firewall Configuration Control Program</refpurpose>
+- </refnamediv>
+-
+- <refsynopsisdiv>
+- <cmdsynopsis>
+- <command>firewall-settings</command>
+- </cmdsynopsis>
+-
+- <cmdsynopsis>
+- <command>firewall-settings <replaceable>KEY=VALUE</replaceable></command>
+- </cmdsynopsis>
+- </refsynopsisdiv>
+-
+- <refsect1>
+- <title>Description</title>
+-
+- <para>
+- The <command>firewall-settings</command> command may be used to set
+- global firewall settingsuration options.
+- </para>
+- <para>
+- Please have a look at the individual man pages for more options.
+- </para>
+- </refsect1>
+-
+- <refsect1>
+- <title>Commands</title>
+-
+- <para>
+- If no additional argument is given, running the command will
+- dump a list of all settingsuration variables and their current values.
+- </para>
+-
+- <para>
+- You may set a new value by adding the variable name and the new
+- value to the command line.
+- </para>
+- </refsect1>
+-
+- <refsect1>
+- <title>Variables</title>
+-
+- <variablelist>
+- <varlistentry>
+- <term>
+- <varname>CONNTRACK_MAX_CONNECTIONS</varname> = <replaceable>16384</replaceable>
+- </term>
+-
+- <listitem>
+- <para>
+- Limits the max. number of simultaneous connections.
+- </para>
+- <para>
+- Modify this if you want to handle a larger number of concurrent
+- connections. Every connection will use approx. 16 kBytes of memory.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <varname>CONNTRACK_UDP_TIMEOUT</varname> = <replaceable>60</replaceable>
+- </term>
+-
+- <listitem>
+- <para>
+- Defines the timeout (in seconds) the kernel will wait until
+- a half-assured UDP connection is fully established.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <varname>FIREWALL_ACCEPT_ICMP_REDIRECTS</varname> = [true|<emphasis>false</emphasis>]
+- </term>
+-
+- <listitem>
+- <para>
+- Enable if you want to accept ICMP redirect messages.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <varname>FIREWALL_CLAMP_PATH_MTU</varname> = [true|<emphasis>false</emphasis>]
+- </term>
+-
+- <listitem>
+- <para>
+- If Path MTU Discovery does not work well, enable this option.
+- It sets the MSS value of a packet so that the remote site would
+- never send a packet bigger than the MSS value.
+- </para>
+- <para>
+- No ICMP packets are needed to make this work, so use this on
+- networks with broken ICMP filtering.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <varname>FIREWALL_DEFAULT_TTL</varname> = <replaceable>64</replaceable>
+- </term>
+-
+- <listitem>
+- <para>
+- Here you can change the default TTL used for sending packets.
+- </para>
+- <para>
+- The given value must be between 10 and 255.
+- Don't mess with this unless you know what you are doing.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <varname>FIREWALL_LOG_BAD_TCP_FLAGS</varname> = [<emphasis>true</emphasis>|false]
+- </term>
+-
+- <listitem>
+- <para>
+- Enable this to log TCP packets with bad flags or options.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <varname>FIREWALL_LOG_INVALID_ICMP</varname> = [<emphasis>true</emphasis>|false]
+- </term>
+-
+- <listitem>
+- <para>
+- Enable this to log INVALID ICMP packets.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <varname>FIREWALL_LOG_INVALID_TCP</varname> = [<emphasis>true</emphasis>|false]
+- </term>
+-
+- <listitem>
+- <para>
+- Enable this to log INVALID TCP packets.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <varname>FIREWALL_LOG_INVALID_UDP</varname> = [<emphasis>true</emphasis>|false]
+- </term>
+-
+- <listitem>
+- <para>
+- Enable this to log INVALID UDP packets.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <varname>FIREWALL_LOG_MARTIANS</varname> = [true|<emphasis>false</emphasis>]
+- </term>
+-
+- <listitem>
+- <para>
+- Enable this to log packets with impossible addresses.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <varname>FIREWALL_LOG_STEALTH_SCANS</varname> = [<emphasis>true</emphasis>|false]
+- </term>
+-
+- <listitem>
+- <para>
+- Enable this to log all stealth scans.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <varname>FIREWALL_PMTU_DISCOVERY</varname> = [true|<emphasis>false</emphasis>]
+- </term>
+-
+- <listitem>
+- <para>
+- Enables Path MTU Discovery.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <varname>FIREWALL_RP_FILTER</varname> = [<emphasis>true</emphasis>|false]
+- </term>
+-
+- <listitem>
+- <para>
+- Enable to drop connection from non-routable IPs,
+- e.g. prevent source routing.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <varname>FIREWALL_SYN_COOKIES</varname> = [<emphasis>true</emphasis>|false]
+- </term>
+-
+- <listitem>
+- <para>
+- Enable for SYN-flood protection.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <varname>FIREWALL_USE_ECN</varname> = [<emphasis>true</emphasis>|false]
+- </term>
+-
+- <listitem>
+- <para>
+- Enables the ECN (Explicit Congestion Notification) TCP flag.
+- </para>
+- <para>
+- Some routers on the Internet still do not support ECN properly,
+- so this is not enabled by default.
+- When this setting is disabled, ECN is only advertised
+- when asked for.
+- </para>
+- </listitem>
+- </varlistentry>
+- </variablelist>
+- </refsect1>
+-
+- <refsect1>
+- <title>See Also</title>
+-
+- <para>
+- <citerefentry>
+- <refentrytitle>firewall</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>
+- </para>
+- </refsect1>
+-</refentry>
+--
+2.39.2
+
diff --git a/network/patches/0068-man-Convert-network-description-8-to-asciidoc.patch b/network/patches/0068-man-Convert-network-description-8-to-asciidoc.patch
new file mode 100644
index 000000000..4c993a4b7
--- /dev/null
+++ b/network/patches/0068-man-Convert-network-description-8-to-asciidoc.patch
@@ -0,0 +1,144 @@
+From c601b69e5d8db595fee00241702ee8bd2689c49e Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 30 Sep 2018 21:24:48 +0200
+Subject: [PATCH 068/304] man: Convert network-description(8) to asciidoc
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 1 -
+ man/include-description.txt | 11 +++++
+ man/network-description.xml | 92 -------------------------------------
+ 3 files changed, 11 insertions(+), 93 deletions(-)
+ create mode 100644 man/include-description.txt
+ delete mode 100644 man/network-description.xml
+
+diff --git a/Makefile.am b/Makefile.am
+index 55d5d18..287a111 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -456,7 +456,6 @@ MANPAGES = \
+ man/firewall-settings.8 \
+ man/network.8 \
+ man/network-color.8 \
+- man/network-description.8 \
+ man/network-device.8 \
+ man/network-dhcp.8 \
+ man/network-dns-server.8 \
+diff --git a/man/include-description.txt b/man/include-description.txt
+new file mode 100644
+index 0000000..a39ba55
+--- /dev/null
++++ b/man/include-description.txt
+@@ -0,0 +1,11 @@
++'description edit'::
++ This command opens an editor and allows you to edit title and description.
++
++ NOTE: The formation of the description is similar to a git commit.
++ Every description has a title, the first line of the description.
++ The title is shown on the status page and in the web user interface.
++ It should be something short like "Office Lan" or "DMZ".
++ After the title can follow a longer description.
++
++'description show'::
++ Prints the description.
+diff --git a/man/network-description.xml b/man/network-description.xml
+deleted file mode 100644
+index f1722b4..0000000
+--- a/man/network-description.xml
++++ /dev/null
+@@ -1,92 +0,0 @@
+-<?xml version="1.0"?>
+-<!DOCTYPE refentry PUBLIC "-//OASIS/DTD DocBook XML V4.2//EN"
+- "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
+-
+-<refentry id="network-color">
+- <refentryinfo>
+- <title>networ-color</title>
+- <productname>network</productname>
+-
+- <authorgroup>
+- <author>
+- <contrib>Developer</contrib>
+- <firstname>Jonatan</firstname>
+- <surname>Schlag</surname>
+- <email>jonatan.schlag(a)ipfire.org</email>
+- </author>
+- </authorgroup>
+- </refentryinfo>
+-
+- <refmeta>
+- <refentrytitle>network-description</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </refmeta>
+-
+- <refnamediv>
+- <refname>network-description</refname>
+- <refpurpose>Network Configuration Control Program</refpurpose>
+- </refnamediv>
+-
+- <refsect1>
+- <title>Description</title>
+-
+- <para>
+- The <command>description</command> command make it possible to add descriptions to zone and ports.
+- A description is similar to a git commit. Every description has a title, the first line of the describtion file.
+- The title is shown on the status page and in the webinterface. It should be something short like Office Lan or DMZ.
+- After the title can follow a longer description. You can write whatever you want.
+- This longer description is shown via the <command>show</command> command
+- </para>
+- </refsect1>
+-
+- <refsect1>
+- <title>Commands</title>
+-
+- <para>
+- The following commands are understood:
+- </para>
+-
+- <variablelist>
+- <varlistentry>
+- <term>
+- <command>edit</command>
+- </term>
+-
+- <listitem>
+- <para>
+- This command opens an editor and allows you to edit title and description.
+- </para>
+- </listitem>
+- </varlistentry>
+- <varlistentry>
+- <term>
+- <command>show</command>
+- </term>
+-
+- <listitem>
+- <para>
+- This command prints title and the longer description in a nice way.
+- </para>
+- </listitem>
+- </varlistentry>
+- </variablelist>
+- </refsect1>
+- <refsect1>
+- <title>See Also</title>
+-
+- <para>
+- <citerefentry>
+- <refentrytitle>network</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>,
+- <citerefentry>
+- <refentrytitle>network-zone</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>,
+- <citerefentry>
+- <refentrytitle>network-port</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>
+- </para>
+- </refsect1>
+-</refentry>
+--
+2.39.2
+
diff --git a/network/patches/0069-man-Convert-network-device-8-to-asciidoc.patch b/network/patches/0069-man-Convert-network-device-8-to-asciidoc.patch
new file mode 100644
index 000000000..1cdc8b87d
--- /dev/null
+++ b/network/patches/0069-man-Convert-network-device-8-to-asciidoc.patch
@@ -0,0 +1,254 @@
+From 9d2265232d8a1c399617e347bda66a8019d8b36d Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 30 Sep 2018 21:40:53 +0200
+Subject: [PATCH 069/304] man: Convert network-device(8) to asciidoc
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ man/network-device.txt | 61 +++++++++++++++
+ man/network-device.xml | 165 -----------------------------------------
+ 2 files changed, 61 insertions(+), 165 deletions(-)
+ create mode 100644 man/network-device.txt
+ delete mode 100644 man/network-device.xml
+
+diff --git a/man/network-device.txt b/man/network-device.txt
+new file mode 100644
+index 0000000..33fcefa
+--- /dev/null
++++ b/man/network-device.txt
+@@ -0,0 +1,61 @@
++network(8)
++==========
++
++NAME
++----
++network-device - Controls network devices
++
++SYNOPSIS
++--------
++[verse]
++'network device' [<options>] <command> ...
++
++DESCRIPTION
++-----------
++The 'network device' command shows low-level status information
++of network devices and other things.
++
++COMMANDS
++--------
++The following commands are understood:
++
++'list'::
++ This command shows a list of all device that are currently present
++ on this system. This includes PHYs and serial devices as well.
++
++'DEVICE discover'::
++ Runs a discovery for many hooks on the given device.
++
++ This will check if the hook can find for example a DHCP server or
++ DSLAM and thus predict for what the device should be used.
++
++'DEVICE identify'::
++ This command only works for Ethernet adapters and will make those
++ that support this feature flash for a few seconds.
++
++ It is handy to find the right device to put the cable in.
++
++'DEVICE monitor'::
++ This command creates a monitor interface for wireless modules.
++
++ An instance of link:tcpdump[8] will be started and show all
++ frames that are sent or received on the 802.11 layer (layer 2).
++
++'DEVICE status'::
++ This will show you very detailed information about the given device.
++
++'DEVICE unlock'::
++ This command will unlock the SIM card in a modem.
++ Only serial devices are supported which are the most 4G or 3G modems.
++
++ For the PIN or PUK code, the user will be prompted.
++
++AUTHORS
++-------
++Michael Tremer
++
++SEE ALSO
++--------
++link:network[8]
++link:network-port[8]
++link:network-zone[8]
+diff --git a/man/network-device.xml b/man/network-device.xml
+deleted file mode 100644
+index 11dc04e..0000000
+--- a/man/network-device.xml
++++ /dev/null
+@@ -1,165 +0,0 @@
+-<?xml version="1.0"?>
+-<!DOCTYPE refentry PUBLIC "-//OASIS/DTD DocBook XML V4.2//EN"
+- "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
+-
+-<refentry id="network-device">
+- <refentryinfo>
+- <title>network-device</title>
+- <productname>network</productname>
+-
+- <authorgroup>
+- <author>
+- <contrib>Developer</contrib>
+- <firstname>Michael</firstname>
+- <surname>Tremer</surname>
+- <email>michael.tremer(a)ipfire.org</email>
+- </author>
+- </authorgroup>
+- </refentryinfo>
+-
+- <refmeta>
+- <refentrytitle>network-device</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </refmeta>
+-
+- <refnamediv>
+- <refname>network-device</refname>
+- <refpurpose>Network Configuration Control Program</refpurpose>
+- </refnamediv>
+-
+- <refsynopsisdiv>
+- <cmdsynopsis>
+- <command>network device <arg choice="plain">COMMAND</arg></command>
+- </cmdsynopsis>
+- </refsynopsisdiv>
+-
+- <refsect1>
+- <title>Description</title>
+-
+- <para>
+- With help of the <command>device</command> subcommands, it is very easy
+- to get status information about network devices and to do some more
+- things.
+- </para>
+- </refsect1>
+-
+- <refsect1>
+- <title>Commands</title>
+-
+- <para>
+- The following commands are understood:
+- </para>
+-
+- <variablelist>
+- <varlistentry>
+- <term>
+- <command>list</command>
+- </term>
+-
+- <listitem>
+- <para>
+- The <command>list</command> command will show a list
+- of all devices that are currently plugged in or active
+- on the system.
+- This includes PHYs and serial devices as well.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command><replaceable>DEVICE</replaceable> status</command>
+- </term>
+-
+- <listitem>
+- <para>
+- This will show you very detailed information about the given
+- device.
+- </para>
+- <para>
+- This is all about the ethernet parts of the device and
+- does not contain any IP information as this is defined
+- as a zone (<citerefentry>
+- <refentrytitle>network-zone</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>).
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command><replaceable>DEVICE</replaceable> identify</command>
+- </term>
+-
+- <listitem>
+- <para>
+- This command only works for Ethernet adapters and will
+- make those that support this feature flash for a few
+- seconds.
+- It is handy to find the right device to put the cable in.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command><replaceable>DEVICE</replaceable> discover</command>
+- </term>
+-
+- <listitem>
+- <para>
+- Runs a discovery for many hooks on the given device.
+- This will check if the hook can find for example a DHCP
+- server or DSLAM and thus predict for what the device
+- should be used.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command><replaceable>DEVICE</replaceable> unlock</command>
+- </term>
+-
+- <listitem>
+- <para>
+- This command will unlock the SIM card in a modem.
+- Only serial devices are supported which are the most
+- UMTS or 3G modems.
+- </para>
+- <para>
+- For the PIN or PUK code, the user will be prompted.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command><replaceable>DEVICE</replaceable> monitor</command>
+- </term>
+-
+- <listitem>
+- <para>
+- The <command>monitor</command> command is used to
+- create a monitor interface for wireless modules.
+- An instance of tcpdump will be started and show
+- all frames that are sent or received on the 802.11
+- layer (layer 2) of the wireless network.
+- </para>
+- </listitem>
+- </varlistentry>
+- </variablelist>
+- </refsect1>
+-
+- <refsect1>
+- <title>See Also</title>
+-
+- <para>
+- <citerefentry>
+- <refentrytitle>network</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>
+- </para>
+- </refsect1>
+-</refentry>
+--
+2.39.2
+
diff --git a/network/patches/0070-man-Convert-network-dhcp-8-to-asciidoc.patch b/network/patches/0070-man-Convert-network-dhcp-8-to-asciidoc.patch
new file mode 100644
index 000000000..95cd6ce5e
--- /dev/null
+++ b/network/patches/0070-man-Convert-network-dhcp-8-to-asciidoc.patch
@@ -0,0 +1,217 @@
+From c6e12dc53a1e65a0089ee0ddb0573a29bc2acd8a Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 30 Sep 2018 21:46:49 +0200
+Subject: [PATCH 070/304] man: Convert network-dhcp(8) to asciidoc
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ man/network-dhcp.txt | 44 +++++++++++++
+ man/network-dhcp.xml | 145 -------------------------------------------
+ 2 files changed, 44 insertions(+), 145 deletions(-)
+ create mode 100644 man/network-dhcp.txt
+ delete mode 100644 man/network-dhcp.xml
+
+diff --git a/man/network-dhcp.txt b/man/network-dhcp.txt
+new file mode 100644
+index 0000000..a448619
+--- /dev/null
++++ b/man/network-dhcp.txt
+@@ -0,0 +1,44 @@
++network(8)
++==========
++
++NAME
++----
++network-dhcp - Controls the DHCP Server
++
++SYNOPSIS
++--------
++[verse]
++'network dhcpv6' <command> ...
++'network dhcpv4' <command> ...
++
++DESCRIPTION
++-----------
++With help of the DHCP commands it is possible to configure DHCP
++servers for IPv6 and IPv4.
++
++COMMANDS
++--------
++The following commands are understood:
++
++'start'::
++ Starts the DHCP server.
++
++'stop'::
++ Stops the DHCP server.
++
++'restart'::
++ Restarts the DHCP server.
++
++'reload'::
++ Reload the DHCP server configuration.
++
++'subnet ...'::
++ TODO
++
++AUTHORS
++-------
++Michael Tremer
++
++SEE ALSO
++--------
++link:network[8]
+diff --git a/man/network-dhcp.xml b/man/network-dhcp.xml
+deleted file mode 100644
+index cc081bb..0000000
+--- a/man/network-dhcp.xml
++++ /dev/null
+@@ -1,145 +0,0 @@
+-<?xml version="1.0"?>
+-<!DOCTYPE refentry PUBLIC "-//OASIS/DTD DocBook XML V4.2//EN"
+- "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
+-
+-<refentry id="network-dhcp">
+- <refentryinfo>
+- <title>network-dhcp</title>
+- <productname>network</productname>
+-
+- <authorgroup>
+- <author>
+- <contrib>Developer</contrib>
+- <firstname>Michael</firstname>
+- <surname>Tremer</surname>
+- <email>michael.tremer(a)ipfire.org</email>
+- </author>
+- </authorgroup>
+- </refentryinfo>
+-
+- <refmeta>
+- <refentrytitle>network-dhcp</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </refmeta>
+-
+- <refnamediv>
+- <refname>network-dhcp</refname>
+- <refpurpose>Network Configuration Control Program</refpurpose>
+- </refnamediv>
+-
+- <refsynopsisdiv>
+- <cmdsynopsis>
+- <command>network <arg choice="plain">[dhcpv6|dhcpv4]</arg> <arg choice="plain">command</arg> ...</command>
+- </cmdsynopsis>
+- </refsynopsisdiv>
+-
+- <refsect1>
+- <title>Description</title>
+-
+- <para>
+- With help of the <command>dhcp</command> commands it is possible to
+- configure DHCP servers for IPv6 and IPv4.
+- </para>
+- </refsect1>
+-
+- <refsect1>
+- <title>Commands</title>
+-
+- <para>
+- The following commands are understood:
+- </para>
+-
+- <variablelist>
+- <varlistentry>
+- <term>
+- <command>start</command>
+- </term>
+-
+- <listitem>
+- <para>
+- Starts the DHCP service.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command>stop</command>
+- </term>
+-
+- <listitem>
+- <para>
+- Stops the DHCP service.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command>restart</command>
+- </term>
+-
+- <listitem>
+- <para>
+- Restarts the DHCP service immediately.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command>reload</command>
+- </term>
+-
+- <listitem>
+- <para>
+- Reload the DHCP service configuration.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command>show</command>
+- </term>
+-
+- <listitem>
+- <para>
+- Shows the DHCP configuration.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command>subnet ...</command>
+- </term>
+-
+- <listitem>
+- <para>
+- Use this command to manage subnets.
+- See <citerefentry>
+- <refentrytitle>network-dhcp-subnet</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry> for details.
+- </para>
+- </listitem>
+- </varlistentry>
+- </variablelist>
+- </refsect1>
+-
+- <refsect1>
+- <title>See Also</title>
+-
+- <para>
+- <citerefentry>
+- <refentrytitle>network</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>,
+- <citerefentry>
+- <refentrytitle>network-dhcp-subnet</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>
+- </para>
+- </refsect1>
+-</refentry>
+--
+2.39.2
+
diff --git a/network/patches/0071-man-Convert-network-dns-server-8-to-asciidoc.patch b/network/patches/0071-man-Convert-network-dns-server-8-to-asciidoc.patch
new file mode 100644
index 000000000..a8f55a10b
--- /dev/null
+++ b/network/patches/0071-man-Convert-network-dns-server-8-to-asciidoc.patch
@@ -0,0 +1,306 @@
+From 063089cbdb2745248bd8556e87de4a0d2bc8091d Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 30 Sep 2018 21:59:01 +0200
+Subject: [PATCH 071/304] man: Convert network-dns-server(8) to asciidoc
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ man/network-dns-server.txt | 75 ++++++++++++++
+ man/network-dns-server.xml | 203 -------------------------------------
+ 2 files changed, 75 insertions(+), 203 deletions(-)
+ create mode 100644 man/network-dns-server.txt
+ delete mode 100644 man/network-dns-server.xml
+
+diff --git a/man/network-dns-server.txt b/man/network-dns-server.txt
+new file mode 100644
+index 0000000..bd01ca7
+--- /dev/null
++++ b/man/network-dns-server.txt
+@@ -0,0 +1,75 @@
++network-dns-server(8)
++=====================
++
++NAME
++----
++network-dns-server - Controls the DNS settings
++
++SYNOPSIS
++--------
++[verse]
++'network dns-server' add SERVER [PRIORITY]
++'network dns-server' remove SERVER
++'network dns-server' list
++'network dns-server' update
++
++DESCRIPTION
++-----------
++With this command, you will be able to configure the local DNS
++configuration.
++
++You may add and remove DNS servers as well as view the settings.
++
++COMMANDS
++--------
++The following commands are understood:
++
++'add' SERVER [PRIORITY]::
++ A new DNS server may be added to the list by the
++ 'add' command.
++ A priority that will rank the server my optionally be given.
++
++ NOTE: SERVER must be a valid IP address and PRIORITY
++ must be a positive number.
++ The smaller this number, the higher is is the rank of
++ the server.
++
++'remove' SERVER::
++ The given server will be removed from the list of DNS servers.
++
++'list'::
++ Shows a list of all servers that are currently in use.
++
++'update'::
++ This command will re-create the system's configuration
++ files. It should not be required to use this command
++ very often.
++
++SETTINGS
++--------
++The following settings may be set using link:network-settings[8]:
++
++'DNS_USE_LOCAL_RESOLVER = [true|false]'::
++ This option defines whether the local DNS resolver should
++ be used or not.
++
++ Basically, the option adds localhost to the list of nameservers
++ in link:resolv.conf[5].
++
++'DNS_SEARCH_DOMAINS ='::
++ This setting configures the search domains for DNS queries
++ made by the local system.
++
++'DNS_RANDOMIZE = [true|false]'::
++ This option will break the DNS server ranks and will query
++ them in a random order which is useful to load-balance
++ multiple DNS servers.
++
++AUTHORS
++-------
++Michael Tremer
++
++SEE ALSO
++--------
++link:network[8],
++link:network-settings[8]
+diff --git a/man/network-dns-server.xml b/man/network-dns-server.xml
+deleted file mode 100644
+index aec52d4..0000000
+--- a/man/network-dns-server.xml
++++ /dev/null
+@@ -1,203 +0,0 @@
+-<?xml version="1.0"?>
+-<!DOCTYPE refentry PUBLIC "-//OASIS/DTD DocBook XML V4.2//EN"
+- "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
+-
+-<refentry id="network-dns-server">
+- <refentryinfo>
+- <title>network-dns-server</title>
+- <productname>network</productname>
+-
+- <authorgroup>
+- <author>
+- <contrib>Developer</contrib>
+- <firstname>Michael</firstname>
+- <surname>Tremer</surname>
+- <email>michael.tremer(a)ipfire.org</email>
+- </author>
+- </authorgroup>
+- </refentryinfo>
+-
+- <refmeta>
+- <refentrytitle>network-dns-server</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </refmeta>
+-
+- <refnamediv>
+- <refname>network-dns-server</refname>
+- <refpurpose>Network Configuration Control Program</refpurpose>
+- </refnamediv>
+-
+- <refsynopsisdiv>
+- <cmdsynopsis>
+- <command>network dns-server <arg choice="plain">[add|remove]</arg> <arg choice="plain">SERVER</arg> [<arg choice="plain">PRIORITY</arg>]</command>
+- </cmdsynopsis>
+-
+- <cmdsynopsis>
+- <command>network dns-server <arg choice="plain">[list|update]</arg></command>
+- </cmdsynopsis>
+- </refsynopsisdiv>
+-
+- <refsect1>
+- <title>Description</title>
+-
+- <para>
+- With help of the <command>dns-server</command> subcommand, you will
+- be able to configure the local DNS configuration.
+- DNS is short for Domain Name System.
+- </para>
+- <para>
+- You may add and remove DNS servers as well as view the settings.
+- </para>
+- </refsect1>
+-
+- <refsect1>
+- <title>Commands</title>
+-
+- <para>
+- The following commands are understood:
+- </para>
+-
+- <variablelist>
+- <varlistentry>
+- <term>
+- <command>
+- add
+- <replaceable>SERVER</replaceable>
+- [<replaceable>PRIORITY</replaceable>]
+- </command>
+- </term>
+-
+- <listitem>
+- <para>
+- A new DNS server may be added to the list by the
+- <command>add</command> command. A priority that will
+- rank the server my optionally be given.
+- </para>
+- <para>
+- <replaceable>SERVER</replaceable> must be a valid IP address
+- and <replaceable>PRIORITY</replaceable> must be a positive
+- integer number. The smaller this number, the higher is
+- is the rank of the server.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command>
+- remove
+- <replaceable>SERVER</replaceable>
+- </command>
+- </term>
+-
+- <listitem>
+- <para>
+- The given server will be removed from the list of
+- DNS servers.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command>list</command>
+- </term>
+-
+- <listitem>
+- <para>
+- Shows a list of all servers that are currently in use.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command>update</command>
+- </term>
+-
+- <listitem>
+- <para>
+- This command will re-create the system's configuration
+- files. It should not be required to use this command
+- very often.
+- </para>
+- </listitem>
+- </varlistentry>
+- </variablelist>
+- </refsect1>
+-
+- <refsect1>
+- <title>Variables</title>
+-
+- <para>
+- These variables may be set by using the <citerefentry>
+- <refentrytitle>network-settings</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry> command.
+- </para>
+-
+- <variablelist>
+- <varlistentry>
+- <term>
+- <varname>DNS_USE_LOCAL_RESOLVER</varname>=[<emphasis>true</emphasis>|false]
+- </term>
+-
+- <listitem>
+- <para>
+- This option defines whether the local DNS resolver should
+- be used or not.
+- </para>
+- <para>
+- Basically, the option adds localhost to the list of
+- nameservers in <citerefentry>
+- <refentrytitle>resolv.conf</refentrytitle>
+- <manvolnum>5</manvolnum>
+- </citerefentry>.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <varname>DNS_SEARCH_DOMAINS</varname>=
+- </term>
+-
+- <listitem>
+- <para>
+- This setting configures the search domains for DNS queries
+- made by the local system.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <varname>DNS_RANDOMIZE</varname>=[true|<emphasis>false</emphasis>]
+- </term>
+-
+- <listitem>
+- <para>
+- This option will break the DNS server ranks and will query
+- them in a random order which is useful to load-balance
+- multiple DNS servers.
+- </para>
+- </listitem>
+- </varlistentry>
+- </variablelist>
+- </refsect1>
+-
+- <refsect1>
+- <title>See Also</title>
+-
+- <para>
+- <citerefentry>
+- <refentrytitle>network</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>,
+- <citerefentry>
+- <refentrytitle>network-settings</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>
+- </para>
+- </refsect1>
+-</refentry>
+--
+2.39.2
+
diff --git a/network/patches/0072-man-Convert-network-performance-tuning-8-to-asciidoc.patch b/network/patches/0072-man-Convert-network-performance-tuning-8-to-asciidoc.patch
new file mode 100644
index 000000000..dd508342b
--- /dev/null
+++ b/network/patches/0072-man-Convert-network-performance-tuning-8-to-asciidoc.patch
@@ -0,0 +1,135 @@
+From c20f292770a6423c112b7f96d724bb13c4019d2a Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 30 Sep 2018 22:04:08 +0200
+Subject: [PATCH 072/304] man: Convert network-performance-tuning(8) to
+ asciidoc
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ man/network-performance-tuning.txt | 33 ++++++++++++++
+ man/network-performance-tuning.xml | 73 ------------------------------
+ 2 files changed, 33 insertions(+), 73 deletions(-)
+ create mode 100644 man/network-performance-tuning.txt
+ delete mode 100644 man/network-performance-tuning.xml
+
+diff --git a/man/network-performance-tuning.txt b/man/network-performance-tuning.txt
+new file mode 100644
+index 0000000..763ee21
+--- /dev/null
++++ b/man/network-performance-tuning.txt
+@@ -0,0 +1,33 @@
++network-performance-tuning(8)
++=============================
++
++NAME
++----
++network-performance-tuning - Performance Tuning for Networking
++
++DESCRIPTION
++-----------
++This page contains a summary of some performance tuning techniques
++that this system is using.
++
++=== SMP Affinity
++
++This system is automatically using SMP affinity for every physical
++network controller, if supported.
++
++A processor core is assigned to handle all interrupts of a certain
++network controller which will result in minimising cache misses,
++reducing network latency and quite possibly increasing throughput.
++
++The algorithm is trying to balance all network controllers across
++all processors.
++
++See /proc/interrups for the distribution of interrupts.
++
++AUTHORS
++-------
++Michael Tremer
++
++SEE ALSO
++--------
++link:network[8]
+diff --git a/man/network-performance-tuning.xml b/man/network-performance-tuning.xml
+deleted file mode 100644
+index 898f142..0000000
+--- a/man/network-performance-tuning.xml
++++ /dev/null
+@@ -1,73 +0,0 @@
+-<?xml version="1.0"?>
+-<!DOCTYPE refentry PUBLIC "-//OASIS/DTD DocBook XML V4.2//EN"
+- "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
+-
+-<refentry id="network-performance-tuning">
+- <refentryinfo>
+- <title>network-performance-tuning</title>
+- <productname>network</productname>
+-
+- <authorgroup>
+- <author>
+- <contrib>Developer</contrib>
+- <firstname>Michael</firstname>
+- <surname>Tremer</surname>
+- <email>michael.tremer(a)ipfire.org</email>
+- </author>
+- </authorgroup>
+- </refentryinfo>
+-
+- <refmeta>
+- <refentrytitle>network-performance-tuning</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </refmeta>
+-
+- <refnamediv>
+- <refname>network-performance-tuning</refname>
+- <refpurpose>Network Configuration Control Program</refpurpose>
+- </refnamediv>
+-
+- <refsect1>
+- <title>Description</title>
+-
+- <para>
+- This page contains a summary of some performance tuning techniques
+- that this system is using.
+- </para>
+- </refsect1>
+-
+- <refsect2>
+- <title>SMP Affinity</title>
+-
+- <para>
+- This system is automatically using SMP affinity for every physical
+- network controller, if supported.
+- </para>
+-
+- <para>
+- A processor core is assigned to handle all interrupts of a certain
+- network controller which will result in minimising cache misses,
+- reducing network latency and quite possibly increasing throughput.
+- </para>
+-
+- <para>
+- The algorithm is trying to balance all network controllers across
+- all processors.
+- </para>
+-
+- <para>
+- See /proc/interrups for the distribution of interrupts.
+- </para>
+- </refsect2>
+-
+- <refsect1>
+- <title>See Also</title>
+-
+- <para>
+- <citerefentry>
+- <refentrytitle>network</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>
+- </para>
+- </refsect1>
+-</refentry>
+--
+2.39.2
+
diff --git a/network/patches/0073-man-Convert-network-port-8-to-asciidoc.patch b/network/patches/0073-man-Convert-network-port-8-to-asciidoc.patch
new file mode 100644
index 000000000..d892b4ff7
--- /dev/null
+++ b/network/patches/0073-man-Convert-network-port-8-to-asciidoc.patch
@@ -0,0 +1,370 @@
+From 065346332054e3b2be85bee3f6d71a3dc34d6275 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 30 Sep 2018 22:27:40 +0200
+Subject: [PATCH 073/304] man: Convert network-port(8) to asciidoc
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ man/network-port.txt | 97 +++++++++++++++++
+ man/network-port.xml | 245 -------------------------------------------
+ 2 files changed, 97 insertions(+), 245 deletions(-)
+ create mode 100644 man/network-port.txt
+ delete mode 100644 man/network-port.xml
+
+diff --git a/man/network-port.txt b/man/network-port.txt
+new file mode 100644
+index 0000000..08b9e90
+--- /dev/null
++++ b/man/network-port.txt
+@@ -0,0 +1,97 @@
++network-port(8)
++===============
++
++NAME
++----
++network-port - Controls Network Ports
++
++SYNOPSIS
++--------
++[verse]
++'network port' new HOOK ...
++'network port' destroy PORT
++'network port' PORT color
++'network port' PORT create
++'network port' PORT description edit
++'network port' PORT description show
++'network port' PORT down
++'network port' PORT edit ...
++'network port' PORT identify
++'network port' PORT remove
++'network port' PORT status
++'network port' PORT up
++
++DESCRIPTION
++-----------
++This command creates, deletes, changes and views the configuration
++and status of ports.
++
++NOTE: A port is a physical or virtual device that is directly connected
++to an other network. It connects those and zones together.
++The 'network device' command shows status information of network devices
++and other things.
++
++COMMANDS
++--------
++The following commands are understood:
++
++'new' HOOK ...::
++ A new port may be created with this command.
++ HOOK must be a valid hook which may require more options.
++
++'destroy' PORT::
++ Destroys the port PORT.
++ The port is removed from any zones it is attached to and shut down.
++
++For all other commands, the name of the port needs to be passed first:
++
++'color'::
++ This command allows settings a color for a port.
++ See link:network-color[8] for more information.
++
++'create'::
++ This will create devices for the existing port PORT.
++
++ This does not create a new port. It will just create the (possibly
++ virtual) interface this port (i.e. create an interface for a WiFi
++ module or a VLAN device).
++
++ The interface is not brought up. Use the 'up' command to do that.
++
++include::include-description.txt[]
++
++'down'::
++ Shuts down the port.
++
++'edit'::
++ This command can be used to alter the configuration of a port.
++ Consult the documentation of the port hook to find out what is supported.
++
++'identify'::
++ This command will make the port flash for a few seconds
++ so that you can identify the correct network adapters
++ in the system.
++
++ This is not supported by all network adapters.
++
++'remove'::
++ This will remove an existing PORT.
++
++ This does not destroy the port. It inverses the operation performed
++ by the 'create' command.
++
++'status'::
++ This will show some detailed information about the status
++ of the specified port.
++
++'up'::
++ Brings up the port. It has to be created first.
++
++AUTHORS
++-------
++Michael Tremer
++
++SEE ALSO
++--------
++link:network[8],
++link:network-zone[8]
+diff --git a/man/network-port.xml b/man/network-port.xml
+deleted file mode 100644
+index 5c0a8ae..0000000
+--- a/man/network-port.xml
++++ /dev/null
+@@ -1,245 +0,0 @@
+-<?xml version="1.0"?>
+-<!DOCTYPE refentry PUBLIC "-//OASIS/DTD DocBook XML V4.2//EN"
+- "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
+-
+-<refentry id="network-port">
+- <refentryinfo>
+- <title>network-port</title>
+- <productname>network</productname>
+-
+- <authorgroup>
+- <author>
+- <contrib>Developer</contrib>
+- <firstname>Michael</firstname>
+- <surname>Tremer</surname>
+- <email>michael.tremer(a)ipfire.org</email>
+- </author>
+- </authorgroup>
+- </refentryinfo>
+-
+- <refmeta>
+- <refentrytitle>network-port</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </refmeta>
+-
+- <refnamediv>
+- <refname>network-port</refname>
+- <refpurpose>Network Configuration Control Program</refpurpose>
+- </refnamediv>
+-
+- <refsynopsisdiv>
+- <cmdsynopsis>
+- <command>network port <arg choice="plain">[new|destroy]</arg> <replaceable>PORT</replaceable> ...</command>
+- </cmdsynopsis>
+-
+- <cmdsynopsis>
+- <command>network port <replaceable>PORT</replaceable> <arg choice="plain">command</arg> ...</command>
+- </cmdsynopsis>
+- </refsynopsisdiv>
+-
+- <refsect1>
+- <title>Description</title>
+-
+- <para>
+- With help of the <command>port</command> command, you can create, delete,
+- change and view the configuration and status of ports.
+- </para>
+-
+- <para>
+- A port is a physical or virtual device that is directly connected
+- to an other network. If connects those and zones together.
+- </para>
+- </refsect1>
+-
+- <refsect1>
+- <title>Commands</title>
+-
+- <para>
+- The following commands are understood:
+- </para>
+-
+- <variablelist>
+- <varlistentry>
+- <term>
+- <command>new <replaceable>HOOK</replaceable> <arg choice="opt" rep="repeat">ARGUMENTS</arg></command>
+- </term>
+-
+- <listitem>
+- <para>
+- A new port may be created by the <command>new</command>
+- command.
+- </para>
+- <para>
+- <replaceable>HOOK</replaceable> must be a valid
+- hook which may require more <replaceable>ARGUMENTS</replaceable>.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command>destroy <replaceable>PORT</replaceable></command>
+- </term>
+-
+- <listitem>
+- <para>
+- A port can be destroyed with this command.
+- </para>
+- <para>
+- The port is removed from any zones it is attached
+- to and shut down.
+- </para>
+- </listitem>
+- </varlistentry>
+- </variablelist>
+-
+- <para>
+- For all other commands, the name of the port needs to be passed first:
+- </para>
+-
+- <variablelist>
+- <varlistentry>
+- <term>
+- <command><replaceable>PORT</replaceable> create</command>
+- </term>
+-
+- <listitem>
+- <para>
+- This will create an existing <replaceable>PORT</replaceable>.
+- </para>
+- <para>
+- This does not create a new port. It will just create the (possibly
+- virtual) interface this port (i.e. create an interface for a WiFi
+- module or a VLAN device).
+- </para>
+- <para>
+- The interface is not brought up. Use the <command>up</command> command
+- to do that.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command><replaceable>PORT</replaceable> remove</command>
+- </term>
+-
+- <listitem>
+- <para>
+- This will remove an existing <replaceable>PORT</replaceable>.
+- </para>
+- <para>
+- This does not destroy the port. It inverses the operation performed
+- by the <command>create</command> command.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command><replaceable>PORT</replaceable> [up|down]</command>
+- </term>
+-
+- <listitem>
+- <para>
+- These commands will bring the port up or down. It has to be
+- created first.
+- </para>
+- </listitem>
+- </varlistentry>
+- <varlistentry>
+- <term>
+- <command><replaceable>PORT</replaceable> color</command>
+- </term>
+-
+- <listitem>
+- <para>
+- This command allows settings a color for a port.
+- See
+- <citerefentry>
+- <refentrytitle>network-color</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>
+- for more information.
+- </para>
+- </listitem>
+- </varlistentry>
+- <varlistentry>
+- <term>
+- <command><replaceable>PORT</replaceable>description</command>
+- </term>
+-
+- <listitem>
+- <para>
+- This command allows you to add a description to a port.
+- See
+- <citerefentry>
+- <refentrytitle>network-description</refentrytitle>
+- <manvolnum>8</manvolnum>,
+- </citerefentry>
+- for more information.
+- </para>
+- </listitem>
+- </varlistentry>
+- <varlistentry>
+- <term>
+- <command><replaceable>PORT</replaceable> edit <arg choice="opt" rep="repeat">ARGUMENTS</arg></command>
+- </term>
+-
+- <listitem>
+- <para>
+- The <command>edit</command> command can be used to alter
+- the configuration of a port. Consult the documentation of the
+- port hook to find out which <replaceable>ARGUMENTS</replaceable>
+- are supported.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command><replaceable>PORT</replaceable> status</command>
+- </term>
+-
+- <listitem>
+- <para>
+- This will show some detailed information about the state
+- if the specified port.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command><replaceable>PORT</replaceable> identify</command>
+- </term>
+-
+- <listitem>
+- <para>
+- This command will make the port flash for a few seconds
+- so that you can identify the correct network adapters
+- in the system.
+- </para>
+- <para>
+- This is not supported by all network adapters.
+- </para>
+- </listitem>
+- </varlistentry>
+- </variablelist>
+- </refsect1>
+-
+- <refsect1>
+- <title>See Also</title>
+-
+- <para>
+- <citerefentry>
+- <refentrytitle>network</refentrytitle>
+- <manvolnum>8</manvolnum>,
+- </citerefentry>
+- <citerefentry>
+- <refentrytitle>network-zone</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>
+- </para>
+- </refsect1>
+-</refentry>
+--
+2.39.2
+
diff --git a/network/patches/0074-man-Converting-network-quick-start-8-to-asciidoc.patch b/network/patches/0074-man-Converting-network-quick-start-8-to-asciidoc.patch
new file mode 100644
index 000000000..8f99ad13a
--- /dev/null
+++ b/network/patches/0074-man-Converting-network-quick-start-8-to-asciidoc.patch
@@ -0,0 +1,275 @@
+From 27b9807e568edee69afa758481be164662770901 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 30 Sep 2018 22:40:35 +0200
+Subject: [PATCH 074/304] man: Converting network-quick-start(8) to asciidoc
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ man/network-quick-start.txt | 92 +++++++++++++++++++++
+ man/network-quick-start.xml | 155 ------------------------------------
+ 2 files changed, 92 insertions(+), 155 deletions(-)
+ create mode 100644 man/network-quick-start.txt
+ delete mode 100644 man/network-quick-start.xml
+
+diff --git a/man/network-quick-start.txt b/man/network-quick-start.txt
+new file mode 100644
+index 0000000..02ebfe0
+--- /dev/null
++++ b/man/network-quick-start.txt
+@@ -0,0 +1,92 @@
++network-quick-start(8)
++======================
++
++NAME
++----
++network-quick-start - Quick Start Guide for Networking
++
++DESCRIPTION
++-----------
++The link:network[8] is a very powerful command that allows you to configure
++the entire networking stack.
++Unfortunately that makes it quite complicated to use as well.
++
++This guide tries to be a good starting point to set up basic networking with
++the 'network' command.
++
++=== Adding an Uplink Zone
++
++The first step is to create a new uplink zone with name 'upl0'.
++
++This zone will be of the link:network-zone-bridge[8] type which is the default
++for all local networks.
++
++------------
++# network zone new upl0 bridge
++------------
++
++The zone will be created and brought up immediately.
++
++=== Attaching Ports
++
++To connect the zone to the physical world outside of our box we will need
++to attach ports to the zone. That is done with a single command.
++To execute this command, we will need to know which ports are available.
++One of the easiest way to find out about that is to use the auto-completion
++feature of the shell like this:
++
++------------
++# network zone upl0 port attach [TAB] [TAB]
++------------
++
++That will list all not yet attached ports. The following command will actually
++attach the port (which is 'p0' in this example).
++
++-----------
++# network zone upl0 port attach p0
++-----------
++
++You can as well get a list of all detected devices, zones and ports by running:
++
++-----------
++# network device list
++-----------
++
++To a zone of the 'bridge' type you may attach more than just one port if you
++wish to.
++
++=== IP Connectivity
++
++After a zone has been created and ports have been attached, you are now
++able to add IP connectivity.
++
++The easiest way to do that is using DHCP which can be enabled by this simple command:
++
++------------
++# network zone upl0 config new dhcp
++------------
++
++=== Debugging
++
++You may see the current status of the network by running this command:
++
++------------
++# network status
++------------
++
++The entire network can be restarted by running:
++
++------------
++# network restart
++------------
++
++AUTHORS
++-------
++Michael Tremer
++
++SEE ALSO
++--------
++link:network[8],
++link:network-device[8],
++link:network-port[8],
++link:network-zone[8]
+diff --git a/man/network-quick-start.xml b/man/network-quick-start.xml
+deleted file mode 100644
+index ea79700..0000000
+--- a/man/network-quick-start.xml
++++ /dev/null
+@@ -1,155 +0,0 @@
+-<?xml version="1.0"?>
+-<!DOCTYPE refentry PUBLIC "-//OASIS/DTD DocBook XML V4.2//EN"
+- "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
+-
+-<refentry id="network">
+- <refentryinfo>
+- <title>network-quick-start</title>
+- <productname>network</productname>
+-
+- <authorgroup>
+- <author>
+- <contrib>Developer</contrib>
+- <firstname>Michael</firstname>
+- <surname>Tremer</surname>
+- <email>michael.tremer(a)ipfire.org</email>
+- </author>
+- </authorgroup>
+- </refentryinfo>
+-
+- <refmeta>
+- <refentrytitle>network-quick-start</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </refmeta>
+-
+- <refnamediv>
+- <refname>network-quick-start</refname>
+- <refpurpose>Network Configuration Control Program</refpurpose>
+- </refnamediv>
+-
+- <refsect1>
+- <title>Quick Start Guide</title>
+-
+- <para>
+- The <command>network</command> is a very powerful command that allows
+- you to configure the entire networking stack. Unfortunately that makes
+- it quite complicated to use as well.
+- This guide tries to be a good starting point to set up basic networking
+- with the <command>network</command> command.
+- </para>
+- </refsect1>
+-
+- <refsect1>
+- <title>Add an uplink zone</title>
+-
+- <para>
+- The first step is to create a new uplink zone with name
+- <replaceable>upl0</replaceable>.
+- This zone will be of the <replaceable>bridge</replaceable> type which is
+- the default for all local networks.
+- </para>
+-
+- <programlisting># network zone new <replaceable>upl0</replaceable> <replaceable>bridge</replaceable></programlisting>
+-
+- <para>
+- The zone will be created and brought up immediately.
+- </para>
+- </refsect1>
+-
+- <refsect1>
+- <title>Attaching ports</title>
+-
+- <para>
+- To connect the zone to the physical world outside of our box we will need
+- to attach ports to the zone.
+- That is done with a single command.
+- To execute this command, we will need to know which ports are available.
+- One of the easiest way to find out about that is to use the auto-completion
+- feature of the shell like this:
+- </para>
+-
+- <programlisting># network zone <replaceable>upl0</replaceable> port attach [TAB] [TAB]</programlisting>
+-
+- <para>
+- That will list all not yet attached ports.
+- The following command will actually attach the port
+- (which is <replaceable>p0</replaceable> in this example).
+- </para>
+-
+- <programlisting># network zone <replaceable>upl0</replaceable> port attach <replaceable>p0</replaceable></programlisting>
+-
+- <para>
+- You can as well get a list of all detected devices,
+- zones and ports by running:
+- </para>
+-
+- <programlisting># network device list</programlisting>
+-
+- <para>
+- To a zone of the <replaceable>bridge</replaceable> type you may attach more
+- than just one port if you wish so.
+- </para>
+- </refsect1>
+-
+- <refsect1>
+- <title>IP connectivity</title>
+-
+- <para>
+- After a zone has been created and ports have been attached, you are now
+- able to add IP connectivity.
+- The easiest way to do that is using DHCP which can be enabled by this
+- simple command:
+- </para>
+-
+- <programlisting># network zone <replaceable>upl0</replaceable> config new <replaceable>ipv6-dhcp</replaceable></programlisting>
+-
+- <para>
+- And for IPv4:
+- </para>
+-
+- <programlisting># network zone <replaceable>upl0</replaceable> config new <replaceable>ipv4-dhcp</replaceable></programlisting>
+- </refsect1>
+-
+- <refsect1>
+- <title>Debugging</title>
+-
+- <para>
+- You may see the current status of the network by running this command:
+- </para>
+-
+- <programlisting># network status</programlisting>
+-
+- <para>
+- The entire network can be restarted by running:
+- </para>
+-
+- <programlisting># network restart</programlisting>
+- </refsect1>
+-
+- <refsect1>
+- <title>See Also</title>
+-
+- <para>
+- <citerefentry>
+- <refentrytitle>network</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>,
+- <citerefentry>
+- <refentrytitle>network-config</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>,
+- <citerefentry>
+- <refentrytitle>network-device</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>,
+- <citerefentry>
+- <refentrytitle>network-port</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>,
+- <citerefentry>
+- <refentrytitle>network-zone</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>
+- </para>
+- </refsect1>
+-</refentry>
+--
+2.39.2
+
diff --git a/network/patches/0075-man-Use-include-for-color-commands.patch b/network/patches/0075-man-Use-include-for-color-commands.patch
new file mode 100644
index 000000000..eccd76aec
--- /dev/null
+++ b/network/patches/0075-man-Use-include-for-color-commands.patch
@@ -0,0 +1,55 @@
+From d28ccf91678256bc299fed2c10b066682487b1e9 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 30 Sep 2018 22:53:20 +0200
+Subject: [PATCH 075/304] man: Use include for color commands
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ man/include-color.txt | 9 +++++++++
+ man/network-port.txt | 7 +++----
+ 2 files changed, 12 insertions(+), 4 deletions(-)
+ create mode 100644 man/include-color.txt
+
+diff --git a/man/include-color.txt b/man/include-color.txt
+new file mode 100644
+index 0000000..073c01b
+--- /dev/null
++++ b/man/include-color.txt
+@@ -0,0 +1,9 @@
++'color set <color>'::
++ The color is set with this command and required to be passed in
++ RGB hex formatting
++
++ NOTE: The color is being used to make identification of network devices
++ easier on the command line and web user interface.
++
++'color reset'::
++ Resets the color to blank.
+diff --git a/man/network-port.txt b/man/network-port.txt
+index 08b9e90..0c26f33 100644
+--- a/man/network-port.txt
++++ b/man/network-port.txt
+@@ -10,7 +10,8 @@ SYNOPSIS
+ [verse]
+ 'network port' new HOOK ...
+ 'network port' destroy PORT
+-'network port' PORT color
++'network port' PORT color set <color>
++'network port' PORT color reset
+ 'network port' PORT create
+ 'network port' PORT description edit
+ 'network port' PORT description show
+@@ -45,9 +46,7 @@ The following commands are understood:
+
+ For all other commands, the name of the port needs to be passed first:
+
+-'color'::
+- This command allows settings a color for a port.
+- See link:network-color[8] for more information.
++include::include-color.txt[]
+
+ 'create'::
+ This will create devices for the existing port PORT.
+--
+2.39.2
+
diff --git a/network/patches/0076-man-Drop-old-network-color-8-man-page.patch b/network/patches/0076-man-Drop-old-network-color-8-man-page.patch
new file mode 100644
index 000000000..a670acfb6
--- /dev/null
+++ b/network/patches/0076-man-Drop-old-network-color-8-man-page.patch
@@ -0,0 +1,72 @@
+From 7c329515f1e23231c315d41b55c4d9bea58c7d1c Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 30 Sep 2018 22:54:02 +0200
+Subject: [PATCH 076/304] man: Drop old network-color(8) man page
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 1 -
+ man/network-color.txt | 39 ---------------------------------------
+ 2 files changed, 40 deletions(-)
+ delete mode 100644 man/network-color.txt
+
+diff --git a/Makefile.am b/Makefile.am
+index 287a111..26f2e9c 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -455,7 +455,6 @@ INSTALL_DIRS += \
+ MANPAGES = \
+ man/firewall-settings.8 \
+ man/network.8 \
+- man/network-color.8 \
+ man/network-device.8 \
+ man/network-dhcp.8 \
+ man/network-dns-server.8 \
+diff --git a/man/network-color.txt b/man/network-color.txt
+deleted file mode 100644
+index f3be474..0000000
+--- a/man/network-color.txt
++++ /dev/null
+@@ -1,39 +0,0 @@
+-network-color(8)
+-================
+-
+-NAME
+-----
+-network-color - Allows assigning a color to a zone or port
+-
+-SYNOPSIS
+---------
+-[verse]
+-'network' [zone ZONE|port PORT] color set AABBCC
+-'network' [zone ZONE|port PORT] reset
+-
+-DESCRIPTION
+------------
+-The 'color' command helps to manage colors for zones and ports.
+-The color is being used to make identification of a zone or port easier on the
+-command line and web user interface.
+-
+-COMMANDS
+---------
+-The following commands are understood:
+-
+-'set' [AABBCC]::
+- The color of a zone or port is set with the 'set' command.
+- It is required to pass a color in hex formatting.
+-
+-'reset'::
+- Resets the color of a zone or port to blank.
+-
+-AUTHOR
+-------
+-Jonatan Schlag
+-
+-SEE ALSO
+---------
+-link:network[8]
+-link:network-zone[8]
+-link:network-port[8]
+--
+2.39.2
+
diff --git a/network/patches/0077-man-Fix-page-headers.patch b/network/patches/0077-man-Fix-page-headers.patch
new file mode 100644
index 000000000..ccf34d48b
--- /dev/null
+++ b/network/patches/0077-man-Fix-page-headers.patch
@@ -0,0 +1,38 @@
+From ec3a18b8cf262977d6fd73cee231338ce1b96ffd Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 30 Sep 2018 22:55:51 +0200
+Subject: [PATCH 077/304] man: Fix page headers
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ man/network-device.txt | 4 ++--
+ man/network-dhcp.txt | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/man/network-device.txt b/man/network-device.txt
+index 33fcefa..4f1c1b0 100644
+--- a/man/network-device.txt
++++ b/man/network-device.txt
+@@ -1,5 +1,5 @@
+-network(8)
+-==========
++network-device(8)
++=================
+
+ NAME
+ ----
+diff --git a/man/network-dhcp.txt b/man/network-dhcp.txt
+index a448619..bcb768e 100644
+--- a/man/network-dhcp.txt
++++ b/man/network-dhcp.txt
+@@ -1,5 +1,5 @@
+-network(8)
+-==========
++network-dhcp(8)
++===============
+
+ NAME
+ ----
+--
+2.39.2
+
diff --git a/network/patches/0078-man-Convert-network-route-8-to-asciidoc.patch b/network/patches/0078-man-Convert-network-route-8-to-asciidoc.patch
new file mode 100644
index 000000000..b2030772a
--- /dev/null
+++ b/network/patches/0078-man-Convert-network-route-8-to-asciidoc.patch
@@ -0,0 +1,157 @@
+From 70172845e300fb2bf491d471224bd087b0c4e0f4 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 31 Mar 2019 15:08:46 +0200
+Subject: [PATCH 078/304] man: Convert network-route(8) to asciidoc
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ man/network-route.txt | 32 ++++++++++++++
+ man/network-route.xml | 97 -------------------------------------------
+ 2 files changed, 32 insertions(+), 97 deletions(-)
+ create mode 100644 man/network-route.txt
+ delete mode 100644 man/network-route.xml
+
+diff --git a/man/network-route.txt b/man/network-route.txt
+new file mode 100644
+index 0000000..bf3ddb4
+--- /dev/null
++++ b/man/network-route.txt
+@@ -0,0 +1,32 @@
++network-route(8)
++================
++
++NAME
++----
++network-route - Manage Routing
++
++SYNOPSIS
++--------
++[verse]
++'network route' COMMAND ...
++
++DESCRIPTION
++-----------
++This command helps to manage routes.
++
++COMMANDS
++--------
++The following commands are understood:
++
++'static' ...::
++ Static routes are managed by the 'static' command followed by the options
++ for static routes which are described in link:network-route-static[8]
++
++AUTHORS
++-------
++Michael Tremer
++
++SEE ALSO
++--------
++link:network[8],
++link:network-route-static[8]
+diff --git a/man/network-route.xml b/man/network-route.xml
+deleted file mode 100644
+index 207a5ce..0000000
+--- a/man/network-route.xml
++++ /dev/null
+@@ -1,97 +0,0 @@
+-<?xml version="1.0"?>
+-<!DOCTYPE refentry PUBLIC "-//OASIS/DTD DocBook XML V4.2//EN"
+- "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
+-
+-<refentry id="network-route">
+- <refentryinfo>
+- <title>network-route</title>
+- <productname>network</productname>
+-
+- <authorgroup>
+- <author>
+- <contrib>Developer</contrib>
+- <firstname>Michael</firstname>
+- <surname>Tremer</surname>
+- <email>michael.tremer(a)ipfire.org</email>
+- </author>
+- </authorgroup>
+- </refentryinfo>
+-
+- <refmeta>
+- <refentrytitle>network-route</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </refmeta>
+-
+- <refnamediv>
+- <refname>network-route</refname>
+- <refpurpose>Network Configuration Control Program</refpurpose>
+- </refnamediv>
+-
+- <refsynopsisdiv>
+- <cmdsynopsis>
+- <command>network route <arg choice="plain">COMMAND</arg></command>
+- </cmdsynopsis>
+- </refsynopsisdiv>
+-
+- <refsect1>
+- <title>Description</title>
+-
+- <para>
+- The <command>route</command> helps to manage routes.
+- </para>
+- </refsect1>
+-
+- <refsect1>
+- <title>Commands</title>
+-
+- <para>
+- The following commands are understood:
+- </para>
+-
+- <variablelist>
+- <varlistentry>
+- <term>
+- <command>static</command>
+- </term>
+-
+- <listitem>
+- <para>
+- Static routes are managed by the <command>static</command> command
+- followed by the options for static routes which are described in:
+- <citerefentry>
+- <refentrytitle>network-route-static</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>
+- </para>
+- </listitem>
+- </varlistentry>
+- </variablelist>
+- </refsect1>
+-
+- <refsect1>
+- <title>Route Types</title>
+-
+- <refsect2>
+- <title>static</title>
+-
+- <para>
+- A static route is a route which does not change when the network changes.
+- </para>
+- </refsect2>
+-</refsect1>
+-
+- <refsect1>
+- <title>See Also</title>
+-
+- <para>
+- <citerefentry>
+- <refentrytitle>network</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>,
+- <citerefentry>
+- <refentrytitle>network-route-static</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>
+- </para>
+- </refsect1>
+-</refentry>
+--
+2.39.2
+
diff --git a/network/patches/0079-.gitignore-Ignore-DS_Store.patch b/network/patches/0079-.gitignore-Ignore-DS_Store.patch
new file mode 100644
index 000000000..010ed44d1
--- /dev/null
+++ b/network/patches/0079-.gitignore-Ignore-DS_Store.patch
@@ -0,0 +1,26 @@
+From 82003431a4998e04e0e67f12ee6c3b6e5e802901 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 31 Mar 2019 15:10:49 +0200
+Subject: [PATCH 079/304] .gitignore: Ignore DS_Store
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ .gitignore | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/.gitignore b/.gitignore
+index 36c85a1..bb093d3 100644
+--- a/.gitignore
++++ b/.gitignore
+@@ -14,6 +14,8 @@
+ /*.tar.bz2
+ /*.tar.gz
+ /*.tar.xz
++.DS_Store
++._.DS_Store
+ *.log
+ *.cache
+ *.la
+--
+2.39.2
+
diff --git a/network/patches/0080-man-Convert-network-route-static-8-to-asciidoc.patch b/network/patches/0080-man-Convert-network-route-static-8-to-asciidoc.patch
new file mode 100644
index 000000000..8d2f01413
--- /dev/null
+++ b/network/patches/0080-man-Convert-network-route-static-8-to-asciidoc.patch
@@ -0,0 +1,280 @@
+From d715390e9b1c4cc72bd22b915a842acc96912108 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 31 Mar 2019 15:34:19 +0200
+Subject: [PATCH 080/304] man: Convert network-route-static(8) to asciidoc
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ man/network-route-static.txt | 69 +++++++++++++
+ man/network-route-static.xml | 183 -----------------------------------
+ 2 files changed, 69 insertions(+), 183 deletions(-)
+ create mode 100644 man/network-route-static.txt
+ delete mode 100644 man/network-route-static.xml
+
+diff --git a/man/network-route-static.txt b/man/network-route-static.txt
+new file mode 100644
+index 0000000..d4774b2
+--- /dev/null
++++ b/man/network-route-static.txt
+@@ -0,0 +1,69 @@
++= network-route-static(8)
++Michael Tremer <michael.tremer(a)ipfire.org>
++
++== NAME
++network-route - Manage Static Routing
++
++== SYNOPSIS
++[verse]
++'network route static' COMMAND ...
++'network route static add' NETWORK [--gateway=GATEWAY,--unreachable,--prohibit,--blackhole] [--mtu=MTU]
++'network route static remove' NETWORK
++'network route static list' [--protocol=ipv6|ipv4]
++
++== DESCRIPTION
++This command helps to manage routes.
++
++== COMMANDS
++The following commands are understood:
++
++'add' NETWORK ...::
++ A new route may be added by the 'add' command. It is required to pass a
++ valid network prefix NETWORK, which can be either IPv6 or IPv4.
++ +
++ For unicast routes, the '--gateway=GATEWAY' option must be passed, where
++ GATEWAY is a valid IP address of the same protocol type as the network
++ prefix is.
++ +
++ Use '--unreachable', '--prohibit', '--blackhole' can be used to create of
++ that type. See ROUTE TYPES below for more information about these options.
++ +
++ The optional '--mtu=MTU' parameter defines the MTU along the path to the
++ destination and must be an integer number. This will show you very
++ detailed information about the given device.
++
++'remove' NETWORK::
++ A route can be removed with this command.
++ +
++ NETWORK is the network prefix of an existing route.
++
++'list'::
++ Shows a list of all configured routes.
++ +
++ Output can be filtered by passing --protocol=[ipv6|ipv4].
++
++== ROUTE TYPES
++
++[horizontal]
++'unicast'::
++ A unicast route is the most common route in routing tables. It is a route to
++ a destination network address, which describes the path to the destination.
++ Use the '--gateway=GATEWAY' option to create such a route.
++
++'unreachable'::
++ When a route is determined and the routing decision process returns a
++ destination with an unreachable route type, an ICMP unreachable message is
++ generated and returned to the source address.
++
++'prohibit'::
++ This works like an _unreachable_ route, but the returned ICMP message is an
++ ICMP prohibited message.
++
++'blackhole'::
++ Packets matching this kind of route are silently discarded.
++ There will be no ICMP message sent to the source and no packet be forwarded.
++
++== SEE ALSO
++link:network[8],
++link:network-route[8],
++link:ip-route[8]
+diff --git a/man/network-route-static.xml b/man/network-route-static.xml
+deleted file mode 100644
+index d43eb62..0000000
+--- a/man/network-route-static.xml
++++ /dev/null
+@@ -1,183 +0,0 @@
+-<?xml version="1.0"?>
+-<!DOCTYPE refentry PUBLIC "-//OASIS/DTD DocBook XML V4.2//EN"
+- "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
+-
+-<refentry id="network-route-static">
+- <refentryinfo>
+- <title>network-route-static</title>
+- <productname>network</productname>
+-
+- <authorgroup>
+- <author>
+- <contrib>Developer</contrib>
+- <firstname>Michael</firstname>
+- <surname>Tremer</surname>
+- <email>michael.tremer(a)ipfire.org</email>
+- </author>
+- </authorgroup>
+- </refentryinfo>
+-
+- <refmeta>
+- <refentrytitle>network-route-static</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </refmeta>
+-
+- <refnamediv>
+- <refname>network-route-static</refname>
+- <refpurpose>Network Configuration Control Program</refpurpose>
+- </refnamediv>
+-
+- <refsynopsisdiv>
+- <cmdsynopsis>
+- <command>network route static <arg choice="plain">COMMAND</arg></command>
+- </cmdsynopsis>
+- </refsynopsisdiv>
+-
+- <refsect1>
+- <title>Description</title>
+-
+- <para>
+- The <command>route static</command> helps to manage static routes.
+- </para>
+- </refsect1>
+-
+- <refsect1>
+- <title>Commands</title>
+-
+- <para>
+- The following commands are understood:
+- </para>
+-
+- <variablelist>
+- <varlistentry>
+- <term>
+- <command>add <replaceable>NETWORK</replaceable> [<option>--gateway=GATEWAY</option>, <option>--unreachable</option>, <option>--prohibit</option>, <option>--blackhole</option>] [<option>--mtu=MTU</option>]</command>
+- </term>
+-
+- <listitem>
+- <para>
+- A new route may be added by the <command>add</command> command.
+- It is always required to pass a valid network prefix
+- <replaceable>NETWORK</replaceable>, which can be either
+- IPv6 or IPv4.
+- </para>
+- <para>
+- For unicast routes, the <option>--gateway=GATEWAY</option>
+- option must be passed, where <varname>GATEWAY</varname>
+- is a valid IP address of the same protocol type as the
+- network prefix is.
+- </para>
+- <para>
+- Use <option>--unreachable</option>, <option>--prohibit</option>,
+- <option>--blackhole</option> can be used to create of that
+- type. See <emphasis>ROUTE TYPES</emphasis> below for more
+- information about these options.
+- </para>
+- <para>
+- The optional <option>--mtu=MTU</option> parameter defines the
+- MTU along the path to the destination and must be an integer
+- number. This will show you very detailed information about
+- the given device.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command>remove <replaceable>NETWORK</replaceable></command>
+- </term>
+-
+- <listitem>
+- <para>
+- A route can be removed with the command.
+- </para>
+- <para>
+- <replaceable>NETWORK</replaceable> is the network prefix
+- of an existing route.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command>list [<option>--protocol=ipv6|ipv4</option>]</command>
+- </term>
+-
+- <listitem>
+- <para>
+- Shows a list of all configured routes.
+- </para>
+- <para>
+- Pass the protocol option to filter the output only for the
+- given protocol.
+- </para>
+- </listitem>
+- </varlistentry>
+- </variablelist>
+- </refsect1>
+-
+- <refsect1>
+- <title>Route Types</title>
+-
+- <refsect2>
+- <title>unicast</title>
+-
+- <para>
+- A unicast route is the most common route in routing tables.
+- It is a route to a destination network address, which describes
+- the path to the destination.
+- Use the <option>--gateway=GATEWAY</option> option to create such
+- a route.
+- </para>
+- </refsect2>
+-
+- <refsect2>
+- <title>unreachable</title>
+-
+- <para>
+- When a route is determined and the routing decision process
+- returns a destination with an unreachable route type, an ICMP
+- unreachable message is generated and returned to the source
+- address.
+- </para>
+- </refsect2>
+-
+- <refsect2>
+- <title>prohibit</title>
+-
+- <para>
+- This works like an <emphasis>unreachable</emphasis> route, but
+- the returned ICMP message is an ICMP prohibited message.
+- </para>
+- </refsect2>
+-
+- <refsect2>
+- <title>blackhole</title>
+-
+- <para>
+- Packets matching this kind of route are silently discarded.
+- There will be no ICMP message sent to the source and no packet
+- be forwarded.
+- </para>
+- </refsect2>
+- </refsect1>
+-
+- <refsect1>
+- <title>See Also</title>
+-
+- <para>
+- <citerefentry>
+- <refentrytitle>network</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>,
+- <citerefentry>
+- <refentrytitle>network-route</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>,
+- <citerefentry>
+- <refentrytitle>ip-route</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>
+- </para>
+- </refsect1>
+-</refentry>
+--
+2.39.2
+
diff --git a/network/patches/0081-man-Convert-network-settings-8-to-asciidoc.patch b/network/patches/0081-man-Convert-network-settings-8-to-asciidoc.patch
new file mode 100644
index 000000000..f0e629f46
--- /dev/null
+++ b/network/patches/0081-man-Convert-network-settings-8-to-asciidoc.patch
@@ -0,0 +1,190 @@
+From daebec37ca3cd19e000d1a9c1a77448d8c155fcd Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 31 Mar 2019 15:47:14 +0200
+Subject: [PATCH 081/304] man: Convert network-settings(8) to asciidoc
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ man/network-settings.txt | 44 +++++++++++++++
+ man/network-settings.xml | 118 ---------------------------------------
+ 2 files changed, 44 insertions(+), 118 deletions(-)
+ create mode 100644 man/network-settings.txt
+ delete mode 100644 man/network-settings.xml
+
+diff --git a/man/network-settings.txt b/man/network-settings.txt
+new file mode 100644
+index 0000000..e77f038
+--- /dev/null
++++ b/man/network-settings.txt
+@@ -0,0 +1,44 @@
++= network-settings(8)
++Michael Tremer <michael.tremer(a)ipfire.org>
++
++== NAME
++network-settings - Change global network settings
++
++== SYNOPSIS
++'network settings'
++'network settings' KEY=VALUE
++
++== DESCRIPTION
++The 'network settings' command may be used to set global settings.
++
++Please have a look at the individual man pages for more options.
++
++== COMMANDS
++If no additional argument is given, running the command will dump a list of
++all settings variables and their current values.
++
++You may set a new value by adding the variable name and the new
++value to the command line.
++
++== VARIABLES
++
++'DEBUG=[true|_false_]'::
++ The DEBUG will control whether debug logging is enabled or not.
++ Additionally to writing debug log messages to the log files, the messages
++ will be displayed on the console as well.
++
++'WIRELESS_REGULATORY_DOMAIN=_00_'::
++ The wireless regulatory domain is set globally for the entire system with
++ the WIRELESS_REGULATORY_DOMAIN setting.
++ +
++ The default is '00' which is the _world_ setting.
++ +
++ Valid values are country codes for countries which have their own
++ regulatory domain.
++
++== AUTHORS
++Michael Tremer
++
++== SEE ALSO
++link:network[8],
++link:network-dns-server[8]
+diff --git a/man/network-settings.xml b/man/network-settings.xml
+deleted file mode 100644
+index 7d1c70d..0000000
+--- a/man/network-settings.xml
++++ /dev/null
+@@ -1,118 +0,0 @@
+-<?xml version="1.0"?>
+-<!DOCTYPE refentry PUBLIC "-//OASIS/DTD DocBook XML V4.2//EN"
+- "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
+-
+-<refentry id="network-settings">
+- <refentryinfo>
+- <title>network-settings</title>
+- <productname>network</productname>
+-
+- <authorgroup>
+- <author>
+- <contrib>Developer</contrib>
+- <firstname>Michael</firstname>
+- <surname>Tremer</surname>
+- <email>michael.tremer(a)ipfire.org</email>
+- </author>
+- </authorgroup>
+- </refentryinfo>
+-
+- <refmeta>
+- <refentrytitle>network-settings</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </refmeta>
+-
+- <refnamediv>
+- <refname>network-settings</refname>
+- <refpurpose>Network Configuration Control Program</refpurpose>
+- </refnamediv>
+-
+- <refsynopsisdiv>
+- <cmdsynopsis>
+- <command>network settings</command>
+- </cmdsynopsis>
+-
+- <cmdsynopsis>
+- <command>network settings <replaceable>KEY=VALUE</replaceable></command>
+- </cmdsynopsis>
+- </refsynopsisdiv>
+-
+- <refsect1>
+- <title>Description</title>
+-
+- <para>
+- The <command>network settings</command> command may be used to set
+- global settingsuration options.
+- </para>
+- <para>
+- Please have a look at the individual man pages for more options.
+- </para>
+- </refsect1>
+-
+- <refsect1>
+- <title>Commands</title>
+-
+- <para>
+- If no additional argument is given, running the command will
+- dump a list of all settingsuration variables and their current values.
+- </para>
+-
+- <para>
+- You may set a new value by adding the variable name and the new
+- value to the command line.
+- </para>
+- </refsect1>
+-
+- <refsect1>
+- <title>Variables</title>
+-
+- <variablelist>
+- <varlistentry>
+- <term>
+- <varname>DEBUG</varname>=[<emphasis>0</emphasis>|1]
+- </term>
+-
+- <listitem>
+- <para>
+- The <varname>DEBUG</varname> will control whether debug
+- logging is enabled or not. Additionally to writing debug
+- log messages to the log files, the messages will be displayed
+- on the console as well.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <varname>WIRELESS_REGULATORY_DOMAIN</varname>=<emphasis>00</emphasis>
+- </term>
+-
+- <listitem>
+- <para>
+- The wireless regulatory domain is set globally for the
+- entire system with the <varname>WIRELESS_REGULATORY_DOMAIN</varname>
+- setting. The default is <emphasis>00</emphasis> which
+- is the <emphasis>world</emphasis> setting.
+- Valid values are country codes for countries which have their
+- own regulatory domain.
+- </para>
+- </listitem>
+- </varlistentry>
+- </variablelist>
+- </refsect1>
+-
+- <refsect1>
+- <title>See Also</title>
+-
+- <para>
+- <citerefentry>
+- <refentrytitle>network</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>,
+- <citerefentry>
+- <refentrytitle>network-dns-server</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>
+- </para>
+- </refsect1>
+-</refentry>
+--
+2.39.2
+
diff --git a/network/patches/0082-man-Convert-network-vpn-8-to-asciidoc.patch b/network/patches/0082-man-Convert-network-vpn-8-to-asciidoc.patch
new file mode 100644
index 000000000..b284f76dc
--- /dev/null
+++ b/network/patches/0082-man-Convert-network-vpn-8-to-asciidoc.patch
@@ -0,0 +1,135 @@
+From 9848b81e6e8c2732920d9a7a115110723e2b07bb Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 31 Mar 2019 15:59:21 +0200
+Subject: [PATCH 082/304] man: Convert network-vpn(8) to asciidoc
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ man/network-vpn.txt | 26 +++++++++++++++
+ man/network-vpn.xml | 81 ---------------------------------------------
+ 2 files changed, 26 insertions(+), 81 deletions(-)
+ create mode 100644 man/network-vpn.txt
+ delete mode 100644 man/network-vpn.xml
+
+diff --git a/man/network-vpn.txt b/man/network-vpn.txt
+new file mode 100644
+index 0000000..5a905db
+--- /dev/null
++++ b/man/network-vpn.txt
+@@ -0,0 +1,26 @@
++= network-vpn(8)
++Michael Tremer <michael.tremer(a)ipfire.org>
++
++== NAME
++network-vpn - Configure Virtual Private Networks
++
++== SYNOPSIS
++'network vpn' COMMAND ...
++
++== DESCRIPTION
++The 'vpn' command allows to create, delete, edit and show the status of VPN
++connections and the configuration around it.
++
++== COMMANDS
++The following commands are understood:
++
++'security-policies' ...::
++ Use this command to manage security policies.
++ +
++ See link:network-vpn-security-policies[8] for details.
++
++== AUTHORS
++Michael Tremer
++
++== SEE ALSO
++link:network[8]
+diff --git a/man/network-vpn.xml b/man/network-vpn.xml
+deleted file mode 100644
+index d71d14a..0000000
+--- a/man/network-vpn.xml
++++ /dev/null
+@@ -1,81 +0,0 @@
+-<?xml version="1.0"?>
+-<!DOCTYPE refentry PUBLIC "-//OASIS/DTD DocBook XML V4.2//EN"
+- "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
+-
+-<refentry id="network-vpn">
+- <refentryinfo>
+- <title>network-vpn</title>
+- <productname>network</productname>
+-
+- <authorgroup>
+- <author>
+- <contrib>Developer</contrib>
+- <firstname>Michael</firstname>
+- <surname>Tremer</surname>
+- <email>michael.tremer(a)ipfire.org</email>
+- </author>
+- </authorgroup>
+- </refentryinfo>
+-
+- <refmeta>
+- <refentrytitle>network-vpn</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </refmeta>
+-
+- <refnamediv>
+- <refname>network-vpn</refname>
+- <refpurpose>Network Configuration Control Program</refpurpose>
+- </refnamediv>
+-
+- <refsynopsisdiv>
+- <cmdsynopsis>
+- <command>network <arg choice="plain">vpn</arg> <arg choice="plain">command</arg> ...</command>
+- </cmdsynopsis>
+- </refsynopsisdiv>
+-
+- <refsect1>
+- <title>Description</title>
+-
+- <para>
+- The <command>vpn</command> command allows to create, delete, edit
+- and show the status of VPN connections and the configuration around it.
+- </para>
+- </refsect1>
+-
+- <refsect1>
+- <title>Commands</title>
+-
+- <para>
+- The following commands are understood:
+- </para>
+-
+- <variablelist>
+- <varlistentry>
+- <term>
+- <command>security-policies ...</command>
+- </term>
+-
+- <listitem>
+- <para>
+- Use this command to manage security policies.
+- See <citerefentry>
+- <refentrytitle>network-vpn-security-policies</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry> for details.
+- </para>
+- </listitem>
+- </varlistentry>
+- </variablelist>
+- </refsect1>
+-
+- <refsect1>
+- <title>See Also</title>
+-
+- <para>
+- <citerefentry>
+- <refentrytitle>network</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>
+- </para>
+- </refsect1>
+-</refentry>
+--
+2.39.2
+
diff --git a/network/patches/0083-man-Convert-network-vpn-security-policies-8-to-ascii.patch b/network/patches/0083-man-Convert-network-vpn-security-policies-8-to-ascii.patch
new file mode 100644
index 000000000..6aa5702e5
--- /dev/null
+++ b/network/patches/0083-man-Convert-network-vpn-security-policies-8-to-ascii.patch
@@ -0,0 +1,453 @@
+From 0a31681e96ee9ed656bf5ce531d4057079a897be Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 31 Mar 2019 16:30:26 +0200
+Subject: [PATCH 083/304] man: Convert network-vpn-security-policies(8) to
+ asciidoc
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ man/network-vpn-security-policies.txt | 111 +++++++++
+ man/network-vpn-security-policies.xml | 313 --------------------------
+ 2 files changed, 111 insertions(+), 313 deletions(-)
+ create mode 100644 man/network-vpn-security-policies.txt
+ delete mode 100644 man/network-vpn-security-policies.xml
+
+diff --git a/man/network-vpn-security-policies.txt b/man/network-vpn-security-policies.txt
+new file mode 100644
+index 0000000..f9dc91a
+--- /dev/null
++++ b/man/network-vpn-security-policies.txt
+@@ -0,0 +1,111 @@
++= network-vpn-security-policies(8)
++Michael Tremer <michael.tremer(a)ipfire.org>
++
++== NAME
++network-vpn-security-policies - Configure VPN Security Policies
++
++== SYNOPSIS
++[verse]
++'network vpn security-policies [new|destroy]' NAME...
++'network vpn security-policies' NAME COMMAND ...
++
++== DESCRIPTION
++With help of the 'vpn security-policies', it is possible to create, destroy
++and edit VPN security policies.
++
++A security policy is a definition of ciphers and algorithms for integrity
++and key-exchanges for VPN connections.
++
++== COMMANDS
++The following commands are understood:
++
++'new NAME'::
++ A new security policy may be created with the 'new' command.
++ +
++ NAME does not allow any spaces.
++
++'destroy NAME'::
++ A security policy can be destroyed with this command.
++ +
++ If the policy is still in use, it cannot be deleted.
++
++For all other commands, the name of the security policy needs to be passed first:
++
++'NAME show'::
++ Shows the configuration of the security policy.
++
++'NAME key-exchange' [IKEv2|IKEv1]::
++ Defines the key exchange algorithm that should be used to initiate an
++ IPsec VPN connection.
++
++'NAME ciphers' [CIPHER-LIST|+CIPHER ...|-CIPHER ...]::
++ This command allows modifying the cipher list.
++ A new CIPHER-LIST can be passed which will replace the current configuration.
++ Alternatively, new ciphers can be added by prepending a + sign to the cipher
++ name and can removed likewise using -.
++ +
++ A cipher is an algorithm that encrypts and decrypts data to be able to
++ transmit it over an insecure channel.
++
++'NAME integrities' [INTEGRITY-LIST|+INTEGRITY ...|-INTEGRITY ...]::
++ This command allows modifying the integrity list similar to the
++ 'ciphers' command.
++ +
++ Integrity algorithms are used to be able to determine if data has been
++ altered when being transferred over an untrusted channel.
++
++'NAME pseudo-random-functions' [PSEUDO-RANDOM-FUNCTION-LIST|+PSEUDO-RANDOM-FUNCTION...|-PSEUDO-RANDOM-FUNCTION]::
++ This command allows modifying the list of pseudo random functions
++ similar to the 'ciphers' command.
++ +
++ These functions are used in combination with an AEAD cipher only.
++
++'NAME group-types' [GROUP-TYPES-LIST|+GROUP-TYPE ...|-GROUP-TYPE]::
++ This command allows modifying the list of group types similar to the
++ 'ciphers' command.
++ +
++ These algorithms are used to negotiate a shared secret of an insecure channel.
++
++'NAME pfs' [on|off]::
++ This command allows to enable or disable Perfect Forward Secrecy (PFS).
++ If PFS is enabled, the encrypted channels of a VPN connection will be
++ renegotiated regularly to avoid that the same keys are used for too long.
++ If an attacker is able to obtain a key that was used to encrypt the
++ data, it is only possible to decrypt a certain amount of data.
++ +
++ It is strongly recommended to enable PFS at all times.
++
++'NAME lifetime' LIFETIME::
++ This command allows to define how often the VPN connection is
++ renegotiated if PFS is enabled.
++
++'NAME compression' [on|off]::
++ This command allows to enable or disable compression.
++ If compression is enabled, all data is being compressed before being
++ sent through the VPN.
++ This setting is ignored if the peer does not support this.
++
++== System Policies
++
++The system comes with builtin policies that cannot be modified by the user.
++They are intended to provide good defaults for various situations.
++
++[horizontal]
++'system'::
++ This policy is the default for every VPN connection and allows using
++ all ciphers, integrity and key-exchange algorithms that are recommended
++ to use and have not been proven or assumed to be broken, yet.
++ +
++ Over time, this policy will change whenever an algorithm has been broken
++ and is not recommended to be used any more.
++
++'performance'::
++ This policy is recommended to be used on systems that are not very powerful.
++ Algorithms with smaller key lengths, but still considered to be secure
++ are being used.
++
++System policies cannot be deleted.
++
++== SEE ALSO
++link:network[8],
++link:network-vpn[8]
+diff --git a/man/network-vpn-security-policies.xml b/man/network-vpn-security-policies.xml
+deleted file mode 100644
+index 40e6213..0000000
+--- a/man/network-vpn-security-policies.xml
++++ /dev/null
+@@ -1,313 +0,0 @@
+-<?xml version="1.0"?>
+-<!DOCTYPE refentry PUBLIC "-//OASIS/DTD DocBook XML V4.2//EN"
+- "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
+-
+-<refentry id="network-zone">
+- <refentryinfo>
+- <title>network-vpn-security-policies</title>
+- <productname>network</productname>
+-
+- <authorgroup>
+- <author>
+- <contrib>Developer</contrib>
+- <firstname>Michael</firstname>
+- <surname>Tremer</surname>
+- <email>michael.tremer(a)ipfire.org</email>
+- </author>
+- </authorgroup>
+- </refentryinfo>
+-
+- <refmeta>
+- <refentrytitle>network-vpn-security-policies</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </refmeta>
+-
+- <refnamediv>
+- <refname>network-vpn-security-policies</refname>
+- <refpurpose>Network Configuration Control Program</refpurpose>
+- </refnamediv>
+-
+- <refsynopsisdiv>
+- <cmdsynopsis>
+- <command>network vpn security-policies <arg choice="plain">[new|destroy]</arg> <replaceable>NAME</replaceable> ...</command>
+- </cmdsynopsis>
+-
+- <cmdsynopsis>
+- <command>network vpn security-policies <replaceable>NAME</replaceable> <arg choice="plain">command</arg> ...</command>
+- </cmdsynopsis>
+- </refsynopsisdiv>
+-
+- <refsect1>
+- <title>Description</title>
+-
+- <para>
+- With help of the <command>vpn security-policies</command>, it is possible
+- to create, destroy and edit VPN security policies.
+- </para>
+- <para>
+- A security policy is a definition of ciphers and algorithms for integrity
+- and key-exchanges for VPN connections.
+- </para>
+- </refsect1>
+-
+- <refsect1>
+- <title>Commands</title>
+-
+- <para>
+- The following commands are understood:
+- </para>
+-
+- <variablelist>
+- <varlistentry>
+- <term>
+- <command>new <replaceable>NAME</replaceable></command>
+- </term>
+-
+- <listitem>
+- <para>
+- A new security policy may be created with the
+- <command>new</command> command.
+- </para>
+-
+- <para>
+- <replaceable>NAME</replaceable> does not allow any spaces.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command>destroy <replaceable>NAME</replaceable></command>
+- </term>
+-
+- <listitem>
+- <para>
+- A security policy can be destroyed with this command.
+- </para>
+- <para>
+- If the policy is still in use, it cannot be deleted.
+- </para>
+- </listitem>
+- </varlistentry>
+- </variablelist>
+-
+- <para>
+- For all other commands, the name of the security policy needs to be passed first:
+- </para>
+-
+- <variablelist>
+- <varlistentry>
+- <term>
+- <command><replaceable>NAME</replaceable> show</command>
+- </term>
+-
+- <listitem>
+- <para>
+- Shows the configuration of the security policy.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command><replaceable>NAME</replaceable> key-exchange <replaceable>[IKEv2|IKEv1]</replaceable></command>
+- </term>
+-
+- <listitem>
+- <para>
+- Defines the key exchange algorithm that should be used to
+- initiate an IPsec VPN connection.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command><replaceable>NAME</replaceable> ciphers <replaceable>[CIPHER-LIST|+CIPHER ...|-CIPHER ...]</replaceable></command>
+- </term>
+-
+- <listitem>
+- <para>
+- This command allows modifying the cipher list.
+- </para>
+-
+- <para>
+- A new <replaceable>CIPHER-LIST</replaceable> can be passed
+- which will replace the current configuration.
+- Alternatively, new ciphers can be added by prepending a
+- + sign to the cipher name and can removed likewise
+- using -.
+- </para>
+-
+- <para>
+- A cipher is an algorithm that encrypts and decrypts data
+- to be able to transmit it over an insecure channel.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command><replaceable>NAME</replaceable> integrities <replaceable>[INTEGRITY-LIST|+INTEGRITY ...|-INTEGRITY ...]</replaceable></command>
+- </term>
+-
+- <listitem>
+- <para>
+- This command allows modifying the integrity list
+- similar to the <command>ciphers</command> command.
+- </para>
+-
+- <para>
+- Integrity algorithms are used to be able to determine
+- if data has been altered when being transfered over
+- an untrusted channel.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command><replaceable>NAME</replaceable> pseudo-random-functions <replaceable>[PSEUDO-RANDOM-FUNCTION-LIST|+PSEUDO-RANDOM-FUNCTION...|-PSEUDO-RANDOM-FUNCTION]</replaceable>
+- </command>
+- </term>
+-
+- <listitem>
+- <para>
+- This command allows modifying the list of pseudo random functions
+- similar to the <command>ciphers</command> command.
+- </para>
+-
+- <para>
+- These functions are used in combination with an AEAD cipher only.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command><replaceable>NAME</replaceable> group-types <replaceable>[GROUP-TYPES-LIST|+GROUP-TYPE ...|-GROUP-TYPE]</replaceable>
+- </command>
+- </term>
+-
+- <listitem>
+- <para>
+- This command allows modifying the list of group types
+- similar to the <command>ciphers</command> command.
+- </para>
+-
+- <para>
+- These algorithms are used to negotiate a shared secret
+- of an insecure channel.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command><replaceable>NAME</replaceable> pfs <replaceable>[on|off]</replaceable></command>
+- </term>
+-
+- <listitem>
+- <para>
+- This command allows to enable or disable Perfect Forward Secrecy (PFS).
+- </para>
+-
+- <para>
+- If PFS is enabled, the encrypted channels of a VPN connection will be
+- renegotiated regularly to avoid that the same keys are used for too long.
+- If an attacker is able to obtain a key that was used to encrypt the
+- data, it is only possible to decrypt a certain amount of data.
+- </para>
+-
+- <para>
+- It is strongly recommended to enable PFS at all times.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command><replaceable>NAME</replaceable> lifetime <replaceable>LIFETIME</replaceable></command>
+- </term>
+-
+- <listitem>
+- <para>
+- This command allows to define how often the VPN connection is
+- renegotiated if PFS is enabled.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command><replaceable>NAME</replaceable> compression <replaceable>[on|off]</replaceable></command>
+- </term>
+-
+- <listitem>
+- <para>
+- This command allows to enable or disable compression.
+- </para>
+-
+- <para>
+- If compression is enabled, all data is being compressed before being
+- sent through the VPN.
+- This setting is ignored if the peer does not support this.
+- </para>
+- </listitem>
+- </varlistentry>
+- </variablelist>
+- </refsect1>
+-
+- <refsect1>
+- <title>System Policies</title>
+-
+- <para>
+- The system comes with builtin policies that cannot be modified by the user.
+- They are intended to provide good defaults for various situations.
+- </para>
+-
+- <refsect2>
+- <title>system</title>
+-
+- <para>
+- This policy is the default for every VPN connection and allows using
+- all ciphers, integrity and key-exchange algorithms that are recommended
+- to use and have not been proven or assumed to be broken, yet.
+- </para>
+-
+- <para>
+- Over time, this policy will change whenever an algorithm has been broken
+- and is not recommended to be used any more.
+- </para>
+- </refsect2>
+-
+- <refsect2>
+- <title>performance</title>
+-
+- <para>
+- This policy is recommended to be used on systems that are not very powerful.
+- Algorithms with smaller key lengths, but still considered to be secure
+- are being used.
+- </para>
+- </refsect2>
+-
+- <para>
+- System policies cannot be deleted.
+- </para>
+- </refsect1>
+-
+- <refsect1>
+- <title>See Also</title>
+-
+- <para>
+- <citerefentry>
+- <refentrytitle>network</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>,
+- <citerefentry>
+- <refentrytitle>network-vpn</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>
+- </para>
+- </refsect1>
+-</refentry>
+--
+2.39.2
+
diff --git a/network/patches/0084-man-Convert-network-zone-8-to-asciidoc.patch b/network/patches/0084-man-Convert-network-zone-8-to-asciidoc.patch
new file mode 100644
index 000000000..0edf995fa
--- /dev/null
+++ b/network/patches/0084-man-Convert-network-zone-8-to-asciidoc.patch
@@ -0,0 +1,375 @@
+From 357723e90cb0f700c4315b6016543db4230df5fb Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 31 Mar 2019 16:46:07 +0200
+Subject: [PATCH 084/304] man: Convert network-zone(8) to asciidoc
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ man/include-color.txt | 2 +-
+ man/include-description.txt | 2 +-
+ man/network-zone.txt | 73 +++++++++++
+ man/network-zone.xml | 247 ------------------------------------
+ 4 files changed, 75 insertions(+), 249 deletions(-)
+ create mode 100644 man/network-zone.txt
+ delete mode 100644 man/network-zone.xml
+
+diff --git a/man/include-color.txt b/man/include-color.txt
+index 073c01b..4b417a5 100644
+--- a/man/include-color.txt
++++ b/man/include-color.txt
+@@ -1,7 +1,7 @@
+ 'color set <color>'::
+ The color is set with this command and required to be passed in
+ RGB hex formatting
+-
++ +
+ NOTE: The color is being used to make identification of network devices
+ easier on the command line and web user interface.
+
+diff --git a/man/include-description.txt b/man/include-description.txt
+index a39ba55..49bac64 100644
+--- a/man/include-description.txt
++++ b/man/include-description.txt
+@@ -1,6 +1,6 @@
+ 'description edit'::
+ This command opens an editor and allows you to edit title and description.
+-
++ +
+ NOTE: The formation of the description is similar to a git commit.
+ Every description has a title, the first line of the description.
+ The title is shown on the status page and in the web user interface.
+diff --git a/man/network-zone.txt b/man/network-zone.txt
+new file mode 100644
+index 0000000..88a1988
+--- /dev/null
++++ b/man/network-zone.txt
+@@ -0,0 +1,73 @@
++= network-zone(8)
++Michael Tremer <michael.tremer(a)ipfire.org>
++
++== NAME
++network-zone - Manage network zones
++
++== SYNOPSIS
++[verse]
++'network zone [new|destroy]' ZONE
++'network zone' ZONE ...
++
++== DESCRIPTION
++With help of the 'zone' command, it is very easy to configure network zones.
++
++It is possible to create zones and remove them. Zones may also be brought up
++and down and reconfigured. Their status may be viewed as well.
++
++== COMMANDS
++The following commands are understood:
++
++'new ZONE HOOK OPTIONS'::
++ A new zone may be created by the 'create' command.
++ There are at least two arguments required.
++ +
++ ZONE must be valid name for a zone which does not already exist.
++ HOOK is a valid zone hook which may require additional options.
++
++'destroy ZONE'::
++ A zone can be destroyed with this command.
++ +
++ There are two possible ways to remove a zone. The case is when the zone is
++ not up. Then, it will be removed immediately. When the zone is current up
++ and used, it will tagged to be remove later, after it has been brought down.
++
++For all other commands, the name of the zone needs to be passed first:
++
++'edit OPTIONS'::
++ The settings of a zone may be edited after it has been created.
++ The options that can be passed depend on the hook that is used for the zone.
++ Run 'network zone ZONE edit --help' to learn more about that.
++ +
++ It usually is required to restart/reload the zone until the new settings
++ are taken into account.
++
++'[up|down]'::
++ These commands will bring the zone up/down. This is done without control
++ of systemd, therefore not intended to be done in a productive environment.
++ However, these commands may be used for debugging.
++
++'[enable|disable]'::
++ These commands will enable or disable the zone. An enabled zone will
++ automatically be started either during the boot process or a hotplug event
++ of an associated port or other device.
++
++'status'::
++ This will show some detailed information about the state if the specified zone.
++
++include::include-color.txt[]
++
++include::include-description.txt[]
++
++'identify'::
++ This command will make all ports of the zone flash for a few seconds so
++ that you can identify the correct network adapters in the system.
++
++'rename' NAME::
++ Renames the zone to NAME.
++ +
++ The command will shut down the zone if it is up and start it again with
++ the new name. If the zone is not up it won't be started.
++
++== SEE ALSO
++link:network[8]
+diff --git a/man/network-zone.xml b/man/network-zone.xml
+deleted file mode 100644
+index 99fa8b8..0000000
+--- a/man/network-zone.xml
++++ /dev/null
+@@ -1,247 +0,0 @@
+-<?xml version="1.0"?>
+-<!DOCTYPE refentry PUBLIC "-//OASIS/DTD DocBook XML V4.2//EN"
+- "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
+-
+-<refentry id="network-zone">
+- <refentryinfo>
+- <title>network-zone</title>
+- <productname>network</productname>
+-
+- <authorgroup>
+- <author>
+- <contrib>Developer</contrib>
+- <firstname>Michael</firstname>
+- <surname>Tremer</surname>
+- <email>michael.tremer(a)ipfire.org</email>
+- </author>
+- </authorgroup>
+- </refentryinfo>
+-
+- <refmeta>
+- <refentrytitle>network-zone</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </refmeta>
+-
+- <refnamediv>
+- <refname>network-zone</refname>
+- <refpurpose>Network Configuration Control Program</refpurpose>
+- </refnamediv>
+-
+- <refsynopsisdiv>
+- <cmdsynopsis>
+- <command>network zone <arg choice="plain">[new|destroy]</arg> <replaceable>ZONE</replaceable> ...</command>
+- </cmdsynopsis>
+-
+- <cmdsynopsis>
+- <command>network zone <replaceable>ZONE</replaceable> <arg choice="plain">command</arg> ...</command>
+- </cmdsynopsis>
+- </refsynopsisdiv>
+-
+- <refsect1>
+- <title>Description</title>
+-
+- <para>
+- With help of the <command>zone</command> command, it is very easy to
+- configure network zones.
+- </para>
+- <para>
+- It is possible to create zones and remove them. Zones may also
+- be brought up and down and reconfigured. Their status may be viewed
+- as well.
+- </para>
+- </refsect1>
+-
+- <refsect1>
+- <title>Commands</title>
+-
+- <para>
+- The following commands are understood:
+- </para>
+-
+- <variablelist>
+- <varlistentry>
+- <term>
+- <command>new <replaceable>ZONE</replaceable> <replaceable>HOOK</replaceable> <arg choice="opt" rep="repeat">OPTIONS</arg></command>
+- </term>
+-
+- <listitem>
+- <para>
+- A new zone may be created by the <command>create</command>
+- command. There are at least two arguments required.
+- </para>
+- <para>
+- <replaceable>ZONE</replaceable> must be valid name for a
+- zone which does not already exist.
+- <replaceable>HOOK</replaceable> is a valid zone hook which
+- may require additional options.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command>destroy <replaceable>ZONE</replaceable></command>
+- </term>
+-
+- <listitem>
+- <para>
+- A zone can be destroyed with this command.
+- </para>
+- <para>
+- There are two possible ways to remove a zone. The case
+- is when the zone is not up. Then, it will be removed
+- immediately. When the zone is current up and used, it
+- will tagged to be remove later, after it has been brought
+- down.
+- </para>
+- </listitem>
+- </varlistentry>
+- </variablelist>
+-
+- <para>
+- For all other commands, the name of the zone needs to be passed first:
+- </para>
+-
+- <variablelist>
+- <varlistentry>
+- <term>
+- <command><replaceable>ZONE</replaceable> edit <arg choice="opt" rep="repeat">OPTIONS</arg></command>
+- </term>
+-
+- <listitem>
+- <para>
+- The settings of a zone may be edited after it has been created.
+- The options that can be passed depend on the hook that is used
+- for the zone.
+- Run <command>network zone <replaceable>ZONE</replaceable> edit --help</command>
+- to learn more about that.
+- </para>
+- <para>
+- It usually is required to restart/reload the zone until
+- the new settings are taken into account.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command><replaceable>ZONE</replaceable> [up|down]</command>
+- </term>
+-
+- <listitem>
+- <para>
+- These commands will bring the zone up/down. This is done
+- without control of systemd, therefore not intended to be
+- done in a productive environment.
+- However, these commands may be used for debugging.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command><replaceable>ZONE</replaceable> [enable|disable]</command>
+- </term>
+-
+- <listitem>
+- <para>
+- These commands will enable or disable the zone. An enabled
+- zone will automatically be started either during the boot process
+- or a hotplug event of an associated port or other device.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command><replaceable>ZONE</replaceable> status</command>
+- </term>
+-
+- <listitem>
+- <para>
+- This will show some detailed information about the state
+- if the specified zone.
+- </para>
+- </listitem>
+- </varlistentry>
+- <varlistentry>
+- <term>
+- <command><replaceable>ZONE</replaceable> color</command>
+- </term>
+-
+- <listitem>
+- <para>
+- This command allows settings a color for a zone.
+- See
+- <citerefentry>
+- <refentrytitle>network-color</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>
+- for more information.
+- </para>
+- </listitem>
+- </varlistentry>
+- <varlistentry>
+- <term>
+- <command><replaceable>ZONE</replaceable>description</command>
+- </term>
+-
+- <listitem>
+- <para>
+- This command make is possible to add a description to a zone.
+- See
+- <citerefentry>
+- <refentrytitle>network-description</refentrytitle>
+- <manvolnum>8</manvolnum>,
+- </citerefentry>
+- for more information.
+- </para>
+- </listitem>
+- </varlistentry>
+- <varlistentry>
+- <term>
+- <command><replaceable>ZONE</replaceable> identify</command>
+- </term>
+-
+- <listitem>
+- <para>
+- This command will make all ports of the zone flash for
+- a few seconds so that you can identify the correct network
+- adapters in the system.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <command><replaceable>ZONE</replaceable> rename <replaceable>NAME</replaceable></command>
+- </term>
+-
+- <listitem>
+- <para>
+- Renames the zone to <replaceable>NAME</replaceable>.
+- </para>
+- <para>
+- The command will shut down the zone if it is up and
+- start it again with the new name. If the zone is not
+- up it won't be started.
+- </para>
+- <para>
+- Zones that are marked to be destroyed cannot be renamed.
+- </para>
+- </listitem>
+- </varlistentry>
+- </variablelist>
+- </refsect1>
+-
+- <refsect1>
+- <title>See Also</title>
+-
+- <para>
+- <citerefentry>
+- <refentrytitle>network</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>
+- </para>
+- </refsect1>
+-</refentry>
+--
+2.39.2
+
diff --git a/network/patches/0085-man-Convert-network-zone-bridge-8-to-asciidoc.patch b/network/patches/0085-man-Convert-network-zone-bridge-8-to-asciidoc.patch
new file mode 100644
index 000000000..6d114cd02
--- /dev/null
+++ b/network/patches/0085-man-Convert-network-zone-bridge-8-to-asciidoc.patch
@@ -0,0 +1,255 @@
+From 010f24cfc6e363815ae6a408a16e8b07c069c1a7 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 31 Mar 2019 16:59:10 +0200
+Subject: [PATCH 085/304] man: Convert network-zone-bridge(8) to asciidoc
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ man/network-zone-bridge.txt | 55 ++++++++++++
+ man/network-zone-bridge.xml | 172 ------------------------------------
+ 2 files changed, 55 insertions(+), 172 deletions(-)
+ create mode 100644 man/network-zone-bridge.txt
+ delete mode 100644 man/network-zone-bridge.xml
+
+diff --git a/man/network-zone-bridge.txt b/man/network-zone-bridge.txt
+new file mode 100644
+index 0000000..2e4f839
+--- /dev/null
++++ b/man/network-zone-bridge.txt
+@@ -0,0 +1,55 @@
++= network-zone-bridge(8)
++Michael Tremer <michael.tremer(a)ipfire.org>
++
++== NAME
++network-zone-bridge - Manage network zones
++
++== SYNOPSIS
++[verse]
++'network zone new ZONE bridge' ...
++'network zone ZONE edit' ...
++
++== DESCRIPTION
++The bridge hook creates an ethernet bridge which acts as an unmanaged network
++switch. It contains one or multiple physical network interfaces or virtual
++devices which will be connected to each other.
++
++The bridge hook is the preferred hook for local area network zones which are
++connected to an ethernet network.
++
++== OPTIONS
++The following options are understood:
++
++'--address=ADDRESS'::
++ By this option, you may define the MAC address of the bridge. If this option
++ is missing, a random MAC address will be generated.
++
++'--mtu=MTU'::
++ Sets the default MTU of the bridge.
++ All ports in the bridge must support this MTU value.
++
++'--stp=[_on_|off]'::
++ This option enables or disables use of the _Spanning Tree Protocol_ (STP).
++ This protocol is used to avoid loops in networks by dynamically disabling
++ packet forwarding on links.
++ +
++ It is highly recommended to leave this option enabled when you add more
++ than one device to the zone. Read below how the behaviour of STP can be changed.
++
++Spanning Tree Protocol (802.1D) configuration options:
++
++'--stp-forward-delay=_0_'::
++ This sets the default time the interfaces are hold off after they have been
++ added to a bridge. The default value is 0.
++
++'--stp-hello=_2_'::
++ This option defines how often a hello message should be sent. The value is
++ given in seconds and the default is 2.
++
++'--stp-priority=512'::
++ The STP priority sets the ranking of this network device within the network.
++ The bridge with the best rank (0 is best) will become the root bridge.
++
++== SEE ALSO
++link:network[8],
++link:network-zone[8]
+diff --git a/man/network-zone-bridge.xml b/man/network-zone-bridge.xml
+deleted file mode 100644
+index a77118b..0000000
+--- a/man/network-zone-bridge.xml
++++ /dev/null
+@@ -1,172 +0,0 @@
+-<?xml version="1.0"?>
+-<!DOCTYPE refentry PUBLIC "-//OASIS/DTD DocBook XML V4.2//EN"
+- "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
+-
+-<refentry id="network-zone-bridge">
+- <refentryinfo>
+- <title>network-zone-bridge</title>
+- <productname>network</productname>
+-
+- <authorgroup>
+- <author>
+- <contrib>Developer</contrib>
+- <firstname>Michael</firstname>
+- <surname>Tremer</surname>
+- <email>michael.tremer(a)ipfire.org</email>
+- </author>
+- </authorgroup>
+- </refentryinfo>
+-
+- <refmeta>
+- <refentrytitle>network-zone-bridge</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </refmeta>
+-
+- <refnamediv>
+- <refname>network-zone-bridge</refname>
+- <refpurpose>Network Configuration Control Program</refpurpose>
+- </refnamediv>
+-
+- <refsynopsisdiv>
+- <cmdsynopsis>
+- <command>network zone new <replaceable>ZONE</replaceable> bridge ...</command>
+- </cmdsynopsis>
+-
+- <cmdsynopsis>
+- <command>network zone <replaceable>ZONE</replaceable> edit ...</command>
+- </cmdsynopsis>
+- </refsynopsisdiv>
+-
+- <refsect1>
+- <title>Description</title>
+-
+- <para>
+- The bridge hook creates an ethernet bridge which acts as an unmanaged network
+- switch. It contains one or multiple phyisical network interfaces or virtual
+- devices which will be connected to each other.
+- </para>
+- <para>
+- The bridge hook is the prefered hook for local area network zones which are
+- connected to an ethernet network.
+- </para>
+- </refsect1>
+-
+- <refsect1>
+- <title>Options</title>
+-
+- <para>
+- The following options are understood:
+- </para>
+-
+- <variablelist>
+- <varlistentry>
+- <term>
+- <option>--stp=[<emphasis>on</emphasis>|off]</option>
+- </term>
+-
+- <listitem>
+- <para>
+- This option enables or disable the use of the
+- <emphasis>Spanning Tree Protocol</emphasis> (STP).
+- This protocol is used to avoid loops in networks by
+- dynamically disabling packet forwarding on links.
+- </para>
+- <para>
+- It is highly recommended to leave this option enabled
+- when you add more than one device to the zone.
+- Read below how the behaviour of STP can be changed.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <option>--mtu=<replaceable>MTU</replaceable></option>
+- </term>
+-
+- <listitem>
+- <para>
+- Sets the default MTU of the bridge.
+- All ports in the bridge must support this MTU value.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <option>--address=<replaceable>ADDRESS</replaceable></option>
+- </term>
+-
+- <listitem>
+- <para>
+- By this option, you may define the MAC address of the
+- bridge. If this option is missing, a random MAC address
+- will be generated.
+- </para>
+- </listitem>
+- </varlistentry>
+- </variablelist>
+-
+- <para>
+- Spanning Tree Protocol (802.1D) configuration options:
+- </para>
+-
+- <variablelist>
+- <varlistentry>
+- <term>
+- <option>--stp-forward-delay=<replaceable>0</replaceable></option>
+- </term>
+-
+- <listitem>
+- <para>
+- This sets the default time the interfaces are hold off
+- after they have been added to a bridge.
+- The default value is 0.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <option>--stp-hello=<replaceable>2</replaceable></option>
+- </term>
+-
+- <listitem>
+- <para>
+- This option defines how often a hello message should be
+- sent. The value is given in seconds and the default is 2.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <option>--stp-priority=<replaceable>512</replaceable></option>
+- </term>
+-
+- <listitem>
+- <para>
+- The STP priority sets the ranking of this network device
+- within the network. The bridge with the best rank
+- (0 is best) will become the root bridge.
+- </para>
+- </listitem>
+- </varlistentry>
+- </variablelist>
+- </refsect1>
+-
+- <refsect1>
+- <title>See Also</title>
+-
+- <para>
+- <citerefentry>
+- <refentrytitle>network</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>,
+- <citerefentry>
+- <refentrytitle>network-zone</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>
+- </para>
+- </refsect1>
+-</refentry>
+--
+2.39.2
+
diff --git a/network/patches/0086-man-Convert-network-zone-config-pppoe-server-8-to-as.patch b/network/patches/0086-man-Convert-network-zone-config-pppoe-server-8-to-as.patch
new file mode 100644
index 000000000..3afd01e9a
--- /dev/null
+++ b/network/patches/0086-man-Convert-network-zone-config-pppoe-server-8-to-as.patch
@@ -0,0 +1,222 @@
+From 718371b565fdb93719f68b5a2dcf719dd57a4e93 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 31 Mar 2019 17:15:50 +0200
+Subject: [PATCH 086/304] man: Convert network-zone-config-pppoe-server(8) to
+ asciidoc
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ man/network-zone-config-pppoe-server.txt | 50 ++++++++
+ man/network-zone-config-pppoe-server.xml | 143 -----------------------
+ 2 files changed, 50 insertions(+), 143 deletions(-)
+ create mode 100644 man/network-zone-config-pppoe-server.txt
+ delete mode 100644 man/network-zone-config-pppoe-server.xml
+
+diff --git a/man/network-zone-config-pppoe-server.txt b/man/network-zone-config-pppoe-server.txt
+new file mode 100644
+index 0000000..72dff8e
+--- /dev/null
++++ b/man/network-zone-config-pppoe-server.txt
+@@ -0,0 +1,50 @@
++= network-zone-config-pppoe-server(8)
++
++== NAME
++network-zone-config-pppoe-server - PPPoE Server Settings
++
++== SYNOPSIS
++[verse]
++`network zone ZONE config create pppoe-server ...`
++`network zone ZONE config pppoe-server edit ...`
++
++== DESCRIPTION
++This configuration hook enables a **PPPoE Server** on a zone.
++
++== OPTIONS
++The following options are understood:
++
++`--subnet=SUBNET`::
++ The `--subnet` option defines an IPv4 pool of which IP addresses are
++ assigned to the remote hosts. The first address of the subnet will be used
++ for the gateway which is the PPPoE server itself.
++ +
++ The subnet must at least have two IP addresses.
++
++`--mtu=MTU`::
++ Set the required MTU (Maximum Transmission Unit) for the PPP connection.
++ The default value is 1492 bytes which is a common MTU for DSL connections.
++
++`--service-name=SERVICE NAME`::
++ This option receives a string which will be used as the service name. The
++ service name is sent out to the clients and used for identification but
++ not authorisation purposes.
++ +
++ The default is an empty value.
++
++`--max-sessions=0`::
++ Limit the number of sessions that may be established by the same MAC address.
++ This must be a positive number.
++ 0 permits an unlimited number of sessions per MAC address.
++
++== EXAMPLES
++
++This command creates a PPPoE server that will assign an IP address from the
++192.168.0.0/16 subnet:
++
++ network zone net0 config create pppoe-server --subnet=192.168.0.0/16
++
++== SEE ALSO
++link:network[8],
++link:network-zone[8],
++link:network-zone-config[8]
+diff --git a/man/network-zone-config-pppoe-server.xml b/man/network-zone-config-pppoe-server.xml
+deleted file mode 100644
+index e6d497e..0000000
+--- a/man/network-zone-config-pppoe-server.xml
++++ /dev/null
+@@ -1,143 +0,0 @@
+-<?xml version="1.0"?>
+-<!DOCTYPE refentry PUBLIC "-//OASIS/DTD DocBook XML V4.2//EN"
+- "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
+-
+-<refentry id="network-zone-config-pppoe-server">
+- <refentryinfo>
+- <title>network-zone-config-pppoe-server</title>
+- <productname>network</productname>
+-
+- <authorgroup>
+- <author>
+- <contrib>Developer</contrib>
+- <firstname>Michael</firstname>
+- <surname>Tremer</surname>
+- <email>michael.tremer(a)ipfire.org</email>
+- </author>
+- </authorgroup>
+- </refentryinfo>
+-
+- <refmeta>
+- <refentrytitle>network-zone-config-pppoe-server</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </refmeta>
+-
+- <refnamediv>
+- <refname>network-zone-config-pppoe-server</refname>
+- <refpurpose>Network Configuration Control Program</refpurpose>
+- </refnamediv>
+-
+- <refsynopsisdiv>
+- <cmdsynopsis>
+- <command>network zone <replaceable>ZONE</replaceable> config create pppoe-server ...</command>
+- </cmdsynopsis>
+- </refsynopsisdiv>
+-
+- <refsect1>
+- <title>Description</title>
+-
+- <para>
+- This configuration hook enables a <emphasis>PPPoE server</emphasis>
+- functionality to a zone which is of an ethernet-like type.
+- </para>
+- <para>
+- The PPPoE server is mostly for development purpose and performs pretty
+- well. However, it is not recommended to use it in production environments.
+- </para>
+- </refsect1>
+-
+- <refsect1>
+- <title>Options</title>
+-
+- <para>
+- The following options are understood:
+- </para>
+-
+- <variablelist>
+- <varlistentry>
+- <term>
+- <option>--subnet=<replaceable>SUBNET</replaceable></option>
+- </term>
+-
+- <listitem>
+- <para>
+- The <option>--subnet</option> option defines an IPv4 pool
+- of which IP addresses are assigned to the remote hosts.
+- The first address of the subnet will be used for the
+- gateway which is the PPPoE server itself.
+- </para>
+- <para>
+- The subnet must at least have two IP addresses.
+- Broadcast and network addresses will be used as well.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <option>--mtu=<replaceable>MTU</replaceable></option>
+- </term>
+-
+- <listitem>
+- <para>
+- Set the required MTU (Maximum Transmission Unit) for
+- the PPP connection.
+- </para>
+- <para>
+- The default value is 1492 bytes which is a common MTU for
+- DSL connections.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <option>--service-name=<replaceable>STRING</replaceable></option>
+- </term>
+-
+- <listitem>
+- <para>
+- This options receives a string which will be used as the
+- service name. The service name is sent out to the clients
+- and used for identification but not authorization purposes.
+- </para>
+- <para>
+- The default is an empty value.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <option>--max-sessions=<emphasis>0</emphasis></option>
+- </term>
+-
+- <listitem>
+- <para>
+- Limit the max. number of sessions that may be established
+- by the same MAC address.
+- </para>
+- <para>
+- This must be a positive number. 0 permits an unlimited
+- number of sessions per MAC address.
+- </para>
+- </listitem>
+- </varlistentry>
+- </variablelist>
+- </refsect1>
+-
+- <refsect1>
+- <title>See Also</title>
+-
+- <para>
+- <citerefentry>
+- <refentrytitle>network</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>,
+- <citerefentry>
+- <refentrytitle>network-zone-config</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>
+- </para>
+- </refsect1>
+-</refentry>
+--
+2.39.2
+
diff --git a/network/patches/0087-man-Convert-network-zone-ip-tunnel-8-to-asciidoc.patch b/network/patches/0087-man-Convert-network-zone-ip-tunnel-8-to-asciidoc.patch
new file mode 100644
index 000000000..ce05d4197
--- /dev/null
+++ b/network/patches/0087-man-Convert-network-zone-ip-tunnel-8-to-asciidoc.patch
@@ -0,0 +1,184 @@
+From 6e94de3efa35088eb322ced2653efeec5f5c29fd Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 31 Mar 2019 17:23:07 +0200
+Subject: [PATCH 087/304] man: Convert network-zone-ip-tunnel(8) to asciidoc
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ man/network-zone-ip-tunnel.txt | 35 ++++++++++
+ man/network-zone-ip-tunnel.xml | 121 ---------------------------------
+ 2 files changed, 35 insertions(+), 121 deletions(-)
+ create mode 100644 man/network-zone-ip-tunnel.txt
+ delete mode 100644 man/network-zone-ip-tunnel.xml
+
+diff --git a/man/network-zone-ip-tunnel.txt b/man/network-zone-ip-tunnel.txt
+new file mode 100644
+index 0000000..cb30731
+--- /dev/null
++++ b/man/network-zone-ip-tunnel.txt
+@@ -0,0 +1,35 @@
++= network-zone-ip-tunnel(8)
++Michael Tremer <michael.tremer(a)ipfire.org>
++
++== NAME
++network-zone-ip-tunnel - Manage IP Tunnels
++
++== SYNOPSIS
++[verse]
++`network zone new ZONE ip-tunnel ...`
++`network zone ZONE edit ...`
++
++== DESCRIPTION
++The ip-tunnel hook is used to create IP tunnels that use protocols like GRE to
++encapsulate IP packets.
++
++== OPTIONS
++The following options are understood:
++
++`--mode=MODE`::
++ Sets the protocol that is being used to encapsulate IP packets.
++ Currently only **GRE** is supported.
++
++`--peer=PEER`::
++ The address of the peer that terminates the remote end of this tunnel.
++ +
++ If left empty, connections from any IP address will be accepted.
++
++`--local-address=LOCAL-ADDRESS`::
++ The local IP address the tunnel originates from.
++ +
++ This is optional and if unset a useful default will be used.
++
++== SEE ALSO
++link:network[8],
++link:network-zone[8]
+diff --git a/man/network-zone-ip-tunnel.xml b/man/network-zone-ip-tunnel.xml
+deleted file mode 100644
+index a1cc257..0000000
+--- a/man/network-zone-ip-tunnel.xml
++++ /dev/null
+@@ -1,121 +0,0 @@
+-<?xml version="1.0"?>
+-<!DOCTYPE refentry PUBLIC "-//OASIS/DTD DocBook XML V4.2//EN"
+- "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
+-
+-<refentry id="network-zone-ip-tunnel">
+- <refentryinfo>
+- <title>network-zone-ip-tunnel</title>
+- <productname>network</productname>
+-
+- <authorgroup>
+- <author>
+- <contrib>Developer</contrib>
+- <firstname>Michael</firstname>
+- <surname>Tremer</surname>
+- <email>michael.tremer(a)ipfire.org</email>
+- </author>
+- </authorgroup>
+- </refentryinfo>
+-
+- <refmeta>
+- <refentrytitle>network-zone-ip-tunnel</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </refmeta>
+-
+- <refnamediv>
+- <refname>network-zone-ip-tunnel</refname>
+- <refpurpose>Network Configuration Control Program</refpurpose>
+- </refnamediv>
+-
+- <refsynopsisdiv>
+- <cmdsynopsis>
+- <command>network zone new <replaceable>ZONE</replaceable> ip-tunnel ...</command>
+- </cmdsynopsis>
+-
+- <cmdsynopsis>
+- <command>network zone <replaceable>ZONE</replaceable> edit ...</command>
+- </cmdsynopsis>
+- </refsynopsisdiv>
+-
+- <refsect1>
+- <title>Description</title>
+-
+- <para>
+- The ip-tunnel hook is used to create IP tunnels that use protocols
+- like GRE to encapsulate IP packets.
+- </para>
+- </refsect1>
+-
+- <refsect1>
+- <title>Options</title>
+-
+- <para>
+- The following options are understood:
+- </para>
+-
+- <variablelist>
+- <varlistentry>
+- <term>
+- <option>--mode=<replaceable>MODE</replaceable></option>
+- </term>
+-
+- <listitem>
+- <para>
+- Sets the protocol that is being used to encapsulate
+- IP packets.
+- Currently only <replaceable>gre</replaceable> is supported.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <option>--peer=<replaceable>PEER</replaceable></option>
+- </term>
+-
+- <listitem>
+- <para>
+- The address of the peer that terminates the remote
+- end of this tunnel.
+- </para>
+-
+- <para>
+- If left empty, connections from any IP address will
+- be accepted.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <option>--local-address=<replaceable>LOCAL-ADDRESS</replaceable></option>
+- </term>
+-
+- <listitem>
+- <para>
+- The local IP address the tunnel originates from.
+- </para>
+-
+- <para>
+- This is optional and if unset a useful default will be used.
+- </para>
+- </listitem>
+- </varlistentry>
+- </variablelist>
+- </refsect1>
+-
+- <refsect1>
+- <title>See Also</title>
+-
+- <para>
+- <citerefentry>
+- <refentrytitle>network</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>,
+- <citerefentry>
+- <refentrytitle>network-zone</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>
+- </para>
+- </refsect1>
+-</refentry>
+--
+2.39.2
+
diff --git a/network/patches/0088-man-Convert-network-zone-modem-8-to-asciidoc.patch b/network/patches/0088-man-Convert-network-zone-modem-8-to-asciidoc.patch
new file mode 100644
index 000000000..d140ce3f8
--- /dev/null
+++ b/network/patches/0088-man-Convert-network-zone-modem-8-to-asciidoc.patch
@@ -0,0 +1,329 @@
+From 23eec7d08e289749759927bcf4c2387cbfcbdce2 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 31 Mar 2019 17:34:10 +0200
+Subject: [PATCH 088/304] man: Convert network-zone-modem(8) to asciidoc
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ man/network-zone-modem.txt | 66 +++++++++++
+ man/network-zone-modem.xml | 235 -------------------------------------
+ 2 files changed, 66 insertions(+), 235 deletions(-)
+ create mode 100644 man/network-zone-modem.txt
+ delete mode 100644 man/network-zone-modem.xml
+
+diff --git a/man/network-zone-modem.txt b/man/network-zone-modem.txt
+new file mode 100644
+index 0000000..6b09622
+--- /dev/null
++++ b/man/network-zone-modem.txt
+@@ -0,0 +1,66 @@
++= network-zone-modem(8)
++Michael Tremer <michael.tremer(a)ipfire.org>
++
++== NAME
++network-zone-modem - Configure serial modems
++
++== SYNOPSIS
++[verse]
++`network zone new ZONE modem ...`
++
++== DESCRIPTION
++The modem hook uses a serial interface to establish a PPP session to an Internet
++Service Provider. This method is used by 56k modems and mobile networks like
++LTE, GSM and 3G.
++
++== OPTIONS
++The following options are understood:
++
++`--device=DEVICE`::
++ Sets the serial device that is used to connect. Example: /dev/ttyUSB0
++
++`--monitor-device=DEVICE`::
++ The optional monitor device is used to collect status information like
++ signal strength and link quality while the connection is established.
++
++`--imsi=IMSI`::
++ Set the IMSI of the SIM card inside the wireless modem to identify it when
++ it is plugged in at runtime.
++
++`--pin=PIN`::
++ The PIN number of the SIM card.
++ This will be used to unlock the SIM card when it is locked.
++
++`--apn=APN`::
++ Sets the Access Point Name (APN) that the modem connects to.
++
++`--phone-number=PHONE-NUMBER`::
++ Sets the phone number that is dialled by the modem when the connection is
++ to be established.
++
++`--username=USERNAME`::
++ Sets the username for authentication.
++
++`--password=PASSWORD`::
++ Sets the password for authentication.
++ +
++ Use the `--auth=` option to transmit it in a secure manner to the provider.
++
++`--baudrate=921600`::
++ The baudrate for the serial link to the modem.
++
++`--mtu=N`::
++ Sets the default MTU of the PPP connection.
++
++`--auth=[chap|pap]`::
++ Define the authentication method that is used to authenticate against your
++ provider. The default is to use the provider's preference.
++
++ * _Challange-Handshake Authentication Protocol_ (`chap`) is the preferred,
++ secure method.
++ * _Password Authentication Protocol_ (`pap`) sends the plaintext password
++ to the authentication server which is the reason why it should be avoided.
++
++== SEE ALSO
++link:network[8],
++link:network-zone[8]
+diff --git a/man/network-zone-modem.xml b/man/network-zone-modem.xml
+deleted file mode 100644
+index 97a1d35..0000000
+--- a/man/network-zone-modem.xml
++++ /dev/null
+@@ -1,235 +0,0 @@
+-<?xml version="1.0"?>
+-<!DOCTYPE refentry PUBLIC "-//OASIS/DTD DocBook XML V4.2//EN"
+- "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
+-
+-<refentry id="network-zone-modem">
+- <refentryinfo>
+- <title>network-zone-modem</title>
+- <productname>network</productname>
+-
+- <authorgroup>
+- <author>
+- <contrib>Developer</contrib>
+- <firstname>Michael</firstname>
+- <surname>Tremer</surname>
+- <email>michael.tremer(a)ipfire.org</email>
+- </author>
+- </authorgroup>
+- </refentryinfo>
+-
+- <refmeta>
+- <refentrytitle>network-zone-modem</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </refmeta>
+-
+- <refnamediv>
+- <refname>network-zone-modem</refname>
+- <refpurpose>Network Configuration Control Program</refpurpose>
+- </refnamediv>
+-
+- <refsynopsisdiv>
+- <cmdsynopsis>
+- <command>network zone new <replaceable>ZONE</replaceable> modem ...</command>
+- </cmdsynopsis>
+- </refsynopsisdiv>
+-
+- <refsect1>
+- <title>Description</title>
+-
+- <para>
+- The modem hook uses a serial interface to establish a PPP session to an
+- Internet Service Provider. This method is used by 56k modems and mobile
+- networks like LTE, GSM and 3G.
+- </para>
+- </refsect1>
+-
+- <refsect1>
+- <title>Options</title>
+-
+- <para>
+- The following options are understood:
+- </para>
+-
+- <variablelist>
+- <varlistentry>
+- <term>
+- <option>--device=<replaceable>DEVICE</replaceable></option>
+- </term>
+-
+- <listitem>
+- <para>
+- Sets the serial device that is used to connect.
+- </para>
+- <para>
+- Example: /dev/ttyUSB0
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <option>--monitor-device=<replaceable>DEVICE</replaceable></option>
+- </term>
+-
+- <listitem>
+- <para>
+- The optional monitor device is used to collect status
+- information like signal strength and link quality while
+- the connection is established.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <option>--imsi=<replaceable>IMSI</replaceable></option>
+- </term>
+-
+- <listitem>
+- <para>
+- Set the IMSI of the SIM card inside the wireless modem
+- to identify it when it is plugged in at runtime.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <option>--pin=<replaceable>PIN</replaceable></option>
+- </term>
+-
+- <listitem>
+- <para>
+- The PIN number of the SIM card.
+- </para>
+- <para>
+- This will be used to unlock the SIM card when it
+- is locked.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <option>--apn=<replaceable>APN</replaceable></option>
+- </term>
+-
+- <listitem>
+- <para>
+- Sets the Access Point Name (<replaceable>APN</replaceable>)
+- that the modem connects to.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <option>--phone-number=<replaceable>PHONE-NUMBER</replaceable></option>
+- </term>
+-
+- <listitem>
+- <para>
+- Sets the phone number that is dialed by the modem when
+- the connection is to be established.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <option>--username=<replaceable>USERNAME</replaceable></option>
+- </term>
+-
+- <listitem>
+- <para>
+- Sets the username for authentication.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <option>--password=<replaceable>PASSWORD</replaceable></option>
+- </term>
+-
+- <listitem>
+- <para>
+- Sets the password for authentication.
+- </para>
+- <para>
+- Use the <option>--auth=</option> option to transmit it
+- in a secure manner to the provider.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <option>--baudrate=<emphasis>921600</emphasis></option>
+- </term>
+-
+- <listitem>
+- <para>
+- The baudrate for the serial link to the modem.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <option>--mtu=<emphasis>N</emphasis></option>
+- </term>
+-
+- <listitem>
+- <para>
+- Sets the default MTU of the PPP connection.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <option>--auth=[chap|pap]</option>
+- </term>
+-
+- <listitem>
+- <para>
+- Define the authentication method that is used to
+- authenticate against your provider.
+- The default is to use the provider's preference.
+- </para>
+- <itemizedlist>
+- <listitem>
+- <para>
+- <emphasis>Challange-Handshake Authentication Protocol</emphasis>
+- (chap) is the preferred secure method.
+- </para>
+- </listitem>
+- <listitem>
+- <para>
+- <emphasis>Password Authentication Protocol</emphasis>
+- (pap) sends the plaintext password to the authentication
+- server which is the reason why it should be avoided to use PAP.
+- </para>
+- </listitem>
+- </itemizedlist>
+- </listitem>
+- </varlistentry>
+- </variablelist>
+- </refsect1>
+-
+- <refsect1>
+- <title>See Also</title>
+-
+- <para>
+- <citerefentry>
+- <refentrytitle>network</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>,
+- <citerefentry>
+- <refentrytitle>network-zone</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>
+- </para>
+- </refsect1>
+-</refentry>
+--
+2.39.2
+
diff --git a/network/patches/0089-man-Convert-network-zone-pppoe-8-to-asciidoc.patch b/network/patches/0089-man-Convert-network-zone-pppoe-8-to-asciidoc.patch
new file mode 100644
index 000000000..191195159
--- /dev/null
+++ b/network/patches/0089-man-Convert-network-zone-pppoe-8-to-asciidoc.patch
@@ -0,0 +1,266 @@
+From d4f0a25cd61fe6a7d0cb711e269e9b75925edf23 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 31 Mar 2019 17:42:10 +0200
+Subject: [PATCH 089/304] man: Convert network-zone-pppoe(8) to asciidoc
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ man/network-zone-pppoe.txt | 52 +++++++++++
+ man/network-zone-pppoe.xml | 186 -------------------------------------
+ 2 files changed, 52 insertions(+), 186 deletions(-)
+ create mode 100644 man/network-zone-pppoe.txt
+ delete mode 100644 man/network-zone-pppoe.xml
+
+diff --git a/man/network-zone-pppoe.txt b/man/network-zone-pppoe.txt
+new file mode 100644
+index 0000000..93b55f2
+--- /dev/null
++++ b/man/network-zone-pppoe.txt
+@@ -0,0 +1,52 @@
++= network-zone-pppoe(8)
++Michael Tremer <michael.tremer(a)ipfire.org>
++
++== NAME
++network-zone-pppoe - PPP over Ethernet
++
++== SYNOPSIS
++[verse]
++`network zone new ZONE pppoe ...`
++
++== DESCRIPTION
++The `pppoe` hook creates a PPPoE connection to your ISP.
++
++== OPTIONS
++The following options are understood:
++
++`--username=USERNAME`::
++ Sets the username for authentication.
++
++`--password=PASSWORD`::
++ Sets the password for authentication.
++ +
++ Use the `--auth=` option to transmit it in a secure manner to the provider.
++
++`--mtu=N`::
++ Sets the default MTU of the PPP connection.
++
++`--auth=[chap|pap]`::
++ Define the authentication method that is used to authenticate against your
++ provider. The default is to use the provider's preference.
++
++ * _Challange-Handshake Authentication Protocol_ (`chap`) is the preferred,
++ secure method.
++ * _Password Authentication Protocol_ (`pap`) sends the plaintext password
++ to the authentication server which is the reason why it should be avoided.
++
++`--access-concentrator=STRING`::
++ By this option, you may define the name of the access concentrator.
++
++`--service-name=STRING`::
++ By this option, you may define the service name.
++
++`--ipv6=[on|off]`::
++ By this option, you may enable or disable IPv6.
++
++`--prefix-delegation=[on|off]`::
++ By this option, you may enable or disable the delegation through your
++ provider of one IPv6 prefix to your system.
++
++== SEE ALSO
++link:network[8],
++link:network-zone[8]
+diff --git a/man/network-zone-pppoe.xml b/man/network-zone-pppoe.xml
+deleted file mode 100644
+index 36c4d0e..0000000
+--- a/man/network-zone-pppoe.xml
++++ /dev/null
+@@ -1,186 +0,0 @@
+-<?xml version="1.0"?>
+-<!DOCTYPE refentry PUBLIC "-//OASIS/DTD DocBook XML V4.2//EN"
+- "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
+-
+-<refentry id="network-zone-pppoe">
+- <refentryinfo>
+- <title>network-zone-pppoe</title>
+- <productname>network</productname>
+-
+- <authorgroup>
+- <author>
+- <contrib>Developer</contrib>
+- <firstname>Michael</firstname>
+- <surname>Tremer</surname>
+- <email>michael.tremer(a)ipfire.org</email>
+- </author>
+- </authorgroup>
+- </refentryinfo>
+-
+- <refmeta>
+- <refentrytitle>network-zone-pppoe</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </refmeta>
+-
+- <refnamediv>
+- <refname>network-zone-pppoe</refname>
+- <refpurpose>Network Configuration Control Program</refpurpose>
+- </refnamediv>
+-
+- <refsynopsisdiv>
+- <cmdsynopsis>
+- <command>network zone new <replaceable>ZONE</replaceable> pppoe ...</command>
+- </cmdsynopsis>
+- </refsynopsisdiv>
+-
+- <refsect1>
+- <title>Description</title>
+-
+- <para>
+- The pppoe hook creates a PPPoE connection to your ISP.
+- </para>
+- </refsect1>
+-
+- <refsect1>
+- <title>Options</title>
+-
+- <para>
+- The following options are understood:
+- </para>
+-
+- <variablelist>
+-
+- <varlistentry>
+- <term>
+- <option>--username=<replaceable>USERNAME</replaceable></option>
+- </term>
+-
+- <listitem>
+- <para>
+- Sets the username for authentication.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <option>--password=<replaceable>PASSWORD</replaceable></option>
+- </term>
+-
+- <listitem>
+- <para>
+- Sets the password for authentication.
+- </para>
+- <para>
+- Use the <option>--auth=</option> option to transmit it
+- in a secure manner to the provider.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <option>--mtu=<emphasis>N</emphasis></option>
+- </term>
+-
+- <listitem>
+- <para>
+- Sets the default MTU of the PPP connection.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <option>--auth=[chap|pap]</option>
+- </term>
+-
+- <listitem>
+- <para>
+- Define the authentication method that is used to
+- authenticate against your provider.
+- The default is to use the provider's preference.
+- </para>
+- <itemizedlist>
+- <listitem>
+- <para>
+- <emphasis>Challange-Handshake Authentication Protocol</emphasis>
+- (chap) is the preferred secure method.
+- </para>
+- </listitem>
+- <listitem>
+- <para>
+- <emphasis>Password Authentication Protocol</emphasis>
+- (pap) sends the plaintext password to the authentication
+- server which is the reason why it should be avoided to use PAP.
+- </para>
+- </listitem>
+- </itemizedlist>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <option>--access-concentrator=<replaceable>STRING</replaceable></option>
+- </term>
+-
+- <listitem>
+- <para>
+- By this option, you may define the name of the access concentrator.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <option>--service-name=<replaceable>STRING</replaceable></option>
+- </term>
+-
+- <listitem>
+- <para>
+- By this option, you may define the service name.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <option>--ipv6=[<emphasis>on</emphasis>|off]</option>
+- </term>
+-
+- <listitem>
+- <para>
+- By this option, you may enable or disable IPv6
+- </para> </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <option>--prefix-delegation=[<emphasis>on</emphasis>|off]</option>
+- </term>
+-
+- <listitem>
+- <para>
+- By this option, you may enable or disable the delegation through your provider of one IPv6 prefix to your system.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- </variablelist>
+- </refsect1>
+-
+- <refsect1>
+- <title>See Also</title>
+-
+- <para>
+- <citerefentry>
+- <refentrytitle>network</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>,
+- <citerefentry>
+- <refentrytitle>network-zone</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>
+- </para>
+- </refsect1>
+-</refentry>
+--
+2.39.2
+
diff --git a/network/patches/0090-man-Convert-network-zone-wireless-8-to-asciidoc.patch b/network/patches/0090-man-Convert-network-zone-wireless-8-to-asciidoc.patch
new file mode 100644
index 000000000..e5c9cf7ff
--- /dev/null
+++ b/network/patches/0090-man-Convert-network-zone-wireless-8-to-asciidoc.patch
@@ -0,0 +1,167 @@
+From bc2b9c75cd5b73e1c2de5463fc1c0bc94b6dad93 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 31 Mar 2019 17:53:20 +0200
+Subject: [PATCH 090/304] man: Convert network-zone-wireless(8) to asciidoc
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ man/network-zone-wireless.txt | 32 ++++++++++
+ man/network-zone-wireless.xml | 107 ----------------------------------
+ 2 files changed, 32 insertions(+), 107 deletions(-)
+ create mode 100644 man/network-zone-wireless.txt
+ delete mode 100644 man/network-zone-wireless.xml
+
+diff --git a/man/network-zone-wireless.txt b/man/network-zone-wireless.txt
+new file mode 100644
+index 0000000..368ac2a
+--- /dev/null
++++ b/man/network-zone-wireless.txt
+@@ -0,0 +1,32 @@
++= network-zone-wireless(8)
++Michael Tremer <michael.tremer(a)ipfire.org>
++
++== NAME
++network-zone-wireless - Wireless Networks
++
++== SYNOPSIS
++[verse]
++`network zone new ZONE wireless ...`
++
++== DESCRIPTION
++The wireless hook uses a WiFi interface and connects to a wireless access point
++in station mode.
++
++Configuration and credentials for any wireless networks to connect to can be
++configured by using link:network-wireless-network[8].
++
++== OPTIONS
++The following options are understood:
++
++`--phy=PHY`::
++ Takes the MAC address or name of the physical layer that is used to create
++ a virtual wireless interface.
++
++`--address=ADDRESS`::
++ Define a MAC address that is used for the virtual wireless device. This
++ parameter is optional and a random MAC address will be generated when
++ omitted.
++
++== SEE ALSO
++link:network[8],
++link:network-zone[8]
+diff --git a/man/network-zone-wireless.xml b/man/network-zone-wireless.xml
+deleted file mode 100644
+index 0931245..0000000
+--- a/man/network-zone-wireless.xml
++++ /dev/null
+@@ -1,107 +0,0 @@
+-<?xml version="1.0"?>
+-<!DOCTYPE refentry PUBLIC "-//OASIS/DTD DocBook XML V4.2//EN"
+- "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
+-
+-<refentry id="network-zone-wireless">
+- <refentryinfo>
+- <title>network-zone-wireless</title>
+- <productname>network</productname>
+-
+- <authorgroup>
+- <author>
+- <contrib>Developer</contrib>
+- <firstname>Michael</firstname>
+- <surname>Tremer</surname>
+- <email>michael.tremer(a)ipfire.org</email>
+- </author>
+- </authorgroup>
+- </refentryinfo>
+-
+- <refmeta>
+- <refentrytitle>network-zone-wireless</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </refmeta>
+-
+- <refnamediv>
+- <refname>network-zone-wireless</refname>
+- <refpurpose>Network Configuration Control Program</refpurpose>
+- </refnamediv>
+-
+- <refsynopsisdiv>
+- <cmdsynopsis>
+- <command>network zone new <replaceable>ZONE</replaceable> wireless ...</command>
+- </cmdsynopsis>
+- </refsynopsisdiv>
+-
+- <refsect1>
+- <title>Description</title>
+-
+- <para>
+- The wireless hook uses a WiFi interface and connects to a
+- wireless access point in station mode.
+- </para>
+-
+- <para>
+- Configuration and credentials for any wireless networks to
+- connect to can be configured by using the
+- <command>network wireless network</command> command.
+-
+- See <citerefentry>
+- <refentrytitle>network-wireless-networks</refentrytitle>
+- <manvolnum>8</manvolnum>,
+- </citerefentry> for details.
+- </para>
+- </refsect1>
+-
+- <refsect1>
+- <title>Options</title>
+-
+- <para>
+- The following options are understood:
+- </para>
+-
+- <variablelist>
+- <varlistentry>
+- <term>
+- <option>--phy=<replaceable>PHY</replaceable></option>
+- </term>
+-
+- <listitem>
+- <para>
+- Takes the MAC address or name of the physical layer
+- that is used to create a virtual wireless interface.
+- </para>
+- </listitem>
+- </varlistentry>
+-
+- <varlistentry>
+- <term>
+- <option>--address=<replaceable>ADDRESS</replaceable></option>
+- </term>
+-
+- <listitem>
+- <para>
+- Define a MAC address that is used for the virtual
+- wireless device. This parameter is optional and
+- a random MAC address will be generated when omitted.
+- </para>
+- </listitem>
+- </varlistentry>
+- </variablelist>
+- </refsect1>
+-
+- <refsect1>
+- <title>See Also</title>
+-
+- <para>
+- <citerefentry>
+- <refentrytitle>network</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>,
+- <citerefentry>
+- <refentrytitle>network-zone</refentrytitle>
+- <manvolnum>8</manvolnum>
+- </citerefentry>
+- </para>
+- </refsect1>
+-</refentry>
+--
+2.39.2
+
diff --git a/network/patches/0091-man-Cleanup-XML-files.patch b/network/patches/0091-man-Cleanup-XML-files.patch
new file mode 100644
index 000000000..3cda095e2
--- /dev/null
+++ b/network/patches/0091-man-Cleanup-XML-files.patch
@@ -0,0 +1,43 @@
+From d746901bf5d4b4eb7591d1e009fad2960647e034 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 31 Mar 2019 20:01:00 +0200
+Subject: [PATCH 091/304] man: Cleanup XML files
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/Makefile.am b/Makefile.am
+index 26f2e9c..d79b0f2 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -475,7 +475,8 @@ MANPAGES = \
+ man/network-zone-wireless.8
+
+ MANPAGES_TXT = $(patsubst %.8,%.txt,$(MANPAGES))
+-MANPAGES_HTML = $(patsubst %.txt,%.html,$(MANPAGES))
++MANPAGES_HTML = $(patsubst %.txt,%.html,$(MANPAGES_TXT))
++MANPAGES_XML = $(patsubst %.txt,%.xml,$(MANPAGES_TXT))
+
+ .PHONY: man
+ man: $(MANPAGES) $(MANPAGES_HTML)
+@@ -484,11 +485,13 @@ man_MANS = \
+ $(MANPAGES)
+
+ noinst_DATA += \
+- $(MANPAGES_HTML)
++ $(MANPAGES_HTML) \
++ $(MANPAGES_XML)
+
+ CLEANFILES += \
+ $(man_MANS) \
+- $(MANPAGES_HTML)
++ $(MANPAGES_HTML) \
++ $(MANPAGES_XML)
+
+ EXTRA_DIST += \
+ $(MANPAGES_TXT)
+--
+2.39.2
+
diff --git a/network/patches/0092-man-Make-distcheck-happy.patch b/network/patches/0092-man-Make-distcheck-happy.patch
new file mode 100644
index 000000000..18d763532
--- /dev/null
+++ b/network/patches/0092-man-Make-distcheck-happy.patch
@@ -0,0 +1,54 @@
+From 5d881996d1a5cf6211ae1fa0d4c4cd6fe6867f79 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 31 Mar 2019 20:08:00 +0200
+Subject: [PATCH 092/304] man: Make distcheck happy
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/Makefile.am b/Makefile.am
+index d79b0f2..0257b02 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -494,6 +494,7 @@ CLEANFILES += \
+ $(MANPAGES_XML)
+
+ EXTRA_DIST += \
++ man/asciidoc.conf \
+ $(MANPAGES_TXT)
+
+ XSLTPROC_FLAGS = \
+@@ -505,20 +506,23 @@ XSLTPROC_FLAGS = \
+ --stringparam man.copyright.section.enabled 1
+
+ XSLTPROC_COMMAND_MAN = \
+- $(AM_V_XSLT)$(XSLTPROC) -o $@ $(XSLTPROC_FLAGS) \
++ $(AM_V_XSLT)$(MKDIR_P) $(dir $@) && \
++ $(XSLTPROC) -o $@ $(XSLTPROC_FLAGS) \
+ http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl $<
+
+ man/%.xml: man/%.txt man/asciidoc.conf
+- $(AM_V_ASCIIDOC)$(ASCIIDOC) \
+- -f man/asciidoc.conf \
++ $(AM_V_ASCIIDOC)$(MKDIR_P) $(dir $@) && \
++ $(ASCIIDOC) \
++ -f $(abs_srcdir)/man/asciidoc.conf \
+ -d manpage -b docbook -o $@ $<
+
+ man/%.8: man/%.xml
+ $(XSLTPROC_COMMAND_MAN)
+
+ man/%.html: man/%.txt man/asciidoc.conf
+- $(AM_V_ASCIIDOC)$(ASCIIDOC) \
+- -f man/asciidoc.conf \
++ $(AM_V_ASCIIDOC)$(MKDIR_P) $(dir $@) && \
++ $(ASCIIDOC) \
++ -f $(abs_srcdir)/man/asciidoc.conf \
+ -b html5 -a icons -a theme=flask -o $@ $<
+
+ # ------------------------------------------------------------------------------
+--
+2.39.2
+
diff --git a/network/patches/0093-man-Include-include-files-in-tarball.patch b/network/patches/0093-man-Include-include-files-in-tarball.patch
new file mode 100644
index 000000000..7270d85bc
--- /dev/null
+++ b/network/patches/0093-man-Include-include-files-in-tarball.patch
@@ -0,0 +1,28 @@
+From ff43523863b7ad7f50f5dfd4fdf80251ef01fa51 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 31 Mar 2019 20:14:34 +0200
+Subject: [PATCH 093/304] man: Include include files in tarball
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/Makefile.am b/Makefile.am
+index 0257b02..6b77f0a 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -474,6 +474,10 @@ MANPAGES = \
+ man/network-zone-pppoe.8 \
+ man/network-zone-wireless.8
+
++EXTRA_DIST += \
++ man/include-color.txt \
++ man/include-description.txt
++
+ MANPAGES_TXT = $(patsubst %.8,%.txt,$(MANPAGES))
+ MANPAGES_HTML = $(patsubst %.txt,%.html,$(MANPAGES_TXT))
+ MANPAGES_XML = $(patsubst %.txt,%.xml,$(MANPAGES_TXT))
+--
+2.39.2
+
diff --git a/network/patches/0094-man-network-route-static-Fix-name.patch b/network/patches/0094-man-network-route-static-Fix-name.patch
new file mode 100644
index 000000000..c13af1a79
--- /dev/null
+++ b/network/patches/0094-man-network-route-static-Fix-name.patch
@@ -0,0 +1,26 @@
+From 71bdead694bdae2e40e8a9f99403b4ec2db77914 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 31 Mar 2019 20:17:09 +0200
+Subject: [PATCH 094/304] man: network-route-static: Fix name
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ man/network-route-static.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/man/network-route-static.txt b/man/network-route-static.txt
+index d4774b2..c6c3fea 100644
+--- a/man/network-route-static.txt
++++ b/man/network-route-static.txt
+@@ -2,7 +2,7 @@
+ Michael Tremer <michael.tremer(a)ipfire.org>
+
+ == NAME
+-network-route - Manage Static Routing
++network-route-static - Manage Static Routing
+
+ == SYNOPSIS
+ [verse]
+--
+2.39.2
+
diff --git a/network/patches/0095-Makefile-Add-target-to-upload-HTML-man-pages.patch b/network/patches/0095-Makefile-Add-target-to-upload-HTML-man-pages.patch
new file mode 100644
index 000000000..b6f262fdb
--- /dev/null
+++ b/network/patches/0095-Makefile-Add-target-to-upload-HTML-man-pages.patch
@@ -0,0 +1,28 @@
+From 2d2e96269516032b3bc4f2222067f6b82398a70a Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 1 Apr 2019 12:31:53 +0200
+Subject: [PATCH 095/304] Makefile: Add target to upload HTML man pages
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/Makefile.am b/Makefile.am
+index 6b77f0a..955f2b7 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -529,6 +529,10 @@ man/%.html: man/%.txt man/asciidoc.conf
+ -f $(abs_srcdir)/man/asciidoc.conf \
+ -b html5 -a icons -a theme=flask -o $@ $<
+
++.PHONY: upload-man
++upload-man: $(MANPAGES_HTML)
++ rsync -avHz --delete --progress $(MANPAGES_HTML) ms@people.ipfire.org:/pub/man-pages/$(PACKAGE_NAME)/
++
+ # ------------------------------------------------------------------------------
+
+ substitutions = \
+--
+2.39.2
+
diff --git a/network/patches/0096-man-Do-not-generate-HTML-documentation-in-normal-bui.patch b/network/patches/0096-man-Do-not-generate-HTML-documentation-in-normal-bui.patch
new file mode 100644
index 000000000..b1c34b320
--- /dev/null
+++ b/network/patches/0096-man-Do-not-generate-HTML-documentation-in-normal-bui.patch
@@ -0,0 +1,29 @@
+From 95556ed6aa03a160df0ed6e929389c3d7283b87b Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 1 Apr 2019 12:45:55 +0200
+Subject: [PATCH 096/304] man: Do not generate HTML documentation in normal
+ build
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/Makefile.am b/Makefile.am
+index 955f2b7..4c26a9d 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -488,10 +488,6 @@ man: $(MANPAGES) $(MANPAGES_HTML)
+ man_MANS = \
+ $(MANPAGES)
+
+-noinst_DATA += \
+- $(MANPAGES_HTML) \
+- $(MANPAGES_XML)
+-
+ CLEANFILES += \
+ $(man_MANS) \
+ $(MANPAGES_HTML) \
+--
+2.39.2
+
diff --git a/network/patches/0097-man-Fix-authorship-warnings.patch b/network/patches/0097-man-Fix-authorship-warnings.patch
new file mode 100644
index 000000000..317a63569
--- /dev/null
+++ b/network/patches/0097-man-Fix-authorship-warnings.patch
@@ -0,0 +1,205 @@
+From 6b1e747472ac60192146fc5ddba12b4a5d021194 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 1 Apr 2019 12:47:02 +0200
+Subject: [PATCH 097/304] man: Fix authorship warnings
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ man/network-route-static.txt | 4 +++-
+ man/network-settings.txt | 1 -
+ man/network-vpn-security-policies.txt | 4 +++-
+ man/network-zone-bridge.txt | 4 +++-
+ man/network-zone-config-pppoe-server.txt | 3 +++
+ man/network-zone-ip-tunnel.txt | 4 +++-
+ man/network-zone-modem.txt | 4 +++-
+ man/network-zone-pppoe.txt | 4 +++-
+ man/network-zone-wireless.txt | 4 +++-
+ man/network-zone.txt | 4 +++-
+ 10 files changed, 27 insertions(+), 9 deletions(-)
+
+diff --git a/man/network-route-static.txt b/man/network-route-static.txt
+index c6c3fea..4ba97eb 100644
+--- a/man/network-route-static.txt
++++ b/man/network-route-static.txt
+@@ -1,5 +1,4 @@
+ = network-route-static(8)
+-Michael Tremer <michael.tremer(a)ipfire.org>
+
+ == NAME
+ network-route-static - Manage Static Routing
+@@ -63,6 +62,9 @@ The following commands are understood:
+ Packets matching this kind of route are silently discarded.
+ There will be no ICMP message sent to the source and no packet be forwarded.
+
++== AUTHORS
++Michael Tremer
++
+ == SEE ALSO
+ link:network[8],
+ link:network-route[8],
+diff --git a/man/network-settings.txt b/man/network-settings.txt
+index e77f038..a1c1ae3 100644
+--- a/man/network-settings.txt
++++ b/man/network-settings.txt
+@@ -1,5 +1,4 @@
+ = network-settings(8)
+-Michael Tremer <michael.tremer(a)ipfire.org>
+
+ == NAME
+ network-settings - Change global network settings
+diff --git a/man/network-vpn-security-policies.txt b/man/network-vpn-security-policies.txt
+index f9dc91a..3c843d7 100644
+--- a/man/network-vpn-security-policies.txt
++++ b/man/network-vpn-security-policies.txt
+@@ -1,5 +1,4 @@
+ = network-vpn-security-policies(8)
+-Michael Tremer <michael.tremer(a)ipfire.org>
+
+ == NAME
+ network-vpn-security-policies - Configure VPN Security Policies
+@@ -106,6 +105,9 @@ They are intended to provide good defaults for various situations.
+
+ System policies cannot be deleted.
+
++== AUTHORS
++Michael Tremer
++
+ == SEE ALSO
+ link:network[8],
+ link:network-vpn[8]
+diff --git a/man/network-zone-bridge.txt b/man/network-zone-bridge.txt
+index 2e4f839..46c78a6 100644
+--- a/man/network-zone-bridge.txt
++++ b/man/network-zone-bridge.txt
+@@ -1,5 +1,4 @@
+ = network-zone-bridge(8)
+-Michael Tremer <michael.tremer(a)ipfire.org>
+
+ == NAME
+ network-zone-bridge - Manage network zones
+@@ -50,6 +49,9 @@ Spanning Tree Protocol (802.1D) configuration options:
+ The STP priority sets the ranking of this network device within the network.
+ The bridge with the best rank (0 is best) will become the root bridge.
+
++== AUTHORS
++Michael Tremer
++
+ == SEE ALSO
+ link:network[8],
+ link:network-zone[8]
+diff --git a/man/network-zone-config-pppoe-server.txt b/man/network-zone-config-pppoe-server.txt
+index 72dff8e..7d83bd1 100644
+--- a/man/network-zone-config-pppoe-server.txt
++++ b/man/network-zone-config-pppoe-server.txt
+@@ -44,6 +44,9 @@ This command creates a PPPoE server that will assign an IP address from the
+
+ network zone net0 config create pppoe-server --subnet=192.168.0.0/16
+
++== AUTHORS
++Michael Tremer
++
+ == SEE ALSO
+ link:network[8],
+ link:network-zone[8],
+diff --git a/man/network-zone-ip-tunnel.txt b/man/network-zone-ip-tunnel.txt
+index cb30731..8e2f30a 100644
+--- a/man/network-zone-ip-tunnel.txt
++++ b/man/network-zone-ip-tunnel.txt
+@@ -1,5 +1,4 @@
+ = network-zone-ip-tunnel(8)
+-Michael Tremer <michael.tremer(a)ipfire.org>
+
+ == NAME
+ network-zone-ip-tunnel - Manage IP Tunnels
+@@ -30,6 +29,9 @@ The following options are understood:
+ +
+ This is optional and if unset a useful default will be used.
+
++== AUTHORS
++Michael Tremer
++
+ == SEE ALSO
+ link:network[8],
+ link:network-zone[8]
+diff --git a/man/network-zone-modem.txt b/man/network-zone-modem.txt
+index 6b09622..082bb21 100644
+--- a/man/network-zone-modem.txt
++++ b/man/network-zone-modem.txt
+@@ -1,5 +1,4 @@
+ = network-zone-modem(8)
+-Michael Tremer <michael.tremer(a)ipfire.org>
+
+ == NAME
+ network-zone-modem - Configure serial modems
+@@ -61,6 +60,9 @@ The following options are understood:
+ * _Password Authentication Protocol_ (`pap`) sends the plaintext password
+ to the authentication server which is the reason why it should be avoided.
+
++== AUTHORS
++Michael Tremer
++
+ == SEE ALSO
+ link:network[8],
+ link:network-zone[8]
+diff --git a/man/network-zone-pppoe.txt b/man/network-zone-pppoe.txt
+index 93b55f2..1a1c4f3 100644
+--- a/man/network-zone-pppoe.txt
++++ b/man/network-zone-pppoe.txt
+@@ -1,5 +1,4 @@
+ = network-zone-pppoe(8)
+-Michael Tremer <michael.tremer(a)ipfire.org>
+
+ == NAME
+ network-zone-pppoe - PPP over Ethernet
+@@ -47,6 +46,9 @@ The following options are understood:
+ By this option, you may enable or disable the delegation through your
+ provider of one IPv6 prefix to your system.
+
++== AUTHORS
++Michael Tremer
++
+ == SEE ALSO
+ link:network[8],
+ link:network-zone[8]
+diff --git a/man/network-zone-wireless.txt b/man/network-zone-wireless.txt
+index 368ac2a..531f8ff 100644
+--- a/man/network-zone-wireless.txt
++++ b/man/network-zone-wireless.txt
+@@ -1,5 +1,4 @@
+ = network-zone-wireless(8)
+-Michael Tremer <michael.tremer(a)ipfire.org>
+
+ == NAME
+ network-zone-wireless - Wireless Networks
+@@ -27,6 +26,9 @@ The following options are understood:
+ parameter is optional and a random MAC address will be generated when
+ omitted.
+
++== AUTHORS
++Michael Tremer
++
+ == SEE ALSO
+ link:network[8],
+ link:network-zone[8]
+diff --git a/man/network-zone.txt b/man/network-zone.txt
+index 88a1988..2c2c6f0 100644
+--- a/man/network-zone.txt
++++ b/man/network-zone.txt
+@@ -1,5 +1,4 @@
+ = network-zone(8)
+-Michael Tremer <michael.tremer(a)ipfire.org>
+
+ == NAME
+ network-zone - Manage network zones
+@@ -69,5 +68,8 @@ include::include-description.txt[]
+ The command will shut down the zone if it is up and start it again with
+ the new name. If the zone is not up it won't be started.
+
++== AUTHORS
++Michael Tremer
++
+ == SEE ALSO
+ link:network[8]
+--
+2.39.2
+
diff --git a/network/patches/0098-man-Make-syntax-format-more-similar-across-files.patch b/network/patches/0098-man-Make-syntax-format-more-similar-across-files.patch
new file mode 100644
index 000000000..5752c844c
--- /dev/null
+++ b/network/patches/0098-man-Make-syntax-format-more-similar-across-files.patch
@@ -0,0 +1,583 @@
+From 39cfece88a2978f946e1713fbf1e2be3faf124d6 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 1 Apr 2019 19:49:01 +0200
+Subject: [PATCH 098/304] man: Make syntax format more similar across files
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ man/firewall-settings.txt | 29 +++++------
+ man/network-device.txt | 37 ++++++--------
+ man/network-dhcp.txt | 35 ++++++--------
+ man/network-dns-server.txt | 50 ++++++++-----------
+ man/network-performance-tuning.txt | 17 +++----
+ man/network-port.txt | 77 ++++++++++++++----------------
+ man/network-quick-start.txt | 15 ++----
+ man/network-route-static.txt | 18 +++----
+ 8 files changed, 116 insertions(+), 162 deletions(-)
+
+diff --git a/man/firewall-settings.txt b/man/firewall-settings.txt
+index 20038e3..81c9bd9 100644
+--- a/man/firewall-settings.txt
++++ b/man/firewall-settings.txt
+@@ -1,30 +1,25 @@
+-firewall-settings(8)
+-====================
++= firewall-settings(8)
+
+-NAME
+-----
++== NAME
+ firewall-settings - Global firewall settings
+
+-SYNOPSIS
+---------
++== SYNOPSIS
+ [verse]
+-'firewall settings'
+-'firewall settings' KEY=VALUE ...
++`firewall settings`
++`firewall settings` KEY=VALUE ...
+
+-DESCRIPTION
+------------
++== DESCRIPTION
+ This command is used to set global firewall settings.
+ Please have a look at the individual man pages for more options.
+
+-COMMANDS
+---------
++== COMMANDS
+ If no argument is given, the configuration will be dumped to the console.
+
+ You may set a new value by adding the variable name and the new value to
+ the command line.
+
+-SETTINGS
+---------
++== SETTINGS
++
+ === CONNTRACK_MAX_CONNECTIONS = 16384
+ Limits the max. number of simultaneous connections.
+
+@@ -88,10 +83,8 @@ Some routers on the Internet still do not support ECN properly.
+ When this setting is disabled, ECN is only advertised
+ when asked for.
+
+-AUTHORS
+--------
++== AUTHORS
+ Michael Tremer
+
+-SEE ALSO
+---------
++== SEE ALSO
+ link:firewall[8]
+diff --git a/man/network-device.txt b/man/network-device.txt
+index 4f1c1b0..d70536e 100644
+--- a/man/network-device.txt
++++ b/man/network-device.txt
+@@ -1,61 +1,54 @@
+-network-device(8)
+-=================
++= network-device(8)
+
+-NAME
+-----
++== NAME
+ network-device - Controls network devices
+
+-SYNOPSIS
+---------
++== SYNOPSIS
+ [verse]
+-'network device' [<options>] <command> ...
++`network device` COMMAND ...
+
+-DESCRIPTION
+------------
+-The 'network device' command shows low-level status information
++== DESCRIPTION
++The `network device` command shows low-level status information
+ of network devices and other things.
+
+-COMMANDS
+---------
++== COMMANDS
+ The following commands are understood:
+
+-'list'::
++`list`::
+ This command shows a list of all device that are currently present
+ on this system. This includes PHYs and serial devices as well.
+
+-'DEVICE discover'::
++`DEVICE discover`::
+ Runs a discovery for many hooks on the given device.
+
+ This will check if the hook can find for example a DHCP server or
+ DSLAM and thus predict for what the device should be used.
+
+-'DEVICE identify'::
++`DEVICE identify`::
+ This command only works for Ethernet adapters and will make those
+ that support this feature flash for a few seconds.
+
+ It is handy to find the right device to put the cable in.
+
+-'DEVICE monitor'::
++`DEVICE monitor`::
+ This command creates a monitor interface for wireless modules.
+
+ An instance of link:tcpdump[8] will be started and show all
+ frames that are sent or received on the 802.11 layer (layer 2).
+
+-'DEVICE status'::
++`DEVICE status`::
+ This will show you very detailed information about the given device.
+
+-'DEVICE unlock'::
++`DEVICE unlock`::
+ This command will unlock the SIM card in a modem.
+ Only serial devices are supported which are the most 4G or 3G modems.
+
+ For the PIN or PUK code, the user will be prompted.
+
+-AUTHORS
+--------
++== AUTHORS
+ Michael Tremer
+
+-SEE ALSO
+---------
++== SEE ALSO
+ link:network[8]
+ link:network-port[8]
+ link:network-zone[8]
+diff --git a/man/network-dhcp.txt b/man/network-dhcp.txt
+index bcb768e..11e5fb4 100644
+--- a/man/network-dhcp.txt
++++ b/man/network-dhcp.txt
+@@ -1,44 +1,37 @@
+-network-dhcp(8)
+-===============
++= network-dhcp(8)
+
+-NAME
+-----
++== NAME
+ network-dhcp - Controls the DHCP Server
+
+-SYNOPSIS
+---------
++== SYNOPSIS
+ [verse]
+-'network dhcpv6' <command> ...
+-'network dhcpv4' <command> ...
++`network dhcpv6` COMMAND ...
++`network dhcpv4` COMMAND ...
+
+-DESCRIPTION
+------------
++== DESCRIPTION
+ With help of the DHCP commands it is possible to configure DHCP
+ servers for IPv6 and IPv4.
+
+-COMMANDS
+---------
++== COMMANDS
+ The following commands are understood:
+
+-'start'::
++`start`::
+ Starts the DHCP server.
+
+-'stop'::
++`stop`::
+ Stops the DHCP server.
+
+-'restart'::
++`restart`::
+ Restarts the DHCP server.
+
+-'reload'::
++`reload`::
+ Reload the DHCP server configuration.
+
+-'subnet ...'::
++`subnet ...`::
+ TODO
+
+-AUTHORS
+--------
++== AUTHORS
+ Michael Tremer
+
+-SEE ALSO
+---------
++== SEE ALSO
+ link:network[8]
+diff --git a/man/network-dns-server.txt b/man/network-dns-server.txt
+index bd01ca7..f5019ce 100644
+--- a/man/network-dns-server.txt
++++ b/man/network-dns-server.txt
+@@ -1,75 +1,67 @@
+-network-dns-server(8)
+-=====================
++= network-dns-server(8)
+
+-NAME
+-----
++== NAME
+ network-dns-server - Controls the DNS settings
+
+-SYNOPSIS
+---------
++== SYNOPSIS
+ [verse]
+-'network dns-server' add SERVER [PRIORITY]
+-'network dns-server' remove SERVER
+-'network dns-server' list
+-'network dns-server' update
++`network dns-server add` SERVER [PRIORITY]
++`network dns-server remove` SERVER
++`network dns-server list`
++`network dns-server update`
+
+-DESCRIPTION
+------------
++== DESCRIPTION
+ With this command, you will be able to configure the local DNS
+ configuration.
+
+ You may add and remove DNS servers as well as view the settings.
+
+-COMMANDS
+---------
++== COMMANDS
+ The following commands are understood:
+
+-'add' SERVER [PRIORITY]::
++`add SERVER [PRIORITY]`::
+ A new DNS server may be added to the list by the
+ 'add' command.
+ A priority that will rank the server my optionally be given.
+-
++ +
+ NOTE: SERVER must be a valid IP address and PRIORITY
+ must be a positive number.
+ The smaller this number, the higher is is the rank of
+ the server.
+
+-'remove' SERVER::
++`remove SERVER`::
+ The given server will be removed from the list of DNS servers.
+
+-'list'::
++`list`::
+ Shows a list of all servers that are currently in use.
+
+-'update'::
++`update`::
+ This command will re-create the system's configuration
+ files. It should not be required to use this command
+ very often.
+
+-SETTINGS
+---------
++== SETTINGS
+ The following settings may be set using link:network-settings[8]:
+
+-'DNS_USE_LOCAL_RESOLVER = [true|false]'::
++`DNS_USE_LOCAL_RESOLVER = [true|false]`::
+ This option defines whether the local DNS resolver should
+ be used or not.
+-
++ +
+ Basically, the option adds localhost to the list of nameservers
+ in link:resolv.conf[5].
+
+-'DNS_SEARCH_DOMAINS ='::
++`DNS_SEARCH_DOMAINS =`::
+ This setting configures the search domains for DNS queries
+ made by the local system.
+
+-'DNS_RANDOMIZE = [true|false]'::
++`DNS_RANDOMIZE = [true|false]`::
+ This option will break the DNS server ranks and will query
+ them in a random order which is useful to load-balance
+ multiple DNS servers.
+
+-AUTHORS
+--------
++== AUTHORS
+ Michael Tremer
+
+-SEE ALSO
+---------
++== SEE ALSO
+ link:network[8],
+ link:network-settings[8]
+diff --git a/man/network-performance-tuning.txt b/man/network-performance-tuning.txt
+index 763ee21..4672bbc 100644
+--- a/man/network-performance-tuning.txt
++++ b/man/network-performance-tuning.txt
+@@ -1,12 +1,9 @@
+-network-performance-tuning(8)
+-=============================
++= network-performance-tuning(8)
+
+-NAME
+-----
++== NAME
+ network-performance-tuning - Performance Tuning for Networking
+
+-DESCRIPTION
+------------
++== DESCRIPTION
+ This page contains a summary of some performance tuning techniques
+ that this system is using.
+
+@@ -22,12 +19,10 @@ reducing network latency and quite possibly increasing throughput.
+ The algorithm is trying to balance all network controllers across
+ all processors.
+
+-See /proc/interrups for the distribution of interrupts.
++See /proc/interrupts for the distribution of interrupts.
+
+-AUTHORS
+--------
++== AUTHORS
+ Michael Tremer
+
+-SEE ALSO
+---------
++== SEE ALSO
+ link:network[8]
+diff --git a/man/network-port.txt b/man/network-port.txt
+index 0c26f33..54cd58c 100644
+--- a/man/network-port.txt
++++ b/man/network-port.txt
+@@ -1,29 +1,25 @@
+-network-port(8)
+-===============
++= network-port(8)
+
+-NAME
+-----
++== NAME
+ network-port - Controls Network Ports
+
+-SYNOPSIS
+---------
++== SYNOPSIS
+ [verse]
+-'network port' new HOOK ...
+-'network port' destroy PORT
+-'network port' PORT color set <color>
+-'network port' PORT color reset
+-'network port' PORT create
+-'network port' PORT description edit
+-'network port' PORT description show
+-'network port' PORT down
+-'network port' PORT edit ...
+-'network port' PORT identify
+-'network port' PORT remove
+-'network port' PORT status
+-'network port' PORT up
+-
+-DESCRIPTION
+------------
++`network port new HOOK ...`
++`network port destroy PORT`
++`network port PORT color set COLOR`
++`network port PORT color reset`
++`network port PORT create`
++`network port PORT description edit`
++`network port PORT description show`
++`network port PORT down`
++`network port PORT edit ...`
++`network port PORT identify`
++`network port PORT remove`
++`network port PORT status`
++`network port PORT up`
++
++== DESCRIPTION
+ This command creates, deletes, changes and views the configuration
+ and status of ports.
+
+@@ -32,15 +28,14 @@ to an other network. It connects those and zones together.
+ The 'network device' command shows status information of network devices
+ and other things.
+
+-COMMANDS
+---------
++== COMMANDS
+ The following commands are understood:
+
+-'new' HOOK ...::
++`new HOOK ...`::
+ A new port may be created with this command.
+ HOOK must be a valid hook which may require more options.
+
+-'destroy' PORT::
++`destroy PORT`::
+ Destroys the port PORT.
+ The port is removed from any zones it is attached to and shut down.
+
+@@ -48,49 +43,47 @@ For all other commands, the name of the port needs to be passed first:
+
+ include::include-color.txt[]
+
+-'create'::
++`create`::
+ This will create devices for the existing port PORT.
+-
++ +
+ This does not create a new port. It will just create the (possibly
+ virtual) interface this port (i.e. create an interface for a WiFi
+ module or a VLAN device).
+-
+- The interface is not brought up. Use the 'up' command to do that.
++ +
++ The interface is not brought up. Use the `up` command to do that.
+
+ include::include-description.txt[]
+
+-'down'::
++`down`::
+ Shuts down the port.
+
+-'edit'::
++`edit`::
+ This command can be used to alter the configuration of a port.
+ Consult the documentation of the port hook to find out what is supported.
+
+-'identify'::
++`identify`::
+ This command will make the port flash for a few seconds
+ so that you can identify the correct network adapters
+ in the system.
+-
++ +
+ This is not supported by all network adapters.
+
+-'remove'::
++`remove`::
+ This will remove an existing PORT.
+-
++ +
+ This does not destroy the port. It inverses the operation performed
+ by the 'create' command.
+
+-'status'::
++`status`::
+ This will show some detailed information about the status
+ of the specified port.
+
+-'up'::
++`up`::
+ Brings up the port. It has to be created first.
+
+-AUTHORS
+--------
++== AUTHORS
+ Michael Tremer
+
+-SEE ALSO
+---------
++== SEE ALSO
+ link:network[8],
+ link:network-zone[8]
+diff --git a/man/network-quick-start.txt b/man/network-quick-start.txt
+index 02ebfe0..1ab5866 100644
+--- a/man/network-quick-start.txt
++++ b/man/network-quick-start.txt
+@@ -1,12 +1,9 @@
+-network-quick-start(8)
+-======================
++= network-quick-start(8)
+
+-NAME
+-----
++== NAME
+ network-quick-start - Quick Start Guide for Networking
+
+-DESCRIPTION
+------------
++== DESCRIPTION
+ The link:network[8] is a very powerful command that allows you to configure
+ the entire networking stack.
+ Unfortunately that makes it quite complicated to use as well.
+@@ -80,12 +77,10 @@ The entire network can be restarted by running:
+ # network restart
+ ------------
+
+-AUTHORS
+--------
++== AUTHORS
+ Michael Tremer
+
+-SEE ALSO
+---------
++== SEE ALSO
+ link:network[8],
+ link:network-device[8],
+ link:network-port[8],
+diff --git a/man/network-route-static.txt b/man/network-route-static.txt
+index 4ba97eb..43a1277 100644
+--- a/man/network-route-static.txt
++++ b/man/network-route-static.txt
+@@ -5,10 +5,10 @@ network-route-static - Manage Static Routing
+
+ == SYNOPSIS
+ [verse]
+-'network route static' COMMAND ...
+-'network route static add' NETWORK [--gateway=GATEWAY,--unreachable,--prohibit,--blackhole] [--mtu=MTU]
+-'network route static remove' NETWORK
+-'network route static list' [--protocol=ipv6|ipv4]
++`network route static COMMAND ...`
++`network route static add NETWORK [--gateway=GATEWAY,--unreachable,--prohibit,--blackhole] [--mtu=MTU]`
++`network route static remove NETWORK`
++`network route static list` [--protocol=ipv6|ipv4]`
+
+ == DESCRIPTION
+ This command helps to manage routes.
+@@ -20,14 +20,14 @@ The following commands are understood:
+ A new route may be added by the 'add' command. It is required to pass a
+ valid network prefix NETWORK, which can be either IPv6 or IPv4.
+ +
+- For unicast routes, the '--gateway=GATEWAY' option must be passed, where
++ For unicast routes, the `--gateway=GATEWAY` option must be passed, where
+ GATEWAY is a valid IP address of the same protocol type as the network
+ prefix is.
+ +
+- Use '--unreachable', '--prohibit', '--blackhole' can be used to create of
++ Use `--unreachable`, `--prohibit`, `--blackhole` can be used to create of
+ that type. See ROUTE TYPES below for more information about these options.
+ +
+- The optional '--mtu=MTU' parameter defines the MTU along the path to the
++ The optional `--mtu=MTU` parameter defines the MTU along the path to the
+ destination and must be an integer number. This will show you very
+ detailed information about the given device.
+
+@@ -39,7 +39,7 @@ The following commands are understood:
+ 'list'::
+ Shows a list of all configured routes.
+ +
+- Output can be filtered by passing --protocol=[ipv6|ipv4].
++ Output can be filtered by passing `--protocol=[ipv6|ipv4]`.
+
+ == ROUTE TYPES
+
+@@ -47,7 +47,7 @@ The following commands are understood:
+ 'unicast'::
+ A unicast route is the most common route in routing tables. It is a route to
+ a destination network address, which describes the path to the destination.
+- Use the '--gateway=GATEWAY' option to create such a route.
++ Use the `--gateway=GATEWAY` option to create such a route.
+
+ 'unreachable'::
+ When a route is determined and the routing decision process returns a
+--
+2.39.2
+
diff --git a/network/patches/0099-hooks-Add-overwritable-function-to-determine-the-por.patch b/network/patches/0099-hooks-Add-overwritable-function-to-determine-the-por.patch
new file mode 100644
index 000000000..09b95df3c
--- /dev/null
+++ b/network/patches/0099-hooks-Add-overwritable-function-to-determine-the-por.patch
@@ -0,0 +1,53 @@
+From d673165c5456e29013def29ed1fa9f202110665a Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 3 Jun 2019 11:50:13 +0200
+Subject: [PATCH 099/304] hooks: Add overwritable function to determine the
+ port name
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/header-port | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+diff --git a/src/header-port b/src/header-port
+index d75fdd8..7d0b272 100644
+--- a/src/header-port
++++ b/src/header-port
+@@ -68,6 +68,12 @@ hook_hotplug_rename_by_address() {
+ return ${EXIT_ERROR}
+ }
+
++# Returns the suggested name of the port
++hook_find_port_name() {
++ assert isset HOOK_PORT_PATTERN
++ port_find_free "${HOOK_PORT_PATTERN}"
++}
++
+ hook_default_new() {
+ local ${HOOK_SETTINGS[*]}
+
+@@ -78,14 +84,16 @@ hook_default_new() {
+ return ${EXIT_ERROR}
+ fi
+
+- assert isset HOOK_PORT_PATTERN
+-
+- local port=$(port_find_free ${HOOK_PORT_PATTERN})
++ # Determine a name for this port
++ local port="$(hook_find_port_name)"
+ assert isset port
+
+- port_settings_write "${port}" ${HOOK_SETTINGS[*]}
++ # Save settings
++ if ! port_settings_write "${port}" ${HOOK_SETTINGS[*]}; then
++ return ${EXIT_ERROR}
++ fi
+
+- exit ${EXIT_OK}
++ return ${EXIT_OK}
+ }
+
+ hook_new() {
+--
+2.39.2
+
diff --git a/network/patches/0100-vlan-Convert-hook-to-use-parse_cmdline-function.patch b/network/patches/0100-vlan-Convert-hook-to-use-parse_cmdline-function.patch
new file mode 100644
index 000000000..3a6445824
--- /dev/null
+++ b/network/patches/0100-vlan-Convert-hook-to-use-parse_cmdline-function.patch
@@ -0,0 +1,76 @@
+From 96045e9c044a709407b40df4145011e335929a3e Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 3 Jun 2019 11:55:35 +0200
+Subject: [PATCH 100/304] vlan: Convert hook to use parse_cmdline function
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/hooks/ports/vlan | 42 ++++++++----------------------------------
+ 1 file changed, 8 insertions(+), 34 deletions(-)
+
+diff --git a/src/hooks/ports/vlan b/src/hooks/ports/vlan
+index f511986..69f5144 100644
+--- a/src/hooks/ports/vlan
++++ b/src/hooks/ports/vlan
+@@ -51,7 +51,14 @@ hook_check_settings() {
+ done
+ }
+
+-hook_new() {
++hook_find_port_name() {
++ assert isset PARENT_DEVICE
++ assert isset TAG
++
++ print "${PARENT_DEVICE}${VLAN_PORT_INTERFIX}${TAG}"
++}
++
++hook_parse_cmdline() {
+ while [ $# -gt 0 ]; do
+ case "${1}" in
+ --parent-device=*)
+@@ -63,42 +70,9 @@ hook_new() {
+ --tag=*)
+ TAG=$(cli_get_val "${1}")
+ ;;
+- *)
+- warning "Unknown argument '${1}'"
+- ;;
+- esac
+- shift
+- done
+-
+- local port="${PARENT_DEVICE}${VLAN_PORT_INTERFIX}${TAG}"
+-
+- port_settings_write "${port}"
+-
+- exit ${EXIT_OK}
+-}
+-
+-hook_edit() {
+- local port=${1}
+- assert isset port
+- shift
+-
+- port_settings_read "${port}"
+-
+- while [ $# -gt 0 ]; do
+- case "${1}" in
+- --address=*)
+- ADDRESS=$(cli_get_val "${1}")
+- ;;
+- *)
+- warning "Unknown argument '${1}'"
+- ;;
+ esac
+ shift
+ done
+-
+- port_settings_write "${port}"
+-
+- exit ${EXIT_OK}
+ }
+
+ hook_create() {
+--
+2.39.2
+
diff --git a/network/patches/0101-vlan-Validate-and-always-set-MAC-address.patch b/network/patches/0101-vlan-Validate-and-always-set-MAC-address.patch
new file mode 100644
index 000000000..75a5310ee
--- /dev/null
+++ b/network/patches/0101-vlan-Validate-and-always-set-MAC-address.patch
@@ -0,0 +1,42 @@
+From abb655547c79f72b97451c02ba285b13c68e5a2a Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 3 Jun 2019 12:00:02 +0200
+Subject: [PATCH 101/304] vlan: Validate and always set MAC address
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/hooks/ports/vlan | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/src/hooks/ports/vlan b/src/hooks/ports/vlan
+index 69f5144..0147e54 100644
+--- a/src/hooks/ports/vlan
++++ b/src/hooks/ports/vlan
+@@ -66,6 +66,12 @@ hook_parse_cmdline() {
+ ;;
+ --address=*)
+ ADDRESS=$(cli_get_val "${1}")
++
++ # Validate address
++ if ! mac_is_valid "${ADDRESS}"; then
++ error "Invalid MAC address given: ${ADDRESS}"
++ return ${EXIT_CONF_ERROR}
++ fi
+ ;;
+ --tag=*)
+ TAG=$(cli_get_val "${1}")
+@@ -73,6 +79,11 @@ hook_parse_cmdline() {
+ esac
+ shift
+ done
++
++ # Generate a random MAC address if none given
++ if ! isset ADDRESS; then
++ ADDRESS="$(mac_generate)"
++ fi
+ }
+
+ hook_create() {
+--
+2.39.2
+
diff --git a/network/patches/0102-vlan-Fail-when-unknown-command-line-parameters-are-b.patch b/network/patches/0102-vlan-Fail-when-unknown-command-line-parameters-are-b.patch
new file mode 100644
index 000000000..28c850b34
--- /dev/null
+++ b/network/patches/0102-vlan-Fail-when-unknown-command-line-parameters-are-b.patch
@@ -0,0 +1,29 @@
+From 0cf39f2d5178f624161b8c4329140bd00b06019c Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 3 Jun 2019 12:02:15 +0200
+Subject: [PATCH 102/304] vlan: Fail when unknown command line parameters are
+ being passed
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/hooks/ports/vlan | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/src/hooks/ports/vlan b/src/hooks/ports/vlan
+index 0147e54..39dbfff 100644
+--- a/src/hooks/ports/vlan
++++ b/src/hooks/ports/vlan
+@@ -76,6 +76,10 @@ hook_parse_cmdline() {
+ --tag=*)
+ TAG=$(cli_get_val "${1}")
+ ;;
++ -*)
++ error "Unknown argument '${1}'"
++ return ${EXIT_CONF_ERROR}
++ ;;
+ esac
+ shift
+ done
+--
+2.39.2
+
diff --git a/network/patches/0103-vlan-Rename-PARENT_DEVICE-to-PARENT_PORT.patch b/network/patches/0103-vlan-Rename-PARENT_DEVICE-to-PARENT_PORT.patch
new file mode 100644
index 000000000..897e75be7
--- /dev/null
+++ b/network/patches/0103-vlan-Rename-PARENT_DEVICE-to-PARENT_PORT.patch
@@ -0,0 +1,102 @@
+From a2f35a67d83bd3a4a4438c2b7b8cbc2ee0002e38 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 3 Jun 2019 12:08:05 +0200
+Subject: [PATCH 103/304] vlan: Rename PARENT_DEVICE to PARENT_PORT
+
+It technically is a port
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/hooks/ports/vlan | 26 ++++++++++++++++----------
+ test/nitsi/test/port-vlan/recipe | 2 +-
+ 2 files changed, 17 insertions(+), 11 deletions(-)
+
+diff --git a/src/hooks/ports/vlan b/src/hooks/ports/vlan
+index 39dbfff..f19eda4 100644
+--- a/src/hooks/ports/vlan
++++ b/src/hooks/ports/vlan
+@@ -23,14 +23,14 @@
+
+ HOOK_SETTINGS=(
+ "ADDRESS"
+- "PARENT_DEVICE"
++ "PARENT_PORT"
+ "TAG"
+ )
+
+-PORT_PARENTS_VAR="PARENT"
++PORT_PARENTS_VAR="PARENT_PORT"
+
+ hook_check_settings() {
+- assert isset PARENT_DEVICE
++ assert isset PARENT_PORT
+ assert isinteger TAG
+
+ if isset ADDRESS; then
+@@ -52,18 +52,15 @@ hook_check_settings() {
+ }
+
+ hook_find_port_name() {
+- assert isset PARENT_DEVICE
++ assert isset PARENT_PORT
+ assert isset TAG
+
+- print "${PARENT_DEVICE}${VLAN_PORT_INTERFIX}${TAG}"
++ print "${PARENT_PORT}${VLAN_PORT_INTERFIX}${TAG}"
+ }
+
+ hook_parse_cmdline() {
+ while [ $# -gt 0 ]; do
+ case "${1}" in
+- --parent-device=*)
+- PARENT_DEVICE=$(cli_get_val "${1}")
+- ;;
+ --address=*)
+ ADDRESS=$(cli_get_val "${1}")
+
+@@ -73,10 +70,19 @@ hook_parse_cmdline() {
+ return ${EXIT_CONF_ERROR}
+ fi
+ ;;
++ --port=*)
++ PARENT_PORT=$(cli_get_val "${1}")
++
++ # Check if PARENT_PORT exists
++ if ! port_exists "${PARENT_PORT}"; then
++ error "Port '${PARENT_PORT}' does not exist"
++ return ${EXIT_CONF_ERROR}
++ fi
++ ;;
+ --tag=*)
+ TAG=$(cli_get_val "${1}")
+ ;;
+- -*)
++ *)
+ error "Unknown argument '${1}'"
+ return ${EXIT_CONF_ERROR}
+ ;;
+@@ -100,7 +106,7 @@ hook_create() {
+ port_settings_read "${port}"
+
+ # Create the VLAN device
+- vlan_create "${port}" "${PARENT_DEVICE}" "${TAG}" "${ADDRESS}"
++ vlan_create "${port}" "${PARENT_PORT}" "${TAG}" "${ADDRESS}"
+
+ exit ${EXIT_OK}
+ }
+diff --git a/test/nitsi/test/port-vlan/recipe b/test/nitsi/test/port-vlan/recipe
+index d41377b..7a99251 100644
+--- a/test/nitsi/test/port-vlan/recipe
++++ b/test/nitsi/test/port-vlan/recipe
+@@ -17,7 +17,7 @@ bob: network zone upl0 config new static 192.168.100.102/24
+ all: network status
+
+ # Create a vlan device with parent port attached to net1
+-all: network port new vlan --parent-device=${p_net1} --tag=42
++all: network port new vlan --port="${p_net1}" --tag=42
+ all: network zone upl0 port attach "${p_net1}v42"
+
+ # Test if the vlan works by pinging bob
+--
+2.39.2
+
diff --git a/network/patches/0104-vlan-Check-if-parent-device-exists-before-bringing-i.patch b/network/patches/0104-vlan-Check-if-parent-device-exists-before-bringing-i.patch
new file mode 100644
index 000000000..6f4ebeded
--- /dev/null
+++ b/network/patches/0104-vlan-Check-if-parent-device-exists-before-bringing-i.patch
@@ -0,0 +1,35 @@
+From 4776723194ad4d1ba75d1b373c1892e44ddcbf97 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 3 Jun 2019 12:15:01 +0200
+Subject: [PATCH 104/304] vlan: Check if parent device exists before bringing
+ it up
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/hooks/ports/vlan | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/src/hooks/ports/vlan b/src/hooks/ports/vlan
+index f19eda4..98178e3 100644
+--- a/src/hooks/ports/vlan
++++ b/src/hooks/ports/vlan
+@@ -103,7 +103,15 @@ hook_create() {
+ device_exists "${port}" && exit ${EXIT_OK}
+
+ # Read configruation
+- port_settings_read "${port}"
++ if ! port_settings_read "${port}"; then
++ return ${EXIT_ERROR}
++ fi
++
++ # Check if the parent port exists
++ if ! port_exists "${PARENT_PORT}"; then
++ error "Port '${PARENT_PORT}' does not exist"
++ return ${EXIT_ERROR}
++ fi
+
+ # Create the VLAN device
+ vlan_create "${port}" "${PARENT_PORT}" "${TAG}" "${ADDRESS}"
+--
+2.39.2
+
diff --git a/network/patches/0105-vlan-Simplify-vlan_remove.patch b/network/patches/0105-vlan-Simplify-vlan_remove.patch
new file mode 100644
index 000000000..b6d1d2bf1
--- /dev/null
+++ b/network/patches/0105-vlan-Simplify-vlan_remove.patch
@@ -0,0 +1,32 @@
+From 23ddd3765e344e06f379a5ccc5c2cfcbfca9c7b7 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 3 Jun 2019 12:15:41 +0200
+Subject: [PATCH 105/304] vlan: Simplify vlan_remove()
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.vlan | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/src/functions/functions.vlan b/src/functions/functions.vlan
+index 97028b0..d83e3ad 100644
+--- a/src/functions/functions.vlan
++++ b/src/functions/functions.vlan
+@@ -88,13 +88,7 @@ vlan_create() {
+ }
+
+ vlan_remove() {
+- local device=${1}
+- assert isset device
+-
+- # Set down device (if not already done).
+- device_set_down ${device}
+-
+- device_delete ${device}
++ device_delete "$@"
+ }
+
+ vlan_get_parent() {
+--
+2.39.2
+
diff --git a/network/patches/0106-vlan-Refactor-vlan_create.patch b/network/patches/0106-vlan-Refactor-vlan_create.patch
new file mode 100644
index 000000000..250739fda
--- /dev/null
+++ b/network/patches/0106-vlan-Refactor-vlan_create.patch
@@ -0,0 +1,146 @@
+From d3a0f73d7b2b6d4f634083f5620752e57a7a691b Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 3 Jun 2019 12:28:17 +0200
+Subject: [PATCH 106/304] vlan: Refactor vlan_create()
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.vlan | 81 +++++++++++++++++++++++-------------
+ src/hooks/ports/vlan | 10 ++++-
+ 2 files changed, 60 insertions(+), 31 deletions(-)
+
+diff --git a/src/functions/functions.vlan b/src/functions/functions.vlan
+index d83e3ad..99a8baa 100644
+--- a/src/functions/functions.vlan
++++ b/src/functions/functions.vlan
+@@ -38,53 +38,76 @@ EOF
+ }
+
+ vlan_create() {
+- local device=${1}
+- assert isset device
++ local device="${1}"
++ shift
+
+- local parent=${2}
+- assert isset parent
++ assert isset device
+
+- local tag=${3}
+- assert isinteger tag
++ local address
++ local parent
++ local tag
++
++ # Parse command line arguments
++ while [ $# -gt 0 ]; do
++ case "${1}" in
++ --address=*)
++ address=$(cli_get_val "${1}")
++ ;;
++ --parent=*)
++ parent=$(cli_get_val "${1}")
++ ;;
++ --tag=*)
++ tag=$(cli_get_val "${1}")
++ ;;
++ *)
++ error "Unrecognized argument: ${1}"
++ return ${EXIT_ERROR}
++ ;;
++ esac
++ shift
++ done
++
++ # Generate a random MAC address if none was passed
++ if ! isset address; then
++ address="$(mac_generate)"
++ fi
+
+- local address=${4}
+- if isset address; then
+- assert ismac address
++ # Check if address is valid
++ if ! ismac address; then
++ log ERROR "Invalid mac address: ${address}"
++ return ${EXIT_ERROR}
+ fi
+
+- # Check if a device with the name does already exist.
+- if device_exists ${device}; then
+- log ERROR "device '${device}' does already exist"
++ # Check if a device with the name does already exist
++ if device_exists "${device}"; then
++ log ERROR "Device '${device}' already exists"
+ return ${EXIT_ERROR}
+ fi
+
+- # Check if the parent device exists.
+- if ! device_exists ${parent}; then
+- log ERROR "parent device '${parent}' does not exist"
++ # Check if the parent device exists
++ if ! device_exists "${parent}"; then
++ log ERROR "Parent device '${parent}' does not exist"
+ return ${EXIT_ERROR}
+ fi
+
+ # Load ebtables stuff.
+ vlan_init
+
+- local command="ip link add link ${parent} name ${device}"
++ # Make the command
++ local command=(
++ ip link add link "${parent}" name "${device}"
++ address "${address}" type vlan id "${tag}"
++ )
+
+- if isset address; then
+- command="${command} address ${address}"
++ # Run the command
++ if ! cmd_quiet "${command[*]}"; then
++ log ERROR "Could not create VLAN device ${device}: $?"
++ return ${EXIT_ERROR}
+ fi
+
+- command="${command} type vlan id ${tag}"
+-
+- cmd_quiet ${command}
+- local ret=$?
+-
+- if [ ${ret} -eq ${EXIT_OK} ]; then
+- log DEBUG "vlan device '${device}' has been created"
+- else
+- log ERROR "could not create vlan device '${device}': ${ret}"
+- fi
++ log DEBUG "Created VLAN device ${device} (parent = ${parent}, id = ${tag})"
+
+- return ${ret}
++ return ${EXIT_OK}
+ }
+
+ vlan_remove() {
+diff --git a/src/hooks/ports/vlan b/src/hooks/ports/vlan
+index 98178e3..4715b1f 100644
+--- a/src/hooks/ports/vlan
++++ b/src/hooks/ports/vlan
+@@ -114,9 +114,15 @@ hook_create() {
+ fi
+
+ # Create the VLAN device
+- vlan_create "${port}" "${PARENT_PORT}" "${TAG}" "${ADDRESS}"
++ if ! vlan_create "${port}" \
++ --address="${ADDRESS}" \
++ --parent="${PARENT_PORT}" \
++ --tag="${TAG}"; then
++ error "Could not create port: ${port}"
++ return ${EXIT_ERROR}
++ fi
+
+- exit ${EXIT_OK}
++ return ${EXIT_OK}
+ }
+
+ hook_remove() {
+--
+2.39.2
+
diff --git a/network/patches/0107-vlan-Create-partent-port-if-necessary.patch b/network/patches/0107-vlan-Create-partent-port-if-necessary.patch
new file mode 100644
index 000000000..2201b68f2
--- /dev/null
+++ b/network/patches/0107-vlan-Create-partent-port-if-necessary.patch
@@ -0,0 +1,30 @@
+From 68cacd23226f401f1676e8bfc975467647cefef0 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 3 Jun 2019 12:29:57 +0200
+Subject: [PATCH 107/304] vlan: Create partent port (if necessary)
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/hooks/ports/vlan | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/src/hooks/ports/vlan b/src/hooks/ports/vlan
+index 4715b1f..384ad50 100644
+--- a/src/hooks/ports/vlan
++++ b/src/hooks/ports/vlan
+@@ -113,6 +113,12 @@ hook_create() {
+ return ${EXIT_ERROR}
+ fi
+
++ # Create the partent port first
++ if ! port_create "${PARENT_PORT}"; then
++ error "Could not bring up parent port: ${PARENT_PORT}"
++ return ${EXIT_ERROR}
++ fi
++
+ # Create the VLAN device
+ if ! vlan_create "${port}" \
+ --address="${ADDRESS}" \
+--
+2.39.2
+
diff --git a/network/patches/0108-vlan-Drop-ebtables-stuff.patch b/network/patches/0108-vlan-Drop-ebtables-stuff.patch
new file mode 100644
index 000000000..4945f7dd2
--- /dev/null
+++ b/network/patches/0108-vlan-Drop-ebtables-stuff.patch
@@ -0,0 +1,49 @@
+From 5338fb1423a84f9faeb597a2b67606fff1f6d6ab Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 3 Jun 2019 12:30:48 +0200
+Subject: [PATCH 108/304] vlan: Drop ebtables stuff
+
+We no longer have ebtables
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.vlan | 16 ----------------
+ 1 file changed, 16 deletions(-)
+
+diff --git a/src/functions/functions.vlan b/src/functions/functions.vlan
+index 99a8baa..c542bb5 100644
+--- a/src/functions/functions.vlan
++++ b/src/functions/functions.vlan
+@@ -24,19 +24,6 @@ PROC_NET_VLAN_CONFIG="${PROC_NET_VLAN}/config"
+
+ VLAN_PORT_INTERFIX="v"
+
+-vlan_init() {
+- ebtables-restore <<EOF
+-*filter
+-:INPUT ACCEPT
+-:FORWARD ACCEPT
+-:OUTPUT ACCEPT
+-
+-*broute
+-:BROUTING ACCEPT
+--A BROUTING -p 802_1Q -j DROP
+-EOF
+-}
+-
+ vlan_create() {
+ local device="${1}"
+ shift
+@@ -90,9 +77,6 @@ vlan_create() {
+ return ${EXIT_ERROR}
+ fi
+
+- # Load ebtables stuff.
+- vlan_init
+-
+ # Make the command
+ local command=(
+ ip link add link "${parent}" name "${device}"
+--
+2.39.2
+
diff --git a/network/patches/0109-vlan-Rename-tag-to-id.patch b/network/patches/0109-vlan-Rename-tag-to-id.patch
new file mode 100644
index 000000000..69998bca2
--- /dev/null
+++ b/network/patches/0109-vlan-Rename-tag-to-id.patch
@@ -0,0 +1,159 @@
+From f24529e498b1c3fe60196c34356e5b005a22ae4c Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 3 Jun 2019 12:34:49 +0200
+Subject: [PATCH 109/304] vlan: Rename tag to id
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.vlan | 12 ++++++------
+ src/hooks/ports/vlan | 26 +++++++++++++-------------
+ test/nitsi/test/port-vlan/recipe | 2 +-
+ 3 files changed, 20 insertions(+), 20 deletions(-)
+
+diff --git a/src/functions/functions.vlan b/src/functions/functions.vlan
+index c542bb5..9a70c95 100644
+--- a/src/functions/functions.vlan
++++ b/src/functions/functions.vlan
+@@ -31,8 +31,8 @@ vlan_create() {
+ assert isset device
+
+ local address
++ local id
+ local parent
+- local tag
+
+ # Parse command line arguments
+ while [ $# -gt 0 ]; do
+@@ -40,12 +40,12 @@ vlan_create() {
+ --address=*)
+ address=$(cli_get_val "${1}")
+ ;;
++ --id=*)
++ id=$(cli_get_val "${1}")
++ ;;
+ --parent=*)
+ parent=$(cli_get_val "${1}")
+ ;;
+- --tag=*)
+- tag=$(cli_get_val "${1}")
+- ;;
+ *)
+ error "Unrecognized argument: ${1}"
+ return ${EXIT_ERROR}
+@@ -80,7 +80,7 @@ vlan_create() {
+ # Make the command
+ local command=(
+ ip link add link "${parent}" name "${device}"
+- address "${address}" type vlan id "${tag}"
++ address "${address}" type vlan id "${id}"
+ )
+
+ # Run the command
+@@ -89,7 +89,7 @@ vlan_create() {
+ return ${EXIT_ERROR}
+ fi
+
+- log DEBUG "Created VLAN device ${device} (parent = ${parent}, id = ${tag})"
++ log DEBUG "Created VLAN device ${device} (parent = ${parent}, id = ${id})"
+
+ return ${EXIT_OK}
+ }
+diff --git a/src/hooks/ports/vlan b/src/hooks/ports/vlan
+index 384ad50..97b6985 100644
+--- a/src/hooks/ports/vlan
++++ b/src/hooks/ports/vlan
+@@ -23,39 +23,39 @@
+
+ HOOK_SETTINGS=(
+ "ADDRESS"
++ "ID"
+ "PARENT_PORT"
+- "TAG"
+ )
+
+ PORT_PARENTS_VAR="PARENT_PORT"
+
+ hook_check_settings() {
+ assert isset PARENT_PORT
+- assert isinteger TAG
++ assert isinteger ID
+
+ if isset ADDRESS; then
+ assert ismac ADDRESS
+ fi
+
+- if [ ${TAG} -gt 4096 ]; then
+- error "TAG is greater than 4096."
++ if [ ${ID} -gt 4096 ]; then
++ error "ID is greater than 4096."
+ exit ${EXIT_ERROR}
+ fi
+
+ local reserved
+ for reserved in 0 4095; do
+- if [ "${TAG}" = "${reserved}" ]; then
+- error "TAG=${reserved} is reserved."
++ if [ "${ID}" = "${reserved}" ]; then
++ error "ID=${reserved} is reserved."
+ exit ${EXIT_ERROR}
+ fi
+ done
+ }
+
+ hook_find_port_name() {
++ assert isset ID
+ assert isset PARENT_PORT
+- assert isset TAG
+
+- print "${PARENT_PORT}${VLAN_PORT_INTERFIX}${TAG}"
++ print "${PARENT_PORT}${VLAN_PORT_INTERFIX}${ID}"
+ }
+
+ hook_parse_cmdline() {
+@@ -70,6 +70,9 @@ hook_parse_cmdline() {
+ return ${EXIT_CONF_ERROR}
+ fi
+ ;;
++ --id=*)
++ ID=$(cli_get_val "${1}")
++ ;;
+ --port=*)
+ PARENT_PORT=$(cli_get_val "${1}")
+
+@@ -79,9 +82,6 @@ hook_parse_cmdline() {
+ return ${EXIT_CONF_ERROR}
+ fi
+ ;;
+- --tag=*)
+- TAG=$(cli_get_val "${1}")
+- ;;
+ *)
+ error "Unknown argument '${1}'"
+ return ${EXIT_CONF_ERROR}
+@@ -122,8 +122,8 @@ hook_create() {
+ # Create the VLAN device
+ if ! vlan_create "${port}" \
+ --address="${ADDRESS}" \
+- --parent="${PARENT_PORT}" \
+- --tag="${TAG}"; then
++ --id="${id}" \
++ --parent="${PARENT_PORT}"; then
+ error "Could not create port: ${port}"
+ return ${EXIT_ERROR}
+ fi
+diff --git a/test/nitsi/test/port-vlan/recipe b/test/nitsi/test/port-vlan/recipe
+index 7a99251..2341e19 100644
+--- a/test/nitsi/test/port-vlan/recipe
++++ b/test/nitsi/test/port-vlan/recipe
+@@ -17,7 +17,7 @@ bob: network zone upl0 config new static 192.168.100.102/24
+ all: network status
+
+ # Create a vlan device with parent port attached to net1
+-all: network port new vlan --port="${p_net1}" --tag=42
++all: network port new vlan --port="${p_net1}" --id=42
+ all: network zone upl0 port attach "${p_net1}v42"
+
+ # Test if the vlan works by pinging bob
+--
+2.39.2
+
diff --git a/network/patches/0110-vlan-Validate-ID.patch b/network/patches/0110-vlan-Validate-ID.patch
new file mode 100644
index 000000000..f4abee55f
--- /dev/null
+++ b/network/patches/0110-vlan-Validate-ID.patch
@@ -0,0 +1,110 @@
+From fc1e91cca425c8e929df76dad4488066070879dd Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 3 Jun 2019 12:41:36 +0200
+Subject: [PATCH 110/304] vlan: Validate ID
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.vlan | 25 ++++++++++++++++++++++++-
+ src/hooks/ports/vlan | 26 +++++++++-----------------
+ 2 files changed, 33 insertions(+), 18 deletions(-)
+
+diff --git a/src/functions/functions.vlan b/src/functions/functions.vlan
+index 9a70c95..ee2fb34 100644
+--- a/src/functions/functions.vlan
++++ b/src/functions/functions.vlan
+@@ -24,6 +24,23 @@ PROC_NET_VLAN_CONFIG="${PROC_NET_VLAN}/config"
+
+ VLAN_PORT_INTERFIX="v"
+
++vlan_valid_id() {
++ local id="${1}"
++
++ # Must be an integer
++ if ! isinteger id; then
++ return ${EXIT_FALSE}
++ fi
++
++ # Must be between 1 and 4095
++ if [ ${id} -ge 1 ] && [ ${id} -le 4096 ]; then
++ return ${EXIT_TRUE}
++ fi
++
++ # Otherwise this is invalid
++ return ${EXIT_FALSE}
++}
++
+ vlan_create() {
+ local device="${1}"
+ shift
+@@ -31,7 +48,7 @@ vlan_create() {
+ assert isset device
+
+ local address
+- local id
++ local id=1
+ local parent
+
+ # Parse command line arguments
+@@ -65,6 +82,12 @@ vlan_create() {
+ return ${EXIT_ERROR}
+ fi
+
++ # Check VLAN ID
++ if ! vlan_valid_id "${id}"; then
++ log ERROR "Invalid VLAN ID: ${id}"
++ return ${EXIT_ERROR}
++ fi
++
+ # Check if a device with the name does already exist
+ if device_exists "${device}"; then
+ log ERROR "Device '${device}' already exists"
+diff --git a/src/hooks/ports/vlan b/src/hooks/ports/vlan
+index 97b6985..7f99dbc 100644
+--- a/src/hooks/ports/vlan
++++ b/src/hooks/ports/vlan
+@@ -30,25 +30,11 @@ HOOK_SETTINGS=(
+ PORT_PARENTS_VAR="PARENT_PORT"
+
+ hook_check_settings() {
++ assert ismac ADDRESS
+ assert isset PARENT_PORT
+- assert isinteger ID
+-
+- if isset ADDRESS; then
+- assert ismac ADDRESS
+- fi
+-
+- if [ ${ID} -gt 4096 ]; then
+- error "ID is greater than 4096."
+- exit ${EXIT_ERROR}
+- fi
+
+- local reserved
+- for reserved in 0 4095; do
+- if [ "${ID}" = "${reserved}" ]; then
+- error "ID=${reserved} is reserved."
+- exit ${EXIT_ERROR}
+- fi
+- done
++ assert isinteger ID
++ assert vlan_valid_id "${ID}"
+ }
+
+ hook_find_port_name() {
+@@ -72,6 +58,12 @@ hook_parse_cmdline() {
+ ;;
+ --id=*)
+ ID=$(cli_get_val "${1}")
++
++ # Validate VLAN ID
++ if ! vlan_valid_id "${ID}"; then
++ error "Invalid VLAN ID: ${ID}"
++ return ${EXIT_CONF_ERROR}
++ fi
+ ;;
+ --port=*)
+ PARENT_PORT=$(cli_get_val "${1}")
+--
+2.39.2
+
diff --git a/network/patches/0111-util-Add-abort-which-will-stop-the-program-immediate.patch b/network/patches/0111-util-Add-abort-which-will-stop-the-program-immediate.patch
new file mode 100644
index 000000000..f14d8610a
--- /dev/null
+++ b/network/patches/0111-util-Add-abort-which-will-stop-the-program-immediate.patch
@@ -0,0 +1,48 @@
+From 9532462fe04658d728ecbf263b586111f73fe2b2 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 3 Jun 2019 13:16:47 +0200
+Subject: [PATCH 111/304] util: Add abort() which will stop the program
+ immediately
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.util | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/src/functions/functions.util b/src/functions/functions.util
+index 7379a98..39ad861 100644
+--- a/src/functions/functions.util
++++ b/src/functions/functions.util
+@@ -469,14 +469,27 @@ assert() {
+ local assertion="$@"
+
+ if ! ${assertion}; then
+- error_log "Assertion '${assertion}' failed."
+ backtrace
+- exit ${EXIT_ERROR_ASSERT}
++
++ # End the program here
++ abort "Assertion failed: ${assertion}"
+ fi
+
+ return ${EXIT_OK}
+ }
+
++# Ends the program immediately without cleaning up
++abort() {
++ local msg="$@"
++
++ # Print message
++ if isset msg; then
++ log ERROR "${msg}"
++ fi
++
++ exit ${EXIT_ERROR_ASSERT}
++}
++
+ # This function checks, if the given argument is an assert error
+ # exit code. If this is the case, the script will halt immediately.
+ assert_check_retval() {
+--
+2.39.2
+
diff --git a/network/patches/0112-vlan-Add-support-for-802.1ad-QinQ.patch b/network/patches/0112-vlan-Add-support-for-802.1ad-QinQ.patch
new file mode 100644
index 000000000..62f77efca
--- /dev/null
+++ b/network/patches/0112-vlan-Add-support-for-802.1ad-QinQ.patch
@@ -0,0 +1,139 @@
+From 2eb7011cb5447f9568c8136940f59a047e1b8dae Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 3 Jun 2019 13:17:06 +0200
+Subject: [PATCH 112/304] vlan: Add support for 802.1ad (QinQ)
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.vlan | 24 +++++++++++++++++++++++-
+ src/hooks/ports/vlan | 22 ++++++++++++++++++++--
+ 2 files changed, 43 insertions(+), 3 deletions(-)
+
+diff --git a/src/functions/functions.vlan b/src/functions/functions.vlan
+index ee2fb34..fbaa34f 100644
+--- a/src/functions/functions.vlan
++++ b/src/functions/functions.vlan
+@@ -22,6 +22,11 @@
+ PROC_NET_VLAN="/proc/net/vlan"
+ PROC_NET_VLAN_CONFIG="${PROC_NET_VLAN}/config"
+
++VLAN_SUPPORTED_PROTOCOLS=(
++ "802.1Q" # default
++ "802.1ad"
++)
++
+ VLAN_PORT_INTERFIX="v"
+
+ vlan_valid_id() {
+@@ -41,6 +46,13 @@ vlan_valid_id() {
+ return ${EXIT_FALSE}
+ }
+
++vlan_supported_protocol() {
++ local proto="${1}"
++ assert isset proto
++
++ list_match "${proto}" "${VLAN_SUPPORTED_PROTOCOLS[@]}"
++}
++
+ vlan_create() {
+ local device="${1}"
+ shift
+@@ -50,6 +62,7 @@ vlan_create() {
+ local address
+ local id=1
+ local parent
++ local protocol="${VLAN_SUPPORTED_PROTOCOLS[0]}"
+
+ # Parse command line arguments
+ while [ $# -gt 0 ]; do
+@@ -63,6 +76,9 @@ vlan_create() {
+ --parent=*)
+ parent=$(cli_get_val "${1}")
+ ;;
++ --protocol=*)
++ protocol=$(cli_get_val "${1}")
++ ;;
+ *)
+ error "Unrecognized argument: ${1}"
+ return ${EXIT_ERROR}
+@@ -82,6 +98,12 @@ vlan_create() {
+ return ${EXIT_ERROR}
+ fi
+
++ # Check protocol
++ if ! vlan_supported_protocol "${protocol}"; then
++ log ERROR "Invalid protocol: ${protocol}"
++ return ${EXIT_ERROR}
++ fi
++
+ # Check VLAN ID
+ if ! vlan_valid_id "${id}"; then
+ log ERROR "Invalid VLAN ID: ${id}"
+@@ -103,7 +125,7 @@ vlan_create() {
+ # Make the command
+ local command=(
+ ip link add link "${parent}" name "${device}"
+- address "${address}" type vlan id "${id}"
++ address "${address}" type vlan proto "${protocol}" id "${id}"
+ )
+
+ # Run the command
+diff --git a/src/hooks/ports/vlan b/src/hooks/ports/vlan
+index 7f99dbc..af563ee 100644
+--- a/src/hooks/ports/vlan
++++ b/src/hooks/ports/vlan
+@@ -25,14 +25,21 @@ HOOK_SETTINGS=(
+ "ADDRESS"
+ "ID"
+ "PARENT_PORT"
++ "PROTOCOL"
+ )
+
++# Set the default to 802.1Q
++DEFAULT_PROTOCOL="${VLAN_SUPPORTED_PROTOCOLS[0]}"
++
+ PORT_PARENTS_VAR="PARENT_PORT"
+
+ hook_check_settings() {
+ assert ismac ADDRESS
+ assert isset PARENT_PORT
+
++ assert isset PROTOCOL
++ assert vlan_supported_protocol "${PROTOCOL}"
++
+ assert isinteger ID
+ assert vlan_valid_id "${ID}"
+ }
+@@ -74,6 +81,16 @@ hook_parse_cmdline() {
+ return ${EXIT_CONF_ERROR}
+ fi
+ ;;
++ --protocol=*)
++ PROTOCOL="$(cli_get_val "${1}")"
++
++ # Check if PROTOCOL is supported
++ if ! vlan_supported_protocol "${PROTOCOL}"; then
++ error "Protocol '${PROTOCOL}' is not supported"
++ error "Choose one of ${VLAN_SUPPORTED_PROTOCOLS[*]}"
++ return ${EXIT_CONF_ERROR}
++ fi
++ ;;
+ *)
+ error "Unknown argument '${1}'"
+ return ${EXIT_CONF_ERROR}
+@@ -114,8 +131,9 @@ hook_create() {
+ # Create the VLAN device
+ if ! vlan_create "${port}" \
+ --address="${ADDRESS}" \
+- --id="${id}" \
+- --parent="${PARENT_PORT}"; then
++ --id="${ID}" \
++ --parent="${PARENT_PORT}" \
++ --protocol="${PROTOCOL}"; then
+ error "Could not create port: ${port}"
+ return ${EXIT_ERROR}
+ fi
+--
+2.39.2
+
diff --git a/network/patches/0113-Do-not-try-to-start-Bird-during-boot-process.patch b/network/patches/0113-Do-not-try-to-start-Bird-during-boot-process.patch
new file mode 100644
index 000000000..7e25e5d9f
--- /dev/null
+++ b/network/patches/0113-Do-not-try-to-start-Bird-during-boot-process.patch
@@ -0,0 +1,57 @@
+From ecc7067479d165f4178f04248d86898cf50e3d95 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Thu, 20 Jun 2019 23:09:01 +0200
+Subject: [PATCH 113/304] Do not try to start Bird during boot process
+
+We should not do this in the network script and let just
+systemd take care of this. Otherwise we would end up in
+an infinite loop during the boot process.
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.bird | 14 --------------
+ src/network | 3 ---
+ 2 files changed, 17 deletions(-)
+
+diff --git a/src/functions/functions.bird b/src/functions/functions.bird
+index 1bbac8c..55d43b5 100644
+--- a/src/functions/functions.bird
++++ b/src/functions/functions.bird
+@@ -33,20 +33,6 @@ bird_reload() {
+ service_reload "bird.service"
+ }
+
+-bird_enable() {
+- # Generate configuration file
+- if ! bird_generate_config; then
+- log ERROR "Could not write Bird configuration"
+- return ${EXIT_ERROR}
+- fi
+-
+- # Enable the service to be automatically started next time
+- service_enable "bird.service"
+-
+- # Start it now
+- bird_start
+-}
+-
+ # Update configuration any apply it in one go
+ bird_update() {
+ if ! bird_generate_config; then
+diff --git a/src/network b/src/network
+index be06d8a..30f87a0 100644
+--- a/src/network
++++ b/src/network
+@@ -1381,9 +1381,6 @@ case "${action}" in
+ # Update resolv.conf(5) when initializing the network
+ dns_generate_resolvconf
+
+- # Make sure bird is running
+- bird_enable
+-
+ # Also execute all triggers
+ triggers_execute_all "init"
+ ;;
+--
+2.39.2
+
diff --git a/network/patches/0114-configure-Break-when-asciidoc-cannot-be-found.patch b/network/patches/0114-configure-Break-when-asciidoc-cannot-be-found.patch
new file mode 100644
index 000000000..1fc0c289d
--- /dev/null
+++ b/network/patches/0114-configure-Break-when-asciidoc-cannot-be-found.patch
@@ -0,0 +1,27 @@
+From 9665b7963d263fd83ac132a84a3809fc6a03287a Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 21 Jun 2019 06:30:44 +0100
+Subject: [PATCH 114/304] configure: Break when asciidoc cannot be found
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ configure.ac | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/configure.ac b/configure.ac
+index 117850f..340cfd6 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -144,6 +144,9 @@ PKG_CHECK_MODULES([LIBNL], [libnl-3.0 libnl-genl-3.0])
+ # ------------------------------------------------------------------------------
+
+ AC_CHECK_PROGS(ASCIIDOC, [asciidoc])
++if test -z "${ASCIIDOC}"; then
++ AC_MSG_ERROR([Required program 'asciidoc' not found])
++fi
+
+ # ------------------------------------------------------------------------------
+
+--
+2.39.2
+
diff --git a/network/patches/0115-Fix-creating-new-configs.patch b/network/patches/0115-Fix-creating-new-configs.patch
new file mode 100644
index 000000000..6f1c964e4
--- /dev/null
+++ b/network/patches/0115-Fix-creating-new-configs.patch
@@ -0,0 +1,29 @@
+From f1081966991d55ccd182b45f58fc0fde31437f77 Mon Sep 17 00:00:00 2001
+From: Stefan Schantl <stefan.schantl(a)ipfire.org>
+Date: Sat, 22 Jun 2019 09:52:37 +0000
+Subject: [PATCH 115/304] Fix creating new configs
+
+The id argument was missing for the zone_config_settings_write.
+
+Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/header-config | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/header-config b/src/header-config
+index c6a775c..ed647cd 100644
+--- a/src/header-config
++++ b/src/header-config
+@@ -45,7 +45,7 @@ hook_new() {
+ fi
+
+ # Write configuration to disk
+- if ! zone_config_settings_write "${zone}" "${HOOK}"; then
++ if ! zone_config_settings_write "${zone}" "${HOOK}" "${id}"; then
+ return ${EXIT_ERROR}
+ fi
+
+--
+2.39.2
+
diff --git a/network/patches/0116-inetcalc-Fix-compiler-warnings.patch b/network/patches/0116-inetcalc-Fix-compiler-warnings.patch
new file mode 100644
index 000000000..9b6dca279
--- /dev/null
+++ b/network/patches/0116-inetcalc-Fix-compiler-warnings.patch
@@ -0,0 +1,30 @@
+From d07532fad069c51d188ba7b93539488499d5dbf9 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 22 Jun 2019 13:31:03 +0000
+Subject: [PATCH 116/304] inetcalc: Fix compiler warnings
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/inetcalc.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/src/inetcalc.c b/src/inetcalc.c
+index 1841c84..7c072e9 100644
+--- a/src/inetcalc.c
++++ b/src/inetcalc.c
+@@ -134,9 +134,9 @@ static int default_prefix(const int family) {
+ static int ip_address_parse_simple(ip_address_t* ip, const int family, const char* address) {
+ assert(family == AF_INET || family == AF_INET6);
+
+- size_t address_length = strlen(address);
+- char buffer[address_length + 1];
+- strncpy(buffer, address, sizeof(buffer));
++ // Copy input to stack
++ char buffer[512];
++ strncpy(buffer, address, sizeof(buffer) - 1);
+
+ // Search for a prefix or subnet mask
+ char* prefix = strchr(buffer, '/');
+--
+2.39.2
+
diff --git a/network/patches/0117-firewall-Drop-separate-scripts-for-IPv6-and-IPv4.patch b/network/patches/0117-firewall-Drop-separate-scripts-for-IPv6-and-IPv4.patch
new file mode 100644
index 000000000..bb9f90e7a
--- /dev/null
+++ b/network/patches/0117-firewall-Drop-separate-scripts-for-IPv6-and-IPv4.patch
@@ -0,0 +1,70 @@
+From 0c5d22de5c22c9264dcb839df72440a1d11faa0c Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 21 Jun 2019 06:34:23 +0100
+Subject: [PATCH 117/304] firewall: Drop separate scripts for IPv6 and IPv4
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 3 +--
+ src/{firewall6 => firewall} | 0
+ src/firewall4 | 29 -----------------------------
+ 3 files changed, 1 insertion(+), 31 deletions(-)
+ rename src/{firewall6 => firewall} (100%)
+ delete mode 100644 src/firewall4
+
+diff --git a/Makefile.am b/Makefile.am
+index 4c26a9d..a36a4ab 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -115,8 +115,7 @@ dist_doc_DATA = \
+ dist_sbin_SCRIPTS = \
+ src/dhclient-script \
+ src/firewall-config \
+- src/firewall4 \
+- src/firewall6 \
++ src/firewall \
+ src/network
+
+ network_DATA = \
+diff --git a/src/firewall6 b/src/firewall
+similarity index 100%
+rename from src/firewall6
+rename to src/firewall
+diff --git a/src/firewall4 b/src/firewall4
+deleted file mode 100644
+index 55eed2c..0000000
+--- a/src/firewall4
++++ /dev/null
+@@ -1,29 +0,0 @@
+-#!/bin/bash
+-###############################################################################
+-# #
+-# IPFire.org - A linux based firewall #
+-# Copyright (C) 2012 IPFire Network Development Team #
+-# #
+-# This program is free software: you can redistribute it and/or modify #
+-# it under the terms of the GNU General Public License as published by #
+-# the Free Software Foundation, either version 3 of the License, or #
+-# (at your option) any later version. #
+-# #
+-# This program is distributed in the hope that it will be useful, #
+-# but WITHOUT ANY WARRANTY; without even the implied warranty of #
+-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
+-# GNU General Public License for more details. #
+-# #
+-# You should have received a copy of the GNU General Public License #
+-# along with this program. If not, see <http://www.gnu.org/licenses/>. #
+-# #
+-###############################################################################
+-
+-. /usr/lib/network/functions
+-
+-# Read firewall settings
+-firewall_settings_read
+-
+-firewall_cli "ipv4" "$@"
+-
+-exit ${EXIT_ERROR}
+--
+2.39.2
+
diff --git a/network/patches/0118-systemd-Remove-double-firewall-scripts.patch b/network/patches/0118-systemd-Remove-double-firewall-scripts.patch
new file mode 100644
index 000000000..d9090af5f
--- /dev/null
+++ b/network/patches/0118-systemd-Remove-double-firewall-scripts.patch
@@ -0,0 +1,76 @@
+From 67131768c979c66ad3717e46cb81a068b14eafee Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 22 Jun 2019 13:43:04 +0000
+Subject: [PATCH 118/304] systemd: Remove double firewall scripts
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 3 +--
+ .../{firewall4.service.in => firewall.service} | 6 +++---
+ src/systemd/firewall6.service.in | 14 --------------
+ 3 files changed, 4 insertions(+), 19 deletions(-)
+ rename src/systemd/{firewall4.service.in => firewall.service} (62%)
+ delete mode 100644 src/systemd/firewall6.service.in
+
+diff --git a/Makefile.am b/Makefile.am
+index a36a4ab..81cf50d 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -363,8 +363,7 @@ UNINSTALL_EXEC_HOOKS += ppp-uninstall-hook
+
+ if HAVE_SYSTEMD
+ systemdsystemunit_DATA = \
+- src/systemd/firewall4.service \
+- src/systemd/firewall6.service \
++ src/systemd/firewall.service \
+ src/systemd/firewall-init.service \
+ src/systemd/network-init.service \
+ src/systemd/network@.service
+diff --git a/src/systemd/firewall4.service.in b/src/systemd/firewall.service
+similarity index 62%
+rename from src/systemd/firewall4.service.in
+rename to src/systemd/firewall.service
+index 568f5e7..34797e5 100644
+--- a/src/systemd/firewall4.service.in
++++ b/src/systemd/firewall.service
+@@ -1,5 +1,5 @@
+ [Unit]
+-Description=Firewall for IPv4
++Description=Firewall for IPFire
+ After=firewall-init.service
+ Before=network.target
+ Requires=firewall-init.service
+@@ -7,8 +7,8 @@ Requires=firewall-init.service
+ [Service]
+ Type=oneshot
+ RemainAfterExit=yes
+-ExecStart=@sbindir@/firewall4 start
+-ExecStop=@sbindir@/firewall4 stop
++ExecStart=@sbindir@/firewall start
++ExecStop=@sbindir@/firewall stop
+
+ [Install]
+ WantedBy=multi-user.target
+diff --git a/src/systemd/firewall6.service.in b/src/systemd/firewall6.service.in
+deleted file mode 100644
+index 873bfe6..0000000
+--- a/src/systemd/firewall6.service.in
++++ /dev/null
+@@ -1,14 +0,0 @@
+-[Unit]
+-Description=Firewall for IPv6
+-After=firewall-init.service
+-Before=network.target
+-Requires=firewall-init.service
+-
+-[Service]
+-Type=oneshot
+-RemainAfterExit=yes
+-ExecStart=@sbindir@/firewall6 start
+-ExecStop=@sbindir@/firewall6 stop
+-
+-[Install]
+-WantedBy=multi-user.target
+--
+2.39.2
+
diff --git a/network/patches/0119-firewall-Add-init-action-to-main-script.patch b/network/patches/0119-firewall-Add-init-action-to-main-script.patch
new file mode 100644
index 000000000..82a8ae26e
--- /dev/null
+++ b/network/patches/0119-firewall-Add-init-action-to-main-script.patch
@@ -0,0 +1,54 @@
+From 3e446cf0bff8c1dc409479bf02b0fc8912847c13 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 22 Jun 2019 13:50:00 +0000
+Subject: [PATCH 119/304] firewall: Add init action to main script
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/firewall | 26 +++++++++++++++++++++++++-
+ 1 file changed, 25 insertions(+), 1 deletion(-)
+
+diff --git a/src/firewall b/src/firewall
+index db7284c..c47ac61 100644
+--- a/src/firewall
++++ b/src/firewall
+@@ -19,11 +19,35 @@
+ # #
+ ###############################################################################
+
++# Parse the command line
++while [ $# -gt 0 ]; do
++ case "${1}" in
++ -d|--debug)
++ DEBUG=1
++ ;;
++ *)
++ action=${1}
++ ;;
++ esac
++ shift
++ [ -n "${action}" ] && break
++done
++
+ . /usr/lib/network/functions
+
+ # Read firewall settings
+ firewall_settings_read
+
+-firewall_cli "ipv6" "$@"
++case "${action}" in
++ # Initialise kernel with firewall settings
++ init)
++ firewall_kernel_init
++ exit $?
++ ;;
++
++ *)
++ firewall_cli "ipv6" "${action}" "$@"
++ ;;
++esac
+
+ exit ${EXIT_ERROR}
+--
+2.39.2
+
diff --git a/network/patches/0120-firewall-Drop-initialisation-helper-script.patch b/network/patches/0120-firewall-Drop-initialisation-helper-script.patch
new file mode 100644
index 000000000..f77ad79db
--- /dev/null
+++ b/network/patches/0120-firewall-Drop-initialisation-helper-script.patch
@@ -0,0 +1,79 @@
+From 19b14da45fb83638878b14e77303194733679bc1 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 22 Jun 2019 13:52:09 +0000
+Subject: [PATCH 120/304] firewall: Drop initialisation helper script
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 1 -
+ src/helpers/firewall-kernel-init | 30 ----------------------------
+ src/systemd/firewall-init.service.in | 4 ++--
+ 3 files changed, 2 insertions(+), 33 deletions(-)
+ delete mode 100644 src/helpers/firewall-kernel-init
+
+diff --git a/Makefile.am b/Makefile.am
+index 81cf50d..0974ba8 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -206,7 +206,6 @@ dist_network_SCRIPTS = \
+
+ dist_helpers_SCRIPTS = \
+ src/helpers/dhcpd-config-helper \
+- src/helpers/firewall-kernel-init \
+ src/helpers/hostapd-config-helper \
+ src/helpers/ipsec-updown \
+ src/helpers/pppd-angel \
+diff --git a/src/helpers/firewall-kernel-init b/src/helpers/firewall-kernel-init
+deleted file mode 100644
+index aea82c4..0000000
+--- a/src/helpers/firewall-kernel-init
++++ /dev/null
+@@ -1,30 +0,0 @@
+-#!/bin/bash
+-###############################################################################
+-# #
+-# IPFire.org - A linux based firewall #
+-# Copyright (C) 2012 IPFire Network Development Team #
+-# #
+-# This program is free software: you can redistribute it and/or modify #
+-# it under the terms of the GNU General Public License as published by #
+-# the Free Software Foundation, either version 3 of the License, or #
+-# (at your option) any later version. #
+-# #
+-# This program is distributed in the hope that it will be useful, #
+-# but WITHOUT ANY WARRANTY; without even the implied warranty of #
+-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
+-# GNU General Public License for more details. #
+-# #
+-# You should have received a copy of the GNU General Public License #
+-# along with this program. If not, see <http://www.gnu.org/licenses/>. #
+-# #
+-###############################################################################
+-
+-. /usr/lib/network/functions
+-
+-# Read firewall settings
+-firewall_setttings_read
+-
+-# Initialize kernel parameters for the firewall.
+-firewall_kernel_init
+-
+-exit ${EXIT_OK}
+diff --git a/src/systemd/firewall-init.service.in b/src/systemd/firewall-init.service.in
+index 24497e9..91dd058 100644
+--- a/src/systemd/firewall-init.service.in
++++ b/src/systemd/firewall-init.service.in
+@@ -1,8 +1,8 @@
+ [Unit]
+-Description=Initialize kernel parameters for the firewalls
++Description=Initialize kernel parameters for the firewall
+ Before=network.target
+
+ [Service]
+ Type=oneshot
+ RemainAfterExit=yes
+-ExecStart=@helpersdir@/firewall-kernel-init
++ExecStart=@sbindir@/firewall init
+--
+2.39.2
+
diff --git a/network/patches/0121-Revert-firewall-Disable-PMTU-by-default.patch b/network/patches/0121-Revert-firewall-Disable-PMTU-by-default.patch
new file mode 100644
index 000000000..01c70c7be
--- /dev/null
+++ b/network/patches/0121-Revert-firewall-Disable-PMTU-by-default.patch
@@ -0,0 +1,28 @@
+From 70c56486267789a3767e22833548694a9b69e1b8 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 22 Jun 2019 13:55:00 +0000
+Subject: [PATCH 121/304] Revert "firewall: Disable PMTU by default"
+
+This reverts commit b3a66a5c00bc4e39ce0db34e2ac96c4911b4e31a.
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.constants-firewall | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/functions/functions.constants-firewall b/src/functions/functions.constants-firewall
+index 4f7f503..d42189a 100644
+--- a/src/functions/functions.constants-firewall
++++ b/src/functions/functions.constants-firewall
+@@ -78,7 +78,7 @@ FIREWALL_USE_ECN="true"
+ FIREWALL_CONFIG_PARAMS="${FIREWALL_CONFIG_PARAMS} FIREWALL_USE_ECN"
+
+ # Path MTU discovery
+-FIREWALL_PMTU_DISCOVERY="false"
++FIREWALL_PMTU_DISCOVERY="true"
+ FIREWALL_CONFIG_PARAMS="${FIREWALL_CONFIG_PARAMS} FIREWALL_PMTU_DISCOVERY"
+
+ # Default TTL
+--
+2.39.2
+
diff --git a/network/patches/0122-firewall-Fix-reading-writing-settings.patch b/network/patches/0122-firewall-Fix-reading-writing-settings.patch
new file mode 100644
index 000000000..d0cd4b263
--- /dev/null
+++ b/network/patches/0122-firewall-Fix-reading-writing-settings.patch
@@ -0,0 +1,147 @@
+From c69adafd8ad8abf4f14b6fe110bbd8efb5eca596 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 22 Jun 2019 14:11:15 +0000
+Subject: [PATCH 122/304] firewall: Fix reading/writing settings
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.constants-firewall | 40 ++++++++++++----------
+ src/functions/functions.settings | 6 ++--
+ 2 files changed, 25 insertions(+), 21 deletions(-)
+
+diff --git a/src/functions/functions.constants-firewall b/src/functions/functions.constants-firewall
+index d42189a..2ca9390 100644
+--- a/src/functions/functions.constants-firewall
++++ b/src/functions/functions.constants-firewall
+@@ -19,6 +19,10 @@
+ # #
+ ###############################################################################
+
++# Firewall file configuration
++FIREWALL_SETTINGS_DIR="/etc/firewall"
++FIREWALL_SETTINGS_FILE="${FIREWALL_SETTINGS_DIR}/settings"
++
+ # This variable is used to point to a directory
+ # in which the iptables ruleset will be generated.
+ IPTABLES_TMPDIR=
+@@ -32,78 +36,78 @@ FIREWALL_MACROS_DIRS="${FIREWALL_CONFIG_DIR}/macros"
+ FIREWALL_MACROS_DIRS="${FIREWALL_MACROS_DIRS} /usr/share/firewall/macros"
+
+ # List of parameters which are saved in the configuration file.
+-FIREWALL_CONFIG_PARAMS=""
++FIREWALL_SETTINGS=( "DEBUG" )
+
+ # Valid arguments in the rules file.
+ FIREWALL_RULES_CONFIG_PARAMS="src dst proto action sport dport in out"
+
+ # Define the default logging method (nflog or syslog).
+ FIREWALL_LOG_METHOD="nflog"
+-FIREWALL_CONFIG_PARAMS="${FIREWALL_CONFIG_PARAMS} FIREWALL_LOG_METHOD"
++FIREWALL_SETTINGS+=( "FIREWALL_LOG_METHOD" )
+
+ # Set the default threshold for the nflog method.
+ FIREWALL_NFLOG_THRESHOLD=30
+-FIREWALL_CONFIG_PARAMS="${FIREWALL_CONFIG_PARAMS} FIREWALL_NFLOG_THRESHOLD"
++FIREWALL_SETTINGS+=( "FIREWALL_NFLOG_THRESHOLD" )
+
+ # Enable clamping MSS for braindead ISPs which filter ICMP packets.
+ FIREWALL_CLAMP_PATH_MTU="false"
+-FIREWALL_CONFIG_PARAMS="${FIREWALL_CONFIG_PARAMS} FIREWALL_CLAMP_PATH_MTU"
++FIREWALL_SETTINGS+=( "FIREWALL_CLAMP_PATH_MTU" )
+
+ # Conntrack: Max. amount of simultaneous connections.
+ CONNTRACK_MAX_CONNECTIONS="16384"
+-FIREWALL_CONFIG_PARAMS="${FIREWALL_CONFIG_PARAMS} CONNTRACK_MAX_CONNECTIONS"
++FIREWALL_SETTINGS+=( "CONNTRACK_MAX_CONNECTIONS" )
+
+ # Conntrack: UDP timeout
+ CONNTRACK_UDP_TIMEOUT="60"
+-FIREWALL_CONFIG_PARAMS="${FIREWALL_CONFIG_PARAMS} CONNTRACK_UDP_TIMEOUT"
++FIREWALL_SETTINGS+=( "CONNTRACK_UDP_TIMEOUT" )
+
+ # Use SYN cookies or not
+ FIREWALL_SYN_COOKIES="true"
+-FIREWALL_CONFIG_PARAMS="${FIREWALL_CONFIG_PARAMS} FIREWALL_SYN_COOKIES"
++FIREWALL_SETTINGS+=( "FIREWALL_SYN_COOKIES" )
+
+ # rp_filter
+ FIREWALL_RP_FILTER="true"
+-FIREWALL_CONFIG_PARAMS="${FIREWALL_CONFIG_PARAMS} FIREWALL_RP_FILTER"
++FIREWALL_SETTINGS+=( "FIREWALL_RP_FILTER" )
+
+ # Log martians
+ FIREWALL_LOG_MARTIANS="false"
+-FIREWALL_CONFIG_PARAMS="${FIREWALL_CONFIG_PARAMS} FIREWALL_LOG_MARTIANS"
++FIREWALL_SETTINGS+=( "FIREWALL_LOG_MARTIANS" )
+
+ # Accept ICMP redirects
+ FIREWALL_ACCEPT_ICMP_REDIRECTS="false"
+-FIREWALL_CONFIG_PARAMS="${FIREWALL_CONFIG_PARAMS} FIREWALL_ACCEPT_ICMP_REDIRECTS"
++FIREWALL_SETTINGS+=( "FIREWALL_ACCEPT_ICMP_REDIRECTS" )
+
+ # ECN (Explicit Congestion Notification)
+ FIREWALL_USE_ECN="true"
+-FIREWALL_CONFIG_PARAMS="${FIREWALL_CONFIG_PARAMS} FIREWALL_USE_ECN"
++FIREWALL_SETTINGS+=( "FIREWALL_USE_ECN" )
+
+ # Path MTU discovery
+ FIREWALL_PMTU_DISCOVERY="true"
+-FIREWALL_CONFIG_PARAMS="${FIREWALL_CONFIG_PARAMS} FIREWALL_PMTU_DISCOVERY"
++FIREWALL_SETTINGS+=( "FIREWALL_PMTU_DISCOVERY" )
+
+ # Default TTL
+ FIREWALL_DEFAULT_TTL="64"
+-FIREWALL_CONFIG_PARAMS="${FIREWALL_CONFIG_PARAMS} FIREWALL_DEFAULT_TTL"
++FIREWALL_SETTINGS+=( "FIREWALL_DEFAULT_TTL" )
+
+ # Log stealth scans
+ FIREWALL_LOG_STEALTH_SCANS="true"
+-FIREWALL_CONFIG_PARAMS="${FIREWALL_CONFIG_PARAMS} FIREWALL_LOG_STEALTH_SCANS"
++FIREWALL_SETTINGS+=( "FIREWALL_LOG_STEALTH_SCANS" )
+
+ # Log packets with bad TCP flags
+ FIREWALL_LOG_BAD_TCP_FLAGS="true"
+-FIREWALL_CONFIG_PARAMS="${FIREWALL_CONFIG_PARAMS} FIREWALL_LOG_BAD_TCP_FLAGS"
++FIREWALL_SETTINGS+=( "FIREWALL_LOG_BAD_TCP_FLAGS" )
+
+ # Log INVALID TCP packets
+ FIREWALL_LOG_INVALID_TCP="true"
+-FIREWALL_CONFIG_PARAMS="${FIREWALL_CONFIG_PARAMS} FIREWALL_LOG_INVALID_TCP"
++FIREWALL_SETTINGS+=( "FIREWALL_LOG_INVALID_TCP" )
+
+ # Log INVALID UDP packets
+ FIREWALL_LOG_INVALID_UDP="true"
+-FIREWALL_CONFIG_PARAMS="${FIREWALL_CONFIG_PARAMS} FIREWALL_LOG_INVALID_UDP"
++FIREWALL_SETTINGS+=( "FIREWALL_LOG_INVALID_UDP" )
+
+ # Log INVALID ICMP packets
+ FIREWALL_LOG_INVALID_ICMP="true"
+-FIREWALL_CONFIG_PARAMS="${FIREWALL_CONFIG_PARAMS} FIREWALL_LOG_INVALID_ICMP"
++FIREWALL_SETTINGS+=( "FIREWALL_LOG_INVALID_ICMP" )
+
+ FIREWALL_SUPPORTED_PROTOCOLS="tcp udp icmp igmp esp ah gre"
+ FIREWALL_PROTOCOLS_SUPPORTING_PORTS="tcp udp"
+diff --git a/src/functions/functions.settings b/src/functions/functions.settings
+index 69f4c23..5728e72 100644
+--- a/src/functions/functions.settings
++++ b/src/functions/functions.settings
+@@ -297,13 +297,13 @@ network_settings_list() {
+ }
+
+ firewall_settings_read() {
+- settings_read "${FIREWALL_SETTINGS_FILE}" "${FIREWALL_SETTINGS_PARAMS}"
++ settings_read "${FIREWALL_SETTINGS_FILE}" "${FIREWALL_SETTINGS[*]}"
+ }
+
+ firewall_settings_write() {
+- settings_write "${FIREWALL_SETTINGS_FILE}" "${FIREWALL_SETTINGS_PARAMS}"
++ settings_write "${FIREWALL_SETTINGS_FILE}" "${FIREWALL_SETTINGS[*]}"
+ }
+
+ firewall_settings_print() {
+- settings_print "${FIREWALL_SETTINGS_PARAMS}"
++ settings_print "${FIREWALL_SETTINGS[*]}"
+ }
+--
+2.39.2
+
diff --git a/network/patches/0123-firewall-Drop-firewall-config-command-in-favour-of-f.patch b/network/patches/0123-firewall-Drop-firewall-config-command-in-favour-of-f.patch
new file mode 100644
index 000000000..8f26fe8ec
--- /dev/null
+++ b/network/patches/0123-firewall-Drop-firewall-config-command-in-favour-of-f.patch
@@ -0,0 +1,80 @@
+From 12c8f41a0791a517d5cc7cd30bd566896891f092 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 22 Jun 2019 14:16:07 +0000
+Subject: [PATCH 123/304] firewall: Drop firewall-config command in favour of
+ "firewall settings"
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 1 -
+ src/firewall | 5 +++++
+ src/firewall-config | 29 -----------------------------
+ 3 files changed, 5 insertions(+), 30 deletions(-)
+ delete mode 100644 src/firewall-config
+
+diff --git a/Makefile.am b/Makefile.am
+index 0974ba8..4fe5068 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -114,7 +114,6 @@ dist_doc_DATA = \
+
+ dist_sbin_SCRIPTS = \
+ src/dhclient-script \
+- src/firewall-config \
+ src/firewall \
+ src/network
+
+diff --git a/src/firewall b/src/firewall
+index c47ac61..569f413 100644
+--- a/src/firewall
++++ b/src/firewall
+@@ -45,6 +45,11 @@ case "${action}" in
+ exit $?
+ ;;
+
++ settings)
++ firewall_cli_settings "$@"
++ exit $?
++ ;;
++
+ *)
+ firewall_cli "ipv6" "${action}" "$@"
+ ;;
+diff --git a/src/firewall-config b/src/firewall-config
+deleted file mode 100644
+index 53ec175..0000000
+--- a/src/firewall-config
++++ /dev/null
+@@ -1,29 +0,0 @@
+-#!/bin/bash
+-###############################################################################
+-# #
+-# IPFire.org - A linux based firewall #
+-# Copyright (C) 2012 IPFire Network Development Team #
+-# #
+-# This program is free software: you can redistribute it and/or modify #
+-# it under the terms of the GNU General Public License as published by #
+-# the Free Software Foundation, either version 3 of the License, or #
+-# (at your option) any later version. #
+-# #
+-# This program is distributed in the hope that it will be useful, #
+-# but WITHOUT ANY WARRANTY; without even the implied warranty of #
+-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
+-# GNU General Public License for more details. #
+-# #
+-# You should have received a copy of the GNU General Public License #
+-# along with this program. If not, see <http://www.gnu.org/licenses/>. #
+-# #
+-###############################################################################
+-
+-. /usr/lib/network/functions
+-
+-# Read firewall settings
+-firewall_settings_read
+-
+-firewall_cli_settings "$@"
+-
+-exit ${EXIT_ERROR}
+--
+2.39.2
+
diff --git a/network/patches/0124-wireless-Do-not-attempt-DFS-when-reg-domain-is-set-t.patch b/network/patches/0124-wireless-Do-not-attempt-DFS-when-reg-domain-is-set-t.patch
new file mode 100644
index 000000000..d7e631785
--- /dev/null
+++ b/network/patches/0124-wireless-Do-not-attempt-DFS-when-reg-domain-is-set-t.patch
@@ -0,0 +1,30 @@
+From 038a7f3628f6b7648f89bb3ef6813e757fed6fec Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 23 Jun 2019 10:30:17 +0000
+Subject: [PATCH 124/304] wireless: Do not attempt DFS when reg domain is set
+ to world
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.wireless | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/src/functions/functions.wireless b/src/functions/functions.wireless
+index 733a356..860b2dd 100644
+--- a/src/functions/functions.wireless
++++ b/src/functions/functions.wireless
+@@ -555,6 +555,11 @@ wireless_supports_dfs() {
+ local device="${1}"
+ assert isset device
+
++ # DFS is not supported if wireless reg domain is set to world
++ if [ -n "${WIRELESS_REGULATORY_DOMAIN}" ] || [ "${WIRELESS_REGULATORY_DOMAIN}" = "00" ]; then
++ return ${EXIT_FALSE}
++ fi
++
+ local phy="$(device_get_phy "${device}")"
+ if ! isset phy; then
+ log ERROR "Could not determine PHY for ${device}"
+--
+2.39.2
+
diff --git a/network/patches/0125-bird-Start-service-when-needed-and-not-already-runni.patch b/network/patches/0125-bird-Start-service-when-needed-and-not-already-runni.patch
new file mode 100644
index 000000000..ad660cf7c
--- /dev/null
+++ b/network/patches/0125-bird-Start-service-when-needed-and-not-already-runni.patch
@@ -0,0 +1,42 @@
+From 0d99f882ea0f8c4b1c55f7107067a0cb35fedfb3 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 23 Jun 2019 10:33:48 +0000
+Subject: [PATCH 125/304] bird: Start service when needed and not already
+ running
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/functions/functions.bird | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/src/functions/functions.bird b/src/functions/functions.bird
+index 55d43b5..cbcb6e2 100644
+--- a/src/functions/functions.bird
++++ b/src/functions/functions.bird
+@@ -21,6 +21,10 @@
+
+ BIRD_CONF="/etc/bird.conf"
+
++bird_is_active() {
++ service_is_active "bird.service"
++}
++
+ bird_start() {
+ service_start "bird.service"
+ }
+@@ -41,7 +45,11 @@ bird_update() {
+ fi
+
+ # Reload bird
+- bird_reload
++ if bird_is_active; then
++ bird_reload
++ else
++ bird_start
++ fi
+ }
+
+ bird_generate_config() {
+--
+2.39.2
+
diff --git a/network/patches/0126-ip-tunnel-Support-setting-MTU-on-tunnels.patch b/network/patches/0126-ip-tunnel-Support-setting-MTU-on-tunnels.patch
new file mode 100644
index 000000000..78fc906ba
--- /dev/null
+++ b/network/patches/0126-ip-tunnel-Support-setting-MTU-on-tunnels.patch
@@ -0,0 +1,60 @@
+From 9515b03940a0fac2db3fff105638f49a53f85e7d Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 23 Jun 2019 11:57:17 +0000
+Subject: [PATCH 126/304] ip-tunnel: Support setting MTU on tunnels
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/hooks/zones/ip-tunnel | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/src/hooks/zones/ip-tunnel b/src/hooks/zones/ip-tunnel
+index c4a4fb4..3c885cb 100644
+--- a/src/hooks/zones/ip-tunnel
++++ b/src/hooks/zones/ip-tunnel
+@@ -26,6 +26,7 @@ SUPPORTED_IP_TUNNEL_MODES="gre sit vti"
+ HOOK_SETTINGS=(
+ "MARK"
+ "MODE"
++ "MTU"
+ "PEER"
+ "LOCAL_ADDRESS"
+ )
+@@ -33,6 +34,9 @@ HOOK_SETTINGS=(
+ # Default mode of the tunnel
+ DEFAULT_MODE="gre"
+
++# Default MTU
++DEFAULT_MTU="1480"
++
+ hook_check_settings() {
+ assert isset MODE && assert isoneof MODE ${SUPPORTED_IP_TUNNEL_MODES}
+
+@@ -67,6 +71,16 @@ hook_parse_cmdline() {
+ fi
+ ;;
+
++ --mtu=*)
++ MTU="$(cli_get_val "${1}")"
++
++ # Validate MTU
++ if ! mtu_is_valid "ipv6" "${MTU}"; then
++ error "Invalid MTU: ${MTU}"
++ return ${EXIT_ERROR}
++ fi
++ ;;
++
+ --peer=*)
+ PEER="$(cli_get_val "${1}")"
+ ;;
+@@ -116,6 +130,7 @@ hook_up() {
+ if ! device_exists "${zone}"; then
+ ip_tunnel_add "${zone}" \
+ --mode="${MODE}" \
++ --mtu="${MTU}" \
+ --remote-address="${PEER}" \
+ --local-address="${LOCAL_ADDRESS}" \
+ --ikey="${MARK}" \
+--
+2.39.2
+
diff --git a/network/patches/0127-firewall-Fix-generating-systemd-file.patch b/network/patches/0127-firewall-Fix-generating-systemd-file.patch
new file mode 100644
index 000000000..9248fb44f
--- /dev/null
+++ b/network/patches/0127-firewall-Fix-generating-systemd-file.patch
@@ -0,0 +1,33 @@
+From b41f1f866ef816e6ea7dd9e23e11e36a588ed611 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 23 Jun 2019 15:37:41 +0000
+Subject: [PATCH 127/304] firewall: Fix generating systemd file
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 3 +--
+ src/systemd/{firewall.service => firewall.service.in} | 0
+ 2 files changed, 1 insertion(+), 2 deletions(-)
+ rename src/systemd/{firewall.service => firewall.service.in} (100%)
+
+diff --git a/Makefile.am b/Makefile.am
+index 4fe5068..78da25f 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -374,8 +374,7 @@ INSTALL_DIRS += \
+ endif
+
+ EXTRA_DIST += \
+- src/systemd/firewall4.service.in \
+- src/systemd/firewall6.service.in \
++ src/systemd/firewall.service.in \
+ src/systemd/firewall-init.service.in \
+ src/systemd/network-init.service.in \
+ src/systemd/network@.service.in
+diff --git a/src/systemd/firewall.service b/src/systemd/firewall.service.in
+similarity index 100%
+rename from src/systemd/firewall.service
+rename to src/systemd/firewall.service.in
+--
+2.39.2
+
diff --git a/network/patches/0128-Make-generating-man-pages-optional.patch b/network/patches/0128-Make-generating-man-pages-optional.patch
new file mode 100644
index 000000000..1dd835994
--- /dev/null
+++ b/network/patches/0128-Make-generating-man-pages-optional.patch
@@ -0,0 +1,69 @@
+From dbe28a055de31302f0b8101e4e294394c6c2b63c Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 21 Jun 2019 14:37:03 +0100
+Subject: [PATCH 128/304] Make generating man-pages optional
+
+Fixes: #11862
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 4 +++-
+ configure.ac | 12 +++++++++++-
+ 2 files changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/Makefile.am b/Makefile.am
+index 78da25f..b6ba5ac 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -480,11 +480,13 @@ MANPAGES_XML = $(patsubst %.txt,%.xml,$(MANPAGES_TXT))
+ .PHONY: man
+ man: $(MANPAGES) $(MANPAGES_HTML)
+
++if ENABLE_MANPAGES
+ man_MANS = \
+ $(MANPAGES)
++endif
+
+ CLEANFILES += \
+- $(man_MANS) \
++ $(MANPAGES) \
+ $(MANPAGES_HTML) \
+ $(MANPAGES_XML)
+
+diff --git a/configure.ac b/configure.ac
+index 340cfd6..37c17e3 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -123,6 +123,14 @@ AS_IF([test "x$enable_debug" = "xyes"], [
+ AC_DEFINE(ENABLE_DEBUG, [1], [Debug messages.])
+ ])
+
++# ------------------------------------------------------------------------------
++
++have_manpages=no
++AC_ARG_ENABLE(manpages, AS_HELP_STRING([--disable-man-pages],
++ [do not install man pages]))
++AS_IF([test "x$enable_manpages" != xno], [have_manpages=yes])
++AM_CONDITIONAL(ENABLE_MANPAGES, [test "x$have_manpages" = "xyes"])
++
+ # ------------------------------------------------------------------------------
+ AC_ARG_WITH([systemdsystemunitdir],
+ AS_HELP_STRING([--with-systemdsystemunitdir=DIR], [Directory for systemd service files]),
+@@ -144,7 +152,7 @@ PKG_CHECK_MODULES([LIBNL], [libnl-3.0 libnl-genl-3.0])
+ # ------------------------------------------------------------------------------
+
+ AC_CHECK_PROGS(ASCIIDOC, [asciidoc])
+-if test -z "${ASCIIDOC}"; then
++if test "${have_manpages}" = "yes" && test -z "${ASCIIDOC}"; then
+ AC_MSG_ERROR([Required program 'asciidoc' not found])
+ fi
+
+@@ -167,4 +175,6 @@ AC_MSG_RESULT([
+
+ systemdsystemunitdir: $systemdsystemunitdir
+ udevdir: $udevdir
++
++ Generate man-pages: ${have_manpages}
+ ])
+--
+2.39.2
+
diff --git a/network/patches/0129-Add-documentation-for-the-IPsec-VPN.patch b/network/patches/0129-Add-documentation-for-the-IPsec-VPN.patch
new file mode 100644
index 000000000..4cf29d53f
--- /dev/null
+++ b/network/patches/0129-Add-documentation-for-the-IPsec-VPN.patch
@@ -0,0 +1,135 @@
+From 18bace574c15e966b8e3571cc00be287236162b5 Mon Sep 17 00:00:00 2001
+From: Jonatan Schlag <jonatan.schlag(a)ipfire.org>
+Date: Mon, 24 Jun 2019 13:30:14 +0200
+Subject: [PATCH 129/304] Add documentation for the IPsec VPN
+
+Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org>
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ man/network-vpn-ipsec.txt | 97 +++++++++++++++++++++++++++++++++++++++
+ man/network-vpn.txt | 5 ++
+ 2 files changed, 102 insertions(+)
+ create mode 100644 man/network-vpn-ipsec.txt
+
+diff --git a/man/network-vpn-ipsec.txt b/man/network-vpn-ipsec.txt
+new file mode 100644
+index 0000000..25347a8
+--- /dev/null
++++ b/man/network-vpn-ipsec.txt
+@@ -0,0 +1,97 @@
++= network-vpn-security-policies(8)
++
++== NAME
++network-ipsec - Configure IPsec VPN connections
++
++== SYNOPSIS
++[verse]
++'network vpn ipsec [new|destroy]' NAME...
++'network vpn ipsec' NAME COMMAND ...
++
++== DESCRIPTION
++With help of the 'vpn ipsec', it is possible to create, destroy
++and edit IPsec VPN connections.
++
++
++== COMMANDS
++The following commands are understood:
++
++'new NAME'::
++ A new IPsec VPN connection may be created with the 'new' command.
++ +
++ NAME does not allow any spaces.
++
++'destroy NAME'::
++ A IPsec VPN connection can be destroyed with this command.
++
++For all other commands, the name of the IPsec VPN connection needs to be passed first:
++
++'NAME show'::
++ Shows the configuration of the IPsec VPN connection
++
++'NAME authentication mode'::
++ Set the authentication mode out of the following available modes:
++ * psk
++
++'NAME authentication psk PSK'::
++ Set the pre-shared-key to PSK, only useful when the authentication mode is psk:
++
++include::include-color.txt[]
++
++include::include-description.txt[]
++
++'NAME down'::
++ Shutdown a etablished IPsec VPN connection
++
++'NAME inactivity-timeout TIME'::
++ Set the inactivity timeout with TIME in seconds or in the format hh:mm:ss
++
++'NAME local id ID'::
++ Specify the identity of the local system.
++ +
++ The ID must be in one of the following formats:
++ * IP address
++ * FQDN
++ * a string which starts with @
++
++'NAME local prefix [PREFIX-LIST|+PREFIX ...|-PREFIX ...]'::
++ Specify the subnets of the local system which should be made available to the remote peer.
++
++'NAME mode [transport|tunnel]'::
++ Set the mode of the IPsec VPN connection.
++
++'NAME peer PEER'::
++ Set the peer to which the IPsec VPN connection should be etablished.
++
++'NAME remote id ID'::
++ Specify the identity of the remote machine.
++ +
++ The ID must be in one of the following formats:
++ * IP address
++ * FQDN
++ * A string which starts with @
++
++'NAME remote prefix [PREFIX-LIST|+PREFIX ...|-PREFIX ...]'::
++ Specify the subnets which the remote side makes available to us.
++
++'NAME security-policy'::
++ Set the security policy which the connection uses.
++ +
++ See link:network-vpn-security-policies[8] for details.
++
++'NAME up'::
++ Establishes the IPsec VPN connection to the remote peer.
++
++'NAME zone'::
++ When you specify a zone of type ip-tunnel here the IPsec connection is established over a vti tunnel.
++ The remote and local prefixes are ignored. Imagine a fiber connection between this two machines, and how you would use it.
++ The IPsec VPN connection works in the same way. You must configure routes and IP addresses of the ip-tunnel hook manually.
++
++
++== AUTHORS
++Michael Tremer,
++Jonatan Schlag
++
++== SEE ALSO
++link:network[8],
++link:network-vpn[8]
+diff --git a/man/network-vpn.txt b/man/network-vpn.txt
+index 5a905db..be33606 100644
+--- a/man/network-vpn.txt
++++ b/man/network-vpn.txt
+@@ -19,6 +19,11 @@ The following commands are understood:
+ +
+ See link:network-vpn-security-policies[8] for details.
+
++'ipsec' ...::
++ Use this command to manage ipsec vpn connections.
++ +
++ See link:network-vpn-ipsec[8] for details.
++
+ == AUTHORS
+ Michael Tremer
+
+--
+2.39.2
+
diff --git a/network/patches/0130-Makefile-Add-network-vpn-ipsec-8.patch b/network/patches/0130-Makefile-Add-network-vpn-ipsec-8.patch
new file mode 100644
index 000000000..2832396ec
--- /dev/null
+++ b/network/patches/0130-Makefile-Add-network-vpn-ipsec-8.patch
@@ -0,0 +1,25 @@
+From 2612a6f4bb0bcc3e155425a653705146eb65d7cd Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 24 Jun 2019 13:28:01 +0100
+Subject: [PATCH 130/304] Makefile: Add network-vpn-ipsec(8)
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/Makefile.am b/Makefile.am
+index b6ba5ac..a5ea123 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -460,6 +460,7 @@ MANPAGES = \
+ man/network-route-static.8 \
+ man/network-settings.8 \
+ man/network-vpn.8 \
++ man/network-vpn-ipsec.8 \
+ man/network-vpn-security-policies.8 \
+ man/network-zone.8 \
+ man/network-zone-bridge.8 \
+--
+2.39.2
+
diff --git a/network/patches/0131-security-policies-performance-Remove-CBC-ciphers.patch b/network/patches/0131-security-policies-performance-Remove-CBC-ciphers.patch
new file mode 100644
index 000000000..92b549ec4
--- /dev/null
+++ b/network/patches/0131-security-policies-performance-Remove-CBC-ciphers.patch
@@ -0,0 +1,23 @@
+From 2cb783babd59716366984c8908e70285f23347f3 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 24 Jun 2019 13:28:12 +0100
+Subject: [PATCH 131/304] security-policies: performance: Remove CBC ciphers
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ config/vpn/security-policies/performance | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/config/vpn/security-policies/performance b/config/vpn/security-policies/performance
+index 9b8e943..b226d8d 100644
+--- a/config/vpn/security-policies/performance
++++ b/config/vpn/security-policies/performance
+@@ -1,4 +1,4 @@
+-CIPHERS="CHACHA20-POLY1305 AES128-GCM128 AES128-CBC"
++CIPHERS="CHACHA20-POLY1305 AES128-GCM128"
+ COMPRESSION="off"
+ GROUP_TYPES="ECP521 ECP384 ECP256 ECP224 ECP192 CURVE25519"
+ INTEGRITIES="SHA256"
+--
+2.39.2
+
diff --git a/network/patches/0132-IPsec-Add-support-for-Curve448.patch b/network/patches/0132-IPsec-Add-support-for-Curve448.patch
new file mode 100644
index 000000000..0238aad9a
--- /dev/null
+++ b/network/patches/0132-IPsec-Add-support-for-Curve448.patch
@@ -0,0 +1,65 @@
+From 27208caa363cad7c2250bdff5b99a9bc16a5ca91 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Wed, 2 Oct 2019 10:36:13 +0000
+Subject: [PATCH 132/304] IPsec: Add support for Curve448
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ config/vpn/security-policies/performance | 2 +-
+ config/vpn/security-policies/system | 2 +-
+ src/functions/functions.vpn-security-policies | 6 +++++-
+ 3 files changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/config/vpn/security-policies/performance b/config/vpn/security-policies/performance
+index b226d8d..209f43d 100644
+--- a/config/vpn/security-policies/performance
++++ b/config/vpn/security-policies/performance
+@@ -1,6 +1,6 @@
+ CIPHERS="CHACHA20-POLY1305 AES128-GCM128"
+ COMPRESSION="off"
+-GROUP_TYPES="ECP521 ECP384 ECP256 ECP224 ECP192 CURVE25519"
++GROUP_TYPES="CURVE25519 CURVE448 ECP521 ECP384 ECP256 ECP224 ECP192"
+ INTEGRITIES="SHA256"
+ PSEUDO_RANDOM_FUNCTIONS="SHA256"
+ KEY_EXCHANGE="ikev2"
+diff --git a/config/vpn/security-policies/system b/config/vpn/security-policies/system
+index db30e69..6ceb0c4 100644
+--- a/config/vpn/security-policies/system
++++ b/config/vpn/security-policies/system
+@@ -1,7 +1,7 @@
+ KEY_EXCHANGE="ikev2"
+ CIPHERS="CHACHA20-POLY1305 AES256-GCM128 AES256-CBC AES192-GCM128 AES192-CBC AES128-GCM128 AES128-CBC"
+ INTEGRITIES="SHA512 SHA384 SHA256"
+-GROUP_TYPES="CURVE25519 ECP521 ECP384 ECP256 ECP224 ECP192 MODP8192 MODP6144 MODP4096 MODP2048"
++GROUP_TYPES="CURVE25519 CURVE448 ECP521 ECP384 ECP256 ECP224 ECP192 MODP8192 MODP6144 MODP4096 MODP2048"
+ PSEUDO_RANDOM_FUNCTIONS="SHA512 SHA384 SHA256"
+ LIFETIME="28800"
+ PFS="on"
+diff --git a/src/functions/functions.vpn-security-policies b/src/functions/functions.vpn-security-policies
+index d1d720b..138e821 100644
+--- a/src/functions/functions.vpn-security-policies
++++ b/src/functions/functions.vpn-security-policies
+@@ -263,6 +263,9 @@ declare -A VPN_SUPPORTED_GROUP_TYPES=(
+
+ # Curve25519
+ [CURVE25519]="256 bit Elliptic Curve 25519"
++
++ # Curve448
++ [CURVE448]="224 bit Elliptic Curve 448"
+ )
+
+ declare -A GROUP_TYPE_TO_STRONGSWAN=(
+@@ -289,8 +292,9 @@ declare -A GROUP_TYPE_TO_STRONGSWAN=(
+ [ECP384BP]="ecp384bp"
+ [ECP512BP]="ecp512bp"
+
+- # Curve25519
++ # More Curves
+ [CURVE25519]="curve25519"
++ [CURVE448]="curve448"
+ )
+
+ cli_vpn_security_policies() {
+--
+2.39.2
+
diff --git a/network/patches/0133-Disable-copybreak.patch b/network/patches/0133-Disable-copybreak.patch
new file mode 100644
index 000000000..c1294c8fb
--- /dev/null
+++ b/network/patches/0133-Disable-copybreak.patch
@@ -0,0 +1,112 @@
+From ea4abb82bc6e613ddebd6235f792dd5bbbc469c9 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Thu, 7 May 2020 20:30:03 +0100
+Subject: [PATCH 133/304] Disable copybreak
+
+Some network interface drivers employ a scheme known as "copybreak"
+in which they make a copy of a received skb if the size of the
+buffer is below a particular threshold, then return the original
+receive skb back to the pool. Since these drivers initially
+allocate a buffer size that is larger than the largest possible
+packet, this scheme returns that large buffer to the pool quickly,
+and uses a smaller one.
+
+The primary benefit of copybreak is better memory utilization. On
+systems where the data is ultimately going to be copied out to user
+space, the copybreak scheme is "low cost" because it has the side
+benefit of priming the cache for that later copy. But on a router
+that only touches the header fields of a received packet, the cost
+can be relatively higher. And on modern systems the memory savings
+is rarely an important consideration.
+
+Some of the drivers that employ copybreak make the feature
+configurable via a module parameter. This file disables copybreak
+in some of those drivers. Generally this results in an improvement
+in forwarding performance for traffic using these drivers.
+
+Fixes: #11930
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org>
+---
+ Makefile.am | 6 +++++
+ src/modprobe.d/no-copybreak.conf | 44 ++++++++++++++++++++++++++++++++
+ 2 files changed, 50 insertions(+)
+ create mode 100644 src/modprobe.d/no-copybreak.conf
+
+diff --git a/Makefile.am b/Makefile.am
+index a5ea123..4aa7314 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -31,6 +31,7 @@ AUTOMAKE_OPTIONS = color-tests
+ configdir = $(sysconfdir)/network
+ bashcompletiondir= $(datadir)/bash-completion/completions
+ libexecdir = $(prefix)/lib
++modprobedir = $(prefix)/lib/modprobe.d
+ pkgconfigdir = $(libdir)/pkgconfig
+ pppdir = $(sysconfdir)/ppp
+ systemconfigdir = $(datadir)/network
+@@ -396,6 +397,11 @@ dist_sysctl_DATA = \
+
+ # ------------------------------------------------------------------------------
+
++dist_modprobe_DATA = \
++ src/modprobe.d/no-copybreak.conf
++
++# ------------------------------------------------------------------------------
++
+ dist_bashcompletion_SCRIPTS = \
+ src/bash-completion/network
+
+diff --git a/src/modprobe.d/no-copybreak.conf b/src/modprobe.d/no-copybreak.conf
+new file mode 100644
+index 0000000..97ea886
+--- /dev/null
++++ b/src/modprobe.d/no-copybreak.conf
+@@ -0,0 +1,44 @@
++#
++# Some network interface drivers employ a scheme known as "copybreak"
++# in which they make a copy of a received skb if the size of the
++# buffer is below a particular threshold, then return the original
++# receive skb back to the pool. Since these drivers initially
++# allocate a buffer size that is larger than the largest possible
++# packet, this scheme returns that large buffer to the pool quickly,
++# and uses a smaller one.
++#
++# The primary benefit of copybreak is better memory utilization. On
++# systems where the data is ultimately going to be copied out to user
++# space, the copybreak scheme is "low cost" because it has the side
++# benefit of priming the cache for that later copy. But on a router
++# that only touches the header fields of a received packet, the cost
++# can be relatively higher. And on modern systems the memory savings
++# is rarely an important consideration.
++#
++# Some of the drivers that employ copybreak make the feature
++# configurable via a module parameter. This file disables copybreak
++# in some of those drivers. Generally this results in an improvement
++# in forwarding performance for traffic using these drivers.
++#
++
++options 3c515 rx_copybreak=0
++options 3c59x rx_copybreak=0
++options bcm63xx copybreak=0
++options cxgb copybreak=0
++options e1000 copybreak=0
++options e1000e copybreak=0
++options epic100 rx_copybreak=0
++options fealnx rx_copybreak=0
++options hamachi rx_copybreak=0
++options ixgb copybreak=0
++options natsemi rx_copybreak=0
++options pch_gbe copybreak=0
++options pcnet32 rx_copybreak=0
++options sis190 rx_copybreak=0
++options sky2 copybreak=0
++options starfire rx_copybreak=0
++options sundance rx_copybreak=0
++options typhoon rx_copybreak=0
++options via-rhine rx_copybreak=0
++options via-velocity rx_copybreak=0
++options yellowfin rx_copybreak=0
+--
+2.39.2
+
diff --git a/network/patches/0134-configure-Check-for-libsystemd.patch b/network/patches/0134-configure-Check-for-libsystemd.patch
new file mode 100644
index 000000000..c47bd0bb8
--- /dev/null
+++ b/network/patches/0134-configure-Check-for-libsystemd.patch
@@ -0,0 +1,25 @@
+From ed993fc9d436da0788eca6f80374c9cd85b8bb9b Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 22 Jan 2023 12:33:11 +0000
+Subject: [PATCH 134/304] configure: Check for libsystemd
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ configure.ac | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/configure.ac b/configure.ac
+index 37c17e3..f3a9c17 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -148,6 +148,7 @@ AM_CONDITIONAL(HAVE_UDEV, [test -n "$with_udevdir"])
+ # ------------------------------------------------------------------------------
+
+ PKG_CHECK_MODULES([LIBNL], [libnl-3.0 libnl-genl-3.0])
++PKG_CHECK_MODULES([SYSTEMD], [libsystemd])
+
+ # ------------------------------------------------------------------------------
+
+--
+2.39.2
+
diff --git a/network/patches/0135-Makefile-Add-scaffolding-for-networkd.patch b/network/patches/0135-Makefile-Add-scaffolding-for-networkd.patch
new file mode 100644
index 000000000..1f716ffae
--- /dev/null
+++ b/network/patches/0135-Makefile-Add-scaffolding-for-networkd.patch
@@ -0,0 +1,93 @@
+From 050f4ece8900b9212de57b3564381d82540323aa Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 22 Jan 2023 12:41:47 +0000
+Subject: [PATCH 135/304] Makefile: Add scaffolding for networkd
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ .gitignore | 1 +
+ Makefile.am | 18 ++++++++++++++++++
+ src/networkd/main.c | 23 +++++++++++++++++++++++
+ 3 files changed, 42 insertions(+)
+ create mode 100644 src/networkd/main.c
+
+diff --git a/.gitignore b/.gitignore
+index bb093d3..e3bae67 100644
+--- a/.gitignore
++++ b/.gitignore
+@@ -3,6 +3,7 @@
+ /config.*
+ /libtool
+ /missing
++/networkd
+ /src/functions/functions
+ /src/inetcalc
+ /src/libnetwork/libnetwork.pc
+diff --git a/Makefile.am b/Makefile.am
+index 4aa7314..64ad94d 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -61,6 +61,7 @@ INSTALL_DIRS =
+ INSTALL_EXEC_HOOKS =
+ UNINSTALL_EXEC_HOOKS =
+ noinst_DATA =
++sbin_PROGRAMS =
+
+ AM_CPPFLAGS = \
+ $(OUR_CPPFLAGS) \
+@@ -299,6 +300,23 @@ EXTRA_DIST += \
+
+ # ------------------------------------------------------------------------------
+
++sbin_PROGRAMS += \
++ networkd
++
++dist_networkd_SOURCES = \
++ src/networkd/main.c
++
++networkd_CPPFLAGS = \
++ $(AM_CPPFLAGS)
++
++networkd_CFLAGS = \
++ $(AM_CFLAGS)
++
++networkd_LDFLAGS = \
++ $(AM_LDFLAGS)
++
++# ------------------------------------------------------------------------------
++
+ util_PROGRAMS = \
+ src/utils/network-phy-list-channels \
+ src/utils/network-phy-list-ciphers \
+diff --git a/src/networkd/main.c b/src/networkd/main.c
+new file mode 100644
+index 0000000..14aafdd
+--- /dev/null
++++ b/src/networkd/main.c
+@@ -0,0 +1,23 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++int main(int argc, char** argv) {
++ return 0;
++}
+--
+2.39.2
+
diff --git a/network/patches/0136-networkd-Link-against-systemd.patch b/network/patches/0136-networkd-Link-against-systemd.patch
new file mode 100644
index 000000000..0ff8ce40e
--- /dev/null
+++ b/network/patches/0136-networkd-Link-against-systemd.patch
@@ -0,0 +1,34 @@
+From 5d326bbb3f564cdb7031d80850bd3fe3c7565233 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 29 Jan 2023 21:18:34 +0000
+Subject: [PATCH 136/304] networkd: Link against systemd
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/Makefile.am b/Makefile.am
+index 64ad94d..74b2fae 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -310,11 +310,15 @@ networkd_CPPFLAGS = \
+ $(AM_CPPFLAGS)
+
+ networkd_CFLAGS = \
+- $(AM_CFLAGS)
++ $(AM_CFLAGS) \
++ $(SYSTEMD_CFLAGS)
+
+ networkd_LDFLAGS = \
+ $(AM_LDFLAGS)
+
++networkd_LDADD = \
++ $(SYSTEMD_LIBS)
++
+ # ------------------------------------------------------------------------------
+
+ util_PROGRAMS = \
+--
+2.39.2
+
diff --git a/network/patches/0137-networkd-Tell-systemd-about-the-daemon-status.patch b/network/patches/0137-networkd-Tell-systemd-about-the-daemon-status.patch
new file mode 100644
index 000000000..005bffe4b
--- /dev/null
+++ b/network/patches/0137-networkd-Tell-systemd-about-the-daemon-status.patch
@@ -0,0 +1,47 @@
+From 26acbb4e03e3a44e6046884eab25f6c7e376c105 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 29 Jan 2023 21:18:53 +0000
+Subject: [PATCH 137/304] networkd: Tell systemd about the daemon status
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/main.c | 24 +++++++++++++++++++++++-
+ 1 file changed, 23 insertions(+), 1 deletion(-)
+
+diff --git a/src/networkd/main.c b/src/networkd/main.c
+index 14aafdd..2429ff5 100644
+--- a/src/networkd/main.c
++++ b/src/networkd/main.c
+@@ -18,6 +18,28 @@
+ # #
+ #############################################################################*/
+
++#include <errno.h>
++#include <stdlib.h>
++
++#include <systemd/sd-daemon.h>
++#include <systemd/sd-event.h>
++
+ int main(int argc, char** argv) {
+- return 0;
++ // XXX Drop privileges
++
++ // We are now ready to process any requests
++ sd_notify(0, "READY=1\n" "STATUS=Processing requests...");
++
++ // Run event loop
++ // XXX TODO
++
++ // Let systemd know that we are shutting down
++ sd_notify(0, "STOPPING=1\n" "STATUS=Shutting down...");
++
++ return EXIT_SUCCESS;
++
++ERROR:
++ sd_notifyf(0, "ERRNO=%i", errno);
++
++ return EXIT_FAILURE;
+ }
+--
+2.39.2
+
diff --git a/network/patches/0138-networkd-Create-a-simple-daemon-class.patch b/network/patches/0138-networkd-Create-a-simple-daemon-class.patch
new file mode 100644
index 000000000..0ac30e734
--- /dev/null
+++ b/network/patches/0138-networkd-Create-a-simple-daemon-class.patch
@@ -0,0 +1,170 @@
+From 112358f3e2d40e148a259b1a7ab466c99947ed4b Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 29 Jan 2023 21:29:09 +0000
+Subject: [PATCH 138/304] networkd: Create a simple daemon class
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 2 ++
+ src/networkd/daemon.c | 56 +++++++++++++++++++++++++++++++++++++++++++
+ src/networkd/daemon.h | 31 ++++++++++++++++++++++++
+ src/networkd/main.c | 16 ++++++++++++-
+ 4 files changed, 104 insertions(+), 1 deletion(-)
+ create mode 100644 src/networkd/daemon.c
+ create mode 100644 src/networkd/daemon.h
+
+diff --git a/Makefile.am b/Makefile.am
+index 74b2fae..40d900e 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -304,6 +304,8 @@ sbin_PROGRAMS += \
+ networkd
+
+ dist_networkd_SOURCES = \
++ src/networkd/daemon.c \
++ src/networkd/daemon.h \
+ src/networkd/main.c
+
+ networkd_CPPFLAGS = \
+diff --git a/src/networkd/daemon.c b/src/networkd/daemon.c
+new file mode 100644
+index 0000000..f635f38
+--- /dev/null
++++ b/src/networkd/daemon.c
+@@ -0,0 +1,56 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#include <stdlib.h>
++
++#include "daemon.h"
++
++struct nw_daemon {
++ int nrefs;
++};
++
++int nw_daemon_create(struct nw_daemon** daemon) {
++ struct nw_daemon* d = calloc(1, sizeof(*d));
++ if (!d)
++ return 1;
++
++ // Initialize reference counter
++ d->nrefs = 1;
++
++ return 0;
++}
++
++static void nw_daemon_free(struct nw_daemon* daemon) {
++ free(daemon);
++}
++
++struct nw_daemon* nw_daemon_ref(struct nw_daemon* daemon) {
++ daemon->nrefs++;
++
++ return daemon;
++}
++
++struct nw_daemon* nw_daemon_unref(struct nw_daemon* daemon) {
++ if (--daemon->nrefs > 0)
++ return daemon;
++
++ nw_daemon_free(daemon);
++ return NULL;
++}
+diff --git a/src/networkd/daemon.h b/src/networkd/daemon.h
+new file mode 100644
+index 0000000..309794e
+--- /dev/null
++++ b/src/networkd/daemon.h
+@@ -0,0 +1,31 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#ifndef NETWORKD_DAEMON_H
++#define NETWORKD_DAEMON_H
++
++struct nw_daemon;
++
++int nw_daemon_create(struct nw_daemon** daemon);
++
++struct nw_daemon* nw_daemon_ref(struct nw_daemon* daemon);
++struct nw_daemon* nw_daemon_unref(struct nw_daemon* daemon);
++
++#endif /* NETWORKD_DAEMON_H */
+diff --git a/src/networkd/main.c b/src/networkd/main.c
+index 2429ff5..48fb2ae 100644
+--- a/src/networkd/main.c
++++ b/src/networkd/main.c
+@@ -24,9 +24,19 @@
+ #include <systemd/sd-daemon.h>
+ #include <systemd/sd-event.h>
+
++#include "daemon.h"
++
+ int main(int argc, char** argv) {
++ struct nw_daemon* daemon = NULL;
++ int r;
++
+ // XXX Drop privileges
+
++ // Create the daemon
++ r = nw_daemon_create(&daemon);
++ if (r)
++ goto ERROR;
++
+ // We are now ready to process any requests
+ sd_notify(0, "READY=1\n" "STATUS=Processing requests...");
+
+@@ -36,10 +46,14 @@ int main(int argc, char** argv) {
+ // Let systemd know that we are shutting down
+ sd_notify(0, "STOPPING=1\n" "STATUS=Shutting down...");
+
+- return EXIT_SUCCESS;
++ goto CLEANUP;
+
+ ERROR:
+ sd_notifyf(0, "ERRNO=%i", errno);
+
++CLEANUP:
++ if (daemon)
++ nw_daemon_unref(daemon);
++
+ return EXIT_FAILURE;
+ }
+--
+2.39.2
+
diff --git a/network/patches/0139-networkd-Create-an-event-loop.patch b/network/patches/0139-networkd-Create-an-event-loop.patch
new file mode 100644
index 000000000..aa45d9f2d
--- /dev/null
+++ b/network/patches/0139-networkd-Create-an-event-loop.patch
@@ -0,0 +1,147 @@
+From c7e1b5db6903099797cf700516706a827ae9cc3e Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 29 Jan 2023 21:49:22 +0000
+Subject: [PATCH 139/304] networkd: Create an event loop
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/daemon.c | 63 +++++++++++++++++++++++++++++++++++++++++++
+ src/networkd/daemon.h | 2 ++
+ src/networkd/main.c | 7 ++---
+ 3 files changed, 69 insertions(+), 3 deletions(-)
+
+diff --git a/src/networkd/daemon.c b/src/networkd/daemon.c
+index f635f38..25fdbdb 100644
+--- a/src/networkd/daemon.c
++++ b/src/networkd/daemon.c
+@@ -20,13 +20,44 @@
+
+ #include <stdlib.h>
+
++#include <systemd/sd-event.h>
++
+ #include "daemon.h"
+
+ struct nw_daemon {
+ int nrefs;
++
++ // Event Loop
++ sd_event* loop;
+ };
+
++static int nw_daemon_setup_loop(struct nw_daemon* daemon) {
++ int r;
++
++ // Fetch a reference to the default event loop
++ r = sd_event_default(&daemon->loop);
++ if (r < 0) {
++ //ERROR("Could not setup event loop: %m\n");
++ return 1;
++ }
++
++ return 0;
++}
++
++static int nw_daemon_setup(struct nw_daemon* daemon) {
++ int r;
++
++ // Setup the event loop
++ r = nw_daemon_setup_loop(daemon);
++ if (r)
++ return r;
++
++ return 0;
++}
++
+ int nw_daemon_create(struct nw_daemon** daemon) {
++ int r;
++
+ struct nw_daemon* d = calloc(1, sizeof(*d));
+ if (!d)
+ return 1;
+@@ -34,10 +65,26 @@ int nw_daemon_create(struct nw_daemon** daemon) {
+ // Initialize reference counter
+ d->nrefs = 1;
+
++ // Setup the daemon
++ r = nw_daemon_setup(d);
++ if (r)
++ goto ERROR;
++
++ // Set the reference
++ *daemon = d;
++
+ return 0;
++
++ERROR:
++ nw_daemon_unref(d);
++
++ return r;
+ }
+
+ static void nw_daemon_free(struct nw_daemon* daemon) {
++ if (daemon->loop)
++ sd_event_unref(daemon->loop);
++
+ free(daemon);
+ }
+
+@@ -54,3 +101,19 @@ struct nw_daemon* nw_daemon_unref(struct nw_daemon* daemon) {
+ nw_daemon_free(daemon);
+ return NULL;
+ }
++
++/*
++ This function contains the main loop of the daemon...
++*/
++int nw_daemon_run(struct nw_daemon* daemon) {
++ int r;
++
++ // Launch the event loop
++ r = sd_event_loop(daemon->loop);
++ if (r) {
++ //ERROR("Could not run the event loop: %m\n");
++ return r;
++ }
++
++ return 0;
++}
+diff --git a/src/networkd/daemon.h b/src/networkd/daemon.h
+index 309794e..215972d 100644
+--- a/src/networkd/daemon.h
++++ b/src/networkd/daemon.h
+@@ -28,4 +28,6 @@ int nw_daemon_create(struct nw_daemon** daemon);
+ struct nw_daemon* nw_daemon_ref(struct nw_daemon* daemon);
+ struct nw_daemon* nw_daemon_unref(struct nw_daemon* daemon);
+
++int nw_daemon_run(struct nw_daemon* daemon);
++
+ #endif /* NETWORKD_DAEMON_H */
+diff --git a/src/networkd/main.c b/src/networkd/main.c
+index 48fb2ae..80123ad 100644
+--- a/src/networkd/main.c
++++ b/src/networkd/main.c
+@@ -22,7 +22,6 @@
+ #include <stdlib.h>
+
+ #include <systemd/sd-daemon.h>
+-#include <systemd/sd-event.h>
+
+ #include "daemon.h"
+
+@@ -40,8 +39,10 @@ int main(int argc, char** argv) {
+ // We are now ready to process any requests
+ sd_notify(0, "READY=1\n" "STATUS=Processing requests...");
+
+- // Run event loop
+- // XXX TODO
++ // Run the daemon
++ r = nw_daemon_run(daemon);
++ if (r)
++ goto ERROR;
+
+ // Let systemd know that we are shutting down
+ sd_notify(0, "STOPPING=1\n" "STATUS=Shutting down...");
+--
+2.39.2
+
diff --git a/network/patches/0140-networkd-Enable-the-service-watchdog.patch b/network/patches/0140-networkd-Enable-the-service-watchdog.patch
new file mode 100644
index 000000000..6371661fe
--- /dev/null
+++ b/network/patches/0140-networkd-Enable-the-service-watchdog.patch
@@ -0,0 +1,31 @@
+From 3b2316e448ad4353964779b4c31edfe20b96ea4f Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 29 Jan 2023 21:53:19 +0000
+Subject: [PATCH 140/304] networkd: Enable the service watchdog
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/daemon.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/src/networkd/daemon.c b/src/networkd/daemon.c
+index 25fdbdb..c6acefe 100644
+--- a/src/networkd/daemon.c
++++ b/src/networkd/daemon.c
+@@ -41,6 +41,13 @@ static int nw_daemon_setup_loop(struct nw_daemon* daemon) {
+ return 1;
+ }
+
++ // Enable the watchdog
++ r = sd_event_set_watchdog(daemon->loop, 1);
++ if (r < 0) {
++ //ERROR("Could not activate watchdog: %m\n");
++ return 1;
++ }
++
+ return 0;
+ }
+
+--
+2.39.2
+
diff --git a/network/patches/0141-networkd-Add-some-very-simple-logging.patch b/network/patches/0141-networkd-Add-some-very-simple-logging.patch
new file mode 100644
index 000000000..e7e9ecb9a
--- /dev/null
+++ b/network/patches/0141-networkd-Add-some-very-simple-logging.patch
@@ -0,0 +1,104 @@
+From c251a9ddf0771b85af69f226e886bdd511e2353d Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 29 Jan 2023 21:57:32 +0000
+Subject: [PATCH 141/304] networkd: Add some very simple logging
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 1 +
+ src/networkd/daemon.c | 7 ++++---
+ src/networkd/logging.h | 32 ++++++++++++++++++++++++++++++++
+ 3 files changed, 37 insertions(+), 3 deletions(-)
+ create mode 100644 src/networkd/logging.h
+
+diff --git a/Makefile.am b/Makefile.am
+index 40d900e..abba646 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -306,6 +306,7 @@ sbin_PROGRAMS += \
+ dist_networkd_SOURCES = \
+ src/networkd/daemon.c \
+ src/networkd/daemon.h \
++ src/networkd/logging.h \
+ src/networkd/main.c
+
+ networkd_CPPFLAGS = \
+diff --git a/src/networkd/daemon.c b/src/networkd/daemon.c
+index c6acefe..4d21bb6 100644
+--- a/src/networkd/daemon.c
++++ b/src/networkd/daemon.c
+@@ -23,6 +23,7 @@
+ #include <systemd/sd-event.h>
+
+ #include "daemon.h"
++#include "logging.h"
+
+ struct nw_daemon {
+ int nrefs;
+@@ -37,14 +38,14 @@ static int nw_daemon_setup_loop(struct nw_daemon* daemon) {
+ // Fetch a reference to the default event loop
+ r = sd_event_default(&daemon->loop);
+ if (r < 0) {
+- //ERROR("Could not setup event loop: %m\n");
++ ERROR("Could not setup event loop: %m\n");
+ return 1;
+ }
+
+ // Enable the watchdog
+ r = sd_event_set_watchdog(daemon->loop, 1);
+ if (r < 0) {
+- //ERROR("Could not activate watchdog: %m\n");
++ ERROR("Could not activate watchdog: %m\n");
+ return 1;
+ }
+
+@@ -118,7 +119,7 @@ int nw_daemon_run(struct nw_daemon* daemon) {
+ // Launch the event loop
+ r = sd_event_loop(daemon->loop);
+ if (r) {
+- //ERROR("Could not run the event loop: %m\n");
++ ERROR("Could not run the event loop: %m\n");
+ return r;
+ }
+
+diff --git a/src/networkd/logging.h b/src/networkd/logging.h
+new file mode 100644
+index 0000000..9d51f21
+--- /dev/null
++++ b/src/networkd/logging.h
+@@ -0,0 +1,32 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#ifndef NETWORKD_LOGGING_H
++#define NETWORKD_LOGGING_H
++
++#include <stdio.h>
++
++/*
++ This is just something simple which will work for now...
++*/
++#define ERROR(...) fprintf(stderr, __VA_ARGS__)
++#define DEBUG(...) printf(__VA_ARGS__)
++
++#endif /* NETWORKD_LOGGING_H */
+--
+2.39.2
+
diff --git a/network/patches/0142-networkd-Register-SIGTERM-SIGINT-SIGHUP.patch b/network/patches/0142-networkd-Register-SIGTERM-SIGINT-SIGHUP.patch
new file mode 100644
index 000000000..61ba97e7c
--- /dev/null
+++ b/network/patches/0142-networkd-Register-SIGTERM-SIGINT-SIGHUP.patch
@@ -0,0 +1,90 @@
+From 025f60f1f2f22db43edd4bb52b6cff48ceb718a0 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 29 Jan 2023 22:24:53 +0000
+Subject: [PATCH 142/304] networkd: Register SIGTERM/SIGINT/SIGHUP
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/daemon.c | 46 +++++++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 44 insertions(+), 2 deletions(-)
+
+diff --git a/src/networkd/daemon.c b/src/networkd/daemon.c
+index 4d21bb6..483252d 100644
+--- a/src/networkd/daemon.c
++++ b/src/networkd/daemon.c
+@@ -18,7 +18,9 @@
+ # #
+ #############################################################################*/
+
++#include <errno.h>
+ #include <stdlib.h>
++#include <string.h>
+
+ #include <systemd/sd-event.h>
+
+@@ -32,20 +34,60 @@ struct nw_daemon {
+ sd_event* loop;
+ };
+
++static int nw_daemon_terminate(sd_event_source* source, const struct signalfd_siginfo* si,
++ void* data) {
++ DEBUG("Received signal to terminate...\n");
++
++ return sd_event_exit(sd_event_source_get_event(source), 0);
++}
++
++static int nw_daemon_reload(sd_event_source* source, const struct signalfd_siginfo* si,
++ void* data) {
++ DEBUG("Received signal to reload...\n");
++
++ // TODO
++
++ return 0;
++}
++
+ static int nw_daemon_setup_loop(struct nw_daemon* daemon) {
+ int r;
+
+ // Fetch a reference to the default event loop
+ r = sd_event_default(&daemon->loop);
+ if (r < 0) {
+- ERROR("Could not setup event loop: %m\n");
++ ERROR("Could not setup event loop: %s\n", strerror(-r));
+ return 1;
+ }
+
+ // Enable the watchdog
+ r = sd_event_set_watchdog(daemon->loop, 1);
+ if (r < 0) {
+- ERROR("Could not activate watchdog: %m\n");
++ ERROR("Could not activate watchdog: %s\n", strerror(-r));
++ return 1;
++ }
++
++ // Listen for SIGTERM
++ r = sd_event_add_signal(daemon->loop, NULL, SIGTERM|SD_EVENT_SIGNAL_PROCMASK,
++ nw_daemon_terminate, daemon);
++ if (r < 0) {
++ ERROR("Could not register handling SIGTERM: %s\n", strerror(-r));
++ return 1;
++ }
++
++ // Listen for SIGINT
++ r = sd_event_add_signal(daemon->loop, NULL, SIGINT|SD_EVENT_SIGNAL_PROCMASK,
++ nw_daemon_terminate, daemon);
++ if (r < 0) {
++ ERROR("Could not register handling SIGINT: %s\n", strerror(-r));
++ return 1;
++ }
++
++ // Listen for SIGHUP
++ r = sd_event_add_signal(daemon->loop, NULL, SIGHUP|SD_EVENT_SIGNAL_PROCMASK,
++ nw_daemon_reload, daemon);
++ if (r < 0) {
++ ERROR("Could not register handling SIGHUP: %s\n", strerror(-r));
+ return 1;
+ }
+
+--
+2.39.2
+
diff --git a/network/patches/0143-networkd-Add-scaffolding-to-reload-the-daemon.patch b/network/patches/0143-networkd-Add-scaffolding-to-reload-the-daemon.patch
new file mode 100644
index 000000000..e83dae62c
--- /dev/null
+++ b/network/patches/0143-networkd-Add-scaffolding-to-reload-the-daemon.patch
@@ -0,0 +1,93 @@
+From 27a3a5969dcc76cc7af7b0dd491703ee2c8baa70 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 29 Jan 2023 22:29:05 +0000
+Subject: [PATCH 143/304] networkd: Add scaffolding to reload the daemon
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/daemon.c | 23 +++++++++++++++++------
+ src/networkd/daemon.h | 2 ++
+ 2 files changed, 19 insertions(+), 6 deletions(-)
+
+diff --git a/src/networkd/daemon.c b/src/networkd/daemon.c
+index 483252d..98fb5bd 100644
+--- a/src/networkd/daemon.c
++++ b/src/networkd/daemon.c
+@@ -34,18 +34,21 @@ struct nw_daemon {
+ sd_event* loop;
+ };
+
+-static int nw_daemon_terminate(sd_event_source* source, const struct signalfd_siginfo* si,
++static int __nw_daemon_terminate(sd_event_source* source, const struct signalfd_siginfo* si,
+ void* data) {
+ DEBUG("Received signal to terminate...\n");
+
+ return sd_event_exit(sd_event_source_get_event(source), 0);
+ }
+
+-static int nw_daemon_reload(sd_event_source* source, const struct signalfd_siginfo* si,
++static int __nw_daemon_reload(sd_event_source* source, const struct signalfd_siginfo* si,
+ void* data) {
++ struct nw_daemon* daemon = (struct nw_daemon*)daemon;
++
+ DEBUG("Received signal to reload...\n");
+
+- // TODO
++ // Reload the daemon
++ nw_daemon_reload(daemon);
+
+ return 0;
+ }
+@@ -69,7 +72,7 @@ static int nw_daemon_setup_loop(struct nw_daemon* daemon) {
+
+ // Listen for SIGTERM
+ r = sd_event_add_signal(daemon->loop, NULL, SIGTERM|SD_EVENT_SIGNAL_PROCMASK,
+- nw_daemon_terminate, daemon);
++ __nw_daemon_terminate, daemon);
+ if (r < 0) {
+ ERROR("Could not register handling SIGTERM: %s\n", strerror(-r));
+ return 1;
+@@ -77,7 +80,7 @@ static int nw_daemon_setup_loop(struct nw_daemon* daemon) {
+
+ // Listen for SIGINT
+ r = sd_event_add_signal(daemon->loop, NULL, SIGINT|SD_EVENT_SIGNAL_PROCMASK,
+- nw_daemon_terminate, daemon);
++ __nw_daemon_terminate, daemon);
+ if (r < 0) {
+ ERROR("Could not register handling SIGINT: %s\n", strerror(-r));
+ return 1;
+@@ -85,7 +88,7 @@ static int nw_daemon_setup_loop(struct nw_daemon* daemon) {
+
+ // Listen for SIGHUP
+ r = sd_event_add_signal(daemon->loop, NULL, SIGHUP|SD_EVENT_SIGNAL_PROCMASK,
+- nw_daemon_reload, daemon);
++ __nw_daemon_reload, daemon);
+ if (r < 0) {
+ ERROR("Could not register handling SIGHUP: %s\n", strerror(-r));
+ return 1;
+@@ -167,3 +170,11 @@ int nw_daemon_run(struct nw_daemon* daemon) {
+
+ return 0;
+ }
++
++int nw_daemon_reload(struct nw_daemon* daemon) {
++ DEBUG("Reloading daemon...\n");
++
++ // XXX TODO
++
++ return 0;
++}
+diff --git a/src/networkd/daemon.h b/src/networkd/daemon.h
+index 215972d..5b14ef3 100644
+--- a/src/networkd/daemon.h
++++ b/src/networkd/daemon.h
+@@ -30,4 +30,6 @@ struct nw_daemon* nw_daemon_unref(struct nw_daemon* daemon);
+
+ int nw_daemon_run(struct nw_daemon* daemon);
+
++int nw_daemon_reload(struct nw_daemon* daemon);
++
+ #endif /* NETWORKD_DAEMON_H */
+--
+2.39.2
+
diff --git a/network/patches/0144-configure-Enable-system-extensions-to-define-_GNU_SO.patch b/network/patches/0144-configure-Enable-system-extensions-to-define-_GNU_SO.patch
new file mode 100644
index 000000000..ced811542
--- /dev/null
+++ b/network/patches/0144-configure-Enable-system-extensions-to-define-_GNU_SO.patch
@@ -0,0 +1,27 @@
+From 374d06ada7c1a3381aa08496abc7c9f173fd8d2f Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 29 Jan 2023 22:52:37 +0000
+Subject: [PATCH 144/304] configure: Enable system extensions to define
+ _GNU_SOURCE
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ configure.ac | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/configure.ac b/configure.ac
+index f3a9c17..b820794 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -65,6 +65,8 @@ AC_PROG_CC_C99
+ AC_PROG_CC_C_O
+ AC_PROG_GCC_TRADITIONAL
+
++AC_USE_SYSTEM_EXTENSIONS
++
+ CC_CHECK_FLAGS_APPEND([with_cflags], [CFLAGS], [\
+ -pipe \
+ -Wall \
+--
+2.39.2
+
diff --git a/network/patches/0145-networkd-Add-scaffolding-to-connect-to-dbus.patch b/network/patches/0145-networkd-Add-scaffolding-to-connect-to-dbus.patch
new file mode 100644
index 000000000..d7729101a
--- /dev/null
+++ b/network/patches/0145-networkd-Add-scaffolding-to-connect-to-dbus.patch
@@ -0,0 +1,255 @@
+From 09a6af1750714828bf109e17882ac0e7d0a6c738 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 30 Jan 2023 02:08:50 +0000
+Subject: [PATCH 145/304] networkd: Add scaffolding to connect to dbus
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 2 +
+ src/networkd/bus.c | 131 ++++++++++++++++++++++++++++++++++++++++++
+ src/networkd/bus.h | 35 +++++++++++
+ src/networkd/daemon.c | 12 ++++
+ 4 files changed, 180 insertions(+)
+ create mode 100644 src/networkd/bus.c
+ create mode 100644 src/networkd/bus.h
+
+diff --git a/Makefile.am b/Makefile.am
+index abba646..60a1bcd 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -304,6 +304,8 @@ sbin_PROGRAMS += \
+ networkd
+
+ dist_networkd_SOURCES = \
++ src/networkd/bus.c \
++ src/networkd/bus.h \
+ src/networkd/daemon.c \
+ src/networkd/daemon.h \
+ src/networkd/logging.h \
+diff --git a/src/networkd/bus.c b/src/networkd/bus.c
+new file mode 100644
+index 0000000..95862d2
+--- /dev/null
++++ b/src/networkd/bus.c
+@@ -0,0 +1,131 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#include <stdlib.h>
++#include <string.h>
++
++#include <systemd/sd-bus.h>
++#include <systemd/sd-event.h>
++
++#include "bus.h"
++#include "daemon.h"
++#include "logging.h"
++
++static int nw_bus_daemon_reload(sd_bus_message* m, void* data, sd_bus_error* ret_error) {
++ return 1;
++}
++
++static const sd_bus_vtable daemon_vtable[] = {
++ SD_BUS_VTABLE_START(0),
++ SD_BUS_METHOD("Reload", SD_BUS_NO_ARGS, SD_BUS_NO_RESULT,
++ nw_bus_daemon_reload, SD_BUS_VTABLE_UNPRIVILEGED),
++ SD_BUS_VTABLE_END,
++};
++
++int nw_bus_connect(sd_bus* bus, sd_event* loop) {
++ int r;
++
++ // Create a bus object
++ r = sd_bus_new(&bus);
++ if (r < 0) {
++ ERROR("Could not allocate a bus object: %s\n", strerror(-r));
++ return 1;
++ }
++
++ // Set description
++ r = sd_bus_set_description(bus, NETWORKD_BUS_DESCRIPTION);
++ if (r < 0) {
++ ERROR("Could not set bus description: %s\n", strerror(-r));
++ return 1;
++ }
++
++ const char* address = secure_getenv("DBUS_SYSTEM_BUS_ADDRESS");
++ if (!address)
++ address = DEFAULT_SYSTEM_BUS_ADDRESS;
++
++ // Set bus address
++ r = sd_bus_set_address(bus, address);
++ if (r < 0) {
++ ERROR("Could not set bus address: %s\n", strerror(-r));
++ return 1;
++ }
++
++ // Set bus client
++ r = sd_bus_set_bus_client(bus, 1);
++ if (r < 0) {
++ ERROR("Could not set bus client: %s\n", strerror(-r));
++ return 1;
++ }
++
++ // Request some credentials for all messages
++ r = sd_bus_negotiate_creds(bus, 1,
++ SD_BUS_CREDS_UID|SD_BUS_CREDS_EUID|SD_BUS_CREDS_EFFECTIVE_CAPS);
++ if (r < 0) {
++ ERROR("Could not negotiate creds: %s\n", strerror(-r));
++ return 1;
++ }
++
++ // Automatically bind when the socket is available
++ r = sd_bus_set_watch_bind(bus, 1);
++ if (r < 0) {
++ ERROR("Could not watch socket: %s\n", strerror(-r));
++ return 1;
++ }
++
++ // Emit a connected signal when we are connected
++ r = sd_bus_set_connected_signal(bus, 1);
++ if (r < 0) {
++ ERROR("Could not enable sending a connect signal: %s\n", strerror(-r));
++ return 1;
++ }
++
++ // Connect to the bus
++ r = sd_bus_start(bus);
++ if (r < 0) {
++ ERROR("Could not connect to bus: %s\n", strerror(-r));
++ return 1;
++ }
++
++ // Register any functions
++ r = sd_bus_add_object_vtable(bus, NULL,
++ NETWORKD_BUS_OBJECT_PATH, NETWORKD_BUS_INTERFACE_NAME, daemon_vtable, NULL);
++ if (r < 0) {
++ ERROR("Could not add object vtable: %s\n", strerror(-r));
++ return 1;
++ }
++
++ // Request interface name
++ // XXX Should this be async?
++ // XXX How do we get the actual error message from dbus?
++ r = sd_bus_request_name(bus, NETWORKD_BUS_INTERFACE_NAME, 0);
++ if (r < 0) {
++ ERROR("Could not request bus name: %s\n", strerror(-r));
++ return 1;
++ }
++
++ // Attach the event loop
++ r = sd_bus_attach_event(bus, loop, 0);
++ if (r < 0) {
++ ERROR("Could not attach bus to event loop: %s\n", strerror(-r));
++ return 1;
++ }
++
++ return 0;
++}
+diff --git a/src/networkd/bus.h b/src/networkd/bus.h
+new file mode 100644
+index 0000000..90c1556
+--- /dev/null
++++ b/src/networkd/bus.h
+@@ -0,0 +1,35 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#ifndef NETWORKD_BUS_H
++#define NETWORKD_BUS_H
++
++#define NETWORKD_BUS_DESCRIPTION "networkd"
++#define NETWORKD_BUS_OBJECT_PATH "/org/ipfire/network1"
++#define NETWORKD_BUS_INTERFACE_NAME "org.ipfire.network1"
++
++#define DEFAULT_SYSTEM_BUS_ADDRESS "unix:path=/run/dbus/system_bus_socket"
++
++#include <systemd/sd-bus.h>
++#include <systemd/sd-event.h>
++
++int nw_bus_connect(sd_bus* bus, sd_event* loop);
++
++#endif /* NETWORKD_BUS_H */
+diff --git a/src/networkd/daemon.c b/src/networkd/daemon.c
+index 98fb5bd..3aee8ca 100644
+--- a/src/networkd/daemon.c
++++ b/src/networkd/daemon.c
+@@ -22,8 +22,10 @@
+ #include <stdlib.h>
+ #include <string.h>
+
++#include <systemd/sd-bus.h>
+ #include <systemd/sd-event.h>
+
++#include "bus.h"
+ #include "daemon.h"
+ #include "logging.h"
+
+@@ -32,6 +34,9 @@ struct nw_daemon {
+
+ // Event Loop
+ sd_event* loop;
++
++ // DBus Connection
++ sd_bus* bus;
+ };
+
+ static int __nw_daemon_terminate(sd_event_source* source, const struct signalfd_siginfo* si,
+@@ -105,6 +110,11 @@ static int nw_daemon_setup(struct nw_daemon* daemon) {
+ if (r)
+ return r;
+
++ // Connect to the system bus
++ r = nw_bus_connect(daemon->bus, daemon->loop);
++ if (r)
++ return r;
++
+ return 0;
+ }
+
+@@ -135,6 +145,8 @@ ERROR:
+ }
+
+ static void nw_daemon_free(struct nw_daemon* daemon) {
++ if (daemon->bus)
++ sd_bus_unref(daemon->bus);
+ if (daemon->loop)
+ sd_event_unref(daemon->loop);
+
+--
+2.39.2
+
diff --git a/network/patches/0146-networkd-Add-scaffolding-for-config-objects.patch b/network/patches/0146-networkd-Add-scaffolding-for-config-objects.patch
new file mode 100644
index 000000000..c50840ce3
--- /dev/null
+++ b/network/patches/0146-networkd-Add-scaffolding-for-config-objects.patch
@@ -0,0 +1,131 @@
+From 6b666d6221c5797f78fa4942561c931609d8f656 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 30 Jan 2023 02:16:06 +0000
+Subject: [PATCH 146/304] networkd: Add scaffolding for config objects
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 2 ++
+ src/networkd/config.c | 58 +++++++++++++++++++++++++++++++++++++++++++
+ src/networkd/config.h | 31 +++++++++++++++++++++++
+ 3 files changed, 91 insertions(+)
+ create mode 100644 src/networkd/config.c
+ create mode 100644 src/networkd/config.h
+
+diff --git a/Makefile.am b/Makefile.am
+index 60a1bcd..50a6034 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -306,6 +306,8 @@ sbin_PROGRAMS += \
+ dist_networkd_SOURCES = \
+ src/networkd/bus.c \
+ src/networkd/bus.h \
++ src/networkd/config.c \
++ src/networkd/config.h \
+ src/networkd/daemon.c \
+ src/networkd/daemon.h \
+ src/networkd/logging.h \
+diff --git a/src/networkd/config.c b/src/networkd/config.c
+new file mode 100644
+index 0000000..d18fb12
+--- /dev/null
++++ b/src/networkd/config.c
+@@ -0,0 +1,58 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#include <stdlib.h>
++
++#include "config.h"
++
++struct nw_config {
++ int nrefs;
++};
++
++static void nw_config_free(struct nw_config* config) {
++ free(config);
++}
++
++int nw_config_create(struct nw_config** config) {
++ struct nw_config* c = calloc(1, sizeof(*c));
++ if (!c)
++ return 1;
++
++ // Initialize reference counter
++ c->nrefs = 1;
++
++ *config = c;
++
++ return 0;
++}
++
++struct nw_config* nw_config_ref(struct nw_config* config) {
++ config->nrefs++;
++
++ return config;
++}
++
++struct nw_config* nw_config_unref(struct nw_config* config) {
++ if (--config->nrefs > 0)
++ return config;
++
++ nw_config_free(config);
++ return NULL;
++}
+diff --git a/src/networkd/config.h b/src/networkd/config.h
+new file mode 100644
+index 0000000..a8aed7f
+--- /dev/null
++++ b/src/networkd/config.h
+@@ -0,0 +1,31 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#ifndef NETWORKD_CONFIG_H
++#define NETWORKD_CONFIG_H
++
++struct nw_config;
++
++int nw_config_create(struct nw_config** config);
++
++struct nw_config* nw_config_ref(struct nw_config* config);
++struct nw_config* nw_config_unref(struct nw_config* config);
++
++#endif /* NETWORKD_CONFIG_H */
+--
+2.39.2
+
diff --git a/network/patches/0147-networkd-Add-scaffolding-to-read-configuration-files.patch b/network/patches/0147-networkd-Add-scaffolding-to-read-configuration-files.patch
new file mode 100644
index 000000000..18b7e2aa7
--- /dev/null
+++ b/network/patches/0147-networkd-Add-scaffolding-to-read-configuration-files.patch
@@ -0,0 +1,94 @@
+From c81a6335fd0e1912fa3e8268ba85b9cd048cf243 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 30 Jan 2023 02:26:41 +0000
+Subject: [PATCH 147/304] networkd: Add scaffolding to read configuration files
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/config.c | 50 +++++++++++++++++++++++++++++++++++++++++++
+ src/networkd/config.h | 3 +++
+ 2 files changed, 53 insertions(+)
+
+diff --git a/src/networkd/config.c b/src/networkd/config.c
+index d18fb12..e808531 100644
+--- a/src/networkd/config.c
++++ b/src/networkd/config.c
+@@ -18,9 +18,11 @@
+ # #
+ #############################################################################*/
+
++#include <stdio.h>
+ #include <stdlib.h>
+
+ #include "config.h"
++#include "logging.h"
+
+ struct nw_config {
+ int nrefs;
+@@ -56,3 +58,51 @@ struct nw_config* nw_config_unref(struct nw_config* config) {
+ nw_config_free(config);
+ return NULL;
+ }
++
++static int nw_config_parse(struct nw_config* config, FILE* f) {
++ // XXX TODO
++
++ return 0;
++}
++
++int nw_config_readf(struct nw_config** config, FILE* f) {
++ int r;
++
++ // Create a new config object
++ r = nw_config_create(config);
++ if (r)
++ return r;
++
++ // Parse the configuration
++ r = nw_config_parse(*config, f);
++ if (r)
++ goto ERROR;
++
++ return 0;
++
++ERROR:
++ nw_config_free(*config);
++ return r;
++}
++
++int nw_config_read(struct nw_config** config, const char* path) {
++ FILE* f = NULL;
++ int r;
++
++ // Open the file
++ f = fopen(path, "r");
++ if (!f) {
++ ERROR("Could not read configuration file %s: %m\n", path);
++ r = 1;
++ goto ERROR;
++ }
++
++ // Read from file
++ r = nw_config_readf(config, f);
++
++ERROR:
++ if (f)
++ fclose(f);
++
++ return r;
++}
+diff --git a/src/networkd/config.h b/src/networkd/config.h
+index a8aed7f..559ba94 100644
+--- a/src/networkd/config.h
++++ b/src/networkd/config.h
+@@ -28,4 +28,7 @@ int nw_config_create(struct nw_config** config);
+ struct nw_config* nw_config_ref(struct nw_config* config);
+ struct nw_config* nw_config_unref(struct nw_config* config);
+
++int nw_config_readf(struct nw_config** config, FILE* f);
++int nw_config_read(struct nw_config** config, const char* path);
++
+ #endif /* NETWORKD_CONFIG_H */
+--
+2.39.2
+
diff --git a/network/patches/0148-networkd-Implement-setting-configuration-values.patch b/network/patches/0148-networkd-Implement-setting-configuration-values.patch
new file mode 100644
index 000000000..cc2641125
--- /dev/null
+++ b/network/patches/0148-networkd-Implement-setting-configuration-values.patch
@@ -0,0 +1,283 @@
+From 4237caa2ed47385e3471822348d908846c745b29 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 30 Jan 2023 03:04:01 +0000
+Subject: [PATCH 148/304] networkd: Implement setting configuration values
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 3 +-
+ src/networkd/config.c | 114 ++++++++++++++++++++++++++++++++++++++++++
+ src/networkd/config.h | 7 +++
+ src/networkd/string.h | 76 ++++++++++++++++++++++++++++
+ 4 files changed, 199 insertions(+), 1 deletion(-)
+ create mode 100644 src/networkd/string.h
+
+diff --git a/Makefile.am b/Makefile.am
+index 50a6034..1b18f62 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -311,7 +311,8 @@ dist_networkd_SOURCES = \
+ src/networkd/daemon.c \
+ src/networkd/daemon.h \
+ src/networkd/logging.h \
+- src/networkd/main.c
++ src/networkd/main.c \
++ src/networkd/string.h
+
+ networkd_CPPFLAGS = \
+ $(AM_CPPFLAGS)
+diff --git a/src/networkd/config.c b/src/networkd/config.c
+index e808531..72a0cfb 100644
+--- a/src/networkd/config.c
++++ b/src/networkd/config.c
+@@ -18,17 +18,72 @@
+ # #
+ #############################################################################*/
+
++#include <errno.h>
+ #include <stdio.h>
+ #include <stdlib.h>
++#include <string.h>
++#include <sys/queue.h>
+
+ #include "config.h"
+ #include "logging.h"
++#include "string.h"
++
++struct nw_config_entry {
++ STAILQ_ENTRY(nw_config_entry) nodes;
++
++ char key[NETWORK_CONFIG_KEY_MAX_LENGTH];
++ char value[NETWORK_CONFIG_KEY_MAX_LENGTH];
++};
+
+ struct nw_config {
+ int nrefs;
++
++ STAILQ_HEAD(entries, nw_config_entry) entries;
+ };
+
++static void nw_config_entry_free(struct nw_config_entry* entry) {
++ free(entry);
++}
++
++static struct nw_config_entry* nw_config_entry_create(
++ struct nw_config* config, const char* key) {
++ int r;
++
++ // Check input value
++ if (!key) {
++ errno = EINVAL;
++ return NULL;
++ }
++
++ // Allocate a new object
++ struct nw_config_entry* entry = calloc(1, sizeof(*entry));
++ if (!entry)
++ return NULL;
++
++ // Store the key
++ r = nw_string_set(entry->key, key);
++ if (r)
++ goto ERROR;
++
++ // Append the new entry
++ STAILQ_INSERT_TAIL(&config->entries, entry, nodes);
++
++ERROR:
++ nw_config_entry_free(entry);
++ return NULL;
++}
++
+ static void nw_config_free(struct nw_config* config) {
++ struct nw_config_entry* entry = NULL;
++
++ while (!STAILQ_EMPTY(&config->entries)) {
++ entry = STAILQ_FIRST(&config->entries);
++ STAILQ_REMOVE_HEAD(&config->entries, nodes);
++
++ // Free the entry
++ nw_config_entry_free(entry);
++ }
++
+ free(config);
+ }
+
+@@ -40,6 +95,9 @@ int nw_config_create(struct nw_config** config) {
+ // Initialize reference counter
+ c->nrefs = 1;
+
++ // Initialise entries
++ STAILQ_INIT(&c->entries);
++
+ *config = c;
+
+ return 0;
+@@ -106,3 +164,59 @@ ERROR:
+
+ return r;
+ }
++
++static struct nw_config_entry* nw_config_find(struct nw_config* config, const char* key) {
++ struct nw_config_entry* entry = NULL;
++
++ STAILQ_FOREACH(entry, &config->entries, nodes) {
++ // Key must match
++ if (strcmp(entry->key, key) != 0)
++ continue;
++
++ // Match!
++ return entry;
++ }
++
++ // No match
++ return NULL;
++}
++
++int nw_config_del(struct nw_config* config, const char* key) {
++ struct nw_config_entry* entry = NULL;
++
++ // Find an entry matching the key
++ entry = nw_config_find(config, key);
++
++ // If there is no entry, there is nothing to do
++ if (!entry)
++ return 0;
++
++ // Otherwise remove the object
++ STAILQ_REMOVE(&config->entries, entry, nw_config_entry, nodes);
++
++ // Free the entry
++ nw_config_entry_free(entry);
++
++ return 0;
++}
++
++int nw_config_set(struct nw_config* config, const char* key, const char* value) {
++ struct nw_config_entry* entry = NULL;
++
++ // Delete the entry if val is NULL
++ if (!value)
++ return nw_config_del(config, key);
++
++ // Find any existing entries
++ entry = nw_config_find(config, key);
++
++ // Create a new entry if it doesn't exist, yet
++ if (!entry) {
++ entry = nw_config_entry_create(config, key);
++ if (!entry)
++ return 1;
++ }
++
++ // Store the new value
++ return nw_string_set(entry->value, value);
++}
+diff --git a/src/networkd/config.h b/src/networkd/config.h
+index 559ba94..a793229 100644
+--- a/src/networkd/config.h
++++ b/src/networkd/config.h
+@@ -21,6 +21,9 @@
+ #ifndef NETWORKD_CONFIG_H
+ #define NETWORKD_CONFIG_H
+
++#define NETWORK_CONFIG_KEY_MAX_LENGTH 128
++#define NETWORK_CONFIG_VALUE_MAX_LENGTH 2048
++
+ struct nw_config;
+
+ int nw_config_create(struct nw_config** config);
+@@ -31,4 +34,8 @@ struct nw_config* nw_config_unref(struct nw_config* config);
+ int nw_config_readf(struct nw_config** config, FILE* f);
+ int nw_config_read(struct nw_config** config, const char* path);
+
++int nw_config_del(struct nw_config* config, const char* key);
++
++int nw_config_set(struct nw_config* config, const char* key, const char* value);
++
+ #endif /* NETWORKD_CONFIG_H */
+diff --git a/src/networkd/string.h b/src/networkd/string.h
+new file mode 100644
+index 0000000..3ac4846
+--- /dev/null
++++ b/src/networkd/string.h
+@@ -0,0 +1,76 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#ifndef NETWORKD_STRING_H
++#define NETWORKD_STRING_H
++
++#include <stdarg.h>
++
++static inline int __nw_string_vformat(char* s, const size_t length,
++ const char* format, va_list args) {
++ // Write string to buffer
++ const ssize_t required = vsnprintf(s, length, format, args);
++
++ // Catch any errors
++ if (required < 0)
++ return 1;
++
++ // Check if the entire string could be written
++ if ((size_t)required >= length) {
++ errno = ENOMEM;
++ return 1;
++ }
++
++ // Success
++ return 0;
++}
++
++#define nw_string_format(s, format, ...) \
++ __nw_string_format(s, sizeof(s), format, __VA_ARGS__)
++
++static inline int __nw_string_format(char* s, const size_t length,
++ const char* format, ...) {
++ va_list args;
++ int r;
++
++ // Call __nw_string_vformat
++ va_start(args, format);
++ r = __nw_string_vformat(s, length, format, args);
++ va_end(args);
++
++ return r;
++}
++
++#define nw_string_set(s, value) __nw_string_set(s, sizeof(s), value)
++
++static inline int __nw_string_set(char* s, const size_t length, const char* value) {
++ // If value is NULL, we will overwrite the buffer with just zeros
++ if (!value) {
++ for (unsigned int i = 0; i < length; i++)
++ s[i] = '\0';
++
++ return 0;
++ }
++
++ // Otherwise just copy
++ return __nw_string_format(s, length, "%s", value);
++}
++
++#endif /* NETWORKD_STRING_H */
+--
+2.39.2
+
diff --git a/network/patches/0149-networkd-Implement-reading-configuration-values.patch b/network/patches/0149-networkd-Implement-reading-configuration-values.patch
new file mode 100644
index 000000000..b008145bd
--- /dev/null
+++ b/network/patches/0149-networkd-Implement-reading-configuration-values.patch
@@ -0,0 +1,55 @@
+From d39683a626fd7f5fe2aea15365a27b3f7727ad0b Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 30 Jan 2023 03:09:57 +0000
+Subject: [PATCH 149/304] networkd: Implement reading configuration values
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/config.c | 21 +++++++++++++++++++++
+ src/networkd/config.h | 3 +++
+ 2 files changed, 24 insertions(+)
+
+diff --git a/src/networkd/config.c b/src/networkd/config.c
+index 72a0cfb..a3db7c6 100644
+--- a/src/networkd/config.c
++++ b/src/networkd/config.c
+@@ -220,3 +220,24 @@ int nw_config_set(struct nw_config* config, const char* key, const char* value)
+ // Store the new value
+ return nw_string_set(entry->value, value);
+ }
++
++const char* nw_config_get(struct nw_config* config, const char* key) {
++ struct nw_config_entry* entry = nw_config_find(config, key);
++
++ // Return the value if found and set
++ if (entry && *entry->value)
++ return entry->value;
++
++ // Otherwise return NULL
++ return NULL;
++}
++
++unsigned int nw_config_get_unsigned_int(struct nw_config* config, const char* key) {
++ const char* value = nw_config_get(config, key);
++
++ // Return zero if not set
++ if (!value)
++ return 0;
++
++ return strtoul(value, NULL, 10);
++}
+diff --git a/src/networkd/config.h b/src/networkd/config.h
+index a793229..c5a2f7f 100644
+--- a/src/networkd/config.h
++++ b/src/networkd/config.h
+@@ -38,4 +38,7 @@ int nw_config_del(struct nw_config* config, const char* key);
+
+ int nw_config_set(struct nw_config* config, const char* key, const char* value);
+
++const char* nw_config_get(struct nw_config* config, const char* key);
++unsigned int nw_config_get_unsigned_int(struct nw_config* config, const char* key);
++
+ #endif /* NETWORKD_CONFIG_H */
+--
+2.39.2
+
diff --git a/network/patches/0150-networkd-Implement-writing-configuration-files.patch b/network/patches/0150-networkd-Implement-writing-configuration-files.patch
new file mode 100644
index 000000000..c66dda673
--- /dev/null
+++ b/network/patches/0150-networkd-Implement-writing-configuration-files.patch
@@ -0,0 +1,79 @@
+From d3dfdb77779004950cf3afb19e456b7d5c39c940 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 30 Jan 2023 03:17:30 +0000
+Subject: [PATCH 150/304] networkd: Implement writing configuration files
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/config.c | 40 ++++++++++++++++++++++++++++++++++++++++
+ src/networkd/config.h | 3 +++
+ 2 files changed, 43 insertions(+)
+
+diff --git a/src/networkd/config.c b/src/networkd/config.c
+index a3db7c6..b2a23f0 100644
+--- a/src/networkd/config.c
++++ b/src/networkd/config.c
+@@ -165,6 +165,46 @@ ERROR:
+ return r;
+ }
+
++int nw_config_writef(struct nw_config* config, FILE* f) {
++ struct nw_config_entry* entry = NULL;
++ int r;
++
++ STAILQ_FOREACH(entry, &config->entries, nodes) {
++ // Skip if value is NULL
++ if (!*entry->value)
++ continue;
++
++ // Write the entry
++ r = fprintf(f, "%s=\"%s\"\n", entry->key, entry->value);
++ if (r < 0) {
++ ERROR("Failed to write configuration: %m\n");
++ return r;
++ }
++ }
++
++ return 0;
++}
++
++int nw_config_write(struct nw_config* config, const char* path) {
++ int r;
++
++ FILE* f = fopen(path, "w");
++ if (!f) {
++ ERROR("Failed to open %s for writing: %m\n", path);
++ r = 1;
++ goto ERROR;
++ }
++
++ // Write configuration
++ r = nw_config_writef(config, f);
++
++ERROR:
++ if (f)
++ fclose(f);
++
++ return r;
++}
++
+ static struct nw_config_entry* nw_config_find(struct nw_config* config, const char* key) {
+ struct nw_config_entry* entry = NULL;
+
+diff --git a/src/networkd/config.h b/src/networkd/config.h
+index c5a2f7f..90e73f4 100644
+--- a/src/networkd/config.h
++++ b/src/networkd/config.h
+@@ -34,6 +34,9 @@ struct nw_config* nw_config_unref(struct nw_config* config);
+ int nw_config_readf(struct nw_config** config, FILE* f);
+ int nw_config_read(struct nw_config** config, const char* path);
+
++int nw_config_writef(struct nw_config* config, FILE* f);
++int nw_config_write(struct nw_config* config, const char* path);
++
+ int nw_config_del(struct nw_config* config, const char* key);
+
+ int nw_config_set(struct nw_config* config, const char* key, const char* value);
+--
+2.39.2
+
diff --git a/network/patches/0151-networkd-Read-main-configuration-file.patch b/network/patches/0151-networkd-Read-main-configuration-file.patch
new file mode 100644
index 000000000..4a6a2ee67
--- /dev/null
+++ b/network/patches/0151-networkd-Read-main-configuration-file.patch
@@ -0,0 +1,54 @@
+From 2ac78f288a7c1f8b363cf0c86fc196aeeb8e8264 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 30 Jan 2023 03:20:23 +0000
+Subject: [PATCH 151/304] networkd: Read main configuration file
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/daemon.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/src/networkd/daemon.c b/src/networkd/daemon.c
+index 3aee8ca..bd5f1f0 100644
+--- a/src/networkd/daemon.c
++++ b/src/networkd/daemon.c
+@@ -26,12 +26,15 @@
+ #include <systemd/sd-event.h>
+
+ #include "bus.h"
++#include "config.h"
+ #include "daemon.h"
+ #include "logging.h"
+
+ struct nw_daemon {
+ int nrefs;
+
++ struct nw_config* config;
++
+ // Event Loop
+ sd_event* loop;
+
+@@ -105,6 +108,11 @@ static int nw_daemon_setup_loop(struct nw_daemon* daemon) {
+ static int nw_daemon_setup(struct nw_daemon* daemon) {
+ int r;
+
++ // Read configuration file
++ r = nw_config_read(&daemon->config, "/etc/network/settings");
++ if (r)
++ return r;
++
+ // Setup the event loop
+ r = nw_daemon_setup_loop(daemon);
+ if (r)
+@@ -145,6 +153,8 @@ ERROR:
+ }
+
+ static void nw_daemon_free(struct nw_daemon* daemon) {
++ if (daemon->config)
++ nw_config_unref(daemon->config);
+ if (daemon->bus)
+ sd_bus_unref(daemon->bus);
+ if (daemon->loop)
+--
+2.39.2
+
diff --git a/network/patches/0152-networkd-Set-configuration-path-from-build-scripts.patch b/network/patches/0152-networkd-Set-configuration-path-from-build-scripts.patch
new file mode 100644
index 000000000..a06cb3b29
--- /dev/null
+++ b/network/patches/0152-networkd-Set-configuration-path-from-build-scripts.patch
@@ -0,0 +1,41 @@
+From 5c1452a43a6a8d3d3596fa8be38741e62852ce5c Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 30 Jan 2023 03:29:45 +0000
+Subject: [PATCH 152/304] networkd: Set configuration path from build scripts
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 3 ++-
+ src/networkd/daemon.c | 2 +-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/Makefile.am b/Makefile.am
+index 1b18f62..3cc7ce9 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -315,7 +315,8 @@ dist_networkd_SOURCES = \
+ src/networkd/string.h
+
+ networkd_CPPFLAGS = \
+- $(AM_CPPFLAGS)
++ $(AM_CPPFLAGS) \
++ -DCONFIG_DIR="\"$(configdir)\""
+
+ networkd_CFLAGS = \
+ $(AM_CFLAGS) \
+diff --git a/src/networkd/daemon.c b/src/networkd/daemon.c
+index bd5f1f0..9077c54 100644
+--- a/src/networkd/daemon.c
++++ b/src/networkd/daemon.c
+@@ -109,7 +109,7 @@ static int nw_daemon_setup(struct nw_daemon* daemon) {
+ int r;
+
+ // Read configuration file
+- r = nw_config_read(&daemon->config, "/etc/network/settings");
++ r = nw_config_read(&daemon->config, CONFIG_DIR "/settings");
+ if (r)
+ return r;
+
+--
+2.39.2
+
diff --git a/network/patches/0153-networkd-Add-scaffolding-for-zones.patch b/network/patches/0153-networkd-Add-scaffolding-for-zones.patch
new file mode 100644
index 000000000..8b720d38f
--- /dev/null
+++ b/network/patches/0153-networkd-Add-scaffolding-for-zones.patch
@@ -0,0 +1,192 @@
+From e4eebc6e6a0091729831fd1361d0a9fd0d205114 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 30 Jan 2023 03:42:57 +0000
+Subject: [PATCH 153/304] networkd: Add scaffolding for zones
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 4 ++-
+ src/networkd/config.h | 2 ++
+ src/networkd/string.h | 3 ++
+ src/networkd/zone.c | 83 +++++++++++++++++++++++++++++++++++++++++++
+ src/networkd/zone.h | 35 ++++++++++++++++++
+ 5 files changed, 126 insertions(+), 1 deletion(-)
+ create mode 100644 src/networkd/zone.c
+ create mode 100644 src/networkd/zone.h
+
+diff --git a/Makefile.am b/Makefile.am
+index 3cc7ce9..5bb9c4d 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -312,7 +312,9 @@ dist_networkd_SOURCES = \
+ src/networkd/daemon.h \
+ src/networkd/logging.h \
+ src/networkd/main.c \
+- src/networkd/string.h
++ src/networkd/string.h \
++ src/networkd/zone.c \
++ src/networkd/zone.h
+
+ networkd_CPPFLAGS = \
+ $(AM_CPPFLAGS) \
+diff --git a/src/networkd/config.h b/src/networkd/config.h
+index 90e73f4..3474ae1 100644
+--- a/src/networkd/config.h
++++ b/src/networkd/config.h
+@@ -21,6 +21,8 @@
+ #ifndef NETWORKD_CONFIG_H
+ #define NETWORKD_CONFIG_H
+
++#include <stdio.h>
++
+ #define NETWORK_CONFIG_KEY_MAX_LENGTH 128
+ #define NETWORK_CONFIG_VALUE_MAX_LENGTH 2048
+
+diff --git a/src/networkd/string.h b/src/networkd/string.h
+index 3ac4846..52b5add 100644
+--- a/src/networkd/string.h
++++ b/src/networkd/string.h
+@@ -21,7 +21,10 @@
+ #ifndef NETWORKD_STRING_H
+ #define NETWORKD_STRING_H
+
++#include <errno.h>
+ #include <stdarg.h>
++#include <stdio.h>
++#include <string.h>
+
+ static inline int __nw_string_vformat(char* s, const size_t length,
+ const char* format, va_list args) {
+diff --git a/src/networkd/zone.c b/src/networkd/zone.c
+new file mode 100644
+index 0000000..5066c4b
+--- /dev/null
++++ b/src/networkd/zone.c
+@@ -0,0 +1,83 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#include <stdlib.h>
++
++#include "config.h"
++#include "string.h"
++#include "zone.h"
++
++struct nw_zone {
++ int nrefs;
++
++ char name[NETWORK_ZONE_NAME_MAX_LENGTH];
++
++ // Configuration
++ struct nw_config *config;
++};
++
++static void nw_zone_free(struct nw_zone* zone) {
++ if (zone->config)
++ nw_config_unref(zone->config);
++
++ free(zone);
++}
++
++int nw_zone_create(struct nw_zone** zone, const char* name) {
++ int r;
++
++ // Allocate a new object
++ struct nw_zone* z = calloc(1, sizeof(*z));
++ if (!z)
++ return 1;
++
++ // Initialize reference counter
++ z->nrefs = 1;
++
++ // Store the name
++ r = nw_string_set(z->name, name);
++ if (r)
++ goto ERROR;
++
++ *zone = z;
++ return 0;
++
++ERROR:
++ nw_zone_free(z);
++ return r;
++}
++
++struct nw_zone* nw_zone_ref(struct nw_zone* zone) {
++ zone->nrefs++;
++
++ return zone;
++}
++
++struct nw_zone* nw_zone_unref(struct nw_zone* zone) {
++ if (--zone->nrefs > 0)
++ return zone;
++
++ nw_zone_free(zone);
++ return NULL;
++}
++
++const char* nw_zone_name(struct nw_zone* zone) {
++ return zone->name;
++}
+diff --git a/src/networkd/zone.h b/src/networkd/zone.h
+new file mode 100644
+index 0000000..78287ab
+--- /dev/null
++++ b/src/networkd/zone.h
+@@ -0,0 +1,35 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#ifndef NETWORKD_ZONE_H
++#define NETWORKD_ZONE_H
++
++#define NETWORK_ZONE_NAME_MAX_LENGTH 16
++
++struct nw_zone;
++
++int nw_zone_create(struct nw_zone** zone, const char* name);
++
++struct nw_zone* nw_zone_ref(struct nw_zone* zone);
++struct nw_zone* nw_zone_unref(struct nw_zone* zone);
++
++const char* nw_zone_name(struct nw_zone* zone);
++
++#endif /* NETWORKD_ZONE_H */
+--
+2.39.2
+
diff --git a/network/patches/0154-networkd-Install-a-dbus-service-file.patch b/network/patches/0154-networkd-Install-a-dbus-service-file.patch
new file mode 100644
index 000000000..c5fdc33df
--- /dev/null
+++ b/network/patches/0154-networkd-Install-a-dbus-service-file.patch
@@ -0,0 +1,82 @@
+From 063eb4d841e8fc4625d889a9d5f8ac832bd60f0d Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 30 Jan 2023 04:05:07 +0000
+Subject: [PATCH 154/304] networkd: Install a dbus service file
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 4 ++++
+ configure.ac | 15 +++++++++++++++
+ src/networkd/org.ipfire.network1.service | 5 +++++
+ 3 files changed, 24 insertions(+)
+ create mode 100644 src/networkd/org.ipfire.network1.service
+
+diff --git a/Makefile.am b/Makefile.am
+index 5bb9c4d..5cfeefa 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -62,6 +62,7 @@ INSTALL_EXEC_HOOKS =
+ UNINSTALL_EXEC_HOOKS =
+ noinst_DATA =
+ sbin_PROGRAMS =
++dist_dbussystembusdir_DATA =
+
+ AM_CPPFLAGS = \
+ $(OUR_CPPFLAGS) \
+@@ -330,6 +331,9 @@ networkd_LDFLAGS = \
+ networkd_LDADD = \
+ $(SYSTEMD_LIBS)
+
++dist_dbussystembusdir_DATA += \
++ src/networkd/org.ipfire.network1.service
++
+ # ------------------------------------------------------------------------------
+
+ util_PROGRAMS = \
+diff --git a/configure.ac b/configure.ac
+index b820794..8634a39 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -133,6 +133,20 @@ AC_ARG_ENABLE(manpages, AS_HELP_STRING([--disable-man-pages],
+ AS_IF([test "x$enable_manpages" != xno], [have_manpages=yes])
+ AM_CONDITIONAL(ENABLE_MANPAGES, [test "x$have_manpages" = "xyes"])
+
++# ------------------------------------------------------------------------------
++
++AC_ARG_WITH([dbussystembusdir], AS_HELP_STRING([--with-dbussystembusdir=DIR],
++ [path to D-Bus system bus services directory]), [with_dbussystembusdir=${withval}])
++if test -z "${with_dbussystembusdir}"; then
++ AC_MSG_CHECKING([D-Bus system bus services dir])
++ with_dbussystembusdir="$($PKG_CONFIG --variable=system_bus_services_dir dbus-1)"
++ if test -z "${with_dbussystembusdir}"; then
++ AC_MSG_ERROR([D-Bus system bus services directory is required])
++ fi
++ AC_MSG_RESULT([${with_dbussystembusdir}])
++fi
++AC_SUBST(dbussystembusdir, [${with_dbussystembusdir}])
++
+ # ------------------------------------------------------------------------------
+ AC_ARG_WITH([systemdsystemunitdir],
+ AS_HELP_STRING([--with-systemdsystemunitdir=DIR], [Directory for systemd service files]),
+@@ -176,6 +190,7 @@ AC_MSG_RESULT([
+
+ prefix: $prefix
+
++ dbussystembusdir: ${dbussystembusdir}
+ systemdsystemunitdir: $systemdsystemunitdir
+ udevdir: $udevdir
+
+diff --git a/src/networkd/org.ipfire.network1.service b/src/networkd/org.ipfire.network1.service
+new file mode 100644
+index 0000000..fdeda66
+--- /dev/null
++++ b/src/networkd/org.ipfire.network1.service
+@@ -0,0 +1,5 @@
++[D-BUS Service]
++Name=org.ipfire.network1
++Exec=/bin/false
++User=root
++SystemdService=dbus-org.ipfire.network1.service
+--
+2.39.2
+
diff --git a/network/patches/0155-networkd-Install-a-dbus-policy.patch b/network/patches/0155-networkd-Install-a-dbus-policy.patch
new file mode 100644
index 000000000..5185e467a
--- /dev/null
+++ b/network/patches/0155-networkd-Install-a-dbus-policy.patch
@@ -0,0 +1,87 @@
+From d5fab986b9ac9a692b26e5f5d49a51dce85ccf59 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 30 Jan 2023 18:47:30 +0000
+Subject: [PATCH 155/304] networkd: Install a dbus policy
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 8 ++++++--
+ configure.ac | 12 ++++++++++++
+ src/networkd/org.ipfire.network1.conf | 16 ++++++++++++++++
+ 3 files changed, 34 insertions(+), 2 deletions(-)
+ create mode 100644 src/networkd/org.ipfire.network1.conf
+
+diff --git a/Makefile.am b/Makefile.am
+index 5cfeefa..eeda5ba 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -62,7 +62,8 @@ INSTALL_EXEC_HOOKS =
+ UNINSTALL_EXEC_HOOKS =
+ noinst_DATA =
+ sbin_PROGRAMS =
+-dist_dbussystembusdir_DATA =
++dist_dbuspolicy_DATA =
++dist_dbussystembus_DATA =
+
+ AM_CPPFLAGS = \
+ $(OUR_CPPFLAGS) \
+@@ -331,7 +332,10 @@ networkd_LDFLAGS = \
+ networkd_LDADD = \
+ $(SYSTEMD_LIBS)
+
+-dist_dbussystembusdir_DATA += \
++dist_dbuspolicy_DATA += \
++ src/networkd/org.ipfire.network1.conf
++
++dist_dbussystembus_DATA += \
+ src/networkd/org.ipfire.network1.service
+
+ # ------------------------------------------------------------------------------
+diff --git a/configure.ac b/configure.ac
+index 8634a39..e612ff8 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -135,6 +135,18 @@ AM_CONDITIONAL(ENABLE_MANPAGES, [test "x$have_manpages" = "xyes"])
+
+ # ------------------------------------------------------------------------------
+
++AC_ARG_WITH(
++ [dbuspolicydir],
++ AS_HELP_STRING(
++ [--with-dbuspolicydir=arg],
++ [directory for D-Bus policies (default: ${dbusdatadir|datarootdir}/dbus-1/system.d)]
++ ),
++ [dbuspolicydir="$withval"],
++ [PKG_CHECK_VAR([dbusdatadir], [dbus-1], [datadir],, [dbusdatadir="${datarootdir}"])
++ dbuspolicydir="${dbusdatadir}/dbus-1/system.d"]
++)
++AC_SUBST(dbuspolicydir)
++
+ AC_ARG_WITH([dbussystembusdir], AS_HELP_STRING([--with-dbussystembusdir=DIR],
+ [path to D-Bus system bus services directory]), [with_dbussystembusdir=${withval}])
+ if test -z "${with_dbussystembusdir}"; then
+diff --git a/src/networkd/org.ipfire.network1.conf b/src/networkd/org.ipfire.network1.conf
+new file mode 100644
+index 0000000..96e8e15
+--- /dev/null
++++ b/src/networkd/org.ipfire.network1.conf
+@@ -0,0 +1,16 @@
++<?xml version="1.0"?> <!--*-nxml-*-->
++<!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
++ "https://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
++
++<busconfig>
++ <policy user="network">
++ <allow own="org.ipfire.network1"/>
++ <allow send_destination="org.ipfire.network1"/>
++ <allow receive_sender="org.ipfire.network1"/>
++ </policy>
++
++ <policy context="default">
++ <allow send_destination="org.ipfire.network1"/>
++ <allow receive_sender="org.ipfire.network1"/>
++ </policy>
++</busconfig>
+--
+2.39.2
+
diff --git a/network/patches/0156-configure-Tidy-up-dbus-path-detection.patch b/network/patches/0156-configure-Tidy-up-dbus-path-detection.patch
new file mode 100644
index 000000000..887870a32
--- /dev/null
+++ b/network/patches/0156-configure-Tidy-up-dbus-path-detection.patch
@@ -0,0 +1,53 @@
+From 9ca8914ef2c65a669aa05e37f2dbe232f54ecbf1 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 30 Jan 2023 18:51:34 +0000
+Subject: [PATCH 156/304] configure: Tidy up dbus path detection
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ configure.ac | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index e612ff8..ba5967d 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -147,17 +147,16 @@ AC_ARG_WITH(
+ )
+ AC_SUBST(dbuspolicydir)
+
+-AC_ARG_WITH([dbussystembusdir], AS_HELP_STRING([--with-dbussystembusdir=DIR],
+- [path to D-Bus system bus services directory]), [with_dbussystembusdir=${withval}])
+-if test -z "${with_dbussystembusdir}"; then
+- AC_MSG_CHECKING([D-Bus system bus services dir])
+- with_dbussystembusdir="$($PKG_CONFIG --variable=system_bus_services_dir dbus-1)"
+- if test -z "${with_dbussystembusdir}"; then
+- AC_MSG_ERROR([D-Bus system bus services directory is required])
+- fi
+- AC_MSG_RESULT([${with_dbussystembusdir}])
+-fi
+-AC_SUBST(dbussystembusdir, [${with_dbussystembusdir}])
++AC_ARG_WITH(
++ [dbussystembusdir],
++ AS_HELP_STRING(
++ [--with-dbussystembusdir=arg],
++ [path to D-Bus system bus services directory]
++ ),
++ [dbussystembusdir="$withval"],
++ [PKG_CHECK_VAR([dbussystembusdir], [dbus-1], [system_bus_services_dir],, [dbussystembusdir="${datarootdir}"])]
++)
++AC_SUBST(dbuspolicydir)
+
+ # ------------------------------------------------------------------------------
+ AC_ARG_WITH([systemdsystemunitdir],
+@@ -202,6 +201,7 @@ AC_MSG_RESULT([
+
+ prefix: $prefix
+
++ dbuspolicydir: ${dbuspolicydir}
+ dbussystembusdir: ${dbussystembusdir}
+ systemdsystemunitdir: $systemdsystemunitdir
+ udevdir: $udevdir
+--
+2.39.2
+
diff --git a/network/patches/0157-configure-Drop-non-sensical-CFLAGS-and-add-more-warn.patch b/network/patches/0157-configure-Drop-non-sensical-CFLAGS-and-add-more-warn.patch
new file mode 100644
index 000000000..3e608f6af
--- /dev/null
+++ b/network/patches/0157-configure-Drop-non-sensical-CFLAGS-and-add-more-warn.patch
@@ -0,0 +1,77 @@
+From a465e68bd8bf11f7cd41089941ad558dbda34f19 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 30 Jan 2023 18:54:54 +0000
+Subject: [PATCH 157/304] configure: Drop non-sensical CFLAGS and add more
+ warnings
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ configure.ac | 42 ++++++++++++++----------------------------
+ 1 file changed, 14 insertions(+), 28 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index ba5967d..9560838 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -28,6 +28,8 @@ AC_INIT([network],
+
+ AC_CONFIG_AUX_DIR([build-aux])
+
++AC_USE_SYSTEM_EXTENSIONS
++AC_SYS_LARGEFILE
+ AC_PREFIX_DEFAULT([/usr])
+
+ AM_INIT_AUTOMAKE([
+@@ -65,37 +67,21 @@ AC_PROG_CC_C99
+ AC_PROG_CC_C_O
+ AC_PROG_GCC_TRADITIONAL
+
+-AC_USE_SYSTEM_EXTENSIONS
+-
+ CC_CHECK_FLAGS_APPEND([with_cflags], [CFLAGS], [\
+- -pipe \
+ -Wall \
+- -Wextra \
+- -Wno-inline \
+- -Wundef \
+- "-Wformat=2 -Wformat-security -Wformat-nonliteral" \
+- -Wno-unused-parameter \
+- -Wno-unused-result \
+- -fno-strict-aliasing \
+- -ffunction-sections \
+- -fdata-sections \
+- -fstack-protector-all \
+- --param=ssp-buffer-size=4])
+-AC_SUBST([OUR_CFLAGS], $with_cflags)
++ -Wchar-subscripts \
++ -Wformat-security \
++ -Wmissing-declarations \
++ -Wmissing-prototypes \
++ -Wnested-externs \
++ -Wpointer-arith \
++ -Wshadow \
++ -Wsign-compare \
++ -Wstrict-prototypes \
++ -Wtype-limits \
++])
+
+-AS_CASE([$CFLAGS], [*-O[[12345g\ ]]*],
+- [CC_CHECK_FLAGS_APPEND([with_cppflags], [CPPFLAGS], [\
+- -Wp,-D_FORTIFY_SOURCE=2])],
+- [AC_MSG_RESULT([skipping -D_FORTIFY_SOURCE, optimization not enabled])])
+-AC_SUBST([OUR_CPPFLAGS], $with_cppflags)
+-
+-CC_CHECK_FLAGS_APPEND([with_ldflags], [LDFLAGS], [\
+- -Wl,--as-needed \
+- -Wl,--no-undefined \
+- -Wl,--gc-sections \
+- -Wl,-z,relro \
+- -Wl,-z,now])
+-AC_SUBST([OUR_LDFLAGS], $with_ldflags)
++AC_SUBST([OUR_CFLAGS], $with_cflags)
+
+ # ------------------------------------------------------------------------------
+
+--
+2.39.2
+
diff --git a/network/patches/0158-libnetwork-Fix-prototype-of-network_version.patch b/network/patches/0158-libnetwork-Fix-prototype-of-network_version.patch
new file mode 100644
index 000000000..6dbfcad59
--- /dev/null
+++ b/network/patches/0158-libnetwork-Fix-prototype-of-network_version.patch
@@ -0,0 +1,26 @@
+From ac17b7ef5c2dc801dc9eb179927096bc18e7bc58 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 30 Jan 2023 18:56:17 +0000
+Subject: [PATCH 158/304] libnetwork: Fix prototype of network_version()
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/libnetwork/network/libnetwork.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/libnetwork/network/libnetwork.h b/src/libnetwork/network/libnetwork.h
+index 2919fc9..e69fd04 100644
+--- a/src/libnetwork/network/libnetwork.h
++++ b/src/libnetwork/network/libnetwork.h
+@@ -36,7 +36,7 @@ void network_set_log_fn(struct network_ctx* ctx,
+ int network_get_log_priority(struct network_ctx* ctx);
+ void network_set_log_priority(struct network_ctx* ctx, int priority);
+
+-const char* network_version();
++const char* network_version(void);
+
+ #ifdef NETWORK_PRIVATE
+
+--
+2.39.2
+
diff --git a/network/patches/0159-networkd-Move-systemd-notifications-into-daemon-obje.patch b/network/patches/0159-networkd-Move-systemd-notifications-into-daemon-obje.patch
new file mode 100644
index 000000000..3c3051800
--- /dev/null
+++ b/network/patches/0159-networkd-Move-systemd-notifications-into-daemon-obje.patch
@@ -0,0 +1,104 @@
+From 8a88982f6823b376f2eace8c718dc930072de667 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 30 Jan 2023 19:00:51 +0000
+Subject: [PATCH 159/304] networkd: Move systemd notifications into daemon
+ object
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/daemon.c | 19 ++++++++++++++++---
+ src/networkd/main.c | 24 ++++--------------------
+ 2 files changed, 20 insertions(+), 23 deletions(-)
+
+diff --git a/src/networkd/daemon.c b/src/networkd/daemon.c
+index 9077c54..b93877e 100644
+--- a/src/networkd/daemon.c
++++ b/src/networkd/daemon.c
+@@ -23,6 +23,7 @@
+ #include <string.h>
+
+ #include <systemd/sd-bus.h>
++#include <systemd/sd-daemon.h>
+ #include <systemd/sd-event.h>
+
+ #include "bus.h"
+@@ -183,14 +184,26 @@ struct nw_daemon* nw_daemon_unref(struct nw_daemon* daemon) {
+ int nw_daemon_run(struct nw_daemon* daemon) {
+ int r;
+
++ // We are now ready to process any requests
++ sd_notify(0, "READY=1\n" "STATUS=Processing requests...");
++
+ // Launch the event loop
+ r = sd_event_loop(daemon->loop);
+- if (r) {
+- ERROR("Could not run the event loop: %m\n");
+- return r;
++ if (r < 0) {
++ ERROR("Could not run the event loop: %s\n", strerror(-r));
++ goto ERROR;
+ }
+
++
++ // Let systemd know that we are shutting down
++ sd_notify(0, "STOPPING=1\n" "STATUS=Shutting down...");
++
+ return 0;
++
++ERROR:
++ sd_notifyf(0, "ERRNO=%i", -r);
++
++ return 1;
+ }
+
+ int nw_daemon_reload(struct nw_daemon* daemon) {
+diff --git a/src/networkd/main.c b/src/networkd/main.c
+index 80123ad..51a9bba 100644
+--- a/src/networkd/main.c
++++ b/src/networkd/main.c
+@@ -18,10 +18,7 @@
+ # #
+ #############################################################################*/
+
+-#include <errno.h>
+-#include <stdlib.h>
+-
+-#include <systemd/sd-daemon.h>
++#include <stddef.h>
+
+ #include "daemon.h"
+
+@@ -34,27 +31,14 @@ int main(int argc, char** argv) {
+ // Create the daemon
+ r = nw_daemon_create(&daemon);
+ if (r)
+- goto ERROR;
+-
+- // We are now ready to process any requests
+- sd_notify(0, "READY=1\n" "STATUS=Processing requests...");
++ return r;
+
+ // Run the daemon
+ r = nw_daemon_run(daemon);
+- if (r)
+- goto ERROR;
+-
+- // Let systemd know that we are shutting down
+- sd_notify(0, "STOPPING=1\n" "STATUS=Shutting down...");
+-
+- goto CLEANUP;
+-
+-ERROR:
+- sd_notifyf(0, "ERRNO=%i", errno);
+
+-CLEANUP:
++ // Cleanup
+ if (daemon)
+ nw_daemon_unref(daemon);
+
+- return EXIT_FAILURE;
++ return r;
+ }
+--
+2.39.2
+
diff --git a/network/patches/0160-man-Fix-incorrect-name-on-IPsec-man-page.patch b/network/patches/0160-man-Fix-incorrect-name-on-IPsec-man-page.patch
new file mode 100644
index 000000000..ba3b4f6bf
--- /dev/null
+++ b/network/patches/0160-man-Fix-incorrect-name-on-IPsec-man-page.patch
@@ -0,0 +1,45 @@
+From fbe46265eecc9064df8819d9bd08e5fcb0ea985c Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 30 Jan 2023 19:03:41 +0000
+Subject: [PATCH 160/304] man: Fix incorrect name on IPsec man page
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ man/network-vpn-ipsec.txt | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/man/network-vpn-ipsec.txt b/man/network-vpn-ipsec.txt
+index 25347a8..d60d41d 100644
+--- a/man/network-vpn-ipsec.txt
++++ b/man/network-vpn-ipsec.txt
+@@ -1,7 +1,7 @@
+-= network-vpn-security-policies(8)
++= network-vpn-ipsec(8)
+
+ == NAME
+-network-ipsec - Configure IPsec VPN connections
++network-vpn-ipsec - Configure IPsec VPN connections
+
+ == SYNOPSIS
+ [verse]
+@@ -27,7 +27,7 @@ The following commands are understood:
+ For all other commands, the name of the IPsec VPN connection needs to be passed first:
+
+ 'NAME show'::
+- Shows the configuration of the IPsec VPN connection
++ Shows the configuration of the IPsec VPN connection
+
+ 'NAME authentication mode'::
+ Set the authentication mode out of the following available modes:
+@@ -58,7 +58,7 @@ include::include-description.txt[]
+ Specify the subnets of the local system which should be made available to the remote peer.
+
+ 'NAME mode [transport|tunnel]'::
+- Set the mode of the IPsec VPN connection.
++ Set the mode of the IPsec VPN connection.
+
+ 'NAME peer PEER'::
+ Set the peer to which the IPsec VPN connection should be etablished.
+--
+2.39.2
+
diff --git a/network/patches/0161-networkd-Install-some-simple-PolicyKit-policy.patch b/network/patches/0161-networkd-Install-some-simple-PolicyKit-policy.patch
new file mode 100644
index 000000000..68634a0e1
--- /dev/null
+++ b/network/patches/0161-networkd-Install-some-simple-PolicyKit-policy.patch
@@ -0,0 +1,94 @@
+From bf98bd657165f87eafae1442a6396239d74cd88e Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 30 Jan 2023 19:26:35 +0000
+Subject: [PATCH 161/304] networkd: Install some simple PolicyKit policy
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 4 ++++
+ configure.ac | 13 +++++++++++++
+ src/networkd/org.ipfire.network1.policy | 19 +++++++++++++++++++
+ 3 files changed, 36 insertions(+)
+ create mode 100644 src/networkd/org.ipfire.network1.policy
+
+diff --git a/Makefile.am b/Makefile.am
+index eeda5ba..4802de3 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -64,6 +64,7 @@ noinst_DATA =
+ sbin_PROGRAMS =
+ dist_dbuspolicy_DATA =
+ dist_dbussystembus_DATA =
++dist_polkitpolicy_DATA =
+
+ AM_CPPFLAGS = \
+ $(OUR_CPPFLAGS) \
+@@ -338,6 +339,9 @@ dist_dbuspolicy_DATA += \
+ dist_dbussystembus_DATA += \
+ src/networkd/org.ipfire.network1.service
+
++dist_polkitpolicy_DATA += \
++ src/networkd/org.ipfire.network1.policy
++
+ # ------------------------------------------------------------------------------
+
+ util_PROGRAMS = \
+diff --git a/configure.ac b/configure.ac
+index 9560838..16f0724 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -144,6 +144,18 @@ AC_ARG_WITH(
+ )
+ AC_SUBST(dbuspolicydir)
+
++AC_ARG_WITH(
++ [polkitpolicydir],
++ AS_HELP_STRING(
++ [--with-polkitpolicydir=arg],
++ [directory for PolicyKit policies]
++ ),
++ [polkitpolicydir="$withval"],
++ [PKG_CHECK_VAR([polkitpolicydir], [polkit], [actiondir])
++ polkitpolicydir="${datadir}/polkit-1/actions"]
++)
++AC_SUBST(polkitpolicydir)
++
+ # ------------------------------------------------------------------------------
+ AC_ARG_WITH([systemdsystemunitdir],
+ AS_HELP_STRING([--with-systemdsystemunitdir=DIR], [Directory for systemd service files]),
+@@ -189,6 +201,7 @@ AC_MSG_RESULT([
+
+ dbuspolicydir: ${dbuspolicydir}
+ dbussystembusdir: ${dbussystembusdir}
++ polkitpolicydir: ${polkitpolicydir}
+ systemdsystemunitdir: $systemdsystemunitdir
+ udevdir: $udevdir
+
+diff --git a/src/networkd/org.ipfire.network1.policy b/src/networkd/org.ipfire.network1.policy
+new file mode 100644
+index 0000000..46318f1
+--- /dev/null
++++ b/src/networkd/org.ipfire.network1.policy
+@@ -0,0 +1,19 @@
++<?xml version="1.0" encoding="UTF-8"?> <!--*-nxml-*-->
++<!DOCTYPE policyconfig PUBLIC "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
++ "https://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
++
++<policyconfig>
++ <vendor>The IPFire Project</vendor>
++ <vendor_url>https://www.ipfire.org</vendor_url>
++
++ <action id="org.ipfire.network1.reload">
++ <description gettext-domain="systemd">Reload Network Settings</description>
++ <message gettext-domain="network">Authentication is required to reload network settings.</message>
++ <defaults>
++ <allow_any>auth_admin</allow_any>
++ <allow_inactive>auth_admin</allow_inactive>
++ <allow_active>auth_admin_keep</allow_active>
++ </defaults>
++ <annotate key="org.freedesktop.policykit.owner">unix-user:network</annotate>
++ </action>
++</policyconfig>
+--
+2.39.2
+
diff --git a/network/patches/0162-networkd-Call-function-when-we-are-connected-to-dbus.patch b/network/patches/0162-networkd-Call-function-when-we-are-connected-to-dbus.patch
new file mode 100644
index 000000000..62c5161e8
--- /dev/null
+++ b/network/patches/0162-networkd-Call-function-when-we-are-connected-to-dbus.patch
@@ -0,0 +1,51 @@
+From bf42846c2ac47b5ecb8eea5cba618b130a6401ab Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 30 Jan 2023 20:55:42 +0000
+Subject: [PATCH 162/304] networkd: Call function when we are connected to dbus
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/bus.c | 18 +++++++++++++++++-
+ 1 file changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/src/networkd/bus.c b/src/networkd/bus.c
+index 95862d2..36ae7c9 100644
+--- a/src/networkd/bus.c
++++ b/src/networkd/bus.c
+@@ -28,10 +28,18 @@
+ #include "daemon.h"
+ #include "logging.h"
+
+-static int nw_bus_daemon_reload(sd_bus_message* m, void* data, sd_bus_error* ret_error) {
++static int nw_bus_daemon_reload(sd_bus_message* m, void* data, sd_bus_error* error) {
+ return 1;
+ }
+
++static int nw_bus_on_connect(sd_bus_message* m, void* data, sd_bus_error* error) {
++ struct nw_daemon* daemon = (struct nw_daemon*)data;
++
++ DEBUG("Connected to D-Bus\n");
++
++ return 0;
++}
++
+ static const sd_bus_vtable daemon_vtable[] = {
+ SD_BUS_VTABLE_START(0),
+ SD_BUS_METHOD("Reload", SD_BUS_NO_ARGS, SD_BUS_NO_RESULT,
+@@ -127,5 +135,13 @@ int nw_bus_connect(sd_bus* bus, sd_event* loop) {
+ return 1;
+ }
+
++ // Request receiving a connect signal
++ r = sd_bus_match_signal_async(bus, NULL, "org.freedesktop.DBus.Local",
++ NULL, "org.freedesktop.DBus.Local", "Connected", nw_bus_on_connect, NULL, NULL);
++ if (r < 0) {
++ ERROR("Could not request match on Connected signal: %s\n", strerror(-r));
++ return 1;
++ }
++
+ return 0;
+ }
+--
+2.39.2
+
diff --git a/network/patches/0163-networkd-Install-a-systemd-service-file.patch b/network/patches/0163-networkd-Install-a-systemd-service-file.patch
new file mode 100644
index 000000000..460834fea
--- /dev/null
+++ b/network/patches/0163-networkd-Install-a-systemd-service-file.patch
@@ -0,0 +1,116 @@
+From 5d968c0188b8181db6f392f925d7875e12e7e21b Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Wed, 1 Feb 2023 15:26:34 +0000
+Subject: [PATCH 163/304] networkd: Install a systemd service file
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ .gitignore | 1 +
+ Makefile.am | 12 ++++++++-
+ src/networkd/networkd.service.in | 45 ++++++++++++++++++++++++++++++++
+ 3 files changed, 57 insertions(+), 1 deletion(-)
+ create mode 100644 src/networkd/networkd.service.in
+
+diff --git a/.gitignore b/.gitignore
+index e3bae67..9194c93 100644
+--- a/.gitignore
++++ b/.gitignore
+@@ -8,6 +8,7 @@
+ /src/inetcalc
+ /src/libnetwork/libnetwork.pc
+ /src/network.pc
++/src/networkd/networkd.service
+ /src/ppp/ip-updown
+ /src/systemd/*.service
+ /test/nitsi/test/settings
+diff --git a/Makefile.am b/Makefile.am
+index 4802de3..3a3f82c 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -65,6 +65,7 @@ sbin_PROGRAMS =
+ dist_dbuspolicy_DATA =
+ dist_dbussystembus_DATA =
+ dist_polkitpolicy_DATA =
++systemdsystemunit_DATA =
+
+ AM_CPPFLAGS = \
+ $(OUR_CPPFLAGS) \
+@@ -342,6 +343,15 @@ dist_dbussystembus_DATA += \
+ dist_polkitpolicy_DATA += \
+ src/networkd/org.ipfire.network1.policy
+
++systemdsystemunit_DATA += \
++ src/networkd/networkd.service
++
++EXTRA_DIST += \
++ src/networkd/networkd.service.in
++
++CLEANFILES += \
++ src/networkd/networkd.service
++
+ # ------------------------------------------------------------------------------
+
+ util_PROGRAMS = \
+@@ -406,7 +416,7 @@ UNINSTALL_EXEC_HOOKS += ppp-uninstall-hook
+ # ------------------------------------------------------------------------------
+
+ if HAVE_SYSTEMD
+-systemdsystemunit_DATA = \
++systemdsystemunit_DATA += \
+ src/systemd/firewall.service \
+ src/systemd/firewall-init.service \
+ src/systemd/network-init.service \
+diff --git a/src/networkd/networkd.service.in b/src/networkd/networkd.service.in
+new file mode 100644
+index 0000000..4361023
+--- /dev/null
++++ b/src/networkd/networkd.service.in
+@@ -0,0 +1,45 @@
++[Unit]
++Description=Network Configuration
++Documentation=man:networkd.service(8)
++
++ConditionCapability=CAP_NET_ADMIN
++DefaultDependencies=no
++# systemd-udevd.service can be dropped once tuntap is moved to netlink
++After=systemd-udevd.service network-pre.target systemd-sysusers.service systemd-sysctl.service
++Before=network.target multi-user.target shutdown.target
++Conflicts=shutdown.target
++Wants=network.target
++
++[Service]
++AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW
++BusName=org.ipfire.network1
++CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW
++DeviceAllow=char-* rw
++ExecStart=@sbindir@/networkd
++FileDescriptorStoreMax=512
++LockPersonality=yes
++MemoryDenyWriteExecute=yes
++NoNewPrivileges=yes
++ProtectProc=invisible
++ProtectClock=yes
++ProtectControlGroups=yes
++ProtectHome=yes
++ProtectKernelLogs=yes
++ProtectKernelModules=yes
++ProtectSystem=strict
++Restart=on-failure
++RestartSec=0
++RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 AF_PACKET
++RestrictNamespaces=yes
++RestrictRealtime=yes
++RestrictSUIDSGID=yes
++SystemCallArchitectures=native
++SystemCallErrorNumber=EPERM
++SystemCallFilter=@system-service
++Type=notify-reload
++User=network
++WatchdogSec=3min
++
++[Install]
++WantedBy=multi-user.target
++Alias=dbus-org.ipfire.network1.service
+--
+2.39.2
+
diff --git a/network/patches/0164-networkd-Fully-implement-bus-handler-for-Reload.patch b/network/patches/0164-networkd-Fully-implement-bus-handler-for-Reload.patch
new file mode 100644
index 000000000..65054fa0b
--- /dev/null
+++ b/network/patches/0164-networkd-Fully-implement-bus-handler-for-Reload.patch
@@ -0,0 +1,32 @@
+From 1dc98e400cd9c17edffa8f94f02a38ca1777cef8 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Wed, 1 Feb 2023 15:26:57 +0000
+Subject: [PATCH 164/304] networkd: Fully implement bus handler for Reload
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/bus.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/src/networkd/bus.c b/src/networkd/bus.c
+index 36ae7c9..56eda87 100644
+--- a/src/networkd/bus.c
++++ b/src/networkd/bus.c
+@@ -29,7 +29,13 @@
+ #include "logging.h"
+
+ static int nw_bus_daemon_reload(sd_bus_message* m, void* data, sd_bus_error* error) {
+- return 1;
++ struct nw_daemon* daemon = (struct nw_daemon*)data;
++
++ // Reload the daemon
++ nw_daemon_reload(daemon);
++
++ // Respond with an empty message
++ return sd_bus_reply_method_return(m, NULL);
+ }
+
+ static int nw_bus_on_connect(sd_bus_message* m, void* data, sd_bus_error* error) {
+--
+2.39.2
+
diff --git a/network/patches/0165-networkd-Asynchronously-register-to-the-bus.patch b/network/patches/0165-networkd-Asynchronously-register-to-the-bus.patch
new file mode 100644
index 000000000..c122a8ee2
--- /dev/null
+++ b/network/patches/0165-networkd-Asynchronously-register-to-the-bus.patch
@@ -0,0 +1,28 @@
+From 1e5ff643f2e18e5133ec932d5355f110ca1bfbf4 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Wed, 1 Feb 2023 15:27:18 +0000
+Subject: [PATCH 165/304] networkd: Asynchronously register to the bus
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/bus.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/src/networkd/bus.c b/src/networkd/bus.c
+index 56eda87..5224aaa 100644
+--- a/src/networkd/bus.c
++++ b/src/networkd/bus.c
+@@ -126,9 +126,7 @@ int nw_bus_connect(sd_bus* bus, sd_event* loop) {
+ }
+
+ // Request interface name
+- // XXX Should this be async?
+- // XXX How do we get the actual error message from dbus?
+- r = sd_bus_request_name(bus, NETWORKD_BUS_INTERFACE_NAME, 0);
++ r = sd_bus_request_name_async(bus, NULL, NETWORKD_BUS_INTERFACE_NAME, 0, NULL, NULL);
+ if (r < 0) {
+ ERROR("Could not request bus name: %s\n", strerror(-r));
+ return 1;
+--
+2.39.2
+
diff --git a/network/patches/0166-networkd-config-Split-flushing-all-entries-into-a-fu.patch b/network/patches/0166-networkd-config-Split-flushing-all-entries-into-a-fu.patch
new file mode 100644
index 000000000..e9601d3e8
--- /dev/null
+++ b/network/patches/0166-networkd-config-Split-flushing-all-entries-into-a-fu.patch
@@ -0,0 +1,71 @@
+From 91915f80f60943afec29743eda7258f5bf65e8e5 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Wed, 1 Feb 2023 21:46:11 +0000
+Subject: [PATCH 166/304] networkd: config: Split flushing all entries into a
+ function
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/config.c | 25 ++++++++++++++++---------
+ src/networkd/config.h | 2 ++
+ 2 files changed, 18 insertions(+), 9 deletions(-)
+
+diff --git a/src/networkd/config.c b/src/networkd/config.c
+index b2a23f0..a11ee1c 100644
+--- a/src/networkd/config.c
++++ b/src/networkd/config.c
+@@ -74,15 +74,8 @@ ERROR:
+ }
+
+ static void nw_config_free(struct nw_config* config) {
+- struct nw_config_entry* entry = NULL;
+-
+- while (!STAILQ_EMPTY(&config->entries)) {
+- entry = STAILQ_FIRST(&config->entries);
+- STAILQ_REMOVE_HEAD(&config->entries, nodes);
+-
+- // Free the entry
+- nw_config_entry_free(entry);
+- }
++ // Flush all entries
++ nw_config_flush(config);
+
+ free(config);
+ }
+@@ -117,6 +110,20 @@ struct nw_config* nw_config_unref(struct nw_config* config) {
+ return NULL;
+ }
+
++int nw_config_flush(struct nw_config* config) {
++ struct nw_config_entry* entry = NULL;
++
++ while (!STAILQ_EMPTY(&config->entries)) {
++ entry = STAILQ_FIRST(&config->entries);
++ STAILQ_REMOVE_HEAD(&config->entries, nodes);
++
++ // Free the entry
++ nw_config_entry_free(entry);
++ }
++
++ return 0;
++}
++
+ static int nw_config_parse(struct nw_config* config, FILE* f) {
+ // XXX TODO
+
+diff --git a/src/networkd/config.h b/src/networkd/config.h
+index 3474ae1..3878063 100644
+--- a/src/networkd/config.h
++++ b/src/networkd/config.h
+@@ -33,6 +33,8 @@ int nw_config_create(struct nw_config** config);
+ struct nw_config* nw_config_ref(struct nw_config* config);
+ struct nw_config* nw_config_unref(struct nw_config* config);
+
++int nw_config_flush(struct nw_config* config);
++
+ int nw_config_readf(struct nw_config** config, FILE* f);
+ int nw_config_read(struct nw_config** config, const char* path);
+
+--
+2.39.2
+
diff --git a/network/patches/0167-networkd-Change-config-read-functions-to-not-create-.patch b/network/patches/0167-networkd-Change-config-read-functions-to-not-create-.patch
new file mode 100644
index 000000000..5cc42ff66
--- /dev/null
+++ b/network/patches/0167-networkd-Change-config-read-functions-to-not-create-.patch
@@ -0,0 +1,70 @@
+From 3239c3b1a98103e79ae7ab524fc12386a781249f Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Wed, 1 Feb 2023 22:03:29 +0000
+Subject: [PATCH 167/304] networkd: Change config read functions to not create
+ a new instance
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/config.c | 24 ++----------------------
+ src/networkd/config.h | 4 ++--
+ 2 files changed, 4 insertions(+), 24 deletions(-)
+
+diff --git a/src/networkd/config.c b/src/networkd/config.c
+index a11ee1c..0048e44 100644
+--- a/src/networkd/config.c
++++ b/src/networkd/config.c
+@@ -124,33 +124,13 @@ int nw_config_flush(struct nw_config* config) {
+ return 0;
+ }
+
+-static int nw_config_parse(struct nw_config* config, FILE* f) {
++int nw_config_readf(struct nw_config* config, FILE* f) {
+ // XXX TODO
+
+ return 0;
+ }
+
+-int nw_config_readf(struct nw_config** config, FILE* f) {
+- int r;
+-
+- // Create a new config object
+- r = nw_config_create(config);
+- if (r)
+- return r;
+-
+- // Parse the configuration
+- r = nw_config_parse(*config, f);
+- if (r)
+- goto ERROR;
+-
+- return 0;
+-
+-ERROR:
+- nw_config_free(*config);
+- return r;
+-}
+-
+-int nw_config_read(struct nw_config** config, const char* path) {
++int nw_config_read(struct nw_config* config, const char* path) {
+ FILE* f = NULL;
+ int r;
+
+diff --git a/src/networkd/config.h b/src/networkd/config.h
+index 3878063..c4f9125 100644
+--- a/src/networkd/config.h
++++ b/src/networkd/config.h
+@@ -35,8 +35,8 @@ struct nw_config* nw_config_unref(struct nw_config* config);
+
+ int nw_config_flush(struct nw_config* config);
+
+-int nw_config_readf(struct nw_config** config, FILE* f);
+-int nw_config_read(struct nw_config** config, const char* path);
++int nw_config_readf(struct nw_config* config, FILE* f);
++int nw_config_read(struct nw_config* config, const char* path);
+
+ int nw_config_writef(struct nw_config* config, FILE* f);
+ int nw_config_write(struct nw_config* config, const char* path);
+--
+2.39.2
+
diff --git a/network/patches/0168-networkd-Store-the-path-with-the-configuration-objec.patch b/network/patches/0168-networkd-Store-the-path-with-the-configuration-objec.patch
new file mode 100644
index 000000000..5b745e3f8
--- /dev/null
+++ b/network/patches/0168-networkd-Store-the-path-with-the-configuration-objec.patch
@@ -0,0 +1,200 @@
+From b076fa8b6b7aa4b5746b8ef01469e074b6a228ae Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Wed, 1 Feb 2023 22:37:06 +0000
+Subject: [PATCH 168/304] networkd: Store the path with the configuration
+ object
+
+This makes it easier to call read and write functions without
+re-composing the path again and again...
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/config.c | 64 +++++++++++++++++++++++++++++++++++++------
+ src/networkd/config.h | 11 ++++----
+ src/networkd/daemon.c | 2 +-
+ 3 files changed, 61 insertions(+), 16 deletions(-)
+
+diff --git a/src/networkd/config.c b/src/networkd/config.c
+index 0048e44..e531ec6 100644
+--- a/src/networkd/config.c
++++ b/src/networkd/config.c
+@@ -19,6 +19,7 @@
+ #############################################################################*/
+
+ #include <errno.h>
++#include <limits.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <string.h>
+@@ -38,6 +39,9 @@ struct nw_config_entry {
+ struct nw_config {
+ int nrefs;
+
++ // The path to the configuration file
++ char path[PATH_MAX];
++
+ STAILQ_HEAD(entries, nw_config_entry) entries;
+ };
+
+@@ -80,7 +84,9 @@ static void nw_config_free(struct nw_config* config) {
+ free(config);
+ }
+
+-int nw_config_create(struct nw_config** config) {
++int nw_config_create(struct nw_config** config, const char* path) {
++ int r;
++
+ struct nw_config* c = calloc(1, sizeof(*c));
+ if (!c)
+ return 1;
+@@ -91,9 +97,26 @@ int nw_config_create(struct nw_config** config) {
+ // Initialise entries
+ STAILQ_INIT(&c->entries);
+
++ // Store the path
++ if (path) {
++ r = nw_string_set(c->path, path);
++ if (r)
++ goto ERROR;
++
++ // Try to read the configuration from path
++ r = nw_config_read(c);
++ if (r)
++ goto ERROR;
++ }
++
+ *config = c;
+
+ return 0;
++
++ERROR:
++ nw_config_free(c);
++
++ return r;
+ }
+
+ struct nw_config* nw_config_ref(struct nw_config* config) {
+@@ -110,6 +133,13 @@ struct nw_config* nw_config_unref(struct nw_config* config) {
+ return NULL;
+ }
+
++const char* nw_config_path(struct nw_config* config) {
++ if (*config->path)
++ return config->path;
++
++ return NULL;
++}
++
+ int nw_config_flush(struct nw_config* config) {
+ struct nw_config_entry* entry = NULL;
+
+@@ -124,20 +154,30 @@ int nw_config_flush(struct nw_config* config) {
+ return 0;
+ }
+
+-int nw_config_readf(struct nw_config* config, FILE* f) {
++static int nw_config_readf(struct nw_config* config, FILE* f) {
+ // XXX TODO
+
+ return 0;
+ }
+
+-int nw_config_read(struct nw_config* config, const char* path) {
++int nw_config_read(struct nw_config* config) {
+ FILE* f = NULL;
+ int r;
+
++ // We cannot read if path is not set
++ if (!*config->path) {
++ errno = ENOTSUP;
++ return 1;
++ }
++
+ // Open the file
+- f = fopen(path, "r");
++ f = fopen(config->path, "r");
+ if (!f) {
+- ERROR("Could not read configuration file %s: %m\n", path);
++ // Silently ignore if the file does not exist
++ if (errno == ENOENT)
++ return 0;
++
++ ERROR("Could not read configuration file %s: %m\n", config->path);
+ r = 1;
+ goto ERROR;
+ }
+@@ -152,7 +192,7 @@ ERROR:
+ return r;
+ }
+
+-int nw_config_writef(struct nw_config* config, FILE* f) {
++static int nw_config_writef(struct nw_config* config, FILE* f) {
+ struct nw_config_entry* entry = NULL;
+ int r;
+
+@@ -172,12 +212,18 @@ int nw_config_writef(struct nw_config* config, FILE* f) {
+ return 0;
+ }
+
+-int nw_config_write(struct nw_config* config, const char* path) {
++int nw_config_write(struct nw_config* config) {
+ int r;
+
+- FILE* f = fopen(path, "w");
++ // We cannot write if path is not set
++ if (!*config->path) {
++ errno = ENOTSUP;
++ return 1;
++ }
++
++ FILE* f = fopen(config->path, "w");
+ if (!f) {
+- ERROR("Failed to open %s for writing: %m\n", path);
++ ERROR("Failed to open %s for writing: %m\n", config->path);
+ r = 1;
+ goto ERROR;
+ }
+diff --git a/src/networkd/config.h b/src/networkd/config.h
+index c4f9125..5b9910b 100644
+--- a/src/networkd/config.h
++++ b/src/networkd/config.h
+@@ -28,18 +28,17 @@
+
+ struct nw_config;
+
+-int nw_config_create(struct nw_config** config);
++int nw_config_create(struct nw_config** config, const char* path);
+
+ struct nw_config* nw_config_ref(struct nw_config* config);
+ struct nw_config* nw_config_unref(struct nw_config* config);
+
+-int nw_config_flush(struct nw_config* config);
++const char* nw_config_path(struct nw_config* config);
+
+-int nw_config_readf(struct nw_config* config, FILE* f);
+-int nw_config_read(struct nw_config* config, const char* path);
++int nw_config_flush(struct nw_config* config);
+
+-int nw_config_writef(struct nw_config* config, FILE* f);
+-int nw_config_write(struct nw_config* config, const char* path);
++int nw_config_read(struct nw_config* config);
++int nw_config_write(struct nw_config* config);
+
+ int nw_config_del(struct nw_config* config, const char* key);
+
+diff --git a/src/networkd/daemon.c b/src/networkd/daemon.c
+index b93877e..5b097c2 100644
+--- a/src/networkd/daemon.c
++++ b/src/networkd/daemon.c
+@@ -110,7 +110,7 @@ static int nw_daemon_setup(struct nw_daemon* daemon) {
+ int r;
+
+ // Read configuration file
+- r = nw_config_read(&daemon->config, CONFIG_DIR "/settings");
++ r = nw_config_create(&daemon->config, CONFIG_DIR "/settings");
+ if (r)
+ return r;
+
+--
+2.39.2
+
diff --git a/network/patches/0169-networkd-zones-Try-to-read-configuration-automatical.patch b/network/patches/0169-networkd-zones-Try-to-read-configuration-automatical.patch
new file mode 100644
index 000000000..6d7eb9b40
--- /dev/null
+++ b/network/patches/0169-networkd-zones-Try-to-read-configuration-automatical.patch
@@ -0,0 +1,137 @@
+From 00b5de56ae30d4d8f0288ec160570ab6129aec79 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Wed, 1 Feb 2023 22:39:34 +0000
+Subject: [PATCH 169/304] networkd: zones: Try to read configuration
+ automatically
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/string.h | 25 ++++++++++++++++++++++
+ src/networkd/zone.c | 49 +++++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 74 insertions(+)
+
+diff --git a/src/networkd/string.h b/src/networkd/string.h
+index 52b5add..4ae2dbf 100644
+--- a/src/networkd/string.h
++++ b/src/networkd/string.h
+@@ -26,6 +26,9 @@
+ #include <stdio.h>
+ #include <string.h>
+
++#define nw_string_vformat(s, format, ...) \
++ __nw_string_vformat(s, sizeof(s), format, __VA_ARGS__)
++
+ static inline int __nw_string_vformat(char* s, const size_t length,
+ const char* format, va_list args) {
+ // Write string to buffer
+@@ -76,4 +79,26 @@ static inline int __nw_string_set(char* s, const size_t length, const char* valu
+ return __nw_string_format(s, length, "%s", value);
+ }
+
++/*
++ Paths
++*/
++
++#define nw_path_join(s, first, second) \
++ __nw_path_join(s, sizeof(s), first, second)
++
++static inline int __nw_path_join(char* s, const size_t length,
++ const char* first, const char* second) {
++ if (!first)
++ return __nw_string_format(s, length, "%s", second);
++
++ if (!second)
++ return __nw_string_format(s, length, "%s", first);
++
++ // Remove leading slashes from second argument
++ while (*second == '/')
++ second++;
++
++ return __nw_string_format(s, length, "%s/%s", first, second);
++}
++
+ #endif /* NETWORKD_STRING_H */
+diff --git a/src/networkd/zone.c b/src/networkd/zone.c
+index 5066c4b..4790d33 100644
+--- a/src/networkd/zone.c
++++ b/src/networkd/zone.c
+@@ -18,6 +18,7 @@
+ # #
+ #############################################################################*/
+
++#include <limits.h>
+ #include <stdlib.h>
+
+ #include "config.h"
+@@ -33,6 +34,32 @@ struct nw_zone {
+ struct nw_config *config;
+ };
+
++#define nw_zone_path(zone, path, format, ...) \
++ __nw_zone_path(zone, path, sizeof(path), format, __VA_ARGS__)
++
++static int __nw_zone_path(struct nw_zone* zone, char* p, const size_t length,
++ const char* format, ...) {
++ char prefix[NAME_MAX];
++ char suffix[NAME_MAX];
++ va_list args;
++ int r;
++
++ // Format the prefix
++ r = nw_string_format(prefix, "%s/zones/%s", CONFIG_DIR, zone->name);
++ if (r)
++ return r;
++
++ // Format the suffix
++ va_start(args, format);
++ r = nw_string_vformat(suffix, format, args);
++ va_end(args);
++ if (r)
++ return r;
++
++ // Join the two parts together
++ return __nw_path_join(p, length, prefix, suffix);
++}
++
+ static void nw_zone_free(struct nw_zone* zone) {
+ if (zone->config)
+ nw_config_unref(zone->config);
+@@ -40,6 +67,23 @@ static void nw_zone_free(struct nw_zone* zone) {
+ free(zone);
+ }
+
++static int nw_zone_setup(struct nw_zone* zone) {
++ char path[PATH_MAX];
++ int r;
++
++ // Compose the path to the main configuration file
++ r = nw_zone_path(zone, path, "%s", "settings");
++ if (r)
++ return r;
++
++ // Initialize the configuration
++ r = nw_config_create(&zone->config, path);
++ if (r)
++ return r;
++
++ return 0;
++}
++
+ int nw_zone_create(struct nw_zone** zone, const char* name) {
+ int r;
+
+@@ -56,6 +100,11 @@ int nw_zone_create(struct nw_zone** zone, const char* name) {
+ if (r)
+ goto ERROR;
+
++ // Setup the zone
++ r = nw_zone_setup(z);
++ if (r)
++ goto ERROR;
++
+ *zone = z;
+ return 0;
+
+--
+2.39.2
+
diff --git a/network/patches/0170-networkd-Read-all-zones-from-configuration.patch b/network/patches/0170-networkd-Read-all-zones-from-configuration.patch
new file mode 100644
index 000000000..bbf4a09c5
--- /dev/null
+++ b/network/patches/0170-networkd-Read-all-zones-from-configuration.patch
@@ -0,0 +1,201 @@
+From 19e74c9b5d7e9372a3ea9d27579ba8608626459d Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Wed, 1 Feb 2023 22:40:04 +0000
+Subject: [PATCH 170/304] networkd: Read all zones from configuration
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/daemon.c | 131 +++++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 130 insertions(+), 1 deletion(-)
+
+diff --git a/src/networkd/daemon.c b/src/networkd/daemon.c
+index 5b097c2..86731d1 100644
+--- a/src/networkd/daemon.c
++++ b/src/networkd/daemon.c
+@@ -18,9 +18,11 @@
+ # #
+ #############################################################################*/
+
++#include <dirent.h>
+ #include <errno.h>
+ #include <stdlib.h>
+ #include <string.h>
++#include <sys/queue.h>
+
+ #include <systemd/sd-bus.h>
+ #include <systemd/sd-daemon.h>
+@@ -30,6 +32,14 @@
+ #include "config.h"
+ #include "daemon.h"
+ #include "logging.h"
++#include "zone.h"
++
++struct nw_daemon_zone {
++ struct nw_zone* zone;
++
++ // Link to the other zones
++ STAILQ_ENTRY(nw_daemon_zone) nodes;
++};
+
+ struct nw_daemon {
+ int nrefs;
+@@ -41,6 +51,9 @@ struct nw_daemon {
+
+ // DBus Connection
+ sd_bus* bus;
++
++ // Zones
++ STAILQ_HEAD(zones, nw_daemon_zone) zones;
+ };
+
+ static int __nw_daemon_terminate(sd_event_source* source, const struct signalfd_siginfo* si,
+@@ -106,7 +119,85 @@ static int nw_daemon_setup_loop(struct nw_daemon* daemon) {
+ return 0;
+ }
+
+-static int nw_daemon_setup(struct nw_daemon* daemon) {
++static int nw_daemon_load_zone_filter(const struct dirent* path) {
++ const char* fn = path->d_name;
++
++ // Ignore everything starting with '.'
++ if (*fn == '.')
++ return 0;
++
++ // Ignore anything that isn't a directory
++ if (path->d_type != DT_DIR)
++ return 0;
++
++ return 1;
++}
++
++static int nw_daemon_add_zone(struct nw_daemon* daemon, struct nw_zone* zone) {
++ // Allocate a new entry
++ struct nw_daemon_zone* entry = calloc(1, sizeof(*entry));
++ if (!entry)
++ return 1;
++
++ // Reference the zone
++ entry->zone = nw_zone_ref(zone);
++
++ // Add it to the list
++ STAILQ_INSERT_TAIL(&daemon->zones, entry, nodes);
++
++ return 0;
++}
++
++static int nw_daemon_load_zones(struct nw_daemon* daemon) {
++ struct dirent** paths = NULL;
++ int n;
++ int r = 0;
++
++ struct nw_zone* zone = NULL;
++
++ // Scan the zones directory
++ n = scandir(CONFIG_DIR "/zones", &paths, nw_daemon_load_zone_filter, alphasort);
++ if (n < 0) {
++ ERROR("Could not load zones: %m\n");
++ return 1;
++ }
++
++ DEBUG("Found %d zone(s)\n", n);
++
++ // Load all zones
++ for (int i = 0; i < n; i++) {
++ const char* name = paths[i]->d_name;
++
++ DEBUG("Loading zone '%s'...\n", name);
++
++ // Create a new zone object
++ r = nw_zone_create(&zone, name);
++ if (r)
++ goto ERROR;
++
++ // Store the zone
++ r = nw_daemon_add_zone(daemon, zone);
++ if (r) {
++ nw_zone_unref(zone);
++ goto ERROR;
++ }
++
++ nw_zone_unref(zone);
++ }
++
++ERROR:
++ // Free paths
++ if (paths) {
++ for (int i = 0; i < n; i++) {
++ free(paths[i]);
++ }
++ free(paths);
++ }
++
++ return r;
++}
++
++static int nw_daemon_load_config(struct nw_daemon* daemon) {
+ int r;
+
+ // Read configuration file
+@@ -114,6 +205,22 @@ static int nw_daemon_setup(struct nw_daemon* daemon) {
+ if (r)
+ return r;
+
++ // Load zones
++ r = nw_daemon_load_zones(daemon);
++ if (r)
++ return r;
++
++ return r;
++}
++
++static int nw_daemon_setup(struct nw_daemon* daemon) {
++ int r;
++
++ // Read the configuration
++ r = nw_daemon_load_config(daemon);
++ if (r)
++ return r;
++
+ // Setup the event loop
+ r = nw_daemon_setup_loop(daemon);
+ if (r)
+@@ -137,6 +244,9 @@ int nw_daemon_create(struct nw_daemon** daemon) {
+ // Initialize reference counter
+ d->nrefs = 1;
+
++ // Initialize zones
++ STAILQ_INIT(&d->zones);
++
+ // Setup the daemon
+ r = nw_daemon_setup(d);
+ if (r)
+@@ -153,7 +263,26 @@ ERROR:
+ return r;
+ }
+
++static void nw_daemon_free_zones(struct nw_daemon* daemon) {
++ struct nw_daemon_zone* entry = NULL;
++
++ while (!STAILQ_EMPTY(&daemon->zones)) {
++ entry = STAILQ_FIRST(&daemon->zones);
++
++ // Dereference the zone
++ nw_zone_unref(entry->zone);
++
++ // Remove the entry from the list
++ STAILQ_REMOVE_HEAD(&daemon->zones, nodes);
++
++ // Free the entry
++ free(entry);
++ }
++}
++
+ static void nw_daemon_free(struct nw_daemon* daemon) {
++ nw_daemon_free_zones(daemon);
++
+ if (daemon->config)
+ nw_config_unref(daemon->config);
+ if (daemon->bus)
+--
+2.39.2
+
diff --git a/network/patches/0171-networkd-bus-Create-a-unified-function-to-register-a.patch b/network/patches/0171-networkd-bus-Create-a-unified-function-to-register-a.patch
new file mode 100644
index 000000000..3cca53689
--- /dev/null
+++ b/network/patches/0171-networkd-bus-Create-a-unified-function-to-register-a.patch
@@ -0,0 +1,128 @@
+From 9806a600f4cdf68aa2c0e509e40be6ed9ad08b44 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Wed, 1 Feb 2023 23:04:27 +0000
+Subject: [PATCH 171/304] networkd: bus: Create a unified function to register
+ an interface
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/bus.c | 52 +++++++++++++++++++++++++++++++++-------------
+ src/networkd/bus.h | 14 +++++++++++--
+ 2 files changed, 49 insertions(+), 17 deletions(-)
+
+diff --git a/src/networkd/bus.c b/src/networkd/bus.c
+index 5224aaa..eab123c 100644
+--- a/src/networkd/bus.c
++++ b/src/networkd/bus.c
+@@ -38,6 +38,19 @@ static int nw_bus_daemon_reload(sd_bus_message* m, void* data, sd_bus_error* err
+ return sd_bus_reply_method_return(m, NULL);
+ }
+
++static const sd_bus_vtable daemon_vtable[] = {
++ SD_BUS_VTABLE_START(0),
++ SD_BUS_METHOD("Reload", SD_BUS_NO_ARGS, SD_BUS_NO_RESULT,
++ nw_bus_daemon_reload, SD_BUS_VTABLE_UNPRIVILEGED),
++ SD_BUS_VTABLE_END,
++};
++
++const struct nw_bus_implementation daemon_implementation = {
++ .path = "/org/ipfire/network1",
++ .interface = "org.ipfire.network1",
++ .vtables = BUS_VTABLES(daemon_vtable),
++};
++
+ static int nw_bus_on_connect(sd_bus_message* m, void* data, sd_bus_error* error) {
+ struct nw_daemon* daemon = (struct nw_daemon*)data;
+
+@@ -46,13 +59,6 @@ static int nw_bus_on_connect(sd_bus_message* m, void* data, sd_bus_error* error)
+ return 0;
+ }
+
+-static const sd_bus_vtable daemon_vtable[] = {
+- SD_BUS_VTABLE_START(0),
+- SD_BUS_METHOD("Reload", SD_BUS_NO_ARGS, SD_BUS_NO_RESULT,
+- nw_bus_daemon_reload, SD_BUS_VTABLE_UNPRIVILEGED),
+- SD_BUS_VTABLE_END,
+-};
+-
+ int nw_bus_connect(sd_bus* bus, sd_event* loop) {
+ int r;
+
+@@ -117,16 +123,13 @@ int nw_bus_connect(sd_bus* bus, sd_event* loop) {
+ return 1;
+ }
+
+- // Register any functions
+- r = sd_bus_add_object_vtable(bus, NULL,
+- NETWORKD_BUS_OBJECT_PATH, NETWORKD_BUS_INTERFACE_NAME, daemon_vtable, NULL);
+- if (r < 0) {
+- ERROR("Could not add object vtable: %s\n", strerror(-r));
+- return 1;
+- }
++ // Register the implementation
++ r = nw_bus_register_implementation(bus, &daemon_implementation, NULL);
++ if (r)
++ return r;
+
+ // Request interface name
+- r = sd_bus_request_name_async(bus, NULL, NETWORKD_BUS_INTERFACE_NAME, 0, NULL, NULL);
++ r = sd_bus_request_name_async(bus, NULL, "org.ipfire.network1", 0, NULL, NULL);
+ if (r < 0) {
+ ERROR("Could not request bus name: %s\n", strerror(-r));
+ return 1;
+@@ -149,3 +152,22 @@ int nw_bus_connect(sd_bus* bus, sd_event* loop) {
+
+ return 0;
+ }
++
++int nw_bus_register_implementation(sd_bus* bus,
++ const struct nw_bus_implementation* impl, void* data) {
++ int r;
++
++ DEBUG("Registering bus object implementation for path=%s iface=%s\n",
++ impl->path, impl->interface);
++
++ for (const sd_bus_vtable** vtable = impl->vtables; vtable && *vtable; vtable++) {
++ r = sd_bus_add_object_vtable(bus, NULL, impl->path, impl->interface, *vtable, data);
++ if (r < 0) {
++ ERROR("Could not register bus path %s with interface %s: %m\n",
++ impl->path, impl->interface);
++ return 1;
++ }
++ }
++
++ return 0;
++}
+diff --git a/src/networkd/bus.h b/src/networkd/bus.h
+index 90c1556..05846e5 100644
+--- a/src/networkd/bus.h
++++ b/src/networkd/bus.h
+@@ -22,8 +22,6 @@
+ #define NETWORKD_BUS_H
+
+ #define NETWORKD_BUS_DESCRIPTION "networkd"
+-#define NETWORKD_BUS_OBJECT_PATH "/org/ipfire/network1"
+-#define NETWORKD_BUS_INTERFACE_NAME "org.ipfire.network1"
+
+ #define DEFAULT_SYSTEM_BUS_ADDRESS "unix:path=/run/dbus/system_bus_socket"
+
+@@ -32,4 +30,16 @@
+
+ int nw_bus_connect(sd_bus* bus, sd_event* loop);
+
++struct nw_bus_implementation {
++ const char* path;
++ const char* interface;
++
++ const sd_bus_vtable** vtables;
++};
++
++#define BUS_VTABLES(...) ((const sd_bus_vtable* []){ __VA_ARGS__, NULL })
++
++int nw_bus_register_implementation(sd_bus* bus,
++ const struct nw_bus_implementation* impl, void* data);
++
+ #endif /* NETWORKD_BUS_H */
+--
+2.39.2
+
diff --git a/network/patches/0172-networkd-Add-a-dummy-bus-implementation-for-zones.patch b/network/patches/0172-networkd-Add-a-dummy-bus-implementation-for-zones.patch
new file mode 100644
index 000000000..6aeef4273
--- /dev/null
+++ b/network/patches/0172-networkd-Add-a-dummy-bus-implementation-for-zones.patch
@@ -0,0 +1,99 @@
+From ed00ef209405d6da4478a8eb050e8792187a2619 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Wed, 1 Feb 2023 23:19:03 +0000
+Subject: [PATCH 172/304] networkd: Add a dummy bus implementation for zones
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 4 +++-
+ src/networkd/zone-bus.c | 27 +++++++++++++++++++++++++++
+ src/networkd/zone-bus.h | 28 ++++++++++++++++++++++++++++
+ 3 files changed, 58 insertions(+), 1 deletion(-)
+ create mode 100644 src/networkd/zone-bus.c
+ create mode 100644 src/networkd/zone-bus.h
+
+diff --git a/Makefile.am b/Makefile.am
+index 3a3f82c..2046fef 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -318,7 +318,9 @@ dist_networkd_SOURCES = \
+ src/networkd/main.c \
+ src/networkd/string.h \
+ src/networkd/zone.c \
+- src/networkd/zone.h
++ src/networkd/zone.h \
++ src/networkd/zone-bus.c \
++ src/networkd/zone-bus.h
+
+ networkd_CPPFLAGS = \
+ $(AM_CPPFLAGS) \
+diff --git a/src/networkd/zone-bus.c b/src/networkd/zone-bus.c
+new file mode 100644
+index 0000000..97396c5
+--- /dev/null
++++ b/src/networkd/zone-bus.c
+@@ -0,0 +1,27 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#include "bus.h"
++#include "zone-bus.h"
++
++const struct nw_bus_implementation zone_bus_impl = {
++ "/org/ipfire/network1/zone",
++ "org.ipfire.network1.Zone",
++};
+diff --git a/src/networkd/zone-bus.h b/src/networkd/zone-bus.h
+new file mode 100644
+index 0000000..0d5583e
+--- /dev/null
++++ b/src/networkd/zone-bus.h
+@@ -0,0 +1,28 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#ifndef NETWORKD_ZONE_BUS_H
++#define NETWORKD_ZONE_BUS_H
++
++#include "bus.h"
++
++extern const struct nw_bus_implementation zone_bus_impl;
++
++#endif /* NETWORKD_ZONE_BUS_H */
+--
+2.39.2
+
diff --git a/network/patches/0173-networkd-Pass-daemon-to-all-functions-called-by-the-.patch b/network/patches/0173-networkd-Pass-daemon-to-all-functions-called-by-the-.patch
new file mode 100644
index 000000000..d8ff55d71
--- /dev/null
+++ b/network/patches/0173-networkd-Pass-daemon-to-all-functions-called-by-the-.patch
@@ -0,0 +1,66 @@
+From eaeca0f9f44f0c791f21add7162ee6c7eea5ee4a Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Wed, 1 Feb 2023 23:25:17 +0000
+Subject: [PATCH 173/304] networkd: Pass daemon to all functions called by the
+ bus
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/bus.c | 4 ++--
+ src/networkd/bus.h | 4 +++-
+ src/networkd/daemon.c | 2 +-
+ 3 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/src/networkd/bus.c b/src/networkd/bus.c
+index eab123c..e854f7b 100644
+--- a/src/networkd/bus.c
++++ b/src/networkd/bus.c
+@@ -59,7 +59,7 @@ static int nw_bus_on_connect(sd_bus_message* m, void* data, sd_bus_error* error)
+ return 0;
+ }
+
+-int nw_bus_connect(sd_bus* bus, sd_event* loop) {
++int nw_bus_connect(sd_bus* bus, sd_event* loop, struct nw_daemon* daemon) {
+ int r;
+
+ // Create a bus object
+@@ -124,7 +124,7 @@ int nw_bus_connect(sd_bus* bus, sd_event* loop) {
+ }
+
+ // Register the implementation
+- r = nw_bus_register_implementation(bus, &daemon_implementation, NULL);
++ r = nw_bus_register_implementation(bus, &daemon_implementation, daemon);
+ if (r)
+ return r;
+
+diff --git a/src/networkd/bus.h b/src/networkd/bus.h
+index 05846e5..55e65b8 100644
+--- a/src/networkd/bus.h
++++ b/src/networkd/bus.h
+@@ -28,7 +28,9 @@
+ #include <systemd/sd-bus.h>
+ #include <systemd/sd-event.h>
+
+-int nw_bus_connect(sd_bus* bus, sd_event* loop);
++#include "daemon.h"
++
++int nw_bus_connect(sd_bus* bus, sd_event* loop, struct nw_daemon* daemon);
+
+ struct nw_bus_implementation {
+ const char* path;
+diff --git a/src/networkd/daemon.c b/src/networkd/daemon.c
+index 86731d1..a478e60 100644
+--- a/src/networkd/daemon.c
++++ b/src/networkd/daemon.c
+@@ -227,7 +227,7 @@ static int nw_daemon_setup(struct nw_daemon* daemon) {
+ return r;
+
+ // Connect to the system bus
+- r = nw_bus_connect(daemon->bus, daemon->loop);
++ r = nw_bus_connect(daemon->bus, daemon->loop, daemon);
+ if (r)
+ return r;
+
+--
+2.39.2
+
diff --git a/network/patches/0174-networkd-Move-zone-list-into-an-own-object.patch b/network/patches/0174-networkd-Move-zone-list-into-an-own-object.patch
new file mode 100644
index 000000000..6145c971e
--- /dev/null
+++ b/network/patches/0174-networkd-Move-zone-list-into-an-own-object.patch
@@ -0,0 +1,493 @@
+From 0c8e7342a7da002e877ed445d0223453acd4b93d Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Thu, 2 Feb 2023 00:38:13 +0000
+Subject: [PATCH 174/304] networkd: Move zone list into an own object
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 2 +
+ src/networkd/daemon.c | 121 ++----------------------
+ src/networkd/daemon.h | 4 +
+ src/networkd/zones.c | 213 ++++++++++++++++++++++++++++++++++++++++++
+ src/networkd/zones.h | 35 +++++++
+ 5 files changed, 263 insertions(+), 112 deletions(-)
+ create mode 100644 src/networkd/zones.c
+ create mode 100644 src/networkd/zones.h
+
+diff --git a/Makefile.am b/Makefile.am
+index 2046fef..ae4cb85 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -317,6 +317,8 @@ dist_networkd_SOURCES = \
+ src/networkd/logging.h \
+ src/networkd/main.c \
+ src/networkd/string.h \
++ src/networkd/zones.c \
++ src/networkd/zones.h \
+ src/networkd/zone.c \
+ src/networkd/zone.h \
+ src/networkd/zone-bus.c \
+diff --git a/src/networkd/daemon.c b/src/networkd/daemon.c
+index a478e60..588aa4e 100644
+--- a/src/networkd/daemon.c
++++ b/src/networkd/daemon.c
+@@ -18,11 +18,8 @@
+ # #
+ #############################################################################*/
+
+-#include <dirent.h>
+ #include <errno.h>
+ #include <stdlib.h>
+-#include <string.h>
+-#include <sys/queue.h>
+
+ #include <systemd/sd-bus.h>
+ #include <systemd/sd-daemon.h>
+@@ -33,13 +30,7 @@
+ #include "daemon.h"
+ #include "logging.h"
+ #include "zone.h"
+-
+-struct nw_daemon_zone {
+- struct nw_zone* zone;
+-
+- // Link to the other zones
+- STAILQ_ENTRY(nw_daemon_zone) nodes;
+-};
++#include "zones.h"
+
+ struct nw_daemon {
+ int nrefs;
+@@ -53,7 +44,7 @@ struct nw_daemon {
+ sd_bus* bus;
+
+ // Zones
+- STAILQ_HEAD(zones, nw_daemon_zone) zones;
++ struct nw_zones* zones;
+ };
+
+ static int __nw_daemon_terminate(sd_event_source* source, const struct signalfd_siginfo* si,
+@@ -119,84 +110,6 @@ static int nw_daemon_setup_loop(struct nw_daemon* daemon) {
+ return 0;
+ }
+
+-static int nw_daemon_load_zone_filter(const struct dirent* path) {
+- const char* fn = path->d_name;
+-
+- // Ignore everything starting with '.'
+- if (*fn == '.')
+- return 0;
+-
+- // Ignore anything that isn't a directory
+- if (path->d_type != DT_DIR)
+- return 0;
+-
+- return 1;
+-}
+-
+-static int nw_daemon_add_zone(struct nw_daemon* daemon, struct nw_zone* zone) {
+- // Allocate a new entry
+- struct nw_daemon_zone* entry = calloc(1, sizeof(*entry));
+- if (!entry)
+- return 1;
+-
+- // Reference the zone
+- entry->zone = nw_zone_ref(zone);
+-
+- // Add it to the list
+- STAILQ_INSERT_TAIL(&daemon->zones, entry, nodes);
+-
+- return 0;
+-}
+-
+-static int nw_daemon_load_zones(struct nw_daemon* daemon) {
+- struct dirent** paths = NULL;
+- int n;
+- int r = 0;
+-
+- struct nw_zone* zone = NULL;
+-
+- // Scan the zones directory
+- n = scandir(CONFIG_DIR "/zones", &paths, nw_daemon_load_zone_filter, alphasort);
+- if (n < 0) {
+- ERROR("Could not load zones: %m\n");
+- return 1;
+- }
+-
+- DEBUG("Found %d zone(s)\n", n);
+-
+- // Load all zones
+- for (int i = 0; i < n; i++) {
+- const char* name = paths[i]->d_name;
+-
+- DEBUG("Loading zone '%s'...\n", name);
+-
+- // Create a new zone object
+- r = nw_zone_create(&zone, name);
+- if (r)
+- goto ERROR;
+-
+- // Store the zone
+- r = nw_daemon_add_zone(daemon, zone);
+- if (r) {
+- nw_zone_unref(zone);
+- goto ERROR;
+- }
+-
+- nw_zone_unref(zone);
+- }
+-
+-ERROR:
+- // Free paths
+- if (paths) {
+- for (int i = 0; i < n; i++) {
+- free(paths[i]);
+- }
+- free(paths);
+- }
+-
+- return r;
+-}
+-
+ static int nw_daemon_load_config(struct nw_daemon* daemon) {
+ int r;
+
+@@ -206,7 +119,7 @@ static int nw_daemon_load_config(struct nw_daemon* daemon) {
+ return r;
+
+ // Load zones
+- r = nw_daemon_load_zones(daemon);
++ r = nw_zones_load(&daemon->zones);
+ if (r)
+ return r;
+
+@@ -244,9 +157,6 @@ int nw_daemon_create(struct nw_daemon** daemon) {
+ // Initialize reference counter
+ d->nrefs = 1;
+
+- // Initialize zones
+- STAILQ_INIT(&d->zones);
+-
+ // Setup the daemon
+ r = nw_daemon_setup(d);
+ if (r)
+@@ -263,26 +173,9 @@ ERROR:
+ return r;
+ }
+
+-static void nw_daemon_free_zones(struct nw_daemon* daemon) {
+- struct nw_daemon_zone* entry = NULL;
+-
+- while (!STAILQ_EMPTY(&daemon->zones)) {
+- entry = STAILQ_FIRST(&daemon->zones);
+-
+- // Dereference the zone
+- nw_zone_unref(entry->zone);
+-
+- // Remove the entry from the list
+- STAILQ_REMOVE_HEAD(&daemon->zones, nodes);
+-
+- // Free the entry
+- free(entry);
+- }
+-}
+-
+ static void nw_daemon_free(struct nw_daemon* daemon) {
+- nw_daemon_free_zones(daemon);
+-
++ if (daemon->zones)
++ nw_zones_unref(daemon->zones);
+ if (daemon->config)
+ nw_config_unref(daemon->config);
+ if (daemon->bus)
+@@ -342,3 +235,7 @@ int nw_daemon_reload(struct nw_daemon* daemon) {
+
+ return 0;
+ }
++
++struct nw_zones* nw_daemon_zones(struct nw_daemon* daemon) {
++ return nw_zones_ref(daemon->zones);
++}
+diff --git a/src/networkd/daemon.h b/src/networkd/daemon.h
+index 5b14ef3..bc69795 100644
+--- a/src/networkd/daemon.h
++++ b/src/networkd/daemon.h
+@@ -21,6 +21,8 @@
+ #ifndef NETWORKD_DAEMON_H
+ #define NETWORKD_DAEMON_H
+
++#include "zone.h"
++
+ struct nw_daemon;
+
+ int nw_daemon_create(struct nw_daemon** daemon);
+@@ -32,4 +34,6 @@ int nw_daemon_run(struct nw_daemon* daemon);
+
+ int nw_daemon_reload(struct nw_daemon* daemon);
+
++struct nw_zones* nw_daemon_zones(struct nw_daemon* daemon);
++
+ #endif /* NETWORKD_DAEMON_H */
+diff --git a/src/networkd/zones.c b/src/networkd/zones.c
+new file mode 100644
+index 0000000..7d04267
+--- /dev/null
++++ b/src/networkd/zones.c
+@@ -0,0 +1,213 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#include <dirent.h>
++#include <stdlib.h>
++#include <string.h>
++#include <sys/queue.h>
++
++#include "logging.h"
++#include "zone.h"
++#include "zones.h"
++
++struct nw_zones_entry {
++ struct nw_zone* zone;
++
++ // Link to the other entries
++ STAILQ_ENTRY(nw_zones_entry) nodes;
++};
++
++struct nw_zones {
++ int nrefs;
++
++ STAILQ_HEAD(entries, nw_zones_entry) entries;
++};
++
++static int nw_zones_create(struct nw_zones** zones) {
++ struct nw_zones* z = calloc(1, sizeof(*z));
++ if (!z)
++ return 1;
++
++ // Initialize the reference counter
++ z->nrefs = 1;
++
++ // Initialize entries
++ STAILQ_INIT(&z->entries);
++
++ // Reference the pointer
++ *zones = z;
++
++ return 0;
++}
++
++static void nw_zones_free(struct nw_zones* zones) {
++ struct nw_zones_entry* entry = NULL;
++
++ while (!STAILQ_EMPTY(&zones->entries)) {
++ entry = STAILQ_FIRST(&zones->entries);
++
++ // Dereference the zone
++ nw_zone_unref(entry->zone);
++
++ // Remove the entry from the list
++ STAILQ_REMOVE_HEAD(&zones->entries, nodes);
++
++ // Free the entry
++ free(entry);
++ }
++}
++
++struct nw_zones* nw_zones_ref(struct nw_zones* zones) {
++ zones->nrefs++;
++
++ return zones;
++}
++
++struct nw_zones* nw_zones_unref(struct nw_zones* zones) {
++ if (--zones->nrefs > 0)
++ return zones;
++
++ nw_zones_free(zones);
++ return NULL;
++}
++
++static int nw_zones_add_zone(struct nw_zones* zones, struct nw_zone* zone) {
++ // Allocate a new entry
++ struct nw_zones_entry* entry = calloc(1, sizeof(*entry));
++ if (!entry)
++ return 1;
++
++ // Reference the zone
++ entry->zone = nw_zone_ref(zone);
++
++ // Add it to the list
++ STAILQ_INSERT_TAIL(&zones->entries, entry, nodes);
++
++ return 0;
++}
++
++static int nw_zones_load_filter(const struct dirent* path) {
++ const char* fn = path->d_name;
++
++ // Ignore everything starting with '.'
++ if (*fn == '.')
++ return 0;
++
++ // Ignore anything that isn't a directory
++ if (path->d_type != DT_DIR)
++ return 0;
++
++ return 1;
++}
++
++static int __nw_zones_load(struct nw_zones* zones) {
++ struct dirent** paths = NULL;
++ int n;
++ int r = 0;
++
++ struct nw_zone* zone = NULL;
++
++ // Scan the zones directory
++ n = scandir(CONFIG_DIR "/zones", &paths, nw_zones_load_filter, alphasort);
++ if (n < 0) {
++ ERROR("Could not load zones: %m\n");
++ return 1;
++ }
++
++ DEBUG("Found %d zone(s)\n", n);
++
++ // Load all zones
++ for (int i = 0; i < n; i++) {
++ const char* name = paths[i]->d_name;
++
++ DEBUG("Loading zone '%s'...\n", name);
++
++ // Create a new zone object
++ r = nw_zone_create(&zone, name);
++ if (r)
++ goto ERROR;
++
++ // Store the zone
++ r = nw_zones_add_zone(zones, zone);
++ if (r) {
++ nw_zone_unref(zone);
++ goto ERROR;
++ }
++
++ nw_zone_unref(zone);
++ }
++
++ERROR:
++ // Free paths
++ if (paths) {
++ for (int i = 0; i < n; i++) {
++ free(paths[i]);
++ }
++ free(paths);
++ }
++
++ return r;
++}
++
++int nw_zones_load(struct nw_zones** zones) {
++ int r;
++
++ // Create a new zones object
++ r = nw_zones_create(zones);
++ if (r)
++ return r;
++
++ // Load all zones
++ r = __nw_zones_load(*zones);
++ if (r)
++ goto ERROR;
++
++ return 0;
++
++ERROR:
++ nw_zones_unref(*zones);
++ return r;
++}
++
++size_t nw_zones_num(struct nw_zones* zones) {
++ struct nw_zones_entry* entry = NULL;
++ size_t length = 0;
++
++ // Count all zones
++ STAILQ_FOREACH(entry, &zones->entries, nodes)
++ length++;
++
++ return length;
++}
++
++struct nw_zone* nw_zones_get_by_name(struct nw_zones* zones, const char* name) {
++ struct nw_zones_entry* entry = NULL;
++
++ STAILQ_FOREACH(entry, &zones->entries, nodes) {
++ const char* __name = nw_zone_name(entry->zone);
++
++ // If the name matches, return a reference to the zone
++ if (strcmp(name, __name) == 0)
++ return nw_zone_ref(entry->zone);
++ }
++
++ // No match found
++ return NULL;
++}
+diff --git a/src/networkd/zones.h b/src/networkd/zones.h
+new file mode 100644
+index 0000000..0d34c3e
+--- /dev/null
++++ b/src/networkd/zones.h
+@@ -0,0 +1,35 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#ifndef NETWORKD_ZONES_H
++#define NETWORKD_ZONES_H
++
++struct nw_zones;
++
++struct nw_zones* nw_zones_ref(struct nw_zones* zones);
++struct nw_zones* nw_zones_unref(struct nw_zones* zones);
++
++int nw_zones_load(struct nw_zones** zones);
++
++size_t nw_zones_num(struct nw_zones* zones);
++
++struct nw_zone* nw_zones_get_by_name(struct nw_zones* zones, const char* name);
++
++#endif /* NETWORKD_ZONES_H */
+--
+2.39.2
+
diff --git a/network/patches/0175-networkd-Implement-enumerating-zones-on-the-bus.patch b/network/patches/0175-networkd-Implement-enumerating-zones-on-the-bus.patch
new file mode 100644
index 000000000..490d257c6
--- /dev/null
+++ b/network/patches/0175-networkd-Implement-enumerating-zones-on-the-bus.patch
@@ -0,0 +1,238 @@
+From ebc65f19ecbf67f9c8a739316afe4892d4f6a732 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Thu, 2 Feb 2023 00:53:21 +0000
+Subject: [PATCH 175/304] networkd: Implement enumerating zones on the bus
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/bus.c | 18 +++++++++++++++++
+ src/networkd/bus.h | 3 +++
+ src/networkd/zone-bus.c | 29 +++++++++++++++++++++++++++
+ src/networkd/zone.c | 14 +++++++++++++
+ src/networkd/zone.h | 2 ++
+ src/networkd/zones.c | 44 +++++++++++++++++++++++++++++++++++++++++
+ src/networkd/zones.h | 2 ++
+ 7 files changed, 112 insertions(+)
+
+diff --git a/src/networkd/bus.c b/src/networkd/bus.c
+index e854f7b..26876fa 100644
+--- a/src/networkd/bus.c
++++ b/src/networkd/bus.c
+@@ -27,6 +27,7 @@
+ #include "bus.h"
+ #include "daemon.h"
+ #include "logging.h"
++#include "zone-bus.h"
+
+ static int nw_bus_daemon_reload(sd_bus_message* m, void* data, sd_bus_error* error) {
+ struct nw_daemon* daemon = (struct nw_daemon*)data;
+@@ -49,6 +50,7 @@ const struct nw_bus_implementation daemon_implementation = {
+ .path = "/org/ipfire/network1",
+ .interface = "org.ipfire.network1",
+ .vtables = BUS_VTABLES(daemon_vtable),
++ .children = BUS_IMPLEMENTATIONS(&zone_bus_impl),
+ };
+
+ static int nw_bus_on_connect(sd_bus_message* m, void* data, sd_bus_error* error) {
+@@ -169,5 +171,21 @@ int nw_bus_register_implementation(sd_bus* bus,
+ }
+ }
+
++ // Register the node enumerator
++ if (impl->node_enumerator) {
++ r = sd_bus_add_node_enumerator(bus, NULL, impl->path, impl->node_enumerator, data);
++ if (r < 0) {
++ ERROR("Could not add the node enumerator for %s: %m\n", impl->path);
++ return 1;
++ }
++ }
++
++ // Register any child implementations
++ for (int i = 0; impl->children && impl->children[i]; i++) {
++ r = nw_bus_register_implementation(bus, impl->children[i], data);
++ if (r)
++ return r;
++ }
++
+ return 0;
+ }
+diff --git a/src/networkd/bus.h b/src/networkd/bus.h
+index 55e65b8..6232ebb 100644
+--- a/src/networkd/bus.h
++++ b/src/networkd/bus.h
+@@ -37,8 +37,11 @@ struct nw_bus_implementation {
+ const char* interface;
+
+ const sd_bus_vtable** vtables;
++ sd_bus_node_enumerator_t node_enumerator;
++ const struct nw_bus_implementation** children;
+ };
+
++#define BUS_IMPLEMENTATIONS(...) ((const struct nw_bus_implementation* []) { __VA_ARGS__, NULL })
+ #define BUS_VTABLES(...) ((const sd_bus_vtable* []){ __VA_ARGS__, NULL })
+
+ int nw_bus_register_implementation(sd_bus* bus,
+diff --git a/src/networkd/zone-bus.c b/src/networkd/zone-bus.c
+index 97396c5..ebd8789 100644
+--- a/src/networkd/zone-bus.c
++++ b/src/networkd/zone-bus.c
+@@ -19,9 +19,38 @@
+ #############################################################################*/
+
+ #include "bus.h"
++#include "daemon.h"
++#include "logging.h"
++#include "zone.h"
+ #include "zone-bus.h"
++#include "zones.h"
++
++static int nw_zone_node_enumerator(sd_bus* bus, const char* path, void* data,
++ char*** nodes, sd_bus_error* error) {
++ int r;
++
++ DEBUG("Enumerating zones...\n");
++
++ // Fetch a reference to the daemon
++ struct nw_daemon* daemon = (struct nw_daemon*)data;
++
++ // Fetch zones
++ struct nw_zones* zones = nw_daemon_zones(daemon);
++
++ // Make bus paths for all zones
++ r = nw_zones_bus_paths(zones, nodes);
++ if (r)
++ goto ERROR;
++
++ERROR:
++ nw_zones_unref(zones);
++
++ return r;
++}
+
+ const struct nw_bus_implementation zone_bus_impl = {
+ "/org/ipfire/network1/zone",
+ "org.ipfire.network1.Zone",
++ //.fallback_vtables = BUS_FALLBACK_VTABLES({zone_bus_vtable, nw_zone_object_find}),
++ .node_enumerator = nw_zone_node_enumerator,
+ };
+diff --git a/src/networkd/zone.c b/src/networkd/zone.c
+index 4790d33..f78334e 100644
+--- a/src/networkd/zone.c
++++ b/src/networkd/zone.c
+@@ -21,6 +21,8 @@
+ #include <limits.h>
+ #include <stdlib.h>
+
++#include <systemd/sd-bus.h>
++
+ #include "config.h"
+ #include "string.h"
+ #include "zone.h"
+@@ -130,3 +132,15 @@ struct nw_zone* nw_zone_unref(struct nw_zone* zone) {
+ const char* nw_zone_name(struct nw_zone* zone) {
+ return zone->name;
+ }
++
++char* nw_zone_bus_path(struct nw_zone* zone) {
++ char* p = NULL;
++ int r;
++
++ // Encode the bus path
++ r = sd_bus_path_encode("/org/ipfire/network1/zone", zone->name, &p);
++ if (r < 0)
++ return NULL;
++
++ return p;
++}
+diff --git a/src/networkd/zone.h b/src/networkd/zone.h
+index 78287ab..081a720 100644
+--- a/src/networkd/zone.h
++++ b/src/networkd/zone.h
+@@ -32,4 +32,6 @@ struct nw_zone* nw_zone_unref(struct nw_zone* zone);
+
+ const char* nw_zone_name(struct nw_zone* zone);
+
++char* nw_zone_bus_path(struct nw_zone* zone);
++
+ #endif /* NETWORKD_ZONE_H */
+diff --git a/src/networkd/zones.c b/src/networkd/zones.c
+index 7d04267..4f739f5 100644
+--- a/src/networkd/zones.c
++++ b/src/networkd/zones.c
+@@ -37,7 +37,11 @@ struct nw_zones_entry {
+ struct nw_zones {
+ int nrefs;
+
++ // Zone Entries
+ STAILQ_HEAD(entries, nw_zones_entry) entries;
++
++ // A counter of the zone entries
++ unsigned int num;
+ };
+
+ static int nw_zones_create(struct nw_zones** zones) {
+@@ -100,6 +104,9 @@ static int nw_zones_add_zone(struct nw_zones* zones, struct nw_zone* zone) {
+ // Add it to the list
+ STAILQ_INSERT_TAIL(&zones->entries, entry, nodes);
+
++ // Increment the counter
++ zones->num++;
++
+ return 0;
+ }
+
+@@ -211,3 +218,40 @@ struct nw_zone* nw_zones_get_by_name(struct nw_zones* zones, const char* name) {
+ // No match found
+ return NULL;
+ }
++
++int nw_zones_bus_paths(struct nw_zones* zones, char*** paths) {
++ struct nw_zones_entry* entry = NULL;
++ char* path = NULL;
++
++ // Allocate an array for all paths
++ char** p = calloc(zones->num + 1, sizeof(*p));
++ if (!p)
++ return 1;
++
++ unsigned int i = 0;
++
++ // Walk through all zones
++ STAILQ_FOREACH(entry, &zones->entries, nodes) {
++ // Generate the bus path
++ path = nw_zone_bus_path(entry->zone);
++ if (!path)
++ goto ERROR;
++
++ // Append the bus path to the array
++ p[i++] = path;
++ }
++
++ // Return pointer
++ *paths = p;
++
++ return 0;
++
++ERROR:
++ if (p) {
++ for (char** e = p; *e; e++)
++ free(*e);
++ free(p);
++ }
++
++ return 1;
++}
+diff --git a/src/networkd/zones.h b/src/networkd/zones.h
+index 0d34c3e..6e2686d 100644
+--- a/src/networkd/zones.h
++++ b/src/networkd/zones.h
+@@ -32,4 +32,6 @@ size_t nw_zones_num(struct nw_zones* zones);
+
+ struct nw_zone* nw_zones_get_by_name(struct nw_zones* zones, const char* name);
+
++int nw_zones_bus_paths(struct nw_zones* zones, char*** paths);
++
+ #endif /* NETWORKD_ZONES_H */
+--
+2.39.2
+
diff --git a/network/patches/0176-networkd-Return-zone-when-it-is-being-accessed-by-it.patch b/network/patches/0176-networkd-Return-zone-when-it-is-being-accessed-by-it.patch
new file mode 100644
index 000000000..0f442e34b
--- /dev/null
+++ b/network/patches/0176-networkd-Return-zone-when-it-is-being-accessed-by-it.patch
@@ -0,0 +1,159 @@
+From bd9ffd6a19a8bf403a534998e0c2d3e2bf9b51c1 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Thu, 2 Feb 2023 01:07:51 +0000
+Subject: [PATCH 176/304] networkd: Return zone when it is being accessed by
+ its path
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/bus.c | 12 ++++++++++++
+ src/networkd/bus.h | 8 +++++++-
+ src/networkd/daemon.c | 11 +++++++++++
+ src/networkd/daemon.h | 4 ++++
+ src/networkd/zone-bus.c | 34 +++++++++++++++++++++++++++++++++-
+ 5 files changed, 67 insertions(+), 2 deletions(-)
+
+diff --git a/src/networkd/bus.c b/src/networkd/bus.c
+index 26876fa..cab2ae6 100644
+--- a/src/networkd/bus.c
++++ b/src/networkd/bus.c
+@@ -162,6 +162,7 @@ int nw_bus_register_implementation(sd_bus* bus,
+ DEBUG("Registering bus object implementation for path=%s iface=%s\n",
+ impl->path, impl->interface);
+
++ // Register vtables
+ for (const sd_bus_vtable** vtable = impl->vtables; vtable && *vtable; vtable++) {
+ r = sd_bus_add_object_vtable(bus, NULL, impl->path, impl->interface, *vtable, data);
+ if (r < 0) {
+@@ -171,6 +172,17 @@ int nw_bus_register_implementation(sd_bus* bus,
+ }
+ }
+
++ // Register fallback vtables
++ for (const struct nw_bus_vtable_pair* p = impl->fallback_vtables; p && p->vtable; p++) {
++ r = sd_bus_add_fallback_vtable(bus, NULL, impl->path, impl->interface,
++ p->vtable, p->object_find, data);
++ if (r < 0) {
++ ERROR("Could not register bus path %s with interface %s: %m\n",
++ impl->path, impl->interface);
++ return 1;
++ }
++ }
++
+ // Register the node enumerator
+ if (impl->node_enumerator) {
+ r = sd_bus_add_node_enumerator(bus, NULL, impl->path, impl->node_enumerator, data);
+diff --git a/src/networkd/bus.h b/src/networkd/bus.h
+index 6232ebb..42ab2d3 100644
+--- a/src/networkd/bus.h
++++ b/src/networkd/bus.h
+@@ -32,15 +32,21 @@
+
+ int nw_bus_connect(sd_bus* bus, sd_event* loop, struct nw_daemon* daemon);
+
++struct nw_bus_vtable_pair {
++ const sd_bus_vtable* vtable;
++ sd_bus_object_find_t object_find;
++};
++
+ struct nw_bus_implementation {
+ const char* path;
+ const char* interface;
+-
+ const sd_bus_vtable** vtables;
++ const struct nw_bus_vtable_pair* fallback_vtables;
+ sd_bus_node_enumerator_t node_enumerator;
+ const struct nw_bus_implementation** children;
+ };
+
++#define BUS_FALLBACK_VTABLES(...) ((const struct nw_bus_vtable_pair[]) { __VA_ARGS__, {} })
+ #define BUS_IMPLEMENTATIONS(...) ((const struct nw_bus_implementation* []) { __VA_ARGS__, NULL })
+ #define BUS_VTABLES(...) ((const sd_bus_vtable* []){ __VA_ARGS__, NULL })
+
+diff --git a/src/networkd/daemon.c b/src/networkd/daemon.c
+index 588aa4e..5b5cbb4 100644
+--- a/src/networkd/daemon.c
++++ b/src/networkd/daemon.c
+@@ -236,6 +236,17 @@ int nw_daemon_reload(struct nw_daemon* daemon) {
+ return 0;
+ }
+
++/*
++ Zones
++*/
++
+ struct nw_zones* nw_daemon_zones(struct nw_daemon* daemon) {
+ return nw_zones_ref(daemon->zones);
+ }
++
++struct nw_zone* nw_daemon_get_zone_by_name(struct nw_daemon* daemon, const char* name) {
++ if (!daemon->zones)
++ return NULL;
++
++ return nw_zones_get_by_name(daemon->zones, name);
++}
+diff --git a/src/networkd/daemon.h b/src/networkd/daemon.h
+index bc69795..891c297 100644
+--- a/src/networkd/daemon.h
++++ b/src/networkd/daemon.h
+@@ -34,6 +34,10 @@ int nw_daemon_run(struct nw_daemon* daemon);
+
+ int nw_daemon_reload(struct nw_daemon* daemon);
+
++/*
++ Zones
++*/
+ struct nw_zones* nw_daemon_zones(struct nw_daemon* daemon);
++struct nw_zone* nw_daemon_get_zone_by_name(struct nw_daemon* daemon, const char* name);
+
+ #endif /* NETWORKD_DAEMON_H */
+diff --git a/src/networkd/zone-bus.c b/src/networkd/zone-bus.c
+index ebd8789..aafbfaf 100644
+--- a/src/networkd/zone-bus.c
++++ b/src/networkd/zone-bus.c
+@@ -48,9 +48,41 @@ ERROR:
+ return r;
+ }
+
++static int nw_zone_object_find(sd_bus* bus, const char* path, const char* interface,
++ void* data, void** found, sd_bus_error* error) {
++ char* name = NULL;
++ int r;
++
++ // Fetch a reference to the daemon
++ struct nw_daemon* daemon = (struct nw_daemon*)data;
++
++ // Decode the path of the requested object
++ r = sd_bus_path_decode(path, "/org/ipfire/network1/zone", &name);
++ if (r <= 0)
++ return 0;
++
++ // Find the zone
++ struct nw_zone* zone = nw_daemon_get_zone_by_name(daemon, name);
++ if (!zone)
++ return 0;
++
++ // Match!
++ *found = zone;
++
++ nw_zone_unref(zone);
++
++ return 1;
++}
++
++static const sd_bus_vtable zone_vtable[] = {
++ SD_BUS_VTABLE_START(0),
++
++ SD_BUS_VTABLE_END
++};
++
+ const struct nw_bus_implementation zone_bus_impl = {
+ "/org/ipfire/network1/zone",
+ "org.ipfire.network1.Zone",
+- //.fallback_vtables = BUS_FALLBACK_VTABLES({zone_bus_vtable, nw_zone_object_find}),
++ .fallback_vtables = BUS_FALLBACK_VTABLES({zone_vtable, nw_zone_object_find}),
+ .node_enumerator = nw_zone_node_enumerator,
+ };
+--
+2.39.2
+
diff --git a/network/patches/0177-networkd-Split-daemon-bus-implementation-into-a-sepa.patch b/network/patches/0177-networkd-Split-daemon-bus-implementation-into-a-sepa.patch
new file mode 100644
index 000000000..d1219c248
--- /dev/null
+++ b/network/patches/0177-networkd-Split-daemon-bus-implementation-into-a-sepa.patch
@@ -0,0 +1,175 @@
+From d6edaf630588fbc6b54a315f49f252e226c15342 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Thu, 2 Feb 2023 01:23:31 +0000
+Subject: [PATCH 177/304] networkd: Split daemon bus implementation into a
+ separate file
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 2 ++
+ src/networkd/bus.c | 29 ++---------------------
+ src/networkd/daemon-bus.c | 49 +++++++++++++++++++++++++++++++++++++++
+ src/networkd/daemon-bus.h | 28 ++++++++++++++++++++++
+ 4 files changed, 81 insertions(+), 27 deletions(-)
+ create mode 100644 src/networkd/daemon-bus.c
+ create mode 100644 src/networkd/daemon-bus.h
+
+diff --git a/Makefile.am b/Makefile.am
+index ae4cb85..3972d8d 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -314,6 +314,8 @@ dist_networkd_SOURCES = \
+ src/networkd/config.h \
+ src/networkd/daemon.c \
+ src/networkd/daemon.h \
++ src/networkd/daemon-bus.c \
++ src/networkd/daemon-bus.h \
+ src/networkd/logging.h \
+ src/networkd/main.c \
+ src/networkd/string.h \
+diff --git a/src/networkd/bus.c b/src/networkd/bus.c
+index cab2ae6..258aacd 100644
+--- a/src/networkd/bus.c
++++ b/src/networkd/bus.c
+@@ -19,39 +19,14 @@
+ #############################################################################*/
+
+ #include <stdlib.h>
+-#include <string.h>
+
+ #include <systemd/sd-bus.h>
+ #include <systemd/sd-event.h>
+
+ #include "bus.h"
+ #include "daemon.h"
++#include "daemon-bus.h"
+ #include "logging.h"
+-#include "zone-bus.h"
+-
+-static int nw_bus_daemon_reload(sd_bus_message* m, void* data, sd_bus_error* error) {
+- struct nw_daemon* daemon = (struct nw_daemon*)data;
+-
+- // Reload the daemon
+- nw_daemon_reload(daemon);
+-
+- // Respond with an empty message
+- return sd_bus_reply_method_return(m, NULL);
+-}
+-
+-static const sd_bus_vtable daemon_vtable[] = {
+- SD_BUS_VTABLE_START(0),
+- SD_BUS_METHOD("Reload", SD_BUS_NO_ARGS, SD_BUS_NO_RESULT,
+- nw_bus_daemon_reload, SD_BUS_VTABLE_UNPRIVILEGED),
+- SD_BUS_VTABLE_END,
+-};
+-
+-const struct nw_bus_implementation daemon_implementation = {
+- .path = "/org/ipfire/network1",
+- .interface = "org.ipfire.network1",
+- .vtables = BUS_VTABLES(daemon_vtable),
+- .children = BUS_IMPLEMENTATIONS(&zone_bus_impl),
+-};
+
+ static int nw_bus_on_connect(sd_bus_message* m, void* data, sd_bus_error* error) {
+ struct nw_daemon* daemon = (struct nw_daemon*)data;
+@@ -126,7 +101,7 @@ int nw_bus_connect(sd_bus* bus, sd_event* loop, struct nw_daemon* daemon) {
+ }
+
+ // Register the implementation
+- r = nw_bus_register_implementation(bus, &daemon_implementation, daemon);
++ r = nw_bus_register_implementation(bus, &daemon_bus_impl, daemon);
+ if (r)
+ return r;
+
+diff --git a/src/networkd/daemon-bus.c b/src/networkd/daemon-bus.c
+new file mode 100644
+index 0000000..aac9775
+--- /dev/null
++++ b/src/networkd/daemon-bus.c
+@@ -0,0 +1,49 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#include <systemd/sd-bus.h>
++
++#include "bus.h"
++#include "daemon.h"
++#include "zone-bus.h"
++
++static int nw_daemon_bus_reload(sd_bus_message* m, void* data, sd_bus_error* error) {
++ struct nw_daemon* daemon = (struct nw_daemon*)data;
++
++ // Reload the daemon
++ nw_daemon_reload(daemon);
++
++ // Respond with an empty message
++ return sd_bus_reply_method_return(m, NULL);
++}
++
++static const sd_bus_vtable daemon_vtable[] = {
++ SD_BUS_VTABLE_START(0),
++ SD_BUS_METHOD("Reload", SD_BUS_NO_ARGS, SD_BUS_NO_RESULT,
++ nw_daemon_bus_reload, SD_BUS_VTABLE_UNPRIVILEGED),
++ SD_BUS_VTABLE_END,
++};
++
++const struct nw_bus_implementation daemon_bus_impl = {
++ .path = "/org/ipfire/network1",
++ .interface = "org.ipfire.network1",
++ .vtables = BUS_VTABLES(daemon_vtable),
++ .children = BUS_IMPLEMENTATIONS(&zone_bus_impl),
++};
+diff --git a/src/networkd/daemon-bus.h b/src/networkd/daemon-bus.h
+new file mode 100644
+index 0000000..787e92a
+--- /dev/null
++++ b/src/networkd/daemon-bus.h
+@@ -0,0 +1,28 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#ifndef NETWORKD_DAEMON_BUS_H
++#define NETWORKD_DAEMON_BUS_H
++
++#include "bus.h"
++
++extern const struct nw_bus_implementation daemon_bus_impl;
++
++#endif /* NETWORKD_DAEMON_BUS_H */
+--
+2.39.2
+
diff --git a/network/patches/0178-networkd-Add-a-test-bus-property-to-set-the-MTU.patch b/network/patches/0178-networkd-Add-a-test-bus-property-to-set-the-MTU.patch
new file mode 100644
index 000000000..2e5452d76
--- /dev/null
+++ b/network/patches/0178-networkd-Add-a-test-bus-property-to-set-the-MTU.patch
@@ -0,0 +1,201 @@
+From 9368a163388c9f8665dbdedaccae70ee168df714 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 4 Feb 2023 22:10:56 +0000
+Subject: [PATCH 178/304] networkd: Add a test bus property to set the MTU
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/config.c | 38 +++++++++++++++++++++++++-------------
+ src/networkd/config.h | 5 +++--
+ src/networkd/zone-bus.c | 34 ++++++++++++++++++++++++++++++++++
+ src/networkd/zone.c | 14 ++++++++++++++
+ src/networkd/zone.h | 7 +++++++
+ 5 files changed, 83 insertions(+), 15 deletions(-)
+
+diff --git a/src/networkd/config.c b/src/networkd/config.c
+index e531ec6..788308f 100644
+--- a/src/networkd/config.c
++++ b/src/networkd/config.c
+@@ -273,6 +273,17 @@ int nw_config_del(struct nw_config* config, const char* key) {
+ return 0;
+ }
+
++const char* nw_config_get(struct nw_config* config, const char* key) {
++ struct nw_config_entry* entry = nw_config_find(config, key);
++
++ // Return the value if found and set
++ if (entry && *entry->value)
++ return entry->value;
++
++ // Otherwise return NULL
++ return NULL;
++}
++
+ int nw_config_set(struct nw_config* config, const char* key, const char* value) {
+ struct nw_config_entry* entry = NULL;
+
+@@ -294,23 +305,24 @@ int nw_config_set(struct nw_config* config, const char* key, const char* value)
+ return nw_string_set(entry->value, value);
+ }
+
+-const char* nw_config_get(struct nw_config* config, const char* key) {
+- struct nw_config_entry* entry = nw_config_find(config, key);
+-
+- // Return the value if found and set
+- if (entry && *entry->value)
+- return entry->value;
+-
+- // Otherwise return NULL
+- return NULL;
+-}
+-
+-unsigned int nw_config_get_unsigned_int(struct nw_config* config, const char* key) {
++int nw_config_get_int(struct nw_config* config, const char* key, const int __default) {
+ const char* value = nw_config_get(config, key);
+
+ // Return zero if not set
+ if (!value)
+- return 0;
++ return __default;
+
+ return strtoul(value, NULL, 10);
+ }
++
++int nw_config_set_int(struct nw_config* config, const char* key, const int value) {
++ char __value[1024];
++ int r;
++
++ // Format the value as string
++ r = nw_string_format(__value, "%d\n", value);
++ if (r)
++ return r;
++
++ return nw_config_set(config, key, __value);
++}
+diff --git a/src/networkd/config.h b/src/networkd/config.h
+index 5b9910b..b8d8555 100644
+--- a/src/networkd/config.h
++++ b/src/networkd/config.h
+@@ -42,9 +42,10 @@ int nw_config_write(struct nw_config* config);
+
+ int nw_config_del(struct nw_config* config, const char* key);
+
++const char* nw_config_get(struct nw_config* config, const char* key);
+ int nw_config_set(struct nw_config* config, const char* key, const char* value);
+
+-const char* nw_config_get(struct nw_config* config, const char* key);
+-unsigned int nw_config_get_unsigned_int(struct nw_config* config, const char* key);
++int nw_config_get_int(struct nw_config* config, const char* key, const int __default);
++int nw_config_set_int(struct nw_config* config, const char* key, const int value);
+
+ #endif /* NETWORKD_CONFIG_H */
+diff --git a/src/networkd/zone-bus.c b/src/networkd/zone-bus.c
+index aafbfaf..e9c2ecc 100644
+--- a/src/networkd/zone-bus.c
++++ b/src/networkd/zone-bus.c
+@@ -18,6 +18,8 @@
+ # #
+ #############################################################################*/
+
++#include <errno.h>
++
+ #include "bus.h"
+ #include "daemon.h"
+ #include "logging.h"
+@@ -74,9 +76,41 @@ static int nw_zone_object_find(sd_bus* bus, const char* path, const char* interf
+ return 1;
+ }
+
++/*
++ MTU
++*/
++static int nw_zone_bus_get_mtu(sd_bus* bus, const char *path, const char *interface,
++ const char* property, sd_bus_message* reply, void* data, sd_bus_error *error) {
++ struct nw_zone* zone = (struct nw_zone*)data;
++
++ return sd_bus_message_append(reply, "u", nw_zone_mtu(zone));
++}
++
++static int nw_zone_bus_set_mtu(sd_bus* bus, const char* path, const char* interface,
++ const char* property, sd_bus_message* value, void* data, sd_bus_error* error) {
++ unsigned int mtu = 0;
++ int r;
++
++ struct nw_zone* zone = (struct nw_zone*)data;
++
++ // Parse the value
++ r = sd_bus_message_read(value, "u", &mtu);
++ if (r < 0)
++ return r;
++
++ if (!nw_zone_set_mtu(zone, mtu))
++ return -errno;
++
++ return 0;
++}
++
+ static const sd_bus_vtable zone_vtable[] = {
+ SD_BUS_VTABLE_START(0),
+
++ // MTU
++ SD_BUS_WRITABLE_PROPERTY("MTU", "u", nw_zone_bus_get_mtu, nw_zone_bus_set_mtu,
++ 0, SD_BUS_VTABLE_PROPERTY_EMITS_CHANGE),
++
+ SD_BUS_VTABLE_END
+ };
+
+diff --git a/src/networkd/zone.c b/src/networkd/zone.c
+index f78334e..c64706f 100644
+--- a/src/networkd/zone.c
++++ b/src/networkd/zone.c
+@@ -24,6 +24,7 @@
+ #include <systemd/sd-bus.h>
+
+ #include "config.h"
++#include "logging.h"
+ #include "string.h"
+ #include "zone.h"
+
+@@ -144,3 +145,16 @@ char* nw_zone_bus_path(struct nw_zone* zone) {
+
+ return p;
+ }
++
++/*
++ MTU
++*/
++unsigned int nw_zone_mtu(struct nw_zone* zone) {
++ return nw_config_get_int(zone->config, "MTU", NETWORK_ZONE_DEFAULT_MTU);
++}
++
++int nw_zone_set_mtu(struct nw_zone* zone, unsigned int mtu) {
++ DEBUG("Change MTU of %s to %u\n", zone->name, mtu);
++
++ return nw_config_set_int(zone->config, "MTU", mtu);
++}
+diff --git a/src/networkd/zone.h b/src/networkd/zone.h
+index 081a720..4a00412 100644
+--- a/src/networkd/zone.h
++++ b/src/networkd/zone.h
+@@ -22,6 +22,7 @@
+ #define NETWORKD_ZONE_H
+
+ #define NETWORK_ZONE_NAME_MAX_LENGTH 16
++#define NETWORK_ZONE_DEFAULT_MTU 1500
+
+ struct nw_zone;
+
+@@ -34,4 +35,10 @@ const char* nw_zone_name(struct nw_zone* zone);
+
+ char* nw_zone_bus_path(struct nw_zone* zone);
+
++/*
++ MTU
++*/
++unsigned int nw_zone_mtu(struct nw_zone* zone);
++int nw_zone_set_mtu(struct nw_zone* zone, unsigned int mtu);
++
+ #endif /* NETWORKD_ZONE_H */
+--
+2.39.2
+
diff --git a/network/patches/0179-networkd-Connect-to-udev.patch b/network/patches/0179-networkd-Connect-to-udev.patch
new file mode 100644
index 000000000..e5e06191b
--- /dev/null
+++ b/network/patches/0179-networkd-Connect-to-udev.patch
@@ -0,0 +1,203 @@
+From b286cd831946a3134f5355fe45901a8a4057dce1 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 5 Feb 2023 11:05:23 +0000
+Subject: [PATCH 179/304] networkd: Connect to udev
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 2 ++
+ src/networkd/daemon.c | 64 +++++++++++++++++++++++++++++++++++++++++++
+ src/networkd/devmon.c | 27 ++++++++++++++++++
+ src/networkd/devmon.h | 28 +++++++++++++++++++
+ 4 files changed, 121 insertions(+)
+ create mode 100644 src/networkd/devmon.c
+ create mode 100644 src/networkd/devmon.h
+
+diff --git a/Makefile.am b/Makefile.am
+index 3972d8d..2ebe622 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -316,6 +316,8 @@ dist_networkd_SOURCES = \
+ src/networkd/daemon.h \
+ src/networkd/daemon-bus.c \
+ src/networkd/daemon-bus.h \
++ src/networkd/devmon.c \
++ src/networkd/devmon.h \
+ src/networkd/logging.h \
+ src/networkd/main.c \
+ src/networkd/string.h \
+diff --git a/src/networkd/daemon.c b/src/networkd/daemon.c
+index 5b5cbb4..960fd96 100644
+--- a/src/networkd/daemon.c
++++ b/src/networkd/daemon.c
+@@ -23,15 +23,20 @@
+
+ #include <systemd/sd-bus.h>
+ #include <systemd/sd-daemon.h>
++#include <systemd/sd-device.h>
+ #include <systemd/sd-event.h>
+
+ #include "bus.h"
+ #include "config.h"
+ #include "daemon.h"
++#include "devmon.h"
+ #include "logging.h"
+ #include "zone.h"
+ #include "zones.h"
+
++// Increase the receive buffer to 128 MiB
++#define RCVBUF_SIZE 128 * 1024 * 1024
++
+ struct nw_daemon {
+ int nrefs;
+
+@@ -43,6 +48,9 @@ struct nw_daemon {
+ // DBus Connection
+ sd_bus* bus;
+
++ // udev Connection
++ sd_device_monitor* devmon;
++
+ // Zones
+ struct nw_zones* zones;
+ };
+@@ -126,6 +134,57 @@ static int nw_daemon_load_config(struct nw_daemon* daemon) {
+ return r;
+ }
+
++static int nw_start_device_monitor(struct nw_daemon* daemon) {
++ int r;
++
++ const char* subsystems[] = {
++ "net",
++ "ieee80211",
++ "rfkill",
++ NULL,
++ };
++
++ // Create a new connection to monitor any devices
++ r = sd_device_monitor_new(&daemon->devmon);
++ if (r < 0) {
++ ERROR("Could not inititalize the device monitor: %m\n");
++ return 1;
++ }
++
++ // Increase the receive buffer
++ r = sd_device_monitor_set_receive_buffer_size(daemon->devmon, RCVBUF_SIZE);
++ if (r < 0) {
++ ERROR("Could not increase buffer size for the device monitor: %m\n");
++ return 1;
++ }
++
++ // Filter for events for all relevant subsystems
++ for (const char** subsystem = subsystems; *subsystem; subsystem++) {
++ r = sd_device_monitor_filter_add_match_subsystem_devtype(
++ daemon->devmon, *subsystem, NULL);
++ if (r < 1) {
++ ERROR("Could not add device monitor for the %s subsystem: %m\n", *subsystem);
++ return 1;
++ }
++ }
++
++ // Attach the device monitor to the event loop
++ r = sd_device_monitor_attach_event(daemon->devmon, daemon->loop);
++ if (r < 0) {
++ ERROR("Could not attach the device monitor to the event loop: %m\n");
++ return 1;
++ }
++
++ // Start processing events...
++ r = sd_device_monitor_start(daemon->devmon, nw_devmon_handle_uevent, daemon);
++ if (r < 0) {
++ ERROR("Could not start the device monitor: %m\n");
++ return 1;
++ }
++
++ return 0;
++}
++
+ static int nw_daemon_setup(struct nw_daemon* daemon) {
+ int r;
+
+@@ -144,6 +203,11 @@ static int nw_daemon_setup(struct nw_daemon* daemon) {
+ if (r)
+ return r;
+
++ // Connect to udev
++ r = nw_start_device_monitor(daemon);
++ if (r)
++ return r;
++
+ return 0;
+ }
+
+diff --git a/src/networkd/devmon.c b/src/networkd/devmon.c
+new file mode 100644
+index 0000000..0a8c26d
+--- /dev/null
++++ b/src/networkd/devmon.c
+@@ -0,0 +1,27 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#include <systemd/sd-device.h>
++
++#include "devmon.h"
++
++int nw_devmon_handle_uevent(sd_device_monitor* monitor, sd_device* device, void* data) {
++ return 0;
++}
+diff --git a/src/networkd/devmon.h b/src/networkd/devmon.h
+new file mode 100644
+index 0000000..0d8970a
+--- /dev/null
++++ b/src/networkd/devmon.h
+@@ -0,0 +1,28 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#ifndef NETWORKD_DEVMON_H
++#define NETWORKD_DEVMON_H
++
++#include <systemd/sd-device.h>
++
++int nw_devmon_handle_uevent(sd_device_monitor* monitor, sd_device* device, void* data);
++
++#endif /* NETWORKD_DEVMON_H */
+--
+2.39.2
+
diff --git a/network/patches/0180-networkd-Change-to-a-non-privileged-user-right-away.patch b/network/patches/0180-networkd-Change-to-a-non-privileged-user-right-away.patch
new file mode 100644
index 000000000..71fb343c5
--- /dev/null
+++ b/network/patches/0180-networkd-Change-to-a-non-privileged-user-right-away.patch
@@ -0,0 +1,105 @@
+From eb3f6449e9319715fbb6135b1a47d18eaac2169e Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 5 Feb 2023 12:06:19 +0000
+Subject: [PATCH 180/304] networkd: Change to a non-privileged user right away
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/main.c | 73 ++++++++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 72 insertions(+), 1 deletion(-)
+
+diff --git a/src/networkd/main.c b/src/networkd/main.c
+index 51a9bba..fbd6c3b 100644
+--- a/src/networkd/main.c
++++ b/src/networkd/main.c
+@@ -18,15 +18,86 @@
+ # #
+ #############################################################################*/
+
++#include <grp.h>
++#include <pwd.h>
+ #include <stddef.h>
++#include <sys/prctl.h>
++#include <sys/types.h>
++#include <unistd.h>
+
+ #include "daemon.h"
++#include "logging.h"
++
++static int drop_privileges(const char* user) {
++ struct passwd* passwd = NULL;
++ int r;
++
++ // Fetch the current user
++ uid_t current_uid = getuid();
++
++ // If we have not been launched by root, we will assume that we have already
++ // been launched with a minimal set of privileges.
++ if (current_uid > 0)
++ return 0;
++
++ DEBUG("Dropping privileges...\n");
++
++ // Fetch information about the desired user
++ passwd = getpwnam(user);
++ if (!passwd) {
++ ERROR("Could not find user %s: %m\n", user);
++ return 1;
++ }
++
++ uid_t uid = passwd->pw_uid;
++ gid_t gid = passwd->pw_gid;
++
++ // Change group
++ r = setresgid(gid, gid, gid);
++ if (r) {
++ ERROR("Could not change group to %d: %m\n", gid);
++ return 1;
++ }
++
++ // Set any supplementary groups
++ r = setgroups(0, NULL);
++ if (r) {
++ ERROR("Could not set supplementary groups: %m\n");
++ return 1;
++ }
++
++ // Do not drop any capabilities when we change to the new user
++ r = prctl(PR_SET_KEEPCAPS, 1);
++ if (r) {
++ ERROR("Could not set PR_SET_KEEPCAPS: %m\n");
++ return 1;
++ }
++
++ // Change to the new user
++ r = setresuid(uid, uid, uid);
++ if (r) {
++ ERROR("Could not change user to %d: %m\n", uid);
++ return 1;
++ }
++
++ // Reset PR_SET_KEEPCAPS
++ r = prctl(PR_SET_KEEPCAPS, 0);
++ if (r) {
++ ERROR("Could not set PR_SET_KEEPCAPS: %m\n");
++ return 1;
++ }
++
++ return 0;
++}
+
+ int main(int argc, char** argv) {
+ struct nw_daemon* daemon = NULL;
+ int r;
+
+- // XXX Drop privileges
++ // Drop privileges
++ r = drop_privileges("network");
++ if (r)
++ return r;
+
+ // Create the daemon
+ r = nw_daemon_create(&daemon);
+--
+2.39.2
+
diff --git a/network/patches/0181-networkd-Drop-all-capabilities-except-a-few-we-would.patch b/network/patches/0181-networkd-Drop-all-capabilities-except-a-few-we-would.patch
new file mode 100644
index 000000000..50d627fdc
--- /dev/null
+++ b/network/patches/0181-networkd-Drop-all-capabilities-except-a-few-we-would.patch
@@ -0,0 +1,195 @@
+From dabf344de60d568e304a7f4d10548813ee4ce588 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 5 Feb 2023 13:17:21 +0000
+Subject: [PATCH 181/304] networkd: Drop all capabilities except a few we would
+ like to keep
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 2 +
+ configure.ac | 1 +
+ src/networkd/main.c | 121 ++++++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 124 insertions(+)
+
+diff --git a/Makefile.am b/Makefile.am
+index 2ebe622..df61552 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -334,12 +334,14 @@ networkd_CPPFLAGS = \
+
+ networkd_CFLAGS = \
+ $(AM_CFLAGS) \
++ $(CAP_CFLAGS) \
+ $(SYSTEMD_CFLAGS)
+
+ networkd_LDFLAGS = \
+ $(AM_LDFLAGS)
+
+ networkd_LDADD = \
++ $(CAP_LIBS) \
+ $(SYSTEMD_LIBS)
+
+ dist_dbuspolicy_DATA += \
+diff --git a/configure.ac b/configure.ac
+index 16f0724..e1baa64 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -172,6 +172,7 @@ AM_CONDITIONAL(HAVE_UDEV, [test -n "$with_udevdir"])
+
+ # ------------------------------------------------------------------------------
+
++PKG_CHECK_MODULES([CAP], [libcap])
+ PKG_CHECK_MODULES([LIBNL], [libnl-3.0 libnl-genl-3.0])
+ PKG_CHECK_MODULES([SYSTEMD], [libsystemd])
+
+diff --git a/src/networkd/main.c b/src/networkd/main.c
+index fbd6c3b..9a0fd74 100644
+--- a/src/networkd/main.c
++++ b/src/networkd/main.c
+@@ -19,8 +19,10 @@
+ #############################################################################*/
+
+ #include <grp.h>
++#include <linux/capability.h>
+ #include <pwd.h>
+ #include <stddef.h>
++#include <sys/capability.h>
+ #include <sys/prctl.h>
+ #include <sys/types.h>
+ #include <unistd.h>
+@@ -28,6 +30,120 @@
+ #include "daemon.h"
+ #include "logging.h"
+
++static int cap_acquire_setpcap(void) {
++ cap_flag_value_t value;
++ int r;
++
++ // Fetch current capabilities
++ cap_t caps = cap_get_proc();
++
++ // Check if CAP_SETPCAP is already enabled
++ r = cap_get_flag(caps, CAP_SETPCAP, CAP_EFFECTIVE, &value);
++ if (r) {
++ ERROR("The kernel does not seem to know CAP_SETPCAP: %m\n");
++ goto ERROR;
++ }
++
++ // It CAP_SETPCAP isn't set, we will try to set it
++ if (value != CAP_SET) {
++ const cap_value_t cap = CAP_SETPCAP;
++
++ r = cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap, CAP_SET);
++ if (r) {
++ ERROR("Could not set CAP_SETPCAP: %m\n");
++ goto ERROR;
++ }
++
++ // Store capabilities
++ r = cap_set_proc(caps);
++ if (r) {
++ ERROR("Could not acquire effective CAP_SETPCAP capability: %m\n");
++ goto ERROR;
++ }
++ }
++
++ERROR:
++ if (caps)
++ cap_free(caps);
++
++ return r;
++}
++
++static cap_flag_value_t keep_cap(const cap_value_t cap, const cap_value_t* keep_caps) {
++ for (const cap_value_t* c = keep_caps; *c; c++) {
++ if (cap == *c)
++ return CAP_SET;
++ }
++
++ return CAP_CLEAR;
++}
++
++static int drop_capabilities(void) {
++ int r;
++
++ const cap_value_t keep_caps[] = {
++ CAP_NET_ADMIN,
++ CAP_NET_BIND_SERVICE,
++ CAP_NET_BROADCAST,
++ CAP_NET_RAW,
++ 0,
++ };
++
++ // Acquire CAP_SETPCAP
++ r = cap_acquire_setpcap();
++ if (r)
++ return r;
++
++ // Fetch the current set of capabilities
++ cap_t caps = cap_get_proc();
++
++ // Drop all capabilities that we do not need
++ for (cap_value_t cap = 1; cap <= CAP_LAST_CAP; cap++) {
++ // Skip any capabilities we would like to skip
++ cap_flag_value_t flag = keep_cap(cap, keep_caps);
++
++ // Drop the capability from the bounding set
++ if (flag == CAP_CLEAR) {
++ r = prctl(PR_CAPBSET_DROP, cap);
++ if (r) {
++ ERROR("Could not drop capability from the bounding set: %m\n");
++ goto ERROR;
++ }
++ }
++
++ r = cap_set_flag(caps, CAP_INHERITABLE, 1, &cap, CAP_CLEAR);
++ if (r) {
++ ERROR("Could not set capability %d: %m\n", (int)cap);
++ goto ERROR;
++ }
++
++ r = cap_set_flag(caps, CAP_PERMITTED, 1, &cap, flag);
++ if (r) {
++ ERROR("Could not set capability %d: %m\n", (int)cap);
++ goto ERROR;
++ }
++
++ r = cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap, flag);
++ if (r) {
++ ERROR("Could not set capability %d: %m\n", (int)cap);
++ goto ERROR;
++ }
++ }
++
++ // Restore capabilities
++ r = cap_set_proc(caps);
++ if (r) {
++ ERROR("Could not restore capabilities: %m\n");
++ goto ERROR;
++ }
++
++ERROR:
++ if (caps)
++ cap_free(caps);
++
++ return r;
++}
++
+ static int drop_privileges(const char* user) {
+ struct passwd* passwd = NULL;
+ int r;
+@@ -87,6 +203,11 @@ static int drop_privileges(const char* user) {
+ return 1;
+ }
+
++ // Drop capabilities
++ r = drop_capabilities();
++ if (r)
++ return r;
++
+ return 0;
+ }
+
+--
+2.39.2
+
diff --git a/network/patches/0182-networkd-Connect-to-the-kernel-s-netlink-interface.patch b/network/patches/0182-networkd-Connect-to-the-kernel-s-netlink-interface.patch
new file mode 100644
index 000000000..ccee33026
--- /dev/null
+++ b/network/patches/0182-networkd-Connect-to-the-kernel-s-netlink-interface.patch
@@ -0,0 +1,95 @@
+From e62b300ef78484b882d2da8683ebe79896523a13 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Thu, 9 Feb 2023 19:46:25 +0000
+Subject: [PATCH 182/304] networkd: Connect to the kernel's netlink interface
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/daemon.c | 50 +++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 50 insertions(+)
+
+diff --git a/src/networkd/daemon.c b/src/networkd/daemon.c
+index 960fd96..13e1257 100644
+--- a/src/networkd/daemon.c
++++ b/src/networkd/daemon.c
+@@ -25,6 +25,7 @@
+ #include <systemd/sd-daemon.h>
+ #include <systemd/sd-device.h>
+ #include <systemd/sd-event.h>
++#include <systemd/sd-netlink.h>
+
+ #include "bus.h"
+ #include "config.h"
+@@ -45,6 +46,9 @@ struct nw_daemon {
+ // Event Loop
+ sd_event* loop;
+
++ // Netlink Connection
++ sd_netlink* rtnl;
++
+ // DBus Connection
+ sd_bus* bus;
+
+@@ -185,6 +189,47 @@ static int nw_start_device_monitor(struct nw_daemon* daemon) {
+ return 0;
+ }
+
++static int _rtnl_dummy(sd_netlink* rtnl, sd_netlink_message* message, void* data) {
++ DEBUG("_rtnl_dummy called\n");
++
++ return 0;
++}
++
++static int nw_daemon_connect_rtnl(struct nw_daemon* daemon, int fd) {
++ int r;
++
++ // Connect to Netlink
++ r = sd_netlink_open(&daemon->rtnl);
++ if (r < 0) {
++ ERROR("Could not connect to the kernel's netlink interface: %m\n");
++ return 1;
++ }
++
++ // Increase the receive buffer
++ r = sd_netlink_increase_rxbuf(daemon->rtnl, RCVBUF_SIZE);
++ if (r < 0) {
++ ERROR("Could not increase receive buffer for the netlink socket: %m\n");
++ return 1;
++ }
++
++ // Connect it to the event loop
++ r = sd_netlink_attach_event(daemon->rtnl, daemon->loop, 0);
++ if (r < 0) {
++ ERROR("Could not connect the netlink socket to the event loop: %m\n");
++ return 1;
++ }
++
++ // Register callback for new interfaces
++ r = sd_netlink_add_match(daemon->rtnl, NULL, RTM_NEWLINK, _rtnl_dummy, NULL,
++ daemon, "networkd-RTM_NEWLINK");
++ if (r < 0) {
++ ERROR("Could not register RTM_NEWLINK: %m\n");
++ return 1;
++ }
++
++ return 0;
++}
++
+ static int nw_daemon_setup(struct nw_daemon* daemon) {
+ int r;
+
+@@ -198,6 +243,11 @@ static int nw_daemon_setup(struct nw_daemon* daemon) {
+ if (r)
+ return r;
+
++ // Connect to the kernel's netlink interface
++ r = nw_daemon_connect_rtnl(daemon, 0);
++ if (r)
++ return r;
++
+ // Connect to the system bus
+ r = nw_bus_connect(daemon->bus, daemon->loop, daemon);
+ if (r)
+--
+2.39.2
+
diff --git a/network/patches/0183-networkd-Link-against-libnetwork.patch b/network/patches/0183-networkd-Link-against-libnetwork.patch
new file mode 100644
index 000000000..73a400d3c
--- /dev/null
+++ b/network/patches/0183-networkd-Link-against-libnetwork.patch
@@ -0,0 +1,25 @@
+From b53b186e84560a3376da5e858e41c23bb4526847 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Thu, 9 Feb 2023 19:50:47 +0000
+Subject: [PATCH 183/304] networkd: Link against libnetwork
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/Makefile.am b/Makefile.am
+index df61552..80218d9 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -341,6 +341,7 @@ networkd_LDFLAGS = \
+ $(AM_LDFLAGS)
+
+ networkd_LDADD = \
++ src/libnetwork.la \
+ $(CAP_LIBS) \
+ $(SYSTEMD_LIBS)
+
+--
+2.39.2
+
diff --git a/network/patches/0184-networkd-Add-a-link-object.patch b/network/patches/0184-networkd-Add-a-link-object.patch
new file mode 100644
index 000000000..33272bae2
--- /dev/null
+++ b/network/patches/0184-networkd-Add-a-link-object.patch
@@ -0,0 +1,145 @@
+From 87a1e1e0b052f814aac355b60aedf736eef0bead Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Thu, 9 Feb 2023 20:05:00 +0000
+Subject: [PATCH 184/304] networkd: Add a link object
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 2 ++
+ src/networkd/link.c | 72 +++++++++++++++++++++++++++++++++++++++++++++
+ src/networkd/link.h | 31 +++++++++++++++++++
+ 3 files changed, 105 insertions(+)
+ create mode 100644 src/networkd/link.c
+ create mode 100644 src/networkd/link.h
+
+diff --git a/Makefile.am b/Makefile.am
+index 80218d9..e8946b7 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -318,6 +318,8 @@ dist_networkd_SOURCES = \
+ src/networkd/daemon-bus.h \
+ src/networkd/devmon.c \
+ src/networkd/devmon.h \
++ src/networkd/link.c \
++ src/networkd/link.h \
+ src/networkd/logging.h \
+ src/networkd/main.c \
+ src/networkd/string.h \
+diff --git a/src/networkd/link.c b/src/networkd/link.c
+new file mode 100644
+index 0000000..06e3101
+--- /dev/null
++++ b/src/networkd/link.c
+@@ -0,0 +1,72 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#include <stddef.h>
++#include <stdlib.h>
++
++#include "daemon.h"
++#include "link.h"
++
++struct nw_link {
++ struct nw_daemon* daemon;
++ int nrefs;
++
++ // Interface Index
++ int ifindex;
++};
++
++int nw_link_create(struct nw_link** link, struct nw_daemon* daemon, int ifindex) {
++ // Allocate a new object
++ struct nw_link* l = calloc(1, sizeof(*l));
++ if (!l)
++ return 1;
++
++ // Store a reference to the daemon
++ l->daemon = nw_daemon_ref(daemon);
++
++ // Initialize the reference counter
++ l->nrefs = 1;
++
++ // Store the ifindex
++ l->ifindex = ifindex;
++
++ *link = l;
++
++ return 0;
++}
++
++static void nw_link_free(struct nw_link* link) {
++ if (link->daemon)
++ nw_daemon_unref(link->daemon);
++}
++
++struct nw_link* nw_link_ref(struct nw_link* link) {
++ link->nrefs++;
++
++ return link;
++}
++
++struct nw_link* nw_link_unref(struct nw_link* link) {
++ if (--link->nrefs > 0)
++ return link;
++
++ nw_link_free(link);
++ return NULL;
++}
+diff --git a/src/networkd/link.h b/src/networkd/link.h
+new file mode 100644
+index 0000000..cd79fde
+--- /dev/null
++++ b/src/networkd/link.h
+@@ -0,0 +1,31 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#ifndef NETWORKD_LINK_H
++#define NETWORKD_LINK_H
++
++struct nw_link;
++
++int nw_link_create(struct nw_link** link, struct nw_daemon* daemon, int ifindex);
++
++struct nw_link* nw_link_ref(struct nw_link* link);
++struct nw_link* nw_link_unref(struct nw_link* link);
++
++#endif /* NETWORKD_LINK_H */
+--
+2.39.2
+
diff --git a/network/patches/0185-networkd-Add-a-container-for-links.patch b/network/patches/0185-networkd-Add-a-container-for-links.patch
new file mode 100644
index 000000000..327ce5c39
--- /dev/null
+++ b/network/patches/0185-networkd-Add-a-container-for-links.patch
@@ -0,0 +1,303 @@
+From 18b8c8415c595442f796638f85a244915339c974 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Thu, 9 Feb 2023 20:25:29 +0000
+Subject: [PATCH 185/304] networkd: Add a container for links
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 2 +
+ src/networkd/daemon.c | 48 ++++++++++++++++++-
+ src/networkd/link.h | 2 +
+ src/networkd/links.c | 105 ++++++++++++++++++++++++++++++++++++++++++
+ src/networkd/links.h | 35 ++++++++++++++
+ 5 files changed, 190 insertions(+), 2 deletions(-)
+ create mode 100644 src/networkd/links.c
+ create mode 100644 src/networkd/links.h
+
+diff --git a/Makefile.am b/Makefile.am
+index e8946b7..024bf45 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -320,6 +320,8 @@ dist_networkd_SOURCES = \
+ src/networkd/devmon.h \
+ src/networkd/link.c \
+ src/networkd/link.h \
++ src/networkd/links.c \
++ src/networkd/links.h \
+ src/networkd/logging.h \
+ src/networkd/main.c \
+ src/networkd/string.h \
+diff --git a/src/networkd/daemon.c b/src/networkd/daemon.c
+index 13e1257..27b118e 100644
+--- a/src/networkd/daemon.c
++++ b/src/networkd/daemon.c
+@@ -31,6 +31,7 @@
+ #include "config.h"
+ #include "daemon.h"
+ #include "devmon.h"
++#include "links.h"
+ #include "logging.h"
+ #include "zone.h"
+ #include "zones.h"
+@@ -55,6 +56,9 @@ struct nw_daemon {
+ // udev Connection
+ sd_device_monitor* devmon;
+
++ // Links
++ struct nw_links* links;
++
+ // Zones
+ struct nw_zones* zones;
+ };
+@@ -230,6 +234,28 @@ static int nw_daemon_connect_rtnl(struct nw_daemon* daemon, int fd) {
+ return 0;
+ }
+
++static int nw_daemon_enumerate_links(struct nw_daemon* daemon) {
++ int r;
++
++ // Create a new links container
++ r = nw_links_create(&daemon->links, daemon);
++ if (r)
++ return r;
++
++ return nw_links_enumerate(daemon->links);
++}
++
++static int nw_daemon_enumerate(struct nw_daemon* daemon) {
++ int r;
++
++ // Links
++ r = nw_daemon_enumerate_links(daemon);
++ if (r)
++ return r;
++
++ return 0;
++}
++
+ static int nw_daemon_setup(struct nw_daemon* daemon) {
+ int r;
+
+@@ -258,6 +284,11 @@ static int nw_daemon_setup(struct nw_daemon* daemon) {
+ if (r)
+ return r;
+
++ // Enumerate everything we need to know
++ r = nw_daemon_enumerate(daemon);
++ if (r)
++ return r;
++
+ return 0;
+ }
+
+@@ -287,11 +318,19 @@ ERROR:
+ return r;
+ }
+
+-static void nw_daemon_free(struct nw_daemon* daemon) {
++static void nw_daemon_cleanup(struct nw_daemon* daemon) {
+ if (daemon->zones)
+ nw_zones_unref(daemon->zones);
++ if (daemon->links)
++ nw_links_unref(daemon->links);
+ if (daemon->config)
+ nw_config_unref(daemon->config);
++}
++
++static void nw_daemon_free(struct nw_daemon* daemon) {
++ // Cleanup common objects
++ nw_daemon_cleanup(daemon);
++
+ if (daemon->bus)
+ sd_bus_unref(daemon->bus);
+ if (daemon->loop)
+@@ -330,15 +369,20 @@ int nw_daemon_run(struct nw_daemon* daemon) {
+ goto ERROR;
+ }
+
+-
+ // Let systemd know that we are shutting down
+ sd_notify(0, "STOPPING=1\n" "STATUS=Shutting down...");
+
++ // Cleanup everything
++ nw_daemon_cleanup(daemon);
++
+ return 0;
+
+ ERROR:
+ sd_notifyf(0, "ERRNO=%i", -r);
+
++ // Cleanup everything
++ nw_daemon_cleanup(daemon);
++
+ return 1;
+ }
+
+diff --git a/src/networkd/link.h b/src/networkd/link.h
+index cd79fde..6ffe843 100644
+--- a/src/networkd/link.h
++++ b/src/networkd/link.h
+@@ -21,6 +21,8 @@
+ #ifndef NETWORKD_LINK_H
+ #define NETWORKD_LINK_H
+
++#include "daemon.h"
++
+ struct nw_link;
+
+ int nw_link_create(struct nw_link** link, struct nw_daemon* daemon, int ifindex);
+diff --git a/src/networkd/links.c b/src/networkd/links.c
+new file mode 100644
+index 0000000..b81d6a5
+--- /dev/null
++++ b/src/networkd/links.c
+@@ -0,0 +1,105 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#include <stddef.h>
++#include <stdlib.h>
++#include <sys/queue.h>
++
++#include "daemon.h"
++#include "link.h"
++#include "links.h"
++
++struct nw_links_entry {
++ struct nw_link* link;
++
++ // Link to the other entries
++ STAILQ_ENTRY(nw_links_entry) nodes;
++};
++
++struct nw_links {
++ struct nw_daemon* daemon;
++ int nrefs;
++
++ // Link Entries
++ STAILQ_HEAD(entries, nw_links_entry) entries;
++
++ // A counter of the link entries
++ unsigned int num;
++};
++
++int nw_links_create(struct nw_links** links, struct nw_daemon* daemon) {
++ struct nw_links* l = calloc(1, sizeof(*l));
++ if (!l)
++ return 1;
++
++ // Store a reference to the daemon
++ l->daemon = nw_daemon_ref(daemon);
++
++ // Initialize the reference counter
++ l->nrefs = 1;
++
++ // Initialize entries
++ STAILQ_INIT(&l->entries);
++
++ // Reference the pointer
++ *links = l;
++
++ return 0;
++}
++
++static void nw_links_free(struct nw_links* links) {
++ struct nw_links_entry* entry = NULL;
++
++ while (!STAILQ_EMPTY(&links->entries)) {
++ entry = STAILQ_FIRST(&links->entries);
++
++ // Dereference the zone
++ nw_link_unref(entry->link);
++
++ // Remove the entry from the list
++ STAILQ_REMOVE_HEAD(&links->entries, nodes);
++
++ // Free the entry
++ free(entry);
++ }
++
++ if (links->daemon)
++ nw_daemon_unref(links->daemon);
++}
++
++struct nw_links* nw_links_ref(struct nw_links* links) {
++ links->nrefs++;
++
++ return links;
++}
++
++struct nw_links* nw_links_unref(struct nw_links* links) {
++ if (--links->nrefs > 0)
++ return links;
++
++ nw_links_free(links);
++ return NULL;
++}
++
++int nw_links_enumerate(struct nw_links* links) {
++ // TODO
++
++ return 0;
++}
+diff --git a/src/networkd/links.h b/src/networkd/links.h
+new file mode 100644
+index 0000000..b2976e4
+--- /dev/null
++++ b/src/networkd/links.h
+@@ -0,0 +1,35 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#ifndef NETWORKD_LINKS_H
++#define NETWORKD_LINKS_H
++
++#include "daemon.h"
++
++struct nw_links;
++
++int nw_links_create(struct nw_links** links, struct nw_daemon* daemon);
++
++struct nw_links* nw_links_ref(struct nw_links* links);
++struct nw_links* nw_links_unref(struct nw_links* links);
++
++int nw_links_enumerate(struct nw_links* links);
++
++#endif /* NETWORKD_LINKS_H */
+--
+2.39.2
+
diff --git a/network/patches/0186-networkd-Enumerate-all-links-on-startup.patch b/network/patches/0186-networkd-Enumerate-all-links-on-startup.patch
new file mode 100644
index 000000000..b547f60f4
--- /dev/null
+++ b/network/patches/0186-networkd-Enumerate-all-links-on-startup.patch
@@ -0,0 +1,172 @@
+From eaf649ee9bdfa7e20ba381a505e2c5b48501c242 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Thu, 9 Feb 2023 20:41:02 +0000
+Subject: [PATCH 186/304] networkd: Enumerate all links on startup
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/daemon.c | 16 +++++++++-------
+ src/networkd/daemon.h | 7 +++++++
+ src/networkd/link.c | 7 +++++++
+ src/networkd/link.h | 2 ++
+ src/networkd/links.c | 39 +++++++++++++++++++++++++++++++++++++--
+ 5 files changed, 62 insertions(+), 9 deletions(-)
+
+diff --git a/src/networkd/daemon.c b/src/networkd/daemon.c
+index 27b118e..88ce8e7 100644
+--- a/src/networkd/daemon.c
++++ b/src/networkd/daemon.c
+@@ -31,6 +31,7 @@
+ #include "config.h"
+ #include "daemon.h"
+ #include "devmon.h"
++#include "link.h"
+ #include "links.h"
+ #include "logging.h"
+ #include "zone.h"
+@@ -193,12 +194,6 @@ static int nw_start_device_monitor(struct nw_daemon* daemon) {
+ return 0;
+ }
+
+-static int _rtnl_dummy(sd_netlink* rtnl, sd_netlink_message* message, void* data) {
+- DEBUG("_rtnl_dummy called\n");
+-
+- return 0;
+-}
+-
+ static int nw_daemon_connect_rtnl(struct nw_daemon* daemon, int fd) {
+ int r;
+
+@@ -224,7 +219,7 @@ static int nw_daemon_connect_rtnl(struct nw_daemon* daemon, int fd) {
+ }
+
+ // Register callback for new interfaces
+- r = sd_netlink_add_match(daemon->rtnl, NULL, RTM_NEWLINK, _rtnl_dummy, NULL,
++ r = sd_netlink_add_match(daemon->rtnl, NULL, RTM_NEWLINK, nw_link_process, NULL,
+ daemon, "networkd-RTM_NEWLINK");
+ if (r < 0) {
+ ERROR("Could not register RTM_NEWLINK: %m\n");
+@@ -394,6 +389,13 @@ int nw_daemon_reload(struct nw_daemon* daemon) {
+ return 0;
+ }
+
++/*
++ Netlink
++*/
++sd_netlink* nw_daemon_get_rtnl(struct nw_daemon* daemon) {
++ return daemon->rtnl;
++}
++
+ /*
+ Zones
+ */
+diff --git a/src/networkd/daemon.h b/src/networkd/daemon.h
+index 891c297..543685f 100644
+--- a/src/networkd/daemon.h
++++ b/src/networkd/daemon.h
+@@ -21,6 +21,8 @@
+ #ifndef NETWORKD_DAEMON_H
+ #define NETWORKD_DAEMON_H
+
++#include <systemd/sd-netlink.h>
++
+ #include "zone.h"
+
+ struct nw_daemon;
+@@ -34,6 +36,11 @@ int nw_daemon_run(struct nw_daemon* daemon);
+
+ int nw_daemon_reload(struct nw_daemon* daemon);
+
++/*
++ Netlink
++*/
++sd_netlink* nw_daemon_get_rtnl(struct nw_daemon* daemon);
++
+ /*
+ Zones
+ */
+diff --git a/src/networkd/link.c b/src/networkd/link.c
+index 06e3101..ec0593b 100644
+--- a/src/networkd/link.c
++++ b/src/networkd/link.c
+@@ -23,6 +23,7 @@
+
+ #include "daemon.h"
+ #include "link.h"
++#include "logging.h"
+
+ struct nw_link {
+ struct nw_daemon* daemon;
+@@ -70,3 +71,9 @@ struct nw_link* nw_link_unref(struct nw_link* link) {
+ nw_link_free(link);
+ return NULL;
+ }
++
++int nw_link_process(sd_netlink* rtnl, sd_netlink_message* message, void* data) {
++ DEBUG("nw_link_process called\n");
++
++ return 0;
++}
+diff --git a/src/networkd/link.h b/src/networkd/link.h
+index 6ffe843..6003133 100644
+--- a/src/networkd/link.h
++++ b/src/networkd/link.h
+@@ -30,4 +30,6 @@ int nw_link_create(struct nw_link** link, struct nw_daemon* daemon, int ifindex)
+ struct nw_link* nw_link_ref(struct nw_link* link);
+ struct nw_link* nw_link_unref(struct nw_link* link);
+
++int nw_link_process(sd_netlink* rtnl, sd_netlink_message* message, void* data);
++
+ #endif /* NETWORKD_LINK_H */
+diff --git a/src/networkd/links.c b/src/networkd/links.c
+index b81d6a5..22584f2 100644
+--- a/src/networkd/links.c
++++ b/src/networkd/links.c
+@@ -99,7 +99,42 @@ struct nw_links* nw_links_unref(struct nw_links* links) {
+ }
+
+ int nw_links_enumerate(struct nw_links* links) {
+- // TODO
++ sd_netlink_message* req = NULL;
++ sd_netlink_message* res = NULL;
++ int r;
+
+- return 0;
++ sd_netlink* rtnl = nw_daemon_get_rtnl(links->daemon);
++ if (!rtnl)
++ return 1;
++
++ r = sd_rtnl_message_new_link(rtnl, &req, RTM_GETLINK, 0);
++ if (r < 0)
++ return 1;
++
++ r = sd_netlink_message_set_request_dump(req, 1);
++ if (r < 0)
++ return 1;
++
++ r = sd_netlink_call(rtnl, req, 0, &res);
++ if (r < 0)
++ return 1;
++
++ sd_netlink_message* m = res;
++
++ // Iterate through all replies
++ do {
++ r = nw_link_process(rtnl, m, links->daemon);
++ if (r)
++ goto ERROR;
++ } while ((m = sd_netlink_message_next(m)));
++
++ERROR:
++ if (m)
++ sd_netlink_message_unref(m);
++ if (req)
++ sd_netlink_message_unref(req);
++ if (res)
++ sd_netlink_message_unref(res);
++
++ return r;
+ }
+--
+2.39.2
+
diff --git a/network/patches/0187-networkd-Create-a-link-object-for-each-interface.patch b/network/patches/0187-networkd-Create-a-link-object-for-each-interface.patch
new file mode 100644
index 000000000..cfa266627
--- /dev/null
+++ b/network/patches/0187-networkd-Create-a-link-object-for-each-interface.patch
@@ -0,0 +1,362 @@
+From 766f08ca103698e6578228e11f81c1d73d687d65 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Thu, 9 Feb 2023 21:38:09 +0000
+Subject: [PATCH 187/304] networkd: Create a link object for each interface
+
+We are also listening for netlink events that add and delete any
+interfaces.
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/daemon.c | 29 +++++++++++
+ src/networkd/daemon.h | 12 ++++-
+ src/networkd/link.c | 117 ++++++++++++++++++++++++++++++++++++++++--
+ src/networkd/link.h | 2 +
+ src/networkd/links.c | 54 +++++++++++++++++++
+ src/networkd/links.h | 6 +++
+ 6 files changed, 215 insertions(+), 5 deletions(-)
+
+diff --git a/src/networkd/daemon.c b/src/networkd/daemon.c
+index 88ce8e7..dc2aed6 100644
+--- a/src/networkd/daemon.c
++++ b/src/networkd/daemon.c
+@@ -226,6 +226,14 @@ static int nw_daemon_connect_rtnl(struct nw_daemon* daemon, int fd) {
+ return 1;
+ }
+
++ // Register callback for deleted interfaces
++ r = sd_netlink_add_match(daemon->rtnl, NULL, RTM_DELLINK, nw_link_process, NULL,
++ daemon, "networkd-RTM_DELLINK");
++ if (r < 0) {
++ ERROR("Could not register RTM_DELLINK: %m\n");
++ return 1;
++ }
++
+ return 0;
+ }
+
+@@ -396,6 +404,27 @@ sd_netlink* nw_daemon_get_rtnl(struct nw_daemon* daemon) {
+ return daemon->rtnl;
+ }
+
++/*
++ Links
++*/
++struct nw_links* nw_daemon_links(struct nw_daemon* daemon) {
++ return nw_links_ref(daemon->links);
++}
++
++void nw_daemon_drop_link(struct nw_daemon* daemon, struct nw_link* link) {
++ if (!daemon->links)
++ return;
++
++ nw_links_drop_link(daemon->links, link);
++}
++
++struct nw_link* nw_daemon_get_link_by_ifindex(struct nw_daemon* daemon, int ifindex) {
++ if (!daemon->links)
++ return NULL;
++
++ return nw_links_get_by_ifindex(daemon->links, ifindex);
++}
++
+ /*
+ Zones
+ */
+diff --git a/src/networkd/daemon.h b/src/networkd/daemon.h
+index 543685f..8e534c5 100644
+--- a/src/networkd/daemon.h
++++ b/src/networkd/daemon.h
+@@ -23,10 +23,11 @@
+
+ #include <systemd/sd-netlink.h>
+
+-#include "zone.h"
+-
+ struct nw_daemon;
+
++#include "link.h"
++#include "zone.h"
++
+ int nw_daemon_create(struct nw_daemon** daemon);
+
+ struct nw_daemon* nw_daemon_ref(struct nw_daemon* daemon);
+@@ -41,6 +42,13 @@ int nw_daemon_reload(struct nw_daemon* daemon);
+ */
+ sd_netlink* nw_daemon_get_rtnl(struct nw_daemon* daemon);
+
++/*
++ Links
++*/
++struct nw_links* nw_daemon_links(struct nw_daemon* daemon);
++void nw_daemon_drop_link(struct nw_daemon* daemon, struct nw_link* link);
++struct nw_link* nw_daemon_get_link_by_ifindex(struct nw_daemon* daemon, int ifindex);
++
+ /*
+ Zones
+ */
+diff --git a/src/networkd/link.c b/src/networkd/link.c
+index ec0593b..b6ece82 100644
+--- a/src/networkd/link.c
++++ b/src/networkd/link.c
+@@ -21,8 +21,11 @@
+ #include <stddef.h>
+ #include <stdlib.h>
+
++#include <systemd/sd-netlink.h>
++
+ #include "daemon.h"
+ #include "link.h"
++#include "links.h"
+ #include "logging.h"
+
+ struct nw_link {
+@@ -48,12 +51,16 @@ int nw_link_create(struct nw_link** link, struct nw_daemon* daemon, int ifindex)
+ // Store the ifindex
+ l->ifindex = ifindex;
+
++ DEBUG("New link allocated (ifindex = %d)\n", l->ifindex);
++
+ *link = l;
+
+ return 0;
+ }
+
+ static void nw_link_free(struct nw_link* link) {
++ DEBUG("Freeing link (ifindex = %d)\n", link->ifindex);
++
+ if (link->daemon)
+ nw_daemon_unref(link->daemon);
+ }
+@@ -72,8 +79,112 @@ struct nw_link* nw_link_unref(struct nw_link* link) {
+ return NULL;
+ }
+
+-int nw_link_process(sd_netlink* rtnl, sd_netlink_message* message, void* data) {
+- DEBUG("nw_link_process called\n");
++int nw_link_ifindex(struct nw_link* link) {
++ return link->ifindex;
++}
+
+- return 0;
++int nw_link_process(sd_netlink* rtnl, sd_netlink_message* message, void* data) {
++ struct nw_links* links = NULL;
++ struct nw_link* link = NULL;
++ const char* ifname = NULL;
++ int ifindex;
++ uint16_t type;
++ int r;
++
++ struct nw_daemon* daemon = (struct nw_daemon*)data;
++
++ // Fetch links
++ links = nw_daemon_links(daemon);
++ if (!links) {
++ r = 1;
++ goto ERROR;
++ }
++
++ // Check if this message could be received
++ if (sd_netlink_message_is_error(message)) {
++ r = sd_netlink_message_get_errno(message);
++ if (r < 0)
++ ERROR("Could not receive link message: %m\n");
++
++ goto IGNORE;
++ }
++
++ // Fetch the message type
++ r = sd_netlink_message_get_type(message, &type);
++ if (r < 0) {
++ ERROR("Could not fetch message type: %m\n");
++ goto IGNORE;
++ }
++
++ // Check type
++ switch (type) {
++ case RTM_NEWLINK:
++ case RTM_DELLINK:
++ break;
++
++ default:
++ ERROR("Received an unexpected message (type %u)\n", type);
++ goto IGNORE;
++ }
++
++ // Fetch the interface index
++ r = sd_rtnl_message_link_get_ifindex(message, &ifindex);
++ if (r < 0) {
++ ERROR("Could not fetch ifindex: %m\n");
++ goto IGNORE;
++ }
++
++ // Check interface index
++ if (ifindex <= 0) {
++ ERROR("Received an invalid ifindex\n");
++ goto IGNORE;
++ }
++
++ // Fetch the interface name
++ r = sd_netlink_message_read_string(message, IFLA_IFNAME, &ifname);
++ if (r < 0) {
++ ERROR("Received a netlink message without interface name: %m\n");
++ goto IGNORE;
++ }
++
++ // Try finding an existing link
++ link = nw_daemon_get_link_by_ifindex(daemon, ifindex);
++
++ switch (type) {
++ case RTM_NEWLINK:
++ // If the link doesn't exist, create it
++ if (!link) {
++ r = nw_link_create(&link, daemon, ifindex);
++ if (r) {
++ ERROR("Could not create link: %m\n");
++ goto ERROR;
++ }
++ }
++
++ // TODO Import any data from the netlink message
++
++ // Add it to the list
++ r = nw_links_add_link(links, link);
++ if (r)
++ goto ERROR;
++
++ break;
++
++ case RTM_DELLINK:
++ if (link)
++ nw_links_drop_link(links, link);
++
++ break;
++ }
++
++IGNORE:
++ r = 0;
++
++ERROR:
++ if (links)
++ nw_links_unref(links);
++ if (link)
++ nw_link_unref(link);
++
++ return r;
+ }
+diff --git a/src/networkd/link.h b/src/networkd/link.h
+index 6003133..e482d71 100644
+--- a/src/networkd/link.h
++++ b/src/networkd/link.h
+@@ -30,6 +30,8 @@ int nw_link_create(struct nw_link** link, struct nw_daemon* daemon, int ifindex)
+ struct nw_link* nw_link_ref(struct nw_link* link);
+ struct nw_link* nw_link_unref(struct nw_link* link);
+
++int nw_link_ifindex(struct nw_link* link);
++
+ int nw_link_process(sd_netlink* rtnl, sd_netlink_message* message, void* data);
+
+ #endif /* NETWORKD_LINK_H */
+diff --git a/src/networkd/links.c b/src/networkd/links.c
+index 22584f2..044a27d 100644
+--- a/src/networkd/links.c
++++ b/src/networkd/links.c
+@@ -23,6 +23,7 @@
+ #include <sys/queue.h>
+
+ #include "daemon.h"
++#include "logging.h"
+ #include "link.h"
+ #include "links.h"
+
+@@ -98,6 +99,49 @@ struct nw_links* nw_links_unref(struct nw_links* links) {
+ return NULL;
+ }
+
++static struct nw_links_entry* nw_links_find_link(struct nw_links* links, const int ifindex) {
++ struct nw_links_entry* entry = NULL;
++
++ STAILQ_FOREACH(entry, &links->entries, nodes) {
++ if (nw_link_ifindex(entry->link) == ifindex)
++ return entry;
++ }
++
++ // No match found
++ return NULL;
++}
++
++int nw_links_add_link(struct nw_links* links, struct nw_link* link) {
++ // Allocate a new entry
++ struct nw_links_entry* entry = calloc(1, sizeof(*entry));
++ if (!entry)
++ return 1;
++
++ // Reference the link
++ entry->link = nw_link_ref(link);
++
++ // Add it to the list
++ STAILQ_INSERT_TAIL(&links->entries, entry, nodes);
++
++ // Increment the counter
++ links->num++;
++
++ return 0;
++}
++
++void nw_links_drop_link(struct nw_links* links, struct nw_link* link) {
++ struct nw_links_entry* entry = NULL;
++
++ entry = nw_links_find_link(links, nw_link_ifindex(link));
++ if (!entry)
++ return;
++
++ DEBUG("Dropping link %d\n", nw_link_ifindex(entry->link));
++
++ STAILQ_REMOVE(&links->entries, entry, nw_links_entry, nodes);
++ links->num--;
++}
++
+ int nw_links_enumerate(struct nw_links* links) {
+ sd_netlink_message* req = NULL;
+ sd_netlink_message* res = NULL;
+@@ -138,3 +182,13 @@ ERROR:
+
+ return r;
+ }
++
++struct nw_link* nw_links_get_by_ifindex(struct nw_links* links, int ifindex) {
++ struct nw_links_entry* entry = NULL;
++
++ entry = nw_links_find_link(links, ifindex);
++ if (!entry)
++ return NULL;
++
++ return nw_link_ref(entry->link);
++}
+diff --git a/src/networkd/links.h b/src/networkd/links.h
+index b2976e4..2f2bbea 100644
+--- a/src/networkd/links.h
++++ b/src/networkd/links.h
+@@ -22,6 +22,7 @@
+ #define NETWORKD_LINKS_H
+
+ #include "daemon.h"
++#include "link.h"
+
+ struct nw_links;
+
+@@ -30,6 +31,11 @@ int nw_links_create(struct nw_links** links, struct nw_daemon* daemon);
+ struct nw_links* nw_links_ref(struct nw_links* links);
+ struct nw_links* nw_links_unref(struct nw_links* links);
+
++int nw_links_add_link(struct nw_links* links, struct nw_link* link);
++void nw_links_drop_link(struct nw_links* links, struct nw_link* link);
++
+ int nw_links_enumerate(struct nw_links* links);
+
++struct nw_link* nw_links_get_by_ifindex(struct nw_links* links, int ifindex);
++
+ #endif /* NETWORKD_LINKS_H */
+--
+2.39.2
+
diff --git a/network/patches/0188-networkd-Only-add-link-if-we-created-it.patch b/network/patches/0188-networkd-Only-add-link-if-we-created-it.patch
new file mode 100644
index 000000000..844c432c0
--- /dev/null
+++ b/network/patches/0188-networkd-Only-add-link-if-we-created-it.patch
@@ -0,0 +1,38 @@
+From b8a1a68c48849accb658b926f3596857dba41654 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 10 Feb 2023 09:53:47 +0000
+Subject: [PATCH 188/304] networkd: Only add link if we created it
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/link.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/src/networkd/link.c b/src/networkd/link.c
+index b6ece82..32a66cd 100644
+--- a/src/networkd/link.c
++++ b/src/networkd/link.c
+@@ -159,15 +159,15 @@ int nw_link_process(sd_netlink* rtnl, sd_netlink_message* message, void* data) {
+ ERROR("Could not create link: %m\n");
+ goto ERROR;
+ }
++
++ // Add it to the list
++ r = nw_links_add_link(links, link);
++ if (r)
++ goto ERROR;
+ }
+
+ // TODO Import any data from the netlink message
+
+- // Add it to the list
+- r = nw_links_add_link(links, link);
+- if (r)
+- goto ERROR;
+-
+ break;
+
+ case RTM_DELLINK:
+--
+2.39.2
+
diff --git a/network/patches/0189-networkd-Import-interface-name.patch b/network/patches/0189-networkd-Import-interface-name.patch
new file mode 100644
index 000000000..00f801dd7
--- /dev/null
+++ b/network/patches/0189-networkd-Import-interface-name.patch
@@ -0,0 +1,106 @@
+From f650f6cd802686e545d41d00be4a0abd67765391 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 10 Feb 2023 10:03:08 +0000
+Subject: [PATCH 189/304] networkd: Import interface name
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/link.c | 52 ++++++++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 51 insertions(+), 1 deletion(-)
+
+diff --git a/src/networkd/link.c b/src/networkd/link.c
+index 32a66cd..40f809f 100644
+--- a/src/networkd/link.c
++++ b/src/networkd/link.c
+@@ -18,8 +18,10 @@
+ # #
+ #############################################################################*/
+
++#include <net/if.h>
+ #include <stddef.h>
+ #include <stdlib.h>
++#include <string.h>
+
+ #include <systemd/sd-netlink.h>
+
+@@ -27,6 +29,7 @@
+ #include "link.h"
+ #include "links.h"
+ #include "logging.h"
++#include "string.h"
+
+ struct nw_link {
+ struct nw_daemon* daemon;
+@@ -34,6 +37,9 @@ struct nw_link {
+
+ // Interface Index
+ int ifindex;
++
++ // Interface Name
++ char ifname[IF_NAMESIZE];
+ };
+
+ int nw_link_create(struct nw_link** link, struct nw_daemon* daemon, int ifindex) {
+@@ -83,6 +89,47 @@ int nw_link_ifindex(struct nw_link* link) {
+ return link->ifindex;
+ }
+
++static int nw_link_update_ifname(struct nw_link* link, sd_netlink_message* message) {
++ const char* ifname = NULL;
++ int r;
++
++ r = sd_netlink_message_read_string(message, IFLA_IFNAME, &ifname);
++ if (r < 0) {
++ ERROR("Could not read link name for link %d: %m\n", link->ifindex);
++ return 1;
++ }
++
++ // Do nothing if the name is already set
++ if (strcmp(link->ifname, ifname) == 0)
++ return 0;
++
++ // Otherwise update the name
++ r = nw_string_set(link->ifname, ifname);
++ if (r) {
++ ERROR("Could not set link name: %m\n");
++ return 1;
++ }
++
++ DEBUG("Link %d has been renamed to '%s'\n", link->ifindex, link->ifname);
++
++ return 0;
++}
++
++/*
++ This function is called whenever anything changes, so that we can
++ update our internal link object.
++*/
++static int nw_link_update(struct nw_link* link, sd_netlink_message* message) {
++ int r;
++
++ // Update the interface name
++ r = nw_link_update_ifname(link, message);
++ if (r)
++ return r;
++
++ return 0;
++}
++
+ int nw_link_process(sd_netlink* rtnl, sd_netlink_message* message, void* data) {
+ struct nw_links* links = NULL;
+ struct nw_link* link = NULL;
+@@ -166,7 +213,10 @@ int nw_link_process(sd_netlink* rtnl, sd_netlink_message* message, void* data) {
+ goto ERROR;
+ }
+
+- // TODO Import any data from the netlink message
++ // Import any data from the netlink message
++ r = nw_link_update(link, message);
++ if (r)
++ goto ERROR;
+
+ break;
+
+--
+2.39.2
+
diff --git a/network/patches/0190-networkd-Read-link-MTU.patch b/network/patches/0190-networkd-Read-link-MTU.patch
new file mode 100644
index 000000000..9da1cd019
--- /dev/null
+++ b/network/patches/0190-networkd-Read-link-MTU.patch
@@ -0,0 +1,96 @@
+From f37df5ea0920add075e294db28a3ec5ed83b0fe5 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 10 Feb 2023 10:13:37 +0000
+Subject: [PATCH 190/304] networkd: Read link MTU
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/link.c | 58 +++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 58 insertions(+)
+
+diff --git a/src/networkd/link.c b/src/networkd/link.c
+index 40f809f..62be893 100644
+--- a/src/networkd/link.c
++++ b/src/networkd/link.c
+@@ -40,6 +40,11 @@ struct nw_link {
+
+ // Interface Name
+ char ifname[IF_NAMESIZE];
++
++ // MTU
++ uint32_t mtu;
++ uint32_t min_mtu;
++ uint32_t max_mtu;
+ };
+
+ int nw_link_create(struct nw_link** link, struct nw_daemon* daemon, int ifindex) {
+@@ -115,6 +120,54 @@ static int nw_link_update_ifname(struct nw_link* link, sd_netlink_message* messa
+ return 0;
+ }
+
++static int nw_link_update_mtu(struct nw_link* link, sd_netlink_message* message) {
++ uint32_t mtu = 0;
++ uint32_t min_mtu = 0;
++ uint32_t max_mtu = 0;
++ int r;
++
++ // Read the MTU
++ r = sd_netlink_message_read_u32(message, IFLA_MTU, &mtu);
++ if (r < 0) {
++ ERROR("Could not read MTU for link %d: %m\n", link->ifindex);
++ return r;
++ }
++
++ // Read the minimum MTU
++ r = sd_netlink_message_read_u32(message, IFLA_MIN_MTU, &min_mtu);
++ if (r < 0) {
++ ERROR("Could not read the minimum MTU for link %d: %m\n", link->ifindex);
++ return r;
++ }
++
++ // Read the maximum MTU
++ r = sd_netlink_message_read_u32(message, IFLA_MAX_MTU, &max_mtu);
++ if (r < 0) {
++ ERROR("Could not read the maximum MTU for link %d: %m\n", link->ifindex);
++ return r;
++ }
++
++ // Set the maximum MTU to infinity
++ if (!max_mtu)
++ max_mtu = UINT32_MAX;
++
++ // Store min/max MTU
++ link->min_mtu = min_mtu;
++ link->max_mtu = max_mtu;
++
++ // End here, if the MTU has not been changed
++ if (link->mtu == mtu)
++ return 0;
++
++ DEBUG("Link %d: MTU has changed to %" PRIu32 " (min: %" PRIu32 ", max: %" PRIu32 ")\n",
++ link->ifindex, link->mtu, link->min_mtu, link->max_mtu);
++
++ // Store MTU
++ link->mtu = mtu;
++
++ return 0;
++}
++
+ /*
+ This function is called whenever anything changes, so that we can
+ update our internal link object.
+@@ -127,6 +180,11 @@ static int nw_link_update(struct nw_link* link, sd_netlink_message* message) {
+ if (r)
+ return r;
+
++ // Update the MTU
++ r = nw_link_update_mtu(link, message);
++ if (r)
++ return r;
++
+ return 0;
+ }
+
+--
+2.39.2
+
diff --git a/network/patches/0191-networkd-config-Actually-return-entry-instead-of-fre.patch b/network/patches/0191-networkd-config-Actually-return-entry-instead-of-fre.patch
new file mode 100644
index 000000000..19ebcc0fb
--- /dev/null
+++ b/network/patches/0191-networkd-config-Actually-return-entry-instead-of-fre.patch
@@ -0,0 +1,27 @@
+From 82f84c5ff3079de8b57f5a10a118fb4ecab20ffb Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 10 Feb 2023 15:24:19 +0000
+Subject: [PATCH 191/304] networkd: config: Actually return entry instead of
+ freeing it straight away
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/config.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/src/networkd/config.c b/src/networkd/config.c
+index 788308f..ef6218e 100644
+--- a/src/networkd/config.c
++++ b/src/networkd/config.c
+@@ -72,6 +72,8 @@ static struct nw_config_entry* nw_config_entry_create(
+ // Append the new entry
+ STAILQ_INSERT_TAIL(&config->entries, entry, nodes);
+
++ return entry;
++
+ ERROR:
+ nw_config_entry_free(entry);
+ return NULL;
+--
+2.39.2
+
diff --git a/network/patches/0192-networkd-config-Implement-reading-configuration-file.patch b/network/patches/0192-networkd-config-Implement-reading-configuration-file.patch
new file mode 100644
index 000000000..b8fc1dbef
--- /dev/null
+++ b/network/patches/0192-networkd-config-Implement-reading-configuration-file.patch
@@ -0,0 +1,139 @@
+From 5ef56cff5e19dcda00a76a40846fe3def9e6239f Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 10 Feb 2023 15:24:53 +0000
+Subject: [PATCH 192/304] networkd: config: Implement reading configuration
+ files
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/config.c | 46 ++++++++++++++++++++++++++++++++++++++++---
+ src/networkd/string.h | 41 ++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 84 insertions(+), 3 deletions(-)
+
+diff --git a/src/networkd/config.c b/src/networkd/config.c
+index ef6218e..17d6d89 100644
+--- a/src/networkd/config.c
++++ b/src/networkd/config.c
+@@ -157,9 +157,49 @@ int nw_config_flush(struct nw_config* config) {
+ }
+
+ static int nw_config_readf(struct nw_config* config, FILE* f) {
+- // XXX TODO
++ char* line = NULL;
++ size_t length = 0;
++ int r;
+
+- return 0;
++ ssize_t bytes_read = 0;
++
++ char* key = NULL;
++ char* val = NULL;
++
++ for (;;) {
++ // Read the next line
++ bytes_read = getline(&line, &length, f);
++ if (bytes_read < 0)
++ break;
++
++ // Key starts at the beginning of the line
++ key = line;
++
++ // Value starts after '='
++ val = strchr(line, '=');
++
++ // Invalid line without a '=' character
++ if (!val)
++ continue;
++
++ // Split the string
++ *val++ = '\0';
++
++ // Strip any whitespace from value
++ r = nw_string_strip(val);
++ if (r)
++ break;
++
++ // Store the setting
++ r = nw_config_set(config, key, val);
++ if (r)
++ break;
++ }
++
++ if (line)
++ free(line);
++
++ return r;
+ }
+
+ int nw_config_read(struct nw_config* config) {
+@@ -204,7 +244,7 @@ static int nw_config_writef(struct nw_config* config, FILE* f) {
+ continue;
+
+ // Write the entry
+- r = fprintf(f, "%s=\"%s\"\n", entry->key, entry->value);
++ r = fprintf(f, "%s=%s\n", entry->key, entry->value);
+ if (r < 0) {
+ ERROR("Failed to write configuration: %m\n");
+ return r;
+diff --git a/src/networkd/string.h b/src/networkd/string.h
+index 4ae2dbf..f3c5b71 100644
+--- a/src/networkd/string.h
++++ b/src/networkd/string.h
+@@ -21,6 +21,7 @@
+ #ifndef NETWORKD_STRING_H
+ #define NETWORKD_STRING_H
+
++#include <ctype.h>
+ #include <errno.h>
+ #include <stdarg.h>
+ #include <stdio.h>
+@@ -79,6 +80,46 @@ static inline int __nw_string_set(char* s, const size_t length, const char* valu
+ return __nw_string_format(s, length, "%s", value);
+ }
+
++static inline int nw_string_lstrip(char* s) {
++ char* p = s;
++
++ // Count any leading spaces
++ while (*p && isspace(*p))
++ p++;
++
++ // Move the string to the beginning of the buffer
++ while (*p)
++ *s++ = *p++;
++
++ // Terminate the string
++ *s = '\0';
++
++ return 0;
++}
++
++static inline int nw_string_rstrip(char* s) {
++ ssize_t l = strlen(s) - 1;
++
++ while (l >= 0 && isspace(s[l]))
++ s[l--] = '\0';
++
++ return 0;
++}
++
++static inline int nw_string_strip(char* s) {
++ int r;
++
++ r = nw_string_lstrip(s);
++ if (r)
++ return r;
++
++ r = nw_string_rstrip(s);
++ if (r)
++ return r;
++
++ return 0;
++}
++
+ /*
+ Paths
+ */
+--
+2.39.2
+
diff --git a/network/patches/0193-networkd-Add-scaffolding-for-ports.patch b/network/patches/0193-networkd-Add-scaffolding-for-ports.patch
new file mode 100644
index 000000000..ca9832e08
--- /dev/null
+++ b/network/patches/0193-networkd-Add-scaffolding-for-ports.patch
@@ -0,0 +1,159 @@
+From abeab06924b22765dbc410c563f27077f348b5e9 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 10 Feb 2023 16:15:46 +0000
+Subject: [PATCH 193/304] networkd: Add scaffolding for ports
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 2 ++
+ src/networkd/port.c | 84 +++++++++++++++++++++++++++++++++++++++++++++
+ src/networkd/port.h | 33 ++++++++++++++++++
+ 3 files changed, 119 insertions(+)
+ create mode 100644 src/networkd/port.c
+ create mode 100644 src/networkd/port.h
+
+diff --git a/Makefile.am b/Makefile.am
+index 024bf45..4bd3975 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -324,6 +324,8 @@ dist_networkd_SOURCES = \
+ src/networkd/links.h \
+ src/networkd/logging.h \
+ src/networkd/main.c \
++ src/networkd/port.c \
++ src/networkd/port.h \
+ src/networkd/string.h \
+ src/networkd/zones.c \
+ src/networkd/zones.h \
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+new file mode 100644
+index 0000000..019521f
+--- /dev/null
++++ b/src/networkd/port.c
+@@ -0,0 +1,84 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#include <net/if.h>
++#include <stdlib.h>
++
++#include "config.h"
++#include "string.h"
++#include "port.h"
++
++struct nw_port {
++ int nrefs;
++
++ char name[IF_NAMESIZE];
++
++ // Configuration
++ struct nw_config *config;
++};
++
++static void nw_port_free(struct nw_port* port) {
++ if (port->config)
++ nw_config_unref(port->config);
++
++ free(port);
++}
++
++int nw_port_create(struct nw_port** port, const char* name) {
++ int r;
++
++ // Allocate a new object
++ struct nw_port* p = calloc(1, sizeof(*p));
++ if (!p)
++ return 1;
++
++ // Initialize reference counter
++ p->nrefs = 1;
++
++ // Store the name
++ r = nw_string_set(p->name, name);
++ if (r)
++ goto ERROR;
++
++ *port = p;
++ return 0;
++
++ERROR:
++ nw_port_free(p);
++ return r;
++}
++
++struct nw_port* nw_port_ref(struct nw_port* port) {
++ port->nrefs++;
++
++ return port;
++}
++
++struct nw_port* nw_port_unref(struct nw_port* port) {
++ if (--port->nrefs > 0)
++ return port;
++
++ nw_port_free(port);
++ return NULL;
++}
++
++const char* nw_port_name(struct nw_port* port) {
++ return port->name;
++}
+diff --git a/src/networkd/port.h b/src/networkd/port.h
+new file mode 100644
+index 0000000..cea6203
+--- /dev/null
++++ b/src/networkd/port.h
+@@ -0,0 +1,33 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#ifndef NETWORKD_PORT_H
++#define NETWORKD_PORT_H
++
++struct nw_port;
++
++int nw_port_create(struct nw_port** port, const char* name);
++
++struct nw_port* nw_port_ref(struct nw_port* port);
++struct nw_port* nw_port_unref(struct nw_port* port);
++
++const char* nw_port_name(struct nw_port* port);
++
++#endif /* NETWORKD_PORT_H */
+--
+2.39.2
+
diff --git a/network/patches/0194-networkd-Add-port-container.patch b/network/patches/0194-networkd-Add-port-container.patch
new file mode 100644
index 000000000..53004d0a9
--- /dev/null
+++ b/network/patches/0194-networkd-Add-port-container.patch
@@ -0,0 +1,240 @@
+From b8db2713c790000860e1c3b0d4f8e588cfa5ac04 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 10 Feb 2023 16:26:36 +0000
+Subject: [PATCH 194/304] networkd: Add port container
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 2 +
+ src/networkd/daemon.c | 23 ++++++++++
+ src/networkd/ports.c | 100 ++++++++++++++++++++++++++++++++++++++++++
+ src/networkd/ports.h | 35 +++++++++++++++
+ 4 files changed, 160 insertions(+)
+ create mode 100644 src/networkd/ports.c
+ create mode 100644 src/networkd/ports.h
+
+diff --git a/Makefile.am b/Makefile.am
+index 4bd3975..d78d61e 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -326,6 +326,8 @@ dist_networkd_SOURCES = \
+ src/networkd/main.c \
+ src/networkd/port.c \
+ src/networkd/port.h \
++ src/networkd/ports.c \
++ src/networkd/ports.h \
+ src/networkd/string.h \
+ src/networkd/zones.c \
+ src/networkd/zones.h \
+diff --git a/src/networkd/daemon.c b/src/networkd/daemon.c
+index dc2aed6..aee27e3 100644
+--- a/src/networkd/daemon.c
++++ b/src/networkd/daemon.c
+@@ -34,6 +34,7 @@
+ #include "link.h"
+ #include "links.h"
+ #include "logging.h"
++#include "ports.h"
+ #include "zone.h"
+ #include "zones.h"
+
+@@ -62,6 +63,10 @@ struct nw_daemon {
+
+ // Zones
+ struct nw_zones* zones;
++
++ // Ports
++ struct nw_ports* ports;
++
+ };
+
+ static int __nw_daemon_terminate(sd_event_source* source, const struct signalfd_siginfo* si,
+@@ -248,6 +253,17 @@ static int nw_daemon_enumerate_links(struct nw_daemon* daemon) {
+ return nw_links_enumerate(daemon->links);
+ }
+
++static int nw_daemon_enumerate_ports(struct nw_daemon* daemon) {
++ int r;
++
++ // Create a new ports container
++ r = nw_ports_create(&daemon->ports, daemon);
++ if (r)
++ return r;
++
++ return nw_ports_enumerate(daemon->ports);
++}
++
+ static int nw_daemon_enumerate(struct nw_daemon* daemon) {
+ int r;
+
+@@ -256,6 +272,11 @@ static int nw_daemon_enumerate(struct nw_daemon* daemon) {
+ if (r)
+ return r;
+
++ // Ports
++ r = nw_daemon_enumerate_ports(daemon);
++ if (r)
++ return r;
++
+ return 0;
+ }
+
+@@ -322,6 +343,8 @@ ERROR:
+ }
+
+ static void nw_daemon_cleanup(struct nw_daemon* daemon) {
++ if (daemon->ports)
++ nw_ports_unref(daemon->ports);
+ if (daemon->zones)
+ nw_zones_unref(daemon->zones);
+ if (daemon->links)
+diff --git a/src/networkd/ports.c b/src/networkd/ports.c
+new file mode 100644
+index 0000000..500153a
+--- /dev/null
++++ b/src/networkd/ports.c
+@@ -0,0 +1,100 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#include <stdlib.h>
++#include <string.h>
++#include <sys/queue.h>
++
++#include "logging.h"
++#include "port.h"
++#include "ports.h"
++
++struct nw_ports_entry {
++ struct nw_port* port;
++
++ // Link to the other entries
++ STAILQ_ENTRY(nw_ports_entry) nodes;
++};
++
++struct nw_ports {
++ struct nw_daemon* daemon;
++ int nrefs;
++
++ // Port Entries
++ STAILQ_HEAD(entries, nw_ports_entry) entries;
++
++ // A counter of the port entries
++ unsigned int num;
++};
++
++int nw_ports_create(struct nw_ports** ports, struct nw_daemon* daemon) {
++ struct nw_ports* p = calloc(1, sizeof(*p));
++ if (!p)
++ return 1;
++
++ // Store a reference to the daemon
++ p->daemon = nw_daemon_ref(daemon);
++
++ // Initialize the reference counter
++ p->nrefs = 1;
++
++ // Initialize entries
++ STAILQ_INIT(&p->entries);
++
++ // Reference the pointer
++ *ports = p;
++
++ return 0;
++}
++
++static void nw_ports_free(struct nw_ports* ports) {
++ struct nw_ports_entry* entry = NULL;
++
++ while (!STAILQ_EMPTY(&ports->entries)) {
++ entry = STAILQ_FIRST(&ports->entries);
++
++ // Dereference the port
++ nw_port_unref(entry->port);
++
++ // Remove the entry from the list
++ STAILQ_REMOVE_HEAD(&ports->entries, nodes);
++
++ // Free the entry
++ free(entry);
++ }
++}
++
++struct nw_ports* nw_ports_ref(struct nw_ports* ports) {
++ ports->nrefs++;
++
++ return ports;
++}
++
++struct nw_ports* nw_ports_unref(struct nw_ports* ports) {
++ if (--ports->nrefs > 0)
++ return ports;
++
++ nw_ports_free(ports);
++ return NULL;
++}
++
++int nw_ports_enumerate(struct nw_ports* ports) {
++ return 0; // XXX TODO
++}
+diff --git a/src/networkd/ports.h b/src/networkd/ports.h
+new file mode 100644
+index 0000000..76a4a3a
+--- /dev/null
++++ b/src/networkd/ports.h
+@@ -0,0 +1,35 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#ifndef NETWORKD_PORTS_H
++#define NETWORKD_PORTS_H
++
++struct nw_ports;
++
++#include "daemon.h"
++
++int nw_ports_create(struct nw_ports** ports, struct nw_daemon* daemon);
++
++struct nw_ports* nw_ports_ref(struct nw_ports* ports);
++struct nw_ports* nw_ports_unref(struct nw_ports* ports);
++
++int nw_ports_enumerate(struct nw_ports* ports);
++
++#endif /* NETWORKD_ZONES_H */
+--
+2.39.2
+
diff --git a/network/patches/0195-networkd-Enumerate-ports-on-startup.patch b/network/patches/0195-networkd-Enumerate-ports-on-startup.patch
new file mode 100644
index 000000000..30b406c35
--- /dev/null
+++ b/network/patches/0195-networkd-Enumerate-ports-on-startup.patch
@@ -0,0 +1,247 @@
+From c791afc87a22936e9564e449182ee6452659887e Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 11 Feb 2023 10:59:03 +0000
+Subject: [PATCH 195/304] networkd: Enumerate ports on startup
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 2 ++
+ src/networkd/port.h | 2 ++
+ src/networkd/ports.c | 61 ++++++++++++++++++++++++++++++++++++++++++-
+ src/networkd/string.h | 8 ++++++
+ src/networkd/util.c | 61 +++++++++++++++++++++++++++++++++++++++++++
+ src/networkd/util.h | 29 ++++++++++++++++++++
+ 6 files changed, 162 insertions(+), 1 deletion(-)
+ create mode 100644 src/networkd/util.c
+ create mode 100644 src/networkd/util.h
+
+diff --git a/Makefile.am b/Makefile.am
+index d78d61e..505d679 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -329,6 +329,8 @@ dist_networkd_SOURCES = \
+ src/networkd/ports.c \
+ src/networkd/ports.h \
+ src/networkd/string.h \
++ src/networkd/util.c \
++ src/networkd/util.h \
+ src/networkd/zones.c \
+ src/networkd/zones.h \
+ src/networkd/zone.c \
+diff --git a/src/networkd/port.h b/src/networkd/port.h
+index cea6203..250a694 100644
+--- a/src/networkd/port.h
++++ b/src/networkd/port.h
+@@ -21,6 +21,8 @@
+ #ifndef NETWORKD_PORT_H
+ #define NETWORKD_PORT_H
+
++#define PORT_CONFIG_DIR CONFIG_DIR "/ports"
++
+ struct nw_port;
+
+ int nw_port_create(struct nw_port** port, const char* name);
+diff --git a/src/networkd/ports.c b/src/networkd/ports.c
+index 500153a..19a3a59 100644
+--- a/src/networkd/ports.c
++++ b/src/networkd/ports.c
+@@ -21,10 +21,13 @@
+ #include <stdlib.h>
+ #include <string.h>
+ #include <sys/queue.h>
++#include <sys/stat.h>
+
+ #include "logging.h"
+ #include "port.h"
+ #include "ports.h"
++#include "string.h"
++#include "util.h"
+
+ struct nw_ports_entry {
+ struct nw_port* port;
+@@ -95,6 +98,62 @@ struct nw_ports* nw_ports_unref(struct nw_ports* ports) {
+ return NULL;
+ }
+
++static int nw_ports_add_port(struct nw_ports* ports, struct nw_port* port) {
++ // Allocate a new entry
++ struct nw_ports_entry* entry = calloc(1, sizeof(*entry));
++ if (!entry)
++ return 1;
++
++ // Reference the port
++ entry->port = nw_port_ref(port);
++
++ // Add it to the list
++ STAILQ_INSERT_TAIL(&ports->entries, entry, nodes);
++
++ // Increment the counter
++ ports->num++;
++
++ return 0;
++}
++
++static int __nw_ports_enumerate(const char* path, const struct stat* s, void* data) {
++ struct nw_port* port = NULL;
++ int r;
++
++ struct nw_ports* ports = (struct nw_ports*)data;
++
++ // Skip anything that isn't a regular file
++ if (!S_ISREG(s->st_mode))
++ return 0;
++
++ // Find the basename of the file
++ const char* name = nw_path_basename(path);
++
++ // Break on invalid paths
++ if (!name)
++ return 0;
++
++ // Skip any hidden files
++ if (*name == '.')
++ return 0;
++
++ // Create a new port
++ r = nw_port_create(&port, name);
++ if (r)
++ goto ERROR;
++
++ // Add the port to the list
++ r = nw_ports_add_port(ports, port);
++ if (r)
++ goto ERROR;
++
++ERROR:
++ if (port)
++ nw_port_unref(port);
++
++ return r;
++}
++
+ int nw_ports_enumerate(struct nw_ports* ports) {
+- return 0; // XXX TODO
++ return nw_ftw(PORT_CONFIG_DIR, PORT_CONFIG_DIR "/*", __nw_ports_enumerate, ports);
+ }
+diff --git a/src/networkd/string.h b/src/networkd/string.h
+index f3c5b71..6ff44f9 100644
+--- a/src/networkd/string.h
++++ b/src/networkd/string.h
+@@ -142,4 +142,12 @@ static inline int __nw_path_join(char* s, const size_t length,
+ return __nw_string_format(s, length, "%s/%s", first, second);
+ }
+
++static inline const char* nw_path_basename(const char* path) {
++ const char* basename = strrchr(path, '/');
++ if (!basename)
++ return NULL;
++
++ return basename + 1;
++}
++
+ #endif /* NETWORKD_STRING_H */
+diff --git a/src/networkd/util.c b/src/networkd/util.c
+new file mode 100644
+index 0000000..0381ea8
+--- /dev/null
++++ b/src/networkd/util.c
+@@ -0,0 +1,61 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#include <errno.h>
++#include <fnmatch.h>
++#include <ftw.h>
++#include <stddef.h>
++#include <stdio.h>
++
++#include "util.h"
++
++int nw_ftw(const char* path, const char* filter,
++ int (*callback)(const char* path, const struct stat* s, void* data), void* data) {
++ /*
++ This is a nested function which allows us to pass some custom pointer to
++ the callback function as that isn't possible with nftw().
++ */
++ int __callback(const char* p, const struct stat* s, int type, struct FTW* ftw) {
++ int r;
++
++ // Filter out anything we don't want
++ if (filter) {
++ r = fnmatch(filter, p, FNM_PATHNAME);
++
++ switch (r) {
++ // Pattern didn't match
++ case FNM_NOMATCH:
++ return 0;
++
++ // Pattern matched
++ case 0:
++ break;
++
++ // Error
++ default:
++ return 1;
++ }
++ }
++
++ return callback(p, s, data);
++ }
++
++ return nftw(path, __callback, 0, 0);
++}
+diff --git a/src/networkd/util.h b/src/networkd/util.h
+new file mode 100644
+index 0000000..950afda
+--- /dev/null
++++ b/src/networkd/util.h
+@@ -0,0 +1,29 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#ifndef NETWORKD_UTIL_H
++#define NETWORKD_UTIL_H
++
++#include <sys/stat.h>
++
++int nw_ftw(const char* path, const char* filter,
++ int (*callback)(const char* path, const struct stat* s, void* data), void* data);
++
++#endif /* NETWORKD_UTIL_H */
+--
+2.39.2
+
diff --git a/network/patches/0196-networkd-Perform-port-setup-from-configuration.patch b/network/patches/0196-networkd-Perform-port-setup-from-configuration.patch
new file mode 100644
index 000000000..96bc04918
--- /dev/null
+++ b/network/patches/0196-networkd-Perform-port-setup-from-configuration.patch
@@ -0,0 +1,147 @@
+From 827435c82f60ba1b7717d74faeac6cb6b85d6588 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 11 Feb 2023 11:21:02 +0000
+Subject: [PATCH 196/304] networkd: Perform port setup from configuration
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/port.c | 76 +++++++++++++++++++++++++++++++++++++++++++++
+ src/networkd/port.h | 5 +++
+ 2 files changed, 81 insertions(+)
+
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index 019521f..f78489b 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -18,10 +18,12 @@
+ # #
+ #############################################################################*/
+
++#include <limits.h>
+ #include <net/if.h>
+ #include <stdlib.h>
+
+ #include "config.h"
++#include "logging.h"
+ #include "string.h"
+ #include "port.h"
+
+@@ -29,11 +31,31 @@ struct nw_port {
+ int nrefs;
+
+ char name[IF_NAMESIZE];
++ nw_port_type_t type;
+
+ // Configuration
+ struct nw_config *config;
+ };
+
++static const struct nw_port_type_map {
++ nw_port_type_t type;
++ const char* name;
++} nw_port_type_map[] = {
++ { NW_PORT_DUMMY, "dummy" },
++ { NW_PORT_UNKNOWN, NULL },
++};
++
++static nw_port_type_t nw_port_type_from_string(const char* s) {
++ const struct nw_port_type_map* map = NULL;
++
++ for (map = nw_port_type_map; *map->name; map++) {
++ if (strcmp(map->name, s) == 0)
++ return map->type;
++ }
++
++ return NW_PORT_UNKNOWN;
++}
++
+ static void nw_port_free(struct nw_port* port) {
+ if (port->config)
+ nw_config_unref(port->config);
+@@ -41,6 +63,55 @@ static void nw_port_free(struct nw_port* port) {
+ free(port);
+ }
+
++static int nw_port_setup_common(struct nw_port* port) {
++ return 0; // XXX TODO
++}
++
++static nw_port_type_t nw_port_setup_type(struct nw_port* port) {
++ const char* type = nw_config_get(port->config, "TYPE");
++ if (!type)
++ return NW_PORT_UNKNOWN;
++
++ return nw_port_type_from_string(type);
++}
++
++static int nw_port_setup(struct nw_port* port) {
++ char path[PATH_MAX];
++ int r;
++
++ // Compose the path to the main configuration file
++ r = nw_path_join(path, PORT_CONFIG_DIR, port->name);
++ if (r)
++ return r;
++
++ // Initialize the configuration
++ r = nw_config_create(&port->config, path);
++ if (r)
++ return r;
++
++ // Determine type
++ port->type = nw_port_setup_type(port);
++ if (!port->type) {
++ ERROR("Could not determine type of port %s\n", port->name);
++ return 0;
++ }
++
++ // Perform some common initialization
++ r = nw_port_setup_common(port);
++ if (r)
++ return r;
++
++ // Call any custom initialization
++ switch (port->type) {
++ // These do not need any special initialization
++ case NW_PORT_DUMMY:
++ case NW_PORT_UNKNOWN:
++ break;
++ }
++
++ return 0;
++}
++
+ int nw_port_create(struct nw_port** port, const char* name) {
+ int r;
+
+@@ -57,6 +128,11 @@ int nw_port_create(struct nw_port** port, const char* name) {
+ if (r)
+ goto ERROR;
+
++ // Setup the port
++ r = nw_port_setup(p);
++ if (r)
++ goto ERROR;
++
+ *port = p;
+ return 0;
+
+diff --git a/src/networkd/port.h b/src/networkd/port.h
+index 250a694..af7fbdd 100644
+--- a/src/networkd/port.h
++++ b/src/networkd/port.h
+@@ -23,6 +23,11 @@
+
+ #define PORT_CONFIG_DIR CONFIG_DIR "/ports"
+
++typedef enum nw_port_type {
++ NW_PORT_UNKNOWN = 0,
++ NW_PORT_DUMMY,
++} nw_port_type_t;
++
+ struct nw_port;
+
+ int nw_port_create(struct nw_port** port, const char* name);
+--
+2.39.2
+
diff --git a/network/patches/0197-networkd-Read-Ethernet-address-from-configuration.patch b/network/patches/0197-networkd-Read-Ethernet-address-from-configuration.patch
new file mode 100644
index 000000000..38ca85ee1
--- /dev/null
+++ b/network/patches/0197-networkd-Read-Ethernet-address-from-configuration.patch
@@ -0,0 +1,145 @@
+From 2e7f4705a61e8435e22d49fcff49ecf8dde389ef Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 11 Feb 2023 11:48:23 +0000
+Subject: [PATCH 197/304] networkd: Read Ethernet address from configuration
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 1 +
+ src/networkd/address.h | 47 ++++++++++++++++++++++++++++++++++++++++++
+ src/networkd/port.c | 36 +++++++++++++++++++++++++++++++-
+ 3 files changed, 83 insertions(+), 1 deletion(-)
+ create mode 100644 src/networkd/address.h
+
+diff --git a/Makefile.am b/Makefile.am
+index 505d679..a27736a 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -308,6 +308,7 @@ sbin_PROGRAMS += \
+ networkd
+
+ dist_networkd_SOURCES = \
++ src/networkd/address.h \
+ src/networkd/bus.c \
+ src/networkd/bus.h \
+ src/networkd/config.c \
+diff --git a/src/networkd/address.h b/src/networkd/address.h
+new file mode 100644
+index 0000000..1d9fbfc
+--- /dev/null
++++ b/src/networkd/address.h
+@@ -0,0 +1,47 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#ifndef NETWORKD_ADDRESS_H
++#define NETWORKD_ADDRESS_H
++
++#include <netinet/ether.h>
++#include <string.h>
++
++typedef struct ether_addr nw_address_t;
++
++static inline int nw_address_from_string(nw_address_t* addr, const char* s) {
++ struct ether_addr* p = ether_aton_r(s, addr);
++ if (!p)
++ return 1;
++
++ return 0;
++}
++
++static inline char* nw_address_to_string(const nw_address_t* addr) {
++ char buffer[ETH_ALEN];
++
++ char* p = ether_ntoa_r(addr, buffer);
++ if (!p)
++ return NULL;
++
++ return strdup(buffer);
++}
++
++#endif /* NETWORKD_ADDRESS_H */
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index f78489b..aff79a5 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -20,8 +20,10 @@
+
+ #include <limits.h>
+ #include <net/if.h>
++#include <stdint.h>
+ #include <stdlib.h>
+
++#include "address.h"
+ #include "config.h"
+ #include "logging.h"
+ #include "string.h"
+@@ -35,6 +37,9 @@ struct nw_port {
+
+ // Configuration
+ struct nw_config *config;
++
++ // Common attributes
++ nw_address_t address;
+ };
+
+ static const struct nw_port_type_map {
+@@ -63,8 +68,37 @@ static void nw_port_free(struct nw_port* port) {
+ free(port);
+ }
+
++static int nw_port_setup_address(struct nw_port* port) {
++ int r;
++
++ // Read ADDRESS from configuration
++ const char* s = nw_config_get(port->config, "ADDRESS");
++ if (!s) {
++ ERROR("Port %s: Address isn't set\n", port->name);
++ return 1;
++ }
++
++ // Parse the address
++ r = nw_address_from_string(&port->address, s);
++ if (r) {
++ ERROR("Port %s: Could not parse address: %m\n", port->name);
++ return r;
++ }
++
++ // XXX Do we need to check for multicast here?
++
++ return 0;
++}
++
+ static int nw_port_setup_common(struct nw_port* port) {
+- return 0; // XXX TODO
++ int r;
++
++ // Address
++ r = nw_port_setup_address(port);
++ if (r)
++ return r;
++
++ return 0;
+ }
+
+ static nw_port_type_t nw_port_setup_type(struct nw_port* port) {
+--
+2.39.2
+
diff --git a/network/patches/0198-networkd-Generate-a-random-Ethernet-address-for-port.patch b/network/patches/0198-networkd-Generate-a-random-Ethernet-address-for-port.patch
new file mode 100644
index 000000000..8067e204d
--- /dev/null
+++ b/network/patches/0198-networkd-Generate-a-random-Ethernet-address-for-port.patch
@@ -0,0 +1,93 @@
+From 9a93da54510ec2b49e0890d2b420a097316eaace Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 11 Feb 2023 12:01:42 +0000
+Subject: [PATCH 198/304] networkd: Generate a random Ethernet address for
+ ports
+
+This happens when either no address was set, or it cannot be parsed.
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/address.h | 25 +++++++++++++++++++++++++
+ src/networkd/port.c | 14 ++++++++++++--
+ 2 files changed, 37 insertions(+), 2 deletions(-)
+
+diff --git a/src/networkd/address.h b/src/networkd/address.h
+index 1d9fbfc..f875b26 100644
+--- a/src/networkd/address.h
++++ b/src/networkd/address.h
+@@ -23,6 +23,9 @@
+
+ #include <netinet/ether.h>
+ #include <string.h>
++#include <sys/random.h>
++
++#include "logging.h"
+
+ typedef struct ether_addr nw_address_t;
+
+@@ -44,4 +47,26 @@ static inline char* nw_address_to_string(const nw_address_t* addr) {
+ return strdup(buffer);
+ }
+
++static inline int nw_address_generate(nw_address_t* addr) {
++ ssize_t bytes = getrandom(addr, sizeof(*addr), 0);
++ if (bytes < 0) {
++ ERROR("getrandom() failed: %m\n");
++ return 1;
++ }
++
++ // Check if we filled the entire buffer
++ if (bytes < (ssize_t)sizeof(*addr)) {
++ ERROR("Could not gather enough randomness\n");
++ return 1;
++ }
++
++ // Clear the multicast bit
++ addr->ether_addr_octet[0] &= 0xfe;
++
++ // Set the software-generated bit
++ addr->ether_addr_octet[1] |= 0x02;
++
++ return 0;
++}
++
+ #endif /* NETWORKD_ADDRESS_H */
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index aff79a5..4c32592 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -75,18 +75,28 @@ static int nw_port_setup_address(struct nw_port* port) {
+ const char* s = nw_config_get(port->config, "ADDRESS");
+ if (!s) {
+ ERROR("Port %s: Address isn't set\n", port->name);
+- return 1;
++ goto ERROR;
+ }
+
+ // Parse the address
+ r = nw_address_from_string(&port->address, s);
+ if (r) {
+ ERROR("Port %s: Could not parse address: %m\n", port->name);
+- return r;
++ goto ERROR;
+ }
+
+ // XXX Do we need to check for multicast here?
+
++ return 0;
++
++ERROR:
++ // Generate a random Ethernet address
++ r = nw_address_generate(&port->address);
++ if (r) {
++ ERROR("Could not generate a random Ethernet address: %m\n");
++ return r;
++ }
++
+ return 0;
+ }
+
+--
+2.39.2
+
diff --git a/network/patches/0199-networkd-Introduce-address-flags-for-better-readabil.patch b/network/patches/0199-networkd-Introduce-address-flags-for-better-readabil.patch
new file mode 100644
index 000000000..35671509c
--- /dev/null
+++ b/network/patches/0199-networkd-Introduce-address-flags-for-better-readabil.patch
@@ -0,0 +1,43 @@
+From 35fc59cd654c084cfe2550ed874d768f624b591e Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 11 Feb 2023 12:06:18 +0000
+Subject: [PATCH 199/304] networkd: Introduce address flags for better
+ readability
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/address.h | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/src/networkd/address.h b/src/networkd/address.h
+index f875b26..0885d75 100644
+--- a/src/networkd/address.h
++++ b/src/networkd/address.h
+@@ -29,6 +29,11 @@
+
+ typedef struct ether_addr nw_address_t;
+
++enum {
++ NW_ADDRESS_MULTICAST = (1 << 0),
++ NW_ADDRESS_SOFTWAREASSIGNED = (1 << 1),
++};
++
+ static inline int nw_address_from_string(nw_address_t* addr, const char* s) {
+ struct ether_addr* p = ether_aton_r(s, addr);
+ if (!p)
+@@ -61,10 +66,10 @@ static inline int nw_address_generate(nw_address_t* addr) {
+ }
+
+ // Clear the multicast bit
+- addr->ether_addr_octet[0] &= 0xfe;
++ addr->ether_addr_octet[0] &= ~NW_ADDRESS_MULTICAST;
+
+ // Set the software-generated bit
+- addr->ether_addr_octet[1] |= 0x02;
++ addr->ether_addr_octet[0] |= NW_ADDRESS_SOFTWAREASSIGNED;
+
+ return 0;
+ }
+--
+2.39.2
+
diff --git a/network/patches/0200-networkd-Check-if-Ethernet-addresses-from-config-are.patch b/network/patches/0200-networkd-Check-if-Ethernet-addresses-from-config-are.patch
new file mode 100644
index 000000000..b1f3b2ab4
--- /dev/null
+++ b/network/patches/0200-networkd-Check-if-Ethernet-addresses-from-config-are.patch
@@ -0,0 +1,46 @@
+From d81d9cf5582b9be41968c10c01bf436b066d4e34 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 11 Feb 2023 12:10:15 +0000
+Subject: [PATCH 200/304] networkd: Check if Ethernet addresses from config are
+ usable
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/address.h | 4 ++++
+ src/networkd/port.c | 7 ++++++-
+ 2 files changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/src/networkd/address.h b/src/networkd/address.h
+index 0885d75..d284a0b 100644
+--- a/src/networkd/address.h
++++ b/src/networkd/address.h
+@@ -74,4 +74,8 @@ static inline int nw_address_generate(nw_address_t* addr) {
+ return 0;
+ }
+
++static inline int nw_address_is_multicast(const nw_address_t* addr) {
++ return (addr->ether_addr_octet[0] & NW_ADDRESS_MULTICAST);
++}
++
+ #endif /* NETWORKD_ADDRESS_H */
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index 4c32592..89f3181 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -85,7 +85,12 @@ static int nw_port_setup_address(struct nw_port* port) {
+ goto ERROR;
+ }
+
+- // XXX Do we need to check for multicast here?
++ // Check if this address is usable
++ r = nw_address_is_multicast(&port->address);
++ if (r) {
++ DEBUG("Port %s: Multicast bit is set on Ethernet address\n", port->name);
++ goto ERROR;
++ }
+
+ return 0;
+
+--
+2.39.2
+
diff --git a/network/patches/0201-networkd-Export-ports-over-dbus.patch b/network/patches/0201-networkd-Export-ports-over-dbus.patch
new file mode 100644
index 000000000..4381b54bb
--- /dev/null
+++ b/network/patches/0201-networkd-Export-ports-over-dbus.patch
@@ -0,0 +1,347 @@
+From 7297ba7fab067d53560eaeba7e8aa992cef3308a Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 11 Feb 2023 12:34:41 +0000
+Subject: [PATCH 201/304] networkd: Export ports over dbus
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 6 ++-
+ src/networkd/daemon-bus.c | 3 +-
+ src/networkd/daemon.c | 14 ++++++
+ src/networkd/daemon.h | 6 +++
+ src/networkd/port-bus.c | 89 +++++++++++++++++++++++++++++++++++++++
+ src/networkd/port-bus.h | 28 ++++++++++++
+ src/networkd/port.c | 14 ++++++
+ src/networkd/port.h | 2 +
+ src/networkd/ports.c | 52 +++++++++++++++++++++++
+ src/networkd/ports.h | 6 ++-
+ 10 files changed, 216 insertions(+), 4 deletions(-)
+ create mode 100644 src/networkd/port-bus.c
+ create mode 100644 src/networkd/port-bus.h
+
+diff --git a/Makefile.am b/Makefile.am
+index a27736a..893f1b8 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -325,10 +325,12 @@ dist_networkd_SOURCES = \
+ src/networkd/links.h \
+ src/networkd/logging.h \
+ src/networkd/main.c \
+- src/networkd/port.c \
+- src/networkd/port.h \
+ src/networkd/ports.c \
+ src/networkd/ports.h \
++ src/networkd/port.c \
++ src/networkd/port.h \
++ src/networkd/port-bus.c \
++ src/networkd/port-bus.h \
+ src/networkd/string.h \
+ src/networkd/util.c \
+ src/networkd/util.h \
+diff --git a/src/networkd/daemon-bus.c b/src/networkd/daemon-bus.c
+index aac9775..ca0754f 100644
+--- a/src/networkd/daemon-bus.c
++++ b/src/networkd/daemon-bus.c
+@@ -22,6 +22,7 @@
+
+ #include "bus.h"
+ #include "daemon.h"
++#include "port-bus.h"
+ #include "zone-bus.h"
+
+ static int nw_daemon_bus_reload(sd_bus_message* m, void* data, sd_bus_error* error) {
+@@ -45,5 +46,5 @@ const struct nw_bus_implementation daemon_bus_impl = {
+ .path = "/org/ipfire/network1",
+ .interface = "org.ipfire.network1",
+ .vtables = BUS_VTABLES(daemon_vtable),
+- .children = BUS_IMPLEMENTATIONS(&zone_bus_impl),
++ .children = BUS_IMPLEMENTATIONS(&port_bus_impl, &zone_bus_impl),
+ };
+diff --git a/src/networkd/daemon.c b/src/networkd/daemon.c
+index aee27e3..795a8b7 100644
+--- a/src/networkd/daemon.c
++++ b/src/networkd/daemon.c
+@@ -448,6 +448,20 @@ struct nw_link* nw_daemon_get_link_by_ifindex(struct nw_daemon* daemon, int ifin
+ return nw_links_get_by_ifindex(daemon->links, ifindex);
+ }
+
++/*
++ Ports
++*/
++struct nw_ports* nw_daemon_ports(struct nw_daemon* daemon) {
++ return nw_ports_ref(daemon->ports);
++}
++
++struct nw_port* nw_daemon_get_port_by_name(struct nw_daemon* daemon, const char* name) {
++ if (!daemon->ports)
++ return NULL;
++
++ return nw_ports_get_by_name(daemon->ports, name);
++}
++
+ /*
+ Zones
+ */
+diff --git a/src/networkd/daemon.h b/src/networkd/daemon.h
+index 8e534c5..e08537e 100644
+--- a/src/networkd/daemon.h
++++ b/src/networkd/daemon.h
+@@ -49,6 +49,12 @@ struct nw_links* nw_daemon_links(struct nw_daemon* daemon);
+ void nw_daemon_drop_link(struct nw_daemon* daemon, struct nw_link* link);
+ struct nw_link* nw_daemon_get_link_by_ifindex(struct nw_daemon* daemon, int ifindex);
+
++/*
++ Ports
++*/
++struct nw_ports* nw_daemon_ports(struct nw_daemon* daemon);
++struct nw_port* nw_daemon_get_port_by_name(struct nw_daemon* daemon, const char* name);
++
+ /*
+ Zones
+ */
+diff --git a/src/networkd/port-bus.c b/src/networkd/port-bus.c
+new file mode 100644
+index 0000000..8c327b9
+--- /dev/null
++++ b/src/networkd/port-bus.c
+@@ -0,0 +1,89 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#include <errno.h>
++
++#include "bus.h"
++#include "daemon.h"
++#include "logging.h"
++#include "port.h"
++#include "port-bus.h"
++#include "ports.h"
++
++static int nw_port_node_enumerator(sd_bus* bus, const char* path, void* data,
++ char*** nodes, sd_bus_error* error) {
++ int r;
++
++ DEBUG("Enumerating ports...\n");
++
++ // Fetch a reference to the daemon
++ struct nw_daemon* daemon = (struct nw_daemon*)data;
++
++ // Fetch ports
++ struct nw_ports* ports = nw_daemon_ports(daemon);
++
++ // Make bus paths for all ports
++ r = nw_ports_bus_paths(ports, nodes);
++ if (r)
++ goto ERROR;
++
++ERROR:
++ nw_ports_unref(ports);
++
++ return r;
++}
++
++static int nw_port_object_find(sd_bus* bus, const char* path, const char* interface,
++ void* data, void** found, sd_bus_error* error) {
++ char* name = NULL;
++ int r;
++
++ // Fetch a reference to the daemon
++ struct nw_daemon* daemon = (struct nw_daemon*)data;
++
++ // Decode the path of the requested object
++ r = sd_bus_path_decode(path, "/org/ipfire/network1/port", &name);
++ if (r <= 0)
++ return 0;
++
++ // Find the port
++ struct nw_port* port = nw_daemon_get_port_by_name(daemon, name);
++ if (!port)
++ return 0;
++
++ // Match!
++ *found = port;
++
++ nw_port_unref(port);
++
++ return 1;
++}
++
++static const sd_bus_vtable port_vtable[] = {
++ SD_BUS_VTABLE_START(0),
++ SD_BUS_VTABLE_END
++};
++
++const struct nw_bus_implementation port_bus_impl = {
++ "/org/ipfire/network1/port",
++ "org.ipfire.network1.Port",
++ .fallback_vtables = BUS_FALLBACK_VTABLES({port_vtable, nw_port_object_find}),
++ .node_enumerator = nw_port_node_enumerator,
++};
+diff --git a/src/networkd/port-bus.h b/src/networkd/port-bus.h
+new file mode 100644
+index 0000000..95e49a8
+--- /dev/null
++++ b/src/networkd/port-bus.h
+@@ -0,0 +1,28 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#ifndef NETWORKD_PORT_BUS_H
++#define NETWORKD_PORT_BUS_H
++
++#include "bus.h"
++
++extern const struct nw_bus_implementation port_bus_impl;
++
++#endif /* NETWORKD_PORT_BUS_H */
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index 89f3181..d1e3f7f 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -23,6 +23,8 @@
+ #include <stdint.h>
+ #include <stdlib.h>
+
++#include <systemd/sd-bus.h>
++
+ #include "address.h"
+ #include "config.h"
+ #include "logging.h"
+@@ -207,3 +209,15 @@ struct nw_port* nw_port_unref(struct nw_port* port) {
+ const char* nw_port_name(struct nw_port* port) {
+ return port->name;
+ }
++
++char* nw_port_bus_path(struct nw_port* port) {
++ char* p = NULL;
++ int r;
++
++ // Encode the bus path
++ r = sd_bus_path_encode("/org/ipfire/network1/port", port->name, &p);
++ if (r < 0)
++ return NULL;
++
++ return p;
++}
+diff --git a/src/networkd/port.h b/src/networkd/port.h
+index af7fbdd..e3655cf 100644
+--- a/src/networkd/port.h
++++ b/src/networkd/port.h
+@@ -37,4 +37,6 @@ struct nw_port* nw_port_unref(struct nw_port* port);
+
+ const char* nw_port_name(struct nw_port* port);
+
++char* nw_port_bus_path(struct nw_port* port);
++
+ #endif /* NETWORKD_PORT_H */
+diff --git a/src/networkd/ports.c b/src/networkd/ports.c
+index 19a3a59..24bd257 100644
+--- a/src/networkd/ports.c
++++ b/src/networkd/ports.c
+@@ -157,3 +157,55 @@ ERROR:
+ int nw_ports_enumerate(struct nw_ports* ports) {
+ return nw_ftw(PORT_CONFIG_DIR, PORT_CONFIG_DIR "/*", __nw_ports_enumerate, ports);
+ }
++
++struct nw_port* nw_ports_get_by_name(struct nw_ports* ports, const char* name) {
++ struct nw_ports_entry* entry = NULL;
++
++ STAILQ_FOREACH(entry, &ports->entries, nodes) {
++ const char* __name = nw_port_name(entry->port);
++
++ // If the name matches, return a reference to the zone
++ if (strcmp(name, __name) == 0)
++ return nw_port_ref(entry->port);
++ }
++
++ // No match found
++ return NULL;
++}
++
++int nw_ports_bus_paths(struct nw_ports* ports, char*** paths) {
++ struct nw_ports_entry* entry = NULL;
++ char* path = NULL;
++
++ // Allocate an array for all paths
++ char** p = calloc(ports->num + 1, sizeof(*p));
++ if (!p)
++ return 1;
++
++ unsigned int i = 0;
++
++ // Walk through all ports
++ STAILQ_FOREACH(entry, &ports->entries, nodes) {
++ // Generate the bus path
++ path = nw_port_bus_path(entry->port);
++ if (!path)
++ goto ERROR;
++
++ // Append the bus path to the array
++ p[i++] = path;
++ }
++
++ // Return pointer
++ *paths = p;
++
++ return 0;
++
++ERROR:
++ if (p) {
++ for (char** e = p; *e; e++)
++ free(*e);
++ free(p);
++ }
++
++ return 1;
++}
+diff --git a/src/networkd/ports.h b/src/networkd/ports.h
+index 76a4a3a..e807e25 100644
+--- a/src/networkd/ports.h
++++ b/src/networkd/ports.h
+@@ -32,4 +32,8 @@ struct nw_ports* nw_ports_unref(struct nw_ports* ports);
+
+ int nw_ports_enumerate(struct nw_ports* ports);
+
+-#endif /* NETWORKD_ZONES_H */
++struct nw_port* nw_ports_get_by_name(struct nw_ports* ports, const char* name);
++
++int nw_ports_bus_paths(struct nw_ports* ports, char*** paths);
++
++#endif /* NETWORKD_PORTS_H */
+--
+2.39.2
+
diff --git a/network/patches/0202-networkd-address-Fix-buffer-to-Ethernet-address-stri.patch b/network/patches/0202-networkd-address-Fix-buffer-to-Ethernet-address-stri.patch
new file mode 100644
index 000000000..b72c77c0f
--- /dev/null
+++ b/network/patches/0202-networkd-address-Fix-buffer-to-Ethernet-address-stri.patch
@@ -0,0 +1,27 @@
+From 8c569e1ca29435a0caa6ecc3b2118ac2dbac4466 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 11 Feb 2023 13:53:52 +0000
+Subject: [PATCH 202/304] networkd: address: Fix buffer to Ethernet address
+ strings
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/address.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/networkd/address.h b/src/networkd/address.h
+index d284a0b..b7556f4 100644
+--- a/src/networkd/address.h
++++ b/src/networkd/address.h
+@@ -43,7 +43,7 @@ static inline int nw_address_from_string(nw_address_t* addr, const char* s) {
+ }
+
+ static inline char* nw_address_to_string(const nw_address_t* addr) {
+- char buffer[ETH_ALEN];
++ char buffer[18];
+
+ char* p = ether_ntoa_r(addr, buffer);
+ if (!p)
+--
+2.39.2
+
diff --git a/network/patches/0203-networkd-ports-Export-Ethernet-address-over-dbus.patch b/network/patches/0203-networkd-ports-Export-Ethernet-address-over-dbus.patch
new file mode 100644
index 000000000..91a0ac533
--- /dev/null
+++ b/network/patches/0203-networkd-ports-Export-Ethernet-address-over-dbus.patch
@@ -0,0 +1,102 @@
+From 4a383286ff94b4bc6efdde95c26070b68b8942e3 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 11 Feb 2023 13:54:33 +0000
+Subject: [PATCH 203/304] networkd: ports: Export Ethernet address over dbus
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/port-bus.c | 34 ++++++++++++++++++++++++++++++++++
+ src/networkd/port.c | 4 ++++
+ src/networkd/port.h | 4 ++++
+ 3 files changed, 42 insertions(+)
+
+diff --git a/src/networkd/port-bus.c b/src/networkd/port-bus.c
+index 8c327b9..1a48655 100644
+--- a/src/networkd/port-bus.c
++++ b/src/networkd/port-bus.c
+@@ -19,7 +19,9 @@
+ #############################################################################*/
+
+ #include <errno.h>
++#include <stdlib.h>
+
++#include "address.h"
+ #include "bus.h"
+ #include "daemon.h"
+ #include "logging.h"
+@@ -76,8 +78,40 @@ static int nw_port_object_find(sd_bus* bus, const char* path, const char* interf
+ return 1;
+ }
+
++static int nw_port_bus_get_address(sd_bus* bus, const char* path, const char* interface,
++ const char* property, sd_bus_message* reply, void* data, sd_bus_error* error) {
++ struct nw_port* port = (struct nw_port*)data;
++ int r;
++
++ // Fetch the address
++ const nw_address_t* address = nw_port_get_address(port);
++
++ // Format the address as a string
++ char* s = nw_address_to_string(address);
++ if (!s) {
++ // XXX How to handle any errors?
++ return 0;
++ }
++
++ // Append the address to the return value
++ r = sd_bus_message_append(reply, "s", s);
++ if (r)
++ goto ERROR;
++
++ERROR:
++ if (s)
++ free(s);
++
++ return r;
++}
++
+ static const sd_bus_vtable port_vtable[] = {
+ SD_BUS_VTABLE_START(0),
++
++ // Address
++ SD_BUS_PROPERTY("Address", "s", nw_port_bus_get_address,
++ 0, SD_BUS_VTABLE_PROPERTY_EMITS_CHANGE),
++
+ SD_BUS_VTABLE_END
+ };
+
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index d1e3f7f..e59e760 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -221,3 +221,7 @@ char* nw_port_bus_path(struct nw_port* port) {
+
+ return p;
+ }
++
++const nw_address_t* nw_port_get_address(struct nw_port* port) {
++ return &port->address;
++}
+diff --git a/src/networkd/port.h b/src/networkd/port.h
+index e3655cf..caf1433 100644
+--- a/src/networkd/port.h
++++ b/src/networkd/port.h
+@@ -30,6 +30,8 @@ typedef enum nw_port_type {
+
+ struct nw_port;
+
++#include "address.h"
++
+ int nw_port_create(struct nw_port** port, const char* name);
+
+ struct nw_port* nw_port_ref(struct nw_port* port);
+@@ -39,4 +41,6 @@ const char* nw_port_name(struct nw_port* port);
+
+ char* nw_port_bus_path(struct nw_port* port);
+
++const nw_address_t* nw_port_get_address(struct nw_port* port);
++
+ #endif /* NETWORKD_PORT_H */
+--
+2.39.2
+
diff --git a/network/patches/0204-networkd-Add-method-to-fetch-corresponding-link-to-p.patch b/network/patches/0204-networkd-Add-method-to-fetch-corresponding-link-to-p.patch
new file mode 100644
index 000000000..e762f961c
--- /dev/null
+++ b/network/patches/0204-networkd-Add-method-to-fetch-corresponding-link-to-p.patch
@@ -0,0 +1,201 @@
+From 30d4ab67ce9936c6668d93229c8cc808c725338c Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 11 Feb 2023 14:10:16 +0000
+Subject: [PATCH 204/304] networkd: Add method to fetch corresponding link to
+ port
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/daemon.c | 7 +++++++
+ src/networkd/daemon.h | 1 +
+ src/networkd/link.h | 5 +++--
+ src/networkd/links.c | 15 +++++++++++++++
+ src/networkd/links.h | 1 +
+ src/networkd/port.c | 13 ++++++++++++-
+ src/networkd/port.h | 3 ++-
+ src/networkd/ports.c | 2 +-
+ 8 files changed, 42 insertions(+), 5 deletions(-)
+
+diff --git a/src/networkd/daemon.c b/src/networkd/daemon.c
+index 795a8b7..c4acff5 100644
+--- a/src/networkd/daemon.c
++++ b/src/networkd/daemon.c
+@@ -448,6 +448,13 @@ struct nw_link* nw_daemon_get_link_by_ifindex(struct nw_daemon* daemon, int ifin
+ return nw_links_get_by_ifindex(daemon->links, ifindex);
+ }
+
++struct nw_link* nw_daemon_get_link_by_name(struct nw_daemon* daemon, const char* name) {
++ if (!daemon->links)
++ return NULL;
++
++ return nw_links_get_by_name(daemon->links, name);
++}
++
+ /*
+ Ports
+ */
+diff --git a/src/networkd/daemon.h b/src/networkd/daemon.h
+index e08537e..a40dd60 100644
+--- a/src/networkd/daemon.h
++++ b/src/networkd/daemon.h
+@@ -48,6 +48,7 @@ sd_netlink* nw_daemon_get_rtnl(struct nw_daemon* daemon);
+ struct nw_links* nw_daemon_links(struct nw_daemon* daemon);
+ void nw_daemon_drop_link(struct nw_daemon* daemon, struct nw_link* link);
+ struct nw_link* nw_daemon_get_link_by_ifindex(struct nw_daemon* daemon, int ifindex);
++struct nw_link* nw_daemon_get_link_by_name(struct nw_daemon* daemon, const char* name);
+
+ /*
+ Ports
+diff --git a/src/networkd/link.h b/src/networkd/link.h
+index e482d71..72ddfa9 100644
+--- a/src/networkd/link.h
++++ b/src/networkd/link.h
+@@ -21,16 +21,17 @@
+ #ifndef NETWORKD_LINK_H
+ #define NETWORKD_LINK_H
+
+-#include "daemon.h"
+-
+ struct nw_link;
+
++#include "daemon.h"
++
+ int nw_link_create(struct nw_link** link, struct nw_daemon* daemon, int ifindex);
+
+ struct nw_link* nw_link_ref(struct nw_link* link);
+ struct nw_link* nw_link_unref(struct nw_link* link);
+
+ int nw_link_ifindex(struct nw_link* link);
++const char* nw_link_name(struct nw_link* link);
+
+ int nw_link_process(sd_netlink* rtnl, sd_netlink_message* message, void* data);
+
+diff --git a/src/networkd/links.c b/src/networkd/links.c
+index 044a27d..7aa83a3 100644
+--- a/src/networkd/links.c
++++ b/src/networkd/links.c
+@@ -20,6 +20,7 @@
+
+ #include <stddef.h>
+ #include <stdlib.h>
++#include <string.h>
+ #include <sys/queue.h>
+
+ #include "daemon.h"
+@@ -192,3 +193,17 @@ struct nw_link* nw_links_get_by_ifindex(struct nw_links* links, int ifindex) {
+
+ return nw_link_ref(entry->link);
+ }
++
++struct nw_link* nw_links_get_by_name(struct nw_links* links, const char* name) {
++ struct nw_links_entry* entry = NULL;
++
++ STAILQ_FOREACH(entry, &links->entries, nodes) {
++ const char* n = nw_link_name(entry->link);
++
++ if (strcmp(name, n) == 0)
++ return nw_link_ref(entry->link);
++ }
++
++ // No match found
++ return NULL;
++}
+diff --git a/src/networkd/links.h b/src/networkd/links.h
+index 2f2bbea..2b5c787 100644
+--- a/src/networkd/links.h
++++ b/src/networkd/links.h
+@@ -37,5 +37,6 @@ void nw_links_drop_link(struct nw_links* links, struct nw_link* link);
+ int nw_links_enumerate(struct nw_links* links);
+
+ struct nw_link* nw_links_get_by_ifindex(struct nw_links* links, int ifindex);
++struct nw_link* nw_links_get_by_name(struct nw_links* links, const char* name);
+
+ #endif /* NETWORKD_LINKS_H */
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index e59e760..33e75d7 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -27,11 +27,13 @@
+
+ #include "address.h"
+ #include "config.h"
++#include "link.h"
+ #include "logging.h"
+ #include "string.h"
+ #include "port.h"
+
+ struct nw_port {
++ struct nw_daemon* daemon;
+ int nrefs;
+
+ char name[IF_NAMESIZE];
+@@ -66,6 +68,8 @@ static nw_port_type_t nw_port_type_from_string(const char* s) {
+ static void nw_port_free(struct nw_port* port) {
+ if (port->config)
+ nw_config_unref(port->config);
++ if (port->daemon)
++ nw_daemon_unref(port->daemon);
+
+ free(port);
+ }
+@@ -163,7 +167,7 @@ static int nw_port_setup(struct nw_port* port) {
+ return 0;
+ }
+
+-int nw_port_create(struct nw_port** port, const char* name) {
++int nw_port_create(struct nw_port** port, struct nw_daemon* daemon, const char* name) {
+ int r;
+
+ // Allocate a new object
+@@ -171,6 +175,9 @@ int nw_port_create(struct nw_port** port, const char* name) {
+ if (!p)
+ return 1;
+
++ // Store a reference to the daemon
++ p->daemon = nw_daemon_ref(daemon);
++
+ // Initialize reference counter
+ p->nrefs = 1;
+
+@@ -222,6 +229,10 @@ char* nw_port_bus_path(struct nw_port* port) {
+ return p;
+ }
+
++static struct nw_link* nw_port_get_link(struct nw_port* port) {
++ return nw_daemon_get_link_by_name(port->daemon, port->name);
++}
++
+ const nw_address_t* nw_port_get_address(struct nw_port* port) {
+ return &port->address;
+ }
+diff --git a/src/networkd/port.h b/src/networkd/port.h
+index caf1433..92d60b2 100644
+--- a/src/networkd/port.h
++++ b/src/networkd/port.h
+@@ -31,8 +31,9 @@ typedef enum nw_port_type {
+ struct nw_port;
+
+ #include "address.h"
++#include "daemon.h"
+
+-int nw_port_create(struct nw_port** port, const char* name);
++int nw_port_create(struct nw_port** port, struct nw_daemon* daemon, const char* name);
+
+ struct nw_port* nw_port_ref(struct nw_port* port);
+ struct nw_port* nw_port_unref(struct nw_port* port);
+diff --git a/src/networkd/ports.c b/src/networkd/ports.c
+index 24bd257..9cec111 100644
+--- a/src/networkd/ports.c
++++ b/src/networkd/ports.c
+@@ -138,7 +138,7 @@ static int __nw_ports_enumerate(const char* path, const struct stat* s, void* da
+ return 0;
+
+ // Create a new port
+- r = nw_port_create(&port, name);
++ r = nw_port_create(&port, ports->daemon, name);
+ if (r)
+ goto ERROR;
+
+--
+2.39.2
+
diff --git a/network/patches/0205-networkd-Use-typedef-to-keep-type-names-shorter.patch b/network/patches/0205-networkd-Use-typedef-to-keep-type-names-shorter.patch
new file mode 100644
index 000000000..c8f82a9e4
--- /dev/null
+++ b/network/patches/0205-networkd-Use-typedef-to-keep-type-names-shorter.patch
@@ -0,0 +1,1617 @@
+From 2361667ee3e575e7c1b3044936a7b466283d7996 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 11 Feb 2023 17:44:42 +0000
+Subject: [PATCH 205/304] networkd: Use typedef to keep type names shorter
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/bus.c | 4 +--
+ src/networkd/bus.h | 10 +++----
+ src/networkd/config.c | 36 +++++++++++------------
+ src/networkd/config.h | 26 ++++++++---------
+ src/networkd/daemon-bus.c | 4 +--
+ src/networkd/daemon-bus.h | 2 +-
+ src/networkd/daemon.c | 60 +++++++++++++++++++--------------------
+ src/networkd/daemon.h | 34 ++++++++++++----------
+ src/networkd/link.c | 26 ++++++++---------
+ src/networkd/link.h | 12 ++++----
+ src/networkd/links.c | 26 ++++++++---------
+ src/networkd/links.h | 18 ++++++------
+ src/networkd/main.c | 2 +-
+ src/networkd/port-bus.c | 12 ++++----
+ src/networkd/port-bus.h | 2 +-
+ src/networkd/port.c | 30 ++++++++++----------
+ src/networkd/port.h | 14 ++++-----
+ src/networkd/ports.c | 26 ++++++++---------
+ src/networkd/ports.h | 14 ++++-----
+ src/networkd/zone-bus.c | 14 ++++-----
+ src/networkd/zone-bus.h | 2 +-
+ src/networkd/zone.c | 24 ++++++++--------
+ src/networkd/zone.h | 16 +++++------
+ src/networkd/zones.c | 26 ++++++++---------
+ src/networkd/zones.h | 14 ++++-----
+ 25 files changed, 229 insertions(+), 225 deletions(-)
+
+diff --git a/src/networkd/bus.c b/src/networkd/bus.c
+index 258aacd..1daa035 100644
+--- a/src/networkd/bus.c
++++ b/src/networkd/bus.c
+@@ -29,14 +29,14 @@
+ #include "logging.h"
+
+ static int nw_bus_on_connect(sd_bus_message* m, void* data, sd_bus_error* error) {
+- struct nw_daemon* daemon = (struct nw_daemon*)data;
++ nw_daemon* daemon = (nw_daemon*)data;
+
+ DEBUG("Connected to D-Bus\n");
+
+ return 0;
+ }
+
+-int nw_bus_connect(sd_bus* bus, sd_event* loop, struct nw_daemon* daemon) {
++int nw_bus_connect(sd_bus* bus, sd_event* loop, nw_daemon* daemon) {
+ int r;
+
+ // Create a bus object
+diff --git a/src/networkd/bus.h b/src/networkd/bus.h
+index 42ab2d3..05b4c63 100644
+--- a/src/networkd/bus.h
++++ b/src/networkd/bus.h
+@@ -30,27 +30,27 @@
+
+ #include "daemon.h"
+
+-int nw_bus_connect(sd_bus* bus, sd_event* loop, struct nw_daemon* daemon);
++int nw_bus_connect(sd_bus* bus, sd_event* loop, nw_daemon* daemon);
+
+ struct nw_bus_vtable_pair {
+ const sd_bus_vtable* vtable;
+ sd_bus_object_find_t object_find;
+ };
+
+-struct nw_bus_implementation {
++typedef struct nw_bus_implementation {
+ const char* path;
+ const char* interface;
+ const sd_bus_vtable** vtables;
+ const struct nw_bus_vtable_pair* fallback_vtables;
+ sd_bus_node_enumerator_t node_enumerator;
+ const struct nw_bus_implementation** children;
+-};
++} nw_bus_implementation;
+
+ #define BUS_FALLBACK_VTABLES(...) ((const struct nw_bus_vtable_pair[]) { __VA_ARGS__, {} })
+-#define BUS_IMPLEMENTATIONS(...) ((const struct nw_bus_implementation* []) { __VA_ARGS__, NULL })
++#define BUS_IMPLEMENTATIONS(...) ((const nw_bus_implementation* []) { __VA_ARGS__, NULL })
+ #define BUS_VTABLES(...) ((const sd_bus_vtable* []){ __VA_ARGS__, NULL })
+
+ int nw_bus_register_implementation(sd_bus* bus,
+- const struct nw_bus_implementation* impl, void* data);
++ const nw_bus_implementation* impl, void* data);
+
+ #endif /* NETWORKD_BUS_H */
+diff --git a/src/networkd/config.c b/src/networkd/config.c
+index 17d6d89..b3d5284 100644
+--- a/src/networkd/config.c
++++ b/src/networkd/config.c
+@@ -50,7 +50,7 @@ static void nw_config_entry_free(struct nw_config_entry* entry) {
+ }
+
+ static struct nw_config_entry* nw_config_entry_create(
+- struct nw_config* config, const char* key) {
++ nw_config* config, const char* key) {
+ int r;
+
+ // Check input value
+@@ -79,17 +79,17 @@ ERROR:
+ return NULL;
+ }
+
+-static void nw_config_free(struct nw_config* config) {
++static void nw_config_free(nw_config* config) {
+ // Flush all entries
+ nw_config_flush(config);
+
+ free(config);
+ }
+
+-int nw_config_create(struct nw_config** config, const char* path) {
++int nw_config_create(nw_config** config, const char* path) {
+ int r;
+
+- struct nw_config* c = calloc(1, sizeof(*c));
++ nw_config* c = calloc(1, sizeof(*c));
+ if (!c)
+ return 1;
+
+@@ -121,13 +121,13 @@ ERROR:
+ return r;
+ }
+
+-struct nw_config* nw_config_ref(struct nw_config* config) {
++nw_config* nw_config_ref(nw_config* config) {
+ config->nrefs++;
+
+ return config;
+ }
+
+-struct nw_config* nw_config_unref(struct nw_config* config) {
++nw_config* nw_config_unref(nw_config* config) {
+ if (--config->nrefs > 0)
+ return config;
+
+@@ -135,14 +135,14 @@ struct nw_config* nw_config_unref(struct nw_config* config) {
+ return NULL;
+ }
+
+-const char* nw_config_path(struct nw_config* config) {
++const char* nw_config_path(nw_config* config) {
+ if (*config->path)
+ return config->path;
+
+ return NULL;
+ }
+
+-int nw_config_flush(struct nw_config* config) {
++int nw_config_flush(nw_config* config) {
+ struct nw_config_entry* entry = NULL;
+
+ while (!STAILQ_EMPTY(&config->entries)) {
+@@ -156,7 +156,7 @@ int nw_config_flush(struct nw_config* config) {
+ return 0;
+ }
+
+-static int nw_config_readf(struct nw_config* config, FILE* f) {
++static int nw_config_readf(nw_config* config, FILE* f) {
+ char* line = NULL;
+ size_t length = 0;
+ int r;
+@@ -202,7 +202,7 @@ static int nw_config_readf(struct nw_config* config, FILE* f) {
+ return r;
+ }
+
+-int nw_config_read(struct nw_config* config) {
++int nw_config_read(nw_config* config) {
+ FILE* f = NULL;
+ int r;
+
+@@ -234,7 +234,7 @@ ERROR:
+ return r;
+ }
+
+-static int nw_config_writef(struct nw_config* config, FILE* f) {
++static int nw_config_writef(nw_config* config, FILE* f) {
+ struct nw_config_entry* entry = NULL;
+ int r;
+
+@@ -254,7 +254,7 @@ static int nw_config_writef(struct nw_config* config, FILE* f) {
+ return 0;
+ }
+
+-int nw_config_write(struct nw_config* config) {
++int nw_config_write(nw_config* config) {
+ int r;
+
+ // We cannot write if path is not set
+@@ -280,7 +280,7 @@ ERROR:
+ return r;
+ }
+
+-static struct nw_config_entry* nw_config_find(struct nw_config* config, const char* key) {
++static struct nw_config_entry* nw_config_find(nw_config* config, const char* key) {
+ struct nw_config_entry* entry = NULL;
+
+ STAILQ_FOREACH(entry, &config->entries, nodes) {
+@@ -296,7 +296,7 @@ static struct nw_config_entry* nw_config_find(struct nw_config* config, const ch
+ return NULL;
+ }
+
+-int nw_config_del(struct nw_config* config, const char* key) {
++int nw_config_del(nw_config* config, const char* key) {
+ struct nw_config_entry* entry = NULL;
+
+ // Find an entry matching the key
+@@ -315,7 +315,7 @@ int nw_config_del(struct nw_config* config, const char* key) {
+ return 0;
+ }
+
+-const char* nw_config_get(struct nw_config* config, const char* key) {
++const char* nw_config_get(nw_config* config, const char* key) {
+ struct nw_config_entry* entry = nw_config_find(config, key);
+
+ // Return the value if found and set
+@@ -326,7 +326,7 @@ const char* nw_config_get(struct nw_config* config, const char* key) {
+ return NULL;
+ }
+
+-int nw_config_set(struct nw_config* config, const char* key, const char* value) {
++int nw_config_set(nw_config* config, const char* key, const char* value) {
+ struct nw_config_entry* entry = NULL;
+
+ // Delete the entry if val is NULL
+@@ -347,7 +347,7 @@ int nw_config_set(struct nw_config* config, const char* key, const char* value)
+ return nw_string_set(entry->value, value);
+ }
+
+-int nw_config_get_int(struct nw_config* config, const char* key, const int __default) {
++int nw_config_get_int(nw_config* config, const char* key, const int __default) {
+ const char* value = nw_config_get(config, key);
+
+ // Return zero if not set
+@@ -357,7 +357,7 @@ int nw_config_get_int(struct nw_config* config, const char* key, const int __def
+ return strtoul(value, NULL, 10);
+ }
+
+-int nw_config_set_int(struct nw_config* config, const char* key, const int value) {
++int nw_config_set_int(nw_config* config, const char* key, const int value) {
+ char __value[1024];
+ int r;
+
+diff --git a/src/networkd/config.h b/src/networkd/config.h
+index b8d8555..041a10e 100644
+--- a/src/networkd/config.h
++++ b/src/networkd/config.h
+@@ -26,26 +26,26 @@
+ #define NETWORK_CONFIG_KEY_MAX_LENGTH 128
+ #define NETWORK_CONFIG_VALUE_MAX_LENGTH 2048
+
+-struct nw_config;
++typedef struct nw_config nw_config;
+
+-int nw_config_create(struct nw_config** config, const char* path);
++int nw_config_create(nw_config** config, const char* path);
+
+-struct nw_config* nw_config_ref(struct nw_config* config);
+-struct nw_config* nw_config_unref(struct nw_config* config);
++nw_config* nw_config_ref(nw_config* config);
++nw_config* nw_config_unref(nw_config* config);
+
+-const char* nw_config_path(struct nw_config* config);
++const char* nw_config_path(nw_config* config);
+
+-int nw_config_flush(struct nw_config* config);
++int nw_config_flush(nw_config* config);
+
+-int nw_config_read(struct nw_config* config);
+-int nw_config_write(struct nw_config* config);
++int nw_config_read(nw_config* config);
++int nw_config_write(nw_config* config);
+
+-int nw_config_del(struct nw_config* config, const char* key);
++int nw_config_del(nw_config* config, const char* key);
+
+-const char* nw_config_get(struct nw_config* config, const char* key);
+-int nw_config_set(struct nw_config* config, const char* key, const char* value);
++const char* nw_config_get(nw_config* config, const char* key);
++int nw_config_set(nw_config* config, const char* key, const char* value);
+
+-int nw_config_get_int(struct nw_config* config, const char* key, const int __default);
+-int nw_config_set_int(struct nw_config* config, const char* key, const int value);
++int nw_config_get_int(nw_config* config, const char* key, const int __default);
++int nw_config_set_int(nw_config* config, const char* key, const int value);
+
+ #endif /* NETWORKD_CONFIG_H */
+diff --git a/src/networkd/daemon-bus.c b/src/networkd/daemon-bus.c
+index ca0754f..93a0411 100644
+--- a/src/networkd/daemon-bus.c
++++ b/src/networkd/daemon-bus.c
+@@ -26,7 +26,7 @@
+ #include "zone-bus.h"
+
+ static int nw_daemon_bus_reload(sd_bus_message* m, void* data, sd_bus_error* error) {
+- struct nw_daemon* daemon = (struct nw_daemon*)data;
++ nw_daemon* daemon = (nw_daemon*)data;
+
+ // Reload the daemon
+ nw_daemon_reload(daemon);
+@@ -42,7 +42,7 @@ static const sd_bus_vtable daemon_vtable[] = {
+ SD_BUS_VTABLE_END,
+ };
+
+-const struct nw_bus_implementation daemon_bus_impl = {
++const nw_bus_implementation daemon_bus_impl = {
+ .path = "/org/ipfire/network1",
+ .interface = "org.ipfire.network1",
+ .vtables = BUS_VTABLES(daemon_vtable),
+diff --git a/src/networkd/daemon-bus.h b/src/networkd/daemon-bus.h
+index 787e92a..c314963 100644
+--- a/src/networkd/daemon-bus.h
++++ b/src/networkd/daemon-bus.h
+@@ -23,6 +23,6 @@
+
+ #include "bus.h"
+
+-extern const struct nw_bus_implementation daemon_bus_impl;
++extern const nw_bus_implementation daemon_bus_impl;
+
+ #endif /* NETWORKD_DAEMON_BUS_H */
+diff --git a/src/networkd/daemon.c b/src/networkd/daemon.c
+index c4acff5..9b9bf73 100644
+--- a/src/networkd/daemon.c
++++ b/src/networkd/daemon.c
+@@ -44,7 +44,7 @@
+ struct nw_daemon {
+ int nrefs;
+
+- struct nw_config* config;
++ nw_config* config;
+
+ // Event Loop
+ sd_event* loop;
+@@ -59,13 +59,13 @@ struct nw_daemon {
+ sd_device_monitor* devmon;
+
+ // Links
+- struct nw_links* links;
++ nw_links* links;
+
+ // Zones
+- struct nw_zones* zones;
++ nw_zones* zones;
+
+ // Ports
+- struct nw_ports* ports;
++ nw_ports* ports;
+
+ };
+
+@@ -78,7 +78,7 @@ static int __nw_daemon_terminate(sd_event_source* source, const struct signalfd_
+
+ static int __nw_daemon_reload(sd_event_source* source, const struct signalfd_siginfo* si,
+ void* data) {
+- struct nw_daemon* daemon = (struct nw_daemon*)daemon;
++ nw_daemon* daemon = (nw_daemon*)daemon;
+
+ DEBUG("Received signal to reload...\n");
+
+@@ -88,7 +88,7 @@ static int __nw_daemon_reload(sd_event_source* source, const struct signalfd_sig
+ return 0;
+ }
+
+-static int nw_daemon_setup_loop(struct nw_daemon* daemon) {
++static int nw_daemon_setup_loop(nw_daemon* daemon) {
+ int r;
+
+ // Fetch a reference to the default event loop
+@@ -132,7 +132,7 @@ static int nw_daemon_setup_loop(struct nw_daemon* daemon) {
+ return 0;
+ }
+
+-static int nw_daemon_load_config(struct nw_daemon* daemon) {
++static int nw_daemon_load_config(nw_daemon* daemon) {
+ int r;
+
+ // Read configuration file
+@@ -148,7 +148,7 @@ static int nw_daemon_load_config(struct nw_daemon* daemon) {
+ return r;
+ }
+
+-static int nw_start_device_monitor(struct nw_daemon* daemon) {
++static int nw_start_device_monitor(nw_daemon* daemon) {
+ int r;
+
+ const char* subsystems[] = {
+@@ -199,7 +199,7 @@ static int nw_start_device_monitor(struct nw_daemon* daemon) {
+ return 0;
+ }
+
+-static int nw_daemon_connect_rtnl(struct nw_daemon* daemon, int fd) {
++static int nw_daemon_connect_rtnl(nw_daemon* daemon, int fd) {
+ int r;
+
+ // Connect to Netlink
+@@ -242,7 +242,7 @@ static int nw_daemon_connect_rtnl(struct nw_daemon* daemon, int fd) {
+ return 0;
+ }
+
+-static int nw_daemon_enumerate_links(struct nw_daemon* daemon) {
++static int nw_daemon_enumerate_links(nw_daemon* daemon) {
+ int r;
+
+ // Create a new links container
+@@ -253,7 +253,7 @@ static int nw_daemon_enumerate_links(struct nw_daemon* daemon) {
+ return nw_links_enumerate(daemon->links);
+ }
+
+-static int nw_daemon_enumerate_ports(struct nw_daemon* daemon) {
++static int nw_daemon_enumerate_ports(nw_daemon* daemon) {
+ int r;
+
+ // Create a new ports container
+@@ -264,7 +264,7 @@ static int nw_daemon_enumerate_ports(struct nw_daemon* daemon) {
+ return nw_ports_enumerate(daemon->ports);
+ }
+
+-static int nw_daemon_enumerate(struct nw_daemon* daemon) {
++static int nw_daemon_enumerate(nw_daemon* daemon) {
+ int r;
+
+ // Links
+@@ -280,7 +280,7 @@ static int nw_daemon_enumerate(struct nw_daemon* daemon) {
+ return 0;
+ }
+
+-static int nw_daemon_setup(struct nw_daemon* daemon) {
++static int nw_daemon_setup(nw_daemon* daemon) {
+ int r;
+
+ // Read the configuration
+@@ -316,10 +316,10 @@ static int nw_daemon_setup(struct nw_daemon* daemon) {
+ return 0;
+ }
+
+-int nw_daemon_create(struct nw_daemon** daemon) {
++int nw_daemon_create(nw_daemon** daemon) {
+ int r;
+
+- struct nw_daemon* d = calloc(1, sizeof(*d));
++ nw_daemon* d = calloc(1, sizeof(*d));
+ if (!d)
+ return 1;
+
+@@ -342,7 +342,7 @@ ERROR:
+ return r;
+ }
+
+-static void nw_daemon_cleanup(struct nw_daemon* daemon) {
++static void nw_daemon_cleanup(nw_daemon* daemon) {
+ if (daemon->ports)
+ nw_ports_unref(daemon->ports);
+ if (daemon->zones)
+@@ -353,7 +353,7 @@ static void nw_daemon_cleanup(struct nw_daemon* daemon) {
+ nw_config_unref(daemon->config);
+ }
+
+-static void nw_daemon_free(struct nw_daemon* daemon) {
++static void nw_daemon_free(nw_daemon* daemon) {
+ // Cleanup common objects
+ nw_daemon_cleanup(daemon);
+
+@@ -365,13 +365,13 @@ static void nw_daemon_free(struct nw_daemon* daemon) {
+ free(daemon);
+ }
+
+-struct nw_daemon* nw_daemon_ref(struct nw_daemon* daemon) {
++nw_daemon* nw_daemon_ref(nw_daemon* daemon) {
+ daemon->nrefs++;
+
+ return daemon;
+ }
+
+-struct nw_daemon* nw_daemon_unref(struct nw_daemon* daemon) {
++nw_daemon* nw_daemon_unref(nw_daemon* daemon) {
+ if (--daemon->nrefs > 0)
+ return daemon;
+
+@@ -382,7 +382,7 @@ struct nw_daemon* nw_daemon_unref(struct nw_daemon* daemon) {
+ /*
+ This function contains the main loop of the daemon...
+ */
+-int nw_daemon_run(struct nw_daemon* daemon) {
++int nw_daemon_run(nw_daemon* daemon) {
+ int r;
+
+ // We are now ready to process any requests
+@@ -412,7 +412,7 @@ ERROR:
+ return 1;
+ }
+
+-int nw_daemon_reload(struct nw_daemon* daemon) {
++int nw_daemon_reload(nw_daemon* daemon) {
+ DEBUG("Reloading daemon...\n");
+
+ // XXX TODO
+@@ -423,32 +423,32 @@ int nw_daemon_reload(struct nw_daemon* daemon) {
+ /*
+ Netlink
+ */
+-sd_netlink* nw_daemon_get_rtnl(struct nw_daemon* daemon) {
++sd_netlink* nw_daemon_get_rtnl(nw_daemon* daemon) {
+ return daemon->rtnl;
+ }
+
+ /*
+ Links
+ */
+-struct nw_links* nw_daemon_links(struct nw_daemon* daemon) {
++nw_links* nw_daemon_links(nw_daemon* daemon) {
+ return nw_links_ref(daemon->links);
+ }
+
+-void nw_daemon_drop_link(struct nw_daemon* daemon, struct nw_link* link) {
++void nw_daemon_drop_link(nw_daemon* daemon, nw_link* link) {
+ if (!daemon->links)
+ return;
+
+ nw_links_drop_link(daemon->links, link);
+ }
+
+-struct nw_link* nw_daemon_get_link_by_ifindex(struct nw_daemon* daemon, int ifindex) {
++nw_link* nw_daemon_get_link_by_ifindex(nw_daemon* daemon, int ifindex) {
+ if (!daemon->links)
+ return NULL;
+
+ return nw_links_get_by_ifindex(daemon->links, ifindex);
+ }
+
+-struct nw_link* nw_daemon_get_link_by_name(struct nw_daemon* daemon, const char* name) {
++nw_link* nw_daemon_get_link_by_name(nw_daemon* daemon, const char* name) {
+ if (!daemon->links)
+ return NULL;
+
+@@ -458,11 +458,11 @@ struct nw_link* nw_daemon_get_link_by_name(struct nw_daemon* daemon, const char*
+ /*
+ Ports
+ */
+-struct nw_ports* nw_daemon_ports(struct nw_daemon* daemon) {
++nw_ports* nw_daemon_ports(nw_daemon* daemon) {
+ return nw_ports_ref(daemon->ports);
+ }
+
+-struct nw_port* nw_daemon_get_port_by_name(struct nw_daemon* daemon, const char* name) {
++nw_port* nw_daemon_get_port_by_name(nw_daemon* daemon, const char* name) {
+ if (!daemon->ports)
+ return NULL;
+
+@@ -473,11 +473,11 @@ struct nw_port* nw_daemon_get_port_by_name(struct nw_daemon* daemon, const char*
+ Zones
+ */
+
+-struct nw_zones* nw_daemon_zones(struct nw_daemon* daemon) {
++nw_zones* nw_daemon_zones(nw_daemon* daemon) {
+ return nw_zones_ref(daemon->zones);
+ }
+
+-struct nw_zone* nw_daemon_get_zone_by_name(struct nw_daemon* daemon, const char* name) {
++nw_zone* nw_daemon_get_zone_by_name(nw_daemon* daemon, const char* name) {
+ if (!daemon->zones)
+ return NULL;
+
+diff --git a/src/networkd/daemon.h b/src/networkd/daemon.h
+index a40dd60..1694599 100644
+--- a/src/networkd/daemon.h
++++ b/src/networkd/daemon.h
+@@ -23,43 +23,47 @@
+
+ #include <systemd/sd-netlink.h>
+
+-struct nw_daemon;
++typedef struct nw_daemon nw_daemon;
+
+ #include "link.h"
++#include "links.h"
++#include "port.h"
++#include "ports.h"
+ #include "zone.h"
++#include "zones.h"
+
+-int nw_daemon_create(struct nw_daemon** daemon);
++int nw_daemon_create(nw_daemon** daemon);
+
+-struct nw_daemon* nw_daemon_ref(struct nw_daemon* daemon);
+-struct nw_daemon* nw_daemon_unref(struct nw_daemon* daemon);
++nw_daemon* nw_daemon_ref(nw_daemon* daemon);
++nw_daemon* nw_daemon_unref(nw_daemon* daemon);
+
+-int nw_daemon_run(struct nw_daemon* daemon);
++int nw_daemon_run(nw_daemon* daemon);
+
+-int nw_daemon_reload(struct nw_daemon* daemon);
++int nw_daemon_reload(nw_daemon* daemon);
+
+ /*
+ Netlink
+ */
+-sd_netlink* nw_daemon_get_rtnl(struct nw_daemon* daemon);
++sd_netlink* nw_daemon_get_rtnl(nw_daemon* daemon);
+
+ /*
+ Links
+ */
+-struct nw_links* nw_daemon_links(struct nw_daemon* daemon);
+-void nw_daemon_drop_link(struct nw_daemon* daemon, struct nw_link* link);
+-struct nw_link* nw_daemon_get_link_by_ifindex(struct nw_daemon* daemon, int ifindex);
+-struct nw_link* nw_daemon_get_link_by_name(struct nw_daemon* daemon, const char* name);
++nw_links* nw_daemon_links(nw_daemon* daemon);
++void nw_daemon_drop_link(nw_daemon* daemon, nw_link* link);
++nw_link* nw_daemon_get_link_by_ifindex(nw_daemon* daemon, int ifindex);
++nw_link* nw_daemon_get_link_by_name(nw_daemon* daemon, const char* name);
+
+ /*
+ Ports
+ */
+-struct nw_ports* nw_daemon_ports(struct nw_daemon* daemon);
+-struct nw_port* nw_daemon_get_port_by_name(struct nw_daemon* daemon, const char* name);
++nw_ports* nw_daemon_ports(nw_daemon* daemon);
++nw_port* nw_daemon_get_port_by_name(nw_daemon* daemon, const char* name);
+
+ /*
+ Zones
+ */
+-struct nw_zones* nw_daemon_zones(struct nw_daemon* daemon);
+-struct nw_zone* nw_daemon_get_zone_by_name(struct nw_daemon* daemon, const char* name);
++nw_zones* nw_daemon_zones(nw_daemon* daemon);
++nw_zone* nw_daemon_get_zone_by_name(nw_daemon* daemon, const char* name);
+
+ #endif /* NETWORKD_DAEMON_H */
+diff --git a/src/networkd/link.c b/src/networkd/link.c
+index 62be893..2f95dc3 100644
+--- a/src/networkd/link.c
++++ b/src/networkd/link.c
+@@ -32,7 +32,7 @@
+ #include "string.h"
+
+ struct nw_link {
+- struct nw_daemon* daemon;
++ nw_daemon* daemon;
+ int nrefs;
+
+ // Interface Index
+@@ -47,9 +47,9 @@ struct nw_link {
+ uint32_t max_mtu;
+ };
+
+-int nw_link_create(struct nw_link** link, struct nw_daemon* daemon, int ifindex) {
++int nw_link_create(nw_link** link, nw_daemon* daemon, int ifindex) {
+ // Allocate a new object
+- struct nw_link* l = calloc(1, sizeof(*l));
++ nw_link* l = calloc(1, sizeof(*l));
+ if (!l)
+ return 1;
+
+@@ -69,20 +69,20 @@ int nw_link_create(struct nw_link** link, struct nw_daemon* daemon, int ifindex)
+ return 0;
+ }
+
+-static void nw_link_free(struct nw_link* link) {
++static void nw_link_free(nw_link* link) {
+ DEBUG("Freeing link (ifindex = %d)\n", link->ifindex);
+
+ if (link->daemon)
+ nw_daemon_unref(link->daemon);
+ }
+
+-struct nw_link* nw_link_ref(struct nw_link* link) {
++nw_link* nw_link_ref(nw_link* link) {
+ link->nrefs++;
+
+ return link;
+ }
+
+-struct nw_link* nw_link_unref(struct nw_link* link) {
++nw_link* nw_link_unref(nw_link* link) {
+ if (--link->nrefs > 0)
+ return link;
+
+@@ -90,11 +90,11 @@ struct nw_link* nw_link_unref(struct nw_link* link) {
+ return NULL;
+ }
+
+-int nw_link_ifindex(struct nw_link* link) {
++int nw_link_ifindex(nw_link* link) {
+ return link->ifindex;
+ }
+
+-static int nw_link_update_ifname(struct nw_link* link, sd_netlink_message* message) {
++static int nw_link_update_ifname(nw_link* link, sd_netlink_message* message) {
+ const char* ifname = NULL;
+ int r;
+
+@@ -120,7 +120,7 @@ static int nw_link_update_ifname(struct nw_link* link, sd_netlink_message* messa
+ return 0;
+ }
+
+-static int nw_link_update_mtu(struct nw_link* link, sd_netlink_message* message) {
++static int nw_link_update_mtu(nw_link* link, sd_netlink_message* message) {
+ uint32_t mtu = 0;
+ uint32_t min_mtu = 0;
+ uint32_t max_mtu = 0;
+@@ -172,7 +172,7 @@ static int nw_link_update_mtu(struct nw_link* link, sd_netlink_message* message)
+ This function is called whenever anything changes, so that we can
+ update our internal link object.
+ */
+-static int nw_link_update(struct nw_link* link, sd_netlink_message* message) {
++static int nw_link_update(nw_link* link, sd_netlink_message* message) {
+ int r;
+
+ // Update the interface name
+@@ -189,14 +189,14 @@ static int nw_link_update(struct nw_link* link, sd_netlink_message* message) {
+ }
+
+ int nw_link_process(sd_netlink* rtnl, sd_netlink_message* message, void* data) {
+- struct nw_links* links = NULL;
+- struct nw_link* link = NULL;
++ nw_links* links = NULL;
++ nw_link* link = NULL;
+ const char* ifname = NULL;
+ int ifindex;
+ uint16_t type;
+ int r;
+
+- struct nw_daemon* daemon = (struct nw_daemon*)data;
++ nw_daemon* daemon = (nw_daemon*)data;
+
+ // Fetch links
+ links = nw_daemon_links(daemon);
+diff --git a/src/networkd/link.h b/src/networkd/link.h
+index 72ddfa9..acb5e7b 100644
+--- a/src/networkd/link.h
++++ b/src/networkd/link.h
+@@ -21,17 +21,17 @@
+ #ifndef NETWORKD_LINK_H
+ #define NETWORKD_LINK_H
+
+-struct nw_link;
++typedef struct nw_link nw_link;
+
+ #include "daemon.h"
+
+-int nw_link_create(struct nw_link** link, struct nw_daemon* daemon, int ifindex);
++int nw_link_create(nw_link** link, nw_daemon* daemon, int ifindex);
+
+-struct nw_link* nw_link_ref(struct nw_link* link);
+-struct nw_link* nw_link_unref(struct nw_link* link);
++nw_link* nw_link_ref(nw_link* link);
++nw_link* nw_link_unref(nw_link* link);
+
+-int nw_link_ifindex(struct nw_link* link);
+-const char* nw_link_name(struct nw_link* link);
++int nw_link_ifindex(nw_link* link);
++const char* nw_link_name(nw_link* link);
+
+ int nw_link_process(sd_netlink* rtnl, sd_netlink_message* message, void* data);
+
+diff --git a/src/networkd/links.c b/src/networkd/links.c
+index 7aa83a3..9f41034 100644
+--- a/src/networkd/links.c
++++ b/src/networkd/links.c
+@@ -29,14 +29,14 @@
+ #include "links.h"
+
+ struct nw_links_entry {
+- struct nw_link* link;
++ nw_link* link;
+
+ // Link to the other entries
+ STAILQ_ENTRY(nw_links_entry) nodes;
+ };
+
+ struct nw_links {
+- struct nw_daemon* daemon;
++ nw_daemon* daemon;
+ int nrefs;
+
+ // Link Entries
+@@ -46,8 +46,8 @@ struct nw_links {
+ unsigned int num;
+ };
+
+-int nw_links_create(struct nw_links** links, struct nw_daemon* daemon) {
+- struct nw_links* l = calloc(1, sizeof(*l));
++int nw_links_create(nw_links** links, nw_daemon* daemon) {
++ nw_links* l = calloc(1, sizeof(*l));
+ if (!l)
+ return 1;
+
+@@ -66,7 +66,7 @@ int nw_links_create(struct nw_links** links, struct nw_daemon* daemon) {
+ return 0;
+ }
+
+-static void nw_links_free(struct nw_links* links) {
++static void nw_links_free(nw_links* links) {
+ struct nw_links_entry* entry = NULL;
+
+ while (!STAILQ_EMPTY(&links->entries)) {
+@@ -86,13 +86,13 @@ static void nw_links_free(struct nw_links* links) {
+ nw_daemon_unref(links->daemon);
+ }
+
+-struct nw_links* nw_links_ref(struct nw_links* links) {
++nw_links* nw_links_ref(nw_links* links) {
+ links->nrefs++;
+
+ return links;
+ }
+
+-struct nw_links* nw_links_unref(struct nw_links* links) {
++nw_links* nw_links_unref(nw_links* links) {
+ if (--links->nrefs > 0)
+ return links;
+
+@@ -100,7 +100,7 @@ struct nw_links* nw_links_unref(struct nw_links* links) {
+ return NULL;
+ }
+
+-static struct nw_links_entry* nw_links_find_link(struct nw_links* links, const int ifindex) {
++static struct nw_links_entry* nw_links_find_link(nw_links* links, const int ifindex) {
+ struct nw_links_entry* entry = NULL;
+
+ STAILQ_FOREACH(entry, &links->entries, nodes) {
+@@ -112,7 +112,7 @@ static struct nw_links_entry* nw_links_find_link(struct nw_links* links, const i
+ return NULL;
+ }
+
+-int nw_links_add_link(struct nw_links* links, struct nw_link* link) {
++int nw_links_add_link(nw_links* links, struct nw_link* link) {
+ // Allocate a new entry
+ struct nw_links_entry* entry = calloc(1, sizeof(*entry));
+ if (!entry)
+@@ -130,7 +130,7 @@ int nw_links_add_link(struct nw_links* links, struct nw_link* link) {
+ return 0;
+ }
+
+-void nw_links_drop_link(struct nw_links* links, struct nw_link* link) {
++void nw_links_drop_link(nw_links* links, struct nw_link* link) {
+ struct nw_links_entry* entry = NULL;
+
+ entry = nw_links_find_link(links, nw_link_ifindex(link));
+@@ -143,7 +143,7 @@ void nw_links_drop_link(struct nw_links* links, struct nw_link* link) {
+ links->num--;
+ }
+
+-int nw_links_enumerate(struct nw_links* links) {
++int nw_links_enumerate(nw_links* links) {
+ sd_netlink_message* req = NULL;
+ sd_netlink_message* res = NULL;
+ int r;
+@@ -184,7 +184,7 @@ ERROR:
+ return r;
+ }
+
+-struct nw_link* nw_links_get_by_ifindex(struct nw_links* links, int ifindex) {
++nw_link* nw_links_get_by_ifindex(nw_links* links, int ifindex) {
+ struct nw_links_entry* entry = NULL;
+
+ entry = nw_links_find_link(links, ifindex);
+@@ -194,7 +194,7 @@ struct nw_link* nw_links_get_by_ifindex(struct nw_links* links, int ifindex) {
+ return nw_link_ref(entry->link);
+ }
+
+-struct nw_link* nw_links_get_by_name(struct nw_links* links, const char* name) {
++nw_link* nw_links_get_by_name(nw_links* links, const char* name) {
+ struct nw_links_entry* entry = NULL;
+
+ STAILQ_FOREACH(entry, &links->entries, nodes) {
+diff --git a/src/networkd/links.h b/src/networkd/links.h
+index 2b5c787..21e6cfb 100644
+--- a/src/networkd/links.h
++++ b/src/networkd/links.h
+@@ -24,19 +24,19 @@
+ #include "daemon.h"
+ #include "link.h"
+
+-struct nw_links;
++typedef struct nw_links nw_links;
+
+-int nw_links_create(struct nw_links** links, struct nw_daemon* daemon);
++int nw_links_create(nw_links** links, nw_daemon* daemon);
+
+-struct nw_links* nw_links_ref(struct nw_links* links);
+-struct nw_links* nw_links_unref(struct nw_links* links);
++nw_links* nw_links_ref(nw_links* links);
++nw_links* nw_links_unref(nw_links* links);
+
+-int nw_links_add_link(struct nw_links* links, struct nw_link* link);
+-void nw_links_drop_link(struct nw_links* links, struct nw_link* link);
++int nw_links_add_link(nw_links* links, nw_link* link);
++void nw_links_drop_link(nw_links* links, nw_link* link);
+
+-int nw_links_enumerate(struct nw_links* links);
++int nw_links_enumerate(nw_links* links);
+
+-struct nw_link* nw_links_get_by_ifindex(struct nw_links* links, int ifindex);
+-struct nw_link* nw_links_get_by_name(struct nw_links* links, const char* name);
++nw_link* nw_links_get_by_ifindex(nw_links* links, int ifindex);
++nw_link* nw_links_get_by_name(nw_links* links, const char* name);
+
+ #endif /* NETWORKD_LINKS_H */
+diff --git a/src/networkd/main.c b/src/networkd/main.c
+index 9a0fd74..d3afc2a 100644
+--- a/src/networkd/main.c
++++ b/src/networkd/main.c
+@@ -212,7 +212,7 @@ static int drop_privileges(const char* user) {
+ }
+
+ int main(int argc, char** argv) {
+- struct nw_daemon* daemon = NULL;
++ nw_daemon* daemon = NULL;
+ int r;
+
+ // Drop privileges
+diff --git a/src/networkd/port-bus.c b/src/networkd/port-bus.c
+index 1a48655..996be92 100644
+--- a/src/networkd/port-bus.c
++++ b/src/networkd/port-bus.c
+@@ -36,10 +36,10 @@ static int nw_port_node_enumerator(sd_bus* bus, const char* path, void* data,
+ DEBUG("Enumerating ports...\n");
+
+ // Fetch a reference to the daemon
+- struct nw_daemon* daemon = (struct nw_daemon*)data;
++ nw_daemon* daemon = (nw_daemon*)data;
+
+ // Fetch ports
+- struct nw_ports* ports = nw_daemon_ports(daemon);
++ nw_ports* ports = nw_daemon_ports(daemon);
+
+ // Make bus paths for all ports
+ r = nw_ports_bus_paths(ports, nodes);
+@@ -58,7 +58,7 @@ static int nw_port_object_find(sd_bus* bus, const char* path, const char* interf
+ int r;
+
+ // Fetch a reference to the daemon
+- struct nw_daemon* daemon = (struct nw_daemon*)data;
++ nw_daemon* daemon = (nw_daemon*)data;
+
+ // Decode the path of the requested object
+ r = sd_bus_path_decode(path, "/org/ipfire/network1/port", &name);
+@@ -66,7 +66,7 @@ static int nw_port_object_find(sd_bus* bus, const char* path, const char* interf
+ return 0;
+
+ // Find the port
+- struct nw_port* port = nw_daemon_get_port_by_name(daemon, name);
++ nw_port* port = nw_daemon_get_port_by_name(daemon, name);
+ if (!port)
+ return 0;
+
+@@ -80,7 +80,7 @@ static int nw_port_object_find(sd_bus* bus, const char* path, const char* interf
+
+ static int nw_port_bus_get_address(sd_bus* bus, const char* path, const char* interface,
+ const char* property, sd_bus_message* reply, void* data, sd_bus_error* error) {
+- struct nw_port* port = (struct nw_port*)data;
++ nw_port* port = (nw_port*)data;
+ int r;
+
+ // Fetch the address
+@@ -115,7 +115,7 @@ static const sd_bus_vtable port_vtable[] = {
+ SD_BUS_VTABLE_END
+ };
+
+-const struct nw_bus_implementation port_bus_impl = {
++const nw_bus_implementation port_bus_impl = {
+ "/org/ipfire/network1/port",
+ "org.ipfire.network1.Port",
+ .fallback_vtables = BUS_FALLBACK_VTABLES({port_vtable, nw_port_object_find}),
+diff --git a/src/networkd/port-bus.h b/src/networkd/port-bus.h
+index 95e49a8..373c281 100644
+--- a/src/networkd/port-bus.h
++++ b/src/networkd/port-bus.h
+@@ -23,6 +23,6 @@
+
+ #include "bus.h"
+
+-extern const struct nw_bus_implementation port_bus_impl;
++extern const nw_bus_implementation port_bus_impl;
+
+ #endif /* NETWORKD_PORT_BUS_H */
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index 33e75d7..41b8b24 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -33,14 +33,14 @@
+ #include "port.h"
+
+ struct nw_port {
+- struct nw_daemon* daemon;
++ nw_daemon* daemon;
+ int nrefs;
+
+ char name[IF_NAMESIZE];
+ nw_port_type_t type;
+
+ // Configuration
+- struct nw_config *config;
++ nw_config *config;
+
+ // Common attributes
+ nw_address_t address;
+@@ -65,7 +65,7 @@ static nw_port_type_t nw_port_type_from_string(const char* s) {
+ return NW_PORT_UNKNOWN;
+ }
+
+-static void nw_port_free(struct nw_port* port) {
++static void nw_port_free(nw_port* port) {
+ if (port->config)
+ nw_config_unref(port->config);
+ if (port->daemon)
+@@ -74,7 +74,7 @@ static void nw_port_free(struct nw_port* port) {
+ free(port);
+ }
+
+-static int nw_port_setup_address(struct nw_port* port) {
++static int nw_port_setup_address(nw_port* port) {
+ int r;
+
+ // Read ADDRESS from configuration
+@@ -111,7 +111,7 @@ ERROR:
+ return 0;
+ }
+
+-static int nw_port_setup_common(struct nw_port* port) {
++static int nw_port_setup_common(nw_port* port) {
+ int r;
+
+ // Address
+@@ -122,7 +122,7 @@ static int nw_port_setup_common(struct nw_port* port) {
+ return 0;
+ }
+
+-static nw_port_type_t nw_port_setup_type(struct nw_port* port) {
++static nw_port_type_t nw_port_setup_type(nw_port* port) {
+ const char* type = nw_config_get(port->config, "TYPE");
+ if (!type)
+ return NW_PORT_UNKNOWN;
+@@ -130,7 +130,7 @@ static nw_port_type_t nw_port_setup_type(struct nw_port* port) {
+ return nw_port_type_from_string(type);
+ }
+
+-static int nw_port_setup(struct nw_port* port) {
++static int nw_port_setup(nw_port* port) {
+ char path[PATH_MAX];
+ int r;
+
+@@ -167,11 +167,11 @@ static int nw_port_setup(struct nw_port* port) {
+ return 0;
+ }
+
+-int nw_port_create(struct nw_port** port, struct nw_daemon* daemon, const char* name) {
++int nw_port_create(nw_port** port, nw_daemon* daemon, const char* name) {
+ int r;
+
+ // Allocate a new object
+- struct nw_port* p = calloc(1, sizeof(*p));
++ nw_port* p = calloc(1, sizeof(*p));
+ if (!p)
+ return 1;
+
+@@ -199,13 +199,13 @@ ERROR:
+ return r;
+ }
+
+-struct nw_port* nw_port_ref(struct nw_port* port) {
++nw_port* nw_port_ref(nw_port* port) {
+ port->nrefs++;
+
+ return port;
+ }
+
+-struct nw_port* nw_port_unref(struct nw_port* port) {
++nw_port* nw_port_unref(nw_port* port) {
+ if (--port->nrefs > 0)
+ return port;
+
+@@ -213,11 +213,11 @@ struct nw_port* nw_port_unref(struct nw_port* port) {
+ return NULL;
+ }
+
+-const char* nw_port_name(struct nw_port* port) {
++const char* nw_port_name(nw_port* port) {
+ return port->name;
+ }
+
+-char* nw_port_bus_path(struct nw_port* port) {
++char* nw_port_bus_path(nw_port* port) {
+ char* p = NULL;
+ int r;
+
+@@ -229,10 +229,10 @@ char* nw_port_bus_path(struct nw_port* port) {
+ return p;
+ }
+
+-static struct nw_link* nw_port_get_link(struct nw_port* port) {
++static nw_link* nw_port_get_link(nw_port* port) {
+ return nw_daemon_get_link_by_name(port->daemon, port->name);
+ }
+
+-const nw_address_t* nw_port_get_address(struct nw_port* port) {
++const nw_address_t* nw_port_get_address(nw_port* port) {
+ return &port->address;
+ }
+diff --git a/src/networkd/port.h b/src/networkd/port.h
+index 92d60b2..9881846 100644
+--- a/src/networkd/port.h
++++ b/src/networkd/port.h
+@@ -28,20 +28,20 @@ typedef enum nw_port_type {
+ NW_PORT_DUMMY,
+ } nw_port_type_t;
+
+-struct nw_port;
++typedef struct nw_port nw_port;
+
+ #include "address.h"
+ #include "daemon.h"
+
+-int nw_port_create(struct nw_port** port, struct nw_daemon* daemon, const char* name);
++int nw_port_create(nw_port** port, nw_daemon* daemon, const char* name);
+
+-struct nw_port* nw_port_ref(struct nw_port* port);
+-struct nw_port* nw_port_unref(struct nw_port* port);
++nw_port* nw_port_ref(nw_port* port);
++nw_port* nw_port_unref(nw_port* port);
+
+-const char* nw_port_name(struct nw_port* port);
++const char* nw_port_name(nw_port* port);
+
+-char* nw_port_bus_path(struct nw_port* port);
++char* nw_port_bus_path(nw_port* port);
+
+-const nw_address_t* nw_port_get_address(struct nw_port* port);
++const nw_address_t* nw_port_get_address(nw_port* port);
+
+ #endif /* NETWORKD_PORT_H */
+diff --git a/src/networkd/ports.c b/src/networkd/ports.c
+index 9cec111..35ed048 100644
+--- a/src/networkd/ports.c
++++ b/src/networkd/ports.c
+@@ -30,14 +30,14 @@
+ #include "util.h"
+
+ struct nw_ports_entry {
+- struct nw_port* port;
++ nw_port* port;
+
+ // Link to the other entries
+ STAILQ_ENTRY(nw_ports_entry) nodes;
+ };
+
+ struct nw_ports {
+- struct nw_daemon* daemon;
++ nw_daemon* daemon;
+ int nrefs;
+
+ // Port Entries
+@@ -47,8 +47,8 @@ struct nw_ports {
+ unsigned int num;
+ };
+
+-int nw_ports_create(struct nw_ports** ports, struct nw_daemon* daemon) {
+- struct nw_ports* p = calloc(1, sizeof(*p));
++int nw_ports_create(nw_ports** ports, nw_daemon* daemon) {
++ nw_ports* p = calloc(1, sizeof(*p));
+ if (!p)
+ return 1;
+
+@@ -67,7 +67,7 @@ int nw_ports_create(struct nw_ports** ports, struct nw_daemon* daemon) {
+ return 0;
+ }
+
+-static void nw_ports_free(struct nw_ports* ports) {
++static void nw_ports_free(nw_ports* ports) {
+ struct nw_ports_entry* entry = NULL;
+
+ while (!STAILQ_EMPTY(&ports->entries)) {
+@@ -84,13 +84,13 @@ static void nw_ports_free(struct nw_ports* ports) {
+ }
+ }
+
+-struct nw_ports* nw_ports_ref(struct nw_ports* ports) {
++nw_ports* nw_ports_ref(nw_ports* ports) {
+ ports->nrefs++;
+
+ return ports;
+ }
+
+-struct nw_ports* nw_ports_unref(struct nw_ports* ports) {
++nw_ports* nw_ports_unref(nw_ports* ports) {
+ if (--ports->nrefs > 0)
+ return ports;
+
+@@ -98,7 +98,7 @@ struct nw_ports* nw_ports_unref(struct nw_ports* ports) {
+ return NULL;
+ }
+
+-static int nw_ports_add_port(struct nw_ports* ports, struct nw_port* port) {
++static int nw_ports_add_port(nw_ports* ports, nw_port* port) {
+ // Allocate a new entry
+ struct nw_ports_entry* entry = calloc(1, sizeof(*entry));
+ if (!entry)
+@@ -117,10 +117,10 @@ static int nw_ports_add_port(struct nw_ports* ports, struct nw_port* port) {
+ }
+
+ static int __nw_ports_enumerate(const char* path, const struct stat* s, void* data) {
+- struct nw_port* port = NULL;
++ nw_port* port = NULL;
+ int r;
+
+- struct nw_ports* ports = (struct nw_ports*)data;
++ nw_ports* ports = (nw_ports*)data;
+
+ // Skip anything that isn't a regular file
+ if (!S_ISREG(s->st_mode))
+@@ -154,11 +154,11 @@ ERROR:
+ return r;
+ }
+
+-int nw_ports_enumerate(struct nw_ports* ports) {
++int nw_ports_enumerate(nw_ports* ports) {
+ return nw_ftw(PORT_CONFIG_DIR, PORT_CONFIG_DIR "/*", __nw_ports_enumerate, ports);
+ }
+
+-struct nw_port* nw_ports_get_by_name(struct nw_ports* ports, const char* name) {
++nw_port* nw_ports_get_by_name(nw_ports* ports, const char* name) {
+ struct nw_ports_entry* entry = NULL;
+
+ STAILQ_FOREACH(entry, &ports->entries, nodes) {
+@@ -173,7 +173,7 @@ struct nw_port* nw_ports_get_by_name(struct nw_ports* ports, const char* name) {
+ return NULL;
+ }
+
+-int nw_ports_bus_paths(struct nw_ports* ports, char*** paths) {
++int nw_ports_bus_paths(nw_ports* ports, char*** paths) {
+ struct nw_ports_entry* entry = NULL;
+ char* path = NULL;
+
+diff --git a/src/networkd/ports.h b/src/networkd/ports.h
+index e807e25..f58c3a4 100644
+--- a/src/networkd/ports.h
++++ b/src/networkd/ports.h
+@@ -21,19 +21,19 @@
+ #ifndef NETWORKD_PORTS_H
+ #define NETWORKD_PORTS_H
+
+-struct nw_ports;
++typedef struct nw_ports nw_ports;
+
+ #include "daemon.h"
+
+-int nw_ports_create(struct nw_ports** ports, struct nw_daemon* daemon);
++int nw_ports_create(nw_ports** ports, nw_daemon* daemon);
+
+-struct nw_ports* nw_ports_ref(struct nw_ports* ports);
+-struct nw_ports* nw_ports_unref(struct nw_ports* ports);
++nw_ports* nw_ports_ref(nw_ports* ports);
++nw_ports* nw_ports_unref(nw_ports* ports);
+
+-int nw_ports_enumerate(struct nw_ports* ports);
++int nw_ports_enumerate(nw_ports* ports);
+
+-struct nw_port* nw_ports_get_by_name(struct nw_ports* ports, const char* name);
++struct nw_port* nw_ports_get_by_name(nw_ports* ports, const char* name);
+
+-int nw_ports_bus_paths(struct nw_ports* ports, char*** paths);
++int nw_ports_bus_paths(nw_ports* ports, char*** paths);
+
+ #endif /* NETWORKD_PORTS_H */
+diff --git a/src/networkd/zone-bus.c b/src/networkd/zone-bus.c
+index e9c2ecc..a06deb5 100644
+--- a/src/networkd/zone-bus.c
++++ b/src/networkd/zone-bus.c
+@@ -34,10 +34,10 @@ static int nw_zone_node_enumerator(sd_bus* bus, const char* path, void* data,
+ DEBUG("Enumerating zones...\n");
+
+ // Fetch a reference to the daemon
+- struct nw_daemon* daemon = (struct nw_daemon*)data;
++ nw_daemon* daemon = (nw_daemon*)data;
+
+ // Fetch zones
+- struct nw_zones* zones = nw_daemon_zones(daemon);
++ nw_zones* zones = nw_daemon_zones(daemon);
+
+ // Make bus paths for all zones
+ r = nw_zones_bus_paths(zones, nodes);
+@@ -56,7 +56,7 @@ static int nw_zone_object_find(sd_bus* bus, const char* path, const char* interf
+ int r;
+
+ // Fetch a reference to the daemon
+- struct nw_daemon* daemon = (struct nw_daemon*)data;
++ nw_daemon* daemon = (nw_daemon*)data;
+
+ // Decode the path of the requested object
+ r = sd_bus_path_decode(path, "/org/ipfire/network1/zone", &name);
+@@ -64,7 +64,7 @@ static int nw_zone_object_find(sd_bus* bus, const char* path, const char* interf
+ return 0;
+
+ // Find the zone
+- struct nw_zone* zone = nw_daemon_get_zone_by_name(daemon, name);
++ nw_zone* zone = nw_daemon_get_zone_by_name(daemon, name);
+ if (!zone)
+ return 0;
+
+@@ -81,7 +81,7 @@ static int nw_zone_object_find(sd_bus* bus, const char* path, const char* interf
+ */
+ static int nw_zone_bus_get_mtu(sd_bus* bus, const char *path, const char *interface,
+ const char* property, sd_bus_message* reply, void* data, sd_bus_error *error) {
+- struct nw_zone* zone = (struct nw_zone*)data;
++ nw_zone* zone = (nw_zone*)data;
+
+ return sd_bus_message_append(reply, "u", nw_zone_mtu(zone));
+ }
+@@ -91,7 +91,7 @@ static int nw_zone_bus_set_mtu(sd_bus* bus, const char* path, const char* interf
+ unsigned int mtu = 0;
+ int r;
+
+- struct nw_zone* zone = (struct nw_zone*)data;
++ nw_zone* zone = (nw_zone*)data;
+
+ // Parse the value
+ r = sd_bus_message_read(value, "u", &mtu);
+@@ -114,7 +114,7 @@ static const sd_bus_vtable zone_vtable[] = {
+ SD_BUS_VTABLE_END
+ };
+
+-const struct nw_bus_implementation zone_bus_impl = {
++const nw_bus_implementation zone_bus_impl = {
+ "/org/ipfire/network1/zone",
+ "org.ipfire.network1.Zone",
+ .fallback_vtables = BUS_FALLBACK_VTABLES({zone_vtable, nw_zone_object_find}),
+diff --git a/src/networkd/zone-bus.h b/src/networkd/zone-bus.h
+index 0d5583e..db257f7 100644
+--- a/src/networkd/zone-bus.h
++++ b/src/networkd/zone-bus.h
+@@ -23,6 +23,6 @@
+
+ #include "bus.h"
+
+-extern const struct nw_bus_implementation zone_bus_impl;
++extern const nw_bus_implementation zone_bus_impl;
+
+ #endif /* NETWORKD_ZONE_BUS_H */
+diff --git a/src/networkd/zone.c b/src/networkd/zone.c
+index c64706f..b6fa65d 100644
+--- a/src/networkd/zone.c
++++ b/src/networkd/zone.c
+@@ -34,13 +34,13 @@ struct nw_zone {
+ char name[NETWORK_ZONE_NAME_MAX_LENGTH];
+
+ // Configuration
+- struct nw_config *config;
++ nw_config *config;
+ };
+
+ #define nw_zone_path(zone, path, format, ...) \
+ __nw_zone_path(zone, path, sizeof(path), format, __VA_ARGS__)
+
+-static int __nw_zone_path(struct nw_zone* zone, char* p, const size_t length,
++static int __nw_zone_path(nw_zone* zone, char* p, const size_t length,
+ const char* format, ...) {
+ char prefix[NAME_MAX];
+ char suffix[NAME_MAX];
+@@ -63,14 +63,14 @@ static int __nw_zone_path(struct nw_zone* zone, char* p, const size_t length,
+ return __nw_path_join(p, length, prefix, suffix);
+ }
+
+-static void nw_zone_free(struct nw_zone* zone) {
++static void nw_zone_free(nw_zone* zone) {
+ if (zone->config)
+ nw_config_unref(zone->config);
+
+ free(zone);
+ }
+
+-static int nw_zone_setup(struct nw_zone* zone) {
++static int nw_zone_setup(nw_zone* zone) {
+ char path[PATH_MAX];
+ int r;
+
+@@ -87,11 +87,11 @@ static int nw_zone_setup(struct nw_zone* zone) {
+ return 0;
+ }
+
+-int nw_zone_create(struct nw_zone** zone, const char* name) {
++int nw_zone_create(nw_zone** zone, const char* name) {
+ int r;
+
+ // Allocate a new object
+- struct nw_zone* z = calloc(1, sizeof(*z));
++ nw_zone* z = calloc(1, sizeof(*z));
+ if (!z)
+ return 1;
+
+@@ -116,13 +116,13 @@ ERROR:
+ return r;
+ }
+
+-struct nw_zone* nw_zone_ref(struct nw_zone* zone) {
++nw_zone* nw_zone_ref(nw_zone* zone) {
+ zone->nrefs++;
+
+ return zone;
+ }
+
+-struct nw_zone* nw_zone_unref(struct nw_zone* zone) {
++nw_zone* nw_zone_unref(nw_zone* zone) {
+ if (--zone->nrefs > 0)
+ return zone;
+
+@@ -130,11 +130,11 @@ struct nw_zone* nw_zone_unref(struct nw_zone* zone) {
+ return NULL;
+ }
+
+-const char* nw_zone_name(struct nw_zone* zone) {
++const char* nw_zone_name(nw_zone* zone) {
+ return zone->name;
+ }
+
+-char* nw_zone_bus_path(struct nw_zone* zone) {
++char* nw_zone_bus_path(nw_zone* zone) {
+ char* p = NULL;
+ int r;
+
+@@ -149,11 +149,11 @@ char* nw_zone_bus_path(struct nw_zone* zone) {
+ /*
+ MTU
+ */
+-unsigned int nw_zone_mtu(struct nw_zone* zone) {
++unsigned int nw_zone_mtu(nw_zone* zone) {
+ return nw_config_get_int(zone->config, "MTU", NETWORK_ZONE_DEFAULT_MTU);
+ }
+
+-int nw_zone_set_mtu(struct nw_zone* zone, unsigned int mtu) {
++int nw_zone_set_mtu(nw_zone* zone, unsigned int mtu) {
+ DEBUG("Change MTU of %s to %u\n", zone->name, mtu);
+
+ return nw_config_set_int(zone->config, "MTU", mtu);
+diff --git a/src/networkd/zone.h b/src/networkd/zone.h
+index 4a00412..1c8e6b6 100644
+--- a/src/networkd/zone.h
++++ b/src/networkd/zone.h
+@@ -24,21 +24,21 @@
+ #define NETWORK_ZONE_NAME_MAX_LENGTH 16
+ #define NETWORK_ZONE_DEFAULT_MTU 1500
+
+-struct nw_zone;
++typedef struct nw_zone nw_zone;
+
+-int nw_zone_create(struct nw_zone** zone, const char* name);
++int nw_zone_create(nw_zone** zone, const char* name);
+
+-struct nw_zone* nw_zone_ref(struct nw_zone* zone);
+-struct nw_zone* nw_zone_unref(struct nw_zone* zone);
++nw_zone* nw_zone_ref(nw_zone* zone);
++nw_zone* nw_zone_unref(nw_zone* zone);
+
+-const char* nw_zone_name(struct nw_zone* zone);
++const char* nw_zone_name(nw_zone* zone);
+
+-char* nw_zone_bus_path(struct nw_zone* zone);
++char* nw_zone_bus_path(nw_zone* zone);
+
+ /*
+ MTU
+ */
+-unsigned int nw_zone_mtu(struct nw_zone* zone);
+-int nw_zone_set_mtu(struct nw_zone* zone, unsigned int mtu);
++unsigned int nw_zone_mtu(nw_zone* zone);
++int nw_zone_set_mtu(nw_zone* zone, unsigned int mtu);
+
+ #endif /* NETWORKD_ZONE_H */
+diff --git a/src/networkd/zones.c b/src/networkd/zones.c
+index 4f739f5..779bbe1 100644
+--- a/src/networkd/zones.c
++++ b/src/networkd/zones.c
+@@ -28,7 +28,7 @@
+ #include "zones.h"
+
+ struct nw_zones_entry {
+- struct nw_zone* zone;
++ nw_zone* zone;
+
+ // Link to the other entries
+ STAILQ_ENTRY(nw_zones_entry) nodes;
+@@ -44,8 +44,8 @@ struct nw_zones {
+ unsigned int num;
+ };
+
+-static int nw_zones_create(struct nw_zones** zones) {
+- struct nw_zones* z = calloc(1, sizeof(*z));
++static int nw_zones_create(nw_zones** zones) {
++ nw_zones* z = calloc(1, sizeof(*z));
+ if (!z)
+ return 1;
+
+@@ -61,7 +61,7 @@ static int nw_zones_create(struct nw_zones** zones) {
+ return 0;
+ }
+
+-static void nw_zones_free(struct nw_zones* zones) {
++static void nw_zones_free(nw_zones* zones) {
+ struct nw_zones_entry* entry = NULL;
+
+ while (!STAILQ_EMPTY(&zones->entries)) {
+@@ -78,13 +78,13 @@ static void nw_zones_free(struct nw_zones* zones) {
+ }
+ }
+
+-struct nw_zones* nw_zones_ref(struct nw_zones* zones) {
++nw_zones* nw_zones_ref(nw_zones* zones) {
+ zones->nrefs++;
+
+ return zones;
+ }
+
+-struct nw_zones* nw_zones_unref(struct nw_zones* zones) {
++nw_zones* nw_zones_unref(nw_zones* zones) {
+ if (--zones->nrefs > 0)
+ return zones;
+
+@@ -92,7 +92,7 @@ struct nw_zones* nw_zones_unref(struct nw_zones* zones) {
+ return NULL;
+ }
+
+-static int nw_zones_add_zone(struct nw_zones* zones, struct nw_zone* zone) {
++static int nw_zones_add_zone(nw_zones* zones, nw_zone* zone) {
+ // Allocate a new entry
+ struct nw_zones_entry* entry = calloc(1, sizeof(*entry));
+ if (!entry)
+@@ -124,12 +124,12 @@ static int nw_zones_load_filter(const struct dirent* path) {
+ return 1;
+ }
+
+-static int __nw_zones_load(struct nw_zones* zones) {
++static int __nw_zones_load(nw_zones* zones) {
+ struct dirent** paths = NULL;
+ int n;
+ int r = 0;
+
+- struct nw_zone* zone = NULL;
++ nw_zone* zone = NULL;
+
+ // Scan the zones directory
+ n = scandir(CONFIG_DIR "/zones", &paths, nw_zones_load_filter, alphasort);
+@@ -173,7 +173,7 @@ ERROR:
+ return r;
+ }
+
+-int nw_zones_load(struct nw_zones** zones) {
++int nw_zones_load(nw_zones** zones) {
+ int r;
+
+ // Create a new zones object
+@@ -193,7 +193,7 @@ ERROR:
+ return r;
+ }
+
+-size_t nw_zones_num(struct nw_zones* zones) {
++size_t nw_zones_num(nw_zones* zones) {
+ struct nw_zones_entry* entry = NULL;
+ size_t length = 0;
+
+@@ -204,7 +204,7 @@ size_t nw_zones_num(struct nw_zones* zones) {
+ return length;
+ }
+
+-struct nw_zone* nw_zones_get_by_name(struct nw_zones* zones, const char* name) {
++nw_zone* nw_zones_get_by_name(nw_zones* zones, const char* name) {
+ struct nw_zones_entry* entry = NULL;
+
+ STAILQ_FOREACH(entry, &zones->entries, nodes) {
+@@ -219,7 +219,7 @@ struct nw_zone* nw_zones_get_by_name(struct nw_zones* zones, const char* name) {
+ return NULL;
+ }
+
+-int nw_zones_bus_paths(struct nw_zones* zones, char*** paths) {
++int nw_zones_bus_paths(nw_zones* zones, char*** paths) {
+ struct nw_zones_entry* entry = NULL;
+ char* path = NULL;
+
+diff --git a/src/networkd/zones.h b/src/networkd/zones.h
+index 6e2686d..e41c74f 100644
+--- a/src/networkd/zones.h
++++ b/src/networkd/zones.h
+@@ -21,17 +21,17 @@
+ #ifndef NETWORKD_ZONES_H
+ #define NETWORKD_ZONES_H
+
+-struct nw_zones;
++typedef struct nw_zones nw_zones;
+
+-struct nw_zones* nw_zones_ref(struct nw_zones* zones);
+-struct nw_zones* nw_zones_unref(struct nw_zones* zones);
++nw_zones* nw_zones_ref(nw_zones* zones);
++nw_zones* nw_zones_unref(nw_zones* zones);
+
+-int nw_zones_load(struct nw_zones** zones);
++int nw_zones_load(nw_zones** zones);
+
+-size_t nw_zones_num(struct nw_zones* zones);
++size_t nw_zones_num(nw_zones* zones);
+
+-struct nw_zone* nw_zones_get_by_name(struct nw_zones* zones, const char* name);
++nw_zone* nw_zones_get_by_name(nw_zones* zones, const char* name);
+
+-int nw_zones_bus_paths(struct nw_zones* zones, char*** paths);
++int nw_zones_bus_paths(nw_zones* zones, char*** paths);
+
+ #endif /* NETWORKD_ZONES_H */
+--
+2.39.2
+
diff --git a/network/patches/0206-networkd-Store-a-reference-to-the-daemon-in-zone.patch b/network/patches/0206-networkd-Store-a-reference-to-the-daemon-in-zone.patch
new file mode 100644
index 000000000..44827567e
--- /dev/null
+++ b/network/patches/0206-networkd-Store-a-reference-to-the-daemon-in-zone.patch
@@ -0,0 +1,180 @@
+From dd84704eadbf2f55f650b5879095bafad7ffec30 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 11 Feb 2023 17:51:28 +0000
+Subject: [PATCH 206/304] networkd: Store a reference to the daemon in zone
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/daemon.c | 2 +-
+ src/networkd/zone.c | 9 ++++++++-
+ src/networkd/zone.h | 4 +++-
+ src/networkd/zones.c | 18 ++++++++++++++----
+ src/networkd/zones.h | 4 +++-
+ 5 files changed, 29 insertions(+), 8 deletions(-)
+
+diff --git a/src/networkd/daemon.c b/src/networkd/daemon.c
+index 9b9bf73..8122f58 100644
+--- a/src/networkd/daemon.c
++++ b/src/networkd/daemon.c
+@@ -141,7 +141,7 @@ static int nw_daemon_load_config(nw_daemon* daemon) {
+ return r;
+
+ // Load zones
+- r = nw_zones_load(&daemon->zones);
++ r = nw_zones_load(&daemon->zones, daemon);
+ if (r)
+ return r;
+
+diff --git a/src/networkd/zone.c b/src/networkd/zone.c
+index b6fa65d..30f22d6 100644
+--- a/src/networkd/zone.c
++++ b/src/networkd/zone.c
+@@ -24,11 +24,13 @@
+ #include <systemd/sd-bus.h>
+
+ #include "config.h"
++#include "daemon.h"
+ #include "logging.h"
+ #include "string.h"
+ #include "zone.h"
+
+ struct nw_zone {
++ nw_daemon* daemon;
+ int nrefs;
+
+ char name[NETWORK_ZONE_NAME_MAX_LENGTH];
+@@ -66,6 +68,8 @@ static int __nw_zone_path(nw_zone* zone, char* p, const size_t length,
+ static void nw_zone_free(nw_zone* zone) {
+ if (zone->config)
+ nw_config_unref(zone->config);
++ if (zone->daemon)
++ nw_daemon_unref(zone->daemon);
+
+ free(zone);
+ }
+@@ -87,7 +91,7 @@ static int nw_zone_setup(nw_zone* zone) {
+ return 0;
+ }
+
+-int nw_zone_create(nw_zone** zone, const char* name) {
++int nw_zone_create(nw_zone** zone, nw_daemon* daemon, const char* name) {
+ int r;
+
+ // Allocate a new object
+@@ -95,6 +99,9 @@ int nw_zone_create(nw_zone** zone, const char* name) {
+ if (!z)
+ return 1;
+
++ // Store a reference to the daemon
++ z->daemon = nw_daemon_ref(daemon);
++
+ // Initialize reference counter
+ z->nrefs = 1;
+
+diff --git a/src/networkd/zone.h b/src/networkd/zone.h
+index 1c8e6b6..9df30ec 100644
+--- a/src/networkd/zone.h
++++ b/src/networkd/zone.h
+@@ -26,7 +26,9 @@
+
+ typedef struct nw_zone nw_zone;
+
+-int nw_zone_create(nw_zone** zone, const char* name);
++#include "daemon.h"
++
++int nw_zone_create(nw_zone** zone, nw_daemon* daemon, const char* name);
+
+ nw_zone* nw_zone_ref(nw_zone* zone);
+ nw_zone* nw_zone_unref(nw_zone* zone);
+diff --git a/src/networkd/zones.c b/src/networkd/zones.c
+index 779bbe1..fd43f1c 100644
+--- a/src/networkd/zones.c
++++ b/src/networkd/zones.c
+@@ -23,6 +23,7 @@
+ #include <string.h>
+ #include <sys/queue.h>
+
++#include "daemon.h"
+ #include "logging.h"
+ #include "zone.h"
+ #include "zones.h"
+@@ -35,6 +36,7 @@ struct nw_zones_entry {
+ };
+
+ struct nw_zones {
++ nw_daemon* daemon;
+ int nrefs;
+
+ // Zone Entries
+@@ -44,11 +46,14 @@ struct nw_zones {
+ unsigned int num;
+ };
+
+-static int nw_zones_create(nw_zones** zones) {
++static int nw_zones_create(nw_zones** zones, nw_daemon* daemon) {
+ nw_zones* z = calloc(1, sizeof(*z));
+ if (!z)
+ return 1;
+
++ // Store a reference to the daemon
++ z->daemon = nw_daemon_ref(daemon);
++
+ // Initialize the reference counter
+ z->nrefs = 1;
+
+@@ -76,6 +81,11 @@ static void nw_zones_free(nw_zones* zones) {
+ // Free the entry
+ free(entry);
+ }
++
++ if (zones->daemon)
++ nw_daemon_unref(zones->daemon);
++
++ free(zones);
+ }
+
+ nw_zones* nw_zones_ref(nw_zones* zones) {
+@@ -147,7 +157,7 @@ static int __nw_zones_load(nw_zones* zones) {
+ DEBUG("Loading zone '%s'...\n", name);
+
+ // Create a new zone object
+- r = nw_zone_create(&zone, name);
++ r = nw_zone_create(&zone, zones->daemon, name);
+ if (r)
+ goto ERROR;
+
+@@ -173,11 +183,11 @@ ERROR:
+ return r;
+ }
+
+-int nw_zones_load(nw_zones** zones) {
++int nw_zones_load(nw_zones** zones, nw_daemon* daemon) {
+ int r;
+
+ // Create a new zones object
+- r = nw_zones_create(zones);
++ r = nw_zones_create(zones, daemon);
+ if (r)
+ return r;
+
+diff --git a/src/networkd/zones.h b/src/networkd/zones.h
+index e41c74f..330e524 100644
+--- a/src/networkd/zones.h
++++ b/src/networkd/zones.h
+@@ -23,10 +23,12 @@
+
+ typedef struct nw_zones nw_zones;
+
++#include "daemon.h"
++
+ nw_zones* nw_zones_ref(nw_zones* zones);
+ nw_zones* nw_zones_unref(nw_zones* zones);
+
+-int nw_zones_load(nw_zones** zones);
++int nw_zones_load(nw_zones** zones, nw_daemon* daemon);
+
+ size_t nw_zones_num(nw_zones* zones);
+
+--
+2.39.2
+
diff --git a/network/patches/0207-networkd-Refactor-enumerating-zones.patch b/network/patches/0207-networkd-Refactor-enumerating-zones.patch
new file mode 100644
index 000000000..e1dec5603
--- /dev/null
+++ b/network/patches/0207-networkd-Refactor-enumerating-zones.patch
@@ -0,0 +1,231 @@
+From 7af642e14376b599183cd19091d4cab28ddc11e7 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 11 Feb 2023 18:00:26 +0000
+Subject: [PATCH 207/304] networkd: Refactor enumerating zones
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/daemon.c | 21 +++++++---
+ src/networkd/zone.h | 2 +
+ src/networkd/zones.c | 97 +++++++++++++------------------------------
+ src/networkd/zones.h | 4 +-
+ 4 files changed, 50 insertions(+), 74 deletions(-)
+
+diff --git a/src/networkd/daemon.c b/src/networkd/daemon.c
+index 8122f58..6a6def3 100644
+--- a/src/networkd/daemon.c
++++ b/src/networkd/daemon.c
+@@ -140,11 +140,6 @@ static int nw_daemon_load_config(nw_daemon* daemon) {
+ if (r)
+ return r;
+
+- // Load zones
+- r = nw_zones_load(&daemon->zones, daemon);
+- if (r)
+- return r;
+-
+ return r;
+ }
+
+@@ -264,6 +259,17 @@ static int nw_daemon_enumerate_ports(nw_daemon* daemon) {
+ return nw_ports_enumerate(daemon->ports);
+ }
+
++static int nw_daemon_enumerate_zones(nw_daemon* daemon) {
++ int r;
++
++ // Create a new zones container
++ r = nw_zones_create(&daemon->zones, daemon);
++ if (r)
++ return r;
++
++ return nw_zones_enumerate(daemon->zones);
++}
++
+ static int nw_daemon_enumerate(nw_daemon* daemon) {
+ int r;
+
+@@ -277,6 +283,11 @@ static int nw_daemon_enumerate(nw_daemon* daemon) {
+ if (r)
+ return r;
+
++ // Zones
++ r = nw_daemon_enumerate_zones(daemon);
++ if (r)
++ return r;
++
+ return 0;
+ }
+
+diff --git a/src/networkd/zone.h b/src/networkd/zone.h
+index 9df30ec..2748e6d 100644
+--- a/src/networkd/zone.h
++++ b/src/networkd/zone.h
+@@ -21,6 +21,8 @@
+ #ifndef NETWORKD_ZONE_H
+ #define NETWORKD_ZONE_H
+
++#define ZONE_CONFIG_DIR CONFIG_DIR "/zones"
++
+ #define NETWORK_ZONE_NAME_MAX_LENGTH 16
+ #define NETWORK_ZONE_DEFAULT_MTU 1500
+
+diff --git a/src/networkd/zones.c b/src/networkd/zones.c
+index fd43f1c..1b0ffdc 100644
+--- a/src/networkd/zones.c
++++ b/src/networkd/zones.c
+@@ -25,6 +25,8 @@
+
+ #include "daemon.h"
+ #include "logging.h"
++#include "string.h"
++#include "util.h"
+ #include "zone.h"
+ #include "zones.h"
+
+@@ -46,7 +48,7 @@ struct nw_zones {
+ unsigned int num;
+ };
+
+-static int nw_zones_create(nw_zones** zones, nw_daemon* daemon) {
++int nw_zones_create(nw_zones** zones, nw_daemon* daemon) {
+ nw_zones* z = calloc(1, sizeof(*z));
+ if (!z)
+ return 1;
+@@ -120,89 +122,48 @@ static int nw_zones_add_zone(nw_zones* zones, nw_zone* zone) {
+ return 0;
+ }
+
+-static int nw_zones_load_filter(const struct dirent* path) {
+- const char* fn = path->d_name;
+-
+- // Ignore everything starting with '.'
+- if (*fn == '.')
+- return 0;
+-
+- // Ignore anything that isn't a directory
+- if (path->d_type != DT_DIR)
+- return 0;
+-
+- return 1;
+-}
+-
+-static int __nw_zones_load(nw_zones* zones) {
+- struct dirent** paths = NULL;
+- int n;
+- int r = 0;
+-
++static int __nw_zones_enumerate(const char* path, const struct stat* s, void* data) {
+ nw_zone* zone = NULL;
++ int r;
+
+- // Scan the zones directory
+- n = scandir(CONFIG_DIR "/zones", &paths, nw_zones_load_filter, alphasort);
+- if (n < 0) {
+- ERROR("Could not load zones: %m\n");
+- return 1;
+- }
+-
+- DEBUG("Found %d zone(s)\n", n);
+-
+- // Load all zones
+- for (int i = 0; i < n; i++) {
+- const char* name = paths[i]->d_name;
+-
+- DEBUG("Loading zone '%s'...\n", name);
+-
+- // Create a new zone object
+- r = nw_zone_create(&zone, zones->daemon, name);
+- if (r)
+- goto ERROR;
+-
+- // Store the zone
+- r = nw_zones_add_zone(zones, zone);
+- if (r) {
+- nw_zone_unref(zone);
+- goto ERROR;
+- }
++ nw_zones* zones = (nw_zones*)data;
+
+- nw_zone_unref(zone);
+- }
++ // Skip anything that isn't a directory
++ if (!S_ISDIR(s->st_mode))
++ return 0;
+
+-ERROR:
+- // Free paths
+- if (paths) {
+- for (int i = 0; i < n; i++) {
+- free(paths[i]);
+- }
+- free(paths);
+- }
++ // Find the basename of the file
++ const char* name = nw_path_basename(path);
+
+- return r;
+-}
++ // Break on invalid paths
++ if (!name)
++ return 0;
+
+-int nw_zones_load(nw_zones** zones, nw_daemon* daemon) {
+- int r;
++ // Skip any hidden files
++ if (*name == '.')
++ return 0;
+
+- // Create a new zones object
+- r = nw_zones_create(zones, daemon);
++ // Create a new zone
++ r = nw_zone_create(&zone, zones->daemon, name);
+ if (r)
+- return r;
++ goto ERROR;
+
+- // Load all zones
+- r = __nw_zones_load(*zones);
++ // Add the zone to the list
++ r = nw_zones_add_zone(zones, zone);
+ if (r)
+ goto ERROR;
+
+- return 0;
+-
+ ERROR:
+- nw_zones_unref(*zones);
++ if (zone)
++ nw_zone_unref(zone);
++
+ return r;
+ }
+
++int nw_zones_enumerate(nw_zones* zones) {
++ return nw_ftw(ZONE_CONFIG_DIR, ZONE_CONFIG_DIR "/*", __nw_zones_enumerate, zones);
++}
++
+ size_t nw_zones_num(nw_zones* zones) {
+ struct nw_zones_entry* entry = NULL;
+ size_t length = 0;
+diff --git a/src/networkd/zones.h b/src/networkd/zones.h
+index 330e524..dbf7ccd 100644
+--- a/src/networkd/zones.h
++++ b/src/networkd/zones.h
+@@ -25,10 +25,12 @@ typedef struct nw_zones nw_zones;
+
+ #include "daemon.h"
+
++int nw_zones_create(nw_zones** zones, nw_daemon* daemon);
++
+ nw_zones* nw_zones_ref(nw_zones* zones);
+ nw_zones* nw_zones_unref(nw_zones* zones);
+
+-int nw_zones_load(nw_zones** zones, nw_daemon* daemon);
++int nw_zones_enumerate(nw_zones* zones);
+
+ size_t nw_zones_num(nw_zones* zones);
+
+--
+2.39.2
+
diff --git a/network/patches/0208-networkd-Save-configuration-when-the-daemon-exits.patch b/network/patches/0208-networkd-Save-configuration-when-the-daemon-exits.patch
new file mode 100644
index 000000000..75c62ada2
--- /dev/null
+++ b/network/patches/0208-networkd-Save-configuration-when-the-daemon-exits.patch
@@ -0,0 +1,239 @@
+From 605e975f53ed433718df5d101496474870d6439c Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 11 Feb 2023 18:29:32 +0000
+Subject: [PATCH 208/304] networkd: Save configuration when the daemon exits
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/daemon.c | 31 +++++++++++++++++++++++++++++++
+ src/networkd/daemon.h | 2 ++
+ src/networkd/main.c | 1 +
+ src/networkd/port.c | 10 ++++++++++
+ src/networkd/port.h | 2 ++
+ src/networkd/ports.c | 13 +++++++++++++
+ src/networkd/ports.h | 2 ++
+ src/networkd/zone.c | 10 ++++++++++
+ src/networkd/zone.h | 2 ++
+ src/networkd/zones.c | 13 +++++++++++++
+ src/networkd/zones.h | 2 ++
+ 11 files changed, 88 insertions(+)
+
+diff --git a/src/networkd/daemon.c b/src/networkd/daemon.c
+index 6a6def3..c67c759 100644
+--- a/src/networkd/daemon.c
++++ b/src/networkd/daemon.c
+@@ -409,6 +409,11 @@ int nw_daemon_run(nw_daemon* daemon) {
+ // Let systemd know that we are shutting down
+ sd_notify(0, "STOPPING=1\n" "STATUS=Shutting down...");
+
++ // Save the configuration
++ r = nw_daemon_save(daemon);
++ if (r)
++ goto ERROR;
++
+ // Cleanup everything
+ nw_daemon_cleanup(daemon);
+
+@@ -431,6 +436,32 @@ int nw_daemon_reload(nw_daemon* daemon) {
+ return 0;
+ }
+
++/*
++ Saves the configuration to disk
++*/
++int nw_daemon_save(nw_daemon* daemon) {
++ int r;
++
++ DEBUG("Saving configuration...\n");
++
++ // Save settings
++ r = nw_config_write(daemon->config);
++ if (r)
++ return r;
++
++ // Save ports
++ r = nw_ports_save(daemon->ports);
++ if (r)
++ return r;
++
++ // Save zones
++ r = nw_zones_save(daemon->zones);
++ if (r)
++ return r;
++
++ return 0;
++}
++
+ /*
+ Netlink
+ */
+diff --git a/src/networkd/daemon.h b/src/networkd/daemon.h
+index 1694599..6f4c217 100644
+--- a/src/networkd/daemon.h
++++ b/src/networkd/daemon.h
+@@ -41,6 +41,8 @@ int nw_daemon_run(nw_daemon* daemon);
+
+ int nw_daemon_reload(nw_daemon* daemon);
+
++int nw_daemon_save(nw_daemon* daemon);
++
+ /*
+ Netlink
+ */
+diff --git a/src/networkd/main.c b/src/networkd/main.c
+index d3afc2a..c8b9a79 100644
+--- a/src/networkd/main.c
++++ b/src/networkd/main.c
+@@ -29,6 +29,7 @@
+
+ #include "daemon.h"
+ #include "logging.h"
++#include "port.h"
+
+ static int cap_acquire_setpcap(void) {
+ cap_flag_value_t value;
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index 41b8b24..30bd98f 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -213,6 +213,16 @@ nw_port* nw_port_unref(nw_port* port) {
+ return NULL;
+ }
+
++int nw_port_save(nw_port* port) {
++ int r;
++
++ r = nw_config_write(port->config);
++ if (r)
++ return r;
++
++ return 0;
++}
++
+ const char* nw_port_name(nw_port* port) {
+ return port->name;
+ }
+diff --git a/src/networkd/port.h b/src/networkd/port.h
+index 9881846..8861046 100644
+--- a/src/networkd/port.h
++++ b/src/networkd/port.h
+@@ -38,6 +38,8 @@ int nw_port_create(nw_port** port, nw_daemon* daemon, const char* name);
+ nw_port* nw_port_ref(nw_port* port);
+ nw_port* nw_port_unref(nw_port* port);
+
++int nw_port_save(nw_port* port);
++
+ const char* nw_port_name(nw_port* port);
+
+ char* nw_port_bus_path(nw_port* port);
+diff --git a/src/networkd/ports.c b/src/networkd/ports.c
+index 35ed048..a87ca03 100644
+--- a/src/networkd/ports.c
++++ b/src/networkd/ports.c
+@@ -98,6 +98,19 @@ nw_ports* nw_ports_unref(nw_ports* ports) {
+ return NULL;
+ }
+
++int nw_ports_save(nw_ports* ports) {
++ struct nw_ports_entry* entry = NULL;
++ int r;
++
++ STAILQ_FOREACH(entry, &ports->entries, nodes) {
++ r = nw_port_save(entry->port);
++ if (r)
++ return r;
++ }
++
++ return 0;
++}
++
+ static int nw_ports_add_port(nw_ports* ports, nw_port* port) {
+ // Allocate a new entry
+ struct nw_ports_entry* entry = calloc(1, sizeof(*entry));
+diff --git a/src/networkd/ports.h b/src/networkd/ports.h
+index f58c3a4..40c9ae1 100644
+--- a/src/networkd/ports.h
++++ b/src/networkd/ports.h
+@@ -30,6 +30,8 @@ int nw_ports_create(nw_ports** ports, nw_daemon* daemon);
+ nw_ports* nw_ports_ref(nw_ports* ports);
+ nw_ports* nw_ports_unref(nw_ports* ports);
+
++int nw_ports_save(nw_ports* ports);
++
+ int nw_ports_enumerate(nw_ports* ports);
+
+ struct nw_port* nw_ports_get_by_name(nw_ports* ports, const char* name);
+diff --git a/src/networkd/zone.c b/src/networkd/zone.c
+index 30f22d6..1e4abc3 100644
+--- a/src/networkd/zone.c
++++ b/src/networkd/zone.c
+@@ -137,6 +137,16 @@ nw_zone* nw_zone_unref(nw_zone* zone) {
+ return NULL;
+ }
+
++int nw_zone_save(nw_zone* zone) {
++ int r;
++
++ r = nw_config_write(zone->config);
++ if (r)
++ return r;
++
++ return 0;
++}
++
+ const char* nw_zone_name(nw_zone* zone) {
+ return zone->name;
+ }
+diff --git a/src/networkd/zone.h b/src/networkd/zone.h
+index 2748e6d..088bb2f 100644
+--- a/src/networkd/zone.h
++++ b/src/networkd/zone.h
+@@ -35,6 +35,8 @@ int nw_zone_create(nw_zone** zone, nw_daemon* daemon, const char* name);
+ nw_zone* nw_zone_ref(nw_zone* zone);
+ nw_zone* nw_zone_unref(nw_zone* zone);
+
++int nw_zone_save(nw_zone* zone);
++
+ const char* nw_zone_name(nw_zone* zone);
+
+ char* nw_zone_bus_path(nw_zone* zone);
+diff --git a/src/networkd/zones.c b/src/networkd/zones.c
+index 1b0ffdc..ea0d8de 100644
+--- a/src/networkd/zones.c
++++ b/src/networkd/zones.c
+@@ -104,6 +104,19 @@ nw_zones* nw_zones_unref(nw_zones* zones) {
+ return NULL;
+ }
+
++int nw_zones_save(nw_zones* zones) {
++ struct nw_zones_entry* entry = NULL;
++ int r;
++
++ STAILQ_FOREACH(entry, &zones->entries, nodes) {
++ r = nw_zone_save(entry->zone);
++ if (r)
++ return r;
++ }
++
++ return 0;
++}
++
+ static int nw_zones_add_zone(nw_zones* zones, nw_zone* zone) {
+ // Allocate a new entry
+ struct nw_zones_entry* entry = calloc(1, sizeof(*entry));
+diff --git a/src/networkd/zones.h b/src/networkd/zones.h
+index dbf7ccd..c887bd0 100644
+--- a/src/networkd/zones.h
++++ b/src/networkd/zones.h
+@@ -30,6 +30,8 @@ int nw_zones_create(nw_zones** zones, nw_daemon* daemon);
+ nw_zones* nw_zones_ref(nw_zones* zones);
+ nw_zones* nw_zones_unref(nw_zones* zones);
+
++int nw_zones_save(nw_zones* zones);
++
+ int nw_zones_enumerate(nw_zones* zones);
+
+ size_t nw_zones_num(nw_zones* zones);
+--
+2.39.2
+
diff --git a/network/patches/0209-networkd-Store-any-flags.patch b/network/patches/0209-networkd-Store-any-flags.patch
new file mode 100644
index 000000000..33427641c
--- /dev/null
+++ b/network/patches/0209-networkd-Store-any-flags.patch
@@ -0,0 +1,69 @@
+From c65300b47197145ac899bd2e80597b4c6b44ca6d Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 13 Feb 2023 15:05:41 +0000
+Subject: [PATCH 209/304] networkd: Store any flags
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/link.c | 31 +++++++++++++++++++++++++++++++
+ 1 file changed, 31 insertions(+)
+
+diff --git a/src/networkd/link.c b/src/networkd/link.c
+index 2f95dc3..78ae106 100644
+--- a/src/networkd/link.c
++++ b/src/networkd/link.c
+@@ -45,6 +45,9 @@ struct nw_link {
+ uint32_t mtu;
+ uint32_t min_mtu;
+ uint32_t max_mtu;
++
++ // Flags
++ unsigned int flags;
+ };
+
+ int nw_link_create(nw_link** link, nw_daemon* daemon, int ifindex) {
+@@ -168,6 +171,29 @@ static int nw_link_update_mtu(nw_link* link, sd_netlink_message* message) {
+ return 0;
+ }
+
++static int nw_link_update_flags(nw_link* link, sd_netlink_message* message) {
++ unsigned int flags = 0;
++ int r;
++
++ // Fetch flags
++ r = sd_rtnl_message_link_get_flags(message, &flags);
++ if (r < 0) {
++ return DEBUG("Could not read link flags: %m\n");
++ return 1;
++ }
++
++ // End here if there have been no changes
++ if (link->flags == flags)
++ return 0;
++
++ // XXX We should log any changes here
++
++ // Store the new flags
++ link->flags = flags;
++
++ return 0;
++}
++
+ /*
+ This function is called whenever anything changes, so that we can
+ update our internal link object.
+@@ -185,6 +211,11 @@ static int nw_link_update(nw_link* link, sd_netlink_message* message) {
+ if (r)
+ return r;
+
++ // Update flags
++ r = nw_link_update_flags(link, message);
++ if (r)
++ return r;
++
+ return 0;
+ }
+
+--
+2.39.2
+
diff --git a/network/patches/0210-networkd-Store-operstate-too.patch b/network/patches/0210-networkd-Store-operstate-too.patch
new file mode 100644
index 000000000..2c0b950d2
--- /dev/null
+++ b/network/patches/0210-networkd-Store-operstate-too.patch
@@ -0,0 +1,59 @@
+From 69ef50c7403a5e09fcdf6ee4b53f94665920277a Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 13 Feb 2023 15:10:01 +0000
+Subject: [PATCH 210/304] networkd: Store operstate, too
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/link.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/src/networkd/link.c b/src/networkd/link.c
+index 78ae106..6392a90 100644
+--- a/src/networkd/link.c
++++ b/src/networkd/link.c
+@@ -48,6 +48,7 @@ struct nw_link {
+
+ // Flags
+ unsigned int flags;
++ uint8_t operstate;
+ };
+
+ int nw_link_create(nw_link** link, nw_daemon* daemon, int ifindex) {
+@@ -173,6 +174,7 @@ static int nw_link_update_mtu(nw_link* link, sd_netlink_message* message) {
+
+ static int nw_link_update_flags(nw_link* link, sd_netlink_message* message) {
+ unsigned int flags = 0;
++ uint8_t operstate = 0;
+ int r;
+
+ // Fetch flags
+@@ -182,14 +184,23 @@ static int nw_link_update_flags(nw_link* link, sd_netlink_message* message) {
+ return 1;
+ }
+
++ // Fetch operstate
++ r = sd_netlink_message_read_u8(message, IFLA_OPERSTATE, &operstate);
++ if (r < 1) {
++ ERROR("Could not read operstate: %m\n");
++ return 1;
++ }
++
+ // End here if there have been no changes
+- if (link->flags == flags)
++ if (link->flags == flags && link->operstate == operstate)
+ return 0;
+
+ // XXX We should log any changes here
+
+- // Store the new flags
++ // Store the new flags & operstate
+ link->flags = flags;
++ link->operstate = operstate;
++
+
+ return 0;
+ }
+--
+2.39.2
+
diff --git a/network/patches/0211-networkd-Add-function-to-check-whether-a-link-has-a-.patch b/network/patches/0211-networkd-Add-function-to-check-whether-a-link-has-a-.patch
new file mode 100644
index 000000000..b5ec88638
--- /dev/null
+++ b/network/patches/0211-networkd-Add-function-to-check-whether-a-link-has-a-.patch
@@ -0,0 +1,96 @@
+From dfd49c2cc85fcee2303a96bc2186de0e21d8da4f Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 13 Feb 2023 15:14:01 +0000
+Subject: [PATCH 211/304] networkd: Add function to check whether a link has a
+ carrier
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/link.c | 32 ++++++++++++++++++++++++++++++--
+ src/networkd/link.h | 2 ++
+ 2 files changed, 32 insertions(+), 2 deletions(-)
+
+diff --git a/src/networkd/link.c b/src/networkd/link.c
+index 6392a90..80478f4 100644
+--- a/src/networkd/link.c
++++ b/src/networkd/link.c
+@@ -18,7 +18,7 @@
+ # #
+ #############################################################################*/
+
+-#include <net/if.h>
++#include <linux/if.h>
+ #include <stddef.h>
+ #include <stdlib.h>
+ #include <string.h>
+@@ -39,7 +39,7 @@ struct nw_link {
+ int ifindex;
+
+ // Interface Name
+- char ifname[IF_NAMESIZE];
++ char ifname[IFNAMSIZ];
+
+ // MTU
+ uint32_t mtu;
+@@ -98,6 +98,20 @@ int nw_link_ifindex(nw_link* link) {
+ return link->ifindex;
+ }
+
++// Carrier
++
++int nw_link_has_carrier(nw_link* link) {
++ return link->operstate == IF_OPER_UP;
++}
++
++static int nw_link_carrier_gained(nw_link* link) {
++ return 0; // XXX TODO
++}
++
++static int nw_link_carrier_lost(nw_link* link) {
++ return 0; // XXX TODO
++}
++
+ static int nw_link_update_ifname(nw_link* link, sd_netlink_message* message) {
+ const char* ifname = NULL;
+ int r;
+@@ -197,10 +211,24 @@ static int nw_link_update_flags(nw_link* link, sd_netlink_message* message) {
+
+ // XXX We should log any changes here
+
++ // Fetch current carrier state
++ const int had_carrier = nw_link_has_carrier(link);
++
+ // Store the new flags & operstate
+ link->flags = flags;
+ link->operstate = operstate;
+
++ // Notify if carrier was gained or lost
++ if (!had_carrier && nw_link_has_carrier(link)) {
++ r = nw_link_carrier_gained(link);
++ if (r < 0)
++ return r;
++
++ } else if (had_carrier && !nw_link_has_carrier(link)) {
++ r = nw_link_carrier_lost(link);
++ if (r < 0)
++ return r;
++ }
+
+ return 0;
+ }
+diff --git a/src/networkd/link.h b/src/networkd/link.h
+index acb5e7b..3d8d397 100644
+--- a/src/networkd/link.h
++++ b/src/networkd/link.h
+@@ -33,6 +33,8 @@ nw_link* nw_link_unref(nw_link* link);
+ int nw_link_ifindex(nw_link* link);
+ const char* nw_link_name(nw_link* link);
+
++int nw_link_has_carrier(nw_link* link);
++
+ int nw_link_process(sd_netlink* rtnl, sd_netlink_message* message, void* data);
+
+ #endif /* NETWORKD_LINK_H */
+--
+2.39.2
+
diff --git a/network/patches/0212-networkd-Add-methods-to-check-zones-ports-for-carrie.patch b/network/patches/0212-networkd-Add-methods-to-check-zones-ports-for-carrie.patch
new file mode 100644
index 000000000..e0058a804
--- /dev/null
+++ b/network/patches/0212-networkd-Add-methods-to-check-zones-ports-for-carrie.patch
@@ -0,0 +1,92 @@
+From 20375a083cbb965971b3b471b161e6475cef3c4b Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 13 Feb 2023 15:34:40 +0000
+Subject: [PATCH 212/304] networkd: Add methods to check zones/ports for
+ carrier
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/port.c | 13 +++++++++++++
+ src/networkd/port.h | 2 ++
+ src/networkd/zone.c | 19 +++++++++++++++++++
+ src/networkd/zone.h | 2 ++
+ 4 files changed, 36 insertions(+)
+
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index 30bd98f..c6c8781 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -246,3 +246,16 @@ static nw_link* nw_port_get_link(nw_port* port) {
+ const nw_address_t* nw_port_get_address(nw_port* port) {
+ return &port->address;
+ }
++
++int nw_port_has_carrier(nw_port* port) {
++ int has_carrier = 0;
++
++ // Fetch link
++ nw_link* link = nw_port_get_link(port);
++ if (link) {
++ has_carrier = nw_link_has_carrier(link);
++ nw_link_unref(link);
++ }
++
++ return has_carrier;
++}
+diff --git a/src/networkd/port.h b/src/networkd/port.h
+index 8861046..33241ed 100644
+--- a/src/networkd/port.h
++++ b/src/networkd/port.h
+@@ -46,4 +46,6 @@ char* nw_port_bus_path(nw_port* port);
+
+ const nw_address_t* nw_port_get_address(nw_port* port);
+
++int nw_port_has_carrier(nw_port* port);
++
+ #endif /* NETWORKD_PORT_H */
+diff --git a/src/networkd/zone.c b/src/networkd/zone.c
+index 1e4abc3..8fe07c5 100644
+--- a/src/networkd/zone.c
++++ b/src/networkd/zone.c
+@@ -163,6 +163,25 @@ char* nw_zone_bus_path(nw_zone* zone) {
+ return p;
+ }
+
++static nw_link* nw_zone_get_link(nw_zone* zone) {
++ return nw_daemon_get_link_by_name(zone->daemon, zone->name);
++}
++
++// Carrier
++
++int nw_zone_has_carrier(nw_zone* zone) {
++ int has_carrier = 0;
++
++ // Fetch link
++ nw_link* link = nw_zone_get_link(zone);
++ if (link) {
++ has_carrier = nw_link_has_carrier(link);
++ nw_link_unref(link);
++ }
++
++ return has_carrier;
++}
++
+ /*
+ MTU
+ */
+diff --git a/src/networkd/zone.h b/src/networkd/zone.h
+index 088bb2f..f5a2355 100644
+--- a/src/networkd/zone.h
++++ b/src/networkd/zone.h
+@@ -41,6 +41,8 @@ const char* nw_zone_name(nw_zone* zone);
+
+ char* nw_zone_bus_path(nw_zone* zone);
+
++int nw_zone_has_carrier(nw_zone* zone);
++
+ /*
+ MTU
+ */
+--
+2.39.2
+
diff --git a/network/patches/0213-networkd-Log-to-journald.patch b/network/patches/0213-networkd-Log-to-journald.patch
new file mode 100644
index 000000000..6f3257eac
--- /dev/null
+++ b/network/patches/0213-networkd-Log-to-journald.patch
@@ -0,0 +1,137 @@
+From 1a70a6864ca83ed91c9acfd6be5a64185ac34917 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 13 Feb 2023 16:00:43 +0000
+Subject: [PATCH 213/304] networkd: Log to journald
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 1 +
+ src/networkd/link.c | 2 +-
+ src/networkd/logging.c | 65 ++++++++++++++++++++++++++++++++++++++++++
+ src/networkd/logging.h | 10 +++++--
+ 4 files changed, 74 insertions(+), 4 deletions(-)
+ create mode 100644 src/networkd/logging.c
+
+diff --git a/Makefile.am b/Makefile.am
+index 893f1b8..eded292 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -323,6 +323,7 @@ dist_networkd_SOURCES = \
+ src/networkd/link.h \
+ src/networkd/links.c \
+ src/networkd/links.h \
++ src/networkd/logging.c \
+ src/networkd/logging.h \
+ src/networkd/main.c \
+ src/networkd/ports.c \
+diff --git a/src/networkd/link.c b/src/networkd/link.c
+index 80478f4..7f49606 100644
+--- a/src/networkd/link.c
++++ b/src/networkd/link.c
+@@ -194,7 +194,7 @@ static int nw_link_update_flags(nw_link* link, sd_netlink_message* message) {
+ // Fetch flags
+ r = sd_rtnl_message_link_get_flags(message, &flags);
+ if (r < 0) {
+- return DEBUG("Could not read link flags: %m\n");
++ DEBUG("Could not read link flags: %m\n");
+ return 1;
+ }
+
+diff --git a/src/networkd/logging.c b/src/networkd/logging.c
+new file mode 100644
+index 0000000..c4809e8
+--- /dev/null
++++ b/src/networkd/logging.c
+@@ -0,0 +1,65 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#include <errno.h>
++#include <stdio.h>
++#include <stdlib.h>
++
++#include <systemd/sd-journal.h>
++
++#include "logging.h"
++
++void nw_log(int priority, const char* file,
++ int line, const char* fn, const char* format, ...) {
++ char* buffer = NULL;
++ va_list args;
++ int r;
++
++ // Format log message
++ va_start(args, format);
++ r = vasprintf(&buffer, format, args);
++ va_end(args);
++ if (r < 0)
++ return;
++
++ // Send message to journald
++ r = sd_journal_send(
++ "MESSAGE=%s", buffer,
++ "PRIORITY=%d", priority,
++
++ // Syslog compat
++ "SYSLOG_IDENTIFIER=networkd",
++
++ // Debugging stuff
++ "ERRNO=%d", errno,
++ "CODE_FILE=%s", file,
++ "CODE_LINE=%d", line,
++ "CODE_FUNC=%s", fn,
++
++ NULL
++ );
++
++ // Fall back to standard output
++ if (r)
++ sd_journal_perror(buffer);
++
++ // Cleanup
++ free(buffer);
++}
+diff --git a/src/networkd/logging.h b/src/networkd/logging.h
+index 9d51f21..ea75ba0 100644
+--- a/src/networkd/logging.h
++++ b/src/networkd/logging.h
+@@ -21,12 +21,16 @@
+ #ifndef NETWORKD_LOGGING_H
+ #define NETWORKD_LOGGING_H
+
+-#include <stdio.h>
++#include <syslog.h>
++
++void nw_log(int priority, const char *file, int line, const char* fn,
++ const char *format, ...) __attribute__((format(printf, 5, 6)));
+
+ /*
+ This is just something simple which will work for now...
+ */
+-#define ERROR(...) fprintf(stderr, __VA_ARGS__)
+-#define DEBUG(...) printf(__VA_ARGS__)
++#define INFO(args...) nw_log(LOG_INFO, __FILE__, __LINE__, __FUNCTION__, ## args)
++#define ERROR(args...) nw_log(LOG_ERR, __FILE__, __LINE__, __FUNCTION__, ## args)
++#define DEBUG(args...) nw_log(LOG_DEBUG, __FILE__, __LINE__, __FUNCTION__, ## args)
+
+ #endif /* NETWORKD_LOGGING_H */
+--
+2.39.2
+
diff --git a/network/patches/0214-networkd-Install-in-usr-lib-network.patch b/network/patches/0214-networkd-Install-in-usr-lib-network.patch
new file mode 100644
index 000000000..3b524d04d
--- /dev/null
+++ b/network/patches/0214-networkd-Install-in-usr-lib-network.patch
@@ -0,0 +1,49 @@
+From ac0188ee9bffceedc94417e586bcbe21daa96c74 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Wed, 1 Mar 2023 15:34:32 +0000
+Subject: [PATCH 214/304] networkd: Install in /usr/lib/network
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 4 ++--
+ src/networkd/networkd.service.in | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/Makefile.am b/Makefile.am
+index eded292..707eabe 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -61,7 +61,7 @@ INSTALL_DIRS =
+ INSTALL_EXEC_HOOKS =
+ UNINSTALL_EXEC_HOOKS =
+ noinst_DATA =
+-sbin_PROGRAMS =
++network_PROGRAMS =
+ dist_dbuspolicy_DATA =
+ dist_dbussystembus_DATA =
+ dist_polkitpolicy_DATA =
+@@ -304,7 +304,7 @@ EXTRA_DIST += \
+
+ # ------------------------------------------------------------------------------
+
+-sbin_PROGRAMS += \
++network_PROGRAMS += \
+ networkd
+
+ dist_networkd_SOURCES = \
+diff --git a/src/networkd/networkd.service.in b/src/networkd/networkd.service.in
+index 4361023..7ee8fad 100644
+--- a/src/networkd/networkd.service.in
++++ b/src/networkd/networkd.service.in
+@@ -15,7 +15,7 @@ AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET
+ BusName=org.ipfire.network1
+ CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW
+ DeviceAllow=char-* rw
+-ExecStart=@sbindir@/networkd
++ExecStart=@networkdir@/networkd
+ FileDescriptorStoreMax=512
+ LockPersonality=yes
+ MemoryDenyWriteExecute=yes
+--
+2.39.2
+
diff --git a/network/patches/0215-networkctl-Create-some-scaffolding.patch b/network/patches/0215-networkctl-Create-some-scaffolding.patch
new file mode 100644
index 000000000..c054332c4
--- /dev/null
+++ b/network/patches/0215-networkctl-Create-some-scaffolding.patch
@@ -0,0 +1,94 @@
+From 840738f6baf2d3024df6ae0e9a887c5b1bef3a50 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Wed, 1 Mar 2023 15:41:17 +0000
+Subject: [PATCH 215/304] networkctl: Create some scaffolding
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ .gitignore | 1 +
+ Makefile.am | 19 +++++++++++++++++++
+ src/networkctl/main.c | 23 +++++++++++++++++++++++
+ 3 files changed, 43 insertions(+)
+ create mode 100644 src/networkctl/main.c
+
+diff --git a/.gitignore b/.gitignore
+index 9194c93..c45db75 100644
+--- a/.gitignore
++++ b/.gitignore
+@@ -3,6 +3,7 @@
+ /config.*
+ /libtool
+ /missing
++/networkctl
+ /networkd
+ /src/functions/functions
+ /src/inetcalc
+diff --git a/Makefile.am b/Makefile.am
+index 707eabe..1640060 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -379,6 +379,24 @@ CLEANFILES += \
+
+ # ------------------------------------------------------------------------------
+
++bin_PROGRAMS += \
++ networkctl
++
++dist_networkctl_SOURCES = \
++ src/networkctl/main.c
++
++networkctl_CFLAGS = \
++ $(AM_CFLAGS) \
++ $(SYSTEMD_CFLAGS)
++
++networkctl_LDFLAGS = \
++ $(AM_LDFLAGS)
++
++networkctl_LDADD = \
++ $(SYSTEMD_LIBS)
++
++# ------------------------------------------------------------------------------
++
+ util_PROGRAMS = \
+ src/utils/network-phy-list-channels \
+ src/utils/network-phy-list-ciphers \
+@@ -622,6 +640,7 @@ substitutions = \
+ '|builddir=$(abs_builddir)|' \
+ '|prefix=$(prefix)|' \
+ '|exec_prefix=$(exec_prefix)|' \
++ '|bindir=$(bindir)|' \
+ '|sbindir=$(sbindir)|' \
+ '|networkdir=$(networkdir)|' \
+ '|helpersdir=$(helpersdir)|' \
+diff --git a/src/networkctl/main.c b/src/networkctl/main.c
+new file mode 100644
+index 0000000..14aafdd
+--- /dev/null
++++ b/src/networkctl/main.c
+@@ -0,0 +1,23 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++int main(int argc, char** argv) {
++ return 0;
++}
+--
+2.39.2
+
diff --git a/network/patches/0216-networkctl-Connect-to-the-system-bus.patch b/network/patches/0216-networkctl-Connect-to-the-system-bus.patch
new file mode 100644
index 000000000..2ba84a6d8
--- /dev/null
+++ b/network/patches/0216-networkctl-Connect-to-the-system-bus.patch
@@ -0,0 +1,45 @@
+From d9b54f58d6abedf04cfa893cae479b05533f470f Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Wed, 1 Mar 2023 15:52:20 +0000
+Subject: [PATCH 216/304] networkctl: Connect to the system bus
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkctl/main.c | 22 +++++++++++++++++++++-
+ 1 file changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/src/networkctl/main.c b/src/networkctl/main.c
+index 14aafdd..6ecaeb6 100644
+--- a/src/networkctl/main.c
++++ b/src/networkctl/main.c
+@@ -18,6 +18,26 @@
+ # #
+ #############################################################################*/
+
++#include <stdio.h>
++
++#include <systemd/sd-bus.h>
++
+ int main(int argc, char** argv) {
+- return 0;
++ sd_bus* bus = NULL;
++ int r;
++
++ // Connect to system bus
++ r = sd_bus_open_system(&bus);
++ if (r < 0) {
++ fprintf(stderr, "Could not connect to system bus: %m\n");
++ goto ERROR;
++ }
++
++ // XXX TODO Do all the work
++
++ERROR:
++ if (bus)
++ sd_bus_flush_close_unref(bus);
++
++ return r;
+ }
+--
+2.39.2
+
diff --git a/network/patches/0217-networkctl-Add-some-help-and-version-arguments.patch b/network/patches/0217-networkctl-Add-some-help-and-version-arguments.patch
new file mode 100644
index 000000000..9f9eaecf0
--- /dev/null
+++ b/network/patches/0217-networkctl-Add-some-help-and-version-arguments.patch
@@ -0,0 +1,94 @@
+From bc44ba7128b38d16455899acaa145daa2eb6aade Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Wed, 1 Mar 2023 16:13:11 +0000
+Subject: [PATCH 217/304] networkctl: Add some help and version arguments
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkctl/main.c | 63 ++++++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 62 insertions(+), 1 deletion(-)
+
+diff --git a/src/networkctl/main.c b/src/networkctl/main.c
+index 6ecaeb6..494fd7d 100644
+--- a/src/networkctl/main.c
++++ b/src/networkctl/main.c
+@@ -18,14 +18,75 @@
+ # #
+ #############################################################################*/
+
++#include <errno.h>
++#include <getopt.h>
+ #include <stdio.h>
++#include <unistd.h>
+
+ #include <systemd/sd-bus.h>
+
+-int main(int argc, char** argv) {
++static int version(void) {
++ printf("networkctl %s\n", PACKAGE_VERSION);
++
++ return 0;
++}
++
++static int help(void) {
++ printf(
++ "%s [OPTIONS...] COMMAND\n\n"
++ "Options:\n"
++ " -h --help Show help\n"
++ " --version Show version\n",
++ program_invocation_short_name
++ );
++
++ return 0;
++}
++
++static int parse_argv(int argc, char* argv[]) {
++ enum {
++ ARG_VERSION,
++ };
++
++ static const struct option options[] = {
++ { "help", no_argument, NULL, 'h' },
++ { "version", no_argument, NULL, ARG_VERSION },
++ { NULL },
++ };
++ int c;
++
++ for (;;) {
++ c = getopt_long(argc, argv, "h", options, NULL);
++ if (c < 0)
++ break;
++
++ switch (c) {
++ case 'h':
++ return help();
++
++ case ARG_VERSION:
++ return version();
++
++ case '?':
++ return -EINVAL;
++
++ default:
++ break;
++ }
++ }
++
++ return 0;
++}
++
++int main(int argc, char* argv[]) {
+ sd_bus* bus = NULL;
+ int r;
+
++ // Parse command line arguments
++ r = parse_argv(argc, argv);
++ if (r)
++ goto ERROR;
++
+ // Connect to system bus
+ r = sd_bus_open_system(&bus);
+ if (r < 0) {
+--
+2.39.2
+
diff --git a/network/patches/0218-networkctl-Implement-a-basic-command-dispatcher.patch b/network/patches/0218-networkctl-Implement-a-basic-command-dispatcher.patch
new file mode 100644
index 000000000..74e8eae38
--- /dev/null
+++ b/network/patches/0218-networkctl-Implement-a-basic-command-dispatcher.patch
@@ -0,0 +1,172 @@
+From f3bb976c4be0fe41959d7623f4ae3269c0e95e1d Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Wed, 1 Mar 2023 16:55:45 +0000
+Subject: [PATCH 218/304] networkctl: Implement a basic command dispatcher
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 2 ++
+ src/networkctl/command.c | 58 ++++++++++++++++++++++++++++++++++++++++
+ src/networkctl/command.h | 34 +++++++++++++++++++++++
+ src/networkctl/main.c | 19 ++++++++++++-
+ 4 files changed, 112 insertions(+), 1 deletion(-)
+ create mode 100644 src/networkctl/command.c
+ create mode 100644 src/networkctl/command.h
+
+diff --git a/Makefile.am b/Makefile.am
+index 1640060..186af94 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -383,6 +383,8 @@ bin_PROGRAMS += \
+ networkctl
+
+ dist_networkctl_SOURCES = \
++ src/networkctl/command.c \
++ src/networkctl/command.h \
+ src/networkctl/main.c
+
+ networkctl_CFLAGS = \
+diff --git a/src/networkctl/command.c b/src/networkctl/command.c
+new file mode 100644
+index 0000000..7114efe
+--- /dev/null
++++ b/src/networkctl/command.c
+@@ -0,0 +1,58 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#include <errno.h>
++#include <getopt.h>
++#include <string.h>
++
++#include "command.h"
++
++static const struct command* command_find(const struct command* commands, const char* verb) {
++ for (const struct command* command = commands; command->verb; command++) {
++ if (strcmp(command->verb, verb) == 0)
++ return command;
++ }
++
++ return NULL;
++}
++
++int command_dispatch(sd_bus* bus, const struct command* commands, int argc, char* argv[]) {
++ const struct command* command = NULL;
++
++ argc -= optind;
++ argv += optind;
++ optind = 1;
++
++ if (!argc) {
++ fprintf(stderr, "Command required\n");
++ return -EINVAL;
++ }
++
++ const char* verb = argv[0];
++
++ // Find a matching command
++ command = command_find(commands, verb);
++ if (!command) {
++ fprintf(stderr, "Unknown command '%s'\n", verb);
++ return -EINVAL;
++ }
++
++ return command->callback(bus, argc, argv);
++}
+diff --git a/src/networkctl/command.h b/src/networkctl/command.h
+new file mode 100644
+index 0000000..f8f295e
+--- /dev/null
++++ b/src/networkctl/command.h
+@@ -0,0 +1,34 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#ifndef NETWORKCTL_COMMAND_H
++#define NETWORKCTL_COMMAND_H
++
++#include <systemd/sd-bus.h>
++
++struct command {
++ const char* verb;
++ int flags;
++ int (*callback)(sd_bus* bus, int argc, char* argv[]);
++};
++
++int command_dispatch(sd_bus* bus, const struct command* commands, int argc, char* argv[]);
++
++#endif /* NETWORKCTL_COMMAND_H */
+diff --git a/src/networkctl/main.c b/src/networkctl/main.c
+index 494fd7d..0cbc3e6 100644
+--- a/src/networkctl/main.c
++++ b/src/networkctl/main.c
+@@ -25,6 +25,22 @@
+
+ #include <systemd/sd-bus.h>
+
++#include "command.h"
++
++static int networkctl_status(sd_bus* bus, int argc, char* argv[]) {
++ printf("%s called\n", __FUNCTION__);
++ return 0;
++}
++
++static int networkctl_main(sd_bus* bus, int argc, char* argv[]) {
++ static const struct command commands[] = {
++ { "status", 0, networkctl_status },
++ { NULL },
++ };
++
++ return command_dispatch(bus, commands, argc, argv);
++}
++
+ static int version(void) {
+ printf("networkctl %s\n", PACKAGE_VERSION);
+
+@@ -94,7 +110,8 @@ int main(int argc, char* argv[]) {
+ goto ERROR;
+ }
+
+- // XXX TODO Do all the work
++ // Run a command
++ r = networkctl_main(bus, argc, argv);
+
+ ERROR:
+ if (bus)
+--
+2.39.2
+
diff --git a/network/patches/0219-networkd-Implement-ListZones-bus-command.patch b/network/patches/0219-networkd-Implement-ListZones-bus-command.patch
new file mode 100644
index 000000000..e6558d155
--- /dev/null
+++ b/network/patches/0219-networkd-Implement-ListZones-bus-command.patch
@@ -0,0 +1,169 @@
+From b4faae0abf9bd02b4aa02660a85d58497ad8b07b Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 14 Apr 2023 11:25:56 +0000
+Subject: [PATCH 219/304] networkd: Implement ListZones bus command
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/daemon-bus.c | 55 +++++++++++++++++++++++++++++++++++++++
+ src/networkd/daemon.c | 7 +++++
+ src/networkd/daemon.h | 1 +
+ src/networkd/zones.c | 13 +++++++++
+ src/networkd/zones.h | 4 +++
+ 5 files changed, 80 insertions(+)
+
+diff --git a/src/networkd/daemon-bus.c b/src/networkd/daemon-bus.c
+index 93a0411..7620eed 100644
+--- a/src/networkd/daemon-bus.c
++++ b/src/networkd/daemon-bus.c
+@@ -18,12 +18,16 @@
+ # #
+ #############################################################################*/
+
++#include <stdlib.h>
++
+ #include <systemd/sd-bus.h>
+
+ #include "bus.h"
+ #include "daemon.h"
++#include "logging.h"
+ #include "port-bus.h"
+ #include "zone-bus.h"
++#include "zones.h"
+
+ static int nw_daemon_bus_reload(sd_bus_message* m, void* data, sd_bus_error* error) {
+ nw_daemon* daemon = (nw_daemon*)data;
+@@ -35,8 +39,59 @@ static int nw_daemon_bus_reload(sd_bus_message* m, void* data, sd_bus_error* err
+ return sd_bus_reply_method_return(m, NULL);
+ }
+
++static int __nw_daemon_bus_list_zones(nw_daemon* daemon, nw_zone* zone, void* data) {
++ sd_bus_message* reply = (sd_bus_message*)data;
++ int r;
++
++ // Fetch zone name
++ const char* name = nw_zone_name(zone);
++
++ // Fetch bus path
++ char* path = nw_zone_bus_path(zone);
++
++ r = sd_bus_message_append(reply, "(so)", name, path);
++
++ free(path);
++
++ return r;
++}
++
++static int nw_daemon_bus_list_zones(sd_bus_message* m, void* data, sd_bus_error* error) {
++ nw_daemon* daemon = (nw_daemon*)data;
++ sd_bus_message* reply = NULL;
++ int r;
++
++ // Form a reply message
++ r = sd_bus_message_new_method_return(m, &reply);
++ if (r < 0)
++ goto ERROR;
++
++ r = sd_bus_message_open_container(reply, 'a', "(so)");
++ if (r < 0)
++ goto ERROR;
++
++ r = nw_daemon_zones_walk(daemon, __nw_daemon_bus_list_zones, reply);
++ if (r < 0)
++ goto ERROR;
++
++ r = sd_bus_message_close_container(reply);
++ if (r < 0)
++ goto ERROR;
++
++ // Send the reply
++ r = sd_bus_send(NULL, reply, NULL);
++
++ERROR:
++ if (reply)
++ sd_bus_message_unref(reply);
++
++ return r;
++}
++
+ static const sd_bus_vtable daemon_vtable[] = {
+ SD_BUS_VTABLE_START(0),
++ SD_BUS_METHOD_WITH_ARGS("ListZones", SD_BUS_NO_ARGS, SD_BUS_RESULT("a(so)", links),
++ nw_daemon_bus_list_zones, SD_BUS_VTABLE_UNPRIVILEGED),
+ SD_BUS_METHOD("Reload", SD_BUS_NO_ARGS, SD_BUS_NO_RESULT,
+ nw_daemon_bus_reload, SD_BUS_VTABLE_UNPRIVILEGED),
+ SD_BUS_VTABLE_END,
+diff --git a/src/networkd/daemon.c b/src/networkd/daemon.c
+index c67c759..925b207 100644
+--- a/src/networkd/daemon.c
++++ b/src/networkd/daemon.c
+@@ -519,6 +519,13 @@ nw_zones* nw_daemon_zones(nw_daemon* daemon) {
+ return nw_zones_ref(daemon->zones);
+ }
+
++int nw_daemon_zones_walk(nw_daemon* daemon, nw_zones_walk_callback callback, void* data) {
++ if (!daemon->zones)
++ return 0;
++
++ return nw_zones_walk(daemon->zones, callback, data);
++}
++
+ nw_zone* nw_daemon_get_zone_by_name(nw_daemon* daemon, const char* name) {
+ if (!daemon->zones)
+ return NULL;
+diff --git a/src/networkd/daemon.h b/src/networkd/daemon.h
+index 6f4c217..ce9a660 100644
+--- a/src/networkd/daemon.h
++++ b/src/networkd/daemon.h
+@@ -66,6 +66,7 @@ nw_port* nw_daemon_get_port_by_name(nw_daemon* daemon, const char* name);
+ Zones
+ */
+ nw_zones* nw_daemon_zones(nw_daemon* daemon);
++int nw_daemon_zones_walk(nw_daemon* daemon, nw_zones_walk_callback callback, void* data);
+ nw_zone* nw_daemon_get_zone_by_name(nw_daemon* daemon, const char* name);
+
+ #endif /* NETWORKD_DAEMON_H */
+diff --git a/src/networkd/zones.c b/src/networkd/zones.c
+index ea0d8de..521da51 100644
+--- a/src/networkd/zones.c
++++ b/src/networkd/zones.c
+@@ -239,3 +239,16 @@ ERROR:
+
+ return 1;
+ }
++
++int nw_zones_walk(nw_zones* zones, nw_zones_walk_callback callback, void* data) {
++ struct nw_zones_entry* entry = NULL;
++ int r;
++
++ STAILQ_FOREACH(entry, &zones->entries, nodes) {
++ r = callback(zones->daemon, entry->zone, data);
++ if (r)
++ return r;
++ }
++
++ return 0;
++}
+diff --git a/src/networkd/zones.h b/src/networkd/zones.h
+index c887bd0..019955e 100644
+--- a/src/networkd/zones.h
++++ b/src/networkd/zones.h
+@@ -23,6 +23,8 @@
+
+ typedef struct nw_zones nw_zones;
+
++typedef int (*nw_zones_walk_callback)(nw_daemon* daemon, nw_zone* zone, void* data);
++
+ #include "daemon.h"
+
+ int nw_zones_create(nw_zones** zones, nw_daemon* daemon);
+@@ -40,4 +42,6 @@ nw_zone* nw_zones_get_by_name(nw_zones* zones, const char* name);
+
+ int nw_zones_bus_paths(nw_zones* zones, char*** paths);
+
++int nw_zones_walk(nw_zones* zones, nw_zones_walk_callback callback, void* data);
++
+ #endif /* NETWORKD_ZONES_H */
+--
+2.39.2
+
diff --git a/network/patches/0220-networkctl-Implement-zone-list-command.patch b/network/patches/0220-networkctl-Implement-zone-list-command.patch
new file mode 100644
index 000000000..05492bc75
--- /dev/null
+++ b/network/patches/0220-networkctl-Implement-zone-list-command.patch
@@ -0,0 +1,188 @@
+From 537fae0bc0758b2b93a80dff94918752ff01b813 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 14 Apr 2023 11:26:43 +0000
+Subject: [PATCH 220/304] networkctl: Implement "zone list" command
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 4 +-
+ src/networkctl/main.c | 2 +
+ src/networkctl/zone.c | 97 +++++++++++++++++++++++++++++++++++++++++++
+ src/networkctl/zone.h | 26 ++++++++++++
+ 4 files changed, 128 insertions(+), 1 deletion(-)
+ create mode 100644 src/networkctl/zone.c
+ create mode 100644 src/networkctl/zone.h
+
+diff --git a/Makefile.am b/Makefile.am
+index 186af94..80a7236 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -385,7 +385,9 @@ bin_PROGRAMS += \
+ dist_networkctl_SOURCES = \
+ src/networkctl/command.c \
+ src/networkctl/command.h \
+- src/networkctl/main.c
++ src/networkctl/main.c \
++ src/networkctl/zone.c \
++ src/networkctl/zone.h
+
+ networkctl_CFLAGS = \
+ $(AM_CFLAGS) \
+diff --git a/src/networkctl/main.c b/src/networkctl/main.c
+index 0cbc3e6..a08256c 100644
+--- a/src/networkctl/main.c
++++ b/src/networkctl/main.c
+@@ -26,6 +26,7 @@
+ #include <systemd/sd-bus.h>
+
+ #include "command.h"
++#include "zone.h"
+
+ static int networkctl_status(sd_bus* bus, int argc, char* argv[]) {
+ printf("%s called\n", __FUNCTION__);
+@@ -35,6 +36,7 @@ static int networkctl_status(sd_bus* bus, int argc, char* argv[]) {
+ static int networkctl_main(sd_bus* bus, int argc, char* argv[]) {
+ static const struct command commands[] = {
+ { "status", 0, networkctl_status },
++ { "zone", 0, networkctl_zone },
+ { NULL },
+ };
+
+diff --git a/src/networkctl/zone.c b/src/networkctl/zone.c
+new file mode 100644
+index 0000000..ee1d0a2
+--- /dev/null
++++ b/src/networkctl/zone.c
+@@ -0,0 +1,97 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#include <systemd/sd-bus.h>
++
++#include "command.h"
++#include "zone.h"
++
++typedef int (*networkctl_zone_walk_callback)
++ (sd_bus* bus, const char* path, const char* name, void* data);
++
++static int networkctl_zone_walk(sd_bus* bus,
++ networkctl_zone_walk_callback callback, void* data) {
++ sd_bus_message* reply = NULL;
++ sd_bus_error error = SD_BUS_ERROR_NULL;
++ int r;
++
++ // Call ListZones
++ r = sd_bus_call_method(bus, "org.ipfire.network1", "/org/ipfire/network1",
++ "org.ipfire.network1", "ListZones", &error, &reply, "");
++ if (r < 0) {
++ fprintf(stderr, "ListZones call failed: %m\n");
++ goto ERROR;
++ }
++
++ const char* name = NULL;
++ const char* path = NULL;
++
++ // Open the container
++ r = sd_bus_message_enter_container(reply, 'a', "(so)");
++ if (r < 0) {
++ fprintf(stderr, "Could not open container: %m\n");
++ goto ERROR;
++ }
++
++ // Iterate over all zones
++ for (;;) {
++ r = sd_bus_message_read(reply, "(so)", &name, &path);
++ if (r < 0)
++ goto ERROR;
++
++ // Break if we reached the end of the container
++ if (r == 0)
++ break;
++
++ // Call the callback
++ r = callback(bus, path, name, data);
++ if (r)
++ goto ERROR;
++ }
++
++ // Close the container
++ sd_bus_message_exit_container(reply);
++
++ERROR:
++ if (reply)
++ sd_bus_message_unref(reply);
++ sd_bus_error_free(&error);
++
++ return r;
++}
++
++static int __networkctl_zone_list(sd_bus* bus, const char* path, const char* name, void* data) {
++ printf("%s\n", name);
++
++ return 0;
++}
++
++static int networkctl_zone_list(sd_bus* bus, int argc, char* argv[]) {
++ return networkctl_zone_walk(bus, __networkctl_zone_list, NULL);
++}
++
++int networkctl_zone(sd_bus* bus, int argc, char* argv[]) {
++ static const struct command commands[] = {
++ { "list", 0, networkctl_zone_list },
++ { NULL },
++ };
++
++ return command_dispatch(bus, commands, argc, argv);
++}
+diff --git a/src/networkctl/zone.h b/src/networkctl/zone.h
+new file mode 100644
+index 0000000..5eddd98
+--- /dev/null
++++ b/src/networkctl/zone.h
+@@ -0,0 +1,26 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#ifndef NETWORKCTL_ZONE_H
++#define NETWORKCTL_ZONE_H
++
++int networkctl_zone(sd_bus* bus, int argc, char* argv[]);
++
++#endif /* NETWORKCTL_ZONE_H */
+--
+2.39.2
+
diff --git a/network/patches/0221-networkd-Fix-finding-links-by-name.patch b/network/patches/0221-networkd-Fix-finding-links-by-name.patch
new file mode 100644
index 000000000..bac9705bc
--- /dev/null
+++ b/network/patches/0221-networkd-Fix-finding-links-by-name.patch
@@ -0,0 +1,56 @@
+From 207abe4eabad65c2d1e120f7c0fc711d17ed017a Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 14 Apr 2023 11:57:19 +0000
+Subject: [PATCH 221/304] networkd: Fix finding links by name
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/link.c | 4 ++++
+ src/networkd/link.h | 2 +-
+ src/networkd/links.c | 2 +-
+ 3 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/src/networkd/link.c b/src/networkd/link.c
+index 7f49606..0fb388b 100644
+--- a/src/networkd/link.c
++++ b/src/networkd/link.c
+@@ -98,6 +98,10 @@ int nw_link_ifindex(nw_link* link) {
+ return link->ifindex;
+ }
+
++const char* nw_link_ifname(nw_link* link) {
++ return link->ifname;
++}
++
+ // Carrier
+
+ int nw_link_has_carrier(nw_link* link) {
+diff --git a/src/networkd/link.h b/src/networkd/link.h
+index 3d8d397..779621b 100644
+--- a/src/networkd/link.h
++++ b/src/networkd/link.h
+@@ -31,7 +31,7 @@ nw_link* nw_link_ref(nw_link* link);
+ nw_link* nw_link_unref(nw_link* link);
+
+ int nw_link_ifindex(nw_link* link);
+-const char* nw_link_name(nw_link* link);
++const char* nw_link_ifname(nw_link* link);
+
+ int nw_link_has_carrier(nw_link* link);
+
+diff --git a/src/networkd/links.c b/src/networkd/links.c
+index 9f41034..3dd06d0 100644
+--- a/src/networkd/links.c
++++ b/src/networkd/links.c
+@@ -198,7 +198,7 @@ nw_link* nw_links_get_by_name(nw_links* links, const char* name) {
+ struct nw_links_entry* entry = NULL;
+
+ STAILQ_FOREACH(entry, &links->entries, nodes) {
+- const char* n = nw_link_name(entry->link);
++ const char* n = nw_link_ifname(entry->link);
+
+ if (strcmp(name, n) == 0)
+ return nw_link_ref(entry->link);
+--
+2.39.2
+
diff --git a/network/patches/0222-networkd-ports-Keep-a-permanent-reference-to-links.patch b/network/patches/0222-networkd-ports-Keep-a-permanent-reference-to-links.patch
new file mode 100644
index 000000000..cb4989442
--- /dev/null
+++ b/network/patches/0222-networkd-ports-Keep-a-permanent-reference-to-links.patch
@@ -0,0 +1,81 @@
+From 02801f0d507924a4efb8c462f6fc775ab5793ebc Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 14 Apr 2023 11:57:48 +0000
+Subject: [PATCH 222/304] networkd: ports: Keep a permanent reference to links
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/port.c | 30 ++++++++++++++++++++----------
+ 1 file changed, 20 insertions(+), 10 deletions(-)
+
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index c6c8781..3c4f0b3 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -36,6 +36,9 @@ struct nw_port {
+ nw_daemon* daemon;
+ int nrefs;
+
++ // Link
++ nw_link* link;
++
+ char name[IF_NAMESIZE];
+ nw_port_type_t type;
+
+@@ -66,6 +69,8 @@ static nw_port_type_t nw_port_type_from_string(const char* s) {
+ }
+
+ static void nw_port_free(nw_port* port) {
++ if (port->link)
++ nw_link_unref(port->link);
+ if (port->config)
+ nw_config_unref(port->config);
+ if (port->daemon)
+@@ -134,6 +139,14 @@ static int nw_port_setup(nw_port* port) {
+ char path[PATH_MAX];
+ int r;
+
++ // Find the link
++ port->link = nw_daemon_get_link_by_name(port->daemon, port->name);
++ if (port->link) {
++ DEBUG("%s: Found matching link %d\n", port->name, nw_link_ifindex(port->link));
++ } else {
++ DEBUG("%s: Could not find matching link\n", port->name);
++ }
++
+ // Compose the path to the main configuration file
+ r = nw_path_join(path, PORT_CONFIG_DIR, port->name);
+ if (r)
+@@ -240,7 +253,10 @@ char* nw_port_bus_path(nw_port* port) {
+ }
+
+ static nw_link* nw_port_get_link(nw_port* port) {
+- return nw_daemon_get_link_by_name(port->daemon, port->name);
++ if (!port->link)
++ return NULL;
++
++ return nw_link_ref(port->link);
+ }
+
+ const nw_address_t* nw_port_get_address(nw_port* port) {
+@@ -248,14 +264,8 @@ const nw_address_t* nw_port_get_address(nw_port* port) {
+ }
+
+ int nw_port_has_carrier(nw_port* port) {
+- int has_carrier = 0;
+-
+- // Fetch link
+- nw_link* link = nw_port_get_link(port);
+- if (link) {
+- has_carrier = nw_link_has_carrier(link);
+- nw_link_unref(link);
+- }
++ if (!port->link)
++ return 0;
+
+- return has_carrier;
++ return nw_link_has_carrier(port->link);
+ }
+--
+2.39.2
+
diff --git a/network/patches/0223-networkd-zones-Keep-a-permanent-reference-to-links.patch b/network/patches/0223-networkd-zones-Keep-a-permanent-reference-to-links.patch
new file mode 100644
index 000000000..bafe16a5b
--- /dev/null
+++ b/network/patches/0223-networkd-zones-Keep-a-permanent-reference-to-links.patch
@@ -0,0 +1,89 @@
+From 4e989bd539cc0aea61345156a6401e7282357d0c Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 14 Apr 2023 12:02:40 +0000
+Subject: [PATCH 223/304] networkd: zones: Keep a permanent reference to links
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/zone.c | 31 +++++++++++++++++++++----------
+ 1 file changed, 21 insertions(+), 10 deletions(-)
+
+diff --git a/src/networkd/zone.c b/src/networkd/zone.c
+index 8fe07c5..4fda1e5 100644
+--- a/src/networkd/zone.c
++++ b/src/networkd/zone.c
+@@ -25,6 +25,7 @@
+
+ #include "config.h"
+ #include "daemon.h"
++#include "link.h"
+ #include "logging.h"
+ #include "string.h"
+ #include "zone.h"
+@@ -33,6 +34,9 @@ struct nw_zone {
+ nw_daemon* daemon;
+ int nrefs;
+
++ // Link
++ nw_link* link;
++
+ char name[NETWORK_ZONE_NAME_MAX_LENGTH];
+
+ // Configuration
+@@ -66,6 +70,8 @@ static int __nw_zone_path(nw_zone* zone, char* p, const size_t length,
+ }
+
+ static void nw_zone_free(nw_zone* zone) {
++ if (zone->link)
++ nw_link_unref(zone->link);
+ if (zone->config)
+ nw_config_unref(zone->config);
+ if (zone->daemon)
+@@ -78,6 +84,14 @@ static int nw_zone_setup(nw_zone* zone) {
+ char path[PATH_MAX];
+ int r;
+
++ // Find the link
++ zone->link = nw_daemon_get_link_by_name(zone->daemon, zone->name);
++ if (zone->link) {
++ DEBUG("%s: Found matching link %d\n", zone->name, nw_link_ifindex(zone->link));
++ } else {
++ DEBUG("%s: Could not find matching link\n", zone->name);
++ }
++
+ // Compose the path to the main configuration file
+ r = nw_zone_path(zone, path, "%s", "settings");
+ if (r)
+@@ -164,22 +178,19 @@ char* nw_zone_bus_path(nw_zone* zone) {
+ }
+
+ static nw_link* nw_zone_get_link(nw_zone* zone) {
+- return nw_daemon_get_link_by_name(zone->daemon, zone->name);
++ if (!zone->link)
++ return NULL;
++
++ return nw_link_ref(zone->link);
+ }
+
+ // Carrier
+
+ int nw_zone_has_carrier(nw_zone* zone) {
+- int has_carrier = 0;
+-
+- // Fetch link
+- nw_link* link = nw_zone_get_link(zone);
+- if (link) {
+- has_carrier = nw_link_has_carrier(link);
+- nw_link_unref(link);
+- }
++ if (!zone->link)
++ return 0;
+
+- return has_carrier;
++ return nw_link_has_carrier(zone->link);
+ }
+
+ /*
+--
+2.39.2
+
diff --git a/network/patches/0224-networkd-config-Add-functions-to-handle-boolean-valu.patch b/network/patches/0224-networkd-config-Add-functions-to-handle-boolean-valu.patch
new file mode 100644
index 000000000..4b2ad1b9b
--- /dev/null
+++ b/network/patches/0224-networkd-config-Add-functions-to-handle-boolean-valu.patch
@@ -0,0 +1,63 @@
+From 8b0b5c6d9e99c09341fe90b1278763fd3f70b53a Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 14 Apr 2023 13:04:17 +0000
+Subject: [PATCH 224/304] networkd: config: Add functions to handle boolean
+ values
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/config.c | 28 ++++++++++++++++++++++++++++
+ src/networkd/config.h | 3 +++
+ 2 files changed, 31 insertions(+)
+
+diff --git a/src/networkd/config.c b/src/networkd/config.c
+index b3d5284..d879ace 100644
+--- a/src/networkd/config.c
++++ b/src/networkd/config.c
+@@ -368,3 +368,31 @@ int nw_config_set_int(nw_config* config, const char* key, const int value) {
+
+ return nw_config_set(config, key, __value);
+ }
++
++static const char* nw_config_true[] = {
++ "true",
++ "yes",
++ "1",
++ NULL,
++};
++
++int nw_config_get_bool(nw_config* config, const char* key) {
++ const char* value = nw_config_get(config, key);
++
++ // No value indicates false
++ if (!value)
++ return 0;
++
++ // Check if we match any known true words
++ for (const char** s = nw_config_true; *s; s++) {
++ if (strcmp(value, *s) == 0)
++ return 1;
++ }
++
++ // No match means false
++ return 0;
++}
++
++int nw_config_set_bool(nw_config* config, const char* key, const int value) {
++ return nw_config_set(config, key, value ? "true" : "false");
++}
+diff --git a/src/networkd/config.h b/src/networkd/config.h
+index 041a10e..0b25f75 100644
+--- a/src/networkd/config.h
++++ b/src/networkd/config.h
+@@ -48,4 +48,7 @@ int nw_config_set(nw_config* config, const char* key, const char* value);
+ int nw_config_get_int(nw_config* config, const char* key, const int __default);
+ int nw_config_set_int(nw_config* config, const char* key, const int value);
+
++int nw_config_get_bool(nw_config* config, const char* key);
++int nw_config_set_bool(nw_config* config, const char* key, const int value);
++
+ #endif /* NETWORKD_CONFIG_H */
+--
+2.39.2
+
diff --git a/network/patches/0225-networkd-Try-to-reconfigure-all-ports-and-zones-on-s.patch b/network/patches/0225-networkd-Try-to-reconfigure-all-ports-and-zones-on-s.patch
new file mode 100644
index 000000000..8ea8c778b
--- /dev/null
+++ b/network/patches/0225-networkd-Try-to-reconfigure-all-ports-and-zones-on-s.patch
@@ -0,0 +1,210 @@
+From b9769b09ea2943e4b212806c11f31f14f627b08f Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 14 Apr 2023 13:06:25 +0000
+Subject: [PATCH 225/304] networkd: Try to reconfigure all ports and zones on
+ startup
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/daemon.c | 36 ++++++++++++++++++++++++++++++++++++
+ src/networkd/port.c | 4 ++++
+ src/networkd/port.h | 2 ++
+ src/networkd/ports.c | 21 +++++++++++++++++++++
+ src/networkd/ports.h | 6 ++++++
+ src/networkd/zone.c | 4 ++++
+ src/networkd/zone.h | 2 ++
+ src/networkd/zones.c | 8 ++++++++
+ src/networkd/zones.h | 2 ++
+ 9 files changed, 85 insertions(+)
+
+diff --git a/src/networkd/daemon.c b/src/networkd/daemon.c
+index 925b207..c6dad91 100644
+--- a/src/networkd/daemon.c
++++ b/src/networkd/daemon.c
+@@ -291,6 +291,37 @@ static int nw_daemon_enumerate(nw_daemon* daemon) {
+ return 0;
+ }
+
++static int __nw_daemon_reconfigure(sd_event_source* s, void* data) {
++ nw_daemon* daemon = (nw_daemon*)data;
++ int r;
++
++ DEBUG("Reconfiguring...\n");
++
++ // Reconfigure all zones
++ r = nw_zones_reconfigure(daemon->zones);
++ if (r)
++ return r;
++
++ // Reconfigure all ports
++ r = nw_ports_reconfigure(daemon->ports);
++ if (r)
++ return r;
++
++ return 0;
++}
++
++static int nw_daemon_reconfigure(nw_daemon* daemon) {
++ int r;
++
++ r = sd_event_add_defer(daemon->loop, NULL, __nw_daemon_reconfigure, daemon);
++ if (r) {
++ ERROR("Could not schedule re-configuration task: %m\n");
++ return r;
++ }
++
++ return 0;
++}
++
+ static int nw_daemon_setup(nw_daemon* daemon) {
+ int r;
+
+@@ -324,6 +355,11 @@ static int nw_daemon_setup(nw_daemon* daemon) {
+ if (r)
+ return r;
+
++ // (Re-)configure everything
++ r = nw_daemon_reconfigure(daemon);
++ if (r)
++ return r;
++
+ return 0;
+ }
+
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index 3c4f0b3..ec40830 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -263,6 +263,10 @@ const nw_address_t* nw_port_get_address(nw_port* port) {
+ return &port->address;
+ }
+
++int nw_port_reconfigure(nw_port* port) {
++ return 0; // XXX TODO
++}
++
+ int nw_port_has_carrier(nw_port* port) {
+ if (!port->link)
+ return 0;
+diff --git a/src/networkd/port.h b/src/networkd/port.h
+index 33241ed..17c8c3c 100644
+--- a/src/networkd/port.h
++++ b/src/networkd/port.h
+@@ -46,6 +46,8 @@ char* nw_port_bus_path(nw_port* port);
+
+ const nw_address_t* nw_port_get_address(nw_port* port);
+
++int nw_port_reconfigure(nw_port* port);
++
+ int nw_port_has_carrier(nw_port* port);
+
+ #endif /* NETWORKD_PORT_H */
+diff --git a/src/networkd/ports.c b/src/networkd/ports.c
+index a87ca03..87135d8 100644
+--- a/src/networkd/ports.c
++++ b/src/networkd/ports.c
+@@ -222,3 +222,24 @@ ERROR:
+
+ return 1;
+ }
++
++int nw_ports_walk(nw_ports* ports, nw_ports_walk_callback callback, void* data) {
++ struct nw_ports_entry* entry = NULL;
++ int r;
++
++ STAILQ_FOREACH(entry, &ports->entries, nodes) {
++ r = callback(ports->daemon, entry->port, data);
++ if (r)
++ return r;
++ }
++
++ return 0;
++}
++
++static int __nw_ports_reconfigure(nw_daemon* daemon, nw_port* port, void* data) {
++ return nw_port_reconfigure(port);
++}
++
++int nw_ports_reconfigure(nw_ports* ports) {
++ return nw_ports_walk(ports, __nw_ports_reconfigure, NULL);
++}
+diff --git a/src/networkd/ports.h b/src/networkd/ports.h
+index 40c9ae1..68ae532 100644
+--- a/src/networkd/ports.h
++++ b/src/networkd/ports.h
+@@ -23,6 +23,8 @@
+
+ typedef struct nw_ports nw_ports;
+
++typedef int (*nw_ports_walk_callback)(nw_daemon* daemon, nw_port* port, void* data);
++
+ #include "daemon.h"
+
+ int nw_ports_create(nw_ports** ports, nw_daemon* daemon);
+@@ -38,4 +40,8 @@ struct nw_port* nw_ports_get_by_name(nw_ports* ports, const char* name);
+
+ int nw_ports_bus_paths(nw_ports* ports, char*** paths);
+
++int nw_ports_walk(nw_ports* ports, nw_ports_walk_callback callback, void* data);
++
++int nw_ports_reconfigure(nw_ports* ports);
++
+ #endif /* NETWORKD_PORTS_H */
+diff --git a/src/networkd/zone.c b/src/networkd/zone.c
+index 4fda1e5..9daa0d3 100644
+--- a/src/networkd/zone.c
++++ b/src/networkd/zone.c
+@@ -184,6 +184,10 @@ static nw_link* nw_zone_get_link(nw_zone* zone) {
+ return nw_link_ref(zone->link);
+ }
+
++int nw_zone_reconfigure(nw_zone* zone) {
++ return 0; // XXX TODO
++}
++
+ // Carrier
+
+ int nw_zone_has_carrier(nw_zone* zone) {
+diff --git a/src/networkd/zone.h b/src/networkd/zone.h
+index f5a2355..591e467 100644
+--- a/src/networkd/zone.h
++++ b/src/networkd/zone.h
+@@ -41,6 +41,8 @@ const char* nw_zone_name(nw_zone* zone);
+
+ char* nw_zone_bus_path(nw_zone* zone);
+
++int nw_zone_reconfigure(nw_zone* zone);
++
+ int nw_zone_has_carrier(nw_zone* zone);
+
+ /*
+diff --git a/src/networkd/zones.c b/src/networkd/zones.c
+index 521da51..84a6673 100644
+--- a/src/networkd/zones.c
++++ b/src/networkd/zones.c
+@@ -252,3 +252,11 @@ int nw_zones_walk(nw_zones* zones, nw_zones_walk_callback callback, void* data)
+
+ return 0;
+ }
++
++static int __nw_zones_reconfigure(nw_daemon* daemon, nw_zone* zone, void* data) {
++ return nw_zone_reconfigure(zone);
++}
++
++int nw_zones_reconfigure(nw_zones* zones) {
++ return nw_zones_walk(zones, __nw_zones_reconfigure, NULL);
++}
+diff --git a/src/networkd/zones.h b/src/networkd/zones.h
+index 019955e..ad39fd2 100644
+--- a/src/networkd/zones.h
++++ b/src/networkd/zones.h
+@@ -44,4 +44,6 @@ int nw_zones_bus_paths(nw_zones* zones, char*** paths);
+
+ int nw_zones_walk(nw_zones* zones, nw_zones_walk_callback callback, void* data);
+
++int nw_zones_reconfigure(nw_zones* zones);
++
+ #endif /* NETWORKD_ZONES_H */
+--
+2.39.2
+
diff --git a/network/patches/0226-networkd-Implement-deleting-links.patch b/network/patches/0226-networkd-Implement-deleting-links.patch
new file mode 100644
index 000000000..ba7e4160e
--- /dev/null
+++ b/network/patches/0226-networkd-Implement-deleting-links.patch
@@ -0,0 +1,147 @@
+From 371b836adc35d69cdd7a4a71144ec5e0f7ef42e1 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 14 Apr 2023 13:33:13 +0000
+Subject: [PATCH 226/304] networkd: Implement deleting links
+
+This is a little bit rough but generally does work.
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/link.c | 66 +++++++++++++++++++++++++++++++++++++++++++++
+ src/networkd/link.h | 2 ++
+ src/networkd/port.c | 19 ++++++++++++-
+ 3 files changed, 86 insertions(+), 1 deletion(-)
+
+diff --git a/src/networkd/link.c b/src/networkd/link.c
+index 0fb388b..949d0d8 100644
+--- a/src/networkd/link.c
++++ b/src/networkd/link.c
+@@ -41,6 +41,11 @@ struct nw_link {
+ // Interface Name
+ char ifname[IFNAMSIZ];
+
++ enum nw_link_state {
++ NW_LINK_UNKNOWN = 0,
++ NW_LINK_DESTROYED,
++ } state;
++
+ // MTU
+ uint32_t mtu;
+ uint32_t min_mtu;
+@@ -94,6 +99,16 @@ nw_link* nw_link_unref(nw_link* link) {
+ return NULL;
+ }
+
++/*
++ This is a helper function for when we pass a reference to the event loop
++ it will have to dereference the link instance later.
++*/
++static void __nw_link_unref(void* data) {
++ nw_link* link = (nw_link*)data;
++
++ nw_link_unref(link);
++}
++
+ int nw_link_ifindex(nw_link* link) {
+ return link->ifindex;
+ }
+@@ -370,3 +385,54 @@ ERROR:
+
+ return r;
+ }
++
++static int __nw_link_destroy(sd_netlink* rtnl, sd_netlink_message* m, void* data) {
++ nw_link* link = (nw_link*)data;
++ int r;
++
++ // Check if the operation was successful
++ r = sd_netlink_message_get_errno(m);
++ if (r < 0) {
++ ERROR("Could not remove link %d: %m\n", link->ifindex);
++ // XXX We should extract the error message
++
++ return 0;
++ }
++
++ // Mark this link as destroyed
++ link->state = NW_LINK_DESTROYED;
++
++ return 0;
++}
++
++int nw_link_destroy(nw_link* link) {
++ sd_netlink_message* m = NULL;
++ int r;
++
++ sd_netlink* rtnl = nw_daemon_get_rtnl(link->daemon);
++ if (!rtnl)
++ return 1;
++
++ DEBUG("Destroying link %d\n", link->ifindex);
++
++ // Create a new message
++ r = sd_rtnl_message_new_link(rtnl, &m, RTM_DELLINK, link->ifindex);
++ if (r < 0) {
++ ERROR("Could not allocate RTM_DELLINK message: %m\n");
++ goto ERROR;
++ }
++
++ // Send the message
++ r = sd_netlink_call_async(rtnl, NULL, m, __nw_link_destroy,
++ __nw_link_unref, nw_link_ref(link), -1, NULL);
++ if (r < 0) {
++ ERROR("Could not send rtnetlink message: %m\n");
++ goto ERROR;
++ }
++
++ERROR:
++ if (m)
++ sd_netlink_message_unref(m);
++
++ return r;
++}
+diff --git a/src/networkd/link.h b/src/networkd/link.h
+index 779621b..58a825a 100644
+--- a/src/networkd/link.h
++++ b/src/networkd/link.h
+@@ -37,4 +37,6 @@ int nw_link_has_carrier(nw_link* link);
+
+ int nw_link_process(sd_netlink* rtnl, sd_netlink_message* message, void* data);
+
++int nw_link_destroy(nw_link* link);
++
+ #endif /* NETWORKD_LINK_H */
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index ec40830..7d02305 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -263,8 +263,25 @@ const nw_address_t* nw_port_get_address(nw_port* port) {
+ return &port->address;
+ }
+
++static int nw_port_is_disabled(nw_port* port) {
++ return nw_config_get_bool(port->config, "DISABLED");
++}
++
+ int nw_port_reconfigure(nw_port* port) {
+- return 0; // XXX TODO
++ int r;
++
++ // If the port is disabled, we will try to destroy it
++ if (nw_port_is_disabled(port)) {
++ if (port->link) {
++ r = nw_link_destroy(port->link);
++ if (r)
++ return r;
++ }
++
++ return 0;
++ }
++
++ // XXX TODO
+ }
+
+ int nw_port_has_carrier(nw_port* port) {
+--
+2.39.2
+
diff --git a/network/patches/0227-networkd-Automatically-reference-dereference-links-t.patch b/network/patches/0227-networkd-Automatically-reference-dereference-links-t.patch
new file mode 100644
index 000000000..465c14c07
--- /dev/null
+++ b/network/patches/0227-networkd-Automatically-reference-dereference-links-t.patch
@@ -0,0 +1,368 @@
+From 611d4aca5d48567a7a7ddb0dd3446a97e91aad54 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 14 Apr 2023 14:15:01 +0000
+Subject: [PATCH 227/304] networkd: Automatically reference/dereference links
+ to zones/ports
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/daemon.c | 7 ++++
+ src/networkd/daemon.h | 1 +
+ src/networkd/link.c | 10 ++++++
+ src/networkd/links.c | 6 ++++
+ src/networkd/port.c | 82 +++++++++++++++++++++++++++++++++++--------
+ src/networkd/port.h | 3 ++
+ src/networkd/zone.c | 78 +++++++++++++++++++++++++++++++++-------
+ src/networkd/zone.h | 3 ++
+ 8 files changed, 164 insertions(+), 26 deletions(-)
+
+diff --git a/src/networkd/daemon.c b/src/networkd/daemon.c
+index c6dad91..02ca8e2 100644
+--- a/src/networkd/daemon.c
++++ b/src/networkd/daemon.c
+@@ -540,6 +540,13 @@ nw_ports* nw_daemon_ports(nw_daemon* daemon) {
+ return nw_ports_ref(daemon->ports);
+ }
+
++int nw_daemon_ports_walk(nw_daemon* daemon, nw_ports_walk_callback callback, void* data) {
++ if (!daemon->ports)
++ return 0;
++
++ return nw_ports_walk(daemon->ports, callback, data);
++}
++
+ nw_port* nw_daemon_get_port_by_name(nw_daemon* daemon, const char* name) {
+ if (!daemon->ports)
+ return NULL;
+diff --git a/src/networkd/daemon.h b/src/networkd/daemon.h
+index ce9a660..a14d33b 100644
+--- a/src/networkd/daemon.h
++++ b/src/networkd/daemon.h
+@@ -60,6 +60,7 @@ nw_link* nw_daemon_get_link_by_name(nw_daemon* daemon, const char* name);
+ Ports
+ */
+ nw_ports* nw_daemon_ports(nw_daemon* daemon);
++int nw_daemon_ports_walk(nw_daemon* daemon, nw_ports_walk_callback callback, void* data);
+ nw_port* nw_daemon_get_port_by_name(nw_daemon* daemon, const char* name);
+
+ /*
+diff --git a/src/networkd/link.c b/src/networkd/link.c
+index 949d0d8..09b9a62 100644
+--- a/src/networkd/link.c
++++ b/src/networkd/link.c
+@@ -114,6 +114,10 @@ int nw_link_ifindex(nw_link* link) {
+ }
+
+ const char* nw_link_ifname(nw_link* link) {
++ // Return NULL if name isn't set
++ if (!*link->ifname)
++ return NULL;
++
+ return link->ifname;
+ }
+
+@@ -154,6 +158,12 @@ static int nw_link_update_ifname(nw_link* link, sd_netlink_message* message) {
+
+ DEBUG("Link %d has been renamed to '%s'\n", link->ifindex, link->ifname);
+
++ // Assign link to ports
++ nw_daemon_ports_walk(link->daemon, __nw_port_set_link, link);
++
++ // Assign link to zones
++ nw_daemon_zones_walk(link->daemon, __nw_zone_set_link, link);
++
+ return 0;
+ }
+
+diff --git a/src/networkd/links.c b/src/networkd/links.c
+index 3dd06d0..40926f3 100644
+--- a/src/networkd/links.c
++++ b/src/networkd/links.c
+@@ -141,6 +141,12 @@ void nw_links_drop_link(nw_links* links, struct nw_link* link) {
+
+ STAILQ_REMOVE(&links->entries, entry, nw_links_entry, nodes);
+ links->num--;
++
++ // Drop link from all ports
++ nw_daemon_ports_walk(links->daemon, __nw_port_drop_link, link);
++
++ // Drop link from all zones
++ nw_daemon_zones_walk(links->daemon, __nw_zone_drop_link, link);
+ }
+
+ int nw_links_enumerate(nw_links* links) {
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index 7d02305..37ab3a7 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -135,39 +135,65 @@ static nw_port_type_t nw_port_setup_type(nw_port* port) {
+ return nw_port_type_from_string(type);
+ }
+
++static int nw_port_set_link(nw_port* port, nw_link* link) {
++ // Do nothing if the same link is being re-assigned
++ if (port->link == link)
++ return 0;
++
++ // Dereference the former link if set
++ if (port->link)
++ nw_link_unref(port->link);
++
++ // Store the new link
++ if (link) {
++ port->link = nw_link_ref(link);
++
++ DEBUG("Port %s: Assigned link %d\n", port->name, nw_link_ifindex(port->link));
++
++ // Or clear the pointer if no link has been provided
++ } else {
++ port->link = NULL;
++
++ DEBUG("Port %s: Removed link\n", port->name);
++ }
++
++ return 0;
++}
++
+ static int nw_port_setup(nw_port* port) {
++ nw_link* link = NULL;
+ char path[PATH_MAX];
+ int r;
+
+ // Find the link
+- port->link = nw_daemon_get_link_by_name(port->daemon, port->name);
+- if (port->link) {
+- DEBUG("%s: Found matching link %d\n", port->name, nw_link_ifindex(port->link));
+- } else {
+- DEBUG("%s: Could not find matching link\n", port->name);
++ link = nw_daemon_get_link_by_name(port->daemon, port->name);
++ if (link) {
++ r = nw_port_set_link(port, link);
++ if (r)
++ goto ERROR;
+ }
+
+ // Compose the path to the main configuration file
+ r = nw_path_join(path, PORT_CONFIG_DIR, port->name);
+ if (r)
+- return r;
++ goto ERROR;
+
+ // Initialize the configuration
+ r = nw_config_create(&port->config, path);
+ if (r)
+- return r;
++ goto ERROR;
+
+ // Determine type
+ port->type = nw_port_setup_type(port);
+ if (!port->type) {
+ ERROR("Could not determine type of port %s\n", port->name);
+- return 0;
++ goto ERROR;
+ }
+
+ // Perform some common initialization
+ r = nw_port_setup_common(port);
+ if (r)
+- return r;
++ goto ERROR;
+
+ // Call any custom initialization
+ switch (port->type) {
+@@ -177,7 +203,11 @@ static int nw_port_setup(nw_port* port) {
+ break;
+ }
+
+- return 0;
++ERROR:
++ if (link)
++ nw_link_unref(link);
++
++ return r;
+ }
+
+ int nw_port_create(nw_port** port, nw_daemon* daemon, const char* name) {
+@@ -252,11 +282,35 @@ char* nw_port_bus_path(nw_port* port) {
+ return p;
+ }
+
+-static nw_link* nw_port_get_link(nw_port* port) {
+- if (!port->link)
+- return NULL;
++int __nw_port_set_link(nw_daemon* daemon, nw_port* port, void* data) {
++ nw_link* link = (nw_link*)data;
++
++ // Fetch the link name
++ const char* ifname = nw_link_ifname(link);
++ if (!ifname) {
++ ERROR("Link does not have a name set\n");
++ return 1;
++ }
++
++ // Set link if the name matches
++ if (strcmp(port->name, ifname) == 0)
++ return nw_port_set_link(port, link);
++
++ // If we have the link set but the name did not match, we will remove it
++ else if (port->link == link)
++ return nw_port_set_link(port, NULL);
++
++ return 0;
++}
++
++int __nw_port_drop_link(nw_daemon* daemon, nw_port* port, void* data) {
++ nw_link* link = (nw_link*)data;
+
+- return nw_link_ref(port->link);
++ // Drop the link if it matches
++ if (port->link == link)
++ return nw_port_set_link(port, NULL);
++
++ return 0;
+ }
+
+ const nw_address_t* nw_port_get_address(nw_port* port) {
+diff --git a/src/networkd/port.h b/src/networkd/port.h
+index 17c8c3c..3981c82 100644
+--- a/src/networkd/port.h
++++ b/src/networkd/port.h
+@@ -44,6 +44,9 @@ const char* nw_port_name(nw_port* port);
+
+ char* nw_port_bus_path(nw_port* port);
+
++int __nw_port_set_link(nw_daemon* daemon, nw_port* port, void* data);
++int __nw_port_drop_link(nw_daemon* daemon, nw_port* port, void* data);
++
+ const nw_address_t* nw_port_get_address(nw_port* port);
+
+ int nw_port_reconfigure(nw_port* port);
+diff --git a/src/networkd/zone.c b/src/networkd/zone.c
+index 9daa0d3..00ab017 100644
+--- a/src/networkd/zone.c
++++ b/src/networkd/zone.c
+@@ -80,29 +80,59 @@ static void nw_zone_free(nw_zone* zone) {
+ free(zone);
+ }
+
++static int nw_zone_set_link(nw_zone* zone, nw_link* link) {
++ // Do nothing if the same link is being re-assigned
++ if (zone->link == link)
++ return 0;
++
++ // Dereference the former link if set
++ if (zone->link)
++ nw_link_unref(zone->link);
++
++ // Store the new link
++ if (link) {
++ zone->link = nw_link_ref(link);
++
++ DEBUG("Zone %s: Assigned link %d\n", zone->name, nw_link_ifindex(zone->link));
++
++ // Or clear the pointer if no link has been provided
++ } else {
++ zone->link = NULL;
++
++ DEBUG("Zone %s: Removed link\n", zone->name);
++ }
++
++ return 0;
++}
++
+ static int nw_zone_setup(nw_zone* zone) {
++ nw_link* link = NULL;
+ char path[PATH_MAX];
+ int r;
+
+ // Find the link
+- zone->link = nw_daemon_get_link_by_name(zone->daemon, zone->name);
+- if (zone->link) {
+- DEBUG("%s: Found matching link %d\n", zone->name, nw_link_ifindex(zone->link));
+- } else {
+- DEBUG("%s: Could not find matching link\n", zone->name);
++ link = nw_daemon_get_link_by_name(zone->daemon, zone->name);
++ if (link) {
++ r = nw_zone_set_link(zone, link);
++ if (r)
++ goto ERROR;
+ }
+
+ // Compose the path to the main configuration file
+ r = nw_zone_path(zone, path, "%s", "settings");
+ if (r)
+- return r;
++ goto ERROR;
+
+ // Initialize the configuration
+ r = nw_config_create(&zone->config, path);
+ if (r)
+- return r;
++ goto ERROR;
+
+- return 0;
++ERROR:
++ if (link)
++ nw_link_unref(link);
++
++ return r;
+ }
+
+ int nw_zone_create(nw_zone** zone, nw_daemon* daemon, const char* name) {
+@@ -177,11 +207,35 @@ char* nw_zone_bus_path(nw_zone* zone) {
+ return p;
+ }
+
+-static nw_link* nw_zone_get_link(nw_zone* zone) {
+- if (!zone->link)
+- return NULL;
++int __nw_zone_set_link(nw_daemon* daemon, nw_zone* zone, void* data) {
++ nw_link* link = (nw_link*)data;
++
++ // Fetch the link name
++ const char* ifname = nw_link_ifname(link);
++ if (!ifname) {
++ ERROR("Link does not have a name set\n");
++ return 1;
++ }
++
++ // Set link if the name matches
++ if (strcmp(zone->name, ifname) == 0)
++ return nw_zone_set_link(zone, link);
++
++ // If we have the link set but the name did not match, we will remove it
++ else if (zone->link == link)
++ return nw_zone_set_link(zone, NULL);
+
+- return nw_link_ref(zone->link);
++ return 0;
++}
++
++int __nw_zone_drop_link(nw_daemon* daemon, nw_zone* zone, void* data) {
++ nw_link* link = (nw_link*)data;
++
++ // Drop the link if it matches
++ if (zone->link == link)
++ return nw_zone_set_link(zone, NULL);
++
++ return 0;
+ }
+
+ int nw_zone_reconfigure(nw_zone* zone) {
+diff --git a/src/networkd/zone.h b/src/networkd/zone.h
+index 591e467..ad348d7 100644
+--- a/src/networkd/zone.h
++++ b/src/networkd/zone.h
+@@ -41,6 +41,9 @@ const char* nw_zone_name(nw_zone* zone);
+
+ char* nw_zone_bus_path(nw_zone* zone);
+
++int __nw_zone_set_link(nw_daemon* daemon, nw_zone* zone, void* data);
++int __nw_zone_drop_link(nw_daemon* daemon, nw_zone* zone, void* data);
++
+ int nw_zone_reconfigure(nw_zone* zone);
+
+ int nw_zone_has_carrier(nw_zone* zone);
+--
+2.39.2
+
diff --git a/network/patches/0228-networkd-ports-Create-dummy-function-to-create-links.patch b/network/patches/0228-networkd-ports-Create-dummy-function-to-create-links.patch
new file mode 100644
index 000000000..3e5f06ff3
--- /dev/null
+++ b/network/patches/0228-networkd-ports-Create-dummy-function-to-create-links.patch
@@ -0,0 +1,46 @@
+From 96b1b84d857124d5b145859e25e3bfe7572eeb73 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 14 Apr 2023 14:29:22 +0000
+Subject: [PATCH 228/304] networkd: ports: Create dummy function to create
+ links
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/port.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index 37ab3a7..5694024 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -321,6 +321,10 @@ static int nw_port_is_disabled(nw_port* port) {
+ return nw_config_get_bool(port->config, "DISABLED");
+ }
+
++static int nw_port_create_link(nw_port* port) {
++ return 0; // XXX TODO
++}
++
+ int nw_port_reconfigure(nw_port* port) {
+ int r;
+
+@@ -335,7 +339,16 @@ int nw_port_reconfigure(nw_port* port) {
+ return 0;
+ }
+
++ // If there is no link, we will try to create it
++ if (!port->link) {
++ r = nw_port_create_link(port);
++ if (r)
++ return r;
++ }
++
+ // XXX TODO
++
++ return 0;
+ }
+
+ int nw_port_has_carrier(nw_port* port) {
+--
+2.39.2
+
diff --git a/network/patches/0229-networkd-daemon-Correctly-store-reference-to-bus.patch b/network/patches/0229-networkd-daemon-Correctly-store-reference-to-bus.patch
new file mode 100644
index 000000000..fbf54fce6
--- /dev/null
+++ b/network/patches/0229-networkd-daemon-Correctly-store-reference-to-bus.patch
@@ -0,0 +1,157 @@
+From 442b2fc2a34e8f6b7343d616d07c1aecb667a652 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 14 Apr 2023 17:35:48 +0000
+Subject: [PATCH 229/304] networkd: daemon: Correctly store reference to bus
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/bus.c | 30 +++++++++++++++++-------------
+ src/networkd/bus.h | 2 +-
+ src/networkd/daemon.c | 2 +-
+ 3 files changed, 19 insertions(+), 15 deletions(-)
+
+diff --git a/src/networkd/bus.c b/src/networkd/bus.c
+index 1daa035..8158c84 100644
+--- a/src/networkd/bus.c
++++ b/src/networkd/bus.c
+@@ -36,18 +36,19 @@ static int nw_bus_on_connect(sd_bus_message* m, void* data, sd_bus_error* error)
+ return 0;
+ }
+
+-int nw_bus_connect(sd_bus* bus, sd_event* loop, nw_daemon* daemon) {
++int nw_bus_connect(sd_bus** bus, sd_event* loop, nw_daemon* daemon) {
++ sd_bus* b = NULL;
+ int r;
+
+ // Create a bus object
+- r = sd_bus_new(&bus);
++ r = sd_bus_new(&b);
+ if (r < 0) {
+ ERROR("Could not allocate a bus object: %s\n", strerror(-r));
+ return 1;
+ }
+
+ // Set description
+- r = sd_bus_set_description(bus, NETWORKD_BUS_DESCRIPTION);
++ r = sd_bus_set_description(b, NETWORKD_BUS_DESCRIPTION);
+ if (r < 0) {
+ ERROR("Could not set bus description: %s\n", strerror(-r));
+ return 1;
+@@ -58,21 +59,21 @@ int nw_bus_connect(sd_bus* bus, sd_event* loop, nw_daemon* daemon) {
+ address = DEFAULT_SYSTEM_BUS_ADDRESS;
+
+ // Set bus address
+- r = sd_bus_set_address(bus, address);
++ r = sd_bus_set_address(b, address);
+ if (r < 0) {
+ ERROR("Could not set bus address: %s\n", strerror(-r));
+ return 1;
+ }
+
+ // Set bus client
+- r = sd_bus_set_bus_client(bus, 1);
++ r = sd_bus_set_bus_client(b, 1);
+ if (r < 0) {
+ ERROR("Could not set bus client: %s\n", strerror(-r));
+ return 1;
+ }
+
+ // Request some credentials for all messages
+- r = sd_bus_negotiate_creds(bus, 1,
++ r = sd_bus_negotiate_creds(b, 1,
+ SD_BUS_CREDS_UID|SD_BUS_CREDS_EUID|SD_BUS_CREDS_EFFECTIVE_CAPS);
+ if (r < 0) {
+ ERROR("Could not negotiate creds: %s\n", strerror(-r));
+@@ -80,53 +81,56 @@ int nw_bus_connect(sd_bus* bus, sd_event* loop, nw_daemon* daemon) {
+ }
+
+ // Automatically bind when the socket is available
+- r = sd_bus_set_watch_bind(bus, 1);
++ r = sd_bus_set_watch_bind(b, 1);
+ if (r < 0) {
+ ERROR("Could not watch socket: %s\n", strerror(-r));
+ return 1;
+ }
+
+ // Emit a connected signal when we are connected
+- r = sd_bus_set_connected_signal(bus, 1);
++ r = sd_bus_set_connected_signal(b, 1);
+ if (r < 0) {
+ ERROR("Could not enable sending a connect signal: %s\n", strerror(-r));
+ return 1;
+ }
+
+ // Connect to the bus
+- r = sd_bus_start(bus);
++ r = sd_bus_start(b);
+ if (r < 0) {
+ ERROR("Could not connect to bus: %s\n", strerror(-r));
+ return 1;
+ }
+
+ // Register the implementation
+- r = nw_bus_register_implementation(bus, &daemon_bus_impl, daemon);
++ r = nw_bus_register_implementation(b, &daemon_bus_impl, daemon);
+ if (r)
+ return r;
+
+ // Request interface name
+- r = sd_bus_request_name_async(bus, NULL, "org.ipfire.network1", 0, NULL, NULL);
++ r = sd_bus_request_name_async(b, NULL, "org.ipfire.network1", 0, NULL, NULL);
+ if (r < 0) {
+ ERROR("Could not request bus name: %s\n", strerror(-r));
+ return 1;
+ }
+
+ // Attach the event loop
+- r = sd_bus_attach_event(bus, loop, 0);
++ r = sd_bus_attach_event(b, loop, 0);
+ if (r < 0) {
+ ERROR("Could not attach bus to event loop: %s\n", strerror(-r));
+ return 1;
+ }
+
+ // Request receiving a connect signal
+- r = sd_bus_match_signal_async(bus, NULL, "org.freedesktop.DBus.Local",
++ r = sd_bus_match_signal_async(b, NULL, "org.freedesktop.DBus.Local",
+ NULL, "org.freedesktop.DBus.Local", "Connected", nw_bus_on_connect, NULL, NULL);
+ if (r < 0) {
+ ERROR("Could not request match on Connected signal: %s\n", strerror(-r));
+ return 1;
+ }
+
++ // Return reference
++ *bus = b;
++
+ return 0;
+ }
+
+diff --git a/src/networkd/bus.h b/src/networkd/bus.h
+index 05b4c63..29b1b4a 100644
+--- a/src/networkd/bus.h
++++ b/src/networkd/bus.h
+@@ -30,7 +30,7 @@
+
+ #include "daemon.h"
+
+-int nw_bus_connect(sd_bus* bus, sd_event* loop, nw_daemon* daemon);
++int nw_bus_connect(sd_bus** bus, sd_event* loop, nw_daemon* daemon);
+
+ struct nw_bus_vtable_pair {
+ const sd_bus_vtable* vtable;
+diff --git a/src/networkd/daemon.c b/src/networkd/daemon.c
+index 02ca8e2..c8e65f4 100644
+--- a/src/networkd/daemon.c
++++ b/src/networkd/daemon.c
+@@ -341,7 +341,7 @@ static int nw_daemon_setup(nw_daemon* daemon) {
+ return r;
+
+ // Connect to the system bus
+- r = nw_bus_connect(daemon->bus, daemon->loop, daemon);
++ r = nw_bus_connect(&daemon->bus, daemon->loop, daemon);
+ if (r)
+ return r;
+
+--
+2.39.2
+
diff --git a/network/patches/0230-networkd-Collect-stats-regulary-and-emit-them-on-dbu.patch b/network/patches/0230-networkd-Collect-stats-regulary-and-emit-them-on-dbu.patch
new file mode 100644
index 000000000..34057f31b
--- /dev/null
+++ b/network/patches/0230-networkd-Collect-stats-regulary-and-emit-them-on-dbu.patch
@@ -0,0 +1,667 @@
+From 15240e0819685c30a4955ae161374b5a3fc9d313 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 14 Apr 2023 17:43:12 +0000
+Subject: [PATCH 230/304] networkd: Collect stats regulary and emit them on
+ dbus
+
+This is useful for us monitoring interface throughput (e.g. in
+collecty).
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 2 +
+ src/networkd/daemon.c | 44 ++++++++
+ src/networkd/daemon.h | 6 +
+ src/networkd/link.c | 81 ++++++++++++++
+ src/networkd/link.h | 6 +
+ src/networkd/port.c | 31 +++++-
+ src/networkd/port.h | 5 +
+ src/networkd/stats-collector.c | 197 +++++++++++++++++++++++++++++++++
+ src/networkd/stats-collector.h | 37 +++++++
+ src/networkd/zone.c | 30 +++++
+ src/networkd/zone.h | 6 +
+ 11 files changed, 444 insertions(+), 1 deletion(-)
+ create mode 100644 src/networkd/stats-collector.c
+ create mode 100644 src/networkd/stats-collector.h
+
+diff --git a/Makefile.am b/Makefile.am
+index 80a7236..22d90d4 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -332,6 +332,8 @@ dist_networkd_SOURCES = \
+ src/networkd/port.h \
+ src/networkd/port-bus.c \
+ src/networkd/port-bus.h \
++ src/networkd/stats-collector.c \
++ src/networkd/stats-collector.h \
+ src/networkd/string.h \
+ src/networkd/util.c \
+ src/networkd/util.h \
+diff --git a/src/networkd/daemon.c b/src/networkd/daemon.c
+index c8e65f4..749a70b 100644
+--- a/src/networkd/daemon.c
++++ b/src/networkd/daemon.c
+@@ -35,6 +35,7 @@
+ #include "links.h"
+ #include "logging.h"
+ #include "ports.h"
++#include "stats-collector.h"
+ #include "zone.h"
+ #include "zones.h"
+
+@@ -67,6 +68,8 @@ struct nw_daemon {
+ // Ports
+ nw_ports* ports;
+
++ // Stats Collector
++ sd_event_source* stats_collector_event;
+ };
+
+ static int __nw_daemon_terminate(sd_event_source* source, const struct signalfd_siginfo* si,
+@@ -322,6 +325,33 @@ static int nw_daemon_reconfigure(nw_daemon* daemon) {
+ return 0;
+ }
+
++static int nw_daemon_starts_stats_collector(nw_daemon* daemon) {
++ sd_event_source* s = NULL;
++ int r;
++
++ // Register the stats collector main function
++ r = sd_event_add_time_relative(daemon->loop, &s, CLOCK_MONOTONIC, 0, 0,
++ nw_stats_collector, daemon);
++ if (r < 0) {
++ ERROR("Could not start the stats collector: %m\n");
++ goto ERROR;
++ }
++
++ // Keep calling the stats collector for forever
++ r = sd_event_source_set_enabled(s, SD_EVENT_ON);
++ if (r < 0)
++ goto ERROR;
++
++ // Keep a reference to the event source
++ daemon->stats_collector_event = sd_event_source_ref(s);
++
++ERROR:
++ if (s)
++ sd_event_source_unref(s);
++
++ return r;
++}
++
+ static int nw_daemon_setup(nw_daemon* daemon) {
+ int r;
+
+@@ -360,6 +390,11 @@ static int nw_daemon_setup(nw_daemon* daemon) {
+ if (r)
+ return r;
+
++ // Start the stats collector
++ r = nw_daemon_starts_stats_collector(daemon);
++ if (r)
++ return r;
++
+ return 0;
+ }
+
+@@ -404,6 +439,8 @@ static void nw_daemon_free(nw_daemon* daemon) {
+ // Cleanup common objects
+ nw_daemon_cleanup(daemon);
+
++ if (daemon->stats_collector_event)
++ sd_event_source_unref(daemon->stats_collector_event);
+ if (daemon->bus)
+ sd_bus_unref(daemon->bus);
+ if (daemon->loop)
+@@ -498,6 +535,13 @@ int nw_daemon_save(nw_daemon* daemon) {
+ return 0;
+ }
+
++/*
++ Bus
++*/
++sd_bus* nw_daemon_get_bus(nw_daemon* daemon) {
++ return daemon->bus;
++}
++
+ /*
+ Netlink
+ */
+diff --git a/src/networkd/daemon.h b/src/networkd/daemon.h
+index a14d33b..74e19e6 100644
+--- a/src/networkd/daemon.h
++++ b/src/networkd/daemon.h
+@@ -21,6 +21,7 @@
+ #ifndef NETWORKD_DAEMON_H
+ #define NETWORKD_DAEMON_H
+
++#include <systemd/sd-bus.h>
+ #include <systemd/sd-netlink.h>
+
+ typedef struct nw_daemon nw_daemon;
+@@ -43,6 +44,11 @@ int nw_daemon_reload(nw_daemon* daemon);
+
+ int nw_daemon_save(nw_daemon* daemon);
+
++/*
++ Bus
++*/
++sd_bus* nw_daemon_get_bus(nw_daemon* daemon);
++
+ /*
+ Netlink
+ */
+diff --git a/src/networkd/link.c b/src/networkd/link.c
+index 09b9a62..1edf20d 100644
+--- a/src/networkd/link.c
++++ b/src/networkd/link.c
+@@ -19,6 +19,7 @@
+ #############################################################################*/
+
+ #include <linux/if.h>
++#include <linux/if_link.h>
+ #include <stddef.h>
+ #include <stdlib.h>
+ #include <string.h>
+@@ -46,6 +47,9 @@ struct nw_link {
+ NW_LINK_DESTROYED,
+ } state;
+
++ // Stats
++ struct rtnl_link_stats64 stats64;
++
+ // MTU
+ uint32_t mtu;
+ uint32_t min_mtu;
+@@ -121,6 +125,83 @@ const char* nw_link_ifname(nw_link* link) {
+ return link->ifname;
+ }
+
++// Stats
++
++const struct rtnl_link_stats64* nw_link_get_stats64(nw_link* link) {
++ return &link->stats64;
++}
++
++static int nw_link_call_getlink(nw_link* link,
++ int (*callback)(sd_netlink* rtnl, sd_netlink_message* m, void* data)) {
++ sd_netlink_message* m = NULL;
++ int r;
++
++ sd_netlink* rtnl = nw_daemon_get_rtnl(link->daemon);
++ if (!rtnl)
++ return 1;
++
++ // Create a new message
++ r = sd_rtnl_message_new_link(rtnl, &m, RTM_GETLINK, link->ifindex);
++ if (r < 0) {
++ ERROR("Could not allocate RTM_GETLINK message: %m\n");
++ goto ERROR;
++ }
++
++ // Send the message
++ r = sd_netlink_call_async(rtnl, NULL, m, callback,
++ __nw_link_unref, nw_link_ref(link), -1, NULL);
++ if (r < 0) {
++ ERROR("Could not send rtnetlink message: %m\n");
++ goto ERROR;
++ }
++
++ERROR:
++ if (m)
++ sd_netlink_message_unref(m);
++
++ return r;
++}
++
++static int __nw_link_update_stats(sd_netlink* rtnl, sd_netlink_message* m, void* data) {
++ nw_link* link = (nw_link*)data;
++ int r;
++
++ // Fetch the stats
++ r = sd_netlink_message_read(m, IFLA_STATS64, sizeof(link->stats64), &link->stats64);
++ if (r < 0)
++ return r;
++
++ DEBUG("Link %d: Stats updated\n", link->ifindex);
++
++ // Log stats
++ DEBUG(" Packets : RX: %12llu, TX: %12llu\n",
++ link->stats64.rx_packets, link->stats64.tx_packets);
++ DEBUG(" Bytes : RX: %12llu, TX: %12llu\n",
++ link->stats64.rx_bytes, link->stats64.tx_bytes);
++ DEBUG(" Errors : RX: %12llu, TX: %12llu\n",
++ link->stats64.rx_errors, link->stats64.tx_errors);
++ DEBUG(" Dropped : RX: %12llu, TX: %12llu\n",
++ link->stats64.rx_dropped, link->stats64.rx_dropped);
++ DEBUG(" Multicast : %llu\n", link->stats64.multicast);
++ DEBUG(" Collisions : %llu\n", link->stats64.collisions);
++
++ // Notify ports that stats have been updated
++ r = nw_daemon_ports_walk(link->daemon, __nw_port_update_stats, link);
++ if (r)
++ return r;
++
++ // Notify zones that stats have been updated
++ r = nw_daemon_zones_walk(link->daemon, __nw_zone_update_stats, link);
++ if (r)
++ return r;
++
++ return 0;
++}
++
++int nw_link_update_stats(nw_link* link) {
++ return nw_link_call_getlink(link, __nw_link_update_stats);
++}
++
+ // Carrier
+
+ int nw_link_has_carrier(nw_link* link) {
+diff --git a/src/networkd/link.h b/src/networkd/link.h
+index 58a825a..2bab47c 100644
+--- a/src/networkd/link.h
++++ b/src/networkd/link.h
+@@ -21,6 +21,8 @@
+ #ifndef NETWORKD_LINK_H
+ #define NETWORKD_LINK_H
+
++#include <linux/if_link.h>
++
+ typedef struct nw_link nw_link;
+
+ #include "daemon.h"
+@@ -33,6 +35,10 @@ nw_link* nw_link_unref(nw_link* link);
+ int nw_link_ifindex(nw_link* link);
+ const char* nw_link_ifname(nw_link* link);
+
++// Stats
++const struct rtnl_link_stats64* nw_link_get_stats64(nw_link* link);
++int nw_link_update_stats(nw_link* link);
++
+ int nw_link_has_carrier(nw_link* link);
+
+ int nw_link_process(sd_netlink* rtnl, sd_netlink_message* message, void* data);
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index 5694024..7638c7b 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -29,8 +29,9 @@
+ #include "config.h"
+ #include "link.h"
+ #include "logging.h"
+-#include "string.h"
+ #include "port.h"
++#include "stats-collector.h"
++#include "string.h"
+
+ struct nw_port {
+ nw_daemon* daemon;
+@@ -357,3 +358,31 @@ int nw_port_has_carrier(nw_port* port) {
+
+ return nw_link_has_carrier(port->link);
+ }
++
++/*
++ Stats
++*/
++
++const struct rtnl_link_stats64* nw_port_get_stats64(nw_port* port) {
++ if (!port->link)
++ return NULL;
++
++ return nw_link_get_stats64(port->link);
++}
++
++int __nw_port_update_stats(nw_daemon* daemon, nw_port* port, void* data) {
++ nw_link* link = (nw_link*)data;
++
++ // Emit stats if link matches
++ if (port->link == link)
++ return nw_stats_collector_emit_port_stats(daemon, port);
++
++ return 0;
++}
++
++int nw_port_update_stats(nw_port* port) {
++ if (port->link)
++ return nw_link_update_stats(port->link);
++
++ return 0;
++}
+diff --git a/src/networkd/port.h b/src/networkd/port.h
+index 3981c82..9dcd6c2 100644
+--- a/src/networkd/port.h
++++ b/src/networkd/port.h
+@@ -53,4 +53,9 @@ int nw_port_reconfigure(nw_port* port);
+
+ int nw_port_has_carrier(nw_port* port);
+
++// Stats
++const struct rtnl_link_stats64* nw_port_get_stats64(nw_port* port);
++int __nw_port_update_stats(nw_daemon* daemon, nw_port* port, void* data);
++int nw_port_update_stats(nw_port* port);
++
+ #endif /* NETWORKD_PORT_H */
+diff --git a/src/networkd/stats-collector.c b/src/networkd/stats-collector.c
+new file mode 100644
+index 0000000..c10602e
+--- /dev/null
++++ b/src/networkd/stats-collector.c
+@@ -0,0 +1,197 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#include <stdlib.h>
++
++#include <systemd/sd-bus.h>
++#include <systemd/sd-event.h>
++
++#include "logging.h"
++#include "port.h"
++#include "stats-collector.h"
++#include "zone.h"
++
++static int __nw_stats_collector_port(nw_daemon* daemon, nw_port* port, void* data) {
++ return nw_port_update_stats(port);
++}
++
++static int __nw_stats_collector_zone(nw_daemon* daemon, nw_zone* zone, void* data) {
++ return nw_zone_update_stats(zone);
++}
++
++int nw_stats_collector(sd_event_source* s, long unsigned int usec, void* data) {
++ nw_daemon* daemon = (nw_daemon*)data;
++ int r;
++
++ DEBUG("Stats collector has been called\n");
++
++ // Schedule the next call
++ r = sd_event_source_set_time(s, usec + NW_STATS_COLLECTOR_INTERVAL);
++ if (r < 0)
++ return r;
++
++ // Ports
++ r = nw_daemon_ports_walk(daemon, __nw_stats_collector_port, NULL);
++ if (r)
++ return r;
++
++ // Zones
++ r = nw_daemon_zones_walk(daemon, __nw_stats_collector_zone, NULL);
++ if (r)
++ return r;
++
++ return 0;
++}
++
++static int nw_stats_collector_emit_stats(nw_daemon* daemon, const char* path,
++ const char* interface, const char* member, const struct rtnl_link_stats64* stats64) {
++ sd_bus_message* m = NULL;
++ int r;
++
++ sd_bus* bus = nw_daemon_get_bus(daemon);
++
++ // Allocate a new message
++ r = sd_bus_message_new_signal(bus, &m, path, interface, member);
++ if (r < 0) {
++ errno = -r;
++ ERROR("Could not allocate bus message: %m\n");
++ goto ERROR;
++ }
++
++ // Open the container
++ r = sd_bus_message_open_container(m, 'a', "{st}");
++ if (r < 0) {
++ ERROR("Could not open container: %m\n");
++ goto ERROR;
++ }
++
++ const struct stats64_entry {
++ const char* key;
++ uint64_t value;
++ } entries[] = {
++ { "rx-packets", stats64->rx_packets },
++ { "tx-packets", stats64->tx_packets },
++ { "rx-bytes", stats64->rx_bytes },
++ { "tx-bytes", stats64->tx_bytes },
++ { "rx-errors", stats64->rx_errors },
++ { "tx-errors", stats64->tx_errors },
++ { "rx-dropped", stats64->rx_dropped },
++ { "tx-dropped", stats64->tx_dropped },
++ { "multicast", stats64->multicast },
++ { "collisions", stats64->collisions },
++
++ // Detailed RX errors
++ { "rx-length-errors", stats64->rx_length_errors },
++ { "rx-over-errors", stats64->rx_over_errors },
++ { "rx-crc-errors", stats64->rx_crc_errors },
++ { "rx-frame-errors", stats64->rx_frame_errors },
++ { "rx-fifo-errors", stats64->rx_fifo_errors },
++ { "rx-missed-errors", stats64->rx_missed_errors },
++
++ // Detailed TX errors
++ { "tx-aborted-errors", stats64->tx_aborted_errors },
++ { "tx-carrier-errors", stats64->tx_carrier_errors },
++ { "tx-fifo-errors", stats64->tx_fifo_errors },
++ { "tx-heartbeat-errors", stats64->tx_heartbeat_errors },
++ { "tx-window-errors", stats64->tx_window_errors },
++
++ { NULL },
++ };
++
++ for (const struct stats64_entry* e = entries; e->key; e++) {
++ r = sd_bus_message_append(m, "{st}", e->key, e->value);
++ if (r < 0) {
++ ERROR("Could not set stat value: %m\n");
++ goto ERROR;
++ }
++ }
++
++ // Close the container
++ r = sd_bus_message_close_container(m);
++ if (r < 0) {
++ ERROR("Could not close container: %m\n");
++ goto ERROR;
++ }
++
++ // Emit the signal
++ r = sd_bus_send(bus, m, NULL);
++ if (r < 0) {
++ ERROR("Could not emit the stats signal for %s: %m\n", path);
++ goto ERROR;
++ }
++
++ERROR:
++ if (m)
++ sd_bus_message_unref(m);
++
++ return r;
++}
++
++int nw_stats_collector_emit_port_stats(nw_daemon* daemon, nw_port* port) {
++ const struct rtnl_link_stats64* stats64 = NULL;
++ char* path = NULL;
++ int r;
++
++ // Fetch the bus path
++ path = nw_port_bus_path(port);
++
++ // Fetch the stats
++ stats64 = nw_port_get_stats64(port);
++
++ // Emit the stats
++ r = nw_stats_collector_emit_stats(daemon, path,
++ "org.ipfire.network1.Port", "Stats", stats64);
++ if (r < 0) {
++ ERROR("Could not emit stats for port %s: %m\n", nw_port_name(port));
++ goto ERROR;
++ }
++
++ERROR:
++ if (path)
++ free(path);
++
++ return r;
++}
++
++int nw_stats_collector_emit_zone_stats(nw_daemon* daemon, nw_zone* zone) {
++ const struct rtnl_link_stats64* stats64 = NULL;
++ char* path = NULL;
++ int r;
++
++ // Fetch the bus path
++ path = nw_zone_bus_path(zone);
++
++ // Fetch the stats
++ stats64 = nw_zone_get_stats64(zone);
++
++ // Emit the stats
++ r = nw_stats_collector_emit_stats(daemon, path,
++ "org.ipfire.network1.Zone", "Stats", stats64);
++ if (r < 0) {
++ ERROR("Could not emit stats for zone %s: %m\n", nw_zone_name(zone));
++ goto ERROR;
++ }
++
++ERROR:
++ if (path)
++ free(path);
++
++ return r;
++}
+diff --git a/src/networkd/stats-collector.h b/src/networkd/stats-collector.h
+new file mode 100644
+index 0000000..ea11c11
+--- /dev/null
++++ b/src/networkd/stats-collector.h
+@@ -0,0 +1,37 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#ifndef NETWORKD_STATS_COLLECTOR_H
++#define NETWORKD_STATS_COLLECTOR_H
++
++#include <systemd/sd-event.h>
++
++#include "daemon.h"
++#include "port.h"
++#include "zone.h"
++
++#define NW_STATS_COLLECTOR_INTERVAL 15 * 1000000ULL // 15 sec in µsec
++
++int nw_stats_collector(sd_event_source* s, long unsigned int usec, void* data);
++
++int nw_stats_collector_emit_port_stats(nw_daemon* daemon, nw_port* port);
++int nw_stats_collector_emit_zone_stats(nw_daemon* daemon, nw_zone* zone);
++
++#endif /* NETWORKD_STATS_COLLECTOR_H */
+diff --git a/src/networkd/zone.c b/src/networkd/zone.c
+index 00ab017..3f47a26 100644
+--- a/src/networkd/zone.c
++++ b/src/networkd/zone.c
+@@ -19,6 +19,7 @@
+ #############################################################################*/
+
+ #include <limits.h>
++#include <linux/if_link.h>
+ #include <stdlib.h>
+
+ #include <systemd/sd-bus.h>
+@@ -27,6 +28,7 @@
+ #include "daemon.h"
+ #include "link.h"
+ #include "logging.h"
++#include "stats-collector.h"
+ #include "string.h"
+ #include "zone.h"
+
+@@ -263,3 +265,31 @@ int nw_zone_set_mtu(nw_zone* zone, unsigned int mtu) {
+
+ return nw_config_set_int(zone->config, "MTU", mtu);
+ }
++
++/*
++ Stats
++*/
++
++const struct rtnl_link_stats64* nw_zone_get_stats64(nw_zone* zone) {
++ if (!zone->link)
++ return NULL;
++
++ return nw_link_get_stats64(zone->link);
++}
++
++int __nw_zone_update_stats(nw_daemon* daemon, nw_zone* zone, void* data) {
++ nw_link* link = (nw_link*)data;
++
++ // Emit stats if link matches
++ if (zone->link == link)
++ return nw_stats_collector_emit_zone_stats(daemon, zone);
++
++ return 0;
++}
++
++int nw_zone_update_stats(nw_zone* zone) {
++ if (zone->link)
++ return nw_link_update_stats(zone->link);
++
++ return 0;
++}
+diff --git a/src/networkd/zone.h b/src/networkd/zone.h
+index ad348d7..9737b45 100644
+--- a/src/networkd/zone.h
++++ b/src/networkd/zone.h
+@@ -28,6 +28,8 @@
+
+ typedef struct nw_zone nw_zone;
+
++#include <linux/if_link.h>
++
+ #include "daemon.h"
+
+ int nw_zone_create(nw_zone** zone, nw_daemon* daemon, const char* name);
+@@ -54,4 +56,8 @@ int nw_zone_has_carrier(nw_zone* zone);
+ unsigned int nw_zone_mtu(nw_zone* zone);
+ int nw_zone_set_mtu(nw_zone* zone, unsigned int mtu);
+
++const struct rtnl_link_stats64* nw_zone_get_stats64(nw_zone* zone);
++int __nw_zone_update_stats(nw_daemon* daemon, nw_zone* zone, void* data);
++int nw_zone_update_stats(nw_zone* zone);
++
+ #endif /* NETWORKD_ZONE_H */
+--
+2.39.2
+
diff --git a/network/patches/0231-address-Fix-output-buffer-size-when-formatting-MAC-a.patch b/network/patches/0231-address-Fix-output-buffer-size-when-formatting-MAC-a.patch
new file mode 100644
index 000000000..716fc51b3
--- /dev/null
+++ b/network/patches/0231-address-Fix-output-buffer-size-when-formatting-MAC-a.patch
@@ -0,0 +1,27 @@
+From 35bf96bb311d13924cd96668736b474c1576f553 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 15 Apr 2023 10:45:53 +0000
+Subject: [PATCH 231/304] address: Fix output buffer size when formatting MAC
+ addresses
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/address.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/networkd/address.h b/src/networkd/address.h
+index b7556f4..7937d62 100644
+--- a/src/networkd/address.h
++++ b/src/networkd/address.h
+@@ -43,7 +43,7 @@ static inline int nw_address_from_string(nw_address_t* addr, const char* s) {
+ }
+
+ static inline char* nw_address_to_string(const nw_address_t* addr) {
+- char buffer[18];
++ char buffer[20];
+
+ char* p = ether_ntoa_r(addr, buffer);
+ if (!p)
+--
+2.39.2
+
diff --git a/network/patches/0232-config-Fail-if-there-is-garbage-after-intergers.patch b/network/patches/0232-config-Fail-if-there-is-garbage-after-intergers.patch
new file mode 100644
index 000000000..d5b55cc45
--- /dev/null
+++ b/network/patches/0232-config-Fail-if-there-is-garbage-after-intergers.patch
@@ -0,0 +1,42 @@
+From 92c8a4fe8806d0a84f4c546be75c0f08dc6d7200 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 15 Apr 2023 10:46:32 +0000
+Subject: [PATCH 232/304] config: Fail if there is garbage after intergers
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/config.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/src/networkd/config.c b/src/networkd/config.c
+index d879ace..42e0172 100644
+--- a/src/networkd/config.c
++++ b/src/networkd/config.c
+@@ -348,13 +348,23 @@ int nw_config_set(nw_config* config, const char* key, const char* value) {
+ }
+
+ int nw_config_get_int(nw_config* config, const char* key, const int __default) {
++ char* p = NULL;
++ int r;
++
+ const char* value = nw_config_get(config, key);
+
+ // Return zero if not set
+ if (!value)
+ return __default;
+
+- return strtoul(value, NULL, 10);
++ // Parse the input
++ r = strtoul(value, &p, 10);
++
++ // If we have characters following the input, we throw it away
++ if (p)
++ return __default;
++
++ return r;
+ }
+
+ int nw_config_set_int(nw_config* config, const char* key, const int value) {
+--
+2.39.2
+
diff --git a/network/patches/0233-config-Avoid-adding-empty-line-after-integers.patch b/network/patches/0233-config-Avoid-adding-empty-line-after-integers.patch
new file mode 100644
index 000000000..6494350da
--- /dev/null
+++ b/network/patches/0233-config-Avoid-adding-empty-line-after-integers.patch
@@ -0,0 +1,26 @@
+From 2d00051763072b26fa5c1ba421afe2f0928d57ce Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 15 Apr 2023 11:13:22 +0000
+Subject: [PATCH 233/304] config: Avoid adding empty line after integers
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/config.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/networkd/config.c b/src/networkd/config.c
+index 42e0172..27cfad8 100644
+--- a/src/networkd/config.c
++++ b/src/networkd/config.c
+@@ -372,7 +372,7 @@ int nw_config_set_int(nw_config* config, const char* key, const int value) {
+ int r;
+
+ // Format the value as string
+- r = nw_string_format(__value, "%d\n", value);
++ r = nw_string_format(__value, "%d", value);
+ if (r)
+ return r;
+
+--
+2.39.2
+
diff --git a/network/patches/0234-ports-Require-type-to-be-set-at-all-times.patch b/network/patches/0234-ports-Require-type-to-be-set-at-all-times.patch
new file mode 100644
index 000000000..da6ff24ab
--- /dev/null
+++ b/network/patches/0234-ports-Require-type-to-be-set-at-all-times.patch
@@ -0,0 +1,133 @@
+From 06bc93d3136c4bd2d75f7c50051b8b96d29dab59 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 15 Apr 2023 11:15:15 +0000
+Subject: [PATCH 234/304] ports: Require type to be set at all times
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/port.c | 50 ++++++++++++++++++++++++++++++--------------
+ src/networkd/port.h | 5 ++++-
+ src/networkd/ports.c | 2 +-
+ 3 files changed, 39 insertions(+), 18 deletions(-)
+
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index 7638c7b..aad6210 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -128,14 +128,6 @@ static int nw_port_setup_common(nw_port* port) {
+ return 0;
+ }
+
+-static nw_port_type_t nw_port_setup_type(nw_port* port) {
+- const char* type = nw_config_get(port->config, "TYPE");
+- if (!type)
+- return NW_PORT_UNKNOWN;
+-
+- return nw_port_type_from_string(type);
+-}
+-
+ static int nw_port_set_link(nw_port* port, nw_link* link) {
+ // Do nothing if the same link is being re-assigned
+ if (port->link == link)
+@@ -184,13 +176,6 @@ static int nw_port_setup(nw_port* port) {
+ if (r)
+ goto ERROR;
+
+- // Determine type
+- port->type = nw_port_setup_type(port);
+- if (!port->type) {
+- ERROR("Could not determine type of port %s\n", port->name);
+- goto ERROR;
+- }
+-
+ // Perform some common initialization
+ r = nw_port_setup_common(port);
+ if (r)
+@@ -211,7 +196,7 @@ ERROR:
+ return r;
+ }
+
+-int nw_port_create(nw_port** port, nw_daemon* daemon, const char* name) {
++int nw_port_create(nw_port** port, nw_daemon* daemon, nw_port_type_t type, const char* name) {
+ int r;
+
+ // Allocate a new object
+@@ -225,6 +210,9 @@ int nw_port_create(nw_port** port, nw_daemon* daemon, const char* name) {
+ // Initialize reference counter
+ p->nrefs = 1;
+
++ // Store the type
++ p->type = type;
++
+ // Store the name
+ r = nw_string_set(p->name, name);
+ if (r)
+@@ -243,6 +231,36 @@ ERROR:
+ return r;
+ }
+
++int nw_port_create_from_config(nw_port** port, nw_daemon* daemon,
++ const char* name, const char* path) {
++ nw_config* config = NULL;
++ int r;
++
++ // Initialize the configuration
++ r = nw_config_create(&config, path);
++ if (r)
++ goto ERROR;
++
++ // Fetch the type
++ const char* type = nw_config_get(config, "TYPE");
++ if (!type) {
++ ERROR("Port configuration %s has no TYPE\n", path);
++ r = 1;
++ goto ERROR;
++ }
++
++ // Create a new port
++ r = nw_port_create(port, daemon, nw_port_type_from_string(type), name);
++ if (r)
++ goto ERROR;
++
++ERROR:
++ if (config)
++ nw_config_unref(config);
++
++ return r;
++}
++
+ nw_port* nw_port_ref(nw_port* port) {
+ port->nrefs++;
+
+diff --git a/src/networkd/port.h b/src/networkd/port.h
+index 9dcd6c2..2f4319b 100644
+--- a/src/networkd/port.h
++++ b/src/networkd/port.h
+@@ -33,7 +33,10 @@ typedef struct nw_port nw_port;
+ #include "address.h"
+ #include "daemon.h"
+
+-int nw_port_create(nw_port** port, nw_daemon* daemon, const char* name);
++int nw_port_create(nw_port** port, nw_daemon* daemon,
++ nw_port_type_t type, const char* name);
++int nw_port_create_from_config(nw_port** port, nw_daemon* daemon,
++ const char* name, const char* path);
+
+ nw_port* nw_port_ref(nw_port* port);
+ nw_port* nw_port_unref(nw_port* port);
+diff --git a/src/networkd/ports.c b/src/networkd/ports.c
+index 87135d8..f0a3ebb 100644
+--- a/src/networkd/ports.c
++++ b/src/networkd/ports.c
+@@ -151,7 +151,7 @@ static int __nw_ports_enumerate(const char* path, const struct stat* s, void* da
+ return 0;
+
+ // Create a new port
+- r = nw_port_create(&port, ports->daemon, name);
++ r = nw_port_create_from_config(&port, ports->daemon, name, path);
+ if (r)
+ goto ERROR;
+
+--
+2.39.2
+
diff --git a/network/patches/0235-port-Implement-reading-writing-VLAN-settings.patch b/network/patches/0235-port-Implement-reading-writing-VLAN-settings.patch
new file mode 100644
index 000000000..687e9eb94
--- /dev/null
+++ b/network/patches/0235-port-Implement-reading-writing-VLAN-settings.patch
@@ -0,0 +1,287 @@
+From c7761af8c8f278f3adb7d422144e13f845089a4b Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 15 Apr 2023 11:16:33 +0000
+Subject: [PATCH 235/304] port: Implement reading/writing VLAN settings
+
+This is just simple test to see where the configuration could be going.
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/port.c | 166 +++++++++++++++++++++++++++++++++++++++++-
+ src/networkd/port.h | 13 ++++
+ src/networkd/string.h | 5 ++
+ 3 files changed, 182 insertions(+), 2 deletions(-)
+
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index aad6210..a240c61 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -40,21 +40,32 @@ struct nw_port {
+ // Link
+ nw_link* link;
+
+- char name[IF_NAMESIZE];
+ nw_port_type_t type;
++ char name[IF_NAMESIZE];
+
+ // Configuration
+ nw_config *config;
+
+ // Common attributes
+ nw_address_t address;
++
++ // VLAN settings
++ struct nw_port_vlan {
++ nw_port* parent;
++ int id;
++
++ // If the parent has not been read from the configuration we will
++ // save the name and try to find it later.
++ char __parent_name[IF_NAMESIZE];
++ } vlan;
+ };
+
+ static const struct nw_port_type_map {
+ nw_port_type_t type;
+ const char* name;
+ } nw_port_type_map[] = {
+- { NW_PORT_DUMMY, "dummy" },
++ { NW_PORT_DUMMY, "dummy" },
++ { NW_PORT_VLAN, "vlan" },
+ { NW_PORT_UNKNOWN, NULL },
+ };
+
+@@ -128,6 +139,28 @@ static int nw_port_setup_common(nw_port* port) {
+ return 0;
+ }
+
++static int nw_port_setup_vlan(nw_port* port) {
++ int r;
++
++ // VLAN ID
++ int id = nw_config_get_int(port->config, "VLAN_ID", NW_VLAN_ID_INVALID);
++ if (id) {
++ r = nw_port_set_vlan_id(port, id);
++ if (r)
++ return r;
++ }
++
++ // Parent Port
++ const char* parent = nw_config_get(port->config, "VLAN_PARENT");
++ if (parent) {
++ r = nw_string_set(port->vlan.__parent_name, parent);
++ if (r)
++ return r;
++ }
++
++ return 0;
++}
++
+ static int nw_port_set_link(nw_port* port, nw_link* link) {
+ // Do nothing if the same link is being re-assigned
+ if (port->link == link)
+@@ -183,6 +216,12 @@ static int nw_port_setup(nw_port* port) {
+
+ // Call any custom initialization
+ switch (port->type) {
++ case NW_PORT_VLAN:
++ r = nw_port_setup_vlan(port);
++ if (r)
++ goto ERROR;
++ break;
++
+ // These do not need any special initialization
+ case NW_PORT_DUMMY:
+ case NW_PORT_UNKNOWN:
+@@ -275,14 +314,50 @@ nw_port* nw_port_unref(nw_port* port) {
+ return NULL;
+ }
+
++static int nw_port_save_vlan(nw_port* port) {
++ int r;
++
++ // VLAN ID
++ r = nw_config_set_int(port->config, "VLAN_ID", port->vlan.id);
++ if (r)
++ return r;
++
++ // Parent Port
++ r = nw_config_set(port->config, "VLAN_PARENT",
++ (port->vlan.parent) ? nw_port_name(port->vlan.parent) : port->vlan.__parent_name);
++ if (r)
++ return r;
++
++ return 0;
++}
++
+ int nw_port_save(nw_port* port) {
+ int r;
+
++ switch (port->type) {
++ // VLAN
++ case NW_PORT_VLAN:
++ r = nw_port_save_vlan(port);
++ if (r)
++ goto ERROR;
++ break;
++
++ // These types do not have any special settings
++ case NW_PORT_DUMMY:
++ case NW_PORT_UNKNOWN:
++ break;
++ }
++
+ r = nw_config_write(port->config);
+ if (r)
+ return r;
+
+ return 0;
++
++ERROR:
++ ERROR("Could not save configuration for port %s: %m\n", port->name);
++
++ return 1;
+ }
+
+ const char* nw_port_name(nw_port* port) {
+@@ -404,3 +479,90 @@ int nw_port_update_stats(nw_port* port) {
+
+ return 0;
+ }
++
++static int nw_port_check_type(nw_port* port, const nw_port_type_t type) {
++ if (port->type == type)
++ return 0;
++
++ errno = ENOTSUP;
++ return -errno;
++}
++
++/*
++ VLAN
++*/
++int nw_port_get_vlan_id(nw_port* port) {
++ int r;
++
++ // Check type
++ r = nw_port_check_type(port, NW_PORT_VLAN);
++ if (r < 0)
++ return r;
++
++ return port->vlan.id;
++}
++
++int nw_port_set_vlan_id(nw_port* port, int id) {
++ int r;
++
++ // Check type
++ r = nw_port_check_type(port, NW_PORT_VLAN);
++ if (r < 0)
++ return r;
++
++ // Check if the VLAN ID is within range
++ if (id < NW_VLAN_ID_MIN || id > NW_VLAN_ID_MAX)
++ return -EINVAL;
++
++ // Store the ID
++ port->vlan.id = id;
++
++ DEBUG("Port %s: Set VLAN ID to %d\n", port->name, port->vlan.id);
++
++ return 0;
++}
++
++nw_port* nw_port_get_vlan_parent(nw_port* port) {
++ int r;
++
++ // Check type
++ r = nw_port_check_type(port, NW_PORT_VLAN);
++ if (r < 0)
++ return NULL;
++
++ // Try to find a reference to the parent if none exists
++ if (!port->vlan.parent && *port->vlan.__parent_name)
++ port->vlan.parent = nw_daemon_get_port_by_name(port->daemon, port->vlan.__parent_name);
++
++ if (port->vlan.parent)
++ return nw_port_ref(port->vlan.parent);
++
++ // No port found
++ return NULL;
++}
++
++int nw_port_set_vlan_parent(nw_port* port, nw_port* parent) {
++ int r;
++
++ // Check type
++ r = nw_port_check_type(port, NW_PORT_VLAN);
++ if (r < 0)
++ return r;
++
++ // Reset the former parent name
++ nw_string_empty(port->vlan.__parent_name);
++
++ // Dereference the former parent
++ if (port->vlan.parent) {
++ nw_port_unref(port->vlan.parent);
++ port->vlan.parent = NULL;
++ }
++
++ // Store the new parent
++ if (parent)
++ port->vlan.parent = nw_port_ref(parent);
++
++ DEBUG("Port %s: Set VLAN parent to %s\n", port->name, nw_port_name(port->vlan.parent));
++
++ return 0;
++}
+diff --git a/src/networkd/port.h b/src/networkd/port.h
+index 2f4319b..d89e1e0 100644
+--- a/src/networkd/port.h
++++ b/src/networkd/port.h
+@@ -26,8 +26,14 @@
+ typedef enum nw_port_type {
+ NW_PORT_UNKNOWN = 0,
+ NW_PORT_DUMMY,
++ NW_PORT_VLAN,
+ } nw_port_type_t;
+
++// VLAN
++#define NW_VLAN_ID_INVALID 0
++#define NW_VLAN_ID_MIN 1
++#define NW_VLAN_ID_MAX 4096
++
+ typedef struct nw_port nw_port;
+
+ #include "address.h"
+@@ -61,4 +67,11 @@ const struct rtnl_link_stats64* nw_port_get_stats64(nw_port* port);
+ int __nw_port_update_stats(nw_daemon* daemon, nw_port* port, void* data);
+ int nw_port_update_stats(nw_port* port);
+
++// VLAN
++int nw_port_get_vlan_id(nw_port* port);
++int nw_port_set_vlan_id(nw_port* port, int id);
++
++nw_port* nw_port_get_vlan_parent(nw_port* port);
++int nw_port_set_vlan_parent(nw_port* port, nw_port* parent);
++
+ #endif /* NETWORKD_PORT_H */
+diff --git a/src/networkd/string.h b/src/networkd/string.h
+index 6ff44f9..5bdfc3d 100644
+--- a/src/networkd/string.h
++++ b/src/networkd/string.h
+@@ -120,6 +120,11 @@ static inline int nw_string_strip(char* s) {
+ return 0;
+ }
+
++static inline void nw_string_empty(char* s) {
++ if (s)
++ *s = '\0';
++}
++
+ /*
+ Paths
+ */
+--
+2.39.2
+
diff --git a/network/patches/0236-ports-Implement-destroying-a-port.patch b/network/patches/0236-ports-Implement-destroying-a-port.patch
new file mode 100644
index 000000000..121334aac
--- /dev/null
+++ b/network/patches/0236-ports-Implement-destroying-a-port.patch
@@ -0,0 +1,193 @@
+From c403eb4c480316090d9ca3fd2915b1bf25ac10c0 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 15 Apr 2023 11:46:22 +0000
+Subject: [PATCH 236/304] ports: Implement destroying a port
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/config.c | 12 ++++++++++
+ src/networkd/config.h | 2 ++
+ src/networkd/link.c | 2 ++
+ src/networkd/port.c | 54 +++++++++++++++++++++++++++++++++++++++++++
+ src/networkd/port.h | 3 +++
+ src/networkd/zone.c | 9 ++++++++
+ src/networkd/zone.h | 2 ++
+ 7 files changed, 84 insertions(+)
+
+diff --git a/src/networkd/config.c b/src/networkd/config.c
+index 27cfad8..8269ede 100644
+--- a/src/networkd/config.c
++++ b/src/networkd/config.c
+@@ -24,6 +24,7 @@
+ #include <stdlib.h>
+ #include <string.h>
+ #include <sys/queue.h>
++#include <unistd.h>
+
+ #include "config.h"
+ #include "logging.h"
+@@ -135,6 +136,17 @@ nw_config* nw_config_unref(nw_config* config) {
+ return NULL;
+ }
+
++int nw_config_destroy(nw_config* config) {
++ int r;
++
++ // Drop all entries
++ r = nw_config_flush(config);
++ if (r)
++ return r;
++
++ return unlink(config->path);
++}
++
+ const char* nw_config_path(nw_config* config) {
+ if (*config->path)
+ return config->path;
+diff --git a/src/networkd/config.h b/src/networkd/config.h
+index 0b25f75..e17c016 100644
+--- a/src/networkd/config.h
++++ b/src/networkd/config.h
+@@ -33,6 +33,8 @@ int nw_config_create(nw_config** config, const char* path);
+ nw_config* nw_config_ref(nw_config* config);
+ nw_config* nw_config_unref(nw_config* config);
+
++int nw_config_destroy(nw_config* config);
++
+ const char* nw_config_path(nw_config* config);
+
+ int nw_config_flush(nw_config* config);
+diff --git a/src/networkd/link.c b/src/networkd/link.c
+index 1edf20d..603aabe 100644
+--- a/src/networkd/link.c
++++ b/src/networkd/link.c
+@@ -308,12 +308,14 @@ static int nw_link_update_flags(nw_link* link, sd_netlink_message* message) {
+ return 1;
+ }
+
++#if 0
+ // Fetch operstate
+ r = sd_netlink_message_read_u8(message, IFLA_OPERSTATE, &operstate);
+ if (r < 1) {
+ ERROR("Could not read operstate: %m\n");
+ return 1;
+ }
++#endif
+
+ // End here if there have been no changes
+ if (link->flags == flags && link->operstate == operstate)
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index a240c61..23ffd0b 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -314,6 +314,60 @@ nw_port* nw_port_unref(nw_port* port) {
+ return NULL;
+ }
+
++int nw_port_destroy(nw_port* port) {
++ int r;
++
++ DEBUG("Destroying port %s\n", port->name);
++
++ // Destroy the physical link (if exists)
++ if (port->link) {
++ r = nw_link_destroy(port->link);
++ if (r)
++ return r;
++ }
++
++ // Dereference the port from other ports
++ r = nw_daemon_ports_walk(port->daemon, __nw_port_drop_port, port);
++ if (r)
++ return r;
++
++ // Dereference the port from other zones
++ r = nw_daemon_zones_walk(port->daemon, __nw_zone_drop_port, port);
++ if (r)
++ return r;
++
++ // Destroy the configuration
++ r = nw_config_destroy(port->config);
++ if (r)
++ return r;
++
++ // Reset type
++ port->type = NW_PORT_UNKNOWN;
++
++ return 0;
++}
++
++int __nw_port_drop_port(nw_daemon* daemon, nw_port* port, void* data) {
++ nw_port* dropped_port = (nw_port*)data;
++ int r;
++
++ switch (port->type) {
++ case NW_PORT_VLAN:
++ if (port->vlan.parent == dropped_port) {
++ r = nw_port_set_vlan_parent(port, NULL);
++ if (r)
++ return r;
++ }
++ break;
++
++ case NW_PORT_DUMMY:
++ case NW_PORT_UNKNOWN:
++ break;
++ }
++
++ return 0;
++}
++
+ static int nw_port_save_vlan(nw_port* port) {
+ int r;
+
+diff --git a/src/networkd/port.h b/src/networkd/port.h
+index d89e1e0..032d82c 100644
+--- a/src/networkd/port.h
++++ b/src/networkd/port.h
+@@ -47,6 +47,9 @@ int nw_port_create_from_config(nw_port** port, nw_daemon* daemon,
+ nw_port* nw_port_ref(nw_port* port);
+ nw_port* nw_port_unref(nw_port* port);
+
++int nw_port_destroy(nw_port* port);
++int __nw_port_drop_port(nw_daemon* daemon, nw_port* port, void* data);
++
+ int nw_port_save(nw_port* port);
+
+ const char* nw_port_name(nw_port* port);
+diff --git a/src/networkd/zone.c b/src/networkd/zone.c
+index 3f47a26..9f5b7f8 100644
+--- a/src/networkd/zone.c
++++ b/src/networkd/zone.c
+@@ -183,6 +183,15 @@ nw_zone* nw_zone_unref(nw_zone* zone) {
+ return NULL;
+ }
+
++int __nw_zone_drop_port(nw_daemon* daemon, nw_zone* zone, void* data) {
++ nw_port* dropped_port = (nw_port*)data;
++
++ // XXX TODO
++ (void)dropped_port;
++
++ return 0;
++}
++
+ int nw_zone_save(nw_zone* zone) {
+ int r;
+
+diff --git a/src/networkd/zone.h b/src/networkd/zone.h
+index 9737b45..480440f 100644
+--- a/src/networkd/zone.h
++++ b/src/networkd/zone.h
+@@ -37,6 +37,8 @@ int nw_zone_create(nw_zone** zone, nw_daemon* daemon, const char* name);
+ nw_zone* nw_zone_ref(nw_zone* zone);
+ nw_zone* nw_zone_unref(nw_zone* zone);
+
++int __nw_zone_drop_port(nw_daemon* daemon, nw_zone* zone, void* data);
++
+ int nw_zone_save(nw_zone* zone);
+
+ const char* nw_zone_name(nw_zone* zone);
+--
+2.39.2
+
diff --git a/network/patches/0237-ports-Create-scaffolding-for-operations-struct.patch b/network/patches/0237-ports-Create-scaffolding-for-operations-struct.patch
new file mode 100644
index 000000000..69b8e3caf
--- /dev/null
+++ b/network/patches/0237-ports-Create-scaffolding-for-operations-struct.patch
@@ -0,0 +1,156 @@
+From 9e8af30e5ff0ab717f7d878f8e9c62323ec161a1 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 4 Jun 2023 14:28:35 +0000
+Subject: [PATCH 237/304] ports: Create scaffolding for operations struct
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 2 ++
+ src/networkd/port-dummy.c | 28 ++++++++++++++++++++++++++++
+ src/networkd/port-dummy.h | 28 ++++++++++++++++++++++++++++
+ src/networkd/port.c | 11 +++++++++++
+ src/networkd/port.h | 7 +++++++
+ 5 files changed, 76 insertions(+)
+ create mode 100644 src/networkd/port-dummy.c
+ create mode 100644 src/networkd/port-dummy.h
+
+diff --git a/Makefile.am b/Makefile.am
+index 22d90d4..15e9fa0 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -332,6 +332,8 @@ dist_networkd_SOURCES = \
+ src/networkd/port.h \
+ src/networkd/port-bus.c \
+ src/networkd/port-bus.h \
++ src/networkd/port-dummy.c \
++ src/networkd/port-dummy.h \
+ src/networkd/stats-collector.c \
+ src/networkd/stats-collector.h \
+ src/networkd/string.h \
+diff --git a/src/networkd/port-dummy.c b/src/networkd/port-dummy.c
+new file mode 100644
+index 0000000..cc4b649
+--- /dev/null
++++ b/src/networkd/port-dummy.c
+@@ -0,0 +1,28 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#include "port.h"
++#include "port-dummy.h"
++
++nw_port_ops_t nw_port_ops_dummy = {
++ // There is no special configuration
++ .config_read = NULL,
++ .config_write = NULL,
++};
+diff --git a/src/networkd/port-dummy.h b/src/networkd/port-dummy.h
+new file mode 100644
+index 0000000..0a29c84
+--- /dev/null
++++ b/src/networkd/port-dummy.h
+@@ -0,0 +1,28 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#ifndef NETWORKD_PORT_DUMMY_H
++#define NETWORKD_PORT_DUMMY_H
++
++#include "port.h"
++
++extern nw_port_ops_t nw_port_ops_dummy;
++
++#endif /* NETWORKD_PORT_DUMMY_H */
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index 23ffd0b..6ba4875 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -30,6 +30,7 @@
+ #include "link.h"
+ #include "logging.h"
+ #include "port.h"
++#include "port-dummy.h"
+ #include "stats-collector.h"
+ #include "string.h"
+
+@@ -49,6 +50,9 @@ struct nw_port {
+ // Common attributes
+ nw_address_t address;
+
++ // Type Operations
++ nw_port_ops_t ops;
++
+ // VLAN settings
+ struct nw_port_vlan {
+ nw_port* parent;
+@@ -252,6 +256,13 @@ int nw_port_create(nw_port** port, nw_daemon* daemon, nw_port_type_t type, const
+ // Store the type
+ p->type = type;
+
++ // Set operations
++ switch (p->type) {
++ case NW_PORT_DUMMY:
++ p->ops = nw_port_ops_dummy;
++ break;
++ }
++
+ // Store the name
+ r = nw_string_set(p->name, name);
+ if (r)
+diff --git a/src/networkd/port.h b/src/networkd/port.h
+index 032d82c..76df7a7 100644
+--- a/src/networkd/port.h
++++ b/src/networkd/port.h
+@@ -37,8 +37,15 @@ typedef enum nw_port_type {
+ typedef struct nw_port nw_port;
+
+ #include "address.h"
++#include "config.h"
+ #include "daemon.h"
+
++typedef struct nw_port_ops {
++ // Configuration
++ int (*config_read)(nw_port* port, nw_config* config);
++ int (*config_write)(nw_port* port, nw_config* config);
++} nw_port_ops_t;
++
+ int nw_port_create(nw_port** port, nw_daemon* daemon,
+ nw_port_type_t type, const char* name);
+ int nw_port_create_from_config(nw_port** port, nw_daemon* daemon,
+--
+2.39.2
+
diff --git a/network/patches/0238-ports-Move-VLAN-stuff-into-its-own-file.patch b/network/patches/0238-ports-Move-VLAN-stuff-into-its-own-file.patch
new file mode 100644
index 000000000..3e83ff9c5
--- /dev/null
+++ b/network/patches/0238-ports-Move-VLAN-stuff-into-its-own-file.patch
@@ -0,0 +1,591 @@
+From ff88697584a58e86b3abdad0b5017fda382f50e9 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 4 Jun 2023 14:54:58 +0000
+Subject: [PATCH 238/304] ports: Move VLAN stuff into its own file
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 2 +
+ src/networkd/port-vlan.c | 150 +++++++++++++++++++++++++++++
+ src/networkd/port-vlan.h | 36 +++++++
+ src/networkd/port.c | 203 ++++++---------------------------------
+ src/networkd/port.h | 51 ++++++++--
+ src/networkd/ports.h | 1 +
+ 6 files changed, 261 insertions(+), 182 deletions(-)
+ create mode 100644 src/networkd/port-vlan.c
+ create mode 100644 src/networkd/port-vlan.h
+
+diff --git a/Makefile.am b/Makefile.am
+index 15e9fa0..aafa59c 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -334,6 +334,8 @@ dist_networkd_SOURCES = \
+ src/networkd/port-bus.h \
+ src/networkd/port-dummy.c \
+ src/networkd/port-dummy.h \
++ src/networkd/port-vlan.c \
++ src/networkd/port-vlan.h \
+ src/networkd/stats-collector.c \
+ src/networkd/stats-collector.h \
+ src/networkd/string.h \
+diff --git a/src/networkd/port-vlan.c b/src/networkd/port-vlan.c
+new file mode 100644
+index 0000000..c9581f6
+--- /dev/null
++++ b/src/networkd/port-vlan.c
+@@ -0,0 +1,150 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#include "config.h"
++#include "daemon.h"
++#include "logging.h"
++#include "port.h"
++#include "port-vlan.h"
++#include "string.h"
++
++static int nw_port_vlan_config_read(nw_port* port) {
++ int r;
++
++ // VLAN ID
++ int id = nw_config_get_int(port->config, "VLAN_ID", NW_VLAN_ID_INVALID);
++ if (id) {
++ r = nw_port_set_vlan_id(port, id);
++ if (r)
++ return r;
++ }
++
++ // Parent Port
++ const char* parent = nw_config_get(port->config, "VLAN_PARENT");
++ if (parent) {
++ r = nw_string_set(port->vlan.__parent_name, parent);
++ if (r)
++ return r;
++ }
++
++ return 0;
++}
++
++static int nw_port_vlan_config_write(nw_port* port) {
++ int r;
++
++ // VLAN ID
++ r = nw_config_set_int(port->config, "VLAN_ID", port->vlan.id);
++ if (r)
++ return r;
++
++ // Parent Port
++ r = nw_config_set(port->config, "VLAN_PARENT",
++ (port->vlan.parent) ? nw_port_name(port->vlan.parent) : port->vlan.__parent_name);
++ if (r)
++ return r;
++
++ return 0;
++}
++
++nw_port_ops_t nw_port_ops_vlan = {
++ // Configuration
++ .config_read = nw_port_vlan_config_read,
++ .config_write = nw_port_vlan_config_write,
++};
++
++/*
++ VLAN
++*/
++int nw_port_get_vlan_id(nw_port* port) {
++ int r;
++
++ // Check type
++ r = nw_port_check_type(port, NW_PORT_VLAN);
++ if (r < 0)
++ return r;
++
++ return port->vlan.id;
++}
++
++int nw_port_set_vlan_id(nw_port* port, int id) {
++ int r;
++
++ // Check type
++ r = nw_port_check_type(port, NW_PORT_VLAN);
++ if (r < 0)
++ return r;
++
++ // Check if the VLAN ID is within range
++ if (id < NW_VLAN_ID_MIN || id > NW_VLAN_ID_MAX)
++ return -EINVAL;
++
++ // Store the ID
++ port->vlan.id = id;
++
++ DEBUG("Port %s: Set VLAN ID to %d\n", port->name, port->vlan.id);
++
++ return 0;
++}
++
++nw_port* nw_port_get_vlan_parent(nw_port* port) {
++ int r;
++
++ // Check type
++ r = nw_port_check_type(port, NW_PORT_VLAN);
++ if (r < 0)
++ return NULL;
++
++ // Try to find a reference to the parent if none exists
++ if (!port->vlan.parent && *port->vlan.__parent_name)
++ port->vlan.parent = nw_daemon_get_port_by_name(port->daemon, port->vlan.__parent_name);
++
++ if (port->vlan.parent)
++ return nw_port_ref(port->vlan.parent);
++
++ // No port found
++ return NULL;
++}
++
++int nw_port_set_vlan_parent(nw_port* port, nw_port* parent) {
++ int r;
++
++ // Check type
++ r = nw_port_check_type(port, NW_PORT_VLAN);
++ if (r < 0)
++ return r;
++
++ // Reset the former parent name
++ nw_string_empty(port->vlan.__parent_name);
++
++ // Dereference the former parent
++ if (port->vlan.parent) {
++ nw_port_unref(port->vlan.parent);
++ port->vlan.parent = NULL;
++ }
++
++ // Store the new parent
++ if (parent)
++ port->vlan.parent = nw_port_ref(parent);
++
++ DEBUG("Port %s: Set VLAN parent to %s\n", port->name, nw_port_name(port->vlan.parent));
++
++ return 0;
++}
+diff --git a/src/networkd/port-vlan.h b/src/networkd/port-vlan.h
+new file mode 100644
+index 0000000..2bacb24
+--- /dev/null
++++ b/src/networkd/port-vlan.h
+@@ -0,0 +1,36 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#ifndef NETWORKD_PORT_VLAN_H
++#define NETWORKD_PORT_VLAN_H
++
++#include "port.h"
++
++extern nw_port_ops_t nw_port_ops_vlan;
++
++// ID
++int nw_port_get_vlan_id(nw_port* port);
++int nw_port_set_vlan_id(nw_port* port, int id);
++
++// Parent Port
++nw_port* nw_port_get_vlan_parent(nw_port* port);
++int nw_port_set_vlan_parent(nw_port* port, nw_port* parent);
++
++#endif /* NETWORKD_PORT_VLAN_H */
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index 6ba4875..b3b7d66 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -31,39 +31,10 @@
+ #include "logging.h"
+ #include "port.h"
+ #include "port-dummy.h"
++#include "port-vlan.h"
+ #include "stats-collector.h"
+ #include "string.h"
+
+-struct nw_port {
+- nw_daemon* daemon;
+- int nrefs;
+-
+- // Link
+- nw_link* link;
+-
+- nw_port_type_t type;
+- char name[IF_NAMESIZE];
+-
+- // Configuration
+- nw_config *config;
+-
+- // Common attributes
+- nw_address_t address;
+-
+- // Type Operations
+- nw_port_ops_t ops;
+-
+- // VLAN settings
+- struct nw_port_vlan {
+- nw_port* parent;
+- int id;
+-
+- // If the parent has not been read from the configuration we will
+- // save the name and try to find it later.
+- char __parent_name[IF_NAMESIZE];
+- } vlan;
+-};
+-
+ static const struct nw_port_type_map {
+ nw_port_type_t type;
+ const char* name;
+@@ -143,28 +114,6 @@ static int nw_port_setup_common(nw_port* port) {
+ return 0;
+ }
+
+-static int nw_port_setup_vlan(nw_port* port) {
+- int r;
+-
+- // VLAN ID
+- int id = nw_config_get_int(port->config, "VLAN_ID", NW_VLAN_ID_INVALID);
+- if (id) {
+- r = nw_port_set_vlan_id(port, id);
+- if (r)
+- return r;
+- }
+-
+- // Parent Port
+- const char* parent = nw_config_get(port->config, "VLAN_PARENT");
+- if (parent) {
+- r = nw_string_set(port->vlan.__parent_name, parent);
+- if (r)
+- return r;
+- }
+-
+- return 0;
+-}
+-
+ static int nw_port_set_link(nw_port* port, nw_link* link) {
+ // Do nothing if the same link is being re-assigned
+ if (port->link == link)
+@@ -219,17 +168,10 @@ static int nw_port_setup(nw_port* port) {
+ goto ERROR;
+
+ // Call any custom initialization
+- switch (port->type) {
+- case NW_PORT_VLAN:
+- r = nw_port_setup_vlan(port);
+- if (r)
+- goto ERROR;
+- break;
+-
+- // These do not need any special initialization
+- case NW_PORT_DUMMY:
+- case NW_PORT_UNKNOWN:
+- break;
++ if (port->ops.config_read) {
++ r = port->ops.config_read(port);
++ if (r)
++ goto ERROR;
+ }
+
+ ERROR:
+@@ -261,6 +203,10 @@ int nw_port_create(nw_port** port, nw_daemon* daemon, nw_port_type_t type, const
+ case NW_PORT_DUMMY:
+ p->ops = nw_port_ops_dummy;
+ break;
++
++ case NW_PORT_VLAN:
++ p->ops = nw_port_ops_vlan;
++ break;
+ }
+
+ // Store the name
+@@ -379,40 +325,17 @@ int __nw_port_drop_port(nw_daemon* daemon, nw_port* port, void* data) {
+ return 0;
+ }
+
+-static int nw_port_save_vlan(nw_port* port) {
+- int r;
+-
+- // VLAN ID
+- r = nw_config_set_int(port->config, "VLAN_ID", port->vlan.id);
+- if (r)
+- return r;
+-
+- // Parent Port
+- r = nw_config_set(port->config, "VLAN_PARENT",
+- (port->vlan.parent) ? nw_port_name(port->vlan.parent) : port->vlan.__parent_name);
+- if (r)
+- return r;
+-
+- return 0;
+-}
+-
+ int nw_port_save(nw_port* port) {
+ int r;
+
+- switch (port->type) {
+- // VLAN
+- case NW_PORT_VLAN:
+- r = nw_port_save_vlan(port);
+- if (r)
+- goto ERROR;
+- break;
+-
+- // These types do not have any special settings
+- case NW_PORT_DUMMY:
+- case NW_PORT_UNKNOWN:
+- break;
++ // Call the custom handler
++ if (port->ops.config_write) {
++ r = port->ops.config_write(port);
++ if (r)
++ goto ERROR;
+ }
+
++ // Write the configuration
+ r = nw_config_write(port->config);
+ if (r)
+ return r;
+@@ -481,7 +404,20 @@ static int nw_port_is_disabled(nw_port* port) {
+ }
+
+ static int nw_port_create_link(nw_port* port) {
+- return 0; // XXX TODO
++ int r;
++
++ // Fail if the function isn't set
++ if (!port->ops.create_link) {
++ errno = ENOTSUP;
++ return -errno;
++ }
++
++ // Create the link
++ r = port->ops.create_link(port);
++ if (r)
++ ERROR("Could not create link %s: %m\n", port->name);
++
++ return r;
+ }
+
+ int nw_port_reconfigure(nw_port* port) {
+@@ -545,89 +481,10 @@ int nw_port_update_stats(nw_port* port) {
+ return 0;
+ }
+
+-static int nw_port_check_type(nw_port* port, const nw_port_type_t type) {
++int nw_port_check_type(nw_port* port, const nw_port_type_t type) {
+ if (port->type == type)
+ return 0;
+
+ errno = ENOTSUP;
+ return -errno;
+ }
+-
+-/*
+- VLAN
+-*/
+-int nw_port_get_vlan_id(nw_port* port) {
+- int r;
+-
+- // Check type
+- r = nw_port_check_type(port, NW_PORT_VLAN);
+- if (r < 0)
+- return r;
+-
+- return port->vlan.id;
+-}
+-
+-int nw_port_set_vlan_id(nw_port* port, int id) {
+- int r;
+-
+- // Check type
+- r = nw_port_check_type(port, NW_PORT_VLAN);
+- if (r < 0)
+- return r;
+-
+- // Check if the VLAN ID is within range
+- if (id < NW_VLAN_ID_MIN || id > NW_VLAN_ID_MAX)
+- return -EINVAL;
+-
+- // Store the ID
+- port->vlan.id = id;
+-
+- DEBUG("Port %s: Set VLAN ID to %d\n", port->name, port->vlan.id);
+-
+- return 0;
+-}
+-
+-nw_port* nw_port_get_vlan_parent(nw_port* port) {
+- int r;
+-
+- // Check type
+- r = nw_port_check_type(port, NW_PORT_VLAN);
+- if (r < 0)
+- return NULL;
+-
+- // Try to find a reference to the parent if none exists
+- if (!port->vlan.parent && *port->vlan.__parent_name)
+- port->vlan.parent = nw_daemon_get_port_by_name(port->daemon, port->vlan.__parent_name);
+-
+- if (port->vlan.parent)
+- return nw_port_ref(port->vlan.parent);
+-
+- // No port found
+- return NULL;
+-}
+-
+-int nw_port_set_vlan_parent(nw_port* port, nw_port* parent) {
+- int r;
+-
+- // Check type
+- r = nw_port_check_type(port, NW_PORT_VLAN);
+- if (r < 0)
+- return r;
+-
+- // Reset the former parent name
+- nw_string_empty(port->vlan.__parent_name);
+-
+- // Dereference the former parent
+- if (port->vlan.parent) {
+- nw_port_unref(port->vlan.parent);
+- port->vlan.parent = NULL;
+- }
+-
+- // Store the new parent
+- if (parent)
+- port->vlan.parent = nw_port_ref(parent);
+-
+- DEBUG("Port %s: Set VLAN parent to %s\n", port->name, nw_port_name(port->vlan.parent));
+-
+- return 0;
+-}
+diff --git a/src/networkd/port.h b/src/networkd/port.h
+index 76df7a7..5253d69 100644
+--- a/src/networkd/port.h
++++ b/src/networkd/port.h
+@@ -21,6 +21,10 @@
+ #ifndef NETWORKD_PORT_H
+ #define NETWORKD_PORT_H
+
++#ifndef IF_NAMESIZE
++#define IF_NAMESIZE 16
++#endif
++
+ #define PORT_CONFIG_DIR CONFIG_DIR "/ports"
+
+ typedef enum nw_port_type {
+@@ -42,10 +46,44 @@ typedef struct nw_port nw_port;
+
+ typedef struct nw_port_ops {
+ // Configuration
+- int (*config_read)(nw_port* port, nw_config* config);
+- int (*config_write)(nw_port* port, nw_config* config);
++ int (*config_read)(nw_port* port);
++ int (*config_write)(nw_port* port);
++
++ // Link
++ int (*create_link)(nw_port* port);
++ int (*destroy_link)(nw_port* port);
+ } nw_port_ops_t;
+
++struct nw_port {
++ nw_daemon* daemon;
++ int nrefs;
++
++ // Link
++ nw_link* link;
++
++ nw_port_type_t type;
++ char name[IF_NAMESIZE];
++
++ // Configuration
++ nw_config *config;
++
++ // Common attributes
++ nw_address_t address;
++
++ // Type Operations
++ nw_port_ops_t ops;
++
++ // VLAN settings
++ struct nw_port_vlan {
++ nw_port* parent;
++ int id;
++
++ // If the parent has not been read from the configuration we will
++ // save the name and try to find it later.
++ char __parent_name[IF_NAMESIZE];
++ } vlan;
++};
++
+ int nw_port_create(nw_port** port, nw_daemon* daemon,
+ nw_port_type_t type, const char* name);
+ int nw_port_create_from_config(nw_port** port, nw_daemon* daemon,
+@@ -72,16 +110,11 @@ int nw_port_reconfigure(nw_port* port);
+
+ int nw_port_has_carrier(nw_port* port);
+
++int nw_port_check_type(nw_port* port, const nw_port_type_t type);
++
+ // Stats
+ const struct rtnl_link_stats64* nw_port_get_stats64(nw_port* port);
+ int __nw_port_update_stats(nw_daemon* daemon, nw_port* port, void* data);
+ int nw_port_update_stats(nw_port* port);
+
+-// VLAN
+-int nw_port_get_vlan_id(nw_port* port);
+-int nw_port_set_vlan_id(nw_port* port, int id);
+-
+-nw_port* nw_port_get_vlan_parent(nw_port* port);
+-int nw_port_set_vlan_parent(nw_port* port, nw_port* parent);
+-
+ #endif /* NETWORKD_PORT_H */
+diff --git a/src/networkd/ports.h b/src/networkd/ports.h
+index 68ae532..4e41f11 100644
+--- a/src/networkd/ports.h
++++ b/src/networkd/ports.h
+@@ -26,6 +26,7 @@ typedef struct nw_ports nw_ports;
+ typedef int (*nw_ports_walk_callback)(nw_daemon* daemon, nw_port* port, void* data);
+
+ #include "daemon.h"
++#include "port.h"
+
+ int nw_ports_create(nw_ports** ports, nw_daemon* daemon);
+
+--
+2.39.2
+
diff --git a/network/patches/0239-ports-Implement-creating-links-from-ports.patch b/network/patches/0239-ports-Implement-creating-links-from-ports.patch
new file mode 100644
index 000000000..6c7f890f0
--- /dev/null
+++ b/network/patches/0239-ports-Implement-creating-links-from-ports.patch
@@ -0,0 +1,294 @@
+From 240e331b2043ae254c6468ed3ce2ec6d8caf98db Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 4 Jun 2023 16:26:44 +0000
+Subject: [PATCH 239/304] ports: Implement creating links from ports
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/port-dummy.c | 5 +-
+ src/networkd/port-vlan.c | 20 +++++
+ src/networkd/port.c | 149 +++++++++++++++++++++++++++++++++++---
+ src/networkd/port.h | 10 ++-
+ 4 files changed, 170 insertions(+), 14 deletions(-)
+
+diff --git a/src/networkd/port-dummy.c b/src/networkd/port-dummy.c
+index cc4b649..09367d8 100644
+--- a/src/networkd/port-dummy.c
++++ b/src/networkd/port-dummy.c
+@@ -18,11 +18,8 @@
+ # #
+ #############################################################################*/
+
+-#include "port.h"
+ #include "port-dummy.h"
+
+ nw_port_ops_t nw_port_ops_dummy = {
+- // There is no special configuration
+- .config_read = NULL,
+- .config_write = NULL,
++ .kind = "dummy",
+ };
+diff --git a/src/networkd/port-vlan.c b/src/networkd/port-vlan.c
+index c9581f6..edf91d9 100644
+--- a/src/networkd/port-vlan.c
++++ b/src/networkd/port-vlan.c
+@@ -18,6 +18,8 @@
+ # #
+ #############################################################################*/
+
++#include <systemd/sd-netlink.h>
++
+ #include "config.h"
+ #include "daemon.h"
+ #include "logging.h"
+@@ -64,10 +66,28 @@ static int nw_port_vlan_config_write(nw_port* port) {
+ return 0;
+ }
+
++static int nw_port_vlan_create_link(nw_port* port, sd_netlink_message* m) {
++ int r;
++
++ // Set VLAN ID
++ r = sd_netlink_message_append_u16(m, IFLA_VLAN_ID, port->vlan.id);
++ if (r < 0)
++ return r;
++
++ return 0;
++}
++
+ nw_port_ops_t nw_port_ops_vlan = {
++ .kind = "vlan",
++
+ // Configuration
+ .config_read = nw_port_vlan_config_read,
+ .config_write = nw_port_vlan_config_write,
++
++ .get_parent_port = nw_port_get_vlan_parent,
++
++ // Link
++ .create_link = nw_port_vlan_create_link,
+ };
+
+ /*
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index b3b7d66..a7cbab6 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -72,7 +72,7 @@ static int nw_port_setup_address(nw_port* port) {
+ // Read ADDRESS from configuration
+ const char* s = nw_config_get(port->config, "ADDRESS");
+ if (!s) {
+- ERROR("Port %s: Address isn't set\n", port->name);
++ ERROR("Port %s: Address is not set\n", port->name);
+ goto ERROR;
+ }
+
+@@ -271,6 +271,16 @@ nw_port* nw_port_unref(nw_port* port) {
+ return NULL;
+ }
+
++/*
++ This is a helper function for when we pass a reference to the event loop
++ it will have to dereference the port instance later.
++*/
++static void __nw_port_unref(void* data) {
++ nw_port* port = (nw_port*)data;
++
++ nw_port_unref(port);
++}
++
+ int nw_port_destroy(nw_port* port) {
+ int r;
+
+@@ -395,6 +405,17 @@ int __nw_port_drop_link(nw_daemon* daemon, nw_port* port, void* data) {
+ return 0;
+ }
+
++static nw_link* nw_port_get_link(nw_port* port) {
++ // Fetch the link if not set
++ if (!port->link)
++ port->link = nw_daemon_get_link_by_name(port->daemon, port->name);
++
++ if (!port->link)
++ return NULL;
++
++ return nw_link_ref(port->link);
++}
++
+ const nw_address_t* nw_port_get_address(nw_port* port) {
+ return &port->address;
+ }
+@@ -403,19 +424,129 @@ static int nw_port_is_disabled(nw_port* port) {
+ return nw_config_get_bool(port->config, "DISABLED");
+ }
+
++static nw_link* nw_port_get_parent_link(nw_port* port) {
++ nw_port* parent = NULL;
++ nw_link* link = NULL;
++
++ // Do nothing if not implemented
++ if (!port->ops.get_parent_port)
++ goto ERROR;
++
++ // Fetch the parent
++ parent = port->ops.get_parent_port(port);
++ if (!parent)
++ goto ERROR;
++
++ // Fetch the link
++ link = nw_port_get_link(parent);
++
++ERROR:
++ if (parent)
++ nw_port_unref(parent);
++
++ return link;
++}
++
++static int __nw_port_create_link(sd_netlink* rtnl, sd_netlink_message* m, void* data) {
++ nw_port* port = (nw_port*)data;
++ int r;
++
++ // Check if the operation was successful
++ r = sd_netlink_message_get_errno(m);
++ if (r < 0) {
++ ERROR("Could not create port %s: %s\n", port->name, strerror(-r));
++ // XXX We should extract the error message
++
++ return 0;
++ }
++
++ DEBUG("Successfully created %s\n", port->name);
++
++ return 0;
++}
++
+ static int nw_port_create_link(nw_port* port) {
++ sd_netlink_message* m = NULL;
++ nw_link* link = NULL;
+ int r;
+
+- // Fail if the function isn't set
+- if (!port->ops.create_link) {
+- errno = ENOTSUP;
+- return -errno;
++ sd_netlink* rtnl = nw_daemon_get_rtnl(port->daemon);
++
++ // Create a new link
++ r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
++ if (r < 0) {
++ ERROR("Could not create netlink message: %m\n");
++ goto ERROR;
+ }
+
+- // Create the link
+- r = port->ops.create_link(port);
+- if (r)
+- ERROR("Could not create link %s: %m\n", port->name);
++ // Set the name
++ r = sd_netlink_message_append_string(m, IFLA_IFNAME, port->name);
++ if (r < 0) {
++ ERROR("Could not set port name: %s\n", strerror(-r));
++ goto ERROR;
++ }
++
++ // XXX Set common things like MAC address, etc.
++
++ // Fetch the parent link
++ link = nw_port_get_parent_link(port);
++ if (link) {
++ r = sd_netlink_message_append_u32(m, IFLA_LINK, nw_link_ifindex(link));
++ if (r < 0)
++ goto ERROR;
++ }
++
++ // Open an IFLA_LINKINFO container
++ r = sd_netlink_message_open_container(m, IFLA_LINKINFO);
++ if (r < 0)
++ goto ERROR;
++
++ // Run the custom setup
++ if (port->ops.create_link) {
++ r = sd_netlink_message_open_container_union(m, IFLA_INFO_DATA, port->ops.kind);
++ if (r < 0) {
++ ERROR("Could not open IFLA_INFO_DATA container: %s\n", strerror(-r));
++ goto ERROR;
++ }
++
++ r = port->ops.create_link(port, m);
++ if (r) {
++ ERROR("Could not create port %s: %m\n", port->name);
++ goto ERROR;
++ }
++
++ // Close the container
++ r = sd_netlink_message_close_container(m);
++ if (r < 0)
++ goto ERROR;
++
++ // Just set IFLA_INFO_KIND if there is no custom function
++ } else {
++ r = sd_netlink_message_append_string(m, IFLA_INFO_KIND, port->ops.kind);
++ if (r < 0)
++ goto ERROR;
++ }
++
++ // Close the container
++ r = sd_netlink_message_close_container(m);
++ if (r < 0)
++ goto ERROR;
++
++ // Send the message
++ r = sd_netlink_call_async(rtnl, NULL, m, __nw_port_create_link,
++ __nw_port_unref, nw_port_ref(port), -1, NULL);
++ if (r < 0) {
++ ERROR("Could not send netlink message: %s\n", strerror(-r));
++ goto ERROR;
++ }
++
++ r = 0;
++
++ERROR:
++ if (m)
++ sd_netlink_message_unref(m);
++ if (link)
++ nw_link_unref(link);
+
+ return r;
+ }
+diff --git a/src/networkd/port.h b/src/networkd/port.h
+index 5253d69..d44ecb6 100644
+--- a/src/networkd/port.h
++++ b/src/networkd/port.h
+@@ -21,6 +21,8 @@
+ #ifndef NETWORKD_PORT_H
+ #define NETWORKD_PORT_H
+
++#include <systemd/sd-netlink.h>
++
+ #ifndef IF_NAMESIZE
+ #define IF_NAMESIZE 16
+ #endif
+@@ -45,12 +47,18 @@ typedef struct nw_port nw_port;
+ #include "daemon.h"
+
+ typedef struct nw_port_ops {
++ // IFLA_INFO_KIND/IFLA_INFO_DATA
++ const char* kind;
++
+ // Configuration
+ int (*config_read)(nw_port* port);
+ int (*config_write)(nw_port* port);
+
++ // Get Parent Port
++ nw_port* (*get_parent_port)(nw_port* port);
++
+ // Link
+- int (*create_link)(nw_port* port);
++ int (*create_link)(nw_port* port, sd_netlink_message* message);
+ int (*destroy_link)(nw_port* port);
+ } nw_port_ops_t;
+
+--
+2.39.2
+
diff --git a/network/patches/0240-ports-Rename-the-ops-struct-as-we-will-need-to-store.patch b/network/patches/0240-ports-Rename-the-ops-struct-as-we-will-need-to-store.patch
new file mode 100644
index 000000000..45390b028
--- /dev/null
+++ b/network/patches/0240-ports-Rename-the-ops-struct-as-we-will-need-to-store.patch
@@ -0,0 +1,219 @@
+From 89f8f6af09b8ebf897ca6f91a3abb3b3f40fcaad Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 4 Jun 2023 16:42:11 +0000
+Subject: [PATCH 240/304] ports: Rename the ops struct as we will need to store
+ more things than function pointers
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/port-dummy.c | 2 +-
+ src/networkd/port-dummy.h | 2 +-
+ src/networkd/port-vlan.c | 17 ++++++++++-------
+ src/networkd/port-vlan.h | 2 +-
+ src/networkd/port.c | 24 ++++++++++++------------
+ src/networkd/port.h | 27 ++++++++++++++++-----------
+ 6 files changed, 41 insertions(+), 33 deletions(-)
+
+diff --git a/src/networkd/port-dummy.c b/src/networkd/port-dummy.c
+index 09367d8..d6842d0 100644
+--- a/src/networkd/port-dummy.c
++++ b/src/networkd/port-dummy.c
+@@ -20,6 +20,6 @@
+
+ #include "port-dummy.h"
+
+-nw_port_ops_t nw_port_ops_dummy = {
++nw_port_info_t nw_port_info_dummy = {
+ .kind = "dummy",
+ };
+diff --git a/src/networkd/port-dummy.h b/src/networkd/port-dummy.h
+index 0a29c84..b07cf39 100644
+--- a/src/networkd/port-dummy.h
++++ b/src/networkd/port-dummy.h
+@@ -23,6 +23,6 @@
+
+ #include "port.h"
+
+-extern nw_port_ops_t nw_port_ops_dummy;
++extern nw_port_info_t nw_port_info_dummy;
+
+ #endif /* NETWORKD_PORT_DUMMY_H */
+diff --git a/src/networkd/port-vlan.c b/src/networkd/port-vlan.c
+index edf91d9..f1cd9fb 100644
+--- a/src/networkd/port-vlan.c
++++ b/src/networkd/port-vlan.c
+@@ -77,17 +77,20 @@ static int nw_port_vlan_create_link(nw_port* port, sd_netlink_message* m) {
+ return 0;
+ }
+
+-nw_port_ops_t nw_port_ops_vlan = {
++nw_port_info_t nw_port_info_vlan = {
+ .kind = "vlan",
+
+- // Configuration
+- .config_read = nw_port_vlan_config_read,
+- .config_write = nw_port_vlan_config_write,
++ // Operations
++ .ops = {
++ // Configuration
++ .config_read = nw_port_vlan_config_read,
++ .config_write = nw_port_vlan_config_write,
+
+- .get_parent_port = nw_port_get_vlan_parent,
++ .get_parent_port = nw_port_get_vlan_parent,
+
+- // Link
+- .create_link = nw_port_vlan_create_link,
++ // Link
++ .create_link = nw_port_vlan_create_link,
++ },
+ };
+
+ /*
+diff --git a/src/networkd/port-vlan.h b/src/networkd/port-vlan.h
+index 2bacb24..c666dfb 100644
+--- a/src/networkd/port-vlan.h
++++ b/src/networkd/port-vlan.h
+@@ -23,7 +23,7 @@
+
+ #include "port.h"
+
+-extern nw_port_ops_t nw_port_ops_vlan;
++extern nw_port_info_t nw_port_info_vlan;
+
+ // ID
+ int nw_port_get_vlan_id(nw_port* port);
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index a7cbab6..061e13c 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -168,8 +168,8 @@ static int nw_port_setup(nw_port* port) {
+ goto ERROR;
+
+ // Call any custom initialization
+- if (port->ops.config_read) {
+- r = port->ops.config_read(port);
++ if (NW_PORT_OPS(port)->config_read) {
++ r = NW_PORT_OPS(port)->config_read(port);
+ if (r)
+ goto ERROR;
+ }
+@@ -201,11 +201,11 @@ int nw_port_create(nw_port** port, nw_daemon* daemon, nw_port_type_t type, const
+ // Set operations
+ switch (p->type) {
+ case NW_PORT_DUMMY:
+- p->ops = nw_port_ops_dummy;
++ p->info = &nw_port_info_dummy;
+ break;
+
+ case NW_PORT_VLAN:
+- p->ops = nw_port_ops_vlan;
++ p->info = &nw_port_info_vlan;
+ break;
+ }
+
+@@ -339,8 +339,8 @@ int nw_port_save(nw_port* port) {
+ int r;
+
+ // Call the custom handler
+- if (port->ops.config_write) {
+- r = port->ops.config_write(port);
++ if (NW_PORT_OPS(port)->config_write) {
++ r = NW_PORT_OPS(port)->config_write(port);
+ if (r)
+ goto ERROR;
+ }
+@@ -429,11 +429,11 @@ static nw_link* nw_port_get_parent_link(nw_port* port) {
+ nw_link* link = NULL;
+
+ // Do nothing if not implemented
+- if (!port->ops.get_parent_port)
++ if (!NW_PORT_OPS(port)->get_parent_port)
+ goto ERROR;
+
+ // Fetch the parent
+- parent = port->ops.get_parent_port(port);
++ parent = NW_PORT_OPS(port)->get_parent_port(port);
+ if (!parent)
+ goto ERROR;
+
+@@ -502,14 +502,14 @@ static int nw_port_create_link(nw_port* port) {
+ goto ERROR;
+
+ // Run the custom setup
+- if (port->ops.create_link) {
+- r = sd_netlink_message_open_container_union(m, IFLA_INFO_DATA, port->ops.kind);
++ if (NW_PORT_OPS(port)->create_link) {
++ r = sd_netlink_message_open_container_union(m, IFLA_INFO_DATA, NW_PORT_INFO(port)->kind);
+ if (r < 0) {
+ ERROR("Could not open IFLA_INFO_DATA container: %s\n", strerror(-r));
+ goto ERROR;
+ }
+
+- r = port->ops.create_link(port, m);
++ r = NW_PORT_OPS(port)->create_link(port, m);
+ if (r) {
+ ERROR("Could not create port %s: %m\n", port->name);
+ goto ERROR;
+@@ -522,7 +522,7 @@ static int nw_port_create_link(nw_port* port) {
+
+ // Just set IFLA_INFO_KIND if there is no custom function
+ } else {
+- r = sd_netlink_message_append_string(m, IFLA_INFO_KIND, port->ops.kind);
++ r = sd_netlink_message_append_string(m, IFLA_INFO_KIND, NW_PORT_INFO(port)->kind);
+ if (r < 0)
+ goto ERROR;
+ }
+diff --git a/src/networkd/port.h b/src/networkd/port.h
+index d44ecb6..b73c5fe 100644
+--- a/src/networkd/port.h
++++ b/src/networkd/port.h
+@@ -46,21 +46,26 @@ typedef struct nw_port nw_port;
+ #include "config.h"
+ #include "daemon.h"
+
+-typedef struct nw_port_ops {
++typedef struct nw_port_info {
+ // IFLA_INFO_KIND/IFLA_INFO_DATA
+ const char* kind;
+
+- // Configuration
+- int (*config_read)(nw_port* port);
+- int (*config_write)(nw_port* port);
++ struct nw_port_ops {
++ // Configuration
++ int (*config_read)(nw_port* port);
++ int (*config_write)(nw_port* port);
+
+- // Get Parent Port
+- nw_port* (*get_parent_port)(nw_port* port);
++ // Get Parent Port
++ nw_port* (*get_parent_port)(nw_port* port);
+
+- // Link
+- int (*create_link)(nw_port* port, sd_netlink_message* message);
+- int (*destroy_link)(nw_port* port);
+-} nw_port_ops_t;
++ // Link
++ int (*create_link)(nw_port* port, sd_netlink_message* message);
++ int (*destroy_link)(nw_port* port);
++ } ops;
++} nw_port_info_t;
++
++#define NW_PORT_INFO(port) (port->info)
++#define NW_PORT_OPS(port) (&NW_PORT_INFO(port)->ops)
+
+ struct nw_port {
+ nw_daemon* daemon;
+@@ -79,7 +84,7 @@ struct nw_port {
+ nw_address_t address;
+
+ // Type Operations
+- nw_port_ops_t ops;
++ nw_port_info_t* info;
+
+ // VLAN settings
+ struct nw_port_vlan {
+--
+2.39.2
+
diff --git a/network/patches/0241-ports-Implement-listing-ports-over-DBus.patch b/network/patches/0241-ports-Implement-listing-ports-over-DBus.patch
new file mode 100644
index 000000000..8c08bc270
--- /dev/null
+++ b/network/patches/0241-ports-Implement-listing-ports-over-DBus.patch
@@ -0,0 +1,256 @@
+From 4c99b8ed5da20ba81845486bbcb9a841b7cd2119 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 4 Jun 2023 16:50:35 +0000
+Subject: [PATCH 241/304] ports: Implement listing ports over DBus
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 2 +
+ src/networkctl/main.c | 2 +
+ src/networkctl/port.c | 97 +++++++++++++++++++++++++++++++++++++++
+ src/networkctl/port.h | 26 +++++++++++
+ src/networkd/daemon-bus.c | 51 ++++++++++++++++++++
+ 5 files changed, 178 insertions(+)
+ create mode 100644 src/networkctl/port.c
+ create mode 100644 src/networkctl/port.h
+
+diff --git a/Makefile.am b/Makefile.am
+index aafa59c..273302b 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -392,6 +392,8 @@ dist_networkctl_SOURCES = \
+ src/networkctl/command.c \
+ src/networkctl/command.h \
+ src/networkctl/main.c \
++ src/networkctl/port.c \
++ src/networkctl/port.h \
+ src/networkctl/zone.c \
+ src/networkctl/zone.h
+
+diff --git a/src/networkctl/main.c b/src/networkctl/main.c
+index a08256c..73908f8 100644
+--- a/src/networkctl/main.c
++++ b/src/networkctl/main.c
+@@ -26,6 +26,7 @@
+ #include <systemd/sd-bus.h>
+
+ #include "command.h"
++#include "port.h"
+ #include "zone.h"
+
+ static int networkctl_status(sd_bus* bus, int argc, char* argv[]) {
+@@ -35,6 +36,7 @@ static int networkctl_status(sd_bus* bus, int argc, char* argv[]) {
+
+ static int networkctl_main(sd_bus* bus, int argc, char* argv[]) {
+ static const struct command commands[] = {
++ { "port", 0, networkctl_port },
+ { "status", 0, networkctl_status },
+ { "zone", 0, networkctl_zone },
+ { NULL },
+diff --git a/src/networkctl/port.c b/src/networkctl/port.c
+new file mode 100644
+index 0000000..689e2f1
+--- /dev/null
++++ b/src/networkctl/port.c
+@@ -0,0 +1,97 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#include <systemd/sd-bus.h>
++
++#include "command.h"
++#include "port.h"
++
++typedef int (*networkctl_port_walk_callback)
++ (sd_bus* bus, const char* path, const char* name, void* data);
++
++static int networkctl_port_walk(sd_bus* bus,
++ networkctl_port_walk_callback callback, void* data) {
++ sd_bus_message* reply = NULL;
++ sd_bus_error error = SD_BUS_ERROR_NULL;
++ int r;
++
++ // Call Listports
++ r = sd_bus_call_method(bus, "org.ipfire.network1", "/org/ipfire/network1",
++ "org.ipfire.network1", "ListPorts", &error, &reply, "");
++ if (r < 0) {
++ fprintf(stderr, "Listports call failed: %m\n");
++ goto ERROR;
++ }
++
++ const char* name = NULL;
++ const char* path = NULL;
++
++ // Open the container
++ r = sd_bus_message_enter_container(reply, 'a', "(so)");
++ if (r < 0) {
++ fprintf(stderr, "Could not open container: %m\n");
++ goto ERROR;
++ }
++
++ // Iterate over all ports
++ for (;;) {
++ r = sd_bus_message_read(reply, "(so)", &name, &path);
++ if (r < 0)
++ goto ERROR;
++
++ // Break if we reached the end of the container
++ if (r == 0)
++ break;
++
++ // Call the callback
++ r = callback(bus, path, name, data);
++ if (r)
++ goto ERROR;
++ }
++
++ // Close the container
++ sd_bus_message_exit_container(reply);
++
++ERROR:
++ if (reply)
++ sd_bus_message_unref(reply);
++ sd_bus_error_free(&error);
++
++ return r;
++}
++
++static int __networkctl_port_list(sd_bus* bus, const char* path, const char* name, void* data) {
++ printf("%s\n", name);
++
++ return 0;
++}
++
++static int networkctl_port_list(sd_bus* bus, int argc, char* argv[]) {
++ return networkctl_port_walk(bus, __networkctl_port_list, NULL);
++}
++
++int networkctl_port(sd_bus* bus, int argc, char* argv[]) {
++ static const struct command commands[] = {
++ { "list", 0, networkctl_port_list },
++ { NULL },
++ };
++
++ return command_dispatch(bus, commands, argc, argv);
++}
+diff --git a/src/networkctl/port.h b/src/networkctl/port.h
+new file mode 100644
+index 0000000..2326ce6
+--- /dev/null
++++ b/src/networkctl/port.h
+@@ -0,0 +1,26 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#ifndef NETWORKCTL_PORT_H
++#define NETWORKCTL_PORT_H
++
++int networkctl_port(sd_bus* bus, int argc, char* argv[]);
++
++#endif /* NETWORKCTL_PORT_H */
+diff --git a/src/networkd/daemon-bus.c b/src/networkd/daemon-bus.c
+index 7620eed..4de8c0f 100644
+--- a/src/networkd/daemon-bus.c
++++ b/src/networkd/daemon-bus.c
+@@ -39,6 +39,55 @@ static int nw_daemon_bus_reload(sd_bus_message* m, void* data, sd_bus_error* err
+ return sd_bus_reply_method_return(m, NULL);
+ }
+
++static int __nw_daemon_bus_list_ports(nw_daemon* daemon, nw_port* port, void* data) {
++ sd_bus_message* reply = (sd_bus_message*)data;
++ int r;
++
++ // Fetch port name
++ const char* name = nw_port_name(port);
++
++ // Fetch bus path
++ char* path = nw_port_bus_path(port);
++
++ r = sd_bus_message_append(reply, "(so)", name, path);
++
++ free(path);
++
++ return r;
++}
++
++static int nw_daemon_bus_list_ports(sd_bus_message* m, void* data, sd_bus_error* error) {
++ nw_daemon* daemon = (nw_daemon*)data;
++ sd_bus_message* reply = NULL;
++ int r;
++
++ // Form a reply message
++ r = sd_bus_message_new_method_return(m, &reply);
++ if (r < 0)
++ goto ERROR;
++
++ r = sd_bus_message_open_container(reply, 'a', "(so)");
++ if (r < 0)
++ goto ERROR;
++
++ r = nw_daemon_ports_walk(daemon, __nw_daemon_bus_list_ports, reply);
++ if (r < 0)
++ goto ERROR;
++
++ r = sd_bus_message_close_container(reply);
++ if (r < 0)
++ goto ERROR;
++
++ // Send the reply
++ r = sd_bus_send(NULL, reply, NULL);
++
++ERROR:
++ if (reply)
++ sd_bus_message_unref(reply);
++
++ return r;
++}
++
+ static int __nw_daemon_bus_list_zones(nw_daemon* daemon, nw_zone* zone, void* data) {
+ sd_bus_message* reply = (sd_bus_message*)data;
+ int r;
+@@ -90,6 +139,8 @@ ERROR:
+
+ static const sd_bus_vtable daemon_vtable[] = {
+ SD_BUS_VTABLE_START(0),
++ SD_BUS_METHOD_WITH_ARGS("ListPorts", SD_BUS_NO_ARGS, SD_BUS_RESULT("a(so)", links),
++ nw_daemon_bus_list_ports, SD_BUS_VTABLE_UNPRIVILEGED),
+ SD_BUS_METHOD_WITH_ARGS("ListZones", SD_BUS_NO_ARGS, SD_BUS_RESULT("a(so)", links),
+ nw_daemon_bus_list_zones, SD_BUS_VTABLE_UNPRIVILEGED),
+ SD_BUS_METHOD("Reload", SD_BUS_NO_ARGS, SD_BUS_NO_RESULT,
+--
+2.39.2
+
diff --git a/network/patches/0242-daemon-Fix-return-code-handling-when-listing-ports-z.patch b/network/patches/0242-daemon-Fix-return-code-handling-when-listing-ports-z.patch
new file mode 100644
index 000000000..ad4948402
--- /dev/null
+++ b/network/patches/0242-daemon-Fix-return-code-handling-when-listing-ports-z.patch
@@ -0,0 +1,56 @@
+From 78b41a2319c3c247a0223187edaea4c9ba98e83b Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 4 Jun 2023 16:52:59 +0000
+Subject: [PATCH 242/304] daemon: Fix return code handling when listing
+ ports/zones
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/daemon-bus.c | 20 ++++++++++++++++++--
+ 1 file changed, 18 insertions(+), 2 deletions(-)
+
+diff --git a/src/networkd/daemon-bus.c b/src/networkd/daemon-bus.c
+index 4de8c0f..f5f7abd 100644
+--- a/src/networkd/daemon-bus.c
++++ b/src/networkd/daemon-bus.c
+@@ -49,9 +49,17 @@ static int __nw_daemon_bus_list_ports(nw_daemon* daemon, nw_port* port, void* da
+ // Fetch bus path
+ char* path = nw_port_bus_path(port);
+
++ // Append the port to the message
+ r = sd_bus_message_append(reply, "(so)", name, path);
++ if (r < 0)
++ goto ERROR;
+
+- free(path);
++ // Success
++ r = 0;
++
++ERROR:
++ if (path)
++ free(path);
+
+ return r;
+ }
+@@ -98,9 +106,17 @@ static int __nw_daemon_bus_list_zones(nw_daemon* daemon, nw_zone* zone, void* da
+ // Fetch bus path
+ char* path = nw_zone_bus_path(zone);
+
++ // Append the zone to the message
+ r = sd_bus_message_append(reply, "(so)", name, path);
++ if (r < 0)
++ goto ERROR;
+
+- free(path);
++ // Success
++ r = 0;
++
++ERROR:
++ if (path)
++ free(path);
+
+ return r;
+ }
+--
+2.39.2
+
diff --git a/network/patches/0243-ports-Do-not-expect-to-come-back-after-creating-link.patch b/network/patches/0243-ports-Do-not-expect-to-come-back-after-creating-link.patch
new file mode 100644
index 000000000..53d7548f5
--- /dev/null
+++ b/network/patches/0243-ports-Do-not-expect-to-come-back-after-creating-link.patch
@@ -0,0 +1,32 @@
+From 895f7134d55c38f3059e88e128d5670187222e69 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 4 Jun 2023 17:05:06 +0000
+Subject: [PATCH 243/304] ports: Do not expect to come back after creating
+ links
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/port.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index 061e13c..c87ed59 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -566,11 +566,8 @@ int nw_port_reconfigure(nw_port* port) {
+ }
+
+ // If there is no link, we will try to create it
+- if (!port->link) {
+- r = nw_port_create_link(port);
+- if (r)
+- return r;
+- }
++ if (!port->link)
++ return nw_port_create_link(port);
+
+ // XXX TODO
+
+--
+2.39.2
+
diff --git a/network/patches/0244-ports-Set-the-configure-MAC-address-when-creating-li.patch b/network/patches/0244-ports-Set-the-configure-MAC-address-when-creating-li.patch
new file mode 100644
index 000000000..f979cdc40
--- /dev/null
+++ b/network/patches/0244-ports-Set-the-configure-MAC-address-when-creating-li.patch
@@ -0,0 +1,34 @@
+From 1574bc0061fa712150316d7bc77954f3264363f8 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 4 Jun 2023 17:09:01 +0000
+Subject: [PATCH 244/304] ports: Set the configure MAC address when creating
+ links
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/port.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index c87ed59..891b831 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -486,7 +486,14 @@ static int nw_port_create_link(nw_port* port) {
+ goto ERROR;
+ }
+
+- // XXX Set common things like MAC address, etc.
++ // XXX Set common things like MTU, etc.
++
++ // Set MAC address
++ r = sd_netlink_message_append_ether_addr(m, IFLA_ADDRESS, &port->address);
++ if (r < 0) {
++ ERROR("Could not set MAC address: %s\n", strerror(-r));
++ goto ERROR;
++ }
+
+ // Fetch the parent link
+ link = nw_port_get_parent_link(port);
+--
+2.39.2
+
diff --git a/network/patches/0245-ports-Show-message-when-creating-ports.patch b/network/patches/0245-ports-Show-message-when-creating-ports.patch
new file mode 100644
index 000000000..ee3cf696a
--- /dev/null
+++ b/network/patches/0245-ports-Show-message-when-creating-ports.patch
@@ -0,0 +1,26 @@
+From 575d1a3f407c29ab5b388d11ba94424adb86423a Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 4 Jun 2023 17:10:34 +0000
+Subject: [PATCH 245/304] ports: Show message when creating ports
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/port.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index 891b831..dfce5b6 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -472,6 +472,8 @@ static int nw_port_create_link(nw_port* port) {
+
+ sd_netlink* rtnl = nw_daemon_get_rtnl(port->daemon);
+
++ DEBUG("Creating port %s...\n", port->name);
++
+ // Create a new link
+ r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
+ if (r < 0) {
+--
+2.39.2
+
diff --git a/network/patches/0246-ports-Constify-info-struct.patch b/network/patches/0246-ports-Constify-info-struct.patch
new file mode 100644
index 000000000..5cc786617
--- /dev/null
+++ b/network/patches/0246-ports-Constify-info-struct.patch
@@ -0,0 +1,80 @@
+From 5ddde002bc70617e45632ddc3dfdcf792a2ee745 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 4 Jun 2023 17:12:52 +0000
+Subject: [PATCH 246/304] ports: Constify info struct
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/port-dummy.c | 2 +-
+ src/networkd/port-dummy.h | 2 +-
+ src/networkd/port-vlan.c | 2 +-
+ src/networkd/port-vlan.h | 2 +-
+ src/networkd/port.h | 2 +-
+ 5 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/src/networkd/port-dummy.c b/src/networkd/port-dummy.c
+index d6842d0..e71e740 100644
+--- a/src/networkd/port-dummy.c
++++ b/src/networkd/port-dummy.c
+@@ -20,6 +20,6 @@
+
+ #include "port-dummy.h"
+
+-nw_port_info_t nw_port_info_dummy = {
++const nw_port_info_t nw_port_info_dummy = {
+ .kind = "dummy",
+ };
+diff --git a/src/networkd/port-dummy.h b/src/networkd/port-dummy.h
+index b07cf39..b74c991 100644
+--- a/src/networkd/port-dummy.h
++++ b/src/networkd/port-dummy.h
+@@ -23,6 +23,6 @@
+
+ #include "port.h"
+
+-extern nw_port_info_t nw_port_info_dummy;
++extern const nw_port_info_t nw_port_info_dummy;
+
+ #endif /* NETWORKD_PORT_DUMMY_H */
+diff --git a/src/networkd/port-vlan.c b/src/networkd/port-vlan.c
+index f1cd9fb..5e970e9 100644
+--- a/src/networkd/port-vlan.c
++++ b/src/networkd/port-vlan.c
+@@ -77,7 +77,7 @@ static int nw_port_vlan_create_link(nw_port* port, sd_netlink_message* m) {
+ return 0;
+ }
+
+-nw_port_info_t nw_port_info_vlan = {
++const nw_port_info_t nw_port_info_vlan = {
+ .kind = "vlan",
+
+ // Operations
+diff --git a/src/networkd/port-vlan.h b/src/networkd/port-vlan.h
+index c666dfb..f02c529 100644
+--- a/src/networkd/port-vlan.h
++++ b/src/networkd/port-vlan.h
+@@ -23,7 +23,7 @@
+
+ #include "port.h"
+
+-extern nw_port_info_t nw_port_info_vlan;
++extern const nw_port_info_t nw_port_info_vlan;
+
+ // ID
+ int nw_port_get_vlan_id(nw_port* port);
+diff --git a/src/networkd/port.h b/src/networkd/port.h
+index b73c5fe..8bc4db8 100644
+--- a/src/networkd/port.h
++++ b/src/networkd/port.h
+@@ -84,7 +84,7 @@ struct nw_port {
+ nw_address_t address;
+
+ // Type Operations
+- nw_port_info_t* info;
++ const nw_port_info_t* info;
+
+ // VLAN settings
+ struct nw_port_vlan {
+--
+2.39.2
+
diff --git a/network/patches/0247-ports-Log-when-we-created-a-random-Ethernet-address.patch b/network/patches/0247-ports-Log-when-we-created-a-random-Ethernet-address.patch
new file mode 100644
index 000000000..df9d75b6a
--- /dev/null
+++ b/network/patches/0247-ports-Log-when-we-created-a-random-Ethernet-address.patch
@@ -0,0 +1,50 @@
+From d667fff47beb1fbdf570006b112e64500528a139 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 4 Jun 2023 17:19:19 +0000
+Subject: [PATCH 247/304] ports: Log when we created a random Ethernet address
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/port.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index dfce5b6..d5ffe42 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -67,6 +67,7 @@ static void nw_port_free(nw_port* port) {
+ }
+
+ static int nw_port_setup_address(nw_port* port) {
++ char* __address = NULL;
+ int r;
+
+ // Read ADDRESS from configuration
+@@ -100,6 +101,15 @@ ERROR:
+ return r;
+ }
+
++ // Format the generated address
++ __address = nw_address_to_string(&port->address);
++ if (__address) {
++ ERROR("Generated a random Ethernet address for %s: %s\n", port->name, __address);
++
++ // Free the address
++ free(__address);
++ }
++
+ return 0;
+ }
+
+@@ -490,7 +500,7 @@ static int nw_port_create_link(nw_port* port) {
+
+ // XXX Set common things like MTU, etc.
+
+- // Set MAC address
++ // Set Ethernet address
+ r = sd_netlink_message_append_ether_addr(m, IFLA_ADDRESS, &port->address);
+ if (r < 0) {
+ ERROR("Could not set MAC address: %s\n", strerror(-r));
+--
+2.39.2
+
diff --git a/network/patches/0248-ports-Add-the-most-basic-supports-for-bonding.patch b/network/patches/0248-ports-Add-the-most-basic-supports-for-bonding.patch
new file mode 100644
index 000000000..8e75993b1
--- /dev/null
+++ b/network/patches/0248-ports-Add-the-most-basic-supports-for-bonding.patch
@@ -0,0 +1,309 @@
+From 95c5dca23c2fa6326cdc59736f48f20e40ed3561 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 5 Jun 2023 14:51:41 +0000
+Subject: [PATCH 248/304] ports: Add the most basic supports for bonding
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 2 +
+ src/networkd/port-bonding.c | 142 ++++++++++++++++++++++++++++++++++++
+ src/networkd/port-bonding.h | 37 ++++++++++
+ src/networkd/port.c | 7 ++
+ src/networkd/port.h | 10 ++-
+ 5 files changed, 196 insertions(+), 2 deletions(-)
+ create mode 100644 src/networkd/port-bonding.c
+ create mode 100644 src/networkd/port-bonding.h
+
+diff --git a/Makefile.am b/Makefile.am
+index 273302b..ad42f49 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -330,6 +330,8 @@ dist_networkd_SOURCES = \
+ src/networkd/ports.h \
+ src/networkd/port.c \
+ src/networkd/port.h \
++ src/networkd/port-bonding.c \
++ src/networkd/port-bonding.h \
+ src/networkd/port-bus.c \
+ src/networkd/port-bus.h \
+ src/networkd/port-dummy.c \
+diff --git a/src/networkd/port-bonding.c b/src/networkd/port-bonding.c
+new file mode 100644
+index 0000000..6bddc43
+--- /dev/null
++++ b/src/networkd/port-bonding.c
+@@ -0,0 +1,142 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#include <systemd/sd-netlink.h>
++
++#include "config.h"
++#include "daemon.h"
++#include "logging.h"
++#include "port.h"
++#include "port-bonding.h"
++#include "string.h"
++
++const struct nw_port_bonding_mode {
++ const int mode;
++ const char* string;
++} nw_port_bonding_modes[] = {
++ { BOND_MODE_ROUNDROBIN, "round-robin" },
++ { BOND_MODE_ACTIVEBACKUP, "active-backup" },
++ { BOND_MODE_XOR, "xor" },
++ { BOND_MODE_BROADCAST, "broadcast" },
++ { BOND_MODE_8023AD, "802.3ad" },
++ { BOND_MODE_TLB, "tlb" },
++ { BOND_MODE_ALB, "alb" },
++ { -1, NULL },
++};
++
++static int nw_port_bonding_mode_from_string(const char* string) {
++ const struct nw_port_bonding_mode* m = NULL;
++
++ for (m = nw_port_bonding_modes; m->string; m++) {
++ if (strcmp(m->string, string) == 0)
++ return m->mode;
++ }
++
++ return -1;
++}
++
++static const char* nw_port_bonding_mode_to_string(const int mode) {
++ const struct nw_port_bonding_mode* m = NULL;
++
++ for (m = nw_port_bonding_modes; m->string; m++) {
++ if (m->mode == mode)
++ return m->string;
++ }
++
++ return NULL;
++}
++
++static int nw_port_bonding_config_read(nw_port* port) {
++ int r;
++
++ // Mode
++ const char* mode = nw_config_get(port->config, "BONDING_MODE");
++ if (mode) {
++ r = nw_port_bonding_set_mode(port, mode);
++ if (r)
++ return r;
++ }
++
++ return 0;
++}
++
++static int nw_port_bonding_config_write(nw_port* port) {
++ int r;
++
++ // Mode
++ r = nw_config_set(port->config, "BONDING_MODE",
++ nw_port_bonding_mode_to_string(port->bonding.mode));
++ if (r)
++ return r;
++
++ return 0;
++}
++
++static int nw_port_bonding_create_link(nw_port* port, sd_netlink_message* m) {
++ int r;
++
++ // Set mode
++ r = sd_netlink_message_append_u8(m, IFLA_BOND_MODE, port->bonding.mode);
++ if (r < 0)
++ return r;
++
++ return 0;
++}
++
++const nw_port_info_t nw_port_info_bonding = {
++ .kind = "bond",
++
++ // Operations
++ .ops = {
++ // Configuration
++ .config_read = nw_port_bonding_config_read,
++ .config_write = nw_port_bonding_config_write,
++
++ // Link
++ .create_link = nw_port_bonding_create_link,
++ },
++};
++
++const char* nw_port_bonding_get_mode(nw_port* port) {
++ return nw_port_bonding_mode_to_string(port->bonding.mode);
++}
++
++int nw_port_bonding_set_mode(nw_port* port, const char* mode) {
++ const int m = nw_port_bonding_mode_from_string(mode);
++
++ switch (m) {
++ case BOND_MODE_ROUNDROBIN:
++ case BOND_MODE_ACTIVEBACKUP:
++ case BOND_MODE_XOR:
++ case BOND_MODE_BROADCAST:
++ case BOND_MODE_8023AD:
++ case BOND_MODE_TLB:
++ case BOND_MODE_ALB:
++ port->bonding.mode = m;
++ break;
++
++ default:
++ ERROR("%s: Unsupported bonding mode '%s'\n", port->name, mode);
++ errno = ENOTSUP;
++ return 1;
++ }
++
++ return 0;
++}
+diff --git a/src/networkd/port-bonding.h b/src/networkd/port-bonding.h
+new file mode 100644
+index 0000000..5cd2c43
+--- /dev/null
++++ b/src/networkd/port-bonding.h
+@@ -0,0 +1,37 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#ifndef NETWORKD_PORT_BONDING_H
++#define NETWORKD_PORT_BONDING_H
++
++#include <linux/if_bonding.h>
++
++#include "port.h"
++
++struct nw_port_bonding {
++ int mode;
++};
++
++extern const nw_port_info_t nw_port_info_bonding;
++
++const char* nw_port_bonding_get_mode(nw_port* port);
++int nw_port_bonding_set_mode(nw_port* port, const char* mode);
++
++#endif /* NETWORKD_PORT_BONDING_H */
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index d5ffe42..b44cc88 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -30,6 +30,7 @@
+ #include "link.h"
+ #include "logging.h"
+ #include "port.h"
++#include "port-bonding.h"
+ #include "port-dummy.h"
+ #include "port-vlan.h"
+ #include "stats-collector.h"
+@@ -39,6 +40,7 @@ static const struct nw_port_type_map {
+ nw_port_type_t type;
+ const char* name;
+ } nw_port_type_map[] = {
++ { NW_PORT_BONDING, "bonding" },
+ { NW_PORT_DUMMY, "dummy" },
+ { NW_PORT_VLAN, "vlan" },
+ { NW_PORT_UNKNOWN, NULL },
+@@ -210,6 +212,10 @@ int nw_port_create(nw_port** port, nw_daemon* daemon, nw_port_type_t type, const
+
+ // Set operations
+ switch (p->type) {
++ case NW_PORT_BONDING:
++ p->info = &nw_port_info_bonding;
++ break;
++
+ case NW_PORT_DUMMY:
+ p->info = &nw_port_info_dummy;
+ break;
+@@ -337,6 +343,7 @@ int __nw_port_drop_port(nw_daemon* daemon, nw_port* port, void* data) {
+ }
+ break;
+
++ case NW_PORT_BONDING:
+ case NW_PORT_DUMMY:
+ case NW_PORT_UNKNOWN:
+ break;
+diff --git a/src/networkd/port.h b/src/networkd/port.h
+index 8bc4db8..f8beed3 100644
+--- a/src/networkd/port.h
++++ b/src/networkd/port.h
+@@ -31,6 +31,7 @@
+
+ typedef enum nw_port_type {
+ NW_PORT_UNKNOWN = 0,
++ NW_PORT_BONDING,
+ NW_PORT_DUMMY,
+ NW_PORT_VLAN,
+ } nw_port_type_t;
+@@ -41,12 +42,14 @@ typedef enum nw_port_type {
+ #define NW_VLAN_ID_MAX 4096
+
+ typedef struct nw_port nw_port;
++typedef struct nw_port_info nw_port_info_t;
+
+ #include "address.h"
+ #include "config.h"
+ #include "daemon.h"
++#include "port-bonding.h"
+
+-typedef struct nw_port_info {
++struct nw_port_info {
+ // IFLA_INFO_KIND/IFLA_INFO_DATA
+ const char* kind;
+
+@@ -62,7 +65,7 @@ typedef struct nw_port_info {
+ int (*create_link)(nw_port* port, sd_netlink_message* message);
+ int (*destroy_link)(nw_port* port);
+ } ops;
+-} nw_port_info_t;
++};
+
+ #define NW_PORT_INFO(port) (port->info)
+ #define NW_PORT_OPS(port) (&NW_PORT_INFO(port)->ops)
+@@ -86,6 +89,9 @@ struct nw_port {
+ // Type Operations
+ const nw_port_info_t* info;
+
++ // Bonding Settings
++ struct nw_port_bonding bonding;
++
+ // VLAN settings
+ struct nw_port_vlan {
+ nw_port* parent;
+--
+2.39.2
+
diff --git a/network/patches/0249-ports-Move-VLAN-settings-into-its-own-header-file.patch b/network/patches/0249-ports-Move-VLAN-settings-into-its-own-header-file.patch
new file mode 100644
index 000000000..3772a8caf
--- /dev/null
+++ b/network/patches/0249-ports-Move-VLAN-settings-into-its-own-header-file.patch
@@ -0,0 +1,64 @@
+From 4d6ac814d5a46ca08a6f3cd6a1431a17cd65bc3e Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 5 Jun 2023 14:54:20 +0000
+Subject: [PATCH 249/304] ports: Move VLAN settings into its own header file
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/port-vlan.h | 11 +++++++++++
+ src/networkd/port.h | 10 ++--------
+ 2 files changed, 13 insertions(+), 8 deletions(-)
+
+diff --git a/src/networkd/port-vlan.h b/src/networkd/port-vlan.h
+index f02c529..cffc178 100644
+--- a/src/networkd/port-vlan.h
++++ b/src/networkd/port-vlan.h
+@@ -23,6 +23,17 @@
+
+ #include "port.h"
+
++struct nw_port_vlan {
++ nw_port* parent;
++
++ // The VLAN ID
++ int id;
++
++ // If the parent has not been read from the configuration we will
++ // save the name and try to find it later.
++ char __parent_name[IF_NAMESIZE];
++};
++
+ extern const nw_port_info_t nw_port_info_vlan;
+
+ // ID
+diff --git a/src/networkd/port.h b/src/networkd/port.h
+index f8beed3..21e2a12 100644
+--- a/src/networkd/port.h
++++ b/src/networkd/port.h
+@@ -48,6 +48,7 @@ typedef struct nw_port_info nw_port_info_t;
+ #include "config.h"
+ #include "daemon.h"
+ #include "port-bonding.h"
++#include "port-vlan.h"
+
+ struct nw_port_info {
+ // IFLA_INFO_KIND/IFLA_INFO_DATA
+@@ -93,14 +94,7 @@ struct nw_port {
+ struct nw_port_bonding bonding;
+
+ // VLAN settings
+- struct nw_port_vlan {
+- nw_port* parent;
+- int id;
+-
+- // If the parent has not been read from the configuration we will
+- // save the name and try to find it later.
+- char __parent_name[IF_NAMESIZE];
+- } vlan;
++ struct nw_port_vlan vlan;
+ };
+
+ int nw_port_create(nw_port** port, nw_daemon* daemon,
+--
+2.39.2
+
diff --git a/network/patches/0250-networkctl-Fix-typo-in-bus-method-name.patch b/network/patches/0250-networkctl-Fix-typo-in-bus-method-name.patch
new file mode 100644
index 000000000..89c6ff5ea
--- /dev/null
+++ b/network/patches/0250-networkctl-Fix-typo-in-bus-method-name.patch
@@ -0,0 +1,26 @@
+From 0744719e820e526593c5c7c0b4b86ce756509333 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 5 Jun 2023 14:55:00 +0000
+Subject: [PATCH 250/304] networkctl: Fix typo in bus method name
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkctl/port.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/networkctl/port.c b/src/networkctl/port.c
+index 689e2f1..3a886ff 100644
+--- a/src/networkctl/port.c
++++ b/src/networkctl/port.c
+@@ -36,7 +36,7 @@ static int networkctl_port_walk(sd_bus* bus,
+ r = sd_bus_call_method(bus, "org.ipfire.network1", "/org/ipfire/network1",
+ "org.ipfire.network1", "ListPorts", &error, &reply, "");
+ if (r < 0) {
+- fprintf(stderr, "Listports call failed: %m\n");
++ fprintf(stderr, "ListPorts call failed: %m\n");
+ goto ERROR;
+ }
+
+--
+2.39.2
+
diff --git a/network/patches/0251-ports-Implement-a-function-the-generally-fetches-the.patch b/network/patches/0251-ports-Implement-a-function-the-generally-fetches-the.patch
new file mode 100644
index 000000000..bc749276e
--- /dev/null
+++ b/network/patches/0251-ports-Implement-a-function-the-generally-fetches-the.patch
@@ -0,0 +1,163 @@
+From 5a5c346c5dac343ec8242adcd04f1fbe542640ff Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 5 Jun 2023 16:47:14 +0000
+Subject: [PATCH 251/304] ports: Implement a function the generally fetches the
+ parent port
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/json.h | 89 +++++++++++++++++++++++++++++++++++++++++++++
+ src/networkd/port.c | 17 +++++----
+ src/networkd/port.h | 2 +
+ 3 files changed, 101 insertions(+), 7 deletions(-)
+ create mode 100644 src/networkd/json.h
+
+diff --git a/src/networkd/json.h b/src/networkd/json.h
+new file mode 100644
+index 0000000..33e237a
+--- /dev/null
++++ b/src/networkd/json.h
+@@ -0,0 +1,89 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#ifndef NETWORKD_JSON_H
++#define NETWORKD_JSON_H
++
++#include <errno.h>
++
++#include <json.h>
++
++// Give some sane names to the reference count functions
++#define json_object_ref json_object_get
++#define json_object_unref json_object_put
++
++static inline int __json_object_add(struct json_object* o,
++ const char* key, struct json_object* value) {
++ int r;
++
++ // Add the object
++ r = json_object_object_add(o, key, value);
++ if (r < 0) {
++ if (value)
++ json_object_unref(value);
++ }
++
++ return r;
++}
++
++static inline int json_object_add_string(struct json_object* o,
++ const char* key, const char* value) {
++ struct json_object* element = NULL;
++
++ // Create a JSON object from the string
++ element = json_object_new_string(value);
++ if (!element)
++ return -errno;
++
++ return __json_object_add(o, key, element);
++}
++
++static inline int json_object_add_int64(struct json_object* o,
++ const char* key, const int64_t value) {
++ struct json_object* element = NULL;
++
++ // Create a JSON object
++ element = json_object_new_int64(value);
++ if (!element)
++ return -errno;
++
++ return __json_object_add(o, key, element);
++}
++
++static inline int json_to_string(struct json_object* o, char** s, size_t* l) {
++ // Format JSON to string
++ const char* buffer = json_object_to_json_string_ext(o,
++ JSON_C_TO_STRING_PRETTY|JSON_C_TO_STRING_PRETTY_TAB);
++ if (!buffer)
++ return -errno;
++
++ // Copy the string to the heap
++ *s = strdup(buffer);
++ if (!*s)
++ return -errno;
++
++ // If requested, store the length of the string
++ if (l)
++ *l = strlen(*s);
++
++ return 0;
++}
++
++#endif /* NETWORKD_JSON_H */
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index b44cc88..c9440d4 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -441,23 +441,26 @@ static int nw_port_is_disabled(nw_port* port) {
+ return nw_config_get_bool(port->config, "DISABLED");
+ }
+
++nw_port* nw_port_get_parent_port(nw_port* port) {
++ if (!NW_PORT_OPS(port)->get_parent_port)
++ return NULL;
++
++ return NW_PORT_OPS(port)->get_parent_port(port);
++}
++
+ static nw_link* nw_port_get_parent_link(nw_port* port) {
+ nw_port* parent = NULL;
+ nw_link* link = NULL;
+
+- // Do nothing if not implemented
+- if (!NW_PORT_OPS(port)->get_parent_port)
+- goto ERROR;
+-
+ // Fetch the parent
+- parent = NW_PORT_OPS(port)->get_parent_port(port);
++ parent = nw_port_get_parent_port(port);
+ if (!parent)
+- goto ERROR;
++ return NULL;
+
+ // Fetch the link
+ link = nw_port_get_link(parent);
+
+-ERROR:
++ // Cleanup
+ if (parent)
+ nw_port_unref(parent);
+
+diff --git a/src/networkd/port.h b/src/networkd/port.h
+index 21e2a12..38d19d1 100644
+--- a/src/networkd/port.h
++++ b/src/networkd/port.h
+@@ -119,6 +119,8 @@ int __nw_port_drop_link(nw_daemon* daemon, nw_port* port, void* data);
+
+ const nw_address_t* nw_port_get_address(nw_port* port);
+
++nw_port* nw_port_get_parent_port(nw_port* port);
++
+ int nw_port_reconfigure(nw_port* port);
+
+ int nw_port_has_carrier(nw_port* port);
+--
+2.39.2
+
diff --git a/network/patches/0252-config-Compare-truthiness-case-insensitively.patch b/network/patches/0252-config-Compare-truthiness-case-insensitively.patch
new file mode 100644
index 000000000..528a6ef4f
--- /dev/null
+++ b/network/patches/0252-config-Compare-truthiness-case-insensitively.patch
@@ -0,0 +1,26 @@
+From 8923434ceb4264fea6044564ca7254bd28cf106e Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 5 Jun 2023 16:47:41 +0000
+Subject: [PATCH 252/304] config: Compare truthiness case-insensitively
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/config.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/networkd/config.c b/src/networkd/config.c
+index 8269ede..78448df 100644
+--- a/src/networkd/config.c
++++ b/src/networkd/config.c
+@@ -407,7 +407,7 @@ int nw_config_get_bool(nw_config* config, const char* key) {
+
+ // Check if we match any known true words
+ for (const char** s = nw_config_true; *s; s++) {
+- if (strcmp(value, *s) == 0)
++ if (strcasecmp(value, *s) == 0)
+ return 1;
+ }
+
+--
+2.39.2
+
diff --git a/network/patches/0253-configure-Depend-on-JSON-C.patch b/network/patches/0253-configure-Depend-on-JSON-C.patch
new file mode 100644
index 000000000..0e485e0a9
--- /dev/null
+++ b/network/patches/0253-configure-Depend-on-JSON-C.patch
@@ -0,0 +1,46 @@
+From 6384cfdf37f873154f695f6cac67fe1926b5bad8 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 5 Jun 2023 16:48:30 +0000
+Subject: [PATCH 253/304] configure: Depend on JSON-C
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 2 ++
+ configure.ac | 1 +
+ 2 files changed, 3 insertions(+)
+
+diff --git a/Makefile.am b/Makefile.am
+index ad42f49..466ad73 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -357,6 +357,7 @@ networkd_CPPFLAGS = \
+ networkd_CFLAGS = \
+ $(AM_CFLAGS) \
+ $(CAP_CFLAGS) \
++ $(JSON_C_CFLAGS) \
+ $(SYSTEMD_CFLAGS)
+
+ networkd_LDFLAGS = \
+@@ -365,6 +366,7 @@ networkd_LDFLAGS = \
+ networkd_LDADD = \
+ src/libnetwork.la \
+ $(CAP_LIBS) \
++ $(JSON_C_LIBS) \
+ $(SYSTEMD_LIBS)
+
+ dist_dbuspolicy_DATA += \
+diff --git a/configure.ac b/configure.ac
+index e1baa64..7883ae9 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -173,6 +173,7 @@ AM_CONDITIONAL(HAVE_UDEV, [test -n "$with_udevdir"])
+ # ------------------------------------------------------------------------------
+
+ PKG_CHECK_MODULES([CAP], [libcap])
++PKG_CHECK_MODULES([JSON_C], [json-c])
+ PKG_CHECK_MODULES([LIBNL], [libnl-3.0 libnl-genl-3.0])
+ PKG_CHECK_MODULES([SYSTEMD], [libsystemd])
+
+--
+2.39.2
+
diff --git a/network/patches/0254-ports-Add-bus-method-to-export-port-information-as-J.patch b/network/patches/0254-ports-Add-bus-method-to-export-port-information-as-J.patch
new file mode 100644
index 000000000..e1650a218
--- /dev/null
+++ b/network/patches/0254-ports-Add-bus-method-to-export-port-information-as-J.patch
@@ -0,0 +1,302 @@
+From e9b0614e1d653a733c76a3246fd800566e3e1561 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Mon, 5 Jun 2023 16:48:43 +0000
+Subject: [PATCH 254/304] ports: Add bus method to export port information as
+ JSON
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 1 +
+ src/networkd/port-bonding.c | 16 +++++++++++
+ src/networkd/port-bus.c | 46 +++++++++++++++++++++++++++++++
+ src/networkd/port-vlan.c | 28 +++++++++++++++++++
+ src/networkd/port.c | 55 +++++++++++++++++++++++++++++++++++++
+ src/networkd/port.h | 9 ++++++
+ 6 files changed, 155 insertions(+)
+
+diff --git a/Makefile.am b/Makefile.am
+index 466ad73..f4c22b4 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -319,6 +319,7 @@ dist_networkd_SOURCES = \
+ src/networkd/daemon-bus.h \
+ src/networkd/devmon.c \
+ src/networkd/devmon.h \
++ src/networkd/json.h \
+ src/networkd/link.c \
+ src/networkd/link.h \
+ src/networkd/links.c \
+diff --git a/src/networkd/port-bonding.c b/src/networkd/port-bonding.c
+index 6bddc43..bbc3fb7 100644
+--- a/src/networkd/port-bonding.c
++++ b/src/networkd/port-bonding.c
+@@ -100,6 +100,19 @@ static int nw_port_bonding_create_link(nw_port* port, sd_netlink_message* m) {
+ return 0;
+ }
+
++static int nw_port_bonding_to_json(nw_port* port, struct json_object* o) {
++ int r;
++
++ // Add mode
++ r = json_object_add_string(o, "BondingMode",
++ nw_port_bonding_mode_to_string(port->bonding.mode));
++ if (r < 0)
++ goto ERROR;
++
++ERROR:
++ return r;
++}
++
+ const nw_port_info_t nw_port_info_bonding = {
+ .kind = "bond",
+
+@@ -111,6 +124,9 @@ const nw_port_info_t nw_port_info_bonding = {
+
+ // Link
+ .create_link = nw_port_bonding_create_link,
++
++ // JSON
++ .to_json = nw_port_bonding_to_json,
+ },
+ };
+
+diff --git a/src/networkd/port-bus.c b/src/networkd/port-bus.c
+index 996be92..41f8ec4 100644
+--- a/src/networkd/port-bus.c
++++ b/src/networkd/port-bus.c
+@@ -20,10 +20,12 @@
+
+ #include <errno.h>
+ #include <stdlib.h>
++#include <systemd/sd-bus.h>
+
+ #include "address.h"
+ #include "bus.h"
+ #include "daemon.h"
++#include "json.h"
+ #include "logging.h"
+ #include "port.h"
+ #include "port-bus.h"
+@@ -105,6 +107,46 @@ ERROR:
+ return r;
+ }
+
++static int nw_port_bus_describe(sd_bus_message* message, void* data,
++ sd_bus_error* error) {
++ sd_bus_message* reply = NULL;
++ struct json_object* json = NULL;
++ char* text = NULL;
++ int r;
++
++ nw_port* port = (nw_port*)data;
++
++ // Export all data to JSON
++ r = nw_port_to_json(port, &json);
++ if (r < 0)
++ goto ERROR;
++
++ // Convert JSON to string
++ r = json_to_string(json, &text, NULL);
++ if (r < 0)
++ goto ERROR;
++
++ // Create a reply message
++ r = sd_bus_message_new_method_return(message, &reply);
++ if (r < 0)
++ goto ERROR;
++
++ r = sd_bus_message_append(reply, "s", text);
++ if (r < 0)
++ goto ERROR;
++
++ // Send the reply
++ r = sd_bus_send(NULL, reply, NULL);
++
++ERROR:
++ if (reply)
++ sd_bus_message_unref(reply);
++ if (text)
++ free(text);
++
++ return r;
++}
++
+ static const sd_bus_vtable port_vtable[] = {
+ SD_BUS_VTABLE_START(0),
+
+@@ -112,6 +154,10 @@ static const sd_bus_vtable port_vtable[] = {
+ SD_BUS_PROPERTY("Address", "s", nw_port_bus_get_address,
+ 0, SD_BUS_VTABLE_PROPERTY_EMITS_CHANGE),
+
++ // Operations
++ SD_BUS_METHOD_WITH_ARGS("Describe", SD_BUS_NO_ARGS, SD_BUS_RESULT("s", json),
++ nw_port_bus_describe, SD_BUS_VTABLE_UNPRIVILEGED),
++
+ SD_BUS_VTABLE_END
+ };
+
+diff --git a/src/networkd/port-vlan.c b/src/networkd/port-vlan.c
+index 5e970e9..ac4a5b4 100644
+--- a/src/networkd/port-vlan.c
++++ b/src/networkd/port-vlan.c
+@@ -22,6 +22,7 @@
+
+ #include "config.h"
+ #include "daemon.h"
++#include "json.h"
+ #include "logging.h"
+ #include "port.h"
+ #include "port-vlan.h"
+@@ -77,6 +78,30 @@ static int nw_port_vlan_create_link(nw_port* port, sd_netlink_message* m) {
+ return 0;
+ }
+
++static int nw_port_vlan_to_json(nw_port* port, struct json_object* o) {
++ nw_port* parent = NULL;
++ int r;
++
++ // Add the VLAN ID
++ r = json_object_add_int64(o, "VLANId", port->vlan.id);
++ if (r < 0)
++ goto ERROR;
++
++ // Fetch the parent
++ parent = nw_port_get_parent_port(port);
++ if (parent) {
++ r = json_object_add_string(o, "VLANParentPort", nw_port_name(parent));
++ if (r < 0)
++ goto ERROR;
++ }
++
++ERROR:
++ if (parent)
++ nw_port_unref(parent);
++
++ return r;
++}
++
+ const nw_port_info_t nw_port_info_vlan = {
+ .kind = "vlan",
+
+@@ -90,6 +115,9 @@ const nw_port_info_t nw_port_info_vlan = {
+
+ // Link
+ .create_link = nw_port_vlan_create_link,
++
++ // JSON
++ .to_json = nw_port_vlan_to_json,
+ },
+ };
+
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index c9440d4..a7fb826 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -27,6 +27,7 @@
+
+ #include "address.h"
+ #include "config.h"
++#include "json.h"
+ #include "link.h"
+ #include "logging.h"
+ #include "port.h"
+@@ -645,3 +646,57 @@ int nw_port_check_type(nw_port* port, const nw_port_type_t type) {
+ errno = ENOTSUP;
+ return -errno;
+ }
++
++/*
++ JSON
++*/
++int nw_port_to_json(nw_port* port, struct json_object** object) {
++ char* address = NULL;
++ int r;
++
++ // Create a new JSON object
++ struct json_object* o = json_object_new_object();
++ if (!o) {
++ r = -errno;
++ goto ERROR;
++ }
++
++ // Add name
++ r = json_object_add_string(o, "Name", port->name);
++ if (r < 0)
++ goto ERROR;
++
++ // Add Type
++ r = json_object_add_string(o, "Type", NW_PORT_INFO(port)->kind);
++ if (r < 0)
++ goto ERROR;
++
++ // Add address
++ address = nw_address_to_string(&port->address);
++ if (address) {
++ r = json_object_add_string(o, "Address", address);
++ if (r < 0)
++ goto ERROR;
++ }
++
++ // Call custom stuff
++ if (NW_PORT_OPS(port)->to_json) {
++ r = NW_PORT_OPS(port)->to_json(port, o);
++ if (r < 0)
++ goto ERROR;
++ }
++
++ // Success
++ r = 0;
++
++ // Return a reference to the created object
++ *object = json_object_ref(o);
++
++ERROR:
++ if (address)
++ free(address);
++ if (o)
++ json_object_unref(o);
++
++ return r;
++}
+diff --git a/src/networkd/port.h b/src/networkd/port.h
+index 38d19d1..e16b957 100644
+--- a/src/networkd/port.h
++++ b/src/networkd/port.h
+@@ -21,6 +21,8 @@
+ #ifndef NETWORKD_PORT_H
+ #define NETWORKD_PORT_H
+
++#include <json.h>
++
+ #include <systemd/sd-netlink.h>
+
+ #ifndef IF_NAMESIZE
+@@ -47,6 +49,7 @@ typedef struct nw_port_info nw_port_info_t;
+ #include "address.h"
+ #include "config.h"
+ #include "daemon.h"
++#include "json.h"
+ #include "port-bonding.h"
+ #include "port-vlan.h"
+
+@@ -65,6 +68,9 @@ struct nw_port_info {
+ // Link
+ int (*create_link)(nw_port* port, sd_netlink_message* message);
+ int (*destroy_link)(nw_port* port);
++
++ // JSON
++ int (*to_json)(nw_port* port, struct json_object* object);
+ } ops;
+ };
+
+@@ -132,4 +138,7 @@ const struct rtnl_link_stats64* nw_port_get_stats64(nw_port* port);
+ int __nw_port_update_stats(nw_daemon* daemon, nw_port* port, void* data);
+ int nw_port_update_stats(nw_port* port);
+
++// JSON
++int nw_port_to_json(nw_port* port, struct json_object** object);
++
+ #endif /* NETWORKD_PORT_H */
+--
+2.39.2
+
diff --git a/network/patches/0255-networkctl-Fix-parsing-commands.patch b/network/patches/0255-networkctl-Fix-parsing-commands.patch
new file mode 100644
index 000000000..77544697d
--- /dev/null
+++ b/network/patches/0255-networkctl-Fix-parsing-commands.patch
@@ -0,0 +1,52 @@
+From d4028bc3f6b422a45f8f2ad41df2e59152474b6e Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Tue, 6 Jun 2023 10:24:08 +0000
+Subject: [PATCH 255/304] networkctl: Fix parsing commands
+
+We used to send the argument that was last parsed to the next function
+which probably isn't very useful.
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkctl/command.c | 6 +-----
+ src/networkctl/main.c | 2 +-
+ 2 files changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/src/networkctl/command.c b/src/networkctl/command.c
+index 7114efe..99202dd 100644
+--- a/src/networkctl/command.c
++++ b/src/networkctl/command.c
+@@ -36,10 +36,6 @@ static const struct command* command_find(const struct command* commands, const
+ int command_dispatch(sd_bus* bus, const struct command* commands, int argc, char* argv[]) {
+ const struct command* command = NULL;
+
+- argc -= optind;
+- argv += optind;
+- optind = 1;
+-
+ if (!argc) {
+ fprintf(stderr, "Command required\n");
+ return -EINVAL;
+@@ -54,5 +50,5 @@ int command_dispatch(sd_bus* bus, const struct command* commands, int argc, char
+ return -EINVAL;
+ }
+
+- return command->callback(bus, argc, argv);
++ return command->callback(bus, argc - 1, argv + 1);
+ }
+diff --git a/src/networkctl/main.c b/src/networkctl/main.c
+index 73908f8..0ba7284 100644
+--- a/src/networkctl/main.c
++++ b/src/networkctl/main.c
+@@ -115,7 +115,7 @@ int main(int argc, char* argv[]) {
+ }
+
+ // Run a command
+- r = networkctl_main(bus, argc, argv);
++ r = networkctl_main(bus, argc - 1, argv + 1);
+
+ ERROR:
+ if (bus)
+--
+2.39.2
+
diff --git a/network/patches/0256-networkctl-Implement-dump-command-for-ports-which-sh.patch b/network/patches/0256-networkctl-Implement-dump-command-for-ports-which-sh.patch
new file mode 100644
index 000000000..45fd3b24d
--- /dev/null
+++ b/network/patches/0256-networkctl-Implement-dump-command-for-ports-which-sh.patch
@@ -0,0 +1,94 @@
+From d566048705bb24b12d46fa4ed7cf9352286d8086 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Tue, 6 Jun 2023 10:24:45 +0000
+Subject: [PATCH 256/304] networkctl: Implement "dump" command for ports which
+ shows the JSON
+
+This is just for debugging purposes.
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkctl/port.c | 51 +++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 51 insertions(+)
+
+diff --git a/src/networkctl/port.c b/src/networkctl/port.c
+index 3a886ff..67bc003 100644
+--- a/src/networkctl/port.c
++++ b/src/networkctl/port.c
+@@ -18,8 +18,11 @@
+ # #
+ #############################################################################*/
+
++#include <limits.h>
++
+ #include <systemd/sd-bus.h>
+
++#include "../networkd/string.h"
+ #include "command.h"
+ #include "port.h"
+
+@@ -77,6 +80,53 @@ ERROR:
+ return r;
+ }
+
++// Dump
++
++static int networkctl_port_dump(sd_bus* bus, int argc, char* argv[]) {
++ sd_bus_message* reply = NULL;
++ sd_bus_error error = SD_BUS_ERROR_NULL;
++ char path[PATH_MAX];
++ const char* text = NULL;
++ int r;
++
++ if (argc < 1) {
++ fprintf(stderr, "Port required\n");
++ return -EINVAL;
++ }
++
++ // Make port path
++ r = nw_string_format(path, "/org/ipfire/network1/port/%s", argv[0]);
++ if (r < 0)
++ goto ERROR;
++
++ // Call Describe
++ r = sd_bus_call_method(bus, "org.ipfire.network1", path,
++ "org.ipfire.network1.Port", "Describe", &error, &reply, "");
++ if (r < 0) {
++ fprintf(stderr, "Describe() call failed: %m\n");
++ goto ERROR;
++ }
++
++ // Read the text
++ r = sd_bus_message_read(reply, "s", &text);
++ if (r < 0) {
++ fprintf(stderr, "Could not parse bus message: %s\n", strerror(-r));
++ goto ERROR;
++ }
++
++ // Print the text
++ if (text)
++ printf("%s\n", text);
++
++ERROR:
++ if (reply)
++ sd_bus_message_unref(reply);
++
++ return r;
++}
++
++// List
++
+ static int __networkctl_port_list(sd_bus* bus, const char* path, const char* name, void* data) {
+ printf("%s\n", name);
+
+@@ -89,6 +139,7 @@ static int networkctl_port_list(sd_bus* bus, int argc, char* argv[]) {
+
+ int networkctl_port(sd_bus* bus, int argc, char* argv[]) {
+ static const struct command commands[] = {
++ { "dump", 0, networkctl_port_dump },
+ { "list", 0, networkctl_port_list },
+ { NULL },
+ };
+--
+2.39.2
+
diff --git a/network/patches/0257-string-Add-macros-to-easily-define-string-table-look.patch b/network/patches/0257-string-Add-macros-to-easily-define-string-table-look.patch
new file mode 100644
index 000000000..29a80be49
--- /dev/null
+++ b/network/patches/0257-string-Add-macros-to-easily-define-string-table-look.patch
@@ -0,0 +1,70 @@
+From f9975100fdb9b9d66d9f21436e7973f9824bbcde Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Wed, 7 Jun 2023 13:16:58 +0000
+Subject: [PATCH 257/304] string: Add macros to easily define string table
+ lookups
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/string.h | 45 +++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 45 insertions(+)
+
+diff --git a/src/networkd/string.h b/src/networkd/string.h
+index 5bdfc3d..d94e270 100644
+--- a/src/networkd/string.h
++++ b/src/networkd/string.h
+@@ -125,6 +125,51 @@ static inline void nw_string_empty(char* s) {
+ *s = '\0';
+ }
+
++/*
++ Tables
++*/
++
++struct nw_string_table {
++ const int id;
++ const char* string;
++};
++
++static inline const char* nw_string_table_lookup_string(
++ const struct nw_string_table* table, const int id) {
++ const struct nw_string_table* entry = NULL;
++
++ for (entry = table; entry->string; entry++)
++ if (entry->id == id)
++ return entry->string;
++
++ return NULL;
++}
++
++static inline int nw_string_table_lookup_id(
++ const struct nw_string_table* table, const char* string) {
++ const struct nw_string_table* entry = NULL;
++
++ for (entry = table; entry->string; entry++)
++ if (strcmp(entry->string, string) == 0)
++ return entry->id;
++
++ return -1;
++}
++
++#define NW_STRING_TABLE_LOOKUP_ID(type, table, method) \
++ __attribute__((unused)) static type method(const char* s) { \
++ return nw_string_table_lookup_id(table, s); \
++ }
++
++#define NW_STRING_TABLE_LOOKUP_STRING(type, table, method) \
++ __attribute__((unused)) static const char* method(const type id) { \
++ return nw_string_table_lookup_string(table, id); \
++ }
++
++#define NW_STRING_TABLE_LOOKUP(type, table) \
++ NW_STRING_TABLE_LOOKUP_ID(type, table, table ## _from_string) \
++ NW_STRING_TABLE_LOOKUP_STRING(type, table, table ## _to_string)
++
+ /*
+ Paths
+ */
+--
+2.39.2
+
diff --git a/network/patches/0258-ports-VLAN-Implement-choosing-a-protocol.patch b/network/patches/0258-ports-VLAN-Implement-choosing-a-protocol.patch
new file mode 100644
index 000000000..ac95117c0
--- /dev/null
+++ b/network/patches/0258-ports-VLAN-Implement-choosing-a-protocol.patch
@@ -0,0 +1,156 @@
+From d872e169c7d38b741b0fd01796202a19357d622c Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Wed, 7 Jun 2023 13:17:36 +0000
+Subject: [PATCH 258/304] ports: VLAN: Implement choosing a protocol
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/port-vlan.c | 49 ++++++++++++++++++++++++++++++++++++++++
+ src/networkd/port-vlan.h | 14 ++++++++++++
+ 2 files changed, 63 insertions(+)
+
+diff --git a/src/networkd/port-vlan.c b/src/networkd/port-vlan.c
+index ac4a5b4..6e13ba9 100644
+--- a/src/networkd/port-vlan.c
++++ b/src/networkd/port-vlan.c
+@@ -18,6 +18,8 @@
+ # #
+ #############################################################################*/
+
++#include <linux/if_link.h>
++
+ #include <systemd/sd-netlink.h>
+
+ #include "config.h"
+@@ -28,6 +30,14 @@
+ #include "port-vlan.h"
+ #include "string.h"
+
++const struct nw_string_table nw_port_vlan_proto[] = {
++ { NW_VLAN_PROTO_8021Q, "802.1Q" },
++ { NW_VLAN_PROTO_8021ad, "802.1ad" },
++ { -1, NULL },
++};
++
++NW_STRING_TABLE_LOOKUP(nw_port_vlan_proto_t, nw_port_vlan_proto)
++
+ static int nw_port_vlan_config_read(nw_port* port) {
+ int r;
+
+@@ -39,6 +49,14 @@ static int nw_port_vlan_config_read(nw_port* port) {
+ return r;
+ }
+
++ // VLAN Protocol
++ const char* proto = nw_config_get(port->config, "VLAN_PROTO");
++ if (proto) {
++ r = nw_port_set_vlan_proto(port, nw_port_vlan_proto_from_string(proto));
++ if (r)
++ return r;
++ }
++
+ // Parent Port
+ const char* parent = nw_config_get(port->config, "VLAN_PARENT");
+ if (parent) {
+@@ -58,6 +76,12 @@ static int nw_port_vlan_config_write(nw_port* port) {
+ if (r)
+ return r;
+
++ // VLAN Protocol
++ r = nw_config_set(port->config, "VLAN_PROTO",
++ nw_port_vlan_proto_to_string(port->vlan.proto));
++ if (r)
++ return r;
++
+ // Parent Port
+ r = nw_config_set(port->config, "VLAN_PARENT",
+ (port->vlan.parent) ? nw_port_name(port->vlan.parent) : port->vlan.__parent_name);
+@@ -75,6 +99,11 @@ static int nw_port_vlan_create_link(nw_port* port, sd_netlink_message* m) {
+ if (r < 0)
+ return r;
+
++ // Set VLAN protocol
++ r = sd_netlink_message_append_u16(m, IFLA_VLAN_PROTOCOL, htobe16(port->vlan.proto));
++ if (r < 0)
++ return r;
++
+ return 0;
+ }
+
+@@ -87,6 +116,12 @@ static int nw_port_vlan_to_json(nw_port* port, struct json_object* o) {
+ if (r < 0)
+ goto ERROR;
+
++ // Add the VLAN Protocol
++ r = json_object_add_string(o, "VLANProtocol",
++ nw_port_vlan_proto_to_string(port->vlan.proto));
++ if (r < 0)
++ goto ERROR;
++
+ // Fetch the parent
+ parent = nw_port_get_parent_port(port);
+ if (parent) {
+@@ -155,6 +190,20 @@ int nw_port_set_vlan_id(nw_port* port, int id) {
+ return 0;
+ }
+
++int nw_port_set_vlan_proto(nw_port* port, const nw_port_vlan_proto_t proto) {
++ switch (proto) {
++ case NW_VLAN_PROTO_8021Q:
++ case NW_VLAN_PROTO_8021ad:
++ port->vlan.proto = proto;
++ break;
++
++ default:
++ return -EINVAL;
++ }
++
++ return 0;
++}
++
+ nw_port* nw_port_get_vlan_parent(nw_port* port) {
+ int r;
+
+diff --git a/src/networkd/port-vlan.h b/src/networkd/port-vlan.h
+index cffc178..17d3134 100644
+--- a/src/networkd/port-vlan.h
++++ b/src/networkd/port-vlan.h
+@@ -21,14 +21,25 @@
+ #ifndef NETWORKD_PORT_VLAN_H
+ #define NETWORKD_PORT_VLAN_H
+
++#include <arpa/inet.h>
++#include <linux/if_ether.h>
++
+ #include "port.h"
+
++typedef enum nw_port_vlan_proto {
++ NW_VLAN_PROTO_8021Q = ETH_P_8021Q,
++ NW_VLAN_PROTO_8021ad = ETH_P_8021AD,
++} nw_port_vlan_proto_t;
++
+ struct nw_port_vlan {
+ nw_port* parent;
+
+ // The VLAN ID
+ int id;
+
++ // Protocol
++ nw_port_vlan_proto_t proto;
++
+ // If the parent has not been read from the configuration we will
+ // save the name and try to find it later.
+ char __parent_name[IF_NAMESIZE];
+@@ -40,6 +51,9 @@ extern const nw_port_info_t nw_port_info_vlan;
+ int nw_port_get_vlan_id(nw_port* port);
+ int nw_port_set_vlan_id(nw_port* port, int id);
+
++// Protocol
++int nw_port_set_vlan_proto(nw_port* port, const nw_port_vlan_proto_t proto);
++
+ // Parent Port
+ nw_port* nw_port_get_vlan_parent(nw_port* port);
+ int nw_port_set_vlan_parent(nw_port* port, nw_port* parent);
+--
+2.39.2
+
diff --git a/network/patches/0259-config-Extend-the-parser-to-easier-read-write-config.patch b/network/patches/0259-config-Extend-the-parser-to-easier-read-write-config.patch
new file mode 100644
index 000000000..6b593b0f3
--- /dev/null
+++ b/network/patches/0259-config-Extend-the-parser-to-easier-read-write-config.patch
@@ -0,0 +1,716 @@
+From 082d81a3b4115422a0d58fe8c3cf504350c76bfe Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Thu, 8 Jun 2023 15:04:38 +0000
+Subject: [PATCH 259/304] config: Extend the parser to easier read/write
+ configs
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/address.h | 6 +-
+ src/networkd/config.c | 197 +++++++++++++++++++++++++++++++++++-
+ src/networkd/config.h | 38 +++++++
+ src/networkd/port-bonding.c | 34 ++++---
+ src/networkd/port-vlan.c | 57 ++++-------
+ src/networkd/port.c | 113 ++++++---------------
+ src/networkd/port.h | 5 +-
+ 7 files changed, 313 insertions(+), 137 deletions(-)
+
+diff --git a/src/networkd/address.h b/src/networkd/address.h
+index 7937d62..afcbca1 100644
+--- a/src/networkd/address.h
++++ b/src/networkd/address.h
+@@ -21,6 +21,7 @@
+ #ifndef NETWORKD_ADDRESS_H
+ #define NETWORKD_ADDRESS_H
+
++#include <errno.h>
+ #include <netinet/ether.h>
+ #include <string.h>
+ #include <sys/random.h>
+@@ -35,9 +36,12 @@ enum {
+ };
+
+ static inline int nw_address_from_string(nw_address_t* addr, const char* s) {
++ if (!s)
++ return -EINVAL;
++
+ struct ether_addr* p = ether_aton_r(s, addr);
+ if (!p)
+- return 1;
++ return -errno;
+
+ return 0;
+ }
+diff --git a/src/networkd/config.c b/src/networkd/config.c
+index 78448df..6f22da2 100644
+--- a/src/networkd/config.c
++++ b/src/networkd/config.c
+@@ -26,6 +26,7 @@
+ #include <sys/queue.h>
+ #include <unistd.h>
+
++#include "address.h"
+ #include "config.h"
+ #include "logging.h"
+ #include "string.h"
+@@ -37,19 +38,37 @@ struct nw_config_entry {
+ char value[NETWORK_CONFIG_KEY_MAX_LENGTH];
+ };
+
++struct nw_config_option {
++ STAILQ_ENTRY(nw_config_option) nodes;
++
++ const char* key;
++ void* data;
++
++ // Callbacks
++ nw_config_option_read_callback_t read_callback;
++ nw_config_option_write_callback_t write_callback;
++};
++
+ struct nw_config {
+ int nrefs;
+
+ // The path to the configuration file
+ char path[PATH_MAX];
+
+- STAILQ_HEAD(entries, nw_config_entry) entries;
++ STAILQ_HEAD(config_entries, nw_config_entry) entries;
++
++ // Options
++ STAILQ_HEAD(parser_entries, nw_config_option) options;
+ };
+
+ static void nw_config_entry_free(struct nw_config_entry* entry) {
+ free(entry);
+ }
+
++static void nw_config_option_free(struct nw_config_option* option) {
++ free(option);
++}
++
+ static struct nw_config_entry* nw_config_entry_create(
+ nw_config* config, const char* key) {
+ int r;
+@@ -81,9 +100,20 @@ ERROR:
+ }
+
+ static void nw_config_free(nw_config* config) {
++ struct nw_config_option* option = NULL;
++
+ // Flush all entries
+ nw_config_flush(config);
+
++ // Free all options
++ while (!STAILQ_EMPTY(&config->options)) {
++ option = STAILQ_FIRST(&config->options);
++ STAILQ_REMOVE_HEAD(&config->options, nodes);
++
++ // Free the options
++ nw_config_option_free(option);
++ }
++
+ free(config);
+ }
+
+@@ -100,6 +130,9 @@ int nw_config_create(nw_config** config, const char* path) {
+ // Initialise entries
+ STAILQ_INIT(&c->entries);
+
++ // Initialise options
++ STAILQ_INIT(&c->options);
++
+ // Store the path
+ if (path) {
+ r = nw_string_set(c->path, path);
+@@ -147,6 +180,33 @@ int nw_config_destroy(nw_config* config) {
+ return unlink(config->path);
+ }
+
++int nw_config_copy(nw_config* config, nw_config** copy) {
++ struct nw_config_entry* entry = NULL;
++ nw_config* c = NULL;
++ int r;
++
++ // Create a new configuration
++ r = nw_config_create(&c, NULL);
++ if (r)
++ return r;
++
++ // Copy everything
++ STAILQ_FOREACH(entry, &config->entries, nodes) {
++ r = nw_config_set(c, entry->key, entry->value);
++ if (r)
++ goto ERROR;
++ }
++
++ *copy = c;
++ return 0;
++
++ERROR:
++ if (c)
++ nw_config_unref(c);
++
++ return r;
++}
++
+ const char* nw_config_path(nw_config* config) {
+ if (*config->path)
+ return config->path;
+@@ -341,6 +401,9 @@ const char* nw_config_get(nw_config* config, const char* key) {
+ int nw_config_set(nw_config* config, const char* key, const char* value) {
+ struct nw_config_entry* entry = NULL;
+
++ // Log the change
++ DEBUG("%p: Setting %s = %s\n", config, key, value);
++
+ // Delete the entry if val is NULL
+ if (!value)
+ return nw_config_del(config, key);
+@@ -418,3 +481,135 @@ int nw_config_get_bool(nw_config* config, const char* key) {
+ int nw_config_set_bool(nw_config* config, const char* key, const int value) {
+ return nw_config_set(config, key, value ? "true" : "false");
+ }
++
++/*
++ Options
++*/
++
++int nw_config_options_read(nw_config* config) {
++ struct nw_config_option* option = NULL;
++ int r;
++
++ STAILQ_FOREACH(option, &config->options, nodes) {
++ r = option->read_callback(config, option->key, option->data);
++ if (r < 0)
++ return r;
++ }
++
++ return 0;
++}
++
++int nw_config_options_write(nw_config* config) {
++ struct nw_config_option* option = NULL;
++ int r;
++
++ STAILQ_FOREACH(option, &config->options, nodes) {
++ r = option->write_callback(config, option->key, option->data);
++ if (r < 0)
++ return r;
++ }
++
++ return 0;
++}
++
++int nw_config_option_add(nw_config* config, const char* key, void* data,
++ nw_config_option_read_callback_t read_callback,
++ nw_config_option_write_callback_t write_callback) {
++ // Check input
++ if (!key || !data || !read_callback || !write_callback)
++ return -EINVAL;
++
++ // Allocate a new option
++ struct nw_config_option* option = calloc(1, sizeof(*option));
++ if (!option)
++ return -errno;
++
++ // Set key
++ option->key = key;
++
++ // Set data
++ option->data = data;
++
++ // Set callbacks
++ option->read_callback = read_callback;
++ option->write_callback = write_callback;
++
++ // Append the new option
++ STAILQ_INSERT_TAIL(&config->options, option, nodes);
++
++ return 0;
++}
++
++int nw_config_read_int(nw_config* config, const char* key, void* data) {
++ int* p = (int*)data;
++
++ // Fetch the value
++ *p = nw_config_get_int(config, key, -1);
++
++ return 0;
++}
++
++int nw_config_write_int(nw_config* config, const char* key, const void* data) {
++ return 0;
++}
++
++// String
++
++int nw_config_read_string(nw_config* config, const char* key, void* data) {
++ const char** p = (const char**)data;
++
++ // Fetch the value
++ const char* value = nw_config_get(config, key);
++ if (value)
++ *p = value;
++
++ return 0;
++}
++
++int nw_config_write_string(nw_config* config, const char* key, const void* data) {
++ const char** value = (const char**)data;
++
++ return nw_config_set(config, key, *value);
++}
++
++// Address
++
++int nw_config_read_address(nw_config* config, const char* key, void* data) {
++ nw_address_t* address = (nw_address_t*)data;
++ int r;
++
++ // Fetch the value
++ const char* value = nw_config_get(config, key);
++ if (!value)
++ return -EINVAL;
++
++ r = nw_address_from_string(address, value);
++ if (r < 0)
++ ERROR("Could not parse address: %s\n", value);
++
++ return r;
++}
++
++int nw_config_write_address(nw_config* config, const char* key, const void* data) {
++ const nw_address_t* address = (nw_address_t*)data;
++ int r;
++
++ // Format the address to string
++ char* value = nw_address_to_string(address);
++ if (!value)
++ return -errno;
++
++ // Store the value
++ r = nw_config_set(config, key, value);
++ if (r < 0)
++ goto ERROR;
++
++ // Success
++ r = 0;
++
++ERROR:
++ if (value)
++ free(value);
++
++ return r;
++}
+diff --git a/src/networkd/config.h b/src/networkd/config.h
+index e17c016..b5417e4 100644
+--- a/src/networkd/config.h
++++ b/src/networkd/config.h
+@@ -34,6 +34,7 @@ nw_config* nw_config_ref(nw_config* config);
+ nw_config* nw_config_unref(nw_config* config);
+
+ int nw_config_destroy(nw_config* config);
++int nw_config_copy(nw_config* config, nw_config** copy);
+
+ const char* nw_config_path(nw_config* config);
+
+@@ -53,4 +54,41 @@ int nw_config_set_int(nw_config* config, const char* key, const int value);
+ int nw_config_get_bool(nw_config* config, const char* key);
+ int nw_config_set_bool(nw_config* config, const char* key, const int value);
+
++/*
++ Options
++*/
++
++int nw_config_options_read(nw_config* config);
++int nw_config_options_write(nw_config* config);
++
++typedef int (*nw_config_option_read_callback_t)
++ (nw_config* config, const char* key, void* data);
++typedef int (*nw_config_option_write_callback_t)
++ (nw_config* config, const char* key, const void* data);
++
++int nw_config_option_add(nw_config* config, const char* key, void* value,
++ nw_config_option_read_callback_t read_callback,
++ nw_config_option_write_callback_t write_callback);
++
++#define NW_CONFIG_OPTION(config, key, data, read_callback, write_callback) \
++ nw_config_option_add(config, key, data, read_callback, write_callback)
++
++#define NW_CONFIG_OPTION_STRING(config, key, data) \
++ nw_config_option_add(config, key, data, nw_config_read_string, nw_config_write_string)
++
++int nw_config_read_string(nw_config* config, const char* key, void* data);
++int nw_config_write_string(nw_config* config, const char* key, const void* data);
++
++#define NW_CONFIG_OPTION_INT(config, key, data) \
++ nw_config_option_add(config, key, data, nw_config_read_int, nw_config_write_int)
++
++int nw_config_read_int(nw_config* config, const char* key, void* data);
++int nw_config_write_int(nw_config* config, const char* key, const void* data);
++
++#define NW_CONFIG_OPTION_ADDRESS(config, key, data) \
++ nw_config_option_add(config, key, data, nw_config_read_address, nw_config_write_address)
++
++int nw_config_read_address(nw_config* config, const char* key, void* data);
++int nw_config_write_address(nw_config* config, const char* key, const void* data);
++
+ #endif /* NETWORKD_CONFIG_H */
+diff --git a/src/networkd/port-bonding.c b/src/networkd/port-bonding.c
+index bbc3fb7..a2e0fc3 100644
+--- a/src/networkd/port-bonding.c
++++ b/src/networkd/port-bonding.c
+@@ -63,27 +63,32 @@ static const char* nw_port_bonding_mode_to_string(const int mode) {
+ return NULL;
+ }
+
+-static int nw_port_bonding_config_read(nw_port* port) {
+- int r;
+-
+- // Mode
+- const char* mode = nw_config_get(port->config, "BONDING_MODE");
+- if (mode) {
+- r = nw_port_bonding_set_mode(port, mode);
+- if (r)
+- return r;
++static int nw_port_bonding_read_mode(nw_config* config, const char* key, void* data) {
++ int* mode = (int*)data;
++
++ const char* value = nw_config_get(config, key);
++ if (value) {
++ *mode = nw_port_bonding_mode_from_string(value);
++ if (!*mode)
++ return -errno;
+ }
+
+ return 0;
+ }
+
+-static int nw_port_bonding_config_write(nw_port* port) {
++static int nw_port_bonding_write_mode(nw_config* config, const char* key, const void* data) {
++ const int* mode = (int*)data;
++
++ return nw_config_set(config, key, nw_port_bonding_mode_to_string(*mode));
++}
++
++static int nw_port_bonding_setup(nw_port* port) {
+ int r;
+
+ // Mode
+- r = nw_config_set(port->config, "BONDING_MODE",
+- nw_port_bonding_mode_to_string(port->bonding.mode));
+- if (r)
++ r = NW_CONFIG_OPTION(port->config, "BONDING_MODE", &port->bonding.mode,
++ nw_port_bonding_read_mode, nw_port_bonding_write_mode);
++ if (r < 0)
+ return r;
+
+ return 0;
+@@ -119,8 +124,7 @@ const nw_port_info_t nw_port_info_bonding = {
+ // Operations
+ .ops = {
+ // Configuration
+- .config_read = nw_port_bonding_config_read,
+- .config_write = nw_port_bonding_config_write,
++ .setup = nw_port_bonding_setup,
+
+ // Link
+ .create_link = nw_port_bonding_create_link,
+diff --git a/src/networkd/port-vlan.c b/src/networkd/port-vlan.c
+index 6e13ba9..2d89a09 100644
+--- a/src/networkd/port-vlan.c
++++ b/src/networkd/port-vlan.c
+@@ -38,54 +38,42 @@ const struct nw_string_table nw_port_vlan_proto[] = {
+
+ NW_STRING_TABLE_LOOKUP(nw_port_vlan_proto_t, nw_port_vlan_proto)
+
+-static int nw_port_vlan_config_read(nw_port* port) {
+- int r;
+-
+- // VLAN ID
+- int id = nw_config_get_int(port->config, "VLAN_ID", NW_VLAN_ID_INVALID);
+- if (id) {
+- r = nw_port_set_vlan_id(port, id);
+- if (r)
+- return r;
++static int nw_port_vlan_read_proto(nw_config* config, const char* key, void* data) {
++ nw_port_vlan_proto_t* proto = (nw_port_vlan_proto_t*)data;
++
++ const char* value = nw_config_get(config, key);
++ if (value) {
++ *proto = nw_port_vlan_proto_from_string(data);
++ if (!*proto)
++ return -errno;
+ }
+
+- // VLAN Protocol
+- const char* proto = nw_config_get(port->config, "VLAN_PROTO");
+- if (proto) {
+- r = nw_port_set_vlan_proto(port, nw_port_vlan_proto_from_string(proto));
+- if (r)
+- return r;
+- }
++ return 0;
++}
+
+- // Parent Port
+- const char* parent = nw_config_get(port->config, "VLAN_PARENT");
+- if (parent) {
+- r = nw_string_set(port->vlan.__parent_name, parent);
+- if (r)
+- return r;
+- }
++static int nw_port_vlan_write_proto(nw_config* config, const char* key, const void* data) {
++ const nw_port_vlan_proto_t* proto = (nw_port_vlan_proto_t*)data;
+
+- return 0;
++ return nw_config_set(config, key, nw_port_vlan_proto_to_string(*proto));
+ }
+
+-static int nw_port_vlan_config_write(nw_port* port) {
++static int nw_port_vlan_setup(nw_port* port) {
+ int r;
+
+ // VLAN ID
+- r = nw_config_set_int(port->config, "VLAN_ID", port->vlan.id);
+- if (r)
++ r = NW_CONFIG_OPTION_INT(port->config, "VLAN_ID", &port->vlan.id);
++ if (r < 0)
+ return r;
+
+ // VLAN Protocol
+- r = nw_config_set(port->config, "VLAN_PROTO",
+- nw_port_vlan_proto_to_string(port->vlan.proto));
+- if (r)
++ r = NW_CONFIG_OPTION(port->config, "VLAN_PROTO", &port->vlan.proto,
++ nw_port_vlan_read_proto, nw_port_vlan_write_proto);
++ if (r < 0)
+ return r;
+
+ // Parent Port
+- r = nw_config_set(port->config, "VLAN_PARENT",
+- (port->vlan.parent) ? nw_port_name(port->vlan.parent) : port->vlan.__parent_name);
+- if (r)
++ r = NW_CONFIG_OPTION_STRING(port->config, "VLAN_PARENT", &port->vlan.__parent_name);
++ if (r < 0)
+ return r;
+
+ return 0;
+@@ -143,8 +131,7 @@ const nw_port_info_t nw_port_info_vlan = {
+ // Operations
+ .ops = {
+ // Configuration
+- .config_read = nw_port_vlan_config_read,
+- .config_write = nw_port_vlan_config_write,
++ .setup = nw_port_vlan_setup,
+
+ .get_parent_port = nw_port_get_vlan_parent,
+
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index a7fb826..cab8fc5 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -69,64 +69,6 @@ static void nw_port_free(nw_port* port) {
+ free(port);
+ }
+
+-static int nw_port_setup_address(nw_port* port) {
+- char* __address = NULL;
+- int r;
+-
+- // Read ADDRESS from configuration
+- const char* s = nw_config_get(port->config, "ADDRESS");
+- if (!s) {
+- ERROR("Port %s: Address is not set\n", port->name);
+- goto ERROR;
+- }
+-
+- // Parse the address
+- r = nw_address_from_string(&port->address, s);
+- if (r) {
+- ERROR("Port %s: Could not parse address: %m\n", port->name);
+- goto ERROR;
+- }
+-
+- // Check if this address is usable
+- r = nw_address_is_multicast(&port->address);
+- if (r) {
+- DEBUG("Port %s: Multicast bit is set on Ethernet address\n", port->name);
+- goto ERROR;
+- }
+-
+- return 0;
+-
+-ERROR:
+- // Generate a random Ethernet address
+- r = nw_address_generate(&port->address);
+- if (r) {
+- ERROR("Could not generate a random Ethernet address: %m\n");
+- return r;
+- }
+-
+- // Format the generated address
+- __address = nw_address_to_string(&port->address);
+- if (__address) {
+- ERROR("Generated a random Ethernet address for %s: %s\n", port->name, __address);
+-
+- // Free the address
+- free(__address);
+- }
+-
+- return 0;
+-}
+-
+-static int nw_port_setup_common(nw_port* port) {
+- int r;
+-
+- // Address
+- r = nw_port_setup_address(port);
+- if (r)
+- return r;
+-
+- return 0;
+-}
+-
+ static int nw_port_set_link(nw_port* port, nw_link* link) {
+ // Do nothing if the same link is being re-assigned
+ if (port->link == link)
+@@ -154,7 +96,6 @@ static int nw_port_set_link(nw_port* port, nw_link* link) {
+
+ static int nw_port_setup(nw_port* port) {
+ nw_link* link = NULL;
+- char path[PATH_MAX];
+ int r;
+
+ // Find the link
+@@ -165,28 +106,32 @@ static int nw_port_setup(nw_port* port) {
+ goto ERROR;
+ }
+
+- // Compose the path to the main configuration file
+- r = nw_path_join(path, PORT_CONFIG_DIR, port->name);
+- if (r)
+- goto ERROR;
+-
+- // Initialize the configuration
+- r = nw_config_create(&port->config, path);
+- if (r)
++ // Generate a random Ethernet address
++ r = nw_address_generate(&port->address);
++ if (r < 0) {
++ ERROR("Could not generate an Ethernet address: %s\n", strerror(-r));
+ goto ERROR;
++ }
+
+- // Perform some common initialization
+- r = nw_port_setup_common(port);
+- if (r)
++ // Setup options
++ r = NW_CONFIG_OPTION_ADDRESS(port->config, "ADDRESS", &port->address);
++ if (r < 0)
+ goto ERROR;
+
+ // Call any custom initialization
+- if (NW_PORT_OPS(port)->config_read) {
+- r = NW_PORT_OPS(port)->config_read(port);
+- if (r)
++ if (NW_PORT_OPS(port)->setup) {
++ r = NW_PORT_OPS(port)->setup(port);
++ if (r < 0)
+ goto ERROR;
+ }
+
++ // Parse the configuration
++ r = nw_config_options_read(port->config);
++ if (r < 0) {
++ ERROR("Could not read configuration for port %s: %s\n", port->name, strerror(-r));
++ goto ERROR;
++ }
++
+ ERROR:
+ if (link)
+ nw_link_unref(link);
+@@ -194,7 +139,8 @@ ERROR:
+ return r;
+ }
+
+-int nw_port_create(nw_port** port, nw_daemon* daemon, nw_port_type_t type, const char* name) {
++int nw_port_create(nw_port** port, nw_daemon* daemon,
++ nw_port_type_t type, const char* name, nw_config* config) {
+ int r;
+
+ // Allocate a new object
+@@ -231,6 +177,11 @@ int nw_port_create(nw_port** port, nw_daemon* daemon, nw_port_type_t type, const
+ if (r)
+ goto ERROR;
+
++ // Copy the configuration
++ r = nw_config_copy(config, &p->config);
++ if (r)
++ goto ERROR;
++
+ // Setup the port
+ r = nw_port_setup(p);
+ if (r)
+@@ -263,7 +214,7 @@ int nw_port_create_from_config(nw_port** port, nw_daemon* daemon,
+ }
+
+ // Create a new port
+- r = nw_port_create(port, daemon, nw_port_type_from_string(type), name);
++ r = nw_port_create(port, daemon, nw_port_type_from_string(type), name, config);
+ if (r)
+ goto ERROR;
+
+@@ -356,12 +307,10 @@ int __nw_port_drop_port(nw_daemon* daemon, nw_port* port, void* data) {
+ int nw_port_save(nw_port* port) {
+ int r;
+
+- // Call the custom handler
+- if (NW_PORT_OPS(port)->config_write) {
+- r = NW_PORT_OPS(port)->config_write(port);
+- if (r)
+- goto ERROR;
+- }
++ // Write out the configuration
++ r = nw_config_options_write(port->config);
++ if (r < 0)
++ goto ERROR;
+
+ // Write the configuration
+ r = nw_config_write(port->config);
+@@ -371,7 +320,7 @@ int nw_port_save(nw_port* port) {
+ return 0;
+
+ ERROR:
+- ERROR("Could not save configuration for port %s: %m\n", port->name);
++ ERROR("Could not save configuration for port %s: %s\n", port->name, strerror(-r));
+
+ return 1;
+ }
+diff --git a/src/networkd/port.h b/src/networkd/port.h
+index e16b957..ef68a89 100644
+--- a/src/networkd/port.h
++++ b/src/networkd/port.h
+@@ -59,8 +59,7 @@ struct nw_port_info {
+
+ struct nw_port_ops {
+ // Configuration
+- int (*config_read)(nw_port* port);
+- int (*config_write)(nw_port* port);
++ int (*setup)(nw_port* port);
+
+ // Get Parent Port
+ nw_port* (*get_parent_port)(nw_port* port);
+@@ -104,7 +103,7 @@ struct nw_port {
+ };
+
+ int nw_port_create(nw_port** port, nw_daemon* daemon,
+- nw_port_type_t type, const char* name);
++ nw_port_type_t type, const char* name, nw_config* config);
+ int nw_port_create_from_config(nw_port** port, nw_daemon* daemon,
+ const char* name, const char* path);
+
+--
+2.39.2
+
diff --git a/network/patches/0260-ports-bonding-Convert-mode-to-string-table.patch b/network/patches/0260-ports-bonding-Convert-mode-to-string-table.patch
new file mode 100644
index 000000000..2723006fd
--- /dev/null
+++ b/network/patches/0260-ports-bonding-Convert-mode-to-string-table.patch
@@ -0,0 +1,93 @@
+From 582536b21276f11b040eef80e185635b312556da Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Thu, 8 Jun 2023 15:12:00 +0000
+Subject: [PATCH 260/304] ports: bonding: Convert mode to string table
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/port-bonding.c | 41 ++++++++-----------------------------
+ src/networkd/port-bonding.h | 12 ++++++++++-
+ 2 files changed, 20 insertions(+), 33 deletions(-)
+
+diff --git a/src/networkd/port-bonding.c b/src/networkd/port-bonding.c
+index a2e0fc3..e765791 100644
+--- a/src/networkd/port-bonding.c
++++ b/src/networkd/port-bonding.c
+@@ -27,41 +27,18 @@
+ #include "port-bonding.h"
+ #include "string.h"
+
+-const struct nw_port_bonding_mode {
+- const int mode;
+- const char* string;
+-} nw_port_bonding_modes[] = {
+- { BOND_MODE_ROUNDROBIN, "round-robin" },
+- { BOND_MODE_ACTIVEBACKUP, "active-backup" },
+- { BOND_MODE_XOR, "xor" },
+- { BOND_MODE_BROADCAST, "broadcast" },
+- { BOND_MODE_8023AD, "802.3ad" },
+- { BOND_MODE_TLB, "tlb" },
+- { BOND_MODE_ALB, "alb" },
++const struct nw_string_table nw_port_bonding_mode[] = {
++ { NW_BONDING_MODE_ROUNDROBIN, "round-robin" },
++ { NW_BONDING_MODE_ACTIVEBACKUP, "active-backup" },
++ { NW_BONDING_MODE_XOR, "xor" },
++ { NW_BONDING_MODE_BROADCAST, "broadcast" },
++ { NW_BONDING_MODE_8023AD, "802.3ad" },
++ { NW_BONDING_MODE_TLB, "tlb" },
++ { NW_BONDING_MODE_ALB, "alb" },
+ { -1, NULL },
+ };
+
+-static int nw_port_bonding_mode_from_string(const char* string) {
+- const struct nw_port_bonding_mode* m = NULL;
+-
+- for (m = nw_port_bonding_modes; m->string; m++) {
+- if (strcmp(m->string, string) == 0)
+- return m->mode;
+- }
+-
+- return -1;
+-}
+-
+-static const char* nw_port_bonding_mode_to_string(const int mode) {
+- const struct nw_port_bonding_mode* m = NULL;
+-
+- for (m = nw_port_bonding_modes; m->string; m++) {
+- if (m->mode == mode)
+- return m->string;
+- }
+-
+- return NULL;
+-}
++NW_STRING_TABLE_LOOKUP(nw_port_bonding_mode_t, nw_port_bonding_mode)
+
+ static int nw_port_bonding_read_mode(nw_config* config, const char* key, void* data) {
+ int* mode = (int*)data;
+diff --git a/src/networkd/port-bonding.h b/src/networkd/port-bonding.h
+index 5cd2c43..e21c251 100644
+--- a/src/networkd/port-bonding.h
++++ b/src/networkd/port-bonding.h
+@@ -25,8 +25,18 @@
+
+ #include "port.h"
+
++typedef enum nw_port_bonding_mode {
++ NW_BONDING_MODE_ROUNDROBIN = BOND_MODE_ROUNDROBIN,
++ NW_BONDING_MODE_ACTIVEBACKUP = BOND_MODE_ACTIVEBACKUP,
++ NW_BONDING_MODE_XOR = BOND_MODE_XOR,
++ NW_BONDING_MODE_BROADCAST = BOND_MODE_BROADCAST,
++ NW_BONDING_MODE_8023AD = BOND_MODE_8023AD,
++ NW_BONDING_MODE_TLB = BOND_MODE_TLB,
++ NW_BONDING_MODE_ALB = BOND_MODE_ALB,
++} nw_port_bonding_mode_t;
++
+ struct nw_port_bonding {
+- int mode;
++ nw_port_bonding_mode_t mode;
+ };
+
+ extern const nw_port_info_t nw_port_info_bonding;
+--
+2.39.2
+
diff --git a/network/patches/0261-config-Rename-data-to-value-as-it-holds-a-reference-.patch b/network/patches/0261-config-Rename-data-to-value-as-it-holds-a-reference-.patch
new file mode 100644
index 000000000..0f032586d
--- /dev/null
+++ b/network/patches/0261-config-Rename-data-to-value-as-it-holds-a-reference-.patch
@@ -0,0 +1,221 @@
+From cc54472edbcc3a4325b9bad6eff1532bcd42c891 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Thu, 8 Jun 2023 15:17:24 +0000
+Subject: [PATCH 261/304] config: Rename "data" to "value" as it holds a
+ reference to it
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/config.c | 64 ++++++++++++++++++++-----------------------
+ src/networkd/config.h | 28 +++++++++----------
+ 2 files changed, 43 insertions(+), 49 deletions(-)
+
+diff --git a/src/networkd/config.c b/src/networkd/config.c
+index 6f22da2..b142d17 100644
+--- a/src/networkd/config.c
++++ b/src/networkd/config.c
+@@ -42,7 +42,7 @@ struct nw_config_option {
+ STAILQ_ENTRY(nw_config_option) nodes;
+
+ const char* key;
+- void* data;
++ void* value;
+
+ // Callbacks
+ nw_config_option_read_callback_t read_callback;
+@@ -491,7 +491,7 @@ int nw_config_options_read(nw_config* config) {
+ int r;
+
+ STAILQ_FOREACH(option, &config->options, nodes) {
+- r = option->read_callback(config, option->key, option->data);
++ r = option->read_callback(config, option->key, option->value);
+ if (r < 0)
+ return r;
+ }
+@@ -504,7 +504,7 @@ int nw_config_options_write(nw_config* config) {
+ int r;
+
+ STAILQ_FOREACH(option, &config->options, nodes) {
+- r = option->write_callback(config, option->key, option->data);
++ r = option->write_callback(config, option->key, option->value);
+ if (r < 0)
+ return r;
+ }
+@@ -512,11 +512,11 @@ int nw_config_options_write(nw_config* config) {
+ return 0;
+ }
+
+-int nw_config_option_add(nw_config* config, const char* key, void* data,
++int nw_config_option_add(nw_config* config, const char* key, void* value,
+ nw_config_option_read_callback_t read_callback,
+ nw_config_option_write_callback_t write_callback) {
+ // Check input
+- if (!key || !data || !read_callback || !write_callback)
++ if (!key || !value || !read_callback || !write_callback)
+ return -EINVAL;
+
+ // Allocate a new option
+@@ -527,8 +527,8 @@ int nw_config_option_add(nw_config* config, const char* key, void* data,
+ // Set key
+ option->key = key;
+
+- // Set data
+- option->data = data;
++ // Set value
++ option->value = value;
+
+ // Set callbacks
+ option->read_callback = read_callback;
+@@ -540,67 +540,61 @@ int nw_config_option_add(nw_config* config, const char* key, void* data,
+ return 0;
+ }
+
+-int nw_config_read_int(nw_config* config, const char* key, void* data) {
+- int* p = (int*)data;
+-
++int nw_config_read_int(nw_config* config, const char* key, void* value) {
+ // Fetch the value
+- *p = nw_config_get_int(config, key, -1);
++ *(int*)value = nw_config_get_int(config, key, -1);
+
+ return 0;
+ }
+
+-int nw_config_write_int(nw_config* config, const char* key, const void* data) {
++int nw_config_write_int(nw_config* config, const char* key, const void* value) {
+ return 0;
+ }
+
+ // String
+
+-int nw_config_read_string(nw_config* config, const char* key, void* data) {
+- const char** p = (const char**)data;
+-
++int nw_config_read_string(nw_config* config, const char* key, void* value) {
+ // Fetch the value
+- const char* value = nw_config_get(config, key);
+- if (value)
+- *p = value;
++ const char* p = nw_config_get(config, key);
++ if (p)
++ *(const char**)value = p;
+
+ return 0;
+ }
+
+-int nw_config_write_string(nw_config* config, const char* key, const void* data) {
+- const char** value = (const char**)data;
+-
+- return nw_config_set(config, key, *value);
++int nw_config_write_string(nw_config* config, const char* key, const void* value) {
++ return nw_config_set(config, key, *(const char**)value);
+ }
+
+ // Address
+
+-int nw_config_read_address(nw_config* config, const char* key, void* data) {
+- nw_address_t* address = (nw_address_t*)data;
++int nw_config_read_address(nw_config* config, const char* key, void* value) {
++ nw_address_t* address = (nw_address_t*)value;
+ int r;
+
+ // Fetch the value
+- const char* value = nw_config_get(config, key);
+- if (!value)
++ const char* p = nw_config_get(config, key);
++ if (!p)
+ return -EINVAL;
+
+- r = nw_address_from_string(address, value);
++ r = nw_address_from_string(address, p);
+ if (r < 0)
+- ERROR("Could not parse address: %s\n", value);
++ ERROR("Could not parse address: %s\n", p);
+
+ return r;
+ }
+
+-int nw_config_write_address(nw_config* config, const char* key, const void* data) {
+- const nw_address_t* address = (nw_address_t*)data;
++int nw_config_write_address(nw_config* config, const char* key, const void* value) {
++ const nw_address_t* address = (nw_address_t*)value;
+ int r;
+
+ // Format the address to string
+- char* value = nw_address_to_string(address);
+- if (!value)
++ char* p = nw_address_to_string(address);
++ if (!p)
+ return -errno;
+
+ // Store the value
+- r = nw_config_set(config, key, value);
++ r = nw_config_set(config, key, p);
+ if (r < 0)
+ goto ERROR;
+
+@@ -608,8 +602,8 @@ int nw_config_write_address(nw_config* config, const char* key, const void* data
+ r = 0;
+
+ ERROR:
+- if (value)
+- free(value);
++ if (p)
++ free(p);
+
+ return r;
+ }
+diff --git a/src/networkd/config.h b/src/networkd/config.h
+index b5417e4..7185038 100644
+--- a/src/networkd/config.h
++++ b/src/networkd/config.h
+@@ -62,9 +62,9 @@ int nw_config_options_read(nw_config* config);
+ int nw_config_options_write(nw_config* config);
+
+ typedef int (*nw_config_option_read_callback_t)
+- (nw_config* config, const char* key, void* data);
++ (nw_config* config, const char* key, void* value);
+ typedef int (*nw_config_option_write_callback_t)
+- (nw_config* config, const char* key, const void* data);
++ (nw_config* config, const char* key, const void* value);
+
+ int nw_config_option_add(nw_config* config, const char* key, void* value,
+ nw_config_option_read_callback_t read_callback,
+@@ -73,22 +73,22 @@ int nw_config_option_add(nw_config* config, const char* key, void* value,
+ #define NW_CONFIG_OPTION(config, key, data, read_callback, write_callback) \
+ nw_config_option_add(config, key, data, read_callback, write_callback)
+
+-#define NW_CONFIG_OPTION_STRING(config, key, data) \
+- nw_config_option_add(config, key, data, nw_config_read_string, nw_config_write_string)
++#define NW_CONFIG_OPTION_STRING(config, key, value) \
++ nw_config_option_add(config, key, value, nw_config_read_string, nw_config_write_string)
+
+-int nw_config_read_string(nw_config* config, const char* key, void* data);
+-int nw_config_write_string(nw_config* config, const char* key, const void* data);
++int nw_config_read_string(nw_config* config, const char* key, void* value);
++int nw_config_write_string(nw_config* config, const char* key, const void* value);
+
+-#define NW_CONFIG_OPTION_INT(config, key, data) \
+- nw_config_option_add(config, key, data, nw_config_read_int, nw_config_write_int)
++#define NW_CONFIG_OPTION_INT(config, key, value) \
++ nw_config_option_add(config, key, value, nw_config_read_int, nw_config_write_int)
+
+-int nw_config_read_int(nw_config* config, const char* key, void* data);
+-int nw_config_write_int(nw_config* config, const char* key, const void* data);
++int nw_config_read_int(nw_config* config, const char* key, void* value);
++int nw_config_write_int(nw_config* config, const char* key, const void* value);
+
+-#define NW_CONFIG_OPTION_ADDRESS(config, key, data) \
+- nw_config_option_add(config, key, data, nw_config_read_address, nw_config_write_address)
++#define NW_CONFIG_OPTION_ADDRESS(config, key, value) \
++ nw_config_option_add(config, key, value, nw_config_read_address, nw_config_write_address)
+
+-int nw_config_read_address(nw_config* config, const char* key, void* data);
+-int nw_config_write_address(nw_config* config, const char* key, const void* data);
++int nw_config_read_address(nw_config* config, const char* key, void* value);
++int nw_config_write_address(nw_config* config, const char* key, const void* value);
+
+ #endif /* NETWORKD_CONFIG_H */
+--
+2.39.2
+
diff --git a/network/patches/0262-config-Add-data-pointer-to-callbacks.patch b/network/patches/0262-config-Add-data-pointer-to-callbacks.patch
new file mode 100644
index 000000000..a97c8d0ac
--- /dev/null
+++ b/network/patches/0262-config-Add-data-pointer-to-callbacks.patch
@@ -0,0 +1,255 @@
+From 3eeb38b7ad3a343645127f11fea281ed2a22e80a Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Thu, 8 Jun 2023 15:23:10 +0000
+Subject: [PATCH 262/304] config: Add data pointer to callbacks
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/config.c | 23 ++++++++++++++---------
+ src/networkd/config.h | 28 ++++++++++++++--------------
+ src/networkd/port-bonding.c | 18 ++++++++++--------
+ src/networkd/port-vlan.c | 18 ++++++++++--------
+ 4 files changed, 48 insertions(+), 39 deletions(-)
+
+diff --git a/src/networkd/config.c b/src/networkd/config.c
+index b142d17..39e9881 100644
+--- a/src/networkd/config.c
++++ b/src/networkd/config.c
+@@ -47,6 +47,7 @@ struct nw_config_option {
+ // Callbacks
+ nw_config_option_read_callback_t read_callback;
+ nw_config_option_write_callback_t write_callback;
++ void* data;
+ };
+
+ struct nw_config {
+@@ -491,7 +492,7 @@ int nw_config_options_read(nw_config* config) {
+ int r;
+
+ STAILQ_FOREACH(option, &config->options, nodes) {
+- r = option->read_callback(config, option->key, option->value);
++ r = option->read_callback(config, option->key, option->value, option->data);
+ if (r < 0)
+ return r;
+ }
+@@ -504,7 +505,7 @@ int nw_config_options_write(nw_config* config) {
+ int r;
+
+ STAILQ_FOREACH(option, &config->options, nodes) {
+- r = option->write_callback(config, option->key, option->value);
++ r = option->write_callback(config, option->key, option->value, option->data);
+ if (r < 0)
+ return r;
+ }
+@@ -514,7 +515,7 @@ int nw_config_options_write(nw_config* config) {
+
+ int nw_config_option_add(nw_config* config, const char* key, void* value,
+ nw_config_option_read_callback_t read_callback,
+- nw_config_option_write_callback_t write_callback) {
++ nw_config_option_write_callback_t write_callback, void* data) {
+ // Check input
+ if (!key || !value || !read_callback || !write_callback)
+ return -EINVAL;
+@@ -533,6 +534,7 @@ int nw_config_option_add(nw_config* config, const char* key, void* value,
+ // Set callbacks
+ option->read_callback = read_callback;
+ option->write_callback = write_callback;
++ option->data = data;
+
+ // Append the new option
+ STAILQ_INSERT_TAIL(&config->options, option, nodes);
+@@ -540,20 +542,21 @@ int nw_config_option_add(nw_config* config, const char* key, void* value,
+ return 0;
+ }
+
+-int nw_config_read_int(nw_config* config, const char* key, void* value) {
++int nw_config_read_int(nw_config* config, const char* key, void* value, void* data) {
+ // Fetch the value
+ *(int*)value = nw_config_get_int(config, key, -1);
+
+ return 0;
+ }
+
+-int nw_config_write_int(nw_config* config, const char* key, const void* value) {
++int nw_config_write_int(nw_config* config,
++ const char* key, const void* value, void* data) {
+ return 0;
+ }
+
+ // String
+
+-int nw_config_read_string(nw_config* config, const char* key, void* value) {
++int nw_config_read_string(nw_config* config, const char* key, void* value, void* data) {
+ // Fetch the value
+ const char* p = nw_config_get(config, key);
+ if (p)
+@@ -562,13 +565,14 @@ int nw_config_read_string(nw_config* config, const char* key, void* value) {
+ return 0;
+ }
+
+-int nw_config_write_string(nw_config* config, const char* key, const void* value) {
++int nw_config_write_string(nw_config* config,
++ const char* key, const void* value, void* data) {
+ return nw_config_set(config, key, *(const char**)value);
+ }
+
+ // Address
+
+-int nw_config_read_address(nw_config* config, const char* key, void* value) {
++int nw_config_read_address(nw_config* config, const char* key, void* value, void* data) {
+ nw_address_t* address = (nw_address_t*)value;
+ int r;
+
+@@ -584,7 +588,8 @@ int nw_config_read_address(nw_config* config, const char* key, void* value) {
+ return r;
+ }
+
+-int nw_config_write_address(nw_config* config, const char* key, const void* value) {
++int nw_config_write_address(nw_config* config,
++ const char* key, const void* value, void* data) {
+ const nw_address_t* address = (nw_address_t*)value;
+ int r;
+
+diff --git a/src/networkd/config.h b/src/networkd/config.h
+index 7185038..d6b8db8 100644
+--- a/src/networkd/config.h
++++ b/src/networkd/config.h
+@@ -62,33 +62,33 @@ int nw_config_options_read(nw_config* config);
+ int nw_config_options_write(nw_config* config);
+
+ typedef int (*nw_config_option_read_callback_t)
+- (nw_config* config, const char* key, void* value);
++ (nw_config* config, const char* key, void* value, void* data);
+ typedef int (*nw_config_option_write_callback_t)
+- (nw_config* config, const char* key, const void* value);
++ (nw_config* config, const char* key, const void* value, void* data);
+
+ int nw_config_option_add(nw_config* config, const char* key, void* value,
+ nw_config_option_read_callback_t read_callback,
+- nw_config_option_write_callback_t write_callback);
++ nw_config_option_write_callback_t write_callback, void* data);
+
+-#define NW_CONFIG_OPTION(config, key, data, read_callback, write_callback) \
+- nw_config_option_add(config, key, data, read_callback, write_callback)
++#define NW_CONFIG_OPTION(config, key, value, read_callback, write_callback, data) \
++ nw_config_option_add(config, key, value, read_callback, write_callback, data)
+
+ #define NW_CONFIG_OPTION_STRING(config, key, value) \
+- nw_config_option_add(config, key, value, nw_config_read_string, nw_config_write_string)
++ nw_config_option_add(config, key, value, nw_config_read_string, nw_config_write_string, NULL)
+
+-int nw_config_read_string(nw_config* config, const char* key, void* value);
+-int nw_config_write_string(nw_config* config, const char* key, const void* value);
++int nw_config_read_string(nw_config* config, const char* key, void* value, void* data);
++int nw_config_write_string(nw_config* config, const char* key, const void* value, void* data);
+
+ #define NW_CONFIG_OPTION_INT(config, key, value) \
+- nw_config_option_add(config, key, value, nw_config_read_int, nw_config_write_int)
++ nw_config_option_add(config, key, value, nw_config_read_int, nw_config_write_int, NULL)
+
+-int nw_config_read_int(nw_config* config, const char* key, void* value);
+-int nw_config_write_int(nw_config* config, const char* key, const void* value);
++int nw_config_read_int(nw_config* config, const char* key, void* value, void* data);
++int nw_config_write_int(nw_config* config, const char* key, const void* value, void* data);
+
+ #define NW_CONFIG_OPTION_ADDRESS(config, key, value) \
+- nw_config_option_add(config, key, value, nw_config_read_address, nw_config_write_address)
++ nw_config_option_add(config, key, value, nw_config_read_address, nw_config_write_address, NULL)
+
+-int nw_config_read_address(nw_config* config, const char* key, void* value);
+-int nw_config_write_address(nw_config* config, const char* key, const void* value);
++int nw_config_read_address(nw_config* config, const char* key, void* value, void* data);
++int nw_config_write_address(nw_config* config, const char* key, const void* value, void* data);
+
+ #endif /* NETWORKD_CONFIG_H */
+diff --git a/src/networkd/port-bonding.c b/src/networkd/port-bonding.c
+index e765791..7bd54e1 100644
+--- a/src/networkd/port-bonding.c
++++ b/src/networkd/port-bonding.c
+@@ -40,12 +40,13 @@ const struct nw_string_table nw_port_bonding_mode[] = {
+
+ NW_STRING_TABLE_LOOKUP(nw_port_bonding_mode_t, nw_port_bonding_mode)
+
+-static int nw_port_bonding_read_mode(nw_config* config, const char* key, void* data) {
+- int* mode = (int*)data;
++static int nw_port_bonding_read_mode(nw_config* config,
++ const char* key, void* value, void* data) {
++ int* mode = (int*)value;
+
+- const char* value = nw_config_get(config, key);
+- if (value) {
+- *mode = nw_port_bonding_mode_from_string(value);
++ const char* p = nw_config_get(config, key);
++ if (p) {
++ *mode = nw_port_bonding_mode_from_string(p);
+ if (!*mode)
+ return -errno;
+ }
+@@ -53,8 +54,9 @@ static int nw_port_bonding_read_mode(nw_config* config, const char* key, void* d
+ return 0;
+ }
+
+-static int nw_port_bonding_write_mode(nw_config* config, const char* key, const void* data) {
+- const int* mode = (int*)data;
++static int nw_port_bonding_write_mode(nw_config* config,
++ const char* key, const void* value, void* data) {
++ const int* mode = (int*)value;
+
+ return nw_config_set(config, key, nw_port_bonding_mode_to_string(*mode));
+ }
+@@ -64,7 +66,7 @@ static int nw_port_bonding_setup(nw_port* port) {
+
+ // Mode
+ r = NW_CONFIG_OPTION(port->config, "BONDING_MODE", &port->bonding.mode,
+- nw_port_bonding_read_mode, nw_port_bonding_write_mode);
++ nw_port_bonding_read_mode, nw_port_bonding_write_mode, NULL);
+ if (r < 0)
+ return r;
+
+diff --git a/src/networkd/port-vlan.c b/src/networkd/port-vlan.c
+index 2d89a09..e3f93d7 100644
+--- a/src/networkd/port-vlan.c
++++ b/src/networkd/port-vlan.c
+@@ -38,12 +38,13 @@ const struct nw_string_table nw_port_vlan_proto[] = {
+
+ NW_STRING_TABLE_LOOKUP(nw_port_vlan_proto_t, nw_port_vlan_proto)
+
+-static int nw_port_vlan_read_proto(nw_config* config, const char* key, void* data) {
+- nw_port_vlan_proto_t* proto = (nw_port_vlan_proto_t*)data;
++static int nw_port_vlan_read_proto(nw_config* config,
++ const char* key, void* value, void* data) {
++ nw_port_vlan_proto_t* proto = (nw_port_vlan_proto_t*)value;
+
+- const char* value = nw_config_get(config, key);
+- if (value) {
+- *proto = nw_port_vlan_proto_from_string(data);
++ const char* p = nw_config_get(config, key);
++ if (p) {
++ *proto = nw_port_vlan_proto_from_string(p);
+ if (!*proto)
+ return -errno;
+ }
+@@ -51,8 +52,9 @@ static int nw_port_vlan_read_proto(nw_config* config, const char* key, void* dat
+ return 0;
+ }
+
+-static int nw_port_vlan_write_proto(nw_config* config, const char* key, const void* data) {
+- const nw_port_vlan_proto_t* proto = (nw_port_vlan_proto_t*)data;
++static int nw_port_vlan_write_proto(nw_config* config,
++ const char* key, const void* value, void* data) {
++ const nw_port_vlan_proto_t* proto = (nw_port_vlan_proto_t*)value;
+
+ return nw_config_set(config, key, nw_port_vlan_proto_to_string(*proto));
+ }
+@@ -67,7 +69,7 @@ static int nw_port_vlan_setup(nw_port* port) {
+
+ // VLAN Protocol
+ r = NW_CONFIG_OPTION(port->config, "VLAN_PROTO", &port->vlan.proto,
+- nw_port_vlan_read_proto, nw_port_vlan_write_proto);
++ nw_port_vlan_read_proto, nw_port_vlan_write_proto, NULL);
+ if (r < 0)
+ return r;
+
+--
+2.39.2
+
diff --git a/network/patches/0263-string-Define-an-own-type-for-string-tables.patch b/network/patches/0263-string-Define-an-own-type-for-string-tables.patch
new file mode 100644
index 000000000..b309634cb
--- /dev/null
+++ b/network/patches/0263-string-Define-an-own-type-for-string-tables.patch
@@ -0,0 +1,75 @@
+From 644eb1c88dc179c3efdeb6af32c5d153d5483957 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Thu, 8 Jun 2023 15:30:41 +0000
+Subject: [PATCH 263/304] string: Define an own type for string tables
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/port-bonding.c | 2 +-
+ src/networkd/port-vlan.c | 2 +-
+ src/networkd/string.h | 12 ++++++------
+ 3 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/src/networkd/port-bonding.c b/src/networkd/port-bonding.c
+index 7bd54e1..b1d2c18 100644
+--- a/src/networkd/port-bonding.c
++++ b/src/networkd/port-bonding.c
+@@ -27,7 +27,7 @@
+ #include "port-bonding.h"
+ #include "string.h"
+
+-const struct nw_string_table nw_port_bonding_mode[] = {
++const nw_string_table_t nw_port_bonding_mode[] = {
+ { NW_BONDING_MODE_ROUNDROBIN, "round-robin" },
+ { NW_BONDING_MODE_ACTIVEBACKUP, "active-backup" },
+ { NW_BONDING_MODE_XOR, "xor" },
+diff --git a/src/networkd/port-vlan.c b/src/networkd/port-vlan.c
+index e3f93d7..792fd28 100644
+--- a/src/networkd/port-vlan.c
++++ b/src/networkd/port-vlan.c
+@@ -30,7 +30,7 @@
+ #include "port-vlan.h"
+ #include "string.h"
+
+-const struct nw_string_table nw_port_vlan_proto[] = {
++const nw_string_table_t nw_port_vlan_proto[] = {
+ { NW_VLAN_PROTO_8021Q, "802.1Q" },
+ { NW_VLAN_PROTO_8021ad, "802.1ad" },
+ { -1, NULL },
+diff --git a/src/networkd/string.h b/src/networkd/string.h
+index d94e270..270ed6b 100644
+--- a/src/networkd/string.h
++++ b/src/networkd/string.h
+@@ -129,14 +129,14 @@ static inline void nw_string_empty(char* s) {
+ Tables
+ */
+
+-struct nw_string_table {
++typedef struct nw_string_table {
+ const int id;
+ const char* string;
+-};
++} nw_string_table_t;
+
+ static inline const char* nw_string_table_lookup_string(
+- const struct nw_string_table* table, const int id) {
+- const struct nw_string_table* entry = NULL;
++ const nw_string_table_t* table, const int id) {
++ const nw_string_table_t* entry = NULL;
+
+ for (entry = table; entry->string; entry++)
+ if (entry->id == id)
+@@ -146,8 +146,8 @@ static inline const char* nw_string_table_lookup_string(
+ }
+
+ static inline int nw_string_table_lookup_id(
+- const struct nw_string_table* table, const char* string) {
+- const struct nw_string_table* entry = NULL;
++ const nw_string_table_t* table, const char* string) {
++ const nw_string_table_t* entry = NULL;
+
+ for (entry = table; entry->string; entry++)
+ if (strcmp(entry->string, string) == 0)
+--
+2.39.2
+
diff --git a/network/patches/0264-config-Implement-option-that-looks-up-string-tables.patch b/network/patches/0264-config-Implement-option-that-looks-up-string-tables.patch
new file mode 100644
index 000000000..6faf489ad
--- /dev/null
+++ b/network/patches/0264-config-Implement-option-that-looks-up-string-tables.patch
@@ -0,0 +1,184 @@
+From 7442668a42febaf6ad533c6d7647ad7847cb4775 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Thu, 8 Jun 2023 15:46:20 +0000
+Subject: [PATCH 264/304] config: Implement option that looks up string tables
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/config.c | 37 +++++++++++++++++++++++++++++++++++++
+ src/networkd/config.h | 14 ++++++++++++++
+ src/networkd/port-bonding.c | 25 ++-----------------------
+ src/networkd/port-vlan.c | 25 ++-----------------------
+ 4 files changed, 55 insertions(+), 46 deletions(-)
+
+diff --git a/src/networkd/config.c b/src/networkd/config.c
+index 39e9881..ee5e8b8 100644
+--- a/src/networkd/config.c
++++ b/src/networkd/config.c
+@@ -570,6 +570,43 @@ int nw_config_write_string(nw_config* config,
+ return nw_config_set(config, key, *(const char**)value);
+ }
+
++// String Table
++
++int nw_config_read_string_table(nw_config* config, const char* key, void* value, void* data) {
++ const char* s = NULL;
++ int* v = (int*)value;
++
++ const nw_string_table_t* table = (nw_string_table_t*)data;
++
++ // Fetch the string
++ s = nw_config_get(config, key);
++ if (!s)
++ return -errno;
++
++ // Lookup the string in the table
++ *v = nw_string_table_lookup_id(table, s);
++
++ // If the result is negative, nothing was found
++ if (*v < 0)
++ return -EINVAL;
++
++ return 0;
++}
++
++int nw_config_write_string_table(nw_config* config,
++ const char* key, const void* value, void* data) {
++ int* v = (int*)value;
++
++ const nw_string_table_t* table = (nw_string_table_t*)data;
++
++ // Lookup the string
++ const char* s = nw_string_table_lookup_string(table, *v);
++ if (!s)
++ return -errno;
++
++ return nw_config_set(config, key, s);
++}
++
+ // Address
+
+ int nw_config_read_address(nw_config* config, const char* key, void* value, void* data) {
+diff --git a/src/networkd/config.h b/src/networkd/config.h
+index d6b8db8..63e9d18 100644
+--- a/src/networkd/config.h
++++ b/src/networkd/config.h
+@@ -73,18 +73,32 @@ int nw_config_option_add(nw_config* config, const char* key, void* value,
+ #define NW_CONFIG_OPTION(config, key, value, read_callback, write_callback, data) \
+ nw_config_option_add(config, key, value, read_callback, write_callback, data)
+
++// String
++
+ #define NW_CONFIG_OPTION_STRING(config, key, value) \
+ nw_config_option_add(config, key, value, nw_config_read_string, nw_config_write_string, NULL)
+
+ int nw_config_read_string(nw_config* config, const char* key, void* value, void* data);
+ int nw_config_write_string(nw_config* config, const char* key, const void* value, void* data);
+
++// String Table
++
++#define NW_CONFIG_OPTION_STRING_TABLE(config, key, value, table) \
++ nw_config_option_add(config, key, value, nw_config_read_string_table, nw_config_write_string_table, (void*)table)
++
++int nw_config_read_string_table(nw_config* config, const char* key, void* value, void* data);
++int nw_config_write_string_table(nw_config* config, const char* key, const void* value, void* data);
++
++// Integer
++
+ #define NW_CONFIG_OPTION_INT(config, key, value) \
+ nw_config_option_add(config, key, value, nw_config_read_int, nw_config_write_int, NULL)
+
+ int nw_config_read_int(nw_config* config, const char* key, void* value, void* data);
+ int nw_config_write_int(nw_config* config, const char* key, const void* value, void* data);
+
++// Address
++
+ #define NW_CONFIG_OPTION_ADDRESS(config, key, value) \
+ nw_config_option_add(config, key, value, nw_config_read_address, nw_config_write_address, NULL)
+
+diff --git a/src/networkd/port-bonding.c b/src/networkd/port-bonding.c
+index b1d2c18..4e4c8a7 100644
+--- a/src/networkd/port-bonding.c
++++ b/src/networkd/port-bonding.c
+@@ -40,33 +40,12 @@ const nw_string_table_t nw_port_bonding_mode[] = {
+
+ NW_STRING_TABLE_LOOKUP(nw_port_bonding_mode_t, nw_port_bonding_mode)
+
+-static int nw_port_bonding_read_mode(nw_config* config,
+- const char* key, void* value, void* data) {
+- int* mode = (int*)value;
+-
+- const char* p = nw_config_get(config, key);
+- if (p) {
+- *mode = nw_port_bonding_mode_from_string(p);
+- if (!*mode)
+- return -errno;
+- }
+-
+- return 0;
+-}
+-
+-static int nw_port_bonding_write_mode(nw_config* config,
+- const char* key, const void* value, void* data) {
+- const int* mode = (int*)value;
+-
+- return nw_config_set(config, key, nw_port_bonding_mode_to_string(*mode));
+-}
+-
+ static int nw_port_bonding_setup(nw_port* port) {
+ int r;
+
+ // Mode
+- r = NW_CONFIG_OPTION(port->config, "BONDING_MODE", &port->bonding.mode,
+- nw_port_bonding_read_mode, nw_port_bonding_write_mode, NULL);
++ r = NW_CONFIG_OPTION_STRING_TABLE(port->config,
++ "BONDING_MODE", &port->bonding.mode, nw_port_bonding_mode);
+ if (r < 0)
+ return r;
+
+diff --git a/src/networkd/port-vlan.c b/src/networkd/port-vlan.c
+index 792fd28..8f5372e 100644
+--- a/src/networkd/port-vlan.c
++++ b/src/networkd/port-vlan.c
+@@ -38,27 +38,6 @@ const nw_string_table_t nw_port_vlan_proto[] = {
+
+ NW_STRING_TABLE_LOOKUP(nw_port_vlan_proto_t, nw_port_vlan_proto)
+
+-static int nw_port_vlan_read_proto(nw_config* config,
+- const char* key, void* value, void* data) {
+- nw_port_vlan_proto_t* proto = (nw_port_vlan_proto_t*)value;
+-
+- const char* p = nw_config_get(config, key);
+- if (p) {
+- *proto = nw_port_vlan_proto_from_string(p);
+- if (!*proto)
+- return -errno;
+- }
+-
+- return 0;
+-}
+-
+-static int nw_port_vlan_write_proto(nw_config* config,
+- const char* key, const void* value, void* data) {
+- const nw_port_vlan_proto_t* proto = (nw_port_vlan_proto_t*)value;
+-
+- return nw_config_set(config, key, nw_port_vlan_proto_to_string(*proto));
+-}
+-
+ static int nw_port_vlan_setup(nw_port* port) {
+ int r;
+
+@@ -68,8 +47,8 @@ static int nw_port_vlan_setup(nw_port* port) {
+ return r;
+
+ // VLAN Protocol
+- r = NW_CONFIG_OPTION(port->config, "VLAN_PROTO", &port->vlan.proto,
+- nw_port_vlan_read_proto, nw_port_vlan_write_proto, NULL);
++ r = NW_CONFIG_OPTION_STRING_TABLE(port->config,
++ "VLAN_PROTO", &port->vlan.proto, nw_port_vlan_proto);
+ if (r < 0)
+ return r;
+
+--
+2.39.2
+
diff --git a/network/patches/0265-ports-Store-the-parent-name.patch b/network/patches/0265-ports-Store-the-parent-name.patch
new file mode 100644
index 000000000..62d2d4863
--- /dev/null
+++ b/network/patches/0265-ports-Store-the-parent-name.patch
@@ -0,0 +1,32 @@
+From d200865e663a1a15b43d7462cbcddf7c13dc6997 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Thu, 8 Jun 2023 15:48:20 +0000
+Subject: [PATCH 265/304] ports: Store the parent name
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/port-vlan.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/src/networkd/port-vlan.c b/src/networkd/port-vlan.c
+index 8f5372e..45abebe 100644
+--- a/src/networkd/port-vlan.c
++++ b/src/networkd/port-vlan.c
+@@ -209,9 +209,13 @@ int nw_port_set_vlan_parent(nw_port* port, nw_port* parent) {
+ }
+
+ // Store the new parent
+- if (parent)
++ if (parent) {
+ port->vlan.parent = nw_port_ref(parent);
+
++ // Store the name
++ nw_string_set(port->vlan.__parent_name, nw_port_name(parent));
++ }
++
+ DEBUG("Port %s: Set VLAN parent to %s\n", port->name, nw_port_name(port->vlan.parent));
+
+ return 0;
+--
+2.39.2
+
diff --git a/network/patches/0266-ports-VLAN-Make-all-constants-uppercase.patch b/network/patches/0266-ports-VLAN-Make-all-constants-uppercase.patch
new file mode 100644
index 000000000..cde9e5d33
--- /dev/null
+++ b/network/patches/0266-ports-VLAN-Make-all-constants-uppercase.patch
@@ -0,0 +1,49 @@
+From 4db7e54816eb20319d2f90336a029386b0cd3e91 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Thu, 8 Jun 2023 15:49:27 +0000
+Subject: [PATCH 266/304] ports: VLAN: Make all constants uppercase
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/port-vlan.c | 4 ++--
+ src/networkd/port-vlan.h | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/src/networkd/port-vlan.c b/src/networkd/port-vlan.c
+index 45abebe..56b0274 100644
+--- a/src/networkd/port-vlan.c
++++ b/src/networkd/port-vlan.c
+@@ -32,7 +32,7 @@
+
+ const nw_string_table_t nw_port_vlan_proto[] = {
+ { NW_VLAN_PROTO_8021Q, "802.1Q" },
+- { NW_VLAN_PROTO_8021ad, "802.1ad" },
++ { NW_VLAN_PROTO_8021AD, "802.1ad" },
+ { -1, NULL },
+ };
+
+@@ -161,7 +161,7 @@ int nw_port_set_vlan_id(nw_port* port, int id) {
+ int nw_port_set_vlan_proto(nw_port* port, const nw_port_vlan_proto_t proto) {
+ switch (proto) {
+ case NW_VLAN_PROTO_8021Q:
+- case NW_VLAN_PROTO_8021ad:
++ case NW_VLAN_PROTO_8021AD:
+ port->vlan.proto = proto;
+ break;
+
+diff --git a/src/networkd/port-vlan.h b/src/networkd/port-vlan.h
+index 17d3134..b4df562 100644
+--- a/src/networkd/port-vlan.h
++++ b/src/networkd/port-vlan.h
+@@ -28,7 +28,7 @@
+
+ typedef enum nw_port_vlan_proto {
+ NW_VLAN_PROTO_8021Q = ETH_P_8021Q,
+- NW_VLAN_PROTO_8021ad = ETH_P_8021AD,
++ NW_VLAN_PROTO_8021AD = ETH_P_8021AD,
+ } nw_port_vlan_proto_t;
+
+ struct nw_port_vlan {
+--
+2.39.2
+
diff --git a/network/patches/0267-ports-Unify-type.patch b/network/patches/0267-ports-Unify-type.patch
new file mode 100644
index 000000000..d0ab4df5c
--- /dev/null
+++ b/network/patches/0267-ports-Unify-type.patch
@@ -0,0 +1,440 @@
+From c464b5d1e146402f153f98a5e5d04b76b4d74e10 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Thu, 8 Jun 2023 16:19:05 +0000
+Subject: [PATCH 267/304] ports: Unify type
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/port-bonding.c | 17 ++++------
+ src/networkd/port-bonding.h | 2 +-
+ src/networkd/port-dummy.c | 2 +-
+ src/networkd/port-dummy.h | 2 +-
+ src/networkd/port-vlan.c | 19 +++++------
+ src/networkd/port-vlan.h | 2 +-
+ src/networkd/port.c | 68 ++++++++++++++++---------------------
+ src/networkd/port.h | 66 +++++++++++++++++------------------
+ 8 files changed, 80 insertions(+), 98 deletions(-)
+
+diff --git a/src/networkd/port-bonding.c b/src/networkd/port-bonding.c
+index 4e4c8a7..ad02b5d 100644
+--- a/src/networkd/port-bonding.c
++++ b/src/networkd/port-bonding.c
+@@ -76,20 +76,17 @@ ERROR:
+ return r;
+ }
+
+-const nw_port_info_t nw_port_info_bonding = {
++const nw_port_type_t nw_port_type_bonding = {
+ .kind = "bond",
+
+- // Operations
+- .ops = {
+- // Configuration
+- .setup = nw_port_bonding_setup,
++ // Configuration
++ .setup = nw_port_bonding_setup,
+
+- // Link
+- .create_link = nw_port_bonding_create_link,
++ // Link
++ .create_link = nw_port_bonding_create_link,
+
+- // JSON
+- .to_json = nw_port_bonding_to_json,
+- },
++ // JSON
++ .to_json = nw_port_bonding_to_json,
+ };
+
+ const char* nw_port_bonding_get_mode(nw_port* port) {
+diff --git a/src/networkd/port-bonding.h b/src/networkd/port-bonding.h
+index e21c251..e5c8c32 100644
+--- a/src/networkd/port-bonding.h
++++ b/src/networkd/port-bonding.h
+@@ -39,7 +39,7 @@ struct nw_port_bonding {
+ nw_port_bonding_mode_t mode;
+ };
+
+-extern const nw_port_info_t nw_port_info_bonding;
++extern const nw_port_type_t nw_port_type_bonding;
+
+ const char* nw_port_bonding_get_mode(nw_port* port);
+ int nw_port_bonding_set_mode(nw_port* port, const char* mode);
+diff --git a/src/networkd/port-dummy.c b/src/networkd/port-dummy.c
+index e71e740..8a44008 100644
+--- a/src/networkd/port-dummy.c
++++ b/src/networkd/port-dummy.c
+@@ -20,6 +20,6 @@
+
+ #include "port-dummy.h"
+
+-const nw_port_info_t nw_port_info_dummy = {
++const nw_port_type_t nw_port_type_dummy = {
+ .kind = "dummy",
+ };
+diff --git a/src/networkd/port-dummy.h b/src/networkd/port-dummy.h
+index b74c991..34a7265 100644
+--- a/src/networkd/port-dummy.h
++++ b/src/networkd/port-dummy.h
+@@ -23,6 +23,6 @@
+
+ #include "port.h"
+
+-extern const nw_port_info_t nw_port_info_dummy;
++extern const nw_port_type_t nw_port_type_dummy;
+
+ #endif /* NETWORKD_PORT_DUMMY_H */
+diff --git a/src/networkd/port-vlan.c b/src/networkd/port-vlan.c
+index 56b0274..06047ab 100644
+--- a/src/networkd/port-vlan.c
++++ b/src/networkd/port-vlan.c
+@@ -106,22 +106,19 @@ ERROR:
+ return r;
+ }
+
+-const nw_port_info_t nw_port_info_vlan = {
++const nw_port_type_t nw_port_type_vlan = {
+ .kind = "vlan",
+
+- // Operations
+- .ops = {
+- // Configuration
+- .setup = nw_port_vlan_setup,
++ // Configuration
++ .setup = nw_port_vlan_setup,
+
+- .get_parent_port = nw_port_get_vlan_parent,
++ .get_parent_port = nw_port_get_vlan_parent,
+
+- // Link
+- .create_link = nw_port_vlan_create_link,
++ // Link
++ .create_link = nw_port_vlan_create_link,
+
+- // JSON
+- .to_json = nw_port_vlan_to_json,
+- },
++ // JSON
++ .to_json = nw_port_vlan_to_json,
+ };
+
+ /*
+diff --git a/src/networkd/port-vlan.h b/src/networkd/port-vlan.h
+index b4df562..6ecf6a4 100644
+--- a/src/networkd/port-vlan.h
++++ b/src/networkd/port-vlan.h
+@@ -45,7 +45,7 @@ struct nw_port_vlan {
+ char __parent_name[IF_NAMESIZE];
+ };
+
+-extern const nw_port_info_t nw_port_info_vlan;
++extern const nw_port_type_t nw_port_type_vlan;
+
+ // ID
+ int nw_port_get_vlan_id(nw_port* port);
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index cab8fc5..c4d6ffe 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -37,26 +37,14 @@
+ #include "stats-collector.h"
+ #include "string.h"
+
+-static const struct nw_port_type_map {
+- nw_port_type_t type;
+- const char* name;
+-} nw_port_type_map[] = {
++static const nw_string_table_t nw_port_type_id[] = {
+ { NW_PORT_BONDING, "bonding" },
+ { NW_PORT_DUMMY, "dummy" },
+ { NW_PORT_VLAN, "vlan" },
+- { NW_PORT_UNKNOWN, NULL },
++ { -1, NULL },
+ };
+
+-static nw_port_type_t nw_port_type_from_string(const char* s) {
+- const struct nw_port_type_map* map = NULL;
+-
+- for (map = nw_port_type_map; *map->name; map++) {
+- if (strcmp(map->name, s) == 0)
+- return map->type;
+- }
+-
+- return NW_PORT_UNKNOWN;
+-}
++NW_STRING_TABLE_LOOKUP(nw_port_type_id_t, nw_port_type_id)
+
+ static void nw_port_free(nw_port* port) {
+ if (port->link)
+@@ -119,8 +107,8 @@ static int nw_port_setup(nw_port* port) {
+ goto ERROR;
+
+ // Call any custom initialization
+- if (NW_PORT_OPS(port)->setup) {
+- r = NW_PORT_OPS(port)->setup(port);
++ if (NW_PORT_TYPE(port)->setup) {
++ r = NW_PORT_TYPE(port)->setup(port);
+ if (r < 0)
+ goto ERROR;
+ }
+@@ -140,7 +128,7 @@ ERROR:
+ }
+
+ int nw_port_create(nw_port** port, nw_daemon* daemon,
+- nw_port_type_t type, const char* name, nw_config* config) {
++ const nw_port_type_id_t type, const char* name, nw_config* config) {
+ int r;
+
+ // Allocate a new object
+@@ -154,21 +142,18 @@ int nw_port_create(nw_port** port, nw_daemon* daemon,
+ // Initialize reference counter
+ p->nrefs = 1;
+
+- // Store the type
+- p->type = type;
+-
+ // Set operations
+- switch (p->type) {
++ switch (type) {
+ case NW_PORT_BONDING:
+- p->info = &nw_port_info_bonding;
++ p->type = &nw_port_type_bonding;
+ break;
+
+ case NW_PORT_DUMMY:
+- p->info = &nw_port_info_dummy;
++ p->type = &nw_port_type_dummy;
+ break;
+
+ case NW_PORT_VLAN:
+- p->info = &nw_port_info_vlan;
++ p->type = &nw_port_type_vlan;
+ break;
+ }
+
+@@ -214,7 +199,7 @@ int nw_port_create_from_config(nw_port** port, nw_daemon* daemon,
+ }
+
+ // Create a new port
+- r = nw_port_create(port, daemon, nw_port_type_from_string(type), name, config);
++ r = nw_port_create(port, daemon, nw_port_type_id_from_string(type), name, config);
+ if (r)
+ goto ERROR;
+
+@@ -286,7 +271,7 @@ int __nw_port_drop_port(nw_daemon* daemon, nw_port* port, void* data) {
+ nw_port* dropped_port = (nw_port*)data;
+ int r;
+
+- switch (port->type) {
++ switch (port->type->id) {
+ case NW_PORT_VLAN:
+ if (port->vlan.parent == dropped_port) {
+ r = nw_port_set_vlan_parent(port, NULL);
+@@ -392,10 +377,10 @@ static int nw_port_is_disabled(nw_port* port) {
+ }
+
+ nw_port* nw_port_get_parent_port(nw_port* port) {
+- if (!NW_PORT_OPS(port)->get_parent_port)
++ if (!NW_PORT_TYPE(port)->get_parent_port)
+ return NULL;
+
+- return NW_PORT_OPS(port)->get_parent_port(port);
++ return NW_PORT_TYPE(port)->get_parent_port(port);
+ }
+
+ static nw_link* nw_port_get_parent_link(nw_port* port) {
+@@ -444,6 +429,13 @@ static int nw_port_create_link(nw_port* port) {
+
+ DEBUG("Creating port %s...\n", port->name);
+
++ // Check the kind
++ if (!NW_PORT_TYPE(port)->kind) {
++ ERROR("Port type has no kind\n");
++ r = -ENOTSUP;
++ goto ERROR;
++ }
++
+ // Create a new link
+ r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
+ if (r < 0) {
+@@ -481,14 +473,14 @@ static int nw_port_create_link(nw_port* port) {
+ goto ERROR;
+
+ // Run the custom setup
+- if (NW_PORT_OPS(port)->create_link) {
+- r = sd_netlink_message_open_container_union(m, IFLA_INFO_DATA, NW_PORT_INFO(port)->kind);
++ if (NW_PORT_TYPE(port)->create_link) {
++ r = sd_netlink_message_open_container_union(m, IFLA_INFO_DATA, NW_PORT_TYPE(port)->kind);
+ if (r < 0) {
+ ERROR("Could not open IFLA_INFO_DATA container: %s\n", strerror(-r));
+ goto ERROR;
+ }
+
+- r = NW_PORT_OPS(port)->create_link(port, m);
++ r = NW_PORT_TYPE(port)->create_link(port, m);
+ if (r) {
+ ERROR("Could not create port %s: %m\n", port->name);
+ goto ERROR;
+@@ -501,7 +493,7 @@ static int nw_port_create_link(nw_port* port) {
+
+ // Just set IFLA_INFO_KIND if there is no custom function
+ } else {
+- r = sd_netlink_message_append_string(m, IFLA_INFO_KIND, NW_PORT_INFO(port)->kind);
++ r = sd_netlink_message_append_string(m, IFLA_INFO_KIND, NW_PORT_TYPE(port)->kind);
+ if (r < 0)
+ goto ERROR;
+ }
+@@ -588,8 +580,8 @@ int nw_port_update_stats(nw_port* port) {
+ return 0;
+ }
+
+-int nw_port_check_type(nw_port* port, const nw_port_type_t type) {
+- if (port->type == type)
++int nw_port_check_type(nw_port* port, const nw_port_type_id_t type) {
++ if (port->type->id == type)
+ return 0;
+
+ errno = ENOTSUP;
+@@ -616,7 +608,7 @@ int nw_port_to_json(nw_port* port, struct json_object** object) {
+ goto ERROR;
+
+ // Add Type
+- r = json_object_add_string(o, "Type", NW_PORT_INFO(port)->kind);
++ r = json_object_add_string(o, "Type", nw_port_type_id_to_string(port->type->id));
+ if (r < 0)
+ goto ERROR;
+
+@@ -629,8 +621,8 @@ int nw_port_to_json(nw_port* port, struct json_object** object) {
+ }
+
+ // Call custom stuff
+- if (NW_PORT_OPS(port)->to_json) {
+- r = NW_PORT_OPS(port)->to_json(port, o);
++ if (NW_PORT_TYPE(port)->to_json) {
++ r = NW_PORT_TYPE(port)->to_json(port, o);
+ if (r < 0)
+ goto ERROR;
+ }
+diff --git a/src/networkd/port.h b/src/networkd/port.h
+index ef68a89..c9add71 100644
+--- a/src/networkd/port.h
++++ b/src/networkd/port.h
+@@ -31,50 +31,49 @@
+
+ #define PORT_CONFIG_DIR CONFIG_DIR "/ports"
+
+-typedef enum nw_port_type {
+- NW_PORT_UNKNOWN = 0,
+- NW_PORT_BONDING,
+- NW_PORT_DUMMY,
+- NW_PORT_VLAN,
+-} nw_port_type_t;
+-
+ // VLAN
+ #define NW_VLAN_ID_INVALID 0
+ #define NW_VLAN_ID_MIN 1
+ #define NW_VLAN_ID_MAX 4096
+
+ typedef struct nw_port nw_port;
+-typedef struct nw_port_info nw_port_info_t;
+
+-#include "address.h"
+-#include "config.h"
+-#include "daemon.h"
+-#include "json.h"
+-#include "port-bonding.h"
+-#include "port-vlan.h"
++typedef enum nw_port_type_id {
++ NW_PORT_UNKNOWN = 0,
++ NW_PORT_BONDING,
++ NW_PORT_DUMMY,
++ NW_PORT_VLAN,
++} nw_port_type_id_t;
++
++typedef struct nw_port_type {
++ // Type ID
++ nw_port_type_id_t id;
+
+-struct nw_port_info {
+ // IFLA_INFO_KIND/IFLA_INFO_DATA
+ const char* kind;
+
+- struct nw_port_ops {
+- // Configuration
+- int (*setup)(nw_port* port);
++ // Configuration
++ int (*setup)(nw_port* port);
+
+- // Get Parent Port
+- nw_port* (*get_parent_port)(nw_port* port);
++ // Get Parent Port
++ nw_port* (*get_parent_port)(nw_port* port);
+
+- // Link
+- int (*create_link)(nw_port* port, sd_netlink_message* message);
+- int (*destroy_link)(nw_port* port);
++ // Link
++ int (*create_link)(nw_port* port, sd_netlink_message* message);
++ int (*destroy_link)(nw_port* port);
+
+- // JSON
+- int (*to_json)(nw_port* port, struct json_object* object);
+- } ops;
+-};
++ // JSON
++ int (*to_json)(nw_port* port, struct json_object* object);
++} nw_port_type_t;
++
++#include "address.h"
++#include "config.h"
++#include "daemon.h"
++#include "json.h"
++#include "port-bonding.h"
++#include "port-vlan.h"
+
+-#define NW_PORT_INFO(port) (port->info)
+-#define NW_PORT_OPS(port) (&NW_PORT_INFO(port)->ops)
++#define NW_PORT_TYPE(port) (port->type)
+
+ struct nw_port {
+ nw_daemon* daemon;
+@@ -83,7 +82,7 @@ struct nw_port {
+ // Link
+ nw_link* link;
+
+- nw_port_type_t type;
++ const nw_port_type_t* type;
+ char name[IF_NAMESIZE];
+
+ // Configuration
+@@ -92,9 +91,6 @@ struct nw_port {
+ // Common attributes
+ nw_address_t address;
+
+- // Type Operations
+- const nw_port_info_t* info;
+-
+ // Bonding Settings
+ struct nw_port_bonding bonding;
+
+@@ -103,7 +99,7 @@ struct nw_port {
+ };
+
+ int nw_port_create(nw_port** port, nw_daemon* daemon,
+- nw_port_type_t type, const char* name, nw_config* config);
++ const nw_port_type_id_t type, const char* name, nw_config* config);
+ int nw_port_create_from_config(nw_port** port, nw_daemon* daemon,
+ const char* name, const char* path);
+
+@@ -130,7 +126,7 @@ int nw_port_reconfigure(nw_port* port);
+
+ int nw_port_has_carrier(nw_port* port);
+
+-int nw_port_check_type(nw_port* port, const nw_port_type_t type);
++int nw_port_check_type(nw_port* port, const nw_port_type_id_t type);
+
+ // Stats
+ const struct rtnl_link_stats64* nw_port_get_stats64(nw_port* port);
+--
+2.39.2
+
diff --git a/network/patches/0268-ports-Move-VLAN-constants-to-VLAN-header.patch b/network/patches/0268-ports-Move-VLAN-constants-to-VLAN-header.patch
new file mode 100644
index 000000000..87b90df53
--- /dev/null
+++ b/network/patches/0268-ports-Move-VLAN-constants-to-VLAN-header.patch
@@ -0,0 +1,46 @@
+From 81ab55ae98a4280265fc7b3bee2c3770d621c152 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Thu, 8 Jun 2023 16:22:11 +0000
+Subject: [PATCH 268/304] ports: Move VLAN constants to VLAN header
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/port-vlan.h | 5 +++++
+ src/networkd/port.h | 5 -----
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/src/networkd/port-vlan.h b/src/networkd/port-vlan.h
+index 6ecf6a4..e17f7e7 100644
+--- a/src/networkd/port-vlan.h
++++ b/src/networkd/port-vlan.h
+@@ -31,6 +31,11 @@ typedef enum nw_port_vlan_proto {
+ NW_VLAN_PROTO_8021AD = ETH_P_8021AD,
+ } nw_port_vlan_proto_t;
+
++// VLAN ID
++#define NW_VLAN_ID_INVALID 0
++#define NW_VLAN_ID_MIN 1
++#define NW_VLAN_ID_MAX 4096
++
+ struct nw_port_vlan {
+ nw_port* parent;
+
+diff --git a/src/networkd/port.h b/src/networkd/port.h
+index c9add71..15b8bc1 100644
+--- a/src/networkd/port.h
++++ b/src/networkd/port.h
+@@ -31,11 +31,6 @@
+
+ #define PORT_CONFIG_DIR CONFIG_DIR "/ports"
+
+-// VLAN
+-#define NW_VLAN_ID_INVALID 0
+-#define NW_VLAN_ID_MIN 1
+-#define NW_VLAN_ID_MAX 4096
+-
+ typedef struct nw_port nw_port;
+
+ typedef enum nw_port_type_id {
+--
+2.39.2
+
diff --git a/network/patches/0269-ports-Drop-UNKNOWN-type.patch b/network/patches/0269-ports-Drop-UNKNOWN-type.patch
new file mode 100644
index 000000000..a82298573
--- /dev/null
+++ b/network/patches/0269-ports-Drop-UNKNOWN-type.patch
@@ -0,0 +1,48 @@
+From b249255d5ca7cdff8ea97e0a0cdd39f1bf0e6e63 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Thu, 8 Jun 2023 16:26:13 +0000
+Subject: [PATCH 269/304] ports: Drop UNKNOWN type
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/port.c | 4 ----
+ src/networkd/port.h | 1 -
+ 2 files changed, 5 deletions(-)
+
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index c4d6ffe..c14d439 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -261,9 +261,6 @@ int nw_port_destroy(nw_port* port) {
+ if (r)
+ return r;
+
+- // Reset type
+- port->type = NW_PORT_UNKNOWN;
+-
+ return 0;
+ }
+
+@@ -282,7 +279,6 @@ int __nw_port_drop_port(nw_daemon* daemon, nw_port* port, void* data) {
+
+ case NW_PORT_BONDING:
+ case NW_PORT_DUMMY:
+- case NW_PORT_UNKNOWN:
+ break;
+ }
+
+diff --git a/src/networkd/port.h b/src/networkd/port.h
+index 15b8bc1..b96b13e 100644
+--- a/src/networkd/port.h
++++ b/src/networkd/port.h
+@@ -34,7 +34,6 @@
+ typedef struct nw_port nw_port;
+
+ typedef enum nw_port_type_id {
+- NW_PORT_UNKNOWN = 0,
+ NW_PORT_BONDING,
+ NW_PORT_DUMMY,
+ NW_PORT_VLAN,
+--
+2.39.2
+
diff --git a/network/patches/0270-ports-Implement-scaffolding-for-configuration.patch b/network/patches/0270-ports-Implement-scaffolding-for-configuration.patch
new file mode 100644
index 000000000..b04a1bf4e
--- /dev/null
+++ b/network/patches/0270-ports-Implement-scaffolding-for-configuration.patch
@@ -0,0 +1,74 @@
+From ea7dc1bbab6162c319ce738161af813f2d1b7241 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Thu, 8 Jun 2023 16:35:33 +0000
+Subject: [PATCH 270/304] ports: Implement scaffolding for configuration
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/port.c | 30 ++++++++++++++++++++++++++++++
+ src/networkd/port.h | 1 +
+ 2 files changed, 31 insertions(+)
+
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index c14d439..fb5d418 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -127,6 +127,19 @@ ERROR:
+ return r;
+ }
+
++static int nw_port_validate(nw_port* port) {
++ int r = 0;
++
++ // Validate the port configuration
++ if (NW_PORT_TYPE(port)->validate) {
++ r = NW_PORT_TYPE(port)->validate(port);
++ if (r < 0)
++ ERROR("Could not check configuration for %s: %s\n", port->name, strerror(-r));
++ }
++
++ return r;
++}
++
+ int nw_port_create(nw_port** port, nw_daemon* daemon,
+ const nw_port_type_id_t type, const char* name, nw_config* config) {
+ int r;
+@@ -172,6 +185,23 @@ int nw_port_create(nw_port** port, nw_daemon* daemon,
+ if (r)
+ goto ERROR;
+
++ // Validate the configuration
++ r = nw_port_validate(p);
++ switch (r) {
++ // Configuration is valid
++ case 0:
++ break;
++
++ // Configuration is invalid
++ case 1:
++ ERROR("%s: Invalid configuration\n", p->name);
++ goto ERROR;
++
++ // Error
++ default:
++ goto ERROR;
++ }
++
+ *port = p;
+ return 0;
+
+diff --git a/src/networkd/port.h b/src/networkd/port.h
+index b96b13e..7c2e436 100644
+--- a/src/networkd/port.h
++++ b/src/networkd/port.h
+@@ -48,6 +48,7 @@ typedef struct nw_port_type {
+
+ // Configuration
+ int (*setup)(nw_port* port);
++ int (*validate)(nw_port* port);
+
+ // Get Parent Port
+ nw_port* (*get_parent_port)(nw_port* port);
+--
+2.39.2
+
diff --git a/network/patches/0271-ports-VLAN-Validate-configuration.patch b/network/patches/0271-ports-VLAN-Validate-configuration.patch
new file mode 100644
index 000000000..6078928b7
--- /dev/null
+++ b/network/patches/0271-ports-VLAN-Validate-configuration.patch
@@ -0,0 +1,53 @@
+From 749b1a85fdbf4ec0ec0ac3b3fe07cdeffd72460c Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Thu, 8 Jun 2023 16:41:13 +0000
+Subject: [PATCH 271/304] ports: VLAN: Validate configuration
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/port-vlan.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/src/networkd/port-vlan.c b/src/networkd/port-vlan.c
+index 06047ab..25a59ee 100644
+--- a/src/networkd/port-vlan.c
++++ b/src/networkd/port-vlan.c
+@@ -60,6 +60,27 @@ static int nw_port_vlan_setup(nw_port* port) {
+ return 0;
+ }
+
++static int nw_port_vlan_validate(nw_port* port) {
++ // Check if the VLAN ID is within range
++ if (port->vlan.id < NW_VLAN_ID_MIN || port->vlan.id > NW_VLAN_ID_MAX) {
++ ERROR("%s: Invalid VLAN ID %d\n", port->name, port->vlan.id);
++ return 1;
++ }
++
++ // Validate protocol
++ switch (port->vlan.proto) {
++ case NW_VLAN_PROTO_8021Q:
++ case NW_VLAN_PROTO_8021AD:
++ break;
++
++ default:
++ ERROR("%p: Invalid VLAN protocol\n", port->name);
++ return 1;
++ }
++
++ return 0;
++}
++
+ static int nw_port_vlan_create_link(nw_port* port, sd_netlink_message* m) {
+ int r;
+
+@@ -111,6 +132,7 @@ const nw_port_type_t nw_port_type_vlan = {
+
+ // Configuration
+ .setup = nw_port_vlan_setup,
++ .validate = nw_port_vlan_validate,
+
+ .get_parent_port = nw_port_get_vlan_parent,
+
+--
+2.39.2
+
diff --git a/network/patches/0272-daemon-Don-t-crash-when-a-port-could-not-be-loaded.patch b/network/patches/0272-daemon-Don-t-crash-when-a-port-could-not-be-loaded.patch
new file mode 100644
index 000000000..a4daf071d
--- /dev/null
+++ b/network/patches/0272-daemon-Don-t-crash-when-a-port-could-not-be-loaded.patch
@@ -0,0 +1,40 @@
+From ac7659bf6a5f84f473424c6976e4ccd6c2e72979 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Thu, 8 Jun 2023 16:46:12 +0000
+Subject: [PATCH 272/304] daemon: Don't crash when a port could not be loaded
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/ports.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/src/networkd/ports.c b/src/networkd/ports.c
+index f0a3ebb..65545e8 100644
+--- a/src/networkd/ports.c
++++ b/src/networkd/ports.c
+@@ -152,8 +152,20 @@ static int __nw_ports_enumerate(const char* path, const struct stat* s, void* da
+
+ // Create a new port
+ r = nw_port_create_from_config(&port, ports->daemon, name, path);
+- if (r)
+- goto ERROR;
++ switch (r) {
++ // All okay
++ case 0:
++ break;
++
++ // Invalid configuration
++ case 1:
++ ERROR("Could not open port %s\n", name);
++ r = 0;
++ goto ERROR;
++
++ default:
++ goto ERROR;
++ }
+
+ // Add the port to the list
+ r = nw_ports_add_port(ports, port);
+--
+2.39.2
+
diff --git a/network/patches/0273-string-Have-all-functions-return-negative-values-on-.patch b/network/patches/0273-string-Have-all-functions-return-negative-values-on-.patch
new file mode 100644
index 000000000..ad88f04bf
--- /dev/null
+++ b/network/patches/0273-string-Have-all-functions-return-negative-values-on-.patch
@@ -0,0 +1,33 @@
+From 45a3d5aaca4e1d64132d7b4190209bb743efaa68 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Thu, 8 Jun 2023 17:05:54 +0000
+Subject: [PATCH 273/304] string: Have all functions return negative values on
+ error
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/string.h | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/src/networkd/string.h b/src/networkd/string.h
+index 270ed6b..a36b023 100644
+--- a/src/networkd/string.h
++++ b/src/networkd/string.h
+@@ -37,12 +37,11 @@ static inline int __nw_string_vformat(char* s, const size_t length,
+
+ // Catch any errors
+ if (required < 0)
+- return 1;
++ return required;
+
+ // Check if the entire string could be written
+ if ((size_t)required >= length) {
+- errno = ENOMEM;
+- return 1;
++ return -ENOMEM;
+ }
+
+ // Success
+--
+2.39.2
+
diff --git a/network/patches/0274-networkd-Parse-command-line-arguments.patch b/network/patches/0274-networkd-Parse-command-line-arguments.patch
new file mode 100644
index 000000000..de3674bec
--- /dev/null
+++ b/network/patches/0274-networkd-Parse-command-line-arguments.patch
@@ -0,0 +1,132 @@
+From 3138451ba526d9ada4e74cffccd10c5807c9bc8e Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 9 Jun 2023 04:58:39 +0000
+Subject: [PATCH 274/304] networkd: Parse command line arguments
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/daemon.c | 45 ++++++++++++++++++++++++++++++++++++++++++-
+ src/networkd/daemon.h | 2 +-
+ src/networkd/main.c | 2 +-
+ 3 files changed, 46 insertions(+), 3 deletions(-)
+
+diff --git a/src/networkd/daemon.c b/src/networkd/daemon.c
+index 749a70b..31fda8e 100644
+--- a/src/networkd/daemon.c
++++ b/src/networkd/daemon.c
+@@ -19,6 +19,8 @@
+ #############################################################################*/
+
+ #include <errno.h>
++#include <getopt.h>
++#include <limits.h>
+ #include <stdlib.h>
+
+ #include <systemd/sd-bus.h>
+@@ -36,6 +38,7 @@
+ #include "logging.h"
+ #include "ports.h"
+ #include "stats-collector.h"
++#include "string.h"
+ #include "zone.h"
+ #include "zones.h"
+
+@@ -45,6 +48,7 @@
+ struct nw_daemon {
+ int nrefs;
+
++ char config_path[PATH_MAX];
+ nw_config* config;
+
+ // Event Loop
+@@ -91,6 +95,40 @@ static int __nw_daemon_reload(sd_event_source* source, const struct signalfd_sig
+ return 0;
+ }
+
++static int nw_daemon_parse_argv(nw_daemon* daemon, int argc, char* argv[]) {
++ enum {
++ ARG_CONFIG,
++ };
++ int r;
++
++ static const struct option options[] = {
++ { "config", required_argument, NULL, ARG_CONFIG },
++ { NULL },
++ };
++ int c;
++
++ for (;;) {
++ c = getopt_long(argc, argv, "", options, NULL);
++ if (c < 0)
++ break;
++
++ switch (c) {
++ case ARG_CONFIG:
++ r = nw_string_set(daemon->config_path, optarg);
++ if (r < 0)
++ return r;
++
++ break;
++
++ // Abort on any unrecognised option
++ default:
++ return -EINVAL;
++ }
++ }
++
++ return 0;
++}
++
+ static int nw_daemon_setup_loop(nw_daemon* daemon) {
+ int r;
+
+@@ -398,7 +436,7 @@ static int nw_daemon_setup(nw_daemon* daemon) {
+ return 0;
+ }
+
+-int nw_daemon_create(nw_daemon** daemon) {
++int nw_daemon_create(nw_daemon** daemon, int argc, char* argv[]) {
+ int r;
+
+ nw_daemon* d = calloc(1, sizeof(*d));
+@@ -408,6 +446,11 @@ int nw_daemon_create(nw_daemon** daemon) {
+ // Initialize reference counter
+ d->nrefs = 1;
+
++ // Parse command line arguments
++ r = nw_daemon_parse_argv(d, argc, argv);
++ if (r)
++ goto ERROR;
++
+ // Setup the daemon
+ r = nw_daemon_setup(d);
+ if (r)
+diff --git a/src/networkd/daemon.h b/src/networkd/daemon.h
+index 74e19e6..8653af3 100644
+--- a/src/networkd/daemon.h
++++ b/src/networkd/daemon.h
+@@ -33,7 +33,7 @@ typedef struct nw_daemon nw_daemon;
+ #include "zone.h"
+ #include "zones.h"
+
+-int nw_daemon_create(nw_daemon** daemon);
++int nw_daemon_create(nw_daemon** daemon, int argc, char* argv[]);
+
+ nw_daemon* nw_daemon_ref(nw_daemon* daemon);
+ nw_daemon* nw_daemon_unref(nw_daemon* daemon);
+diff --git a/src/networkd/main.c b/src/networkd/main.c
+index c8b9a79..f5f09f5 100644
+--- a/src/networkd/main.c
++++ b/src/networkd/main.c
+@@ -222,7 +222,7 @@ int main(int argc, char** argv) {
+ return r;
+
+ // Create the daemon
+- r = nw_daemon_create(&daemon);
++ r = nw_daemon_create(&daemon, argc, argv);
+ if (r)
+ return r;
+
+--
+2.39.2
+
diff --git a/network/patches/0275-networkd-Open-config-directory-and-keep-a-handle-to-.patch b/network/patches/0275-networkd-Open-config-directory-and-keep-a-handle-to-.patch
new file mode 100644
index 000000000..cef8539d8
--- /dev/null
+++ b/network/patches/0275-networkd-Open-config-directory-and-keep-a-handle-to-.patch
@@ -0,0 +1,163 @@
+From 5a925d5f91e32245446ba568da2549b08913c0c7 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 9 Jun 2023 05:28:51 +0000
+Subject: [PATCH 275/304] networkd: Open config directory and keep a handle to
+ it
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/config.c | 2 +-
+ src/networkd/config.h | 1 +
+ src/networkd/daemon.c | 71 ++++++++++++++++++++++++++++++++++++++-----
+ 3 files changed, 66 insertions(+), 8 deletions(-)
+
+diff --git a/src/networkd/config.c b/src/networkd/config.c
+index ee5e8b8..b7f3f72 100644
+--- a/src/networkd/config.c
++++ b/src/networkd/config.c
+@@ -229,7 +229,7 @@ int nw_config_flush(nw_config* config) {
+ return 0;
+ }
+
+-static int nw_config_readf(nw_config* config, FILE* f) {
++int nw_config_readf(nw_config* config, FILE* f) {
+ char* line = NULL;
+ size_t length = 0;
+ int r;
+diff --git a/src/networkd/config.h b/src/networkd/config.h
+index 63e9d18..d532da3 100644
+--- a/src/networkd/config.h
++++ b/src/networkd/config.h
+@@ -40,6 +40,7 @@ const char* nw_config_path(nw_config* config);
+
+ int nw_config_flush(nw_config* config);
+
++int nw_config_readf(nw_config* config, FILE* f);
+ int nw_config_read(nw_config* config);
+ int nw_config_write(nw_config* config);
+
+diff --git a/src/networkd/daemon.c b/src/networkd/daemon.c
+index 31fda8e..e645bee 100644
+--- a/src/networkd/daemon.c
++++ b/src/networkd/daemon.c
+@@ -18,7 +18,9 @@
+ # #
+ #############################################################################*/
+
++#include <dirent.h>
+ #include <errno.h>
++#include <fcntl.h>
+ #include <getopt.h>
+ #include <limits.h>
+ #include <stdlib.h>
+@@ -48,7 +50,7 @@
+ struct nw_daemon {
+ int nrefs;
+
+- char config_path[PATH_MAX];
++ DIR* config_dir;
+ nw_config* config;
+
+ // Event Loop
+@@ -95,6 +97,43 @@ static int __nw_daemon_reload(sd_event_source* source, const struct signalfd_sig
+ return 0;
+ }
+
++/*
++ Configuration
++*/
++
++static int nw_daemon_config_open(nw_daemon* daemon, const char* path) {
++ daemon->config_dir = opendir(path);
++ if (!daemon->config_dir) {
++ ERROR("Could not open %s: %m\n", path);
++ return -errno;
++ }
++
++ return 0;
++}
++
++static FILE* nw_daemon_config_fopen(nw_daemon* daemon, const char* path, const char* mode) {
++ int r;
++
++ // If no configuration path has been opened yet, we will open something
++ if (!daemon->config_dir) {
++ r = nw_daemon_config_open(daemon, CONFIG_DIR);
++ if (r < 0) {
++ errno = -r;
++ return NULL;
++ }
++ }
++
++ // Open the file
++ int fd = openat(dirfd(daemon->config_dir), path, 0);
++ if (fd < 0) {
++ ERROR("Could not open configuration file %s: %m\n", path);
++ return NULL;
++ }
++
++ // Return a file handle
++ return fdopen(fd, mode);
++}
++
+ static int nw_daemon_parse_argv(nw_daemon* daemon, int argc, char* argv[]) {
+ enum {
+ ARG_CONFIG,
+@@ -114,10 +153,9 @@ static int nw_daemon_parse_argv(nw_daemon* daemon, int argc, char* argv[]) {
+
+ switch (c) {
+ case ARG_CONFIG:
+- r = nw_string_set(daemon->config_path, optarg);
++ r = nw_daemon_config_open(daemon, optarg);
+ if (r < 0)
+ return r;
+-
+ break;
+
+ // Abort on any unrecognised option
+@@ -174,12 +212,29 @@ static int nw_daemon_setup_loop(nw_daemon* daemon) {
+ }
+
+ static int nw_daemon_load_config(nw_daemon* daemon) {
++ FILE* f = NULL;
+ int r;
+
+- // Read configuration file
+- r = nw_config_create(&daemon->config, CONFIG_DIR "/settings");
+- if (r)
+- return r;
++ // Open the configuration file
++ f = nw_daemon_config_fopen(daemon, "settings", "r");
++ if (!f) {
++ r = -errno;
++ goto ERROR;
++ }
++
++ // Create configuration
++ r = nw_config_create(&daemon->config, NULL);
++ if (r < 0)
++ goto ERROR;
++
++ // Parse configuration
++ r = nw_config_readf(daemon->config, f);
++ if (r < 0)
++ goto ERROR;
++
++ERROR:
++ if (f)
++ fclose(f);
+
+ return r;
+ }
+@@ -482,6 +537,8 @@ static void nw_daemon_free(nw_daemon* daemon) {
+ // Cleanup common objects
+ nw_daemon_cleanup(daemon);
+
++ if (daemon->config_dir)
++ closedir(daemon->config_dir);
+ if (daemon->stats_collector_event)
+ sd_event_source_unref(daemon->stats_collector_event);
+ if (daemon->bus)
+--
+2.39.2
+
diff --git a/network/patches/0276-networkd-Hold-a-file-descriptor-instead-of-DIR.patch b/network/patches/0276-networkd-Hold-a-file-descriptor-instead-of-DIR.patch
new file mode 100644
index 000000000..f6e74eecd
--- /dev/null
+++ b/network/patches/0276-networkd-Hold-a-file-descriptor-instead-of-DIR.patch
@@ -0,0 +1,99 @@
+From f6e3fd80ad4d86681ad2949567b6763c41530f16 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 9 Jun 2023 05:37:57 +0000
+Subject: [PATCH 276/304] networkd: Hold a file descriptor instead of DIR*
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/daemon.c | 34 ++++++++++++++++------------------
+ 1 file changed, 16 insertions(+), 18 deletions(-)
+
+diff --git a/src/networkd/daemon.c b/src/networkd/daemon.c
+index e645bee..f0ef4aa 100644
+--- a/src/networkd/daemon.c
++++ b/src/networkd/daemon.c
+@@ -18,12 +18,12 @@
+ # #
+ #############################################################################*/
+
+-#include <dirent.h>
+ #include <errno.h>
+ #include <fcntl.h>
+ #include <getopt.h>
+ #include <limits.h>
+ #include <stdlib.h>
++#include <unistd.h>
+
+ #include <systemd/sd-bus.h>
+ #include <systemd/sd-daemon.h>
+@@ -50,7 +50,8 @@
+ struct nw_daemon {
+ int nrefs;
+
+- DIR* config_dir;
++ // Configuration
++ int configfd;
+ nw_config* config;
+
+ // Event Loop
+@@ -102,8 +103,9 @@ static int __nw_daemon_reload(sd_event_source* source, const struct signalfd_sig
+ */
+
+ static int nw_daemon_config_open(nw_daemon* daemon, const char* path) {
+- daemon->config_dir = opendir(path);
+- if (!daemon->config_dir) {
++ // Open the directory
++ daemon->configfd = open(path, O_DIRECTORY);
++ if (daemon->configfd < 0) {
+ ERROR("Could not open %s: %m\n", path);
+ return -errno;
+ }
+@@ -112,19 +114,8 @@ static int nw_daemon_config_open(nw_daemon* daemon, const char* path) {
+ }
+
+ static FILE* nw_daemon_config_fopen(nw_daemon* daemon, const char* path, const char* mode) {
+- int r;
+-
+- // If no configuration path has been opened yet, we will open something
+- if (!daemon->config_dir) {
+- r = nw_daemon_config_open(daemon, CONFIG_DIR);
+- if (r < 0) {
+- errno = -r;
+- return NULL;
+- }
+- }
+-
+ // Open the file
+- int fd = openat(dirfd(daemon->config_dir), path, 0);
++ int fd = openat(daemon->configfd, path, 0);
+ if (fd < 0) {
+ ERROR("Could not open configuration file %s: %m\n", path);
+ return NULL;
+@@ -215,6 +206,13 @@ static int nw_daemon_load_config(nw_daemon* daemon) {
+ FILE* f = NULL;
+ int r;
+
++ // If no configuration path has been opened yet, we will open something
++ if (!daemon->configfd) {
++ r = nw_daemon_config_open(daemon, CONFIG_DIR);
++ if (r < 0)
++ goto ERROR;
++ }
++
+ // Open the configuration file
+ f = nw_daemon_config_fopen(daemon, "settings", "r");
+ if (!f) {
+@@ -537,8 +535,8 @@ static void nw_daemon_free(nw_daemon* daemon) {
+ // Cleanup common objects
+ nw_daemon_cleanup(daemon);
+
+- if (daemon->config_dir)
+- closedir(daemon->config_dir);
++ if (daemon->configfd > 0)
++ close(daemon->configfd);
+ if (daemon->stats_collector_event)
+ sd_event_source_unref(daemon->stats_collector_event);
+ if (daemon->bus)
+--
+2.39.2
+
diff --git a/network/patches/0277-networkd-Add-a-simple-test-environment.patch b/network/patches/0277-networkd-Add-a-simple-test-environment.patch
new file mode 100644
index 000000000..34754b7f2
--- /dev/null
+++ b/network/patches/0277-networkd-Add-a-simple-test-environment.patch
@@ -0,0 +1,197 @@
+From c920185ee99d0f143946925aba0668785225f6f4 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 9 Jun 2023 07:46:40 +0000
+Subject: [PATCH 277/304] networkd: Add a simple test environment
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 24 ++++-
+ test/networkd/00_launch.t/config/settings | 0
+ test/networkd/00_launch.t/test.sh | 4 +
+ test/networkd/test.sh | 108 ++++++++++++++++++++++
+ 4 files changed, 132 insertions(+), 4 deletions(-)
+ create mode 100644 test/networkd/00_launch.t/config/settings
+ create mode 100644 test/networkd/00_launch.t/test.sh
+ create mode 100644 test/networkd/test.sh
+
+diff --git a/Makefile.am b/Makefile.am
+index f4c22b4..fe1e4d1 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -59,6 +59,7 @@ DISTCLEANFILES =
+ EXTRA_DIST =
+ INSTALL_DIRS =
+ INSTALL_EXEC_HOOKS =
++TESTS =
+ UNINSTALL_EXEC_HOOKS =
+ noinst_DATA =
+ network_PROGRAMS =
+@@ -690,12 +691,10 @@ TESTS_ENVIRONMENT = \
+
+ dist_check_DATA = \
+ test/constants.sh \
+- test/test-functions
++ test/test-functions \
++ test/networkd/test.sh
+
+ dist_check_SCRIPTS = \
+- $(TESTS)
+-
+-TESTS = \
+ test/load-library \
+ test/functions/ip/ip_detect_protocol \
+ test/functions/ip/ip_get_prefix \
+@@ -706,6 +705,23 @@ TESTS = \
+ test/functions/ip/ip_protocol_is_supported \
+ test/functions/ip/ip_split_prefix
+
++TESTS += $(dist_check_SCRIPTS)
++
++TEST_EXTENSIONS = .t
++
++NETWORKD_TESTS = \
++ test/networkd/00_launch.t
++
++TESTS += $(NETWORKD_TESTS)
++
++EXTRA_DIST += \
++ test/networkd/test.sh \
++ $(NETWORKD_TESTS)
++
++# Run all networkd tests in their own namespaces
++T_LOG_COMPILER = unshare --net --ipc --uts --user --cgroup --time --pid --fork \
++ $(SHELL) test/networkd/test.sh
++
+ # - NITSI tests ----------------------------------------------------------------
+
+ # Files for the virtual environment
+diff --git a/test/networkd/00_launch.t/config/settings b/test/networkd/00_launch.t/config/settings
+new file mode 100644
+index 0000000..e69de29
+diff --git a/test/networkd/00_launch.t/test.sh b/test/networkd/00_launch.t/test.sh
+new file mode 100644
+index 0000000..f3d7bbc
+--- /dev/null
++++ b/test/networkd/00_launch.t/test.sh
+@@ -0,0 +1,4 @@
++#!/bin/bash
++
++# Simply run networkctl to check whether it works
++./networkctl --version
+diff --git a/test/networkd/test.sh b/test/networkd/test.sh
+new file mode 100644
+index 0000000..2af7479
+--- /dev/null
++++ b/test/networkd/test.sh
+@@ -0,0 +1,108 @@
++#!/bin/bash
++###############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++###############################################################################
++
++# Break if anything fails
++set -e
++
++# Turn on job control
++set -o monitor
++
++run_script() {
++ local script="${1}"
++ shift
++
++ if [ -f "${script}" ]; then
++ echo "Launching ${script}..."
++
++ # Launch the script in a separate shell and echo every command
++ if ! ${SHELL} -xe "${script}"; then
++ echo "${script} failed" >&2
++ return 1
++ fi
++ fi
++
++ return 0
++}
++
++# Launches networkd in the background
++launch_networkd() {
++ echo "Launching networkd..."
++
++ # Launch it!
++ coproc networkd { ./networkd "$@"; }
++
++ echo "networkd launched as PID ${networkd_PID}"
++}
++
++terminate_networkd() {
++ if [ -n "${networkd_PID}" ]; then
++ # Send SIGTERM
++ kill -TERM "${networkd_PID}"
++
++ # Wait until networkd has finished
++ echo "Waiting for networkd to terminate..."
++ wait "${networkd_PID}"
++
++ echo "networkd has terminated"
++ fi
++}
++
++# Make sure networkd has been terminated when this script exits
++trap "terminate_networkd" EXIT
++
++main() {
++ local test="${1}"
++ shift
++
++ echo "Running ${test}..."
++
++ # Check if the test exists
++ if [ ! -d "${test}" ]; then
++ echo "Test '${test}' does not exist" >&2
++ return 2
++ fi
++
++ # Run prepare script
++ if ! run_script "${test}/prepare.sh"; then
++ return 1
++ fi
++
++ # Launch networkd
++ launch_networkd --config="${test}/config"
++
++ # Run test script
++ if ! run_script "${test}/test.sh"; then
++ return 1
++ fi
++
++ # Terminate networkd
++ terminate_networkd
++
++ # Run cleanup script
++ if ! run_script "${test}/cleanup.sh"; then
++ return 1
++ fi
++
++ return 0
++}
++
++# Call main()
++main "$@" || exit $?
+--
+2.39.2
+
diff --git a/network/patches/0278-test-Run-ip-d-link-to-show-the-status-of-the-environ.patch b/network/patches/0278-test-Run-ip-d-link-to-show-the-status-of-the-environ.patch
new file mode 100644
index 000000000..c471daed9
--- /dev/null
+++ b/network/patches/0278-test-Run-ip-d-link-to-show-the-status-of-the-environ.patch
@@ -0,0 +1,48 @@
+From 9ddb7dad28a2122317b0551884640afdf14deadb Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 9 Jun 2023 07:49:54 +0000
+Subject: [PATCH 278/304] test: Run "ip -d link" to show the status of the
+ environment
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ test/networkd/test.sh | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/test/networkd/test.sh b/test/networkd/test.sh
+index 2af7479..a22aeb3 100644
+--- a/test/networkd/test.sh
++++ b/test/networkd/test.sh
+@@ -42,6 +42,19 @@ run_script() {
+ return 0
+ }
+
++dump_command() {
++ echo "Output of $@"
++
++ # Run the command
++ $@ 2>&1
++
++ echo "EOF"
++}
++
++dump_status() {
++ dump_command "ip -d link"
++}
++
+ # Launches networkd in the background
+ launch_networkd() {
+ echo "Launching networkd..."
+@@ -54,6 +67,9 @@ launch_networkd() {
+
+ terminate_networkd() {
+ if [ -n "${networkd_PID}" ]; then
++ # Collect some status information
++ dump_status
++
+ # Send SIGTERM
+ kill -TERM "${networkd_PID}"
+
+--
+2.39.2
+
diff --git a/network/patches/0279-networkctl-Terminate-after-showing-help-or-version.patch b/network/patches/0279-networkctl-Terminate-after-showing-help-or-version.patch
new file mode 100644
index 000000000..ea97f6077
--- /dev/null
+++ b/network/patches/0279-networkctl-Terminate-after-showing-help-or-version.patch
@@ -0,0 +1,64 @@
+From dc2a5320b848576772c261b76b23b87715d118a7 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 9 Jun 2023 07:51:50 +0000
+Subject: [PATCH 279/304] networkctl: Terminate after showing help or version
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkctl/main.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/src/networkctl/main.c b/src/networkctl/main.c
+index 0ba7284..fde77b8 100644
+--- a/src/networkctl/main.c
++++ b/src/networkctl/main.c
+@@ -21,6 +21,7 @@
+ #include <errno.h>
+ #include <getopt.h>
+ #include <stdio.h>
++#include <stdlib.h>
+ #include <unistd.h>
+
+ #include <systemd/sd-bus.h>
+@@ -45,13 +46,13 @@ static int networkctl_main(sd_bus* bus, int argc, char* argv[]) {
+ return command_dispatch(bus, commands, argc, argv);
+ }
+
+-static int version(void) {
++static void version(void) {
+ printf("networkctl %s\n", PACKAGE_VERSION);
+
+- return 0;
++ exit(0);
+ }
+
+-static int help(void) {
++static void help(void) {
+ printf(
+ "%s [OPTIONS...] COMMAND\n\n"
+ "Options:\n"
+@@ -60,7 +61,7 @@ static int help(void) {
+ program_invocation_short_name
+ );
+
+- return 0;
++ exit(0);
+ }
+
+ static int parse_argv(int argc, char* argv[]) {
+@@ -82,10 +83,10 @@ static int parse_argv(int argc, char* argv[]) {
+
+ switch (c) {
+ case 'h':
+- return help();
++ help();
+
+ case ARG_VERSION:
+- return version();
++ version();
+
+ case '?':
+ return -EINVAL;
+--
+2.39.2
+
diff --git a/network/patches/0280-test-Be-less-patient-if-networkd-does-not-want-to-te.patch b/network/patches/0280-test-Be-less-patient-if-networkd-does-not-want-to-te.patch
new file mode 100644
index 000000000..33af11d9d
--- /dev/null
+++ b/network/patches/0280-test-Be-less-patient-if-networkd-does-not-want-to-te.patch
@@ -0,0 +1,84 @@
+From f1e43a02719530f865fd7818b60b706c551d143c Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 9 Jun 2023 08:20:41 +0000
+Subject: [PATCH 280/304] test: Be less patient if networkd does not want to
+ terminate
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ test/networkd/test.sh | 43 +++++++++++++++++++++++++++++++------------
+ 1 file changed, 31 insertions(+), 12 deletions(-)
+
+diff --git a/test/networkd/test.sh b/test/networkd/test.sh
+index a22aeb3..7690978 100644
+--- a/test/networkd/test.sh
++++ b/test/networkd/test.sh
+@@ -63,27 +63,43 @@ launch_networkd() {
+ coproc networkd { ./networkd "$@"; }
+
+ echo "networkd launched as PID ${networkd_PID}"
++
++ sleep 1
+ }
+
+ terminate_networkd() {
+- if [ -n "${networkd_PID}" ]; then
+- # Collect some status information
+- dump_status
+-
+- # Send SIGTERM
+- kill -TERM "${networkd_PID}"
++ local seconds=0
+
+- # Wait until networkd has finished
+- echo "Waiting for networkd to terminate..."
+- wait "${networkd_PID}"
++ if [ -n "${networkd_PID}" ]; then
++ while [ -n "${networkd_PID}" ] && kill -0 "${networkd_PID}"; do
++ case "${seconds}" in
++ # Send SIGTERM in the beginning
++ 0)
++ echo "Sending SIGTERM to networkd"
++ kill -TERM "${networkd_PID}"
++ ;;
++
++ # After 5 seconds, send SIGKILL
++ 5)
++ echo "Sending SIGKILL to networkd"
++ kill -KILL "${networkd_PID}"
++
++ # It is an error, if we have to kill networkd
++ exit 1
++ ;;
++ esac
++
++ # Wait for a moment
++ sleep 1
++
++ # Increment seconds
++ (( seconds++ ))
++ done
+
+ echo "networkd has terminated"
+ fi
+ }
+
+-# Make sure networkd has been terminated when this script exits
+-trap "terminate_networkd" EXIT
+-
+ main() {
+ local test="${1}"
+ shift
+@@ -112,6 +128,9 @@ main() {
+ # Terminate networkd
+ terminate_networkd
+
++ # Collect some status information
++ dump_status
++
+ # Run cleanup script
+ if ! run_script "${test}/cleanup.sh"; then
+ return 1
+--
+2.39.2
+
diff --git a/network/patches/0281-test-Run-networkd-as-root-in-its-own-namespace.patch b/network/patches/0281-test-Run-networkd-as-root-in-its-own-namespace.patch
new file mode 100644
index 000000000..44e59411c
--- /dev/null
+++ b/network/patches/0281-test-Run-networkd-as-root-in-its-own-namespace.patch
@@ -0,0 +1,26 @@
+From 119cc5be2dc054f619226a27ffd855e849330adf Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 9 Jun 2023 09:27:51 +0000
+Subject: [PATCH 281/304] test: Run networkd as root in its own namespace
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Makefile.am b/Makefile.am
+index fe1e4d1..08e04a1 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -720,7 +720,7 @@ EXTRA_DIST += \
+
+ # Run all networkd tests in their own namespaces
+ T_LOG_COMPILER = unshare --net --ipc --uts --user --cgroup --time --pid --fork \
+- $(SHELL) test/networkd/test.sh
++ --map-root-user --keep-caps $(SHELL) test/networkd/test.sh
+
+ # - NITSI tests ----------------------------------------------------------------
+
+--
+2.39.2
+
diff --git a/network/patches/0282-ports-Refactor-enumerating-ports.patch b/network/patches/0282-ports-Refactor-enumerating-ports.patch
new file mode 100644
index 000000000..7295bf7bc
--- /dev/null
+++ b/network/patches/0282-ports-Refactor-enumerating-ports.patch
@@ -0,0 +1,636 @@
+From 8edf3da1c28feb4e2af80786c5e41e52f07b0f73 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 9 Jun 2023 09:29:01 +0000
+Subject: [PATCH 282/304] ports: Refactor enumerating ports
+
+This entails a little rewrite how we deal with where configuration files
+are stored.
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/config.c | 117 ++++++++++--------------------------------
+ src/networkd/config.h | 11 ++--
+ src/networkd/daemon.c | 23 ++++++---
+ src/networkd/daemon.h | 9 ++++
+ src/networkd/port.c | 64 +++++++++++++++++------
+ src/networkd/port.h | 3 +-
+ src/networkd/ports.c | 80 +++++++++++++++++------------
+ src/networkd/zone.c | 27 ++++++++--
+ 8 files changed, 172 insertions(+), 162 deletions(-)
+
+diff --git a/src/networkd/config.c b/src/networkd/config.c
+index b7f3f72..3d444c4 100644
+--- a/src/networkd/config.c
++++ b/src/networkd/config.c
+@@ -53,9 +53,6 @@ struct nw_config_option {
+ struct nw_config {
+ int nrefs;
+
+- // The path to the configuration file
+- char path[PATH_MAX];
+-
+ STAILQ_HEAD(config_entries, nw_config_entry) entries;
+
+ // Options
+@@ -118,7 +115,7 @@ static void nw_config_free(nw_config* config) {
+ free(config);
+ }
+
+-int nw_config_create(nw_config** config, const char* path) {
++int nw_config_create(nw_config** config, FILE* f) {
+ int r;
+
+ nw_config* c = calloc(1, sizeof(*c));
+@@ -134,15 +131,10 @@ int nw_config_create(nw_config** config, const char* path) {
+ // Initialise options
+ STAILQ_INIT(&c->options);
+
+- // Store the path
+- if (path) {
+- r = nw_string_set(c->path, path);
+- if (r)
+- goto ERROR;
+-
+- // Try to read the configuration from path
+- r = nw_config_read(c);
+- if (r)
++ // Read configuration
++ if (f) {
++ r = nw_config_read(c, f);
++ if (r < 0)
+ goto ERROR;
+ }
+
+@@ -156,6 +148,25 @@ ERROR:
+ return r;
+ }
+
++int nw_config_open(nw_config** config, const char* path) {
++ FILE* f = NULL;
++ int r;
++
++ // Open path
++ f = fopen(path, "r");
++ if (!f)
++ return -errno;
++
++ // Create a new configuration
++ r = nw_config_create(config, f);
++
++ERROR:
++ if (f)
++ fclose(f);
++
++ return r;
++}
++
+ nw_config* nw_config_ref(nw_config* config) {
+ config->nrefs++;
+
+@@ -170,17 +181,6 @@ nw_config* nw_config_unref(nw_config* config) {
+ return NULL;
+ }
+
+-int nw_config_destroy(nw_config* config) {
+- int r;
+-
+- // Drop all entries
+- r = nw_config_flush(config);
+- if (r)
+- return r;
+-
+- return unlink(config->path);
+-}
+-
+ int nw_config_copy(nw_config* config, nw_config** copy) {
+ struct nw_config_entry* entry = NULL;
+ nw_config* c = NULL;
+@@ -208,13 +208,6 @@ ERROR:
+ return r;
+ }
+
+-const char* nw_config_path(nw_config* config) {
+- if (*config->path)
+- return config->path;
+-
+- return NULL;
+-}
+-
+ int nw_config_flush(nw_config* config) {
+ struct nw_config_entry* entry = NULL;
+
+@@ -229,7 +222,7 @@ int nw_config_flush(nw_config* config) {
+ return 0;
+ }
+
+-int nw_config_readf(nw_config* config, FILE* f) {
++int nw_config_read(nw_config* config, FILE* f) {
+ char* line = NULL;
+ size_t length = 0;
+ int r;
+@@ -275,39 +268,7 @@ int nw_config_readf(nw_config* config, FILE* f) {
+ return r;
+ }
+
+-int nw_config_read(nw_config* config) {
+- FILE* f = NULL;
+- int r;
+-
+- // We cannot read if path is not set
+- if (!*config->path) {
+- errno = ENOTSUP;
+- return 1;
+- }
+-
+- // Open the file
+- f = fopen(config->path, "r");
+- if (!f) {
+- // Silently ignore if the file does not exist
+- if (errno == ENOENT)
+- return 0;
+-
+- ERROR("Could not read configuration file %s: %m\n", config->path);
+- r = 1;
+- goto ERROR;
+- }
+-
+- // Read from file
+- r = nw_config_readf(config, f);
+-
+-ERROR:
+- if (f)
+- fclose(f);
+-
+- return r;
+-}
+-
+-static int nw_config_writef(nw_config* config, FILE* f) {
++int nw_config_write(nw_config* config, FILE* f) {
+ struct nw_config_entry* entry = NULL;
+ int r;
+
+@@ -327,32 +288,6 @@ static int nw_config_writef(nw_config* config, FILE* f) {
+ return 0;
+ }
+
+-int nw_config_write(nw_config* config) {
+- int r;
+-
+- // We cannot write if path is not set
+- if (!*config->path) {
+- errno = ENOTSUP;
+- return 1;
+- }
+-
+- FILE* f = fopen(config->path, "w");
+- if (!f) {
+- ERROR("Failed to open %s for writing: %m\n", config->path);
+- r = 1;
+- goto ERROR;
+- }
+-
+- // Write configuration
+- r = nw_config_writef(config, f);
+-
+-ERROR:
+- if (f)
+- fclose(f);
+-
+- return r;
+-}
+-
+ static struct nw_config_entry* nw_config_find(nw_config* config, const char* key) {
+ struct nw_config_entry* entry = NULL;
+
+diff --git a/src/networkd/config.h b/src/networkd/config.h
+index d532da3..b25d05e 100644
+--- a/src/networkd/config.h
++++ b/src/networkd/config.h
+@@ -28,21 +28,18 @@
+
+ typedef struct nw_config nw_config;
+
+-int nw_config_create(nw_config** config, const char* path);
++int nw_config_create(nw_config** config, FILE* f);
++int nw_config_open(nw_config** config, const char* path);
+
+ nw_config* nw_config_ref(nw_config* config);
+ nw_config* nw_config_unref(nw_config* config);
+
+-int nw_config_destroy(nw_config* config);
+ int nw_config_copy(nw_config* config, nw_config** copy);
+
+-const char* nw_config_path(nw_config* config);
+-
+ int nw_config_flush(nw_config* config);
+
+-int nw_config_readf(nw_config* config, FILE* f);
+-int nw_config_read(nw_config* config);
+-int nw_config_write(nw_config* config);
++int nw_config_read(nw_config* config, FILE* f);
++int nw_config_write(nw_config* config, FILE* f);
+
+ int nw_config_del(nw_config* config, const char* key);
+
+diff --git a/src/networkd/daemon.c b/src/networkd/daemon.c
+index f0ef4aa..a62e343 100644
+--- a/src/networkd/daemon.c
++++ b/src/networkd/daemon.c
+@@ -113,7 +113,7 @@ static int nw_daemon_config_open(nw_daemon* daemon, const char* path) {
+ return 0;
+ }
+
+-static FILE* nw_daemon_config_fopen(nw_daemon* daemon, const char* path, const char* mode) {
++FILE* nw_daemon_config_fopen(nw_daemon* daemon, const char* path, const char* mode) {
+ // Open the file
+ int fd = openat(daemon->configfd, path, 0);
+ if (fd < 0) {
+@@ -125,6 +125,16 @@ static FILE* nw_daemon_config_fopen(nw_daemon* daemon, const char* path, const c
+ return fdopen(fd, mode);
+ }
+
++DIR* nw_daemon_config_opendir(nw_daemon* daemon, const char* path) {
++ int fd = openat(daemon->configfd, path, O_DIRECTORY);
++ if (fd < 0) {
++ ERROR("Could not open configuration directory %s: %m\n", path);
++ return NULL;
++ }
++
++ return fdopendir(fd);
++}
++
+ static int nw_daemon_parse_argv(nw_daemon* daemon, int argc, char* argv[]) {
+ enum {
+ ARG_CONFIG,
+@@ -221,12 +231,7 @@ static int nw_daemon_load_config(nw_daemon* daemon) {
+ }
+
+ // Create configuration
+- r = nw_config_create(&daemon->config, NULL);
+- if (r < 0)
+- goto ERROR;
+-
+- // Parse configuration
+- r = nw_config_readf(daemon->config, f);
++ r = nw_config_create(&daemon->config, f);
+ if (r < 0)
+ goto ERROR;
+
+@@ -615,10 +620,12 @@ int nw_daemon_save(nw_daemon* daemon) {
+
+ DEBUG("Saving configuration...\n");
+
++#if 0
+ // Save settings
+- r = nw_config_write(daemon->config);
++ r = nw_config_write(daemon->config, f);
+ if (r)
+ return r;
++#endif
+
+ // Save ports
+ r = nw_ports_save(daemon->ports);
+diff --git a/src/networkd/daemon.h b/src/networkd/daemon.h
+index 8653af3..b03086c 100644
+--- a/src/networkd/daemon.h
++++ b/src/networkd/daemon.h
+@@ -21,6 +21,9 @@
+ #ifndef NETWORKD_DAEMON_H
+ #define NETWORKD_DAEMON_H
+
++#include <dirent.h>
++#include <stdio.h>
++
+ #include <systemd/sd-bus.h>
+ #include <systemd/sd-netlink.h>
+
+@@ -44,6 +47,12 @@ int nw_daemon_reload(nw_daemon* daemon);
+
+ int nw_daemon_save(nw_daemon* daemon);
+
++/*
++ Configuration
++*/
++FILE* nw_daemon_config_fopen(nw_daemon* daemon, const char* path, const char* mode);
++DIR* nw_daemon_config_opendir(nw_daemon* daemon, const char* path);
++
+ /*
+ Bus
+ */
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index fb5d418..7d654e3 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -147,7 +147,7 @@ int nw_port_create(nw_port** port, nw_daemon* daemon,
+ // Allocate a new object
+ nw_port* p = calloc(1, sizeof(*p));
+ if (!p)
+- return 1;
++ return -errno;
+
+ // Store a reference to the daemon
+ p->daemon = nw_daemon_ref(daemon);
+@@ -172,17 +172,17 @@ int nw_port_create(nw_port** port, nw_daemon* daemon,
+
+ // Store the name
+ r = nw_string_set(p->name, name);
+- if (r)
++ if (r < 0)
+ goto ERROR;
+
+ // Copy the configuration
+ r = nw_config_copy(config, &p->config);
+- if (r)
++ if (r < 0)
+ goto ERROR;
+
+ // Setup the port
+ r = nw_port_setup(p);
+- if (r)
++ if (r < 0)
+ goto ERROR;
+
+ // Validate the configuration
+@@ -210,32 +210,47 @@ ERROR:
+ return r;
+ }
+
+-int nw_port_create_from_config(nw_port** port, nw_daemon* daemon,
+- const char* name, const char* path) {
++int nw_port_open(nw_port** port, nw_daemon* daemon, const char* name) {
+ nw_config* config = NULL;
++ FILE* f = NULL;
++ char path[PATH_MAX];
+ int r;
+
++ // Make path
++ r = nw_string_format(path, "ports/%s", name);
++ if (r < 0)
++ goto ERROR;
++
++ // Open the configuration file
++ f = nw_daemon_config_fopen(daemon, path, "r");
++ if (!f) {
++ r = -errno;
++ goto ERROR;
++ }
++
+ // Initialize the configuration
+- r = nw_config_create(&config, path);
+- if (r)
++ r = nw_config_create(&config, f);
++ if (r < 0)
+ goto ERROR;
+
+ // Fetch the type
+ const char* type = nw_config_get(config, "TYPE");
+ if (!type) {
+ ERROR("Port configuration %s has no TYPE\n", path);
+- r = 1;
++ r = -ENOTSUP;
+ goto ERROR;
+ }
+
+ // Create a new port
+ r = nw_port_create(port, daemon, nw_port_type_id_from_string(type), name, config);
+- if (r)
++ if (r < 0)
+ goto ERROR;
+
+ ERROR:
+ if (config)
+ nw_config_unref(config);
++ if (f)
++ fclose(f);
+
+ return r;
+ }
+@@ -316,24 +331,39 @@ int __nw_port_drop_port(nw_daemon* daemon, nw_port* port, void* data) {
+ }
+
+ int nw_port_save(nw_port* port) {
++ char path[PATH_MAX];
++ FILE* f = NULL;
+ int r;
+
++ // Compose path
++ r = nw_string_format(path, "ports/%s", port->name);
++ if (r < 0)
++ return r;
++
++ // Open file
++ f = nw_daemon_config_fopen(port->daemon, path, "w");
++ if (!f) {
++ r = -errno;
++ goto ERROR;
++ }
++
+ // Write out the configuration
+ r = nw_config_options_write(port->config);
+ if (r < 0)
+ goto ERROR;
+
+ // Write the configuration
+- r = nw_config_write(port->config);
+- if (r)
+- return r;
+-
+- return 0;
++ r = nw_config_write(port->config, f);
++ if (r < 0)
++ goto ERROR;
+
+ ERROR:
+- ERROR("Could not save configuration for port %s: %s\n", port->name, strerror(-r));
++ if (f)
++ fclose(f);
++ if (r)
++ ERROR("Could not save configuration for port %s: %s\n", port->name, strerror(-r));
+
+- return 1;
++ return r;
+ }
+
+ const char* nw_port_name(nw_port* port) {
+diff --git a/src/networkd/port.h b/src/networkd/port.h
+index 7c2e436..efa2fdb 100644
+--- a/src/networkd/port.h
++++ b/src/networkd/port.h
+@@ -95,8 +95,7 @@ struct nw_port {
+
+ int nw_port_create(nw_port** port, nw_daemon* daemon,
+ const nw_port_type_id_t type, const char* name, nw_config* config);
+-int nw_port_create_from_config(nw_port** port, nw_daemon* daemon,
+- const char* name, const char* path);
++int nw_port_open(nw_port** port, nw_daemon* daemon, const char* name);
+
+ nw_port* nw_port_ref(nw_port* port);
+ nw_port* nw_port_unref(nw_port* port);
+diff --git a/src/networkd/ports.c b/src/networkd/ports.c
+index 65545e8..761e564 100644
+--- a/src/networkd/ports.c
++++ b/src/networkd/ports.c
+@@ -18,6 +18,7 @@
+ # #
+ #############################################################################*/
+
++#include <dirent.h>
+ #include <stdlib.h>
+ #include <string.h>
+ #include <sys/queue.h>
+@@ -129,43 +130,14 @@ static int nw_ports_add_port(nw_ports* ports, nw_port* port) {
+ return 0;
+ }
+
+-static int __nw_ports_enumerate(const char* path, const struct stat* s, void* data) {
++static int nw_ports_enumerate_port(nw_ports* ports, const char* name) {
+ nw_port* port = NULL;
+ int r;
+
+- nw_ports* ports = (nw_ports*)data;
+-
+- // Skip anything that isn't a regular file
+- if (!S_ISREG(s->st_mode))
+- return 0;
+-
+- // Find the basename of the file
+- const char* name = nw_path_basename(path);
+-
+- // Break on invalid paths
+- if (!name)
+- return 0;
+-
+- // Skip any hidden files
+- if (*name == '.')
+- return 0;
+-
+ // Create a new port
+- r = nw_port_create_from_config(&port, ports->daemon, name, path);
+- switch (r) {
+- // All okay
+- case 0:
+- break;
+-
+- // Invalid configuration
+- case 1:
+- ERROR("Could not open port %s\n", name);
+- r = 0;
+- goto ERROR;
+-
+- default:
+- goto ERROR;
+- }
++ r = nw_port_open(&port, ports->daemon, name);
++ if (r < 0 || r == 1)
++ goto ERROR;
+
+ // Add the port to the list
+ r = nw_ports_add_port(ports, port);
+@@ -180,7 +152,47 @@ ERROR:
+ }
+
+ int nw_ports_enumerate(nw_ports* ports) {
+- return nw_ftw(PORT_CONFIG_DIR, PORT_CONFIG_DIR "/*", __nw_ports_enumerate, ports);
++ DIR* d = NULL;
++ struct dirent* entry = NULL;
++ int r;
++
++ // Open the ports directory
++ d = nw_daemon_config_opendir(ports->daemon, "ports");
++ if (!d) {
++ switch (errno) {
++ case ENOENT:
++ return 0;
++
++ default:
++ return -errno;
++ }
++ }
++
++ for (;;) {
++ // Read the next entry
++ entry = readdir(d);
++ if (!entry)
++ break;
++
++ // Skip anything that is not a regular file
++ if (entry->d_type != DT_REG)
++ continue;
++
++ // Skip hidden files
++ if (entry->d_name[0] == '.')
++ continue;
++
++ // Enumerate the port
++ r = nw_ports_enumerate_port(ports, entry->d_name);
++ if (r < 0)
++ goto ERROR;
++ }
++
++ERROR:
++ if (d)
++ closedir(d);
++
++ return r;
+ }
+
+ nw_port* nw_ports_get_by_name(nw_ports* ports, const char* name) {
+diff --git a/src/networkd/zone.c b/src/networkd/zone.c
+index 9f5b7f8..cc5fdaf 100644
+--- a/src/networkd/zone.c
++++ b/src/networkd/zone.c
+@@ -120,6 +120,7 @@ static int nw_zone_setup(nw_zone* zone) {
+ goto ERROR;
+ }
+
++#if 0
+ // Compose the path to the main configuration file
+ r = nw_zone_path(zone, path, "%s", "settings");
+ if (r)
+@@ -129,6 +130,7 @@ static int nw_zone_setup(nw_zone* zone) {
+ r = nw_config_create(&zone->config, path);
+ if (r)
+ goto ERROR;
++#endif
+
+ ERROR:
+ if (link)
+@@ -193,13 +195,32 @@ int __nw_zone_drop_port(nw_daemon* daemon, nw_zone* zone, void* data) {
+ }
+
+ int nw_zone_save(nw_zone* zone) {
++ char path[PATH_MAX];
++ FILE* f = NULL;
+ int r;
+
+- r = nw_config_write(zone->config);
++ // Compose path
++ r = nw_string_format(path, "zones/%s/settings", zone->name);
++ if (r < 0)
++ goto ERROR;
++
++ // Open file
++ f = nw_daemon_config_fopen(zone->daemon, path, "w");
++ if (!f) {
++ r = -errno;
++ goto ERROR;
++ }
++
++ // Write the configuration
++ r = nw_config_write(zone->config, f);
+ if (r)
+- return r;
++ goto ERROR;
+
+- return 0;
++ERROR:
++ if (f)
++ fclose(f);
++
++ return r;
+ }
+
+ const char* nw_zone_name(nw_zone* zone) {
+--
+2.39.2
+
diff --git a/network/patches/0283-tests-Add-new-test-that-creates-two-dummy-interfaces.patch b/network/patches/0283-tests-Add-new-test-that-creates-two-dummy-interfaces.patch
new file mode 100644
index 000000000..17a4933da
--- /dev/null
+++ b/network/patches/0283-tests-Add-new-test-that-creates-two-dummy-interfaces.patch
@@ -0,0 +1,67 @@
+From b2134e9ee25fe3aedddc9f6ef812881724122a81 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 9 Jun 2023 09:38:00 +0000
+Subject: [PATCH 283/304] tests: Add new test that creates two dummy interfaces
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 3 ++-
+ test/networkd/01_dummy.t/config/ports/d0 | 2 ++
+ test/networkd/01_dummy.t/config/ports/d1 | 2 ++
+ test/networkd/01_dummy.t/config/settings | 0
+ test/networkd/01_dummy.t/test.sh | 7 +++++++
+ 5 files changed, 13 insertions(+), 1 deletion(-)
+ create mode 100644 test/networkd/01_dummy.t/config/ports/d0
+ create mode 100644 test/networkd/01_dummy.t/config/ports/d1
+ create mode 100644 test/networkd/01_dummy.t/config/settings
+ create mode 100644 test/networkd/01_dummy.t/test.sh
+
+diff --git a/Makefile.am b/Makefile.am
+index 08e04a1..2df9185 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -710,7 +710,8 @@ TESTS += $(dist_check_SCRIPTS)
+ TEST_EXTENSIONS = .t
+
+ NETWORKD_TESTS = \
+- test/networkd/00_launch.t
++ test/networkd/00_launch.t \
++ test/networkd/01_dummy.t
+
+ TESTS += $(NETWORKD_TESTS)
+
+diff --git a/test/networkd/01_dummy.t/config/ports/d0 b/test/networkd/01_dummy.t/config/ports/d0
+new file mode 100644
+index 0000000..36a350b
+--- /dev/null
++++ b/test/networkd/01_dummy.t/config/ports/d0
+@@ -0,0 +1,2 @@
++TYPE=dummy
++ADDRESS=00:11:22:33:44:55
+diff --git a/test/networkd/01_dummy.t/config/ports/d1 b/test/networkd/01_dummy.t/config/ports/d1
+new file mode 100644
+index 0000000..d040863
+--- /dev/null
++++ b/test/networkd/01_dummy.t/config/ports/d1
+@@ -0,0 +1,2 @@
++TYPE=dummy
++ADDRESS=00:55:44:33:22:11
+diff --git a/test/networkd/01_dummy.t/config/settings b/test/networkd/01_dummy.t/config/settings
+new file mode 100644
+index 0000000..e69de29
+diff --git a/test/networkd/01_dummy.t/test.sh b/test/networkd/01_dummy.t/test.sh
+new file mode 100644
+index 0000000..fff0d69
+--- /dev/null
++++ b/test/networkd/01_dummy.t/test.sh
+@@ -0,0 +1,7 @@
++#!/bin/bash
++
++# Dump status of d0
++./networkctl port dump d0
++
++# Dump status of d1
++./networkctl port dump d1
+--
+2.39.2
+
diff --git a/network/patches/0284-tests-Always-dump-the-environment.patch b/network/patches/0284-tests-Always-dump-the-environment.patch
new file mode 100644
index 000000000..20711f981
--- /dev/null
+++ b/network/patches/0284-tests-Always-dump-the-environment.patch
@@ -0,0 +1,47 @@
+From 5d4157c6655aea0673a60894420a9d5a0fa63dd6 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 9 Jun 2023 09:38:35 +0000
+Subject: [PATCH 284/304] tests: Always dump the environment
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ test/networkd/test.sh | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/test/networkd/test.sh b/test/networkd/test.sh
+index 7690978..9cecf0a 100644
+--- a/test/networkd/test.sh
++++ b/test/networkd/test.sh
+@@ -64,6 +64,9 @@ launch_networkd() {
+
+ echo "networkd launched as PID ${networkd_PID}"
+
++ # Wait until networkd is initialized
++ # XXX Calling sleep(8) is very racy and should be replaced by something that
++ # waits until networkd has connected to dbus
+ sleep 1
+ }
+
+@@ -100,6 +103,9 @@ terminate_networkd() {
+ fi
+ }
+
++# Collect some status information
++trap dump_status EXIT
++
+ main() {
+ local test="${1}"
+ shift
+@@ -128,9 +134,6 @@ main() {
+ # Terminate networkd
+ terminate_networkd
+
+- # Collect some status information
+- dump_status
+-
+ # Run cleanup script
+ if ! run_script "${test}/cleanup.sh"; then
+ return 1
+--
+2.39.2
+
diff --git a/network/patches/0285-test-Collect-more-information-from-test-environment.patch b/network/patches/0285-test-Collect-more-information-from-test-environment.patch
new file mode 100644
index 000000000..186fbe731
--- /dev/null
+++ b/network/patches/0285-test-Collect-more-information-from-test-environment.patch
@@ -0,0 +1,26 @@
+From fcc334a2e325a5d08b7abecb0eb67d7c944b4f35 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 9 Jun 2023 10:00:06 +0000
+Subject: [PATCH 285/304] test: Collect more information from test environment
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ test/networkd/test.sh | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/test/networkd/test.sh b/test/networkd/test.sh
+index 9cecf0a..3eda034 100644
+--- a/test/networkd/test.sh
++++ b/test/networkd/test.sh
+@@ -52,6 +52,8 @@ dump_command() {
+ }
+
+ dump_status() {
++ dump_command "printenv"
++ dump_command "ps aux"
+ dump_command "ip -d link"
+ }
+
+--
+2.39.2
+
diff --git a/network/patches/0286-ports-bonding-Use-correct-enum-for-mode.patch b/network/patches/0286-ports-bonding-Use-correct-enum-for-mode.patch
new file mode 100644
index 000000000..79e10b021
--- /dev/null
+++ b/network/patches/0286-ports-bonding-Use-correct-enum-for-mode.patch
@@ -0,0 +1,38 @@
+From 5f9c43922b2b9e52ad61e5b8203854881da793a4 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 9 Jun 2023 10:17:58 +0000
+Subject: [PATCH 286/304] ports: bonding: Use correct enum for mode
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/port-bonding.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/src/networkd/port-bonding.c b/src/networkd/port-bonding.c
+index ad02b5d..6064957 100644
+--- a/src/networkd/port-bonding.c
++++ b/src/networkd/port-bonding.c
+@@ -97,13 +97,13 @@ int nw_port_bonding_set_mode(nw_port* port, const char* mode) {
+ const int m = nw_port_bonding_mode_from_string(mode);
+
+ switch (m) {
+- case BOND_MODE_ROUNDROBIN:
+- case BOND_MODE_ACTIVEBACKUP:
+- case BOND_MODE_XOR:
+- case BOND_MODE_BROADCAST:
+- case BOND_MODE_8023AD:
+- case BOND_MODE_TLB:
+- case BOND_MODE_ALB:
++ case NW_BONDING_MODE_ROUNDROBIN:
++ case NW_BONDING_MODE_ACTIVEBACKUP:
++ case NW_BONDING_MODE_XOR:
++ case NW_BONDING_MODE_BROADCAST:
++ case NW_BONDING_MODE_8023AD:
++ case NW_BONDING_MODE_TLB:
++ case NW_BONDING_MODE_ALB:
+ port->bonding.mode = m;
+ break;
+
+--
+2.39.2
+
diff --git a/network/patches/0287-networkd-json-Include-string.h.patch b/network/patches/0287-networkd-json-Include-string.h.patch
new file mode 100644
index 000000000..f0774c47f
--- /dev/null
+++ b/network/patches/0287-networkd-json-Include-string.h.patch
@@ -0,0 +1,25 @@
+From e5c50dd3c189c96bead686cc728121d6f22dcd49 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 9 Jun 2023 10:37:00 +0000
+Subject: [PATCH 287/304] networkd: json: Include string.h
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/json.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/networkd/json.h b/src/networkd/json.h
+index 33e237a..19ced9a 100644
+--- a/src/networkd/json.h
++++ b/src/networkd/json.h
+@@ -22,6 +22,7 @@
+ #define NETWORKD_JSON_H
+
+ #include <errno.h>
++#include <string.h>
+
+ #include <json.h>
+
+--
+2.39.2
+
diff --git a/network/patches/0288-ports-Add-support-for-VETH.patch b/network/patches/0288-ports-Add-support-for-VETH.patch
new file mode 100644
index 000000000..b818eac50
--- /dev/null
+++ b/network/patches/0288-ports-Add-support-for-VETH.patch
@@ -0,0 +1,228 @@
+From 67d3fef1d79e933b8af64a39f89fef4b1f8b31cb Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 9 Jun 2023 10:37:47 +0000
+Subject: [PATCH 288/304] ports: Add support for VETH
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 2 +
+ src/networkd/port-veth.c | 81 ++++++++++++++++++++++++++++++++++++++++
+ src/networkd/port-veth.h | 35 +++++++++++++++++
+ src/networkd/port.c | 6 +++
+ src/networkd/port.h | 5 +++
+ 5 files changed, 129 insertions(+)
+ create mode 100644 src/networkd/port-veth.c
+ create mode 100644 src/networkd/port-veth.h
+
+diff --git a/Makefile.am b/Makefile.am
+index 2df9185..caab99e 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -338,6 +338,8 @@ dist_networkd_SOURCES = \
+ src/networkd/port-bus.h \
+ src/networkd/port-dummy.c \
+ src/networkd/port-dummy.h \
++ src/networkd/port-veth.c \
++ src/networkd/port-veth.h \
+ src/networkd/port-vlan.c \
+ src/networkd/port-vlan.h \
+ src/networkd/stats-collector.c \
+diff --git a/src/networkd/port-veth.c b/src/networkd/port-veth.c
+new file mode 100644
+index 0000000..44b1a0d
+--- /dev/null
++++ b/src/networkd/port-veth.c
+@@ -0,0 +1,81 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#include <linux/veth.h>
++
++#include "json.h"
++#include "port.h"
++#include "port-veth.h"
++
++static int nw_port_veth_setup(nw_port* port) {
++ int r;
++
++ // Peer
++ r = NW_CONFIG_OPTION_STRING(port->config, "VETH_PEER", &port->veth.peer);
++ if (r < 0)
++ return 1;
++
++ return 0;
++}
++
++static int nw_port_veth_create_link(nw_port* port, sd_netlink_message* m) {
++ int r;
++
++ // Open the container
++ r = sd_netlink_message_open_container(m, VETH_INFO_PEER);
++ if (r < 0)
++ return r;
++
++ // Set VETH Peer
++ r = sd_netlink_message_append_string(m, IFLA_VLAN_ID, port->veth.peer);
++ if (r < 0)
++ return r;
++
++ // Close the container
++ r = sd_netlink_message_close_container(m);
++ if (r < 0)
++ return r;
++
++ return 0;
++}
++
++static int nw_port_veth_to_json(nw_port* port, struct json_object* o) {
++ int r;
++
++ // Add the VETH Peer
++ r = json_object_add_string(o, "VETHPeer", port->veth.peer);
++ if (r < 0)
++ return r;
++
++ return 0;
++}
++
++const nw_port_type_t nw_port_type_veth = {
++ .kind = "veth",
++
++ // Configuration
++ .setup = nw_port_veth_setup,
++
++ // Link
++ .create_link = nw_port_veth_create_link,
++
++ // JSON
++ .to_json = nw_port_veth_to_json,
++};
+diff --git a/src/networkd/port-veth.h b/src/networkd/port-veth.h
+new file mode 100644
+index 0000000..aa4a03b
+--- /dev/null
++++ b/src/networkd/port-veth.h
+@@ -0,0 +1,35 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#ifndef NETWORKD_PORT_VETH_H
++#define NETWORKD_PORT_VETH_H
++
++#include "port.h"
++
++// Maximum length of the peer name
++#define NW_VETH_PEER_MAX 64
++
++struct nw_port_veth {
++ char peer[NW_VETH_PEER_MAX];
++};
++
++extern const nw_port_type_t nw_port_type_veth;
++
++#endif /* NETWORKD_PORT_VETH_H */
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index 7d654e3..fb62520 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -33,6 +33,7 @@
+ #include "port.h"
+ #include "port-bonding.h"
+ #include "port-dummy.h"
++#include "port-veth.h"
+ #include "port-vlan.h"
+ #include "stats-collector.h"
+ #include "string.h"
+@@ -40,6 +41,7 @@
+ static const nw_string_table_t nw_port_type_id[] = {
+ { NW_PORT_BONDING, "bonding" },
+ { NW_PORT_DUMMY, "dummy" },
++ { NW_PORT_VETH, "veth", },
+ { NW_PORT_VLAN, "vlan" },
+ { -1, NULL },
+ };
+@@ -165,6 +167,9 @@ int nw_port_create(nw_port** port, nw_daemon* daemon,
+ p->type = &nw_port_type_dummy;
+ break;
+
++ case NW_PORT_VETH:
++ p->type = &nw_port_type_veth;
++
+ case NW_PORT_VLAN:
+ p->type = &nw_port_type_vlan;
+ break;
+@@ -324,6 +329,7 @@ int __nw_port_drop_port(nw_daemon* daemon, nw_port* port, void* data) {
+
+ case NW_PORT_BONDING:
+ case NW_PORT_DUMMY:
++ case NW_PORT_VETH:
+ break;
+ }
+
+diff --git a/src/networkd/port.h b/src/networkd/port.h
+index efa2fdb..5c0a2a1 100644
+--- a/src/networkd/port.h
++++ b/src/networkd/port.h
+@@ -36,6 +36,7 @@ typedef struct nw_port nw_port;
+ typedef enum nw_port_type_id {
+ NW_PORT_BONDING,
+ NW_PORT_DUMMY,
++ NW_PORT_VETH,
+ NW_PORT_VLAN,
+ } nw_port_type_id_t;
+
+@@ -66,6 +67,7 @@ typedef struct nw_port_type {
+ #include "daemon.h"
+ #include "json.h"
+ #include "port-bonding.h"
++#include "port-veth.h"
+ #include "port-vlan.h"
+
+ #define NW_PORT_TYPE(port) (port->type)
+@@ -89,6 +91,9 @@ struct nw_port {
+ // Bonding Settings
+ struct nw_port_bonding bonding;
+
++ // VETH Settings
++ struct nw_port_veth veth;
++
+ // VLAN settings
+ struct nw_port_vlan vlan;
+ };
+--
+2.39.2
+
diff --git a/network/patches/0289-config-Add-string-buffer-type.patch b/network/patches/0289-config-Add-string-buffer-type.patch
new file mode 100644
index 000000000..1bf877080
--- /dev/null
+++ b/network/patches/0289-config-Add-string-buffer-type.patch
@@ -0,0 +1,264 @@
+From e633147dcf3bc46e0686e106cb013dfccf30b1c6 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 9 Jun 2023 11:19:30 +0000
+Subject: [PATCH 289/304] config: Add string buffer type
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/config.c | 45 +++++++++++++++++++++++++++---------
+ src/networkd/config.h | 49 +++++++++++++++++++++++++++-------------
+ src/networkd/port-veth.c | 2 +-
+ src/networkd/port-vlan.c | 3 ++-
+ 4 files changed, 70 insertions(+), 29 deletions(-)
+
+diff --git a/src/networkd/config.c b/src/networkd/config.c
+index 3d444c4..c6281cb 100644
+--- a/src/networkd/config.c
++++ b/src/networkd/config.c
+@@ -43,6 +43,7 @@ struct nw_config_option {
+
+ const char* key;
+ void* value;
++ size_t length;
+
+ // Callbacks
+ nw_config_option_read_callback_t read_callback;
+@@ -427,7 +428,8 @@ int nw_config_options_read(nw_config* config) {
+ int r;
+
+ STAILQ_FOREACH(option, &config->options, nodes) {
+- r = option->read_callback(config, option->key, option->value, option->data);
++ r = option->read_callback(config,
++ option->key, option->value, option->length, option->data);
+ if (r < 0)
+ return r;
+ }
+@@ -440,7 +442,8 @@ int nw_config_options_write(nw_config* config) {
+ int r;
+
+ STAILQ_FOREACH(option, &config->options, nodes) {
+- r = option->write_callback(config, option->key, option->value, option->data);
++ r = option->write_callback(config,
++ option->key, option->value, option->length, option->data);
+ if (r < 0)
+ return r;
+ }
+@@ -448,7 +451,8 @@ int nw_config_options_write(nw_config* config) {
+ return 0;
+ }
+
+-int nw_config_option_add(nw_config* config, const char* key, void* value,
++int nw_config_option_add(nw_config* config,
++ const char* key, void* value, const size_t length,
+ nw_config_option_read_callback_t read_callback,
+ nw_config_option_write_callback_t write_callback, void* data) {
+ // Check input
+@@ -465,6 +469,7 @@ int nw_config_option_add(nw_config* config, const char* key, void* value,
+
+ // Set value
+ option->value = value;
++ option->length = length;
+
+ // Set callbacks
+ option->read_callback = read_callback;
+@@ -477,7 +482,8 @@ int nw_config_option_add(nw_config* config, const char* key, void* value,
+ return 0;
+ }
+
+-int nw_config_read_int(nw_config* config, const char* key, void* value, void* data) {
++int nw_config_read_int(nw_config* config,
++ const char* key, void* value, const size_t length, void* data) {
+ // Fetch the value
+ *(int*)value = nw_config_get_int(config, key, -1);
+
+@@ -485,13 +491,14 @@ int nw_config_read_int(nw_config* config, const char* key, void* value, void* da
+ }
+
+ int nw_config_write_int(nw_config* config,
+- const char* key, const void* value, void* data) {
++ const char* key, const void* value, const size_t length, void* data) {
+ return 0;
+ }
+
+ // String
+
+-int nw_config_read_string(nw_config* config, const char* key, void* value, void* data) {
++int nw_config_read_string(nw_config* config,
++ const char* key, void* value, const size_t length, void* data) {
+ // Fetch the value
+ const char* p = nw_config_get(config, key);
+ if (p)
+@@ -501,13 +508,28 @@ int nw_config_read_string(nw_config* config, const char* key, void* value, void*
+ }
+
+ int nw_config_write_string(nw_config* config,
+- const char* key, const void* value, void* data) {
++ const char* key, const void* value, const size_t length, void* data) {
+ return nw_config_set(config, key, *(const char**)value);
+ }
+
++// String Buffer
++
++int nw_config_read_string_buffer(nw_config* config,
++ const char* key, void* value, const size_t length, void* data) {
++ char* string = (char*)value;
++
++ // Fetch the value
++ const char* p = nw_config_get(config, key);
++ if (p)
++ return __nw_string_set(string, length, p);
++
++ return 0;
++}
++
+ // String Table
+
+-int nw_config_read_string_table(nw_config* config, const char* key, void* value, void* data) {
++int nw_config_read_string_table(nw_config* config,
++ const char* key, void* value, const size_t length, void* data) {
+ const char* s = NULL;
+ int* v = (int*)value;
+
+@@ -529,7 +551,7 @@ int nw_config_read_string_table(nw_config* config, const char* key, void* value,
+ }
+
+ int nw_config_write_string_table(nw_config* config,
+- const char* key, const void* value, void* data) {
++ const char* key, const void* value, const size_t length, void* data) {
+ int* v = (int*)value;
+
+ const nw_string_table_t* table = (nw_string_table_t*)data;
+@@ -544,7 +566,8 @@ int nw_config_write_string_table(nw_config* config,
+
+ // Address
+
+-int nw_config_read_address(nw_config* config, const char* key, void* value, void* data) {
++int nw_config_read_address(nw_config* config,
++ const char* key, void* value, const size_t length, void* data) {
+ nw_address_t* address = (nw_address_t*)value;
+ int r;
+
+@@ -561,7 +584,7 @@ int nw_config_read_address(nw_config* config, const char* key, void* value, void
+ }
+
+ int nw_config_write_address(nw_config* config,
+- const char* key, const void* value, void* data) {
++ const char* key, const void* value, const size_t length, void* data) {
+ const nw_address_t* address = (nw_address_t*)value;
+ int r;
+
+diff --git a/src/networkd/config.h b/src/networkd/config.h
+index b25d05e..4b8bc01 100644
+--- a/src/networkd/config.h
++++ b/src/networkd/config.h
+@@ -60,47 +60,64 @@ int nw_config_options_read(nw_config* config);
+ int nw_config_options_write(nw_config* config);
+
+ typedef int (*nw_config_option_read_callback_t)
+- (nw_config* config, const char* key, void* value, void* data);
++ (nw_config* config, const char* key, void* value, const size_t length, void* data);
+ typedef int (*nw_config_option_write_callback_t)
+- (nw_config* config, const char* key, const void* value, void* data);
++ (nw_config* config, const char* key, const void* value, const size_t length, void* data);
+
+-int nw_config_option_add(nw_config* config, const char* key, void* value,
++int nw_config_option_add(nw_config* config, const char* key, void* value, const size_t length,
+ nw_config_option_read_callback_t read_callback,
+ nw_config_option_write_callback_t write_callback, void* data);
+
+-#define NW_CONFIG_OPTION(config, key, value, read_callback, write_callback, data) \
+- nw_config_option_add(config, key, value, read_callback, write_callback, data)
++#define NW_CONFIG_OPTION(config, key, value, length, read_callback, write_callback, data) \
++ nw_config_option_add(config, key, value, length, read_callback, write_callback, data)
+
+ // String
+
+ #define NW_CONFIG_OPTION_STRING(config, key, value) \
+ nw_config_option_add(config, key, value, nw_config_read_string, nw_config_write_string, NULL)
+
+-int nw_config_read_string(nw_config* config, const char* key, void* value, void* data);
+-int nw_config_write_string(nw_config* config, const char* key, const void* value, void* data);
++int nw_config_read_string(nw_config* config,
++ const char* key, void* value, const size_t length, void* data);
++int nw_config_write_string(nw_config* config,
++ const char* key, const void* value, const size_t length, void* data);
++
++#define NW_CONFIG_OPTION_STRING_BUFFER(config, key, value) \
++ nw_config_option_add(config, key, value, sizeof(value), \
++ nw_config_read_string_buffer, nw_config_write_string_buffer, NULL)
++
++int nw_config_read_string_buffer(nw_config* config,
++ const char* key, void* value, const size_t length, void* data);
++#define nw_config_write_string_buffer nw_config_write_string
+
+ // String Table
+
+ #define NW_CONFIG_OPTION_STRING_TABLE(config, key, value, table) \
+- nw_config_option_add(config, key, value, nw_config_read_string_table, nw_config_write_string_table, (void*)table)
++ nw_config_option_add(config, key, value, 0, \
++ nw_config_read_string_table, nw_config_write_string_table, (void*)table)
+
+-int nw_config_read_string_table(nw_config* config, const char* key, void* value, void* data);
+-int nw_config_write_string_table(nw_config* config, const char* key, const void* value, void* data);
++int nw_config_read_string_table(nw_config* config,
++ const char* key, void* value, const size_t length, void* data);
++int nw_config_write_string_table(nw_config* config,
++ const char* key, const void* value, const size_t length, void* data);
+
+ // Integer
+
+ #define NW_CONFIG_OPTION_INT(config, key, value) \
+- nw_config_option_add(config, key, value, nw_config_read_int, nw_config_write_int, NULL)
++ nw_config_option_add(config, key, value, 0, nw_config_read_int, nw_config_write_int, NULL)
+
+-int nw_config_read_int(nw_config* config, const char* key, void* value, void* data);
+-int nw_config_write_int(nw_config* config, const char* key, const void* value, void* data);
++int nw_config_read_int(nw_config* config,
++ const char* key, void* value, const size_t length, void* data);
++int nw_config_write_int(nw_config* config,
++ const char* key, const void* value, const size_t length, void* data);
+
+ // Address
+
+ #define NW_CONFIG_OPTION_ADDRESS(config, key, value) \
+- nw_config_option_add(config, key, value, nw_config_read_address, nw_config_write_address, NULL)
++ nw_config_option_add(config, key, value, 0, nw_config_read_address, nw_config_write_address, NULL)
+
+-int nw_config_read_address(nw_config* config, const char* key, void* value, void* data);
+-int nw_config_write_address(nw_config* config, const char* key, const void* value, void* data);
++int nw_config_read_address(nw_config* config,
++ const char* key, void* value, const size_t length, void* data);
++int nw_config_write_address(nw_config* config,
++ const char* key, const void* value, const size_t length, void* data);
+
+ #endif /* NETWORKD_CONFIG_H */
+diff --git a/src/networkd/port-veth.c b/src/networkd/port-veth.c
+index 44b1a0d..029ef50 100644
+--- a/src/networkd/port-veth.c
++++ b/src/networkd/port-veth.c
+@@ -28,7 +28,7 @@ static int nw_port_veth_setup(nw_port* port) {
+ int r;
+
+ // Peer
+- r = NW_CONFIG_OPTION_STRING(port->config, "VETH_PEER", &port->veth.peer);
++ r = NW_CONFIG_OPTION_STRING_BUFFER(port->config, "VETH_PEER", port->veth.peer);
+ if (r < 0)
+ return 1;
+
+diff --git a/src/networkd/port-vlan.c b/src/networkd/port-vlan.c
+index 25a59ee..c759f71 100644
+--- a/src/networkd/port-vlan.c
++++ b/src/networkd/port-vlan.c
+@@ -53,7 +53,8 @@ static int nw_port_vlan_setup(nw_port* port) {
+ return r;
+
+ // Parent Port
+- r = NW_CONFIG_OPTION_STRING(port->config, "VLAN_PARENT", &port->vlan.__parent_name);
++ r = NW_CONFIG_OPTION_STRING_BUFFER(port->config,
++ "VLAN_PARENT", port->vlan.__parent_name);
+ if (r < 0)
+ return r;
+
+--
+2.39.2
+
diff --git a/network/patches/0290-networkctl-Add-color-functions.patch b/network/patches/0290-networkctl-Add-color-functions.patch
new file mode 100644
index 000000000..9dd6aae4f
--- /dev/null
+++ b/network/patches/0290-networkctl-Add-color-functions.patch
@@ -0,0 +1,176 @@
+From aa7cc0927e2ea5cde54685e01290be8c0afdc31c Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 9 Jun 2023 12:30:33 +0000
+Subject: [PATCH 290/304] networkctl: Add color functions
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 2 +
+ src/networkctl/terminal.c | 51 ++++++++++++++++++++++++
+ src/networkctl/terminal.h | 83 +++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 136 insertions(+)
+ create mode 100644 src/networkctl/terminal.c
+ create mode 100644 src/networkctl/terminal.h
+
+diff --git a/Makefile.am b/Makefile.am
+index caab99e..95fff11 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -402,6 +402,8 @@ dist_networkctl_SOURCES = \
+ src/networkctl/main.c \
+ src/networkctl/port.c \
+ src/networkctl/port.h \
++ src/networkctl/terminal.c \
++ src/networkctl/terminal.h \
+ src/networkctl/zone.c \
+ src/networkctl/zone.h
+
+diff --git a/src/networkctl/terminal.c b/src/networkctl/terminal.c
+new file mode 100644
+index 0000000..de7cd8d
+--- /dev/null
++++ b/src/networkctl/terminal.c
+@@ -0,0 +1,51 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#include <stdlib.h>
++#include <unistd.h>
++
++#include "terminal.h"
++
++// Cache the color mode
++static color_mode_t __color_mode = COLORS_UNKNOWN;
++
++static color_mode_t detect_color_mode(void) {
++ const char* s = NULL;
++
++ // Check for NO_COLOR and if found turn off colours
++ s = secure_getenv("NO_COLOR");
++ if (s)
++ return COLORS_OFF;
++
++ // Disable colours if this isn't an interactive terminal
++ if (!isatty(STDIN_FILENO) || !isatty(STDOUT_FILENO) || !isatty(STDERR_FILENO))
++ return COLORS_OFF;
++
++ // Otherwise we enable colours
++ return COLORS_ON;
++}
++
++color_mode_t color_mode() {
++ if (__color_mode == COLORS_UNKNOWN) {
++ __color_mode = detect_color_mode();
++ }
++
++ return __color_mode;
++}
+diff --git a/src/networkctl/terminal.h b/src/networkctl/terminal.h
+new file mode 100644
+index 0000000..b7bffec
+--- /dev/null
++++ b/src/networkctl/terminal.h
+@@ -0,0 +1,83 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#ifndef NETWORKCTL_TERMINAL_H
++#define NETWORKCTL_TERMINAL_H
++
++typedef enum color_mode {
++ COLORS_UNKNOWN = 0,
++ COLORS_OFF,
++ COLORS_ON,
++} color_mode_t;
++
++// Reset
++#define COLOR_RESET "\x1B[0m"
++
++// Highlight
++#define COLOR_HIGHLIGHT "\x1B[0;1;39m"
++
++// Regular Colors
++#define COLOR_BLACK "\x1B[0;30m"
++#define COLOR_RED "\x1B[0;31m"
++#define COLOR_GREEN "\x1B[0;32m"
++#define COLOR_YELLOW "\x1B[0;33m"
++#define COLOR_BLUE "\x1B[0;34m"
++#define COLOR_MAGENTA "\x1B[0;35m"
++#define COLOR_CYAN "\x1B[0;36m"
++#define COLOR_WHITE "\x1B[0;37m"
++
++#define COLOR_BRIGHT_BLACK "\x1B[0;90m"
++#define COLOR_BRIGHT_RED "\x1B[0;91m"
++#define COLOR_BRIGHT_GREEN "\x1B[0;92m"
++#define COLOR_BRIGHT_YELLOW "\x1B[0;93m"
++#define COLOR_BRIGHT_BLUE "\x1B[0;94m"
++#define COLOR_BRIGHT_MAGENTA "\x1B[0;95m"
++#define COLOR_BRIGHT_CYAN "\x1B[0;96m"
++#define COLOR_BRIGHT_WHITE "\x1B[0;97m"
++
++#define COLOR_HIGHLIGHT_BLACK "\x1B[0;1;30m"
++#define COLOR_HIGHLIGHT_RED "\x1B[0;1;31m"
++#define COLOR_HIGHLIGHT_GREEN "\x1B[0;1;32m"
++#define COLOR_HIGHLIGHT_YELLOW "\x1B[0;1;33m"
++#define COLOR_HIGHLIGHT_BLUE "\x1B[0;1;34m"
++#define COLOR_HIGHLIGHT_MAGENTA "\x1B[0;1;35m"
++#define COLOR_HIGHLIGHT_CYAN "\x1B[0;1;36m"
++#define COLOR_HIGHLIGHT_WHITE "\x1B[0;1;37m"
++
++// Returns the color mode
++color_mode_t color_mode(void);
++
++#define COLOR_FUNC(name, color) \
++ static inline const char* color_##name(void) { \
++ return (color_mode() == COLORS_ON) ? COLOR_ ## color : ""; \
++ }
++
++COLOR_FUNC(reset, RESET)
++COLOR_FUNC(highlight, HIGHLIGHT)
++COLOR_FUNC(black, BLACK)
++COLOR_FUNC(red, RED)
++COLOR_FUNC(green, GREEN)
++COLOR_FUNC(yellow, YELLOW)
++COLOR_FUNC(blue, BLUE)
++COLOR_FUNC(magenta, MAGENTA)
++COLOR_FUNC(cyan, CYAN)
++COLOR_FUNC(white, WHITE)
++
++#endif /* NETWORKCTL_TERMINAL_H */
+--
+2.39.2
+
diff --git a/network/patches/0291-networkctl-Move-describe-into-an-own-function.patch b/network/patches/0291-networkctl-Move-describe-into-an-own-function.patch
new file mode 100644
index 000000000..99aa22bd3
--- /dev/null
+++ b/network/patches/0291-networkctl-Move-describe-into-an-own-function.patch
@@ -0,0 +1,106 @@
+From 8dc40ed861b5ee93f176caf792fc818f681fd9b4 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 9 Jun 2023 12:40:55 +0000
+Subject: [PATCH 291/304] networkctl: Move describe into an own function
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkctl/port.c | 48 ++++++++++++++++++++++++++++++++-----------
+ 1 file changed, 36 insertions(+), 12 deletions(-)
+
+diff --git a/src/networkctl/port.c b/src/networkctl/port.c
+index 67bc003..b6a95c5 100644
+--- a/src/networkctl/port.c
++++ b/src/networkctl/port.c
+@@ -19,6 +19,7 @@
+ #############################################################################*/
+
+ #include <limits.h>
++#include <stdlib.h>
+
+ #include <systemd/sd-bus.h>
+
+@@ -80,22 +81,19 @@ ERROR:
+ return r;
+ }
+
+-// Dump
+-
+-static int networkctl_port_dump(sd_bus* bus, int argc, char* argv[]) {
++static int networkctl_port_describe(sd_bus* bus, const char* name, char** text) {
+ sd_bus_message* reply = NULL;
+ sd_bus_error error = SD_BUS_ERROR_NULL;
+ char path[PATH_MAX];
+- const char* text = NULL;
++ const char* t = NULL;
+ int r;
+
+- if (argc < 1) {
+- fprintf(stderr, "Port required\n");
++ // Check input
++ if (!name || !text)
+ return -EINVAL;
+- }
+
+ // Make port path
+- r = nw_string_format(path, "/org/ipfire/network1/port/%s", argv[0]);
++ r = nw_string_format(path, "/org/ipfire/network1/port/%s", name);
+ if (r < 0)
+ goto ERROR;
+
+@@ -108,15 +106,16 @@ static int networkctl_port_dump(sd_bus* bus, int argc, char* argv[]) {
+ }
+
+ // Read the text
+- r = sd_bus_message_read(reply, "s", &text);
++ r = sd_bus_message_read(reply, "s", &t);
+ if (r < 0) {
+ fprintf(stderr, "Could not parse bus message: %s\n", strerror(-r));
+ goto ERROR;
+ }
+
+- // Print the text
+- if (text)
+- printf("%s\n", text);
++ // Copy text to heap
++ *text = strdup(t);
++ if (!*text)
++ r = -errno;
+
+ ERROR:
+ if (reply)
+@@ -125,6 +124,31 @@ ERROR:
+ return r;
+ }
+
++// Dump
++
++static int networkctl_port_dump(sd_bus* bus, int argc, char* argv[]) {
++ char* text = NULL;
++ int r;
++
++ if (argc < 1) {
++ fprintf(stderr, "Port required\n");
++ return -EINVAL;
++ }
++
++ // Describe the port
++ r = networkctl_port_describe(bus, argv[0], &text);
++ if (r < 0)
++ return r;
++
++ // Print the text
++ printf("%s\n", text);
++
++ if (text)
++ free(text);
++
++ return 0;
++}
++
+ // List
+
+ static int __networkctl_port_list(sd_bus* bus, const char* path, const char* name, void* data) {
+--
+2.39.2
+
diff --git a/network/patches/0292-networkctl-Implement-scaffolding-to-show-ports.patch b/network/patches/0292-networkctl-Implement-scaffolding-to-show-ports.patch
new file mode 100644
index 000000000..df434b0af
--- /dev/null
+++ b/network/patches/0292-networkctl-Implement-scaffolding-to-show-ports.patch
@@ -0,0 +1,145 @@
+From 3363ba36e33d5fc9c455825aeeabf4b615cde3c1 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 9 Jun 2023 14:14:42 +0000
+Subject: [PATCH 292/304] networkctl: Implement scaffolding to show ports
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 2 ++
+ src/networkctl/port.c | 68 +++++++++++++++++++++++++++++++++++++++++++
+ src/networkd/json.h | 9 ++++++
+ 3 files changed, 79 insertions(+)
+
+diff --git a/Makefile.am b/Makefile.am
+index 95fff11..2632ca7 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -409,12 +409,14 @@ dist_networkctl_SOURCES = \
+
+ networkctl_CFLAGS = \
+ $(AM_CFLAGS) \
++ $(JSON_C_CFLAGS) \
+ $(SYSTEMD_CFLAGS)
+
+ networkctl_LDFLAGS = \
+ $(AM_LDFLAGS)
+
+ networkctl_LDADD = \
++ $(JSON_C_LIBS) \
+ $(SYSTEMD_LIBS)
+
+ # ------------------------------------------------------------------------------
+diff --git a/src/networkctl/port.c b/src/networkctl/port.c
+index b6a95c5..439177d 100644
+--- a/src/networkctl/port.c
++++ b/src/networkctl/port.c
+@@ -23,9 +23,11 @@
+
+ #include <systemd/sd-bus.h>
+
++#include "../networkd/json.h"
+ #include "../networkd/string.h"
+ #include "command.h"
+ #include "port.h"
++#include "terminal.h"
+
+ typedef int (*networkctl_port_walk_callback)
+ (sd_bus* bus, const char* path, const char* name, void* data);
+@@ -161,10 +163,76 @@ static int networkctl_port_list(sd_bus* bus, int argc, char* argv[]) {
+ return networkctl_port_walk(bus, __networkctl_port_list, NULL);
+ }
+
++// Show
++
++#define SHOW_LINE " %-12s : %s\n"
++
++static int __networkctl_port_show(sd_bus* bus, const char* path, const char* name, void* data) {
++ struct json_object* object = NULL;
++ enum json_tokener_error json_error;
++ char* describe = NULL;
++ int r;
++
++ // Describe this port
++ r = networkctl_port_describe(bus, name, &describe);
++ if (r < 0)
++ goto ERROR;
++
++ // Parse JSON
++ object = json_tokener_parse_verbose(describe, &json_error);
++ if (!object) {
++ fprintf(stderr, "Could not parse port %s: %s\n",
++ name, json_tokener_error_desc(json_error));
++ return -EINVAL;
++ }
++
++ // Show headline
++ printf("Port %s%s%s\n", color_highlight(), name, color_reset());
++
++ // Show type
++ const char* type = json_object_fetch_string(object, "Type");
++ if (type)
++ printf(SHOW_LINE, "Type", type);
++
++ // Show address
++ const char* address = json_object_fetch_string(object, "Address");
++ if (address)
++ printf(SHOW_LINE, "Address", address);
++
++ // Show an empty line at the end
++ printf("\n");
++
++ // Success!
++ r = 0;
++
++ERROR:
++ if (describe)
++ free(describe);
++ if (object)
++ json_object_unref(object);
++
++ return r;
++}
++
++static int networkctl_port_show(sd_bus* bus, int argc, char* argv[]) {
++ switch (argc) {
++ case 0:
++ return networkctl_port_walk(bus, __networkctl_port_show, NULL);
++
++ case 1:
++ return __networkctl_port_show(bus, NULL, argv[0], NULL);
++
++ default:
++ fprintf(stderr, "Too many arguments\n");
++ return 1;
++ }
++}
++
+ int networkctl_port(sd_bus* bus, int argc, char* argv[]) {
+ static const struct command commands[] = {
+ { "dump", 0, networkctl_port_dump },
+ { "list", 0, networkctl_port_list },
++ { "show", 0, networkctl_port_show },
+ { NULL },
+ };
+
+diff --git a/src/networkd/json.h b/src/networkd/json.h
+index 19ced9a..6c2f66f 100644
+--- a/src/networkd/json.h
++++ b/src/networkd/json.h
+@@ -87,4 +87,13 @@ static inline int json_to_string(struct json_object* o, char** s, size_t* l) {
+ return 0;
+ }
+
++static inline const char* json_object_fetch_string(
++ struct json_object* o, const char* key) {
++ struct json_object* e = json_object_object_get(o, key);
++ if (!e)
++ return NULL;
++
++ return json_object_get_string(e);
++}
++
+ #endif /* NETWORKD_JSON_H */
+--
+2.39.2
+
diff --git a/network/patches/0293-ports-Add-link-stuff-to-JSON-output.patch b/network/patches/0293-ports-Add-link-stuff-to-JSON-output.patch
new file mode 100644
index 000000000..6b3a79ef0
--- /dev/null
+++ b/network/patches/0293-ports-Add-link-stuff-to-JSON-output.patch
@@ -0,0 +1,82 @@
+From 69467266f8b3d8a925604b3ffdeda060c5d409cd Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 9 Jun 2023 14:19:04 +0000
+Subject: [PATCH 293/304] ports: Add link stuff to JSON output
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/link.c | 14 ++++++++++++++
+ src/networkd/link.h | 4 ++++
+ src/networkd/port.c | 7 +++++++
+ 3 files changed, 25 insertions(+)
+
+diff --git a/src/networkd/link.c b/src/networkd/link.c
+index 603aabe..60abd46 100644
+--- a/src/networkd/link.c
++++ b/src/networkd/link.c
+@@ -27,6 +27,7 @@
+ #include <systemd/sd-netlink.h>
+
+ #include "daemon.h"
++#include "json.h"
+ #include "link.h"
+ #include "links.h"
+ #include "logging.h"
+@@ -529,3 +530,16 @@ ERROR:
+
+ return r;
+ }
++
++// JSON
++
++int nw_link_to_json(nw_link* link, struct json_object* o) {
++ int r;
++
++ // Add ifindex
++ r = json_object_add_int64(o, "LinkIndex", link->ifindex);
++ if (r < 0)
++ return r;
++
++ return 0;
++}
+diff --git a/src/networkd/link.h b/src/networkd/link.h
+index 2bab47c..36c7d9d 100644
+--- a/src/networkd/link.h
++++ b/src/networkd/link.h
+@@ -26,6 +26,7 @@
+ typedef struct nw_link nw_link;
+
+ #include "daemon.h"
++#include "json.h"
+
+ int nw_link_create(nw_link** link, nw_daemon* daemon, int ifindex);
+
+@@ -45,4 +46,7 @@ int nw_link_process(sd_netlink* rtnl, sd_netlink_message* message, void* data);
+
+ int nw_link_destroy(nw_link* link);
+
++// JSON
++int nw_link_to_json(nw_link* link, struct json_object* o);
++
+ #endif /* NETWORKD_LINK_H */
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index fb62520..84fceee 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -682,6 +682,13 @@ int nw_port_to_json(nw_port* port, struct json_object** object) {
+ goto ERROR;
+ }
+
++ // Add link stuff
++ if (port->link) {
++ r = nw_link_to_json(port->link, o);
++ if (r < 0)
++ goto ERROR;
++ }
++
+ // Call custom stuff
+ if (NW_PORT_TYPE(port)->to_json) {
+ r = NW_PORT_TYPE(port)->to_json(port, o);
+--
+2.39.2
+
diff --git a/network/patches/0294-link-Add-device-stuff-to-JSON-output.patch b/network/patches/0294-link-Add-device-stuff-to-JSON-output.patch
new file mode 100644
index 000000000..95e39543b
--- /dev/null
+++ b/network/patches/0294-link-Add-device-stuff-to-JSON-output.patch
@@ -0,0 +1,185 @@
+From cf75e1dbc997b8a785e5f4d75e6a3d0efd594cf5 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 9 Jun 2023 14:44:06 +0000
+Subject: [PATCH 294/304] link: Add device stuff to JSON output
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/link.c | 113 ++++++++++++++++++++++++++++++++++++++++----
+ 1 file changed, 105 insertions(+), 8 deletions(-)
+
+diff --git a/src/networkd/link.c b/src/networkd/link.c
+index 60abd46..23918cb 100644
+--- a/src/networkd/link.c
++++ b/src/networkd/link.c
+@@ -24,6 +24,7 @@
+ #include <stdlib.h>
+ #include <string.h>
+
++#include <systemd/sd-device.h>
+ #include <systemd/sd-netlink.h>
+
+ #include "daemon.h"
+@@ -48,6 +49,9 @@ struct nw_link {
+ NW_LINK_DESTROYED,
+ } state;
+
++ // Device
++ struct sd_device* device;
++
+ // Stats
+ struct rtnl_link_stats64 stats64;
+
+@@ -61,11 +65,35 @@ struct nw_link {
+ uint8_t operstate;
+ };
+
++static int nw_link_setup_device(nw_link* link) {
++ int r;
++
++ // Fetch sd-device
++ r = sd_device_new_from_ifindex(&link->device, link->ifindex);
++ if (r < 0) {
++ ERROR("Could not fetch sd-device for link %d: %s\n", link->ifindex, strerror(-r));
++ return r;
++ }
++
++ return 0;
++}
++
++static void nw_link_free(nw_link* link) {
++ DEBUG("Freeing link (ifindex = %d)\n", link->ifindex);
++
++ if (link->device)
++ sd_device_unref(link->device);
++ if (link->daemon)
++ nw_daemon_unref(link->daemon);
++}
++
+ int nw_link_create(nw_link** link, nw_daemon* daemon, int ifindex) {
++ int r;
++
+ // Allocate a new object
+ nw_link* l = calloc(1, sizeof(*l));
+ if (!l)
+- return 1;
++ return -errno;
+
+ // Store a reference to the daemon
+ l->daemon = nw_daemon_ref(daemon);
+@@ -78,16 +106,16 @@ int nw_link_create(nw_link** link, nw_daemon* daemon, int ifindex) {
+
+ DEBUG("New link allocated (ifindex = %d)\n", l->ifindex);
+
+- *link = l;
++ r = nw_link_setup_device(l);
++ if (r < 0)
++ goto ERROR;
+
++ *link = l;
+ return 0;
+-}
+-
+-static void nw_link_free(nw_link* link) {
+- DEBUG("Freeing link (ifindex = %d)\n", link->ifindex);
+
+- if (link->daemon)
+- nw_daemon_unref(link->daemon);
++ERROR:
++ nw_link_free(l);
++ return r;
+ }
+
+ nw_link* nw_link_ref(nw_link* link) {
+@@ -126,6 +154,19 @@ const char* nw_link_ifname(nw_link* link) {
+ return link->ifname;
+ }
+
++static int nw_link_get_sd_device(nw_link* link, struct sd_device** device) {
++ int r;
++
++ // Fetch sd-device
++ r = sd_device_new_from_ifindex(device, link->ifindex);
++ if (r < 0) {
++ ERROR("Could not fetch sd-device for link %d: %s\n", link->ifindex, strerror(-r));
++ return r;
++ }
++
++ return 0;
++}
++
+ // Stats
+
+ const struct rtnl_link_stats64* nw_link_get_stats64(nw_link* link) {
+@@ -533,6 +574,57 @@ ERROR:
+
+ // JSON
+
++static int nw_link_device_to_json(nw_link* link, struct json_object* o) {
++ const char* driver = NULL;
++ const char* vendor = NULL;
++ const char* model = NULL;
++ int r;
++
++ // Fetch driver
++ r = sd_device_get_driver(link->device, &driver);
++ if (r < 0 && r != -ENOENT)
++ return r;
++
++ // Add driver
++ if (driver) {
++ r = json_object_add_string(o, "Driver", driver);
++ if (r < 0)
++ return r;
++ }
++
++ // Fetch vendor
++ r = sd_device_get_property_value(link->device, "ID_VENDOR_FROM_DATABASE", &vendor);
++ if (r < 0) {
++ r = sd_device_get_property_value(link->device, "ID_VENDOR", &vendor);
++ if (r < 0 && r != -ENOENT)
++ return r;
++ }
++
++ // Add vendor
++ if (vendor) {
++ r = json_object_add_string(o, "Vendor", vendor);
++ if (r < 0)
++ return r;
++ }
++
++ // Fetch model
++ r = sd_device_get_property_value(link->device, "ID_MODEL_FROM_DATABASE", &model);
++ if (r < 0) {
++ r = sd_device_get_property_value(link->device, "ID_MODEL", &model);
++ if (r < 0 && r != -ENOENT)
++ return r;
++ }
++
++ // Add model
++ if (model) {
++ r = json_object_add_string(o, "Model", model);
++ if (r < 0)
++ return r;
++ }
++
++ return 0;
++}
++
+ int nw_link_to_json(nw_link* link, struct json_object* o) {
+ int r;
+
+@@ -541,5 +633,10 @@ int nw_link_to_json(nw_link* link, struct json_object* o) {
+ if (r < 0)
+ return r;
+
++ // Add sd-device stuff
++ r = nw_link_device_to_json(link, o);
++ if (r < 0)
++ return r;
++
+ return 0;
+ }
+--
+2.39.2
+
diff --git a/network/patches/0295-ports-Add-scaffolding-for-physical-Ethernet-interfac.patch b/network/patches/0295-ports-Add-scaffolding-for-physical-Ethernet-interfac.patch
new file mode 100644
index 000000000..ec87e49e8
--- /dev/null
+++ b/network/patches/0295-ports-Add-scaffolding-for-physical-Ethernet-interfac.patch
@@ -0,0 +1,246 @@
+From f4f98a384fd5cb95b04be989ec488b2ecfc1960f Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Fri, 9 Jun 2023 14:59:54 +0000
+Subject: [PATCH 295/304] ports: Add scaffolding for physical Ethernet
+ interfaces
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 2 ++
+ src/networkd/link.c | 13 --------
+ src/networkd/port-ethernet.c | 63 ++++++++++++++++++++++++++++++++++++
+ src/networkd/port-ethernet.h | 34 +++++++++++++++++++
+ src/networkd/port.c | 16 ++++++---
+ src/networkd/port.h | 5 +++
+ 6 files changed, 116 insertions(+), 17 deletions(-)
+ create mode 100644 src/networkd/port-ethernet.c
+ create mode 100644 src/networkd/port-ethernet.h
+
+diff --git a/Makefile.am b/Makefile.am
+index 2632ca7..8c0d0c0 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -338,6 +338,8 @@ dist_networkd_SOURCES = \
+ src/networkd/port-bus.h \
+ src/networkd/port-dummy.c \
+ src/networkd/port-dummy.h \
++ src/networkd/port-ethernet.c \
++ src/networkd/port-ethernet.h \
+ src/networkd/port-veth.c \
+ src/networkd/port-veth.h \
+ src/networkd/port-vlan.c \
+diff --git a/src/networkd/link.c b/src/networkd/link.c
+index 23918cb..f172208 100644
+--- a/src/networkd/link.c
++++ b/src/networkd/link.c
+@@ -154,19 +154,6 @@ const char* nw_link_ifname(nw_link* link) {
+ return link->ifname;
+ }
+
+-static int nw_link_get_sd_device(nw_link* link, struct sd_device** device) {
+- int r;
+-
+- // Fetch sd-device
+- r = sd_device_new_from_ifindex(device, link->ifindex);
+- if (r < 0) {
+- ERROR("Could not fetch sd-device for link %d: %s\n", link->ifindex, strerror(-r));
+- return r;
+- }
+-
+- return 0;
+-}
+-
+ // Stats
+
+ const struct rtnl_link_stats64* nw_link_get_stats64(nw_link* link) {
+diff --git a/src/networkd/port-ethernet.c b/src/networkd/port-ethernet.c
+new file mode 100644
+index 0000000..a48b45e
+--- /dev/null
++++ b/src/networkd/port-ethernet.c
+@@ -0,0 +1,63 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#include "config.h"
++#include "json.h"
++#include "port.h"
++#include "port-ethernet.h"
++
++static int nw_port_ethernet_setup(nw_port* port) {
++ int r;
++
++ // Permanent Address
++ r = NW_CONFIG_OPTION_ADDRESS(port->config,
++ "PERMANENT_ADDRESS", &port->ethernet.permanent_address);
++ if (r < 0)
++ return r;
++
++ return 0;
++}
++
++static int nw_port_ethernet_to_json(nw_port* port, struct json_object* o) {
++ char* address = NULL;
++ int r = 0;
++
++ // Permanent Address
++ address = nw_address_to_string(&port->ethernet.permanent_address);
++ if (address) {
++ r = json_object_add_string(o, "PermanentAddress", address);
++ if (r < 0)
++ goto ERROR;
++ }
++
++ERROR:
++ if (address)
++ free(address);
++
++ return r;
++}
++
++const nw_port_type_t nw_port_type_ethernet = {
++ // Configuration
++ .setup = nw_port_ethernet_setup,
++
++ // JSON
++ .to_json = nw_port_ethernet_to_json,
++};
+diff --git a/src/networkd/port-ethernet.h b/src/networkd/port-ethernet.h
+new file mode 100644
+index 0000000..50dade2
+--- /dev/null
++++ b/src/networkd/port-ethernet.h
+@@ -0,0 +1,34 @@
++/*#############################################################################
++# #
++# IPFire.org - A linux based firewall #
++# Copyright (C) 2023 IPFire Network Development Team #
++# #
++# This program is free software: you can redistribute it and/or modify #
++# it under the terms of the GNU General Public License as published by #
++# the Free Software Foundation, either version 3 of the License, or #
++# (at your option) any later version. #
++# #
++# This program is distributed in the hope that it will be useful, #
++# but WITHOUT ANY WARRANTY; without even the implied warranty of #
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
++# GNU General Public License for more details. #
++# #
++# You should have received a copy of the GNU General Public License #
++# along with this program. If not, see <http://www.gnu.org/licenses/>. #
++# #
++#############################################################################*/
++
++#ifndef NETWORKD_PORT_ETHERNET_H
++#define NETWORKD_PORT_ETHERNET_H
++
++#include "address.h"
++#include "port.h"
++
++struct nw_port_ethernet {
++ // Permanent Address
++ nw_address_t permanent_address;
++};
++
++extern const nw_port_type_t nw_port_type_ethernet;
++
++#endif /* NETWORKD_PORT_ETHERNET_H */
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index 84fceee..f547956 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -33,16 +33,18 @@
+ #include "port.h"
+ #include "port-bonding.h"
+ #include "port-dummy.h"
++#include "port-ethernet.h"
+ #include "port-veth.h"
+ #include "port-vlan.h"
+ #include "stats-collector.h"
+ #include "string.h"
+
+ static const nw_string_table_t nw_port_type_id[] = {
+- { NW_PORT_BONDING, "bonding" },
+- { NW_PORT_DUMMY, "dummy" },
+- { NW_PORT_VETH, "veth", },
+- { NW_PORT_VLAN, "vlan" },
++ { NW_PORT_BONDING, "bonding" },
++ { NW_PORT_DUMMY, "dummy" },
++ { NW_PORT_ETHERNET, "ethernet" },
++ { NW_PORT_VETH, "veth", },
++ { NW_PORT_VLAN, "vlan" },
+ { -1, NULL },
+ };
+
+@@ -167,8 +169,13 @@ int nw_port_create(nw_port** port, nw_daemon* daemon,
+ p->type = &nw_port_type_dummy;
+ break;
+
++ case NW_PORT_ETHERNET:
++ p->type = &nw_port_type_ethernet;
++ break;
++
+ case NW_PORT_VETH:
+ p->type = &nw_port_type_veth;
++ break;
+
+ case NW_PORT_VLAN:
+ p->type = &nw_port_type_vlan;
+@@ -329,6 +336,7 @@ int __nw_port_drop_port(nw_daemon* daemon, nw_port* port, void* data) {
+
+ case NW_PORT_BONDING:
+ case NW_PORT_DUMMY:
++ case NW_PORT_ETHERNET:
+ case NW_PORT_VETH:
+ break;
+ }
+diff --git a/src/networkd/port.h b/src/networkd/port.h
+index 5c0a2a1..f1cb3d2 100644
+--- a/src/networkd/port.h
++++ b/src/networkd/port.h
+@@ -36,6 +36,7 @@ typedef struct nw_port nw_port;
+ typedef enum nw_port_type_id {
+ NW_PORT_BONDING,
+ NW_PORT_DUMMY,
++ NW_PORT_ETHERNET,
+ NW_PORT_VETH,
+ NW_PORT_VLAN,
+ } nw_port_type_id_t;
+@@ -67,6 +68,7 @@ typedef struct nw_port_type {
+ #include "daemon.h"
+ #include "json.h"
+ #include "port-bonding.h"
++#include "port-ethernet.h"
+ #include "port-veth.h"
+ #include "port-vlan.h"
+
+@@ -91,6 +93,9 @@ struct nw_port {
+ // Bonding Settings
+ struct nw_port_bonding bonding;
+
++ // Ethernet Settings
++ struct nw_port_ethernet ethernet;
++
+ // VETH Settings
+ struct nw_port_veth veth;
+
+--
+2.39.2
+
diff --git a/network/patches/0296-logging-Add-WARNING-log-level.patch b/network/patches/0296-logging-Add-WARNING-log-level.patch
new file mode 100644
index 000000000..8e81e26ba
--- /dev/null
+++ b/network/patches/0296-logging-Add-WARNING-log-level.patch
@@ -0,0 +1,25 @@
+From 008488e0f95c140f7df74cadd238db16321a7737 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 10 Jun 2023 11:22:46 +0000
+Subject: [PATCH 296/304] logging: Add WARNING log level
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/logging.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/networkd/logging.h b/src/networkd/logging.h
+index ea75ba0..e835064 100644
+--- a/src/networkd/logging.h
++++ b/src/networkd/logging.h
+@@ -30,6 +30,7 @@ void nw_log(int priority, const char *file, int line, const char* fn,
+ This is just something simple which will work for now...
+ */
+ #define INFO(args...) nw_log(LOG_INFO, __FILE__, __LINE__, __FUNCTION__, ## args)
++#define WARNING(args...) nw_log(LOG_WARNING, __FILE__, __LINE__, __FUNCTION__, ## args)
+ #define ERROR(args...) nw_log(LOG_ERR, __FILE__, __LINE__, __FUNCTION__, ## args)
+ #define DEBUG(args...) nw_log(LOG_DEBUG, __FILE__, __LINE__, __FUNCTION__, ## args)
+
+--
+2.39.2
+
diff --git a/network/patches/0297-networkd-Handle-any-uevents-for-links.patch b/network/patches/0297-networkd-Handle-any-uevents-for-links.patch
new file mode 100644
index 000000000..89c6dcce5
--- /dev/null
+++ b/network/patches/0297-networkd-Handle-any-uevents-for-links.patch
@@ -0,0 +1,148 @@
+From 40e2c8ca02fae3d175e8d49498a3b3b443b1c6ef Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 10 Jun 2023 11:29:22 +0000
+Subject: [PATCH 297/304] networkd: Handle any uevents for links
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/devmon.c | 67 +++++++++++++++++++++++++++++++++++++++++++
+ src/networkd/link.c | 19 ++++++++++++
+ src/networkd/link.h | 5 ++++
+ 3 files changed, 91 insertions(+)
+
+diff --git a/src/networkd/devmon.c b/src/networkd/devmon.c
+index 0a8c26d..c751985 100644
+--- a/src/networkd/devmon.c
++++ b/src/networkd/devmon.c
+@@ -20,8 +20,75 @@
+
+ #include <systemd/sd-device.h>
+
++#include "daemon.h"
+ #include "devmon.h"
++#include "logging.h"
++
++static int nw_daemon_handle_uevent_net(nw_daemon* daemon,
++ sd_device* device, sd_device_action_t action) {
++ nw_link* link = NULL;
++ int ifindex;
++ int r;
++
++ // Fetch ifindex
++ r = sd_device_get_ifindex(device, &ifindex);
++ if (r < 0) {
++ ERROR("Could not get ifindex from uevent: %s\n", strerror(-r));
++ goto ERROR;
++ }
++
++ // Fetch the link
++ link = nw_daemon_get_link_by_ifindex(daemon, ifindex);
++ if (!link) {
++ DEBUG("Could not fetch link %d, ignoring\n", ifindex);
++ r = 0;
++ goto ERROR;
++ }
++
++ // Let the link handle its uevent
++ r = nw_link_handle_uevent(link, device, action);
++
++ERROR:
++ if (link)
++ nw_link_unref(link);
++
++ return r;
++}
+
+ int nw_devmon_handle_uevent(sd_device_monitor* monitor, sd_device* device, void* data) {
++ sd_device_action_t action;
++ const char* subsystem = NULL;
++ int r;
++
++ // Fetch daemon
++ nw_daemon* daemon = (nw_daemon*)data;
++
++ // Fetch action
++ r = sd_device_get_action(device, &action);
++ if (r < 0) {
++ WARNING("Could not get uevent action, ignoring: %s\n", strerror(-r));
++ return r;
++ }
++
++ // Fetch subsystem
++ r = sd_device_get_subsystem(device, &subsystem);
++ if (r < 0) {
++ ERROR("Could not get uevent subsystem, ignoring: %s\n", strerror(-r));
++ return r;
++ }
++
++ // Handle any links
++ if (strcmp(subsystem, "net") == 0) {
++ r = nw_daemon_handle_uevent_net(daemon, device, action);
++
++ } else {
++ DEBUG("Received an uevent for an unhandled subsystem '%s', ignoring\n", subsystem);
++ return 0;
++ }
++
++ // Log if something went wrong
++ if (r < 0)
++ ERROR("Failed processing uevent: %s\n", strerror(-r));
++
+ return 0;
+ }
+diff --git a/src/networkd/link.c b/src/networkd/link.c
+index f172208..b0d9e86 100644
+--- a/src/networkd/link.c
++++ b/src/networkd/link.c
+@@ -559,6 +559,25 @@ ERROR:
+ return r;
+ }
+
++// uevent
++
++int nw_link_handle_uevent(nw_link* link, sd_device* device, sd_device_action_t action) {
++ // We need to remove or replace the stored device as it is now outdated
++ if (link->device) {
++ sd_device_unref(link->device);
++
++ // If the device has been removed, we remove its reference
++ if (action == SD_DEVICE_REMOVE)
++ link->device = NULL;
++
++ // Otherwise we just store the new one
++ else
++ link->device = sd_device_ref(device);
++ }
++
++ return 0;
++}
++
+ // JSON
+
+ static int nw_link_device_to_json(nw_link* link, struct json_object* o) {
+diff --git a/src/networkd/link.h b/src/networkd/link.h
+index 36c7d9d..c2f7b7e 100644
+--- a/src/networkd/link.h
++++ b/src/networkd/link.h
+@@ -23,6 +23,8 @@
+
+ #include <linux/if_link.h>
+
++#include <systemd/sd-device.h>
++
+ typedef struct nw_link nw_link;
+
+ #include "daemon.h"
+@@ -46,6 +48,9 @@ int nw_link_process(sd_netlink* rtnl, sd_netlink_message* message, void* data);
+
+ int nw_link_destroy(nw_link* link);
+
++// uevent
++int nw_link_handle_uevent(nw_link* link, sd_device* device, sd_device_action_t action);
++
+ // JSON
+ int nw_link_to_json(nw_link* link, struct json_object* o);
+
+--
+2.39.2
+
diff --git a/network/patches/0298-links-Initialize-udev-device-when-links-are-created.patch b/network/patches/0298-links-Initialize-udev-device-when-links-are-created.patch
new file mode 100644
index 000000000..997073bf7
--- /dev/null
+++ b/network/patches/0298-links-Initialize-udev-device-when-links-are-created.patch
@@ -0,0 +1,83 @@
+From 4d7437ddbcb56da5d64ae9189bdb2c8c161e4a9b Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sat, 10 Jun 2023 12:04:18 +0000
+Subject: [PATCH 298/304] links: Initialize udev device when links are created
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/link.c | 52 +++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 52 insertions(+)
+
+diff --git a/src/networkd/link.c b/src/networkd/link.c
+index b0d9e86..8ba5da5 100644
+--- a/src/networkd/link.c
++++ b/src/networkd/link.c
+@@ -245,6 +245,53 @@ static int nw_link_carrier_lost(nw_link* link) {
+ return 0; // XXX TODO
+ }
+
++static int nw_link_initialize(nw_link* link) {
++ sd_device *device = NULL;
++ int r;
++
++ // Fetch device
++ r = sd_device_new_from_ifindex(&device, link->ifindex);
++ if (r < 0) {
++ WARNING("Could not find device for link %d: %s\n", link->ifindex, strerror(-r));
++ r = 0;
++ goto ERROR;
++ }
++
++ // Check if device is initialized
++ r = sd_device_get_is_initialized(device);
++ switch (r) {
++ // Initialized - fallthrough
++ case 0:
++ break;
++
++ case 1:
++ DEBUG("The device has not been initialized, yet\n");
++ r = 0;
++ goto ERROR;
++
++ default:
++ WARNING("Could not check whether device is initialized, ignoring: %s\n",
++ strerror(-r));
++ goto ERROR;
++ }
++
++ // XXX Check renaming?!
++
++ if (link->device)
++ sd_device_unref(link->device);
++
++ // Store the device
++ link->device = sd_device_ref(device);
++
++ DEBUG("Link %d has been initialized\n", link->ifindex);
++
++ERROR:
++ if (device)
++ sd_device_unref(device);
++
++ return r;
++}
++
+ static int nw_link_update_ifname(nw_link* link, sd_netlink_message* message) {
+ const char* ifname = NULL;
+ int r;
+@@ -476,6 +523,11 @@ int nw_link_process(sd_netlink* rtnl, sd_netlink_message* message, void* data) {
+ goto ERROR;
+ }
+
++ // Initialize the link
++ r = nw_link_initialize(link);
++ if (r < 0)
++ goto ERROR;
++
+ // Add it to the list
+ r = nw_links_add_link(links, link);
+ if (r)
+--
+2.39.2
+
diff --git a/network/patches/0299-link-Skip-uevent-when-the-device-is-renaming.patch b/network/patches/0299-link-Skip-uevent-when-the-device-is-renaming.patch
new file mode 100644
index 000000000..8870dd155
--- /dev/null
+++ b/network/patches/0299-link-Skip-uevent-when-the-device-is-renaming.patch
@@ -0,0 +1,60 @@
+From 7d01b16d6ae3502e48bf99b572be627a2d8a2eac Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 11 Jun 2023 11:07:25 +0000
+Subject: [PATCH 299/304] link: Skip uevent when the device is renaming
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/link.c | 35 +++++++++++++++++++++++++++++++++++
+ 1 file changed, 35 insertions(+)
+
+diff --git a/src/networkd/link.c b/src/networkd/link.c
+index 8ba5da5..cb79dd2 100644
+--- a/src/networkd/link.c
++++ b/src/networkd/link.c
+@@ -613,7 +613,42 @@ ERROR:
+
+ // uevent
+
++static int nw_link_uevent_device_is_renaming(sd_device* device) {
++ int r;
++
++ r = sd_device_get_property_value(device, "ID_RENAMING", NULL);
++ switch (r) {
++ case -ENOENT:
++ return 0;
++
++ case 0:
++ return 1;
++
++ default:
++ return r;
++ }
++}
++
+ int nw_link_handle_uevent(nw_link* link, sd_device* device, sd_device_action_t action) {
++ int r;
++
++ // Check if the device is renaming
++ r = nw_link_uevent_device_is_renaming(device);
++ switch (r) {
++ // Not renaming - Fallthrough
++ case 0:
++ break;
++
++ case 1:
++ DEBUG("Device is renaming, skipping initialization\n");
++ return 0;
++
++ default:
++ ERROR("Could not determine whether the device is being renamed: %s\n",
++ strerror(-r));
++ return r;
++ }
++
+ // We need to remove or replace the stored device as it is now outdated
+ if (link->device) {
+ sd_device_unref(link->device);
+--
+2.39.2
+
diff --git a/network/patches/0300-networkd-Implement-smarter-handling-of-the-configura.patch b/network/patches/0300-networkd-Implement-smarter-handling-of-the-configura.patch
new file mode 100644
index 000000000..dfc0ac3a0
--- /dev/null
+++ b/network/patches/0300-networkd-Implement-smarter-handling-of-the-configura.patch
@@ -0,0 +1,951 @@
+From 25808f650e39dbcdf3e2d0ba42d079a9d5e43079 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 11 Jun 2023 13:02:35 +0000
+Subject: [PATCH 300/304] networkd: Implement smarter handling of the
+ configuration file hierarchy
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/config.c | 207 +++++++++++++++++++++++++++++++++++++++++-
+ src/networkd/config.h | 22 +++++
+ src/networkd/daemon.c | 72 +++++----------
+ src/networkd/daemon.h | 7 +-
+ src/networkd/port.c | 66 +++++++-------
+ src/networkd/port.h | 2 +-
+ src/networkd/ports.c | 50 +++-------
+ src/networkd/zone.c | 112 +++++++++++++----------
+ src/networkd/zone.h | 9 +-
+ src/networkd/zones.c | 37 ++++----
+ 10 files changed, 386 insertions(+), 198 deletions(-)
+
+diff --git a/src/networkd/config.c b/src/networkd/config.c
+index c6281cb..53fd8e3 100644
+--- a/src/networkd/config.c
++++ b/src/networkd/config.c
+@@ -18,12 +18,16 @@
+ # #
+ #############################################################################*/
+
++#include <dirent.h>
+ #include <errno.h>
++#include <fcntl.h>
+ #include <limits.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <string.h>
+ #include <sys/queue.h>
++#include <sys/types.h>
++#include <sys/stat.h>
+ #include <unistd.h>
+
+ #include "address.h"
+@@ -161,7 +165,6 @@ int nw_config_open(nw_config** config, const char* path) {
+ // Create a new configuration
+ r = nw_config_create(config, f);
+
+-ERROR:
+ if (f)
+ fclose(f);
+
+@@ -419,6 +422,208 @@ int nw_config_set_bool(nw_config* config, const char* key, const int value) {
+ return nw_config_set(config, key, value ? "true" : "false");
+ }
+
++/*
++ Directory
++*/
++
++struct nw_configd {
++ int nrefs;
++
++ char path[PATH_MAX];
++ int fd;
++};
++
++static void nw_configd_free(nw_configd* dir) {
++ if (dir->fd >= 0)
++ close(dir->fd);
++
++ free(dir);
++}
++
++static int __nw_configd_create(nw_configd** dir, int fd, const char* path) {
++ nw_configd* d = NULL;
++ int r;
++
++ // Allocate a new object
++ d = calloc(1, sizeof(*d));
++ if (!d)
++ return -errno;
++
++ // Initialize the reference counter
++ d->nrefs = 1;
++
++ // Store the file descriptor
++ d->fd = dup(fd);
++ if (d->fd < 0) {
++ r = -errno;
++ goto ERROR;
++ }
++
++ // Store path
++ if (path) {
++ r = nw_string_set(d->path, path);
++ if (r < 0)
++ goto ERROR;
++ }
++
++ *dir = d;
++ return 0;
++
++ERROR:
++ nw_configd_free(d);
++ return r;
++}
++
++int nw_configd_create(nw_configd** dir, const char* path) {
++ int fd;
++
++ // Open the directory
++ fd = open(path, O_DIRECTORY);
++ if (fd < 0) {
++ ERROR("Could not open %s: %m\n", path);
++ return -errno;
++ }
++
++ return __nw_configd_create(dir, fd, path);
++}
++
++nw_configd* nw_configd_ref(nw_configd* dir) {
++ dir->nrefs++;
++
++ return dir;
++}
++
++nw_configd* nw_configd_unref(nw_configd* dir) {
++ if (--dir->nrefs > 0)
++ return dir;
++
++ nw_configd_free(dir);
++ return NULL;
++}
++
++static int nw_configd_open(nw_configd* dir, const char* path, int flags) {
++ return openat(dir->fd, path, flags);
++}
++
++FILE* nw_configd_fopen(nw_configd* dir, const char* path, const char* mode) {
++ int fd;
++
++ // Open file
++ fd = nw_configd_open(dir, path, 0);
++ if (fd < 0)
++ return NULL;
++
++ // Return a file handle
++ return fdopen(fd, mode);
++}
++
++int nw_configd_open_config(nw_config** config, nw_configd* dir, const char* path) {
++ FILE* f = NULL;
++ int r;
++
++ // Open the file
++ f = nw_configd_fopen(dir, path, "r");
++ if (!f)
++ return -errno;
++
++ // Create configuration
++ r = nw_config_create(config, f);
++ if (r < 0)
++ goto ERROR;
++
++ERROR:
++ if (f)
++ fclose(f);
++
++ return r;
++}
++
++int nw_configd_unlink(nw_configd* dir, const char* path, int flags) {
++ return unlinkat(dir->fd, path, flags);
++}
++
++nw_configd* nw_configd_descend(nw_configd* dir, const char* path) {
++ nw_configd* d = NULL;
++ char p[PATH_MAX];
++ int fd = -1;
++ int r;
++
++ // Join paths
++ r = nw_path_join(p, dir->path, path);
++ if (r < 0)
++ goto ERROR;
++
++ // Open directory
++ fd = nw_configd_open(dir, path, O_DIRECTORY);
++ if (fd < 0) {
++ ERROR("Could not open %s: %m\n", p);
++ goto ERROR;
++ }
++
++ // Create a new config directory object
++ r = __nw_configd_create(&d, fd, p);
++ if (r < 0)
++ goto ERROR;
++
++ERROR:
++ if (fd >= 0)
++ close(fd);
++
++ return d;
++}
++
++int nw_configd_walk(nw_configd* dir, nw_configd_walk_callback callback, void* data) {
++ FILE* f = NULL;
++ DIR* d = NULL;
++ struct dirent* e = NULL;
++ int r;
++
++ // Re-open the directory
++ d = fdopendir(dir->fd);
++ if (!d) {
++ r = -errno;
++ goto ERROR;
++ }
++
++ // Walk trough everything
++ for (;;) {
++ // Read the next entry
++ e = readdir(d);
++ if (!e)
++ break;
++
++ // Skip anything that is not a regular file
++ if (e->d_type != DT_REG)
++ continue;
++
++ // Skip hidden files
++ if (e->d_name[0] == '.')
++ continue;
++
++ // Open the file
++ f = nw_configd_fopen(dir, e->d_name, "r");
++ if (!f) {
++ r = -errno;
++ goto ERROR;
++ }
++
++ // Call the callback
++ r = callback(e, f, data);
++ fclose(f);
++
++ if (r < 0)
++ goto ERROR;
++ }
++
++ r = 0;
++
++ERROR:
++ if (d)
++ closedir(d);
++
++ return r;
++}
++
+ /*
+ Options
+ */
+diff --git a/src/networkd/config.h b/src/networkd/config.h
+index 4b8bc01..3e7c097 100644
+--- a/src/networkd/config.h
++++ b/src/networkd/config.h
+@@ -21,6 +21,7 @@
+ #ifndef NETWORKD_CONFIG_H
+ #define NETWORKD_CONFIG_H
+
++#include <dirent.h>
+ #include <stdio.h>
+
+ #define NETWORK_CONFIG_KEY_MAX_LENGTH 128
+@@ -52,6 +53,27 @@ int nw_config_set_int(nw_config* config, const char* key, const int value);
+ int nw_config_get_bool(nw_config* config, const char* key);
+ int nw_config_set_bool(nw_config* config, const char* key, const int value);
+
++/*
++ Directory
++*/
++
++typedef struct nw_configd nw_configd;
++
++int nw_configd_create(nw_configd** dir, const char* path);
++
++nw_configd* nw_configd_ref(nw_configd* dir);
++nw_configd* nw_configd_unref(nw_configd* dir);
++
++FILE* nw_configd_fopen(nw_configd* dir, const char* path, const char* mode);
++int nw_configd_open_config(nw_config** config, nw_configd* dir, const char* path);
++int nw_configd_unlink(nw_configd* dir, const char* path, int flags);
++
++nw_configd* nw_configd_descend(nw_configd* dir, const char* path);
++
++typedef int (*nw_configd_walk_callback)(struct dirent* entry, FILE* f, void* data);
++
++int nw_configd_walk(nw_configd* dir, nw_configd_walk_callback callback, void* data);
++
+ /*
+ Options
+ */
+diff --git a/src/networkd/daemon.c b/src/networkd/daemon.c
+index a62e343..dfbcc15 100644
+--- a/src/networkd/daemon.c
++++ b/src/networkd/daemon.c
+@@ -51,7 +51,7 @@ struct nw_daemon {
+ int nrefs;
+
+ // Configuration
+- int configfd;
++ nw_configd* configd;
+ nw_config* config;
+
+ // Event Loop
+@@ -103,36 +103,14 @@ static int __nw_daemon_reload(sd_event_source* source, const struct signalfd_sig
+ */
+
+ static int nw_daemon_config_open(nw_daemon* daemon, const char* path) {
+- // Open the directory
+- daemon->configfd = open(path, O_DIRECTORY);
+- if (daemon->configfd < 0) {
+- ERROR("Could not open %s: %m\n", path);
+- return -errno;
+- }
+-
+- return 0;
+-}
+-
+-FILE* nw_daemon_config_fopen(nw_daemon* daemon, const char* path, const char* mode) {
+- // Open the file
+- int fd = openat(daemon->configfd, path, 0);
+- if (fd < 0) {
+- ERROR("Could not open configuration file %s: %m\n", path);
+- return NULL;
+- }
+-
+- // Return a file handle
+- return fdopen(fd, mode);
+-}
++ int r;
+
+-DIR* nw_daemon_config_opendir(nw_daemon* daemon, const char* path) {
+- int fd = openat(daemon->configfd, path, O_DIRECTORY);
+- if (fd < 0) {
+- ERROR("Could not open configuration directory %s: %m\n", path);
+- return NULL;
+- }
++ // Open the configuration directory
++ r = nw_configd_create(&daemon->configd, path);
++ if (r < 0)
++ return r;
+
+- return fdopendir(fd);
++ return 0;
+ }
+
+ static int nw_daemon_parse_argv(nw_daemon* daemon, int argc, char* argv[]) {
+@@ -213,33 +191,17 @@ static int nw_daemon_setup_loop(nw_daemon* daemon) {
+ }
+
+ static int nw_daemon_load_config(nw_daemon* daemon) {
+- FILE* f = NULL;
+ int r;
+
+ // If no configuration path has been opened yet, we will open something
+- if (!daemon->configfd) {
++ if (!daemon->configd) {
+ r = nw_daemon_config_open(daemon, CONFIG_DIR);
+ if (r < 0)
+- goto ERROR;
++ return r;
+ }
+
+ // Open the configuration file
+- f = nw_daemon_config_fopen(daemon, "settings", "r");
+- if (!f) {
+- r = -errno;
+- goto ERROR;
+- }
+-
+- // Create configuration
+- r = nw_config_create(&daemon->config, f);
+- if (r < 0)
+- goto ERROR;
+-
+-ERROR:
+- if (f)
+- fclose(f);
+-
+- return r;
++ return nw_configd_open_config(&daemon->config, daemon->configd, "settings");
+ }
+
+ static int nw_start_device_monitor(nw_daemon* daemon) {
+@@ -540,8 +502,8 @@ static void nw_daemon_free(nw_daemon* daemon) {
+ // Cleanup common objects
+ nw_daemon_cleanup(daemon);
+
+- if (daemon->configfd > 0)
+- close(daemon->configfd);
++ if (daemon->configd)
++ nw_configd_unref(daemon->configd);
+ if (daemon->stats_collector_event)
+ sd_event_source_unref(daemon->stats_collector_event);
+ if (daemon->bus)
+@@ -640,6 +602,16 @@ int nw_daemon_save(nw_daemon* daemon) {
+ return 0;
+ }
+
++nw_configd* nw_daemon_configd(nw_daemon* daemon, const char* path) {
++ if (!daemon->configd)
++ return NULL;
++
++ if (path)
++ return nw_configd_descend(daemon->configd, path);
++
++ return nw_configd_ref(daemon->configd);
++}
++
+ /*
+ Bus
+ */
+diff --git a/src/networkd/daemon.h b/src/networkd/daemon.h
+index b03086c..2d56d79 100644
+--- a/src/networkd/daemon.h
++++ b/src/networkd/daemon.h
+@@ -29,6 +29,7 @@
+
+ typedef struct nw_daemon nw_daemon;
+
++#include "config.h"
+ #include "link.h"
+ #include "links.h"
+ #include "port.h"
+@@ -47,11 +48,7 @@ int nw_daemon_reload(nw_daemon* daemon);
+
+ int nw_daemon_save(nw_daemon* daemon);
+
+-/*
+- Configuration
+-*/
+-FILE* nw_daemon_config_fopen(nw_daemon* daemon, const char* path, const char* mode);
+-DIR* nw_daemon_config_opendir(nw_daemon* daemon, const char* path);
++nw_configd* nw_daemon_configd(nw_daemon* daemon, const char* path);
+
+ /*
+ Bus
+diff --git a/src/networkd/port.c b/src/networkd/port.c
+index f547956..141bba5 100644
+--- a/src/networkd/port.c
++++ b/src/networkd/port.c
+@@ -222,24 +222,10 @@ ERROR:
+ return r;
+ }
+
+-int nw_port_open(nw_port** port, nw_daemon* daemon, const char* name) {
++int nw_port_open(nw_port** port, nw_daemon* daemon, const char* name, FILE* f) {
+ nw_config* config = NULL;
+- FILE* f = NULL;
+- char path[PATH_MAX];
+ int r;
+
+- // Make path
+- r = nw_string_format(path, "ports/%s", name);
+- if (r < 0)
+- goto ERROR;
+-
+- // Open the configuration file
+- f = nw_daemon_config_fopen(daemon, path, "r");
+- if (!f) {
+- r = -errno;
+- goto ERROR;
+- }
+-
+ // Initialize the configuration
+ r = nw_config_create(&config, f);
+ if (r < 0)
+@@ -248,7 +234,7 @@ int nw_port_open(nw_port** port, nw_daemon* daemon, const char* name) {
+ // Fetch the type
+ const char* type = nw_config_get(config, "TYPE");
+ if (!type) {
+- ERROR("Port configuration %s has no TYPE\n", path);
++ ERROR("Port %s has no TYPE\n", name);
+ r = -ENOTSUP;
+ goto ERROR;
+ }
+@@ -261,8 +247,6 @@ int nw_port_open(nw_port** port, nw_daemon* daemon, const char* name) {
+ ERROR:
+ if (config)
+ nw_config_unref(config);
+- if (f)
+- fclose(f);
+
+ return r;
+ }
+@@ -292,6 +276,7 @@ static void __nw_port_unref(void* data) {
+ }
+
+ int nw_port_destroy(nw_port* port) {
++ nw_configd* configd = NULL;
+ int r;
+
+ DEBUG("Destroying port %s\n", port->name);
+@@ -299,26 +284,33 @@ int nw_port_destroy(nw_port* port) {
+ // Destroy the physical link (if exists)
+ if (port->link) {
+ r = nw_link_destroy(port->link);
+- if (r)
+- return r;
++ if (r < 0)
++ goto ERROR;
+ }
+
+ // Dereference the port from other ports
+ r = nw_daemon_ports_walk(port->daemon, __nw_port_drop_port, port);
+- if (r)
+- return r;
++ if (r < 0)
++ goto ERROR;
+
+ // Dereference the port from other zones
+ r = nw_daemon_zones_walk(port->daemon, __nw_zone_drop_port, port);
+- if (r)
+- return r;
++ if (r < 0)
++ goto ERROR;
+
+- // Destroy the configuration
+- r = nw_config_destroy(port->config);
+- if (r)
+- return r;
++ // Fetch the configuration directory
++ configd = nw_daemon_configd(port->daemon, "ports");
++ if (configd) {
++ r = nw_configd_unlink(configd, port->name, 0);
++ if (r < 0)
++ goto ERROR;
++ }
+
+- return 0;
++ERROR:
++ if (configd)
++ nw_configd_unref(configd);
++
++ return r;
+ }
+
+ int __nw_port_drop_port(nw_daemon* daemon, nw_port* port, void* data) {
+@@ -345,17 +337,19 @@ int __nw_port_drop_port(nw_daemon* daemon, nw_port* port, void* data) {
+ }
+
+ int nw_port_save(nw_port* port) {
+- char path[PATH_MAX];
++ nw_configd* configd = NULL;
+ FILE* f = NULL;
+ int r;
+
+- // Compose path
+- r = nw_string_format(path, "ports/%s", port->name);
+- if (r < 0)
+- return r;
++ // Fetch configuration directory
++ configd = nw_daemon_configd(port->daemon, "ports");
++ if (!configd) {
++ r = -errno;
++ goto ERROR;
++ }
+
+ // Open file
+- f = nw_daemon_config_fopen(port->daemon, path, "w");
++ f = nw_configd_fopen(configd, port->name, "w");
+ if (!f) {
+ r = -errno;
+ goto ERROR;
+@@ -372,6 +366,8 @@ int nw_port_save(nw_port* port) {
+ goto ERROR;
+
+ ERROR:
++ if (configd)
++ nw_configd_unref(configd);
+ if (f)
+ fclose(f);
+ if (r)
+diff --git a/src/networkd/port.h b/src/networkd/port.h
+index f1cb3d2..3cbe4b0 100644
+--- a/src/networkd/port.h
++++ b/src/networkd/port.h
+@@ -105,7 +105,7 @@ struct nw_port {
+
+ int nw_port_create(nw_port** port, nw_daemon* daemon,
+ const nw_port_type_id_t type, const char* name, nw_config* config);
+-int nw_port_open(nw_port** port, nw_daemon* daemon, const char* name);
++int nw_port_open(nw_port** port, nw_daemon* daemon, const char* name, FILE* f);
+
+ nw_port* nw_port_ref(nw_port* port);
+ nw_port* nw_port_unref(nw_port* port);
+diff --git a/src/networkd/ports.c b/src/networkd/ports.c
+index 761e564..95a13e3 100644
+--- a/src/networkd/ports.c
++++ b/src/networkd/ports.c
+@@ -130,12 +130,14 @@ static int nw_ports_add_port(nw_ports* ports, nw_port* port) {
+ return 0;
+ }
+
+-static int nw_ports_enumerate_port(nw_ports* ports, const char* name) {
++static int __nw_ports_enumerate(struct dirent* entry, FILE* f, void* data) {
+ nw_port* port = NULL;
+ int r;
+
++ nw_ports* ports = (nw_ports*)data;
++
+ // Create a new port
+- r = nw_port_open(&port, ports->daemon, name);
++ r = nw_port_open(&port, ports->daemon, entry->d_name, f);
+ if (r < 0 || r == 1)
+ goto ERROR;
+
+@@ -152,45 +154,19 @@ ERROR:
+ }
+
+ int nw_ports_enumerate(nw_ports* ports) {
+- DIR* d = NULL;
+- struct dirent* entry = NULL;
++ nw_configd* configd = NULL;
+ int r;
+
+- // Open the ports directory
+- d = nw_daemon_config_opendir(ports->daemon, "ports");
+- if (!d) {
+- switch (errno) {
+- case ENOENT:
+- return 0;
+-
+- default:
+- return -errno;
+- }
+- }
+-
+- for (;;) {
+- // Read the next entry
+- entry = readdir(d);
+- if (!entry)
+- break;
+-
+- // Skip anything that is not a regular file
+- if (entry->d_type != DT_REG)
+- continue;
++ // Fetch ports configuration directory
++ configd = nw_daemon_configd(ports->daemon, "ports");
++ if (!configd)
++ return 0;
+
+- // Skip hidden files
+- if (entry->d_name[0] == '.')
+- continue;
++ // Walk through all files
++ r = nw_configd_walk(configd, __nw_ports_enumerate, ports);
+
+- // Enumerate the port
+- r = nw_ports_enumerate_port(ports, entry->d_name);
+- if (r < 0)
+- goto ERROR;
+- }
+-
+-ERROR:
+- if (d)
+- closedir(d);
++ // Cleanup
++ nw_configd_unref(configd);
+
+ return r;
+ }
+diff --git a/src/networkd/zone.c b/src/networkd/zone.c
+index cc5fdaf..19d221f 100644
+--- a/src/networkd/zone.c
++++ b/src/networkd/zone.c
+@@ -32,6 +32,12 @@
+ #include "string.h"
+ #include "zone.h"
+
++static const nw_string_table_t nw_zone_type_id[] = {
++ { -1, NULL },
++};
++
++NW_STRING_TABLE_LOOKUP(nw_zone_type_id_t, nw_zone_type_id)
++
+ struct nw_zone {
+ nw_daemon* daemon;
+ int nrefs;
+@@ -45,32 +51,6 @@ struct nw_zone {
+ nw_config *config;
+ };
+
+-#define nw_zone_path(zone, path, format, ...) \
+- __nw_zone_path(zone, path, sizeof(path), format, __VA_ARGS__)
+-
+-static int __nw_zone_path(nw_zone* zone, char* p, const size_t length,
+- const char* format, ...) {
+- char prefix[NAME_MAX];
+- char suffix[NAME_MAX];
+- va_list args;
+- int r;
+-
+- // Format the prefix
+- r = nw_string_format(prefix, "%s/zones/%s", CONFIG_DIR, zone->name);
+- if (r)
+- return r;
+-
+- // Format the suffix
+- va_start(args, format);
+- r = nw_string_vformat(suffix, format, args);
+- va_end(args);
+- if (r)
+- return r;
+-
+- // Join the two parts together
+- return __nw_path_join(p, length, prefix, suffix);
+-}
+-
+ static void nw_zone_free(nw_zone* zone) {
+ if (zone->link)
+ nw_link_unref(zone->link);
+@@ -109,8 +89,7 @@ static int nw_zone_set_link(nw_zone* zone, nw_link* link) {
+
+ static int nw_zone_setup(nw_zone* zone) {
+ nw_link* link = NULL;
+- char path[PATH_MAX];
+- int r;
++ int r = 0;
+
+ // Find the link
+ link = nw_daemon_get_link_by_name(zone->daemon, zone->name);
+@@ -120,18 +99,6 @@ static int nw_zone_setup(nw_zone* zone) {
+ goto ERROR;
+ }
+
+-#if 0
+- // Compose the path to the main configuration file
+- r = nw_zone_path(zone, path, "%s", "settings");
+- if (r)
+- goto ERROR;
+-
+- // Initialize the configuration
+- r = nw_config_create(&zone->config, path);
+- if (r)
+- goto ERROR;
+-#endif
+-
+ ERROR:
+ if (link)
+ nw_link_unref(link);
+@@ -139,13 +106,15 @@ ERROR:
+ return r;
+ }
+
+-int nw_zone_create(nw_zone** zone, nw_daemon* daemon, const char* name) {
++int nw_zone_create(nw_zone** zone, nw_daemon* daemon, const nw_zone_type_id_t type,
++ const char* name, nw_config* config) {
++ nw_zone* z = NULL;
+ int r;
+
+ // Allocate a new object
+- nw_zone* z = calloc(1, sizeof(*z));
++ z = calloc(1, sizeof(*z));
+ if (!z)
+- return 1;
++ return -errno;
+
+ // Store a reference to the daemon
+ z->daemon = nw_daemon_ref(daemon);
+@@ -158,6 +127,11 @@ int nw_zone_create(nw_zone** zone, nw_daemon* daemon, const char* name) {
+ if (r)
+ goto ERROR;
+
++ // Copy the configuration
++ r = nw_config_copy(config, &z->config);
++ if (r < 0)
++ goto ERROR;
++
+ // Setup the zone
+ r = nw_zone_setup(z);
+ if (r)
+@@ -171,6 +145,35 @@ ERROR:
+ return r;
+ }
+
++int nw_zone_open(nw_zone** zone, nw_daemon* daemon, const char* name, FILE* f) {
++ nw_config* config = NULL;
++ int r;
++
++ // Initialize the configuration
++ r = nw_config_create(&config, f);
++ if (r < 0)
++ goto ERROR;
++
++ // Fetch the type
++ const char* type = nw_config_get(config, "TYPE");
++ if (!type) {
++ ERROR("Zone %s has no TYPE\n", name);
++ r = -ENOTSUP;
++ goto ERROR;
++ }
++
++ // Create a new zone
++ r = nw_zone_create(zone, daemon, nw_zone_type_id_from_string(type), name, config);
++ if (r < 0)
++ goto ERROR;
++
++ERROR:
++ if (config)
++ nw_config_unref(config);
++
++ return r;
++}
++
+ nw_zone* nw_zone_ref(nw_zone* zone) {
+ zone->nrefs++;
+
+@@ -195,30 +198,41 @@ int __nw_zone_drop_port(nw_daemon* daemon, nw_zone* zone, void* data) {
+ }
+
+ int nw_zone_save(nw_zone* zone) {
+- char path[PATH_MAX];
++ nw_configd* configd = NULL;
+ FILE* f = NULL;
+ int r;
+
+- // Compose path
+- r = nw_string_format(path, "zones/%s/settings", zone->name);
+- if (r < 0)
++ // Fetch configuration directory
++ configd = nw_daemon_configd(zone->daemon, "zones");
++ if (!configd) {
++ r = -errno;
+ goto ERROR;
++ }
+
+ // Open file
+- f = nw_daemon_config_fopen(zone->daemon, path, "w");
++ f = nw_configd_fopen(configd, zone->name, "w");
+ if (!f) {
+ r = -errno;
+ goto ERROR;
+ }
+
++ // Write out the configuration
++ r = nw_config_options_write(zone->config);
++ if (r < 0)
++ goto ERROR;
++
+ // Write the configuration
+ r = nw_config_write(zone->config, f);
+- if (r)
++ if (r < 0)
+ goto ERROR;
+
+ ERROR:
++ if (configd)
++ nw_configd_unref(configd);
+ if (f)
+ fclose(f);
++ if (r)
++ ERROR("Could not save configuration for zone %s: %s\n", zone->name, strerror(-r));
+
+ return r;
+ }
+diff --git a/src/networkd/zone.h b/src/networkd/zone.h
+index 480440f..6ab951b 100644
+--- a/src/networkd/zone.h
++++ b/src/networkd/zone.h
+@@ -28,11 +28,18 @@
+
+ typedef struct nw_zone nw_zone;
+
++typedef enum nw_zone_type_id {
++ __EMPTY
++} nw_zone_type_id_t;
++
+ #include <linux/if_link.h>
+
++#include "config.h"
+ #include "daemon.h"
+
+-int nw_zone_create(nw_zone** zone, nw_daemon* daemon, const char* name);
++int nw_zone_create(nw_zone** zone, nw_daemon* daemon, const nw_zone_type_id_t type,
++ const char* name, nw_config* config);
++int nw_zone_open(nw_zone** zone, nw_daemon* daemon, const char* name, FILE* f);
+
+ nw_zone* nw_zone_ref(nw_zone* zone);
+ nw_zone* nw_zone_unref(nw_zone* zone);
+diff --git a/src/networkd/zones.c b/src/networkd/zones.c
+index 84a6673..654e637 100644
+--- a/src/networkd/zones.c
++++ b/src/networkd/zones.c
+@@ -135,30 +135,15 @@ static int nw_zones_add_zone(nw_zones* zones, nw_zone* zone) {
+ return 0;
+ }
+
+-static int __nw_zones_enumerate(const char* path, const struct stat* s, void* data) {
++static int __nw_zones_enumerate(struct dirent* entry, FILE* f, void* data) {
+ nw_zone* zone = NULL;
+ int r;
+
+ nw_zones* zones = (nw_zones*)data;
+
+- // Skip anything that isn't a directory
+- if (!S_ISDIR(s->st_mode))
+- return 0;
+-
+- // Find the basename of the file
+- const char* name = nw_path_basename(path);
+-
+- // Break on invalid paths
+- if (!name)
+- return 0;
+-
+- // Skip any hidden files
+- if (*name == '.')
+- return 0;
+-
+ // Create a new zone
+- r = nw_zone_create(&zone, zones->daemon, name);
+- if (r)
++ r = nw_zone_open(&zone, zones->daemon, entry->d_name, f);
++ if (r < 0 || r == 1)
+ goto ERROR;
+
+ // Add the zone to the list
+@@ -174,7 +159,21 @@ ERROR:
+ }
+
+ int nw_zones_enumerate(nw_zones* zones) {
+- return nw_ftw(ZONE_CONFIG_DIR, ZONE_CONFIG_DIR "/*", __nw_zones_enumerate, zones);
++ nw_configd* configd = NULL;
++ int r;
++
++ // Fetch zones configuration directory
++ configd = nw_daemon_configd(zones->daemon, "zones");
++ if (!configd)
++ return 0;
++
++ // Walk through all files
++ r = nw_configd_walk(configd, __nw_zones_enumerate, zones);
++
++ // Cleanup
++ nw_configd_unref(configd);
++
++ return r;
+ }
+
+ size_t nw_zones_num(nw_zones* zones) {
+--
+2.39.2
+
diff --git a/network/patches/0301-zones-Move-struct-nw_zone-into-header.patch b/network/patches/0301-zones-Move-struct-nw_zone-into-header.patch
new file mode 100644
index 000000000..84f8b72ec
--- /dev/null
+++ b/network/patches/0301-zones-Move-struct-nw_zone-into-header.patch
@@ -0,0 +1,115 @@
+From 416ba6cd142bc5006b1c977bec86fc12dfffc80c Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 11 Jun 2023 13:09:41 +0000
+Subject: [PATCH 301/304] zones: Move "struct nw_zone" into header
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/port-vlan.h | 2 +-
+ src/networkd/port.h | 6 +-----
+ src/networkd/zone.c | 13 -------------
+ src/networkd/zone.h | 16 +++++++++++++++-
+ 4 files changed, 17 insertions(+), 20 deletions(-)
+
+diff --git a/src/networkd/port-vlan.h b/src/networkd/port-vlan.h
+index e17f7e7..c807238 100644
+--- a/src/networkd/port-vlan.h
++++ b/src/networkd/port-vlan.h
+@@ -47,7 +47,7 @@ struct nw_port_vlan {
+
+ // If the parent has not been read from the configuration we will
+ // save the name and try to find it later.
+- char __parent_name[IF_NAMESIZE];
++ char __parent_name[IFNAMSIZ];
+ };
+
+ extern const nw_port_type_t nw_port_type_vlan;
+diff --git a/src/networkd/port.h b/src/networkd/port.h
+index 3cbe4b0..422a65f 100644
+--- a/src/networkd/port.h
++++ b/src/networkd/port.h
+@@ -25,10 +25,6 @@
+
+ #include <systemd/sd-netlink.h>
+
+-#ifndef IF_NAMESIZE
+-#define IF_NAMESIZE 16
+-#endif
+-
+ #define PORT_CONFIG_DIR CONFIG_DIR "/ports"
+
+ typedef struct nw_port nw_port;
+@@ -82,7 +78,7 @@ struct nw_port {
+ nw_link* link;
+
+ const nw_port_type_t* type;
+- char name[IF_NAMESIZE];
++ char name[IFNAMSIZ];
+
+ // Configuration
+ nw_config *config;
+diff --git a/src/networkd/zone.c b/src/networkd/zone.c
+index 19d221f..1610dc0 100644
+--- a/src/networkd/zone.c
++++ b/src/networkd/zone.c
+@@ -38,19 +38,6 @@ static const nw_string_table_t nw_zone_type_id[] = {
+
+ NW_STRING_TABLE_LOOKUP(nw_zone_type_id_t, nw_zone_type_id)
+
+-struct nw_zone {
+- nw_daemon* daemon;
+- int nrefs;
+-
+- // Link
+- nw_link* link;
+-
+- char name[NETWORK_ZONE_NAME_MAX_LENGTH];
+-
+- // Configuration
+- nw_config *config;
+-};
+-
+ static void nw_zone_free(nw_zone* zone) {
+ if (zone->link)
+ nw_link_unref(zone->link);
+diff --git a/src/networkd/zone.h b/src/networkd/zone.h
+index 6ab951b..2d1e1dc 100644
+--- a/src/networkd/zone.h
++++ b/src/networkd/zone.h
+@@ -23,7 +23,6 @@
+
+ #define ZONE_CONFIG_DIR CONFIG_DIR "/zones"
+
+-#define NETWORK_ZONE_NAME_MAX_LENGTH 16
+ #define NETWORK_ZONE_DEFAULT_MTU 1500
+
+ typedef struct nw_zone nw_zone;
+@@ -32,10 +31,25 @@ typedef enum nw_zone_type_id {
+ __EMPTY
+ } nw_zone_type_id_t;
+
++#include <linux/if.h>
+ #include <linux/if_link.h>
+
+ #include "config.h"
+ #include "daemon.h"
++#include "link.h"
++
++struct nw_zone {
++ nw_daemon* daemon;
++ int nrefs;
++
++ // Link
++ nw_link* link;
++
++ char name[IFNAMSIZ];
++
++ // Configuration
++ nw_config *config;
++};
+
+ int nw_zone_create(nw_zone** zone, nw_daemon* daemon, const nw_zone_type_id_t type,
+ const char* name, nw_config* config);
+--
+2.39.2
+
diff --git a/network/patches/0302-Drop-unused-configuration-file-paths.patch b/network/patches/0302-Drop-unused-configuration-file-paths.patch
new file mode 100644
index 000000000..a390a86f4
--- /dev/null
+++ b/network/patches/0302-Drop-unused-configuration-file-paths.patch
@@ -0,0 +1,40 @@
+From 5548c63c9425f39472e75fef86ad2b8877657997 Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 11 Jun 2023 13:10:31 +0000
+Subject: [PATCH 302/304] Drop unused configuration file paths
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/port.h | 2 --
+ src/networkd/zone.h | 2 --
+ 2 files changed, 4 deletions(-)
+
+diff --git a/src/networkd/port.h b/src/networkd/port.h
+index 422a65f..9770079 100644
+--- a/src/networkd/port.h
++++ b/src/networkd/port.h
+@@ -25,8 +25,6 @@
+
+ #include <systemd/sd-netlink.h>
+
+-#define PORT_CONFIG_DIR CONFIG_DIR "/ports"
+-
+ typedef struct nw_port nw_port;
+
+ typedef enum nw_port_type_id {
+diff --git a/src/networkd/zone.h b/src/networkd/zone.h
+index 2d1e1dc..2ece268 100644
+--- a/src/networkd/zone.h
++++ b/src/networkd/zone.h
+@@ -21,8 +21,6 @@
+ #ifndef NETWORKD_ZONE_H
+ #define NETWORKD_ZONE_H
+
+-#define ZONE_CONFIG_DIR CONFIG_DIR "/zones"
+-
+ #define NETWORK_ZONE_DEFAULT_MTU 1500
+
+ typedef struct nw_zone nw_zone;
+--
+2.39.2
+
diff --git a/network/patches/0303-util-Drop-nw_ftw.patch b/network/patches/0303-util-Drop-nw_ftw.patch
new file mode 100644
index 000000000..dbd75ba6d
--- /dev/null
+++ b/network/patches/0303-util-Drop-nw_ftw.patch
@@ -0,0 +1,77 @@
+From 10edad249159db9d6ef1e2b6e7a8fac78f183fce Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Sun, 11 Jun 2023 13:11:11 +0000
+Subject: [PATCH 303/304] util: Drop nw_ftw
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ src/networkd/util.c | 40 ----------------------------------------
+ src/networkd/util.h | 5 -----
+ 2 files changed, 45 deletions(-)
+
+diff --git a/src/networkd/util.c b/src/networkd/util.c
+index 0381ea8..e2f5cf1 100644
+--- a/src/networkd/util.c
++++ b/src/networkd/util.c
+@@ -18,44 +18,4 @@
+ # #
+ #############################################################################*/
+
+-#include <errno.h>
+-#include <fnmatch.h>
+-#include <ftw.h>
+-#include <stddef.h>
+-#include <stdio.h>
+-
+ #include "util.h"
+-
+-int nw_ftw(const char* path, const char* filter,
+- int (*callback)(const char* path, const struct stat* s, void* data), void* data) {
+- /*
+- This is a nested function which allows us to pass some custom pointer to
+- the callback function as that isn't possible with nftw().
+- */
+- int __callback(const char* p, const struct stat* s, int type, struct FTW* ftw) {
+- int r;
+-
+- // Filter out anything we don't want
+- if (filter) {
+- r = fnmatch(filter, p, FNM_PATHNAME);
+-
+- switch (r) {
+- // Pattern didn't match
+- case FNM_NOMATCH:
+- return 0;
+-
+- // Pattern matched
+- case 0:
+- break;
+-
+- // Error
+- default:
+- return 1;
+- }
+- }
+-
+- return callback(p, s, data);
+- }
+-
+- return nftw(path, __callback, 0, 0);
+-}
+diff --git a/src/networkd/util.h b/src/networkd/util.h
+index 950afda..11317ff 100644
+--- a/src/networkd/util.h
++++ b/src/networkd/util.h
+@@ -21,9 +21,4 @@
+ #ifndef NETWORKD_UTIL_H
+ #define NETWORKD_UTIL_H
+
+-#include <sys/stat.h>
+-
+-int nw_ftw(const char* path, const char* filter,
+- int (*callback)(const char* path, const struct stat* s, void* data), void* data);
+-
+ #endif /* NETWORKD_UTIL_H */
+--
+2.39.2
+
diff --git a/network/patches/0304-Makefile-Fix-typo-in-localstatedir.patch b/network/patches/0304-Makefile-Fix-typo-in-localstatedir.patch
new file mode 100644
index 000000000..9f4bdd45b
--- /dev/null
+++ b/network/patches/0304-Makefile-Fix-typo-in-localstatedir.patch
@@ -0,0 +1,26 @@
+From b9ac9712ab5dadf45ddc3749d7c9e393bc3eddaf Mon Sep 17 00:00:00 2001
+From: Michael Tremer <michael.tremer(a)ipfire.org>
+Date: Tue, 19 Sep 2023 12:54:53 +0000
+Subject: [PATCH 304/304] Makefile: Fix typo in localstatedir
+
+Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+---
+ Makefile.am | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Makefile.am b/Makefile.am
+index 8c0d0c0..7ca1229 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -51,7 +51,7 @@ hooks_zonesdir = $(hooksdir)/zones
+
+ triggersdir = $(networkdir)/triggers
+
+-logdir = $(localestatedir)/log/network
++logdir = $(localstatedir)/log/network
+ utildir = $(networkdir)
+
+ CLEANFILES =
+--
+2.39.2
+
diff --git a/network/patches/network-fix-logdir-path.patch b/network/patches/network-fix-logdir-path.patch
deleted file mode 100644
index f708c030a..000000000
--- a/network/patches/network-fix-logdir-path.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-commit 88e5f32944b8dc1c4b1c74028c7d46c37b2aad34
-Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
-Date: Sun Mar 19 15:58:11 2023 +0100
-
- Makefile.am: Fix typo defining the logdir
-
- The correct value name should be "localstatedir"
-
- Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
-
-diff --git a/Makefile.am b/Makefile.am
-index 893f1b8..5dc4629 100644
---- a/Makefile.am
-+++ b/Makefile.am
-@@ -51,7 +51,7 @@ hooks_zonesdir = $(hooksdir)/zones
-
- triggersdir = $(networkdir)/triggers
-
--logdir = $(localestatedir)/log/network
-+logdir = $(localstatedir)/log/network
- utildir = $(networkdir)
-
- CLEANFILES =
--
2.39.2
1
0
- IPFire-3.x
- Update from version 5.5.15 to 5.5.18
- Changelog
5.5.18
Updated the .ga TLD server. (Closes: #1037288)
Added new recovered IPv4 allocations.
Removed the delegation of 43.0.0.0/8 to JPNIC.
Removed 12 new gTLDs which are no longer active.
Improved the man page source, courtesy of Bjarni Ingi Gislason.
(Closes: #1040613)
Added the .edu.za SLD server.
Updated the .alt.za SLD server.
Added the -ru and -su NIC handles servers.
5.5.17
Added the .cd TLD server.
Updated the -kg NIC handles server name.
Removed 2 new gTLDs which are no longer active.
5.5.16
Add bash completion support, courtesy of Ville Skyttä.
Updated the .tr TLD server.
Removed support for -metu NIC handles.
Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org>
---
whois/whois.nm | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/whois/whois.nm b/whois/whois.nm
index 21cdff974..eba84afc6 100644
--- a/whois/whois.nm
+++ b/whois/whois.nm
@@ -4,8 +4,8 @@
###############################################################################
name = whois
-version = 5.5.15
-release = 2
+version = 5.5.18
+release = 1
groups = Applications/Internet
url = https://github.com/rfc1036/whois
--
2.42.0
1
0
This is needed for the network stack.
The patch reverts https://github.com/systemd/systemd/commit/dd35a61
as systemd currently does not export sd-netlink.
Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org>
---
...evert-sd-netlink-unexport-sd-netlink.patch | 1416 +++++++++++++++++
systemd/systemd.nm | 3 +-
2 files changed, 1418 insertions(+), 1 deletion(-)
create mode 100644 systemd/patches/0001-Revert-sd-netlink-unexport-sd-netlink.patch
diff --git a/systemd/patches/0001-Revert-sd-netlink-unexport-sd-netlink.patch b/systemd/patches/0001-Revert-sd-netlink-unexport-sd-netlink.patch
new file mode 100644
index 000000000..4507a1086
--- /dev/null
+++ b/systemd/patches/0001-Revert-sd-netlink-unexport-sd-netlink.patch
@@ -0,0 +1,1416 @@
+From b0ca7a9351fab7a339357cbc17800e11ccae91e8 Mon Sep 17 00:00:00 2001
+From: Jonatan Schlag <jonatan.schlag(a)ipfire.org>
+Date: Tue, 19 Sep 2023 11:58:49 +0000
+Subject: [PATCH] Revert "sd-netlink: unexport sd-netlink"
+
+This reverts commit dd35a61cafb5ffb380f92f45b9d9e3ac1f53351b.
+---
+ src/libsystemd/libsystemd.sym | 155 ++++++++++++++++++
+ src/libsystemd/sd-netlink/netlink-genl.c | 10 +-
+ .../sd-netlink/netlink-message-rtnl.c | 134 +++++++--------
+ src/libsystemd/sd-netlink/netlink-message.c | 100 +++++------
+ src/libsystemd/sd-netlink/sd-netlink.c | 26 +--
+ src/systemd/meson.build | 2 +-
+ 6 files changed, 291 insertions(+), 136 deletions(-)
+
+diff --git a/src/libsystemd/libsystemd.sym b/src/libsystemd/libsystemd.sym
+index 56a8831f0f..0f84848064 100644
+--- a/src/libsystemd/libsystemd.sym
++++ b/src/libsystemd/libsystemd.sym
+@@ -795,6 +795,161 @@ global:
+ sd_id128_string_equal;
+
+ sd_hwdb_new_from_path;
++
++ sd_netlink_open;
++ sd_netlink_open_fd;
++ sd_netlink_increase_rxbuf;
++ sd_netlink_ref;
++ sd_netlink_unref;
++ sd_netlink_send;
++ sd_netlink_call_async;
++ sd_netlink_call;
++ sd_netlink_read;
++ sd_netlink_get_events;
++ sd_netlink_get_timeout;
++ sd_netlink_process;
++ sd_netlink_wait;
++ sd_netlink_add_match;
++ sd_netlink_attach_event;
++ sd_netlink_detach_event;
++ sd_netlink_attach_filter;
++ sd_netlink_message_append_string;
++ sd_netlink_message_append_strv;
++ sd_netlink_message_append_flag;
++ sd_netlink_message_append_u8;
++ sd_netlink_message_append_u16;
++ sd_netlink_message_append_u32;
++ sd_netlink_message_append_u64;
++ sd_netlink_message_append_s8;
++ sd_netlink_message_append_s16;
++ sd_netlink_message_append_s32;
++ sd_netlink_message_append_s64;
++ sd_netlink_message_append_data;
++ sd_netlink_message_append_container_data;
++ sd_netlink_message_append_in_addr;
++ sd_netlink_message_append_in6_addr;
++ sd_netlink_message_append_sockaddr_in;
++ sd_netlink_message_append_sockaddr_in6;
++ sd_netlink_message_append_ether_addr;
++ sd_netlink_message_append_cache_info;
++ sd_netlink_message_open_container;
++ sd_netlink_message_open_container_union;
++ sd_netlink_message_close_container;
++ sd_netlink_message_read;
++ sd_netlink_message_read_data;
++ sd_netlink_message_read_data_suffix0;
++ sd_netlink_message_read_string_strdup;
++ sd_netlink_message_read_string;
++ sd_netlink_message_read_strv;
++ sd_netlink_message_read_u8;
++ sd_netlink_message_read_u16;
++ sd_netlink_message_read_u32;
++ sd_netlink_message_read_ether_addr;
++ sd_netlink_message_read_cache_info;
++ sd_netlink_message_read_in_addr;
++ sd_netlink_message_read_in6_addr;
++ sd_netlink_message_has_flag;
++ sd_netlink_message_enter_container;
++ sd_netlink_message_enter_array;
++ sd_netlink_message_exit_container;
++ sd_netlink_message_open_array;
++ sd_netlink_message_cancel_array;
++ sd_netlink_message_rewind;
++ sd_netlink_message_next;
++ sd_netlink_message_ref;
++ sd_netlink_message_unref;
++ sd_netlink_message_set_request_dump;
++ sd_netlink_message_is_error;
++ sd_netlink_message_get_errno;
++ sd_netlink_message_get_type;
++ sd_netlink_message_set_flags;
++ sd_netlink_message_is_broadcast;
++ sd_netlink_message_get_max_attribute;
++ sd_netlink_slot_ref;
++ sd_netlink_slot_unref;
++ sd_netlink_slot_get_netlink;
++ sd_netlink_slot_get_userdata;
++ sd_netlink_slot_set_userdata;
++ sd_netlink_slot_get_destroy_callback;
++ sd_netlink_slot_set_destroy_callback;
++ sd_netlink_slot_get_floating;
++ sd_netlink_slot_set_floating;
++ sd_netlink_slot_get_description;
++ sd_netlink_slot_set_description;
++
++ sd_rtnl_message_get_family;
++ sd_rtnl_message_new_addr;
++ sd_rtnl_message_new_addr_update;
++ sd_rtnl_message_addr_set_prefixlen;
++ sd_rtnl_message_addr_set_scope;
++ sd_rtnl_message_addr_set_flags;
++ sd_rtnl_message_addr_get_family;
++ sd_rtnl_message_addr_get_prefixlen;
++ sd_rtnl_message_addr_get_scope;
++ sd_rtnl_message_addr_get_flags;
++ sd_rtnl_message_addr_get_ifindex;
++ sd_rtnl_message_new_link;
++ sd_rtnl_message_link_set_flags;
++ sd_rtnl_message_link_set_type;
++ sd_rtnl_message_link_set_family;
++ sd_rtnl_message_link_get_ifindex;
++ sd_rtnl_message_link_get_flags;
++ sd_rtnl_message_link_get_type;
++ sd_rtnl_message_new_route;
++ sd_rtnl_message_route_set_dst_prefixlen;
++ sd_rtnl_message_route_set_src_prefixlen;
++ sd_rtnl_message_route_set_scope;
++ sd_rtnl_message_route_set_flags;
++ sd_rtnl_message_route_set_table;
++ sd_rtnl_message_route_set_type;
++ sd_rtnl_message_route_get_flags;
++ sd_rtnl_message_route_get_family;
++ sd_rtnl_message_route_get_protocol;
++ sd_rtnl_message_route_get_scope;
++ sd_rtnl_message_route_get_tos;
++ sd_rtnl_message_route_get_table;
++ sd_rtnl_message_route_get_dst_prefixlen;
++ sd_rtnl_message_route_get_src_prefixlen;
++ sd_rtnl_message_route_get_type;
++ sd_rtnl_message_new_nexthop;
++ sd_rtnl_message_nexthop_set_flags;
++ sd_rtnl_message_nexthop_get_flags;
++ sd_rtnl_message_nexthop_get_family;
++ sd_rtnl_message_nexthop_get_protocol;
++ sd_rtnl_message_new_neigh;
++ sd_rtnl_message_neigh_set_flags;
++ sd_rtnl_message_neigh_set_state;
++ sd_rtnl_message_neigh_get_family;
++ sd_rtnl_message_neigh_get_ifindex;
++ sd_rtnl_message_neigh_get_state;
++ sd_rtnl_message_neigh_get_flags;
++ sd_rtnl_message_new_addrlabel;
++ sd_rtnl_message_addrlabel_set_prefixlen;
++ sd_rtnl_message_addrlabel_get_prefixlen;
++ sd_rtnl_message_new_routing_policy_rule;
++ sd_rtnl_message_routing_policy_rule_set_tos;
++ sd_rtnl_message_routing_policy_rule_get_tos;
++ sd_rtnl_message_routing_policy_rule_set_table;
++ sd_rtnl_message_routing_policy_rule_get_table;
++ sd_rtnl_message_routing_policy_rule_set_fib_src_prefixlen;
++ sd_rtnl_message_routing_policy_rule_get_fib_src_prefixlen;
++ sd_rtnl_message_routing_policy_rule_set_fib_dst_prefixlen;
++ sd_rtnl_message_routing_policy_rule_get_fib_dst_prefixlen;
++ sd_rtnl_message_routing_policy_rule_set_fib_type;
++ sd_rtnl_message_routing_policy_rule_get_fib_type;
++ sd_rtnl_message_routing_policy_rule_set_flags;
++ sd_rtnl_message_routing_policy_rule_get_flags;
++ sd_rtnl_message_new_traffic_control;
++ sd_rtnl_message_traffic_control_get_ifindex;
++ sd_rtnl_message_traffic_control_get_handle;
++ sd_rtnl_message_traffic_control_get_parent;
++ sd_rtnl_message_new_mdb;
++
++ sd_genl_socket_open;
++ sd_genl_message_new;
++ sd_genl_message_get_family_name;
++ sd_genl_message_get_command;
++ sd_genl_add_match;
+ } LIBSYSTEMD_251;
+
+ LIBSYSTEMD_253 {
+diff --git a/src/libsystemd/sd-netlink/netlink-genl.c b/src/libsystemd/sd-netlink/netlink-genl.c
+index 1dc62e89ba..aeb4b8a686 100644
+--- a/src/libsystemd/sd-netlink/netlink-genl.c
++++ b/src/libsystemd/sd-netlink/netlink-genl.c
+@@ -365,7 +365,7 @@ int genl_get_policy_set_and_header_size(
+ return 0;
+ }
+
+-int sd_genl_message_new(sd_netlink *nl, const char *family_name, uint8_t cmd, sd_netlink_message **ret) {
++_public_ int sd_genl_message_new(sd_netlink *nl, const char *family_name, uint8_t cmd, sd_netlink_message **ret) {
+ const GenericNetlinkFamily *family;
+ int r;
+
+@@ -381,7 +381,7 @@ int sd_genl_message_new(sd_netlink *nl, const char *family_name, uint8_t cmd, sd
+ return genl_message_new(nl, family, cmd, ret);
+ }
+
+-int sd_genl_message_get_family_name(sd_netlink *nl, sd_netlink_message *m, const char **ret) {
++_public_ int sd_genl_message_get_family_name(sd_netlink *nl, sd_netlink_message *m, const char **ret) {
+ const GenericNetlinkFamily *family;
+ uint16_t nlmsg_type;
+ int r;
+@@ -403,7 +403,7 @@ int sd_genl_message_get_family_name(sd_netlink *nl, sd_netlink_message *m, const
+ return 0;
+ }
+
+-int sd_genl_message_get_command(sd_netlink *nl, sd_netlink_message *m, uint8_t *ret) {
++_public_ int sd_genl_message_get_command(sd_netlink *nl, sd_netlink_message *m, uint8_t *ret) {
+ struct genlmsghdr *h;
+ uint16_t nlmsg_type;
+ size_t size;
+@@ -448,7 +448,7 @@ static int genl_family_get_multicast_group_id_by_name(const GenericNetlinkFamily
+ return 0;
+ }
+
+-int sd_genl_add_match(
++_public_ int sd_genl_add_match(
+ sd_netlink *nl,
+ sd_netlink_slot **ret_slot,
+ const char *family_name,
+@@ -483,6 +483,6 @@ int sd_genl_add_match(
+ callback, destroy_callback, userdata, description);
+ }
+
+-int sd_genl_socket_open(sd_netlink **ret) {
++_public_ int sd_genl_socket_open(sd_netlink **ret) {
+ return netlink_open_family(ret, NETLINK_GENERIC);
+ }
+diff --git a/src/libsystemd/sd-netlink/netlink-message-rtnl.c b/src/libsystemd/sd-netlink/netlink-message-rtnl.c
+index 008e8022b1..ae1d217294 100644
+--- a/src/libsystemd/sd-netlink/netlink-message-rtnl.c
++++ b/src/libsystemd/sd-netlink/netlink-message-rtnl.c
+@@ -56,7 +56,7 @@ static bool rtnl_message_type_is_mdb(uint16_t type) {
+ return IN_SET(type, RTM_NEWMDB, RTM_DELMDB, RTM_GETMDB);
+ }
+
+-int sd_rtnl_message_route_set_dst_prefixlen(sd_netlink_message *m, unsigned char prefixlen) {
++_public_ int sd_rtnl_message_route_set_dst_prefixlen(sd_netlink_message *m, unsigned char prefixlen) {
+ struct rtmsg *rtm;
+
+ assert_return(m, -EINVAL);
+@@ -74,7 +74,7 @@ int sd_rtnl_message_route_set_dst_prefixlen(sd_netlink_message *m, unsigned char
+ return 0;
+ }
+
+-int sd_rtnl_message_route_set_src_prefixlen(sd_netlink_message *m, unsigned char prefixlen) {
++_public_ int sd_rtnl_message_route_set_src_prefixlen(sd_netlink_message *m, unsigned char prefixlen) {
+ struct rtmsg *rtm;
+
+ assert_return(m, -EINVAL);
+@@ -92,7 +92,7 @@ int sd_rtnl_message_route_set_src_prefixlen(sd_netlink_message *m, unsigned char
+ return 0;
+ }
+
+-int sd_rtnl_message_route_set_scope(sd_netlink_message *m, unsigned char scope) {
++_public_ int sd_rtnl_message_route_set_scope(sd_netlink_message *m, unsigned char scope) {
+ struct rtmsg *rtm;
+
+ assert_return(m, -EINVAL);
+@@ -106,7 +106,7 @@ int sd_rtnl_message_route_set_scope(sd_netlink_message *m, unsigned char scope)
+ return 0;
+ }
+
+-int sd_rtnl_message_route_set_flags(sd_netlink_message *m, unsigned flags) {
++_public_ int sd_rtnl_message_route_set_flags(sd_netlink_message *m, unsigned flags) {
+ struct rtmsg *rtm;
+
+ assert_return(m, -EINVAL);
+@@ -120,7 +120,7 @@ int sd_rtnl_message_route_set_flags(sd_netlink_message *m, unsigned flags) {
+ return 0;
+ }
+
+-int sd_rtnl_message_route_get_flags(sd_netlink_message *m, unsigned *flags) {
++_public_ int sd_rtnl_message_route_get_flags(sd_netlink_message *m, unsigned *flags) {
+ struct rtmsg *rtm;
+
+ assert_return(m, -EINVAL);
+@@ -135,7 +135,7 @@ int sd_rtnl_message_route_get_flags(sd_netlink_message *m, unsigned *flags) {
+ return 0;
+ }
+
+-int sd_rtnl_message_route_set_table(sd_netlink_message *m, unsigned char table) {
++_public_ int sd_rtnl_message_route_set_table(sd_netlink_message *m, unsigned char table) {
+ struct rtmsg *rtm;
+
+ assert_return(m, -EINVAL);
+@@ -149,7 +149,7 @@ int sd_rtnl_message_route_set_table(sd_netlink_message *m, unsigned char table)
+ return 0;
+ }
+
+-int sd_rtnl_message_route_get_family(sd_netlink_message *m, int *family) {
++_public_ int sd_rtnl_message_route_get_family(sd_netlink_message *m, int *family) {
+ struct rtmsg *rtm;
+
+ assert_return(m, -EINVAL);
+@@ -164,7 +164,7 @@ int sd_rtnl_message_route_get_family(sd_netlink_message *m, int *family) {
+ return 0;
+ }
+
+-int sd_rtnl_message_route_get_type(sd_netlink_message *m, unsigned char *type) {
++_public_ int sd_rtnl_message_route_get_type(sd_netlink_message *m, unsigned char *type) {
+ struct rtmsg *rtm;
+
+ assert_return(m, -EINVAL);
+@@ -179,7 +179,7 @@ int sd_rtnl_message_route_get_type(sd_netlink_message *m, unsigned char *type) {
+ return 0;
+ }
+
+-int sd_rtnl_message_route_set_type(sd_netlink_message *m, unsigned char type) {
++_public_ int sd_rtnl_message_route_set_type(sd_netlink_message *m, unsigned char type) {
+ struct rtmsg *rtm;
+
+ assert_return(m, -EINVAL);
+@@ -193,7 +193,7 @@ int sd_rtnl_message_route_set_type(sd_netlink_message *m, unsigned char type) {
+ return 0;
+ }
+
+-int sd_rtnl_message_route_get_protocol(sd_netlink_message *m, unsigned char *protocol) {
++_public_ int sd_rtnl_message_route_get_protocol(sd_netlink_message *m, unsigned char *protocol) {
+ struct rtmsg *rtm;
+
+ assert_return(m, -EINVAL);
+@@ -208,7 +208,7 @@ int sd_rtnl_message_route_get_protocol(sd_netlink_message *m, unsigned char *pro
+ return 0;
+ }
+
+-int sd_rtnl_message_route_get_scope(sd_netlink_message *m, unsigned char *scope) {
++_public_ int sd_rtnl_message_route_get_scope(sd_netlink_message *m, unsigned char *scope) {
+ struct rtmsg *rtm;
+
+ assert_return(m, -EINVAL);
+@@ -223,7 +223,7 @@ int sd_rtnl_message_route_get_scope(sd_netlink_message *m, unsigned char *scope)
+ return 0;
+ }
+
+-int sd_rtnl_message_route_get_tos(sd_netlink_message *m, uint8_t *tos) {
++_public_ int sd_rtnl_message_route_get_tos(sd_netlink_message *m, uint8_t *tos) {
+ struct rtmsg *rtm;
+
+ assert_return(m, -EINVAL);
+@@ -238,7 +238,7 @@ int sd_rtnl_message_route_get_tos(sd_netlink_message *m, uint8_t *tos) {
+ return 0;
+ }
+
+-int sd_rtnl_message_route_get_table(sd_netlink_message *m, unsigned char *table) {
++_public_ int sd_rtnl_message_route_get_table(sd_netlink_message *m, unsigned char *table) {
+ struct rtmsg *rtm;
+
+ assert_return(m, -EINVAL);
+@@ -253,7 +253,7 @@ int sd_rtnl_message_route_get_table(sd_netlink_message *m, unsigned char *table)
+ return 0;
+ }
+
+-int sd_rtnl_message_route_get_dst_prefixlen(sd_netlink_message *m, unsigned char *dst_len) {
++_public_ int sd_rtnl_message_route_get_dst_prefixlen(sd_netlink_message *m, unsigned char *dst_len) {
+ struct rtmsg *rtm;
+
+ assert_return(m, -EINVAL);
+@@ -268,7 +268,7 @@ int sd_rtnl_message_route_get_dst_prefixlen(sd_netlink_message *m, unsigned char
+ return 0;
+ }
+
+-int sd_rtnl_message_route_get_src_prefixlen(sd_netlink_message *m, unsigned char *src_len) {
++_public_ int sd_rtnl_message_route_get_src_prefixlen(sd_netlink_message *m, unsigned char *src_len) {
+ struct rtmsg *rtm;
+
+ assert_return(m, -EINVAL);
+@@ -283,7 +283,7 @@ int sd_rtnl_message_route_get_src_prefixlen(sd_netlink_message *m, unsigned char
+ return 0;
+ }
+
+-int sd_rtnl_message_new_route(sd_netlink *rtnl, sd_netlink_message **ret,
++_public_ int sd_rtnl_message_new_route(sd_netlink *rtnl, sd_netlink_message **ret,
+ uint16_t nlmsg_type, int rtm_family,
+ unsigned char rtm_protocol) {
+ struct rtmsg *rtm;
+@@ -309,7 +309,7 @@ int sd_rtnl_message_new_route(sd_netlink *rtnl, sd_netlink_message **ret,
+ return 0;
+ }
+
+-int sd_rtnl_message_new_nexthop(sd_netlink *rtnl, sd_netlink_message **ret,
++_public_ int sd_rtnl_message_new_nexthop(sd_netlink *rtnl, sd_netlink_message **ret,
+ uint16_t nlmsg_type, int nh_family,
+ unsigned char nh_protocol) {
+ struct nhmsg *nhm;
+@@ -347,7 +347,7 @@ int sd_rtnl_message_new_nexthop(sd_netlink *rtnl, sd_netlink_message **ret,
+ return 0;
+ }
+
+-int sd_rtnl_message_nexthop_set_flags(sd_netlink_message *m, uint8_t flags) {
++_public_ int sd_rtnl_message_nexthop_set_flags(sd_netlink_message *m, uint8_t flags) {
+ struct nhmsg *nhm;
+
+ assert_return(m, -EINVAL);
+@@ -360,7 +360,7 @@ int sd_rtnl_message_nexthop_set_flags(sd_netlink_message *m, uint8_t flags) {
+ return 0;
+ }
+
+-int sd_rtnl_message_nexthop_get_flags(sd_netlink_message *m, uint8_t *ret) {
++_public_ int sd_rtnl_message_nexthop_get_flags(sd_netlink_message *m, uint8_t *ret) {
+ struct nhmsg *nhm;
+
+ assert_return(m, -EINVAL);
+@@ -374,7 +374,7 @@ int sd_rtnl_message_nexthop_get_flags(sd_netlink_message *m, uint8_t *ret) {
+ return 0;
+ }
+
+-int sd_rtnl_message_nexthop_get_family(sd_netlink_message *m, uint8_t *family) {
++_public_ int sd_rtnl_message_nexthop_get_family(sd_netlink_message *m, uint8_t *family) {
+ struct nhmsg *nhm;
+
+ assert_return(m, -EINVAL);
+@@ -388,7 +388,7 @@ int sd_rtnl_message_nexthop_get_family(sd_netlink_message *m, uint8_t *family) {
+ return 0;
+ }
+
+-int sd_rtnl_message_nexthop_get_protocol(sd_netlink_message *m, uint8_t *protocol) {
++_public_ int sd_rtnl_message_nexthop_get_protocol(sd_netlink_message *m, uint8_t *protocol) {
+ struct nhmsg *nhm;
+
+ assert_return(m, -EINVAL);
+@@ -402,7 +402,7 @@ int sd_rtnl_message_nexthop_get_protocol(sd_netlink_message *m, uint8_t *protoco
+ return 0;
+ }
+
+-int sd_rtnl_message_neigh_set_flags(sd_netlink_message *m, uint8_t flags) {
++_public_ int sd_rtnl_message_neigh_set_flags(sd_netlink_message *m, uint8_t flags) {
+ struct ndmsg *ndm;
+
+ assert_return(m, -EINVAL);
+@@ -415,7 +415,7 @@ int sd_rtnl_message_neigh_set_flags(sd_netlink_message *m, uint8_t flags) {
+ return 0;
+ }
+
+-int sd_rtnl_message_neigh_set_state(sd_netlink_message *m, uint16_t state) {
++_public_ int sd_rtnl_message_neigh_set_state(sd_netlink_message *m, uint16_t state) {
+ struct ndmsg *ndm;
+
+ assert_return(m, -EINVAL);
+@@ -428,7 +428,7 @@ int sd_rtnl_message_neigh_set_state(sd_netlink_message *m, uint16_t state) {
+ return 0;
+ }
+
+-int sd_rtnl_message_neigh_get_flags(sd_netlink_message *m, uint8_t *flags) {
++_public_ int sd_rtnl_message_neigh_get_flags(sd_netlink_message *m, uint8_t *flags) {
+ struct ndmsg *ndm;
+
+ assert_return(m, -EINVAL);
+@@ -441,7 +441,7 @@ int sd_rtnl_message_neigh_get_flags(sd_netlink_message *m, uint8_t *flags) {
+ return 0;
+ }
+
+-int sd_rtnl_message_neigh_get_state(sd_netlink_message *m, uint16_t *state) {
++_public_ int sd_rtnl_message_neigh_get_state(sd_netlink_message *m, uint16_t *state) {
+ struct ndmsg *ndm;
+
+ assert_return(m, -EINVAL);
+@@ -454,7 +454,7 @@ int sd_rtnl_message_neigh_get_state(sd_netlink_message *m, uint16_t *state) {
+ return 0;
+ }
+
+-int sd_rtnl_message_neigh_get_family(sd_netlink_message *m, int *family) {
++_public_ int sd_rtnl_message_neigh_get_family(sd_netlink_message *m, int *family) {
+ struct ndmsg *ndm;
+
+ assert_return(m, -EINVAL);
+@@ -469,7 +469,7 @@ int sd_rtnl_message_neigh_get_family(sd_netlink_message *m, int *family) {
+ return 0;
+ }
+
+-int sd_rtnl_message_neigh_get_ifindex(sd_netlink_message *m, int *index) {
++_public_ int sd_rtnl_message_neigh_get_ifindex(sd_netlink_message *m, int *index) {
+ struct ndmsg *ndm;
+
+ assert_return(m, -EINVAL);
+@@ -484,7 +484,7 @@ int sd_rtnl_message_neigh_get_ifindex(sd_netlink_message *m, int *index) {
+ return 0;
+ }
+
+-int sd_rtnl_message_new_neigh(
++_public_ int sd_rtnl_message_new_neigh(
+ sd_netlink *rtnl,
+ sd_netlink_message **ret,
+ uint16_t nlmsg_type,
+@@ -517,7 +517,7 @@ int sd_rtnl_message_new_neigh(
+ return 0;
+ }
+
+-int sd_rtnl_message_link_set_flags(sd_netlink_message *m, unsigned flags, unsigned change) {
++_public_ int sd_rtnl_message_link_set_flags(sd_netlink_message *m, unsigned flags, unsigned change) {
+ struct ifinfomsg *ifi;
+
+ assert_return(m, -EINVAL);
+@@ -533,7 +533,7 @@ int sd_rtnl_message_link_set_flags(sd_netlink_message *m, unsigned flags, unsign
+ return 0;
+ }
+
+-int sd_rtnl_message_link_set_type(sd_netlink_message *m, unsigned type) {
++_public_ int sd_rtnl_message_link_set_type(sd_netlink_message *m, unsigned type) {
+ struct ifinfomsg *ifi;
+
+ assert_return(m, -EINVAL);
+@@ -547,7 +547,7 @@ int sd_rtnl_message_link_set_type(sd_netlink_message *m, unsigned type) {
+ return 0;
+ }
+
+-int sd_rtnl_message_link_set_family(sd_netlink_message *m, unsigned family) {
++_public_ int sd_rtnl_message_link_set_family(sd_netlink_message *m, unsigned family) {
+ struct ifinfomsg *ifi;
+
+ assert_return(m, -EINVAL);
+@@ -561,7 +561,7 @@ int sd_rtnl_message_link_set_family(sd_netlink_message *m, unsigned family) {
+ return 0;
+ }
+
+-int sd_rtnl_message_new_link(sd_netlink *rtnl, sd_netlink_message **ret,
++_public_ int sd_rtnl_message_new_link(sd_netlink *rtnl, sd_netlink_message **ret,
+ uint16_t nlmsg_type, int index) {
+ struct ifinfomsg *ifi;
+ int r;
+@@ -586,7 +586,7 @@ int sd_rtnl_message_new_link(sd_netlink *rtnl, sd_netlink_message **ret,
+ return 0;
+ }
+
+-int sd_rtnl_message_addr_set_prefixlen(sd_netlink_message *m, unsigned char prefixlen) {
++_public_ int sd_rtnl_message_addr_set_prefixlen(sd_netlink_message *m, unsigned char prefixlen) {
+ struct ifaddrmsg *ifa;
+
+ assert_return(m, -EINVAL);
+@@ -604,7 +604,7 @@ int sd_rtnl_message_addr_set_prefixlen(sd_netlink_message *m, unsigned char pref
+ return 0;
+ }
+
+-int sd_rtnl_message_addr_set_flags(sd_netlink_message *m, unsigned char flags) {
++_public_ int sd_rtnl_message_addr_set_flags(sd_netlink_message *m, unsigned char flags) {
+ struct ifaddrmsg *ifa;
+
+ assert_return(m, -EINVAL);
+@@ -618,7 +618,7 @@ int sd_rtnl_message_addr_set_flags(sd_netlink_message *m, unsigned char flags) {
+ return 0;
+ }
+
+-int sd_rtnl_message_addr_set_scope(sd_netlink_message *m, unsigned char scope) {
++_public_ int sd_rtnl_message_addr_set_scope(sd_netlink_message *m, unsigned char scope) {
+ struct ifaddrmsg *ifa;
+
+ assert_return(m, -EINVAL);
+@@ -632,7 +632,7 @@ int sd_rtnl_message_addr_set_scope(sd_netlink_message *m, unsigned char scope) {
+ return 0;
+ }
+
+-int sd_rtnl_message_addr_get_family(sd_netlink_message *m, int *ret_family) {
++_public_ int sd_rtnl_message_addr_get_family(sd_netlink_message *m, int *ret_family) {
+ struct ifaddrmsg *ifa;
+
+ assert_return(m, -EINVAL);
+@@ -647,7 +647,7 @@ int sd_rtnl_message_addr_get_family(sd_netlink_message *m, int *ret_family) {
+ return 0;
+ }
+
+-int sd_rtnl_message_addr_get_prefixlen(sd_netlink_message *m, unsigned char *ret_prefixlen) {
++_public_ int sd_rtnl_message_addr_get_prefixlen(sd_netlink_message *m, unsigned char *ret_prefixlen) {
+ struct ifaddrmsg *ifa;
+
+ assert_return(m, -EINVAL);
+@@ -662,7 +662,7 @@ int sd_rtnl_message_addr_get_prefixlen(sd_netlink_message *m, unsigned char *ret
+ return 0;
+ }
+
+-int sd_rtnl_message_addr_get_scope(sd_netlink_message *m, unsigned char *ret_scope) {
++_public_ int sd_rtnl_message_addr_get_scope(sd_netlink_message *m, unsigned char *ret_scope) {
+ struct ifaddrmsg *ifa;
+
+ assert_return(m, -EINVAL);
+@@ -677,7 +677,7 @@ int sd_rtnl_message_addr_get_scope(sd_netlink_message *m, unsigned char *ret_sco
+ return 0;
+ }
+
+-int sd_rtnl_message_addr_get_flags(sd_netlink_message *m, unsigned char *ret_flags) {
++_public_ int sd_rtnl_message_addr_get_flags(sd_netlink_message *m, unsigned char *ret_flags) {
+ struct ifaddrmsg *ifa;
+
+ assert_return(m, -EINVAL);
+@@ -692,7 +692,7 @@ int sd_rtnl_message_addr_get_flags(sd_netlink_message *m, unsigned char *ret_fla
+ return 0;
+ }
+
+-int sd_rtnl_message_addr_get_ifindex(sd_netlink_message *m, int *ret_ifindex) {
++_public_ int sd_rtnl_message_addr_get_ifindex(sd_netlink_message *m, int *ret_ifindex) {
+ struct ifaddrmsg *ifa;
+
+ assert_return(m, -EINVAL);
+@@ -707,7 +707,7 @@ int sd_rtnl_message_addr_get_ifindex(sd_netlink_message *m, int *ret_ifindex) {
+ return 0;
+ }
+
+-int sd_rtnl_message_new_addr(
++_public_ int sd_rtnl_message_new_addr(
+ sd_netlink *rtnl,
+ sd_netlink_message **ret,
+ uint16_t nlmsg_type,
+@@ -736,7 +736,7 @@ int sd_rtnl_message_new_addr(
+ return 0;
+ }
+
+-int sd_rtnl_message_new_addr_update(
++_public_ int sd_rtnl_message_new_addr_update(
+ sd_netlink *rtnl,
+ sd_netlink_message **ret,
+ int index,
+@@ -752,7 +752,7 @@ int sd_rtnl_message_new_addr_update(
+ return 0;
+ }
+
+-int sd_rtnl_message_link_get_ifindex(sd_netlink_message *m, int *ifindex) {
++_public_ int sd_rtnl_message_link_get_ifindex(sd_netlink_message *m, int *ifindex) {
+ struct ifinfomsg *ifi;
+
+ assert_return(m, -EINVAL);
+@@ -767,7 +767,7 @@ int sd_rtnl_message_link_get_ifindex(sd_netlink_message *m, int *ifindex) {
+ return 0;
+ }
+
+-int sd_rtnl_message_link_get_flags(sd_netlink_message *m, unsigned *flags) {
++_public_ int sd_rtnl_message_link_get_flags(sd_netlink_message *m, unsigned *flags) {
+ struct ifinfomsg *ifi;
+
+ assert_return(m, -EINVAL);
+@@ -782,7 +782,7 @@ int sd_rtnl_message_link_get_flags(sd_netlink_message *m, unsigned *flags) {
+ return 0;
+ }
+
+-int sd_rtnl_message_link_get_type(sd_netlink_message *m, unsigned short *type) {
++_public_ int sd_rtnl_message_link_get_type(sd_netlink_message *m, unsigned short *type) {
+ struct ifinfomsg *ifi;
+
+ assert_return(m, -EINVAL);
+@@ -797,7 +797,7 @@ int sd_rtnl_message_link_get_type(sd_netlink_message *m, unsigned short *type) {
+ return 0;
+ }
+
+-int sd_rtnl_message_get_family(sd_netlink_message *m, int *family) {
++_public_ int sd_rtnl_message_get_family(sd_netlink_message *m, int *family) {
+ assert_return(m, -EINVAL);
+ assert_return(family, -EINVAL);
+
+@@ -856,7 +856,7 @@ int sd_rtnl_message_get_family(sd_netlink_message *m, int *family) {
+ return -EOPNOTSUPP;
+ }
+
+-int sd_rtnl_message_new_addrlabel(
++_public_ int sd_rtnl_message_new_addrlabel(
+ sd_netlink *rtnl,
+ sd_netlink_message **ret,
+ uint16_t nlmsg_type,
+@@ -884,7 +884,7 @@ int sd_rtnl_message_new_addrlabel(
+ return 0;
+ }
+
+-int sd_rtnl_message_addrlabel_set_prefixlen(sd_netlink_message *m, unsigned char prefixlen) {
++_public_ int sd_rtnl_message_addrlabel_set_prefixlen(sd_netlink_message *m, unsigned char prefixlen) {
+ struct ifaddrlblmsg *addrlabel;
+
+ assert_return(m, -EINVAL);
+@@ -901,7 +901,7 @@ int sd_rtnl_message_addrlabel_set_prefixlen(sd_netlink_message *m, unsigned char
+ return 0;
+ }
+
+-int sd_rtnl_message_addrlabel_get_prefixlen(sd_netlink_message *m, unsigned char *prefixlen) {
++_public_ int sd_rtnl_message_addrlabel_get_prefixlen(sd_netlink_message *m, unsigned char *prefixlen) {
+ struct ifaddrlblmsg *addrlabel;
+
+ assert_return(m, -EINVAL);
+@@ -915,7 +915,7 @@ int sd_rtnl_message_addrlabel_get_prefixlen(sd_netlink_message *m, unsigned char
+ return 0;
+ }
+
+-int sd_rtnl_message_new_routing_policy_rule(
++_public_ int sd_rtnl_message_new_routing_policy_rule(
+ sd_netlink *rtnl,
+ sd_netlink_message **ret,
+ uint16_t nlmsg_type,
+@@ -940,7 +940,7 @@ int sd_rtnl_message_new_routing_policy_rule(
+ return 0;
+ }
+
+-int sd_rtnl_message_routing_policy_rule_set_tos(sd_netlink_message *m, uint8_t tos) {
++_public_ int sd_rtnl_message_routing_policy_rule_set_tos(sd_netlink_message *m, uint8_t tos) {
+ struct fib_rule_hdr *frh;
+
+ assert_return(m, -EINVAL);
+@@ -954,7 +954,7 @@ int sd_rtnl_message_routing_policy_rule_set_tos(sd_netlink_message *m, uint8_t t
+ return 0;
+ }
+
+-int sd_rtnl_message_routing_policy_rule_get_tos(sd_netlink_message *m, uint8_t *tos) {
++_public_ int sd_rtnl_message_routing_policy_rule_get_tos(sd_netlink_message *m, uint8_t *tos) {
+ struct fib_rule_hdr *frh;
+
+ assert_return(m, -EINVAL);
+@@ -968,7 +968,7 @@ int sd_rtnl_message_routing_policy_rule_get_tos(sd_netlink_message *m, uint8_t *
+ return 0;
+ }
+
+-int sd_rtnl_message_routing_policy_rule_set_table(sd_netlink_message *m, uint8_t table) {
++_public_ int sd_rtnl_message_routing_policy_rule_set_table(sd_netlink_message *m, uint8_t table) {
+ struct fib_rule_hdr *frh;
+
+ assert_return(m, -EINVAL);
+@@ -982,7 +982,7 @@ int sd_rtnl_message_routing_policy_rule_set_table(sd_netlink_message *m, uint8_t
+ return 0;
+ }
+
+-int sd_rtnl_message_routing_policy_rule_get_table(sd_netlink_message *m, uint8_t *table) {
++_public_ int sd_rtnl_message_routing_policy_rule_get_table(sd_netlink_message *m, uint8_t *table) {
+ struct fib_rule_hdr *frh;
+
+ assert_return(m, -EINVAL);
+@@ -996,7 +996,7 @@ int sd_rtnl_message_routing_policy_rule_get_table(sd_netlink_message *m, uint8_t
+ return 0;
+ }
+
+-int sd_rtnl_message_routing_policy_rule_set_flags(sd_netlink_message *m, uint32_t flags) {
++_public_ int sd_rtnl_message_routing_policy_rule_set_flags(sd_netlink_message *m, uint32_t flags) {
+ struct fib_rule_hdr *frh;
+
+ assert_return(m, -EINVAL);
+@@ -1009,7 +1009,7 @@ int sd_rtnl_message_routing_policy_rule_set_flags(sd_netlink_message *m, uint32_
+ return 0;
+ }
+
+-int sd_rtnl_message_routing_policy_rule_get_flags(sd_netlink_message *m, uint32_t *flags) {
++_public_ int sd_rtnl_message_routing_policy_rule_get_flags(sd_netlink_message *m, uint32_t *flags) {
+ struct fib_rule_hdr *frh;
+
+ assert_return(m, -EINVAL);
+@@ -1022,7 +1022,7 @@ int sd_rtnl_message_routing_policy_rule_get_flags(sd_netlink_message *m, uint32_
+ return 0;
+ }
+
+-int sd_rtnl_message_routing_policy_rule_set_fib_type(sd_netlink_message *m, uint8_t type) {
++_public_ int sd_rtnl_message_routing_policy_rule_set_fib_type(sd_netlink_message *m, uint8_t type) {
+ struct fib_rule_hdr *frh;
+
+ assert_return(m, -EINVAL);
+@@ -1036,7 +1036,7 @@ int sd_rtnl_message_routing_policy_rule_set_fib_type(sd_netlink_message *m, uint
+ return 0;
+ }
+
+-int sd_rtnl_message_routing_policy_rule_get_fib_type(sd_netlink_message *m, uint8_t *type) {
++_public_ int sd_rtnl_message_routing_policy_rule_get_fib_type(sd_netlink_message *m, uint8_t *type) {
+ struct fib_rule_hdr *frh;
+
+ assert_return(m, -EINVAL);
+@@ -1050,7 +1050,7 @@ int sd_rtnl_message_routing_policy_rule_get_fib_type(sd_netlink_message *m, uint
+ return 0;
+ }
+
+-int sd_rtnl_message_routing_policy_rule_set_fib_dst_prefixlen(sd_netlink_message *m, uint8_t len) {
++_public_ int sd_rtnl_message_routing_policy_rule_set_fib_dst_prefixlen(sd_netlink_message *m, uint8_t len) {
+ struct fib_rule_hdr *frh;
+
+ assert_return(m, -EINVAL);
+@@ -1064,7 +1064,7 @@ int sd_rtnl_message_routing_policy_rule_set_fib_dst_prefixlen(sd_netlink_message
+ return 0;
+ }
+
+-int sd_rtnl_message_routing_policy_rule_get_fib_dst_prefixlen(sd_netlink_message *m, uint8_t *len) {
++_public_ int sd_rtnl_message_routing_policy_rule_get_fib_dst_prefixlen(sd_netlink_message *m, uint8_t *len) {
+ struct fib_rule_hdr *frh;
+
+ assert_return(m, -EINVAL);
+@@ -1078,7 +1078,7 @@ int sd_rtnl_message_routing_policy_rule_get_fib_dst_prefixlen(sd_netlink_message
+ return 0;
+ }
+
+-int sd_rtnl_message_routing_policy_rule_set_fib_src_prefixlen(sd_netlink_message *m, uint8_t len) {
++_public_ int sd_rtnl_message_routing_policy_rule_set_fib_src_prefixlen(sd_netlink_message *m, uint8_t len) {
+ struct fib_rule_hdr *frh;
+
+ assert_return(m, -EINVAL);
+@@ -1092,7 +1092,7 @@ int sd_rtnl_message_routing_policy_rule_set_fib_src_prefixlen(sd_netlink_message
+ return 0;
+ }
+
+-int sd_rtnl_message_routing_policy_rule_get_fib_src_prefixlen(sd_netlink_message *m, uint8_t *len) {
++_public_ int sd_rtnl_message_routing_policy_rule_get_fib_src_prefixlen(sd_netlink_message *m, uint8_t *len) {
+ struct fib_rule_hdr *frh;
+
+ assert_return(m, -EINVAL);
+@@ -1106,7 +1106,7 @@ int sd_rtnl_message_routing_policy_rule_get_fib_src_prefixlen(sd_netlink_message
+ return 0;
+ }
+
+-int sd_rtnl_message_new_traffic_control(
++_public_ int sd_rtnl_message_new_traffic_control(
+ sd_netlink *rtnl,
+ sd_netlink_message **ret,
+ uint16_t nlmsg_type,
+@@ -1135,7 +1135,7 @@ int sd_rtnl_message_new_traffic_control(
+ return 0;
+ }
+
+-int sd_rtnl_message_traffic_control_get_ifindex(sd_netlink_message *m, int *ret) {
++_public_ int sd_rtnl_message_traffic_control_get_ifindex(sd_netlink_message *m, int *ret) {
+ struct tcmsg *tcm;
+
+ assert_return(m, -EINVAL);
+@@ -1149,7 +1149,7 @@ int sd_rtnl_message_traffic_control_get_ifindex(sd_netlink_message *m, int *ret)
+ return 0;
+ }
+
+-int sd_rtnl_message_traffic_control_get_handle(sd_netlink_message *m, uint32_t *ret) {
++_public_ int sd_rtnl_message_traffic_control_get_handle(sd_netlink_message *m, uint32_t *ret) {
+ struct tcmsg *tcm;
+
+ assert_return(m, -EINVAL);
+@@ -1163,7 +1163,7 @@ int sd_rtnl_message_traffic_control_get_handle(sd_netlink_message *m, uint32_t *
+ return 0;
+ }
+
+-int sd_rtnl_message_traffic_control_get_parent(sd_netlink_message *m, uint32_t *ret) {
++_public_ int sd_rtnl_message_traffic_control_get_parent(sd_netlink_message *m, uint32_t *ret) {
+ struct tcmsg *tcm;
+
+ assert_return(m, -EINVAL);
+@@ -1177,7 +1177,7 @@ int sd_rtnl_message_traffic_control_get_parent(sd_netlink_message *m, uint32_t *
+ return 0;
+ }
+
+-int sd_rtnl_message_new_mdb(
++_public_ int sd_rtnl_message_new_mdb(
+ sd_netlink *rtnl,
+ sd_netlink_message **ret,
+ uint16_t nlmsg_type,
+diff --git a/src/libsystemd/sd-netlink/netlink-message.c b/src/libsystemd/sd-netlink/netlink-message.c
+index 000a50ee3e..33bec2ac9b 100644
+--- a/src/libsystemd/sd-netlink/netlink-message.c
++++ b/src/libsystemd/sd-netlink/netlink-message.c
+@@ -113,7 +113,7 @@ int message_new_synthetic_error(sd_netlink *nl, int error, uint32_t serial, sd_n
+ return 0;
+ }
+
+-int sd_netlink_message_set_request_dump(sd_netlink_message *m, int dump) {
++_public_ int sd_netlink_message_set_request_dump(sd_netlink_message *m, int dump) {
+ assert_return(m, -EINVAL);
+ assert_return(m->hdr, -EINVAL);
+ assert_return(m->protocol != NETLINK_ROUTE ||
+@@ -129,7 +129,7 @@ int sd_netlink_message_set_request_dump(sd_netlink_message *m, int dump) {
+
+ DEFINE_TRIVIAL_REF_FUNC(sd_netlink_message, sd_netlink_message);
+
+-sd_netlink_message* sd_netlink_message_unref(sd_netlink_message *m) {
++_public_ sd_netlink_message* sd_netlink_message_unref(sd_netlink_message *m) {
+ while (m && --m->n_ref == 0) {
+ unsigned i;
+
+@@ -146,7 +146,7 @@ sd_netlink_message* sd_netlink_message_unref(sd_netlink_message *m) {
+ return NULL;
+ }
+
+-int sd_netlink_message_get_type(sd_netlink_message *m, uint16_t *ret) {
++_public_ int sd_netlink_message_get_type(sd_netlink_message *m, uint16_t *ret) {
+ assert_return(m, -EINVAL);
+ assert_return(ret, -EINVAL);
+
+@@ -155,7 +155,7 @@ int sd_netlink_message_get_type(sd_netlink_message *m, uint16_t *ret) {
+ return 0;
+ }
+
+-int sd_netlink_message_set_flags(sd_netlink_message *m, uint16_t flags) {
++_public_ int sd_netlink_message_set_flags(sd_netlink_message *m, uint16_t flags) {
+ assert_return(m, -EINVAL);
+ assert_return(flags != 0, -EINVAL);
+
+@@ -164,7 +164,7 @@ int sd_netlink_message_set_flags(sd_netlink_message *m, uint16_t flags) {
+ return 0;
+ }
+
+-int sd_netlink_message_is_broadcast(sd_netlink_message *m) {
++_public_ int sd_netlink_message_is_broadcast(sd_netlink_message *m) {
+ assert_return(m, -EINVAL);
+
+ return m->multicast_group != 0;
+@@ -230,7 +230,7 @@ static int message_attribute_has_type(sd_netlink_message *m, size_t *ret_size, u
+ return 0;
+ }
+
+-int sd_netlink_message_append_string(sd_netlink_message *m, uint16_t attr_type, const char *data) {
++_public_ int sd_netlink_message_append_string(sd_netlink_message *m, uint16_t attr_type, const char *data) {
+ size_t length, size;
+ int r;
+
+@@ -256,7 +256,7 @@ int sd_netlink_message_append_string(sd_netlink_message *m, uint16_t attr_type,
+ return 0;
+ }
+
+-int sd_netlink_message_append_strv(sd_netlink_message *m, uint16_t attr_type, const char* const *data) {
++_public_ int sd_netlink_message_append_strv(sd_netlink_message *m, uint16_t attr_type, const char* const *data) {
+ size_t length, size;
+ int r;
+
+@@ -284,7 +284,7 @@ int sd_netlink_message_append_strv(sd_netlink_message *m, uint16_t attr_type, co
+ return 0;
+ }
+
+-int sd_netlink_message_append_flag(sd_netlink_message *m, uint16_t attr_type) {
++_public_ int sd_netlink_message_append_flag(sd_netlink_message *m, uint16_t attr_type) {
+ size_t size;
+ int r;
+
+@@ -302,7 +302,7 @@ int sd_netlink_message_append_flag(sd_netlink_message *m, uint16_t attr_type) {
+ return 0;
+ }
+
+-int sd_netlink_message_append_u8(sd_netlink_message *m, uint16_t attr_type, uint8_t data) {
++_public_ int sd_netlink_message_append_u8(sd_netlink_message *m, uint16_t attr_type, uint8_t data) {
+ int r;
+
+ assert_return(m, -EINVAL);
+@@ -319,7 +319,7 @@ int sd_netlink_message_append_u8(sd_netlink_message *m, uint16_t attr_type, uint
+ return 0;
+ }
+
+-int sd_netlink_message_append_u16(sd_netlink_message *m, uint16_t attr_type, uint16_t data) {
++_public_ int sd_netlink_message_append_u16(sd_netlink_message *m, uint16_t attr_type, uint16_t data) {
+ int r;
+
+ assert_return(m, -EINVAL);
+@@ -336,7 +336,7 @@ int sd_netlink_message_append_u16(sd_netlink_message *m, uint16_t attr_type, uin
+ return 0;
+ }
+
+-int sd_netlink_message_append_u32(sd_netlink_message *m, uint16_t attr_type, uint32_t data) {
++_public_ int sd_netlink_message_append_u32(sd_netlink_message *m, uint16_t attr_type, uint32_t data) {
+ int r;
+
+ assert_return(m, -EINVAL);
+@@ -353,7 +353,7 @@ int sd_netlink_message_append_u32(sd_netlink_message *m, uint16_t attr_type, uin
+ return 0;
+ }
+
+-int sd_netlink_message_append_u64(sd_netlink_message *m, uint16_t attr_type, uint64_t data) {
++_public_ int sd_netlink_message_append_u64(sd_netlink_message *m, uint16_t attr_type, uint64_t data) {
+ int r;
+
+ assert_return(m, -EINVAL);
+@@ -370,7 +370,7 @@ int sd_netlink_message_append_u64(sd_netlink_message *m, uint16_t attr_type, uin
+ return 0;
+ }
+
+-int sd_netlink_message_append_s8(sd_netlink_message *m, uint16_t attr_type, int8_t data) {
++_public_ int sd_netlink_message_append_s8(sd_netlink_message *m, uint16_t attr_type, int8_t data) {
+ int r;
+
+ assert_return(m, -EINVAL);
+@@ -387,7 +387,7 @@ int sd_netlink_message_append_s8(sd_netlink_message *m, uint16_t attr_type, int8
+ return 0;
+ }
+
+-int sd_netlink_message_append_s16(sd_netlink_message *m, uint16_t attr_type, int16_t data) {
++_public_ int sd_netlink_message_append_s16(sd_netlink_message *m, uint16_t attr_type, int16_t data) {
+ int r;
+
+ assert_return(m, -EINVAL);
+@@ -404,7 +404,7 @@ int sd_netlink_message_append_s16(sd_netlink_message *m, uint16_t attr_type, int
+ return 0;
+ }
+
+-int sd_netlink_message_append_s32(sd_netlink_message *m, uint16_t attr_type, int32_t data) {
++_public_ int sd_netlink_message_append_s32(sd_netlink_message *m, uint16_t attr_type, int32_t data) {
+ int r;
+
+ assert_return(m, -EINVAL);
+@@ -421,7 +421,7 @@ int sd_netlink_message_append_s32(sd_netlink_message *m, uint16_t attr_type, int
+ return 0;
+ }
+
+-int sd_netlink_message_append_s64(sd_netlink_message *m, uint16_t attr_type, int64_t data) {
++_public_ int sd_netlink_message_append_s64(sd_netlink_message *m, uint16_t attr_type, int64_t data) {
+ int r;
+
+ assert_return(m, -EINVAL);
+@@ -438,7 +438,7 @@ int sd_netlink_message_append_s64(sd_netlink_message *m, uint16_t attr_type, int
+ return 0;
+ }
+
+-int sd_netlink_message_append_data(sd_netlink_message *m, uint16_t attr_type, const void *data, size_t len) {
++_public_ int sd_netlink_message_append_data(sd_netlink_message *m, uint16_t attr_type, const void *data, size_t len) {
+ int r;
+
+ assert_return(m, -EINVAL);
+@@ -451,7 +451,7 @@ int sd_netlink_message_append_data(sd_netlink_message *m, uint16_t attr_type, co
+ return 0;
+ }
+
+-int sd_netlink_message_append_container_data(
++_public_ int sd_netlink_message_append_container_data(
+ sd_netlink_message *m,
+ uint16_t container_type,
+ uint16_t attr_type,
+@@ -493,11 +493,11 @@ int netlink_message_append_in_addr_union(sd_netlink_message *m, uint16_t attr_ty
+ return 0;
+ }
+
+-int sd_netlink_message_append_in_addr(sd_netlink_message *m, uint16_t attr_type, const struct in_addr *data) {
++_public_ int sd_netlink_message_append_in_addr(sd_netlink_message *m, uint16_t attr_type, const struct in_addr *data) {
+ return netlink_message_append_in_addr_union(m, attr_type, AF_INET, (const union in_addr_union *) data);
+ }
+
+-int sd_netlink_message_append_in6_addr(sd_netlink_message *m, uint16_t attr_type, const struct in6_addr *data) {
++_public_ int sd_netlink_message_append_in6_addr(sd_netlink_message *m, uint16_t attr_type, const struct in6_addr *data) {
+ return netlink_message_append_in_addr_union(m, attr_type, AF_INET6, (const union in_addr_union *) data);
+ }
+
+@@ -520,15 +520,15 @@ int netlink_message_append_sockaddr_union(sd_netlink_message *m, uint16_t attr_t
+ return 0;
+ }
+
+-int sd_netlink_message_append_sockaddr_in(sd_netlink_message *m, uint16_t attr_type, const struct sockaddr_in *data) {
++_public_ int sd_netlink_message_append_sockaddr_in(sd_netlink_message *m, uint16_t attr_type, const struct sockaddr_in *data) {
+ return netlink_message_append_sockaddr_union(m, attr_type, (const union sockaddr_union *) data);
+ }
+
+-int sd_netlink_message_append_sockaddr_in6(sd_netlink_message *m, uint16_t attr_type, const struct sockaddr_in6 *data) {
++_public_ int sd_netlink_message_append_sockaddr_in6(sd_netlink_message *m, uint16_t attr_type, const struct sockaddr_in6 *data) {
+ return netlink_message_append_sockaddr_union(m, attr_type, (const union sockaddr_union *) data);
+ }
+
+-int sd_netlink_message_append_ether_addr(sd_netlink_message *m, uint16_t attr_type, const struct ether_addr *data) {
++_public_ int sd_netlink_message_append_ether_addr(sd_netlink_message *m, uint16_t attr_type, const struct ether_addr *data) {
+ int r;
+
+ assert_return(m, -EINVAL);
+@@ -565,7 +565,7 @@ int netlink_message_append_hw_addr(sd_netlink_message *m, uint16_t attr_type, co
+ return 0;
+ }
+
+-int sd_netlink_message_append_cache_info(sd_netlink_message *m, uint16_t attr_type, const struct ifa_cacheinfo *info) {
++_public_ int sd_netlink_message_append_cache_info(sd_netlink_message *m, uint16_t attr_type, const struct ifa_cacheinfo *info) {
+ int r;
+
+ assert_return(m, -EINVAL);
+@@ -583,7 +583,7 @@ int sd_netlink_message_append_cache_info(sd_netlink_message *m, uint16_t attr_ty
+ return 0;
+ }
+
+-int sd_netlink_message_open_container(sd_netlink_message *m, uint16_t attr_type) {
++_public_ int sd_netlink_message_open_container(sd_netlink_message *m, uint16_t attr_type) {
+ size_t size;
+ int r;
+
+@@ -632,7 +632,7 @@ int sd_netlink_message_open_container(sd_netlink_message *m, uint16_t attr_type)
+ return 0;
+ }
+
+-int sd_netlink_message_open_container_union(sd_netlink_message *m, uint16_t attr_type, const char *key) {
++_public_ int sd_netlink_message_open_container_union(sd_netlink_message *m, uint16_t attr_type, const char *key) {
+ const NLAPolicySetUnion *policy_set_union;
+ int r;
+
+@@ -671,7 +671,7 @@ int sd_netlink_message_open_container_union(sd_netlink_message *m, uint16_t attr
+ return 0;
+ }
+
+-int sd_netlink_message_close_container(sd_netlink_message *m) {
++_public_ int sd_netlink_message_close_container(sd_netlink_message *m) {
+ assert_return(m, -EINVAL);
+ assert_return(!m->sealed, -EPERM);
+ assert_return(m->n_containers > 0, -EINVAL);
+@@ -683,7 +683,7 @@ int sd_netlink_message_close_container(sd_netlink_message *m) {
+ return 0;
+ }
+
+-int sd_netlink_message_open_array(sd_netlink_message *m, uint16_t attr_type) {
++_public_ int sd_netlink_message_open_array(sd_netlink_message *m, uint16_t attr_type) {
+ int r;
+
+ assert_return(m, -EINVAL);
+@@ -701,7 +701,7 @@ int sd_netlink_message_open_array(sd_netlink_message *m, uint16_t attr_type) {
+ return 0;
+ }
+
+-int sd_netlink_message_cancel_array(sd_netlink_message *m) {
++_public_ int sd_netlink_message_cancel_array(sd_netlink_message *m) {
+ uint32_t rta_len;
+
+ assert_return(m, -EINVAL);
+@@ -757,7 +757,7 @@ static int netlink_message_read_internal(
+ return RTA_PAYLOAD(rta);
+ }
+
+-int sd_netlink_message_read(sd_netlink_message *m, uint16_t attr_type, size_t size, void *data) {
++_public_ int sd_netlink_message_read(sd_netlink_message *m, uint16_t attr_type, size_t size, void *data) {
+ void *attr_data;
+ int r;
+
+@@ -776,7 +776,7 @@ int sd_netlink_message_read(sd_netlink_message *m, uint16_t attr_type, size_t si
+ return r;
+ }
+
+-int sd_netlink_message_read_data(sd_netlink_message *m, uint16_t attr_type, size_t *ret_size, void **ret_data) {
++_public_ int sd_netlink_message_read_data(sd_netlink_message *m, uint16_t attr_type, size_t *ret_size, void **ret_data) {
+ void *attr_data;
+ int r;
+
+@@ -802,7 +802,7 @@ int sd_netlink_message_read_data(sd_netlink_message *m, uint16_t attr_type, size
+ return r;
+ }
+
+-int sd_netlink_message_read_data_suffix0(sd_netlink_message *m, uint16_t attr_type, size_t *ret_size, void **ret_data) {
++_public_ int sd_netlink_message_read_data_suffix0(sd_netlink_message *m, uint16_t attr_type, size_t *ret_size, void **ret_data) {
+ void *attr_data;
+ int r;
+
+@@ -828,7 +828,7 @@ int sd_netlink_message_read_data_suffix0(sd_netlink_message *m, uint16_t attr_ty
+ return r;
+ }
+
+-int sd_netlink_message_read_string_strdup(sd_netlink_message *m, uint16_t attr_type, char **data) {
++_public_ int sd_netlink_message_read_string_strdup(sd_netlink_message *m, uint16_t attr_type, char **data) {
+ void *attr_data;
+ int r;
+
+@@ -855,7 +855,7 @@ int sd_netlink_message_read_string_strdup(sd_netlink_message *m, uint16_t attr_t
+ return 0;
+ }
+
+-int sd_netlink_message_read_string(sd_netlink_message *m, uint16_t attr_type, const char **data) {
++_public_ int sd_netlink_message_read_string(sd_netlink_message *m, uint16_t attr_type, const char **data) {
+ void *attr_data;
+ int r;
+
+@@ -878,7 +878,7 @@ int sd_netlink_message_read_string(sd_netlink_message *m, uint16_t attr_type, co
+ return 0;
+ }
+
+-int sd_netlink_message_read_u8(sd_netlink_message *m, uint16_t attr_type, uint8_t *data) {
++_public_ int sd_netlink_message_read_u8(sd_netlink_message *m, uint16_t attr_type, uint8_t *data) {
+ void *attr_data;
+ int r;
+
+@@ -901,7 +901,7 @@ int sd_netlink_message_read_u8(sd_netlink_message *m, uint16_t attr_type, uint8_
+ return 0;
+ }
+
+-int sd_netlink_message_read_u16(sd_netlink_message *m, uint16_t attr_type, uint16_t *data) {
++_public_ int sd_netlink_message_read_u16(sd_netlink_message *m, uint16_t attr_type, uint16_t *data) {
+ void *attr_data;
+ bool net_byteorder;
+ int r;
+@@ -929,7 +929,7 @@ int sd_netlink_message_read_u16(sd_netlink_message *m, uint16_t attr_type, uint1
+ return 0;
+ }
+
+-int sd_netlink_message_read_u32(sd_netlink_message *m, uint16_t attr_type, uint32_t *data) {
++_public_ int sd_netlink_message_read_u32(sd_netlink_message *m, uint16_t attr_type, uint32_t *data) {
+ void *attr_data;
+ bool net_byteorder;
+ int r;
+@@ -957,7 +957,7 @@ int sd_netlink_message_read_u32(sd_netlink_message *m, uint16_t attr_type, uint3
+ return 0;
+ }
+
+-int sd_netlink_message_read_ether_addr(sd_netlink_message *m, uint16_t attr_type, struct ether_addr *data) {
++_public_ int sd_netlink_message_read_ether_addr(sd_netlink_message *m, uint16_t attr_type, struct ether_addr *data) {
+ void *attr_data;
+ int r;
+
+@@ -1005,7 +1005,7 @@ int netlink_message_read_hw_addr(sd_netlink_message *m, uint16_t attr_type, stru
+ return 0;
+ }
+
+-int sd_netlink_message_read_cache_info(sd_netlink_message *m, uint16_t attr_type, struct ifa_cacheinfo *info) {
++_public_ int sd_netlink_message_read_cache_info(sd_netlink_message *m, uint16_t attr_type, struct ifa_cacheinfo *info) {
+ void *attr_data;
+ int r;
+
+@@ -1052,7 +1052,7 @@ int netlink_message_read_in_addr_union(sd_netlink_message *m, uint16_t attr_type
+ return 0;
+ }
+
+-int sd_netlink_message_read_in_addr(sd_netlink_message *m, uint16_t attr_type, struct in_addr *data) {
++_public_ int sd_netlink_message_read_in_addr(sd_netlink_message *m, uint16_t attr_type, struct in_addr *data) {
+ union in_addr_union u;
+ int r;
+
+@@ -1063,7 +1063,7 @@ int sd_netlink_message_read_in_addr(sd_netlink_message *m, uint16_t attr_type, s
+ return r;
+ }
+
+-int sd_netlink_message_read_in6_addr(sd_netlink_message *m, uint16_t attr_type, struct in6_addr *data) {
++_public_ int sd_netlink_message_read_in6_addr(sd_netlink_message *m, uint16_t attr_type, struct in6_addr *data) {
+ union in_addr_union u;
+ int r;
+
+@@ -1074,7 +1074,7 @@ int sd_netlink_message_read_in6_addr(sd_netlink_message *m, uint16_t attr_type,
+ return r;
+ }
+
+-int sd_netlink_message_has_flag(sd_netlink_message *m, uint16_t attr_type) {
++_public_ int sd_netlink_message_has_flag(sd_netlink_message *m, uint16_t attr_type) {
+ void *attr_data;
+ int r;
+
+@@ -1095,7 +1095,7 @@ int sd_netlink_message_has_flag(sd_netlink_message *m, uint16_t attr_type) {
+ return 1;
+ }
+
+-int sd_netlink_message_read_strv(sd_netlink_message *m, uint16_t container_type, uint16_t attr_type, char ***ret) {
++_public_ int sd_netlink_message_read_strv(sd_netlink_message *m, uint16_t container_type, uint16_t attr_type, char ***ret) {
+ _cleanup_strv_free_ char **s = NULL;
+ const NLAPolicySet *policy_set;
+ const NLAPolicy *policy;
+@@ -1192,7 +1192,7 @@ static int netlink_container_parse(
+ return 0;
+ }
+
+-int sd_netlink_message_enter_container(sd_netlink_message *m, uint16_t attr_type) {
++_public_ int sd_netlink_message_enter_container(sd_netlink_message *m, uint16_t attr_type) {
+ const NLAPolicy *policy;
+ const NLAPolicySet *policy_set;
+ void *container;
+@@ -1279,7 +1279,7 @@ int sd_netlink_message_enter_container(sd_netlink_message *m, uint16_t attr_type
+ return 0;
+ }
+
+-int sd_netlink_message_enter_array(sd_netlink_message *m, uint16_t attr_type) {
++_public_ int sd_netlink_message_enter_array(sd_netlink_message *m, uint16_t attr_type) {
+ void *container;
+ size_t size;
+ int r;
+@@ -1308,7 +1308,7 @@ int sd_netlink_message_enter_array(sd_netlink_message *m, uint16_t attr_type) {
+ return 0;
+ }
+
+-int sd_netlink_message_exit_container(sd_netlink_message *m) {
++_public_ int sd_netlink_message_exit_container(sd_netlink_message *m) {
+ assert_return(m, -EINVAL);
+ assert_return(m->sealed, -EINVAL);
+ assert_return(m->n_containers > 0, -EINVAL);
+@@ -1322,7 +1322,7 @@ int sd_netlink_message_exit_container(sd_netlink_message *m) {
+ return 0;
+ }
+
+-int sd_netlink_message_get_max_attribute(sd_netlink_message *m, uint16_t *ret) {
++_public_ int sd_netlink_message_get_max_attribute(sd_netlink_message *m, uint16_t *ret) {
+ assert_return(m, -EINVAL);
+ assert_return(m->sealed, -EINVAL);
+ assert_return(ret, -EINVAL);
+@@ -1331,14 +1331,14 @@ int sd_netlink_message_get_max_attribute(sd_netlink_message *m, uint16_t *ret) {
+ return 0;
+ }
+
+-int sd_netlink_message_is_error(sd_netlink_message *m) {
++_public_ int sd_netlink_message_is_error(sd_netlink_message *m) {
+ assert_return(m, 0);
+ assert_return(m->hdr, 0);
+
+ return m->hdr->nlmsg_type == NLMSG_ERROR;
+ }
+
+-int sd_netlink_message_get_errno(sd_netlink_message *m) {
++_public_ int sd_netlink_message_get_errno(sd_netlink_message *m) {
+ struct nlmsgerr *err;
+
+ assert_return(m, -EINVAL);
+@@ -1373,7 +1373,7 @@ static int netlink_message_parse_error(sd_netlink_message *m) {
+ NLMSG_PAYLOAD(m->hdr, hlen));
+ }
+
+-int sd_netlink_message_rewind(sd_netlink_message *m, sd_netlink *nl) {
++_public_ int sd_netlink_message_rewind(sd_netlink_message *m, sd_netlink *nl) {
+ size_t size;
+ int r;
+
+diff --git a/src/libsystemd/sd-netlink/sd-netlink.c b/src/libsystemd/sd-netlink/sd-netlink.c
+index ce0687eb57..fbebcf301b 100644
+--- a/src/libsystemd/sd-netlink/sd-netlink.c
++++ b/src/libsystemd/sd-netlink/sd-netlink.c
+@@ -65,7 +65,7 @@ static int netlink_new(sd_netlink **ret) {
+ return 0;
+ }
+
+-int sd_netlink_open_fd(sd_netlink **ret, int fd) {
++_public_ int sd_netlink_open_fd(sd_netlink **ret, int fd) {
+ _cleanup_(sd_netlink_unrefp) sd_netlink *nl = NULL;
+ int r, protocol;
+
+@@ -103,11 +103,11 @@ int sd_netlink_open_fd(sd_netlink **ret, int fd) {
+ return 0;
+ }
+
+-int sd_netlink_open(sd_netlink **ret) {
++_public_ int sd_netlink_open(sd_netlink **ret) {
+ return netlink_open_family(ret, NETLINK_ROUTE);
+ }
+
+-int sd_netlink_increase_rxbuf(sd_netlink *nl, size_t size) {
++_public_ int sd_netlink_increase_rxbuf(sd_netlink *nl, size_t size) {
+ assert_return(nl, -EINVAL);
+ assert_return(!netlink_pid_changed(nl), -ECHILD);
+
+@@ -145,7 +145,7 @@ static sd_netlink *netlink_free(sd_netlink *nl) {
+
+ DEFINE_TRIVIAL_REF_UNREF_FUNC(sd_netlink, sd_netlink, netlink_free);
+
+-int sd_netlink_send(
++_public_ int sd_netlink_send(
+ sd_netlink *nl,
+ sd_netlink_message *message,
+ uint32_t *serial) {
+@@ -451,7 +451,7 @@ static int timeout_compare(const void *a, const void *b) {
+ return CMP(x->timeout, y->timeout);
+ }
+
+-int sd_netlink_call_async(
++_public_ int sd_netlink_call_async(
+ sd_netlink *nl,
+ sd_netlink_slot **ret_slot,
+ sd_netlink_message *m,
+@@ -516,7 +516,7 @@ int sd_netlink_call_async(
+ return k;
+ }
+
+-int sd_netlink_read(
++_public_ int sd_netlink_read(
+ sd_netlink *nl,
+ uint32_t serial,
+ uint64_t usec,
+@@ -586,7 +586,7 @@ int sd_netlink_read(
+ }
+ }
+
+-int sd_netlink_call(
++_public_ int sd_netlink_call(
+ sd_netlink *nl,
+ sd_netlink_message *message,
+ uint64_t usec,
+@@ -606,14 +606,14 @@ int sd_netlink_call(
+ return sd_netlink_read(nl, serial, usec, ret);
+ }
+
+-int sd_netlink_get_events(sd_netlink *nl) {
++_public_ int sd_netlink_get_events(sd_netlink *nl) {
+ assert_return(nl, -EINVAL);
+ assert_return(!netlink_pid_changed(nl), -ECHILD);
+
+ return ordered_set_size(nl->rqueue) == 0 ? POLLIN : 0;
+ }
+
+-int sd_netlink_get_timeout(sd_netlink *nl, uint64_t *timeout_usec) {
++_public_ int sd_netlink_get_timeout(sd_netlink *nl, uint64_t *timeout_usec) {
+ struct reply_callback *c;
+
+ assert_return(nl, -EINVAL);
+@@ -689,7 +689,7 @@ static int prepare_callback(sd_event_source *s, void *userdata) {
+ return 1;
+ }
+
+-int sd_netlink_attach_event(sd_netlink *nl, sd_event *event, int64_t priority) {
++_public_ int sd_netlink_attach_event(sd_netlink *nl, sd_event *event, int64_t priority) {
+ int r;
+
+ assert_return(nl, -EINVAL);
+@@ -741,7 +741,7 @@ fail:
+ return r;
+ }
+
+-int sd_netlink_detach_event(sd_netlink *nl) {
++_public_ int sd_netlink_detach_event(sd_netlink *nl) {
+ assert_return(nl, -EINVAL);
+ assert_return(nl->event, -ENXIO);
+
+@@ -804,7 +804,7 @@ int netlink_add_match_internal(
+ return 0;
+ }
+
+-int sd_netlink_add_match(
++_public_ int sd_netlink_add_match(
+ sd_netlink *rtnl,
+ sd_netlink_slot **ret_slot,
+ uint16_t type,
+@@ -874,7 +874,7 @@ int sd_netlink_add_match(
+ destroy_callback, userdata, description);
+ }
+
+-int sd_netlink_attach_filter(sd_netlink *nl, size_t len, const struct sock_filter *filter) {
++_public_ int sd_netlink_attach_filter(sd_netlink *nl, size_t len, const struct sock_filter *filter) {
+ assert_return(nl, -EINVAL);
+ assert_return(len == 0 || filter, -EINVAL);
+
+diff --git a/src/systemd/meson.build b/src/systemd/meson.build
+index a9cdcd24a0..03ef60f92a 100644
+--- a/src/systemd/meson.build
++++ b/src/systemd/meson.build
+@@ -13,6 +13,7 @@ _systemd_headers = [
+ 'sd-journal.h',
+ 'sd-login.h',
+ 'sd-messages.h',
++ 'sd-netlink.h',
+ 'sd-path.h',
+ ]
+
+@@ -35,7 +36,6 @@ _not_installed_headers = [
+ 'sd-lldp-tx.h',
+ 'sd-lldp.h',
+ 'sd-ndisc.h',
+- 'sd-netlink.h',
+ 'sd-network.h',
+ 'sd-radv.h',
+ 'sd-resolve.h',
+--
+2.39.2
+
diff --git a/systemd/systemd.nm b/systemd/systemd.nm
index 3981082ed..984a1c026 100644
--- a/systemd/systemd.nm
+++ b/systemd/systemd.nm
@@ -5,7 +5,7 @@
name = systemd
version = 254
-release = 1
+release = 2
maintainer = Stefan Schantl <stefan.schantl(a)ipfire.org>
groups = System/Base
@@ -131,6 +131,7 @@ build
# Run the testsuite.
ninja test -v %{PARALLELISMFLAGS} -C build || true
+
end
install
--
2.39.2
1
0
- IPFire-3.x
- Update from version 0.8.1 to 0.8.2
- Changelog major items. More details can be found at
https://github.com/Cyan4973/xxHash/releases/tag/v0.8.2
0.8.2
xxHash v0.8.2 is an incremental update featuring multiple small improvements
and fixes spread out over ~300 commits. Faster performance
Several updates by @easyaspi314 and @hzhuang1 impact arm platform, most
notably the neon code path. On the M1 Pro, this translates into +20% speed
for xxh3 and xxh128 (from 30.0 GB/s to 36 GB/s).
Some of the changes are generic, so other platforms can be affected too,
though typically to a lesser extend (~5%).
On wasm, speed fo xxh3 is improved by a large factor x2 to x3 (depending on
underlying hardware) through the use of simd128 (@easyaspi314). This is
especially efficient under the v8 js engine, notably used by chrome and
node.js.
Finally, @hzhuang1 added support for the arm's SVE vector extension. This
is useful for server-side aarch64 cpus with hardware support for wide
vectors, such as Fujitsu's A64FX.
Fixes and improvements
Notable fixes in this update include the resolution of issues with XXH3
S390x vector implementation, PowerPC vector compilation with IBM XL
compiler, and -Og compilation.
Furthermore, the command line interface (CLI) was refined with features
such as support for comment lines in check files and commands such as
--binary and --ignore-missing (@t-mat). Additionally, issues with filename
containing /LF character were resolved.
The build process was also refined, with improvements such as fixing
pkgconfig generation with cmake (@ilya-fedin), icc compilation, cmake
install directories, and new build options to reduce binary size
(@easyaspi314). Dedicated install targets were introduced (@ffontaine),
and support for DISPATCH mode in cmake was added (@hzhuang1).
In terms of portability, the update includes the SVE vector implementation
of XXH3, compatibility with freestanding environments using XXH_NO_STDLIB,
and the ability to build on Haiku. The code has also been validated on
m68k and risc-v.
Documentation
XXH3 finally has a written specification, thanks to @adrien1018 !
Source code can also be digested by doxygen to generate code documentation
automatically. An instance is now available at homepage.
Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org>
---
xxhash/xxhash.nm | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/xxhash/xxhash.nm b/xxhash/xxhash.nm
index d551178ae..1a9310fad 100644
--- a/xxhash/xxhash.nm
+++ b/xxhash/xxhash.nm
@@ -4,7 +4,7 @@
###############################################################################
name = xxhash
-version = 0.8.1
+version = 0.8.2
release = 1
groups = System/Libraries
--
2.42.0
1
0
- IPFire-3.x
- Update from version 1.2.13 to 1.3
- Changelog
1.3
Building using K&R (pre-ANSI) function definitions is no longer supported.
Fixed a bug in deflateBound() for level 0 and memLevel 9.
Fixed a bug when gzungetc() is used immediately after gzopen().
Fixed a bug when using gzflush() with a very small buffer.
Fixed a crash when gzsetparams() is attempted for a transparent write.
Fixed test/example.c to work with FORCE_STORED.
Fixed minizip to allow it to open an empty zip file.
Fixed reading disk number start on zip64 files in minizip.
Fixed a logic error in minizip argument processing.
Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org>
---
zlib/zlib.nm | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/zlib/zlib.nm b/zlib/zlib.nm
index 948252bc6..e832c9145 100644
--- a/zlib/zlib.nm
+++ b/zlib/zlib.nm
@@ -4,7 +4,7 @@
###############################################################################
name = zlib
-version = 1.2.13
+version = 1.3
release = 1
groups = System/Libraries
--
2.42.0
1
0
- IPFire-s.x
- Update from version 1.5.2 to 1.5.5
- Changelog is too large to include here. See the following github page for the
details. https://github.com/facebook/zstd/releases
Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org>
---
zstd/zstd.nm | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/zstd/zstd.nm b/zstd/zstd.nm
index 292aeeed4..73d6b023d 100644
--- a/zstd/zstd.nm
+++ b/zstd/zstd.nm
@@ -4,7 +4,7 @@
###############################################################################
name = zstd
-version = 1.5.2
+version = 1.5.5
release = 1
groups = System/Libraries
--
2.42.0
1
0
- IPFire3.x
- Update from version 4.4.33 to 4.4.36
- Changelog
Version 4.4.36
* Fix left over bits failing with Perl v5.38.0 (issue #173).
Version 4.4.35
* Fix build with Perl v5.38.0 (issue #170).
* Fix build with MinGW-w(32|64).
Version 4.4.34
* Update build-aux/m4/ax_valgrind_check.m4 to v23.
* Optimize some cast operation for performance in
lib/alg-yescrypt-platform.c.
* Add SHA-2 Maj() optimization proposed by Wei Dai in lib/alg-sha512.c.
* Explicitly clean the stack and context state after computation in
lib/alg-gost3411-2012-hmac.c, lib/alg-hmac-sha1.c, and lib/alg-sha256.c
(issue #168).
Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org>
---
libxcrypt/libxcrypt.nm | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libxcrypt/libxcrypt.nm b/libxcrypt/libxcrypt.nm
index 0005eba61..cd84935d9 100644
--- a/libxcrypt/libxcrypt.nm
+++ b/libxcrypt/libxcrypt.nm
@@ -4,8 +4,8 @@
###############################################################################
name = libxcrypt
-version = 4.4.33
-release = 2
+version = 4.4.36
+release = 1
groups = System/Libraries
url = https://github.com/besser82/libxcrypt/
--
2.42.0
1
3
Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org>
---
wireguard-tools/wireguard-tools.nm | 42 ++++++++++++++++++++++++++++++
1 file changed, 42 insertions(+)
create mode 100644 wireguard-tools/wireguard-tools.nm
diff --git a/wireguard-tools/wireguard-tools.nm b/wireguard-tools/wireguard-tools.nm
new file mode 100644
index 000000000..b3c2a7eaf
--- /dev/null
+++ b/wireguard-tools/wireguard-tools.nm
@@ -0,0 +1,42 @@
+###############################################################################
+# IPFire.org - An Open Source Firewall Solution #
+# Copyright (C) - IPFire Development Team <info(a)ipfire.org> #
+###############################################################################
+
+name = wireguard-tools
+version = 1.0.20210914
+release = 1
+
+groups = Networking/VPN
+url = https://www.wireguard.com/
+license = GPLv2+
+summary = WireGuard: fast, modern, secure VPN tunnel
+
+description
+ WireGuard is an extremely simple yet fast and modern VPN that
+ utilizes state-of-the-art cryptography. It aims to be faster, simpler,
+ leaner, and more useful than IPsec, while avoiding the massive
+ headache. It intends to be considerably more performant than OpenVPN.
+ WireGuard is designed as a general purpose VPN for running on embedded
+ interfaces and super computers alike, fit for many different
+ circumstances. Initially released for the Linux kernel, it is now
+ cross-platform (Windows, macOS, BSD, iOS, Android) and widely
+ deployable. It is currently under heavy development, but already it
+ might be regarded as the most secure, easiest to use, and simplest VPN
+ solution in the industry.
+end
+
+source_dl = https://git.zx2c4.com/wireguard-tools/snapshot/
+sources = %{thisapp}.tar.xz
+
+build
+ DIR_BUILD = %{DIR_APP}/src
+end
+
+packages
+ package %{name}
+
+ package %{name}-debuginfo
+ template DEBUGINFO
+ end
+end
--
2.39.2
1
0