Mdns fixes

board/aarch64/alder-alder/Config.in

@@ -1,5 +1,6 @@
 config BR2_PACKAGE_ALDER_ALDER
 	bool "Alder"
 	depends on BR2_aarch64
+	select BR2_PACKAGE_LINUX_FIRMWARE_INSIDE_SECURE_MINIFW
 	help
 	  Alder

board/aarch64/marvell-cn9130-crb/Config.in

@@ -1,5 +1,6 @@
 config BR2_PACKAGE_MARVELL_CN9130_CRB
 	bool "Marvell CN9130-CRB"
 	depends on BR2_aarch64
+	select BR2_PACKAGE_LINUX_FIRMWARE_INSIDE_SECURE_MINIFW
 	help
 	  Customer Reference Board for CN9130

board/aarch64/marvell-espressobin/Config.in

@@ -1,5 +1,6 @@
 config BR2_PACKAGE_MARVELL_ESPRESSOBIN
 	bool "Marvell ESPRESSObin"
 	depends on BR2_aarch64
+	select BR2_PACKAGE_LINUX_FIRMWARE_INSIDE_SECURE_MINIFW
 	help
 	  Marvell ESPRESSObin

board/aarch64/styx-dcp-sc-28p/Config.in

@@ -1,5 +1,6 @@
 config BR2_PACKAGE_STYX_DCP_SC_28P
 	bool "Styx DCP-SC-28P"
 	depends on BR2_aarch64
+	select BR2_PACKAGE_LINUX_FIRMWARE_INSIDE_SECURE_MINIFW
 	help
 	  Styx DCP-SC-28P

board/common/rootfs/etc/nginx/available/netbrowse.conf

@@ -1,3 +1,13 @@
+server {
+    listen       80;
+    listen       [::]:80;
+    server_name  network.local;
+
+    location / {
+        include /etc/nginx/netbrowse.conf;
+    }
+}
+
 server {
     listen       443 ssl;
     listen       [::]:443 ssl;

board/common/rootfs/usr/libexec/infix/hostname

@@ -62,8 +62,8 @@ if ! runlevel >/dev/null 2>&1; then
 fi
 
 initctl -bq status lldpd && lldpcli configure system hostname "$new_hostname" 2>/dev/null
-initctl -bq status mdns  && avahi-set-host-name "$new_hostname" 2>/dev/null
-initctl -bq touch netbrowse 2>/dev/null
+initctl -bq touch mdns-alias 2>/dev/null
+initctl -bq touch netbrowse  2>/dev/null
 
 # If called from dhcp script we need to reload to activate new name in syslogd
 # Otherwise we're called from confd, which does the reload when all is done.

configs/aarch64_defconfig

@@ -50,7 +50,6 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
-BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBSSH2_OPENSSL=y

configs/arm_defconfig

@@ -52,7 +52,6 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
-BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
 BR2_PACKAGE_LIBINPUT=y

configs/riscv64_defconfig

@@ -60,7 +60,6 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
-BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBSSH2_OPENSSL=y

configs/x86_64_defconfig

@@ -49,7 +49,6 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
-BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBSSH2_OPENSSL=y

doc/ChangeLog.md

@@ -3,6 +3,38 @@ Change Log
 
 All notable changes to the project are documented in this file.
 
+[v26.03.0][UNRELEASED]
+-------------------------
+
+### Changes
+
+- **Revamped <http://network.local> device browser**.  Device cards now
+  show the IP address, product name, and firmware version from mDNS TXT
+  records.  the mDNS browser is now also available over plain HTTP
+- mDNS service records now embed the per-device hostname (using avahi's `%h`
+  wildcard), so devices avoid the `#2`, `#3` suffix collisions on service names
+  when multiple Infix devices share the same LAN
+- Add configurable mDNS hostname: set `services mdns hostname` to override the
+  mDNS name advertised in A/AAAA records.  Supports `%h` (default hostname),
+  `%i` (hardware ID), and `%m` (MAC address) format specifiers
+- cli: new `show mdns` command to list  mDNS-discovered devices on the LAN,
+  with addresses and product model
+- Add SSH client commands to the CLI:
+  - `ssh [user <name>] [port <num>] <host>` — connect to a remote device
+  - `set ssh known-hosts <host> <keytype> <pubkey>` — pre-enroll a host key
+    received out-of-band, e.g. after a factory reset changes the device host key
+  - `no ssh known-hosts <host>` — remove a stale or changed host key entry
+
+### Fixes
+
+- Fix #1387: `infix.local` now resolves to exactly one device per LAN.  Previously
+  all Infix devices claimed both `hostname.local` and `infix.local`, causing avahi
+  to append `#2`, `#3` suffixes to the shared alias on busy networks.  Assignment
+  is now first-come-first-served using standard mDNS conflict resolution
+- Fix #1416: `show firewall` command show an error when the firewall is disabled
+- Fix regression in MVEBU SafeXcel Crypto Engine for Marvell Armada SOCs (37xx,
+  7k, 8k, and CN913x series).  Firmware package lost in v26.01.0
+
 [v26.02.0][] - 2026-03-01
 -------------------------
 
@@ -1932,6 +1964,7 @@ Supported YANG models in addition to those used by sysrepo and netopeer:
 
 [buildroot]:  https://buildroot.org/
 [UNRELEASED]: https://github.com/kernelkit/infix/compare/v26.02.0...HEAD
+[v26.03.0]:   https://github.com/kernelkit/infix/compare/v26.02.0...v26.03.0
 [v26.02.0]:   https://github.com/kernelkit/infix/compare/v26.01.0...v26.02.0
 [v26.01.0]:   https://github.com/kernelkit/infix/compare/v25.11.0...v26.01.0
 [v25.11.0]:   https://github.com/kernelkit/infix/compare/v25.10.0...v25.11.0

doc/routing.md

@@ -27,6 +27,16 @@ The standard IETF model for static routes reside under the `static`
 control plane protocol.  For our examples we use the instance name
 `default`, you can use any name.
 
+The most common case when using a static IP setup is adding a default
+route (i.e., the default gateway):
+
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config/> <b>edit routing control-plane-protocol static name default ipv4</b>
+admin@example:/config/routing/…/ipv4/> <b>set route 0.0.0.0/0 next-hop next-hop-address 192.168.1.1</b>
+admin@example:/config/routing/…/ipv4/> <b>leave</b>
+admin@example:/>
+</code></pre>
+
 For a route with destination 192.168.200.0/24 via 192.168.1.1:
 
 <pre class="cli"><code>admin@example:/> <b>configure</b>
@@ -53,6 +63,17 @@ admin@example:/>
 
 ## IPv6 Static routes
 
+Default route via an IPv6 gateway:
+
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config/> <b>edit routing control-plane-protocol static name default ipv6</b>
+admin@example:/config/routing/…/ipv6/> <b>set route ::/0 next-hop next-hop-address 2001:db8:3c4d:1::1</b>
+admin@example:/config/routing/…/ipv6/> <b>leave</b>
+admin@example:/>
+</code></pre>
+
+For a route with destination 2001:db8:3c4d:200::/64 via 2001:db8:3c4d:1::1:
+
 <pre class="cli"><code>admin@example:/> <b>configure</b>
 admin@example:/config/> <b>edit routing control-plane-protocol static name default ipv6</b>
 admin@example:/config/routing/…/ipv6/> <b>set route 2001:db8:3c4d:200::/64 next-hop next-hop-address 2001:db8:3c4d:1::1</b>

package/mdns-alias/Config.in

@@ -1,5 +1,6 @@
 config BR2_PACKAGE_MDNS_ALIAS
 	bool mdns-alias
 	select BR2_PACKAGE_AVAHI
+	select BR2_PACKAGE_LIBUEV
 	help
 	  Advertises the initial $(HOSTNAME).local and network.local with Avahi.

package/mdns-alias/mdns-alias.hash

@@ -1,5 +1,5 @@
 # From GitHub release
-sha256  fd7272e4e520418a4a1352b69df852d963adfa928afcfda8e82ce7953626efdd  mdns-alias-1.0.tar.gz
+sha256  cf32b3c224325b3b660669a82e6dc30ad8438016d7492433cea591fa3a8a1dd9  mdns-alias-1.1.tar.gz
 
 # Locally generated
 sha256  3d6f910b5e198f3daab48047b8ee6949040f7abee3927daf2e231f265faf7d91  LICENSE

package/mdns-alias/mdns-alias.mk

@@ -4,11 +4,11 @@
 #
 ################################################################################
 
-MDNS_ALIAS_VERSION = 1.0
+MDNS_ALIAS_VERSION = 1.1
 MDNS_ALIAS_SITE = https://github.com/troglobit/mdns-alias/releases/download/v$(MDNS_ALIAS_VERSION)
 MDNS_ALIAS_LICENSE = ISC
 MDNS_ALIAS_LICENSE_FILES = LICENSE
-MDNS_ALIAS_DEPENDENCIES = host-pkgconf avahi
+MDNS_ALIAS_DEPENDENCIES = host-pkgconf avahi libuev
 #MDNS_ALIAS_AUTORECONF = YES
 #MDNS_ALIAS_DEPENDENCIES += host-automake host-autoconf
 

package/mdns-alias/mdns-alias.svc

@@ -1,2 +1,5 @@
-service <!service/mdns/running> env:-/etc/default/mdns-alias log:prio:daemon.debug,tag:mdns \
-	[2345] mdns-alias $MDNS_ALIAS_ARGS -- mDNS alias advertiser 
+# Avahi advertises the system default hostname, this service advertises
+# /etc/hostname (-H) and, optionally, network.local as CNAMEs.  Changes
+# to /etc/default/mdns-alias will cause Finit to restart not reload.
+service <service/mdns/running> env:-/etc/default/mdns-alias \
+	[2345] mdns-alias -H $MDNS_ALIAS_ARGS --

package/netbrowse/Config.in

@@ -1,6 +1,5 @@
 config BR2_PACKAGE_NETBROWSE
 	bool netbrowse
-	select BR2_PACKAGE_PYTHON_FLASK
+	depends on BR2_PACKAGE_HOST_GO_TARGET_ARCH_SUPPORTS
 	help
-	  Browse mDNS hosts on your network from http://network.local
-
+	  Browse mDNS hosts on your network from https://network.local

package/netbrowse/netbrowse.mk

@@ -4,21 +4,19 @@
 #
 ################################################################################
 
-NETBROWSE_VERSION = 1.0
+NETBROWSE_VERSION = 2.0
 NETBROWSE_SITE_METHOD = local
 NETBROWSE_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/netbrowse
-NETBROWSE_SETUP_TYPE = setuptools
+NETBROWSE_GOMOD = github.com/kernelkit/infix/src/netbrowse
 NETBROWSE_LICENSE = MIT
 NETBROWSE_LICENSE_FILES = LICENSE
 NETBROWSE_REDISTRIBUTE = NO
 
 define NETBROWSE_INSTALL_EXTRA
 	$(INSTALL) -D -m 0644 $(NETBROWSE_PKGDIR)/netbrowse.svc \
 		$(FINIT_D)/available/netbrowse.conf
-	$(INSTALL) -d -m 755 $(TARGET_DIR)/etc/default
-	echo "NETBROWSE_ARGS=\"network.local $(BR2_TARGET_GENERIC_HOSTNAME).local\"" \
-		> $(TARGET_DIR)/etc/default/netbrowse
+	ln -sf ../available/netbrowse.conf $(FINIT_D)/enabled/netbrowse.conf
 endef
 NETBROWSE_POST_INSTALL_TARGET_HOOKS += NETBROWSE_INSTALL_EXTRA
 
-$(eval $(python-package))
+$(eval $(golang-package))

package/netbrowse/netbrowse.svc

@@ -1,2 +1,2 @@
-service <!> name:netbrowse @www-data:www-data log:prio:daemon.debug,tag:mdns \
-	[2345] gunicorn -w 1 -b 127.0.0.1:8000 netbrowse:app -- Network browser
+service <!> name:netbrowse log:prio:daemon.debug,tag:netbrowse \
+	[2345] netbrowse -l 127.0.0.1:8000 -- Network browser

package/skeleton-init-finit/skeleton/etc/default/zebra

@@ -1,2 +1,2 @@
 # --log-level debug
-ZEBRA_ARGS="-A 127.0.0.1 -u frr -g frr --log syslog --log-level err"
+ZEBRA_ARGS="-A 127.0.0.1 -a -s 90000000 -u frr -g frr --log syslog --log-level err"

package/skeleton-init-finit/skeleton/etc/finit.d/available/frr/mgmtd.conf

@@ -1,2 +1,3 @@
 service <!> pid:!/run/frr/mgmtd.pid env:-/etc/default/mgmtd \
-	[2345] mgmtd $MGMTD_ARGS -- FRR MGMT daemon
+	[2345] mgmtd $MGMTD_ARGS \
+	-- FRR MGMT daemon

package/skeleton-init-finit/skeleton/etc/finit.d/available/frr/ospfd.conf

@@ -1,2 +1,3 @@
-service <!pid/zebra> env:-/etc/default/ospfd \
-	[2345] ospfd $OSPFD_ARGS -- OSPF daemon
+service <!pid/zebra> pid:!/run/frr/ospfd.pid env:-/etc/default/ospfd \
+	[2345] ospfd $OSPFD_ARGS \
+	-- OSPF daemon

package/skeleton-init-finit/skeleton/etc/finit.d/available/frr/ripd.conf

@@ -1,3 +1,3 @@
-service <pid/zebra> env:-/etc/default/ripd \
-	[2345] ripd $RIPD_ARGS
+service <pid/zebra> pid:!/run/frr/ripd.pid env:-/etc/default/ripd \
+	[2345] ripd $RIPD_ARGS \
 	-- RIP daemon

package/skeleton-init-finit/skeleton/etc/finit.d/available/frr/zebra.conf

@@ -1,3 +1,3 @@
-service <!pid/mgmtd> pid:!/run/frr/zebra.pid env:-/etc/default/zebra  \
-	[2345] zebra $ZEBRA_ARGS
+service <!pid/mgmtd> pid:!/run/frr/zebra.pid env:-/etc/default/zebra \
+	[2345] zebra $ZEBRA_ARGS \
 	-- Zebra routing daemon

board/common/rootfs/etc/frr/daemons → package/skeleton-init-finit/skeleton/etc/frr/daemons

@@ -1,5 +1,4 @@
-# Default FRR daemons file for Infix - confd overwrites on routing changes.
-# watchfrr, zebra, mgmtd, and staticd are always started by frrinit.sh.
+# Default FRR daemons file used with watchfrr, started by frrinit.sh.
 ospfd=no
 ripd=no
 bfdd=no
@@ -25,4 +24,3 @@ staticd_options="-A 127.0.0.1"
 bfdd_options="   -A 127.0.0.1"
 
 frr_profile="traditional"
-

package/skeleton-init-finit/skeleton/etc/frr/mgmtd.conf

@@ -0,0 +1 @@
+! Empty stub — mgmtd reads its own config at startup; file must exist to avoid log noise.

package/skeleton-init-finit/skeleton/etc/frr/ripd.conf

@@ -0,0 +1 @@
+! Empty stub — mgmtd reads per-daemon configs at startup; file must exist to avoid log noise.

package/skeleton-init-finit/skeleton/etc/frr/ripngd.conf

@@ -0,0 +1 @@
+! Empty stub — mgmtd reads per-daemon configs at startup; file must exist to avoid log noise.

package/skeleton-init-finit/skeleton/etc/frr/staticd.conf

@@ -0,0 +1 @@
+! Empty stub — mgmtd reads per-daemon configs at startup; file must exist to avoid log noise.

package/skeleton-init-finit/skeleton/etc/frr/zebra.conf

@@ -0,0 +1 @@
+! Empty stub — mgmtd reads per-daemon configs at startup; file must exist to avoid log noise.

package/statd/statd.mk

@@ -10,7 +10,7 @@ STATD_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/statd
 STATD_LICENSE = BSD-3-Clause
 STATD_LICENSE_FILES = LICENSE
 STATD_REDISTRIBUTE = NO
-STATD_DEPENDENCIES = sysrepo libev libsrx jansson libyang libite \
+STATD_DEPENDENCIES = sysrepo libev libsrx jansson libyang libite avahi \
 	host-python3 python3 host-python-pypa-build host-python-installer \
 	host-python-poetry-core dbus-python
 STATD_AUTORECONF = YES

patches/firewalld/2.3.1/0001-Silence-warnings-about-old-backends.patch

@@ -1,7 +1,7 @@
 From 03f273fc540082d1eaa23bd9b5847e695afd8283 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Thu, 25 Sep 2025 15:00:54 +0200
-Subject: [PATCH] Silence warnings about old backends
+Subject: [PATCH 1/2] Silence warnings about old backends
 Organization: Wires
 
 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>