a52cdb354d13 dns: validate IPv4 record addresses
b798c24205b5 dns: validate IPv6 record addresses
a3dcb4adc635 dns: validate reverse dns query name lengths
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
(cherry picked from commit 8a7eb57ab8)
When the virtual package "uci-firewall" is installed, the choice
between "firewall" and "firewall4" is arbitrary, sometimes resulting
in one, sometimes the other.
Set the default variant on "firewall4" to make it the preferred
package when installed as a dependency.
Link: https://forum.openwrt.org/t/owut-openwrt-upgrade-tool/200035/1126
Signed-off-by: Eric Fahlgren <ericfahlgren@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22328
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 5d71d9a4be)
Allow reinstalling already-installed packages without a version change.
Only the named packages are reinstalled, not their dependencies.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit 91cff1a6d3)
Several OpenWrt-related fixes are included in this release.
Drop upstreamed patches and refresh the rest.
Signed-off-by: Kuan-Yi Li <kyli@abysm.org>
Link: https://github.com/openwrt/openwrt/pull/22240
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit ed94d3eea7)
memcpy() with overlapping src and dest buffers is an undefined behavior
in C. In the current code, a ConfRej response is generated by copying
input data in-place, where the dest address is lower than the src.
This happens to work in practice because memcpy() forward-copies data,
matching the behavior of memmove() in this case.
However, if FORTIFY_SOURCE or Address Sanitizer is enabled, memcpy()
will detect the overlap at run time and abort the program.
Replace the memcpy() with memmove() to ensure a well-defined behavior.
Reported-by: Filippo Carletti <filippo.carletti@gmail.com>
MRU patch https://github.com/ppp-project/ppp/pull/573
Signed-off-by: Paul Donald <newtwen+github@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22286
(cherry picked from commit 1e9da9798a)
Link: https://github.com/openwrt/openwrt/pull/22318
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Removing tmp/ after having built base-files or toolchain currently
breaks rootfs generation:
$ rm -rf tmp
$ make V=w
...
make[2] package/install
cat: .../openwrt/tmp/base-files.version: No such file or directory
cat: .../openwrt/openwrt/tmp/libc.version: No such file or directory
ERROR: 'base-files=' is not a valid world dependency, format is name(@tag)([<>~=]version)
make[2]: *** [package/Makefile💯 package/install] Error 99
The only way to recover from here is to clean toolchain and base-files via
$ make package/{base-files,toolchain}/clean
tmp is supposed to be ephemeral, so clearing it is an expected action,
which normally just triggers a regeneration of all files there.
Fix this by moving the version files to $(STAGING_DIR).
Fixes: 63e178f067 ("build: lock versions for special APK packages")
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/21803
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit a4e92f0484)
Dave Täht sadly passed away on April 1, 2025. With the OpenWrt 25.12
release, we honor his life and his remarkable contributions.
Dave played a key role in reducing bufferbloat and improving network
latency in OpenWrt and across the wider internet. His work made networks
faster, more responsive, and more reliable for millions of users.
This release is dedicated to his memory and lasting impact on the
networking community.
Dave's Wikipedia article: https://en.wikipedia.org/wiki/Dave_T%C3%A4ht
Link: https://github.com/openwrt/openwrt/pull/22180
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This reverts commit c053b22573.
KSZ DSA driver is the only thing in the kernel selecting DCB support
instead of depending on it if required.
So, it will enable DCB support without asking and we do not want the
kernel size increase, as well as current Layerscape ARMv8 build failure.
So, revert this until its fixed upstream or worked around.
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit b897db9c44)
The key variable is not defined in the scope when setting wpa_psk. Use
config.key instead.
This fixes configuration the 64 characters wpa_psk directly.
Reported-by: donjoe in OpenWrt Forum
Link: https://github.com/openwrt/openwrt/pull/22182
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 69daeebc9a)
180ffcc instance: use mkdir_p helper
9493a3d signal: handle SIGUSR1 as halt
4dd22d0 cgroups: fix syntax error
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit e95cfd2ad7)
7e5b324 instance: check length of names when creating cgroups
014f94c procd: jail/cgroups: fix OOB write in cgroups_apply()
e08cdc8 hotplug-dispatch: fix filter disallowing setting PATH
afa4391 service instance: Improve handling of watchdog config changes
52c64d2 service instance: Fix overwriting of watchdog linked list members
96c827f coldplug: fix missing header include
6b10c71 hotplug-dispatch: fix missing header include
58d7aaa initd/coldplug: create /dev/null before running udevtrigger
64f97ff hotplug-dispatch: redirect output to /dev/null
c4e9859 hotplug-dispatch: use stat if d_type is DT_UNKNOWN
bafdfff system: fix arguments validation in ubus handler
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 361885b133)
51fa9ed6d4d6 interface-ip: fix fortify build error
cbb83a185740 bridge: skip present toggle in bridge_free_member() when device is active
Signed-off-by: Felix Fietkau <nbd@nbd.name>
It looks like commit 6d2f3b1b19 ("package: kernel: dtc: Add DTO support")
added this patch file 9 years ago without it ever being applied anywhere.
Back then there wasn't even a 'dtc' package, but we just used 'dtc' from
the Linux kernel sources.
Nowadays there is package/utils/dtc which is used to build dtc to be used
on the target (*not* a host-build!), and it of course already contains
support for device tree overlays since v1.4.3 from 2017...
This reverts commit 6d2f3b1b19.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Link: https://github.com/openwrt/openwrt/pull/22118
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit c69beade60)
This adds kernel packages for the Microchip KSZ9477 switch family.
Signed-off-by: Tim Harvey <tharvey@gateworks.com>
Link: https://github.com/openwrt/openwrt/pull/22120
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit c053b22573)
75bedc5 wireless-regdb: Update regulatory info for Australia (AU) for 2025
a6e5195 wireless-regdb: Update broken link in regulatory.bin(5) manpage
9e8c67f wireless-regdb: Update regulatory info for Malaysia (MY) for 2024
61a4637 wireless-regdb: Update regulatory info for Malaysia (MY) for 2025
5cefe55 wireless-regdb: Update regulatory info for Tunisia (TN) on 6GHz for 2025
1a729ae wireless-regdb: Update regulatory info for Canada (CA) for 2025
ea20dfa wireless-regdb: update regulatory database based on preceding changes
Link: https://github.com/openwrt/openwrt/pull/22150
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 7c5e329b54)
Due to a missing include, the constant UINT_MAX is undefined. This
fixes issues when building v25.12.0-rc5. Including a newer version of
iproute2 would include the patch, but causes other building issues.
Signed-off-by: Jonas Lochmann <openwrt@jonaslochmann.de>
Link: https://github.com/openwrt/openwrt/pull/22128
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 5f063d18bd)
Ensure that the BSS start_disabled option is always cleared, so that
interfaces come up properly.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit b7cd16dba3)
Without initializing pwd_group, it's set to 0, which is reserved value.
When EAP-PWD is used in wpa_supplicant/eapol_test, next error is seen:
EAP-PWD: Server EAP-pwd-ID proposal: group=0 random=1 prf=1 prep=0
EAP-pwd: Unsupported or disabled proposal
Signed-off-by: Yaroslav Isakov <yaroslav.isakov@gmail.com>
(cherry picked from commit 9d78b2f53c)
Secondary BSSes inherit the alloc value which bypasses
NL80211_ATTR_VIF_RADIO_MASK in nl80211_create_iface() and causes the
kernel to default new interfaces to all radios.
The ucode bss_create fallback fails to correct this because
the interface is already UP.. the kernel rejects SET_INTERFACE with
-EBUSY.
Signed-off-by: Chad Monroe <chad@monroe.io>
(cherry picked from commit 50d3d287e4)
Forward the OpenWrt CPPFLAGS to the compile process. This fixes fortify
sources support.
Link: https://github.com/openwrt/openwrt/pull/22056
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit c3f2a09a25)
Add the OpenWrt CPPFLAGS to the CFLAGS. ebtables does not
support CPPFLAGS. This fixes fortify sources support.
Link: https://github.com/openwrt/openwrt/pull/22056
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 77d896725f)
Add the OpenWrt CPPFLAGS to the CFLAGS. arptables does not
support CPPFLAGS. This fixes fortify sources support.
Link: https://github.com/openwrt/openwrt/pull/22056
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 33b2c6f955)
Add the OpenWrt CPPFLAGS to the FLAGS. iwinfo does not support CPPFLAGS.
This fixes fortify sources support.
Link: https://github.com/openwrt/openwrt/pull/22056
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 379d5b8bc4)
Add the OpenWrt CPPFLAGS to the CFLAGS. zyxel-bootconfig does not
support CPPFLAGS. This fixes fortify sources support.
Link: https://github.com/openwrt/openwrt/pull/22056
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit b8ea5004f4)
Forward the OpenWrt CPPFLAGS to the compile process. This fixes fortify
sources support.
Link: https://github.com/openwrt/openwrt/pull/22056
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit ddb1c1ab33)
Add the OpenWrt CPPFLAGS to the CFLAGS. wireless-tools does not
support CPPFLAGS. This fixes fortify sources support.
Link: https://github.com/openwrt/openwrt/pull/22056
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit d69b283068)
Forward the OpenWrt CPPFLAGS to the compile process. This fixes fortify
sources support.
Link: https://github.com/openwrt/openwrt/pull/22056
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 0f1c1c581f)
Forward the OpenWrt CPPFLAGS to the compile process. This fixes fortify
sources support.
Link: https://github.com/openwrt/openwrt/pull/22056
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit bfd57eab3d)
Forward the OpenWrt CPPFLAGS to the compile process. This fixes fortify
sources support.
Allow to extend the CPPFLAGS and not only overwrite.
Link: https://github.com/openwrt/openwrt/pull/22056
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 53e6935960)
Add the OpenWrt CPPFLAGS to the CFLAGS. bzip2 does not support CPPFLAGS.
This fixes fortify sources support.
Link: https://github.com/openwrt/openwrt/pull/22056
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit cd1fda5c8b)
Forward the OpenWrt CPPFLAGS to the compile process. This fixes fortify
sources support.
Link: https://github.com/openwrt/openwrt/pull/22056
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit b497c3f68f)
Forward the OpenWrt CPPFLAGS to the compile process. This fixes fortify
sources support.
Link: https://github.com/openwrt/openwrt/pull/22056
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 2ca7c2b846)
Forward the OpenWrt CPPFLAGS to the compile process. This fixes fortify
sources support.
Link: https://github.com/openwrt/openwrt/pull/22056
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 39e5f11631)
Forward the OpenWrt CPPFLAGS to the compile process. This fixes fortify
sources support.
Link: https://github.com/openwrt/openwrt/pull/22056
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 35939e4db9)
RIPE Atlas Probe v5 is a network measurement device based on Turris MOX.
u-boot bootscript supports booting both from the original Turris BTRFS
layout and default OpenWrt ext4 boot + root partition layout.
Specifications:
* SoC: Marvell ARMADA 3720
* RAM: 512 MiB, DDR3
* eMMC: 4G
* Ethernet: 1x 1GbE
MAC:
LAN MAC: label on board
Flash instructions:
* For using the default ext4 layout, boot into a live system using
tftpboot in u-boot and flash an OpenWrt SD image onto /dev/mmcblk0.
* For the Turris layout, put the new rootfs into subvolume '@', not
forgetting to add Image, device tree, and boot.scr to /boot.
Misc:
* USB connection is only for power. For UART access use the pin header:
1: GND
2: +1.8V
5: TX
6: RX
* Flashing the image onto Turris Shield won't work. Use Turris MOX image
instead.
Signed-off-by: Tomáš Macholda <tomas.macholda@nic.cz>
Link: https://github.com/openwrt/openwrt/pull/20031
(cherry picked from commit 0271f2ee36)
Signed-off-by: Trix Taiclet <git@trix.moe>
Link: https://github.com/openwrt/openwrt/pull/22048
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
