validate() converts the country alias to country_code and deletes country
before setup_phy() runs, so the iw reg set branch tested a null
config.country and never ran, leaving wdev-only radios (adhoc/mesh/monitor)
on the world regdomain. Use config.country_code.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
The generator emits a '# Setup interface: <ifname>' comment before each
interface, so the first one landed in config.radio.data and made the radio
comparison depend on the first BSS's ifname: renaming it forced a full
radio restart instead of the rename path. Skip comment lines when parsing
radio.data/bss.data.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
The per-wiphy radio-mask loops iterated all MLDs without checking the phy,
so a stop/start or status query for one wiphy touched MLDs on another wiphy
with the same radio index (clearing present bits, tearing links down, or
reporting a foreign MLD). Skip MLDs that do not belong to the phy, matching
mld_update_phy().
Signed-off-by: Felix Fietkau <nbd@nbd.name>
dpp_connector was emitted unquoted, but wpa_supplicant parses it as a
string and hex-decodes an unquoted value; a base64url connector then failed
to parse and the network block was rejected. Emit it via the quoted-string
list. dpp_csign/dpp_netaccesskey stay raw, as they are hex.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
hostapd_free_hapd_data() skips hostapd_ucode_free_bss()/hostapd_ubus_free_bss()
for a bss that never started, so bss.delete() on such a bss freed hapd while
the ucode registry entry and ubus object still referenced it. Call both
explicitly before os_free(); they are idempotent for the started case.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
The early error path jumps to out: before conf is assigned, where
hostapd_config_free(conf) frees an indeterminate pointer. Initialise it to
NULL (hostapd_config_free tolerates NULL).
Signed-off-by: Felix Fietkau <nbd@nbd.name>
hostapd_ucode_free_bss() pushed only two arguments, but the bss_remove
handler (like bss_add/bss_reload) takes three (phy, name, obj), so name
received the bss resource: the DPP hook was never removed and the removal
event was malformed. Push the phy as well.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
phydev.name is already radio-suffixed, and the hostapd handler re-applies
the suffix, so on multi-radio phys the lookup missed and the returned MAC
list was always empty, letting wdev.uc reuse a MAC hostapd had reserved for
an AP BSS. Pass the base phy and radio index.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
setup_sta() called parse_encryption() without the device config, so the
sae-compat branch dereferenced a null dev_config.band and threw, aborting
the whole radio setup. Pass the device config through.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Only an exact GCMP cipher was mapped to the network block; other explicit
ciphers (CCMP-256, GCMP-256, TKIP variants) left pairwise unset, so
wpa_supplicant offered its default set and could not associate with an AP
restricted to the configured cipher. Pass wpa_pairwise through, keeping the
GCMP special case that also pins group.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
The hotplug match /(.+)\.sta.+/ also matched VLAN subinterfaces of a WDS
station (e.g. wlan0.sta1.100 -> wlan0), so the tagged subinterface was added
into the vif base networks, breaking VLAN separation. Anchor the pattern to
the plain station suffix.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
handle_link() passed the option as a ucode boolean, but the netifd
device_set binding reads it with prop_get_int (UC_INTEGER only) and ignored
a boolean, so the option was a no-op. Convert it to 0/1.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
retry was only reset on config change/start, never on a successful setup,
so occasional transient setup failures accumulated over a device lifetime
and latched retry_setup_failed after three cumulative failures. Reset it
when the device comes up.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Service data VLANs were stored under vif_data.vlans, but every consumer
reads vif.vlan, so per-VLAN config from a procd service was silently
dropped. Use the singular key, matching the adjacent station handling.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
wdev_add() dropped the wdev_create() result, so every caller's error check
was dead and an nl80211 NEW_INTERFACE failure was silently ignored (hostapd
and wpa_supplicant then proceeded on a missing netdev with stale MLD
bookkeeping). Return the result.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
new_config was tested against the freshly emptied new_mld object, so it was
always false and the reload-all-interfaces block never ran. Test the
incoming config instead, so the first MLD config re-adds the spliced-out
MLD BSSes.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
The guard meant to bail to a full restart read `!mac_idx < 0`, which parses
as `(!mac_idx) < 0` and is always false, so a static BSSID colliding with
the first (or a foreign-owned) BSS fell through and reassigned the wrong
BSS's address. Use `mac_idx <= 0`.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
device_extended_features() used bitwise OR instead of AND, so every
extended-feature query returned true regardless of the driver bitmap:
ftm_responder and radar_background were always reported present.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
A disabled wifi-device is intentionally still run through the setup path
(with no interfaces) to reliably tear down hostapd/wpa_supplicant and to
handle disabled/enabled flapping, so it reaches state "up" and status
reported up: true alongside disabled: true. Exclude disabled devices from
the up state in status instead.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
On a radio shared with a STA every AP BSS is generated with
start_disabled=1. A smart reload that takes the full bss.set_config() path
restarts the BSS but never cleared start_disabled, so hostapd_start_beacon()
skipped beaconing and the AP went silently quiet until an unrelated
apsta_state event. Clear it when the BSS was already started, matching the
add_bss path.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
A 64-character hex PSK was always quoted, but wpa_supplicant rejects a
quoted passphrase longer than 63 characters, so the network block failed
and the STA never associated while netifd still reported the radio up. Emit
the key unquoted when it is a 64-character raw PMK, matching the AP path.
The sae_password branch keeps quoting, as SAE passwords are arbitrary
strings.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
stop() and destroy() set cancel_setup while a setup handler is running, but
nothing read it, so a device brought down (or removed) mid-setup still went
up and stayed up, holding its interface links. Check the flag (and
autostart/delete) in wdev_mark_up and tear the device down instead of
completing the up transition.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Two defects handling the psk array returned by an auth handler: strlen()
ran before the string was validated (strlen(NULL) on a non-string entry),
and the hex-PMK branch tested the array length instead of the entry length.
A 64-character passphrase therefore reached the passphrase branch and its
memcpy of str_len + 1 overflowed passphrase[MAX_PASSPHRASE_LEN + 1] by one
byte. Validate the type first and branch on the string length.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
The wifi-device injection path used object shorthand `name` where no such
variable is in scope (the loop binds radio/config), so under the strict VM
config_init threw and the whole wireless configuration for that reload was
skipped. Use the radio key as the device name.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
config_reset and shutdown call iface_set_config(name) with no config, but
the null-config guard was dropped in the MLO rework, so config.phy
dereferenced null and threw: config_reset reset nothing and shutdown left
hostapd-created interfaces behind. Restore the guard, removing the stale
config entry and tearing the interface down via iface_config_remove.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
iface.switch_channel() only reports whether a CSA was started, not whether
it completed, so a config-driven channel switch that the driver never
finishes would leave the AP stuck without recovery. After issuing the CSA,
arm a timer and, if the switch has not completed by the deadline
(csa_in_progress still set), fall back to a full interface restart. The
timer is armed only on the config-initiated path, so ubus- and
apsta-triggered channel switches keep their own recovery.
Add an iface.csa_in_progress() ucode method wrapping hostapd_csa_in_progress().
Signed-off-by: Felix Fietkau <nbd@nbd.name>
A config change that only alters the channel or channel width previously
failed the radio comparison in iface_reload_config() and forced a full
interface restart, disconnecting every client. Classify the radio diff:
apply a channel/width-only change through iface.switch_channel() (CSA) so
clients stay associated, keep the full restart for any other radio change.
When a co-located STA on the same band owns the runtime channel
(#channel_owned_by_sta), the change is a no-op on the AP side, which keeps
following the STA via apsta_state. MLD APs and DFS targets fall back to a
full restart, as a single iface-level CSA cannot handle them.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Emit #frequency (the target channel frequency, already computed during phy
setup) and #channel_owned_by_sta (set when a co-located STA/mesh/adhoc on
the same band dictates the runtime channel) into the generated config.
The hostapd daemon uses these to decide whether a channel change can be
applied via CSA instead of a full restart.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lift the #frequency and #channel_owned_by_sta markers (emitted by the
config generator) onto config.radio and keep them out of radio.data so
they do not perturb the radio comparison. These feed the config-driven
channel switch handling added next.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
On 6 GHz there is no HT Operation IE, so a 0 secondary-channel offset made
freq_info() return without a segment centre frequency, leaving wide-channel
switches (80/160/320 MHz) on the stale centre. Pass a null offset for wide
6 GHz channels so the centre is auto-derived.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
switch_channel computed the CSA bandwidth as 40 << oper_chwidth, which
mismaps oper_chwidth 3 (80+80, must be 80 MHz plus center_freq2) to 320
and 9 (320 MHz) to 20480. Map the operating channel width to the actual
MHz bandwidth explicitly.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Add pending patches which add a PSE driver for the PSE setup found on
most of Realtek-based switches. An MCU with a Realtek-defined firmware
and protocol fronts one or more PSE chips (from Realtek or Broadcom) as
a management controller.
The driver provides both I2C/SMBus and UART communication, which varies
among our supported switches. There is no need for complicated userspace
handling anymore, the PSE setup is defined in the device tree and
interfaced in userspace via ethtool, netlink and netifd support.
Those patches have progressed far enough upstream, the bindings are
reviewed. Thus, we can keep this intermediate version downstream to open
it up earlier for usage. Only little changes are expected til the final
version lands.
Link: https://github.com/openwrt/openwrt/pull/23222
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
It seems that GCC 15.3 has added additional OOB checks for ARCH arm32.
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/23774
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
void pointer casting like this is unnecessary.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24177
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
This must be some older compiler and kernel warning.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24177
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Now that all targets using NSS-DP and SSDK have been converted, we can
finally drop these.
Signed-off-by: Robert Marko <robimarko@gmail.com>Link: https://github.com/openwrt/openwrt/pull/22381
Signed-off-by: Robert Marko <robimarko@gmail.com>
Using UUID-based client IDs for DHCPv4/DHCPv6 with no option of falling
back to hardware IDs (ie. MAC-address or DUID-LL) resp. none at all (IPv4),
is causing regressions in some setups.
Introduce a new setting to override the preferred client ID to be used for
DHCPv4/DHCPv6 on a per-interface basis:
network.<ifname>.sendclientid='auto|global|hardware|none'
- "auto" (default if empty or not present) uses any explicitly defined
client ID, or falls back to the global DUID and finally to the DUID-LL
resp. MAC address (ie. identical to before this commit).
- "global" uses the global default DUID, if configured, for DHCPv4 and
DHCPv6 requests, even if a client ID is explicitly specified for the i/f
- "hardware" will not pass a client ID to udhcpc/odhcp6c, even if a global
default DUID is configured or an explicit client ID specified, resulting
in the i/f MAC address resp. type 3 DUID(-LL) to be used
- "none" (IPv4 only) will not add an option tag 61 to DHCPv4 requests at
all.
Signed-off-by: Shine <4c.fce2@proton.me>
Link: https://github.com/openwrt/openwrt/pull/24107
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
struct gpio_keys_button has an unsigned int for its irq field. A signed
one is needed for fwnode_irq_get. Handle it before passing it to the
button member.
Fixes: 79b9a36959 ("gpio-button-hotplug: use device and fwnode")
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24174
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Changes:
* removed upstreamed patches,
* refresh patches,
* add en7523/an7581/an7583 pinctrl support
* add basic PCS support for an7583
* add an7583 specific mdio bus support
Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
Link: https://github.com/openwrt/openwrt/pull/24165
Signed-off-by: Robert Marko <robimarko@gmail.com>
Update to the latest stable version. Also remove obsolete symbol
PKG_CONFIG_SYSROOT_DIR[1].
[1] 8ef8dee4f3
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/24123
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Upstream prefers these instead of OF functions.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24120
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
This fixes a simple logic error of the macaddr lookup in utils.uc.
It read from the wrong sysfs file and compared it without trimming.
Signed-off-by: Harin Lee <me@harin.net>
Link: https://github.com/openwrt/openwrt/pull/24070
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
c0abf80df1c1 config: fix NULL pointer dereference when typed device creation fails
4a19d2568c0b device: migrate alias users when replacing a device
e2f28e5ec0a8 interface: defer interface removal to avoid use-after-free
34760f2aec34 interface: fix alias handling when the parent interface does not exist
0bab70f05296 bridge: cancel the member retry timer on teardown and free
a562a8eca41d bridge: fix memory leak of hotplug member vlan ranges
4c7b3f7caf88 proto-ext: clear the proto task kill flag when starting a new task
8a38aecd84de system-linux: include the priority when deleting ip rules
844c0fe78eed device: remove unused __devlock counter
dbdf0d0e5830 system-linux: initialise FMR prefix lengths before parsing
fb456b5e65df iprule: keep unchanged rules installed on reload
7d8f9900c273 vrf: sync changes with bonding.c/bridge.c
f0db4101c1ea vrf: remove incorrect IPv6 disable on VRF ports
9dfea5b242b2 vrf: remove unused vrf_empty field
6f6bf8bec23b vrf: rename vrf_state_type to vrf_device_type
37c770a6b86d vrf: add license header
35171a157516 system-linux: fix system_vrf_addif retry loop
6cbcc107e984 bonding: cancel the port retry timer on teardown and free
787848926a19 extdev: fix invalid frees and unwind order on handler registration failure
2a8ed44dc613 interface-ip: fix address family check when removing offlink null-routes
576e1f3de154 interface-ip: preserve subnet route state when keeping an address
10f25df801c1 bridge: fix parsing of the stp_kernel option
3132f007ebf0 bonding: skip present toggle in bonding_free_port() when device is active
24950e564fff bonding: fix stale primary_port pointer after port enable failure
4c8374dc0f79 interface: fix zone string leak on config reload
65e96ba990b2 ubus: fix netns fd leak in netns_updown error path
fa9ee5efd4b2 utils: fix out-of-bounds fallback in uci_get_validate_string
6ccbf71d7a97 utils: fix false positives and dead branch in check_pid_path
3ec503831ebd iprule: default src/dest masks to the host prefix length
9a520edc3be4 system-linux: implement the neighbour flush in system_if_clear_entries
62b6256bf95c system-linux: fix vxlan link creation with gbp disabled
6c0a837f10fc system-linux: fix rtnl socket desync when clearing kernel entries
d1a0ceb71991 macvlan: fix NULL dereference when dumping a device without parent
937c3aa801af vlandev: fix NULL dereference when dumping a device without parent
89025924ba51 vlan: fix device chain lookup for names with a non-vlan separator
c961d1e16814 vlan: fix rejection of maximum length vlan device names
1cbf89e3108c vlandev: fix type of vlan alias lookup result
08a4a7b33056 proto-ext: fix stuck state machine when the setup script fails to launch
c8c8b79a5bcb proto-ext: queue restart requests while a script task is running
0c990ce2ca09 ubus: report failure from the interface restart method
e6af4a5bf6f2 interface: fix undefined shift when computing the ip6hint mask
67f8107fb21c interface-ip: fix undefined shifts in prefix assignment arithmetic
903bd1c3daa5 interface-ip: fix out-of-bounds access in clear_if_addr for zero masks
56ffff895672 system-linux: fix ethtool feature block count
bbc818a6527f system-linux: fix EINTR retry in read_string_file
9c2970832d8f system-linux: fix off-by-one in vxlan VNI validation
c5b5d54ce2f9 bridge: validate the upper bound of hotplug vlan ranges
1595cd7b25da main: handle execvp failure on restart
24b2703171fe handler: guard against zero-length lines when parsing handler dumps
c2b760fc7cc5 handler: free glob results in netifd_init_extdev_handlers
60e3243bdcd8 handler: reject negative parameter types in handler descriptions
274b1594e0ca interface-ip: tear down the ULA prefix on an invalid prefix length
e692ec77d51b interface-ip: expire config routes with a valid option
684dc2d50902 device: fix error handling in device_create
c02101330247 interface: fully clean up partially constructed interfaces on free
1db485d6a39c handler: clear parameter list pointers on parse failure
5694c49f964f system-linux: stop receive loops on netlink errors
d108c504df4e system-linux: fix bogus master ifindex result for non-DSA devices
d6f609170f1e system-linux: fix swapped rx/tx in negotiated pause reporting
8a19380586ef extdev: fix NULL pointer dereference when parsing stats params
a1cc96488c02 extdev: fix memory leaks on device free
d2085a59abbc extdev: fix bridge config leak on no-op reload
4d1a4ae487b6 ucode: close pipe read end in spawned child processes
6c407410259c config: validate bridge vlan port and alias attributes
8afd58bead2f bridge: fix pvid clearing leaking to other vlan members
e8edb3f78652 bonding: fix port failure accounting in bonding_enable_port
6088f7b3b9d7 system-dummy: fix metric clobbering device name in route debug output
Signed-off-by: Felix Fietkau <nbd@nbd.name>
e2fa9dcf67a8 uloop: fix use-after-free when cancelling interval timers
329d823294a0 uloop: keep signal handler installed while other watchers remain
3362b39a1c03 kvlist: fix use-after-free when updating an entry in place
b33f74af02b2 list: define list_prev_entry used by list_for_each_entry_continue_reverse
65f62583c236 udebug: check hdr before dereferencing it in set_start_time
9d7fb82530b5 udebug: reject non-power-of-two ring metadata from a peer
2e0e7f0f4d38 udebug: verify shared-memory fd size before mapping
dda814a9750a usock: retry poll() on EINTR in usock_wait_ready()
72e2b396bd9a ustream: reset byte and buffer counters when freeing buffers
be161d0320da utils: guard cbuf_order against zero and one
08081477ad6c uloop: fix kevent() eventlist size argument in register_kevent
0c3eec553828 uloop: fix kqueue timer interval arithmetic
a9ab90bd1d5d uloop: fix use-after-free in signal_consume when a callback deletes a watcher
c08a4ab53129 uloop: fix use-after-free in uloop_handle_processes when a callback deletes a process
7677b7a4f3a4 vlist: pass the tree as comparator context in VLIST_TREE_INIT
Signed-off-by: Felix Fietkau <nbd@nbd.name>
