The generator emits a '# Setup interface: <ifname>' comment before each
interface, so the first one landed in config.radio.data and made the radio
comparison depend on the first BSS's ifname: renaming it forced a full
radio restart instead of the rename path. Skip comment lines when parsing
radio.data/bss.data.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
The per-wiphy radio-mask loops iterated all MLDs without checking the phy,
so a stop/start or status query for one wiphy touched MLDs on another wiphy
with the same radio index (clearing present bits, tearing links down, or
reporting a foreign MLD). Skip MLDs that do not belong to the phy, matching
mld_update_phy().
Signed-off-by: Felix Fietkau <nbd@nbd.name>
hostapd_free_hapd_data() skips hostapd_ucode_free_bss()/hostapd_ubus_free_bss()
for a bss that never started, so bss.delete() on such a bss freed hapd while
the ucode registry entry and ubus object still referenced it. Call both
explicitly before os_free(); they are idempotent for the started case.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
The early error path jumps to out: before conf is assigned, where
hostapd_config_free(conf) frees an indeterminate pointer. Initialise it to
NULL (hostapd_config_free tolerates NULL).
Signed-off-by: Felix Fietkau <nbd@nbd.name>
hostapd_ucode_free_bss() pushed only two arguments, but the bss_remove
handler (like bss_add/bss_reload) takes three (phy, name, obj), so name
received the bss resource: the DPP hook was never removed and the removal
event was malformed. Push the phy as well.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
new_config was tested against the freshly emptied new_mld object, so it was
always false and the reload-all-interfaces block never ran. Test the
incoming config instead, so the first MLD config re-adds the spliced-out
MLD BSSes.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
The guard meant to bail to a full restart read `!mac_idx < 0`, which parses
as `(!mac_idx) < 0` and is always false, so a static BSSID colliding with
the first (or a foreign-owned) BSS fell through and reassigned the wrong
BSS's address. Use `mac_idx <= 0`.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
On a radio shared with a STA every AP BSS is generated with
start_disabled=1. A smart reload that takes the full bss.set_config() path
restarts the BSS but never cleared start_disabled, so hostapd_start_beacon()
skipped beaconing and the AP went silently quiet until an unrelated
apsta_state event. Clear it when the BSS was already started, matching the
add_bss path.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Two defects handling the psk array returned by an auth handler: strlen()
ran before the string was validated (strlen(NULL) on a non-string entry),
and the hex-PMK branch tested the array length instead of the entry length.
A 64-character passphrase therefore reached the passphrase branch and its
memcpy of str_len + 1 overflowed passphrase[MAX_PASSPHRASE_LEN + 1] by one
byte. Validate the type first and branch on the string length.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
config_reset and shutdown call iface_set_config(name) with no config, but
the null-config guard was dropped in the MLO rework, so config.phy
dereferenced null and threw: config_reset reset nothing and shutdown left
hostapd-created interfaces behind. Restore the guard, removing the stale
config entry and tearing the interface down via iface_config_remove.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
iface.switch_channel() only reports whether a CSA was started, not whether
it completed, so a config-driven channel switch that the driver never
finishes would leave the AP stuck without recovery. After issuing the CSA,
arm a timer and, if the switch has not completed by the deadline
(csa_in_progress still set), fall back to a full interface restart. The
timer is armed only on the config-initiated path, so ubus- and
apsta-triggered channel switches keep their own recovery.
Add an iface.csa_in_progress() ucode method wrapping hostapd_csa_in_progress().
Signed-off-by: Felix Fietkau <nbd@nbd.name>
A config change that only alters the channel or channel width previously
failed the radio comparison in iface_reload_config() and forced a full
interface restart, disconnecting every client. Classify the radio diff:
apply a channel/width-only change through iface.switch_channel() (CSA) so
clients stay associated, keep the full restart for any other radio change.
When a co-located STA on the same band owns the runtime channel
(#channel_owned_by_sta), the change is a no-op on the AP side, which keeps
following the STA via apsta_state. MLD APs and DFS targets fall back to a
full restart, as a single iface-level CSA cannot handle them.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lift the #frequency and #channel_owned_by_sta markers (emitted by the
config generator) onto config.radio and keep them out of radio.data so
they do not perturb the radio comparison. These feed the config-driven
channel switch handling added next.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
On 6 GHz there is no HT Operation IE, so a 0 secondary-channel offset made
freq_info() return without a segment centre frequency, leaving wide-channel
switches (80/160/320 MHz) on the stale centre. Pass a null offset for wide
6 GHz channels so the centre is auto-derived.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
switch_channel computed the CSA bandwidth as 40 << oper_chwidth, which
mismaps oper_chwidth 3 (80+80, must be 80 MHz plus center_freq2) to 320
and 9 (320 MHz) to 20480. Map the operating channel width to the actual
MHz bandwidth explicitly.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Cherry pick the patches recommended in the hostapd security advisory
2026-1:
https://w1.fi/security/2026-1/missing-ml-parsing-validation.txt
Vulnerability
Vulnerabilities in parsing and use of received multi-link (MLO/EHT/IEEE
802.11be/Wi-Fi 7) information has been identified in hostapd and
wpa_supplicant. These issues show up in various cases where frames
including information on affiliated links are parsed and processed in
both AP and STA modes. The issues can result in process termination due
to buffer read overflow checks and memory corruption.
The issues for AP mode (hostapd or wpa_supplicant) can result in
denial-of-service attacks due to process termination and small memory
corruption that could theoretically cause other issues, but it does not
seem likely that those could be exploiting in practice. Affected areas
can be reached by sending invalid Management frames without needing
authentication or user action on the target device.
CVE-2026-58374
Link: https://github.com/openwrt/openwrt/pull/24043
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Commit 6f30f08d0e ("dnsmasq: add fallback for default dhcpv4/dhcpv6
values") changed dnsmasq.init to default the 'dhcpv4'/'dhcpv6' UCI
options to 'disabled' when a 'config dhcp' section leaves them unset:
- config_get dhcpv4 "$cfg" dhcpv4
- config_get dhcpv6 "$cfg" dhcpv6
+ config_get dhcpv4 "$cfg" dhcpv4 disabled
+ config_get dhcpv6 "$cfg" dhcpv6 disabled
The intent was to match odhcpd, which already treats an unset value
as disabled, so both backends behave the same way for newly created
configs. Its companion commit 85767ac8fe added explicit
'option dhcpv4/dhcpv6 server' lines to the stock 'lan' section in the
packaged dhcp.conf template, which covers fresh installs.
Neither commit accounts for configs that predate the change. Before
it, an unset dhcpv4/dhcpv6 option was implicitly treated as enabled,
so it was common (and still is, on any router upgraded from before
this landed) to have 'config dhcp' sections for additional
interfaces/VLANs with no explicit dhcpv4/dhcpv6 option at all. After
the change, dnsmasq.init silently skips '--dhcp-range' for every one
of those sections:
if [ "$dhcpv4" != "disabled" ]; then
...
fi
The result: any interface whose dhcp section never needed the option
before stops handing out leases entirely, with nothing logged beyond
a normal dnsmasq startup, while sections that happen to already carry
an explicit 'server' value keep working. On a router with several
VLANs this looks exactly like "DHCP only works on one interface."
Fix by shipping a one-time /etc/uci-defaults migration, matching the
existing 50-dnsmasq-migrate-resolv-conf-auto.sh /
50-dnsmasq-migrate-ipset.sh pattern in this package: for every
'config dhcp' section, if dhcpv4/dhcpv6 is unset, explicitly set it
to 'server', preserving the pre-6f30f08d0e behavior for existing
configs. Sections that already set the option (or set 'disabled'
deliberately) are left untouched, and sections that never reach the
check (e.g. 'wan' with 'option ignore 1') are unaffected.
Signed-off-by: John Audia <therealgraysky@proton.me>
Link: https://github.com/openwrt/openwrt/pull/24068
Signed-off-by: Robert Marko <robimarko@gmail.com>
Indicate that there are some changes. This should make sure that the
package gets updated.
Fixes: 63c0767f3d ("ead: fix integer underflow in handle_send_a()")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
add ra/dhcpv4/dhcpv6
dhcpv6 service provided by dnsmasq without odhcpd
Signed-off-by: Andy Chiang <AndyChiang_git@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/23445
Signed-off-by: Robert Marko <robimarko@gmail.com>
GCC 15 defaults to C23, where an empty parameter list "()" means
"(void)" instead of an unspecified argument list. This broke two spots
in the bundled tinysrp sources:
- The interrupt() signal handler in t_truerand.c was declared with
"()", so its type became "void (*)(void)" and no longer matched the
"void (*)(int)" expected by signal():
t_truerand.c💯32: error: passing argument 2 of 'signal' from
incompatible pointer type [-Wincompatible-pointer-types]
Give it the proper signal handler signature instead.
- The pre-ANSI fallback in t_defines.h declared strchr(), strrchr()
and strtok() with "()". ead.c is compiled without -DHAVE_CONFIG_H,
so STDC_HEADERS is undefined and that legacy branch is taken, where
the zero-argument prototypes now conflict with the declarations in
the standard headers:
tinysrp/t_defines.h:90:30: error: conflicting types for 'strtok';
have 'char *(void)'
Drop the dead K&R branch and include <stdlib.h> and <string.h>
unconditionally; the library's own objects already take this path
via config.h.
Assisted-by: Claude:claude-opus-4-8
Link: https://github.com/openwrt/openwrt/pull/23955
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
When bridge VLAN filtering is active, network_get_physdev resolves
UCI interface names to the VLAN sub-interface (e.g. br-lanv0) rather
than the bridge master. LLDP frames use reserved multicast
(01:80:c2:00:00:0e) which bridges trap to member ports, so lldpd
must listen on the physical ports to receive them.
Detect when the resolved device is a sub-interface of a bridge and
expand it to the list of bridge member ports instead.
Signed-off-by: John Crispin <john@phrozen.org>
handle_send_a() computed the SRP "A" parameter length as
len = ntohl(msg->len) - sizeof(struct ead_msg_number);
sizeof(struct ead_msg_number) is 1, and the subtraction is evaluated in
unsigned arithmetic. A packet with msg->len == 0 therefore wraps the
result to a huge value which, assigned to the signed int len, becomes -1.
The following bounds check is signed:
if (len > MAXPARAMLEN + 1)
return false;
so -1 passes, and memcpy(A.data, number->data, len) runs with len cast to
size_t (~SIZE_MAX) against the 257-byte abuf, crashing the daemon.
Neither parse_message() nor handle_packet() validate msg->len (only the
captured packet length), so an unauthenticated attacker on the local
segment can reach this path and crash ead with a single crafted packet.
Validate the claimed length in unsigned arithmetic before the subtraction
and bound it on both sides. Doing the upper-bound check unsigned as well
also closes a 32-bit-only variant where sizeof(ead_packet) + msg->len
overflows in handle_packet(), letting a large msg->len reach the same
negative-len path.
Link: https://github.com/openwrt/openwrt/security/advisories/GHSA-9558-77jp-g3fw
Reported-by: @Vasco0x4
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Update to 2.5.3 and use the official tarball.
Changelog: https://github.com/ppp-project/ppp/releases/tag/v2.5.3
Removed upstreamed:
- 000-pppd-session-fixed-building-with-gcc-15.patch
- 001-pppdump-fixed-building-with-gcc-15.patch
- 501-fix-memcpy-fortify.patch
- 502-remove_mru.patch
Manually rebased:
- 500-add-pptp-plugin.patch
Add a pending patch to relax the check to avoid breaking existing
configurations.
Signed-off-by: Qingfang Deng <dqfext@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23540
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The unet CLI's join handler used the joiner's --network value as the
local network name, so an unspecified --network fell back to the
literal 'unet'. The inviter typically uses a different name (e.g.
ucoord_<venue>), so the two sides ended up keyed differently and any
upper layer subscribing to the network-named unetmsg channel never
saw each other.
The inviter now passes enroll_info={ network } to enroll_start so
the inviter's network name rides along in enroll_meta. The joiner
prefers data.enroll_meta?.network when present, falling back to its
own --network value for backwards compatibility with older inviters.
Signed-off-by: John Crispin <john@phrozen.org>
Changes:
https://github.com/lldpd/lldpd/releases/tag/1.0.22
Fixes:
- Fix out-of-bound read access when removing VLAN tag (CVE-2026-46433, issue 787)
- Reject 0-length management address in LLDP
- Fix race condition when creating the control socket
- Fix FDP MAC address
- Fix memory leak in the BSD bridge query path
- Fix duplicate management addresses when merging EDP VLAN frames
Signed-off-by: Paul Donald <newtwen+github@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23567
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
- generate or use RSA only if none of the modern algorithms (Ed25519, ECDSA) are supported;
- remove size constraints for key size.
Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23217
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
- try to detect supported (hostkey) algorithms; otherwise fallback to predefined list;
- remove size constraint for ECDSA: custom build may include only 384 or 521 bit curves;
- remove size constraint for RSA: default RSA key size is 2048 bits which is sufficient for SSH security recommendations, and previous value of 1024 bits is considered insecure.
Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23217
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
f5d17dd60a89 mstp: add default Hello Time constant
17c36bebada1 mstp: use default Hello Time in recordTimes
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
6ab9abb56bcb cgi, file: fix crash due to field_len type mismatch with libubox
Signed-off-by: Andy Chiang <AndyChiang_git@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/23446
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
