The shell config generator read the client private key from the UCI
options priv_key / priv_key_pwd (and priv_key2 / priv_key2_pwd for the
inner tunnel). The ucode generator was switched to private_key /
private_key_passwd (matching the wpa_supplicant field names), and LuCI
was updated accordingly, but existing configurations still carry the old
option names.
Such configs silently lose their private key: for an EAP-TLS client this
leaves wpa_supplicant without a client key and authentication fails after
upgrading from 24.10.
The schema already lists priv_key / priv_key_pwd, but as plain strings,
so validate() never migrates them. Declare them (and the missing
priv_key2 / priv_key2_pwd) as aliases of the private_key* options so the
old names keep working.
Fixes: https://github.com/openwrt/openwrt/issues/22599
Fixes: 218f3884d2 ("wifi-scripts: add ucode based scripts")
Assisted-by: Claude:claude-opus-4-8
Link: https://github.com/openwrt/openwrt/pull/24088
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The supplicant config generator emitted the altsubject_match,
domain_match and domain_suffix_match server certificate constraints
through the plain (unquoted) variable list. As these are UCI arrays,
they were rendered space-separated and without quotes, e.g.
altsubject_match=DNS:a.example.com DNS:b.example.com
wpa_supplicant parses an unquoted string value as a hex blob, so such a
line fails to parse and the constraint is dropped. wpa_supplicant
expects a single quoted, semicolon-separated string:
altsubject_match="DNS:a.example.com;DNS:b.example.com"
Join these lists with semicolons and emit them as quoted strings.
The inner-tunnel (phase 2) constraints subject_match2, altsubject_match2,
domain_match2 and domain_suffix_match2 were not written to the config at
all; emit them as well. Add the matching inner EAP-TLS options ca_cert2,
client_cert2, private_key2 and private_key2_passwd to the schema so they
validate cleanly.
Fixes: 218f3884d2 ("wifi-scripts: add ucode based scripts")
Assisted-by: Claude:claude-opus-4-8
Link: https://github.com/openwrt/openwrt/pull/24088
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The supplicant config generator emitted the phase2 directive as
phase2="auth=${auth}" for every PEAP/TTLS/FAST configuration. That is
wrong whenever the configured inner method is an EAP method: for
auth='EAP-MSCHAPV2' it produced phase2="auth=EAP-MSCHAPV2", which
wpa_supplicant rejects with:
TLS: Unsupported Phase2 EAP method 'EAP-MSCHAPV2'
breaking WPA-Enterprise clients that use an EAP inner method.
Mirror the shell config generator (hostapd.sh): strip the "EAP-" prefix
and pick the phase2 prefix from the method type, i.e. "autheap=" for a
tunneled EAP method with TTLS and "auth=" for a non-EAP method or a
full "auth=..." spec provided by the user.
Fixes: https://github.com/openwrt/openwrt/issues/24086
Fixes: c92ded2f6e ("wifi-scripts: fix EAP STA support in supplicant config generation")
Assisted-by: Claude:claude-opus-4-8
Link: https://github.com/openwrt/openwrt/pull/24088
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Commit 1f86f4e471 ("wifi-scripts: ucode: simplify wpa_pairwise default
selection") made HE and EHT BSSes default their pairwise cipher to
"GCMP-256 CCMP", and commit 86b9eec8f0 ("wifi-scripts: ucode: add
WPA3-Personal Compatibility Mode") always put GCMP-256 into the RSNE
Override 2 element on EHT compatibility-mode BSSes.
WPA3 Specification v3.5 only makes GCMP-256 mandatory when the BSS enables
EHT or MLO (section 2.5, item 5); for HE and below the WPA3 and Wi-Fi
Enhanced Open Deployment Guide v1.1 lists it as recommended, not required.
Advertising it by default causes interoperability problems: several
clients fail to associate when GCMP-256 is offered as a pairwise cipher
and connect again with CCMP only (Nanoleaf devices, a Motorola/Unisoc
phone, a Linux/iwd laptop).
Add a gcmp256 UCI option and, like sae_ext_key, default it on only where
GCMP-256 is both mandatory and safe: on Compatibility mode (sae-compat)
BSSes running an EHT htmode, which carry it in a separate RSNE Override 2
element that legacy clients ignore. It defaults off for WPA3-Personal
(sae) and Transition (sae-mixed) mode and on non-EHT BSSes. An explicit
'option gcmp256 0/1' overrides the default per BSS.
Both GCMP-256 pairwise defaults now key off config.gcmp256 (and, from the
earlier driver-support change, the phy actually implementing the cipher):
the sae/sae-mixed "GCMP-256 CCMP" pairwise cipher and the sae-compat RSNE
Override 2 element. The 'encryption sae+gcmp256' suffix and the wpa3-192
mode still force GCMP-256 as before.
Fixes: 1f86f4e471 ("wifi-scripts: ucode: simplify wpa_pairwise default selection")
Fixes: 86b9eec8f0 ("wifi-scripts: ucode: add WPA3-Personal Compatibility Mode")
Assisted-by: Claude:claude-opus-4-8
Link: https://github.com/openwrt/openwrt/pull/24041
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Commit a12cec9ea3 ("wifi-scripts: ucode: advertise SAE-EXT-KEY AKM
alongside SAE") advertised the SAE-EXT-KEY AKM (00-0F-AC:24, SAE using a
group-dependent hash, aka SAE-GDH) by default on every sae, sae-mixed and
sae-compat BSS.
WPA3 Specification v3.5 only makes this AKM mandatory when the BSS enables
EHT or MLO (section 2.5, item 4); for HE and below it is merely
recommended (sections 2.2 and 2.3). In practice the FT-SAE-EXT-KEY AKM
(SAE-EXT-KEY combined with 802.11r), which gets added automatically once
Fast Transition is enabled, keeps some clients from associating (a Samsung
Galaxy Tab S10 FE) or makes them reboot shortly after connecting (a Poco
X6). Plain SAE-EXT-KEY without FT was seen to work on the same tablet, but
its interoperability is not well tested.
Drop the fixed schema default and pick the default from the auth type in
parse_encryption instead. Only default it on where it is both mandatory
and safe to offer: on Compatibility mode (sae-compat) BSSes running an EHT
htmode, which carry it in a separate RSN Override element that legacy
clients ignore. Keep it off for WPA3-Personal (sae) and Transition
(sae-mixed) mode, where it would sit in the main RSNE that a choking
client cannot ignore, and off on non-EHT BSSes. An explicit
'option sae_ext_key 0/1' still overrides this per BSS.
The SAE-EXT-KEY AKM in the sae-compat RSN Override 2 element now keys off
config.sae_ext_key alone; the extra config.rsn_override_pairwise_2 guard
is dropped, decoupling the AKM from the GCMP-256 pairwise cipher so each
follows its own option.
Fixes: a12cec9ea3 ("wifi-scripts: ucode: advertise SAE-EXT-KEY AKM alongside SAE")
Assisted-by: Claude:claude-opus-4-8
Link: https://github.com/openwrt/openwrt/pull/24041
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The GCMP-256 pairwise cipher was advertised based only on the BSS htmode
(HE/EHT), without checking whether the driver actually implements it. On
phys that do not support GCMP-256 this makes hostapd reject the
configuration and fail to start.
Query the phy's NL80211 cipher suite list in device_capabilities() and
expose a phy_features.cipher_gcmp256 flag, then only offer GCMP-256 when
the driver advertises the GCMP-256 cipher suite (00-0F-AC:9, 0x000fac09),
mirroring how the HT/VHT feature flags are already gated on the reported
phy capabilities. This covers both the sae/sae-mixed "GCMP-256 CCMP"
pairwise default and the GCMP-256 pairwise cipher in the sae-compat RSNE
Override 2 element.
The "GCMP-256 CCMP" default now keys off driver support alone instead of
the htmode; a follow-up commit reintroduces the per-mode/EHT restriction
via a gcmp256 option.
Fixes: 1f86f4e471 ("wifi-scripts: ucode: simplify wpa_pairwise default selection")
Fixes: 86b9eec8f0 ("wifi-scripts: ucode: add WPA3-Personal Compatibility Mode")
Assisted-by: Claude:claude-opus-4-8
Link: https://github.com/openwrt/openwrt/pull/24041
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Cherry pick the patches recommended in the hostapd security advisory
2026-1:
https://w1.fi/security/2026-1/missing-ml-parsing-validation.txt
Vulnerability
Vulnerabilities in parsing and use of received multi-link (MLO/EHT/IEEE
802.11be/Wi-Fi 7) information has been identified in hostapd and
wpa_supplicant. These issues show up in various cases where frames
including information on affiliated links are parsed and processed in
both AP and STA modes. The issues can result in process termination due
to buffer read overflow checks and memory corruption.
The issues for AP mode (hostapd or wpa_supplicant) can result in
denial-of-service attacks due to process termination and small memory
corruption that could theoretically cause other issues, but it does not
seem likely that those could be exploiting in practice. Affected areas
can be reached by sending invalid Management frames without needing
authentication or user action on the target device.
CVE-2026-58374
Link: https://github.com/openwrt/openwrt/pull/24043
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Indicate that there are some changes. This should make sure that the
package gets updated.
Fixes: 257aee0cc0 ("scripts: dhcpv6: don't report custom ip6class if default")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Indicate that there are some changes. This should make sure that the
package gets updated.
Fixes: 63c0767f3d ("ead: fix integer underflow in handle_send_a()")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
GCC 15 defaults to C23, where an empty parameter list "()" means
"(void)" instead of an unspecified argument list. This broke two spots
in the bundled tinysrp sources:
- The interrupt() signal handler in t_truerand.c was declared with
"()", so its type became "void (*)(void)" and no longer matched the
"void (*)(int)" expected by signal():
t_truerand.c:100:32: error: passing argument 2 of 'signal' from
incompatible pointer type [-Wincompatible-pointer-types]
Give it the proper signal handler signature instead.
- The pre-ANSI fallback in t_defines.h declared strchr(), strrchr()
and strtok() with "()". ead.c is compiled without -DHAVE_CONFIG_H,
so STDC_HEADERS is undefined and that legacy branch is taken, where
the zero-argument prototypes now conflict with the declarations in
the standard headers:
tinysrp/t_defines.h:90:30: error: conflicting types for 'strtok';
have 'char *(void)'
Drop the dead K&R branch and include <stdlib.h> and <string.h>
unconditionally; the library's own objects already take this path
via config.h.
Assisted-by: Claude:claude-opus-4-8
Link: https://github.com/openwrt/openwrt/pull/23955
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
GCC 15 defaults to C23, where an empty parameter list "()" means
"(void)" instead of an unspecified argument list. This broke thc-ipv6 in
two ways:
- thc-ipv6.h declared thc_open_ipv6() with an empty argument list, so
its prototype became "int(void)" and conflicted with the actual
definition "int thc_open_ipv6(char *interface)" and all of its
callers:
thc-ipv6-lib.c:127:36: error: too many arguments to function
'thc_open_ipv6'; expected 0, have 1
thc-ipv6-lib.c:2555:5: error: conflicting types for 'thc_open_ipv6';
have 'int(char *)'
- The alarming() SIGALRM handlers in detect_sniffer6.c and thcping6.c
were declared with "()", so their type became "void (*)(void)" and no
longer matched the "void (*)(int)" expected by signal():
detect_sniffer6.c:140:19: error: passing argument 2 of 'signal'
from incompatible pointer type [-Wincompatible-pointer-types]
Add patches giving the prototype and the signal handlers their proper
signatures.
Assisted-by: Claude:claude-opus-4-8
Link: https://github.com/openwrt/openwrt/pull/23956
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
GCC 15 enables -Wheader-guard and the kernel module build treats
warnings as errors, so the mismatched include guards in three driver
headers break the build:
include/rtl8812a_sreset.h:20: error: header guard
'_RTL88812A_SRESET_H_' followed by '#define' of a different macro
[-Werror=header-guard]
Add a patch making each '#ifndef' match its '#define'. rtl8192e_sreset.h
was a copy/paste of the rtl8812a guard, so it gets its own
'_RTL8192E_SRESET_H_' name instead of duplicating '_RTL8812A_SRESET_H_'.
Assisted-by: Claude:claude-opus-4-8
Link: https://github.com/openwrt/openwrt/pull/23957
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
handle_send_a() computed the SRP "A" parameter length as
len = ntohl(msg->len) - sizeof(struct ead_msg_number);
sizeof(struct ead_msg_number) is 1, and the subtraction is evaluated in
unsigned arithmetic. A packet with msg->len == 0 therefore wraps the
result to a huge value which, assigned to the signed int len, becomes -1.
The following bounds check is signed:
if (len > MAXPARAMLEN + 1)
return false;
so -1 passes, and memcpy(A.data, number->data, len) runs with len cast to
size_t (~SIZE_MAX) against the 257-byte abuf, crashing the daemon.
Neither parse_message() nor handle_packet() validate msg->len (only the
captured packet length), so an unauthenticated attacker on the local
segment can reach this path and crash ead with a single crafted packet.
Validate the claimed length in unsigned arithmetic before the subtraction
and bound it on both sides. Doing the upper-bound check unsigned as well
also closes a 32-bit-only variant where sizeof(ead_packet) + msg->len
overflows in handle_packet(), letting a large msg->len reach the same
negative-len path.
Link: https://github.com/openwrt/openwrt/security/advisories/GHSA-9558-77jp-g3fw
Reported-by: @Vasco0x4
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
When growing the segment array in find_entry(), the memset() that zeroes
the newly allocated slots computed the destination with redundant sizeof
scaling:
memset(segments + (num_segments * sizeof(struct tffs_entry_segment)), ...)
segments is a typed pointer, so pointer arithmetic already scales by the
element size. Multiplying the offset by sizeof again advances the
destination by num_segments * sizeof^2 bytes, landing far outside the
realloc()'d buffer and zeroing unrelated heap memory whenever a TFFS
entry spans multiple segments that require array expansion.
Drop the redundant multiplication so the memset targets segments[num_segments].
This is a robustness fix for malformed/corrupt TFFS content; the parser
only reads the on-device nand-tffs MTD partition as root, so it is not
considered security relevant.
Reported-by: @Vasco0x4
Assisted-by: Claude:claude-opus-4-8
Link: https://github.com/openwrt/openwrt/pull/23763
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
f227ab4f1285 uclient: fix memory leak of url when backend alloc fails
645236607a3d uclient: free proxy_url in uclient_free
53d2d11fb00d uclient-http: fix NULL deref when digest WWW-Authenticate lacks params
0ba1b8718be5 ucode: check calloc return in uc_uclient_new
5cb19466d076 uclient-fetch: reset redirect counter per request
568c447950c1 uclient-fetch: retry short writes and surface errors
4c4a61a69ac3 uclient-fetch: use strtoull to parse Content-Length
440ca260622d uclient-http: validate Content-Length and chunk sizes from the server
8658324bd234 uclient: cast to unsigned char before ctype classifications
bf403fa0f8e5 uclient-fetch: reject CR in --header values
ec47f4176b1e uclient-fetch: always allocate auth_str and free it on exit
391dacd10d31 uclient-http: fail digest auth when the cnonce cannot be randomized
ba1f4311b099 ucode: clamp read length to the size of the static buffer
0ba47f319b09 uclient-fetch: advance to the next URL between requests
9dd0055d527d uclient: initialize *port for unknown address families
f816506651d5 uclient-http: start digest nonce count at 1
9b9b2da40835 uclient-http: fix 2-byte buffer undercount in digest add_field
80fb1e5ee68b ucode: avoid double-free of SSL context on ssl_init error
d44fb561bbcf ucode: don't clear an unrelated registry slot on free
02562403d2a3 uclient-fetch: close the output file before fetching the next URL
4a63561d0012 uclient-http: initialize fd to -1 so a failed connect can't close stdin
428ae8342118 uclient: cancel pending timers in uclient_free()
ffd8db308289 uclient-fetch: guard SSL debug setup against a missing SSL context
9f4db039a263 ucode: release callback argument references
d2af92b0aad9 uclient-http: resolve redirects against the proxy target URL
5dddda023267 uclient-utils: avoid out-of-bounds pointer in get_url_filename
8507588e7ce7 uclient-http: use the proxy target URL for HTTP authentication
322c89c6ca0a uclient-http: retry 401 auth for all body-less request methods
db3bb00ddda7 uclient-http: accept unquoted digest auth parameter values
5ce9983b2a11 uclient-http: follow 303 and 308 redirects
070c868486dc uclient-fetch: finalize request on invalid 206 Content-Range
83659a5a9bc1 uclient-fetch: concatenate multiple URLs into a single -O file
43bed2753998 ucode: don't leak string references in status()/get_headers()
03b17e4fc793 uclient-fetch: attach credentials to the proxy target, not the proxy
74c07b12f7ab uclient-fetch: don't run the progress meter in spider mode
daad21fa2c17 uclient-fetch: handle init_request failure on the 204 resume retry
Link: https://github.com/openwrt/openwrt/pull/23693
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
08bd058e0246 ra: skip malformed options instead of aborting RA processing
2550a1dd276e dhcpv6: fix inverted Authentication option validation in Reply
496e55d43de6 dhcpv6: use host-order option length in Authentication validation
b6f0c70f5fc2 dhcpv6: fix out-of-bounds end pointer when parsing IA in Advertise
92fd11cd9547 dhcpv6: fix OOB read and 1-byte heap overflow on captive-portal option
0dab8feec55a ra: fix OOB read on captive-portal option comparison
a4d6a3232c24 script: fix string_to_env writing garbage and reading past input
2521bf732b9f script: avoid kill(0) when SIGCHLD races script_call
56cec7a15816 odhcp6c: drop stale hash_ifname() declaration
49d9c0112bb8 odhcp6c: propagate allocation failure from insert_state
4bd976fd60c0 dhcpv6: ensure hostname buffer is NUL-terminated for dn_comp
6d12865fb89c ubus: validate element type when parsing reconfigure_dhcp opt_send
01130f80338a script: handle allocation failures in env helpers
0a19052dc9fb odhcp6c: refuse to follow symlinks when writing pidfile
d6c2fbdc255c odhcp6c: skip malformed /proc/net/if_inet6 entries
b6add6c0e30e dhcpv6: avoid signed-shift undefined behaviour in IAID derivation
ce52fe118b13 ubus: clear cached object type id on disconnect
91f88c694f6f config: stop mutating caller-supplied buffers in send-options parser
c938c168cbef script: handle fork() failure when launching state script
1546a48255b2 ubus: avoid out-of-bounds read when serializing captive-portal URI
3270f081039d all: fix inverted captive-portal URI equality check (RFC 8910 §3)
e9a9e9d45f38 odhcp6c: bound the address length when parsing the -P argument
5ad94c86e864 script: walk entries with odhcp6c_next_entry in entry_to_env
df4f199c02fc ubus: walk entries correctly and don't leak an open table in entry_to_blob
6c1c4c48d4a2 ubus: don't leak an open table on malformed S46 rule/bind in s46_to_blob
1797d2bca3c0 odhcp6c: remove pidfile on exit
86a6665e4bb0 ra: clear captive-portal state when router signals unrestricted URI
0a4e51db30d5 dhcpv6: require known SERVERID when validating Reconfigure
afc3c8534864 dhcpv6: reject Reconfigure with malformed or duplicate Message option
df27a49c98d8 dhcpv6: enforce monotonic replay counter on Reconfigure RKAP
9177f236c2d7 odhcp6c: do not treat DHCPv6 option type 0 as end-of-list
daf4ec3054e7 example: write all DNS servers to resolv.conf
Link: https://github.com/openwrt/openwrt/pull/23652
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
69b62b1990bc rpc-sys: packagelist: increase input buffer size
e655a0d69492 exec: defer async reply teardown to avoid use-after-free
5b078674a592 optimize by reusing timeout member
d005c885dbe4 session: clamp uloop timeout to avoid int overflow
a545f008da91 ucode: add request.defer() for async method handling
ab6549a99c7c file: avoid sending uninitialized stack memory for broken symlinks
7af2dd81cd53 main: prevent integer overflow when parsing -t timeout argument
680705e4b76d plugin: use snprintf in ubus lookup callback to prevent buffer overflow
fb0302dc0e51 session: detect short read of /dev/urandom in rpc_random()
dc091afa5860 rpc-sys: packagelist: check calloc() result for world array
4fbd48515d6a rpc-sys: packagelist: avoid size_t underflow when stripping ABI version
46fce7d5efc9 ucode: fix off-by-one truncation of generated ubus object type name
26dba5206e17 exec: prevent double close() of exec pipe descriptors
af5d6f431186 uci: prevent integer overflow of client supplied apply timeout
d06d2a81dc29 rc: fix memory leak of list request context
0de666811559 rc: copy list "name" filter to avoid use-after-free
75470f4b5124 rc: use a per-request blob_buf for the list reply
3037a0e36856 treat exec failures in forked children with _exit() instead of return
f5ffec54d7c7 rc: reap killed child on list "running" check timeout
fd4fcdeb186b rpc-sys: packagelist: close status file on world parsing error paths
e22aea1a51df rpc-sys: packagelist: read world file instead of mmap to avoid SIGBUS
79c8087c8e8e file: avoid zero-length b64_decode() on empty write data
cd1d9588da63 ucode: bound recursion when converting blob arguments to ucode values
2decaec3ef1b iwinfo: fix error handling and backend leak in survey
28faf6403792 cast char arguments to unsigned char for ctype.h functions
Link: https://github.com/openwrt/openwrt/pull/23650
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Change the schedule from once a day to twice a day (03:00 and 15:00
UTC) and raise the default max_prs from 16 to 24, so more open PRs
get covered now that the per-PR trigger has been removed.
Link: https://github.com/openwrt/openwrt/pull/23474
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Drop the pull_request_target trigger so the LLM review no longer runs
on opened/reopened PRs. We are limited to 15 Claude routine runs per
day, and the automatic per-PR trigger exhausted that budget on
several days, starving the nightly digest.
The nightly schedule and manual workflow_dispatch triggers remain.
Link: https://github.com/openwrt/openwrt/pull/23474
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Delete .github/workflows/claude-code-review.yml. It is superseded by
the LLM review action, which runs automatically and uses the Claude
routine API instead of the much more expensive Claude API.
Link: https://github.com/openwrt/openwrt/pull/23474
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
4b274055ede3 libubus: fix NULL dereference on OOM in ubus_queue_msg
8b5be570f13e libubus-acl: fix dangling pointers on blob_memdup failure in acl_recv_cb
9105ea2a349a ubusd_acl: fix NULL dereference on OOM in ubusd_acl_alloc_obj
07d7f34ac278 ubusd_acl: handle allocation failures in ubusd_acl_init_client
497321a5ea90 ubusd_acl: fix NULL dereference on OOM in ubusd_acl_init
f66d52ba983f ubusd_event: fix OOM handling in ubusd_send_event_msg
11ea1b3bdbea ubusd_main: fix async-signal-unsafe SIGHUP handler
0c095592ccb7 ubusd_proto: fix resource leaks and ID tree corruption in ubusd_proto_new_client
f61695e6e12a ubusd_proto: fix NULL dereference for user/group in ubusd_handle_add_watch
7ecacfadd9bc ubusd_proto: fix NULL dereference on OOM in ubusd_proto_init_retmsg
3ab9d7759545 lua: fix inverted argument check in ubus_lua_add
43051ca73aec lua: fix unchecked calloc and memory leak in ubus_lua_load_object
4ca0b141e9a7 ubusd_id: use getrandom(2) unconditionally on Linux
7e4356da8abe ubusd_monitor: fix NULL dereference on OOM in ubusd_monitor_message
5849870f2251 libubus-req: fix file descriptor leaks in ubus_process_req_msg
f29767f90af1 libubus: fix file descriptor leaks in ubus_process_msg
b099d050b59d libubus: make ubus_shutdown idempotent
a564b8dcb395 ubusd_main: check strdup return value in mkdir_sockdir
239edcbaaac8 ubusd_id: fix continue in do-while skipping random ID retry
09d2df45bf38 ubusd: fix NULL dereference on OOM in ubus_msg_enqueue
bcc45ca981fd libubus: actually set FD_CLOEXEC on the ubus socket
8188f5ce8564 libubus-io: close recv_fd captured before get_next_msg failure
7a068bac5a9b libubus-io: byte-swap peer in HELLO when storing as local_id
747013f6ea05 libubus-io: reset sock.fd to -1 after close on ubus_reconnect error path
020a64b9b169 ubusd_acl: use size_t for strlen result in ubusd_acl_alloc_obj
f92ffd289dcc ubusd: use size_t for string and blob length variables
795b32bb96b6 ubusd: use fixed-width types for sequence counters
Link: https://github.com/openwrt/openwrt/pull/23487
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This fixes:
* CVE-2026-6042: Algorithmic Complexity DoS in musl libc iconv
* CVE-2026-40200: musl libc: stack corruption in qsort with sufficiently large inputs
Link: https://github.com/openwrt/openwrt/pull/23329
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Manual workflow_dispatch and push share the same ref on main, so
they previously landed in the same concurrency group
'Build Kernel-refs/heads/main' (and the equivalent for the packages
workflow). With cancel-in-progress: false for non-PR events, only
one run can be pending per group: a newer queued run cancels the
older pending one.
That made the manual trigger unreliable in both directions. A push
landing while a dispatch was queued displaced the dispatch (so the
ccache reseed never ran), and dispatching while a push was queued
displaced the push (so the legitimate per-commit build was lost).
Adding github.event_name to the concurrency group puts pushes,
dispatches, and pull_requests in separate buckets on the same ref,
so they no longer compete with each other.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Link: https://github.com/openwrt/openwrt/pull/23283
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Allow the Build Kernel and Build all core packages workflows to be
launched manually from the Actions tab. The shared workflow side
detects workflow_dispatch and, for Build Kernel, rebuilds the full
target/subtarget matrix including testing kernel versions, so a
manual run can re-seed the s3 ccache when a queued push run got
displaced from the concurrency queue by the next commit on main.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Link: https://github.com/openwrt/openwrt/pull/23283
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
895f92164b66 uloop: add ULOOP_PRIORITY support for EPOLLPRI events
f9b1f3ff17ba uloop: revert my flag changes from the ULOOP_PRIORITY change
2982bfb1c325 blob: fix wrong type for realloc result in blob_buffer_grow()
78c20f6c8579 json_script: convert recursive __json_script_file_free() to iterative
e7c13bf8cbca usock: fix off-by-one in nanosecond normalization in poll_restart()
68b3f1588de4 uloop: usock: add error checking for fcntl and remove duplicate include
03821f942c49 uloop: fix undefined behavior in signal bit operations for signals > 32
e6e6fd83e26d blobmsg: fix policy name length overflow and add bounds check in blobmsg_parse()
d30b9cc1a02d usock: fix integer overflow in timeout calculations
406e342bb900 udebug: fix double off-by-one in udebug_entry_vprintf()
700eca0bac66 blobmsg_json: fix integer overflow in blobmsg_puts()
6351fe552162 blobmsg_json: floor strbuf size and tighten the post-format guard
58b6543f1b25 blobmsg: fix unsigned integer overflow in blobmsg_alloc_string_buffer()
d7a3ae699df0 blobmsg: use correct byte-order macro when setting BLOB_ATTR_EXTENDED
23c6618a5b90 blobmsg_json: fix double format string to avoid truncation and data loss
1edf1d704e76 jshn: fix integer overflow and type confusion in jshn_parse_file
9b488010c4a7 utils: fix integer overflow in __calloc_a()
40a87f734b94 blob: fix integer overflow in buffer growth functions
02fccb465651 blob: use size_t for blob_memdup() length
0fa612ca08f7 json_script: avoid alloca() on attacker-controlled pattern length
8c9862b6921b blobmsg: fix integer overflow in blobmsg_realloc_string_buffer()
5fbef5bb94fb ustream: avoid INT_MAX overflow on malloc in ustream_vprintf()
1501e60e5554 md5: detect read errors in md5sum() instead of returning a bogus hash
Link: https://github.com/openwrt/openwrt/pull/23212
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This was not refresh before because of a merge race.
Fixes: 4c942c06b8 ("kernel: bump 6.18 to 6.18.27")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This contains many fixes from upstream Linux.
The code block from this patch was moved a bit in the function:
subsys/110-mac80211_keep_keys_on_stop_ap.patch
This patch was applied upstream:
subsys/330-mac80211-fix-crash-in-ieee80211_chan_bw_change-for-A.patch
Link: https://github.com/openwrt/openwrt/pull/23167
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Backport upstream iw commit d90618809e06 ("iw: scan: print RSN
Element Override IEs") as 001-*.patch so `iw scan` decodes the
RSNOE (vendor WFA type 41) and RSNO2E (type 42) elements that
hostapd emits for WPA3 Compatibility / RSN Overriding APs.
Also refresh the hunk offsets in 200-reduce_size.patch.
Link: https://github.com/openwrt/openwrt/pull/23009
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Two of the IW_FULL guards in 200-reduce_size.patch were inverted
or incomplete:
* the "unknown event" handler unconditionally replaced the
verbose print with the short form, so IW_FULL builds lost
the command name decoding;
* the early return before the vendor IE parser used
#ifdef IW_FULL, which suppressed parsing in the full build
instead of the size-reduced one.
Wrap both with the correct #ifndef IW_FULL / #else so the full
and reduced builds produce the intended output.
Link: https://github.com/openwrt/openwrt/pull/23009
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The WPA3 and Wi-Fi Enhanced Open Deployment Guide v1.1 (Table 4,
"SAE Groups") recommends that WPA3-Personal APs advertise support
for SAE groups 19, 20 and 21:
* group 19 - ECP 256-bit (NIST P-256)
* group 20 - ECP 384-bit (NIST P-384)
* group 21 - ECP 521-bit (NIST P-521)
hostapd's default is group 19 only, which leaves the two larger
ECP groups unavailable even though the peer may prefer them.
Set sae_groups = "19 20 21" as the default for any BSS whose
auth_type is sae or psk-sae (SAE, SAE Transition and SAE
Compatibility modes).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/23009
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The WPA3 and Wi-Fi Enhanced Open Deployment and Implementation Guide
v1.1 (Tables 4, 5, 6) requires the group-management cipher (BIP) to
match the mode and strength of the pairwise cipher: GCM-mode pairwise
ciphers pair with BIP-GMAC integrity, CCM-mode pairwise ciphers with
BIP-CMAC integrity. The ucode pipeline hard-coded group_mgmt_cipher
to AES-128-CMAC (BIP-CMAC-128) regardless of the pairwise cipher,
except for the eap192 special case that already forced BIP-GMAC-256.
An EHT WPA3-Personal BSS therefore emitted wpa_pairwise=GCMP-256
alongside group_mgmt_cipher=AES-128-CMAC -- the integrity cipher two
steps weaker than the data cipher and a spec violation on EHT.
hostapd has a single group_mgmt_cipher knob, so the selected BIP has
to be compatible with every pairwise cipher in wpa_pairwise. Picking
from the first token would mis-select on mixed lists -- e.g.
wpa_pairwise=\"GCMP-256 CCMP\" would yield BIP-GMAC-256, which a
CCMP-only STA cannot negotiate.
Walk the wpa_pairwise tokens and pick the BIP that matches the
weakest cipher present:
CCMP / TKIP -> AES-128-CMAC (BIP-CMAC-128)
CCMP-256 -> BIP-CMAC-256
GCMP -> BIP-GMAC-128
GCMP-256 -> BIP-GMAC-256
Token matching uses fnmatch wildcards against a copy of wpa_pairwise
that is padded with leading and trailing spaces, so each token is
space-bounded regardless of its position in the list.
The RSN override pairwise lists are not consulted: in the only
caller that sets them (WPA3-Personal Compatibility Mode), Tables 6
and 7 require BIP-CMAC-128 across RSNE/RSNOE/RSNO2E even when the
override lists advertise GCMP-256, so wpa_pairwise=CCMP already
yields the correct BIP.
An explicit ieee80211w_mgmt_cipher UCI value still wins over the
derived default.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/23009
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
WPA3 Specification v3.5 §13 defines the Transition Disable element sent
inside message 3 of the 4-way handshake. An AP that is no longer
offering a transition mode for its SSID sets the matching bit so that
compliant STAs permanently stop falling back to WPA-PSK / WPA-EAP /
open for that SSID, hardening against downgrade attacks and against
operator mistakes where a transition-mode BSS is briefly brought up on
an SSID that previously ran WPA3-only.
Expose this as a UCI list 'transition_disable' with three classes of
entries:
* The existing OpenWrt encryption tokens 'sae' (bit 0x01), 'sae-pk'
(0x02), 'wpa3' (0x04) and 'owe' (0x08) OR into the bitmap. SAE-PK
itself is not yet wired through wifi-scripts; the token only lets
an operator who configured SAE-PK out of band also hand the
matching bit to hostapd.
* 'on' derives the bitmap from the AP's auth_type ('sae' -> 0x01,
'eap2'/'eap192' -> 0x04, pure 'owe' -> 0x08) and overrides any
other explicit tokens in the same list. Transition BSSes
(psk-sae, eap-eap2, owe with owe_transition set) produce no
bits even under 'on' because they are by definition still in
transition.
* 'off' unconditionally suppresses the element regardless of any
other entries. Operators who need to revert a WPA3-only SSID back
to a transition mode can set this proactively, giving compliant
STAs time to forget the permanent bit before the mode change.
Leave the list unset by default. Advertising Transition Disable is a
one-way door -- once a compliant STA has seen the permanent bit for an
SSID it will refuse to associate to a transition-mode BSS of the same
name ever again -- so it must be opted in to per SSID, never flipped
on by a firmware bump. This also matches the WPA3 and Wi-Fi Enhanced
Open Deployment and Implementation Guide v1.1 Table 4 requirement that
Transition Disable be MAND disabled by default on APs.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/23009
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The WPA3 and Wi-Fi Enhanced Open Deployment and Implementation Guide
v1.1 (Tables 7 and 8) mandates "H2E Only" for SAE on 6 GHz, in both
WPA3-Personal Only and WPA3-Personal Compatibility Mode: the 6 GHz
band disallows the legacy Hunting-and-Pecking password element, so
the AP must advertise BSS Membership Selector 123 to force STAs onto
H2E.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/23009
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The WPA3 and Wi-Fi Enhanced Open Deployment and Implementation Guide
v1.1 §2.4 (Tables 6 and 7) defines WPA3-Personal Compatibility Mode:
the AP advertises a legacy-looking RSNE (WPA-PSK, CCMP-128, PMF
Disabled) while RSN Override Elements layered on top expose SAE and,
on EHT, SAE-EXT-KEY. WPA2-only STAs and STAs that ignore RSN
Overriding associate unchanged; modern STAs pick up the stronger WPA3
AKM via RSNOE or RSNO2E.
Only the pairwise cipher differs between elements: RSNE and RSNOE
advertise CCMP-128, RSNO2E advertises GCMP-256 (EHT only). Group
data (CCMP-128) and group management cipher (BIP-CMAC-128) are the
same in all three per Tables 6/7, so hostapd's BSS-wide group_cipher
and group_mgmt_cipher singletons produce the spec-correct values.
Unlike WPA3-Personal Transition Mode (sae-mixed), which puts PSK and
SAE together in the main RSNE with PMF Capable, Compatibility Mode
keeps the main RSNE strictly WPA2-shaped so clients that choke on a
mixed AKM list or PMF=Capable still see a pure WPA2 BSS. The trade-
off is that clients without RSN Overriding support never pick up SAE.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/23009
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The WPA3 and Wi-Fi Enhanced Open Deployment and Implementation Guide
v1.1, Table 4 (Common security configuration) marks Beacon Protection
as MAND for EHT-enabled APs and RECOM otherwise for all WPA3 and
Wi-Fi Enhanced Open modes.
The ucode path blindly passed beacon_prot through from UCI in iface
setup, which ran before encryption and MFP had been configured, and
left hostapd at its insecure default of 0 when the user did not
explicitly opt in.
Default beacon_prot to 1 in iface_mfp after MFP has been confirmed to
be enabled, and emit it there instead of in iface_setup so the option
is only written when PMF support is actually negotiated. Users can
still disable it explicitly via UCI.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/23009
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
WPA3 Specification v3.5 §2.5.4 mandates that an AP's BSS Configuration
enables AKM suite selector 00-0F-AC:24 (SAE-EXT-KEY, SAE with a
group-dependent hash) whenever EHT or MLO is enabled. The WPA3 and
Wi-Fi Enhanced Open Deployment Guide v1.1 also recommends it on
non-EHT APs (Tables 3, 5, 6, 8).
Add a new sae_ext_key UCI option (enabled by default) that advertises
SAE-EXT-KEY, and FT-SAE-EXT-KEY when 802.11r is enabled, alongside
plain SAE/FT-SAE for the sae and psk-sae encryption modes.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/23009
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
parse_encryption() stashed a preliminary wpa_pairwise value in a
local wpa3_pairwise variable, cleared it per auth_type, then let a
switch default either copy it back or special-case wpa3-192. The
result was three separate places where wpa_pairwise was clobbered
and behavior that was awkward to trace when the explicit cipher
suffix (encryption[1]) and the auth_type disagreed.
Replace the scaffolding with a single block at the end of
parse_encryption() that only assigns wpa_pairwise via ??= when no
earlier branch (explicit cipher suffix, wpa3-192, or sae-compat)
has already set one:
no WPA -> null
60 GHz (hw_mode=ad) -> GCMP
HE or EHT htmode -> GCMP-256 CCMP
everything else -> CCMP
wpa3-192 now sets wpa_pairwise='GCMP-256' directly in its switch
case, so the final default block can stay short. No functional
change for existing encryption values.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/23009
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The rsn_override UCI number was scaffolding that let a Transition
Mode BSS (sae-mixed, wpa3-mixed) automatically overlay a WPA3
Compatibility-Mode-like layout: WPA3 AKMs were moved from the main
RSNE into RSNOE/RSNO2E, and with rsn_override=2 the main RSNE even
dropped SAE entirely to placate clients that refuse to associate to
a mixed AKM list.
This layout does not match any mode defined in the WPA3 and Wi-Fi
Enhanced Open Deployment and Implementation Guide v1.1: Transition
Mode (Table 5) advertises the full AKM list in a single RSNE, and
Compatibility Mode (§2.4, Tables 6 and 7) requires a specific
combination of RSNE, RSNOE and RSNO2E contents that the knob cannot
express. In practice it also triggers interop failures: Pixel 10
phones refuse to associate to a Transition-Mode BSS whose SAE-EXT-KEY
AKM has been shoved into RSNO2E by this scaffolding, even though the
same BSS works fine when the full AKM list stays in the main RSNE.
Keep the generated configuration honest by removing the knob; the RSN
override plumbing stays in place for a future caller that sets the
override fields explicitly. SAE-EXT-KEY advertisement will be added
back in a later commit via a dedicated sae_ext_key path that places
the AKM where the Deployment Guide actually requires it.
Drop the rsn_override schema entry and every wifi-scripts path that
read it:
* parse_encryption no longer diverts the WPA3 pairwise cipher
into rsn_override_pairwise.
* wpa_key_mgmt no longer mirrors WPA-EAP into
rsn_override_key_mgmt, moves SAE/SAE-EXT-KEY into the override
for psk-sae, or drops the main RSNE AKM list when
rsn_override > 1.
* generate() no longer back-fills missing rsn_override_* fields
from the main RSNE or duplicates the override element into an
MLO-gated RSNO2E.
The RSN override elements are now emitted only when each of
(rsn_override_key_mgmt, rsn_override_pairwise, rsn_override_mfp) --
and their _2 counterparts -- has been populated explicitly, which
keeps the machinery from firing on transition modes where it was
never spec-compliant.
Fixes: https://github.com/openwrt/openwrt/issues/21486
Fixes: https://github.com/openwrt/openwrt/issues/22200
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/23009
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
sae_require_mfp and sae_pwe are SAE-specific knobs but iface_auth_type()
set them on every auth type that requires PMF (sae, owe, eap2, eap192,
dpp) and on both PMF-optional transition modes (psk-sae, eap-eap2).
hostapd silently ignores the stray settings on non-SAE BSSes, but they
clutter the generated configuration and make it harder to tell at a
glance which knobs actually apply.
Split the grouping: keep ieee80211w (and rsn_override_mfp for transition
modes) where it was, and move sae_require_mfp / sae_pwe into a separate
check that only fires for the two auth types that actually run SAE (sae
and psk-sae).
No functional change on the air.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/23009
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Tightened from real bot reviews:
- Patch regeneration: spell out which make ... refresh command
to recommend for each patch directory class, so the bot stops
suggesting git format-patch for quilt-managed patches.
- Backports / cherry-picks: a backport's diff should match the
upstream commit on main verbatim; flag only deviations and
the missing (cherry picked from commit <sha>) trailer, not
pre-existing style issues.
- New device support: require Hardware specification, Flash
instructions, and MAC address layout sections in the commit
message that introduces a new device. Two reference commits
(986ca4c887, a2dcbd79a4) named so the bot can sample the
expected shape.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/23184
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Drop-in wrapper that calls the reusable LLM review workflows in
openwrt/actions-shared-workflows. Triggers on pull_request_target
(incl. PRs from forks), a nightly cron (03:00 UTC), and manual
workflow_dispatch with a max_prs input override.
A detect-kernels pre-step builds the extra_repos list at workflow
runtime: it reads target/linux/generic/kernel-* in the base branch
to derive gregkh/linux:v<X.Y.Z> tags for each currently-targeted
kernel, then appends u-boot/u-boot:master. The list updates
automatically when kernel versions are bumped; the routine clones
only the entries actually needed for a given diff.
The bundled .github/llm-review-rules.md teaches the bot two
project-specific deprecations to flag even when other in-tree files
still use the legacy form:
- LED label syntax `label = "<color>:<function>";` -->
`color = <LED_COLOR_ID_*>;` + `function = "<func>";`
- `mediatek,mtd-eeprom` for MAC sourcing -->
`nvmem-cells` + `nvmem-cell-names = "mac-address";`
Repository settings need LLM_ROUTINE_ID_PR / LLM_ROUTINE_TOKEN_PR
and the *_NIGHTLY counterparts populated before the workflow can
fire. See openwrt/actions-shared-workflows/docs/llm-review-setup.md
for the full setup procedure.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/23105
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Stop overriding CCACHE_COMPILERCHECK from rules.mk and rely on
ccache's default, which hashes the compiler binary's mtime and
size.
For a local tree that is enough: the toolchain only changes when
it is rebuilt, and a rebuild updates mtime and size. Users who
want a stricter check can still set CCACHE_COMPILERCHECK in their
environment.
CI does not depend on this export either. The workflow writes a
secondary ccache.conf with
compiler_check=string:<toolchain-commit-sha>
so the cache key is tied to the toolchain source revision. That
is both stricter than the previous "%compiler% -v -c" setting
and portable across runners, where compiler mtimes would not
match after restoring a cache archive.
Link: https://github.com/openwrt/openwrt/pull/22995
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This is based on version 1.0.93 plus these commits:
0ca689a fix: fetch base branch to ensure correct PR-only diffs
b7d533d fix: handle fork PRs by fetching via pull/N/head
Link: https://github.com/openwrt/openwrt/pull/22897
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
track_progress: true makes Claude post an initial comment immediately
when triggered and update it with a checklist as it works, so reviewers
can see what Claude is doing rather than waiting for a silent delay.
It also forces tag mode on PR/issue comment events, which is the
correct mode for interactive code review.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/22897
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Allow Bash(grep:*) so Claude can search the codebase for context
during PR reviews. Without this, grep calls using shell glob patterns
were denied even though plain directory greps were allowed.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/22897
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The workflow already uses contents: read which prevents GitHub from
accepting any push. The --disallowedTools setting adds a second layer
by stopping Claude from even attempting git write operations.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/22897
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The GitHub CI was sometimes still building some tools again even when
the same version was already pre-built. This change fixes the problem
and should improve the speed of the GitHub CI actions. The duration of
the "Build tools" step will be reduced from 5 to 20 minutes down to
10 to 15 seconds.
make also checks that dependencies are not more recent than the target
it wants to build. Previously find returned files in an arbitrary order
and touch set the current timestamp. Since touch is called per file the
timestamps differ in fractional seconds, so not all files got the same
time. make detected a more recent dependency and started to rebuild.
Now all files are set to the same timestamp and make will assume
everything is up to date.
It is sufficient to only touch the stamp files to prevent rebuilding.
Link: https://github.com/openwrt/openwrt/pull/22888
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
ELF binaries embed the maximum page size used during linking in the
PT_LOAD segment alignment. If this value is larger than the actual
system page size, the kernel will still load the binary but wastes
memory due to over-alignment. If it is smaller, the binary may fail
to load or cause incorrect behavior with features like RELRO.
Most architectures use 4KB pages, but loongarch64 uses 16KB pages
(CONFIG_PAGE_SIZE_16KB). Explicitly pass -z max-page-size to the
linker so that binaries are built with the correct page alignment for
the target, avoiding issues with RELRO segment padding and ensuring
correct memory mapping on the target system.
Before binutils 2.39 RELRO sections were padded to common page size
which is 4K on MIPS, with binutils 3.29 the padding was changed to
max page size which is 64K on MIPS. With this change we will pad them to
4K again.
This reduces the size of user space binaries in OpenWrt.
The size of the uncompressed root file system of a mips malta be build
decreased by about 20%.
old file size:
```
$ du -s build_dir/target-mips_24kc_musl/root-malta/
15844 build_dir/target-mips_24kc_musl/root-malta/
```
New file size:
```
$ du -s build_dir/target-mips_24kc_musl/root-malta/
12564 build_dir/target-mips_24kc_musl/root-malta/
```
The size of the image did not decrease much because of the strong
compression used by OpenWrt.
Link: https://github.com/openwrt/openwrt/pull/22800
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This version fixes some security problems:
* Client impersonation while resuming a TLS 1.3 session
(CVE-2026-34873)
* Entropy on Linux can fall back to /dev/urandom (CVE-2026-34871)
* PSA random generator cloning (CVE-2026-25835)
* Compiler-induced constant-time violations (CVE-2025-66442)
* Null pointer dereference when setting a distinguished name
(CVE-2026-34874)
* Buffer overflow in FFDH public key export (CVE-2026-34875)
* FFDH: lack of contributory behaviour due to improper input validation
(CVE-2026-34872)
* Signature Algorithm Injection (CVE-2026-25834)
* CCM multipart finish tag-length validation bypass (CVE-2026-34876)
* Risk of insufficient protection of serialized session or context data
leading to potential memory safety issues (CVE-2026-34877)
* Buffer underflow in x509_inet_pton_ipv6() (CVE-2026-25833)
Changelog: https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-3.6.6
Size increases by 470 bytes on aarch64:
343995 bin/packages/aarch64_generic/base/libmbedtls21-3.6.5-r1.apk
344465 bin/packages/aarch64_generic/base/libmbedtls21-3.6.6-r1.apk
Link: https://github.com/openwrt/openwrt/pull/22787
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Use a patched fork while waiting for
https://github.com/anthropics/claude-code-action/pull/963 to be
merged and released upstream.
Version v1.0.77 contains many improvments over 1.0.49 which was used
before. It uses Sonnet 4.6 instead of Sonnet 4.5.
Fixes: c0e75c9de6 ("github: add Claude code review workflow triggered by /claude comment")
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Modern gawk rejects C-style /* ... */ comments in AWK code, treating
them as regex patterns where '*' has nothing to quantify. Replace all
such comments with AWK-style '#' comments in lantiq_bdi_conf.awk and
lantiq_ram_init_uart.awk.
Also replace the pattern 'if (x) /* comment */ else action' which used
a C comment as a null statement with the equivalent 'if (!x) action'.
Fixes build error:
awk: error: ? * + or {interval} not preceded by valid subpattern
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/22458
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Without a prompt the action auto-detected mode: tag instead of agent
when triggered via issue_comment, resulting in no review being posted.
Remove the prompt so the action can correctly use its built-in agent
mode with full PR context.
Fixes: c0e75c9de6 ("github: add Claude code review workflow triggered by /claude comment")
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The claude-code-action uses mcp__github_ci__get_ci_status and related
tools to check workflow run status as part of the review. Without
actions: read the GitHub API calls for CI status are rejected.
Fixes: c0e75c9de6 ("github: add Claude code review workflow triggered by /claude comment")
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The whitelist was too restrictive, causing permission denials when
Claude tried to use basic tools like Read or Grep to analyse the diff.
Remove it and let the action use its default toolset.
Fixes: c0e75c9de6 ("github: add Claude code review workflow triggered by /claude comment")
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Add claude-code-review.yml using anthropics/claude-code-action@v1.
The review runs when a PR comment containing "/claude" is posted,
avoiding unnecessary API usage on every push.
Uses issue_comment trigger restricted to PR comments only. Only
triggers for users with write access (OWNER, MEMBER, COLLABORATOR)
and when the comment body contains "/claude", preventing any runner
from being allocated for unrelated comments. A short domain hint
steers the review toward OpenWrt embedded Linux conventions.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/22556
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Rename the patches folder too and also adapt the name in the toolchain menu.
Without changing the patches folder name the patches are not applied.
Fixes: adad973a9c ("toolchain: binutils: update to 2.45.1")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The device has 1 100MBit/s port. By default the PHY firmware is running
in 1GBit/s mode. The driver will try to load the 1GBit/s firmware and
fail if it is not there. Set the GPHY0 also to 100MBit/s mode.
The driver uses all nodes independent of the status attribute.
Do the same fix for AVM FRITZ!Box 7412 too.
Reported-by: Achelon in OpenWrt forum
Fixes: https://github.com/openwrt/openwrt/issues/21836
Link: https://github.com/openwrt/openwrt/pull/22188
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The key variable is not defined in the scope when setting wpa_psk. Use
config.key instead.
This fixes configuration the 64 characters wpa_psk directly.
Reported-by: donjoe in OpenWrt Forum
Link: https://github.com/openwrt/openwrt/pull/22182
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The configuration for the dlink,dir-1360-a1 also changed the settings
for the devices defined on top of it. "lan1 lan2 lan3 lan4" "wan" is
the default configuration, no need to add it here.
Fixes: 7a8e2efed5 ("ramips: add support for D-Link DIR-1360 A1")
Reported-by: schmars in IRC
Link: https://github.com/openwrt/openwrt/pull/22179
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
75bedc5 wireless-regdb: Update regulatory info for Australia (AU) for 2025
a6e5195 wireless-regdb: Update broken link in regulatory.bin(5) manpage
9e8c67f wireless-regdb: Update regulatory info for Malaysia (MY) for 2024
61a4637 wireless-regdb: Update regulatory info for Malaysia (MY) for 2025
5cefe55 wireless-regdb: Update regulatory info for Tunisia (TN) on 6GHz for 2025
1a729ae wireless-regdb: Update regulatory info for Canada (CA) for 2025
ea20dfa wireless-regdb: update regulatory database based on preceding changes
Link: https://github.com/openwrt/openwrt/pull/22150
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Hauke Mehrtens