This fixes the following security problems:
CVE-2025-14282: Avoid privilege escalation via unix stream forwarding in Dropbear server.
CVE-2019-6111: This allowed a malicious server to overwrite arbitrary local files.
This backports two upstream merged PRs:
https://github.com/mkj/dropbear/pull/391https://github.com/mkj/dropbear/pull/394
and this upstream commit:
48a17cff6a
Link: https://github.com/openwrt/openwrt/pull/21192
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 0f52a05723988633882d6c52122009ce11f8956b)
Currently its only possible to disable port forwarding only for specific
keys, via the OpenSSH-style restriction in `authorized_keys` file.
In some use cases it might be feasible to disable such features globally
on service level, so lets add new LocalPortForward and RemotePortForward
config knobs.
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Link: https://github.com/openwrt/openwrt/pull/21071
(cherry picked from commit 83f6177dbf44fa92ecf6d2e1cda9f92cfc5fe849)
[ fix conflict error ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 3c97c4a44cbeb767281f3260c1f6da4772432807)
A lot of recent commits in odhcpd main branch are structural/semantic
changes, so instead of adding those changes to 24.10 branch it's better
to focus on the fixes.
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
(cherry picked from commit 180646ce4b012c721e3cb33f9dca92e5234a739b)
b14cf98 router: log “Sending a RA on lan” at LOG_DEBUG
c2810fe odhcpd: update cmake file
8c2c065 odhcpd: convert README to markdown
3b96480 odhcpd: allow the use of an alternative cfg file
7328bfe odhcpd: remove confusing #defines
cdb9e5b odhcpd: improve RFC9096 § 3.5 SLAAC compliance
RFC9096 § 3.5 SLAAC compliance introduces a new config option (odhcpd
piofolder), which may wear out the flash under certain conditions (for
example: ISPs with dynamic IPv6 prefixes which disconnect the clients
every X hours).
Therefore, setting "dhcp.odhcpd.piofolder" to persistent storage in the
router flash is not advisable and should be set to other kinds of
persistent storage such as USBs, SDs, NVMEs...
In order to prevent wearing out the router flash it's set to ephemeral
storage by default (tmp):
uci set dhcp.odhcpd.piofolder="/tmp/odhcpd-piofolder"
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
(cherry picked from commit ea79b5875af8ead522050d16850264b01166e8a8)
(cherry picked from commit be32ab85cff01370da77ec88925edefa97ced1a7)
2859741d971e dhcpv4: store reqopts as uint8_t
6d342cc03bf7 odhcpd: add DNR (RFC 9463) support
c89b8b3f2ff3 odhcpd: make the IPv6 RA DNR lifetime configurable
066b3dc6ec1a netlink: fix a memory leak
171140e90b6a odhcpd: add a helper function for addr6/prefix parsing
5585b969c18f router: move pref64 calculations to the config stage
4308384748be dhcpv6: add ipv6 pxe support
6e1ad492cef5 router: replace ssize_t with size_t
Signed-off-by: David Härdeman <david@hardeman.nu>
Link: https://github.com/openwrt/openwrt/pull/20022
Signed-off-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
(cherry picked from commit a6da0e0d376bac4c75a3b1401bd52d49e608b891)
(cherry picked from commit 39510c21a0025b75240f32e37fa5f4fceb6570a3)
Make sure that the package gets updated after the last fix.
Fixes: 9d83c1b1a9d4 ("uqmi: fix data-format parsing")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 0203ef3fc95bb1745418be90b30ee400b72108c2)
(cherry picked from commit de44a349084af8481aa5f67ceacf424e06b0a166)
wda-get-data-format now returns an object instead of a single string.
Account for this change when reading the packet data format.
Suggested-by: Sebastian Ertz (https://github.com/sebastianertz)
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit cd20ae44f22d7a10d3522ad94894ca34828fa163)
(cherry picked from commit 9d83c1b1a9d4991958870b247552551661af4c3b)
Allow initially generated MAC address to be preserved across reload
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit 5bdb7a59906ee71d0178f78c4b3ce4c4ff4bb4e0)
(cherry picked from commit 76eb96c875fce2f8b83f3e2a7a675aade308c5c9)
Current PKG_MIRROR_HASH is wrong, but it went unnoticed, because the
tarball is being fetched from @OPENWRT project mirrors. Can be
reproduced with:
make package/ebtables/{download,check} FIXUP=1 DL_DIR=/tmp PKG_MIRROR_HASH=''
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Link: https://github.com/openwrt/openwrt/pull/20322
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 7d4edb21b62a84a3a9442263b3080c3d443e12f7)
(cherry picked from commit 0d3076aa19a0f5ebdaa63abb30864cebafbb16bf)
This reverts commit e26e856459.
From release 24.10 we always use wifi-scripts and netifd doesn't ship
netifd-wireless.sh anymore.
When wifi-scripts is selected, the netifd install fails as it can't find
the local script to remove.
To fix it, drop the workaround entirely.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Make it possible to use wifi-scripts for initial wireless
autoconfiguration without netifd as we can't have netifd enabled in the
system, since it would clash with prplWare stack.
Signed-off-by: Petr Štetiar <petr.stetiar@prplfoundation.org>
Adapt mac80211.uc script to prpl0S default name and add guest interface
default config following prplOS mainline modification.
References: PCF-1428
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
This patch was upstreamed and is now available in the currently used 20242.86 version of dropbear.
For this reason we can remove the patch from prplos.
Signed-off-by: Matthias Franck <matthias.franck@softathome.com>
A feed might provide the new wifi-scripts package that moved the wifi
script files to a dedicated package.
Add support for this by tweaking netifd package and check if
wifi-scripts is getting compiled. In such case, remove the netifd
file in favor of feed package.
Signed-off-by: John Crispin <john@phrozen.org>
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
[ this is V1 of the patch as a interim solution before V2 is submitted
upstream and eventually merged ]
For Multi-AP traffic separation requirement, wpa_supplicant parses
802.1Q Multi-AP sub-element and reports:
- VLAN ID of the AP it connects to.
- Multi-AP profile of the AP it connects to.
Closes: PCF-1538
Upstream-Status: Denied [https://patchwork.ozlabs.org/project/hostap/patch/DM4PR19MB6173508761EFFA0E7E366CD8A88E2@DM4PR19MB6173.namprd19.prod.outlook.com/#3434833]
Signed-off-by: Jurijs Soloveckis <jsoloveckis@maxlinear.com>
Signed-off-by: Igor Plesser <i.plesser@inango-systems.com>
Signed-off-by: Maarten De Decker <maarten.dedecker@mind.be>
Signed-off-by: Petr Štetiar <petr.stetiar@prplfoundation.org>
When the DHCPv6 client sends a DHCPv6 Solicit with both IA_NA and IA_PD
options, and if the server replies with a status code = NoAddrsAvailable
in the IA_NA option, then currently the DHCPv6 client sends a new
Solicit with only the IA_PD option despite the fact that a prefix was
sent by the server in the previous Advertise.
This behavior is described in
https://datatracker.ietf.org/doc/html/rfc7550#section-4.2
The client must handle the case of a server that does not offer both
valid IA_NA and IA_PD options when both are requested, according to RFC
7550. It should not send a new Solicit, but a Request. The client should
however ignore the Advertise message if none of the IA_NA and IA_PD
options are offered by the server.
References: PCF-1390
Signed-off-by: Matthias FRANCK <matthias.franck@softathome.com>
According to TR181, setting the RSEnable parameter to false should result in no router solicitation messages to be sent from the interface. This seems not the case, the messages are always seen regardless of the parameter value.
To solve this patch odhcp6c to not automatically sends Router Sollicitations as well.
This patch should be properly reworked to make it upstreamable. This progress is tracked in PCF-950
(cherry picked from commit 0f87c3f5a34f85c24e33c174a3baf26df1773056)
Dropbear currently only supports binding on IP addresses and not on
interface bounding. Problem with the IPv4 address binding is that
dropbear needs to restart each time you get a new IP address, breaking
current connections.
Upstream-Status: Merged [https://github.com/mkj/dropbear/pull/229]
Signed-off-by: Diederik De Coninck <diederik.deconinck_ext@softathome.com>
Signed-off-by: Matthias FRANCK <matthias.franck_ext@softathome.com>
Signed-off-by: Petr Štetiar <ynezz@true.cz> [patch refresh]
(cherry picked from commit cf92a90cc7f0f660048366c12fdde870b0c41850)
To translate the logical interface name (e.g. lan) to the physical name (e.g. br-lan)
- first odhcpd will look in /etc/config/dhcp for dhcp.lan.ifname or dhcp.lan.networkid
- then, if compiled with WITH_UBUS, odhcpd will look at /etc/config/network and the interface name is overruled even if not found
This patch should be upstreamed. This is tracked in PCF-951.
Signed-off-by: Matthias FRANCK <matthias.franck_ext@softathome.com>
(cherry picked from commit be95bc06b69d27e53528edc99898fc80c6362ac0)
For now services and hosts are not linked, umdns need to be modified to allow that link witch is required by tr181
This patch should be upstreamed, this progress is tracked in PCF-952.
Signed-off-by: Matthias FRANCK <matthias.franck_ext@softathome.com>
(cherry picked from commit 637e7e319dcace9c5411b407f2a967b4ff6cce33)
Correctly load the list of basic_rates from UCI. basic-rates shall be
stored as a option-list. The current code did not retrieve this list
correctly.
wpa_supplicant uses a different config option to set basic-rates
when operating in mesh-mode.
Use the correct config key and calculation for mesh-interfaces.
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit a854d833eabdbc3b42065927c136d75b981a1021)
hostapd_neighbor_set_own_report is normally called from interface setup only.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit 985005219020ac1446e28217bfdd7a0a7a7a59d0)
Ensure that hapd->own_addr is set properly, since hostapd_setup_bss
only handles it for secondary BSS interfaces
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit 3ebf11071159d8b2d238cfd19cadad85059fe7e3)
61ae5732adea iprule: amend ipproto netlink nla_put_u32 to nla_put_u8
d610d68c71b8 device: add support for configuring vrf
a1b6386a20a6 device: fix bonding primary port selection
e8bbf246ce2e system-linux: fix sysfs name for all_ports_active flag
723c699e84f4 Restore disable_ipv6 sysctl after removing a device from bridge or bond
d476e18e8d43 iprule: resolve ipproto by name
7901e66c5f27 netifd: iprule add sport and dport
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 15c2ca0a834752cc9505751fc6d2f51861d34dfd)
Link: https://github.com/openwrt/openwrt/pull/19125
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
lldpd can send several hardware inventory TLV fields. Extend the init
script to provide these when the existing flag 'lldpmed_no_inventory' is
disabled. Five new methods provide default values for some of them,
taken from /etc/os-release and /etc/board.json.
There is no homogeneous method to determine the hardware serial number,
so it can be provided manually, as can asset ID.
Note: properties >= 32 characters are truncated at send time (by lldpd),
and some (Cisco) equipment displays junk after strings >= 32 characters.
So truncate to 31.
Tested on: 24.10.0 (known compatible with 22 and 23 also)
===
Example
===
The following lldpd config lines:
configure inventory hardware-revision "v0"
configure inventory software-revision "r28427-6df0e3d02a"
configure inventory firmware-revision "OpenWrt 24.10.0"
configure inventory serial-number "ABCDEF-123456"
configure inventory manufacturer "glinet"
configure inventory model "GL.iNet GL-MT6000"
# 32 characters:
configure inventory asset "abcdefghijklmnopqrstuvwxyz 12345"
Produce the following TLV (decoded by Wireshark):
Telecommunications Industry Association TR-41 Committee - Inventory - Hardware Revision
1111 111. .... .... = TLV Type: Organization Specific (127)
.... ...0 0000 0110 = TLV Length: 6
Organization Unique Code: 00:12:bb (Telecommunications Industry Association TR-41 Committee)
Media Subtype: Inventory - Hardware Revision (0x05)
Hardware Revision: v0
Telecommunications Industry Association TR-41 Committee - Inventory - Firmware Revision
1111 111. .... .... = TLV Type: Organization Specific (127)
.... ...0 0001 0011 = TLV Length: 19
Organization Unique Code: 00:12:bb (Telecommunications Industry Association TR-41 Committee)
Media Subtype: Inventory - Firmware Revision (0x06)
Firmware Revision: OpenWrt 24.10.0
Telecommunications Industry Association TR-41 Committee - Inventory - Software Revision
1111 111. .... .... = TLV Type: Organization Specific (127)
.... ...0 0001 0101 = TLV Length: 21
Organization Unique Code: 00:12:bb (Telecommunications Industry Association TR-41 Committee)
Media Subtype: Inventory - Software Revision (0x07)
Software Revision: r28427-6df0e3d02a
Telecommunications Industry Association TR-41 Committee - Inventory - Serial Number
1111 111. .... .... = TLV Type: Organization Specific (127)
.... ...0 0001 0100 = TLV Length: 20
Organization Unique Code: 00:12:bb (Telecommunications Industry Association TR-41 Committee)
Media Subtype: Inventory - Serial Number (0x08)
Serial Number: ABCDEF-123456
Telecommunications Industry Association TR-41 Committee - Inventory - Manufacturer Name
1111 111. .... .... = TLV Type: Organization Specific (127)
.... ...0 0000 1010 = TLV Length: 10
Organization Unique Code: 00:12:bb (Telecommunications Industry Association TR-41 Committee)
Media Subtype: Inventory - Manufacturer Name (0x09)
Manufacturer Name: glinet
Telecommunications Industry Association TR-41 Committee - Inventory - Model Name
1111 111. .... .... = TLV Type: Organization Specific (127)
.... ...0 0001 0101 = TLV Length: 21
Organization Unique Code: 00:12:bb (Telecommunications Industry Association TR-41 Committee)
Media Subtype: Inventory - Model Name (0x0a)
Model Name: GL.iNet GL-MT6000
Telecommunications Industry Association TR-41 Committee - Inventory - Asset ID
1111 111. .... .... = TLV Type: Organization Specific (127)
.... ...0 0010 0011 = TLV Length: 35
Organization Unique Code: 00:12:bb (Telecommunications Industry Association TR-41 Committee)
Media Subtype: Inventory - Asset ID (0x0b)
Asset ID: abcdefghijklmnopqrstuvwxyz 1234
The Cisco DUT displays:
Hardware Revision: v0
Firmware Revision: OpenWrt 24.10.0
Software Revision: r28427-6df0e3d02a
Serial Number: ABCDEF-123456
Manufacturer Name: glinet
Model Name: GL.iNet GL-MT6000
Asset ID: abcdefghijklmnopqrstuvwxyz 1234
Signed-off-by: Paul Donald <newtwen+github@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/18354
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 412c850f07285643a444815ca20d0bbb2afec17e)
Link: https://github.com/openwrt/openwrt/pull/18469
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Some modems and SIM cards take a bit longer to initialize after UIM has been
powered off. Waiting too little time can cause the qmi protocol to end up
in a loop repeatedly power-cycling the SIM card.
Avoid that by
a) increasing the time we unconditionally sleep after --uim-power-on
b) increasing the time we allow uqmi to wait for response for --uim-get-sim-state
Signed-off-by: Antti Seppälä <a.seppala@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/18772
(cherry picked from commit d63663601de4feb2b7a049c9b0901f10e79496cb)
Signed-off-by: Felix Baumann <felix.bau@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/18965
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Group 'local' declarations and 'json_get_vars', sort alphabetically within groups, and split off more generic parameters.
- delegate and sourcefilter were not declared as local variables
Signed-off-by: Leon M. Busch-George <leon@georgemail.eu>
(cherry picked from commit bf768867dc0eea6b51d2db90a8f1380cc52529c1)
Signed-off-by: Felix Baumann <felix.bau@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/18965
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
For WIFI7 devices (such as mt7925e), the dev width is currently
always "20 MHz (no HT)" in monitor mode.
Add EHT and HE160 support to iw_htmode to fix this issue.
Additionally, the following changes are made:
1. Set iw_htmode to 160MHz for VHT160. The reason for the current
VHT160 setting is unclear and seems to have been in place for
over a decade (ibss_htmode [1]). If anyone knows its impact,
please inform me so I can restore it.
2. Modify MHZ to MHz. The original matching table in the current
iw tool uses MHz. Although the match is case-insensitive,
correcting this won't hurt.
[1]: 768d09be87
Signed-off-by: Ming Kuang <ming@imkuang.com>
Link: https://github.com/openwrt/openwrt/pull/18319
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 86eb1c0b5add1e0b493b25508c45b2df9d722c78)
Do not verify the format of TLV. Leave that to lldpd.
These lldpd config entries:
config custom-tlv
list ports 'eth0'
option tlv 'replace oui 33,44,55 subtype 254 oui-info 55,55,55,55,55'
config custom-tlv
option tlv 'oui 33,44,44 subtype 232'
list ports 'br-lan'
list ports 'eth0'
config custom-tlv # oui-info truncated
option tlv 'add oui 33,44,33 subtype 66 oui-info 5555555555'
config custom-tlv
option tlv 'add oui 33,44,31 subtype 44'
config custom-tlv # invalid oui
option tlv 'add oui 3322 subtype 79'
config custom-tlv # invalid oui
option tlv 'oui 3312 subtype 74'
Produce the following lldpd.conf content:
configure ports eth0 lldp custom-tlv replace oui 33,44,55 subtype 254 oui-info 55,55,55,55,55
configure ports br-lan,eth0 lldp custom-tlv oui 33,44,44 subtype 232
configure lldp custom-tlv add oui 33,44,33 subtype 66 oui-info 5555555555
configure lldp custom-tlv add oui 33,44,31 subtype 44
configure lldp custom-tlv add oui 3322 subtype 79
configure lldp custom-tlv oui 3312 subtype 74
And lldpd (v1.0.13 on v22) logs the following:
Sat Mar 16 19:11:39 2024 daemon.info lldpd[10916]: custom TLV op replace oui 33:44:55 subtype fe
Sat Mar 16 19:11:39 2024 daemon.info lldpd[10916]: custom TLV op add oui 33:44:44 subtype e8
Sat Mar 16 19:11:39 2024 daemon.info lldpd[10916]: custom TLV op add oui 33:44:33 subtype 42
Sat Mar 16 19:11:39 2024 daemon.info lldpd[10916]: custom TLV op add oui 33:44:33 subtype 42
Sat Mar 16 19:11:39 2024 daemon.info lldpd[10916]: custom TLV op add oui 33:44:31 subtype 2c
Sat Mar 16 19:11:39 2024 daemon.info lldpd[10916]: custom TLV op add oui 33:44:31 subtype 2c
Sat Mar 16 19:11:39 2024 daemon.warn lldpcli[10915]: invalid OUI value '3322'
Sat Mar 16 19:11:39 2024 daemon.info lldpcli[10915]: an error occurred while executing last command
Sat Mar 16 19:11:39 2024 daemon.warn lldpcli[10915]: invalid OUI value '3312'
Sat Mar 16 19:11:39 2024 daemon.info lldpcli[10915]: an error occurred while executing last command
Sat Mar 16 19:11:39 2024 daemon.info lldpcli[10915]: lldpd should resume operations
( The last two TLV are invalid: their oui must be three hex bytes, comma
separated. Only the first hex byte of oui-info 5555555555 is used )
Depends on #14867 and its release version bump
Tested on: 22.03.6
Signed-off-by: Paul Donald <newtwen+github@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/14872
(cherry picked from commit 8d1fe32c2c46a8de519f9926be2bc062cef66f24)
Link: https://github.com/openwrt/openwrt/pull/18343
Signed-off-by: Robert Marko <robimarko@gmail.com>
where csv = comma separated value(s)
Make the function more generic. Can use it for not only 'config'.
Now it can be used to parse interfaces for additional lldpd settings,
e.g. custom-tlv.
Tested on: 22.03.6
Signed-off-by: Paul Donald <newtwen+github@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/14872
(cherry picked from commit a015f59880c72a1bdd07de32491f85ce7f8d2a1c)
Link: https://github.com/openwrt/openwrt/pull/18343
Signed-off-by: Robert Marko <robimarko@gmail.com>
d8b43985e4d7 ubus: fix token_create policy
7326459bd743 ubus: dump service information on network_get
6c9c8fbd8128 service: add @all as alias for all members, unless defined differently
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit 84909c62c8455a08fb8bb29bd7809ab22c927bf0)
`ucv_array_set` releases the array's reference to the object being cleared.
If this is the last reference to the object, it will be freed, making our
pointer `val` invalid.
To avoid this, we need to obtain our own reference to the object so we
can safely return `val`.
Signed-off-by: Matthew Cather <mattbob4@gmail.com>
(cherry picked from commit 6a10da2934441a59283394a84917edf4983e3043)
Since `wpa_ucode_registry_add` collects its own reference to the values added, the
two functions `hostapd_ucode_bss_get_uval` and `hostapd_ucode_iface_get_uval` would
sometimes return a referenced object (from `uc_resource_new`) and sometimes return
an unreferenced object (from `wpa_ucode_registry_get`). Now, both functions always
return a referenced object.
This change also indirectly fixes `hostapd_ucode_bss_get_uval`, ensuring it now
always returns a referenced object.
Signed-off-by: Matthew Cather <mattbob4@gmail.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit 7729f960933a03c9eebd2b65a695ea57718ccb77)
Remove extra ucv_get calls when passing a referenced value to an object
without using it further.
Signed-off-by: Matthew Cather <mattbob4@gmail.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit 22eaf1864731dd29918357b26565dbd9420fd314)
This fixes a common reference counting bug typically along the lines of:
```
uc_value_push(ucv_get(ucv_string_new(...)));
```
This would leave our new string with a reference count of 2, one from
the construction of the string, the other from `ucv_get`. This would
prevent the strings from being correctly cleaned up when it goes out
of scope.
Signed-off-by: Matthew Cather <mattbob4@gmail.com>
(cherry picked from commit f79968ee0f76c41414fb0c08980b9c2a259964d3)
75a236be122a service: add missing null pointer check
f5341f327539 ubus: add api for generating and validating security tokens
3fab99eab4d5 add udebug support
28d86bd30e97 pex: only respond to update requests when we have network data
8e6f37cc361e pex-msg: ignore no-data responses if version is zero
12e6cf7f63e1 pex: create pex host from update responses
edc8fdae463a ubus: show the local addresses in network status
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit ce68f61cb67a4701a108f838f510e72ca63ed78e)
