Integrates following changes:
* 03fd769fd genEvt: ensure wds station seen and auth before assuming connection
* e628fbb44 genEvt: assume deauthTx and disassocTx as disconnection events
* 45e811b66 genVap: detect disconnected station when getting single station stats
* 1c1a40cfd nl80211: fix retcode when station entry is not found
References: PPW-1523
Signed-off-by: prplbot <bot@prplfoundation.org>
Integrates following changes:
- b604e81: ("odl: correct version information for Security.Certificate", 2026-07-30)
References: PPW-2233
Signed-off-by: Jen Freeman <jen.freeman@consult.red>
signed-off-by: Hela Saadani <hela.saadani_ext@softathome.com>
Component jobs currently inherit the full-tier 85-minute timeout.
Measured runs peak at 35.8 minutes for components and 80.8 minutes for
the full tier.
Set each tier to the smallest five-minute multiple at least four
minutes above its maximum observed duration. This gives component jobs
40 minutes and retains 85 minutes for full jobs.
Keep the full-job limit explicit because those jobs would otherwise
inherit the new component limit. A hung component job now releases its
device roughly 45 minutes sooner.
Assisted-by: claude:opus-5:orchestrator
Assisted-by: codex:gpt-5.6-sol:medium-fast
References: CI-7
Signed-off-by: Petr Štetiar <petr.stetiar@prplfoundation.org>
run_check reports a failed command by expanding its complete argument
list. A full Freedom cram run carries about 199 test paths, producing
one roughly 13,000-character log line that obscures the actual failure.
The test arguments form a contiguous .t suffix. Count and replace only
that suffix with `(N tests)` in failure diagnostics, leaving the command
head and non-test invocations unchanged. Keep executing the original
arguments and preserve status and sentinel handling.
Cram's --verbose job output still lists each test path and result. The
component resolver continues to emit the selected path list used by the
job.
Assisted-by: claude:opus-5:orchestrator
Assisted-by: codex:gpt-5.6-sol:medium-fast
References: CI-7
Signed-off-by: Petr Štetiar <petr.stetiar@prplfoundation.org>
The LCM bridge carrier reflects whether its container-side port is
live. Split execution can inspect it before the LCM suite tears that
state down, so the bridge can appear either live or without carrier.
Carrier state is not the route line's only variable part: ip route
also emits a trailing separator. Account for that separator after the
optional linkdown flag so both carrier states match.
Accept both observed route and link forms in every board's copy of the
affected expectations while keeping every address, interface
attribute, and the carrier-to-state pairing constrained.
Assisted-by: codex:gpt-5
Assisted-by: claude:opus-5:orchestrator
Assisted-by: codex:gpt-5.6-sol:medium-fast
References: CI-7
Signed-off-by: Petr Štetiar <petr.stetiar@prplfoundation.org>
The split prplos bucket reaches the discovery assertions sooner than the full suite and can observe an empty first root device.
Poll for the first root-device UUID for at most one minute before retaining the existing parameter assertions unchanged.
Assisted-by: codex:gpt-5
References: CI-7
Signed-off-by: Petr Štetiar <petr.stetiar@prplfoundation.org>
The data-model-mapper sibling test installs its package at runtime and creates Device.X_PRPLWARE-COM_SoftwareModules. The generic inventory must not depend on that sibling side effect.
Filter the mapper-only element following the cellular detachment precedent in e342d300. The mapper test continues to exercise the element in the LCM bucket.
Assisted-by: codex:gpt-5
References: CI-7
Signed-off-by: Petr Štetiar <petr.stetiar@prplfoundation.org>
Component jobs start automatically whenever CRAM_COMPONENTS selects
them, and the variable defaults to prplos. Every merge-request pipeline
therefore schedules six hardware jobs whether or not anybody needs
them, and the bucket choice is fixed before the pipeline exists. The
non-DUT manifest lint also starts automatically in non-scheduled
pipelines.
Testbed time is the scarce resource, and the build test jobs feeding
these DUT jobs are already manual in merge-request pipelines. The
natural flow is to pick buckets after a build finishes, not at
pipeline creation. The lint should follow the same opt-in flow.
Drop the CRAM_COMPONENTS default and add trailing manual rules so every
component job and the lint appear as optional play buttons in
non-scheduled pipelines. Manually started jobs never gate the pipeline
result. With no opt-in variable or release-tag override, no cram-related
job at all, lint included, starts automatically.
Setting CRAM_COMPONENTS still starts the listed buckets automatically
with each board's existing blocking behavior. The automatic full run in
prplware release tag pipelines is unchanged.
Assisted-by: claude:fable-5
References: CI-7
Signed-off-by: Petr Štetiar <petr.stetiar@prplfoundation.org>
The component manifest lint currently runs only during local validation.
Merge requests get no feedback when new tests silently enter the prplos
remainder.
Add a non-DUT manifest coverage job to every pipeline. Fetch an MR base
when needed and pass it to the lint. Newly-in-remainder warnings then
appear in job output.
Give the job explicit rules: a job without rules keeps the legacy
branches-and-tags default and is never created in merge-request
pipelines, the exact place the diff-base comparison exists for. Skip
scheduled pipelines, which carry no cram work.
Use the digest-pinned testbed v1.3.0 image for Python, YAML, and git. The
MR diff-base comparison requires runtime git for cat-file, fetch, and the
lint script's child processes.
The image runs as the testbed user while the runner checkout has a
different owner. Git otherwise rejects the checkout before lint starts:
```text
fatal: detected dubious ownership in repository at
'/builds/prpl-foundation/prplos/prplos'
```
Pass a safe.directory override for CI_PROJECT_DIR through Git's inherited
configuration environment. Print the selected MR diff base so the
comparison path remains visible in job evidence. Add no hardware runner
tags or build dependencies.
Assisted-by: codex:gpt-5
Assisted-by: claude:fable-5
References: CI-7
Signed-off-by: Petr Štetiar <petr.stetiar@prplfoundation.org>
The hardware cram jobs currently run each board's complete suite. Every
automatic pipeline therefore consumes coverage that can be selected more
cheaply by component.
Add a runtime component template so test collection happens in cram's
checkout and environment. Replace each legacy board job with four static
full, prplmesh, lcm, and prplos jobs selected through the
comma-separated CRAM_COMPONENTS variable.
Name each job `cram <board> [<component>]` and include the selected
component in the expandable test-execution section title.
Move the MXL-specific cram skip from the legacy job-name token. Use the
stable DUT board identifier instead.
Preserve skip behavior under the compact OSPv2 name.
Default automatic pipelines to prplos. Start the full jobs
automatically in prplware release tag pipelines, whose build jobs also
run automatically. Keep cram jobs out of scheduled pipelines entirely,
as with the legacy suite: schedules never create the build jobs these
jobs need, so any selected cram job would fail scheduled pipeline
creation with an unsatisfiable needs reference. Keep the test command,
post suite, timeout, run_check, and JUnit filenames unchanged.
Assisted-by: codex:gpt-5
Assisted-by: claude:fable-5
References: CI-7
Signed-off-by: Petr Štetiar <petr.stetiar@prplfoundation.org>
The computed prplos remainder keeps existing tests covered, but it can
also hide accidental classification of newly added tests. Stale or
overlapping component globs can likewise make split jobs unreliable.
The sanity set adds another strict boundary: a sanity test must not also
belong to an explicit component bucket.
Add a location-agnostic lint using the shared bucketing implementation.
Validate the schema, glob coverage, and sanity and explicit-component
exclusivity. Check the reserved smoke and hardware-only sets. Include
sanity in the reported bucket counts. Accept either a Git ref or a file
list as the baseline for newly-in-remainder warnings. Report missing
targets for tracked test symlinks without failing the otherwise valid
manifest.
Assisted-by: codex:gpt-5
References: CI-7
Signed-off-by: Petr Štetiar <petr.stetiar@prplfoundation.org>
The legacy cram suite repeats nested directories to run setup-sensitive
tests early. Component jobs need the same ordered and deduplicated file
list without embedding repository locations in the CI configuration.
Some DUT and environment checks also need to run before every split
component because their failure invalidates the rest of that job.
Add a reserved sanity set and the lcm and prplmesh manifest buckets,
keeping prplos as the computed remainder. Remove sanity matches before
partitioning the other tests, and prepend the ordered sanity block when
resolving any split component. Keep full-suite resolution unchanged and
allow the sanity block to be resolved directly for inspection.
Add a shared collector which preserves cram 0.7 traversal and
first-occurrence deduplication. Retain broken test symlinks so
pre-existing tree defects cannot crash list resolution.
Assisted-by: codex:gpt-5
References: CI-7
Signed-off-by: Petr Štetiar <petr.stetiar@prplfoundation.org>
Upgrade iperf3 to a version that includes fixes for the CVEs identified
by the BlackDuck security scan.
Resolved vulnerabilities:
- CVE-2024-53580: DoS vulnerability (HIGH)
- CVE-2025-54349: Off-by-one heap overflow in authentication (MEDIUM)
- CVE-2025-54350: Security issue resolved by upstream release
- CVE-2025-54351: Buffer overflow in UDP MSG_TRUNC/zerocopy path (HIGH)
References: PPW-2137
Signed-off-by: FAOUZI YAHYA <faouzi.yahya_ext@softathome.com>
Changes made in this commit f694f20d9b were undone by this one 8b7913caef causing an issue with the builds
the goal of this MR is to restore that change
References: PCF-2730
Signed-off-by: Hela Saadani <hela.saadani_ext@softathome.com>
Upstep Botan from 2.19.4 to 3.12.0 to address vulnerabilities
reported by the BlackDuck scan on the Fast Track platforms.
The update covers the reported CVEs that are fixed in newer Botan releases:
CVE-2026-32877 / BDSA-2026-5921, fixed in Botan 3.11.0
CVE-2026-32884 / BDSA-2026-5922, fixed in Botan 3.11.0
CVE-2024-39312 / BDSA-2024-4197, fixed in Botan 3.5.0 and 2.19.5
CVE-2024-34702 / BDSA-2024-4196, fixed in Botan 3.5.0 and 2.19.5
References: PPW-2051
Signed-off-by: Matthias Franck <matthias.franck@softathome.com>
The packages feed revision bumped by this alignment moves hwdata from
0.387 to 0.407. Its pci.ids now carries a name for 17cb:0308, so lspci
reports "SDX61/SDX62/SDX65 [Snapdragon 5G X6X-series]" where it used to
fall back to "Device 0308".
References: PPW-1773, PPW-2138, PPW-1785
Signed-off-by: Alexandre Fiset <alexandre.fiset@softathome.com>
Some default config options in the curl package changed, so let's align the tests accordingly.
See:
f693e556aca9bd8f6f58b087bf18412dbe2c0008
References: PPW-1773, PPW-2138, PPW-1785
Signed-off-by: Matthias Franck <matthias.franck@softathome.com>
Manually update the PCS driver with new proposed upstream version. This
can't be normally cherry-picked from main branch as main branch now use
standalone PCS feature that is problematic to port for very old kernel
(6.6)
Link: https://github.com/openwrt/openwrt/pull/24263
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 443ec4032a78cbeb52c5761b7702033904fa6a11)
changelog: https://salsa.debian.org/debian/ca-certificates/-/blob/master/debian/changelog
* Remove ca-certificates-local example (closes: #988912, #1127101).
* Update Mozilla certificate authority bundle to version 2.86
The following certificate authority was added (+):
+ e-Szigno TLS Root CA 2023
The following certificate authorities were removed (-):
- QuoVadis Root CA 2
- QuoVadis Root CA 3
- DigiCert Assured ID Root CA
- DigiCert Global Root CA
- DigiCert High Assurance EV Root CA
- SwissSign Gold CA - G2
- SecureTrust CA
- Secure Global CA
- COMODO Certification Authority
- Certigna
- certSIGN ROOT CA
- AffirmTrust Commercial
- AffirmTrust Networking
- AffirmTrust Premium
- AffirmTrust Premium ECC
- TeliaSonera Root CA v1
- Entrust Root Certification Authority - G2
- Entrust Root Certification Authority - EC1
- Trustwave Global Certification Authority
- Trustwave Global ECC P256 Certification Authority
- Trustwave Global ECC P384 Certification Authority
- GLOBALTRUST 2020
- GTS Root R2
- FIRMAPROFESIONAL CA ROOT-A WEB
The following certificate authority was renamed (~):
~ "OISTE Server Root RSA G1" (removed leading space)
Signed-off-by: Fengyu Wu <saldry@proton.me>
Link: https://github.com/openwrt/openwrt/pull/23675
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
(cherry picked from commit 8aaa8d401308d32806c080aab458c3f08208cbf0)
(cherry picked from commit 8b29bf400569335f27e6ebac22f68c5b3254238f)
The ccache build relies on doctest, which
is useless and can be disabled.
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
Link: https://github.com/openwrt/openwrt/pull/17700
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 08ebb9e91401416e8c8fa0519ab431d7df4c2b2c)
(cherry picked from commit 0c5fe133b3d134b8c251ef61932d29555dd50bba)
This fixes multiple bugs, some might be security relevant.
Link: https://github.com/openwrt/openwrt/pull/24330
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit b421c63071dc56dd9a2aab2b26dee23bc7eb677f)
Enable the busybox feature to save shell command history.
(.apk size increase 0.5 kB)
To prevent flash wear,
* save history only at the exit from a shell session, and
* set /tmp as the default location for the history file. The history
is kept on ramdisk until a reboot, when the history is then lost.
If the user wants to save history onto flash, he can change the location
definition in /etc/profile.d/busybox-history-file.sh
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
Link: https://github.com/openwrt/openwrt/pull/17179
cherry picked from commit e23b37b2d9a2e766b1ad151f59a04eb68b6a3341)
[ fix conflict error ]
Signed-off-by: Andrey Zotikov <andrey.zotikov@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23634
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 26471f32b5b8a3f5d9ccd432083eaf42a0f04cef)
This fixes multiple bugs, some might be security relevant.
Link: https://github.com/openwrt/openwrt/pull/24258
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit b9ad54db42ddf79335f5224a5ad612cb8389028a)
This cherry picks the following changes:
- Security: server: Fix ability to bypass an authorized_keys "forced_command"
option by an authenticated user, if Dropbear is running with "-t" option.
("-t" is require both password and public key).
c60db64081
Reported by Jeremy Brown
- Security: server: Open authorized_keys non-blocking. This avoids getting stuck
with special files, could allow denial of service from local users.
8b579571b5
Reported by Turistu
- Security: scp: Add missed patch to fix CVE-2019-6111 allowing a malicious server
to overwrite unexpected files.
143291baca
Patch from OpenSSH, reported missing by Asim Viladi Oglu Manizada @manizada
Note breaking change: "-r" is now disallowed when the target directory exists
(an additional change in Dropbear's version). If that's required an alternative
such as rsync could be used.
61bd0e3e65
- Security: scp: Clear setuid/setgid bits on received files.
443ccc1fd1
Patch from OpenSSH, tracked as CVE-2026-35385
- Security: client/server: Fix close() of a file descriptor from an out-of-bounds
read. This seems difficult to exploit but may have unforeseen effects.
067fd3846c
Reported by Ankit Singh and @j499261162
Link: https://github.com/openwrt/openwrt/pull/23980
(cherry picked from commit 2218cb19494609076776ae8c13254de60c5f40f3)
Link: https://github.com/openwrt/openwrt/pull/24296
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 262c09368fda76c85c519b7554f33bb98fb3263f)
This fixes the following security isseus with CVE numbers:
CVE-2026-55614: GHSA-mcfg-c4r7-pjpf — case-sensitive Transfer-Encoding matching
CVE-2026-55612: GHSA-p55c-rmhc-qfm5 — invalid chunk-length state reset
CVE-2026-55613: GHSA-wgwp-64hh-f52p — ubus POST body parse-error desync
The branch also carries hardening with no CVE: one-byte overflow in
uh_urldecode, off-by-one OOB read in uh_b64decode, constant-time
password compare, $p$ crypt-hash handling.
Link: https://github.com/openwrt/openwrt/pull/24259
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit f68fa732873c280f290f16aef32b3240c790b390)
Cherry pick the patches recommended in the hostapd security advisory
2026-1:
https://w1.fi/security/2026-1/missing-ml-parsing-validation.txt
Vulnerability
Vulnerabilities in parsing and use of received multi-link (MLO/EHT/IEEE
802.11be/Wi-Fi 7) information has been identified in hostapd and
wpa_supplicant. These issues show up in various cases where frames
including information on affiliated links are parsed and processed in
both AP and STA modes. The issues can result in process termination due
to buffer read overflow checks and memory corruption.
The issues for AP mode (hostapd or wpa_supplicant) can result in
denial-of-service attacks due to process termination and small memory
corruption that could theoretically cause other issues, but it does not
seem likely that those could be exploiting in practice. Affected areas
can be reached by sending invalid Management frames without needing
authentication or user action on the target device.
Link: https://github.com/openwrt/openwrt/pull/24043
(cherry picked from commit 8614a2ba6885d0bec345a1010a0d59c64abe403c)
[Removed 004, 0005 and 008 which do not apply and fix some others]
Link: https://github.com/openwrt/openwrt/pull/24295
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 452bc24984b7df0ab12e73372d3fbb3930d404fe)
CMake fails to bootstrap its host tool with GCC 16:
cmake.o: undefined reference to
`cmGlobalGhsMultiGenerator::cmGlobalGhsMultiGenerator(cmake*)'
Source/cmake.cxx includes cmGlobalGhsMultiGenerator.h guarded only by
__linux__, not by CMAKE_BOOTSTRAP. The NewFactory() call is compiled out
during bootstrap, but GCC 16 devirtualization still emits the uncalled
inline NewFactory() and the cmGlobalGeneratorSimpleFactory<> template,
which reference symbols only defined in cmGlobalGhsMultiGenerator.cxx, a
file that is not compiled during bootstrap.
Backport the upstream fix, which moves the include behind the existing
CMAKE_BOOTSTRAP guard. It is in no 3.30.x release (that branch is EOL);
upstream shipped it first in 3.31.10 / 4.0.5 / 4.1.2.
Assisted-by: Claude:claude-opus-4-8
Link: https://github.com/openwrt/openwrt/pull/24303
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit ee6e56c82ef738199312e3eb28df40806ddf41cf)
This patch backports a small but important part of the upstream commit:
b3f1b9e2aa07 build: Remove INCLUDE_MEMORY [PR117737]
Its original commit message fails to mention that the commit also moves
the `#include <memory>` to an earlier position within system.h,
which is the actual change that we're after in this patch.
Building our GCC 14.3 with host GCC 16, the inclusion order starts to matter,
which is an issue that was also touched upon by the upstream commits:
9970b576b7e4 Include safe-ctype.h after C++ standard headers, to avoid over-poisoning
f6e00226a4ca build: Move sstream include above safe-ctype.h {PR117771]
Signed-off-by: Lars Gierth <larsg@systemli.org>
Link: https://github.com/openwrt/openwrt/pull/23095
Signed-off-by: Robert Marko <robimarko@gmail.com>
[hauke: Add GCC 13 too]
(cherry picked from commit a32a367259574958768f44916d6cce8c8939ad27)
Link: https://github.com/openwrt/openwrt/pull/24302
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 35369da86f1b9540ad738c2225eebf310e7348a4)
libcody will fail to build if building using a GCC16 host compiler, so
backport the upstream fix.
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
[hauke: Add patch for GCC 13 too]
(cherry picked from commit e7e5d470c166561698078727f7ac154d2e4dbfb0)
Link: https://github.com/openwrt/openwrt/pull/24302
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit f05b9f96e0a4e77bd295d4518dab380e336aba57)
Remove the .github/workflows/labeler.yml workflow and enable the "enable_labeler_yml" option in .github/formalities.json to let the webhook bot handle pull request labeling. This avoids running on GitHub Actions, so it is faster and uses fewer resources.
It uses the existing .github/labeler.yml for labels.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24256
(cherry picked from commit 4f2dc5cc6497a6cef0a43bdefde522e734c1f40d)
Link: https://github.com/openwrt/openwrt/pull/24319
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 7df79b25f5ebcb51d5f059cf73f8ae72fae4419d)
This commit migrates the repository validation to a webhook-based bot instead of the GitHub Actions workflow (.github/workflows/formal.yml).
Since the bot handles stable branch labeling automatically (via the "branch_labeling: true" configuration option), the redundant branch check and labeling steps are removed from .github/workflows/labeler.yml.
The following configuration choices are applied in formalities.json:
- check_space_after_assignment: false (Disabled temporarily to catch any issues since it is a newly implemented check)
- check_makefile_indentation: false (Disabled temporarily to catch any issues since it is a new feature)
- check_patch_headers: 'warning' (Changed to warning instead of hard error since many legacy patches lack headers)
- enable_stale_bot: false (Disabled for now)
Other configurations can be adjusted in formalities.json based on the openwrt-bot-worker repository [1].
[1] https://github.com/openwrt/openwrt-bot-worker
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24256
(cherry picked from commit 9146f931b62e9b20df84566187a837b904df1e2f)
Link: https://github.com/openwrt/openwrt/pull/24319
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit a30deed6bd4348283e8e116014f7da0d8697fdc5)
Update to the most recent version.
The biggest change is the switch to Node.js 24.
Link: https://github.com/openwrt/openwrt/pull/22903
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 05b6a93173135ab86f82663523b531577f5e6062)
Link: https://github.com/openwrt/openwrt/pull/24319
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 263acdfb657945bf3c3bb5db8fee752215637d42)
Update the dependencies to the latest version.
The biggest change is the update to Node.js 24.
Link: https://github.com/openwrt/openwrt/pull/22903
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 372e57f243456da71d1bb28df7b332d9296b76d9)
Link: https://github.com/openwrt/openwrt/pull/24319
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 04fd025d6bde57a338cb5b50c70bd30e11d07a0e)
Run this only when a PR is created, so either author or anyone who can
edit the PR message (all maintainers) can trigger such build.
Instead of maintaining it in the main repository, move it to the
external repository to bloat this repository less with further CI
commits.
Signed-off-by: Paul Spooren <mail@aparcar.org>
(cherry picked from commit 8cff0d8ca0d42aec4cb47313cd0c3dd99e06bbec)
Link: https://github.com/openwrt/openwrt/pull/24319
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit d91a9ac1efc06b58c92b0e20951288a3de214416)
Change-log since version 2026.03.18, retrieved from the wireless-regdb mailing lists:
wireless-regdb: update regulatory database based on preceding changes
wireless-regdb: Update regulatory info for Brunei Darussalam (BN) for 2022
wireless-regdb: allow 320MHz channel width for Russia
wireless-regdb: Update 6 GHz rules for Hong Kong (HK)
wireless-regdb: Update 5/6 GHz power rules for Russia (RU)
wireless-regdb: Fix 60 GHz power unit for Ukraine (UA)
wireless-regdb: Update 6 GHz rules for South Africa (ZA)
wireless-regdb: Update 6 GHz rules for South Korea (KR)
wireless-regdb: Update regulatory rules for Sri Lanka (LK)
wireless-regdb: Add regulatory info for CEPT countries FO, GI, IM, SM and VA listed by WiFi Alliance
Signed-off-by: Hafiz Zafran <hfzz7@duck.com>
Link: https://github.com/openwrt/openwrt/pull/23594
(cherry picked from commit 848c54b5f42904d4afaae077efd5180cb6752b9c)
Link: https://github.com/openwrt/openwrt/pull/24301
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 9f11fa9de18de615bf0a34822600fbe5399879c0)
Indicate that there are some changes. This should make sure that the
package gets updated.
Fixes: 63c0767f3d02 ("ead: fix integer underflow in handle_send_a()")
(cherry picked from commit 75fad162df8e88d0b535cca83453b0ad05267349)
Link: https://github.com/openwrt/openwrt/pull/24298
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 58264cce83b0837fabf94021b5677dd3209b2655)
handle_send_a() computed the SRP "A" parameter length as
len = ntohl(msg->len) - sizeof(struct ead_msg_number);
sizeof(struct ead_msg_number) is 1, and the subtraction is evaluated in
unsigned arithmetic. A packet with msg->len == 0 therefore wraps the
result to a huge value which, assigned to the signed int len, becomes -1.
The following bounds check is signed:
if (len > MAXPARAMLEN + 1)
return false;
so -1 passes, and memcpy(A.data, number->data, len) runs with len cast to
size_t (~SIZE_MAX) against the 257-byte abuf, crashing the daemon.
Neither parse_message() nor handle_packet() validate msg->len (only the
captured packet length), so an unauthenticated attacker on the local
segment can reach this path and crash ead with a single crafted packet.
Validate the claimed length in unsigned arithmetic before the subtraction
and bound it on both sides. Doing the upper-bound check unsigned as well
also closes a 32-bit-only variant where sizeof(ead_packet) + msg->len
overflows in handle_packet(), letting a large msg->len reach the same
negative-len path.
Link: https://github.com/openwrt/openwrt/security/advisories/GHSA-9558-77jp-g3fw
Reported-by: @Vasco0x4
Assisted-by: Claude:claude-opus-4-8
(cherry picked from commit 63c0767f3d02f7b10b0f0b5293366bd059a08ca5)
Link: https://github.com/openwrt/openwrt/pull/24298
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 3944c026aa7cd27222ce334df72d2bcb6be86b9c)
