build: upgrade OpenWrt base to 25.12 (kernel 6.12)

build.sh

@@ -26,15 +26,18 @@ set_version_variables()
 {
 
 	#openwrt branch
-	branch_name="24.10"
-	branch_id="openwrt-24.10"
-	packages_branch="openwrt-24.10"
+	branch_name="25.12"
+	branch_id="openwrt-25.12"
+	packages_branch="openwrt-25.12"
 
 
-	# set precise commit in repo to use 
-	# you can set this to an alternate commit 
+	# set precise commit in repo to use
+	# you can set this to an alternate commit
 	# or empty to checkout latest
-	openwrt_commit="95d0ca014c4ce5e225579f859c066dc74a20763b"
+	# pinned to the v25.12.5 tag's commit (not branch head) for
+	# reproducibility, same convention as the prior 24.10 pin -- see
+	# docs/openwrt-2512-bump-plan.md/-progress.md in gargoyle-tools
+	openwrt_commit="f0a60eee2fe051741c643ea6118718aae1ef17fb"
 	openwrt_abbrev_commit=$( echo "$openwrt_commit" | cut -b 1-7 )
 
 

netfilter-match-modules/integrate_netfilter_modules.sh

@@ -143,13 +143,13 @@ EOF
 	printf "$defines\n" >> nf-patch-build/linux-download-make
 
 	cat << 'EOF' >>nf-patch-build/linux-download-make
+GENERIC_PLATFORM_DIR := $(TOPDIR)/target/linux/generic
+PLATFORM_DIR:=$(TOPDIR)/target/linux/$(BOARD)
+
 include $(INCLUDE_DIR)/kernel-version.mk
 KERNEL_NAME:=$(shell echo "$(KERNEL)" | sed 's/ /\./g' |  sed 's/\.$$//g' )
 KERNEL_PATCHVER_NAME:=$(shell echo "$(KERNEL_PATCHVER)" | sed 's/ /\./g' |  sed 's/\.$$//g' )
 
-GENERIC_PLATFORM_DIR := $(TOPDIR)/target/linux/generic
-PLATFORM_DIR:=$(TOPDIR)/target/linux/$(BOARD)
-
 GENERIC_BACKPORT_PATCH_DIR := $(GENERIC_PLATFORM_DIR)/backport-$(KERNEL_NAME)
 GENERIC_PENDING_PATCH_DIR := $(GENERIC_PLATFORM_DIR)/pending-$(KERNEL_NAME)
 GENERIC_HACK_PATCH_DIR := $(GENERIC_PLATFORM_DIR)/hack-$(KERNEL_NAME)
@@ -473,6 +473,30 @@ for new_d in $new_nftables_module_dirs ; do
 			insert_lines_at "$insert_line_num" "$config_lines" "linux.new/net/netfilter/Kconfig" "1"
 		fi
 
+		#some custom nft_* expressions (e.g. bandwidth) declare more netlink attributes than
+		#upstream's NFT_EXPR_MAXATTR allows. Kernel 6.12 added nft_register_expr() ->
+		#WARN_ON_ONCE(type->maxattr > NFT_EXPR_MAXATTR), which fails registration (-ENOMEM)
+		#for any expr type declaring more attributes than the constant permits -- this check
+		#didn't exist before 6.12. A module signals it needs a higher ceiling by shipping an
+		#optional "maxattr" file (just the required integer) alongside its module/header/
+		#nftables dirs; if present, bump NFT_EXPR_MAXATTR here to at least that value.
+		#NFT_EXPR_MAXATTR is a kernel-internal sizing constant (bounds a fixed-size on-stack
+		#netlink attribute array in nf_tables_api.c/nft_inner.c), not part of the uAPI, so
+		#raising it carries no wire-format/ABI risk. This bump deliberately lives here rather
+		#than as a standalone generic kernel patch, so it stays next to the module that
+		#actually requires it -- a bare "16 -> 17" edit elsewhere would be meaningless
+		#without knowing which expression type forced it.
+		if [ -e "$new_d/maxattr" ] ; then
+			required_maxattr=$(cat "$new_d/maxattr")
+			nf_tables_h="linux.new/include/net/netfilter/nf_tables.h"
+			current_maxattr=$(cat "$nf_tables_h" | egrep "#define NFT_EXPR_MAXATTR" | egrep -o "[0-9]+")
+			if [ -n "$current_maxattr" ] && [ "$required_maxattr" -gt "$current_maxattr" ] ; then
+				echo "nftables $upper_name module declares $required_maxattr attributes, exceeding kernel's NFT_EXPR_MAXATTR=$current_maxattr -- raising it to $required_maxattr"
+				cat "$nf_tables_h" | sed "s/#define NFT_EXPR_MAXATTR.*/#define NFT_EXPR_MAXATTR $required_maxattr/" >.tmp.tmp
+				mv .tmp.tmp "$nf_tables_h"
+			fi
+		fi
+
 		#update files for nftables extension
 		if [ -e $new_d/nftables/meta ] ; then
 			while IFS=$'\n' read -r line;
@@ -606,7 +630,10 @@ if [ "$patch_kernel" = 1 ] ; then
 	cd linux.new
 	module_files=$(find net/netfilter)
 	include_files=$(find include/linux/netfilter)
-	test_files="$module_files $include_files"
+	#outside both dirs walked above -- included so an NFT_EXPR_MAXATTR bump (see the
+	#nftables module loop above) actually lands in the generated patch
+	nf_tables_h_file="include/net/netfilter/nf_tables.h"
+	test_files="$module_files $include_files $nf_tables_h_file"
 	cd ..
 	for t in $test_files ; do
 		if [ ! -d "linux.new/$t" ] ; then

netfilter-match-modules/iptables/bandwidth/extension/libxt_bandwidth.c

@@ -41,15 +41,9 @@
 #include <linux/netfilter.h>
 #include <linux/netfilter/xt_bandwidth.h>
 
-typedef union
-{
-	struct in_addr ip4;
-	struct in6_addr ip6;
-} ipany;
-
 int get_minutes_west(void);
 void set_kernel_timezone(void);
-int parse_sub(char* subnet_string, ipany* subnet, ipany* subnet_mask, int family);
+int parse_sub(char* subnet_string, union xt_bandwidth_ipany* subnet, union xt_bandwidth_ipany* subnet_mask, int family);
 static void param_problem_exit_error(char* msg);
 char** split_on_separators(char* line, char* separators, int num_separators, int max_pieces, int include_remainder_at_max);
 char* trim_flanking_whitespace(char* str);
@@ -105,8 +99,8 @@ static int parse(	int c,
 	struct xt_bandwidth_info *info = (struct xt_bandwidth_info *)(*match)->data;
 	int valid_arg = 0;
 	long int num_read;
-	uint64_t read_64;
-	time_t read_time;
+	long long int read_64;
+	long long int read_time;
 
 	/* set defaults first time we get here */
 	if(*flags == 0)
@@ -424,11 +418,11 @@ static void print_bandwidth_args(struct xt_bandwidth_info* info, int family)
 
 		if(info->cmp == BANDWIDTH_GT)
 		{
-			printf("--greater_than %lld ", info->bandwidth_cutoff);
+			printf("--greater_than %lld ", (long long)info->bandwidth_cutoff);
 		}
 		if(info->cmp == BANDWIDTH_LT)
 		{
-			printf("--less_than %lld ", info->bandwidth_cutoff);
+			printf("--less_than %lld ", (long long)info->bandwidth_cutoff);
 		}
 		if (info->type == BANDWIDTH_COMBINED) /* too much data to print for multi types, have to use socket to get/set data */
 		{
@@ -442,12 +436,12 @@ static void print_bandwidth_args(struct xt_bandwidth_info* info, int family)
 			}
 			else 
 			{
-				printf("--current_bandwidth %lld ", info->current_bandwidth);
+				printf("--current_bandwidth %lld ", (long long)info->current_bandwidth);
 			}
 		}
 		if(info->reset_is_constant_interval)
 		{
-			printf("--reset_interval %lld ", info->reset_interval);
+			printf("--reset_interval %lld ", (long long)info->reset_interval);
 		}
 		else
 		{
@@ -474,7 +468,7 @@ static void print_bandwidth_args(struct xt_bandwidth_info* info, int family)
 		}
 		if(info->reset_time > 0)
 		{
-			printf("--reset_time %lld ", info->reset_time);
+			printf("--reset_time %lld ", (long long)info->reset_time);
 		}
 		if(info->num_intervals_to_save > 0)
 		{
@@ -531,7 +525,7 @@ static void save_mt4(const void *ip, const struct xt_entry_match *match)
 	print_bandwidth_args(info, NFPROTO_IPV4);
 
 	time(&now);
-	printf("--last_backup-time %lld ", now);
+	printf("--last_backup-time %lld ", (long long)now);
 }
 
 static void save_mt6(const void *ip, const struct xt_entry_match *match)
@@ -542,7 +536,7 @@ static void save_mt6(const void *ip, const struct xt_entry_match *match)
 	print_bandwidth_args(info, NFPROTO_IPV6);
 
 	time(&now);
-	printf("--last_backup-time %lld ", now);
+	printf("--last_backup-time %lld ", (long long)now);
 }
 
 static struct xtables_match bandwidth_mt_reg[] = 
@@ -587,7 +581,7 @@ static void param_problem_exit_error(char* msg)
 	xtables_error(PARAMETER_PROBLEM, "%s", msg);
 }
 
-int parse_sub(char* subnet_string, ipany* subnet, ipany* subnet_mask, int family)
+int parse_sub(char* subnet_string, union xt_bandwidth_ipany* subnet, union xt_bandwidth_ipany* subnet_mask, int family)
 {
 	char** sub_parts = split_on_separators(subnet_string,"/",1,2,1);
 	char* substr = trim_flanking_whitespace(sub_parts[0]);

netfilter-match-modules/iptables/bandwidth/module/bandwidth_deps/tree_map.h

@@ -1089,5 +1089,3 @@ static unsigned long sdbm_string_hash(const char *key)
 	}
 	return hashed_key;
 }
-
-

netfilter-match-modules/iptables/webmon/extension/libxt_webmon.c

@@ -25,6 +25,7 @@
 #include <string.h>
 #include <stdlib.h>
 #include <getopt.h>
+#include <unistd.h>
 
 #include <arpa/inet.h>
 

netfilter-match-modules/iptables/webmon/module/xt_webmon.c

@@ -103,6 +103,12 @@ static int max_search_queue_length   = 5;
 
 static spinlock_t webmon_lock = __SPIN_LOCK_UNLOCKED(webmon_lock);;
 
+void add_queue_node(int family, ipany src_ip, char* value, queue* full_queue, string_map* queue_index, char* queue_index_key, uint32_t max_queue_length);
+void destroy_queue(queue* q);
+int strnicmp(const char * cs,const char * ct,size_t count);
+char *strnistr(const char *s, const char *find, size_t slen);
+int within_edit_distance(char *s1, char *s2, int max_edit);
+char** split_on_separators(char* line, char* separators, int num_separators, int max_pieces, int include_remainder_at_max, unsigned long *num_pieces);
 
 static void update_queue_node_time(queue_node* update_node, queue* full_queue)
 {
@@ -131,7 +137,7 @@ static void update_queue_node_time(queue_node* update_node, queue* full_queue)
 	}
 }
 
-void add_queue_node(int family, ipany src_ip, char* value, queue* full_queue, string_map* queue_index, char* queue_index_key, uint32_t max_queue_length )
+void add_queue_node(int family, ipany src_ip, char* value, queue* full_queue, string_map* queue_index, char* queue_index_key, uint32_t max_queue_length)
 {
 
 	queue_node *new_node = (queue_node*)kmalloc(sizeof(queue_node), GFP_ATOMIC);

netfilter-match-modules/iptables/weburl/module/weburl_deps/regexp.c

@@ -83,7 +83,7 @@ void regerror(char * s)
  */
 
 /* definition	number	opnd?	meaning */
-#define	END	0	/* no	End of program. */
+#define	P_END	0	/* no	End of program. */
 #define	BOL	1	/* no	Match "" at beginning of line. */
 #define	EOL	2	/* no	Match "" at end of line. */
 #define	ANY	3	/* no	Match any one character. */
@@ -275,7 +275,7 @@ regcomp(char *exp,int *patternsize)
 	r->regmust = NULL;
 	r->regmlen = 0;
 	scan = r->program+1;			/* First BRANCH. */
-	if (OP(regnext(&g, scan)) == END) {		/* Only one top-level choice. */
+	if (OP(regnext(&g, scan)) == P_END) {		/* Only one top-level choice. */
 		scan = OPERAND(scan);
 
 		/* Starting-point info. */
@@ -361,7 +361,7 @@ reg(struct match_globals *g, int paren, int *flagp /* Parenthesized? */ )
 	}
 
 	/* Make a closing node, and hook it on the end. */
-	ender = regnode(g, (paren) ? CLOSE+parno : END);
+	ender = regnode(g, (paren) ? CLOSE+parno : P_END);
 	regtail(g, ret, ender);
 
 	/* Hook the tails of the branches to the closing node. */
@@ -978,7 +978,7 @@ regmatch(struct match_globals *g, char *prog)
 				return(0);
 			}
 			break;
-		case END:
+		case P_END:
 			return(1);	/* Success! */
 			break;
 		default:
@@ -991,7 +991,7 @@ regmatch(struct match_globals *g, char *prog)
 	}
 
 	/*
-	 * We get here only if there's trouble -- normally "case END" is
+	 * We get here only if there's trouble -- normally "case P_END" is
 	 * the terminating point.
 	 */
 	printk("<3>Regexp: corrupted pointers\n");
@@ -1075,13 +1075,13 @@ void
 regdump(regexp *r)
 {
 	register char *s;
-	register char op = EXACTLY;	/* Arbitrary non-END op. */
+	register char op = EXACTLY;	/* Arbitrary non-P_END op. */
 	register char *next;
 	/* extern char *strchr(); */
 
 
 	s = r->program + 1;
-	while (op != END) {	/* While that wasn't END last time... */
+	while (op != P_END) {	/* While that wasn't P_END last time... */
 		op = OP(s);
 		printf("%2d%s", s-r->program, regprop(s));	/* Where, what. */
 		next = regnext(s);
@@ -1151,7 +1151,7 @@ regprop(char *op)
 	case BACK:
 		p = "BACK";
 		break;
-	case END:
+	case P_END:
 		p = "END";
 		break;
 	case OPEN+1:

netfilter-match-modules/iptables/weburl/module/weburl_deps/regexp.h

@@ -37,5 +37,6 @@ regexp * regcomp(char *exp, int *patternsize);
 int regexec(regexp *prog, char *string);
 void regsub(regexp *prog, char *source, char *dest);
 void regerror(char *s);
+__kernel_size_t my_strcspn(const char *s1,const char *s2);
 
 #endif

netfilter-match-modules/iptables/weburl/module/xt_weburl.c

@@ -52,6 +52,12 @@ MODULE_ALIAS("ip6t_weburl");
 
 string_map* compiled_map = NULL;
 
+int strnicmp(const char * cs,const char * ct,size_t count);
+char *strnistr(const char *s, const char *find, size_t slen);
+int do_match_test(unsigned char match_type,  const char* reference, char* query);
+int http_match(const struct xt_weburl_info* info, const unsigned char* packet_data, int packet_length);
+int https_match(const struct xt_weburl_info* info, const unsigned char* packet_data, int packet_length);
+
 int strnicmp(const char * cs,const char * ct,size_t count)
 {
 	register signed char __res = 0;

netfilter-match-modules/nftables/bandwidth/maxattr

@@ -0,0 +1 @@
+17

netfilter-match-modules/nftables/bandwidth/module/nft_bandwidth.c

@@ -35,7 +35,7 @@
 
 #include <linux/semaphore.h> 
 
-#include "bandwidth_deps/tree_map.h"
+#include "nft_bandwidth_deps/tree_map.h"
 #include <linux/netfilter/nft_bandwidth.h>
 
 #include <linux/ip.h>
@@ -133,6 +133,10 @@ static ktime_t get_nominal_previous_reset_time(struct nft_bandwidth_info *info,
 
 static uint64_t* initialize_map_entries_for_ip(info_and_maps* iam, char* ip, uint64_t initial_bandwidth, uint32_t family);
 
+char** split_on_separators(char* line, char* separators, int num_separators, int max_pieces, int include_remainder_at_max, unsigned long *num_pieces);
+char* trim_flanking_whitespace(char* str);
+void parse_ips_and_ranges(char* addr_str, struct nft_bandwidth_info *priv);
+
 int free_null_terminated_string_array(char** strs);
 
 int free_null_terminated_string_array(char** strs)
@@ -3464,10 +3468,23 @@ static int __init init(void)
 	if(id_map == NULL) /* deal with kmalloc failure */
 	{
 		printk("id map is null, returning -1\n");
+		nf_unregister_sockopt(&nft_bandwidth_sockopts);
 		return -1;
 	}
 
-	return nft_register_expr(&nft_bandwidth_type);
+	{
+		int register_err = nft_register_expr(&nft_bandwidth_type);
+		if(register_err != 0)
+		{
+			/* registration failed (e.g. too many netlink attributes for
+			 * this kernel's NFT_EXPR_MAXATTR) -- undo the sockopt
+			 * registration above, otherwise the kernel's sockopt table
+			 * is left pointing at code that's about to be unloaded */
+			printk("nft_bandwidth: nft_register_expr failed (%d), unregistering sockopts\n", register_err);
+			nf_unregister_sockopt(&nft_bandwidth_sockopts);
+		}
+		return register_err;
+	}
 }
 
 static void __exit fini(void)

netfilter-match-modules/nftables/bandwidth/nftables/meta

@@ -21,3 +21,4 @@ src_statement.c.1||insert||after||0||include <rule.h>||src/statement.c
 src_statement.c.2||insert||before||2||static void reject_stmt_print||src/statement.c
 include_linux_netfilter_nftables.h.1||insert||after||0||#define NFTA_REJECT_MAX||include/linux/netfilter/nf_tables.h
 include_parser.h.1||insert||after||0||PARSER_SC_STMT_REJECT||include/parser.h
+src_statement.c.3||insert||after||0||case STMT_REJECT: return &reject_stmt_ops;||src/statement.c

netfilter-match-modules/nftables/bandwidth/nftables/src_statement.c.3

@@ -0,0 +1 @@
+	case STMT_BANDWIDTH: return &bandwidth_stmt_ops;

netfilter-match-modules/nftables/timerange/nftables/meta

@@ -20,3 +20,4 @@ src_scanner.l.2||insert||before||1||scanner_push_start_cond\(yyscanner, SCANSTAT
 src_statement.c.1||insert||before||2||static void reject_stmt_print||src/statement.c
 include_linux_netfilter_nftables.h.1||insert||after||0||#define NFTA_REJECT_MAX||include/linux/netfilter/nf_tables.h
 include_parser.h.1||insert||after||0||PARSER_SC_STMT_REJECT||include/parser.h
+src_statement.c.2||insert||after||0||case STMT_REJECT: return &reject_stmt_ops;||src/statement.c

netfilter-match-modules/nftables/timerange/nftables/src_statement.c.2

@@ -0,0 +1 @@
+	case STMT_TIMERANGE: return &timerange_stmt_ops;