Merge pull request #1076 from kernelkit/update-changelog

doc: update changelog date for v25.06
2026-07-27 11:13:02 +02:00 · 2025-07-01 14:19:41 +02:00 · 2025-07-01 11:29:04 +02:00 · 2025-06-30 09:48:30 +02:00 · 2025-06-30 08:40:45 +02:00 · 2025-06-29 22:24:23 +02:00
117 changed files with 2260 additions and 204 deletions
@@ -65,7 +65,7 @@ config INFIX_COMPATIBLE

 config INFIX_TAGLINE
 	string "Operating system tagline"
-	default "Infix -- a Network Operating System"
+	default "Infix OS — Immutable.Friendly.Secure"
 	help
 	  Mandatory. Used for identifying the OS, e.g. as PRETTY_NAME in
 	  /etc/os-release and description in the GNS3 appliance.
@@ -2,11 +2,11 @@

 <img align="right" src="doc/logo.png" alt="Infix - Linux <3 NETCONF" width=480 border=10>

-Infix is a free, Linux based, immutable Network Operating System (NOS)
-built on [Buildroot][1], and [sysrepo][2].  A powerful mix that ease
-porting to different platforms, simplify long-term maintenance, and
-provide made-easy management using NETCONF, RESTCONF[^2], or the
-built-in command line interface (CLI) from a console or SSH login.
+Infix is a free, Linux-based, immutable operating system built around
+[Buildroot][1] and [sysrepo][2].  A powerful mix that ease porting to
+different platforms, simplify long-term maintenance, and provide
+made-easy management using NETCONF, RESTCONF[^2], or the built-in
+command line interface (CLI) from a console or SSH login.

 > Click the **▶ Example CLI Session** foldout below for an example, or
 > head on over to the [Infix Documentation](doc/README.md) for more
@@ -27,13 +27,15 @@ it maintenance-free.  Configuration and data, e.g, containers, is stored
 on separate partitions to ensure complete separation from system files
 and allow for seamless backup, restore, and provisioning.

-In itself, Infix is perfectly suited for dedicated networking tasks, and
-with native support for Docker containers, the operating system provides
-a versatile platform that can easily be adapted to any customer need.
-Be it legacy applications, network protocols, process monitoring, or
-edge data analysis, it can run close to end equipment.  Either directly
-connected on dedicated Ethernet ports or indirectly using virtual
-network cables to exist on the same LAN as other connected equipment.
+In itself, Infix is perfectly suited for dedicated networking tasks,
+such as routing, switching, and monitoring.  This is how it started, as
+a network focused operating system.  Now, with native support for Docker
+containers, it provides a versatile platform that can easily be adapted
+to any customer need.  Be it legacy applications, network protocols,
+process monitoring, or edge data analysis, it can run close to end
+equipment.  Either directly connected on dedicated Ethernet ports or
+indirectly using virtual network cables to exist on the same LAN as
+other connected equipment.

 The simple design of Infix provides complete control over both system
 and data, minimal cognitive burden, and makes it incredibly easy to get
@@ -45,11 +45,11 @@ The default credentials for the demo builds is
    login: admin
    password: admin

-    Infix -- a Network Operating System v24.09.0-rc1 (hvc0)
+    Infix OS — Immutable.Friendly.Secure v24.09.0-rc1 (hvc0)
    infix-00-00-00 login: admin
    Password: 
    .-------.
-    |  . .  | Infix -- a Network Operating System
+    |  . .  | Infix OS — Immutable.Friendly.Secure
    |-. v .-| https://kernelkit.org
    '-'---'-'

@@ -122,9 +122,9 @@ There's a lot of tutorials and guides online, start here:
 About
 -----

-Infix is a free, Linux based, immutable Network Operating System (NOS)
-built on Buildroot, and sysrepo.  A powerful mix that ease porting to
-different platforms, simplify long-term maintenance, and provide easy
-management using NETCONF, RESTCONF, or the built-in command line
-interface (CLI) from a console or SSH login.
+Infix is a free, Linux-based, immutable operating system built around
+Buildroot, and sysrepo.  A powerful mix that ease porting to different
+platforms, simplify long-term maintenance, and provide easy management
+using NETCONF, RESTCONF, or the built-in command line interface (CLI)
+from a console or SSH login.

@@ -78,7 +78,7 @@ config QEMU_MACHINE

 config QEMU_MACHINE_RAM
 	string "RAM size (k/M/G)"
-	default "384M"
+	default "448M"
 	help
 	  The default, 384 MiB, works for most configurations.  However,
 	  if you get kernel panic with: "System is deadlocked on memory",
@@ -0,0 +1,5 @@
+service name:wpa_supplicant :%i \
+			[2345] wpa_supplicant -s -i %i -c /etc/wpa_supplicant-%i.conf -P/var/run/wpa_supplicant-%i.pid \
+			       -- WPA supplicant @%i
+
+task name:wifi-scanner :%i [2345] <pid/wpa_supplicant:%i> /usr/libexec/infix/wifi-scanner %i -- Start scanning for SSID @ %i
@@ -1,4 +1,4 @@
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.org
 '-'---'-'
@@ -0,0 +1 @@
+SUBSYSTEM=="net", ACTION=="add", TEST=="/sys/class/net/$name/wireless", NAME="wifi%n"
@@ -0,0 +1,16 @@
+#!/bin/sh
+
+if [ $# -ne 1 ]; then
+	echo "usage: $0 <ifname>"
+	exit 1
+fi
+ifname=$1
+
+TIMEOUT=300
+status=$(wpa_cli -i $ifname scan)
+while [ "$status" != "OK" ]; do
+	status=$(wpa_cli -i $ifname scan)
+	TIMEOUT=$((TIMEOUT-1))
+	[ $TIMEOUT -eq 0 ] && logger -t wifi-scanner "Failed to start scanning $ifname" && exit 1
+	sleep 0.5
+done
@@ -27,7 +27,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.32"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.35"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -126,7 +126,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -165,6 +165,8 @@ BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
+BR2_PACKAGE_FEATURE_WIFI=y
+BR2_PACKAGE_FEATURE_WIFI_DONGLE_REALTEK=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
 BR2_PACKAGE_GETENT=y
@@ -27,7 +27,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.32"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.35"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -108,7 +108,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -29,7 +29,7 @@ BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image
 BR2_ROOTFS_POST_SCRIPT_ARGS="-c $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/genimage.cfg"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.32"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.35"
 BR2_LINUX_KERNEL_PATCH="$(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/rk3328-nanopi-r2s-dts.patch"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/r2s/linux_defconfig"
@@ -170,7 +170,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
 INFIX_IMAGE_ID="${INFIX_ID}-r2s"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -162,7 +162,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -29,7 +29,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.32"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.35"
 BR2_LINUX_KERNEL_PATCH="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/bcm2711-rpi-4-b-dts.patch"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/bcm2711_defconfig"
@@ -163,7 +163,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
 INFIX_IMAGE_ID="${INFIX_ID}-rpi4"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -26,7 +26,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INF
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.32"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.35"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -132,7 +132,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -167,6 +167,8 @@ BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
+BR2_PACKAGE_FEATURE_WIFI=y
+BR2_PACKAGE_FEATURE_WIFI_DONGLE_REALTEK=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
 BR2_PACKAGE_GETENT=y
@@ -27,7 +27,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INF
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.32"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.35"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -115,7 +115,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -3,6 +3,22 @@ Change Log

 All notable changes to the project are documented in this file.

+[v25.06.0][] - 2025-07-01
+-------------------------
+
+### Changes
+- Upgrade Buildroot to 2025.02.4 (LTS)
+- Upgrade Linux kernel to 6.12.35 (LTS)
+- Upgrade curiOS built-in containers to v25.06.0
+- Add support for setting mode of a container content mount, issue #1070
+- Add Wi-Fi client support and add support for some USB-Wi-Fi cards
+- New slogan: Infix OS — Immutable.Friendly.Secure
+
+### Fixes
+- cli: fix by-word movement, detect word barrier using non-alphanum chars
+- cli: fix delete word left/right, make sure to save word in kill buffer
+
+
 [v25.05.1][] - 2025-06-12
 -------------------------

@@ -1578,7 +1594,7 @@ Supported YANG models in addition to those used by sysrepo and netopeer:
 - N/A

 [buildroot]:  https://buildroot.org/
-[UNRELEASED]: https://github.com/kernelkit/infix/compare/v25.05.1...HEAD
+[v25.06.0]:   https://github.com/kernelkit/infix/compare/v25.05.1...v26.06.0
 [v25.05.1]:   https://github.com/kernelkit/infix/compare/v25.05.0...v25.05.1
 [v25.05.0]:   https://github.com/kernelkit/infix/compare/v25.04.0...v25.05.0
 [v25.04.0]:   https://github.com/kernelkit/infix/compare/v25.03.0...v25.04.0
@@ -1,7 +1,7 @@
 <img align="right" src="logo.png" alt="Infix - Linux <3 NETCONF" width=480 border=10>

-Welcome to Infix, your friendly Network Operating System!  On these
-pages you can find both user and developer documentation.
+Welcome to Infix, your immutable, friendly, and secure operating system!
+On these pages you can find both user and developer documentation.

 Most topics on configuring the system include CLI examples, but every
 setting, as well as status read-back from the operational datastore, is
@@ -214,7 +214,7 @@ text file without line breaks (`-w0`):
 ```bash
 $ echo "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCAtLSBhIE5ldHdvcmsgT3BlcmF0aW5nIFN5c3RlbQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQuZ2l0aHViLmlvCictJy0tLSctJwo=" |base64 -d
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.github.io
 '-'---'-'
 ```
@@ -294,7 +294,7 @@ rtt min/avg/max/mdev = 0.852/1.105/1.348/0.202 ms
 linux-pc:# ssh admin@infix-c0-ff-ee.local
 (admin@infix-c0-ff-ee.local) Password: 
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.org
 '-'---'-

@@ -334,7 +334,7 @@ rtt min/avg/max/mdev = 0.751/1.482/2.281/0.626 ms
 linux-pc:# ssh admin@infix.local
 (admin@infix.local) Password: 
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.org
 '-'---'-

@@ -79,11 +79,11 @@ typically setup to run at 115200 baud, 8N1.


 ```
-Infix -- a Network Operating System v24.11.1 (ttyS0)
+Infix OS — Immutable.Friendly.Secure v24.11.1 (ttyS0)
 example login: admin
 Password:
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.org
 '-'---'-'

@@ -92,7 +92,7 @@ Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
 Warning: Permanently added 'fe80::ff:fe00:0%eth0' (ED25519) to the list of known hosts.
 admin@fe80::ff:fe00:0%eth0's password: *****
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.org
 '-'---'-'

@@ -1263,7 +1263,7 @@ It should now be possible to access the switch from the PC via SSH (or NETCONF).
 ~ $ ssh admin@fe80::0053:00ff:fe06:1101%eth1
 admin@fe80::0053:00ff:fe06:1101%eth1's password: 
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.org
 '-'---'-'

@@ -427,11 +427,11 @@ admin@example:/> reboot
 [ OK ] Update DNS configuration
 [ OK ] Starting Status daemon

-Infix -- a Network Operating System v25.03.1 (ttyS0)
+Infix OS — Immutable.Friendly.Secure v25.03.1 (ttyS0)
 example login: admin
 Password:
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.org
 '-'---'-'

@@ -638,7 +638,7 @@ admin@example:/> reboot
 [ OK ] Verifying self-signed https certificate
 [ OK ] Starting Status daemon

-Infix -- a Network Operating System v25.01.0 (ttyS0)
+Infix OS — Immutable.Friendly.Secure v25.01.0 (ttyS0)
 example login:
 ```
 > [!NOTE]
@@ -695,7 +695,7 @@ admin@example:/> reboot
 [ OK ] Verifying self-signed https certificate
 [ OK ] Starting Status daemon

-Infix -- a Network Operating System v25.01.0 (ttyS0)
+Infix OS — Immutable.Friendly.Secure v25.01.0 (ttyS0)

 ERROR: Corrupt startup-config, system has reverted to default login credentials
 failed-00-00-00 login:
@@ -738,7 +738,7 @@ Reboot now to perform reset, (y/N)? y

 Please press Enter to activate this console.

-Infix -- a Network Operating System v25.01.0 (ttyS0)
+Infix OS — Immutable.Friendly.Secure v25.01.0 (ttyS0)
 example login:
 ```

@@ -123,11 +123,11 @@ there is another helper script in Infamy for this:
    Trying 127.0.0.1...
    Connected to 127.0.0.1.

-    Infix -- a Network Operating System v23.11.0-226-g0c144da (console)
+    Infix OS — Immutable.Friendly.Secure v23.11.0-226-g0c144da (console)
    infix-00-00-00 login: admin
    Password:
    .-------.
-    |  . .  | Infix -- a Network Operating System
+    |  . .  | Infix OS — Immutable.Friendly.Secure
    |-. v .-| https://kernelkit.org
    '-'---'-'

@@ -0,0 +1,152 @@
+# Wi-Fi (Wireless LAN)
+
+Infix includes built-in Wi-Fi client support for connecting to
+wireless networks. When a compatible Wi-Fi adapter is detected, the
+system automatically begins scanning for available networks.
+
+## Current Limitations
+
+- Only client mode is supported (no access point functionality)
+- USB hotplug is not supported - adapters must be present at boot
+- Interface naming may be inconsistent with multiple USB Wi-Fi adapters
+
+## Supported Wi-Fi Adapters
+
+Wi-Fi support is primarily tested with Realtek chipset-based adapters.
+
+### Known Working Chipsets
+
+- RTL8821CU
+- Other Realtek chipsets may work but are not guaranteed
+
+
+> [!NOTE]  Some Realtek chipsets require proprietary drivers not included in the standard kernel
+>          Firmware requirements vary by chipset
+>          Check kernel logs if your adapter is not detected
+
+## Configuration
+
+Add a supported Wi-Fi network device. To verify that it has been
+detected, look for `wifi0` in `show interfaces`
+
+```
+admin@example:/>  show interfaces
+INTERFACE       PROTOCOL   STATE       DATA
+lo              loopback   UP
+                ipv4                   127.0.0.1/8 (static)
+                ipv6                   ::1/128 (static)
+e1              ethernet   UP          02:00:00:00:00:01
+                ipv6                   fe80::ff:fe00:1/64 (link-layer)
+                ipv6                   fec0::ff:fe00:1/64 (link-layer)
+wifi0           ethernet   DOWN        f0:09:0d:36:5f:86
+                wifi                   ssid: ------, signal: ------
+
+```
+Add the new Wi-Fi interface to the configuration to start scanning.
+```
+admin@example:/config/> set interface wifi0
+admin@example:/config/> leave
+```
+Now the system will now start scanning in the background. To
+see the result read the operational datastore for interface `wifi0` or
+use the CLI
+
+```
+admin@infix-00-00-00:/> show interfaces name wifi0
+name                : wifi0
+type                : wifi
+index               : 3
+mtu                 : 1500
+operational status  : down
+physical address    : f0:09:0d:36:5f:86
+ipv4 addresses      :
+ipv6 addresses      :
+SSID                : ----
+Signal              : ----
+
+SSID                                    ENCRYPTION                    SIGNAL
+ssid1                                   WPA2-Personal                 excellent
+ssid2                                   WPA2-Personal                 excellent
+ssid3                                   WPA2-Personal                 excellent
+ssid4                                   WPA2-Personal                 good
+ssid5                                   WPA2-Personal                 good
+ssid6                                   WPA2-Personal                 good
+```
+
+In the CLI, signal strength is reported as: excellent, good, poor or
+bad. For precise values, use NETCONF or RESTCONF, where the RSSI (in
+dBm) is available in the operational datastore.
+
+Configure your Wi-Fi secret in the keystore, it should be between 8
+and 63 characters
+
+```
+admin@example:/> configure
+admin@example:/config/> edit keystore symmetric-key example
+admin@example:/config/keystore/symmetric-key/example/> set key-format wifi-preshared-key-format
+admin@example:/config/keystore/symmetric-key/example/> set cleartext-key mysecret
+admin@example:/config/keystore/symmetric-key/example/> leave
+admin@example:/>
+```
+
+Configure the Wi-Fi settings, set secret to the name selected above
+for the symmetric key, in this case `example`.
+
+WPA2 or WPA3 encryption will be automatically selected based on what
+the access point supports. No manual selection is required unless
+connecting to an open network. No support for certificate based
+authentication yet.
+
+Unencrypted network is also supported, to connect to an unencrypted
+network (generally not recommended):
+```
+admin@example:/config/interface/wifi0/> set wifi encryption disabled
+```
+
+A valid `country-code` is also required for regulatory compliance, the
+valid codes are documented in the YANG model `infix-wifi-country-codes`
+
+
+```
+admin@example:/> configure
+admin@example:/config/> edit interface wifi0
+admin@example:/config/interface/wifi0/>
+admin@example:/config/interface/wifi0/> set wifi ssid ssid1
+admin@example:/config/interface/wifi0/> set wifi secret example
+admin@example:/config/interface/wifi0/> set wifi country-code SE
+admin@example:/config/interface/wifi0/> leave
+```
+
+The Wi-Fi negotiation should now start immediately, provided that the
+SSID and pre-shared key are correct. You can verify the connection by
+running `show interfaces` again.
+
+
+```
+admin@example:/> show interfaces
+INTERFACE       PROTOCOL   STATE       DATA
+lo              loopback   UP
+                ipv4                   127.0.0.1/8 (static)
+                ipv6                   ::1/128 (static)
+e1              ethernet   UP          02:00:00:00:00:01
+                ipv6                   fe80::ff:fe00:1/64 (link-layer)
+                ipv6                   fec0::ff:fe00:1/64 (link-layer)
+wifi0           ethernet   UP          f0:09:0d:36:5f:86
+                wifi                   ssid: ssid1, signal: excellent
+
+admin@example:/>
+```
+
+## Troubleshooting Connection Issues
+
+Use `show wifi scan wifi0` and `show interfaces` to verify signal strength
+and connection status. If issues arise, try the following
+troubleshooting steps:
+
+1. **Verify signal strength**: Check that the target network shows "good" or "excellent" signal
+2. **Check credentials**: Verify the preshared key in `ietf-keystore`
+3. **Review logs**: Check system logs with `show log` for Wi-Fi related errors
+4. **Regulatory compliance**: Ensure the country-code matches your location
+5. **Hardware detection**: Confirm the adapter appears in `show interfaces`
+
+If issues persist, check the system log for specific error messages that can help identify the root cause.
@@ -2,6 +2,7 @@ menu "Packages"

 comment "Hardware Support"
 source "$BR2_EXTERNAL_INFIX_PATH/package/board/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/package/feature-wifi/Config.in"

 comment "Software Packages"
 source "$BR2_EXTERNAL_INFIX_PATH/package/bin/Config.in"
@@ -42,5 +43,4 @@ source "$BR2_EXTERNAL_INFIX_PATH/package/rousette/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/nghttp2-asio/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/date-cpp/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/rauc-installation-status/Config.in"
-
 endmenu
@@ -25,6 +25,11 @@ else
 CONFD_CONF_OPTS += --disable-containers
 endif

+ifeq ($(BR2_PACKAGE_FEATURE_WIFI),y)
+CONFD_CONF_OPTS += --enable-wifi
+else
+CONFD_CONF_OPTS += --disable-wifi
+endif
 define CONFD_INSTALL_EXTRA
 	for fn in confd.conf resolvconf.conf; do \
 		cp $(CONFD_PKGDIR)/$$fn  $(FINIT_D)/available/; \
@@ -69,6 +74,12 @@ define CONFD_INSTALL_YANG_MODULES_CONTAINERS
 	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/containers.inc
 endef
 endif
+ifeq ($(BR2_PACKAGE_FEATURE_WIFI),y)
+define CONFD_INSTALL_YANG_MODULES_WIFI
+	$(COMMON_SYSREPO_ENV) \
+	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/wifi.inc
+endef
+endif

 # PER_PACKAGE_DIR
 # Since the last package in the dependency chain that runs sysrepoctl is confd, we need to
@@ -97,6 +108,7 @@ CONFD_PRE_BUILD_HOOKS += CONFD_CLEANUP
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_EXTRA
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES_CONTAINERS
+CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES_WIFI
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_IN_ROMFS
 CONFD_TARGET_FINALIZE_HOOKS += CONFD_CLEANUP

@@ -1,4 +1,4 @@
 # Locally computed
 sha256  ab15fd526bd8dd18a9e77ebc139656bf4d33e97fc7238cd11bf60e2b9b8666c6  COPYING
-sha256  3e7f777a054fbc29173bcdafe50ca096a8abf9e556bec9f52617c9881c9ce3e3  curios-httpd-oci-arm64-v24.11.0.tar.gz
-sha256  bfa52f712301427a21b89cfee31ca315e1404973affaf34b23978a70a3ec4f63  curios-httpd-oci-amd64-v24.11.0.tar.gz
+sha256  c4995c0a7a96d5273c97c7c026c03ff5e2a42cade6d66808fdeba0fae9a343d8  curios-httpd-oci-arm64-v25.06.0.tar.gz
+sha256  4d48a03b38eabe558052ecbab7560e6d9f995311eb91b90ddaac336b5f001a5e  curios-httpd-oci-amd64-v25.06.0.tar.gz
@@ -4,7 +4,7 @@
 #
 ################################################################################

-CURIOS_HTTPD_VERSION = v24.11.0
+CURIOS_HTTPD_VERSION = v25.06.0
 CURIOS_HTTPD_SOURCE = curios-httpd-oci-$(GO_GOARCH)-$(CURIOS_HTTPD_VERSION).tar.gz
 CURIOS_HTTPD_SITE = https://github.com/kernelkit/curiOS/releases/download/$(CURIOS_HTTPD_VERSION)
 CURIOS_HTTPD_LICENSE = GPL
@@ -1,4 +1,4 @@
 # Locally computed
 sha256  ab15fd526bd8dd18a9e77ebc139656bf4d33e97fc7238cd11bf60e2b9b8666c6  COPYING
-sha256  95b3625587738cb0a8cc6e9eb41d10a0b2f77ae99dbb1d9b213148d35268eb75  curios-nftables-oci-arm64-v24.11.0.tar.gz
-sha256  4f61ccef90721b8f95a5c7b77b69ccccb5dbd215b9c38986d20e5b245244e902  curios-nftables-oci-amd64-v24.11.0.tar.gz
+sha256  94c7173fe4b8e64dcb1e0f67b974c23753ccce73bc07212a87e35f41a41ae5b8  curios-nftables-oci-arm64-v25.06.0.tar.gz
+sha256  feceb82327cccb4433db63e469f6ed115c10c0266242f0171b85ae1a88472757  curios-nftables-oci-amd64-v25.06.0.tar.gz
@@ -4,7 +4,7 @@
 #
 ################################################################################

-CURIOS_NFTABLES_VERSION = v24.11.0
+CURIOS_NFTABLES_VERSION = v25.06.0
 CURIOS_NFTABLES_SOURCE = curios-nftables-oci-$(GO_GOARCH)-$(CURIOS_NFTABLES_VERSION).tar.gz
 CURIOS_NFTABLES_SITE = https://github.com/kernelkit/curiOS/releases/download/$(CURIOS_NFTABLES_VERSION)
 CURIOS_NFTABLES_LICENSE = GPL
@@ -0,0 +1,20 @@
+config BR2_PACKAGE_FEATURE_WIFI
+	bool "Feature Wi-Fi"
+	select BR2_PACKAGE_WPA_SUPPLICANT
+	select BR2_PACKAGE_WPA_SUPPLICANT_WPA3
+	select BR2_PACKAGE_WPA_SUPPLICANT_DEBUG_SYSLOG
+	select BR2_PACKAGE_WPA_SUPPLICANT_AUTOSCAN
+	select BR2_PACKAGE_WPA_SUPPLICANT_CLI
+	select BR2_PACKAGE_WIRELESS_REGDB
+	select BR2_PACKAGE_IW
+	help
+	  Enables WiFi in Infix. Enables all requried applications.
+
+config BR2_PACKAGE_FEATURE_WIFI_DONGLE_REALTEK
+       bool "Realtek USB WiFi Dongles"
+       depends on BR2_PACKAGE_FEATURE_WIFI
+       select BR2_PACKAGE_LINUX_FIRMWARE
+       select BR2_PACKAGE_LINUX_FIRMWARE_RTL_RTW88
+       select BR2_PACKAGE_LINUX_FIRMWARE_RTL_RTW89
+       help
+         Enables Support for RTW88 and RTW89 USB dongles.
@@ -0,0 +1,42 @@
+################################################################################
+#
+# Wi-Fi support
+#
+################################################################################
+
+FEATURE_WIFI_PACKAGE_VERSION = 1.0
+FEATURE_WIFI_PACKAGE_LICENSE = MIT
+
+define FEATURE_WIFI_LINUX_CONFIG_FIXUPS
+	$(call KCONFIG_ENABLE_OPT,CONFIG_WLAN)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_RFKILL)
+	$(call KCONFIG_SET_OPT,CONFIG_MAC80211,m)
+	$(call KCONFIG_SET_OPT,CONFIG_CFG80211,m)
+
+	$(if $(filter y,$(BR2_PACKAGE_FEATURE_WIFI_DONGLE_REALTEK)),
+		$(call KCONFIG_ENABLE_OPT,CONFIG_WLAN_VENDOR_REALTEK)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW89)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8703B)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8723CS)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8723D)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8723DE)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8723DS)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8723DU)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8723X)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8821C)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8821CE)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8821CS)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8821CU)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8822B)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8822BE)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8822BS)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8822BU)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8822C)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8822CU)
+		$(call KCONFIG_ENABLE_OPT,CONFIG_RTW88_8822CE)
+	)
+endef
+
+
+$(eval $(generic-package))
@@ -28,7 +28,6 @@ KLISH_PLUGIN_INFIX_CONF_OPTS += --enable-shell
 else
 KLISH_PLUGIN_INFIX_CONF_OPTS += --disable-shell
 endif
-
 ifeq ($(BR2_PACKAGE_BASH),y)
 KLISH_PLUGIN_INFIX_CONF_OPTS += --with-shell=/bin/bash
 else
@@ -1,3 +1,3 @@
 # Locally calculated
 sha256  9d9d33b873917ca5d0bdcc47a36d2fd385971ab0c045d1472fcadf95ee5bcf5b  LICENCE
-sha256  79c9b16b227320fea358114738933ea25be33f8f263d3eec1f83fb603c0c0b22  klish-019ebd2704e322b5d500f5687d526431e535eec8-git4.tar.gz
+sha256  eff4cc740c6cfe2c03f7aeee2092f16616575d1462b1ad67d9f476463a6bf3fe  klish-1c5ae4bbb49a0d7e1425ca1afe8518b873ee84cb-git4.tar.gz
@@ -4,7 +4,7 @@
 #
 ################################################################################

-KLISH_VERSION = 019ebd2704e322b5d500f5687d526431e535eec8
+KLISH_VERSION = 1c5ae4bbb49a0d7e1425ca1afe8518b873ee84cb
 KLISH_SITE = https://github.com/kernelkit/klish.git
 #KLISH_VERSION = tags/3.0.0
 #KLISH_SITE = https://src.libcode.org/pkun/klish.git
@@ -1,5 +1,5 @@
 # From https://github.com/troglobit/tetris/releases/
-sha256 2c6e17f927d4b73dca97c7d280d3848a515a87ca70ecdf072808561e47bf757c  tetris-1.4.0.tar.gz
+sha256 c19b3e5eea43891d55481de5530f5824131974a85fc2a18b8a977bcebcba8223  tetris-1.5.0.tar.gz

 # Locally calculated
 sha256 a84e2b5247b2013a69496eecdd16e6051c04f1f3cb259b5f6ca8e671101a1f94  LICENSE
@@ -4,7 +4,7 @@
 #
 ################################################################################

-TETRIS_VERSION = 1.4.0
+TETRIS_VERSION = 1.5.0
 TETRIS_SITE = https://github.com/troglobit/tetris/releases/download/$(TETRIS_VERSION)
 TETRIS_LICENSE = ISC
 TETRIS_LICENSE_FILES = LICENSE
@@ -1,8 +1,9 @@
-From fcbddd99782709b8bb8b028b580eaaf750431502 Mon Sep 17 00:00:00 2001
+From 072c2f0732bc1a55aaeb9b5319a71bb472e2fd7d Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 12 Mar 2024 10:27:24 +0100
 Subject: [PATCH 01/27] [FIX] net: dsa: mv88e6xxx: Fix timeout on waiting for
 PPU on 6393X
+Organization: Wires

 In a multi-chip setup, delays of up to 750ms are observed before the
 device (6393X) signals completion of PPU initialization (Global 1,
@@ -1,8 +1,9 @@
-From b5056d553c2f1493b66a1c7c456b74fb87eb6f9d Mon Sep 17 00:00:00 2001
+From 7b18b787450759f1c2507c7b65c81c3686040c90 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 27 Mar 2024 15:52:43 +0100
 Subject: [PATCH 02/27] net: dsa: mv88e6xxx: Improve indirect register access
 perf on 6393
+Organization: Wires

 When operating in multi-chip mode, the 6393 family maps a subset of
 commonly used global registers to the outermost address space (in
@@ -1,8 +1,9 @@
-From 11d35cf88242ab4c896baadced08c92385264cf5 Mon Sep 17 00:00:00 2001
+From 379dd2a00dc647b034befead65b26e467e63ae75 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Mon, 22 Apr 2024 23:18:01 +0200
 Subject: [PATCH 03/27] net: dsa: mv88e6xxx: Honor ports being managed via
 in-band-status
+Organization: Wires

 Keep all link parameters in their unforced states when the port is
 declared as being managed via in-band-status, and let the MAC
@@ -1,8 +1,9 @@
-From a975aade77741273d2531e52de5163ed83dda411 Mon Sep 17 00:00:00 2001
+From fd676f49b5aa5a1d372446be9ee01d1f126bcd54 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 24 Apr 2024 22:41:04 +0200
 Subject: [PATCH 04/27] net: dsa: mv88e6xxx: Limit rsvd2cpu policy to user
 ports on 6393X
+Organization: Wires

 For packets with a DA in the IEEE reserved L2 group range, originating
 from a CPU, forward it as normal, rather than classifying it as
@@ -1,7 +1,8 @@
-From 3ec7b214fc24eb0590517eb2e32fcc55e1ddcd43 Mon Sep 17 00:00:00 2001
+From 2aeb87ab82b7b9fb37e6b1c830dec5374158aa5d Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 16 Nov 2023 19:44:32 +0100
 Subject: [PATCH 05/27] net: dsa: mv88e6xxx: Add LED infrastructure
+Organization: Wires

 Parse DT for LEDs and register them for devices that support it,
 though no actual implementations exist yet.
@@ -1,7 +1,8 @@
-From 245031376473a5da1aa58d2d94cec8b860fa4094 Mon Sep 17 00:00:00 2001
+From 3de6f58239d6b09c3fe1e0978a556481be8f3a95 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 16 Nov 2023 21:59:35 +0100
 Subject: [PATCH 06/27] net: dsa: mv88e6xxx: Add LED support for 6393X
+Organization: Wires

 Trigger support:
 - "none"
@@ -1,8 +1,9 @@
-From 43f2078a012891e34673b6cd5f59d8a6d761a49a Mon Sep 17 00:00:00 2001
+From f28803088158ddf97186f143f4bdc516e42e9354 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 28 May 2024 10:38:42 +0200
 Subject: [PATCH 07/27] net: dsa: tag_dsa: Use tag priority as initial
 skb->priority
+Organization: Wires

 Use the 3-bit priority field from the DSA tag as the initial packet
 priority on ingress to the CPU.
@@ -1,8 +1,9 @@
-From b461a4b81f08577cb932405712e9b828be69ae2c Mon Sep 17 00:00:00 2001
+From bbbf265610459ec49afcde923d1872ca3e2ad679 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 16 Jan 2024 16:00:55 +0100
 Subject: [PATCH 08/27] net: dsa: Support MDB memberships whose L2 addresses
 overlap
+Organization: Wires

 Multiple IP multicast groups (32 for v4, 2^80 for v6) map to the same
 L2 address. This means that switchdev drivers may receive multiple MDB
@@ -1,7 +1,8 @@
-From b7685c7c95324e6cbd5b74343b065b2fd6dd7033 Mon Sep 17 00:00:00 2001
+From 797ed124853b8f0ef6d110e1633be2637c97c31d Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 21 Mar 2024 19:12:15 +0100
 Subject: [PATCH 09/27] net: dsa: Support EtherType based priority overrides
+Organization: Wires

 ---
 include/net/dsa.h |  4 ++++
@@ -1,8 +1,9 @@
-From 88b342d0c8d46b8b51fdebde1f89c74cbae93801 Mon Sep 17 00:00:00 2001
+From ea2d865a2101317e22c60143e891d643feac8e8c Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Fri, 22 Mar 2024 16:15:43 +0100
 Subject: [PATCH 10/27] net: dsa: mv88e6xxx: Support EtherType based priority
 overrides
+Organization: Wires

 ---
 drivers/net/dsa/mv88e6xxx/chip.c    | 64 +++++++++++++++++++++++++++++
@@ -1,7 +1,8 @@
-From cc93e5f94d1c0f5c459f4ce479bb3e51a636ea3e Mon Sep 17 00:00:00 2001
+From a239baf492b7c4a1280562bb9478006627b73036 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 28 May 2024 11:04:22 +0200
 Subject: [PATCH 11/27] net: dsa: mv88e6xxx: Add mqprio qdisc support
+Organization: Wires

 Add support for attaching mqprio qdisc's to mv88e6xxx ports and use
 the packet's traffic class as the outgoing priority when no PCP bits
@@ -1,8 +1,9 @@
-From eaf7cdbe2d1f8f4c1a7e3a9da9af8005224564d6 Mon Sep 17 00:00:00 2001
+From 60ac4461cef9b2024df52c23a040b100093ba1d7 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 29 May 2024 13:20:41 +0200
 Subject: [PATCH 12/27] net: dsa: mv88e6xxx: Use VLAN prio over IP when both
 are available
+Organization: Wires

 Switch the priority sourcing precdence to prefer VLAN PCP over IP
 DSCP, when both are available.
@@ -1,8 +1,9 @@
-From 072e5f29fda05c64ef460c6f22d341c1a15bf0b8 Mon Sep 17 00:00:00 2001
+From d3b20e07514928830034d4af2eb7660bfcacc1e0 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 26 Nov 2024 19:45:59 +0100
 Subject: [PATCH 13/27] [FIX] net: dsa: mv88e6xxx: Trap locally terminated
 VLANs
+Organization: Wires

 Before this change, in a setup like the following, packets assigned to
 VLAN 10 were forwarded between the switch ports, even though the
@@ -1,8 +1,9 @@
-From d60964c1fcffda523339c6dc920a0d9bb47c2dc5 Mon Sep 17 00:00:00 2001
+From b4870c7df5d6659da439e8f1322dd5496a15445e Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 19 Sep 2023 18:38:10 +0200
 Subject: [PATCH 14/27] net: phy: marvell10g: Support firmware loading on
 88X3310
+Organization: Wires

 When probing, if a device is waiting for firmware to be loaded into
 its RAM, ask userspace for the binary and load it over XMDIO.
@@ -1,8 +1,9 @@
-From b3f76049e4f7aa89f9bbc345d7d512ad4623a431 Mon Sep 17 00:00:00 2001
+From 6161b59334064ebfc0b80b0214fa12e6d042400e Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 21 Nov 2023 20:15:24 +0100
 Subject: [PATCH 15/27] net: phy: marvell10g: Fix power-up when strapped to
 start powered down
+Organization: Wires

 On devices which are hardware strapped to start powered down (PDSTATE
 == 1), make sure that we clear the power-down bit on all units
@@ -1,7 +1,8 @@
-From b3e8ff6144d695ddd6209bf2c83e709a307e53ad Mon Sep 17 00:00:00 2001
+From 403075caa172cf8e5c50346a86698b0a909a9263 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 15 Nov 2023 20:58:42 +0100
 Subject: [PATCH 16/27] net: phy: marvell10g: Add LED support for 88X3310
+Organization: Wires

 Pickup the LEDs from the state in which the hardware reset or
 bootloader left them, but also support further configuration via
@@ -1,8 +1,9 @@
-From 92de10bbe084fb2744e3fa487bc0b4a85595ccf8 Mon Sep 17 00:00:00 2001
+From 84ca381445809f1d796c461a5b085ff4a3b7f93e Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 12 Dec 2023 09:51:05 +0100
 Subject: [PATCH 17/27] net: phy: marvell10g: Support LEDs tied to a single
 media side
+Organization: Wires

 In a combo-port setup, i.e. where both the copper and fiber interface
 are available to the user, the LEDs may be physically located either
@@ -1,7 +1,8 @@
-From e4d37c329a06d914ad7c49f9230804eb2f02a310 Mon Sep 17 00:00:00 2001
+From 47eddfb80fd6bbbc186b0d8a93697c36840168e8 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 27 Mar 2024 10:10:19 +0100
 Subject: [PATCH 18/27] net: phy: Do not resume PHY when attaching
+Organization: Wires

 The PHY should not start negotiating with its link-partner until
 explicitly instructed to do so.
@@ -19,7 +20,7 @@ administratively down.
 1 file changed, 1 deletion(-)

 diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
-index 8af44224480f..a2e386e9fafc 100644
+index 13dea33d86ff..25d0face304a 100644
 --- a/drivers/net/phy/phy_device.c
 +++ b/drivers/net/phy/phy_device.c
@@ -1661,7 +1661,6 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
@@ -1,8 +1,9 @@
-From 6c543747d8b5611b84041376fa2299944fb60ab4 Mon Sep 17 00:00:00 2001
+From 761e5315fc2bac3809258e9719efd1475a73ac14 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Mon, 4 Mar 2024 16:47:28 +0100
 Subject: [PATCH 19/27] net: bridge: avoid classifying unknown multicast as
 mrouters_only
+Organization: Wires

 Unknown multicast, MAC/IPv4/IPv6, should always be flooded according to
 the per-port mcast_flood setting, as well as to detected and configured
@@ -152,10 +153,10 @@ index ceaa5a89b947..e54d648db7de 100644
 			br_multicast_flood(mdst, skb, brmctx, local_rcv, false);
 	}
 diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
-index b2ae0d2434d2..3137c1fcfc6a 100644
+index 733ff6b758f6..b1799e03403f 100644
 --- a/net/bridge/br_multicast.c
 +++ b/net/bridge/br_multicast.c
-@@ -3774,6 +3774,11 @@ static void br_multicast_err_count(const struct net_bridge *br,
+@@ -3835,6 +3835,11 @@ static void br_multicast_err_count(const struct net_bridge *br,
 	u64_stats_update_end(&pstats->syncp);
 }
 
@@ -167,7 +168,7 @@ index b2ae0d2434d2..3137c1fcfc6a 100644
 static void br_multicast_pim(struct net_bridge_mcast *brmctx,
 			     struct net_bridge_mcast_port *pmctx,
 			     const struct sk_buff *skb)
-@@ -3820,7 +3825,8 @@ static int br_multicast_ipv4_rcv(struct net_bridge_mcast *brmctx,
+@@ -3881,7 +3886,8 @@ static int br_multicast_ipv4_rcv(struct net_bridge_mcast *brmctx,
 
 	if (err == -ENOMSG) {
 		if (!ipv4_is_local_multicast(ip_hdr(skb)->daddr)) {
@@ -177,7 +178,7 @@ index b2ae0d2434d2..3137c1fcfc6a 100644
 		} else if (pim_ipv4_all_pim_routers(ip_hdr(skb)->daddr)) {
 			if (ip_hdr(skb)->protocol == IPPROTO_PIM)
 				br_multicast_pim(brmctx, pmctx, skb);
-@@ -3889,7 +3895,8 @@ static int br_multicast_ipv6_rcv(struct net_bridge_mcast *brmctx,
+@@ -3950,7 +3956,8 @@ static int br_multicast_ipv6_rcv(struct net_bridge_mcast *brmctx,
 
 	if (err == -ENOMSG || err == -ENODATA) {
 		if (!ipv6_addr_is_ll_all_nodes(&ipv6_hdr(skb)->daddr))
@@ -188,7 +189,7 @@ index b2ae0d2434d2..3137c1fcfc6a 100644
 		    ipv6_addr_is_all_snoopers(&ipv6_hdr(skb)->daddr))
 			br_ip6_multicast_mrd_rcv(brmctx, pmctx, skb);
 diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
-index df502cc1191c..b456cf9ec1cc 100644
+index 6a1bce8959af..ed5325c6add9 100644
 --- a/net/bridge/br_private.h
 +++ b/net/bridge/br_private.h
@@ -483,6 +483,7 @@ enum net_bridge_opts {
@@ -210,7 +211,7 @@ index df502cc1191c..b456cf9ec1cc 100644
 
 /* return true if both source port and dest port are isolated */
 static inline bool br_skb_isolated(const struct net_bridge_port *to,
-@@ -1409,6 +1410,19 @@ static inline void br_multicast_flood(struct net_bridge_mdb_entry *mdst,
+@@ -1410,6 +1411,19 @@ static inline void br_multicast_flood(struct net_bridge_mdb_entry *mdst,
 {
 }
 
@@ -1,8 +1,9 @@
-From 2a32b5fa3c5a1eccba292572eea1c092b4dd5fc7 Mon Sep 17 00:00:00 2001
+From 41c6eeb5c4042027eac70243dd28bcaf963ac6b8 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Tue, 5 Mar 2024 06:44:41 +0100
 Subject: [PATCH 20/27] net: bridge: Ignore router ports when forwarding L2
 multicast
+Organization: Wires

 Multicast router ports are either statically configured or learned from
 control protocol traffic (IGMP/MLD/PIM).  These protocols regulate IP
@@ -16,10 +17,10 @@ Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 1 file changed, 4 insertions(+), 1 deletion(-)

 diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
-index b456cf9ec1cc..aad99a27d968 100644
+index ed5325c6add9..0afb886b9a30 100644
 --- a/net/bridge/br_private.h
 +++ b/net/bridge/br_private.h
-@@ -1087,7 +1087,10 @@ br_multicast_get_first_rport_node(struct net_bridge_mcast *brmctx,
+@@ -1088,7 +1088,10 @@ br_multicast_get_first_rport_node(struct net_bridge_mcast *brmctx,
 	if (skb->protocol == htons(ETH_P_IPV6))
 		return rcu_dereference(hlist_first_rcu(&brmctx->ip6_mc_router_list));
 #endif
@@ -1,8 +1,9 @@
-From d8e5e7cef63d5eba6ef2c9e4f1f2cec359b71019 Mon Sep 17 00:00:00 2001
+From f831362d0a5717cbb18a9173defca6ec4d886377 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Thu, 4 Apr 2024 16:36:30 +0200
 Subject: [PATCH 21/27] net: bridge: drop delay for applying strict multicast
 filtering
+Organization: Wires

 This *local* patch drops the initial delay before applying strict multicast
 filtering, introduced in [1] and recently updated in [2].
@@ -24,7 +25,7 @@ Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 2 files changed, 8 insertions(+), 38 deletions(-)

 diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
-index 3137c1fcfc6a..34be07a1fd00 100644
+index b1799e03403f..282105bdca85 100644
 --- a/net/bridge/br_multicast.c
 +++ b/net/bridge/br_multicast.c
@@ -1762,10 +1762,6 @@ static void br_ip6_multicast_querier_expired(struct timer_list *t)
@@ -38,7 +39,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 static void br_multicast_select_own_querier(struct net_bridge_mcast *brmctx,
 					    struct br_ip *ip,
 					    struct sk_buff *skb)
-@@ -3196,12 +3192,8 @@ int br_multicast_dump_querier_state(struct sk_buff *skb,
+@@ -3257,12 +3253,8 @@ int br_multicast_dump_querier_state(struct sk_buff *skb,
 
 static void
 br_multicast_update_query_timer(struct net_bridge_mcast *brmctx,
@@ -52,7 +53,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 	mod_timer(&query->timer, jiffies + brmctx->multicast_querier_interval);
 }
 
-@@ -3392,13 +3384,12 @@ static void
+@@ -3453,13 +3445,12 @@ static void
 br_ip4_multicast_query_received(struct net_bridge_mcast *brmctx,
 				struct net_bridge_mcast_port *pmctx,
 				struct bridge_mcast_other_query *query,
@@ -68,7 +69,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 	br_ip4_multicast_mark_router(brmctx, pmctx);
 }
 
-@@ -3407,13 +3398,12 @@ static void
+@@ -3468,13 +3459,12 @@ static void
 br_ip6_multicast_query_received(struct net_bridge_mcast *brmctx,
 				struct net_bridge_mcast_port *pmctx,
 				struct bridge_mcast_other_query *query,
@@ -84,7 +85,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 	br_ip6_multicast_mark_router(brmctx, pmctx);
 }
 #endif
-@@ -3467,7 +3457,7 @@ static void br_ip4_multicast_query(struct net_bridge_mcast *brmctx,
+@@ -3528,7 +3518,7 @@ static void br_ip4_multicast_query(struct net_bridge_mcast *brmctx,
 
 		br_ip4_multicast_query_received(brmctx, pmctx,
 						&brmctx->ip4_other_query,
@@ -93,7 +94,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 		goto out;
 	}
 
-@@ -3555,7 +3545,7 @@ static int br_ip6_multicast_query(struct net_bridge_mcast *brmctx,
+@@ -3616,7 +3606,7 @@ static int br_ip6_multicast_query(struct net_bridge_mcast *brmctx,
 
 		br_ip6_multicast_query_received(brmctx, pmctx,
 						&brmctx->ip6_other_query,
@@ -102,7 +103,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 		goto out;
 	} else if (!group) {
 		goto out;
-@@ -4063,8 +4053,6 @@ void br_multicast_ctx_init(struct net_bridge *br,
+@@ -4124,8 +4114,6 @@ void br_multicast_ctx_init(struct net_bridge *br,
 		    br_ip4_multicast_local_router_expired, 0);
 	timer_setup(&brmctx->ip4_other_query.timer,
 		    br_ip4_multicast_querier_expired, 0);
@@ -111,7 +112,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 	timer_setup(&brmctx->ip4_own_query.timer,
 		    br_ip4_multicast_query_expired, 0);
 #if IS_ENABLED(CONFIG_IPV6)
-@@ -4072,8 +4060,6 @@ void br_multicast_ctx_init(struct net_bridge *br,
+@@ -4133,8 +4121,6 @@ void br_multicast_ctx_init(struct net_bridge *br,
 		    br_ip6_multicast_local_router_expired, 0);
 	timer_setup(&brmctx->ip6_other_query.timer,
 		    br_ip6_multicast_querier_expired, 0);
@@ -120,7 +121,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 	timer_setup(&brmctx->ip6_own_query.timer,
 		    br_ip6_multicast_query_expired, 0);
 #endif
-@@ -4208,12 +4194,10 @@ static void __br_multicast_stop(struct net_bridge_mcast *brmctx)
+@@ -4269,12 +4255,10 @@ static void __br_multicast_stop(struct net_bridge_mcast *brmctx)
 {
 	del_timer_sync(&brmctx->ip4_mc_router_timer);
 	del_timer_sync(&brmctx->ip4_other_query.timer);
@@ -133,7 +134,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 	del_timer_sync(&brmctx->ip6_own_query.timer);
 #endif
 }
-@@ -4641,8 +4625,6 @@ EXPORT_SYMBOL_GPL(br_multicast_router);
+@@ -4728,8 +4712,6 @@ EXPORT_SYMBOL_GPL(br_multicast_router);
 
 int br_multicast_set_querier(struct net_bridge_mcast *brmctx, unsigned long val)
 {
@@ -142,7 +143,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 	val = !!val;
 
 	spin_lock_bh(&brmctx->br->multicast_lock);
-@@ -4653,19 +4635,9 @@ int br_multicast_set_querier(struct net_bridge_mcast *brmctx, unsigned long val)
+@@ -4740,19 +4722,9 @@ int br_multicast_set_querier(struct net_bridge_mcast *brmctx, unsigned long val)
 	if (!val)
 		goto unlock;
 
@@ -163,7 +164,7 @@ index 3137c1fcfc6a..34be07a1fd00 100644
 #endif
 
 diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
-index aad99a27d968..ee8c2268ab5a 100644
+index 0afb886b9a30..5b5b2c2442a5 100644
 --- a/net/bridge/br_private.h
 +++ b/net/bridge/br_private.h
@@ -78,7 +78,6 @@ struct bridge_mcast_own_query {
@@ -174,7 +175,7 @@ index aad99a27d968..ee8c2268ab5a 100644
 };
 
 /* selected querier */
-@@ -1165,8 +1164,7 @@ __br_multicast_querier_exists(struct net_bridge_mcast *brmctx,
+@@ -1166,8 +1165,7 @@ __br_multicast_querier_exists(struct net_bridge_mcast *brmctx,
 		own_querier_enabled = false;
 	}
 
@@ -1,8 +1,9 @@
-From 9a1600de341da6d7e5b4294040f9b9bb1dbaf4c2 Mon Sep 17 00:00:00 2001
+From 1e0eb62180058e98c7d18e3e04540925801e34b5 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 16 May 2024 14:51:54 +0200
 Subject: [PATCH 22/27] net: bridge: Differentiate MDB additions from
 modifications
+Organization: Wires

 Before this change, the reception of an IGMPv3 report (and analogously
 for MLDv2) that adds a new group, would trigger two MDB RTM_NEWMDB
@@ -62,7 +63,7 @@ index 7e1ad229e133..3b1873e7c499 100644
 	if (br_multicast_should_handle_mode(brmctx, cfg->group.proto))
 		br_multicast_star_g_handle_mode(pg, cfg->filter_mode);
 diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
-index 34be07a1fd00..9c8bf38e0079 100644
+index 282105bdca85..aa97b07ed528 100644
 --- a/net/bridge/br_multicast.c
 +++ b/net/bridge/br_multicast.c
@@ -619,7 +619,7 @@ static void br_multicast_fwd_src_handle(struct net_bridge_group_src *src)
@@ -83,7 +84,7 @@ index 34be07a1fd00..9c8bf38e0079 100644
 	}
 out:
 	spin_unlock(&br->multicast_lock);
-@@ -2887,7 +2887,7 @@ static int br_ip4_multicast_igmp3_report(struct net_bridge_mcast *brmctx,
+@@ -2948,7 +2948,7 @@ static int br_ip4_multicast_igmp3_report(struct net_bridge_mcast *brmctx,
 			break;
 		}
 		if (changed)
@@ -92,7 +93,7 @@ index 34be07a1fd00..9c8bf38e0079 100644
 unlock_continue:
 		spin_unlock(&brmctx->br->multicast_lock);
 	}
-@@ -3029,7 +3029,7 @@ static int br_ip6_multicast_mld2_report(struct net_bridge_mcast *brmctx,
+@@ -3090,7 +3090,7 @@ static int br_ip6_multicast_mld2_report(struct net_bridge_mcast *brmctx,
 			break;
 		}
 		if (changed)
@@ -1,8 +1,9 @@
-From 0c877e451f0c7b722ad5d230ea1caab0967c1dad Mon Sep 17 00:00:00 2001
+From 86a738ca46e019a8913d100138d8972681a65b4b Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Fri, 24 Nov 2023 23:29:55 +0100
 Subject: [PATCH 23/27] nvmem: layouts: onie-tlv: Let device probe even when
 TLV is invalid
+Organization: Wires

 Before this change, probing an NVMEM device, expected to contain a
 valid TLV, would fail if it had not been provisioned yet. But an
@@ -1,7 +1,8 @@
-From 97cf0cdd2066192002da814883dc0bfff423a7ff Mon Sep 17 00:00:00 2001
+From df19ceb2579bd87d58f2caab739d8ba678785f5c Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Mon, 29 Apr 2024 15:14:51 +0200
 Subject: [PATCH 24/27] usb: core: adjust log level for unauthorized devices
+Organization: Wires

 The fact that a USB device currently is not authorized is not an error,
 so let's adjust the log level so these messages slip below radar for the
@@ -1,8 +1,9 @@
-From 2a0b03f9e4d789a36627a0798542b265be075b97 Mon Sep 17 00:00:00 2001
+From eea7cb00b2e657445de9913736ff38b99ed0f9a5 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Thu, 16 Jan 2025 12:35:12 +0100
 Subject: [PATCH 25/27] net: dsa: mv88e6xxx: collapse disabled state into
 blocking
+Organization: Wires

 This patch changes the behavior of switchcore ports wrt. the port state.
 Instead of disabling the port, the driver now treats the disabled state
@@ -1,8 +1,9 @@
-From 856ee833fe803bcda382c0ddd5af5dfe1f29add5 Mon Sep 17 00:00:00 2001
+From 0e24579e619a9d3ebb03293822092e03d16d6ad2 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 12 Feb 2025 22:03:14 +0100
 Subject: [PATCH 26/27] net: dsa: mv88e6xxx: Only activate LAG offloading when
 bridged
+Organization: Wires

 The current port isolation scheme for mv88e6xxx is detailed here:
 https://lore.kernel.org/netdev/20220203101657.990241-1-tobias@waldekranz.com/
@@ -1,8 +1,9 @@
-From f5bea4bc63d8c77ba4268f53acadde1b7fbd384f Mon Sep 17 00:00:00 2001
+From 73b60d31a3318344428842c7368b2f1eb0c05596 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Sun, 11 Aug 2024 11:27:35 +0200
 Subject: [PATCH 27/27] net: usb: r8152: add r8153b support for link/activity
 LEDs
+Organization: Wires

 This patch adds support for the link/activity LEDs on the NanoPi R2S
 and OrangePi R1 Plus.
@@ -1,2 +1,2 @@
 # Calculated with ../utils/kernel-refresh.sh
-sha256   a9b020721778384507010177d3929e7d4058f7f6120f05a99d56b5c5c0346a70  linux-6.12.32.tar.xz
+sha256   05f4e0b01dde578c3328eb539d305cccec7b84e939f6dd5f21fdaf5f313da748  linux-6.12.35.tar.xz
@@ -0,0 +1,232 @@
+From 9df1957e656940a50b844da879911ab5981ad1a9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Mattias=20Walstr=C3=B6m?= <lazzer@gmail.com>
+Date: Wed, 18 Jun 2025 21:21:18 +0200
+Subject: [PATCH] Add pidfile support when not daemonize
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Organization: Wires
+
+Adds pidfile.c from libite
+
+Signed-off-by: Mattias Walström <lazzer@gmail.com>
+---
+ wpa_supplicant/Makefile         |   1 +
+ wpa_supplicant/pidfile.c        | 153 ++++++++++++++++++++++++++++++++
+ wpa_supplicant/wpa_supplicant.c |   7 +-
+ 3 files changed, 160 insertions(+), 1 deletion(-)
+ create mode 100644 wpa_supplicant/pidfile.c
+
+diff --git a/wpa_supplicant/Makefile b/wpa_supplicant/Makefile
+index fd7d7a0bd..e14c7732a 100644
+--- a/wpa_supplicant/Makefile
+++ b/wpa_supplicant/Makefile
+@@ -104,6 +104,7 @@ endif
+ OBJS = config.o
+ OBJS += notify.o
+ OBJS += bss.o
+OBJS += pidfile.o
+ OBJS += eap_register.o
+ OBJS += ../src/utils/common.o
+ OBJS += ../src/utils/config.o
+diff --git a/wpa_supplicant/pidfile.c b/wpa_supplicant/pidfile.c
+new file mode 100644
+index 000000000..29dfbe242
+--- /dev/null
+++ b/wpa_supplicant/pidfile.c
+@@ -0,0 +1,153 @@
+/*	Updated by troglobit for libite/finit/uftpd projects 2016/07/04 */
+/*	$OpenBSD: pidfile.c,v 1.11 2015/06/03 02:24:36 millert Exp $	*/
+/*	$NetBSD: pidfile.c,v 1.4 2001/02/19 22:43:42 cgd Exp $	*/
+
+/*-
+ * Copyright (c) 1999 The NetBSD Foundation, Inc.
+ * All rights reserved.
+ *
+ * This code is derived from software contributed to The NetBSD Foundation
+ * by Jason R. Thorpe.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @file pidfile.c
+ * @author NetBSD Foundation Inc.
+ * @date 1999
+ * @copyright 2-clause BSD License
+ */
+
+#include <sys/stat.h>		/* utimensat() */
+#include <sys/time.h>		/* utimensat() on *BSD */
+#include <sys/types.h>
+#include <errno.h>
+#include <paths.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#ifndef pidfile
+static char *pidfile_path = NULL;
+static pid_t pidfile_pid  = 0;
+
+static void pidfile_cleanup(void);
+
+const  char *__pidfile_path = _PATH_VARRUN; /* Note: includes trailing slash '/' */
+const  char *__pidfile_name = NULL;
+extern char *__progname;
+
+/**
+ * Create or update mtime of process PID file.
+ * @param basename  Program name, or @c NULL, may start with '/'
+ *
+ * This function is intended to be used by UNIX daemons to save the PID of the main process
+ * responsible for handling signals.  If @p basename is @c NULL the implicit @a __progname
+ * variable from the C-library is used.  The @p basename may also start with '/', in which
+ * case it is interpreted as the absolute path to the PID file.
+ *
+ * @returns POSIX OK(0) on success, otherwise non-zero on error.
+ */
+int pidfile(const char *basename)
+{
+	int save_errno;
+	int atexit_already;
+	pid_t pid;
+	FILE *f;
+
+	if (basename == NULL)
+		basename = __progname;
+
+	pid = getpid();
+	atexit_already = 0;
+
+	if (pidfile_path != NULL) {
+		if (!access(pidfile_path, R_OK) && pid == pidfile_pid) {
+			utimensat(0, pidfile_path, NULL, 0);
+			return (0);
+		}
+		free(pidfile_path);
+		pidfile_path = NULL;
+		__pidfile_name = NULL;
+		atexit_already = 1;
+	}
+
+	if (basename[0] != '/') {
+		if (asprintf(&pidfile_path, "%s.pid", basename) == -1)
+			return (-1);
+	} else {
+		if (asprintf(&pidfile_path, "%s", basename) == -1)
+			return (-1);
+	}
+
+	if ((f = fopen(pidfile_path, "w")) == NULL) {
+		save_errno = errno;
+		free(pidfile_path);
+		pidfile_path = NULL;
+		errno = save_errno;
+		return (-1);
+	}
+
+	if (fprintf(f, "%ld\n", (long)pid) <= 0 || fflush(f) != 0) {
+		save_errno = errno;
+		(void) fclose(f);
+		(void) unlink(pidfile_path);
+		free(pidfile_path);
+		pidfile_path = NULL;
+		errno = save_errno;
+		return (-1);
+	}
+	(void) fclose(f);
+	__pidfile_name = pidfile_path;
+
+	/*
+	 * LITE extension, no need to set up another atexit() handler
+	 * if user only called us to update the mtime of the PID file
+	 */
+	if (atexit_already)
+		return (0);
+
+	pidfile_pid = pid;
+	if (atexit(pidfile_cleanup) < 0) {
+		save_errno = errno;
+		(void) unlink(pidfile_path);
+		free(pidfile_path);
+		pidfile_path = NULL;
+		pidfile_pid = 0;
+		errno = save_errno;
+		return (-1);
+	}
+
+	return (0);
+}
+
+static void
+pidfile_cleanup(void)
+{
+	if (pidfile_path != NULL && pidfile_pid == getpid()) {
+		(void) unlink(pidfile_path);
+		free(pidfile_path);
+		pidfile_path = NULL;
+	}
+}
+#endif
+diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c
+index dfbd63163..3a762ebc2 100644
+--- a/wpa_supplicant/wpa_supplicant.c
+++ b/wpa_supplicant/wpa_supplicant.c
+@@ -123,6 +123,7 @@ const char *const wpa_supplicant_full_license5 =
+ "\n";
+ #endif /* CONFIG_NO_STDOUT_DEBUG */
+ 
+int pidfile(const char *basename);
+ 
+ static void wpa_bss_tmp_disallow_timeout(void *eloop_ctx, void *timeout_ctx);
+ static void wpas_verify_ssid_beacon(void *eloop_ctx, void *timeout_ctx);
+@@ -1490,6 +1491,9 @@ static void wpa_supplicant_reconfig(int sig, void *signal_ctx)
+ 		/* Ignore errors since we cannot really do much to fix this */
+ 		wpa_printf(MSG_DEBUG, "Could not reopen debug log file");
+ 	}
+
+	if (!global->params.daemonize)
+		pidfile(global->params.pid_file);
+ }
+ 
+ 
+@@ -8555,7 +8559,6 @@ struct wpa_global * wpa_supplicant_init(struct wpa_params *params)
+ 	return global;
+ }
+ 
+-
+ /**
+  * wpa_supplicant_run - Run the %wpa_supplicant main event loop
+  * @global: Pointer to global data from wpa_supplicant_init()
+@@ -8589,6 +8592,8 @@ int wpa_supplicant_run(struct wpa_global *global)
+ 	eloop_register_signal_terminate(wpa_supplicant_terminate, global);
+ 	eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
+ 
+	if (!global->params.daemonize)
+		pidfile(global->params.pid_file);
+ 	eloop_run();
+ 
+ 	return 0;
+-- 
+2.43.0
+
@@ -1,4 +1,4 @@
 pkglibexec_SCRIPTS = bootstrap error load gen-service gen-hostname \
 		     gen-interfaces gen-motd gen-hardware gen-version \
-		     mstpd-wait-online
+		     mstpd-wait-online wait-interface
 sbin_SCRIPTS       = dagger migrate
@@ -0,0 +1,21 @@
+#!/bin/sh
+if [ $# -lt 2 ]; then
+	echo "usage: $0 <ifname> <timeout>"
+	exit 1
+fi
+
+ifname=$1
+timeout=$2
+while true; do
+    if ip link show $ifname &>/dev/null; then
+        break
+    fi
+
+    retries=$(($retries + 1))
+    if [ $retries -ge $timeout ]; then
+        logger -t wait-interface "Timeout: Interface $ifname not found after $timeout seconds"
+        exit 1
+    fi
+
+    sleep 1
+done
@@ -41,6 +41,10 @@ AC_ARG_ENABLE(containers,
        AS_HELP_STRING([--enable-containers], [Enable support for containers]),,[
 	enable_containers=no])

+AC_ARG_ENABLE(wifi,
+        AS_HELP_STRING([--enable-wifi], [Enable support for Wi-Fi]),,[
+	enable_wifi=no])
+
 AC_ARG_WITH(login-shell,
        AS_HELP_STRING([--with-login-shell=shell], [Login shell for new users, default: /bin/false]),
 	[login_shell=$withval], [login_shell=yes])
@@ -52,6 +56,9 @@ AC_ARG_WITH(crypt,
 AS_IF([test "x$enable_containers" = "xyes"], [
        AC_DEFINE(CONTAINERS, 1, [Built with container support])])

+AS_IF([test "x$enable_wifi" = "xyes"], [
+        AC_DEFINE(HAVE_WIFI, 1, [Built with Wi-Fi support])])
+
 AS_IF([test "x$with_login_shell" != "xno"], [
 	AS_IF([test "x$login_shell" = "xyes"], [login_shell=/bin/false])
 	AC_DEFINE_UNQUOTED(LOGIN_SHELL, "$login_shell", [Default: /bin/false])],[
@@ -122,6 +129,7 @@ cat <<EOF

 Optional features:
  Container support ....: $enable_containers
+  Wi-Fi support ........: $enable_wifi
  Login shell ..........: $login_shell
  Default crypt algo ...: $crypt

@@ -37,6 +37,7 @@ confd_plugin_la_SOURCES =			\
 	  infix-if-vlan.c			\
 	  infix-if-gre.c			\
 	  infix-if-vxlan.c			\
+	  infix-if-wifi.c			\
 	ietf-keystore.c				\
 	ietf-system.c				\
 	ietf-syslog.c				\
@@ -12,6 +12,7 @@
 #include <sys/time.h>
 #include <sys/param.h>
 #include <unistd.h>
+#include <stdbool.h>

 #include <libite/lite.h>
 #include <libite/queue.h>
@@ -137,9 +138,20 @@ static inline int register_change(sr_session_ctx_t *session, const char *module,
 	int flags, sr_module_change_cb cb, void *arg, sr_subscription_ctx_t **sub)
 {
 	struct confd *ptr = (struct confd *)arg;
+	bool need_core_hooks;
 	int rc;

-	if (!flags) {
+	/*
+	 * For standard subscribtions we hook into the callback chain
+	 * for all modules to figure out, per changeset, which of the
+	 * callbacks is the last one.  This is where we want to call the
+	 * global commit-done hook for candidate -> running changes and
+	 * the startup-save hook for running -> startup copying.
+	 */
+
+	need_core_hooks = !(flags & SR_SUBSCR_UPDATE);
+
+	if (need_core_hooks) {
 		sr_module_change_subscribe(ptr->session, module, xpath, core_pre_hook, NULL,
 				0, SR_SUBSCR_PASSIVE, sub);
 	}
@@ -151,14 +163,7 @@ static inline int register_change(sr_session_ctx_t *session, const char *module,
 		return rc;
 	}

-	/*
-	 * For standard subscribtions we hook into the callback chain
-	 * for all modules to figure out, per changeset, which of the
-	 * callbacks is the last one.  This is where we want to call the
-	 * global commit-done hook for candidate -> running changes and
-	 * the startup-save hook for running -> startup copying.
-	 */
-	if (!flags) {
+	if (need_core_hooks) {
 		sr_module_change_subscribe(ptr->session, module, xpath, core_post_hook, NULL,
 				core_hook_prio(), SR_SUBSCR_PASSIVE, sub);
 		sr_module_change_subscribe(ptr->startup, module, xpath, core_startup_save, NULL,
@@ -52,6 +52,9 @@ enum netdag_exit {
 };

 enum netdag_init {
+	/* Timeout for slow interfaces */
+	NETDAG_INIT_TIMEOUT = 00,
+
 	/* Configure link layer */
 	NETDAG_INIT_PHYS = 10,

@@ -114,23 +114,6 @@ int netdag_gen_ethtool(struct dagger *net, struct lyd_node *cif, struct lyd_node
 	struct lyd_node *eth = lydx_get_child(dif, "ethernet");
 	int err;

-	/*
-	 * Story time: when assigning a physical interface to a container, and then
-	 *             removing it, even though our type may be 'etherlike' we will
-	 *             get the following from sysrepo:
-	 *
-	 *               "ieee802-ethernet-interface:ethernet": {
-	 *                 "@": {
-	 *                   "yang:operation": "delete"
-	 *                 },
-	 *                 "duplex": "full"
-	 *               },
-	 *
-	 *             Hence this "redundant" check.
-	 */
-	if (iftype_from_iface(cif) != IFT_ETH)
-		return 0;
-
 	if (!eth)
 		return 0;

@@ -9,8 +9,11 @@
 #include <srx/common.h>
 #include <srx/lyx.h>
 #include <srx/srx_val.h>
+#include <libyang/libyang.h>

 #include "ietf-interfaces.h"
+#define  IFACE_PROBE_TIMEOUT 40
+

 bool iface_has_quirk(const char *ifname, const char *quirkname)
 {
@@ -27,6 +30,7 @@ bool iface_has_quirk(const char *ifname, const char *quirkname)

 	return quirk ? json_is_true(quirk) : false;
 }
+
 static bool iface_is_phys(const char *ifname)
 {
 	bool is_phys = false;
@@ -84,7 +88,9 @@ static int ifchange_cand_infer_type(sr_session_ctx_t *session, const char *path)
 		goto out;
 	}

-	if (iface_is_phys(ifname))
+	if (!fnmatch("wifi+([0-9])", ifname, FNM_EXTMATCH))
+		inferred.data.string_val = "infix-if-type:wifi";
+	else if (iface_is_phys(ifname))
 		inferred.data.string_val = "infix-if-type:ethernet";
 	else if (!fnmatch("br+([0-9])", ifname, FNM_EXTMATCH))
 		inferred.data.string_val = "infix-if-type:bridge";
@@ -112,6 +118,7 @@ static int ifchange_cand_infer_type(sr_session_ctx_t *session, const char *path)
 		inferred.data.string_val = "infix-if-type:gretap";
 	else if (!fnmatch("vxlan+([0-9])", ifname, FNM_EXTMATCH))
 		inferred.data.string_val = "infix-if-type:vxlan";
+
 	free(ifname);

 	if (inferred.data.string_val)
@@ -416,9 +423,13 @@ static int netdag_gen_afspec_add(sr_session_ctx_t *session, struct dagger *net,
 		return vlan_gen(NULL, cif, ip);
 	case IFT_VXLAN:
 		return vxlan_gen(NULL, cif, ip);
-
+	case IFT_WIFI:
+		return wifi_gen(NULL, cif, net);
 	case IFT_ETH:
+		return netdag_gen_ethtool(net, cif, dif);
 	case IFT_LO:
+		return 0;
+
 	case IFT_UNKNOWN:
 		sr_session_set_error_message(net->session, "%s: unsupported interface type \"%s\"",
 					     ifname, lydx_get_cattr(cif, "type"));
@@ -440,16 +451,18 @@ static int netdag_gen_afspec_set(sr_session_ctx_t *session, struct dagger *net,
 		return lag_gen(dif, cif, ip, 0);
 	case IFT_VLAN:
 		return vlan_gen(dif, cif, ip);
-
+	case IFT_ETH:
+		return netdag_gen_ethtool(net, cif, dif);
+	case IFT_WIFI:
+		return wifi_gen(dif, cif, net);
 	case IFT_DUMMY:
 	case IFT_GRE:
 	case IFT_GRETAP:
 	case IFT_VETH:
 	case IFT_VXLAN:
+	case IFT_LO:
 		return 0;

-	case IFT_ETH:
-	case IFT_LO:
 	case IFT_UNKNOWN:
 		return ERR_IFACE(cif, -ENOSYS, "unsupported interface type \"%s\"",
 				 lydx_get_cattr(cif, "type"));
@@ -466,10 +479,11 @@ static bool netdag_must_del(struct lyd_node *dif, struct lyd_node *cif)
 	case IFT_DUMMY:
 	case IFT_LO:
 		break;
+
+	case IFT_WIFI:
 	case IFT_ETH:
-	/* case IFT_LAG: */
-	/* 	... REMEMBER WHEN ADDING BOND SUPPORT ... */
 		return lydx_get_child(dif, "custom-phys-address");
+
 	case IFT_GRE:
 	case IFT_GRETAP:
 		return lydx_get_descendant(lyd_child(dif), "gre", NULL);
@@ -519,12 +533,12 @@ static int link_gen_del(struct lyd_node *dif, FILE *ip)
 	return 0;
 }

-static int veth_gen_del(struct lyd_node *dif, FILE *ip)
+static int veth_gen_del(struct lyd_node *dif, FILE *sh)
 {
 	if (!veth_is_primary(dif))
 		return 0;

-	return link_gen_del(dif, ip);
+	return link_gen_del(dif, sh);
 }

 static int netdag_gen_iface_del(struct dagger *net, struct lyd_node *dif,
@@ -554,6 +568,10 @@ static int netdag_gen_iface_del(struct dagger *net, struct lyd_node *dif,
 	case IFT_LO:
 		eth_gen_del(dif, ip);
 		break;
+	case IFT_WIFI:
+		eth_gen_del(dif, ip);
+		wifi_gen_del(dif, net);
+		break;
 	case IFT_VETH:
 		veth_gen_del(dif, ip);
 		break;
@@ -573,16 +591,35 @@ static int netdag_gen_iface_del(struct dagger *net, struct lyd_node *dif,
 	return 0;
 }

+static sr_error_t netdag_gen_iface_timeout(struct dagger *net, const char *ifname, const char *iftype)
+{
+	if (!strcmp(iftype, "infix-if-type:ethernet") || !strcmp(iftype, "infix-if-type:wifi")) {
+		FILE *wait = dagger_fopen_net_init(net, ifname, NETDAG_INIT_TIMEOUT, "wait-interface.sh");
+		if (!wait) {
+			return -EIO;
+		}
+
+		fprintf(wait, "/usr/libexec/confd/wait-interface %s %d\n", ifname, IFACE_PROBE_TIMEOUT);
+		fclose(wait);
+	 }
+	return SR_ERR_OK;
+}
+
 static sr_error_t netdag_gen_iface(sr_session_ctx_t *session, struct dagger *net,
 				   struct lyd_node *dif, struct lyd_node *cif)
 {
 	const char *ifname = lydx_get_cattr(dif, "name");
+	const char *iftype = lydx_get_cattr(dif, "type")?:lydx_get_cattr(cif, "type");
 	enum lydx_op op = lydx_get_op(dif);
 	const char *attr;
 	int err = 0;
-	bool fixed;
 	FILE *ip;

+
+	err = netdag_gen_iface_timeout(net, ifname, iftype);
+	if (err)
+		goto err;
+
 	if ((err = cni_netdag_gen_iface(net, ifname, dif, cif))) {
 		/* error or managed by CNI/podman */
 		if (err > 0)
@@ -590,9 +627,7 @@ static sr_error_t netdag_gen_iface(sr_session_ctx_t *session, struct dagger *net
 		goto err;
 	}

-	fixed = iface_is_phys(ifname) || !strcmp(ifname, "lo");
-
-	DEBUG("%s(%s) %s", ifname, fixed ? "fixed" : "dynamic",
+	DEBUG("%s %s", ifname,
 	      (op == LYDX_OP_NONE) ? "mod" : ((op == LYDX_OP_CREATE) ? "add" : "del"));

 	if (op == LYDX_OP_DELETE) {
@@ -630,7 +665,7 @@ static sr_error_t netdag_gen_iface(sr_session_ctx_t *session, struct dagger *net
 		goto err;
 	}

-	if (!fixed && op == LYDX_OP_CREATE) {
+	if (op == LYDX_OP_CREATE) {
 		err = netdag_gen_afspec_add(session, net, dif, cif, ip);
 		if (err)
 			goto err_close_ip;
@@ -655,7 +690,7 @@ static sr_error_t netdag_gen_iface(sr_session_ctx_t *session, struct dagger *net
 		goto err_close_ip;

 	/* Set type specific attributes */
-	if (!fixed && op != LYDX_OP_CREATE) {
+	if (op != LYDX_OP_CREATE) {
 		err = netdag_gen_afspec_set(session, net, dif, cif, ip);
 		if (err)
 			goto err_close_ip;
@@ -679,8 +714,6 @@ static sr_error_t netdag_gen_iface(sr_session_ctx_t *session, struct dagger *net

 	err = err ? : netdag_gen_sysctl(net, cif, dif);

-	err = err ? : netdag_gen_ethtool(net, cif, dif);
-
 err_close_ip:
 	fclose(ip);
 err:
@@ -710,6 +743,7 @@ static int netdag_init_iface(struct lyd_node *cif)

 	case IFT_DUMMY:
 	case IFT_ETH:
+	case IFT_WIFI:
 	case IFT_GRE:
 	case IFT_GRETAP:
 	case IFT_LO:
@@ -790,7 +824,7 @@ static int ifchange(sr_session_ctx_t *session, uint32_t sub_id, const char *modu
 	if (err)
 		return err;

-	err = sr_get_data(session, "/interfaces/interface", 0, 0, 0, &cfg);
+	err = sr_get_data(session, "//.", 0, 0, 0, &cfg);
 	if (err || !cfg)
 		goto err_abandon;

@@ -800,7 +834,6 @@ static int ifchange(sr_session_ctx_t *session, uint32_t sub_id, const char *modu

 	cifs = lydx_get_descendant(cfg->tree, "interfaces", "interface", NULL);
 	difs = lydx_get_descendant(diff, "interfaces", "interface", NULL);
-
 	err = netdag_init(session, &confd->netdag, cifs, difs);
 	if (err)
 		goto err_free_diff;
@@ -829,15 +862,72 @@ err_abandon:
 	return err;
 }

+static int keystorecb(sr_session_ctx_t *session, uint32_t sub_id, const char *module,
+		    const char *xpath, sr_event_t event, unsigned request_id, void *_confd)
+{
+	const struct lyd_node *diff;
+	const char *secret_name;
+	struct confd *confd = _confd;
+	struct lyd_node *interfaces, *interface, *dkeys, *dkey, *wifi;
+	sr_data_t *cfg = NULL;
+        int err = SR_ERR_OK;
+
+	switch (event) {
+	case SR_EV_CHANGE:
+		break;
+	default:
+		return SR_ERR_OK;
+	}
+
+	err = sr_get_data(session, "/interfaces/interface", 0, 0, 0, &cfg);
+	if (err || !cfg)
+		return err;
+
+	diff = sr_get_change_diff(session);
+	if (!diff)
+		goto cleanup;
+
+	interfaces = lydx_get_descendant(cfg->tree, "interfaces", "interface", NULL);
+	dkeys = lydx_get_descendant((struct lyd_node*) diff, "keystore", "symmetric-keys", "symmetric-key", NULL);
+
+	LYX_LIST_FOR_EACH(dkeys, dkey, "symmetric-key") {
+		secret_name = lydx_get_cattr(dkey, "name");
+		if (!secret_name)
+			continue;
+
+		LYX_LIST_FOR_EACH(interfaces, interface, "interface") {
+			const char *name;
+
+			if (iftype_from_iface(interface) != IFT_WIFI)
+				continue;
+
+			wifi = lydx_get_child(interface, "wifi");
+			if (!wifi)
+				continue;
+
+			name = lydx_get_cattr(wifi, "secret");
+			if (!name || strcmp(name, secret_name))
+				continue;
+			wifi_gen(NULL, interface, &confd->netdag);
+		}
+	}
+
+cleanup:
+	if (cfg)
+		sr_release_data(cfg);
+	return err;
+}
+
 int ietf_interfaces_init(struct confd *confd)
 {
 	int rc;

 	REGISTER_CHANGE(confd->session, "ietf-interfaces", "/ietf-interfaces:interfaces//.",
-			0, ifchange, confd, &confd->sub);
+			SR_SUBSCR_CHANGE_ALL_MODULES, ifchange, confd, &confd->sub);
+	REGISTER_CHANGE(confd->session, "ietf-keystore", "//*",
+			SR_SUBSCR_CHANGE_ALL_MODULES, keystorecb, confd, &confd->sub);
 	REGISTER_CHANGE(confd->cand, "ietf-interfaces", "/ietf-interfaces:interfaces//.",
 			SR_SUBSCR_UPDATE, ifchange_cand, confd, &confd->sub);
-
 	return SR_ERR_OK;
 fail:
 	ERROR("failed, error %d: %s", rc, sr_strerror(rc));
@@ -25,6 +25,7 @@
 	_map(IFT_BRIDGE, "infix-if-type:bridge")	\
 	_map(IFT_DUMMY,  "infix-if-type:dummy")		\
 	_map(IFT_ETH,    "infix-if-type:ethernet")	\
+	_map(IFT_WIFI,   "infix-if-type:wifi")	        \
 	_map(IFT_GRE,    "infix-if-type:gre")		\
 	_map(IFT_GRETAP, "infix-if-type:gretap")	\
 	_map(IFT_LAG,    "infix-if-type:lag")	\
@@ -119,6 +120,10 @@ int bridge_mcd_gen(struct lyd_node *cifs);
 /* infix-if-bridge-port.c */
 int bridge_port_gen(struct lyd_node *dif, struct lyd_node *cif, FILE *ip);

+/* infix-if-wifi.c */
+int wifi_gen(struct lyd_node *dif, struct lyd_node *cif, struct dagger *net);
+int wifi_gen_del(struct lyd_node *dif,  struct dagger *net);
+
 /* infix-if-gre.c */
 int gre_gen(struct lyd_node *dif, struct lyd_node *cif, FILE *ip);

@@ -113,10 +113,25 @@ static int add(const char *name, struct lyd_node *cif)

 		/* Content mount: create a unique file with 'content' and bind mount */
 		if (data) {
+			const char *mode = lydx_get_cattr(node, "mode");
 			const char *contdir = "/run/containers/files";
+			mode_t file_mode = 0644;
 			char cmd[256];
+			int pos, fd;
 			FILE *pp;
-			int pos;
+
+			if (mode) {
+				unsigned long val;
+				char *endptr;
+
+				val = strtoul(mode, &endptr, 8);
+				if (*endptr != '\0' || val > 07777) {
+					ERROR("%s: invalid file mode '%s'", nm, mode);
+					continue;
+				}
+
+				file_mode = (mode_t)val;
+			}

 			/*
 			 * prefix file name with container name, shared namespace,
@@ -129,6 +144,27 @@ static int add(const char *name, struct lyd_node *cif)
 					nm[i] = '-';
 			}

+			/*
+			 * Always create with secure permissions, then immediately
+			 * set final mode.  This takes care of both new files and
+			 * updates to existing files atomically.
+			 */
+			fd = open(nm, O_CREAT | O_WRONLY | O_TRUNC, 0600);
+			if (fd < 0) {
+				ERRNO("%s: failed creating file %s", name, nm);
+				continue;
+			}
+
+			/* Set final permissions */
+			if (fchmod(fd, file_mode) < 0) {
+				ERRNO("%s: failed setting file mode %s", nm, mode);
+				close(fd);
+				unlink(nm);
+				continue;
+			}
+			close(fd);
+
+			/* Now decode base64 content into the properly secured file */
 			snprintf(cmd, sizeof(cmd), "base64 -d > %s", nm);
 			pp = popen(cmd, "w");
 			if (!pp || fputs(data, pp) < 0) {
@@ -137,8 +173,8 @@ static int add(const char *name, struct lyd_node *cif)
 					pclose(pp);
 				continue;
 			}
-
 			pclose(pp);
+
 			type = "bind"; /* discard any configured setting */
 			src = nm;      /* discard any source, not used for content mounts */
 		}
@@ -0,0 +1,110 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
+#include <srx/lyx.h>
+
+#include "ietf-interfaces.h"
+
+#define WPA_SUPPLICANT_FINIT_CONF "/etc/finit.d/available/wpa_supplicant-%s.conf"
+#define WPA_SUPPLICANT_CONF       "/etc/wpa_supplicant-%s.conf"
+
+static int wifi_gen_config(const char *ifname, const char *ssid, const char *country, const char *secret, const char* encryption, struct dagger *net)
+{
+	FILE *wpa_supplicant = NULL, *wpa = NULL;
+	char *encryption_str;
+	int rc = SR_ERR_OK;
+
+	if (!secret && (ssid && country && encryption)) {
+		/* Not an error, updated from two ways, interface cb and keystore cb. */
+		return 0;
+	}
+
+	wpa = dagger_fopen_net_init(net, ifname, NETDAG_INIT_POST, "wpa_supplicant.sh");
+	if (!wpa) {
+		rc = SR_ERR_INTERNAL;
+		goto out;
+	}
+
+	fprintf(wpa, "# Generated by Infix confd\n");
+
+	fprintf(wpa, "if [ -f '/etc/finit.d/enabled/wifi@%s.conf' ];then\n", ifname);
+	fprintf(wpa, "initctl -bfqn touch wifi@%s\n", ifname);
+	fprintf(wpa, "else\n");
+	fprintf(wpa, "initctl -bfqn enable wifi@%s\n", ifname);
+	fprintf(wpa, "fi\n");
+	fclose(wpa);
+
+	wpa_supplicant = fopenf("w", WPA_SUPPLICANT_CONF, ifname);
+	if (!wpa_supplicant) {
+		rc = SR_ERR_INTERNAL;
+		goto out;
+	}
+
+	if (!secret || !ssid || !country || !encryption) {
+		fprintf(wpa_supplicant,
+			"ctrl_interface=/run/wpa_supplicant\n"
+			"autoscan=periodic:10\n"
+			"ap_scan=1\n");
+	} else {
+		if (!strcmp(encryption, "disabled")) {
+			asprintf(&encryption_str, "key_mgmt=NONE");
+		} else {
+			asprintf(&encryption_str, "key_mgmt=SAE WPA-PSK\npsk=\"%s\"", secret);
+		}
+		fprintf(wpa_supplicant,
+			"country=%s\n"
+			"ctrl_interface=/run/wpa_supplicant\n"
+			"autoscan=periodic:10\n"
+			"ap_scan=1\n"
+			"network={\n"
+			"bgscan=\"simple: 30:-45:300\"\n"
+			"ssid=\"%s\"\n"
+			"%s\n"
+			"}\n", country, ssid, encryption_str);
+			free(encryption_str);
+	}
+	fclose(wpa_supplicant);
+
+out:
+	return rc;
+
+}
+int wifi_gen(struct lyd_node *dif, struct lyd_node *cif, struct dagger *net)
+{
+	const char *ssid, *secret_name, *secret, *ifname, *country, *encryption;
+	struct lyd_node *wifi, *secret_node;
+
+	bool enabled;
+	ifname      = lydx_get_cattr(cif, "name");
+
+	if (cif && !lydx_get_child(cif, "wifi")) {
+		return wifi_gen_config(ifname, NULL, NULL, NULL, NULL, net);
+	}
+
+	enabled     = lydx_get_bool(cif, "enabled");
+	wifi        = lydx_get_child(cif, "wifi");
+
+	ssid        = lydx_get_cattr(wifi, "ssid");
+	secret_name = lydx_get_cattr(wifi, "secret");
+	country     = lydx_get_cattr(wifi, "country-code");
+	encryption  = lydx_get_cattr(wifi, "encryption");
+	secret_node = lydx_get_xpathf(cif, "../../keystore/symmetric-keys/symmetric-key[name='%s']", secret_name);
+	secret      = lydx_get_cattr(secret_node, "cleartext-key");
+
+	if (!enabled)
+		return wifi_gen_del(cif, net);
+
+	return wifi_gen_config(ifname, ssid, country, secret, encryption, net);
+}
+
+int wifi_gen_del(struct lyd_node *dif,  struct dagger *net)
+{
+	const char *ifname = lydx_get_cattr(dif, "name");
+	FILE *iw = dagger_fopen_net_exit(net, ifname, NETDAG_EXIT_PRE, "iw.sh");
+
+	fprintf(iw, "# Generated by Infix confd\n");
+	fprintf(iw, "iw dev %s disconnect\n", ifname);
+	fprintf(iw, "initctl -bfqn disable wifi@%s\n", ifname);
+	fclose(iw);
+	erasef(WPA_SUPPLICANT_CONF, ifname);
+
+	return SR_ERR_OK;
+}
@@ -1,5 +1,4 @@
 # -*- sh -*-
-# REMEMBER TO UPDATE infix-interfaces ALSO IN containers.inc

 MODULES=(
 	"ietf-system@2014-08-06.yang -e authentication -e local-users -e ntp -e ntp-udp-port -e timezone-name"
@@ -35,7 +34,9 @@ MODULES=(
 	"ieee802-ethernet-interface@2019-06-21.yang"
 	"infix-ethernet-interface@2024-02-27.yang"
 	"infix-factory-default@2023-06-28.yang"
-	"infix-interfaces@2025-01-09.yang -e vlan-filtering"
-	"infix-crypto-types@2025-02-04.yang"
-	"infix-keystore@2025-02-04.yang"
+	"infix-interfaces@2025-06-17.yang -e vlan-filtering"
+	"ietf-crypto-types -e cleartext-symmetric-keys"
+	"infix-crypto-types@2025-06-17.yang"
+	"ietf-keystore -e symmetric-keys"
+	"infix-keystore@2025-06-17.yang"
 )
@@ -22,6 +22,11 @@ module infix-containers {
    prefix infix-sys;
  }

+  revision 2025-06-25 {
+    description "Add file mode option to content mounts, allows creating scripts.";
+    reference "internal";
+  }
+
  revision 2025-05-14 {
    description
      "Validation improvement:
@@ -390,6 +395,16 @@ module infix-containers {
          }
        }

+        leaf mode {
+          description "File permissions for content mounts (not used for source mounts).
+
+                       Octal notation (e.g., '755', '0644', '4755').  When not specified,
+                       the mode will be '0644'.";
+          type string {
+            pattern '0?[0-7]{3,4}';
+          }
+        }
+
        leaf read-only {
          description "All mounts are read-only by default.
                       Use this option to allow containers to write to files
@@ -5,6 +5,10 @@ module infix-crypto-types {
  import ietf-crypto-types {
    prefix ct;
  }
+
+  revision 2025-06-17 {
+    description "Add Wi-Fi secret support.";
+  }
  revision 2025-02-04 {
    description "Initial";
  }
@@ -24,4 +28,14 @@ module infix-crypto-types {
    base public-key-format;
    base ct:ssh-public-key-format;
  }
+  identity symmetric-key-format {
+    description
+      "Base for symmetric key format";
+  }
+  identity wifi-preshared-key-format {
+    base ct:symmetric-key-format;
+    base symmetric-key-format;
+    description
+      "WiFi secret key";
+  }
 }
@@ -38,6 +38,14 @@ module infix-if-type {
    reference "internal";
  }

+  /*
+   * Features
+   */
+
+  feature wifi {
+    description "WiFi support is an optional build-time feature in Infix.";
+  }
+
  /*
   * Identities
   */
@@ -98,4 +106,10 @@ module infix-if-type {
    base ianaift:l2vlan;
    description "Layer 2 Virtual LAN using 802.1Q.";
  }
+  identity wifi {
+    if-feature wifi;
+    base infix-interface-type;
+    base ianaift:ieee80211;
+    description "WiFi interface";
+  }
 }
@@ -0,0 +1,185 @@
+submodule infix-if-wifi {
+  yang-version 1.1;
+  belongs-to infix-interfaces {
+    prefix infix-if;
+  }
+  import ietf-interfaces {
+    prefix if;
+  }
+  import ietf-yang-types {
+    prefix yang;
+  }
+  import ietf-netconf-acm {
+    prefix nacm;
+  }
+  import ietf-keystore {
+    prefix ks;
+  }
+  import infix-crypto-types {
+    prefix ixct;
+  }
+  import infix-if-type {
+    prefix infixift;
+  }
+  import infix-wifi-country-codes {
+    prefix iwcc;
+  }
+
+  organization "KernelKit";
+  contact      "kernelkit@googlegroups.com";
+  description
+    "WiFi-specific extensions to the standard IETF interfaces model.
+
+     This submodule defines configuration and operational data relevant to
+     WiFi interfaces, including security settings, network
+     discovery, and regulatory compliance.
+
+     It supports WiFi client mode and enables comprehensive management of
+     wireless connections, including encryption, country codes, and scanning.";
+
+  revision 2025-05-27 {
+    description "Initial revision.";
+    reference "internal";
+  }
+
+  feature wifi {
+    description "WiFi support is an optional build-time feature in Infix.";
+  }
+
+  typedef encryption {
+    type enumeration {
+      enum auto {
+        description
+          "Enables WPA/WPA2/WPA3 encryption with automatic protocol
+           negotiation. The system uses the strongest supported variant supported by Access Point.";
+      }
+      enum disabled {
+        description
+          "Disables encryption for an open network.
+
+           WARNING: Open networks transmit data unencrypted and should only
+           be used in trusted environments.";
+      }
+    }
+    description
+      "Encryption modes available for WiFi connections.
+
+       - auto: Secure connection using WPA3/WPA2/WPA (auto-selected)
+       - disabled: Open network (unencrypted)";
+  }
+
+
+  augment "/if:interfaces/if:interface" {
+    when "derived-from-or-self(if:type, 'infixift:wifi')" {
+      description
+        "Applies only to interfaces of type 'wifi'.";
+    }
+
+    container wifi {
+      if-feature wifi;
+      presence "Configure Wi-Fi settings";
+
+      description
+        "WiFi-specific configuration and operational data.";
+
+      leaf country-code {
+        type iwcc:country-code;
+        mandatory true;
+        description
+          "Two-letter ISO 3166-1 country code for regulatory compliance.
+
+           Examples: 'US', 'DE', 'JP'.
+
+           WARNING: Incorrect values may violate local laws.";
+
+
+      }
+
+      leaf encryption {
+        default auto;
+        type encryption;
+
+        description
+          "WiFi encryption method.
+
+           - auto (default): Enables WPA2/WPA3 auto-negotiation
+           - disabled: Disables encryption (open network)";
+      }
+
+      leaf ssid {
+        type string {
+          length "1..32";
+        }
+        mandatory true;
+
+        description
+          "WiFi network name (SSID).
+
+           Case-sensitive, must match the target network.
+
+           Length: 1–32 characters.";
+      }
+
+      leaf secret {
+        type ks:symmetric-key-ref;
+        mandatory true;
+        must "../encryption != 'disabled'" {
+           error-message
+            "Pre-shared key required unless encryption is disabled.";
+        }
+
+        description
+          "Pre-shared key (PSK) for WPA-secured networks.";
+      }
+
+      leaf rssi {
+        config false;
+        type int16;
+        units "dBm";
+        description
+          "Current received signal strength (RSSI) in dBm.
+
+           Lower (more negative) values indicate stronger signals.";
+      }
+
+      list scan-results {
+        config false;
+        key ssid;
+        description
+          "List of discovered networks.";
+
+        leaf ssid {
+          type string;
+          description
+            "SSID of the discovered network.";
+        }
+
+        leaf bssid {
+          type string;
+          description
+            "BSSID of the discovered network.";
+        }
+
+        leaf rssi {
+          type int16;
+          units "dBm";
+          description
+            "Signal strength of the network.";
+        }
+
+        leaf channel {
+          type int16;
+          description
+            "Channel on which the network was detected.";
+        }
+
+        leaf-list encryption {
+          ordered-by user;
+          type string;
+          description
+            "Human-readable description of the detected security.";
+        }
+      }
+    }
+  }
+}
@@ -0,0 +1 @@
+infix-if-wifi.yang
@@ -3,9 +3,6 @@ module infix-interfaces {
  namespace "urn:infix:interfaces:ns:yang:1.0";
  prefix infix-if;

-  import infix-if-type {
-    prefix infix-ift;
-  }
  import ietf-interfaces {
    prefix if;
  }
@@ -15,6 +12,12 @@ module infix-interfaces {
  import ietf-inet-types {
    prefix inet;
  }
+  import ietf-keystore {
+    prefix ks;
+  }
+  import infix-if-type {
+    prefix infix-ift;
+  }

  include infix-if-base;
  include infix-if-bridge;
@@ -24,12 +27,18 @@ module infix-interfaces {
  include infix-if-vlan;
  include infix-if-gre;
  include infix-if-vxlan;
+  include infix-if-wifi;

  organization "KernelKit";
  contact      "kernelkit@googlegroups.com";
  description  "Linux bridge and lag extensions for ietf-interfaces.";

-  revision 2025-01-09 {
+  revision 2025-06-17 {
+    description "Add support for Wi-Fi client.";
+    reference "internal";
+  }
+
+ revision 2025-01-09 {
    description "Add support for link aggregation, static and LACP.";
    reference "internal";
  }
@@ -5,9 +5,15 @@ module infix-keystore {
  import ietf-keystore {
    prefix ks;
  }
+  import ietf-crypto-types {
+    prefix ct;
+  }
  import infix-crypto-types {
    prefix infix-ct;
  }
+  revision 2025-06-17 {
+    description "Add Wi-Fi secrets support";
+  }
  revision 2025-02-04 {
    description "Initial";
  }
@@ -25,4 +31,35 @@ module infix-keystore {
      }
    }
  }
+  deviation "/ks:keystore/ks:symmetric-keys/ks:symmetric-key/ks:key-format" {
+    deviate not-supported;
+  }
+  augment "/ks:keystore/ks:symmetric-keys/ks:symmetric-key" {
+    leaf key-format {
+      type identityref {
+        base infix-ct:symmetric-key-format;
+      }
+      description
+        "Identifies the symmetric key's format
+
+        Valid symmetric key formats are:
+        wifi-preshared-key-format  - WiFi preshared key";
+    }
+  }
+  deviation "/ks:keystore/ks:symmetric-keys/ks:symmetric-key/ks:key-type/ks:cleartext-key/ks:cleartext-key" {
+    deviate not-supported;
+  }
+  augment "/ks:keystore/ks:symmetric-keys/ks:symmetric-key/ks:key-type" {
+    case cleartext-key {
+      leaf cleartext-key {
+        type string;
+        must "../../ks:key-format != 'infix-ct:wifi-preshared-key-format' or " +
+          "(string-length(.) >= 8 and string-length(.) <= 63)" {
+          error-message "WiFi pre-shared key must be 8-63 characters long";
+        }
+        description "WiFi pre-shared key: 8-63 printable ASCII characters";
+
+      }
+    }
+  }
 }
@@ -3,10 +3,15 @@ module infix-meta {
  namespace "urn:infix:meta:ns:yang:1.0";
  prefix infix-meta;

+  import ietf-yang-metadata {
+    prefix md;
+  }
+
  organization "KernelKit";
  contact      "kernelkit@googlegroups.com";
  description  "Infix metadata.";

+
  revision 2024-10-18 {
    description "Mark entire meta container obsolete.";
    reference "internal";
@@ -16,6 +21,12 @@ module infix-meta {
    reference "internal";
  }

+  md:annotation dirty {
+    type string;
+    description
+      "data";
+  }
+
  container meta {
    description "Meta data";
    status obsolete;
@@ -0,0 +1,287 @@
+module infix-wifi-country-codes {
+  yang-version 1.1;
+  namespace "urn:infix:wifi-country-codes";
+  prefix iwcc;
+
+  organization   "KernelKit";
+
+  contact        "kernelkit@googlegroups.com";
+
+  description
+    "This module defines country codes for WiFi regulatory domain
+     configuration based on ISO 3166-1 alpha-2 standard.
+
+     This model provides country code definitions for use in
+     802.11 wireless LAN regulatory compliance configuration.
+
+     The regulatory domain configuration follows the principles
+     established in IETF RFCs for wireless access point management.";
+
+  revision 2025-06-02 {
+    description
+      "Initial revision for WiFi country code support.";
+    reference
+      "RFC 5415: Control And Provisioning of Wireless Access Points (CAPWAP) Protocol Specification
+       RFC 5416: Control and Provisioning of Wireless Access Points (CAPWAP) Protocol Binding for IEEE 802.11";
+  }
+
+  typedef country-code {
+    type enumeration {
+      enum "AD" { description "Andorra"; }
+      enum "AE" { description "United Arab Emirates"; }
+      enum "AF" { description "Afghanistan"; }
+      enum "AG" { description "Antigua and Barbuda"; }
+      enum "AI" { description "Anguilla"; }
+      enum "AL" { description "Albania"; }
+      enum "AM" { description "Armenia"; }
+      enum "AO" { description "Angola"; }
+      enum "AQ" { description "Antarctica"; }
+      enum "AR" { description "Argentina"; }
+      enum "AS" { description "American Samoa"; }
+      enum "AT" { description "Austria"; }
+      enum "AU" { description "Australia"; }
+      enum "AW" { description "Aruba"; }
+      enum "AX" { description "Åland Islands"; }
+      enum "AZ" { description "Azerbaijan"; }
+      enum "BA" { description "Bosnia and Herzegovina"; }
+      enum "BB" { description "Barbados"; }
+      enum "BD" { description "Bangladesh"; }
+      enum "BE" { description "Belgium"; }
+      enum "BF" { description "Burkina Faso"; }
+      enum "BG" { description "Bulgaria"; }
+      enum "BH" { description "Bahrain"; }
+      enum "BI" { description "Burundi"; }
+      enum "BJ" { description "Benin"; }
+      enum "BL" { description "Saint Barthélemy"; }
+      enum "BM" { description "Bermuda"; }
+      enum "BN" { description "Brunei Darussalam"; }
+      enum "BO" { description "Bolivia"; }
+      enum "BQ" { description "Bonaire, Sint Eustatius and Saba"; }
+      enum "BR" { description "Brazil"; }
+      enum "BS" { description "Bahamas"; }
+      enum "BT" { description "Bhutan"; }
+      enum "BV" { description "Bouvet Island"; }
+      enum "BW" { description "Botswana"; }
+      enum "BY" { description "Belarus"; }
+      enum "BZ" { description "Belize"; }
+      enum "CA" { description "Canada"; }
+      enum "CC" { description "Cocos (Keeling) Islands"; }
+      enum "CD" { description "Congo, Democratic Republic of the"; }
+      enum "CF" { description "Central African Republic"; }
+      enum "CG" { description "Congo"; }
+      enum "CH" { description "Switzerland"; }
+      enum "CI" { description "Côte d'Ivoire"; }
+      enum "CK" { description "Cook Islands"; }
+      enum "CL" { description "Chile"; }
+      enum "CM" { description "Cameroon"; }
+      enum "CN" { description "China"; }
+      enum "CO" { description "Colombia"; }
+      enum "CR" { description "Costa Rica"; }
+      enum "CU" { description "Cuba"; }
+      enum "CV" { description "Cabo Verde"; }
+      enum "CW" { description "Curaçao"; }
+      enum "CX" { description "Christmas Island"; }
+      enum "CY" { description "Cyprus"; }
+      enum "CZ" { description "Czechia"; }
+      enum "DE" { description "Germany"; }
+      enum "DJ" { description "Djibouti"; }
+      enum "DK" { description "Denmark"; }
+      enum "DM" { description "Dominica"; }
+      enum "DO" { description "Dominican Republic"; }
+      enum "DZ" { description "Algeria"; }
+      enum "EC" { description "Ecuador"; }
+      enum "EE" { description "Estonia"; }
+      enum "EG" { description "Egypt"; }
+      enum "EH" { description "Western Sahara"; }
+      enum "ER" { description "Eritrea"; }
+      enum "ES" { description "Spain"; }
+      enum "ET" { description "Ethiopia"; }
+      enum "FI" { description "Finland"; }
+      enum "FJ" { description "Fiji"; }
+      enum "FK" { description "Falkland Islands (Malvinas)"; }
+      enum "FM" { description "Micronesia"; }
+      enum "FO" { description "Faroe Islands"; }
+      enum "FR" { description "France"; }
+      enum "GA" { description "Gabon"; }
+      enum "GB" { description "United Kingdom"; }
+      enum "GD" { description "Grenada"; }
+      enum "GE" { description "Georgia"; }
+      enum "GF" { description "French Guiana"; }
+      enum "GG" { description "Guernsey"; }
+      enum "GH" { description "Ghana"; }
+      enum "GI" { description "Gibraltar"; }
+      enum "GL" { description "Greenland"; }
+      enum "GM" { description "Gambia"; }
+      enum "GN" { description "Guinea"; }
+      enum "GP" { description "Guadeloupe"; }
+      enum "GQ" { description "Equatorial Guinea"; }
+      enum "GR" { description "Greece"; }
+      enum "GS" { description "South Georgia and the South Sandwich Islands"; }
+      enum "GT" { description "Guatemala"; }
+      enum "GU" { description "Guam"; }
+      enum "GW" { description "Guinea-Bissau"; }
+      enum "GY" { description "Guyana"; }
+      enum "HK" { description "Hong Kong"; }
+      enum "HM" { description "Heard Island and McDonald Islands"; }
+      enum "HN" { description "Honduras"; }
+      enum "HR" { description "Croatia"; }
+      enum "HT" { description "Haiti"; }
+      enum "HU" { description "Hungary"; }
+      enum "ID" { description "Indonesia"; }
+      enum "IE" { description "Ireland"; }
+      enum "IL" { description "Israel"; }
+      enum "IM" { description "Isle of Man"; }
+      enum "IN" { description "India"; }
+      enum "IO" { description "British Indian Ocean Territory"; }
+      enum "IQ" { description "Iraq"; }
+      enum "IR" { description "Iran"; }
+      enum "IS" { description "Iceland"; }
+      enum "IT" { description "Italy"; }
+      enum "JE" { description "Jersey"; }
+      enum "JM" { description "Jamaica"; }
+      enum "JO" { description "Jordan"; }
+      enum "JP" { description "Japan"; }
+      enum "KE" { description "Kenya"; }
+      enum "KG" { description "Kyrgyzstan"; }
+      enum "KH" { description "Cambodia"; }
+      enum "KI" { description "Kiribati"; }
+      enum "KM" { description "Comoros"; }
+      enum "KN" { description "Saint Kitts and Nevis"; }
+      enum "KP" { description "Korea, Democratic People's Republic of"; }
+      enum "KR" { description "Korea, Republic of"; }
+      enum "KW" { description "Kuwait"; }
+      enum "KY" { description "Cayman Islands"; }
+      enum "KZ" { description "Kazakhstan"; }
+      enum "LA" { description "Lao People's Democratic Republic"; }
+      enum "LB" { description "Lebanon"; }
+      enum "LC" { description "Saint Lucia"; }
+      enum "LI" { description "Liechtenstein"; }
+      enum "LK" { description "Sri Lanka"; }
+      enum "LR" { description "Liberia"; }
+      enum "LS" { description "Lesotho"; }
+      enum "LT" { description "Lithuania"; }
+      enum "LU" { description "Luxembourg"; }
+      enum "LV" { description "Latvia"; }
+      enum "LY" { description "Libya"; }
+      enum "MA" { description "Morocco"; }
+      enum "MC" { description "Monaco"; }
+      enum "MD" { description "Moldova"; }
+      enum "ME" { description "Montenegro"; }
+      enum "MF" { description "Saint Martin (French part)"; }
+      enum "MG" { description "Madagascar"; }
+      enum "MH" { description "Marshall Islands"; }
+      enum "MK" { description "North Macedonia"; }
+      enum "ML" { description "Mali"; }
+      enum "MM" { description "Myanmar"; }
+      enum "MN" { description "Mongolia"; }
+      enum "MO" { description "Macao"; }
+      enum "MP" { description "Northern Mariana Islands"; }
+      enum "MQ" { description "Martinique"; }
+      enum "MR" { description "Mauritania"; }
+      enum "MS" { description "Montserrat"; }
+      enum "MT" { description "Malta"; }
+      enum "MU" { description "Mauritius"; }
+      enum "MV" { description "Maldives"; }
+      enum "MW" { description "Malawi"; }
+      enum "MX" { description "Mexico"; }
+      enum "MY" { description "Malaysia"; }
+      enum "MZ" { description "Mozambique"; }
+      enum "NA" { description "Namibia"; }
+      enum "NC" { description "New Caledonia"; }
+      enum "NE" { description "Niger"; }
+      enum "NF" { description "Norfolk Island"; }
+      enum "NG" { description "Nigeria"; }
+      enum "NI" { description "Nicaragua"; }
+      enum "NL" { description "Netherlands"; }
+      enum "NO" { description "Norway"; }
+      enum "NP" { description "Nepal"; }
+      enum "NR" { description "Nauru"; }
+      enum "NU" { description "Niue"; }
+      enum "NZ" { description "New Zealand"; }
+      enum "OM" { description "Oman"; }
+      enum "PA" { description "Panama"; }
+      enum "PE" { description "Peru"; }
+      enum "PF" { description "French Polynesia"; }
+      enum "PG" { description "Papua New Guinea"; }
+      enum "PH" { description "Philippines"; }
+      enum "PK" { description "Pakistan"; }
+      enum "PL" { description "Poland"; }
+      enum "PM" { description "Saint Pierre and Miquelon"; }
+      enum "PN" { description "Pitcairn"; }
+      enum "PR" { description "Puerto Rico"; }
+      enum "PS" { description "Palestine, State of"; }
+      enum "PT" { description "Portugal"; }
+      enum "PW" { description "Palau"; }
+      enum "PY" { description "Paraguay"; }
+      enum "QA" { description "Qatar"; }
+      enum "RE" { description "Réunion"; }
+      enum "RO" { description "Romania"; }
+      enum "RS" { description "Serbia"; }
+      enum "RU" { description "Russian Federation"; }
+      enum "RW" { description "Rwanda"; }
+      enum "SA" { description "Saudi Arabia"; }
+      enum "SB" { description "Solomon Islands"; }
+      enum "SC" { description "Seychelles"; }
+      enum "SD" { description "Sudan"; }
+      enum "SE" { description "Sweden"; }
+      enum "SG" { description "Singapore"; }
+      enum "SH" { description "Saint Helena, Ascension and Tristan da Cunha"; }
+      enum "SI" { description "Slovenia"; }
+      enum "SJ" { description "Svalbard and Jan Mayen"; }
+      enum "SK" { description "Slovakia"; }
+      enum "SL" { description "Sierra Leone"; }
+      enum "SM" { description "San Marino"; }
+      enum "SN" { description "Senegal"; }
+      enum "SO" { description "Somalia"; }
+      enum "SR" { description "Suriname"; }
+      enum "SS" { description "South Sudan"; }
+      enum "ST" { description "Sao Tome and Principe"; }
+      enum "SV" { description "El Salvador"; }
+      enum "SX" { description "Sint Maarten (Dutch part)"; }
+      enum "SY" { description "Syrian Arab Republic"; }
+      enum "SZ" { description "Eswatini"; }
+      enum "TC" { description "Turks and Caicos Islands"; }
+      enum "TD" { description "Chad"; }
+      enum "TF" { description "French Southern Territories"; }
+      enum "TG" { description "Togo"; }
+      enum "TH" { description "Thailand"; }
+      enum "TJ" { description "Tajikistan"; }
+      enum "TK" { description "Tokelau"; }
+      enum "TL" { description "Timor-Leste"; }
+      enum "TM" { description "Turkmenistan"; }
+      enum "TN" { description "Tunisia"; }
+      enum "TO" { description "Tonga"; }
+      enum "TR" { description "Turkey"; }
+      enum "TT" { description "Trinidad and Tobago"; }
+      enum "TV" { description "Tuvalu"; }
+      enum "TW" { description "Taiwan"; }
+      enum "TZ" { description "Tanzania"; }
+      enum "UA" { description "Ukraine"; }
+      enum "UG" { description "Uganda"; }
+      enum "UM" { description "United States Minor Outlying Islands"; }
+      enum "US" { description "United States of America"; }
+      enum "UY" { description "Uruguay"; }
+      enum "UZ" { description "Uzbekistan"; }
+      enum "VA" { description "Holy See (Vatican City State)"; }
+      enum "VC" { description "Saint Vincent and the Grenadines"; }
+      enum "VE" { description "Venezuela"; }
+      enum "VG" { description "Virgin Islands, British"; }
+      enum "VI" { description "Virgin Islands, U.S."; }
+      enum "VN" { description "Viet Nam"; }
+      enum "VU" { description "Vanuatu"; }
+      enum "WF" { description "Wallis and Futuna"; }
+      enum "WS" { description "Samoa"; }
+      enum "YE" { description "Yemen"; }
+      enum "YT" { description "Mayotte"; }
+      enum "ZA" { description "South Africa"; }
+      enum "ZM" { description "Zambia"; }
+      enum "ZW" { description "Zimbabwe"; }
+    }
+    description
+      "Complete list of ISO 3166-1 alpha-2 country codes for
+       regulatory domain configuration.";
+    reference
+      "ISO 3166-1:2020 Codes for the representation of names of countries
+       and their subdivisions -- Part 1: Country codes";
+  }
+}
@@ -0,0 +1 @@
+infix-wifi-country-codes.yang
@@ -1,6 +1,5 @@
 # -*- sh -*-
-# REMEMBER TO UPDATE infix-interfaces ALSO IN confd.inc
 MODULES=(
-    "infix-interfaces@2025-01-09.yang -e vlan-filtering -e containers"
-    "infix-containers@2025-05-14.yang"
+    "infix-interfaces -e containers"
+    "infix-containers@2025-06-25.yang"
 )
@@ -0,0 +1,4 @@
+MODULES=(
+	"infix-interfaces -e wifi"
+	"infix-if-type -e wifi"
+)
@@ -62,7 +62,7 @@ code > span.in { color: #60a0b0; font-weight: bold; font-style: italic; } /* Inf
 	</script>
 		<h1>Welcome to Infix :-)</h1>
 	      <p><img align="right" src="logo.png" alt="Infix - Linux <3 NETCONF" width=480 border=10></p>
-<p>Infix is a free, Linux based, immutable Network Operating System (NOS) built on <a href="https://buildroot.org/">Buildroot</a>, and <a href="https://www.sysrepo.org/">sysrepo</a>. A powerful mix that ease porting to different platforms, simplify long-term maintenance, and provide made-easy management using NETCONF<a href="#fn1" class="footnote-ref" id="fnref1" role="doc-noteref"><sup>1</sup></a> or the built-in command line interface (CLI) from a console or SSH login.</p>
+<p>Infix is a free, Linux-based, immutable, and friendly operating system built around <a href="https://buildroot.org/">Buildroot</a>, and <a href="https://www.sysrepo.org/">sysrepo</a>.  A powerful mix that ease porting to different platforms, simplify long-term maintenance, and provide made-easy management using NETCONF<a href="#fn1" class="footnote-ref" id="fnref1" role="doc-noteref"><sup>1</sup></a> or the built-in command line interface (CLI) from a console or SSH login.</p>
 <blockquote>
 <p>Click the <strong>▶ Example CLI Session</strong> foldout below for an example, or head on over to the <a href="doc/README.md">Infix Documentation</a> for more information on how to set up the system.</p>
 </blockquote>
@@ -164,6 +164,20 @@ def lldp(args: List[str]):
        return
    cli_pretty(data, "show-lldp")

+def wifi(args: List[str]):
+    iface = args[0]
+    if len(args) == 0:
+        print("Illigal usage")
+        return
+    if is_valid_interface_name(iface):
+        if not os.path.exists(f"/sys/class/net/{iface}/wireless"):
+            print("Not a Wi-Fi interface")
+            return
+        data = run_sysrepocfg("/ietf-interfaces:interfaces")
+        cli_pretty(data, "show-wifi-scan", "-n", iface)
+    else:
+        print(f"Invalid interface name: {iface}")
+
 def execute_command(command: str, args: List[str]):
    command_mapping = {
        'dhcp': dhcp,
@@ -174,6 +188,7 @@ def execute_command(command: str, args: List[str]):
        'lldp': lldp,
        'software' : software,
        'stp': stp,
+        'wifi': wifi
    }

    if command in command_mapping:
@@ -82,6 +82,20 @@ class PadNtpSource:
    poll = 14


+class PadWifiScan:
+    ssid  = 40
+    encryption = 30
+    signal = 9
+
+
+class PadLldp:
+    interface = 16
+    rem_idx = 10
+    time = 12
+    chassis_id = 20
+    port_id = 20
+
+
 class Decore():
    @staticmethod
    def decorate(sgr, txt, restore="0"):
@@ -103,6 +117,10 @@ class Decore():
    def green(txt):
        return Decore.decorate("32", txt, "39")

+    @staticmethod
+    def bright_green(txt):
+        return Decore.decorate("1;32", txt, "39")
+
    @staticmethod
    def yellow(txt):
        return Decore.decorate("33", txt, "39")
@@ -116,12 +134,17 @@ class Decore():
        return Decore.decorate("100", txt)


-class PadLldp:
-    interface = 16
-    rem_idx = 10
-    time = 12
-    chassis_id = 20
-    port_id = 20
+def rssi_to_status(rssi):
+    if rssi <= -75:
+        status = Decore.bright_green("excellent")
+    elif rssi <= -65:
+        status = Decore.green("good")
+    elif rssi <= -50:
+        status = Decore.yellow("poor")
+    else:
+        status = Decore.red("bad")
+
+    return status


 def datetime_now():
@@ -196,7 +219,6 @@ class Date(datetime):
        tz = tz.replace(":", "")
        return cls.strptime(f"{date}+{tz}", "%Y-%m-%dT%H:%M:%S%z")

-
 class Route:
    def __init__(self, data, ip):
        self.data = data
@@ -524,12 +546,16 @@ class Iface:

        self.gre = self.data.get('infix-interfaces:gre')
        self.vxlan = self.data.get('infix-interfaces:vxlan')
+        self.wifi = self.data.get('infix-interfaces:wifi')

        if self.data.get('infix-interfaces:vlan'):
            self.lower_if = self.data.get('infix-interfaces:vlan', None).get('lower-layer-if',None)
        else:
            self.lower_if = ''

+    def is_wifi(self):
+        return self.type == "infix-if-type:wifi"
+
    def is_vlan(self):
        return self.type == "infix-if-type:vlan"

@@ -554,7 +580,7 @@ class Iface:

    def is_gretap(self):
        return self.data['type'] == "infix-if-type:gretap"
-    
+
    def oper(self, detail=False):
        """Remap in brief overview to fit column widths."""
        if not detail and self.oper_status == "lower-layer-down":
@@ -625,6 +651,47 @@ class Iface:
        row = self._pr_proto_common("loopback", False, pipe);
        print(row)

+    def pr_wifi_ssids(self):
+        hdr =  (f"{'SSID':<{PadWifiScan.ssid}}"
+                f"{'ENCRYPTION':<{PadWifiScan.encryption}}"
+                f"{'SIGNAL':<{PadWifiScan.signal}}"
+                )
+
+        print(Decore.invert(hdr))
+        results=self.wifi.get("scan-results", {})
+        for result in results:
+            encstr = ",".join(result["encryption"])
+            status=rssi_to_status(result["rssi"])
+            row = f"{result['ssid']:<{PadWifiScan.ssid}}"
+            row += f"{encstr:<{PadWifiScan.encryption}}"
+            row += f"{status:<{PadWifiScan.signal}}"
+
+            print(row)
+
+
+    def pr_proto_wifi(self, pipe=''):
+        row = self._pr_proto_common("ethernet", True, pipe);
+        print(row)
+        ssid = None
+        rssi = None
+
+        if self.wifi:
+            rssi=self.wifi.get("rssi")
+            ssid=self.wifi.get("ssid")
+        if ssid is None:
+            ssid="------"
+
+        if rssi is None:
+            signal="------"
+        else:
+            signal=rssi_to_status(rssi)
+        data_str = f"ssid: {ssid}, signal: {signal}"
+
+        row =  f"{'':<{Pad.iface}}"
+        row += f"{'wifi':<{Pad.proto}}"
+        row += f"{'':<{Pad.state}}{data_str}"
+        print(row)
+
    def pr_proto_br(self, br_vlans):
        data_str = ""

@@ -765,6 +832,12 @@ class Iface:
        self.pr_proto_ipv4()
        self.pr_proto_ipv6()

+    def pr_wifi(self):
+        self.pr_name(pipe="")
+        self.pr_proto_wifi()
+        self.pr_proto_ipv4()
+        self.pr_proto_ipv6()
+
    def pr_vlan(self, _ifaces):
        self.pr_name(pipe="")
        self.pr_proto_eth()
@@ -874,6 +947,14 @@ class Iface:
        else:
                print(f"{'ipv6 addresses':<{20}}:")

+        if self.wifi:
+            ssid=self.wifi.get('ssid', "----")
+            rssi=self.wifi.get('rssi', "----")
+            print(f"{'SSID':<{20}}: {ssid}")
+            print(f"{'Signal':<{20}}: {rssi}")
+            print("")
+            self.pr_wifi_ssids()
+
        if self.gre:
            print(f"{'local address':<{20}}: {self.gre['local']}")
            print(f"{'remote address':<{20}}: {self.gre['remote']}")
@@ -1045,6 +1126,10 @@ def pr_interface_list(json):
            iface.pr_vxlan()
            continue

+        if iface.is_wifi():
+            iface.pr_wifi()
+            continue
+
        if iface.is_vlan():
            iface.pr_vlan(ifaces)
            continue
@@ -1320,13 +1405,13 @@ def show_lldp(json):
        f"{'CHASSIS-ID':<{PadLldp.chassis_id}}"
        f"{'PORT-ID':<{PadLldp.port_id}}"
    )
-    
+
    print(Decore.invert(header))

    for port_data in lldp_ports:
        port_name = port_data["name"]
        neighbors = port_data.get("remote-systems-data", [])
-        
+
        for neighbor in neighbors:
            entry = LldpNeighbor(port_name, neighbor)
            entry.print()
@@ -1394,6 +1479,7 @@ def main():
        show_routing_table(json_data, args.ip)
    elif args.command == "show-software":
        show_software(json_data, args.name)
+
    else:
        print(f"Error, unknown command '{args.command}'")
        sys.exit(1)
@@ -1,3 +1,4 @@
+from ..host import HOST
 from . import common

 from . import bridge
@@ -7,6 +8,7 @@ from . import lag
 from . import tun
 from . import veth
 from . import vlan
+from . import wifi


 def statistics(iplink):
@@ -24,13 +26,16 @@ def statistics(iplink):


 def iplink2yang_type(iplink):
+    ifname=iplink["ifname"]
    match iplink["link_type"]:
        case "loopback":
            return "infix-if-type:loopback"
        case "gre"|"gre6":
            return "infix-if-type:gre"
        case "ether":
-            pass
+            data = HOST.run(tuple(f"ls /sys/class/net/{ifname}/wireless/".split()), default="no")
+            if data != "no":
+                return "infix-if-type:wifi"
        case _:
            return "infix-if-type:other"

@@ -133,6 +138,9 @@ def interface(iplink, ipaddr):
        case "infix-if-type:vlan":
            if v := vlan.vlan(iplink):
                interface["infix-interfaces:vlan"] = v
+        case "infix-if-type:wifi":
+            if w := wifi.wifi(iplink["ifname"]):
+                interface["infix-interfaces:wifi"] = w

    match iplink2yang_lower(iplink):
        case "infix-interfaces:bridge-port":
@@ -0,0 +1,160 @@
+from ..host import HOST
+import json
+import re
+
+def wifi(ifname):
+    data=HOST.run(tuple(f"wpa_cli -i {ifname} status".split()), default="")
+    wifi_data={}
+
+    if data != "":
+        for line in data.splitlines():
+            k,v = line.split("=")
+            if k == "ssid":
+                wifi_data["ssid"] = v
+            if k == "wpa_state" and v == "DISCONNECTED": # wpa_suppicant has most likely restarted, restart scanning
+                HOST.run(tuple(f"wpa_cli -i {ifname} scan".split()), default="")
+
+        data=HOST.run(tuple(f"wpa_cli -i {ifname} signal_poll".split()), default="FAIL")
+
+        # signal_poll return FAIL not connected
+        if data.strip() != "FAIL":
+            for line in data.splitlines():
+                k,v = line.strip().split("=")
+                if k == "RSSI":
+                    wifi_data["rssi"]=int(v)
+    data=HOST.run(tuple(f"wpa_cli -i {ifname} scan_result".split()), default="FAIL")
+
+    if data != "FAIL":
+        wifi_data["scan-results"] = parse_wpa_scan_result(data)
+
+    return wifi_data
+
+
+def parse_wpa_scan_result(scan_output):
+    networks = {}
+    lines = scan_output.strip().split('\n')
+
+    # Skip header line and any empty lines
+    for line in lines:
+        line = line.strip()
+        if not line or 'bssid / frequency' in line.lower():
+            continue
+
+        # Split by tabs or multiple spaces
+        parts = re.split(r'\t+|\s{2,}', line)
+
+        if len(parts) >= 5:
+            bssid = parts[0].strip()
+            frequency = int(parts[1].strip())
+            rssi = int(parts[2].strip())
+            flags = parts[3].strip()
+            ssid = parts[4].strip() if len(parts) > 4 else ""
+
+            # Skip hidden SSIDs (empty or whitespace only)
+            if not ssid or ssid.isspace() or  '\\x00' in ssid:
+                continue
+
+            # Extract encryption information from flags
+            encryption = extract_encryption(flags)
+
+            # Convert frequency to channel
+            channel = frequency_to_channel(frequency)
+
+            # Keep only the network with best (highest) RSSI per SSID
+            if ssid not in networks or rssi < networks[ssid]['rssi']:
+                networks[ssid] = {
+                    'bssid': bssid,
+                    'ssid': ssid,
+                    'rssi': rssi,
+                    'encryption': encryption,
+                    'channel': channel
+                }
+    # Convert to list and sort by RSSI (best first)
+    result = list(networks.values())
+    result.sort(key=lambda x: x['rssi'], reverse=False)
+
+    return result
+
+def frequency_to_channel(frequency):
+    """Convert frequency (MHz) to WiFi channel number"""
+    freq = int(frequency)
+
+    # 2.4 GHz band (channels 1-14)
+    if 2412 <= freq <= 2484: # Channel 14 is special
+        if freq == 2484:
+            return 14
+        return (freq - 2412) // 5 + 1
+
+    # 5 GHz band (channels 36-165)
+    elif 5170 <= freq <= 5825:
+        return (freq - 5000) // 5
+
+    # 6 GHz band (channels 1-233)
+    elif 5955 <= freq <= 7115:
+        return (freq - 5950) // 5
+
+    else:
+        return f"Unknown ({freq} MHz)"
+
+def extract_encryption(flags):
+    """Extract detailed encryption information from flags string"""
+    flags = flags.upper()
+    encryption_info = {
+        'protocols': [],
+        'key_mgmt': [],
+        'ciphers': [],
+        'auth_type': 'Unknown'
+    }
+
+    # Extract WPA protocols
+    if 'WPA3' in flags:
+        encryption_info['protocols'].append('WPA3')
+    if 'WPA2' in flags:
+        encryption_info['protocols'].append('WPA2')
+    if 'WPA-' in flags and 'WPA2' not in flags and 'WPA3' not in flags:
+        encryption_info['protocols'].append('WPA')
+
+    # Extract key management methods
+    if 'PSK' in flags:
+        encryption_info['key_mgmt'].append('PSK')
+        encryption_info['auth_type'] = 'Personal'
+    if 'EAP' in flags:
+        encryption_info['key_mgmt'].append('EAP')
+        encryption_info['auth_type'] = 'Enterprise'
+    if 'SAE' in flags:  # WPA3 Personal
+        encryption_info['key_mgmt'].append('SAE')
+        encryption_info['auth_type'] = 'Personal'
+    if 'OWE' in flags:  # Enhanced Open (WPA3)
+        encryption_info['key_mgmt'].append('OWE')
+        encryption_info['auth_type'] = 'Enhanced Open'
+    if 'FT' in flags:
+        encryption_info['key_mgmt'].append('FT')
+
+    # Extract cipher suites
+    if 'CCMP' in flags:
+        encryption_info['ciphers'].append('CCMP')
+    if 'TKIP' in flags:
+        encryption_info['ciphers'].append('TKIP')
+    if 'GCMP' in flags:
+        encryption_info['ciphers'].append('GCMP')
+
+    # Handle special cases
+    if 'WEP' in flags:
+        return ['WEP']
+
+    if not encryption_info['protocols'] and 'ESS' in flags:
+        return ['Open']
+
+    # Return array of supported protocols with auth type
+    result = []
+    for protocol in encryption_info['protocols']:
+        if encryption_info['auth_type'] == 'Enterprise':
+            result.append(f"{protocol}-Enterprise")
+        elif encryption_info['auth_type'] == 'Personal':
+            result.append(f"{protocol}-Personal")
+        elif encryption_info['auth_type'] == 'Enhanced Open':
+            result.append(f"{protocol}-Enhanced-Open")
+        else:
+            result.append(protocol)
+
+    return result if result else ['Unknown']
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Richard AlpeandGitHub	40e94883c6	Merge pull request #1076 from kernelkit/update-changelog doc: update changelog date for v25.06	2025-07-01 14:19:41 +02:00
Richard Alpe	9f268606e4	doc: update changelog date for v25.06 Signed-off-by: Richard Alpe <richard@bit42.se>	2025-07-01 11:29:04 +02:00
Jon-Olov VatnandGitHub	de113503ea	Merge pull request #1075 from kernelkit/update-changelog-v25.06.0 Update Changelog for Infix v25.06.0	2025-06-30 09:48:30 +02:00
Jon-Olov Vatn	6f203b1c78	Update Changelog for Infix v25.06.0 [skip ci]	2025-06-30 08:40:45 +02:00
Mattias WalströmandGitHub	c31bbbefa9	Merge pull request #1074 from kernelkit/wifi-fixes	2025-06-29 22:24:23 +02:00
Mattias Walström	0d03f874ee	confd: wifi: Fix several bugs in WiFi implemenation * Did not work to reconfigure * Was not possible to run from startup * Othe minor things.	2025-06-29 21:07:10 +02:00
Mattias Walström	51176c7d26	feature: wifi: Allow to set regulation setting (country-code) We was missing the firmware required for this, and for this to work cfg80211 needs to be as module since the rootfs is not loaded when it is loaded if compiled in kernel. And add iw since it very useful for debugging.	2025-06-29 21:06:33 +02:00
Mattias WalströmandGitHub	88958a0b1f	Merge pull request #1073 from kernelkit/upgrade-kernel Bump kernel to 6.12.35 (LTS)	2025-06-27 15:04:49 +02:00
Mattias Walström	e3f87799b6	utils/kernel-refresh.sh: Stage defconfigs Everything else got staged, but not defconfigs	2025-06-27 13:39:31 +02:00
Mattias Walström	ebcb38be37	Bump kernel to 6.12.35 (LTS)	2025-06-27 13:36:41 +02:00
Ahmed KaricandGitHub	889fb3eb79	Merge pull request #1072 from kernelkit/container-remote-exec Verify Host Command Execution from Container	2025-06-26 14:11:28 +02:00
Ahmed Karic	2a6e7e5208	test: Verify host command execution Add test to verify a container on Infix can execute commands on the host by mounting a script to `/etc/rc.local` with proper permissions. The test confirms host hostname change using `nsenter` from inside a privileged container. Resolves #1024	2025-06-26 13:10:43 +02:00
Joachim WibergandGitHub	9629e2eef4	Merge pull request #1071 from kernelkit/mount-mode Add support for setting mode of a container content mount	2025-06-26 12:35:02 +02:00
Joachim Wiberg	a0c48e7b5f	Add support for setting mode of a container content mount Fixes #1070 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-06-25 19:49:47 +02:00
Ahmed KaricandGitHub	edd2e60dd5	Merge pull request #1059 from kernelkit/speed_duplex Verify auto-negotiated speed/duplex	2025-06-25 10:00:10 +02:00
Ahmed Karic	ec82d68a9f	test: Verify auto-negotiated speed/duplex (copper)	2025-06-25 08:54:33 +02:00
Ahmed Karic	20d5426935	test/docker: Upgrade docker image to include ethtool Add `ethtool` to the Docker test environment to support interface auto-negotiation tests.	2025-06-25 08:01:13 +02:00
Mattias WalströmandGitHub	9d6d0e2388	Merge pull request #1069 from kernelkit/upgrade-buildroot	2025-06-24 19:55:41 +02:00
Joachim WibergandGitHub	6167f2a6a4	Merge pull request #1067 from kernelkit/misc New slogan and updated containers Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-06-24 15:11:06 +02:00
Joachim Wiberg	4ad2664b78	doc: update changelog for v25.06 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-06-24 13:54:54 +02:00
Joachim Wiberg	fe031f1a10	package/klish: fix by-word movement and kill buffer support - Fix by-word movement, detect word barrier using non-alphanum chars - Fix delete word left/right, make sure to save word in kill buffer Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-06-24 13:54:54 +02:00
Joachim Wiberg	0a3277caf2	package/curious-*: bump to v25.06.0 - Buildroot updated to v25.02.3 - Tefactor of nftables container The nftables container now includes BusyBox, a shell with vi and some basic filesystem tools, as well as nsenter and unshare, suitable for testing and other more advanced tasks. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-06-24 13:54:53 +02:00
Joachim Wiberg	cac357458c	Rebranding, make slogan more inclusive, Infix is more now ... Fixes #1052 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-06-24 13:54:53 +02:00
Mattias Walström	7b8bc43bca	Bump buildroot to 2025.02.4 (LTS)	2025-06-24 13:36:36 +02:00
Joachim Wiberg	5c7fc3f570	package/tetris: bump to v1.5.0 ChangeLog https://github.com/troglobit/tetris/releases/tag/1.5.0 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-06-22 21:12:50 +02:00
Joachim WibergandGitHub	bae70ec85a	Merge pull request #1066 from kernelkit/upgrade-kernel Upgrade Linux kernel to 6.12.34 (LTS) Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-06-20 09:52:54 +02:00
Mattias Walström	eeb10b0f07	Upgrade Linux kernel to 6.12.34 (LTS)	2025-06-19 21:14:30 +02:00
Mattias WalströmandGitHub	b92c9daedd	Merge pull request #1058 from kernelkit/wifi-support	2025-06-19 18:34:35 +02:00
Mattias Walström	de33df14e2	test: case: ietf_syslog/remote: Fix typo of interface type Has not been triggered before because we ignored operations on fixed interfaces.	2025-06-19 15:23:32 +02:00
Mattias Walström	5eeed0e743	changelog: Update with Wi-Fi client Also add kernel update to correct release.	2025-06-19 15:23:31 +02:00
Mattias Walström	24852caad0	doc: Add Wi-Fi Documention	2025-06-19 15:23:31 +02:00
Mattias Walström	08f4207277	configs: Enable Wi-Fi support	2025-06-19 15:23:30 +02:00
Mattias Walström	5fbb30fed5	Wi-Fi: Add Wi-Fi information to operational and CLI output * show wifi scan <ifname> to see located SSIDs * interface status	2025-06-19 15:23:30 +02:00
Mattias Walström	f25f0ab050	Wi-Fi: Add template finit service for wpa_supplicant	2025-06-19 15:23:29 +02:00
Mattias Walström	b53c1612f0	confd: Add basic Wi-Fi client support Support implemented: * WPA2/3 support * scanning (in background, results in operational) * Unencrypted networks No certificate support, only PSK only client so far, no AP	2025-06-19 15:23:28 +02:00
Mattias Walström	57d5bf1577	confd: Add script to wait for an interface usage: wait-interface wlan0 30	2025-06-19 15:23:27 +02:00
Mattias Walström	0ad8fab5c7	wpa_supplicant: Add support for pidfile when not daemonize	2025-06-19 15:23:27 +02:00
Mattias Walström	ecabce86c7	Add meta-package for adding Wi-Fi support Helps adding everything that needs to be compiled to get Wi-Fi support working. Both modules, firmware and applications are selected here	2025-06-19 15:23:26 +02:00
Mattias Walström	a7e72a46d9	confd: Simplify enabling features in YANG models If a extra infix feature require features to be added to an already loaded module. Instead of have the exact module definition in multiple places (with date), this will allow a much more flexible sytax: MODULES=( "infix-interfaces -e containers" ) This require that the infix-interfaces is loaded before this file is run.	2025-06-19 15:23:25 +02:00
Mattias Walström	915bef2dd4	udev: Rename all wlan interfaces wifiN and start scanning This since the feature is called 'wifi' in Infix, this makes the naming consistent over the system. Also trigger start of a wpa_supplicant, for scanning in the background. The scanning results is available operational.	2025-06-19 15:23:24 +02:00
Mattias Walström	7f9a1df6f7	qemu: Increase memory for virtual machine Image is too big, more memory is required	2025-06-19 15:23:24 +02:00
Mattias Walström	67a6fc18d5	confd: Always run netdag_gen_afspec_set and netdag_gen_afspec_add on all iftypes If an iftype does not need to do anything, just return 0. This makes the code much more easy to follow.	2025-06-19 15:23:23 +02:00
Mattias Walström	8538888069	confd: core: Allow all other flags then SR_SUBSCR_UPDATE Other flags may be load-bearing in some modules, but SR_SUBSCR_UPDATE, we never want to keep track on in the core hooks.	2025-06-19 10:34:46 +02:00
Mattias WalströmandGitHub	5a1cf7f9f8	Merge pull request #1063 from kernelkit/upgrade-kernel Upgrade Linux kernel to v6.12.33 (LTS)	2025-06-18 07:56:21 +02:00
Ahmed Karic	6755011b25	Upgrade Linux kernel to 6.12.33 (LTS)	2025-06-16 10:49:02 +02:00
				`@@ -0,0 +1 @@`
				`SUBSYSTEM=="net", ACTION=="add", TEST=="/sys/class/net/$name/wireless", NAME="wifi%n"`