Divested-WRT: No-nonsense hardened builds for Linksys WRT series

wally_walrus · 2021-02-14T01:51:38.190Z

SkewedZeppelin:

...
@wally_walrus
If you are compiling you can put configs in
packages/base-files/
or
target/linux/mvebu/cortexa9/base-files

@SkewedZeppelin, thank you... I was hoping there would be a way to "mount" the image and copy the files over. I wish I could compile on my own but I'm not there yet, may have to take that as my next project

SkewedZeppelin · 2021-02-14T01:52:41.443Z

@wally_walrus
I think you technically can extract the sysupgrade and use squashfstools to edit the root partition.
But ymmv.

scott68 · 2021-02-14T02:08:13.970Z

SkewedZeppelin:

Is your LAN br-lan?

Yes, its br-lan. No dual router setups.

I used your divested .config, added a couple packages, and setup from scratch. The build is very stable. Fastest pings yet.

Personally I use x86 build with ap's, but I help family and a friend. One has 1200ac with a single ap and the other has a 32x using internal wlans. No ip6 on the 32x's wlans is not a deal breaker. Heck, it may keep his kids off of facetime. Lol. No strange errors in log to report. Everything else looks normal.

I'm going to backup and reflash your latest to see if a package I added is causing the issue.

SkewedZeppelin · 2021-02-14T02:18:06.146Z

@scott68
here are the relevant parts of my config for reference:

/etc/config/network
config globals 'globals'
	option ula_prefix 'CHANGE ME'

config interface 'lan'
	option ip6assign '64'
	option ip6hint '1'
	option ip6ifaceid '::1' #INCREMENT this on each subsequent router/AP

config interface 'wan'
	option ifname 'wan'
	option proto 'dhcp'
	option peerdns '0'

config interface 'wan6'
	option ifname 'wan'
	option proto 'dhcpv6'
	option peerdns '0'
	option reqprefix '56'
	option auto '1'


/etc/config/dhcp
config dhcp 'lan'
	option interface 'lan'
	option leasetime '12h'
	option dhcpv6 'server'
	option ra 'server'
	option ra_slaac '1'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'

skitts24 · 2021-02-14T04:43:28.015Z

hi,
@SkewedZeppelin - thanks for the guide and the video - very helpful and much appreciated.

Is there a how to migrate guide for swconfig to dsa. I tried to search this forum for more info but havent had much luck. Or is it better off just installing the firmware factory defaults and reconfiguring ?
cheers

SkewedZeppelin · 2021-02-14T05:44:00.123Z

@skitts24

Rough swconfig to DSA migration steps:

Backup
Edit /etc/config/network as follows:

drop all config switch* blocks and their contents
in config interface 'lan' change option ifname value to 'lan1 lan2 lan3 lan4'
in config interface 'wan' change option ifname value to 'wan'
add the following

config device 'wan_wan_dev'
	option name 'wan'
	option macaddr '[INSERT MAC]'

Edit /etc/config/system as follows:

in config system add option compat_version '1.1'
in config led 'led_wan' change option dev to 'wan'

Edit /etc/config/sqm as follows

in config queue 'eth1' change option interface to 'wan'

sysupgrade with keep settings checked
success?

Note: if it isn't right you will get locked out, and will have to factory reset via the button.

I haven't done it in a while, please anyone correct it if necessary.
I'll then write it up and add it to the site soon.

Alternative you can just sysupgrade with keep settings unchecked and start fresh.

nitroshift · 2021-02-14T07:33:10.524Z

Under lan section also add the wireless interfaces as they are members of the same zone.

nitroshift

skitts24 · 2021-02-14T12:20:01.397Z

Thanks heaps - i will give that a go and let you know if i have any issues.

skitts24 · 2021-02-15T14:32:02.961Z

i want to build an image without the firewall but am not sure exactly how to remove it and where it sits in the config. I have a 2 wrt-32x (second one i scored for real cheap), one being an ap only.
in the config under the luci -> applications section i cant make a change to the install option which i assume is based on other dependencies that are installing. problem is i dont know where they are located in the config exactly.
cheers

SkewedZeppelin · 2021-02-15T15:26:54.911Z

@skitts24
You do not need to remove the firewall if all you want to do is use it as an AP.

OpenWrt Wiki – 5 Feb 11

Wireless Access Point / Dumb Access Point / Dumb AP

Wireless Access Point / Dumb Access Point / Dumb AP Note The term “Dumb Access Point” appears to have originated in the Raspberry Pi world. From the perspective of a generic network engineer, the correct term would be “Wireless Access Point”

skitts24 · 2021-02-15T16:19:50.141Z

Thanks. I was reading that doco earlier and it was saying to disable the firewall. I thought it would be easier to just not install it so I would have a custom config with no firewall installed for that particular router

sunchar · 2021-02-16T18:55:44.538Z

Hi!

I´m trying to compile following your instructions, but when running this ./scripts/feeds install -a -f everithing seems to be OK, but later it shows this warnings:

WARNING: Makefile 'package/utils/busybox/Makefile' has a dependency on 'libpam', which does not exist
WARNING: Makefile 'package/utils/busybox/Makefile' has a dependency on 'libpam', which does not exist
WARNING: Makefile 'package/utils/busybox/Makefile' has a build dependency on 'libpam', which does not exist
WARNING: Makefile 'package/boot/kexec-tools/Makefile' has a dependency on 'liblzma', which does not exist
WARNING: Makefile 'package/network/services/lldpd/Makefile' has a dependency on 'libnetsnmp', which does not exist
WARNING: Makefile 'package/utils/policycoreutils/Makefile' has a dependency on 'libpam', which does not exist
WARNING: Makefile 'package/utils/policycoreutils/Makefile' has a dependency on 'libpam', which does not exist
WARNING: Makefile 'package/utils/policycoreutils/Makefile' has a build dependency on 'libpam', which does not exist

I'm compiling from Ubuntu 20.04 LTS using WSL2.

Will this be a problem?

Thank you!

SkewedZeppelin · 2021-02-16T19:09:40.783Z

@sunchar

Master is currently broken/in-flux right now.
~~I'd checkout to d8afae0be8f0a2a4a26e303dd5212e2a2f8d69a3.~~
I'm not actually sure how to checkout all repos. Anyone know?

sunchar · 2021-02-17T02:09:12.429Z

This means that it could lead to problems if install resulting firmware?

vgaetera · 2021-02-17T03:09:12.259Z

SkewedZeppelin:

I'm not actually sure how to checkout all repos. Anyone know?

Checkout specific code revision

sunchar · 2021-02-17T03:56:45.030Z

This is my first atempt, but it didn't worked. This is the result of the last step:

$ make -j16
ln: failed to create symbolic link 'lib64': Not a directory
ln: failed to create symbolic link 'lib32': Not a directory
time: target/linux/prereq#0.47#0.23#2.89
 make[1] world
 make[2] tools/compile
 make[3] -C tools/flock compile
 make[3] -C tools/xz compile
 make[2] package/cleanup
    ERROR: tools/xz failed to build.
make -r world: build failed. Please re-run make with -j1 V=s or V=sc for a higher verbosity level to see what's going on
make: *** [/mnt/c/Users/Carlos/openwrt/include/toplevel.mk:230: world] Error 1

Any ideas about what i'm doing wrong?
I'm new on this.

Thank you!

ghoffman · 2021-02-17T11:47:26.089Z

do you have all the build libraries?
see

OpenWrt Wiki – 13 Oct 16

Developer guide

Developer guide This page has links to all the pages of OpenWrt development documentation. Use the Search facility to find more information. Quick overview of OpenWrt's internals * Overview Assembling firmware images with the ImageBuilder * ...

i have had to use -j1 for first make on a local git clone.
this is specifically mentioned in the quick building guide:

OpenWrt Wiki – 11 Dec 16

Quick Image Building Guide

Quick Image Building Guide This is a short guide for building an OpenWrt snapshot firmware image. To build a stable release, look to the beginners guide to building your own firmware. There is a FAQ about difference between a release and a snapshot...

"For faster compiling, use make -j N , where N is the number of CPU cores + 1. Be aware that this method is prone to errors during compiling. In case you encounter compile errors, your very first step is to compile again without -j N . Use of make download prior to parallel compilation is recommended to prevent some of these errors (-jN is generally safe for the download step for those with faster Internet connectivity.)"

it is a mystery to me why these errors occur but I have usually been able to resolve them by running make -j1.

ninjanoir78 · 2021-02-17T11:51:44.316Z

Use j -1 V=sc

sunchar · 2021-02-17T15:49:45.282Z

It didn't worked. I will do everything from the beginning.

Thank you!

sunchar · 2021-02-17T15:56:30.164Z

I installed the libraries for debia/ubuntu without any problem:

[OpenWrt Wiki] Build system setup

running maje -j1 -V=sc shows this:

$ make -j1 V=sc
make[1]: Entering directory '/mnt/c/Users/Carlos/openwrt'
make[2]: Entering directory '/mnt/c/Users/Carlos/openwrt'
+ mkdir -p /mnt/c/Users/Carlos/openwrt/staging_dir/target-arm_cortex-a9+vfpv3-d16_musl_eabi
+ cd /mnt/c/Users/Carlos/openwrt/staging_dir/target-arm_cortex-a9+vfpv3-d16_musl_eabi
+ mkdir -p bin lib stamp usr/include usr/lib
mkdir -p /mnt/c/Users/Carlos/openwrt/build_dir/target-arm_cortex-a9+vfpv3-d16_musl_eabi/stamp
touch /mnt/c/Users/Carlos/openwrt/staging_dir/target-arm_cortex-a9+vfpv3-d16_musl_eabi/.prepared
+ mkdir -p /mnt/c/Users/Carlos/openwrt/staging_dir/host
+ cd /mnt/c/Users/Carlos/openwrt/staging_dir/host
+ mkdir -p bin lib stamp usr/include usr/lib
mkdir -p /mnt/c/Users/Carlos/openwrt/build_dir/host/stamp /mnt/c/Users/Carlos/openwrt/staging_dir/host/include/sys
install -m0644 /mnt/c/Users/Carlos/openwrt/tools/include/*.h /mnt/c/Users/Carlos/openwrt/staging_dir/host/include/
install -m0644 /mnt/c/Users/Carlos/openwrt/tools/include/sys/*.h /mnt/c/Users/Carlos/openwrt/staging_dir/host/include/sys/
ln -snf lib /mnt/c/Users/Carlos/openwrt/staging_dir/host/lib64
touch /mnt/c/Users/Carlos/openwrt/staging_dir/host/.prepared
make[3]: Entering directory '/mnt/c/Users/Carlos/openwrt/tools/flock'
make[3]: Leaving directory '/mnt/c/Users/Carlos/openwrt/tools/flock'
time: tools/flock/compile#0.11#0.05#0.64
make[3]: Entering directory '/mnt/c/Users/Carlos/openwrt/tools/xz'
(cd /mnt/c/Users/Carlos/openwrt/build_dir/host/xz-5.2.5/; if [ -x configure ]; then cp -fpR /mnt/c/Users/Carlos/openwrt/scripts/config.{guess,sub} /mnt/c/Users/Carlos/openwrt/build_dir/host/xz-5.2.5// && CC="gcc" CFLAGS="-O2 -I/mnt/c/Users/Carlos/openwrt/staging_dir/host/include " CXX="g++" CPPFLAGS="-I/mnt/c/Users/Carlos/openwrt/staging_dir/host/include " LDFLAGS="-L/mnt/c/Users/Carlos/openwrt/staging_dir/host/lib " CONFIG_SHELL="/usr/bin/env bash"  bash ./configure --target=x86_64-pc-linux-gnu --host=x86_64-pc-linux-gnu --build=x86_64-pc-linux-gnu --program-prefix="" --program-suffix="" --prefix=/mnt/c/Users/Carlos/openwrt/staging_dir/host --exec-prefix=/mnt/c/Users/Carlos/openwrt/staging_dir/host --sysconfdir=/mnt/c/Users/Carlos/openwrt/staging_dir/host/etc --localstatedir=/mnt/c/Users/Carlos/openwrt/staging_dir/host/var --sbindir=/mnt/c/Users/Carlos/openwrt/staging_dir/host/bin --enable-static=yes --enable-shared=no --disable-doc --disable-nls --with-pic ; fi )
cat: -: No such file or directory
cat: -: No such file or directory
cat: -: No such file or directory
cat: -: No such file or directory
cat: -: No such file or directory
cat: -: No such file or directory
cat: -: No such file or directory
cat: -: No such file or directory
cat: -: No such file or directory

XZ Utils 5.2.5

System type:
checking build system type... x86_64-pc-linux-gnu
checking host system type... x86_64-pc-linux-gnu

Configure options:
checking if debugging code should be compiled... no
checking which encoders to build... lzma1 lzma2 delta x86 powerpc ia64 arm armthumb sparc
checking which decoders to build... lzma1 lzma2 delta x86 powerpc ia64 arm armthumb sparc
checking which match finders to build... hc3 hc4 bt2 bt3 bt4
checking which integrity checks to build... crc32 crc64 sha256
checking if external SHA-256 should be used... no
checking if assembler optimizations should be used... x86_64
checking if small size is preferred over speed... no
checking if threading support is wanted... yes, posix
checking how much RAM to assume if the real amount is unknown... 128 MiB
cat: -: No such file or directory
checking if library symbol versioning should be used... yes
checking if sandboxing should be used... maybe (autodetect)

checking for a shell that conforms to POSIX... /bin/sh

Initializing Automake:
checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... yes
checking for a thread-safe mkdir -p... /usr/bin/mkdir -p
checking for gawk... gawk
checking whether make sets $(MAKE)... cat: -: No such file or directory
no
checking whether make supports nested variables... yes
cat: -: No such file or directory
cat: -: No such file or directory
checking whether ln -s works... yes
checking whether make supports the include directive... cat: -: No such file or directory
no
checking for x86_64-pc-linux-gnu-gcc... gcc
cat: -: No such file or directory
checking whether the C compiler works... no
configure: error: in `/mnt/c/Users/Carlos/openwrt/build_dir/host/xz-5.2.5':
configure: error: C compiler cannot create executables
See `config.log' for more details
make[3]: *** [Makefile:37: /mnt/c/Users/Carlos/openwrt/build_dir/host/xz-5.2.5/.configured] Error 77
make[3]: Leaving directory '/mnt/c/Users/Carlos/openwrt/tools/xz'
time: tools/xz/compile#0.61#0.29#3.24
    ERROR: tools/xz failed to build.
make[2]: *** [tools/Makefile:159: tools/xz/compile] Error 1
make[2]: Leaving directory '/mnt/c/Users/Carlos/openwrt'
make[1]: *** [tools/Makefile:155: /mnt/c/Users/Carlos/openwrt/staging_dir/host/stamp/.tools_compile_yyynyynnyyynyyyyyynyynnyyyynyyyyyyyyyyyyyyyynynnyyyyyyy] Error 2
make[1]: Leaving directory '/mnt/c/Users/Carlos/openwrt'
make: *** [/mnt/c/Users/Carlos/openwrt/include/toplevel.mk:230: world] Error 2

So I will start from scratch to see if something went wrong before this.

Thank you!