Divested-WRT: No-nonsense hardened builds for Linksys WRT series

@skitts24
You do not need to remove the firewall if all you want to do is use it as an AP.

Thanks. I was reading that doco earlier and it was saying to disable the firewall. I thought it would be easier to just not install it so I would have a custom config with no firewall installed for that particular router

Hi!

I´m trying to compile following your instructions, but when running this ./scripts/feeds install -a -f everithing seems to be OK, but later it shows this warnings:

WARNING: Makefile 'package/utils/busybox/Makefile' has a dependency on 'libpam', which does not exist
WARNING: Makefile 'package/utils/busybox/Makefile' has a dependency on 'libpam', which does not exist
WARNING: Makefile 'package/utils/busybox/Makefile' has a build dependency on 'libpam', which does not exist
WARNING: Makefile 'package/boot/kexec-tools/Makefile' has a dependency on 'liblzma', which does not exist
WARNING: Makefile 'package/network/services/lldpd/Makefile' has a dependency on 'libnetsnmp', which does not exist
WARNING: Makefile 'package/utils/policycoreutils/Makefile' has a dependency on 'libpam', which does not exist
WARNING: Makefile 'package/utils/policycoreutils/Makefile' has a dependency on 'libpam', which does not exist
WARNING: Makefile 'package/utils/policycoreutils/Makefile' has a build dependency on 'libpam', which does not exist

I'm compiling from Ubuntu 20.04 LTS using WSL2.

Will this be a problem?

Thank you!

2 Likes

@sunchar

Master is currently broken/in-flux right now.
I'd checkout to d8afae0be8f0a2a4a26e303dd5212e2a2f8d69a3.
I'm not actually sure how to checkout all repos. Anyone know?

3 Likes

This means that it could lead to problems if install resulting firmware?

Checkout specific code revision

1 Like

This is my first atempt, but it didn't worked. This is the result of the last step:

$ make -j16
ln: failed to create symbolic link 'lib64': Not a directory
ln: failed to create symbolic link 'lib32': Not a directory
time: target/linux/prereq#0.47#0.23#2.89
 make[1] world
 make[2] tools/compile
 make[3] -C tools/flock compile
 make[3] -C tools/xz compile
 make[2] package/cleanup
    ERROR: tools/xz failed to build.
make -r world: build failed. Please re-run make with -j1 V=s or V=sc for a higher verbosity level to see what's going on
make: *** [/mnt/c/Users/Carlos/openwrt/include/toplevel.mk:230: world] Error 1

Any ideas about what i'm doing wrong?
I'm new on this.

Thank you!

do you have all the build libraries?
see

i have had to use -j1 for first make on a local git clone.
this is specifically mentioned in the quick building guide:

"For faster compiling, use make -j N , where N is the number of CPU cores + 1. Be aware that this method is prone to errors during compiling. In case you encounter compile errors, your very first step is to compile again without -j N . Use of make download prior to parallel compilation is recommended to prevent some of these errors (-jN is generally safe for the download step for those with faster Internet connectivity.)"

it is a mystery to me why these errors occur but I have usually been able to resolve them by running make -j1.

Use j -1 V=sc

1 Like

It didn't worked. I will do everything from the beginning.

Thank you!

I installed the libraries for debia/ubuntu without any problem:

[OpenWrt Wiki] Build system setup

running maje -j1 -V=sc shows this:

$ make -j1 V=sc
make[1]: Entering directory '/mnt/c/Users/Carlos/openwrt'
make[2]: Entering directory '/mnt/c/Users/Carlos/openwrt'
+ mkdir -p /mnt/c/Users/Carlos/openwrt/staging_dir/target-arm_cortex-a9+vfpv3-d16_musl_eabi
+ cd /mnt/c/Users/Carlos/openwrt/staging_dir/target-arm_cortex-a9+vfpv3-d16_musl_eabi
+ mkdir -p bin lib stamp usr/include usr/lib
mkdir -p /mnt/c/Users/Carlos/openwrt/build_dir/target-arm_cortex-a9+vfpv3-d16_musl_eabi/stamp
touch /mnt/c/Users/Carlos/openwrt/staging_dir/target-arm_cortex-a9+vfpv3-d16_musl_eabi/.prepared
+ mkdir -p /mnt/c/Users/Carlos/openwrt/staging_dir/host
+ cd /mnt/c/Users/Carlos/openwrt/staging_dir/host
+ mkdir -p bin lib stamp usr/include usr/lib
mkdir -p /mnt/c/Users/Carlos/openwrt/build_dir/host/stamp /mnt/c/Users/Carlos/openwrt/staging_dir/host/include/sys
install -m0644 /mnt/c/Users/Carlos/openwrt/tools/include/*.h /mnt/c/Users/Carlos/openwrt/staging_dir/host/include/
install -m0644 /mnt/c/Users/Carlos/openwrt/tools/include/sys/*.h /mnt/c/Users/Carlos/openwrt/staging_dir/host/include/sys/
ln -snf lib /mnt/c/Users/Carlos/openwrt/staging_dir/host/lib64
touch /mnt/c/Users/Carlos/openwrt/staging_dir/host/.prepared
make[3]: Entering directory '/mnt/c/Users/Carlos/openwrt/tools/flock'
make[3]: Leaving directory '/mnt/c/Users/Carlos/openwrt/tools/flock'
time: tools/flock/compile#0.11#0.05#0.64
make[3]: Entering directory '/mnt/c/Users/Carlos/openwrt/tools/xz'
(cd /mnt/c/Users/Carlos/openwrt/build_dir/host/xz-5.2.5/; if [ -x configure ]; then cp -fpR /mnt/c/Users/Carlos/openwrt/scripts/config.{guess,sub} /mnt/c/Users/Carlos/openwrt/build_dir/host/xz-5.2.5// && CC="gcc" CFLAGS="-O2 -I/mnt/c/Users/Carlos/openwrt/staging_dir/host/include " CXX="g++" CPPFLAGS="-I/mnt/c/Users/Carlos/openwrt/staging_dir/host/include " LDFLAGS="-L/mnt/c/Users/Carlos/openwrt/staging_dir/host/lib " CONFIG_SHELL="/usr/bin/env bash"  bash ./configure --target=x86_64-pc-linux-gnu --host=x86_64-pc-linux-gnu --build=x86_64-pc-linux-gnu --program-prefix="" --program-suffix="" --prefix=/mnt/c/Users/Carlos/openwrt/staging_dir/host --exec-prefix=/mnt/c/Users/Carlos/openwrt/staging_dir/host --sysconfdir=/mnt/c/Users/Carlos/openwrt/staging_dir/host/etc --localstatedir=/mnt/c/Users/Carlos/openwrt/staging_dir/host/var --sbindir=/mnt/c/Users/Carlos/openwrt/staging_dir/host/bin --enable-static=yes --enable-shared=no --disable-doc --disable-nls --with-pic ; fi )
cat: -: No such file or directory
cat: -: No such file or directory
cat: -: No such file or directory
cat: -: No such file or directory
cat: -: No such file or directory
cat: -: No such file or directory
cat: -: No such file or directory
cat: -: No such file or directory
cat: -: No such file or directory

XZ Utils 5.2.5

System type:
checking build system type... x86_64-pc-linux-gnu
checking host system type... x86_64-pc-linux-gnu

Configure options:
checking if debugging code should be compiled... no
checking which encoders to build... lzma1 lzma2 delta x86 powerpc ia64 arm armthumb sparc
checking which decoders to build... lzma1 lzma2 delta x86 powerpc ia64 arm armthumb sparc
checking which match finders to build... hc3 hc4 bt2 bt3 bt4
checking which integrity checks to build... crc32 crc64 sha256
checking if external SHA-256 should be used... no
checking if assembler optimizations should be used... x86_64
checking if small size is preferred over speed... no
checking if threading support is wanted... yes, posix
checking how much RAM to assume if the real amount is unknown... 128 MiB
cat: -: No such file or directory
checking if library symbol versioning should be used... yes
checking if sandboxing should be used... maybe (autodetect)

checking for a shell that conforms to POSIX... /bin/sh

Initializing Automake:
checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... yes
checking for a thread-safe mkdir -p... /usr/bin/mkdir -p
checking for gawk... gawk
checking whether make sets $(MAKE)... cat: -: No such file or directory
no
checking whether make supports nested variables... yes
cat: -: No such file or directory
cat: -: No such file or directory
checking whether ln -s works... yes
checking whether make supports the include directive... cat: -: No such file or directory
no
checking for x86_64-pc-linux-gnu-gcc... gcc
cat: -: No such file or directory
checking whether the C compiler works... no
configure: error: in `/mnt/c/Users/Carlos/openwrt/build_dir/host/xz-5.2.5':
configure: error: C compiler cannot create executables
See `config.log' for more details
make[3]: *** [Makefile:37: /mnt/c/Users/Carlos/openwrt/build_dir/host/xz-5.2.5/.configured] Error 77
make[3]: Leaving directory '/mnt/c/Users/Carlos/openwrt/tools/xz'
time: tools/xz/compile#0.61#0.29#3.24
    ERROR: tools/xz failed to build.
make[2]: *** [tools/Makefile:159: tools/xz/compile] Error 1
make[2]: Leaving directory '/mnt/c/Users/Carlos/openwrt'
make[1]: *** [tools/Makefile:155: /mnt/c/Users/Carlos/openwrt/staging_dir/host/stamp/.tools_compile_yyynyynnyyynyyyyyynyynnyyyynyyyyyyyyyyyyyyyynynnyyyyyyy] Error 2
make[1]: Leaving directory '/mnt/c/Users/Carlos/openwrt'
make: *** [/mnt/c/Users/Carlos/openwrt/include/toplevel.mk:230: world] Error 2

So I will start from scratch to see if something went wrong before this.

Thank you!

@sunchar
Are you using the Windows Subsystem for Linux?

Yes, im using WSL2.

I'll check this post and comment later, now i'm at work.

Thanks!

Silly question incoming..

Is IPv6 disabled by default? Noticed that DHCPv6/WAN6 doesn't have a network device present.

If so, how could one go about enabling it?


Also was wondering how the resized builds are going (I have a venom).. the warning scared me a bit since I don't have a way to do a serial recovery if necessary haha

Thanks

@digital_mystik
You are the second person to report IPv6 issues.
IPv6 is not disabled by default.
I have it working and fully functional on both my mamba and caiman.
I am not too sure what is happening there.
See No-nonsense Linksys WRT builds - #148 by SkewedZeppelin for my config

As for the resized builds, they seem A-OK.
Still not merged upstream yet.

hmm.. interesting. No biggie since IPv4 is still functional. Not sure why it doesn't work either :man_shrugging:

The resized builds will be nice since 5.10 is the new LTS and will allow for the extra goodies that have been merged.

There is now a testing build with Linux 5.10 thanks to @nitroshift.
It does not include the critical DSA/FDB sync fixes.
It also lacks WireGuard.
I briefly tested it on my caiman.

3 Likes

Hi @SkewedZeppelin I'm also having IPv6 "issues" but different from what's reported here. My ISP provides a /56 prefix, and my network is split as follows (each has its own firewall zone):

  • default LAN (192.168.10.x)
  • 3 more LANs - OPT4 (192.168.40.x), OPT5 (192.168.50.x) and OPT6 (192.168.60.x)

Each of the router's interfaces facing the above has "Advanced Settings - Use built-in IPv6 management" checked. Also all router interfaces are identically configured for IPv6 (IPv6 assignment length = 64, IPv6 assignment hint = 10, 40, 50 and 60 respectively and IPv6 suffix = ::1)

In the Interface - DHCP Server - IPv6 settings I have:

  • Router Advertisement Service - server mode
  • DHCPv6-Service - server mode
  • NDP-Proxy - disabled
  • DHCPv6-Mode - stateless+stateful

Despite all the above seemingly identical, only clients in the the default LAN have proper IPv6 connectivity - the other 3 OPTx don't. I just wonder if you have any thoughts for whether I need to add firewall rules to enable IPv6 on OPTx (given they're all in different firewall zones) while LAN perhaps has it by default.

TIA

Wireguard was / is not a priority as I never used it but I know Wireguard needs some attention upstream.

nitroshift

1 Like

@nitroshift

There is work on fixing WireGuard here

@wally_walrus and others re: IPv6
Can you all try to comment the ipv6 lines in /etc/sysctl.d/60-restict.conf and reboot?
See if that makes a difference.