Divested-WRT: No-nonsense hardened builds for Linksys WRT series

@SkewedZeppelin, thank you... I was hoping there would be a way to "mount" the image and copy the files over. I wish I could compile on my own but I'm not there yet, may have to take that as my next project :slight_smile:

@wally_walrus
I think you technically can extract the sysupgrade and use squashfstools to edit the root partition.
But ymmv.

Yes, its br-lan. No dual router setups.

I used your divested .config, added a couple packages, and setup from scratch. The build is very stable. Fastest pings yet.

Personally I use x86 build with ap's, but I help family and a friend. One has 1200ac with a single ap and the other has a 32x using internal wlans. No ip6 on the 32x's wlans is not a deal breaker. Heck, it may keep his kids off of facetime. Lol. No strange errors in log to report. Everything else looks normal.

I'm going to backup and reflash your latest to see if a package I added is causing the issue.

@scott68
here are the relevant parts of my config for reference:

/etc/config/network
config globals 'globals'
	option ula_prefix 'CHANGE ME'

config interface 'lan'
	option ip6assign '64'
	option ip6hint '1'
	option ip6ifaceid '::1' #INCREMENT this on each subsequent router/AP

config interface 'wan'
	option ifname 'wan'
	option proto 'dhcp'
	option peerdns '0'

config interface 'wan6'
	option ifname 'wan'
	option proto 'dhcpv6'
	option peerdns '0'
	option reqprefix '56'
	option auto '1'


/etc/config/dhcp
config dhcp 'lan'
	option interface 'lan'
	option leasetime '12h'
	option dhcpv6 'server'
	option ra 'server'
	option ra_slaac '1'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'

hi,
@SkewedZeppelin - thanks for the guide and the video - very helpful and much appreciated.

Is there a how to migrate guide for swconfig to dsa. I tried to search this forum for more info but havent had much luck. Or is it better off just installing the firmware factory defaults and reconfiguring ?
cheers

@skitts24

Rough swconfig to DSA migration steps:

  1. Backup
  2. Edit /etc/config/network as follows:
  • drop all config switch* blocks and their contents
  • in config interface 'lan' change option ifname value to 'lan1 lan2 lan3 lan4'
  • in config interface 'wan' change option ifname value to 'wan'
  • add the following
config device 'wan_wan_dev'
	option name 'wan'
	option macaddr '[INSERT MAC]'
  1. Edit /etc/config/system as follows:
  • in config system add option compat_version '1.1'
  • in config led 'led_wan' change option dev to 'wan'
  1. Edit /etc/config/sqm as follows
  • in config queue 'eth1' change option interface to 'wan'
  1. sysupgrade with keep settings checked
  2. success?

Note: if it isn't right you will get locked out, and will have to factory reset via the button.

I haven't done it in a while, please anyone correct it if necessary.
I'll then write it up and add it to the site soon.

Alternative you can just sysupgrade with keep settings unchecked and start fresh.

5 Likes

Under lan section also add the wireless interfaces as they are members of the same zone.

nitroshift

3 Likes

Thanks heaps - i will give that a go and let you know if i have any issues.

i want to build an image without the firewall but am not sure exactly how to remove it and where it sits in the config. I have a 2 wrt-32x (second one i scored for real cheap), one being an ap only.
in the config under the luci -> applications section i cant make a change to the install option which i assume is based on other dependencies that are installing. problem is i dont know where they are located in the config exactly.
cheers

@skitts24
You do not need to remove the firewall if all you want to do is use it as an AP.

Thanks. I was reading that doco earlier and it was saying to disable the firewall. I thought it would be easier to just not install it so I would have a custom config with no firewall installed for that particular router

Hi!

I´m trying to compile following your instructions, but when running this ./scripts/feeds install -a -f everithing seems to be OK, but later it shows this warnings:

WARNING: Makefile 'package/utils/busybox/Makefile' has a dependency on 'libpam', which does not exist
WARNING: Makefile 'package/utils/busybox/Makefile' has a dependency on 'libpam', which does not exist
WARNING: Makefile 'package/utils/busybox/Makefile' has a build dependency on 'libpam', which does not exist
WARNING: Makefile 'package/boot/kexec-tools/Makefile' has a dependency on 'liblzma', which does not exist
WARNING: Makefile 'package/network/services/lldpd/Makefile' has a dependency on 'libnetsnmp', which does not exist
WARNING: Makefile 'package/utils/policycoreutils/Makefile' has a dependency on 'libpam', which does not exist
WARNING: Makefile 'package/utils/policycoreutils/Makefile' has a dependency on 'libpam', which does not exist
WARNING: Makefile 'package/utils/policycoreutils/Makefile' has a build dependency on 'libpam', which does not exist

I'm compiling from Ubuntu 20.04 LTS using WSL2.

Will this be a problem?

Thank you!

2 Likes

@sunchar

Master is currently broken/in-flux right now.
I'd checkout to d8afae0be8f0a2a4a26e303dd5212e2a2f8d69a3.
I'm not actually sure how to checkout all repos. Anyone know?

3 Likes

This means that it could lead to problems if install resulting firmware?

Checkout specific code revision

1 Like

This is my first atempt, but it didn't worked. This is the result of the last step:

$ make -j16
ln: failed to create symbolic link 'lib64': Not a directory
ln: failed to create symbolic link 'lib32': Not a directory
time: target/linux/prereq#0.47#0.23#2.89
 make[1] world
 make[2] tools/compile
 make[3] -C tools/flock compile
 make[3] -C tools/xz compile
 make[2] package/cleanup
    ERROR: tools/xz failed to build.
make -r world: build failed. Please re-run make with -j1 V=s or V=sc for a higher verbosity level to see what's going on
make: *** [/mnt/c/Users/Carlos/openwrt/include/toplevel.mk:230: world] Error 1

Any ideas about what i'm doing wrong?
I'm new on this.

Thank you!

do you have all the build libraries?
see

i have had to use -j1 for first make on a local git clone.
this is specifically mentioned in the quick building guide:

"For faster compiling, use make -j N , where N is the number of CPU cores + 1. Be aware that this method is prone to errors during compiling. In case you encounter compile errors, your very first step is to compile again without -j N . Use of make download prior to parallel compilation is recommended to prevent some of these errors (-jN is generally safe for the download step for those with faster Internet connectivity.)"

it is a mystery to me why these errors occur but I have usually been able to resolve them by running make -j1.

Use j -1 V=sc

1 Like

It didn't worked. I will do everything from the beginning.

Thank you!

I installed the libraries for debia/ubuntu without any problem:

[OpenWrt Wiki] Build system setup

running maje -j1 -V=sc shows this:

$ make -j1 V=sc
make[1]: Entering directory '/mnt/c/Users/Carlos/openwrt'
make[2]: Entering directory '/mnt/c/Users/Carlos/openwrt'
+ mkdir -p /mnt/c/Users/Carlos/openwrt/staging_dir/target-arm_cortex-a9+vfpv3-d16_musl_eabi
+ cd /mnt/c/Users/Carlos/openwrt/staging_dir/target-arm_cortex-a9+vfpv3-d16_musl_eabi
+ mkdir -p bin lib stamp usr/include usr/lib
mkdir -p /mnt/c/Users/Carlos/openwrt/build_dir/target-arm_cortex-a9+vfpv3-d16_musl_eabi/stamp
touch /mnt/c/Users/Carlos/openwrt/staging_dir/target-arm_cortex-a9+vfpv3-d16_musl_eabi/.prepared
+ mkdir -p /mnt/c/Users/Carlos/openwrt/staging_dir/host
+ cd /mnt/c/Users/Carlos/openwrt/staging_dir/host
+ mkdir -p bin lib stamp usr/include usr/lib
mkdir -p /mnt/c/Users/Carlos/openwrt/build_dir/host/stamp /mnt/c/Users/Carlos/openwrt/staging_dir/host/include/sys
install -m0644 /mnt/c/Users/Carlos/openwrt/tools/include/*.h /mnt/c/Users/Carlos/openwrt/staging_dir/host/include/
install -m0644 /mnt/c/Users/Carlos/openwrt/tools/include/sys/*.h /mnt/c/Users/Carlos/openwrt/staging_dir/host/include/sys/
ln -snf lib /mnt/c/Users/Carlos/openwrt/staging_dir/host/lib64
touch /mnt/c/Users/Carlos/openwrt/staging_dir/host/.prepared
make[3]: Entering directory '/mnt/c/Users/Carlos/openwrt/tools/flock'
make[3]: Leaving directory '/mnt/c/Users/Carlos/openwrt/tools/flock'
time: tools/flock/compile#0.11#0.05#0.64
make[3]: Entering directory '/mnt/c/Users/Carlos/openwrt/tools/xz'
(cd /mnt/c/Users/Carlos/openwrt/build_dir/host/xz-5.2.5/; if [ -x configure ]; then cp -fpR /mnt/c/Users/Carlos/openwrt/scripts/config.{guess,sub} /mnt/c/Users/Carlos/openwrt/build_dir/host/xz-5.2.5// && CC="gcc" CFLAGS="-O2 -I/mnt/c/Users/Carlos/openwrt/staging_dir/host/include " CXX="g++" CPPFLAGS="-I/mnt/c/Users/Carlos/openwrt/staging_dir/host/include " LDFLAGS="-L/mnt/c/Users/Carlos/openwrt/staging_dir/host/lib " CONFIG_SHELL="/usr/bin/env bash"  bash ./configure --target=x86_64-pc-linux-gnu --host=x86_64-pc-linux-gnu --build=x86_64-pc-linux-gnu --program-prefix="" --program-suffix="" --prefix=/mnt/c/Users/Carlos/openwrt/staging_dir/host --exec-prefix=/mnt/c/Users/Carlos/openwrt/staging_dir/host --sysconfdir=/mnt/c/Users/Carlos/openwrt/staging_dir/host/etc --localstatedir=/mnt/c/Users/Carlos/openwrt/staging_dir/host/var --sbindir=/mnt/c/Users/Carlos/openwrt/staging_dir/host/bin --enable-static=yes --enable-shared=no --disable-doc --disable-nls --with-pic ; fi )
cat: -: No such file or directory
cat: -: No such file or directory
cat: -: No such file or directory
cat: -: No such file or directory
cat: -: No such file or directory
cat: -: No such file or directory
cat: -: No such file or directory
cat: -: No such file or directory
cat: -: No such file or directory

XZ Utils 5.2.5

System type:
checking build system type... x86_64-pc-linux-gnu
checking host system type... x86_64-pc-linux-gnu

Configure options:
checking if debugging code should be compiled... no
checking which encoders to build... lzma1 lzma2 delta x86 powerpc ia64 arm armthumb sparc
checking which decoders to build... lzma1 lzma2 delta x86 powerpc ia64 arm armthumb sparc
checking which match finders to build... hc3 hc4 bt2 bt3 bt4
checking which integrity checks to build... crc32 crc64 sha256
checking if external SHA-256 should be used... no
checking if assembler optimizations should be used... x86_64
checking if small size is preferred over speed... no
checking if threading support is wanted... yes, posix
checking how much RAM to assume if the real amount is unknown... 128 MiB
cat: -: No such file or directory
checking if library symbol versioning should be used... yes
checking if sandboxing should be used... maybe (autodetect)

checking for a shell that conforms to POSIX... /bin/sh

Initializing Automake:
checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... yes
checking for a thread-safe mkdir -p... /usr/bin/mkdir -p
checking for gawk... gawk
checking whether make sets $(MAKE)... cat: -: No such file or directory
no
checking whether make supports nested variables... yes
cat: -: No such file or directory
cat: -: No such file or directory
checking whether ln -s works... yes
checking whether make supports the include directive... cat: -: No such file or directory
no
checking for x86_64-pc-linux-gnu-gcc... gcc
cat: -: No such file or directory
checking whether the C compiler works... no
configure: error: in `/mnt/c/Users/Carlos/openwrt/build_dir/host/xz-5.2.5':
configure: error: C compiler cannot create executables
See `config.log' for more details
make[3]: *** [Makefile:37: /mnt/c/Users/Carlos/openwrt/build_dir/host/xz-5.2.5/.configured] Error 77
make[3]: Leaving directory '/mnt/c/Users/Carlos/openwrt/tools/xz'
time: tools/xz/compile#0.61#0.29#3.24
    ERROR: tools/xz failed to build.
make[2]: *** [tools/Makefile:159: tools/xz/compile] Error 1
make[2]: Leaving directory '/mnt/c/Users/Carlos/openwrt'
make[1]: *** [tools/Makefile:155: /mnt/c/Users/Carlos/openwrt/staging_dir/host/stamp/.tools_compile_yyynyynnyyynyyyyyynyynnyyyynyyyyyyyyyyyyyyyynynnyyyyyyy] Error 2
make[1]: Leaving directory '/mnt/c/Users/Carlos/openwrt'
make: *** [/mnt/c/Users/Carlos/openwrt/include/toplevel.mk:230: world] Error 2

So I will start from scratch to see if something went wrong before this.

Thank you!