OpenWrt in Docker (openwrt/docker, docker-openwrt) best practices, LuCI [app] development, PQ Post-Quantum crypto (!RSA,) (2023)

[westurner]

Went looking for resources to learn to develop a simple luci app,

• https://openwrt.org/docs/guide-user/virtualization/docker_openwrt_image#openwrt_as_a_native_docker_image

openwrt/docker

• https://github.com/openwrt/docker/blob/main/Dockerfile
• https://github.com/openwrt/docker/blob/main/.github/workflows/containers.yml
• https://github.com/openwrt/docker#rootfs-experimental ::

  docker run --rm -it openwrt/rootfs
  # inside the Docker container
  mkdir /var/lock/
  opkg update
  opkg install tmate
  tmate
  

  Then to develop LuCI apps:

  opkg install luci-ssl   # seeAlso: docker-openwrt/Dockerfile
  

docker-openwrt

• https://github.com/oofnikj/docker-openwrt
• https://github.com/oofnikj/docker-openwrt/blob/master/Dockerfile ::

FROM scratch
ADD rootfs.tar.gz /
RUN mkdir -p /var/lock
RUN opkg remove --force-depends \
      dnsmasq* \
      wpad* \
      iw* && \
    opkg update && \
    opkg install luci \
      wpad-wolfssl \
      iw-full \
      ip-full \
      kmod-mac80211 \
      dnsmasq-full \
      iptables-mod-checksum
RUN opkg list-upgradable | awk '{print $1}' | xargs opkg upgrade || true

RUN echo "iptables -A POSTROUTING -t mangle -p udp --dport 68 -j CHECKSUM --checksum-fill" >> /etc/firewall.user
RUN sed -i '/^exit 0/i cat \/tmp\/resolv.conf > \/etc\/resolv.conf' /etc/rc.local

ARG ts
ARG version
LABEL org.opencontainers.image.created=$ts
LABEL org.opencontainers.image.version=$version
LABEL org.opencontainers.image.source=https://github.com/oofnikj/docker-openwrt

CMD [ "/sbin/init" ]

luci app development

• src: https://github.com/openwrt/luci
• docs: https://github.com/openwrt/luci/blob/master/CONTRIBUTING.md
• docs: https://openwrt.org/docs/guide-developer/luci
• docs: https://openwrt.org/docs/guide-user/luci/luci.essentials
• docs: https://openwrt.github.io/luci/api/
• docs: https://openwrt.github.io/luci/api/modules/luci.util.html
• docs: https://openwrt.github.io/luci/jsapi/
• docs: https://openwrt.github.io/luci/jsapi/LuCI.html
• docs: https://github.com/openwrt/luci/wiki/DevelopmentEnvironmentHowTo
• there are a number of luci-* packages; opkg install luci-ssl results in an ssl cert being generated
• pkg: https://openwrt.org/packages/pkgdata/luci
• pkg: https://openwrt.org/packages/pkgdata/luci-ssl
• pkg: https://openwrt.org/packages/pkgdata/luci-ssl-openssl
• pkg: https://openwrt.org/packages/pkgdata/luci-ssl-nginx
• https://github.com/openwrt/luci/tree/openwrt-22.03/collections/luci/Makefile (uhttpd)
• https://github.com/openwrt/luci/blob/openwrt-22.03/collections/luci-ssl/Makefile (uhttpd+wolfssl)
• https://github.com/openwrt/luci/blob/openwrt-22.03/collections/luci-ssl-openssl/Makefile (uhttpd+openssl)
• https://github.com/openwrt/luci/blob/openwrt-22.03/collections/luci-ssl-nginx/Makefile (nginx+openssl)
• https://openwrt.org/docs/guide-user/services/tls/certs#self_signed_certs
• https://openwrt.org/docs/guide-user/services/webserver/uhttpd#https_enable_and_certificate_settings_and_creation
• https://github.com/mathiasertl/django-ca
• https://openwrt.org/packages/pkgdata/luci-app-acme
• https://github.com/openwrt/luci/blob/master/libs/luci-lib-px5g/src/px5g.c#L68 ... "almost OT note about [dropbear] and PQ Post-Quantum algorithms":
  • RSA
  • ECC/ECDSA // ed25519
    • https://github.com/openwrt/openwrt/issues/7984#issuecomment-1435770751
    • https://github.com/mkj/dropbear/blob/master/src/curve25519.c
    • https://github.com/mkj/dropbear/blob/master/libtomcrypt/src/pk/ecc/ecc.c
  • PQ: Post-Quantum
    • https://en.wikipedia.org/wiki/NTRU#Implementations ::

      OpenSSH by default uses NTRU combined with the X25519 ECDH key exchange since August 2022, included in version 9.0.[19]

      • Streamlined NTRU Prime + x25519 key exchange method
        https://github.com/mkj/dropbear/issues/157
• example luci code to get started reading:
  • https://github.com/openwrt/luci/tree/master/applications/luci-app-example
  • https://github.com/openwrt/luci/blob/master/modules/luci-mod-system/htdocs/luci-static/resources/view/system/reboot.js
  • https://github.com/openwrt/luci/blob/master/applications/luci-app-statistics/htdocs/luci-static/resources/view/statistics/graphs.js
  • https://github.com/openwrt/luci/blob/master/applications/luci-app-wol/root/usr/share/rpcd/acl.d/luci-app-wol.json
  • https://github.com/openwrt/luci/blob/master/applications/luci-app-wol/htdocs/luci-static/resources/view/wol.js
• List of luci-app-* packages:
  https://openwrt.org/packages/index/luci---applications
  • luci app ideas:
    • https://github.com/openspeedtest/Speed-Test
    • https://github.com/tohojo/flent
      • https://openwrt.org/packages/pkgdata/netperf
    • https://github.com/openthread/ot-br-posix/blob/main/src/openwrt/otbr-firewall.init.in
    • https://github.com/samyk/webscan
    • https://github.com/gekmihesg/ansible-openwrt
      • https://github.com/ansible-community/ara -style logs on the openwrt client,
      • https://github.com/gekmihesg/ansible-openwrt/blob/master/library/openwrt_uci.sh
• https://learnxinyminutes.com/docs/lua/

[westurner]

• Additional luci app ideas:
  • etckeeper git interface:
    • on_install(etckeeper_init())
    • on_click(push(config._.remote_n))
    • on_click(etckeeper_commit())
    • /etc/init/etckeepergitweb
      • opkg install git-gitweb
    • etckeeper:
      • src: https://git.joeyh.name/index.cgi/etckeeper.git/tree/
      • Etckeeper: requesting help with building an OpenWrt package :

Etckeeper: requesting help with building an OpenWrt package

Hello all, I've been using OpenWRT for over a year now, and absolutely love the capability and flexibility it provides. On all my other *nix systems, I use etckeeper and git to provide version management of /etc, and would like to do the same on my OpenWRT systems. I've managed to get etckeeper installed manually on an emulated instance of OpenWRT, and successfully version controlled the /etc folder on my git server. I've posted detailed to GitHub on how to manually install etckeeper. The p…

[westurner]

Additional luci app ideas:

• mDNS browser
  • https://openwrt.org/docs/guide-developer/mdns#browsing_announced_services
    ubus call umdns update; sleep 2; ubus call umdns browse
• mDNS repeater config (vs avahi-daemon for mDNS forwarding; which also lacks firewalling/eBPF/nftables support FWIU)
  • https://github.com/geekman/mdns-repeater/blob/master/mdns-repeater.c#L322

[westurner]

Additional luci app ideas:

• luci-app- discover_nodes_and_services_on_the_lan
  • $ [fping,arp-scan,nmap,] > /tmp/reports/ # (w/ cron)