Custom firmware build for R7800 v. 1.0.2.76SF & v. 1.0.2.76.1SF

[Voxel]

Continuation of
. . .
https://www.snbforums.com/threads/custom-firmware-build-for-r7800-v-1-0-2-74-4sf.62646/
https://www.snbforums.com/threads/c...or-r7800-v-1-0-2-75-1sf-v-1-0-2-75-2sf.62906/

New version of my custom firmware build: 1.0.2.76SF.

Changes (vs 1.0.2.75.2SF):

1. OpenVPN is upgraded 2.4.8->2.4.9 (CVE--2020-11810).

https://openvpn.net/community-downloads/​

2. OpenSSL v. 1.1.1 package is upgraded 1.1.1e->1.1.1f.
3. DNSCrypt Proxy v.2 is upgraded 2.0.41->2.0.42.
4. nano package is upgraded 4.9->4.9.2.
5. libxml2 package is upgraded 2.9.9->2.9.10.
6. ethtool package is upgaded 4.19->5.4.
7. coreutils package (sort) is upgraded 8.31->8.32.
8. Host tools (e2fsprogs): is upgraded to 1.45.6.
9. Host tools (xz): is upgraded to 5.2.5.
10. Host tools (mm-macros): is upgraded to 1.0.0.

[Edited]

Quick fix version: 1.0.2.76.1SF.

Changes (vs 1.0.2.76SF):

1. OpenSSL v. 1.1.1 package is upgraded 1.1.1f->1.1.1g (CVE-2020-1967).

https://nvd.nist.gov/vuln/detail/CVE-2020-1967​

The link is:

https://www.voxel-firmware.com (thanks to vladlenas for his help with hosting).

Voxel.

 

[microchip]

Is there a possibility to update busybox? Or is that complicated?

 

[Voxel]

Is there a possibility to update busybox? Or is that complicated?

The problem is in time. NG/DNI is using relatively old version of busybox with own modifications/changes:

https://github.com/SVoxel/R7800/tree/master/git_home/busybox.git

And some of its core utils such as ps, tail, cat, head, gawk etc. are working a bit differently, other options vs e.g. more fresh version of busybox from Entware. I do not remember exactly what difference and what concrete list of utils. Firmware contains about 300 scripts, some of them are from QCA, some from DNI. some mine. I have to check practically all of them and fix a lot if I upgrade busybox. I already faced the error messages when busybox from Entware (/opt/bin;/opt/sbin) was included in my build by default into PATH before busybox from firmware. I.e. wrong result of some scripts...


Voxel.

 

[HELLO_wORLD]

Is it possible to update iptables and ipset in future release?

In firmware:
iptables is v1.4.10 (your Entware version is 1.4.21-3).
ipset is v6.24 (your Entware version is 7.4-1).

 

[Frankhar]

Thank you again Voxel for your great work, just upgraded, so far so good!

 

[Voxel]

Is it possible to update iptables and ipset in future release?

In firmware:
iptables is v1.4.10 (your Entware version is 1.4.21-3).
ipset is v6.24 (your Entware version is 7.4-1).

iptables: I did not check in deep the possibility to upgrade this package. I tried to upgrade ipset.

The main problem with these packages is that they are dependent on kernel sources (including kernel modules).

ipset. Impossible to upgrade even to version e.g. 6.30. There is a configured header in source codes ip_set_compat.h.in since v. 6.30. Part of codes

static inline __be16 tc_skb_protocol(const struct sk_buff *skb)
{
    if (vlan_tx_tag_present(skb))
        return skb->vlan_proto;
    return skb->protocol;
}

and sk_buff structure does not have the member vlan_proto in kernel codes. I cannot correct this part of kernel for R7800: pro-build kernel modules (QCA drivers) could crash. Obvious: other memory layout.

It is possible to upgrade ipset to 7.4 for R9000 and for Orbi...

iptables: still under my investigation.

Voxel.

 

[HELLO_wORLD]

Tricky...

Thank you @Voxel
I fully trust you in your choices.

The important is optimization over latest version. If more recent versions are not faster, using less cpu and/or memory or fixing major security problems, that’s not worth it.

 

[LeKeiser]

Firmware just upgrade. Thanx a lot again Voxel for your great work

 

[HELLO_wORLD]

One quick question:
Are the versions of iptables and ipset in your Entware repo dependent on the kernel? I did not try to install these packages yet on Entware on R7800.

If they are not dependent, why not just replace the ones one the rootfs in firmware by those standalone versions? Or would they be less optimized?

iptables: I did not check in deep the possibility to upgrade this package. I tried to upgrade ipset.

The main problem with these packages is that they are dependent on kernel sources (including kernel modules).

ipset. Impossible to upgrade even to version e.g. 6.30. There is a configured header in source codes ip_set_compat.h.in since v. 6.30. Part of codes

static inline __be16 tc_skb_protocol(const struct sk_buff *skb)
{
    if (vlan_tx_tag_present(skb))
        return skb->vlan_proto;
    return skb->protocol;
}

and sk_buff structure does not have the member vlan_proto in kernel codes. I cannot correct this part of kernel for R7800: pro-build kernel modules (QCA drivers) could crash. Obvious: other memory layout.

It is possible to upgrade ipset to 7.4 for R9000 and for Orbi...

iptables: still under my investigation.

Voxel.

 

[Voxel]

QuickFix version 1.0.2.76.1SF

CVE-2020-1967 is fixed (OpenSSL 1.1.1g).

Voxel.

 

[Voxel]

One quick question:
Are the versions of iptables and ipset in your Entware repo dependent on the kernel? I did not try to install these packages yet on Entware on R7800.

If they are not dependent, why not just replace the ones one the rootfs in firmware by those standalone versions? Or would they be less optimized?

Entware versions are using generic version of kernel. Not specialized for R7800 with e.g. QCA changes. And because of this no kernel modules are assembled and used in Entware.

Example: wireguard-tools package is also available in Entware but it is useless w/o WireGuard modules loaded to kernel.

Voxel.

 

[Obsidian...]

Thank you @Voxel

 

[bartj12]

Thanks again @Voxel. You are making the r7800 so much better!

 

[Deleted member 22229]

For some reason i cant use 75 or 76 on my R7800. Wierd issue with some web pages load and some load very very slow or not at all. I have a pretty vanilla set up no add on's. I have factory reset many times set up from scratch always with the same result. Going back to NG 1.0.2.68 always resolves the problem and the router works great again. I don't have a much more time to keep testing need my connection to be up and running during this time.

Anybody else have anything like this happen ? I have other router options but thought i would put the 7800 back inline for a few. Strange indeed.

 

[microchip]

For some reason i cant use 75 or 76 on my R7800. Wierd issue with some web pages load and some load very very slow or not at all. I have a pretty vanilla set up no add on's. I have factory reset many times set up from scratch always with the same result. Going back to NG 1.0.2.68 always resolves the problem and the router works great again. I don't have a much more time to keep testing need my connection to be up and running during this time.

Anybody else have anything like this happen ? I have other router options but thought i would put the 7800 back inline for a few. Strange indeed.

I've experienced this myself here and do not know the cause of it. Most of the time, the interface is fast but every now and then, when trying to connect to it or load another page, it takes up to 20 seconds to load.

 

[Deleted member 22229]

I've experienced this myself here and do not know the cause of it. Most of the time, the interface is fast but every now and then, when trying to connect to it or load another page, it takes up to 20 seconds to load.

I was not refering to the Web UI interface i am talking about websites. I just can't understand what could possibly cause this. It makes the router unusable. Again loading stock 68 and all is perfect again. I am baffled. Possibly a DNS issue ? I have tried many including just using my ISP's.

 

[Deleted member 22229]

Have you tried a factory reset and setup from scratch after loading recent Voxel FW versions?

As stated in my first post i have flashed and did complete factory resets many times with the same result. I am going to try 76.1 and dirty flash over stock and see if it does it again.

 

[microchip]

I was not refering to the Web UI interface i am talking about websites. I just can't understand what could possibly cause this. It makes the router unusable. Again loading stock 68 and all is perfect again. I am baffled. Possibly a DNS issue ? I have tried many including just using my ISP's.

Oh, OK. I've not experienced this issue here. "Works for me(TM)"

 

[e38BimmerFN]

Ok, I have v74.4 loaded on mine with Entware.
I haven't upgraded as of yet.

 

[Deleted member 22229]

Unreal.. A dirty flash over wifi from stock 68 to 76.1 works. No lag or time outs. I wonder if a factory reset will bring the issue back ? It's probably needed going from stock to 76.1. Dare i try..