Firmware "Check Update" just spins and spins with no response

[Sas]

Hi I have searched the forums but not found anything mentioning this particular problem. I'm on AC68U, currently with firmware 384.17. For the past 2 or three versions of the firmware (about 2 months I guess) whenever I go to the Firmware Upgrade page and click the "Check" button, I just get a spinning gif and the words:

Contacting the update server...

It just stays like this and there is never a response at all. Any suggestions for how to fix this? I have tried resetting the router, disabling/enabling the firewall, disabling/enabling Diversion, etc. But no difference. I always have to check the download site manually (by visiting it). Haven't any problems upgrading firmware or anything, but it never completes a check. Thanks for any help or advice.

 

[JacquesR]

It just stays like this and there is never a response at all. Any suggestions for how to fix this? I have tried resetting the router, disabling/enabling the firewall, disabling/enabling Diversion, etc. But no difference. I always have to check the download site manually (by visiting it). Haven't any problems upgrading firmware or anything, but it never completes a check. Thanks for any help or advice.

A search for "Check Update" found this similar thread, with a few suggestions for fixing it.

 

[Sas]

A search for "Check Update" found this similar thread, with a few suggestions for fixing it.

Thanks for the reply, I already saw that thread and tried its suggestions, but none of them work or change the behavior in any way alas.

 

[Sas]

I still have this problem, in case anyone has any ideas how to fix it...

 

[dave14305]

I still have this problem, in case anyone has any ideas how to fix it...

If you login to the router via SSH and run this command, does it work?

curl -v https://fwupdate.asuswrt-merlin.net/manifest.txt

Spoiler: My results

# curl -v https://fwupdate.asuswrt-merlin.net/manifest.txt
*   Trying 2606:4700:3035::6812:29a7:443...
* Immediate connect fail for 2606:4700:3035::6812:29a7: Network is unreachable
*   Trying 104.18.41.167:443...
* Connected to fwupdate.asuswrt-merlin.net (104.18.41.167) port 443 (#0)
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:mad:STRENGTH
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: none
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-ECDSA-AES128-GCM-SHA256
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: C=US; ST=CA; L=San Francisco; O=Cloudflare, Inc.; CN=sni.cloudflaressl.com
*  start date: May 14 00:00:00 2020 GMT
*  expire date: Oct  9 12:00:00 2020 GMT
*  subjectAltName: host "fwupdate.asuswrt-merlin.net" matched cert's "*.asuswrt-merlin.net"
*  issuer: C=US; ST=CA; L=San Francisco; O=CloudFlare, Inc.; CN=CloudFlare Inc ECC CA-2
*  SSL certificate verify ok.
> GET /manifest.txt HTTP/1.1
> Host: fwupdate.asuswrt-merlin.net
> User-Agent: curl/7.69.1
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Date: Sat, 16 May 2020 22:39:48 GMT
< Content-Type: text/plain; charset=UTF-8
< Content-Length: 551
< Connection: keep-alive
< Set-Cookie: __cfduid=da2a65b5868a919150b0492ff73242e841589668788; expires=Mon, 15-Jun-20 22:39:48 GMT; path=/; domain=.asuswrt-merlin.net; HttpOnly; SameSite=Lax; Secure
< Last-Modified: Sun, 26 Apr 2020 04:58:31 GMT
< Cache-Control: max-age=14400
< CF-Cache-Status: HIT
< Age: 75020
< Accept-Ranges: bytes
< Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
< Server: cloudflare
< CF-RAY: 594898c56c9c7e31-XXX
< cf-request-id: 02c13dcf6500007e3140260200000001
<
RT-AC56U#FW384.6#EXT0#BETAFW384.6#BETAEXTbeta3#
RT-AC3200#FW384.13#EXT8#BETAFW384.10#BETAEXTbeta3#
RT-AC87U#FW384.13#EXT8#BETAFW384.10#BETAEXTbeta3#
RT-AC86U#FW384.17#EXT0#BETAFW384.10#BETAEXTbeta3#
RT-AC88U#FW384.17#EXT0#BETAFW384.10#BETAEXTbeta3#
RT-AC3100#FW384.17#EXT0#BETAFW384.10#BETAEXTbeta3#
RT-AC68U#FW384.17#EXT0#BETAFW384.10#BETAEXTbeta3#
RT-AC5300#FW384.17#EXT0#BETAFW384.10#BETAEXTbeta3#
RT-AX88U#FW384.17#EXT0#BETAFW384.10#BETAEXTbeta3#
RT-AX56U#FW384.17#EXT0#BETAFW384.10#BETAEXTbeta3#
RT-AX58U#FW384.17#EXT0#BETAFW384.10#BETAEXTbeta3#
* Connection #0 to host fwupdate.asuswrt-merlin.net left intact

 

[Sas]

If you login to the router via SSH and run this command, does it work?

curl -v https://fwupdate.asuswrt-merlin.net/manifest.txt

Thanks for your reply! Yes it seems to give a very similar result to yours. But the web interface just spins and spins with no return...

 

[Sas]

And looking at the dev tools network panel for that page is just an endless stream of activity with (seemingly) no valid responses...

 

[Sas]

Is there some way to check what the correct nvram settings should be? Could that be the problem?

 

[dave14305]

What’s the output of:

nvram get firmware_server

It should be

https://fwupdate.asuswrt-merlin.net

 

[Sas]

What’s the output of:

nvram get firmware_server

It should be

https://fwupdate.asuswrt-merlin.net

Yeah, that one I already checked, it matches yours.

 

[dave14305]

Yeah, that one I already checked, it matches yours.

Check what’s in /tmp/webs_upgrade.log after pushing the update check button.
Then run

sh -x /usr/sbin/webs_update.sh

to see if the underlying script runs successfully and check the file again.

 

[Sas]

ok here is the process I went through:
1. Rebooted router
2. Pushed Check button on firmware page
3. Checked for /tmp/web_upgrade.log - file did not exist
4. Ran sh -x /usr/sbin/webs_update.sh
5. Rechecked for /tmp/web_upgrade.log - this time file DID exist and contents were:

---- update real normal----
---- Have 384.17_100----
---- Stable available 384.17_0----

 

[dave14305]

Any browser console errors, or ad-blockers without whitelisting the router URL?

 

[Sas]

Any browser console errors, or ad-blockers without whitelisting the router URL?

nope. just the strange endlessly repeating network calls shown in the image I posted above...

 

[dave14305]

nope. just the strange endlessly repeating network calls shown in the image I posted above...

If you press the button in the GUI, then run the script in another window, will the GUI stop spinning?

 

[Sas]

If you press the button in the GUI, then run the script in another window, will the GUI stop spinning?

Nope, spinning gif still present, no change in main window after running
sh -x /usr/sbin/webs_update.sh from separate console window. (if that is what you meant)

 

[Sas]

I don't suppose anyone has yet found a solution for this? I just updated to the last firmware released a few days back and the problem persists.

 

[dave14305]

There was a malware identified a few weeks ago that was blocking these downloads. Check if it’s happened on your router. It’s a simple nvram check for three-oh (but should be three-zero).

[ "$(nvram get apps_wget_timeout)" = "3O" ] && echo "Malware" || echo "OK"

 

[Jack Yaz]

There was a malware identified a few weeks ago that was blocking these downloads. Check if it’s happened on your router. It’s a simple nvram check for three-oh (but should be three-zero).

[ "$(nvram get apps_wget_timeout)" = "3O" ] && echo "Malware" || echo "OK"

wasn't this mitigated in 384.18? https://github.com/RMerl/asuswrt-merlin.ng/commit/8361d39aff247d79bd24a89d5e7f0607baddec27

 

[Sas]

Not sure if I have run this correctly (I just pasted `[ "$(nvram get apps_wget_timeout)" = "3O" ] && echo "Malware" || echo "OK"` at the command prompt when ssh-ing into my router) but it returned "OK"