A significant new release of the OpenWrt 21.02.0 distribution has been introduced, aimed at deployment in various network devices such as routers, switches, and access points. OpenWrt supports numerous platforms and architectures and features a build system that allows for seamless cross-compilation, including various components in the build, making it easy to create customized firmware or disk images with the desired set of pre-installed packages. Builds have been prepared for 36 target platforms.
Notable changes in OpenWrt 21.02.0 include:
- The minimum hardware requirements have been raised. The default build now requires a device with 8 MB Flash and 64 MB RAM due to the inclusion of additional Linux kernel subsystems for OpenWrt. However, it is still possible to create a custom trimmed-down build that can run on devices with 4 MB Flash and 32 MB RAM, though such a build will have limited functionality and stability is not guaranteed.
- The base installation includes packages for support of the WPA3 wireless network security technology, which is now available by default both in client mode and when creating an access point. WPA3 offers protection against password guessing attacks (preventing offline password cracking) and utilizes the SAE authentication protocol. WPA3 support is available in most drivers for wireless devices.
- The base installation now includes support for TLS and HTTPS by default, allowing access to the LuCI web interface over HTTPS and enabling utilities like wget and opkg to retrieve information over encrypted communication channels. The servers distributing packages downloaded via opkg have also been switched to provide information over HTTPS by default. The encryption library mbedTLS has been replaced with wolfSSL (mbedTLS and OpenSSL libraries can still be manually installed as options if needed). An option for automatic redirection to HTTPS in the web interface has been proposed: 'uhttpd.main.redirect_https=1'.
- Initial support for the DSA (Distributed Switch Architecture) kernel subsystem has been implemented, providing tools for configuring and managing cascaded Ethernet switches using mechanisms typically applied for configuring standard network interfaces (iproute2, ifconfig). DSA can be used to set up ports and VLANs instead of the previously offered swconfig tool, although not all switch drivers currently support DSA. In this release, DSA is utilized for drivers such as ath79 (TP-Link TL-WR941ND), bcm4908, gemini, kirkwood, mediatek, mvebu, octeon, ramips (mt7621), and realtek.
- Changes have been made to the syntax of configuration files located in /etc/config/network. In the 'config interface' block, the 'ifname' option has been renamed to 'device', and in the 'config device' block, the 'bridge' and 'ifname' options have been renamed to 'ports'. For new installations, separate files for device settings (layer 2, 'config device' block) and network interfaces (layer 3, 'config interface' block) are now generated. To maintain backward compatibility, support for the old syntax is preserved, meaning that previously created settings will not require changes. However, when the old syntax is detected in the web interface, a suggestion to migrate to the new syntax, necessary for editing settings via the web interface, will be presented.
Example of the new syntax: config device option name ‘br-lan’ option type ‘bridge’ option macaddr ’00:01:02:XX:XX:XX’ list ports ‘lan1’ list ports ‘lan2’ list ports ‘lan3’ list ports ‘lan4’ config interface ‘lan’ option device ‘br-lan’ option proto ‘static’ option ipaddr ‘192.168.1.1’ option netmask ‘255.255.255.0’ option ip6assign ’60’ config device option name ‘eth1’ option macaddr ’00:01:02:YY:YY:YY’ config interface ‘wan’ option device ‘eth1’ option proto ‘dhcp’ config interface ‘wan6’ option device ‘eth1’ option proto ‘dhcpv6’
Similarly, the field names in board.json have been changed from 'ifname' to 'device', following the syntax changes in the configuration files located in /etc/config/network.
- A new 'realtek' platform has been added, enabling the use of OpenWrt on devices with a large number of Ethernet ports, such as D-Link, ZyXEL, ALLNET, INABA, and NETGEAR Ethernet switches.
- New bcm4908 and rockchip platforms have been added for devices based on the Broadcom BCM4908 and Rockchip RK33xx SoCs. Improvements have been made to previously supported platforms to enhance device support.
- Support for the ar71xx platform has been discontinued, and the ath79 platform should be used instead (for devices tied to ar71xx, it is recommended to perform a clean reinstall of OpenWrt). Support for the cns3xxx (Cavium Networks CNS3xxx), rb532 (MikroTik RB532), and samsung (Samsung TQ210) platforms has also been discontinued.
- Executable files of applications involved in processing network connections are compiled in PIE (Position-Independent Executables) mode with full support for Address Space Layout Randomization (ASLR) to complicate the exploitation of vulnerabilities in such applications.
- By default, options for supporting container isolation technologies are enabled when building the Linux kernel, allowing most platforms to utilize the LXC toolkit and procd-ujail mode in OpenWrt.
- The ability to build with support for the SELinux mandatory access control system has been provided (disabled by default).
- Package versions have been updated, including releases of musl libc 1.1.24, glibc 2.33, gcc 8.4.0, binutils 2.34, hostapd 2020-06-08, dnsmasq 2.85, dropbear 2020.81, busybox 1.33.1. The Linux kernel has been updated to version 5.4.143, with the wireless stack cfg80211/mac80211 ported from kernel 5.10.42 and support transferred. VPN Wireguard.
Source: opennet.ru
