An opensource OpenWrt variant for mainland China users.
Go to file
Dominick Grift 816b83e4ef
selinux-policy: update to version 1.2.3
86ca9c6 devstatus: prints to terminal
95de949 deal with /rom/dev/console label inconsistencies
ab6b6ee uci: hack to deal with potentially mislabeled char files
acf9172 dnsmasq this can't be right
021db5b luci-app-tinyproxy
cf3a9c4 support/secmark: removes duplicate loopback rules
eeb2610 dhcp servers: recv dhcp client packets
d5a5fc3 more support/secmark "fixes"
35d8604 update support secmark
4c155c0 packets these were caused by labeling issues with loopback
fad35a5 nftables reads routing table
f9c5a04 umurmur: kill an mumur instance that does not run as root
10a10c6 mmc stordev make this consistent
ab3ec5b Makefile: sort with LC_ALL=C
b34eaa5 fwenv rules
8c2960f adds rfkill nodedev and some mmc partitions to stordev
5a9ffe9 rcboot runs fwenv with a transition
9954bf6 dnsmasq in case of tcp
ab66468 dnsmasq try this
5bfcb88 dnsmasq stubby not sure why this is happening
863f549 luci not sure why it recv and send server packets
d5cddb0 uhttpd sends sigkill luci cgi
44cc04d stubby: it does not maintain anything in there
db730b4 Adds stubby
ccbcf0e tor simplify network access
a308065 tor basic
a9c0163 znc loose ends
327a9af acme: allow acme_cleanup.sh to restart znc
4015614 basic znc
7ef14a2 support/secmark: clarify some things
3107afe README: todo qrencode
943035a README and secmark doc
4c90937 ttyd: fix that socket leak again
3239adf dnsmasq icmp packets and fix a tty leak issue
b41d38f Makefile: optimize
95d05b1 sandbox dontaudit ttyd leak
0b7d670 rpcd: reads mtu
e754bf1 opkg-lists try this
35fb530 opkg-lists: custom
4328754 opkg try to address mislabeled /tmp/opkg-lists
3e2385c rcnftqos
95eae2d ucode
c86d366 luci diagnostics
e10b443 rpcd packets and wireguard/luci
a25e020 igmpproxt packets
0106f00 luci
dcef79c nftqos related
3c9bc90 related to nft-qos and luci
f8502d4 dnsmasq more related to /usr/lib/dnsmasq/dhcp-script.sh
29a4271 dnsmasq: related to /usr/lib/dnsmasq/dhcp-script.sh
0c5805a some nft-qos
1100b41 adds a label for /tmp/.ujailnoafile
e141a83 initscript: i labeled ujail procd.execfile
a3b0302 Makefile: adds a default target + packets target
6a3f8ef label usign as opkg and label fwtool and sysupgrade
04d1cc7 sysupgrade: i meant don't do the fc spec
763bec0 sysupgrade: dont do /tmp/sysupgrade.img
af2306f adds a failsafe.tmpfile and labels validate_firmware_image
5b15760 fwenv: comment doesnt make sense
370ac3b fwenv: executes shell
67e3fcb fwenv: adds fw_setsys
544d211 adds procd execfile module to label procd related exec files
99d5f13 rclocalconffile: treat /etc/rc.button like /etc/rc.local
4dfd662 label uclient-fetch the same as wget
75d8212 osreleasemiscfile: adds /etc/device_info
0c1f116 adds a rcbuttonconffile for /etc/rc.button (base-files)
ccd23f8 adds a syslog.conffile for /etc/syslog.conf (busybox)
f790600 adds a libattr.conffile for /etc/xattr.conf
fcc028e fwenv: adds fwsys
1255470 xtables: various iptables alternatives
a7c4035 Revert "sqm: runs xtables, so also allow nftables"
0d331c3 sqm: runs xtables, so also allow nftables
f34076b acme: will run nftables in the near future
6217046 allow ssl.read types to read /tmp/etc/ssl/engines.cnf
d0deea3 fixes dns packets
8399efc Revert "sandbox: see if dontauditing this affects things"
73d716a sandbox: see if dontauditing this affects things
b5ee097 sandbox: also allow readinherited dropbear pipes
12ee46b iwinfo traverses /tmp/run/wpa_supplicant
4a4d724 agent.cil: also reads inherited dropbear pipes
d48013f support/secmark: i tightened my dns packet policy
645ad9e dns packets redone
4790b25 dnsnetpacket: fix obj macro template
d9fafff redo dns packets
0a68498 ttyd: leaks a netlink route socket
1d2e6be .gitattributes: remove todo
e1bb954 usbutil: reads bus sysfile symlinks
d275a32 support/secmark: clean it up a little
af5ce12 Makefile: exclude packet types in default make target
3caacdf support/secmark: document tunable/boolean
e3dd3e6 invalidpacketselinuxbool: make it build-time again
54f0ccf odhcpd packet fix
4a864ba contrib/secmark: add a big FAT warning
bead937 contrib/secmark: adds note about secmark support
146ae16 netpacket remove test
2ce9899 dns packets, odhcp6c raw packet, 4123 ntpnts for netnod
070a45f chrony and unbound packets
eba894f rawip socket packets cannot be labeled
656ae0b adds isakmp (500), ipsec-nat-t (4500) and rawip packet types
35325db adds igmp packet type
5cf444c adds icmp packet type
2e41304 sandbox some more packet access for sandbox net
12caad6 packet accesses
b8eb9a8 adds a trunkload of packet types
a42a336 move rules related to invalid netpeers and ipsec associations
a9e40e0 xtables/nftables allow relabelto all packet types
aa5a52c README: adds item to wish list
3a96eec experiment: simple label based packet filtering
26d6f95 nftables reads/writes fw pipes

Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
(cherry picked from commit e01b1c22df)
2022-05-31 01:37:28 +08:00
config config/Config-kernel.in: disable namespaces for small flash devices by default 2022-05-17 16:36:15 +08:00
include kernel: bump to 4.9.316, 4.14.281, 4.19.245 2022-05-27 23:40:09 +08:00
LICENSES LICENSE: sync with upstream 2021-02-16 14:19:09 +08:00
package selinux-policy: update to version 1.2.3 2022-05-31 01:37:28 +08:00
scripts scripts/download.pl: drop broken mirror 2022-05-06 22:11:33 +08:00
target kernel: refresh sfp patch 2022-05-29 19:28:09 +08:00
toolchain Revert "toolchain/musl: update to 1.2.2" 2022-03-16 17:36:36 +08:00
tools tools: drop ucl and upx 2022-05-30 00:25:30 +08:00
.gitattributes fix permisson 2019-08-16 15:09:42 +08:00
.gitignore toolchain: add a version that can be bumped to force toolchain/target rebuild 2021-11-19 23:58:57 +08:00
BSDmakefile build: use SPDX license tags 2021-02-06 12:07:10 +08:00
Config.in build: scripts/config - update to kconfig-v5.14 2022-02-24 11:35:03 +08:00
CONTRIBUTED.md CONTRIBUTED: add JetBrains logo 2021-12-23 11:35:12 +08:00
COPYING LICENSE: sync with upstream 2021-02-16 14:19:09 +08:00
feeds.conf.default feeds/routing: switch to ImmortalWrt's openwrt-18.06 branch 2021-10-22 22:26:07 +08:00
Makefile toolchain: add a version that can be bumped to force toolchain/target rebuild 2021-11-19 23:58:57 +08:00
README.md tools: drop ucl and upx 2022-05-30 00:25:30 +08:00
rules.mk rules: add legacy mark 2021-11-26 00:14:49 +08:00

logo

Project ImmortalWrt

ImmortalWrt is a fork of OpenWrt, with more packages ported, more devices supported, better performance, and special optimizations for mainland China users.
Compared the official one, we allow to use hacks or non-upstreamable patches / modifications to achieve our purpose. Source from anywhere.

Default login address: http://192.168.1.1 or http://immortalwrt.lan, username: root, password: password.

Development

To build your own firmware you need a GNU/Linux, BSD or MacOSX system (case sensitive filesystem required). Cygwin is unsupported because of the lack of a case sensitive file system.

Requirements

To build with this project, Ubuntu 18.04 LTS is preferred. And you need use the CPU based on AMD64 architecture, with at least 4GB RAM and 25 GB available disk space. Make sure the Internet is accessible.

The following tools are needed to compile ImmortalWrt, the package names vary between distributions.

  • Here is an example for Ubuntu users:

    • Method 1:

      Setup dependencies via APT
      sudo apt update -y
      sudo apt full-upgrade -y
      sudo apt install -y ack antlr3 asciidoc autoconf automake autopoint binutils bison build-essential \
        bzip2 ccache cmake cpio curl device-tree-compiler ecj fastjar flex gawk gettext gcc-multilib g++-multilib \
        git gperf haveged help2man intltool lib32gcc1 libc6-dev-i386 libelf-dev libglib2.0-dev libgmp3-dev libltdl-dev \
        libmpc-dev libmpfr-dev libncurses5-dev libncursesw5 libncursesw5-dev libreadline-dev libssl-dev libtool lrzsz \
        mkisofs msmtp nano ninja-build p7zip p7zip-full patch pkgconf python2.7 python3 python3-pip python3-ply \
        python-docutils qemu-utils re2c rsync scons squashfs-tools subversion swig texinfo uglifyjs upx-ucl unzip \
        vim wget xmlto xxd zlib1g-dev
      
    • Method 2:

      curl -s https://build-scripts.immortalwrt.eu.org/init_build_environment.sh | sudo bash
      
  • You can also download and use prebuilt container directly:
    See #Quickstart - Build image via OPDE

Note:

  • For the for love of god please do not use ROOT user to build your image.
  • Using CPUs based on other architectures should be fine to compile ImmortalWrt, but more hacks are needed - No warranty at all.
  • You must not have spaces in PATH or in the work folders on the drive.
  • If you're using Windows Subsystem for Linux (or WSL), removing Windows folders from PATH is required, please see Build system setup WSL documentation.
  • Using macOS as the host build OS is not recommended. No warranty at all. You can get tips from Build system setup macOS documentation.
  • For more details, please see Build system setup documentation.

Quickstart

  • Method 1:

    1. Run git clone -b <branch> --single-branch https://github.com/immortalwrt/immortalwrt to clone the source code.
    2. Run cd immortalwrt to enter source directory.
    3. Run ./scripts/feeds update -a to obtain all the latest package definitions defined in feeds.conf / feeds.conf.default
    4. Run ./scripts/feeds install -a to install symlinks for all obtained packages into package/feeds/
    5. Run make menuconfig to select your preferred configuration for the toolchain, target system & firmware packages.
    6. Run make to build your firmware. This will download all sources, build the cross-compile toolchain and then cross-compile the GNU/Linux kernel & all chosen applications for your target system.
  • Method 2:

    Build image via OPDE
    • Pull the prebuilt container:

      docker pull immortalwrt/opde:base
      # docker run --rm -it immortalwrt/opde:base
      
    • For Linux User:

      git clone -b <branch> --single-branch https://github.com/immortalwrt/immortalwrt && cd immortalwrt
      docker run --rm -it \
          -v $PWD:/openwrt \
        immortalwrt/opde:base zsh
      ./scripts/feeds update -a && ./scripts/feeds install -a
      
    • For Windows User:

      1. Create a volume 'immortalwrt' and clone ImmortalWrt source into volume.
      docker run --rm -it -v immortalwrt:/openwrt immortalwrt/opde:base git clone -b <branch> --single-branch https://github.com/immortalwrt/immortalwrt .
      
      1. Enter docker container and update feeds.
      docker run --rm -it -v immortalwrt:/openwrt immortalwrt/opde:base
      ./scripts/feeds update -a && ./scripts/feeds install -a
      
      • Tips: ImmortalWrt source code can not be cloned into NTFS filesystem (symbol link problem during compilation), but docker volume is fine.
    • Proxy Support:

      docker run --rm -it \
        -e   all_proxy=http://example.com:1081 \
        -e  http_proxy=http://example.com:1081 \
        -e https_proxy=http://example.com:1081 \
        -e   ALL_PROXY=http://example.com:1081 \
        -e  HTTP_PROXY=http://example.com:1081 \
        -e HTTPS_PROXY=http://example.com:1081 \
        -v $PWD:/openwrt \
        immortalwrt/opde:base zsh
      

      Recommand http rather socks5 protocol

      IP can not be localhost or 127.0.0.1

    • For Windows User, binary is still in volume. It can be copied to outside via followed command:

      docker run --rm -v <D:\path\to\dir>:/dst -v openwrt:/openwrt -w /dst immortalwrt:base cp /openwrt/bin /dst
      

      Make sure D:\path\to\dir has been appended in File Sharing.

The main repository uses multiple sub-repositories to manage packages of different categories. All packages are installed via the ImmortalWrt package manager called opkg. If you're looking to develop the web interface or port packages to ImmortalWrt, please find the fitting repository below.

Support Information

For a list of supported devices see the OpenWrt Hardware Database

Documentation

Support Community

License

ImmortalWrt is licensed under GPL-3.0-only.