Introducing the LEDE project – A reboot of the OpenWrt community

Home routers come with one of three instruction set families (MIPS, ARM, PowerPC) with CPUs or SoCs from at least six major manufacturers (Broadcom, Qualcomm-Atheros, Ralink/MediaTek, Marvell, Freescale/NXP, Realtek) and WiFi interfaces from any of them except Freescale but plus Quantenna. And there are multiple generations of hardware in the market at any one time. That adds up to a hardware ecosystem that is vastly more diverse than PCs; this is in no way a narrow scope of problem. And I'm ignoring all the devices that also have a cable, DSL, or cellular modem.

The boundaries of what tasks are handled by the CPU vs by dedicated offloads on the SoC vs by the NIC (which usually has software of its own) differs with every manufacturer and every hardware generation. The job we want our routers to do is a moving target as the industry continues to develop new routing and configuration protocols (eg. Homenet) and new QoS techniques and new WiFi rate control techniques that need to be incorporated into the software running on the CPU and/or NIC. The hardware is usually weak enough that the products can only get the job done by prioritizing performance over expensive security measures.

I could get behind the idea of a line-rate dedicated firewall+NAT with formally specified behavior. But any attempt to enumerate the core functionality of a modern wireless router will leave you with a job that is far larger than any successful formally specified/verified software project.

Running atop Linux is the only option that doesn't leave you stranded with a '90s-era feature set and a cripplingly small base of supported hardware, and the userspace stuff is the low-hanging fruit for securing anyway.

OpenWRT is awesome, really would like to see one project (not split into two)

May chat with nbd [1]?

Also checkout history [2].

[1] https://www.lede-project.org/about.html [2] http://meetings.lede-project.org/lede-adm/2016/

My comment is getting lots of downvotes. I'd argue:

- All the routers (buffalo, linksys) I've installed OpenWRT on have ended up being fairly unstable and have required reboots. The only consumer grade wifi router I've tried that seems stable is the Apple Airport Extreme.

- Most home users never come close to maxing out the throughput a pi can offer.

- If not a pi, perhaps another open hardware device -- seems like one could be sold for under $50 with nic support that addresses all the max USB bandwidth concerns (it may already exist).

- All the complexity of installing on random wifi router hardware (version maintenance, minimal storage space, etc.) seems prohibitive compared to the simplicity of a pi, risk of bricking the router, etc.

As far as I remember, L4 is such a minimal beast that you typically run something like a Linux-Kernel inside it, to do most of the boring stuff. And then use the guarantees on isolation provided by L4 to have timing or security critical functions into their own L4 tasks. Am I wrong there?

But even if L4 would provide the minimal set of functions expected to pass packets on an embedded device like a router: Would you really gain security if you had to rewrite most of the libraries involved for, say, user-interface and configuration (where all of the exploits reside) from scratch? The whole wpa/wpa2-hostapd madness, or VPN setup with all the many dozens of possible protocol combinations?

And even when one plans to rewrite hostapd, openvpn, dnsmasqd with all their dependencies from scratch, in a safer language than C, with reduced priviledges and isolated from the rest of the system: One still could run these replacements easily under a Linux kernel providing most of the necessary infrastructure and with hardly and bugs being discovered in the kernel core that would be relevant for such an embedded device.

BTW that seems to be a nifty irc bot:

http://wiki.debian.org/MeetBot