From 74d50719acb91ff2318d89e01789bb4dd80ed5c4 Mon Sep 17 00:00:00 2001 From: ssmithx Date: Sun, 26 Jul 2026 23:24:01 +0000 Subject: [PATCH] updated flashing script --- scripts/flash-mt3000-openwrt.sh | 169 +++++++++++++++++++++++++------- 1 file changed, 132 insertions(+), 37 deletions(-) diff --git a/scripts/flash-mt3000-openwrt.sh b/scripts/flash-mt3000-openwrt.sh index 4bd2c76c..1d2835fb 100755 --- a/scripts/flash-mt3000-openwrt.sh +++ b/scripts/flash-mt3000-openwrt.sh @@ -1,16 +1,18 @@ #!/usr/bin/env bash -# Flash stock OpenWrt on a GL.iNet GL-MT3000 (Beryl AX) via SSH from archy +# Flash stock OpenWrt on a GL.iNet GL-MT3000 (Beryl AX) # -# Usage: ./flash-mt3000-openwrt.sh [router-ip] +# Usage: +# ./flash-mt3000-openwrt.sh [router-ip] [--image /path/to/image.bin] # -# Defaults to 192.168.8.1. Runs entirely from archy (archipelago). -# Requires: curl, sshpass, ssh, sha256sum, scp +# Defaults to 192.168.8.1. +# Requires: curl, sshpass, ssh, sha256sum +# Optional: scp (falls back to pipe if unavailable on router) # # What it does: # 1. Verifies tools and connectivity -# 2. Downloads the stock OpenWrt sysupgrade image +# 2. Downloads the stock OpenWrt sysupgrade image (or uses a pre-downloaded one) # 3. Verifies SHA256 checksum -# 4. Uploads image to the router via SCP +# 4. Uploads image to the router (SCP or pipe) # 5. Flashes via sysupgrade (no settings preserved) # 6. Waits for reboot and verifies new firmware # @@ -18,16 +20,6 @@ set -euo pipefail -PASSWORD="${1:?Usage: $0 [router-ip]}" -ROUTER="${2:-192.168.8.1}" -SSH_USER="root" -OPENWRT_VERSION="24.10.2" -IMAGE_NAME="openwrt-24.10.2-mediatek-filogic-glinet_gl-mt3000-squashfs-sysupgrade.bin" -IMAGE_URL="https://downloads.openwrt.org/releases/${OPENWRT_VERSION}/targets/mediatek/filogic/${IMAGE_NAME}" -DOWNLOAD_DIR="/tmp/openwrt-flash" -LOCAL_IMAGE="${DOWNLOAD_DIR}/${IMAGE_NAME}" -NEW_IP="192.168.1.1" - RED='\033[0;31m' GREEN='\033[0;32m' YELLOW='\033[1;33m' @@ -37,13 +29,56 @@ log() { echo -e "${GREEN}[+]${NC} $*"; } warn() { echo -e "${YELLOW}[!]${NC} $*"; } err() { echo -e "${RED}[-]${NC} $*" >&2; } +# --- Parse args --- +PASSWORD="" +ROUTER="192.168.8.1" +LOCAL_IMAGE="" + +while [[ $# -gt 0 ]]; do + case "$1" in + --image) + LOCAL_IMAGE="$2" + shift 2 + ;; + --router) + ROUTER="$2" + shift 2 + ;; + *) + if [ -z "$PASSWORD" ]; then + PASSWORD="$1" + else + ROUTER="$1" + fi + shift + ;; + esac +done + +if [ -z "$PASSWORD" ]; then + echo "Usage: $0 [router-ip] [--image /path/to/sysupgrade.bin]" + echo "" + echo "Options:" + echo " --image PATH Use a pre-downloaded sysupgrade image instead of downloading" + echo " --router IP Router IP (default: 192.168.8.1)" + exit 1 +fi + +SSH_USER="root" +OPENWRT_VERSION="24.10.2" +IMAGE_NAME="openwrt-${OPENWRT_VERSION}-mediatek-filogic-glinet_gl-mt3000-squashfs-sysupgrade.bin" +IMAGE_URL="https://downloads.openwrt.org/releases/${OPENWRT_VERSION}/targets/mediatek/filogic/${IMAGE_NAME}" +CHECKSUM_URL="https://downloads.openwrt.org/releases/${OPENWRT_VERSION}/targets/mediatek/filogic/sha256sums" +DOWNLOAD_DIR="/tmp/openwrt-flash" +DEFAULT_IMAGE="${DOWNLOAD_DIR}/${IMAGE_NAME}" +NEW_IP="192.168.1.1" + SSH_CMD="sshpass -p ${PASSWORD} ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 ${SSH_USER}@${ROUTER}" -SCP_CMD="sshpass -p ${PASSWORD} scp -o StrictHostKeyChecking=no -o ConnectTimeout=10" # --- Step 1: Check tools --- log "Checking required tools..." MISSING=() -for cmd in curl sshpass ssh sha256sum scp; do +for cmd in curl sshpass ssh sha256sum; do command -v "$cmd" >/dev/null 2>&1 || MISSING+=("$cmd") done if [ ${#MISSING[@]} -gt 0 ]; then @@ -68,22 +103,73 @@ if [[ "$BOARD" != *"mt3000"* ]]; then fi log "Confirmed GL-MT3000 (board: ${BOARD})." -# --- Step 3: Download image --- -log "Downloading OpenWrt ${OPENWRT_VERSION} sysupgrade image..." -mkdir -p "$DOWNLOAD_DIR" -if [ -f "$LOCAL_IMAGE" ]; then - warn "Image already exists locally, skipping download." -else - if ! curl -fSL --progress-bar -o "$LOCAL_IMAGE" "$IMAGE_URL"; then - err "Download failed from ${IMAGE_URL}" +# --- Step 3: Get image --- +if [ -n "$LOCAL_IMAGE" ]; then + # User provided a local image + if [ ! -f "$LOCAL_IMAGE" ]; then + err "Image file not found: ${LOCAL_IMAGE}" exit 1 fi + log "Using provided image: ${LOCAL_IMAGE}" +else + # Download the image + log "Downloading OpenWrt ${OPENWRT_VERSION} sysupgrade image..." + mkdir -p "$DOWNLOAD_DIR" + + if [ -f "$DEFAULT_IMAGE" ]; then + warn "Image already exists locally, skipping download." + else + # Test if HTTPS is being intercepted (common with GL.iNet routers) + CERT_ISSUE=false + CERT_INFO=$(curl -v --connect-timeout 5 "https://downloads.openwrt.org" 2>&1 || true) + if echo "$CERT_INFO" | grep -qi "GLiNet\|gl-inet\|self-signed"; then + CERT_ISSUE=true + warn "HTTPS interception detected — the router is MITM-ing TLS connections." + warn "This is the same issue that breaks Tailscale." + fi + + if [ "$CERT_ISSUE" = true ]; then + warn "Attempting download via HTTP..." + HTTP_URL="${IMAGE_URL/https:/http:}" + if ! curl -fSL --progress-bar --connect-timeout 10 -o "$DEFAULT_IMAGE" "$HTTP_URL" 2>/dev/null; then + err "" + err "Download failed. The router is intercepting HTTPS and HTTP is also blocked." + err "" + err "Workaround: download the image on a machine NOT behind this router," + err "then run this script with --image /path/to/${IMAGE_NAME}" + err "" + err "Direct download URL:" + err " ${IMAGE_URL}" + err "" + exit 1 + fi + else + if ! curl -fSL --progress-bar -o "$DEFAULT_IMAGE" "$IMAGE_URL"; then + err "Download failed from ${IMAGE_URL}" + exit 1 + fi + fi + fi + LOCAL_IMAGE="$DEFAULT_IMAGE" fi -log "Downloaded: $(ls -lh "$LOCAL_IMAGE" | awk '{print $5}')" + +log "Image ready: $(ls -lh "$LOCAL_IMAGE" | awk '{print $5}')" # --- Step 4: Verify checksum --- log "Verifying SHA256 checksum..." - EXPECTED_HASH=$(curl -fsSL "https://downloads.openwrt.org/releases/${OPENWRT_VERSION}/targets/mediatek/filogic/sha256sums" 2>/dev/null | grep "${IMAGE_NAME}" | awk '{print $1}' || true) +EXPECTED_HASH="" +CHECKSUM_ATTEMPTS=( + "https://downloads.openwrt.org/releases/${OPENWRT_VERSION}/targets/mediatek/filogic/sha256sums" + "http://downloads.openwrt.org/releases/${OPENWRT_VERSION}/targets/mediatek/filogic/sha256sums" +) + +for url in "${CHECKSUM_ATTEMPTS[@]}"; do + EXPECTED_HASH=$(curl -fsSL --connect-timeout 5 "$url" 2>/dev/null | grep "${IMAGE_NAME}" | awk '{print $1}' || true) + if [ -n "$EXPECTED_HASH" ]; then + break + fi +done + if [ -n "$EXPECTED_HASH" ]; then ACTUAL_HASH=$(sha256sum "$LOCAL_IMAGE" | awk '{print $1}') if [ "$EXPECTED_HASH" != "$ACTUAL_HASH" ]; then @@ -94,7 +180,7 @@ if [ -n "$EXPECTED_HASH" ]; then fi log "Checksum OK: ${ACTUAL_HASH:0:16}..." else - warn "Could not fetch expected checksum, skipping verification." + warn "Could not fetch expected checksum (network issue?), skipping verification." fi # --- Step 5: Pre-flash checks --- @@ -110,13 +196,21 @@ fi log "Free space on /tmp: $((FREE_KB/1024))MB, image: $((IMAGE_SIZE_KB/1024))MB — OK." # Verify current firmware -CURRENT_FW=$($SSH_CMD "cat /etc/openwrt_release | grep DISTRIB_DESCRIPTION" || true) +CURRENT_FW=$($SSH_CMD "cat /etc/openwrt_release 2>/dev/null | grep DISTRIB_DESCRIPTION" || true) log "Current firmware: ${CURRENT_FW}" # --- Step 6: Upload image --- log "Uploading image to router..." -$SCP_CMD "$LOCAL_IMAGE" ${SSH_USER}@${ROUTER}:/tmp/openwrt-sysupgrade.bin -log "Upload complete." + +# Try SCP first, fall back to pipe (GL.iNet firmware lacks sftp-server) +if command -v scp >/dev/null 2>&1 && \ + sshpass -p "$PASSWORD" scp -o StrictHostKeyChecking=no -o ConnectTimeout=5 -o BatchMode=yes "$LOCAL_IMAGE" "${SSH_USER}@${ROUTER}:/tmp/openwrt-sysupgrade.bin" 2>/dev/null; then + log "Upload complete (via SCP)." +else + log "SCP unavailable on router, using pipe transfer..." + cat "$LOCAL_IMAGE" | $SSH_CMD "cat > /tmp/openwrt-sysupgrade.bin" + log "Upload complete (via pipe)." +fi # Verify uploaded file REMOTE_HASH=$($SSH_CMD "sha256sum /tmp/openwrt-sysupgrade.bin | awk '{print \$1}'") @@ -129,6 +223,7 @@ fi log "Remote file verified." # --- Step 7: Flash --- +echo "" log "============================================" log "FLASHING STOCK OPENWRT ${OPENWRT_VERSION}" log "The router will reboot. This takes ~3-5 min." @@ -147,18 +242,18 @@ sleep 15 # --- Step 8: Wait for new router --- log "Waiting for stock OpenWrt at ${NEW_IP}..." -for i in $(seq 1 60); do +for i in $(seq 1 90); do if ping -c1 -W2 "$NEW_IP" >/dev/null 2>&1; then log "Router is up at ${NEW_IP}!" break fi - if [ $i -eq 60 ]; then - warn "Router not responding at ${NEW_IP} after 2 minutes." + if [ $i -eq 90 ]; then + warn "Router not responding at ${NEW_IP} after 3 minutes." warn "It may still be booting. Try: ssh root@${NEW_IP}" warn "If unreachable, hold reset for U-Boot recovery at 192.168.1.1" exit 1 fi - printf "\r Waiting... (%d/60)" $i + printf "\r Waiting... (%d/90)" $i sleep 2 done echo "" @@ -166,7 +261,7 @@ echo "" # --- Step 9: Verify new firmware --- log "Verifying new firmware..." for attempt in 1 2 3; do - if ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no root@${NEW_IP} "cat /etc/openwrt_release" 2>/dev/null; then + if ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new root@${NEW_IP} "cat /etc/openwrt_release" 2>/dev/null; then echo "" log "============================================" log "FLASH COMPLETE"