Skip to content

Reaper v3.1.0 — RT-BE96U

Choose a tag to compare

View all tags
@github-actions github-actions released this 08 Sep 16:36
· 1 commit to main since this release
v3.1.0-RT-BE96U
4970ae4

v3.1.0 — OpenSSL 3.5, second attempt: the library every TLS path stands on (built RT-BE96U)

  • The firmware moves from OpenSSL 1.1.1w (end of life since September 2023) to OpenSSL 3.5.8.
    Every source-built consumer — hostapd and wpa_supplicant, httpd, curl and wget, OpenVPN, strongSwan,
    inadyn, Tor, vsftpd, lighttpd, net-snmp, the Reaper Advisor daemon and 110 more — now links the
    real 3.5 library directly. The closed ASUS binaries that cannot be rebuilt (AiMesh's cfg_server and
    friends, the Let's Encrypt helper, the lighttpd modules) keep their OpenSSL 1.1 ABI through a small
    forwarding shim that hands every call to 3.5. The port is Asuswrt-Merlin upstream work by RSDNTWK
    (the shim and the 3.5 integration) and Eric "Merlin" Sauvageau (the parallel-compile fix),
    carried as cherry-picks with their authorship intact; the Reaper Advisor daemon links 3.5 alone.
  • Why the first attempt (v3.0.3) broke Wi-Fi and this one does not. hostapd had been compiled in
    the wireless SDK tree all along; its link rule never sees a library change, so the September 1 image
    shipped a hostapd still bound to the 1.1 name — which now resolved to the shim, which does not carry
    the elliptic-curve functions WPA3-SAE needs. This rung purges every object compiled against the old
    headers before the swap — including the ones git ignores, which the first purge could not see — and
    adds a release gate (check 22) that names the only binaries allowed to depend on the 1.1 name in a
    3.5 image and fails on any other. hostapd is required by that gate to link libcrypto.so.3
    outright, verified with readelf, not inferred from a green build.
  • Proven on the RT-BE96U before it was written up: 31 minutes on the test image with hostapd
    never restarting, five stations through WPA3-SAE on 6 GHz at 320 MHz, HTTPS UI and outbound TLS
    working, the router's certificate unchanged across the flash. A pre-flash kit now exists that
    loader-traces every consumer of the new image on the running router from /tmp before anything
    is flashed.
  • Licensing. OpenSSL 3.x is Apache-2.0; its text is added under LICENSES/, and the notices no
    longer misdescribe OpenSSL as BSD/MIT. The move resolves a conflict rather than creating one:
    1.1.1's OpenSSL/SSLeay advertising clause was never GPL-compatible.
  • First boot is one box. The security banner's Wi-Fi step used to open the stock Wireless page,
    which shows the primary radios' settings; on this build those become the hidden AiMesh backhaul and
    the network people join lives on the fronthaul VIFs the mesh daemon rebuilds afterwards. A factory box
    now gets one Reaper page: network name, Wi-Fi password, router login password. It writes what the
    stock apply writes on every band (one name, WPA2/WPA3 on 2.4 and 5 GHz, WPA3 on 6 GHz, Smart Connect
    on) and fires the same restart, so the mesh daemon's split is unchanged; the login change follows the
    same committed path as the password page. Keys under 8 characters are refused in the page and in the
    router, the rule that saved v2.9.1. The stock Wireless page is untouched for engineers, and a new
    release check locks the whole chain - page, gate, banner target, 25 language packs - so it cannot
    quietly regress. The security banner that points at it is down to one row and one button: while
    both the login and the Wi-Fi are factory it says so once and offers "Set up this router"; only the
    half that remains gets its own button after that.
  • Packaging. The 3.5 source (5,767 files) is too large to publish as a patch; it ships as the
    hash-pinned overlays/openssl-3.5-source.tar.gz, unpacked by the public build after the patch
    series, with only the integration diff and the shim in patches/. The reproduce recipe in the
    docs gains that one step.
  • Factory reset takes the short road, and the page says how to get back. Three waits came out of
    the reset chain, none of them doing work: the web server no longer waits up to two minutes for a
    USB application to stop when none is mounted; the reset request is handed to the service manager
    in the form that waits for it rather than the one that gives up after 15 seconds; and the reset
    routine takes the reboot lock first, the way a plain reboot does, so the shutdown can never spin
    half a minute on a lock left by a daemon that died mid-write. The router logs a timestamp at each
    step so the next report carries numbers. The Backup page changed too: the veil now says that the
    router comes back on its open factory network with its default address, and links to it, instead
    of polling in silence; it no longer mistakes the few seconds the web server is busy for the reboot
    and bounces to a login page that is about to vanish; and if the router has not gone down within
    three minutes it says so and hands the page back. A new release check pins all three files.
  • AiMesh backhaul parking stays in sync with wireless restarts. Any apply that restarts the
    radios, from the Network or Wireless page or from the mesh daemon itself, re-creates the parked
    carriers, and the parking service kept believing they were down. It now checks the live state on
    every pass, logs that the carrier came back, and parks it again within five seconds.
  • Phones get the full width. Below 680px the shell collapses its rail into a sticky icon strip
    under the header, the way the dashboard already did, and the page takes the whole screen; stock
    pages framed in the shell pan sideways until each is replaced by a native one. Two small labels
    with it: the Connections page no longer calls a weighted class "WRR" (every port has run strict
    priority since v2.5.4), and the Advisor's client-pin hint no longer clips inside its box.
  • The update check learns a beta channel. A Beta Channel switch on the Firmware page (off by
    default) lets the check also read the Dev branch's beta line in the update manifest. The rule is
    the owner's: a beta is offered only to a router that already runs the newest stable release, and
    only when the beta's number is higher than that stable's; when the stable release carries the same
    number, only the stable one is offered. A beta offer is labelled as one on the page and on the
    dashboard badge, its release note opens with the beta warning, and the previous firmware stays in
    the standby partition as always. On the publishing side a Dev-branch publish now writes a separate
    MODEL#VARIANT-beta# line into the manifest and leaves the stable line untouched; firmware older
    than v3.1.0 cannot match that line and keeps seeing stable releases only. A release check pins the
    chain (check script, note script, the nvram key, the page, 25 language packs).
  • The QoS page stops explaining Weighted classes. The hint under the class list, and the "Priority
    vs Weighted" explainer below it, described a scheduler mode that was removed in v2.5.4 and cannot be
    selected; the hint now says only that classes are served strictly top to bottom, in all 25 language
    packs, and the explainer is gone.

Images & checksums (RT-BE96U)

Two flashable images: + AI Advisor (default) and Standard (noMCP, all AI components compiled out entirely). Flash the *_nand_squashfs.pkgtb via Administration > Firmware Upgrade.

Variant File SHA-256
+ AI Advisor RT-BE96U_3006_102.8_Reaper_v3.1.0_nand_squashfs.pkgtb fc053cee798b64717e8cf1ddf414ad95b2f63ff401ca028cb445e2069438a337
Standard RT-BE96U_3006_102.8_Reaper_v3.1.0_noMCP_nand_squashfs.pkgtb ce63a14479625c9eaebebf734c3f5db9cc2844de1f023012e7cb7d12e37687d2

Verify a download against the attached SHA256SUMS-RT-BE96U-Reaper_v3.1.0.txt.

Corresponding source & reproducibility

The RT-BE96U image for v3.1.0 is built from this repository at tag v3.1.0-RT-BE96U: the pinned Asuswrt-Merlin base (3006.102.8-beta2, a7ebfa133a) plus the complete patch series. The tag freezes the exact source that produced it.

The auto-attached Source code (zip/tar.gz) asset below is this repository at tag v3.1.0-RT-BE96U (patches + docs).

Assets 5
Loading