Updating OpenWRT due to security issues

Question

OpenWRT, like any other operating system, suffers from security issues. OpenSSL, for example, appears to have new bugs every month.

I use my router as the termination point for openvpn (one of the few external points that terminate on the router, rather than forward to another machine). This has package dependencies (eg on openssl).

Are there patches available? I can run

opkg update
opkg list-upgradable

and get zero results. I'm assuming this is because the default repo's are static and don't get updated.

So, finally, the question:

Are updates available for OpenWRT, without needing to reflash the whole machine to the latest/greatest (beta?) version?

Answer 1

Updating OpenWrt requires reflashing each time there is an update to apply, except in the case where you have deliberately placed the root filesystem on external storage (e.g. USB drive).

However, even in this configuration, the maintainers recommend you not do it:

Recommended by extroot maintainer

I recommend that you DO NOT try to do upgrades using opkgupgrade. You will likely end up with an inconsistent state and bricked router that way:

• The main reason is that the uClibc ABI (Application Binary Interface) is unstable and changes from revision to revision, so binaries for one version of uClibc may be incompatible with versions from another.
• Another problem that can arise is if you try to upgrade the kernel packages, then flash and reboot, but your operation is interrupted in any way, then you will have a kernel and module mismatch and likely a brick.
• Finally, if you upgrade all packages but the kernel and the kernel modules, some packages like iptables will be broken.