Losing Freetz due to an automatic update

[fraternl]

I have a provision script which makes sure some options are set.
One of the most important ones is disabling autoupdate.

Sometimes I "lose" a Freetzed box because the standard AVM-software is flashed on it due to an automatic update.
To prevent this I change these values in /var/flash/ar7.cfg

if grep -q 'allow_background_comm_with_manufacturer.*yes' /var/flash/ar7.cfg || grep -q 'crashreport_mode.*support' /var/flash/ar7.cfg || grep -q 'all
ow_cross_domain_comm.*yes' /var/flash/ar7.cfg ; then
  if cat /var/flash/ar7.cfg >/tmp/ar7.cfg ; then
    # ipv6mode = ipv6_off;
    # sed -i 's/ipv6mode.*/ipv6mode = ipv6_off;/g' /tmp/ar7.cfg

    # auto_update_all_enabled = no;
    sed -i 's/auto_update_all_enabled.*/auto_update_all_enabled = no;/g' /tmp/ar7.cfg

    # auto_update_enable = no;
    sed -i 's/auto_update_enable.*/auto_update_enable = no;/g' /tmp/ar7.cfg

    # allow_background_comm_with_manufacturer = no;
    sed -i 's/allow_background_comm_with_manufacturer.*/allow_background_comm_with_manufacturer = no;/g' /tmp/ar7.cfg

    # allow_cross_domain_comm = no;
    sed -i 's/allow_cross_domain_comm.*/allow_cross_domain_comm = no;/g' /tmp/ar7.cfg

    # crashreport_mode = to_support_only;
    sed -i 's/crashreport_mode.*/crashreport_mode = disabled_by_user;/g' /tmp/ar7.cfg

    # allow_security_report_with_manufacturer = no;
    sed -i 's/allow_security_report_with_manufacturer.*/allow_security_report_with_manufacturer = no;/g' /tmp/ar7.cfg

    cat /tmp/ar7.cfg >/var/flash/ar7.cfg
    ctlmgr -s
    ctlmgr
    modsave flash
  fi 
fi

Is this still necessary or will Freetz-NG not flash a standard AVM-Firmware?
The original Freetz did.

[aus-sua]

Sometimes I "lose" a Freetzed box because the standard AVM-software is flashed on it due to an automatic update.

I use the very pragmatic approach in menuconfig for the problem:

[x] Select hardening

or directly only

[x] Remove public firmware key

So the problem is no longer a problem.
Even if in the AVM-Web-If the option:
automatic update is set,
the AVM software will abort the flash-update
(because the original AVM key is no longer available).

However, an update is still possible at any time via the freetz-NG-Web-If.

But,
you have to take care of the security of the AVM system yourself!

---

Ich nutze für das Problem den ganz pragmatischen Ansatz in der menuconfig:

[x] Select hardening
oder direkt nur
[x] Remove public firmware key

Damit ist das Problem kein Problem mehr.
Selbst wenn im AVM-Web-If die Option:
automtisches Update
gesetzt ist, bricht die AVM-Software das flaschen des neuen
Update ab, weil ja der Original-AVM-Key nicht mehr
vorhanden ist.

Ein Update ist über das freetz-NG-Web-If jederzeit weiter möglich.
Aber,
um die Sicherheit des AVM-Systems muß man sich dadurch eben selbst kümmern!

[fraternl]

Thanks for your info.

[fda77]

I'm using both, removed the avm-cert and disabed everything. You have also a juis-check on freetz-webif if ti was enabled in menuconfig.

But using "sed" for ar7.cfg is outdated! Use "ctlmgr_ctl" and no ctlmgr restart is needed:

# Bei Aufruf von www.avm.de darf AVM gerätespezifische Daten Ihrer FRITZ!Box auslesen
echo -n "allow_cross_domain_comm = "
ctlmgr_ctl r box settings/allow_cross_domain_comm
ctlmgr_ctl w box settings/allow_cross_domain_comm 0

# Fehlerberichte automatisch an AVM senden
echo -n "crashreport_mode = "
ctlmgr_ctl r emailnotify settings/crashreport_mode
ctlmgr_ctl w emailnotify settings/crashreport_mode disabled_by_user

I've planed to add a simple webif site for view+edit such values https://github.com/Freetz-NG/freetz-ng/blob/master/make/pkgs/mod/files/root/usr/mww/cgi-bin/uimods.cgi But had no time yet (you could still be the 1st)

[fraternl]

Thanks...
Will consider ctlmgr_ctl w

It is indeed more elegant

[fraternl]

I wanted to rewrite the startup script and refrain from manipulating /var/flash/ar7.cfg and having to restart ctlmgr

The way the settings in the AVM-UI influence /var/flash/ar7.cfg can be checked.
I examined them to find out what variables I needed to change.

You gave me the 2 examples (crashreport_mode & allow_cross_domain_comm) and they work.
I then checked

root@fritz:/var/mod/root# ctlmgr_ctl r box settings/auto_update_enable
root@fritz:/var/mod/root# ctlmgr_ctl r box settings/auto_update_all_enabled
root@fritz:/var/mod/root#

...and they return nothing.
Is there a page where all these commands are documented?
This one doesn't work anymore (domain in quarantine) http://www.wehavemorefun.de/fritzbox/User-Interface-Module
Still, these specific ones may be missing there as well.

My method may not be elegant and I knew this, but at least I didn't need to guess which ones I need.

These do work:

root@fritz:/var/mod/root# ctlmgr_ctl r box settings/allow_security_report_with_manufacturer
0
root@fritz:/var/mod/root# ctlmgr_ctl r box settings/allow_background_comm_with_manufacturer
0
root@fritz:/var/mod/root# ctlmgr_ctl r box settings/allow_cross_domain_comm
0
root@fritz:/var/mod/root# ctlmgr_ctl r emailnotify settings/crashreport_mode
disabled_by_user
root@fritz:/var/mod/root#

Because I need to revert to manipulating /var/flash/ar7.cfg anyhow, there's no use making a change now.

[fraternl]

I found out the commands for ctlmgr are in /lib/libar7cfg.so.1.0.0
I tested several commands to replace emailnotify but to no avail.

I think unattended_update is the one that should work. It doesn't.
In /var/flash/ar7.cfg the variable auto_update_all_enabled is placed in the section unattended_update

root@fritz:/var/mod/root# ctlmgr_ctl r unattended_update settings/auto_update_all_enabled
root@fritz:/var/mod/root# ctlmgr_ctl r fwupdatehintmail settings/auto_update_all_enabled
root@fritz:/var/mod/root# ctlmgr_ctl r securitymail settings/auto_update_all_enabled
root@fritz:/var/mod/root# ctlmgr_ctl r backendsupport settings/auto_update_all_enabled
root@fritz:/var/mod/root# 

unattended_update {
        update_found = no;
        no_update_found_time = "1970-01-01 00:00:00";
        update_found_time = "1970-01-01 00:00:00";
        priority = 1;
        check_intervall = 168;
        enabled = yes;
        auto_update_enable = no;
        auto_update_all_enabled = no;
        cfg_version = 2;
        auto_update_last_check_time = "1970-01-01 00:00:00";
        fwupdatehintmail_time = "1970-01-01 00:00:00";
        predownload_url = "";
        maintenance_window_enabled = no;
        maintenance_window_start = 1d;
}

strings /lib/libar7cfg.so.1.0.0 | grep -C20 emailnoti
AR7CFG_dnsserver_alloc
AR7CFG_dnsserver_free
AR7CFG_ddnstype_alloc
AR7CFG_ddnstype_free
AR7CFG_ddnsprovider_alloc
AR7CFG_ddnsprovider_free
AR7CFG_ddnsaccount_alloc
AR7CFG_ddnsaccount_free
AR7CFG_ddns_alloc
AR7CFG_ddns_free
AR7CFG_webui_alloc
AR7CFG_webui_free
AR7CFG_capiovertcp_alloc
AR7CFG_capiovertcp_free
AR7CFG_emailservice_alloc
AR7CFG_emailservice_free
AR7CFG_securitymail_alloc
AR7CFG_securitymail_free
AR7CFG_fwupdatehintmail_alloc
AR7CFG_fwupdatehintmail_free
AR7CFG_emailnotify_alloc
AR7CFG_emailnotify_free
AR7CFG_backendsupport_alloc
AR7CFG_backendsupport_free
AR7CFG_night_time_control_alloc
AR7CFG_night_time_control_free
AR7CFG_ntpclient_alloc
AR7CFG_ntpclient_free
AR7CFG_led_alloc
AR7CFG_led_free
AR7CFG_timezone_manual_alloc
AR7CFG_timezone_manual_free
AR7CFG_mrouter_alloc
AR7CFG_mrouter_free
AR7CFG_rip_alloc
AR7CFG_rip_free
AR7CFG_cpu_schedule_alloc
AR7CFG_cpu_schedule_free
AR7CFG_TR_064_alloc
AR7CFG_TR_064_free
AR7CFG_landevice_alloc
AR7CFG_landevice_free
--
AR7CFG_qos_forward_cfg_struct
AR7CFG_qos_bridge_cfg_struct
AR7CFG_trunk_port_cfg_struct
AR7CFG_qos_queue_cfg_struct
AR7CFG_prios_struct
AR7CFG_prio_profile_struct
AR7CFG_prio_user_struct
AR7CFG_multiwan_struct
AR7CFG_ipv6_multiwan_struct
AR7CFG_landevices_struct
AR7CFG_landevice_struct
AR7CFG_TR_064_struct
AR7CFG_cpu_schedule_struct
AR7CFG_rip_struct
AR7CFG_mrouter_struct
AR7CFG_timezone_manual_struct
AR7CFG_led_struct
AR7CFG_ntpclient_struct
AR7CFG_night_time_control_struct
AR7CFG_backendsupport_struct
AR7CFG_emailnotify_struct
AR7CFG_fwupdatehintmail_struct
AR7CFG_securitymail_struct
AR7CFG_emailservice_struct
AR7CFG_capiovertcp_struct
AR7CFG_webui_struct
AR7CFG_ddns_struct
AR7CFG_ddnsaccount_struct
AR7CFG_ddnsprovider_struct
AR7CFG_ddnstype_struct
AR7CFG_dnsserver_struct
AR7CFG_dhcpclient_struct
AR7CFG_dhcpserver_struct
AR7CFG_dhcpoverwrite_struct
AR7CFG_dhcpclass_struct
AR7CFG_dhcpstatic_struct
AR7CFG_lispcfg_struct
AR7CFG_hybridcfg_struct
AR7CFG_lisp_autoprio_struct
AR7CFG_autoprio_param_struct
AR7CFG_lisp_eid_struct
--
ar7cfg_add_aontv_arch
boxuser_make_unique_username
slab_dmalloc
boxuser_make_userid
ar7cfg_get_boxusers
ar7cfg_is_ipclient
ar7cfg_find_sync_group_by_name
ar7cfg_infer_sync_group
fbconf_get_wan_access_default
MyFritzOAuthClient_IsMyClientID
urlader_getenv_r
tolowerhexdigit
ar7cfg_is_ata_lan
ar7cfg_is_ata_wlan
ar7cfg_is_multipdn_by_vlan
save_ar7_config
get_ptest_server
save_config
free_ar7_config
free_config
ar7cfg_emailnotify_wlangueststatusmail_configured
ar7cfg_emailnotify_infomail_configured
ar7cfg_emailnotify_infomail_configured_with_eventlist
ar7cfg_emailnotify_configexport_configured
ar7cfg_emailnotify_configexport_configured_without_password
ar7cfg_emailnotify_securitymail_configured
ar7cfg_emailnotify_fwupdatehint_configured
ar7cfg_emailnotify_sender_configured
ar7cfg_is_smtp_filter_active
ar7cfg_get_smtp_sever_and_port
stringlist_split
cstr_strtoi
ar7cfg_get_smtp_port
ar7cfg_emailnotify_crashreport_enabled
boxenv_buildtype
ar7cfg_is_ui_defaultuser
ar7cfg_is_1und1_pppoe_arch
fix_ar7_config
boxenv_hwrevision
boxenv_oem_is
boxenv_config_is
stringlist_append_string_caseunique
stringlist_remove_string
boxenv_ethcount
memcmp
ipmasqfwrule_parse
ntohl
csock_isaddr6_zero
urlader_getmac_as_serial
stringlist_copy
getenv
ipmasqfwruleex_parse
ntohs
ip6_portrange_parse
--
urlader_getmac
cstr_is_set
avmcsock_pgmname
creat
emailaddress_parse
ConvertEmailAddrFromUTF8ToIDNA_WithAlloc
str___clear_text
slab_dcalloc
stringlist_shin
strcpy
boxenv_serial
boxenv_productclass_vodafone
stringlist_prepend_string_unique
strncasestr
bugmsg
mkusername
load_ar7_config_with_failed_cb
load_config_with_failed_cb
load_ar7_config
load_config
ar7cfg_get_emailnotify_to
ar7cfg_get_emailnotify_from
ar7cfg_get_emailnotify_smtpserver
ar7cfg_get_emailnotify_accountname
ar7cfg_get_emailnotify_passwd
ar7cfg_get_emailnotify_enabled
free_port_range_list
ar7cfg_set_port_ranges
strtol
stringlist_append_sprintf
qsort
ar7cfg_ports_in_range
get_profile_not_surf_rules
config_copystruct
rewrite_ar7_config_after_load
strcasestr
strrpl
fbconf_get_bridge_ports
stringlist_append_unique
memblock_set
strcasecmp_safe
memcpy
localtime_r
mktime
crwmmap_writerlock
crwmmap_mapmem
--
lisp_eid
autoprio_param
lisp_autoprio
hybridcfg
lispcfg
dhcpstatic
dhcpclass
dhcpoverwrite
dhcpserver
dhcpclient
dnsserver
ddnstype
ddnsprovider
ddnsaccount
ddns
webui
capiovertcp
emailservice
securitymail
fwupdatehintmail
emailnotify
backendsupport
night_time_control
ntpclient
timezone_manual
mrouter
cpu_schedule
TR_064
landevice
landevices
ipv6_multiwan
multiwan
prio_user
prio_profile
prios
qos_queue_cfg
trunk_port_cfg
qos_bridge_cfg
qos_forward_cfg
qos_result_cfg
qos_flow_cfg

[fda77]

You just need to read:

$  ctlmgr_ctl
(u: dump), then list of ui-modules. If empty, will provide list of available ui-modules

$  ctlmgr_ctl u
...

$  for x in $(ctlmgr_ctl u); do echo ">>> $x:"; ctlmgr_ctl u $x; echo; done | tee savedout.txt

->

$  ctlmgr_ctl r updatecheck settings/auto_update_mode
$  ctlmgr_ctl r updatecheck settings/auto_update_all_enabled

[fraternl]

Thanks

[fraternl]

UPDATE="`ctlmgr_ctl r updatecheck settings/auto_update_all_enabled`"
UPDATE="${UPDATE}`ctlmgr_ctl r updatecheck settings/auto_update_enabled`"
UPDATE="${UPDATE}`ctlmgr_ctl r updatecheck settings/auto_update_check_enabled`"
UPDATE="${UPDATE}`ctlmgr_ctl r box settings/allow_cross_domain_comm`"

if echo ${UPDATE} | grep -q '1' ; then
  ctlmgr_ctl w updatecheck settings/auto_update_all_enabled 0
  ctlmgr_ctl w updatecheck settings/auto_update_enabled 0
  ctlmgr_ctl w updatecheck settings/auto_update_check_enabled 0

  ctlmgr_ctl w box settings/allow_cross_domain_comm 0
  ctlmgr_ctl w box settings/allow_security_report_with_manufacturer 0
  ctlmgr_ctl w box settings/allow_background_comm_with_manufacturer 0

  ctlmgr_ctl w emailnotify settings/crashreport_mode disabled_by_user
fi

[fraternl]

I didn't like the several readings of the variables, so I'm now doing this to speed it up

# careful with auto_update_all_enabled as it also exists for powerline
if sed -e '/powerline/,+9d' /var/flash/ar7.cfg | egrep ' (auto_update|allow_[csb][rea])' | grep -q 'yes;' ; then
  echo "disabling autoupdate"

  ctlmgr_ctl w updatecheck settings/auto_update_all_enabled 0
  ctlmgr_ctl w updatecheck settings/auto_update_enabled 0
  ctlmgr_ctl w updatecheck settings/auto_update_check_enabled 0

  ctlmgr_ctl w box settings/allow_cross_domain_comm 0
  ctlmgr_ctl w box settings/allow_security_report_with_manufacturer 0
  ctlmgr_ctl w box settings/allow_background_comm_with_manufacturer 0

  ctlmgr_ctl w emailnotify settings/crashreport_mode disabled_by_user
else
  echo "autoupdate already disabled"
fi

if grep -q 'Features = 65535' /var/flash/tr069.cfg ; then
  ctlmgr_ctl w tr069  settings/LabSupportEnable 0
  ctlmgr_ctl w tr069  settings/LabUploadReqEnable 0
fi

If any of these are set to "yes", the above script will set them to "no"

sed -e '/powerline/,+9d' /var/flash/ar7.cfg | egrep ' (auto_update|allow_[csb][rea])'
        allow_background_comm_with_manufacturer = no;
        allow_cross_domain_comm = no;
        allow_security_report_with_manufacturer = no;
        auto_update_enable = no;
        auto_update_all_enabled = no;
        auto_update_last_check_time = "1970-01-01 00:00:00";

[fda77]

The ctlmgr caches values and because of that reading the ar7 could show other values. This caching is the reason you restart the ctlmgr in the OP - it writes cached back. But it should be okay for this

[fda77]

@fraternl
maybe you want to test or extend with interesting items

• d29ebdf webif: add uimods

also i have no english translations of the german avm webif phrases of the items

[fraternl]

I have tested uimods

I found the drop-down box non-intuitive

The "signed firmware" is not working
It may well be that another (standard) mod I ran disables this function.
I do not get any nag-screen.

It could be an idea to omit it from the list if you know which mod this is.

A code change for this is needed (but also needed to make this bilingual)

Here's what I came up with regarding a translation to English.

<       box:allow_security_report_with_manufacturer     0|1                                     Your FRITZ!Box can be reached by AVM to retrieve selected diagnostics data or a diagnostics summary.
<       box:allow_background_comm_with_manufacturer     0|1                                     FRITZ!Box searches for updates periodically.
<       box:allow_cross_domain_comm                     0|1                                     To improve the product and ensure safe operation on your connection, this FRITZ!Box sends diagnostic data, for instance error reports, to AVM where needed.
<       box:button_events_disable                       0|1                                     Key Lock
<       box:signed_firmware                             0|1                                     Nagging with a link when box is not signed during diagnostics
<       boxusers:twofactor_auth_enabled                 0|1                                     Extra confirmation to configure certain settings and functions
<       emailnotify:crashreport_mode                    to_support_only|disabled_by_user        Send error messages automatically to AVM
<       eth_ports:eee_off_for_all_ports                 0|1                                     DISABLE Energy Efficient Ethernet
<       meshd:loop_prevention_state                     0|1                                     Prevent network loop
<       sar:gpon_ploam_password                         |                                       GPON ONT-Installation password
<       sar:gpon_reg_id                                 |                                       GPON Registration ID
<       sar:gpon_serial                                 |                                       GPON Serial number
---
>       box:allow_security_report_with_manufacturer     0|1                                     Ihre FRITZ!Box ist f&uuml;r AVM erreichbar, um ausgew&auml;hlte Diagnosedaten oder eine Diagnosezusammenfassung abzurufen.
>       box:allow_background_comm_with_manufacturer     0|1                                     FRITZ!Box sucht periodisch nach Updates
>       box:allow_cross_domain_comm                     0|1                                     Bei Aufruf von www.avm.de darf AVM ger&auml;tespezifische Daten Ihrer FRITZ!Box auslesen
>       box:button_events_disable                       0|1                                     Tastensperre
>       box:signed_firmware                             0|1                                     Nagt mit Link zu hilfe_nichtsigniert.html in der Diagnose und macht sonstwas damit
>       boxusers:twofactor_auth_enabled                 0|1                                     Nervige Zwei-Faktor Authentifizierung
>       emailnotify:crashreport_mode                    to_support_only|disabled_by_user        Fehlerberichte automatisch an AVM senden
>       eth_ports:eee_off_for_all_ports                 0|1                                     Energy Efficient Ethernet DEAKTIVIEREN
>       meshd:loop_prevention_state                     0|1                                     Netzwerkschleifenverhinderung
>       sar:gpon_ploam_password                         |                                       GPON ONT-Installationskennung
>       sar:gpon_reg_id                                 |                                       GPON Registrierungs-ID
>       sar:gpon_serial                                 |                                       GPON Seriennummer
28c28
<       tr369:enable                                    0|1                                     Remote administration of LAN by Provider
---
>       tr369:enable                                    0|1                                     Fernadministration des LAN durch den Provider
39c39
<       updatecheck:auto_update_mode                    update_all|update_important|check       Install new FRITZ!OS-Versions automatically
---
>       updatecheck:auto_update_mode                    update_all|update_important|check       neue FRITZ!OS-Versionen automatisch installieren

[fda77]

Thanks for translations!

In html there is a textbox for input OR a combobox with predefined items. But there is no "editable html combobox". google it and tell me how to do it better...

signed firmware

Not all variables could be changed, eg the sid-sessions timer also not. I could add a magic default value, eg "static" or whatever and then make this input uneditable. But then you could not TRY to change it. I i remember correctly the timer could be changed in (or some older?) inhaus

A code change for this is needed

No ... new is what you liked, ack what the command responded and chk the 2nd read for checking if avm really wrote it (some tigger some action and return back to old) - so an empty ack is okay when it does not accept changes (by avm design). And it "failed" if the new!=chk

[fda77]

hilfe_nichtsigniert.html does not yet exist, but avm seem to plan to no longer provide updates if not signed

if "1"=="1"then
if box.query("updatecheck:status/update_available_hint")=="1"then
diag_item.result.updateNeeded=true
diag_item.status="warning"
end
else
diag_item.result.thirdParty=true
diag_item.result.link=href.help_get("hilfe_nichtsigniert.html","hide=yes")
diag_item.status="warning"
end
end
end

[fraternl]

google it and tell me how to do it better...
Somehow I have let webdesign, even simple HTML, go past.
I have no ambition to change this. It was just an observation from a user point of view.

You would need to change your code to make it bilingual?

I think it's nice to have this overview.
For me it's important that those settings aren't forgotten, so I will apply them automatically.
remote management is nice until you lose remote management.

[fda77]

I also dont like webdesing. There are workareounds for an editable combobox with a lot of javascript, but then another one conplains about js. And it much mor than the current 1 line of code
Your translations are commited yet: 70ffb50

[fda77]

I noticed a device with(1) freetz and shows signed_firmware = "1", but my 7490 hats "0"
They are both signed with own key - but during flashing the signatur (which embedds everything) gets lost.
Maybe the difference is flash by ftp/adam and flash by freetz-webif?