TheUnboundDeveloper/AM-Reaper v3.4.8-beta-BQ16

Reaper v3.4.8-beta — BQ16

on GitHub

v3.4.8 — Dreadwatch, Security Review watch rules, the latency and loss chart, security-review fixes

Everything in v3.4.7 is included.

• Dreadwatch: threat domains on their own page, with counts. Reviewer feedback: name blocking
  (dnsmasq NXDOMAIN) and address blocking (ipset drops) are different enforcement points, and a block
  whose effect cannot be measured cannot be trusted. The v3.4.7 card left the Warden page for a new tab,
  Warden › Dreadwatch, with its own feeds table, status and counters. dnsmasq gained two Reaper
  options: reaper-nx=/name/ (answered like an answer-less address=, but flagged as Dreadwatch's)
  and reaper-hitlog=PATH, which records each NXDOMAIN answered from the list as time, asking client
  and the listed name — at most 50 records a second and 256 KB between collections, the excess counted
  as Not recorded; ordinary lookups are never recorded and nothing goes to syslog per lookup. Warden's
  15-minute job (and each page refresh) folds the records into /jffs/rwarden/dns.counters: total since
  reset, per feed, the top 100 names and devices; the newest 500 lookups stay in RAM. The page adds a
  self-test (one query to the router's resolver, NXDOMAIN expected), a reset, and a coverage card (DNS
  Director forcing, the Firefox DoH canary). Needs Warden on, as before. Behaviour change: the
  list's /jffs copy is now dns.nx; the v3.4.7 dns.cache is replayed only when no dns.nx exists
  and is removed once one is written, so a downgrade rebuilds its list at its first update. Guide 4.3.10.
• Security Review: watch rules, per-item accept, an acceptance log. Reviewer feedback: expected
  /jffs churn turned every run into the same list. Rules in /jffs/reaper/review/rules (hash,
  meta, exist, ignore and a glob, or cron: / nvram: patterns; first match wins, 100 at most)
  are applied by one awk engine to both the live inventory and the baseline, so an ignored path is
  never reported as removed and a changed mode is a grey rule changed row, not a change. Each row
  gets Accept, Existence only, Ignore and Ignore folder; Accept all stays. Every acceptance and rules
  save is audited, logged with counts and up to 20 items (reaper-audit: review …) and appended to
  /jffs/reaper/review/accept.log (200 kept; the card shows 10). The rules survive updates and ride
  the settings export (rwatch_rules, validated on import). Guide 2.9.
• Traffic Analyzer: latency and loss get their own chart, with a real right axis. Reviewer
  feedback: latency showed only on the history windows, under a Latency (right axis) legend with no
  right axis. A Latency & loss card under WAN throughput now draws round-trip time (left, ms) and
  the one-minute loss (right, %) on every window; live it samples on each poll and holds the last reply
  until the next 5-second probe, so the line is continuous, and on history a period with no reply is a
  gap. rtrafd publishes each probe's sequence number and result (seq, last_us) for this. The WAN
  throughput chart is back to its two traces. Guide 4.7.1.
• Warden: the abuse.ch feed hosts are whitelisted once. urlhaus, threatfox and
  feodotracker.abuse.ch are Fastly anycast names answered from 151.101.2.49, .66.49, .130.49
  and .194.49, inside the United States country list — the v3.4.7 ipdeny failure with US in place of
  FR. The four addresses are added like the ipdeny entry: only those missing (bare or /32), appended,
  logged, under their own one-time marker, so a deleted entry is never put back. Guide 4.3.5.
• Security review 2026-10-20: one medium and five low findings fixed. IPv6 device names now honour
  dnsmasq's hosts-clash rule, so a LAN device can no longer have its IPv6 address served for the
  router's or another device's name (F-1; it was opt-in). The Connections page's name table ignores
  DNS replies from LAN hosts that are not a resolver the router knows (DHCP-advertised, or one it
  forwards to), and its backfill only accepts the answer to the question it asked (F-2, F-3). The
  session cookie carries SameSite=Lax (F-4). The public-build workflows pin every GitHub Action to
  a commit SHA (F-5). Behaviour change: a device held by Gatekeeper now gets every name answered
  with the router's own address by a resolver of its own on port 5300 (run under its own name, so a
  dnsmasq restart leaves it alone), so the sign-in sheet still appears but nothing can be looked up
  or tunnelled (F-6). Detail in REAPER-FIXES; guide 4.2.6, 4.2.8, 4.14b.
• No file or folder under /jffs stays writable by every user. Field (RT-BE88U): the v3.3.8
  umask fix only shaped new files; anything created earlier kept 0666 through every rewrite, and a
  full-backup restore brings old modes back - 250+ entries on the reporting box, among them
  /jffs/nvram/sshd_authkeys (dropbear's authorized keys), the VPN and HTTPS private keys, the ACME
  account and the rule lists. dnsmasq, avahi and lldpd run as nobody, so one compromised daemon
  could plant an SSH key and become root. At every boot, right after /jffs is mounted and before
  anything runs from it, the "other" write bit is removed from every regular file and folder on it
  (symlinks never followed, FIFOs and sticky shared folders left alone, one log line with the count;
  reaper_jffs_perm_sweep, rc/ubifs.c / jffs2.c). The Security Review lists any entry that has
  it again (the card and the dashboard, one log line per change of the count). Behaviour change:
  an add-on that relied on a world-writable file or folder under /jffs needs its own owner instead.
• Diagnostics report v1.3.42 to v1.3.45. Section 14b gains the Gatekeeper sinkhole (pid, port,
  redirect rule counts); section 14 a Dreadwatch line: blocked lookups in total and per feed, not
  recorded, devices, pending hits and each feed's last result — counts only. A finding notes a list
  that predates counting. v1.3.44 reads a missing hits file as 0 instead of printing a shell error;
  v1.3.45 counts files and folders under /jffs any user can write (section 3, a finding when not 0).
• Dictionaries. 71 tokens added and 2 reworded in all 25 packs, translated (lockstep 7503).

Images & checksums (BQ16)

Two flashable images: + AI Advisor (default) and Standard (noMCP, all AI components compiled out entirely). Flash the *_nand_squashfs.pkgtb via Administration > Firmware Upgrade.

This is a beta release. Its filename carries _BETA and the router reports the same string on the dashboard and the About page, so you can always tell which channel a flashed image came from. Stable releases carry no marker.

Verify a download against the attached SHA256SUMS-BQ16-Reaper_v3.4.8.txt.

Corresponding source & reproducibility

The BQ16 image for v3.4.8-beta is built from this repository at tag v3.4.8-beta-BQ16: the pinned Asuswrt-Merlin base (3006.102.8-beta2, a7ebfa133a) plus the complete patch series. The tag freezes the exact source that produced it.

• Patches: patches/
• Provenance record: provenance/manifest.json
• How to verify: docs/REPRODUCIBILITY.md and docs/SOURCE-AVAILABILITY.md

The auto-attached Source code (zip/tar.gz) asset below is this repository at tag v3.4.8-beta-BQ16 (patches + docs).