@mrgnex
I ran into the same situation on my RT-AC68U (armv7l) FW-384.15. I've intentionally stayed in that older FW [ WAN interface stability - regardless of ISP provider (Verizon FIOS, Comcast Xfinity, Starry) at multiple locations. This version was the one that has maintained stability. Use to be an issue at time on prior versions and some older ones non issue. Either way I tried something after .15 and it was unstable so I backed to .15 and haven't really looked at it in last few years]
Summary: Was able to resolve by modifying the PATH inside the firewall script. Moved /usr/sbin to the end of the path instead of it sitting in front of the /opt/bin directory which is where the entware version of curl is at.
Additional details:
Anyway earlier today I decided to update an few items running on it via amtm to bring scripts, entware packages and also skynet up to date as possible while staying on the older FW.
I ran into a problem with curl after it got updated via me running inside the ssh session without any issues:
opkg update
opkg upgrade
Then I rebooted the router and logged back in again and ran:
curl -V
resulted in: (curl 8.1.1 (arm-openwrt-linux-gnu) libcurl/8.1.1 OpenSSL/3.0.8 zlib/1.2.13)
When I went to run firewall --> Option 3 (Malware Blacklist) --> Option 1 (update) I got the similar:
curl: option --retry-all-errors: is unknown, etc..
So I checked my path:
echo $PATH
resulted in: /opt/bin:/opt/sbin:/bin:/usr/bin:/sbin:/usr/sbin:/home/rjsh:/mmc/sbin:/mmc/bin:/mmc/usr/sbin:/mmc/usr/bin:/opt/sbin:/opt/bin:/opt/usr/sbin:/opt/usr/bin
I checked which curl is running:
which curl
resulted in: /opt/bin/curl
I check the version
curl -V
resulted in: curl 8.1.1 (arm-openwrt-linux-gnu) libcurl/8.1.1 OpenSSL/3.0.8 zlib/1.2.13
Release-Date: 2023-05-23
Looked at the help to make sure the option exists (it does) via:
curl --help curl
resulted in:
...
--retry <num> Retry request if transient problems occur
--retry-all-errors Retry all errors (use with --retry)
...
Then I checked the firewall script:
which firewall
resulted in: /opt/bin/firewall
cat /opt/bin/firewall | grep -i "path"
resulted in: export PATH="/sbin:/bin:/usr/sbin:/usr/bin:$PATH"
I checked each of those directories to see if another version of curl was in it prior to the $PATH
the /usr/sbin directory for me had another variant of curl in there.
cd /usr/sbin
./curl -V
resulted in:
curl 7.67.0 (arm-unknown-linux-gnu) libcurl/7.67.0 OpenSSL/1.0.2u
Release-Date: 2019-11-06
I checked the help for parameters usable with this version of curl via:
./curl --help
resulted in:
...
--resolve <host
ort:address[,address]...> Resolve the host+port to this address
--retry <num> Retry request if transient problems occur
--retry-connrefused Retry on connection refused (use with --retry)
--retry-delay <seconds> Wait time between retries
--retry-max-time <seconds> Retry only within this period
--sasl-authzid <identity> Use this identity to act as during SASL PLAIN authentication
...
There was no --retry-all-errors parameter in v7.67.0.
So I decided to modify the firewall script itself:
which firewall
resulted in: /opt/bin/firewall
# change directory
cd /opt/bin
# make a backup copy
cp firewall firewall.orig.bak
# open an editor to modify the firewall script.
nano firewall
Approx 17th line down has the following:
export PATH="/sbin:/bin:/usr/sbin:/usr/bin:$PATH"
I replaced that single line with the following two lines (the 1st line is the same as original except with a # in front to comment it out. The 2nd line shifts the /usr/sbin from the 3rd entry in the future PATH over to post-pend to be the last directory in the future PATH.
#export PATH="/sbin:/bin:/usr/sbin:/usr/bin:$PATH"
export PATH="/sbin:/bin:/usr/bin:$PATH:/usr/sbin"
I saved out via Control O and Control X
Ran the firewall again and this time I was able to utilized the current curl version when I did malware update, etc.
This should also hold true for enabling the latest version of curl being used for the daily / weekly / monthly update option you've selected in the settings, as I believe they all call via crontab jobs the firewall script to perform the update.
