config ‘wifi-device’ ‘wl0′
      option ‘type’ ‘broadcom’
      option ‘channel’ ’5′
      option ‘disabled’ ’0′
config wifi-iface
      option device “wl0″
      option network lan
      option mode ap
      option ssid “OpenWrt”
      option encryption psk2
      option key “keyforclients”
config wifi-iface
      option device “wl0″
      option network lan
      option mode wds
      option bssid 00:16:B6:19:63:C8
      option ssid “OpenWrtWDS”
      option encryption psk2
      option key “pskforWDS”

And guess what? It worked like a charm! So I could replace the odd DD-WRT boxes. Anyways ... does anybody have an idea where to find the sourcecode of anything > v23 SP1?

This year the opera “Die Meistersinger” is broadcasted online under the slogan “live dabei” (live there) via the great thing called “Internet” and to a public viewing area in Bayreuth, which is a premiere in both cases. So if you don’t have a ticket for the Festspielhaus and not in a position to make use of the public viewing but interested to have a look at the opera, you may want to check if your system matches the technical requirements and give it a try.

; <<>> DiG 9.3.4 <<>> +dnssec web.pixaco.se @83.169.184.161
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; ANSWER SECTION:
web.pixaco.se. 0 IN A 204.9.89.60

Beside that, this behavour breaks the whole DNS, since many mechanism rely on a negative answer. The most visible effect for the users is, that when having a typo on surfing, he will forwarded to http://suche.kabeldeutschland.de/de.kde.assist/?domain=<domainyoutypedinyourprompt>. Since 204.9.88.0/21 is located at our transatlantic friends from US, there might be some problem with leaking privacy informations. I don’t feel happy, if I had a typo in my URL and getting listed for it on any terror list or providing the newest porno links to my american friends inside the organisations with the tree capitals.

All that for getting some extra money, but racing pricedumping for connectivity, this sucks a lot.
If you are a customer and feel pissed, you can send a friendly note to them:

Kabel Deutschland Vertrieb und Service GmbH & Co. KG
Beschwerdestelle
99116 Erfurt
kundenservice@kabeldeutschland.de
Fax: 01805299925

A quick and dirty workaround for dnsmasq maybe to add “bogus-nxdomain=204.9.89.60″ to your config file. This doesn’t fix the DNSSEC problem.
The problem also pops up at dns-operations and there are traces at google too.

[UPDATE] Over 1 year later zdnet.de discoverd the problem.

2008/02/19 15:08:06 BGP: Performing BGP general scanning
2008/02/19 15:08:06 BGP: scanning IPv4 Unicast routing tables
2008/02/19 15:08:06 BGP: scanning IPv6 Unicast routing tables
2008/02/19 15:08:07 BGP: Import timer expired.
2008/02/19 15:08:13 BGP: 192.168.96.2 rcvd UPDATE w/ attr: nexthop 212.202.214.150, origin i, localpref 100, metric 0, path 20676 2914 2914 2914 2914 4755 4755 4755 4755 4755 9583
2008/02/19 15:08:13 BGP: 192.168.96.2 rcvd 124.7.35.0/24
2008/02/19 15:08:13 BGP: Zebra send: IPv4 route add 124.7.35.0/24 nexthop 212.202.214.150 metric 0
2008/02/19 15:08:17 BGP: 192.168.96.2 sending KEEPALIVE
2008/02/19 15:08:17 BGP: 192.168.96.2 KEEPALIVE rcvd
2008/02/19 15:08:17 BGP: %NOTIFICATION: received from neighbor 192.168.96.2 4/0 (Hold Timer Expired) 0 bytes
2008/02/19 15:08:17 BGP: %ADJCHANGE: neighbor 192.168.96.2 Down BGP Notification received

Any ideas are welcome … also some other routing suite alternatives.

Would you like to enter the initial configuration dialog? [yes/no]:
Loading pxelinux.0 from 10.42.10.50 (via FastEthernet4/0/0): !!!
[OK - 13156 bytes]

So the box took an IP via DHCP and tried to netboot. (Un)fortunately it only breaks my terminal, so no worries! ;)

• only bind9 (>= 9.3) and NSD privides support (yet)
• bandwidth will be increased 2-3 times with max. key size
• increased memory usage depending on your server software
• operational costs will increasing dramaticaly due significant higher amount of regular work
• more computing power (hardware) needed to generate dnssec ready zones and signing
• unknown influence on resolving nameservers (load/memory/bandwidth)
• chain of trust ends at resolving nameserver and is not provided to enduser

Since the last issue isn’t solved (yet), it doesn’t make any sence for me to invest resources into setting up DNSSec infrastructur, cause the end user would not recognize if the communication with the resolving nameserver or the resolving nameserver itself is taken over.

Any complaints and/or hint? Did I missed something?

So … after more than one hour googling I found the following in the broadcom kernel module source:

if (val && strstr(v, "psk")) {
val = (strstr(v, "psk2") ? 0x84 : 0x4);
v = nvram_safe_get(wl_var("wpa_psk"));
if ((strlen(v) >= 8) && (strlen(v) < 63)) {

bcom_ioctl(skfd, ifname, WLC_SET_WPA_AUTH, &val, sizeof(val));

if (nvram_match(wl_var("mode"), "wet")) {
/* Enable in-driver WPA supplicant */
wsec_pmk_t pmk;

pmk.key_len = (unsigned short) strlen(v);
pmk.flags = WSEC_PASSPHRASE;
strcpy(pmk.key, v);
bcom_ioctl(skfd, ifname, WLC_SET_WSEC_PMK, &pmk, sizeof(pmk));
bcom_set_int(skfd, ifname, "sup_wpa", 1);
}
}
}

So … this means, that the WPA-PSK length has to be >= 8 and < 63, mine was 65. This wasn´t a problem yet, cause I used the routers only in AP mode, where this restriction doesn't effect. Shorting the WPA-PSK length 62 did the trick!

Successfull was the following modifications to factory (linksys) defaults:

nvram set vlan0ports=”0 1 2 5*”
nvram set vlan1ports=”4 5*”
nvram set vlan0hwname=”et0″
nvram set vlan2ports=”3 5″
nvram set vlan2hwname=”et0″
nvram set dmz_ifname=”vlan2″
nvram set lan_ifname=”br0″
nvram set lan_ifnames=”vlan0″
nvram set wan_ifname=”ppp0″

Now the door is open to extend the functionality of the openwrt router

# df
Filesystem 1k-blocks Used Available Use% Mounted on
/dev/root 7296 3420 3876 47% /
none 15276 36 15240 0% /tmp

Hrhrhrhr … :-) Disassemble photos can be found here

Don´t ask how, but we got some units to europe.

The first thing we does, was to install openwrt and to try debridge the switch to have multiple interfaces instead. We was able to remove ports from the switch, but cant create additional working vlans like on WRT54G. So at this point its useless for our purpose. But we will start exploring as son as possible we have a running serial console.