config ‘wifi-device’ ‘wl0′
      option ‘type’ ‘broadcom’
      option ‘channel’ ’5′
      option ‘disabled’ ’0′
config wifi-iface
      option device “wl0″
      option network lan
      option mode ap
      option ssid “OpenWrt”
      option encryption psk2
      option key “keyforclients”
config wifi-iface
      option device “wl0″
      option network lan
      option mode wds
      option bssid 00:16:B6:19:63:C8
      option ssid “OpenWrtWDS”
      option encryption psk2
      option key “pskforWDS”

And guess what? It worked like a charm! So I could replace the odd DD-WRT boxes. Anyways ... does anybody have an idea where to find the sourcecode of anything > v23 SP1?

Since my box has an USB port, I was missing a way to umount mounted usb storage. Looking deeper into it, I noticed that partitions get mounted by ‘/etc/hotplug.d/usb/01-mount’ like this:

# mount
[...]
part1 on /mnt/disc0_1 type ext3 (rw)
part2 on /mnt/disc0_2 type vfat (rw)

The correct devices are missing. A patch is available:

mount.patch

Okay … So far, so good. Now some tweaking to webif^2 for umounting attached usb storage devices. Here comes the patch:

umount-button.patch

So … after more than one hour googling I found the following in the broadcom kernel module source:

if (val && strstr(v, "psk")) {
val = (strstr(v, "psk2") ? 0x84 : 0x4);
v = nvram_safe_get(wl_var("wpa_psk"));
if ((strlen(v) >= 8) && (strlen(v) < 63)) {

bcom_ioctl(skfd, ifname, WLC_SET_WPA_AUTH, &val, sizeof(val));

if (nvram_match(wl_var("mode"), "wet")) {
/* Enable in-driver WPA supplicant */
wsec_pmk_t pmk;

pmk.key_len = (unsigned short) strlen(v);
pmk.flags = WSEC_PASSPHRASE;
strcpy(pmk.key, v);
bcom_ioctl(skfd, ifname, WLC_SET_WSEC_PMK, &pmk, sizeof(pmk));
bcom_set_int(skfd, ifname, "sup_wpa", 1);
}
}
}

So … this means, that the WPA-PSK length has to be >= 8 and < 63, mine was 65. This wasn´t a problem yet, cause I used the routers only in AP mode, where this restriction doesn't effect. Shorting the WPA-PSK length 62 did the trick!

Successfull was the following modifications to factory (linksys) defaults:

nvram set vlan0ports=”0 1 2 5*”
nvram set vlan1ports=”4 5*”
nvram set vlan0hwname=”et0″
nvram set vlan2ports=”3 5″
nvram set vlan2hwname=”et0″
nvram set dmz_ifname=”vlan2″
nvram set lan_ifname=”br0″
nvram set lan_ifnames=”vlan0″
nvram set wan_ifname=”ppp0″

Now the door is open to extend the functionality of the openwrt router

# df
Filesystem 1k-blocks Used Available Use% Mounted on
/dev/root 7296 3420 3876 47% /
none 15276 36 15240 0% /tmp

Hrhrhrhr … :-) Disassemble photos can be found here

Don´t ask how, but we got some units to europe.

The first thing we does, was to install openwrt and to try debridge the switch to have multiple interfaces instead. We was able to remove ports from the switch, but cant create additional working vlans like on WRT54G. So at this point its useless for our purpose. But we will start exploring as son as possible we have a running serial console.

The following NVRAM-Settings need to take place:

#!/bin/sh
#Port 0 into WAN, 5 Router themselv
nvram set vlan1hwname=et0
nvram set vlan1ports="0 5"
#Port 2, 3 and 4 into LAN, 5 Router themselv
nvram set vlan0hwname=et0
nvram set vlan0ports="2 3 4 5*"
# Port 1 into DMZ, 5 Router themselv
nvram set vlan2hwname=et0
nvram set vlan2ports="1 5*"
# Static IP-Address for DMZ-IF
nvram set dmz_ifname=vlan2
nvram set dmz_proto=static
nvram set dmz_ipaddr=172.18.20.5
nvram set dmz_netmask=255.255.255.0
# save all the stuff
nvram commit

To bring automaticaly up the dmz-if, you need to add “ifup dmz” with:

# sed “s/ifup lan/ifup lan@ ifup dmz/” \
/etc/init.d/S40network | tr ‘@’ ‘n’ > /etc/init.d/S40network

To allow traffic forwarded by the new if, you will maybe add for example the following into “/etc/firewall.users”:

#!/bin/sh
DMZ=$(nvram get dmz_ifname)
#Allow Forward from DMZ into WAN
iptables -A FORWARD -i $DMZ -o $WAN -j ACCEPT
#Allow Forward from DMZ into LAN
iptables -A FORWARD -i $DMZ -o $LAN -j ACCEPT
#Allow Forward from LAN into DMZ
iptables -A FORWARD -i $LAN -o $DMZ -j ACCEPT

But it will be better to specify exactly, what services are allowed from and into DMZ!

Welcome to minicom 2.1

OPTIONS: History Buffer, F-key Macros, Search History Buffer, I18n
Compiled on Mar 29 2005, 09:39:09.

Press CTRL-A Z for help on special keys

BusyBox v1.00 (2005.07.08-18:02+0000) Built-in shell (ash)
Enter ‘help’ for a list of built-in commands.

_______ ________ __
| |.—–.—–.—–.| | | |.—-.| |_
| – || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
WHITE RUSSIAN (RC1) ——————————-
* 2 oz Vodka Mix the Vodka and Kahlua together
* 1 oz Kahlua over ice, then float the cream or
* 1/2oz cream milk on the top.
—————————————————
root@gollum:/# AT S7=45 S0=0 L1 V1 X4 &c1 E1 Q0
/bin/ash: c1: not found
root@gollum:/# /bin/ash: AT: not found

[1] + Done(127) AT S7=45 S0=0 L1 V1 X4
root@gollum:/#
root@gollum:/#
root@gollum:/# reboot The system is going down NOW !!
watchquag Sending SIGTERM to all processes.
Sending SIGKILL to all processes.
Please stand by while rebooting the system.
Restarting system.
Please stand by while rebooting the system…