Moving into Sun Yat-sen University's South Campus, Wrestling with the Campus Network

进驻中山大学南校区，折腾校园网 苏剑林 · 2016-09-05 · Machine Learning OpenWrt router

Beginning my journey as a graduate student, hoping that one day I can reach the level of a true master.

After entering Sun Yat-sen University, all sorts of annoyances started piling up. The most annoying thing first was that the semester started way too early — August 26th, which felt like at least a week earlier than most schools. What's the point of starting so early? Next came the feeling that SYSU's administrative system was pretty chaotic, much worse than my undergrad school, South China Normal University. Well, I won't complain about these trivial matters for now — next comes setting up the campus network, which turned out to be the start of a whole ordeal.

We're on the South Campus, where the campus network authenticates through the Ruijie (锐捷) client, and I use a MacBook. To be fair, SYSU thoughtfully provides a Mac version of Ruijie, only about 1MB in size — pretty nice. But as everyone knows, MacBooks don't have an Ethernet port, so every time I wanted to get online I'd have to plug in a USB Ethernet adapter and connect a cable. How annoying is that? So I looked for a way to dial in through a router instead. I'm not exactly inexperienced here — I've done some research on OpenWrt before, and back in undergrad the network there also used Ruijie, where I could replace the official dial-up client with mentohust, quite easily. So I tried repeating that process here, only to find that authentication kept failing. I tried every method suggested online, but none of them worked.

After some research, I found that on Windows, only the officially provided Ruijie version 4.90 works here — any newer or older version of Ruijie downloaded elsewhere fails to authenticate. I suspect it's precisely this mechanism that makes mentohust fail to authenticate. Also, the mentohust versions circulating online are mostly based on the V2 protocol, while 4.90 is based on V4. I later went and downloaded the V4 version for cross-compilation, but testing showed it still didn't work. Just when I was nearly giving up hope, I discovered mentohust-proxy, an improved version of mentohust, which gave me new hope. (How did I find it? I just went straight to GitHub and searched, because I'd really run out of options.)

The principle is simple: if authentication can't be completed directly through mentohust, then use proxy mode, where the computer itself completes the authentication, and mentohust is only responsible for sending heartbeat packets to keep the connection alive. It's a somewhat compromise solution, but it should be said to be a fairly general one, since its success basically depends only on your own computer's Ruijie client. Once I saw this approach, I knew there was hope, so I quickly brushed up on cross-compilation and eventually got it compiled successfully, and completed authentication successfully on the router. more

Cross-compilation

My environment is CentOS 7. First, install the environment dependencies — these dependencies are all things I found online, and I'm not sure if the list is complete, so leave a comment if something doesn't work. You can just search "openwrt编译" (compiling OpenWrt) and probably find plenty of related links.

sudo yum install autoconf binutils bison bzip2 flex gawk gcc gcc-c++ gettext make ncurses-devel patch unzip wget zlib-devel curl curl-devel openssl-devel perl perl-devel cpio expat-devel gettext-devel xz openssh-clients cmake libtool

Download the SDK package into the home directory. My router uses the common MT7620n chipset, so I downloaded the mt7620 SDK:

cd ~
wget https://downloads.openwrt.org/chaos_calmer/15.05.1/ramips/mt7620/OpenWrt-SDK-15.05.1-ramips-mt7620_gcc-4.8-linaro_uClibc-0.9.33.2.Linux-x86_64.tar.bz2
tar jxvf OpenWrt-SDK-15.05.1-ramips-mt7620_gcc-4.8-linaro_uClibc-0.9.33.2.Linux-x86_64.tar.bz2
mv OpenWrt-SDK-15.05.1-ramips-mt7620_gcc-4.8-linaro_uClibc-0.9.33.2.Linux-x86_64 op

Download libpcap. Here I compile the dependency library libpcap directly into the build, to avoid having to install it separately.

wget http://www.tcpdump.org/release/libpcap-1.7.4.tar.gz
tar zxvf libpcap-1.7.4.tar.gz

Download mentohust-proxy.

git clone https://github.com/updateing/mentohust-proxy.git

Configure environment variables (here /home/job is my home directory):

export PATH=$PATH:/home/job/op/staging_dir/toolchain-mipsel_24kec+dsp_gcc-4.8-linaro_uClibc-0.9.33.2/bin:/home/job/op/staging_dir/host/bin
export STAGING_DIR=/home/job/op/staging_dir

The rest of the process is pretty much like a normal compile, just with the extra parameter host=mipsel-openwrt-linux-uclibc. First compile libpcap:

cd libpcap-1.7.4
./configure --host=mipsel-openwrt-linux-uclibc --with-pcap=linux
make

Then compile mentohust-proxy:

cd ../mentohust-proxy
sh autogen.sh
./configure --host=mipsel-openwrt-linux-uclibc --disable-encodepass --disable-notify --with-pcap=/home/job/libpcap-1.7.4/libpcap.a
make

The mentohust binary in the src directory is the final compiled file.

Completing Authentication

Download mentohust and upload it to the router. You can first try whether mentohust alone can complete authentication; if not, use proxy authentication. By the way, this upgraded version of mentohust is much more user-friendly — here's its help text.

mentohust -h
Welcome to MentoHUST Version: 0.3.1
Copyright (C) 2009-2010 HustMoon Studio
人到华中大，有甜亦有辣。明德厚学地，求是创新家。
802.1x proxy and other new features by Hamster Tian 2015-2016.
Bug report to http://code.google.com/p/mentohust/issues/list
Usage: ./mentohust [-option][parameter] or [-option] [parameter] or [--long-option] [parameter]
Options: --help -h Show this help message
--kill -k -k(exit program) other(restart program)
--write -w Save parameters to config file
--username -u Username
--password -p Password
--nic -n Network interface name
--ip -i IP [default: local IP]
--mask -m Subnet mask [default: local mask]
--gateway -g Gateway [default: 0.0.0.0]
--dns -s DNS [default: 0.0.0.0]
--ping-host -o Ping host [default: 0.0.0.0, meaning this feature is disabled]
--auth-timeout -t Authentication timeout (seconds) [default: 8]
--heartbeat -e Heartbeat interval (seconds) [default: 30]
--wait-after-fail -r Wait after failure (seconds) [default: 15]
--max-fail -l Allowed number of failures [0 means unlimited, default: 8]
--no-auto-reauth -x Whether to auto-reconnect after disconnection: 0(no) 1(yes) [default: 1]
--eap-bcast-addr -a Multicast address: 0(standard) 1(Ruijie) 2(Sail) [default: 0]
--dhcp-type -d DHCP mode: 0(don't use) 1(secondary authentication) 2(after authentication) 3(before authentication) [default: 0]
--daemonize -b Whether to run in background: 0(no) 1(yes, suppress output) 2(yes, keep output) 3(yes, output to file) [default: 0]
--fake-supplicant-version -v Client version number [default 0.00 means compatible with xrgsu]
--template-file -f Custom data file [default: not used]
--dhcp-script -c DHCP script [default: dhclient]
--proxy-lan-iface -z In proxy authentication mode, the network interface listening for auth packets (setting this enables proxy mode)
--proxy-require-success -j Number of Success packets required before closing the LAN listening thread in proxy authentication mode [default: 1]
--decode-config -q Show the contents of SuConfig.dat (e.g. -q/path/SuConfig.dat)
--max-retries Maximum number of retries before getting a success or failure result, 0 means unlimited retries [default: 0]
Example: ./mentohust -u username -p password -n eth0 -i 192.168.0.1 -m 255.255.255.0 -g 0.0.0.0 -s 0.0.0.0 -o 0.0.0.0 -t 8 -e 30 -r 15 -a 0 -d 1 -b 0 -v 4.10 -f default.mpf -c dhclient
About proxy mode: in this mode MentoHUST will not initiate authentication itself, but instead will modify the source MAC of the authentication packets captured on the LAN and forward them to the WAN, so that the local machine's authentication succeeds.
In proxy mode, the username, password, and reconnect-on-disconnect settings (-u, -p, -x) are invalid and don't need to be specified. Since the Start packet is constructed manually, you still need to specify the DHCP mode and multicast address (-d, -a).
Proxy mode example: ./mentohust --proxy-lan-iface br0 --nic eth0 --eap-bcast-addr 1 --dhcp-type 2 -proxy-require-success 2
Note: please make sure to run this with root privileges!

First plug the campus network cable into the router's WAN port, then connect the computer to a LAN port (or via WiFi), and run this command on the router:

./mentohust --proxy-lan-iface br-lan --nic eth0.2 --eap-bcast-addr 0 --dhcp-type 2

Then just use Ruijie on your computer to dial in, and you'll see the router display a successful connection. To keep mentohust running, you can use screen, or just use the -b parameter directly. There you go — enjoy your WiFi.

What's Next

There's a lot more you can do from here, like NAT traversal, SSH proxying, resource sharing, and so on.

Compiled binary, usable for MTK-series routers: mentohust_mtk.zip

Reference Links

https://github.com/updateing/mentohust-proxy

https://www.yjblog.net/post/123.html

http://soundrain.net/2016/04/25/mentohust-v4版本编译及ipv6的配置/