Herta mit DSL-G684T Firmware

ssh -L 8080:192.0.2.1:8080 [email protected]

#!/bin/sh

# This script builds the Herta FW mod, you need several prerequisites (gcc
# and make in $PATH is one, html2text and grep are others...) to be met when
# using this, see commands & comments below.
#
# Apart from this script, you should have the unsquashfs-1.0.tar.bz2 in the
# same directory. All other tools and images will be downloaded by this script
#
# Note that this needs ~350MB of free disk space during build for temp data!
#
# The basic approach is to decompile the binary images of Herta and DSL-G684T
# FW, and to copy some things over from the Herta FW to the DSL-G684T FW. So
# the resulting FW image is a DSL-G684T FW with some files from the original
# Herta FW plus some config modifications.


echo '##### Check some prerequisites...'

# The "full custom" unsquashfs-lzma for squashfs-1.0 you should have received
# along with this script, it was modified by me and is hence not an official
# release you could get elsewhere...
if [ ! -e ./unsquashfs-lzma-1.0.tar.bz2 ]
then
        echo ERROR: Could not find required ./unsquashfs-lzma-1.0.tar.bz2! >&2
        exit 1
fi

# Not nice but necessary to set the permissions of the files in the FW image
# correctly later; should maybe try fakeroot or sudo someday...
if [ "`whoami`" != "root" ]
then
        echo ERROR: Sorry, this script only works with root permission >&2
        exit 1
fi


echo '##### Download all necessary items...'

# Put the FW tarballs from the DLINK FTP into a dedicated folder
[ -d dl_dir ] || mkdir -p dl_dir
cd dl_dir
# Check if the FW tarballs have been downloaded previously, otherwise get them
[ -e DSL-G684T_fw_reva_302B01T02EUA20070413_ALL_en_20070413.zip ] || wget ftp://ftp.dlink.de/dsl/dsl-g684t/driver_software/DSL-G684T_fw_reva_302B01T02EUA20070413_ALL_en_20070413.zip
[ -e DVA-G3342SB_fw_reva_5.0_de_19092008_Offline_Update.zip ]     || wget ftp://ftp.dlink.de/dva/dva-g3342sb/driver_software/DVA-G3342SB_fw_reva_5.0_de_19092008_Offline_Update.zip
[ -e DSL-Board_GPL_code.tgz ]                                     || wget ftp://ftp.dlink.de/dva/dva-g3342sb/driver_software/DSL-Board_GPL_code.tgz
cd ..


echo '##### Download and/or build all the tools needed...'

# Create a build dir (or clean up the previous one) for temporary data
rm -rf build_dir
mkdir build_dir
cd build_dir

# Get & compile find-squashfs; tries to automatically rip the source from a
# post in ip-phone-forum (in a fritz-box-thread iirc...). If this should not
# work for you, open the URL that is fetched by wget and copy-paste the
# code there manually to ./dl_dir/find-squashfs.c. Did not provide it as I'm
# unsure about license...
# What it does is actually quite trivial: just searches for squashfs magic
# string and extract all data that follows to squashfs, all previous data
# to a the kernel image. Did this originally with a hex editor, but this is
# more convenient (and can be used in batch mode, of course).
# Could maybe use some scripting language like perl or python to achieve the
# same, or maybe even some shell tools... but for now this works.
# Code is not 64-bit-safe, which is why I used -m32 on my 64bit host, could
# be omitted on a 32bit-host-OS, but should not do harm there either.
[ -e ../dl_dir/find-squashfs.c ] || \
wget -O - "http://www.ip-phone-forum.de/showpost.php?p=328268&postcount=2" 2> \
        /dev/null | html2text -width 160 - | grep -A 84 Code | grep -v Code > \
        ../dl_dir/find-squashfs.c
gcc -m32 ../dl_dir/find-squashfs.c -o find-squashfs

# Untar and build the unsquashfs-utility. See if the Makefile might need
# adaption in your environment. I created this myself by backporting a version
# for squashfs 2.x adding the lzma decompressor shipped with the mksquashfs in
# the Herta source tarball. I could not find a working unsquashfs-lzma for
# (the really old) squashfs 1.x used in Herta/DSL-G684T or even just some old
# kernel that would be able to mount it...
# Could also be that DLINK/TI hacked that mksquashfs-lzma version themselves,
# as hooking lzma into squashfs to compress filesystem data is not an
# "official" branch or port (plain vanilla squashfs uses gzip), and several
# "flavors" of this seem to exist...
# Was by far the most awkward job in the whole process... there seemed to be
# even some bug in the standard lzma-decompress which only slightly corrupted
# a few of the unsquashed files and took me days to detect. After switching to
# the small decoder (used in the kernel), it *finally* worked as expected...
tar jxf ../unsquashfs-lzma-1.0.tar.bz2
make -C unsquashfs-lzma-1.0

# The source tarball of Herta contains some tools I used (mksquashfs and
# tichksum) in binary form, so no need to compile those yourself. Those
# binaries worked for me, if they don't for you, you'll have to compile them
# yourself from source (which did not work for me out of the box with the
# gcc on my host, which was also why I decided just to use the precompiled
# binaries).
tar zxf ../dl_dir/DSL-Board_GPL_code.tgz


echo '##### Extract & decompile the squashfs images...'

# Unzip the FW tarballs
unzip ../dl_dir/DVA-G3342SB_fw_reva_5.0_de_19092008_Offline_Update.zip
unzip ../dl_dir/DSL-G684T_fw_reva_302B01T02EUA20070413_ALL_en_20070413.zip

# Extract the squashfs-image from the Herta FW
./find-squashfs Firmware\ 5.0\ Final/image/DLinkHB-C_DSL-G684T_singleimage_kernel_fs_V3.00B01T01.HB-C.20070815
rm -f kernel.raw
mv -f kernelsquashfs.raw squashfs_herta.img

# Extract the squashfs-image from the DSL-G684T FW
./find-squashfs DLinkEU-A_DSL-G684T_singleimage_kernel_fs_V3.02B01T02.EU-A.20070413
mv -f kernelsquashfs.raw squashfs_g684t.img

# Decompile the herta squashfs: we will rip some files out of this to put them
# into the DSL-G684T FW (see below)
./unsquashfs-lzma-1.0/unsquashfs-lzma squashfs_herta.img
mv -f squashfs-root squashfs-root-herta

# Decompile the G684-T squashfs: this will be our working copy
./unsquashfs-lzma-1.0/unsquashfs-lzma squashfs_g684t.img


echo '##### Now the actual mods follow...'

# This is IMPORTANT, as otherwise ssh pubkey login will not work! ('/' is set
# as $HOME of user root in the G684T FW!). mksquashfs will set the access
# permissions of '/' in the image according to the permissions of this dir!
chmod go-rwx squashfs-root

# The var.tar gets loop-mounted on Herta, but contains files that have an
# owner other than root: will also result in ssh-pubkey-logins to be disabled
# by dropbear, so rcmd from horst won't work if left like this
cd squashfs-root
tar xf var.tar
rm -f var.tar
# this actually corrects ownership for all files in root-fs, not only var.tar
chown -R root:root ../squashfs-root
tar cf var.tar var/
rm -rf var/*
cd ..

# Copy the .ssh-dir from '/root' in the Herta fw to '/': as mentioned, on
# DSL-G684T the $HOME of root is set to '/' instead of '/root' (like on the
# original Herta FW). Found no way to change this, $HOME seems to be set by
# one of the closed-source cm_* binaries. Can't take the cm_* from Herta, as
# they also contain other functionality (e.g. the network stuff (WPA2) for
# which this mod is created in the first place). Also exporting $HOME at the
# beginning of /etc/init.d/rcS was not successful.
# In order for this to work, file permissions also needed to be adapted (see
# the previous two step above), as dropbear is quite picky about those... as
# mentioned, it will not allow pubkey logins if these permissions are not
# strict enough. This will effectively result in rcmd from Horst not working,
# as it uses pubkey-ssh-login.
# So long story short: .ssh/ needs to be in the home-dir or root (which is
# '/'), as it contains the authorized_keys to allow public key logins from
# Horst (and hence rcmd to function).
cp -af squashfs-root-herta/root/.ssh squashfs-root/

# Replace the host keys, might not be mandatory, but the FW then "identifies"
# as Herta...
cp -af squashfs-root-herta/etc/dropbear/* squashfs-root/etc/dropbear/

# Copy the 'nvram' -binary over from the original Herta FW. Don't get fooled,
# Herta does *not* use the "nvram-concept" to save its configuration, config
# management is all done by the cm_* -stuff again...
# *This* nvram is allowing Herta to query configuration data stored in
# *HORSTs* nvram. Horsts nvramd is listening on port 888 to answer those
# queries from Herta. It is for example used by some of the firewall-scripts
# Horst copies to Hertas /var/tmp -dir during startup, and hence mandatory for
# the setup process between Horst and Herta to function correctly.
cp -af squashfs-root-herta/usr/sbin/nvram squashfs-root/usr/sbin/

# This appends a command to the init script which will bring up the the br0:1
# -interface: Horst and Hertas "private" network. Is also sort-of a hack, as
# all other network setup is again done by the cm_* binaries... in the
# original Herta FW this is also true for the private net. But as I don't have
# source those binaries (and can't just copy them from Herta for the before-
# mentioned reasons), the following also does the trick.
# This basically waits until the cm_* brought up br0, then brings up br0:1.
# NOTE: Not bringing this up (or disabling it via 'ifconfig br0:1 down' later)
# will result in Horst being in the same subnet as the LAN ports and Herta.
# Just change the internal IPs in HORTSs nvram (grep for the relevant
# variables e.g. via 'nvram -L | grep 192\.0\.2\..' on Horst) to valid values
# in the standard LAN and you are done, having Horst and Herta next to each
# other in the LAN instead of Horst hiding behind Herta!
echo '(while [ "`ifconfig br0 2> /dev/null`" = "" ] ; do sleep 5s ; done && /sbin/ifconfig br0:1 192.0.2.1 netmask 255.255.255.0) &' >> squashfs-root/etc/init.d/rcS
echo "" >> squashfs-root/etc/init.d/rcS


echo '##### End of mods, now create the firmware image...'

# Compile the modified squashfs image
nsp/src/squashfs/mksquashfs squashfs-root squashfs_g684t_herta_mod.img -noappend -le

# Re-assemble the FW-Image: use the original kernel image from the DSL-G684T
# we extracted earlier, plus our modified root-fs.
cat kernel.raw squashfs_g684t_herta_mod.img > ../DLinkEU-A_DSL-G684T_singleimage_kernel_fs_V3.02B01T02.EU-A.20070413_mod_horst_herta

# Append checksum to the final image: Herta will not flash the image (at least
# from WebIF) if the checksum at the end of the image is missing or incorrect.
nsp/src/TI-chksum/tichksum ../DLinkEU-A_DSL-G684T_singleimage_kernel_fs_V3.02B01T02.EU-A.20070413_mod_horst_herta && \
echo '##### Done, have fun!' || \
echo '##### Sorry, something went wrong, please see previous output!'