Captive Portals & Brighton

Yesterday I gave a talk at SANE user group on my history with wireless networks as part of the PierToPier.net project in Brighton (now defunct) and my experimentation with captive portal software which I began revisiting this time last year. I thought it would be a good opportunity to develop my programming skills by tidying up and modernising parts of the codebase which caused problems, such as things preventing builds on a modern system with clang which is now the default compiler for FreeBSD on i386/AMD64 architectures and OS X. The slides from my talk can be found here.

IMG_3248

Back in the early to mid 2000’s there were 2 initiatives to provide public access wifi in Brighton. Loose Connection and PierToPier.net, each had a different focus & approach.
Loose Connection was a commercial venture which could be deemed a VAR, they resold a ADSL connection along with a draytek router & that was it. Individual wireless networks with the loose connection SSID dotted around drinking holes in Brighton, the founding(?) company Metranet lives on as a WISP today.
PierToPier.net was a community driven effort with a technical team of volunteers, predominantly from a service provider / telecoms / networking background. Each node on the network was sponsored by a host who’d buy and run the equipment while the project members managed it.

The project started off based around the fanless VIA mini-itx boards, Prism2 chipset wireless cards, booting linux with hostapd and nocatauth/nocatsplash off a CF card in a IDE to CF adapter.
This was a very flexible platform, if there was no package for it you could build it with ease, problem was that it had a high cost for entry, £250 to £300? so from the start we were looking to reduce costs.
The other issue was though we’d eliminated moving parts, the casing was not suitable for outdoor use.

With the availability of 3rd party firmware and promotional sales of the WRT54G, PierToPier switched hardware platforms as the low cost solution for new nodes.
Tom Grifiths discovered Chillispot around the same time frame and we adopted it due to enhanced functionality it provided, such as RADIUS accounting and working captive portal. We’d previously ran into issues with browser support running nocatauth which by that point was no longer maintained and stability issues with nocatsplash.

Glastonbury 2005
VIA motherboard again this time with CF adapter & mini-pci slot onboard
2x Atheros A/B/G mini-pci cards, one on mini-pci to PCI bridges and second onboard
Stuck to a pelican case with epoxy
Two holes drilled in the side of the case for external antennas

It was early times for support of the cards and the wireless standards. In this era OpenBSD was leading the way in terms of support of hardware and development of their ieee80211 wifi stack, they were the first to reverse engineer the Atheros binary blob HAL (years before anyone?) but late to the game for the 802.11g, 11a was enabled from the start but didn’t appear to work – bringing the interface up in .11a hostap mode wouldn’t necessarily work.
Looking at alternatives there was a short lived live environment named WifiBSD which was based around FreeBSD but later moved to NetBSD before development ceased. The support for the Atheros cards was not as good as OpenBSD, hence not wasn’t much use.

The hardware for the Glastonbury nodes were truly terrible, all functionality had been wired to a single bus which caused the system to lock hard in most configurations. e.g. you booted from a CF card and tried to bring up a wireless interface. The only way to use the system was to disable everything that wasn’t needed in the BIOS including VGA, if there was an issue, you’d have to factory reset the BIOS before diagnosing.

For the wireless network at Glastonbury, the 11a 5GHz network was used as the backhaul while the 11b/g interface was used for connecting wireless clients. No captive portal, connect to the AP & off you go.

We arrived onsite on Tuesday, starting getting things running, Thursday morning the rain and lightning started things went downhill from there. loss of connectivity between the backhaul links meant things fell apart.

By the time we’d discovered Chillipot the project had a 1.0 release out which had preliminary support for FreeBSD. The website claimed only FreeBSD 5 and up were supported, I created a port and submitted it for inclusion in the tree, net-mgmt/chillispot was born, Edwin@ from the ports team fixed the code so that it’d work on previous releases. I then moved onto creating a OpenBSD port, this was slightly harder and the final peace was actually resolved by a Steve Davies. I got the code to build on OpenBSD but networking wouldn’t work. This turned out to be because an additional 4 bytes needed to be allocated which Steve fixed. It never made it into the OpenBSD tree (only tested it on i386 and SPARC, it used strcpy() everywhere and didn’t run on SPARC) but it can be found in ports-wip. I then moved onto creating a live CD environment based on FreeBSD 6 using freesbie for advocacy purposes named BrightonChilli. The idea was to remove the hurdle of going through the installation process and provided an environment that just needed the configuration of network interfaces and chillispot. A person with previous experience of running chillispot would be familiar and a new user would not be too out of place.
This was in the days of X configuration being a part of sysinstall which could hang if Xconfigure was run and you’d have to start the install process again as the install was incomplete (for a newcomer). I was interviewed on BSDtalk #73 regarding BrightonChilli.

PierToPier also produced its own Linux image named Muddy Linux targeted for x86 hardware that ran the necessary stack to serve as a node on the network.
After Chillispot 1.1.0, the project went quiet, there was no answer from the founding developer for quite a while and eventually the web hosting stopped and the domain expired.
The community rehomed to coova.org and development continued in Coovachilli which was founded by David Bird, a contributor to Chillispot.
Coovachilli initially lacked support for FreeBSD but it was eventually added in by David and net-mgmt/coovachilli was born in ports. Not much else was done after that until a year ago. With FreeBSD 10 and the switch to clang, the codebase needed attention, first step was to get it to build correctly with GCC. The use of error_t from glibc caused the build to fail as it’s not available in FreeBSD, ensuring this was declared allowed the build to complete successfully. To resolve build issues with clang, nested functions were separated out. Any function with missing prototypes & parameter lists were addressed next.
struct ifreq had been marked as deprecated since 2000 and was finally removed in FreeBSD 10. The *BSD specific sections of Coova were switched out to the new struct ifaliasreq & Linux was left to use the pre-existing method. There was extensive use of macros for the logging functionality, these were dropped in favour of using the existing standard syslog(3) with the correct log level defined. This had the benefit of revealing issues which were not detected previously such as incorrect format specifiers.
There are still many things that need to be cleared up, the 3rd party functions added in are particularly problematic and will probably be my next task to replace with standard components.
CoovaChilli & Chillisport have seen large scale deployments thanks to use by Fon, o2 and Google which now owns Coova.

IMG_3250

Chillispot 1.1.0 for FreeBSD

I’ve finally gotten around to bringing the FreeBSD port of Chillispot up to date with the current release (v1.1.0).
As v1.1.0 is considered unstable it will not overwrite v1.0 which is currently in the tree, it will instead live alongside it in net-mgmt/chillispot-dev.
I have not had a chance to test this port with any wireless clients yet but it should work in theory, the only difference between this port & the initial patch I made to make it buildable is that I’ve used an alternative method for dealing with clearenv() as pointed out by Joe Marcus Clarke

Grab a copy of the first revision of the port here

Brighton Chilli 0.002-ALPHA Released

I finally managed to roll out a new release of Brighton Chilli, the new release contains the following fixes & additions:
Added support for WPA & 802.11i to the kernel
Added support for Atheros chipset cards to the kernel
Fixed a typo in chilli.conf (chilli should redirect to the right file now)
Patch for chillispots hotspotlogin.cgi to enable it to work with lighttpd
Move the cgi-bin directory to /var mfs so that it’s on a writable FS allowing hotspotlogin.cgi to be edited
Added chillispot to rc.conf
Serial console redirection now works
Changed the loader logo to beastie

Using Chillispot with Lightttpd

Whilst working on the next release of Brighton Chilli I found that if you attempt to use the stock hostspotlogin.cgi with lighttpd you’ll be presented with the following error message:
ChilliSpot Login Failed
Login must use encrypted connection.

Even though your server is setup correctly.
Apply this patch to your hostspotlogin.cgi & all should be well.

Brighton Chilli Is Born

I’ve made a Freesbie containing everything needed to get a chillispot based wifi hotspot up and running.

At the moment you need to tweak some of the config files by hand but I will hopefully manage to automate everything withing the next couple of releases

Check it out here

Chillispot PF Config & More

I have just submitted a PR to update my port for FreeBSD
The update contains a Install guide which covers install & config of Chillispot, Apache 1.3.x with mod_ssl, MySQL 4.1.x & freeRADIUS + A sample PF config file aswell as a IPFW config file & a RC startup script.
If you can’t wait till it’s merged into the tree you can grab a copy of the port from here

Running Chillispot on OpenBSD, NetBSD & Mac OS X

*** 08/07/06 – Update, the patch just allows Chillispot to build successfully, tun.c needs some more patching before chillispot will work. Sorry 🙁 ***

I have made a patch which will enable Chillispot compile & run on OpenBSD, NetBSD & Mac OS X.

The patch has been tested working on the following versions of O/S’s
OpenBSD 3.9
NetBSD 3.0-STABLE & -CURRENT
Mac OS X 10.4.7
though it should work on previous versions aswell.

To build Chillipot 1.0 first download & extract Chillispot.
Then copy the patch into the Chillispot directory & issue:
patch -p1 < chillispot -1.0.patch

You should get the following result:
patching file src/chilli.c
patching file src/dhcp.c
patching file src/redir.c
patching file src/syserr.c
patching file src/tun.c

For NetBSD & OpenBSD:
Now run ./configure with the relevant switches e.g.
./configure --sysconfdir=/etc --localstatedir=/var
then for OpenBSD: run make install chilli_LDFLAGS=""

For Mac OS X:
Run make install chilli_LDFLAGS="-lcrypto -lresolv"
If compiling fails with the following error:
redir.c: In function 'redir_accept':
redir.c:1400: error: nested functions are not supported on MacOSX
redir.c:1406: error: nested functions are not supported on MacOSX
make[2]: *** [redir.o] Error 1
make[1]: *** [all-recursive] Error 1
make: *** [all] Error 2

then you’re using GCC 4.0.1, use gcc_select to switch to GCC 3.3 by running gcc_select 3.3 then rerunning make. When you’re done you can switch back to GCC 4 by running gcc_select 4.0 surprise surprise!!! 🙂