English (unofficial) translations of posts at kexue.fm
Source

Moving into Sun Yat-sen University South Campus and Tinkering with the Campus Network

Translated by DeepSeek V4 Pro. Translations can be inaccurate, please refer to the original post for important stuff.

Jianlin Su September 5, 2016 #3936

Starting my journey as a graduate student, I hope one day to reach the level of the "Sweeping Monk" (a legendary hidden master).

After entering Sun Yat-sen University (SYSU), various frustrating things began to happen. First and foremost is the extremely early start date; school started on August 26th, which feels at least a week earlier than most other universities. I wonder what the point of starting so early is. Next is the feeling that SYSU’s management system is quite chaotic, far worse than my undergraduate institution, South China Normal University (SCNU). Anyway, I won’t complain about these trivial matters for now. Next, I had to set up the campus network, which was the beginning of a real struggle.

We are located at the South Campus, where the campus network is authenticated via the Ruijie client. I use a MacBook, and fortunately, SYSU quite humanely provides a Mac version of Ruijie, which is only about 1MB in size—quite nice. However, as everyone knows, MacBooks do not have a built-in Ethernet port. Every time I want to go online, I have to plug in a USB network adapter and connect a network cable, which is very annoying. Therefore, I wanted to find a way to dial in through a router. I’m not exactly inexperienced; I’ve done some research on the OpenWrt system. Back in my undergraduate days, we also used Ruijie, and I could use MentoHUST as a substitute for dialing, which was very simple. However, when I repeated that process here, I found that authentication failed consistently. I tried various methods suggested online, but none could solve the problem.

After some research, I discovered that under Windows, only the official Ruijie version 4.90 provided by the school works here. Higher or lower versions of Ruijie downloaded from elsewhere fail the verification. I suspect it is this mechanism that makes it difficult for MentoHUST to pass authentication. Furthermore, the popular versions of MentoHUST are based on the V2 protocol, while version 4.90 is based on V4. Later, I downloaded the V4 version for cross-compilation, but tests showed it still didn’t work. Just as I was nearing despair, I discovered mentohust-proxy, an improved version of MentoHUST that gave me hope. (How did I find it? I searched directly on GitHub because I was truly out of options.)

The principle is simple: if MentoHUST cannot complete the authentication directly, it uses a proxy mode. The computer completes the authentication, and MentoHUST is only responsible for sending heartbeat packets to maintain the connection. This is a compromise, but it should be a very universal solution because its success basically depends only on your own computer’s Ruijie client. Seeing this plan, I knew there was a chance. I quickly brushed up on my cross-compilation knowledge, successfully compiled it, and finally completed the authentication on the router.

Cross-Compilation

My environment is CentOS 7. First, install the environment dependencies. These dependencies were found online, and I’m not sure if they are complete; if it doesn’t work, please leave a comment. You can find many related links by searching for "OpenWrt compilation."

sudo yum install autoconf binutils bison bzip2 flex gawk gcc gcc-c++ gettext make ncurses-devel patch unzip wget zlib-devel curl curl-devel openssl-devel perl perl-devel cpio expat-devel gettext-devel xz openssh-clients cmake libtool

Download the SDK package to the home directory. My router uses the common MT7620n scheme, so I downloaded the one for mt7620:

cd ~
wget https://downloads.openwrt.org/chaos_calmer/15.05.1/ramips/mt7620/OpenWrt-SDK-15.05.1-ramips-mt7620_gcc-4.8-linaro_uClibc-0.9.33.2.Linux-x86_64.tar.bz2
tar jxvf OpenWrt-SDK-15.05.1-ramips-mt7620_gcc-4.8-linaro_uClibc-0.9.33.2.Linux-x86_64.tar.bz2
mv OpenWrt-SDK-15.05.1-ramips-mt7620_gcc-4.8-linaro_uClibc-0.9.33.2.Linux-x86_64 op

Download libpcap. I will compile the dependency library libpcap directly into it to avoid manual installation.

wget http://www.tcpdump.org/release/libpcap-1.7.4.tar.gz
tar zxvf libpcap-1.7.4.tar.gz

Download mentohust-proxy:

git clone https://github.com/updateing/mentohust-proxy.git

Configure environment variables (here /home/job is my home directory):

export PATH=$PATH:/home/job/op/staging_dir/toolchain-mipsel_24kec+dsp_gcc-4.8-linaro_uClibc-0.9.33.2/bin:/home/job/op/staging_dir/host/bin
export STAGING_DIR=/home/job/op/staging_dir

The rest of the process is similar to normal compilation, but with the added host=mipsel-openwrt-linux-uclibc parameter. First, compile libpcap:

cd libpcap-1.7.4
./configure --host=mipsel-openwrt-linux-uclibc --with-pcap=linux
make

Then compile mentohust-proxy:

cd ../mentohust-proxy
sh autogen.sh
./configure --host=mipsel-openwrt-linux-uclibc --disable-encodepass --disable-notify --with-pcap=/home/job/libpcap-1.7.4/libpcap.a
make

The mentohust file in the src directory is the final compiled binary.

Completing Authentication

Download the mentohust binary and upload it to the router. You can first try if MentoHUST can complete the authentication directly. If not, use the proxy authentication. By the way, this upgraded version of MentoHUST is more user-friendly. Below is its help file:

>>> mentohust -h
Welcome to MentoHUST Version: 0.3.1
Copyright (C) 2009-2010 HustMoon Studio
Coming to HUST, there is both sweetness and spice. A land of virtue and profound learning, a home for seeking truth and innovation.
802.1x proxy and other new features by Hamster Tian 2015-2016.
Bug report to http://code.google.com/p/mentohust/issues/list

Usage: ./mentohust [-option][parameter] or [-option] [parameter] or [–long-option] [parameter]
Options:
–help -h Display this help information
–kill -k -k(Exit program) Others(Restart program)
–write -w Save parameters to configuration file
–username -u Username
–password -p Password
–nic -n Network interface name
–ip -i IP [Default: local IP]
–mask -m Subnet mask [Default: local mask]
–gateway -g Gateway [Default: 0.0.0.0]
–dns -s DNS [Default: 0.0.0.0]
–ping-host -o Ping host [Default: 0.0.0.0, means disabled]
–auth-timeout -t Auth timeout (seconds) [Default: 8]
–heartbeat -e Heartbeat interval (seconds) [Default: 30]
–wait-after-fail -r Wait after failure (seconds) [Default: 15]
–max-fail -l Max allowed failures [0 means unlimited, Default: 8]
–no-auto-reauth -x Auto-reconnect after drop: 0(No) 1(Yes) [Default: 1]
–eap-bcast-addr -a Multicast address: 0(Standard) 1(Ruijie) 2(Cernet) [Default: 0]
–dhcp-type -d DHCP mode: 0(None) 1(Secondary) 2(After Auth) 3(Before Auth) [Default: 0]
–daemonize -b Run in background: 0(No) 1(Yes, no output) 2(Yes, keep output) 3(Yes, output to file) [Default: 0]
–fake-supplicant-version -v Client version number [Default: 0.00 for xrgsu compatibility]
–template-file -f Custom data file [Default: none]
–dhcp-script -c DHCP script [Default: dhclient]
–proxy-lan-iface -z LAN interface to listen for auth packets in proxy mode (Setting this enables proxy mode)
–proxy-require-success -j Number of Success packets needed before closing LAN listener in proxy mode [Default: 1]
–decode-config -q Show content of SuConfig.dat (e.g., -q/path/SuConfig.dat)
–max-retries Max retries before auth result, 0 means infinite [Default: 0]

Example: ./mentohust -u username -p password -n eth0 -i 192.168.0.1 -m 255.255.255.0 -g 0.0.0.0 -s 0.0.0.0 -o 0.0.0.0 -t 8 -e 30 -r 15 -a 0 -d 1 -b 0 -v 4.10 -f default.mpf -c dhclient

About Proxy Mode: In this mode, MentoHUST will not initiate authentication itself. Instead, it modifies the source MAC of authentication packets captured on the LAN and forwards them to the WAN, allowing the local machine to pass authentication. In proxy mode, username, password, and reconnection settings (-u, -p, -x) are invalid and need not be specified. Since the Start packet is self-constructed, DHCP mode and multicast address (-d, -a) still need to be specified.

Proxy Mode Example: ./mentohust –proxy-lan-iface br0 –nic eth0 –eap-bcast-addr 1 –dhcp-type 2 -proxy-require-success 2
Note: Please ensure it is run with root privileges!

First, connect the campus network cable to the router’s WAN port, then connect the computer to the LAN port (WiFi also works). Start the command on the router:

./mentohust --proxy-lan-iface br-lan --nic eth0.2 --eap-bcast-addr 0 --dhcp-type 2

Then use the Ruijie client on the computer to dial in. You will see that the router shows a successful dial-in. To keep MentoHUST running, you can use screen or simply use the -b parameter. Now, you can enjoy WiFi.

Next Steps

There are many more things to do next, such as intranet penetration, SSH proxying, resource sharing, etc.

Compiled program, available for MTK series routers: mentohust_mtk.zip