How I saved my Raspberry IoT Edge host going into Denial-Of-Service (DoS) mode

Setup of IoT system

I was using a Raspberry-Pi #B (35$ ARM processor, RPi) for home autoamation running as edge router/server . I have a customized golang server that connects to my IoT sensors and updates to postgres DB (previously I used TICK stack , but I had Influxdb corruption issues, so I switched to postgres DB). All of these apps are hosted in docker-instances inside the RPi.  I still use Graphana as front-end GUI (after I added the postgres as datasource to Grapahana). 

Disk configuration to separate OS with applications

To safegaurd RPi going to Denial-Of-Service mode due to root disk-starvation, I have used extra USB-stick for customized-Apps, Postgress DB, Graphana and other docker instances. In this way, if any applications (including graphana, postgres, influx,  customized apps) fills-up disk , one can still access RPi as RPi's SD-Card  is still in good-shape (wrt to disk space).

Telegram-Bot integration

Recently I have added support for Telegram-Bot integration with my RPi , so that I can communicate to my RPi outside my home WiFI network. The integration went well and I can issue commands from Telegram app and handle in RPi (evetually I can reach my sensors). 

Telegram-Bot transient error cauing DoS situation

Everything went fine till I switched off my home WiFi network in home. The moment I switched off WiFi network, the third party Telegram-Bot framework started to fills up the USB-Disk (which is shared by docker instances, customized apps,etc) as my customized-app's stdout/stderr are routed to USB-disk (for debugging/post-mortem-analysis). Within 12 hours of night time, 8GB of data is filled up. If this fillup is continued, within another 12 hours all of my docker instances (postgres, graphana and my customized app will have DoS siatuation.

Solution

To mitigate the above DoS situation, I could route the stdout/stderr to /dev/null, but I will lose information in case of critical errors(apart from this error) from third-party-code-bases and any unhandled golang's stack-traces and panic outputs.

For handling all the above tricky situations, I have written small golang application named safeout that consumes stdout/stderr of any number of processes and redirects the output of each stdout/stderr into disk-files with checks on maximum size (with one backup file). 

I configured my customized application with above safeout . Now myApp (or any other app in docker instance ) starts redirecting  stdout/stderr to disk, they will not fill-up disk (as safeout will ensure maximum disk space limits are honored with one backup copy)

safeout Code is at Safeout

5$ TV Remote Control Using Smart Phone

I have following goals for controlling my Infrared Controlled Appliances:

• Towards the goal of the controlling my TV, Set-Top-Boxes,AC,etc, at lower cost less than 5$ (or even go less in case one has  more IR appliances or one has already a raspberry/chip in home for Home Automation/IoT works) per device. I am leaving the cost of central controller, whose cost would be around 9$.
• Design/Develop an Open Sourced system like LIRC project that controls the IR appliances using smartphone and WiFi(there by avoiding line of contact issues in IR based remote controls)
• Make any old TV(including CRT TV and LED TVs that are not smart TVs,etc) to be  controlled from any smart phone
• Also ensure that smartphone SHOULD not require  IR  based emitter (as smartphones with IR transmitter are little costlier)

To achieve these goals,  I have designed and tested initial version of my Centralized Home IR Appliances control system that can adapt and control different IR appliances at very cheap cost. The system has following features:

• It is cheap
• It Generic and one can add any number of IR devices
• All one has to for adding new IR appliance is to add the IR codes in form of property file
• Works with most of the smartphone (at present only android phones)
• Gives generic REST based interfaces to control these appliances (TODO)
• Gives generic RBAC control of these IR appliances (TODO)

For implementing initial working prototype, I chose:

• Common costs for all IR appliances in a Home
• 9$ Chip Computer as central control system where all Smart Phones sends commands . This device is common for all IR appliances in home (that are in same WiFi network). Though  I have chose 9$ chip-computer, once can use Raspberry-PI or any computer that run python.

2A Power supply for each IR transmitter 2$ (approximate)

• Per IR appliance costs for IR Transmission
• For each IR appliance, I have put one ESP8266 device to send IR commands (which costed me 2.82$). For each IR appliance , we need to this board (in case if both appliances are not in same IR visibility)
• I bought one IR Transmitter for 1.1$ (approximate) 
• Power supply for each IR transmitter 1.1$ (approximate)

At present the system control my TV and set-top-box. In future, I am going add more devices like my LG-Air-Conditioner

I have put code in 3 projects in Git-Hub:

• Java based SW application named TVRemote ( Android Application that controls my TV and my set-top-box)
• C++ Based embedded Firmware Infrared-Command-Sender for sending IR based commands from ESP8266 
• Python-Based Centralized Server for controlling all IR appliances running on 9$ Chip computer

Get Current Time from Bed while sleeping (without seeing Watch/Phone) by simple Hand waving

As a part of  Home Automation jobs, one of my use case is:

• Know the current time in night (in pitch dark room)
• with following requirements
• I am still sleeping 
• I don't want to open my eyes for seeing time on watch/phone
• My phone or watch are 4 meters from bed, I don't want to go to that place to pickup phone/watch

So thought that let me use latest hot/cheap wifi-chip ESP8266 (NodeMCU version) to do this job.

I used a Passive Infrared Sensor (PIR - ~1$) , ESP8226-NodeMCU-Board ( ~4$) and Android phone (~your capacity)  for this purpose.

• PIR 
• Will sense any movement. I had kept this sensor at back of bed. If I wave my hand near PIR sensor, it will sense and give input to ESP8266 Chip
• ESP8266
• This will work as WiFi Access Point for Android mobile
• Runs embedded firmware to sense the PIR reading & debouncing the PIR signal
• Sends a HTTP call to Android Phone for speaking the time 
• Android Phone
• It will connect to WiFi-AP (from above ESP8266 )
• It works as HTTP-Server for requests from ESP8266
• It will run a Speaker service for any incoming requests from ESP8266
• Ensure that works when phone in deep sleep mode

I have finished 3rd version of the code (FW at ESP8266 & Android-App in Smartphone). I will put code and pictures in the weekend.

Launchpad can survive on 1000mAh LiPo battery for 1.5 years with Radio Link to RPi board

So after last few days of work on data serialization across Rpi & LaunchPad (MSP430G2553), I integrated the Serialization library that sends couple of 32-bit /16-bit integers from MCU to RPi via NRF24L01+ chip.

Initially MCU was raking around 230uA current . After some tweaking, it came down 130uA .

As final optimization (for this round of testing), I shutdown the NRF24L01+ chip till next time radio-packet-transmission. This step lead to MCU current consumption of 25uA . So in this period (approximate 12 seconds) MCU is in LPM3 sleep-state and radio is in shutdown-state. When MCU wakes-up, it activates NRF chip again & sends radio-packets, during this tx-period, it takes around 400uA for a breif period.


So taking on average current consumption of 50uA (including radio-packet-tx current bump), using battery life calculator for 1000mAh LiPO battery's life is around 14000hours (583 days). Not bad for a starter project :)

I have just documented the initial video for the same at youtube .


I will be submitting the code in github in coming days after stabilization and cleanups.
I will do same test for MSP430F5969 (FRAM board with Super capacitor on it).

Finally able to make Raspberry to talk to MSP430 via NRF24L01+

As a part of my future IoT projects, I was trying to create reusable libraries and utilities for Arduino, MSP430, PIC, Freescale and STM32 processors using Nordic NRF24L01+ wireless transceiver chip. Ultimate goal is to make cheap sensors (that cost less than 7 to10$ including sensors & batteries) that could be deployed in any IoT, HomeAutomation, etc projects. I was planning to use Raspberry (or any cheap Linux board or cheap Android sticks -- future goal)  as my central observer of these cheap nodes.

Here are some  major tasks that were necessary (apart from HW):

• Circuit diagrams that make connectivity
• FW for Linux box and MCUs
• A Data Serialization library for MCUs and Linux box

After lots of trials and tribulations (with limited amount free time after my office/home jobs), I was able to talk Raspberry with following devices (in initial setup scenarios):

• MSP430 LaunchPad with MSP430G2553
• MSP430FR5969 LaunchPad

Idea is to make Raspberry as to receive the radio packets from all sensors ( MSP430s, Arduinos, PICs,etc) and this Raspberry connected to network via LAN and WiFi.

As a next step for proper communication along these wide variety of MCUs with different endianness, I need to create small library in C/C++ for packing all types integers (uint8_t, int8_t, uint16_t, int16_t, uint32_t, int32_t ) and chars.  As I could not get this from web (with whatever search strings I gave), so I created  small library for doing this job. At present this works on Linux (so that Raspberry can understand what wireless nodes are sending), MSP430G2553 and MSP430FR5969. All UT was done for most generic corner cases, I shall be using this for my home IoT framework.

Once I finish more tests and my system, I will publish code at github:

• Raspberry to MSP430G2553 
• Raspberry to MSP430FR5969
• Generic C based Data-Serialization library for Linux/MCUs

I will also publish circuit diagrams for:

• Raspberry to NRF24L01+
• MSP430FR5969 to  NRF24L01+
• MSP430G2553 to  NRF24L01+

Able to deploy POCO framework on OpneWRT on AWM002

After successfully installing the OpenWRT linux kernel on AWM002, I configured the OpenWRT build system to have following functionality:

• GPIO functionality exposed via Linux Kernel GPIO export route.
• Configured OpenWRT build system to include POCO C++ framework 
• Create an directory-entry in OpenWRT build root package/libs/poco/
• Copied all files (actually 2 files)  from  OpenWRT package repo
• Configured to Linux menuconfg to include to build following libraries
• librt
• libstdc++
• libPoco*
• My kernel config file

AWM002 booting OpenWRT kernel via tfftp

After successfully made the AWM002 up, I want to load OpenWRT kernel on the same module.

To do that we need to do following:

• Ensure that you have setup LAN and connected to PC 
• On PC  tftp server shouble be  running at port 69
• Ensure that you load your OpenWRT kernel image in root directory (let us say your image name is '/linux_sep_11'
• You may use OpenWRT kernel from following link
• If you have any firewall, disable it for the time being.
• In Fedora, you can do that by 'service iptables stop'
• Ensure that you have setup serial cable and connected to PC . Ensure that you open a serial terminal and be sure that you have connected to device
• Now power cycle the board
• At the same time, press 4 in serial terminal. This should lead to U-Boot prompt 'RT5350 # '
•  Issue following command to see environment:
• RT5350 # printenv
• bootcmd=tftp
• bootdelay=5
• baudrate=57600
• ethaddr="00:AA:BB:CC:DD:10"
• stdin=serial
• stdout=serial
• stderr=serial
• ipaddr=10.10.10.254 <== this might be different like 192.168.x.x (module ip)
• serverip=10.10.10.1   <== this might be different like 192.168.x.x (PC ip)
• Now change 'ipaddr' and 'serverip' to reflect above values, by following UBoot commands
• setenv ipaddr 10.10.10.254 
• setenv serverip 10.10.10.1
• Also add extra (undocumented help option ) like (this will help to point to  '/linux_sep_11', otherwise tftp booting will point to 'test.bin' file ). OTOH, you can rename your '/linux_sep_11' to test.bin (to avoid this extra bootfile setting)
• setenv  bootfile /linux_sep_11
• printenv command should show all changed values
• Now save values to flash by 'saveenv' command
• Ensure that these values are persistent (check by using 'printenv' command
• Now power-cycle and press 2 (on serial console to get U-Boot access) to get image from tftp-server.It will ask for confirmation to overwrite flash. Say yes & finally you see OpenWRT booting up.
• 
  
• WARNING:  Please keep in mind that you may end bricking up your module in doing these activities and I am no way responsible for that :) . BTW, with these steps on my environment, I have not bricked my AWM002 module

AWM002 serial bootup output

• Ensure that you have cutecom is installed for GUI-based terminal viewer.
• Configure for 57600 baud for Serial port parameter and chose appropriate serial port (some thing like /dev/ttyUSB0  -- see dmesg output)
• Power up AWM002 module

You can see following output from serial console

U-Boot 1.1.3 (Jul 29 2013 - 10:29:51)


Board: Ralink APS
oC DRAM:  32 MB

relocate_code Pointer at: 81fb4000

******************************

Software System Reset Occurred

******************************

spi_wait_nsec: 42 

spi device id: c2 20 17 c2 20 (2017c220)

find flash: MX25L6405D

raspi_read: from:30000 len:1000 

.*** Warning - bad CRC, using default environment


============================================ 

Ralink UBoot Version: 4.1.0.0

-------------------------------------------- 

ASIC 5350_MP (Port5<->None)

DRAM_CONF_FROM: Boot-Strapping 

DRAM_TYPE: SDRAM 

DRAM_SIZE: 256 Mbits

DRAM_WIDTH: 16 bits

DRAM_TOTAL_WIDTH: 16 bits

TOTAL_MEMORY_SIZE: 32 MBytes

Flash component: SPI Flash

Date:Jul 29 2013  Time:10:29:51

============================================ 

icache: sets:256, ways:4, linesz:32 ,total:32768

dcache: sets:128, ways:4, linesz:32 ,total:16384 


 ##### The CPU freq = 360 MHZ #### 

 estimate memory size =32 Mbytes


Please choose the operation: 

   1: Load system code to SDRAM via TFTP. 

   2: Load system code then write to Flash via TFTP. 

   3: Boot system code via Flash (default).

   4: Entr boot command line interface.

   7: Load Boot Loader code then write to Flash via Serial. 

   9: Load Boot Loader code then write to Flash via TFTP. 


\0x08\0x08\0x08 4 
\0x08\0x08\0x08 3 
\0x08\0x08\0x08 2 
\0x08\0x08\0x08 1 
\0x08\0x08\0x08 0 

   

3: System Boot system code via Flash.

## Booti
ng image at bc050000 ...

raspi_read: from:50000 len:40 

.   Image Name:   Linux Kernel Image

   Image Type:   MIPS Linux Kernel Image (lzma compressed)

   Data Size:    3830574 Bytes =  3.7 MB

   Load Address: 80000000

   Entry Point:  802cf000

raspi_read: from:50040 len:3a732e 

..........................
.................................   Verifying Checksum ... 
OK

   Uncompressing Kernel Image ... 
OK

No initrd

## Transferring control to Linux (at address 802cf
000) ...

## Giving linux memsize in MB, 32


Starting kernel ...



LINUX started...

 THIS IS ASIC
Linux version 2.6.21 (ray@asiarf-Aspire-S3) (gcc version 3.4.2) #334 Tue Nov 26 14:28:26 CST 2013

 The CPU frequency set to 360 MHz
CPU revision is: 0001964c
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Built 1 zonelists.  Total pages: 8128
Kernel command line: console=ttyS1,57600n8 root=/dev/ram0
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
cause = 40808008, status = 11000000
PID hash table entries: 128 (order: 7, 512 bytes)
calculating r4koff... 000000c8(200)
CPU frequency 0.05 MHz
Using 0.050 MHz high precision timer.
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 26652k/32768k available (2198k kernel code, 6116k reserved, 673k data, 2856k init, 0k highmem)

Mount-cache hash table entries: 512
NET: Registered protocol fa
mily 16
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
deice id : c2 20 17 c2 20 (2017c220)
MX25L6405D(c2 2017c220) (8192 Kbytes)
mtd .name = raspi, .size = 0x00800000 (8M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
Creating 5 MTD partitions on "raspi":
0x00000000-0x00800000 : "ALL"
0x00000000-0x00030000 : "Bootloader"
0x00030000-0x00040000 : "Config"
Time: MIPS clocksource has been installed.
0x00040000-0x00050000 : "Factory"
0x00050000-0x01000000 : "Kernel"
mtd: partition "Kernel" extends beyond the end of device "raspi" -- size truncated to 0x7b0000
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
detected lzma initramfs
detected lzma initramfs
initramfs: LZMA lc=3,lp=0,pb=2,dictSize=1048576,origSize=12314112
LZMA initramfs by Ming-Ching Tiew .............
............................................................
............................................................
.......................................................RT3xxx E
HCI/OHCI init.
fuse init (API version 7.8)
io scheduler noop registered (default)
Ralink gpio driver initialized

HDLC line discipline: version $Revision: 1.1.1.1 $, maxframe=4096

N_HDLC line discipline registered.
Serial: 8250/16550 driver $Revision: 1.9 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A
serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A
RAMDISK driver initialized: 16 RAM disks of 16384K size 1024 blocksize
loop: loaded (max 8 devices)
rdm_major = 253
Ralink APSoC Ethernet Driver Initilization. v2.1  256 rx/tx descriptors allocated, mtu = 1500!
MAC_ADRH -- : 0x0000000c
MAC_ADRL -- : 0x43305077
PROC INIT OK!
PPP generic driver version 2.4.2
PPP BSD Compression module registered
NET: Registered protocol family 24
PPPoL2TP kernel driver, V0.17
PPTP driver version 0.8.1
block2mtd: version $Revision: 1.1.1.1 $
rt3xxx-ehci rt3xxx-ehci: Ralink EHCI Host Controller
rt3xxx-ehci rt3xxx-ehci: new USB bus registered, assigned bus number 1
rt3xxx-ehci rt3xxx-ehci: irq 18, io mem 0x101c0000
rt3xxx-ehci rt3xxx-ehci: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected

rt3xxx-ohci rt3xxx-ohci: RT3xxx OHCI Controller
rt3xxx-ohci 
rt3xxx-ohci: new USB bus registered, assigned bus number 2
rt3xxx-ohci rt3xxx-ohci: irq 18, io mem 0x101c1000
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
nf_conntrack version 0.5.0 (256 buckets, 2048 max)
ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Restricted Cone
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 10
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear 
All bugs added by David S. Miller 

Freeing unused kernel memory: 2856k freed

init started: BusyB
ox v1.12.1 (2013-10-15 14:30Algorithmics/MIPS FPU Emulator v1.5
:14 CST)

starting pid 629, tty '': '/etc_ro/rcS'
devpts: called with bogus options
Welcome to
     _______  _______  ___     __  ____   _  _   ___
    |  ___  \|   __  ||   |   |__||    \ | || | /  /
    | |___| ||  |__| ||   |__  __ |     \| || |/  /
    |   _   /|   _   ||      ||  || |\     ||     \
    |__| \__\|__| |__||______||__||_| \____||_|\___\

   \0x09             =System Architecture Department=


starting pid 638, tty '/dev/ttyS1': '/bin/sh'


BusyBox v1.12.1 (2013-10-15 14:30:14 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

# ralink_gpio: sending a SIGUSR1 to process 633

internet.sh

Password for 'admin' changed

rmmod: ralink_wdt: No such file or directory
rmmod: cls: No such file or directory
rmmod: hw_nat: No such file or directory
rmmod: raeth: No such file or directory
insmod: bridge.ko: module not found
insmod: mii.ko: module not found
insmod: raeth.ko: module not found


##### disable 1st wireless interface #####
rmmod: rt2860v2_a
p_net: No such file or directory
rmmod: rt2860v2_ap: No such file or directory
rmmod: rt2860v2_ap_util: No such file or directory

rt2860v2_ap: module license 'unspecified' taints kernel.


==
= pAd = c0002000, size = 805120 ===

<-- --="" -="" -f="" -t="" 00="" 01="" 0="" 0x0000000c="" 0x1300="00064380" 0x43305077="" 0x8913="" 0x8914="" 1.="" 1="" 2.="" 20mhz.l="" 2="" 3.="" 3100="" 3900="" 8021q.ko:="" 8021q:="" :="" a0493000="" address="" argument="" assign="" bbp="" be="" blinks="" br0:="" brctl:="" bridge="" bssid="00:0c:43:30:50:90" can="" cannot="" change="" changed="" config="" desc="" detected="" dev_set_promisc="" device="" directory="" do="" does="" done.="" entered="" entering="" error="" esw="" etc="" eth2.1:="" eth2.1="" eth2="" exist="" failed:="" file="" filter="" for="" forwarding="" found="" ifconfig:="" initialize="" insmod:="" insmod="" inva="" invalid="" ioctl="" iptable="" iptables="" is="" kernel="" key1str="" key2str="" key3str="" key4str="" key="" killall:="" killed="" learning="" led="13," length="" lid="" link="" mac_adrh="" mac_adrl="" main="" mangle="" master="" mcs="" mode="" module="" need="" needs="" nf_con="" nf_conntrack_proto_gre:="" nf_nat_pptp:="" nf_nat_proto_gre:="" no="" not="" ntrack_pptp:="" off="4000," offset="70," on="1," or="" partition="" perhaps="" ph="" phy="" phy_rx_ring="" phy_tx_ring="0x016f2000," port="" process="" promiscuous="" propagating="" r4="" ra0="" radvd.conf="" ralink="" reg="" rem:="" remove="" requested="" reset="1," rm:="" rmmod:="" rt28xx_init="" rt305x_esw:="" rtmpallocadapterblock="" rtmpalloctxrxringmemory="" rx="" rx_ring0="0xa16f3000" s="" set:="" set="ff" size="2048" stat="" state="" status="" such="" switch="" sync="" t="" table="" time="4000" to="" topology="" tx_ring="0xa16f2000" type="" udhcpd:="" uity="" upgraded.="" us="" v1.3.5:="" value="ffff506f" vconfig:="" vlan="" write="" x_esw:="" y="" you="" your="">/dev/null 2>&1
iptables -D FORWARD -j macipport_filter 1>/dev/null 2>&1
iptables -F macipport_filter 1>/dev/null 2>&1
iptables -D FORWARD -j web_filter  1>/dev/null 2>&1
iptables -F web_filter  1>/dev/null 2>&1
iptables -D FORWARD -j malicious_filter 1>/dev/null 2>&1
iptables -F malicious_filter  1>/dev/null 2>&1
iptables -D INPUT -j malicious_input_filter 1>/dev/null 2>&1
iptables -F malicious_input_filter  1>/dev/null 2>&1
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -t filter -N web_filter 1>/dev/null 2>&1
iptables -t filter -N macipport_filter 1>/dev/null 2>&1
iptables -t filter -N malicious_filter 1>/dev/null 2>&1
iptables -t filter -N synflood_filter 1>/dev/null 2>&1
iptables -t filter -N malicious_input_filter 1>/dev/null 2>&1
iptables -t filter -N synflood_input_filter 1>/dev/null 2>&1
iptables -t filter -A FORWARD -j web_filter 1>/dev/null 2>&1
iptables -t filter -A FORWARD -j macipport_filter 1>/dev/null 2>&1
iptables -t filter -A FORWARD -j malicious_filter 1>/dev/null 2>&1
iptables -t filter -A malicious_filter -p tcp --syn -j synflood_filter 1>/dev/null 2>&1
iptables -t filter -A INPUT -j malicious_input_filter 1>/dev/null 2>&1
iptables -t filter -A malicious_input_filter -p tcp --syn -j synflood_input_filter 1>/dev/null 2>&1
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 1>/dev/null 2>&1
iptables -A malicious_input_filter -i eth2.2 -p tcp --dport 80 -j DROP
/bin/super_dmz -f
sh: /bin/super_dmz: not found
iptables -t nat -D PREROUTING -j port_forward 1>/dev/null 2>&1
iptables -t nat -F port_forward  1>/dev/null 2>&1; iptabl
es -t nat -X port_forward  1>/dev/null 2>&1
iptables -t nat -D PREROUTING -j DMZ 1>/dev/null 2>&1
iptables -t nat -F DMZ 1>/dev/null 2>&1; iptables -t nat -X DMZ  1>/dev/null 2>&1
cat /proc/sys/net/netfilter/nf_conntrack_udp_timeout > /var/.udpbackup
echo 0 > /proc/sys/net/netfilter/nf_conntrack_udp_timeout
cat /var/.udpbackup > /proc/sys/net/netfilter/nf_conntrack_udp_timeout; rm -f /var/.udpbackup
cat /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_established > /var/.tcpbackup
echo 0 > /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_established
cat /var/.tcpbackup > /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_established; rm -f /var/.tcpbackup
iptables -t nat -N port_forward 1>/dev/null 2>&1; iptables -t nat -I PREROUTING 1 -j port_forward 1>/dev/null 2>&1
iptables -t nat -N DMZ 1>/dev/null 2>&1; iptables -t nat -I PREROUTING 2 -j DMZ 1>/dev/null 2>&1
ntp.sh
ddns.sh
kill -9 `cat /var/run/wscd.pid.ra0`
cat: can't open '/var/run/wscd.pid.ra0': No such file or directory
kill: you need to specify whom to kill
iwpriv ra0 set WscConfMode=0 1>/dev/null 2>&1
route delete 239.255.255.250 1>/dev/null 2>&1

killall -q klogd
killall -q syslogd
syslogd -C8 1>/dev/null
 2>&1
klogd 1>/dev/null 2>&1
killall -q zebra
killall -q ripd
echo 0 > /proc/sys/net/ipv6/conf/all/forwarding
webs: Listening for HTTP requests at address 10.10.10.254

fetchSmbConfig: No such file or directory

killall -q -USR1 udhcpd

Setting up busybox for AWM002 board

After successfully booting up AWM002 module, I found that busybox shell provided in default FW is very old and restricted one.


# /bin/ls --help
BusyBox v1.12.1 (2013-10-15 14:30:14 CST) multi-call binary

Usage: ls [-1AaCdilnsTwxk] [filenames...]

So I tried to upload latest busybox from busybox-site. After downloading the busybox mips-binary, we need to upload to AWM002 module. On stock FW, no FTP/SSH services are available. So we need to setup AWM002 to have FTP server (from default 

# /bin/proftpd.sh server awm002 10.10.10.254 21 5

...

Some iptable 'raw' module errors (ignore them for the time being)

# /bin/proftpd

Above command should start proftpd on AWM002 module

From PC, FTP the MIPS-binary busybox-mipsel (in binary mode)  to /tmp (for example)

Now log into AWM002 module by telnet/serial cable and issue following commands:

# cd /tmp

# chmod 755 busybox-mipsel

# mkdir /root

# mkdir /root/bin

# /tmp/busybox-mipsel --install -s /root/bin 

Copy following contents to /.profile

export PATH=/root/bin:$PATH

Log off from AWM002 and login & you will have more latest & unrestricted busybox binary on PATH will all commands. 

Note: Keep in mind that /.profile, /root/ and  /root/bin and trasient & they will go off once you reboot module

Home Access Control System

I was planning a Home Access Control System for lots of days. Finally got some time over past few months. Finally I finished version-2 of my Home Access Control System.

Current version uses Raspberry for controlling the Main Door lock. Client are: Smartphones and RFID keys.

At present, I have written Android client for controlling. But the system is capable to handle iOS/WinPhones.

I will add more photos and code in coming weeks. More info can be found at at this place