DD-WRT has open holes in firewall

[Chess]

A recent discussion on my LUG mailing list raised some disturbing questions about the DD-WRT firmware for the Linksys WRT54G and other routers. Apparently, the developers have inserted code into the firmware to open up certain ports for their customers, and then forget to take out this code when making a final release for the public. Thus, several released versions of the firmware had iptables rules with hard-coded IP's that opened up ports to those ip's. The developers have fixed this problem, but given that DD-WRT is pretty popular, there are probably many routers out there still running the older version.

Here is the start of the ML thread that shows the output of iptables -L -n on a new install:

http://www.trilug.org/pipermail/trilug/ ... 55541.html

here is a post on the DD-WRT forums about it:

http://www.dd-wrt.com/phpBB2/viewtopic.php?t=35783

I think this is a pretty big problem and probably should get some exposure out there to let other DD-WRT users know about it.

[greggh]

I was looking into dd-wrt recently and came across this...

http://www.bitsum.com/about-ddwrt.htm

DD-WRT - An affront to the good will of the F/OSS community

Instead of giving credit where credit is due, Brainslayer has changed strings in the software to in an attempt to hide the true authors of programs simply because he, or someone, changed a handful of lines of code amongst tens of thousands. Consider Busybox, which is the single component responsible for implementing almost all core system utilities and the system shell. Its shell startup message was changed in DD-WRT to downplay the contributions of the numerous developers of Busybox from all over the world:

BusyBox v1.01 (2006.05.16-18:12+0000) Built-in shell (ash)

AND NOW IT READS:

Now DD-WRT VeryBusyBox v1.01 (2006.05.16-18:12+0000) Built-in shell (ash)

Furthermore, DD-WRT at one point did give sparse credit to a handful of contributors. This was later removed as Brainslayer decided more and more of the code was 'his'. Although this lack of attribution may be offensive to some, it is not illegal. The fact that DD-WRT is so much the work of others is a critical part of the argument that follows below.

DD-WRT Free for home use only

Adding this ILLEGAL statement to DD-WRT clearly showed the intentions of the author. Brainslayer has no right to restrict where his GPL derivative works are allowed to be used. Again, DD-WRT's code is not stand-alone, dynamically linked extensions. Instead, all major components are built upon the code that was originally there (i.e. the original Linksys http management console). Update: He removed this text from the license in v23 SP1, probably because he discovered it to be illegal. See Appendix A for a snippet of the license text in DD-WRT v23.

Anybody have more info on this? Is this stuff true, or are these just the rantings of a pissed off former contributor?

[jturning]

Anyone using DD-WRT? You have to reboot it much? How do you like it over the regular firmware.

I was thinking about giving it a try, but a little leary. And my router is to new to run the other flavors.

Bugz

[greggh]

Anyone using DD-WRT? You have to reboot it much? How do you like it over the regular firmware.

I was thinking about giving it a try, but a little leary. And my router is to new to run the other flavors.

Bugz

I was reading that Tomato is also pretty good. But it doen't have nearly the number of features that DD-WRT has. But many people say that the QOS works better on Tomato.

[Tsuroerusu]

I was looking into dd-wrt recently and came across this...

http://www.bitsum.com/about-ddwrt.htm

DD-WRT - An affront to the good will of the F/OSS community

Instead of giving credit where credit is due, Brainslayer has changed strings in the software to in an attempt to hide the true authors of programs simply because he, or someone, changed a handful of lines of code amongst tens of thousands. Consider Busybox, which is the single component responsible for implementing almost all core system utilities and the system shell. Its shell startup message was changed in DD-WRT to downplay the contributions of the numerous developers of Busybox from all over the world:

BusyBox v1.01 (2006.05.16-18:12+0000) Built-in shell (ash)

AND NOW IT READS:

Now DD-WRT VeryBusyBox v1.01 (2006.05.16-18:12+0000) Built-in shell (ash)

Furthermore, DD-WRT at one point did give sparse credit to a handful of contributors. This was later removed as Brainslayer decided more and more of the code was 'his'. Although this lack of attribution may be offensive to some, it is not illegal. The fact that DD-WRT is so much the work of others is a critical part of the argument that follows below.

DD-WRT Free for home use only

Adding this ILLEGAL statement to DD-WRT clearly showed the intentions of the author. Brainslayer has no right to restrict where his GPL derivative works are allowed to be used. Again, DD-WRT's code is not stand-alone, dynamically linked extensions. Instead, all major components are built upon the code that was originally there (i.e. the original Linksys http management console). Update: He removed this text from the license in v23 SP1, probably because he discovered it to be illegal. See Appendix A for a snippet of the license text in DD-WRT v23.

Anybody have more info on this? Is this stuff true, or are these just the rantings of a pissed off former contributor?

[troelsmj@earth ~]$ aoihoshi
DD-WRT v24 std (c) 2008 NewMedia-NET GmbH
Release: 05/16/08 (SVN revision: 9513)
==========================================================

____ ___ __ ______ _____ ____ _ _
| _ \| _ \ \ \ / / _ \_ _| __ _|___ \| || |
|| | || ||____\ \ /\ / /| |_) || | \ \ / / __) | || |_
||_| ||_||_____\ V V / | _ < | | \ V / / __/|__ _|
|___/|___/ \_/\_/ |_| \_\|_| \_/ |_____| |_|

DD-WRT v24
http://www.dd-wrt.com

==========================================================


BusyBox v1.9.2 (2008-05-16 23:17:08 CEST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

root@aoihoshi:~#

Emphasis is mine.

Anyone using DD-WRT? You have to reboot it much? How do you like it over the regular firmware.

I was thinking about giving it a try, but a little leary. And my router is to new to run the other flavors.

Bugz

I've been using it for over a year now, and I've been really happy with it. The latest version, v24, could seriously have used more testing before it was released, as there's still lots of weird things going on in terms of bugs etc.
However I still use v24, the reason is that it allows you do do virtual interfaces for the wireless network. This means you can run multiple wireless networks, with different encryption protocols and SSIDs, off the same router. This is great for security. The physical network is the one I mainly use, it runs WPA2 and is linked into my regular LAN so that I can access my desktop from my laptop. The first virtual interface I have also runs WPA2, and that's solely for my sister's laptop, because I don't want Vista on my network spewing weird packets all over the place, this one is not linked into my LAN, so any machines on this virtual network can't connect to or even see the machines on the LAN or on the physical wireless network as they are different networks. The second virtual interface I have uses WEP encraption, and is purely for devices that doesn't support WPA, and also for other devices that may run some proprietary software which I do not trust on my main network (Both of these examples apply to my Nintendo DS and Wii), this network is not linked into my main network either, and machiens on here can't access machines on the two other wireless networks. All three wireless networks have their own IP ranges as well, and it generally works really well, the only problem I have is when the router comes back online after a cold reboot or power off, some of the virtual networks won't work unless I go into the configuration and hit the Apply button in the wireless section, I have no idea why, weird bug somewhere that I hope gets fixed in v24 SP1.

Overall, I really like DD-WRT, great stuff. v24 also has some cool graphs to look at, and a bunch of other neat features, such as Repeater mode, which is handy if you need to borrow your neighbor's Internet connection!

[greggh]

[troelsmj@earth ~]$ aoihoshi
DD-WRT v24 std (c) 2008 NewMedia-NET GmbH
Release: 05/16/08 (SVN revision: 9513)
==========================================================

____ ___ __ ______ _____ ____ _ _
| _ \| _ \ \ \ / / _ \_ _| __ _|___ \| || |
|| | || ||____\ \ /\ / /| |_) || | \ \ / / __) | || |_
||_| ||_||_____\ V V / | _ < | | \ V / / __/|__ _|
|___/|___/ \_/\_/ |_| \_\|_| \_/ |_____| |_|

DD-WRT v24
http://www.dd-wrt.com

==========================================================


BusyBox v1.9.2 (2008-05-16 23:17:08 CEST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

root@aoihoshi:~#

Emphasis is mine.

But the thing I quoted was written in 2006. It seems Brainslayer under pressure from the community changed it back. You can find it referred to as VeryBusyBox on the forums...

http://www.dd-wrt.com/phpBB2/viewtopic.php?t=1939

Brainslayer also at one point wrote "DD-WRT Free for home use only", which is a violation of the GPL, but he changed and removed that bit of text, probably after the community complained too. I don't think it's a good thing when the leader of a project's first inclinations are to violate or at least twist the GPL.

[Tsuroerusu]

[troelsmj@earth ~]$ aoihoshi
DD-WRT v24 std (c) 2008 NewMedia-NET GmbH
Release: 05/16/08 (SVN revision: 9513)
==========================================================

____ ___ __ ______ _____ ____ _ _
| _ \| _ \ \ \ / / _ \_ _| __ _|___ \| || |
|| | || ||____\ \ /\ / /| |_) || | \ \ / / __) | || |_
||_| ||_||_____\ V V / | _ < | | \ V / / __/|__ _|
|___/|___/ \_/\_/ |_| \_\|_| \_/ |_____| |_|

DD-WRT v24
http://www.dd-wrt.com

==========================================================


BusyBox v1.9.2 (2008-05-16 23:17:08 CEST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

root@aoihoshi:~#

Emphasis is mine.

But the thing I quoted was written in 2006. It seems Brainslayer under pressure from the community changed it back. You can find it referred to as VeryBusyBox on the forums...

http://www.dd-wrt.com/phpBB2/viewtopic.php?t=1939

Brainslayer also at one point wrote "DD-WRT Free for home use only", which is a violation of the GPL, but he changed and removed that bit of text, probably after the community complained too. I don't think it's a good thing when the leader of a project's first inclinations are to violate or at least twist the GPL.

I agree, but that certainly doesn't scare a lot of people away from Ubuntu!
Mark Shuttleworth has been so busy telling Red Hat how proprietary they are (When they really are not), that he apparently forgot about those GPL violating, proprietary drivers his distribution is including.

[greggh]

Well, I'll be playing around with DD-WRT soon. I just picked up a used Linksys WRT54GS version 1. That's one of the ones with double the RAM and Flash (32 MB & 8 MB) so it will run the DD-WRT Mega Edition. I think it may even be possible to install Asterisk on it.