"; */ ?>


Nov 08

Configure iwl3945 Driver on Ubuntu

It is quite frustrating when you have a wireless card built in, but you cannot use it – don’t you agree? That seems to be the case for wifi cards that are served by “iwl3945” driver. One of such examples can be “Intel Corporation PRO/Wireless 3945ABG” card.

Before, ( e.g. Feisty and earlier ) “ipw3945” driver was used instead, and worked beautifully with Intel cards. However the active development of this driver has stopped a couple of years ago, which means that security risks that were identified in the last couple of years were not patched. Therefore Ubuntu community switched to a more recent and supported “iwl3945” driver.

However that created a problem with NetworkManager that is used as a default network user interface in (Gnome) Ubuntu. It appears that in order “to be compatible with NetworkManager, a wireless driver must support both hardware and software scanning. Currently, hardware scanning is faster and more reliable and so is recommended for use with NetworkManager“. But unfortunately “iwl3945” driver does not support hardware scanning very well, however it is a default behaviour that NetworkManager expects.

But usually, and that is what I love Ubuntu for, if there is a problem, there is 99.9999% a solution to this problem. So this how to will help you solve it, and enjoy your Intel Wireless card with Ubuntu, despite of inconsiderate (in this case) NetworkManager.

1. Remove the bad guy

sudo apt-get remove network-manager

2. Disable “iwl3945” hardware scan

sudo vi /etc/modrobe.d/iwl3945


	alias wlan0 iwl3945
	options iwl3945 disable_hw_scan=1   # <-- enables software scanning

and save it (:wq).

At this you might want to restart or (optinal) just re-insert the module like this:

sudo modprobe -r iwl3945
sudo modprobe iwl3945

3. Install the good guy

Here you’ll install “the good guy” – his/her name is WICD:

Add wicd’s repository to Ubuntu sources:

sudo vi /etc/apt/sources.list
	 deb http://apt.wicd.net intrepid extras

(if you have Hardy Heron, then add “deb http://apt.wicd.net hardy extras” instead)

Update repositories

   sudo apt-get update

Install wicd “the normal Ubuntu way”:

   sudo apt-get install wicd

4. Run the good guy


or restart, it should run automatically.

Happy wifying!

Nov 08

Configure Simp Server to Encrypt IM clients in Linux

Recently many companies started to inject their security policies with securing IM communication. It makes sense, since everything you type in that chat window to your buddy flies over the network in a clear text. That does not sound to bad, you think, but what it really means, is if anybody wanted to see what you are talking to your colleague, or even to your wife, about, s/he can see it easily by reading your network packets – which is a very easy thing to do now days.

Another example could be the client whose policy is to monitor all the incoming/outgoing network request, and you want to talk over IM to your colleague about something that you do not want your client to see.

Below I’ll show you how to secure you IM communication with SimpServer: http://www.secway.fr/us/products/simpserver/ on Unix client/server boxes. I am going to use Ubuntu here as an example, but it should work for most if not for all Unix flavours.

1. Get the SimpServer.

According to the liink above “SimpServer is currently beta software and is free for any use”, hence let’s get it for free from here:

wget http://download.secway.com/public/products/simpserver/simpserver-2.1.5c-linux-x86.tgz

2. Install the SimpServer.

Before untarring it, let’s make sure the standard C++ libraries that SimpServer uses are installed:

sudo apt-get install libstdc++5

Now let’s untar it and move to “/usr/local” – that is where it will search for its binary files, so make sure you do that:

tar -xvzf simpserver-2.1.5c-linux-x86.tgz
sudo mv simp/ /usr/local/

Go to “/usr/local/simp/bin/”, and run the SimpServer:

cd /usr/local/simp/bin/
SimpServer Linux - (c) Copyright Secway 2000-2005
All rights reserved
Visit http://www.secway.com/products/simpserver/ for updates.
Visit http://www.secway.com/support/ for support.
MSN Service on, mode 1
MSN Service on, mode 0
AIM Service on, mode 1
ICQ Service on, mode 1
YAHOO Service on, mode 1
Admin Service on, mode 0

If there are any problems, grab the simpserver version that is offered here: http://www.secway.fr/us/products/simpserver/download.php

3. Configure the SimpServer.

While SimpServer is running, telnet to it (port 10023). Default “username/password” are “admin/admin”:

$ telnet localhost 10023
Connected to localhost.
Escape character is '^]'.
SimpServer Linux - (c) Copyright Secway 2000-2005
All rights reserved
Visit http://www.secway.com/products/simpserver/ for updates.
Visit http://www.secway.com/support/ for support.
Login: admin
Password: admin

Let’s see what it is capable of by asking for “help”:

> help
SimpServer Linux - (c) Copyright Secway 2000-2005
All rights reserved
Visit http://www.secway.com/products/simpserver/ for updates.
Visit http://www.secway.com/support/ for support.
 ?,        help                  print this help
 list,     list_keys             [all, public, private]
 generate, generate_private_key  [-e<account>] [-s<service>] [-c<cipher>] [-b<size>] [-n<name>] [-p
 load,     load_private_key      -i<keyid> [-e<account>] [-s<service>] [-c<cipher>] [-p
 unload,   unload_private_key    -i<keyid> [-e<account>] [-s<service>] [-c<cipher>]
 change,   change_password       -i<keyid> [-e<account>] [-s<service>] [-c<cipher>] [-o
<old_password>] [-p<new_password>]
 delete,   delete_key            -i<keyid> [-e<account>] [-s<service>] [-c<cipher>] [-force] [-pendinf]
 accept,   accept_pending_key    -i<keyid> [-e<account>] [-s<service>] [-c<cipher>]
 quit,     exit                  exit

4. Create private/public certificates.

Notice that the “list” command, from the above help, shows all/public/private keys, including your public/private key, and all your IM buddies that you are talking to.

Let’s try to see what keys we have right away (without doing anything yet):

> list
Prv  Loaded KeyId             SHA-1 fingerprint                                   Date        Type         Srv  Name

As you can see, we have no keys – because for now we have neither “secure/encrypted” IM buddies, nor our public/private key pair.

Hence start by by running a “generate” command that would create your the key pair (link to certificates article) that will be used:

> generate
generating the new key pair, please wait... done!
new key: 278dc025d92cdbc4  b14e 7b16 6415 e88f 2a67 2fe6 2e31 579b 580e 1a89   2008-10-16  RSA-2048  [admin] KeyPair

Now let’s “list” the keys again:

> list
Prv  Loaded KeyId             SHA-1 fingerprint                                   Date        Type         Srv  Name
Yes  Yes    278dc025d92cdbc4  b14e 7b16 6415 e88f 2a67 2fe6 2e31 579b 580e 1a89   2008-10-16     RSA-2048    *  [admin] KeyPair

Perfect – you have your own “KeyPair”, that will be used to authenticate and encrypt communication from your IM buddies.

5. Connect IM clients to the SimpServer.

Next, let’s connect to our SimpPro / SimpLight / etc.. IM buddies. Here is an example on how to configure “Pidgin” to use a SimpServer:

For example you’d like your work AIM account to “follow the company standards” and use encryption via simp server. Here is what you should do

Go to "Accounts" -> (Choose your AIM account) "Edit Account" -> "Advanced"
Choose "SOCKS4" in "Proxy Options"
type "" in Host
type "15191" in Port

Pidgin SOCKS4 settings

Why “”? Because you have started the SimpServer on your local box. By the way, you can start the server on one box, and use it from many other PCs by entering IP address of that box to the “host” field for the proxy settings of the account in your IM client.

Why “15191”? Let’s look at the server output once again:

MSN Service on, mode 1
MSN Service on, mode 0
AIM Service on, mode 1
ICQ Service on, mode 1
YAHOO Service on, mode 1
Admin Service on, mode 0

We see that “AIM Service” listens on the port “15191”.

6. Start using the SimpServer with your IM client(s).

Now when you send an IM to anybody who runs SimpPro / SimpLight / or just a Simp Server, they would get a pop up asking them to accept your message. After they do accept it, your public key ( one of the keys that was generated by the “generate” command ) will be added to their Simp database. Same thing will happen when they ping you or respond to your IM encrypted message – their public key will be added to the simpserver:

Here is an example of what happens initially, when there is a new “Simp-Oriented” buddy pings you:

(2008-10-16 15:16:09) BuddyName: *** (*) SimpServer Linux - Encrypted and Authenticated (*) ***
(2008-10-16 15:16:09) BuddyName: Hey, that is cool - so now our messages are encrypted...!

And now you can go back to your “telnet” session and “list” the keys again:

> list
Prv  Loaded KeyId             SHA-1 fingerprint                                   Date        Type         Srv  Name
Yes  Yes    278dc025d92cdbc4  b14e 7b16 6415 e88f 2a67 2fe6 2e31 579b 580e 1a89   2008-10-16     RSA-2048    *  [admin] KeyPair
 No  N/A    0f2292a9d40c2f90  ab1d 6f78 6bff a03e 892a 34df 2b3a 26e7 16ff cbb9   2008-10-16     RSA-2048  AIM   <buddy1Name>
 No  N/A    62f02d7e858e0139  c315 616f 8518 d9c8 9827 e4c4 d8b4 2448 06f7 4278   2008-10-16     RSA-2048  AIM   <buddy2Name>

Notice that now you have your own “KeyPair”, a public key for “Buddy1Name”, and a public key for “Buddy2Name”.

Happy Secure IMing, and don’t abuse your secrecy :)

Oct 08

Getting Return Code from ANT in SHELL

This short tutorial shows how to get an exit code from Ant and act upon it. This can be useful when building a massive application that requires several Ant scripts/targets and a collection of shell scripts.

The rule of thumb when building the system is “when it should fail -> it should fail”. Sounds weird, but it is really true.

If the whole build of the application takes 15-20 minutes, and one of the libraries failed to build (for example), the whole build should fail. Otherwise, if the build master inspects the logs, and sees something went wrong (in case it is logged), s/he would have to spend another 20 minutes to rebuild it. Or what is even worse, the application could end up in an inconsistent state, without anybody raising a flag, and that would be very dangerous, especially if the current release goes beyond integration builds, for example to quality assurance or even worse – to production.

So, above are the reasons, below is an ultra simple example with a solution:

Let’s say we have an Ant script (build.xml) that checks for duplicate jars in a directory. The target name that does that is “check-duplicate-jars”:


    <target name="check-duplicate-jars" depends="some-other-task">
        <!-- does its magic here -->

Let’s say we also have a simple shell script that calls “ant “. If this shell script is in the same directory as the “build.xml”, we can call it like this “./callant.sh check-duplicate-jars”, and it should check if there are any duplicate jars. Let’s run the shell script:

[user@host]$ ./callant.sh check-duplicate-jars
ANT: Running check-duplicate-jars task...
Buildfile: build.xml
     [echo] Checking for duplicate jars......
     [exec] ***********    NO DUPLICATE JARS FOUND IN LIB!    ***********
Total time: 3 seconds
ANT: Return code is: "0"
GREAT SUCCESS: Niiice - I liiike!

This is an expected behavior. However what would be nice is to have this shell script “fail hard”, in case the Ant script (build.xml) fails.

Let’s try to misspell the target name “check-duplicate-jar” (should be plural: “check-duplicate-jars”) and run it:

[user@host]$ ./call-ant.sh check-duplicate-jar
ANT: Running check-duplicate-jar task...
Buildfile: build.xml
Target `check-duplicate-jar' does not exist in this project.
Total time: 1 second
ANT: Return code is: "1"
BUILD ERROR: I am failing hard...

Wonderful – it failed! That is an expected behavior. And here is a sneak peek to the magic box – the “callant.sh” shell script:

echo "ANT: Running $tname task..."
ant $tname
echo "ANT: Return code is: \""$antReturnCode"\""
if [ $antReturnCode -ne 0 ];then
    echo "BUILD ERROR: I am failing hard..."
    exit 1;
    echo "GREAT SUCCESS: Niiice - I liiike!"
    exit 0;

Hence the whole magic is here:


In general, “$?” will return an exist code of any executable run within the shell script.
Well, now you ready for the massive build process. Get to work, and may the build force be with you! :)

Oct 08

Use HSQLDB Functions with Hibernate Mapping Files

Let’s say you need to do a “local integration” test, where you code does not depend on external systems (queues/external servers/DB/etc..). Creating unit tests, mocking/stubbing everything out is all good, but sometimes you need to be able to run tests that are as close as possible to the “real world” deal, while you are in “local mode” – e.g. plane, subway, basically somewhere without access to the real external systems.

One of ways you can approach it with databases is to load schemas you need in memory, and work (test) against those schemas. This is relatively easy to do with HSQLDB, and there are many “googlable” guides on how to do it. However in this little howto, I want to show you how you can define your own HSQLDB functions, and use them as either “stubs” (or even “real deal”).

Here is an example on why you may need it. Consider this Hibernate mapping file that is used in your application:

<?xml version="1.0"?>
<!DOCTYPE hibernate-mapping PUBLIC
    "-//Hibernate/Hibernate Mapping DTD 3.0//EN"
	<class name="CustomerCreditCardSearchResultDto" table="CR_CREDIT_CARD">
		<id name="id" column="CR_CREDIT_CARD_ID">
			<generator class="native">
                                 <param name="sequence">SQ_CR_CREDIT_CARD</param>
                <property name="accountNumber" formula="some_pkg.decode( ACCOUNT_NUMBER )" />
                <property name="secretNumber" formula="some_pkg.decode( SECRET_NUMBER )" />
                <property name="expirationDate" column="EXPIRATION_DATE" type="date" />
                <property name="zipCode" column="ZIP_CODE" />

Let’s say you created a CR_CREDIT_CARD table in in-memory DB, populated it, started your test. Now when you try to read a “CustomerCreditCardSearchResultDto” object somewhere in your test, Hibernate will construct an SQL query from the mapping file above, and execute it on the in-memory DB.

However there is a problem – it is going to fail with a similar Exception:

Caused by: java.sql.SQLException: Unexpected token: DECODE in statement [select <query here> .... ]
	at org.hsqldb.jdbc.Util.throwError(Unknown Source)
	at org.hsqldb.jdbc.jdbcPreparedStatement.<init>(Unknown Source)
	at org.hsqldb.jdbc.jdbcConnection.prepareStatement(Unknown Source)
	at org.apache.commons.dbcp.DelegatingConnection.prepareStatement(DelegatingConnection.java:248)
	at org.apache.commons.dbcp.PoolingDataSource$PoolGuardConnectionWrapper.prepareStatement(PoolingDataSource.java:302)
	at org.hibernate.jdbc.AbstractBatcher.getPreparedStatement(AbstractBatcher.java:442)
	at org.hibernate.jdbc.AbstractBatcher.getPreparedStatement(AbstractBatcher.java:368)
	at org.hibernate.jdbc.AbstractBatcher.prepareQueryStatement(AbstractBatcher.java:105)
	at org.hibernate.loader.Loader.prepareQueryStatement(Loader.java:1561)
	at org.hibernate.loader.Loader.doQuery(Loader.java:661)
	at org.hibernate.loader.Loader.doQueryAndInitializeNonLazyCollections(Loader.java:224)
	at org.hibernate.loader.Loader.loadEntity(Loader.java:1785)
	... 60 more

If there is an Exception – there is a Reason for it :) Notice these two mappings in the Hibernate mapping file above:

<property name="accountNumber" formula="some_pkg.decode( ACCOUNT_NUMBER )" />
<property name="secretNumber" formula="some_pkg.decode( SECRET_NUMBER )" />

That says Hibernate to construct SQL that uses this “some_pkg.decode()” custom function/store procedure after (in case of SELECT) reading these values from a database. However, in you local testing environment, you do not have this function defined. It is probably defined in the DB (like Oracle/DB2/etc) itself.

But for most, if not for all, technical problems there is a solution, so don’t worry – you can define this function(s) yourself. Since it is a test, the most logical thing, since you want to abstract the code out from the external systems (and their functions) would be to define stubs to these functions.

Let’s create a utility “HsqlFunctions” Java class with static methods to be used by HSQLDB (it can only use static Java methods in its SQL, btw):

package org.project.test.util;
 * HSQL functions to be aliased.
 *    DDL example:
 *    CREATE ALIAS DECODE FOR "org.project.test.util.HsqlFunctions.decodeString"
 * @author blog.dotkam.com
public final class HsqlFunctions
   private HsqlFunctions()
     // static utility class - does not need to be constructed.
     * Stub for the decode function.
     * Usually used to "please" Hibernate Mapping Files.
     * @param value - String value for the column
     * @return - returns the same String value
    public static String decodeString( String value )
        return value;

Now, when creating a test schema, you can ALIAS this static method as HSQLDB function like this:

     CREATE ALIAS DECODE FOR "org.project.test.util.HsqlFunctions.decodeString"

This will tell HSQLDB to call “decodeString” static Java method on the column value, every time it sees “decode( COLUMN )” in SQL.

One thing to notice, though – make sure the type that the Java methods take are exactly the same as defined by DDL (Database Schema). For example, if you pass in column value as an Object:

    public static String decodeString( Object value )
        return String.valueOf (value );

And the column is defined as VARCHAR in schema, HSQLDB will try to pack that String into an Object, and it will fail with a similar exception:

Caused by: java.sql.SQLException: Wrong data type: hexadecimal string with odd number of characters in statement [select ... <query here>]
	at org.hsqldb.jdbc.Util.throwError(Unknown Source)
	at org.hsqldb.jdbc.jdbcPreparedStatement.executeQuery(Unknown Source)
	at org.apache.commons.dbcp.DelegatingPreparedStatement.executeQuery(DelegatingPreparedStatement.java:93)
	at org.hibernate.jdbc.AbstractBatcher.getResultSet(AbstractBatcher.java:139)
	at org.hibernate.loader.Loader.getResultSet(Loader.java:1669)
	at org.hibernate.loader.Loader.doQuery(Loader.java:662)
	at org.hibernate.loader.Loader.doQueryAndInitializeNonLazyCollections(Loader.java:224)
	at org.hibernate.loader.Loader.loadEntity(Loader.java:1785)
	... 60 more

Below is just an excerpt on how you would set up the schema to use it with HSQLDB in your test:

    private static final String CREATE_ALIASES =
        "FOR \"org.project.test.util.HsqlFunctions.decodeString\"";
    private static final String CREATE_SEQUENCES =
    private static final String CREATE_TABLES =
        "DROP TABLE cr_credit_card IF EXISTS;" +
        "CREATE TABLE cr_credit_card (" +
            "cr_credit_id NUMERIC(15), " +
            "account_number VARCHAR(48)," +
        //  Creating the schema
        m_jdbcTemplate.execute( CREATE_ALIASES );
        m_jdbcTemplate.execute( CREATE_SEQUENCES );
        m_jdbcTemplate.execute( CREATE_TABLES );
        //  HSQLDB is ready to be populated with data at this point.

You can use DBUnit to create the schema above and populate it with the data. The above is just a straight forward hardcoded example.
Notice how it also creates a sequence “SQ_CR_CREDIT_CARD” to please the Hibernate, and others who might use it in the application.

Happy “local integration” testing!

Feel free to post questions/comments/suggestions, I’ll try to respond when have a free second or two :)

Oct 08

Configure Multiple SSIDs with One Router

One Router Multiple SSIDsA standard “home setup” for the wireless router now days consists of just hosting one Service Set IDentifier – or SSID. And if only a year ago that could seem as a router (firmware) limitation, right now using multiple SSIDs with a single wireless router is just a matter of re-configuration.

Below is a simple guide on how to configure a single affordable (from $25 and up) router, that is available to anybody, to host multiple (up to 16 – at the moment of writing) SSIDs using DD-WRT firmware. In order to install the firmware on the router, follow the official DD-WRT Installation Guide.

Below step-by-step howto is good for any routers that could be found on DD-WRT supported hardware list. Which includes pretty much any “home” router that is out there. Given that DD-WRT is installed, let’s move on to configuring it to host multiple SSIDs.

First let’s look at what we would like to archive as our “end goal”:

Multiple SSIDs by several wireless VLANs served by one router

So what we would like to have is:

  • One router with DD-WRT firmware installed, that hosts 2 (in this example) SSIDs: “Home” and “Guest”

  • Two VLANs where one network (VLAN1) can “see” another (VLAN2), but not other way around.
    What that means is that all “Home” clients (computers that are connected to “Home” SSID) can see (ping/connect to/etc.) “Guest” computers, however none of “Guest” clients can see “Home” computers. (this is a matter of configuration, and can be configured differently, depending on what you need)

Step 1. Setup DHCP server for the “Home” (main) network.

As you can see from the “end goal” diagram above, the “Home” SSID (or VLAN1) has a subnet, and its DHCP client addresses start from Hence that is what needs to be configured on DD-WRT’s “Setup -> Basic Setup” screen (the “Router Local IP” should be set to which would dictate the subnet to be

DD-WRT - DHCP settings

Note that “” is just an example – you would want to use something that is appropriate for your network – e.g. “”

Step 2. Setup wireless networks (SSIDs).

Now we need to create two wireless networks – one main network (e.g. “Home”), and one virtual network (e.g. “Guest”). For that go to DD-WRT “Wireless -> Basic Settings” screen:

configure wireless networks with dd-wrt

Enter a desired name for “Physical Interface’s -> Wireless Network Name(SSID)” (this is going to be the main network). You can also stick to the “end goal” diagram above, and enter “Home”.

After that is done, click “Add” to add a “Virtual Interface” and enter its SSID name as well (e.g. you can enter “Guest”). Make sure that the “Network Configuration” is set to “Bridged” as shown on the screen in this step.

Step 3. Configure wireless network security.

In the previous step we configured two wireless networks, now let’s secure them. We will use 128 bit WEP algorithm for both of them due to the reason described in “Step 5”. To accomplish this go to DD-WRT “Wireless -> Wireless Security” screen:

configure wireless security with dd-wrt

Choose “WEP” for “Security Mode”, 128 bits for “Encryption”, enter “Passphrase” and click “Generate” button.

Do it for both networks (Physical and Virtual Interfaces)

Step 4. Setup a virtual interface, and its DHCP settings.

Now we will set the bridge for the virtual network – “Guest” (or VLAN2) from the “end goal” diagram above. For that go to DD-WRT “Services -> Services” screen:

Configuring DNSMasq and DHCP for virtual network

Find “DNSMasq” section, enable “DNSMasq”, and in “Additional DNSMasq Options” enter:


This would create a DHCP server for the virtual (“Guest”, VLAN2) network.
“” is again – just an example, you can use any subnet that suits your needs.

Step 5. Setup firewall rules and a startup script.

This is the most complex step, that makes many network administrators confused, and regular people to give up on DD-WRT multiple SSID configuration. But don’t worry :) – below is a “copy/paste”, working deal.

Go to the DD-WRT “Administration -> Commands” screen:

Setting up firewall rules and a startup script for multiple SSIDs - DD-WRT

Enter the following firewall rules to the “Firewall” section:

iptables -I INPUT -i br1 -m state --state NEW -j logaccept
iptables -I FORWARD -i br1 -o vlan1 -m state --state NEW -j ACCEPT
#below keeps the two networks from talking
iptables -I FORWARD -i br0 -o br1 -j logdrop

Enter the following commands to the “Startup” (it is a startup script that executes when the router starts up):

brctl addbr br1
brctl delif br0 wl0.1
brctl addif br1 wl0.1
ifconfig br1 netmask
ifconfig vlan2 up
brctl addif br1 vlan2
ifconfig br1 up
##FIX NAS. Here NAS is disabled, cause it is NOT used for WEP, and these wifi networks will use WEP (for now)
killall nas
nas -P /tmp/nas.wl0lan.pid -H 34954 -l br0 -i eth1
nas -P /tmp/nas.wl0.1lan.pid -H 34954 -l br1 -i wl0.1

Here is where it gets interesting… Remember in “Step 3”, when configuring wireless security, we chose WEP? That was done because the current DD-WRT firmware “v24-sp1 (07/27/08) micro”, that is used at the moment of writing, has a bug in starting NAS, which is a proprietary binary tool that sets up dynamic encryption (WEP/WPA) on wireless devices.

UPDATE (12/22/2008):
           Tried "v24-sp2" (09/26/08 std - build 10431M VINT Eko) for WRTG54GL v1.1 router -
           WPA worked with multiple (tried 2) SSIDs.

In a startup script above, we start NAS in “vanilla” mode for “eth1” (the main network) and for “wl0.1” (guest, virtual nework), and therefore we are using WEP for both networks.

The only line from above startup script that you might want to change is:

ifconfig br1 netmask

Here “” is, again, an example, so if you chose a different subnet for the virtual network (br1), you should enter it instead.

Now you can save all the changes and restart the router. You should be good to go!
If you have any questions or comments, you are welcome to address them below in the “comments” section.