funcptr

Change one password

2018-12-24T06:19:52+00:00
It is that time of year where security professionals the world over end up talking with friends and family about security. It will be inevitable, almost as inevitable as someone wearing a stupid Christmas sweater they are a little too proud of.
The standard advice we've been giving for years is pretty simple:
Don't re-use your passwords across sites</li>
Use a password manager</li> </ol>
Anyone that has done technical support for anyone that isn't as familiar with IT knows well that as soon as you complicate something, you end up getting twice the calls, even for things that are not your fault; "Well, since you setup that password thing my printer won't print" ...
It is fantastic advice, it is where we should all strive to be, we should all have password managers and should never re-use passwords.
However let's change one single password. Start small.
There is likely to be a single account that is the root of trust for all other accounts. An email address, either at an ISP somewhere (and maybe this is the year you get them to switch from that old Earthlink</a> email address?) or more likely a free email provider.
That's the account we want to target.
If we can secure the root of trust, the email address that can be used for password reset emails and for phishing we've already won a large battle. Individual accounts may still be "vulnerable", but now we've closed one giant hole.
After all, we all learn to walk before we learn how to run. This small step can set the tone for even more and better security later.
Should we go further? Absolutely, identify the primary accounts that are high risk, as an example:


Python Packaging and Distribution
2018-05-21T14:00:00+00:00
There's been many a discussion online related to a variety of tools related to
Python packaging and distribution. There is pip</a>, pipenv</a> and
poetry</a> that have been the tools under discussion.</p>
As an open source maintainer as part of the Pylons Project</a>, while I would
love to be writing code I end up spending a lot of time dealing with user
questions around packaging/distributing their source code using the software
I've helped build, and as we move forward myself and other maintainers were
wondering if we were actually helping users move forward in the best way
possible using best of breed tools.1</a></sup></p>
As the Python community has moved from easy_install</a> to pip, we too have
kept the documentation up to date. We went from python setup.py develop</code> to
pip install -e .</code> to create editable installs of local projects, and try to
let people know the pitfalls of using both easy_install and pip in the same
project (mostly with an answer that falls in line with: remove your virtual
environment and start over, just use pip).</p>
As part of Pyramid</a> we have developed and maintain various different
cookiecutter</a> templates, and our goal is to attempt to provide templates
that are both useful, but also follow best practices that are being adopted
within the community at large so that newcomers can use their existing
skills/knowledge and those that are starting with us walk away with a knowledge
and experience that applies not just to development of Pyramid applications,
but also applies to the broader community as a whole.</p>
pip</h2>
Pip is a great tool that has simplified installation of packages, it supports
using binary distributions named wheels</a> and has a way to easily install
software from the Python Packaging Index</a>. It has a rather naive
dependency resolution process, but for the most part it works and works well.
It replaced easy_install as the tool to use for installing packages.</p>
While you can use a requirements.txt</code> file with pip to install a "blessed"
list of software there is no good way to "lock" the dependencies of
dependencies without manually adding it to the list of requirements. This ends
up making it very difficult to manage, and it is very difficult to know that
what has been tested is what the user is actually going to get because packages
may be updated at anytime, and re-creating the same exact environment is
difficult and fraught with errors.</p>
This is where Pipfile</a> is supposed to help. This is a project to add a
new, more descriptive requirements file, as well as allowing for a lockfile
that would lock not just your primary packages you have listed, but also all
dependencies of dependencies all the way down the tree. This helps with
reproducibility and allows for the same installation on two different systems
to have the exact same software/dependencies installed.</p>
pipenv</h2>
While pip is a great tool, and with the Pipfile changes it would allow for
locking of dependencies, there is one more puzzle piece missing. When
installing packages while you can install them into the global namespace, the
recommended way is to install all packages for a particular tool/project into a
virtual environment.</p>
Normally you'd invoke virtualenv</a>, to create this environment and then
you'd make sure to install all packages within it, thereby isolating it from
the rest of the system.</p>
pipenv automates this for you, as well as using Pipfile</code> it also supports
locking using Pipfile.lock</code> and provides a bunch of tooling around
adding/removing dependencies from a local project.</p>
pipenv allows you to easily create an environment and manage dependencies, but
it makes no effort to solve the problem of distributing and building a package
that may be installed by third parties.</p>
poetry</h2>
Poetry is a similar project to pipenv, with a major difference being that it
was built to help with distributing/developing applications and building a
distributable package that may then be installed using pip.</p>
Instead of using a Pipfile</code> it uses a recently standardised pyproject.toml</code>
file instead. Like pipenv it also supports locking, and it provides tooling
around adding/removing dependencies as well as managing what versions are
required.</p>
Ultimately those dependencies are going to end up as metadata in a
distributable package.</p>
Poetry makes it easier to manage a software development project, whether that
is for an application using various libraries for internal use, or for
libraries that are going to be distributed to other developers.</p>
The divide</h2>
This is where the divide really starts, while you can use pipenv with a
standard setuptools</a> project, any dependencies you add to the Pipfile
using pipenv's tooling will not be listed as a dependencies for your project
when you distribute it, this either means you need to duplicate the list in
both setup.py</code> as well as the Pipfile</code>, or you have to add your current
project as an editable install within your Pipfile</code> which means your Pipfile</code>
is now not as easily distributable.</p>
There are work-arounds that people have used, such as having setup.py</code> read a
requirements.txt</code>, so that you could have all your requirements listed in a
text file, and not in setup.py</code>, but asking to do the same with a Pipfile</code> in
pipenv was met with a "Do not do this."</a>.</p>
poetry explicitly allows you to add dependencies in one place, and those
dependency listings are then automatically inserted into the package metadata
that is created when you build your distributable package.</p>
The two use cases</h2>
There are two competing use cases, one is the deployment of software packages
and being able to run them, but not as a developer, the other is a developer of
software packages that needs to define dependencies for the project to run.</p>
pipenv solves the deployment case. If I was a user I could very simply grab a
known good Pipfile.lock</code> and use pipenv to install a known good set of
software, this is great when I am deploying a project. It is the use case that
many in the Python Packaging Authority</a> also seem to be optimizing for.</p>
The other use case is for developers that are building new software, either by
using a list of existing packages and deploying privately, or people developing
software for other developers to be published on the Python Packaging Index.</p>
This latter group of people is under represented due to it likely being much
smaller, and existing tools like setuptools</code> and setup.py</code> already providing
a "good enough" experience. Innovation in this area is something that readily
needs to be improved upon to make it easier to create new libraries/packages
that follow best practices. The amount of copy and pastes people have done for
adding a setup.py</code> to their projects or to make something work is long. It's
all a little bit of black magic, and there is a great many things that have
been carried over because of cargo cult programming.</p>
Explicit mentions by the Python Packaging Authority</h2>
Reading the packaging guide on managing dependencies</a>, pipenv is the
recommended tool:</p>

This tutorial walks you through the use of Pipenv to manage dependencies for
an application. It will show you how to install and use the necessary tools
and make strong recommendations on best practices.</p>
</blockquote>
this language, along with what packaging.python.org</code> implies as a URL makes it
difficult as a project maintainer to recommend alternate tools, becuase even if
those tools are superior for the use case we are recommending them for it is
always going to lead to questions from users, such as:</p>

Why are you not using pipenv, the official tool recommended by Python.org?</p>
</blockquote>
We get similar questions about easy_install</code> vs pip</code> all of the time, as
well as why people should switch, and we can point to various bits of
documentation that explains why pip is a better choice.</p>
If we were to recommend an alternate the appeal to authority that python.org</code>
implies is going to make it much more difficult, and the question will become
"why is the Pylons Project not using recommended tooling?"</p>
poetry is listed as a footnote on that page, alongside pip-tools</a> and
hatch</a>, and is mentioned only for doing library development, with no
mention of other requirements that may make it a much better tool for
developing locally.</p>
Deployment is not development</h2>
If I am using pipenv with a non-installable project (no setup.py) I end up
having to figure out how to get the code, and the Pipfile</code>/Pipfile.lock</code> to
my environment I am deploying into. pipenv's install provides a way to make
sure to only install if the Pipfile.lock</code> is up to date or otherwise will fail
to continue. If you are using a local project though, and it uses setup.py</code>
the only way that the Pipfile.lock</code> will contain any sub-dependencies of your
setup.py</code> project is if you install it as editable</code>. Otherwise
sub-dependencies are not locked.2</a></sup></p>
If I am using poetry I get an pip installable project, but it doesn't contain
any hard pins or lock files. I'd have to distribute pyproject.lock</code> as well as
my wheel. This gets me a little closer, but still no lock file that includes my
newly produced wheel, and has all of its dependencies locked.</p>
The Python Packaging Authority based on Twitter conversations with its members
and the documentation on packaging.python.org</code> suggest using pipenv for
development. pipenv is particular ill-suited for development if the goal is to
create a package to be deployed to production. With two locations to define
dependencies it leaves people scratching their heads as to which is canonical,
and if a dependency is added to Pipfile</code> but not setup.py</code> it may leave a
developer thinking their package is ready for distribution when in reality it
is missing a dependency that is required to run/use said distribution.</p>
At this point using both projects seems like a win-win. Use poetry to
build/develop a package, then use pipenv in the integration phase to create a
Pipfile.lock</code> that is used to deploy in production. This way you get the best
of both worlds. A great tool that can help you register entry points and
another that can help you with deploying a known good set of dependencies.</p>
Interestingly, even the pipenv docs seem to agree that it is a deployment tool:</p>

Specify your target Python version in your Pipfile’s [requires] section.
Ideally, you should only have one target Python version, as this is a
deployment tool.</p>
-- Pipenv - General Recommendations & Version Control</a></p>
</blockquote>
Use pipenv if you have a script that requires a couple of dependencies and
doesn't need all of the extra overhead of packaging metadata/packaging. Use
poetry if you want to build a distributable project that can easily be deployed
by others, and use both if you develop a project and need a known good
environment to deploy.</p>
In summary</h2>
There will likely never be a time that one single tool is considered good
enough, and competition between tools is a way to keep advancing forward.
Packaging in the Python community for a long time has been difficult. Wheels
has made things a little better. pip has made management of installing new
packages easier and improved upon easy_install. Here's to the next evolution.</p>

Now, can we talk about standardising on pyproject.toml</code> since that is already
where "project" metadata needs to go, might as well re-use the name instead of
having two different names/files. Oh, and PEP 517</a> can't come soon enough
so that alternate tools like flit</a> can be used instead of
setuptools/setup.py</code>.</p>



We created an issue named Support poetry,
flit, pipenv, or ...?</a> that attempts to go over the pros and cons of the
various tools and how we currently support our users in our documentation on
building projects using pyramid, including how to create a project that is
distributable.  Pyramid heavily uses pkg_resources</code></a> and entry
points.  The way to register the entry points is to have an installable
package. The framework is flexible enough that there is no requirement for
entry points, but at that point you are in territory where the default
tooling provided by the project will not work, and some of the convenience
tools/functionality that Pyramid provides it's users/developers is not
available. ↩</a></p>
</li>

See documentation for Editable Dependencies (e.g.  -e   .</code>)</a> which as of this writing states: 
Sub-dependencies are not</strong> added to the Pipfile.lock if you leave the -e option out.</blockquote> ↩</a></p>
</li>
</ol>
</section>


Mac OS X El Capitan Installer Removes Custom Group ID and Membership
2015-10-02T01:23:45+00:00
As always, after Apple releases their new operating system, my systems are
upgraded. This time the upgrade was less of a surprise in terms of what it
brings because I'd been beta testing the new release for the past couple of
weeks, however I was still caught off guard.</p>
On OS X, by default all user accounts start at ID 501 and count up, so if you
have two accounts, you will have user ID 501 and 502 in use. For most people
they will most likely never change this, and all is well. The default group ID
for all new user accounts is staff</code> which has a group ID of 20. So if you have
a single account named for example janedoe</code> her user ID would be 501 and her
group ID would be 20 (staff</code>).</p>
Coming from a FreeBSD world and running a lot of FreeBSD systems, user accounts
start at 1001, and count up. When you create a new user account on FreeBSD, by
default that user is also added to a group with the same name as the username,
with the same ID. So you end up with an account with ID 1001 and default group
ID 1001. Using the same example, a user named janedoe</code> would have a user ID of
1001, and a group ID of 1001 (janedoe</code>).</p>
When I first installed OS X, and almost every single new installation since, I
have followed these steps to change my user ID and group ID to match those on
my FreeBSD systems:</p>

Assumption is that you have a separate user account other than the one you
are about to modify that you can temporarily use that has administrator
privileges on the local Mac; I create an "Administrator" account for that
reason.</li>
System Preferences</li>
Users and Groups</li>
Click the +</code> (You may need to click the lock in the bottom left first)</li>
Change the dropdown to group</code></li>
Enter Full Name: janedoe</code></li>
Create group</li>
Right click on group (janedoe</code>)</li>
Advanced Options...</li>
Change the Group ID to 1001</li>
Okay</li>
Right click on user (janedoe</code>)</li>
Advanced Options...</li>
Change User ID from 501</code> to 1001</code></li>
Change Group from staff</code> to janedoe</code></li>
Okay</li>
Close System Preferences</li>
Open Terminal, become root user (sudo su)</li>
cd /Users/janedoe</code></li>
find . -uid 501 -print0 | xargs -0 chown 1001:1001</code></li>
</ol>
This allows me to have the same user ID and group ID on both my Mac OS X and on
FreeBSD, thereby making it easier to use tools like rsync that keeps ownership
and permissions, as well as using NFS. Other ways to do something similar is
using LDAP/Kerberos with shared directory service, but that is a little heavy
handed for a home network.</p>
This has worked for me without issues since OS X 10.8, even upgrading from 10.8 to
10.9 and then 10.10 did not change anything. However as soon as I did the
upgrade to El Capitan (10.11) I noticed that all of my ls -lah</code> output looked
like this:</p>
drwxr-xr-x+  13 xistence  1001   442B Oct  1 16:58 Desktop</span></span>
drwx------+  28 xistence  1001   952B Aug 31 12:17 Documents</span></span>
drwx------+  89 xistence  1001   3.0K Oct  1 15:56 Downloads</span></span>
drwx------@  72 xistence  1001   2.4K Oct  2 00:16 Library</span></span></code></pre>
and id</code> provided this valuable output:</p>
uid=1001(xistence) gid=20(xistence) groups=20(xistence),12(everyone),61(localaccounts),399(com.apple.access_ssh),402(com.apple.sharepoint.group.2),401(com.apple.sharepoint.group.1),100(_lpoperator)</span></span></code></pre>
Wait, what happened to the staff</code> group that I am supposed to be a member of,
and why is my xistence</code> group ID now stating it is 20 and not 1001 as I was
expecting.</p>
I wondered if the upgrade had messed up my group somehow, and it was
confirmed when I checked with dscl</code>.</p>
$ dscl . -read /Groups/xistence</span></span>
[...]</span></span>
Password: *</span></span>
PrimaryGroupID: 20</span></span>
RealName: xistence</span></span>
RecordName: xistence</span></span>
RecordType: dsRecTypeStandard:Groups</span></span></code></pre>
Do note that the group xistence</code> does not show up in System Preferences</em> ->
Users and Groups</em>, so we'll have to do some command line magic.</p>
Well, that's worrisome, why is this matching a built-in group's ID? Specifically
let's check the staff</code> group and make sure it still has the appropriate group
ID.</p>
$ dscl . -read /Groups/staff</span></span>
[...]</span></span>
GroupMembership: root</span></span>
Password: *</span></span>
PrimaryGroupID: 20</span></span>
RealName: Staff</span></span>
RecordName: staff BUILTIN\Users</span></span>
RecordType: dsRecTypeStandard:Groups</span></span></code></pre>
Next I had to check to see what my user account was set to as the default group
ID:</p>
$ dscl . -read /Users/xistence</span></span>
[...]</span></span>
NFSHomeDirectory: /Users/xistence</span></span>
Password: ********</span></span>
PrimaryGroupID: 20</span></span>
RealName:</span></span>
 Delta Regeer</span></span>
RecordName: xistence delta@regeer.org com.apple.idms.appleid.prd.53696d524c62372b48344a53755864634e4f374b32513d3d</span></span>
RecordType: dsRecTypeStandard:Users</span></span>
UniqueID: 1001</span></span>
UserShell: /bin/bash</span></span></code></pre>
Well, that is not entirely what I was expecting either, at last it didn't touch
my user ID. Time to fix things.</p>
First let's change the xistence</code> group's group ID to 1001, and then change the
Primary Group ID for the user xistence</code> to group ID 1001.</p>
dscl</span> .</span> -change</span> /Groups/xistence PrimaryGroupID</span> 20 1001</span></span>
dscl</span> .</span> -change</span> /Users/xistence PrimaryGroupID</span> 20 1001</span></span></code></pre>
After that id</code> looked a little bit more sane:</p>
uid=1001(xistence) gid=1001(xistence) groups=1001(xistence),12(everyone),61(localaccounts),399(com.apple.access_ssh),402(com.apple.sharepoint.group.2),401(com.apple.sharepoint.group.1),100(_lpoperator)</span></span></code></pre>
However now the group staff</code> is missing from the list of groups that the user
xistence</code> is a member of, which I don't think will hurt anything, but we still
want to be able to read/write any folders that are designated as staff</code>
elsewhere in the OS, and any other privileges that entails. So let's add the
user xistence</code> to the staff</code> group:</p>
dscl</span> .</span> -append</span> /Groups/staff GroupMembership xistence</span></span></code></pre>
Let's verify, and check id</code> again:</p>
uid=1001(xistence) gid=1001(xistence) groups=1001(xistence),12(everyone),20(staff),61(localaccounts),399(com.apple.access_ssh),402(com.apple.sharepoint.group.2),401(com.apple.sharepoint.group.1),100(_lpoperator)</span></span></code></pre>
For this to fully take effect, log out and log back in. This will make sure
that all new files have the correct user ID/group ID set.</p>
After the change to the Group ID, the group still doesn't show up in System
Preferences</em> -> Users and Groups</em>, which I find weird since it is not a
built-in group.</p>
Luckily everything is back to the way it was before the upgrade, and my backup
scripts and NFS shares work again without issues.</p>


Cobbler with CentOS 7 failure to boot/kickstart
2015-07-08T19:54:43+00:00
Over the past week I've been working on building out an instance of Cobbler and
testing some of the provisioning that it is able to do. One of the operating
systems that I wanted to deploy is CentOS 7.</p>
After I imported the system into cobbler, it correctly showed up in the
pxelinux boot menu and it would happily load the kernel and the initrd, however
after initial bootup it would throw the following error message:</p>
dracut-initqueue[867]: Warning: Could not boot.</span></span>
dracut-initqueue[867]: Warning: /dev/root does not exist</span></span>
</span>
         Starting Dracut Emergency Shell...</span></span>
Warning: /dev/root does not exist</span></span>
</span>
Generating "/run/initramfs/rdsosreport.txt"</span></span>
</span>
</span>
Entering emergency mode. Exit the shell to continue.</span></span>
Type "journalctl" to view the system logs.</span></span>
You might want to save "/run/initramfs/rdsosreport.txt" to a USB stick or /boot</span></span>
after mounting them and attach it to a bug report</span></span></code></pre>
After that it gives you a root shell.</p>
Some Google searching led me to an mailing list post for Cobbler</a> where
someone mentioned that adding ksdevice=link</code> to the Cobbler profile allowed
the system to boot without issues.</p>
However before I just implement a change I want to know why that fixes the
issue, so I searched Google for "kickstart ksdevice" and found Red Hat's
documentation on starting a kickstart</a>. Searching that page for "ksdevice"
led me to this section:</p>

ksdevice=<device></code></p>
The installation program uses this network device to connect to the network. You can specify the device in one of five ways:</p>

the device name of the interface, for example, eth0</code></li>
the MAC address of the interface, for example, 00:12:34:56:78:9a</code></li>
the keyword link</code>, which specifies the first interface with its link in the up state</li>
the keyword bootif</code>, which uses the MAC address that pxelinux set in the
BOOTIF variable. Set IPAPPEND 2 in your pxelinux.cfg file to have pxelinux
set the BOOTIF variable.</li>
the keyword ibft</code>, which uses the MAC address of the interface specified by iBFT</li>
</ul>
For example, consider a system connected to an NFS server through the eth1
device. To perform a kickstart installation on this system using a kickstart
file from the NFS server, you would use the command ks=nfs:<server>:/<path> ksdevice=eth1</code> at the boot: prompt.</p>
</blockquote>
While ksdevice=link</code> would work for some of the machines I am deploying, it
wouldn't work for most since they have multiple interfaces and each one of
those interfaces would have link, what I really wanted was ksdevice=bootif</code>,
which is the most sensible default.</p>
So I modified the profile with ksdevice=link</code> just to test, and that worked
without issues, so then I modified the profile and added ksdevice=link</code>, and
this failed.</p>
I figured I should check the pxelinux.cfg/default</code> file that Cobbler generates
upon issuing a cobbler sync</code> and verify that ksdevice=bootif</code> is actually
listed correctly.</p>
What I found was this:</p>
LABEL CentOS-7.1-x86_64</span></span>
        kernel /images/CentOS-7.1-x86_64/vmlinuz</span></span>
        MENU LABEL CentOS-7.1-x86_64</span></span>
        append initrd=/images/CentOS-7.1-x86_64/initrd.img ksdevice=${net0/mac} lang=  kssendmac text  ks=http://10.10.10.1/cblr/svc/op/ks/profile/CentOS-7.1-x86_64</span></span>
        ipappend 2</span></span></code></pre>
This has a ksdevice=${net0/mac}</code> which is not what I had put in the profile,
overwriting ksdevice</code> in the profile with ksdevice=link</code> did correctly put
that into the pxelinux.cfg/default</code> file, so Cobbler was overwriting my change
somehow.</p>
A quick search of ${net0/mac}</code> led me to a page about gPXE commandline
items</a> that contained the same variable. At which point I remembered that in
Cobbler you set up your profile to be gPXE enabled or not. The default when you
import an image is to enable gPXE support.</p>
cobbler profile report  --name=CentOS-7.1-x86_64</span></span>
</span>
Name                           : CentOS-7.1-x86_64</span></span>
TFTP Boot Files                : {}</span></span>
Comment                        : </span></span>
DHCP Tag                       : default</span></span>
Distribution                   : CentOS-7.1-x86_64</span></span>
Enable gPXE?                   : True</span></span>
Enable PXE Menu?               : 1</span></span>
[...]</span></span></code></pre>
So let's modify the profile to disable gPXE support:</p>
cobbler</span> profile edit</span> --name=CentOS-7.1-x86_64 --enable-gpxe=False</span></span>
cobbler</span> sync</span></span></code></pre>
Verify that the change was made:</p>
cobbler profile report  --name=CentOS-7.1-x86_64</span></span>
</span>
[...]</span></span>
Enable gPXE?                   : False</span></span>
[...]</span></span></code></pre>
Then let's take a look at our pxelinux.cfg/default</code> file and make sure that it
looks correct:</p>
LABEL CentOS-7.1-x86_64</span></span>
        kernel /images/CentOS-7.1-x86_64/vmlinuz</span></span>
        MENU LABEL CentOS-7.1-x86_64</span></span>
        append initrd=/images/CentOS-7.1-x86_64/initrd.img ksdevice=bootif lang=  kssendmac text  ks=http://10.10.10.1/cblr/svc/op/ks/profile/CentOS-7.1-x86_64</span></span>
        ipappend 2</span></span></code></pre>
This time our ksdevice is correctly set. Upon rebooting my PXE booted server it
picked up the correct interface, made a DHCP request and kickstarted the server
using the provided kickstart file, and installation completed successfully.</p>
So unless you chain-boot gPXE from pxelinux by default, make sure that your
profiles are not set to be gPXE enabled if you want to use them directly from
the pxelinux menu.</p>
While researching more about this article, I found a blog post by Vlad Ionescu
about PXE installing RHEL 7 from Cobbler</a> where he suggests disabling
ksdevice</code> entirely and adding an extra inst.repo</code> variable to the kernel
command line, however on older versions of CentOS 7 and Red Hat Enterprise
Linux 7 there is a bug report</a> that shows that an empty ksdevice</code> could
cause anaconda to crash, and setting a manual inst.repo</code> for every profile
seems like overkill when just disabling gPXE for the profile also solves the
problem.</p>


Neutron L3 agent with multiple provider networks
2014-09-29T18:11:00+00:00
Due to requirements outside of my control, there was a requirement to run
multiple "provider" networks each with each providing their own floating
address pool from a single network node, I wanted to do this as simply as
possible using a single l3 agent rather than having to figure out how to get
systemd to start multiple with different configuration files.</p>
Currently I've installed and configured an OpenStack instance that looks like
this:</p>
+---------------------+</span></span>
|                     |</span></span>
|                  +--+----+</span></span>
|                  |       |</span></span>
|      +-----------+-+  +--+----------+</span></span>
|      | Compute     |  | Compute     |</span></span>
|      |     01      |  |     02      |</span></span>
|      +------+------+  +-----+-------+</span></span>
|             |               |</span></span>
|             |               +----------+</span></span>
|             +------------+--+          |</span></span>
|                          |             |</span></span>
| +-------------+    +-----+-------+     |</span></span>
| | Controller  |    |   Network   |     |</span></span>
| |             |    |             |     +---+  Tenant Networks (vlan tagged) (vlan ID's 350 - 400)</span></span>
| +-----+----+--+    +------+----+-+</span></span>
|       |    |              |    |</span></span>
|       |    |              |    +-----------+  Floating Networks (vlan tagged) (vlan ID's 340 - 349)</span></span>
|       |    |              |</span></span>
|       |    |              |</span></span>
+------------+--------------+----------------+  Management Network (10.5.2.0/25)</span></span>
        |</span></span>
        |</span></span>
        +------------------------------------+  External API Network (10.5.2.128/25)</span></span></code></pre>
There are two compute nodes, a controller node that runs all of the API
services, and a network node that is strictly used for providing network
functions (routers, load balancers, firewalls, all that fun stuff!).</p>
There are two flat networks that provide the following:</p>

External API access</li>
A management network that OpenStack uses internally to communicate between
instances and to manage it, which is not accessible from the other three
networks.</li>
</ol>
The other two networks are both vlan tagged:</p>

Tenant networks, with the possibility of 50 vlan ID's</li>
Floating networks, with existing vlan ID's for existing networks</li>
</ol>
Since the OpenStack Icehouse release, the l3 agent has supported the ability to
use the Open vSwitch configuration to specify how traffic should be routed
rather than statically defining that a single l3 agent routes certain traffic
to a single Linux bridge. Setting this up is fairly simple if you follow the
documentation, with one caveat, variables you think would be defined to no
value, actually have a value and thus need to be explicitly zeroed out.</p>
On the network node</h2>
First, we need to configure the l3 agent, so let's set some extra variables in
/etc/neutron/l3-agent.ini</code>:</p>
gateway_external_network_id</span> =</span></span>
external_network_bridge</span> =</span></span></code></pre>
It is important that these two are set, not left commented out, unfortunately
when commented out they have some defaults set and it will fail to work, so
explicitly setting them to blank will fix that issue.</p>
Next, we need to set up our Open vSwitch configuration. In
/etc/neutron/plugin.ini</code> the following needs to be configured:</p>

bridge_mappings</code></li>
network_vlan_ranges</code></li>
</ul>
Note, that these may already be configured, in which case there is nothing left
to do. Mine currently looks like this:</p>
bridge_mappings</span> = tenant1:br-tnt,provider1:br-ex</span></span></code></pre>
This basically specifies that any networks created under "provider name"
tenant1</code> are going to be mapped to the Open vSwitch bridge br-tnt</code> and any
networks with "provider name" provider1</code> will be mapped to br-ex</code>.</p>
br-tnt</code> is mapped to my tenant network and on the switch has vlan ID's 350 -
400 assigned, and br-ex</code> has vlan ID's 340 - 349 assigned.</p>
Following the above knowledge, my network_vlan_ranges</code> is configured as such:</p>
network_vlan_ranges</span> = tenant1:350:400,provider1:340:349</span></span></code></pre>
Make sure to restart all neutron services:</p>
openstack-service</span> restart neutron</span></span></code></pre>On the controller (where neutron-server</code> lives)</h2>
On the controller we just need to make sure that our network_vlan_ranges</code>
matches what is on the network node, with one exception, we do not list our
provider1</code> vlan ranges since we don't want to make those available to
accidentally be assigned when a regular tenant creates a new network.</p>
So our configuration should list:</p>
network_vlan_ranges</span> = tenant1:350:400</span></span></code></pre>
Make sure that all neutron services are restarted:</p>
openstack-service</span> restart neutron</span></span></code></pre>Create the Neutron networks</h2>
Now, as an administrative user we need to create the provider networks.</p>
source</span> ~/keystonerc_admin</span></span>
</span>
neutron</span> net-create</span> "</span>192.168.1.0/24-floating</span>"</span> \</span></span>
    --router:external</span> True</span> \</span></span>
    --provider:network_type</span> vlan</span> \</span></span>
    --provider:physical_network</span> provider1</span> \</span></span>
    --provider:segmentation_id</span> 340</span></span>
</span>
neutron</span> net-create</span> "</span>192.168.2.0/24-floating</span>"</span> \</span></span>
    --router:external</span> True</span> \</span></span>
    --provider:network_type</span> vlan</span> \</span></span>
    --provider:physical_network</span> provider1</span> \</span></span>
    --provider:segmentation_id</span> 341</span></span></code></pre>
Notice how we've created two networks, given them each individual names (I like
to use the name of the network they are going to be used for) and have been
attached to the provider1</code>. Note that provider1</code> is completely
administratively defined, and could just as well have been physnet1</code>, so long
as it is consistent across all of the configuration files.</p>
Now let's create subnets on this network:</p>
neutron</span> subnet-create</span> "</span>192.168.1.0/24-floating</span>"</span> 192.168.1.0/24</span> \</span></span>
    --allocation-pool</span> start=192.168.1.4,end=</span>192.168.1.254 \</span></span>
    --disable-dhcp --gateway</span> 192.168.1.1</span></span>
</span>
neutron</span> subnet-create</span> "</span>192.168.2.0/24-floating</span>"</span> 192.168.2.0/24</span> \</span></span>
    --allocation-pool</span> start=192.168.2.4,end=</span>192.168.2.254 \</span></span>
    --disable-dhcp --gateway</span> 192.168.2.1</span></span></code></pre>
Now that these networks are defined, you should be able to have tenants create
routers and set their gateways to either of these new networks by selecting
from the drop-down in Horizon or by calling neutron router-gateway-set <router id> <network id></code> on the command line.</p>
The l3 agent will automatically configure and set up the router as required on
the network node, and traffic will flow to either vlan 340 or vlan 341 as
defined above depending on what floating network the user uses as a gateway.</p>
This drastically simplifies the configuration of multiple floating IP networks
since no longer is there a requirement to start up and configure multiple l3
agents each with their own network ID configured. This makes configuration less
brittle and easier to maintain over time.</p>


OpenStack resizing of instances
2014-09-29T17:10:00+00:00
One thing that is not always adequately explained in the OpenStack
documentation is how exactly instance resizing works, and what is required,
especially while using KVM as the virtualisation provider, with multiple
compute nodes.</p>
You might find something similiar to the following in your logs, and no good
documentation on how to fix it.</p>
ERROR nova.compute.manager [req-7cb1c029-beb4-4905-a9d9-62d488540eda f542d1b5afeb4908b8b132c4486f9fa8 c2bfab5ad24642359f43cdff9bb00047] [instance: 99736f90-db0f-4cba-8f44-a73a603eee0b] Setting instance vm_state to ERROR</span></span>
TRACE nova.compute.manager [instance: 99736f90-db0f-4cba-8f44-a73a603eee0b] Traceback (most recent call last):</span></span>
TRACE nova.compute.manager [instance: 99736f90-db0f-4cba-8f44-a73a603eee0b]   File "/usr/lib/python2.7/site-packages/nova/compute/manager.py", line 5596, in _error_out_instance_on_exception</span></span>
TRACE nova.compute.manager [instance: 99736f90-db0f-4cba-8f44-a73a603eee0b]     yield</span></span>
TRACE nova.compute.manager [instance: 99736f90-db0f-4cba-8f44-a73a603eee0b]   File "/usr/lib/python2.7/site-packages/nova/compute/manager.py", line 3459, in resize_instance</span></span>
TRACE nova.compute.manager [instance: 99736f90-db0f-4cba-8f44-a73a603eee0b]     block_device_info)</span></span>
TRACE nova.compute.manager [instance: 99736f90-db0f-4cba-8f44-a73a603eee0b]   File "/usr/lib/python2.7/site-packages/nova/virt/libvirt/driver.py", line 4980, in migrate_disk_and_power_off</span></span>
TRACE nova.compute.manager [instance: 99736f90-db0f-4cba-8f44-a73a603eee0b]     utils.execute('ssh', dest, 'mkdir', '-p', inst_base)</span></span>
TRACE nova.compute.manager [instance: 99736f90-db0f-4cba-8f44-a73a603eee0b]   File "/usr/lib/python2.7/site-packages/nova/utils.py", line 165, in execute</span></span>
TRACE nova.compute.manager [instance: 99736f90-db0f-4cba-8f44-a73a603eee0b]     return processutils.execute(*cmd, **kwargs)</span></span>
TRACE nova.compute.manager [instance: 99736f90-db0f-4cba-8f44-a73a603eee0b]   File "/usr/lib/python2.7/site-packages/nova/openstack/common/processutils.py", line 193, in execute</span></span>
TRACE nova.compute.manager [instance: 99736f90-db0f-4cba-8f44-a73a603eee0b]     cmd=' '.join(cmd))</span></span>
TRACE nova.compute.manager [instance: 99736f90-db0f-4cba-8f44-a73a603eee0b] ProcessExecutionError: Unexpected error while running command.</span></span>
TRACE nova.compute.manager [instance: 99736f90-db0f-4cba-8f44-a73a603eee0b] Command: ssh 10.5.2.20 mkdir -p /var/lib/nova/instances/99736f90-db0f-4cba-8f44-a73a603eee0b</span></span>
TRACE nova.compute.manager [instance: 99736f90-db0f-4cba-8f44-a73a603eee0b] Exit code: 255</span></span>
TRACE nova.compute.manager [instance: 99736f90-db0f-4cba-8f44-a73a603eee0b] Stdout: ''</span></span>
TRACE nova.compute.manager [instance: 99736f90-db0f-4cba-8f44-a73a603eee0b] Stderr: 'Host key verification failed.\r\n'</span></span>
TRACE nova.compute.manager [instance: 99736f90-db0f-4cba-8f44-a73a603eee0b] </span></span>
ERROR oslo.messaging.rpc.dispatcher [-] Exception during message handling: Unexpected error while running command.</span></span>
Command: ssh 10.5.2.20 mkdir -p /var/lib/nova/instances/99736f90-db0f-4cba-8f44-a73a603eee0b</span></span>
Exit code: 255</span></span>
Stdout: ''</span></span>
Stderr: 'Host key verification failed.\r\n'</span></span></code></pre>
When OpenStack's nova is instructed to resize an instance it will also change
the host it is running on, almost never will it schedule the instance on the
same host and do the resize on the same host it already exists. There is a
configuration flag to change this, however in my case I would rather the
scheduler be run again, especially if the instance size is changing
drastically. During the resize process, the node where the instance is
currently running will use SSH to connect to the instance where the resized
instance will live, and copy over the instance and associated files.</p>
There are a couple of assumptions I will be making:</p>

Your nova</code>, and qemu</code> user both have the same UID on all compute nodes</li>
The path for your instances is the same on all of your compute nodes</li>
</ol>
Configure the nova user</h2>
First things first, let's make sure our nova</code> user has an appropriate shell set:</p>
cat</span> /etc/passwd</span> |</span> grep</span> nova</span></span></code></pre>
Verify that the last entry is /bin/bash</code>.</p>
If not, let's modify the user and make it so:</p>
usermod</span> -s</span> /bin/bash nova</span></span></code></pre>Generate SSH key and configuration</h2>
After doing this the next steps are all run as the nova</code> user.</p>
su</span> - nova</span></span></code></pre>
We need to generate an SSH key:</p>
ssh-keygen</span> -t</span> rsa</span></span></code></pre>
Follow the directions, and save the key WITHOUT a passphrase.</p>
Next up we need to configure SSH to not do host key verification, unless you
want to manually SSH to all compute nodes that exist and accept the key (and
continue to do so for each new compute node you add).</p>
cat</span> <<</span> EOF</span> ></span> ~/.ssh/config</span></span>
Host *</span></span>
    StrictHostKeyChecking no</span></span>
    UserKnownHostsFile=/dev/null</span></span>
EOF</span></span></code></pre>
Next we need to make sure we copy the the contents of id_rsa.pub</code> to
authorized_keys</code> and set the mode on it correctly.</p>
cat</span> ~/.ssh/id_rsa.pub</span> ></span> .ssh/authorized_keys</span></span>
chmod</span> 600</span> .ssh/authorized_keys</span></span></code></pre>
This should be all the configuration for SSH you need to do. Now comes the
import part, you will need to tar up and copy the ~nova/.ssh</code> directory to
every single compute node you have provisioned. This way all compute nodes will
be able to SSH to the remote host to run the commands required to copy an
instance over, and resize it.</p>
Reset state on existing ERROR'ed instances</h2>
If you have any instances that are currently in the ERROR</code> state due to a
failed resize, you will be able to issue the following command to reset the
state back to running and try again:</p>
nova</span> reset-state</span> --active</span> <</span>ID of instanc</span>e</span>></span></span></code></pre>
This will start the instance, and you will be able to once again issue the
resize command to resize the instance.</p>


Build numbers in binaries using waf
2014-06-10T17:32:03+00:00
My build system of choice these days for any C++ project is waf</a>. One of
the things I always like havig is the build number included in the final
binary, so that with a simple ./binary --version</code> or even ./binary</code> the
version is printed that it was built from. This can make it much simpler to
debug any potential issues, especially if fixes may have already been made but
a bad binary was deployed.</p>
Setup the wscript</h2>
Make sure that your wscript somewhere near the top contains the following:</p>
APPNAME</span> =</span> '</span>myapp</span>'</span></span>
VERSION</span> =</span> '</span>0.0.0</span>'</span></span></code></pre>
Then in your configure(cfg)</code> add the following:</p>
cfg.env.</span>VERSION</span> =</span> VERSION</span></span>
cfg.env.</span>APPNAME</span> =</span> APPNAME</span></span>
</span>
git_version</span> =</span> try_git_version</span>()</span></span>
</span>
if</span> git_version:</span></span>
    cfg.env.</span>VERSION</span> +=</span> '</span>-</span>'</span> +</span> git_version</span></span></code></pre>
The try_git_version()</code> function is fairly simple and looks like this:</p>
def</span> try_git_version</span>()</span>:</span></span>
    import</span> os</span></span>
    import</span> sys</span></span>
</span>
    version</span> =</span> None</span></span>
    try</span>:</span></span>
        version</span> =</span> os.</span>popen</span>(</span>'</span>git describe --always --dirty --long</span>'</span>).</span>read</span>().</span>strip</span>()</span></span>
    except</span> Exception</span> as</span> e:</span></span>
        print</span> e</span></span>
    return</span> version</span></span></code></pre>
It runs git describe --always --dirty --long</code> which will return something
along these lines: 401b85f-dirty</code>. If you have any annoted tags, it will
return the tag name as well.</p>
If git</code> is not installed, or it is not a valid git</code> directory, then it will
simply return None</code>. At that point all we have to go on is the VERSION</code>
variable set at the top of the wscript.</p>
Now that we have our configuration environment set up with the VERSION</code> we
want to get that into a file that we can then include in our C++ source code.</p>
Create a build_version.h.in</code> file</h2>
#</span>ifndef</span> BUILD_VERSION_H_IN_941AD1F24D0A9D</span></span>
#</span>define</span> BUILD_VERSION_H_IN_941AD1F24D0A9D</span></span>
</span>
char</span> VERSION[] </span>=</span> "</span>@VERSION@</span>"</span>;</span></span>
</span>
#</span>endif</span> /* BUILD_VERSION_H_IN_941AD1F24D0A9D */</span></span></code></pre>Add the following to build(ctx)</code></h2>
ctx</span>(</span>features</span>=</span>'</span>subst</span>',</span></span>
        source</span>=</span>'</span>build_version.h.in</span>',</span></span>
        target</span>=</span>'</span>build_version.h</span>',</span></span>
        VERSION</span> =</span> ctx.env</span>[</span>'</span>VERSION</span>'</span>]</span>,</span></span>
        )</span></span></code></pre>
This uses the substitution feature to transform build_version.h.in</code> into
build_version.h</code>, while inserting the version into the file.</p>
Include build_version.h</code> in your source code</h2>
#</span>include</span> "</span>build_version.h</span>"</span></span></code></pre>
And add something along these lines to your main()</code>:</p>
std::cerr </span><<</span> "</span>Version: </span>"</span> <<</span> VERSION </span><<</span> std::endl;</span></span></code></pre>
This will print out the VERSION</code> that has been stored in build_version.h</code>.</p>
Full example</h2>
Check out my mdns-announce</a> project on Github for an example of how this is
implemented.</p>


Tamper proof session cookies and session storage
2014-06-10T17:09:45+00:00
As a follow-up to my previous article regarding User sessions, what data
should be stored where?</a>, I wanted to discuss how to store the session, and
how to generate cookies that are tamper proof.</p>
What are we trying to accomplish?</h2>
Ultimately we want to be able to have X amount pieces of data that are tied to
a particular user. Unfortunately due the fact that HTTP is a stateless protocol
we have to use cookies. Cookies are small little pieces of data that are
transmitted from the server to the client (generally done once), and then upon
the user coming back to the website they are transmitted from the client to the
server. This allows us to uniquely track a single user across connections to
our website.</p>
If the website allows a user to authenticate and the fact that they are
authenticated is stored in the session, we also want to make sure that we can
aggressively expire a session, if this is possible depends on our session
storage.</p>
Session storage</h2>
There are a multitude of ways to store the session data, but it ultimately
boils down to server-side or client-side. Server-side can be done in Cassandra,
Memcache, Redis or even in a SQL database.</p>
Server-side storage</h3>
The main one that has
been used for years is to use server side storage. Storing a small file on the
servers hard drive that contains the data, and the client is sent a cookie that
contains a unique identifier that is linked to the on-disk storage.</p>
For example:</p>
1 => /tmp/session_1</span></span>
2 => /tmp/session_2</span></span>
...</span></span>
N => /tmp/session_N</span></span></code></pre>Easily expire sessions</h4>
The upside to server-side storage is that it is possible for us to very easily
expire a session, simply remove the associated file/data that is stored and the
users session has now become invalid.</p>
Client-side storage</h3>
The other method that has recently started being used more to make it easier to
scale the server side is to store session data encoded in base64 in the cookie
itself. In this case there is no unique session ID, and no data is stored
server side.</p>
Expiration is more difficult</h4>
The downside to using client-side storage is that there is no way, short of the
expiration on the cookie itself for the website to expire a session. There are
work-arounds, but they all require storing state server-side. A hybrid approach
for example is possible, store a unique ID along with the session data, and
store that unique ID server side, but none of the extra data. Remove the unique
ID server side and if we receive a session that contains a unique ID we don't
recognise, we simply clear the session.</p>
Expiration, why do I care?</h2>
Being able to easily expire a users sessions allows for extra security
measures. For example in Google Mail it is possible to sign out all other
locations, this forces those other locations to re-authenticate before gaining
access to your account.</p>
This is a good security measure to have, so that if a users cookie is stolen,
or their credentials are compromised upon changing their password all their
sessions are invalidated and an attacker using an old cookie/session ID can't
continue to wreak havoc on the users account.</p>
Cookie format</h2>
If we are just storing a session ID, or the full session the cookie should be
hardened so that it can not be tampered with by a client. Even if you are
protecting the cookie using SSL, we still don't want to allow a malicious user
to modify the cookie to change the session ID or the session itself.</p>
Signing your cookie</h3>
The single best way to make sure your cookie has not been tampered with is to
cryptographically sign your cookie, and upon receiving the cookie from the
client verifying that the signature matches what you are expecting. This is
especially important if you are using client-side storage, because you don't
want someone to be able to change the user ID from 950 to 1 and suddenly
impersonate a different user.</p>
Use an HMAC</h4>
HMAC (Hash-based message authentication code) is an cryptographic construct
that uses a hashing algorithm (SHA-1, SHA-256, SHA-3) to create a MAC (message
authentication code) with a secret key. It is very easy given the secret key
and the original data to create the MAC, but it is very difficult if not
impossible to take the original data, and MAC and get the secret key.</p>
This allows us to do the following:</p>
data = "Hello World"</span></span>
mac = HMAC(data, sha256, "SEEKRIT")</span></span></code></pre>
Our mac</code> would now be equal to:</p>
e655f98cb9b3c02f45576f7906d64b0b7f8731f25a5319c42ca666917aca45a4</span></span></code></pre>
If we now create our cookie as follows:</p>
cookie = mac + " " + data</span></span></code></pre>
It would look as follows:</p>
cookie = e655f98cb9b3c02f45576f7906d64b0b7f8731f25a5319c42ca666917aca45a4 Hello World</span></span></code></pre>
We can then send that to the client that requested the page. Once the client
visits the next page, their browser will send that same cookie back to use. If
we split the mac from the data, we can then do the following operation:</p>
cookie = e655f98cb9b3c02f45576f7906d64b0b7f8731f25a5319c42ca666917aca45a4 Hello World</span></span>
data = "Hello World"</span></span>
mac = e655f98cb9b3c02f45576f7906d64b0b7f8731f25a5319c42ca666917aca45a4</span></span>
</span>
mac_verify = HMAC(data, sha256, "SEEKRIT")</span></span>
</span>
mac_verify == mac</span></span></code></pre>
If and only if mac_verify</code> and mac</code> are the same can we be sure that the
cookie has not been tampered with.</p>
This requires that the client is NEVER aware of what we are using as our secret
key. In the above exmaples that is "SEEKRIT". In your web application you will
be required to make this a configuration variable, and you will have to take
care not to commit that configuration variable to a git repository and upload
it to github (for example).</p>
Do not use a bare hash algorithm</h4>
Using a bare hash algorithm allows for length extension attacks</a> if used
incorrectly, this would allow an attacker to concatenate extra data to the end
of our existing data, modify the "MAC" and the server would accept it.</p>
This construct is thus very dangerous:</p>
data = "Hello World"</span></span>
key = "SEEKRIT"</span></span>
mac = SHA1(key + data)</span></span></code></pre>
The following construct is still not recommended, but is not nearly as
dangerous:</p>
mac = SHA1(data + key)</span></span></code></pre>
Due to the key being last, this is not vulnerable to a length extension attack,
however please don't do this, instead stick to using an HMAC instead.</p>
Encrypting session data</h2>
When using client-side storage, it may be beneficial to encrypt the data to add
an extra layer of security. Even if encrypting the data you need to continue
using a MAC.</p>
Using just encryption will not protect you against decrypting bad data because
an attacker decided to provide invalid data. Signing the cookie data with a MAC
makes sure that the attacker is not able to mess with the ciphertext.</p>
What are web frameworks/languages doing by default?</h2>
I am most familiar with the Pylons Project's Pyramid Web Framework</a>, the
default session implementation that is provided by the project is named
SignedCookieSessionFactory</code>, as the name implies this uses a client-side
cookie to store the session data, which is signed using a secret key that is
provided upon instantiation of the factory.</p>
Flask sessions</a> also uses a signed cookie for client-side session storage.</p>
Ruby on Rails</a> uses a signed/encrypted cookie for client-side session
storage by default.</p>
PHP</a> does not by default sign the session cookie, it does however use
server-side storage for session data by default. However extra security can be
added by installing PHP SuHoSin</a> which adds session cookie
encryption/signing.</p>


Building custom ports with Poudriere and Portshaker
2013-12-11T00:10:11+00:00
Guest post by Scott Sturdivant</a>.</em></p>
Maintaining custom ports and integrating them into your build process doesn't
need to be difficult.  The documentation surrounding this process however is
either non-existent, or lacking in its clarity.  At the end of the day, it really
is as simple as maintaining a repository whose structure matches the ports tree
layout, then managing that repository and the standard ports tree
with portshaker</a>, and finally handing the end result off to poudriere</a>.</p>
Your Custom Repository</h2>
For this example, we'll assume a git</a> repo is used and that you're already
familiar with how to build FreeBSD</a> ports</a>.  We'll also assume that we
have but a single port that we're maintaining and that it is called myport</code>.
The hierarchy of your repo should simply be category/myport</code>.  We'll refer to
this repo simply as myrepo</code>.</p>
Portshaker</h2>
Portshaker is the tool responsible for taking multiple ports sources and then
merging them down into a single target.  In our case, we have two sources: our
git repo (myrepo</code>) containing myport</code>, and the standard FreeBSD ports tree.
We aim to merge this down into a single ports tree that poudriere will then use
for its builds.</p>
To configure portshaker, add the following to the
/usr/local/etc/portshaker.conf</code> file:</p>
# vim:set syntax=sh:</span></span>
# $Id: portshaker.conf.sample 116 2008-09-30 16:15:02Z romain.tartiere $</span></span>
</span>
#---[ Base directory for mirrored Ports Trees ]---</span></span>
mirror_base_dir</span>=</span>"</span>/var/cache/portshaker</span>"</span></span>
</span>
#---[ Directories where to merge ports ]---</span></span>
ports_trees</span>=</span>"</span>default</span>"</span></span>
</span>
use_zfs</span>=</span>"</span>no</span>"</span></span>
poudriere_ports_mountpoint</span>=</span>"</span>/usr/local/poudriere/ports</span>"</span></span>
default_poudriere_tree</span>=</span>"</span>default</span>"</span></span>
default_merge_from</span>=</span>"</span>freebsd myrepo</span>"</span></span></code></pre>
Some key points here are that the two items listed in for the
default_merge_from</code> argument need to have scripts present in the
/usr/local/etc/portshaker.d</code> directory.  Further more, the combination of the
poudriere_ports_mountpoint</code> and default_poudriere_tree</code> needs to be a ports
tree that is then registered with poudriere.</p>
Next, we need to tell portshaker how to go off and fetch our two types of ports
trees, freebsd</code> and myrepo</code>.  For the freebsd</code> ports tree, create
/usr/local/etc/portshaker.d/freebsd</code> with the following contents and make it
executable:</p>
#!/bin/sh</span></span>
.</span> /usr/local/share/portshaker/portshaker.subr</span></span>
method</span>=</span>"</span>portsnap</span>"</span></span>
run_portshaker_command</span> $*</span></span></code></pre>
Next, create a similar script to handle our repository containing our custom
port.  /usr/local/etc/portshaker.d/myrepo</code> should contain the following and
similarly be executable:</p>
#!/bin/sh</span></span>
.</span> /usr/local/share/portshaker/portshaker.subr</span></span>
method</span>=</span>"</span>git</span>"</span></span>
git_clone_uri</span>=</span>"</span>http://github.com/scottsturdivant/packaging.git</span>"</span></span>
git_branch</span>=</span>"</span>master</span>"</span></span>
run_portshaker_command</span> $*</span></span></code></pre>
Obviously replace the git_clone_uri</code> and git_branch</code> variables to reflect
your actual configuration.  For more information about the values and what they
can contain, consult man portshaker.d</code></p>
Now, portshaker should be all set.  Execute portshaker -U</code> to update your
merge_from</code> ports trees (freebsd</code> and myrepo</code>).  You'll see the standard
portsnap</a> fetch and extract process as well as a git clone.  After a good
bit of time, these will both be present in the /var/cache/portshaker</code>
directory.  Go ahead and merge them together by executing portshaker -M</code>.</p>
Hooray!  You now have /usr/local/poudriere/ports/default/ports</code> that is a
combination of the normal ports tree and your custom one.</p>
We're effectively complete with configuring portshaker.  Whenever your port is
updated, just re-run portshaker -U</code> and portshaker -M</code> to grab the latest
changes and perform the merge.</p>
Poudriere</h2>
Poudriere is a good tool for building ports.  We will use it to handle our
merged directory.  Begin by configuring poudriere
(/usr/local/etc/poudriere.conf</code>):</p>
NO_ZFS</span>=yes</span></span>
FREEBSD_HOST</span>=ftp://ftp.freebsd.org</span></span>
RESOLV_CONF</span>=/etc/resolv.conf</span></span>
BASEFS</span>=/usr/local/poudriere</span></span>
USE_PORTLINT</span>=no</span></span>
USE_TMPFS</span>=yes</span></span>
DISTFILES_CACHE</span>=/usr/ports/distfiles</span></span>
CHECK_CHANGED_OPTIONS</span>=yes</span></span></code></pre>
Really there's nothing here that is specific to the problem at hand, so feel
free to consult the provided configuration file to tune it to your needs.</p>
Now, the step that is</em> specific is to set poudriere up with a ports tree that
it does not manage, specifically our resultant merged directory.  If you
consult man poudriere</code>, it specifies that for the ports</code> subcommand, there is
a -m method</code> switch which controls the methodology used to create the ports
tree.  By default, it is portsnap.  This is confusing as in our case, we do not
want poudriere to actually do anything.  We want it to just use an existing
path.  Fortunately, there is a way!</p>
The poudriere wiki has an entry for using the system ports tree</a>, so we
adopt it for our needs by executing:</p>
poudriere</span> ports</span> -c -F -f</span> none</span> -M</span> /usr/local/poudriere/ports/default</span> \</span></span>
    -p</span> default</span></span></code></pre>
If you've consulted the poudriere manpage, you'll see that the -F</code> and -f</code>
switches both reference ZFS in their help.  As we're not using ZFS, it's not
clear how they will behave.  However, in conjunction with the custom mountpoint
(-M /usr/local/poudriere/ports/default</code>), we ultimately wind up with what we
want, a ports tree that poudriere can use, but does not manage:</p>
# poudriere ports -l</span></span>
PORTSTREE            METHOD     PATH</span></span>
default              -          /usr/local/poudriere/ports/default</span></span></code></pre>
Note that this resulting PATH is the combination of the
poudriere_ports_mountpoint</code> and default_poudriere_tree</code> variables present in
our /usr/local/etc/portshaker.conf</code> configuration file.</p>
Building software from your custom ports tree</h2>
Go ahead and create your jail(s) like you normally would (i.e.
poudriere -c -j 92amd64 -V 9.2-RELEASE -a amd64</code>) and any other configuration
you would like, and then go ahead and build myport</code> with
poudriere bulk -j 92amd64 -p default category/myport</code>.  Success!</p>


User sessions, what data should be stored where?
2013-08-25T13:05:00+00:00
This article has been updated. For the old version please check
Archive.org</a></em></p>
A couple of days ago on reddit.com</a>'s /r/netsec</a> a poster by the name
of Dan Weber</a> posted what he believed to be an attack on PHP sessions:
Hacking PHP sessions by running out of memory</a> (reddit link)</a>. The way
the "attack" works is as follows:</p>

Create a new session</li>
Assign some new data to the session, in this case a username which is used
to signify that the user is logged in.</li>
Check to verify that the user should be logged in</li>
If the user should not be logged in, destroy the session.</li>
</ol>
The "attack" would be to run the PHP</a> script out of memory on number 3, since
once something is set on the session it is immediately stored, so even if the
user is not supposed to be logged in, they are now logged in since their
session says they are.</p>
I wouldn't necessarily call this a PHP hack, this is really just bad practice
in terms of programming, the logic should be reversed.</p>

Create a new session</li>
Verify the user should be logged in</li>
If so, set the session data</li>
If the user should not be logged in, don't set the session data</li>
</ol>
That would solve the problem at hand, and now there is no way for the user to
trick the PHP script into believing she is logged in when that is not the case.</p>
However as the discussion went on on Reddit, it became even more clear that
there are no good resources on what you should store in the user session, and
what you shouldn't store in the user session. Some of these things may seem
like common knowledge, but sadly this is something every single new person to
programming has to learn on their own.</p>
Some assumptions</h2>
Let's get this out of the way, this is in no way limited to PHP, but it is the
one I will be using as an example. This can all apply to Ruby (Ruby on
Rails</a>), Python (Pyramid</a>) or many other frameworks.</p>
The basic problem is that generally writing to the session is not an atomic
transaction based on the page accessed, so the assumption made in this article
is that when you write to the session it is instantly committed, and there is
no way to roll it back upon failure. If there was, our first example listed
wouldn't be able to occur since upon running out of memory at step 3, the
session would have been rolled back and cleaned up.</p>
What should you store in the users session?</h2>
You should only really store anything in the session that if it were made
public it would do very little harm.</p>
Really the list of items to be stored in a session are as follows:</p>

The users unique id (The ID that allows you to retrieve the users
information from storage)</li>
Temporary state (i.e. Flash messages)</li>
CSRF token</li>
</ol>
More importantly, don't store permission bits, or group memberships, or
anything that is used to allow/deny access to particular resources. You want to
store just enough information that upon a user accessing your site you are able
to retrieve the users information from storage, and based upon that information
from storage you then make decisions such as permissions/group memberships.</p>
Why is this important?</h3>
One of the things that Dan Weber brought up in the Reddit post was storing the
users permission level and group membership in the session. If your code is
then relying on the session to always contain the right permission level, then
there is no way to expire someones access to the data.</p>

A user logs in</li>
A user gets various permissions, and they are set in the session</li>
The user has been fired from his job, and an administrator removes the
users permissions</li>
Since the user is still logged in, the users permission bits are still
set, and he continues to have access to parts of the site/information he
shouldn't have access to.</li>
</ol>
If instead on every page visit we simply pull out the users unique id and
verify the permissions upon access, as soon as the permissions are revoked by
the administrator the user no longer has access to the various resources.</p>
Temporary state</h3>
There has to be an easy way to remember something from page visit to page visit
that isn't considered detrimental if the information gets lost. One of those
things is flash messages. Flash messages are generally used to provide the user
indication that something has changed, they are shown once and then never
again.</p>
Storing these as session data makes sense. If the flash message gets set,
great, if it doesn't get set, it doesn't matter. Flash messages are simply a
notification tool, if the user misses them it isn't important.</p>
What you shouldn't store in the session</h2>
Definitely don't store any kind of permission bits, groups a user is a part of
or anything that would allow the user access that they normally would not be
able to access.</p>
On each page access check what permissions the user has. While it may mean a
little more heavy lifting server side it provides extra security, and the means
to enforce changes in permissions instantly.</p>
Good secure programming practices</h2>
Keep secure programming practices in mind at all times, always consider how the
information you are storing/processing is accessed/viewed/administered. More
importantly think about the access controls that are in place, and how one
could expire access to a particular resource without requiring a co-operative
client.</p>
The ordering of how variables are set, and when they are set are very
important.  $_SESSION['isadmin'] = True</code> at the top of a PHP script, and then
removing it by checking to see if the user is actually an administrator later
on in the script is a bad idea.</p>
Always order your code so that if a failure does occur there is no chance that
a critical section of your code is executed by accident, or that information is
stored in a half-verified state. This is especially important for access
control.</p>


Embedding ZeroMQ in the libev Event Loop
2013-04-20T18:22:00+00:00
In a previous article on ZeroMQ</a> we went over how ZeroMQ is triggered when
you use the socket that ZeroMQ returns, in that article there was some
discussion of embedding ZeroMQ into another event loop. Let's do that.</p>
libev</a> is an absolutely fantastic library that helps make it easy to write
evented programs. Evented programs work by getting notified that an action has
happened, and acting upon it. Unlike threaded where multiple pieces of work are
being executed at the same time, in an evented system you move every item that
could block to an event loop, that then calls back into user code with a
notification to continue. If one event uses up more than its fair share of CPU
time because it is busy doing a long calculation, every single other event that
is waiting will never get notified.</p>
Now, as previously discussed ZeroMQ is edge triggered, so embedding it into an
event loop that is level triggered doesn't do us much good, because we will miss
certain ZeroMQ notifications.</p>
One way to solve this problem is by looping over ZeroMQ's event system until we
get back a notification that it no longer has anything else for us to process,
that would look something like this1</a></sup>:</p>
int</span> zevents </span>=</span> 0</span>;</span></span>
size_t</span> zevents_len </span>=</span> sizeof</span>(zevents);</span></span>
zmq_socket</span>.</span>getsockopt</span>(ZMQ_EVENTS,</span> &</span>zevents,</span> &</span>zevents_len);</span></span>
</span>
do</span> {</span></span>
    if</span> (zevents </span>&</span> ZMQ_POLLIN) {</span></span>
        // We can read from the ZeroMQ socket</span></span>
    }</span> else</span> {</span></span>
        break</span>;</span></span>
    }</span></span>
</span>
    // Check to see if there is more to read ...</span></span>
    zmq_socket</span>.</span>getsockopt</span>(ZMQ_EVENTS,</span> &</span>zevents,</span> &</span>zevents_len);</span></span>
}</span> while</span> (zevents </span>&</span> ZMQ_POLLIN);</span></span>
</span>
if</span> (zevents </span>&</span> ZMQ_POLLOUT) {</span></span>
    // We can write to the ZeroMQ socket</span></span>
}</span></span>
</span>
// If neither of the above is true, then it was a false positive</span></span></code></pre>
However if we are receiving information from ZeroMQ remote endpoints faster
than we can process them, we end up being stuck in that do</code> ... while</code> loop
forever. If we have other events we want to process, that isn't entirely fair
since they will never ever get called again. Especially in a server application
where it may be servicing thousands of clients this is simply not acceptable.</p>
libev</h2>
libev provides various different event notifications, to be able to get around
edge triggered notifications, and still provide fair round-robin for all events
we are going to have to build on top of multiple different events.</p>
The events used will be:</p>

ev::io</code></a>: This one is pretty self explanatory, this is for getting notified
about input output changes. This is the one we are going to use on the
ZMQ_FD</code>.</li>
ev::prepare</code></a> and ev::check</code></a>: These two are generally used together, they
can be used to change the event loop and or make modifications on the fly to
events that have been registered with the event loop.</li>
ev::idle</code></a>: This is an event that gets fired whenever the event loop has
nothing else to do, so no other events fired, this will fire.</li>
</ul>
Plan of attack</h2>
Since the prepare</code> and check</code> run before and after the loop, we are going to
be using those to do most of the work. We use an io</code> so that we can turn off
the idle</code> when we can actually wait for a result from ZeroMQ's file
descriptor, otherwise we use idle</code> so that we will always get called once
every loop.</p>
In the prepare</code> watcher callback we do the following:</p>

Check to see what events ZeroMQ has for us, and check what events the user
has requested.</li>
If the ZeroMQ has an event for us that we want, and the user has requested
that event, we start the idle watcher.</li>
If ZeroMQ has no events, we start the io watcher.</li>
</ol>
In the check</code> watcher callback we do the following:</p>

Stop both the io</code> and idle</code> watchers, they were only there to make sure
that our check</code> watcher was called.</li>
See what event ZeroMQ has for us, and check that against what the user
wants. Depending on the event, call user defined function write() or user
defined function read().</li>
If this was a spurious wake-up on the part of ZeroMQ we simply ignore it
and let libev go on to other events.</li>
</ol>
We could make all of this work by simply using the prepare</code>, check</code> and
idle</code> watchers, but that would mean libev would be busy-waiting for something
to happen on the ZeroMQ socket. The io</code> watcher is required simply so in times
of nothing happening libev in its library can call into the kernels event
handling mechanism and go to sleep. We can't use just the io</code> watcher due to
the edge-triggered notification, because we'd miss all kinds of ZeroMQ
messages. So all four watchers are required, and play crucial parts in making
this work.</p>
Let's get down to code</h2>
Below you will find example code, it is not complete. Do note that I am using
some C++11isms, error checking code may not be complete/correct and in general
I don't suggest you copy and paste this without reading and understanding what
it does.</p>
The zmq_event</code> class is meant to be used as a base class, inherit from it, and
create the write()</code> and read()</code> functions. These functions will be called
when you are able to read from the ZeroMQ socket, or when you are able to write
to the ZeroMQ socket. You are guaranteed to be able to read one whole ZeroMQ
message, so if it is a multi-part message, do make sure to loop on
ZMQ_SNDMORE</code> as required.</p>
Upon instantiation it will automatically start being notified about events, we
start off with ev::READ</code>. When your sub-class wants to write to ZeroMQ it
should put the messages to be written into a list somewhere, and set
ev::READ | ev::WRITE</code> on watcher_io</code>, by calling
watcher_io.set(socket_fd, ev::READ | ev::WRITE)</code>. write()</code> will then be
called, write a single message to ZeroMQ, and if necessary when finished
writing, unset ev::WRITE</code> using watcher_io.set(socket_fd, ev::READ)</code>. If you
are not finished writing, after writing that singular message you may return
and write()</code> will be called again the next loop iteration. This way if you
have a lot of data to write you don't starve the other events from receiving
their notifications.</p>
zmq_event.h</code></h4>
#</span>include</span> <</span>string</span>></span></span>
</span>
#</span>include</span> <</span>ev++.h</span>></span></span>
#</span>include</span> <</span>zmq.hpp</span>></span></span>
</span>
class</span> zmq_event {</span></span>
    public:</span></span>
        zmq_event</span>(zmq::</span>context_t</span>&</span> context</span>,</span> int</span> type</span>,</span> const</span> std::string</span>&</span> connect</span>);</span></span>
        virtual</span> ~zmq_event</span>();</span></span>
</span>
    protected:</span></span>
        // This gets fired before the event loop, to prepare</span></span>
        void</span> before</span>(ev::prepare</span>&</span> prep</span>,</span> int</span> revents</span>);</span></span>
</span>
        // This is fired after the event loop, but before any other type of events</span></span>
        void</span> after</span>(ev::check</span>&</span> check</span>,</span> int</span> revents</span>);</span></span>
</span>
        // We need to have a no-op function available for those events that we</span></span>
        // want to add to the list, but should never fire an actual event</span></span>
        template</span> <</span>typename</span> T></span></span>
            inline</span> void</span> noop</span>(T</span>&</span> w</span>,</span> int</span> revents</span>) {};</span></span>
</span>
        // Function we are going to call to write to the ZeroMQ socket</span></span>
        virtual</span> void</span> write</span>()</span> =</span> 0</span>;</span></span>
</span>
        // Function we are going to call to read from the ZeroMQ socket</span></span>
        virtual</span> void</span> read</span>()</span> =</span> 0</span>;</span></span>
</span>
        // Some helper function, one to start notifications</span></span>
        void</span> start_notify</span>();</span></span>
</span>
        // And one to stop notifications.</span></span>
        void</span> stop_notify</span>();</span></span>
</span>
        // Our event types</span></span>
        ev::io      watcher_io;</span></span>
        ev::prepare watcher_prepare;</span></span>
        ev::check   watcher_check;</span></span>
        ev::idle    watcher_idle;</span></span>
</span>
        // Our ZeroMQ socket</span></span>
        zmq::</span>socket_t</span> socket;</span></span>
        int</span>           socket_fd </span>= -</span>1</span>;</span></span>
};</span></span></code></pre>zmq_event.cc</code></h4>
#</span>include</span> <</span>stdexcept</span>></span></span>
</span>
#</span>include</span> "</span>zmq_event.h</span>"</span></span>
</span>
zmq_event::</span>zmq_event</span>(zmq::</span>context_t</span>&</span> context,</span> int</span> type,</span> const</span> std::string</span>&</span> connect) :</span> socket</span>(context, type) {</span></span>
    // Get the file descriptor for the socket</span></span>
    size_t</span> fd_len </span>=</span> sizeof</span>(_socket_fd);</span></span>
    socket</span>.</span>getsockopt</span>(ZMQ_FD,</span> &</span>socket_fd,</span> &</span>fd_len);</span></span>
</span>
    // Actually connect to the ZeroMQ endpoint, could replace this with a bind as well ...</span></span>
    socket</span>.</span>bind</span>(</span>connect</span>.</span>c_str</span>());</span></span>
</span>
    // Set up all of our watchers</span></span>
</span>
    // Have our IO watcher check for READ on the ZeroMQ socket</span></span>
    watcher_io</span>.</span>set</span>(socket_fd, ev::READ);</span></span>
</span>
    // This watcher has a no-op callback</span></span>
    watcher_io</span>.</span>set</span><</span>zmq_event,</span> &</span>zmq_event::noop</span>></span>(</span>this</span>);</span></span>
</span>
    // Set up our prepare watcher to call the before() function</span></span>
    watcher_prepare</span>.</span>set</span><</span>zmq_event,</span> &</span>zmq_event::before</span>></span>(</span>this</span>);</span></span>
</span>
    // Set up the check watcher to call the after() function</span></span>
    watcher_check</span>.</span>set</span><</span>zmq_event,</span> &</span>zmq_event::after</span>></span>(</span>this</span>);</span></span>
</span>
    // Set up our idle watcher, once again a no-op</span></span>
    watcher_idle</span>.</span>set</span><</span>zmq_event,</span> &</span>zmq_event::noop</span>></span>(</span>this</span>);</span></span>
</span>
    // Tell libev to start notifying us!</span></span>
    start_notify</span>();</span></span>
}</span></span>
</span>
zmq_event::</span>~</span>zmq_event</span>() {}</span></span>
</span>
zmq_event::</span>before</span>(ev::prepare</span>&</span>,</span> int</span> revents) {</span></span>
    if</span> (EV_ERROR </span>&</span> revents) {</span></span>
        throw</span> std::</span>runtime_error</span>(</span>"</span>libev error</span>"</span>);</span></span>
    }</span></span>
</span>
    // Get any events that may be waiting</span></span>
    uint32_t</span> zevents </span>=</span> 0</span>;</span></span>
    size_t</span> zevents_len </span>=</span> sizeof</span>(zevents);</span></span>
</span>
    // Lucky for us, getting the events available doesn't invalidate the</span></span>
    // events, so that calling this in `before()` and in `after()` will</span></span>
    // give us the same results.</span></span>
    socket</span>.</span>getsockopt</span>(ZMQ_EVENTS,</span> &</span>zevents,</span> &</span>zevents_len);</span></span>
</span>
    // Check what events exists, and check it against what event we want. We</span></span>
    // "abuse" our watcher_io.events for this information.</span></span>
    if</span> ((zevents </span>&</span> ZMQ_POLLOUT)</span> &&</span> (</span>watcher_io</span>.</span>events</span> &</span> ev::WRITE)) {</span></span>
        watcher_idle</span>.</span>start</span>();</span></span>
        return</span>;</span></span>
    }</span></span>
</span>
    if</span> ((zevents </span>&</span> ZMQ_POLLIN)</span> &&</span> (</span>watcher_io</span>.</span>events</span> &</span> ev::READ)) {</span></span>
        watcher_idle</span>.</span>start</span>();</span></span>
        return</span>;</span></span>
    }</span></span>
</span>
    // No events ready to be processed, we'll just go watch some io</span></span>
    watcher_io</span>.</span>start</span>();</span></span>
}</span></span>
</span>
zmq_event::</span>after</span>(ev::check</span>&</span>,</span> int</span> revents) {</span></span>
    if</span> (EV_ERROR </span>&</span> revents) {</span></span>
        throw</span> std::</span>runtime_error</span>(</span>"</span>libev error</span>"</span>);</span></span>
    }</span></span>
</span>
    // Stop both the idle and the io watcher, no point in calling the no-op callback</span></span>
    // One of them will be reactived by before() on the next loop</span></span>
    watcher_idle</span>.</span>stop</span>();</span></span>
    watcher_io</span>.</span>stop</span>();</span></span>
</span>
    // Get the events</span></span>
    uint32_t</span> zevents </span>=</span> 0</span>;</span></span>
    size_t</span> zevents_len </span>=</span> sizeof</span>(zevents);</span></span>
    socket</span>.</span>getsockopt</span>(ZMQ_EVENTS,</span> &</span>zevents,</span> &</span>zevents_len);</span></span>
</span>
    // Check the events and call the users read/write function</span></span>
    if</span> ((zevents </span>&</span> ZMQ_POLLIN)</span> &&</span> (</span>watcher_io</span>.</span>events</span> &</span> ev::READ)) {</span></span>
        this</span>-></span>read</span>();</span></span>
    }</span></span>
</span>
    if</span> ((zevents </span>&</span> ZMQ_POLLOUT)</span> &&</span> (</span>watcher_io</span>.</span>events</span> &</span> ev::WRITE)) {</span></span>
        this</span>-></span>write</span>();</span></span>
    }</span></span>
}</span></span>
</span>
zmq_event::</span>start_notify</span>() {</span></span>
    watcher_check</span>.</span>start</span>();</span></span>
    watcher_prepare</span>.</span>start</span>();</span></span>
}</span></span>
</span>
zmq_event::</span>stop_notify</span>() {</span></span>
    watcher_check</span>.</span>stop</span>();</span></span>
    watcher_prepare</span>.</span>stop</span>();</span></span>
}</span></span></code></pre>Other event loops</h2>
libev is but just one of many event loops that exist out there, hopefully
this shows how it is possible to embed ZeroMQ into an event loop, thereby
making it easier to embed ZeroMQ into any other event loops.</p>



This snippet was from my older article regarding
ZeroMQ edge triggered notifications</a>. I would highly suggest reading that
article for more information and even more background on what is going on. ↩</a></p>
</li>
</ol>
</section>


ZeroMQ - Edge Triggered Notification
2012-09-10T19:01:50+00:00
ZeroMQ</a> is an absolutely fantastic communications library that has allowed
me to very easily create networks/connections between multiple different
applications to communicate in an extremely fast yet directed manner and allow
scaling of the connected entities with almost no second thought.</p>
I have used ZeroMQ within Python and C++, and it has been fantastic leaving
that part of the communication layer to a library rather than writing something
similar myself. However, embedding ZeroMQ into an another event loop has proven
to have some quirks. They are documented in the API, but not so much by other
users/examples found around the web, and caught me by surprise.</p>
This post mainly goes over the issue, the difference between edge and level
triggered and how ZeroMQ works. I am hoping to spend some time documenting how
to embed ZeroMQ correctly inside libev</a> at a later date.</p>
The quirk</h2>
ZeroMQ allows you to get an underlying file descriptor (ZMQ_FD</code>) for a ZeroMQ
socket using getsockopt()</code></a>, this is not the actual ZeroMQ file descriptor
but a stand-in:</p>
int</span> fd </span>=</span> 0</span>;</span></span>
size_t</span> fd_len </span>=</span> sizeof</span>(fd);</span></span>
zmq_socket</span>.</span>getsockopt</span>(ZMQ_FD,</span> &</span>fd,</span> &</span>fd_len);</span></span></code></pre>
This file descriptor can then be passed on to poll()</code>, select()</code>, kqueue()</code>
or whatever your event notification library of choice may be, the idea being
that if the file descriptor is notified to be available for reading then you
check the sockets ZMQ_EVENTS</code></a> and find out if you are allowed to read or
write to the ZeroMQ socket, or even possibly neither (false positive). The same
file descriptor is also used internally within the ZeroMQ library for
notification and thus we may receive an event notification that we can't do
anything with.</p>
As stated in the ZeroMQ API guide for getsockopt()</code> under ZMQ_FD</code></a>:</p>

the ØMQ library shall signal any pending events on the socket in an
edge-triggered</em> fashion by making the file descriptor become ready for
reading.</p>
</blockquote>
and further it states:</p>

The ability to read from the returned file descriptor does not necessarily
indicate that messages are available to be read from, or can be written to,
the underlying socket; applications must retrieve the actual event state with
a subsequent retrieval of the ZMQ_EVENTS</code> option.</p>
</blockquote>
So far so good, so after we return from our event notification on the file
descriptor we simply ask ZeroMQ whether or not we can read or write (or
possibly both):</p>
int</span> zevents </span>=</span> 0</span>;</span></span>
size_t</span> zevents_len </span>=</span> sizeof</span>(zevents);</span></span>
zmq_socket</span>.</span>getsockopt</span>(ZMQ_EVENTS,</span> &</span>zevents,</span> &</span>zevents_len);</span></span>
</span>
if</span> (zevents </span>&</span> ZMQ_POLLIN) {</span></span>
    // We can read from the ZeroMQ socket</span></span>
}</span></span>
</span>
if</span> (zevents </span>&</span> ZMQ_POLLOUT) {</span></span>
    // We can write to the ZeroMQ socket</span></span>
}</span></span>
</span>
// If neither of the above is true, then it was a false positive</span></span></code></pre>
So now you are happily reading from ZeroMQ and using the data as you wish,
except you start to notice that sometimes it can take a little while for data
to show up, or that if the end-point you are connected to on ZeroMQ sends a lot
of data it is not delivered in a timely fashion. This is where the
documentation for edge triggered comes into play, and that is something that is
different about ZeroMQ compared to for example BSD sockets.</p>
Edge triggered versus level triggered</h2>
Edge and level triggered refer to what kind of signal a device will output in
an attempt to gain the attention of another device. Edge and level triggered
have their history in electronics and hardware, where they play a very crucial
role.</p>
For both level and edge triggered assume the data is represented by this simple string:</p>
00000000000111111111111111111111100000000011111111111000000000</span></span></code></pre>
The zeroes (0) are where no data is available, and the ones (1) are where data
is available for processing.</p>
Level triggered</h3>
Level triggered devices when they require attention, and until they no longer
require attention will signal with a high voltage (going back to early
electronics), and when they no longer require attention signal with a low
voltage.</p>
Data:  00000000001111111111111111111111000000000011111111111000000000</span></span>
Block:      A               B              C         D</span></span>
+ 5v              ____________________           _________</span></span>
  -    __________|                    |_________|         |__________</span></span>
  0v</span></span>
State: 0          1                    0          1        0</span></span></code></pre>
At this point, once the signal turns to 1 in block B we can start processing
data, and until we are done processing data the signal will stay 1. Once we are
done processing the device will signal that we are done by setting the state to
0 in block C, and the process can repeat itself with block D.</p>
Edge triggered</h3>
Edge triggered devices when they require attention will simply turn on the
signal for a short period of time and then turn it back off until all of the
requireding processing is complete at which point they will once again signal
that they need processing.</p>
Data:  00000000001111111111111111111111100000000011111111111000000000</span></span>
Block:      A     B              C                 D</span></span>
+ 5v              __                              __</span></span>
  -    __________|  |____________________________|  |________________</span></span>
  0v</span></span>
State: 0          1              0                1        0</span></span></code></pre>
In this case when the trigger arrives you have to process all of the data
available. When block B arrives and we get 1 as our signal, we have to process
all of the data, we won't know when we are done other than some other
notification scheme by the device. (Such as a special message that says we are
done). Then when we are done we can go back to listening to waiting for a
trigger.</p>
If however in the time that we are processing the data from the trigger at B
receive more data to process we won't get notified because we weren't
officially done processing data from the device, and thus the device will not
notify us of the new data again until we have processed all of the data.</p>
There are some devices that as soon as you start processing their data, you
re-enable the trigger, so if you receive new data while still processing the
old you will get a new notification.</p>
ZeroMQ uses edge triggered</h2>
When multiple message arrive for the ZeroMQ socket, one notification is sent.
You check to see if the ZMQ_EVENTS</code> actually contains ZMQ_POLLIN</code> and then
read a single message from ZeroMQ. Content that you have processed the data
ZeroMQ has for you, you add the file descriptor back to the event notification
library and wait. However, you know you sent two messages, but all you got was
one. The next time you send data to the socket, it returns the second message,
and you have now send three but the third doesn't seem to arrive.</p>
This is where the edge triggered comes in. ZeroMQ only notifies you once, and
after it has notified you it won't notify you again until it receives new
messages, EVEN</em> if you have messages waiting for you. In BSD sockets when you
recv()</code> data from the socket, if it is not all of the data it will simply tell
you, and until all of the data has been read that the socket has to offer it is
going to tell you (level triggered).</p>
This means that when you get a notification from ZeroMQ you have to use a loop
to process all of the messages that are coming your way:</p>
int</span> zevents </span>=</span> 0</span>;</span></span>
size_t</span> zevents_len </span>=</span> sizeof</span>(zevents);</span></span>
zmq_socket</span>.</span>getsockopt</span>(ZMQ_EVENTS,</span> &</span>zevents,</span> &</span>zevents_len);</span></span>
</span>
do</span> {</span></span>
    if</span> (zevents </span>&</span> ZMQ_POLLIN) {</span></span>
        // We can read from the ZeroMQ socket</span></span>
    }</span> else</span> {</span></span>
        break</span>;</span></span>
    }</span></span>
</span>
    // Check to see if there is more to read ...</span></span>
    zmq_socket</span>.</span>getsockopt</span>(ZMQ_EVENTS,</span> &</span>zevents,</span> &</span>zevents_len);</span></span>
}</span> while</span> (zevents </span>&</span> ZMQ_POLLIN);</span></span>
</span>
if</span> (zevents </span>&</span> ZMQ_POLLOUT) {</span></span>
    // We can write to the ZeroMQ socket</span></span>
}</span></span>
</span>
// If neither of the above is true, then it was a false positive</span></span></code></pre>
The same is true if you need to send multiple messages, you will need to check
ZMQ_EVENTS</code> for ZMQ_POLLOUT</code> and send messages so long as that holds true, as
soon as it is no longer true you will need to wait until you get triggered
again by using the file descriptor in your event notification library.</p>
Embedding or co-existing with another event loop</h2>
Embedding ZeroMQ into a different event loop becomes more difficult when you
realise that it is edge triggered versus level triggered. If you want to allow
fair processing of data between events it becomes harder to accomplish with
ZeroMQ because you are required to process all of the data before going back to
your event loop or requires the setting up of different types of events
depending on the state that the ZeroMQ socket is in to make sure you process
all of the data and don't forget any.</p>
Edge triggered for the ZeroMQ file descriptor was a design decision which
unfortunately made the use of ZeroMQ sockets more difficult and different from
BSD sockets which makes it harder for application programmers to do the right
thing. There are plenty of questions on the internet regarding the proper usage
of ZMQ_FD</code> with various different event notification schemes/implementations.</p>


IPv6 -- getaddrinfo() and bind() ordering with V6ONLY
2012-08-07T22:39:56+00:00
Recently I ran into an issue that took me a while to sort out, and it is
regarding inconsistent behaviour on various OS's with regards to IPv6 sockets
(AF_INET6</code></a>1</a></sup>) and calling bind(2)</code></a> after getting the
results back from getaddrinfo(3)</code></a>.</p>
A call to getaddrinfo()</code> with the hints set to AF_UNSPEC</code></a> in ai_family</code>
and AI_PASSIVE</code></a> in ai_flags</code> will return to us 1 or more results that we
can bind()</code> to. Sample code for that looks like this:</p>
struct</span> addrinfo hints,</span> *</span>addrlist;</span></span>
</span>
memset</span>(</span>&</span>hints</span>,</span> 0</span>,</span> sizeof</span>(hints));</span></span>
</span>
// Ask for TCP</span></span>
hints.ai_socktype </span>=</span> SOCK_STREAM;</span></span>
</span>
// Any family works for us ...</span></span>
hints.ai_family </span>=</span> AF_UNSPEC;</span></span>
</span>
// Set some hints</span></span>
hints.ai_flags </span>=</span> </span></span>
    AI_PASSIVE    </span>|</span> // We want to use this with bind</span></span>
    AI_ADDRCONFIG;</span>  // Only return IPv4 or IPv6 if they are configured</span></span>
</span>
int</span> rv;</span></span>
</span>
if</span> ((rv </span>=</span> getaddrinfo</span>(</span>0</span>,</span> "</span>7020</span>"</span>,</span> &</span>hints</span>,</span> &</span>addrlist</span>))</span> !=</span> 0</span>) {</span></span>
    fprintf</span>(stderr,</span> "</span>getaddrinfo: </span>%s</span>"</span>,</span> gai_strerror</span>(rv))</span>;</span></span>
    return</span> 1</span>;</span></span>
}</span></span>
</span>
// Use the list in *addrlist</span></span>
for</span> (addr </span>=</span> addrlist; addr </span>!=</span> 0</span>; addr </span>=</span> addr</span>-</span>></span>ai_next) {</span></span>
    // use *addr as appropriate</span></span>
}</span></span>
</span>
// Clean up the memory from getaddrinfo()</span></span>
freeaddrinfo</span>(addrlist);</span></span></code></pre>
On Linux there are two entries returned when the host it is run on has both
IPv4 and IPv6 enabled. An AF_INET</code> which was followed by an AF_INET6</code>. Now,
it is not said that you are required to use all of the results that are
returned, but if you want to listen on all address families it is off course
suggested.</p>
Following the steps below for each of the returned results should result in
having 1 or more different sockets that are bound to a single port.</p>

Create the socket()</li>
Set any socket options you want (SO_REUSEADDR</code> for example)</li>
Then bind() the socket</li>
After that call listen() (followed off course by accept() on the socket)</li>
</ol>
Only for some unknown reason (and errno</code> is no help) bind()</code> fails when you
get to the AF_INET6</code>, which was returned second. Searching online as to why
the bind would fail doesn't give you any good results and the thing that is
even worse is that if you run the same code on another platform such as
FreeBSD</a>, OpenIndiana</a> or Mac OS X</a> no such failure exists. However
I started suspecting something was up when I started looking at the output from
netstat -lan | grep 7020</code> on Mac OS X. Where 7020 is the port I passed into
getaddrinfo()</code>.</p>
tcp46      0      0  *.7020                 *.*  LISTEN     </span></span>
tcp4       0      0  *.7020                 *.*  LISTEN </span></span></code></pre>
Wait a minute ... one of the sockets is on both IPv4 and on IPv6. Some more
time spent searching the internet I came across RFC 3493 section 5.3</a>,
which is titled "IPV6_V6ONLY</code> option for AF_INET6</code> Sockets".</p>

As stated in section <3.7 Compatibility with IPv4 Nodes>, AF_INET6</code> sockets
may be used for both IPv4 and IPv6 communications.  Some applications may
want to restrict their use of an AF_INET6</code> socket to IPv6 communications
only.</p>
</blockquote>
This was going down the right route, so I changed my code so that in the steps
listed above in number 2 I added the following code if the socket type is
AF_INET6</code>:</p>
if</span> (</span>setsockopt</span>(sockfd, IPPROTO_IPV6, IPV6_V6ONLY,</span> &</span>yes</span>,</span> sizeof</span>(</span>int</span>))</span> ==</span> -</span>1</span>) {</span></span>
    close</span>(sockfd)</span>;</span></span>
    fprintf</span>(stderr,</span> "</span>setsockopt: </span>%s</span> IPV6_V6ONLY</span>\n</span>"</span>,</span> strerror</span>(errno))</span>;</span></span>
    continue</span>;</span></span>
}</span></span></code></pre>
The RFC 3493 section 5.3 also states that this option should be turned off by
default, which means that all IPv6 sockets can also communicate over IPv4. Thus
technically setting the option manually in code the best way to fix the issue.
FreeBSD has had this feature turned on (as in IPv6 sockets can only communicate
with IPv6 and NOT IPv4) since 5.x.</p>
The biggest issue is that the remaining operating systems (OS X and
OpenIndiana) don't have the same behaviour as Linux which makes troubleshooting
this issue more difficult than it should be. The issue is that the RFC doesn't
specify what exactly the operating should do when it encounters a request to
bind to the same port on IPv4 and IPv6. The only place where I have found this
documented is in "IPv6 Network Programming"</a> under "Tips in IPv6
Programming" chapter 4, section 4, appropriately titled "bind(2) Ordering and
Conflicts".</p>

If you get a bind()</code> error when attempting to bind to an AF_INET6</code> socket
please make sure that you set the socket option IPV6_V6ONLY</code> on the AF_INET6</code>
socket. The default as required by RFC 3493 is to have that option be off. The
default is wrong, and the RFC should have been more specific regarding what the
right behaviour is when attempting to bind on an AF_INET6</code> socket when already
bound on an AF_INET</code> while IPV6_V6ONLY</code> is set to false.</p>
The full code that I used for testing, along with a little bit more information
is available as a gist on github</a>.</p>



The old BSD style socket()</code></a> called for defines
starting with PF_</code> such as PF_INET</code> and PF_INET6</code> with the PF</code> standing for
protocol family. POSIX starts them with AF_</code>, and calls them an address
family. On almost every operating system PF_INET</code> is the same as AF_INET</code>. If
the define doesn't exist you can always create it. ↩</a></p>
</li>
</ol>
</section>


FreeBSD 8.2 to 9.0 update with ZFS on root (mirror)
2012-04-24T18:36:20+00:00
Upgrading from one version of FreeBSD to another has become much simpler with
freebsd-update</code></a> than before, a full rebuild of the FreeBSD kernel/world
source used to be required (other upgrade paths existed but were not widely
touted). freebsd-update</code> works extremely well when using UFS as your file
system, there are however some gotcha's that one needs to look out for when
using FreeBSD Root on ZFS. Two machines needed upgrading, both are running with
a ZFS root mirror on FreeBSD 8.2-RELEASE. I had followed the FreeBSD Root on
ZFS (mirror)</a> wiki article and everything has been running smoothly ever
since.</p>
  pool: zroot</span></span>
 state: ONLINE</span></span>
 scrub: scrub completed after 0h35m with 0 errors on Mon Mar  5 10:58:19 2012</span></span>
config:</span></span>
</span>
    NAME           STATE     READ WRITE CKSUM</span></span>
    zroot          ONLINE       0     0     0</span></span>
      mirror       ONLINE       0     0     0</span></span>
        gpt/disk0  ONLINE       0     0     0</span></span>
        gpt/disk1  ONLINE       0     0     0</span></span>
</span>
errors: No known data errors</span></span></code></pre>
Wanting to take advantage of some of the advancements made in FreeBSD
9.0-RELEASE</a> such as the updated ZFS, a bug that was fixed that stopped
jails from owning a ZFS file system, improved dtrace, and better IPv6 support
required that the plunge be taken and an upgrade was in order.  There were a
couple reports of people having done source upgrades and then having issues
booting their system, but I found one mailling list post</a> that suggested
that everything went well using freebsd-update</code>, so that is the route I went
with.</p>
I read through the entirety of the FreeBSD 9.0-ERLEASE Release Notes</a>
before moving forward to make sure I didn't miss any important changes that
would cause my system to not restart correctly or would require changing system
configuration files before attempting the upgrade. I would advise you to do the
same.</p>
I ran freebsd-update -r 9.0-RELEASE upgrade</code> and after accepting the list of
components that were installed, I got an error saying:</p>
# freebsd-update -r 9.0-RELEASE upgrade</span></span>
Looking up update.FreeBSD.org mirrors... 4 mirrors found.</span></span>
Fetching metadata signature for 8.2-RELEASE from update2.freebsd.org... done.</span></span>
Fetching metadata index... done.</span></span>
Inspecting system... done.</span></span>
</span>
The following components of FreeBSD seem to be installed:</span></span>
kernel/generic src/base src/bin src/cddl src/contrib src/crypto src/etc</span></span>
src/games src/gnu src/include src/krb5 src/lib src/libexec src/release</span></span>
src/rescue src/sbin src/secure src/share src/sys src/tools src/ubin</span></span>
src/usbin world/base world/catpages world/dict world/doc world/games</span></span>
world/info world/lib32 world/manpages</span></span>
</span>
The following components of FreeBSD do not seem to be installed:</span></span>
world/proflibs</span></span>
</span>
Does this look reasonable (y/n)? y</span></span>
</span>
Fetching metadata signature for 9.0-RELEASE from update2.freebsd.org... done.</span></span>
Fetching metadata index... done.</span></span>
</span>
The update metadata is correctly signed, but</span></span>
failed an integrity check.</span></span>
Cowardly refusing to proceed any further.</span></span></code></pre>
Specifically the line stating "Cowardly refusing to proceed further", a quick
Google</a> later I found the 9.0-RC1 mailling list post</a> that suggested
the following one line fix:</p>
sed</span> -i</span> ''</span> -e</span> '</span>s/=_/=%@_/</span>'</span> /usr/sbin/freebsd-update</span></span></code></pre>
After that quick fix, a re-run of freebsd-update</code> functioned without issues
and finished, showing me what it would change, asking me if it seemed
acceptable and telling me what it was going to remove and what was going to be
installed.</p>
Next we run freebsd-update</code> for the first time in this three step process:</p>
freebsd-update</span> install</span></span></code></pre>
Don't restart yet (although it tells you to)! We need to go back and make sure
we update the boot records first.</p>
Going back to the mailling list post made by Magnus Strahlert</a>, I made note
of the following:</p>

Had to upgrade the gpt bootcode as instructed when upgrading the zpool for
the system to boot.</p>
</blockquote>
This is the only comment that worried me, and nowhere in the email thread does
the poster describe what commands he ran. In any case I figure he meant
re-running the boot code commands from the FreeBSD Root on ZFS wiki article:</p>
gpart</span> bootcode</span> -b</span> /boot/pmbr</span> -p</span> /boot/gptzfsboot</span> -i</span> 1</span> da0</span></span>
gpart</span> bootcode</span> -b</span> /boot/pmbr</span> -p</span> /boot/gptzfsboot</span> -i</span> 1</span> da1</span></span></code></pre>
After running these commands, it told me that it had updated the boot code and then I ran:</p>
shutdown</span> -r</span> now</span></span></code></pre>
After the machine came back online (it is in those moments when you have a
small heartattack when the machine doesn't come up as fast as you had expected
...) you log back in and run:</p>
freebsd-update</span> install</span></span></code></pre>
This will install all of the updated binaries that came with FreeBSD 9.0, at
this point FreeBSD update will tell you to upgrade all installed software and
ports, and then run freebsd-update</code> one more time to remove all unnecessary
shared libraries. If you want to have certain software continue functioning,
yet you want freebsd-update</code> to remove any other remaining old 8.x files, you
can install misc/compat8x</code></a> from the ports tree. This is the suggested
route to go if you want to keep the 8.x libraries around for compatibility
reasons.</p>
cd</span> /usr/ports/misc/compat8x</span></span>
make</span> install clean</span></span>
# or</span></span>
# portmaster misc/compat8x</span></span></code></pre>
I use portmaster</code> and the following command will simply rebuild every port
installed on the system:</p>
portmaster</span> -aPf</span></span></code></pre>
The -P</code> to portmaster</code> means look for package and if available use it,
otherwise build from port.</p>
Run freebsd-update</code> one last time:</p>
freebsd-update</span> install</span></span></code></pre>
Since we are running ZFS we will most likely also want to upgrade our pool to
the latest version of ZFS to take advantage of any new goodies (such as
deduplication!), upgrading a zpool is easy:</p>
zpool</span> upgrade zroot</span></span></code></pre>
That upgrades to the latest pool version, now we will want to upgrade our
existing file systems to the latest version of ZFS, do note that this will make
them incompatible with older file system verisons (so if you use zfs send for
backups, your other endpoint will need to be of the same ZFS version)</p>
zfs</span> upgrade</span> # List all ZFS file systems that need to be upgraded</span></span>
zfs</span> upgrade</span> -a</span> # Upgrade all file systems</span></span></code></pre>
After this one last reboot to make sure that all the processes come back online
using the newer libraries and that you didn't accidentally miss something.</p>
shutdown</span> -r</span> now</span></span></code></pre>
At this point the system has been upgraded from FreeBSD 8.0-RELEASE to FreeBSD
9.0-RELEASE and has all of the latest updates and enhancements.</p>


OpenSSL as a Filter (or non-blocking OpenSSL)
2012-04-08T16:50:14+00:00
OpenSSL</a> as a library at first glance is complicated, and then you realise
that a lot of the documentation</a> seems to be incomplete or missing.
Generally the individual man pages for the various functions are not bad, and
they will give you relevant information to help you along, but it can be hard
to find.</p>
The idea is to write a filter in such a way that OpenSSL can easily be disabled
or removed. We don't want to rely on OpenSSL specific functionality in our
code, for instance in the future we may want to change to using Botan</a> or
another SSL/TLS library without having to change a lot of core functionality.</p>
Possible methods</h2>
There are various ways of doing non-blocking OpenSSL, the main one is to simply
set the underlying socket to non-blocking and pass it into OpenSSL, at that
point the functions SSL_write()</code> and SSL_read()</code> will enter various error
states that can be read by SSL_get_error()</code></a>, more specifically the
function will return either SSL_ERROR_WANT_READ</code> or SSL_ERROR_WANT_WRITE</code>.</p>
The other method, the one used below, was described by Marc Lehmann in a post
to the libev mailling list</a> and uses memory BIO</a> objects. Specifically
he linked to some Perl sample code; the OpenSSL setup</a>, and the function
called for new incoming data/data to be written: dotls function</a>.</p>

The code is very new and might still be buggy, but it outlines the
principles: use a memory stream, which will avoid all issues with blocking in
openssl</p>
</blockquote>
It shows the idea pretty clearly but unless you know Perl it can be really
confusing as to what is going on.</p>
The SSL Filter implementation</h2>
The SSL_CTX</code></a> that is passed in contains all of the initialisation that is
done for OpenSSL in general, which is not shown here. The SSLFilter</code> is
created for each time you want to have a socket start doing SSL.</p>
// openssl_filter.h</span></span>
</span>
class</span> SSLFilter {</span></span>
    public:</span></span>
        SSLFilter</span>(SSL_CTX</span>*</span> ctxt</span>,</span></span>
                  std::string</span>*</span> nread</span>,</span></span>
                  std::string</span>*</span> nwrite</span>,</span></span>
                  std::string</span>*</span> aread</span>,</span></span>
                  std::string</span>*</span> awrite</span>);</span></span>
        virtual</span> ~SSLFilter</span>();</span></span>
</span>
        void</span> update</span>();</span></span>
</span>
    private:</span></span>
        bool</span> continue_ssl_</span>(</span>int</span> function_return</span>);</span></span>
</span>
        SSL </span>*</span> ssl;</span></span>
        BIO </span>*</span> rbio;</span></span>
        BIO </span>*</span> wbio;</span></span>
</span>
        std::string</span>*</span> nread;</span></span>
        std::string</span>*</span> nwrite;</span></span>
        std::string</span>*</span> aread;</span></span>
        std::string</span>*</span> awrite;</span></span>
};</span></span></code></pre>
The class contains mainly various different bits of state, when you create the
filter you pass in a pointer to four different strings, they are used as
follows:</p>

nread</code>: This contains data to be processed by the filter, from the network</li>
nwrite</code>: This contains data that has been processed by the filter, and has
to be sent to the network</li>
aread</code>: This contains data that has been processed by the filter, and is
ready to be processed by the application</li>
awrite</code>: This contains data that the application wants to send out to the
network and is ready for processing by the filter.</li>
</ul>
The other private variables contain various different pieces of state and are
created by the filters constructors.</p>

ssl</code>: Contains the state for the current SSL connection.</li>
rbio</code>: Contains the data that the SSL functions will read from, data put in
here is copied from nread</code>.</li>
wbio</code>: Contains the data that the SSL functions will write to, data from
this BIO is copied to nwrite</code>.</li>
</ul>
The implementation is the really interesting part.</p>
  1</span>// openssl_filter.cc</span></span>
  2</span></span>
  3</span>#</span>include</span> <</span>stdexcept</span>></span></span>
  4</span></span>
  5</span>#</span>include</span> "</span>openssl_filter.h</span>"</span></span>
  6</span></span>
  7</span>SSLFilter::</span>SSLFilter</span>(SSL_CTX</span>*</span> ctxt, </span></span>
  8</span>                     std::string</span>*</span> nread, </span></span>
  9</span>                     std::string</span>*</span> nwrite,</span></span>
 10</span>                     std::string</span>*</span> aread,</span></span>
 11</span>                     std::string</span>*</span> awrite)</span></span>
 12</span>                      :</span></span>
 13</span>                     nread</span>(nread), </span></span>
 14</span>                     nwrite</span>(nwrite), </span></span>
 15</span>                     aread</span>(aread), </span></span>
 16</span>                     awrite</span>(awrite) {</span></span>
 17</span></span>
 18</span>    rbio </span>=</span> BIO_new</span>(</span>BIO_s_mem</span>());</span></span>
 19</span>    wbio </span>=</span> BIO_new</span>(</span>BIO_s_mem</span>());</span></span>
 20</span>    </span></span>
 21</span>    ssl </span>=</span> SSL_new</span>(ctxt);</span></span>
 22</span>    </span></span>
 23</span>    SSL_set_accept_state</span>(ssl);</span></span>
 24</span>    SSL_set_bio</span>(ssl, rbio, wbio);</span></span>
 25</span>}</span></span>
 26</span></span>
 27</span>SSLFilter::</span>~</span>SSLFilter</span>() {</span></span>
 28</span>    SSL_free</span>(_ssl);</span></span>
 29</span>}</span></span>
 30</span></span>
 31</span>void</span> SSLFilter::</span>update</span>(Filter::FilterDirection) {</span></span>
 32</span>    // If we have data from the network to process, put it the memory BIO for OpenSSL</span></span>
 33</span>    if</span> (</span>!</span>nread</span>-></span>empty</span>()) {</span></span>
 34</span>        int</span> written </span>=</span> BIO_write</span>(rbio,</span> nread</span>-></span>c_str</span>(),</span> nread</span>-></span>length</span>());</span></span>
 35</span>        if</span> (written </span>></span> 0</span>)</span> nread</span>-></span>erase</span>(</span>0</span>, written);</span></span>
 36</span>    }</span></span>
 37</span></span>
 38</span>    // If the application wants to write data out to the network, process it with SSL_write</span></span>
 39</span>    if</span> (</span>!</span>awrite</span>-></span>empty</span>()) {</span></span>
 40</span>        int</span> written </span>=</span> SSL_write</span>(ssl,</span> awrite</span>-></span>c_str</span>(),</span> awrite</span>-></span>length</span>());</span></span>
 41</span></span>
 42</span>        if</span> (</span>!</span>continue_ssl_</span>()) {</span></span>
 43</span>            throw</span> std::</span>runtime_error</span>(</span>"</span>An SSL error occured.</span>"</span>);</span></span>
 44</span>        }</span></span>
 45</span></span>
 46</span>        if</span> (written </span>></span> 0</span>)</span> awrite</span>-></span>erase</span>(</span>0</span>, written);</span></span>
 47</span>    }</span></span>
 48</span></span>
 49</span>    // Read data for the application from the encrypted connection and place it in the string for the app to read</span></span>
 50</span>    while</span> (</span>1</span>) {</span></span>
 51</span>        char *</span>readto </span>=</span> new</span> char</span>[</span>1024</span>];</span></span>
 52</span>        int</span> read </span>=</span> SSL_read</span>(ssl, readto,</span> 1024</span>);</span></span>
 53</span>       </span></span>
 54</span>        if</span> (</span>!</span>continue_ssl_</span>()) {</span></span>
 55</span>            delete</span> readto;</span></span>
 56</span>            throw</span> std::</span>runtime_error</span>(</span>"</span>An SSL error occured.</span>"</span>);</span></span>
 57</span>        }</span></span>
 58</span></span>
 59</span>        if</span> (read </span>></span> 0</span>) {</span></span>
 60</span>            size_t</span> cur_size </span>=</span> aread</span>-></span>length</span>();</span></span>
 61</span>            aread</span>-></span>resize</span>(cur_size </span>+</span> read);</span></span>
 62</span>            std::</span>copy</span>(readto, readto </span>+</span> read,</span> aread</span>-></span>begin</span>()</span> +</span> cur_size);</span></span>
 63</span>        }</span></span>
 64</span></span>
 65</span>        delete</span> readto;</span></span>
 66</span></span>
 67</span>        if</span> (</span>static_cast</span><size_t></span>(read)</span> !=</span> 1024</span> ||</span> written </span>==</span> 0</span>)</span> break</span>;</span></span>
 68</span>    }</span></span>
 69</span></span>
 70</span>    // Read any data to be written to the network from the memory BIO and copy it to nwrite</span></span>
 71</span>    while</span> (</span>1</span>) {</span></span>
 72</span>        char *</span>readto </span>=</span> new</span> char</span>[</span>1024</span>];</span></span>
 73</span>        int</span> read </span>=</span> BIO_read</span>(wbio, readto,</span> 1024</span>);</span></span>
 74</span>        </span></span>
 75</span>        if</span> (read </span>></span> 0</span>) {</span></span>
 76</span>            size_t</span> cur_size </span>=</span> nwrite</span>-></span>length</span>();</span></span>
 77</span>            nwrite</span>-></span>resize</span>(cur_size </span>+</span> read);</span></span>
 78</span>            std::</span>copy</span>(readto, readto </span>+</span> read,</span> nwrite</span>-></span>begin</span>()</span> +</span> cur_size);</span></span>
 79</span>        }</span></span>
 80</span></span>
 81</span>        delete</span> readto;</span></span>
 82</span></span>
 83</span>        if</span> (</span>static_cast</span><size_t></span>(read)</span> !=</span> 1024</span> ||</span> read </span>==</span> 0</span>)</span> break</span>;</span></span>
 84</span>    }</span></span>
 85</span>}</span></span>
 86</span></span>
 87</span>bool</span> SSLFilter::</span>continue_ssl_</span>(</span>int</span> function_return</span>) {</span></span>
 88</span>    int</span> err </span>=</span> SSL_get_error</span>(ssl, function_return);</span></span>
 89</span></span>
 90</span>    if</span> (err </span>==</span> SSL_ERROR_NONE </span>||</span> err </span>==</span> SSL_ERROR_WANT_READ) {</span></span>
 91</span>        return</span> true</span>;</span></span>
 92</span>    }</span></span>
 93</span></span>
 94</span>    if</span> (err </span>==</span> SSL_ERROR_SYSCALL) {</span></span>
 95</span>        ERR_print_errors_fp</span>(stderr);</span></span>
 96</span>        perror</span>(</span>"</span>syscall error: </span>"</span>);</span></span>
 97</span>        return</span> false</span>;</span></span>
 98</span>    }</span></span>
 99</span></span>
100</span>    if</span> (err </span>==</span> SSL_ERROR_SSL) {</span></span>
101</span>        ERR_print_errors_fp</span>(stderr);</span></span>
102</span>        return</span> false</span>;</span></span>
103</span>    }</span></span>
104</span>    return</span> true</span>;</span></span>
105</span>}</span></span></code></pre>Explanation of the SSL Filter class</h3>
Line 7 - 25</strong>, we create the two memory BIO's and then call SSL_new()</code> using
the passed in SSL_CTX</code>, set the accept set for SSL and then we hook up the two
BIO objects to the ssl</code> object.</p>
Line 27 - 29</strong>, All we do in the destructor is SSL_free()</code> the SSL state,
which automatically takes care of freeing the two memory BIOs that were given
to it.</p>
Line 33 - 36</strong>, if nread</code> is not empty we copy the data into rbio</code>. rbio</code>
is used by the SSL functions to read from (as if it were reading from a
socket). We read into the memory BIO as much as possible, technically this
should be everything, but it is possible it won't read everything due to memory
constraints, next time SSLFilter::update()</code> is called it will get emptied as
much as possible again.</p>
Line 39 - 47</strong>, we see if there is anything that the app wants to write out
to the remote client, if there is we call SSL_write()</code>. After the call to
SSL_write()</code> we call continue_ssl_()</code> to see if we can safely continue using
SSL.</p>
Line 50 - 68</strong>, this is where try to read as much data from SSL_read()</code> as
we can and place it in aread</code>. This is data that has been decrypted by OpenSSL
and can be used by the application. After the call to SSL_read()</code> we call
continue_ssl_()</code> to see if we can safely continue using SSL.</p>
Line 71 - 84</strong>, if OpenSSL has to write something to the network, either
directly due to something the app did (by filling awrite</code>) or because of
something the remote client sent, it will place it in its memory buffer
(wbio</code>), what we do here is drain that memory buffer and fill nwrite</code>.</p>
Line 87 - 105</strong>, the continue_ssl_()</code> function gets the SSL errors using
SSL_get_error</code></a> and checks that either it is SSL_ERROR_NONE</code> or
SSL_ERROR_WANT_READ</code> both of which are acceptable errors, any other errors and
we check to see if it is an error due to a system call or due to an SSL error,
we print out the errors to standard error and return false. At that point the
calling code is free to go about its business as it pleases (most likely
throwing an error).</p>
Notes regarding this sample code ...</h4>
The only thing missing in this example code is checking to see if the SSL
connection has gone into an SSL_shutdown()</code> mode. This should be added so that
you cleanly shut down an SSL connection, but it is not absolutely required,
especially since it seems to be shaky as to whether or not it will work,
especially if you are using SSLv3 or SSLv2.</p>
How to use the SSL Filter</h3>
Here are the steps to using this filter:</p>

At program startup set up the SSL_CTX</code> structure as required, so that it
be used in the SSLFilter</code></li>
Set up socket/event loop and accept() new socket.</li>
Create four new std::string</code>'s and create a new SSLFilter, pass in the
SSL_CTX</code> you created, and the four buffers.</li>
Add the new socket to the event loop to wait for reading.</li>
</ol>
Now upon receiving a read ready status from the event loop, the following should be done:</p>

Read data into nread</code> buffer.</li>
call SSLFilter::update()</code></li>
See if aread</code> is not empty, process the data as you please</li>
Write data to awrite</code> as needed, if data is written to awrite</code>, call
SSLFilter::update(WRITE)</code> to process the data</li>
See if nwrite</code> is not empty, if so add socket to event loop for write
readiness.</li>
</ol>
Once you receive a write ready status from the event loop, you should do the following:</p>

Write data in nwrite</code> to the socket.</li>
If nwrite</code> is empty, remove the socket from the event loop for writing (so
that you don't have the event loop notifying you of the ability to write,
even-though you have nothing to write).</li>
</ol>
Now it becomes simple to add OpenSSL to any open socket, in a way that is easy
to refactor later and or disable depending on parameters passed in as arguments
to the program. If you set nread</code> to the same string as aread</code> and nwrite</code>
to awrite</code> and don't create an SSLFilter you have bypassed the filter...</p>


Converting KVM virtual machines to VirtualBox
2012-04-01T01:03:32+00:00
Recently the requirement came up to take a KVM</a> based virtual machine and
move it over to a VirtualBox</a> image. Which turned out to be a fairly simple
endeavour, and was fairly painless. The longest part was transferring over the
40 GB image from one machine to the other where the conversion could take
place. The machine the image was coming from was only on a 100 Mbit/sec
connection so that took a good hour.</p>
Converting from KVM to VirtualBox for a FreeBSD image was pretty
simple, the VBoxManage</code> command has a convertdd</code> command that allows you to
convert from raw disk .img</code> format to .vdi</code> format.</p>
VBoxManage convertdd KVM-image.img VB-image.vdi</span></span></code></pre>
After this, unfortunately, there is no way to to automatically convert over the
settings that the virtual machine had, such as the network cards, the memory
allocations and hard drive settings. You will have to go to VirtualBox and
create a new virtual machine and replicate all of the settings. Once that is
done make sure to select the same type of disk controller (SATA or IDE) so that
the drive will hopefully be assigned the same name in the device tree so that
you don't need to alter your /etc/fstab</code>.</p>
Hopefully everything boots without any issues. If not try creating a new
virtual machine, attach the converted image as a secondary drive and see if you
can mount the converted image within your new install. If so maybe transferring
the data using rsync</code> or dump</code>/restore</code> would be an option.</p>


Generating stylesheets for pygments
2011-11-27T00:00:00+00:00
Update: this blog is no longer using the same technology for deployment as
before, the below information is available for historical reasons.</p>

For this blog I am using Python markdown</a> with the Pygments</a> plugin
that is available. Pygments does all of the code highlighting and outputs the
required span</code> tags and inputs them within the page.</p>
If you were to look at the <div><pre></pre></div></code> block that is generated
you'd see something like this:</p>
<div class="codehilite"><pre><span class="k">def</span> <span class="nf">function</span><span class="p">(</span><span class="n">var</span><span class="o">=</span><span class="bp">None</span><span class="p">):</span></span></span>
<span class="k">if</span> <span class="n">var</span> <span class="ow">is</span> <span class="ow">not</span> <span class="bp">None</span><span class="p">:</span></span></span>
    <span class="k">print</span> <span class="n">var</span></span></span>
</pre></div></span></span></code></pre>
which is generated from the following snippet of code:</p>
def</span> function</span>(</span>var=</span>None</span>)</span>:</span></span>
    if</span> var</span> is not</span> None</span>:</span></span>
        print</span> var</span></span></code></pre>
As you see the top css class</code> is codehilite</code>, and then underneath that there
are a bunch of other classes such as k</code>, n</code>, o</code>, and so forth. Those are all
classes that can be styled. Now one could write such a stylesheet by hand or we
can simply use one of the stylesheets that Pygments ships with.</p>
The documentation for Pygments tells you how to get built-in styles</a>, which
is as simple as:</p>
>>></span> from</span> pygments.styles</span> import</span> get_all_styles</span></span>
>>></span> styles</span> =</span> list</span>(</span>get_all_styles</span>())</span></span>
>>></span> styles</span></span>
['</span>monokai</span>'</span>,</span> '</span>manni</span>'</span>,</span> '</span>perldoc</span>'</span>,</span> '</span>borland</span>'</span>,</span> '</span>colorful</span>'</span>,</span> '</span>default</span>'</span>,</span> ...</span>]</span> </span></span></code></pre>
These are all the styles that are available to you the user, now how do we get
the style into an actual .css</code> file that we can link to in our sites HTML
file? We use the pygmentize</code> command line tool:</p>
pygmentize</span> -f</span> html</span> -S</span> trac</span> -a</span> .codehilite</span> ></span> pygments.css</span></span></code></pre>
Feel free to replace trac</code> with any of the styles you have installed on your
system. -f</code> tells it what formatter to use, since we want it to output the css
we ask it to use the HTML formatter, -S</code> tells pygmentize</code> what style to
use, and -a</code> prepends the .codehilite</code> class before every rule (this way we
don't pollute the whole CSS namespace with all the aforementioned class's such
as k</code>, o</code>, ow</code> and others).</p>


NAT with PF on an interface with multiple IP addresses
2011-09-08T02:40:00+00:00
If you want to do NAT for your currently running jail instances on FreeBSD so
that they can have outgoing connections you could try the following pf.conf</code>
to set up NAT on the interface that the jails have their IP addresses on.</p>
ext_if="em0"    # The network card your default gateway is on</span></span>
jail_if="lo1"   # The interface that your jails have IP addresses on</span></span>
</span>
# Set some options</span></span>
set optimization aggressive</span></span>
set block-policy drop</span></span>
set skip on lo</span></span>
</span>
# NAT on the external interface when coming from the jail interface</span></span>
nat on $ext_if from $jail_if:network:0 to any -> ($ext_if)</span></span>
</span>
# We just pass everything</span></span>
pass quick all</span></span></code></pre>
What I have done is create IP addresses within the private network range
(10/8</code>, 172.16/12</code>, 192.168/16</code>) on the lo1</code> interface. These can't be in
the 127/8</code> range because those addresses can't be NAT'ed (not sure if this is
a limitation in pf or if this is a FreeBSD limitation), which is a shame
because using 127.1.0.1/24</code> would be pretty awesome in my opinion.</p>
What I did find though is that the above will not work correctly if your main
network card (the one your default gateway is on, in the example em0</code>)
contains multiple IP addresses. At that point the syntax ($ext_if)</code> does not
function correctly and will cause packet loss/drop. 1</a></sup></p>
So instead of using the syntax above we simply replace ($ext_if)</code> with the
actual IP address of the interface. This takes care of the issue and will let
your jails have proper internet access without issues.</p>
ext_if="em0"</span></span>
jail_if="lo1"</span></span>
</span>
set optimization aggressive</span></span>
set block-policy drop</span></span>
set skip on lo</span></span>
</span>
nat on $ext_if from $jail_if:network:0 to any -> 192.168.1.2 # Your IP! </span></span>
</span>
pass quick all</span></span></code></pre>
The other way you can solve this problem off course is to provide your jails
with IP addresses within the same range that go to your default gateway thereby
solving the problem of needing to NAT in the first place.</p>



Do note that I am using FreeBSD 8.2, so this may
be fixed in the new FreeBSD 9 that is due to be released soon. ↩</a></p>
</li>
</ol>
</section>


FreeBSD running within KVM: Serial Console
2011-08-21T18:53:52+00:00
Instead of using virtualisation technology such as VMWare of VirtualBox I
decided to give the new KVM</a> technology that is included with Linux. It is
fast, and has been extremely reliable. However I wanted to be able to access
the console on the guest FreeBSD instances.</p>
I used virt-manager, a graphical tool, to set up everything, including creating
the virtual machine, I didn't want to have to deal with XML configuration files
and whatnot. After installing FreeBSD there are a few changes I made to get a
virtual console working, this allows virsh console <domain></code> to function
as expected.</p>
First we add a new file to the root file system (which should be the first
slice on the drive):</p>
echo</span> "</span>-Dh</span>"</span> ></span> /boot.config</span></span></code></pre>
See man 5 boot.config</a> for more information. Basically -D says that FreeBSD
should boot with a dual console configuration (built-in over VGA) and serial
console, and -h says to force the serial console to on.</p>
If you were to reboot now and use the virsh command:</p>
virsh</span> console FreeBSD</span></span></code></pre>
you would see the system go through the boot process and show output starting
from when the boot block gains control, at this point however you still have no
way to login to this new console since we never specified that we wanted any
ttys on the serial console, for that we need to edit /etc/ttys.</p>
We are looking for the ttyu0 entry, we want to make sure to change dialup to
vt100, and off to on, so that it should look like this:</p>
ttyu0   "/usr/libexec/getty std.9600"   vt100   on secure</span></span></code></pre>
Now when we reboot once more we will get the usual login display that we have
come to expect of console on FreeBSD, and we can login over the serial console.
This way we don't have to open up the virtual machine manager to get a console,
and can continue to do almost everything from a terminal window.</p>


PostgreSQL setup for external connections
2011-08-16T17:48:54+00:00
PostgreSQL is a fantastic open-source RDBMS which is extremely powerful, once
installed on FreeBSD getting it set up is pretty simple. We do want to change
some of the defaults though. By default the system will be set up to trust any
user using the local socket to connect as any user to any database.</p>
By setting up the initdb</code></a> flags we can change how PostgreSQL generates
the default configuration files. Adding -A md5</code> tells it to use the md5
authentication mechanism</a>, which requires that passwords sent over the wire
are md5 hashed.</p>
Add the following to /etc/rc.conf</code></a> for the initdb flags, and enable
PostgreSQL as a service:</p>
postgresql_initdb_flags="-D /usr/local/pgsql/data -W -A md5"</span></span>
postgresql_enable="YES"</span></span></code></pre>
And then run:</p>
/usr/local/etc/rc.d/postgresql</span> initdb</span></span></code></pre>
This will initialise and create the configuration as well as setting up some of
the default tables. You will want to navigate to the folder specified in the
initdb_flags</code> above:</p>
cd</span> /usr/local/pgsql/data</span></span></code></pre>
this is where you will find the files that we are going to modify next to get
PostgreSQL set up to listen to connections coming in on a private network
(192.168.1.1/24</code>) and where we allow connections coming in from servers on
that network. This is strictly for setting up PostgreSQL in a situation where
you have multiple servers accessing it as a client on a private network.</p>
After this we need to modify a few files to get it to listen to TCP/IPv4
connections, first we start with postgresql.conf</code></a> and add:</p>
listen_addresses</span> =</span> '</span>127.0.0.1,192.168.1.1</span>'</span></span></code></pre>
Then in pg_hba.conf</code></a> we add a new line:</p>
host	all		all		192.168.1.1/24		md5</span></span></code></pre>
This allows anyone in the 192.168.1.1/24 range to connect to our PostgreSQL
instance and to use the databases. This is exactly what we want to allow, now
we start PostgreSQL using the rc script:</p>
/usr/local/etc/rc.d/postgresql</span> start</span></span></code></pre>


Setting up jails with multiple IPs and providing it with internet access
2011-08-15T15:40:04+00:00
I have multiple VMs up and running and generally I have an internal to the
VMs only network set up, in the current project I am working on I have
three completely different networks set up.</p>

DHCP assigned network that routes to the outside network on the host (192.168.0.1/24)</li>
An internal to the VM's network interface (10.99.12.1/24)</li>
A network that is tied to the host's wireless network (setup to be an AP) (10.99.11.1/24)</li>
</ol>
So within my FreeBSD VM I have the following: em0</code>, em1</code>, em2</code> as
"network cards". In my FreeBSD VM, I am creating two jails that are going
to contain different pieces of server software. The jails need IP's in
the following ranges, 10.99.12.1/24 (to connect to another VM),
10.99.11.1/24 (Wifi network) and then it needs to have an IP address that
is considered "local" and we can NAT on, so in addition to the above
networks we also needed to add another network. The easiest way to create
new interface with IP addresses is using a bridge. They can be assigned
IP addresses, which is all we need.</p>
At this point inside of a jail it kinda looks like this:</p>
em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500</span></span>
    options=209b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_MAGIC></span></span>
    ether 52:54:00:6b:6a:49</span></span>
    media: Ethernet autoselect (1000baseT <full-duplex>)</span></span>
    status: active</span></span>
em1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500</span></span>
    options=209b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_MAGIC></span></span>
    ether 52:54:00:2f:a5:55</span></span>
    inet 10.99.12.4 netmask 0xffffffff broadcast 10.99.12.4</span></span>
    media: Ethernet autoselect (1000baseT <full-duplex>)</span></span>
    status: active</span></span>
em2: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500</span></span>
    options=209b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_MAGIC></span></span>
    ether 52:54:00:bb:b6:43</span></span>
    inet 10.99.11.14 netmask 0xffffffff broadcast 10.99.11.14</span></span>
    media: Ethernet autoselect (1000baseT <full-duplex>)</span></span>
    status: active</span></span>
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384</span></span>
    options=3<RXCSUM,TXCSUM></span></span>
bridge0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500</span></span>
    ether da:de:63:c9:55:6c</span></span>
    inet 10.0.1.4 netmask 0xffffffff broadcast 10.0.1.4</span></span>
    id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15</span></span>
    maxage 20 holdcnt 6 proto rstp maxaddr 100 timeout 1200</span></span>
    root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0</span></span></code></pre>
em0</code> doesn't have an address since that is our DHCP address, em1</code>,
em2</code> and bridge0</code> all have IP addresses, in the jail configuration the
bridge0</code> IP address is listed first, and thus when something binds or
sends it sends from that IP address. The thing is that at this point the
jail does not have internet access.</p>
Jails inherit the routing table from their host environment (yes, you
can compile in more routing tables ... but I don't want to modify stock),
any traffic that goes to the outside is going to go out over the default
route, thing is you'd expect that traffic to show up on bridge0</code> where
the IP address exists, instead using tcpdump</code> you see it show up on
em0</code>, which is where the default route is. I would have expected having
to do NAT on the bridge, not just the external interface.</p>
Here is the pf</code> configuration.</p>
ext_if="em0"</span></span>
jail_if="bridge0"</span></span>
</span>
set optimization aggressive</span></span>
set block-policy drop</span></span>
set skip on lo</span></span>
</span>
nat on $ext_if from $jail_if:network:0 to any -> ($ext_if)</span></span>
</span>
pass quick all</span></span></code></pre>
And we've got internet within our jail.</p>


Apache mod_fastcgi and PHP with PHP-FPM
2010-11-14T23:37:27+00:00
Recently I did a server migration from an older server to a newer server and in
an attempt to help stability I wanted to see if there was a better way to do
PHP FastCGI. In my research I came across running PHP using the FastCGI server
that spins up a PHP on a TCP/IP port and allows the web server to connect to
it. However this doesn't help with spawning or keeping track of instances or
error recovery.</p>
This is where PHP-FPM</a> comes in handy. It does all of the hard work for us,
it spawns the processes and has a bunch of really awesome features that help
run PHP as various different users as required with different PHP ini files and
memory limits. PHP-FPM's defaults, at least from a ports install, are extremely
sane and I don't really suggest changing them. After setting up PHP FPM I had
to set up Apache.</p>
mod_fcgid</code> doesn't allow for remote connections, and as such I was unable to use
it for what I needed it for. mod_fastcgi</code> provides the
FastCGIExternalServer</a> configuration key, which is exactly what I needed.</p>

"The FastCgiExternalServer directive defines filename as an external
FastCGI application. If filename does not begin with a slash (/</code>) then it is
assumed to be relative to the ServerRoot</code>. The filename does not have to exist
in the local filesystem. URIs that Apache resolves to this filename will be
handled by this external FastCGI application."</p>
</blockquote>
What this documentation does not state is that the path up to the last part of
it has to exist in the local file system. So in my first couple of attempts I
pointed it at /usr/local/www/fastcgi/php5.fcgi</code> without having an actual fastcgi
directory located in /usr/local/www/</code>. There are a lot of examples that require
creating a new FastCGIExternalServer</code> for each and every VirtualHost</code> this is
unacceptable to me, the reason they require it is because they set the
FastCGIExternalServer</code> path to the folder where they are going to be serving
files from.</p>
In the end I found that after creating the /usr/local/www/fastcgi</code> directory
(and reading the mod_fastcgi</code> source code) that all it does is make Apache
believe a file exists in a certain directory, much like Alias</code>, except Alias</code>
allows full paths to be aliased, not so here.</p>
The AddType</code> and Action</code> add custom types and what the action should be when
such a type is encountered. In this case the action is to redirect the request
to /php5.fcgi</code> which will handle the rest of the request. This does not require
another FastCGI section per VirtualHost</code> as each PHP request will just get
shuttled to the php handler.</p>
Do take note that I have specifically disallowed Apache to serve anything from
the /usr/local/www/fastcgi/</code> folder, except for a single file php5.fcgi</code>
which is our FastCGIExternalServer</code> file.</p>
<IfModule mod_fastcgi.c></span></span>
    Alias /php5.fcgi /usr/local/www/fastcgi/php5.fcgi</span></span>
    FastCGIExternalServer /usr/local/www/fastcgi/php5.fcgi -flush -host 127.0.0.1:9000</span></span>
    AddType application/x-httpd-fastphp5 .php</span></span>
    Action application/x-httpd-fastphp5 /php5.fcgi</span></span>
</span>
    <Directory "/usr/local/www/fastcgi/"></span></span>
        Order deny,allow</span></span>
        Deny from all</span></span>
        <Files "php5.fcgi"></span></span>
            Order allow,deny</span></span>
            Allow from all</span></span>
        </Files></span></span>
    </Directory></span></span>
</IfModule></span></span></code></pre>
Note that even-though in my last post</a> concerning mod_fastcgi</code> I as moving
away from it, I am now doing the opposite, instead of moving from
mod_fastcgi</code> to mod_fcgid</code></a> I'm back to mod_fastcgi</code>, only because
mod_fcgid</code> doesn't offer the same functionality.</p>
So far this has provided far more stability, along with PHP-FPM doing all of
the process management I can now use a single PHP instance that is running on a
single port for the various web servers I am testing. At the moment I have both
Lighttpd and Apache using the same PHP-FPM instance. It is faster, less
memory is wasted and PHP-FPM is much better at process management than
mod_fastcgi</code> or mod_fcgid</code>.</p>


Magic Properties on Google AppEngine
2010-03-24T02:15:33+00:00
Update to my previous Google AppEngine auto-updating properties post</a>.</p>
In my last post I was talking about:</p>

[...] however there is still an issue, for now the MagicProperty is only
updated the first time the property it affects is set</p>
</blockquote>
I fixed that issue, it has a local cache that is added to the model, so if the
value does change, the cache would no longer be valid and the value is
recreated, otherwise the already computed value is returned. There was however
another issue I had to deal with, and that was the fact that the cache was not
being written to the datastore, this meant that upon getting the data back from
the datastore we recomputed it anyway. Now the programmer has to do some extra
work, they have to add a cache unindexed property to the model, and pass it
into the MagicProperty</code> to be used as the caching variable. Within the
save()</code> they have to prime the cache by setting a temporary variable equal to
the to be computed variable just in case the cache variables have not been
primed, this has not yet been documented other than in my SVN history.</p>
We still don't allow setting of the magic property, however upon returning from
the datastore it calls make_value_from_datastore</code>, which returns a
_MagicDatastore</code>, as long as we set with an instance of _MagicDatastore</code> it will
allow it to go through, so we can get the value from the datastore without
having to recompute the value.</p>
Read the code for an example on how to use this.</p>
Code is added below, feel free to use it as you wish under the license that is
attached.</p>
  1</span>###</span></span>
  2</span> # Copyright (c) 2010 Delta Regeer;</span></span>
  3</span> #</span></span>
  4</span> # Permission to use, copy, modify, and distribute this software for any</span></span>
  5</span> # purpose with or without fee is hereby granted, provided that the above</span></span>
  6</span> # copyright notice and this permission notice appear in all copies.</span></span>
  7</span> #</span></span>
  8</span> # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES</span></span>
  9</span> # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF</span></span>
 10</span> # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR</span></span>
 11</span> # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES</span></span>
 12</span> # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN</span></span>
 13</span> # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF</span></span>
 14</span> # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.</span></span>
 15</span> #</span></span>
 16</span>###</span></span>
 17</span></span>
 18</span>import</span> logging</span></span>
 19</span>import</span> hashlib</span></span>
 20</span>from</span> google.appengine.ext</span> import</span> db</span></span>
 21</span></span>
 22</span></span>
 23</span>def</span> MagicProperty</span>(</span>prop</span>,</span> magic_func=</span>None</span>,</span> cache_prop=</span>None</span>,</span> pass_instance=</span>False</span>,</span> *args</span>,</span> **kw</span>)</span>:</span></span>
 24</span>    if</span> magic_func:</span></span>
 25</span>        # No pants required.</span></span>
 26</span>        return</span> _MagicProperty</span>(</span>prop</span>,</span> magic_func</span>,</span> cache_prop</span>,</span> pass_instance</span>,</span> *</span>args</span>,</span> **</span>kw</span>)</span></span>
 27</span>    else</span>:</span></span>
 28</span>        # We are putting some pants on the function.</span></span>
 29</span>        def</span> pants</span>(</span>magic_func</span>)</span>:</span></span>
 30</span>            return</span> _MagicProperty</span>(</span>prop</span>,</span> magic_func</span>,</span> cache_prop</span>,</span> pass_instance</span>,</span> *</span>args</span>,</span> **</span>kw</span>)</span></span>
 31</span>        return</span> pants</span></span>
 32</span></span>
 33</span>class</span> _MagicDatastore</span>():</span></span>
 34</span>    """</span>This is an internal class for _MagicProperty.</span>"""</span></span>
 35</span>    </span></span>
 36</span>    def</span> __init__</span>(</span>self</span>,</span> val</span>)</span>:</span></span>
 37</span>        self</span>.value</span> =</span> val</span></span>
 38</span>    </span></span>
 39</span>    def</span> retval</span>(</span>self</span>)</span>:</span></span>
 40</span>        return</span> self</span>.value</span></span>
 41</span></span>
 42</span>class</span> _MagicProperty</span>(</span>db</span>.</span>Property</span>):</span></span>
 43</span>    """</span>MagicProperty which will modify output based on a function that it is given.</span></span>
 44</span>    </span></span>
 45</span>    This has several ways in which it may be called:</span></span>
 46</span>    </span></span>
 47</span>    In this example we create the model, no caching is done, so any data that is returned from the datastore</span></span>
 48</span>    will be erased the first time that the MagicProperty is accessed and recomputed.</span></span>
 49</span>    </span></span>
 50</span>        class MagicTest(db.Model):</span></span>
 51</span>            title = db.StringProperty(required=True)</span></span>
 52</span>            chars = utils.MagicProperty(title, len, required=True)</span></span>
 53</span>    </span></span>
 54</span>        mytest = MagicTest(title="It was for the good of the school!")</span></span>
 55</span>        </span></span>
 56</span>        >>> </span>print mytest.title</span></span>
 57</span>        It was for the good of the school!</span></span>
 58</span>        >>> </span>print mytest.chars</span></span>
 59</span>        34</span></span>
 60</span>        </span></span>
 61</span>        mytest = MagicTest.all().get()</span></span>
 62</span>        </span></span>
 63</span>        >>> </span>print mytest.title</span></span>
 64</span>        Hello</span></span>
 65</span>        >>> </span>print mytest.chars		</span></span>
 66</span>        5	# Do note, this is recalculated the first time it is called, as long as title does not change it won't be recomputed.</span></span>
 67</span>    </span></span>
 68</span>    In this example we create the model, and we also create a caching property so that even when we get values back </span></span>
 69</span>    from the datastore we use the cached computed value rather than running the function again. Do note that this requires overriding put()</span></span>
 70</span>    to prime the cache as there is currently no way to specify that certain properties should be "saved" before others.</span></span>
 71</span>    </span></span>
 72</span>        class MagicTesting(db.Model):</span></span>
 73</span>            title = db.StringProperty(required=True)</span></span>
 74</span>            cache = db.UnindexedProperty()</span></span>
 75</span>            chars = utils.MagicProperty(title, len, cache_prop=cache, required=True)</span></span>
 76</span>        </span></span>
 77</span>            def put(self, *args, **kw):</span></span>
 78</span>                prime_cache = self.chars</span></span>
 79</span>                super(MagicTesting).put(*args, **kw)</span></span>
 80</span>        </span></span>
 81</span>        mytesting = MagicTesting(title="Get the pocket knife out of my boot.")</span></span>
 82</span>    </span></span>
 83</span>        >>> </span>print mytesting.title</span></span>
 84</span>        Get the pocket knife out of my boot.</span></span>
 85</span>        >>> </span>print mytesting.chars</span></span>
 86</span>        36</span></span>
 87</span>        </span></span>
 88</span>        mytesting = MagicTest.all().get()</span></span>
 89</span>        </span></span>
 90</span>        >>> </span>print mytesting.title</span></span>
 91</span>        How are you?</span></span>
 92</span>        >>> </span>print mytesting.chars	</span></span>
 93</span>        12	# This is not recomputed so long as the title has not changed, however it uses more datastore space to store a hash.</span></span>
 94</span>        </span></span>
 95</span>        </span></span>
 96</span>    Inspired by: </span></span>
 97</span>    http://appengine-cookbook.appspot.com/recipe/custom-model-properties-are-cute</span></span>
 98</span>    http://code.google.com/appengine/articles/extending_models.html</span></span>
 99</span>    http://googleappengine.blogspot.com/2009/07/writing-custom-property-classes.html</span></span>
100</span>    </span></span>
101</span>    """</span></span>
102</span>    def</span> __init__</span>(</span>self</span>,</span> prop</span>,</span> magic_func</span>,</span> cache_prop</span>,</span> pass_instance</span>,</span> *args</span>,</span> **kw</span>)</span>:</span></span>
103</span>        """</span></span>
104</span>        Extra parameters you can give this initializer.</span></span>
105</span>        </span></span>
106</span>            prop		= Property to be acted upon</span></span>
107</span>            magic_func	= The function to be called when the property is accessed</span></span>
108</span>            cache_prop	= The property that can hold our cache, I suggest it is an db.UnindexedProperty() since it just stores sha1 hashes</span></span>
109</span>        """</span></span>
110</span>        super</span>(</span>_MagicProperty</span>,</span> self</span>).</span>__init__</span>(</span>*</span>args</span>,</span> **</span>kw</span>)</span></span>
111</span>        self</span>.magic_func</span> =</span> magic_func</span></span>
112</span>        self</span>.magic_prop</span> =</span> prop</span></span>
113</span>        self</span>.magic_cache</span> =</span> cache_prop</span></span>
114</span>        self</span>.magic_pass</span> =</span> pass_instance</span></span>
115</span>        </span></span>
116</span>    def</span> get_cache_val</span>(</span>self</span>,</span> model_instance</span>,</span> class_instance</span>)</span>:</span></span>
117</span>        if</span> self</span>.magic_cache</span> is not</span> None</span>:</span></span>
118</span>            return</span> self</span>.magic_cache.</span>__get__</span>(</span>model_instance</span>,</span> class_instance</span>)</span></span>
119</span>        return</span> getattr</span>(</span>model_instance</span>,</span> self</span>.</span>attr_name</span>()</span> +</span> "</span>orig</span>",</span> None</span>)</span></span>
120</span>            </span></span>
121</span>    def</span> set_cache_val</span>(</span>self</span>,</span> model_instance</span>,</span> val</span>)</span>:</span></span>
122</span>        val</span> =</span> hashlib.</span>sha1</span>(</span>val</span>).</span>hexdigest</span>()</span></span>
123</span>        </span></span>
124</span>        if</span> self</span>.magic_cache</span> is not</span> None</span>:</span></span>
125</span>            self</span>.magic_cache.</span>__set__</span>(</span>model_instance</span>,</span> val</span>)</span></span>
126</span>        setattr</span>(</span>model_instance</span>,</span> self</span>.</span>attr_name</span>()</span> +</span> "</span>orig</span>",</span> val</span>)</span></span>
127</span>    </span></span>
128</span>    def</span> attr_name</span>(</span>self</span>)</span>:</span></span>
129</span>        # In google.appengine.ex.db there is an explicit warning not to use this method, so we test for it first.</span></span>
130</span>        if</span> self</span>._attr_name:</span></span>
131</span>            return</span> self</span>.</span>_attr_name</span>()</span></span>
132</span>        else</span>:</span></span>
133</span>            return</span> "</span>_</span>"</span> +</span> self</span>.name</span></span>
134</span>    </span></span>
135</span>    def</span> __get__</span>(</span>self</span>,</span> model_instance</span>,</span> class_instance</span>)</span>:</span></span>
136</span>        if</span> model_instance</span> is</span> None</span>:</span></span>
137</span>            return</span> self</span></span>
138</span>        </span></span>
139</span>        cur</span> =</span> self</span>.magic_prop.</span>__get__</span>(</span>model_instance</span>,</span> class_instance</span>)</span></span>
140</span>        cur</span> =</span> cur.</span>encode</span>(</span>'</span>utf-8</span>'</span>)		</span></span>
141</span>        last</span> =</span> self</span>.</span>get_cache_val</span>(</span>model_instance</span>,</span> class_instance</span>)</span></span>
142</span>        if</span> last</span> ==</span> hashlib.</span>sha1</span>(</span>cur</span>).</span>hexdigest</span>():</span></span>
143</span>            logging.</span>info</span>(</span>"</span>Cache hit: </span>%s</span>"</span> %</span> (cur)</span>)</span></span>
144</span>            return</span> getattr</span>(</span>model_instance</span>,</span> self</span>.</span>attr_name</span>()</span>,</span> None</span>)</span></span>
145</span>        </span></span>
146</span>        logging.</span>info</span>(</span>"</span>Cache miss: </span>%s</span>"</span> %</span> (cur)</span>)</span></span>
147</span>        </span></span>
148</span>        magic_done</span> = u</span>""</span></span>
149</span>        if</span> self</span>.magic_pass:</span></span>
150</span>            magic_done</span> =</span> self</span>.</span>magic_func</span>(</span>model_instance</span>,</span> cur</span>)</span></span>
151</span>        else</span>:</span></span>
152</span>            magic_done</span> =</span> self</span>.</span>magic_func</span>(</span>cur</span>)</span></span>
153</span>        </span></span>
154</span>        # Set the attribute in the model</span></span>
155</span>        setattr</span>(</span>model_instance</span>,</span> self</span>.</span>attr_name</span>()</span>,</span> magic_done</span>)</span></span>
156</span>        self</span>.</span>set_cache_val</span>(</span>model_instance</span>,</span> cur</span>)</span></span>
157</span>        </span></span>
158</span>        return</span> magic_done</span></span>
159</span>        </span></span>
160</span>    </span></span>
161</span>    def</span> __set__</span>(</span>self</span>,</span> model_instance</span>,</span> value</span>)</span>:</span></span>
162</span>        if</span> isinstance</span>(</span>value</span>,</span> _MagicDatastore</span>):</span></span>
163</span>            setattr</span>(</span>model_instance</span>,</span> self</span>.</span>attr_name</span>()</span>,</span> value.</span>retval</span>())</span></span>
164</span>        else</span>:</span></span>
165</span>            raise</span> db.</span>DerivedPropertyError</span>(</span>"</span>MagicProperty is magic. Magic may not be modified.</span>"</span>)</span></span>
166</span>    </span></span>
167</span>    def</span> make_value_from_datastore</span>(</span>self</span>,</span> value</span>)</span>:</span></span>
168</span>        return</span> _MagicDatastore</span>(</span>value</span>)</span></span></code></pre>


Auto-updating Properties in Google AppEngine Models
2010-02-21T04:03:42+00:00
EDIT: I have an updated version of this code available in a newer post, please
go to Magic Properties on Google AppEngine</a> for the updated information.
For the generic information that has not changed, and the idea behind the code
please continue below.</p>

In Google AppEngine a model may contain many different properties, from this
model you can generate a form using djangoforms. This is all good and well
until you have a required property on a model that needs to have part of it be
calculated based upon something the user types in. For example, a blog entry
generally has a "slug" which is generated from the title, now in Google
AppEngine's models, if a property is required it has to be set at object
creation time.</p>
Djangoforms has a form.save(committed=False)</code> that allows one to get back an
unsaved Model</code>, however since slug is not in the form (since it is auto
generated) it cannot be set at model creation time. Even adding a hidden field
to the form with the name of the property is not going to satisfy the model
since a value of None</code> is considered to be empty, which means it does not meet
the required=True</code> status.</p>
After trying a multitude of different options I ran across an article about
extending models</a> that specifically talked about adding custom properties
that were saved into the DB, and could be searched on, this got me digging and
I found a blog post on the Google AppEngine blogspot</a> about the exact same
thing, using yet again a different example. The one that got me on the right
track was the following post by Rodrigo Moraes on his custom model
properties</a>.</p>
I came up with the following fairly quickly after also taking a look at
googleappengine.ext.db</code> within the Google AppEngine framework, however there is
still an issue, for now the MagicProperty</code> is only updated the first time the
property it affects is set. I am not yet sure how to work around that, I will
have to do some more digging, maybe there is a way to get notified if another
property gets modified or updated.</p>
import</span> logging</span></span>
from</span> google.appengine.ext</span> import</span> db</span></span>
</span>
</span>
def</span> MagicProperty</span>(</span>prop</span>,</span> magic_func=</span>None</span>,</span> *args</span>,</span> **kw</span>)</span>:</span></span>
    if</span> magic_func:</span></span>
        # No pants required.</span></span>
        return</span> _MagicProperty</span>(</span>prop</span>,</span> magic_func</span>,</span> *</span>args</span>,</span> **</span>kw</span>)</span></span>
    else</span>:</span></span>
        # We are putting some pants on the function.</span></span>
        def</span> pants</span>(</span>magic_func</span>)</span>:</span></span>
            return</span> _MagicProperty</span>(</span>prop</span>,</span> magic_func</span>,</span> *</span>args</span>,</span> **</span>kw</span>)</span></span>
        return</span> pants</span></span>
</span>
</span>
class</span> _MagicProperty</span>(</span>db</span>.</span>Property</span>):</span></span>
    """</span>MagicProperty which will modify output based on a function that it is given.</span></span>
    </span></span>
    Inspired by: </span></span>
    http://appengine-cookbook.appspot.com/recipe/custom-model-properties-are-cute</span></span>
    http://code.google.com/appengine/articles/extending_models.html</span></span>
    http://googleappengine.blogspot.com/2009/07/writing-custom-property-classes.html</span></span>
    </span></span>
    """</span></span>
    def</span> __init__</span>(</span>self</span>,</span> prop</span>,</span> magic_func</span>,</span> *args</span>,</span> **kw</span>)</span>:</span></span>
        super</span>(</span>_MagicProperty</span>,</span> self</span>).</span>__init__</span>(</span>*</span>args</span>,</span> **</span>kw</span>)</span></span>
        self</span>.magic_func</span> =</span> magic_func</span></span>
        self</span>.magic_prop</span> =</span> prop</span></span>
    </span></span>
    def</span> attr_name</span>(</span>self</span>)</span>:</span></span>
        # In google.appengine.ex.db there is an explicit warning not to use this method, so we test for it first.</span></span>
        if</span> self</span>._attr_name:</span></span>
            return</span> self</span>.</span>_attr_name</span>()</span></span>
        else</span>:</span></span>
            return</span> "</span>_</span>"</span> +</span> self</span>.name</span></span>
    </span></span>
    def</span> __get__</span>(</span>self</span>,</span> model_instance</span>,</span> class_instance</span>)</span>:</span></span>
        if</span> model_instance</span> is</span> None</span>:</span></span>
            return</span> self</span></span>
        </span></span>
        #</span> TODO</span>: If the property that this one is functioning on is changed, we need a way to know that so that we recalculate</span></span>
        </span></span>
        # Original __get__ in google.appengine.ext.db has getattr to retrieve the value from the model instance</span></span>
        magic_done</span> =</span> getattr</span>(</span>model_instance</span>,</span> self</span>.</span>attr_name</span>()</span>,</span> None</span>)</span></span>
        if</span> magic_done</span> is</span> None</span>:</span></span>
            magic_done</span> =</span> self</span>.</span>magic_func</span>(</span>self</span>.magic_prop.</span>__get__</span>(</span>model_instance</span>,</span> class_instance</span>))</span></span>
            </span></span>
            # Set the attribute in the model</span></span>
            setattr</span>(</span>model_instance</span>,</span> self</span>.</span>_attr_name</span>()</span>,</span> magic_done</span>)</span></span>
        return</span> magic_done</span></span>
        </span></span>
    </span></span>
    def</span> __set__</span>(</span>self</span>,</span> *args</span>)</span>:</span></span>
        raise</span> db.</span>DerivedPropertyError</span>(</span>"</span>MagicProperty is magic. Magic may not be modified.</span>"</span>)</span></span></code></pre>
The approach that the DateTimeProperty</a> takes is one that I can't use
because my class is dependant upon an external property, not whether or not a
value was set when the object was instantiated.</p>
Google AppEngine is posing some rather interesting challenges. Although, for
slugs it may not be entirely bad that it can only be set once, as that means
title changes on the article won't cause the slug to change possibly breaking
old links. This definitely requires more research and more thinking.</p>


Property class on AppEngine does not support a tuple for choices
2010-02-15T04:56:59+00:00
Google AppEngine</a> does not allow one to set the choices field of a model
property</a></a> to a tuple; this workaround will have have a form give the
user the choices with the user friendly items but have the backend store the
non-user friendly version.</p>
# Set up our non-user friendly and user friendly choices</span></span>
REDIRECT_CHOICES</span> =</span> (</span></span>
    (</span>301</span>,</span> "</span>301 - Permanent Redirect</span>"</span>),</span></span>
    (</span>302</span>,</span> "</span>302 - Temporary Redirect</span>"</span>),</span></span>
    (</span>403</span>,</span> "</span>403 - Access Denied</span>"</span>),</span></span>
    (</span>404</span>,</span> "</span>404 - File Not Found</span>"</span>),</span></span>
    (</span>500</span>,</span> "</span>500 - Internal Server Error</span>"</span>)</span></span>
)</span></span>
</span>
# Sample model that has the required Property with the choices set to the</span></span>
# non-user friendly values</span></span>
class</span> Shorturl</span>(</span>db</span>.</span>Model</span>):</span></span>
    uripath</span> =</span> db.</span>StringProperty</span>(</span>verbose_name</span>=</span>"</span>Path</span>",</span> required</span>=</span>True</span>)</span></span>
    httpcode</span> =</span> db.</span>IntegerProperty</span>(</span></span>
        verbose_name</span>=</span>"</span>HTTP code</span>",</span></span>
        required</span>=</span>True</span>,</span></span>
        default</span>=</span>301</span>,</span></span>
        choices</span>=</span>[</span>x</span>[</span>0</span>]</span> for</span> x</span> in</span> REDIRECT_CHOICES</span>]</span></span>
    )</span></span>
    location</span> =</span> db.</span>StringProperty</span>(</span>verbose_name</span>=</span>"</span>Location</span>"</span>)</span></span>
</span>
# This is our djangoform that has the choices set as required so that the user</span></span>
# gets the user friendly version and not just simply the numbers.</span></span>
class</span> ShorturlForm</span>(</span>djangoforms</span>.</span>ModelForm</span>):</span></span>
    httpcode</span> =</span> forms.</span>IntegerField</span>(</span></span>
        widget</span>=</span>forms.</span>Select</span>(</span>choices</span>=</span>REDIRECT_CHOICES</span>)</span>,</span></span>
        required</span>=</span>True</span>,</span></span>
        label</span>=</span>'</span>HTTP code</span>'</span></span>
    )</span></span>
</span>
    class</span> Meta</span>:</span></span>
        model</span> =</span> Shorturl</span></span></code></pre>
Given the above tuple it will set the choices in the model for Google AppEngine
and pass it to the field on the Django form allowing user friendly output. This
will allow the user to pick the right redirect choice without having to know
that various different redirect codes or have to look them up.</p>


Moving from mod_fastcgi to mod_fcgid
2009-08-25T23:22:03+00:00
Update: I've since moved to a PHP-FPM with mod_fastcgi</code> based setup which works
much better than mod_fcgid</code> could ever dream of, taking process management away
from Apache and putting it where it actually makes sense has improved server
load and improved website speed. See my new PHP-FPM with mod_fastcgi
post</a> for more information.</p>
--</p>
Errors, all they cause is trouble. The dreaded 500 error showed up when
visiting my favourite tech website, the one I am the administrator for. This
time I had enough, there was going to be no more playing around with PHP
settings, attempting to figure out why PHP was suddenly dying and or why
mod_fastcgi</code> refused to retry a select() when it failed due to a system
signal.</p>
The server in question runs Apache in MPM worker mode since a threaded Apache
is going to be faster than a pre-fork, besides this server does not have as
much memory so it seemed to be better to have multiple threads rather than
multiple processes, each of which would have their own memory segment. There
however is the issue that this server also needs to run PHP, the accepted
method to do so is to use mod_php</code> along with Apache; however PHP is not thread
safe.</p>
The alternative is FastCGI, basically it spawns PHP processes as a separate
stand-alone process, with their own memory space, much like Apache pre-fork,
however now when one process grows to big, or when a process is no longer
needed it can be cleaned up, keeping memory to a minimum. Also, FastCGI is
perfectly thread safe, this means that with Apache running in MPM worker mode
we could now still run our PHP scripts even when they were not thread safe.</p>
Setting up mod_fastcgi</code> is not that hard, it takes some httpd.conf
configuration values, and off course the loadmodule is assumed here:</p>
# Set up mod_fastcgi</span></span>
<IfModule `mod_fastcgi`.c></span></span>
    FastCgiIpcDir /var/tmp/fcgi-ipc/</span></span>
    FastCgiConfig -autoUpdate -singleThreshold 100 -killInterval 300 -idle-timeout 240 -pass-header HTTP_AUTHORIZATION</span></span>
</span>
    AddHandler  fastcgi-script              .fcgi .fcg .fpl</span></span>
</span>
    Action      application/x-httpd-php5    /fastcgi-bin/php5.fcgi</span></span>
    AddType     application/x-httpd-php5    .php .php5</span></span>
</IfModule></span></span>
</span>
# Set up the script alias, basically anything in this directory gets executed as a fastcgi script</span></span>
ScriptAlias /fastcgi-bin/ "/usr/local/www/fastcgi-bin/"</span></span>
<Location /fastcgi-bin/></span></span>
    Options ExecCGI </span></span>
    SetHandler fastcgi-script</span></span>
    Order allow,deny</span></span>
    Allow from all</span></span>
</Location></span></span></code></pre>
Because of errors that mod_fastcgi</code> was throwing out at me, I figured
mod_fcgid</code> is worth a try. However all of the configurations I found required
me to add an FCGIWrapper line into each of my VirtualHost blocks, which was an
immediate no-no since there is well over 100 of those on the server, and I'd
rather spend my time doing other things.</p>
With some trial and error, and some Googling I put the following together for
mod_fcgid</code>, tested it out, and once it worked perfectly set Apache off running
with the following configuration:</p>
# Set up mod_fcgid</span></span>
<IfModule `mod_fcgid`.c></span></span>
    AddHandler  fcgid-script                 .fcgi .fcg .fpl</span></span>
    IPCCommTimeout 60</span></span>
    SocketPath  /var/tmp/fcgi-ipc/</span></span>
</span>
    Action      application/x-httpd-php5    /fastcgi-bin/php5.fcgi</span></span>
    AddType     application/x-httpd-php5    .php .php5</span></span>
</IfModule></span></span>
</span>
# Set up the script alias, basically anything in this directory gets executed as a fastcgi script</span></span>
ScriptAlias /fastcgi-bin/ "/usr/local/www/fastcgi-bin/"</span></span>
<Location /fastcgi-bin/></span></span>
    Options ExecCGI </span></span>
    SetHandler fcgid-script</span></span>
    Order allow,deny</span></span>
    Allow from all</span></span>
</Location></span></span></code></pre>
Notice how similar they both are, that was the whole goal. mod_fcgid</code> was
supposed to be a drop in replacement, and thankfully it was. PHP was served as
it once was, with a twist.</p>
The php5.fcgi script is as follows for those of you trying to set this up as
well:</p>
#!/bin/sh</span></span>
# To use your own php.ini, comment the next line and uncomment the following one</span></span>
#PHPRC="/usr/local/etc"</span></span>
#export PHPRC</span></span>
PHP_FCGI_CHILDREN</span>=</span>4</span></span>
export</span> PHP_FCGI_CHILDREN</span></span>
exec</span> /usr/local/bin/php-cgi</span></span></code></pre>
Some things that that intrigued me is that my php processes seemed to be capped
now. Where mod_fastcgi</code> would spawn processes but never remove them or kill
them when they were no longer needed, mod_fcgid</code> keeps the running php
processes to a sane limit instantly starting new processes when required to
handle the requests coming in. This means that the server now has more free
memory for MySQL, or file caches which has helped speed up other types of
transfers as well. Even with the relatively short time that mod_fcgid</code> has
been in place it has been faster, more reliable and more sane than
mod_fastcgi</code>. Whichever one you pick, make sure to benchmark your server and
check your error logs to solve common issues, the issue may not be what FastCGI
module you picked but rather PHP itself that is causing the errors!</p>


Hosting NFS shares from a Zone
2009-02-21T00:10:26+00:00
I am currently trying to get my web development environment all set up.
While I like using vi, I really do prefer TextMate on my Mac OS X to do
the real heavy lifting and all of the editing.</p>
As I was working on getting my homedir on my zone to be shared over NFS I
was getting errors that NFS was not a valid protocol from sharemgr</code>, the
program that is used to add new shares to the system.</p>
xistence@webdev.network.lan:~# sharemgr create -P nfs homedir  </span></span>
Invalid protocol specified: nfs</span></span></code></pre>
A little bit of Googling brought me to a mailing list message saying that
some server packages may be missing. This is entirely possible since my
Zone was created with a minimal set of packages, so I log into the global
host where NFS sharing does work and run the following:</p>
xistence@Keyhole.network.lan:~# pkg list | grep nfs</span></span>
SUNWnfsc                                      0.5.11-0.101    installed  ----</span></span>
SUNWnfsckr                                    0.5.11-0.101    installed  ----</span></span>
SUNWnfss                                      0.5.11-0.101    installed  ----</span></span>
SUNWnfsskr                                    0.5.11-0.101    installed  ----</span></span></code></pre>
Ah, so those are probably not installed in the zone, quick pkg install</code>
later:</p>
xistence@webdev.network.lan:~# pkg install SUNWnfsc SUNWnfsckr SUNWnfss SUNWnfsskr</span></span>
DOWNLOAD                                    PKGS       FILES     XFER (MB)</span></span>
Completed                                    3/3       17/17     0.28/0.28 </span></span>
</span>
PHASE                                        ACTIONS</span></span>
Install Phase                                  55/55 </span></span>
PHASE                                          ITEMS</span></span>
Reading Existing Index                           9/9 </span></span>
Indexing Packages                                3/3</span></span></code></pre>
Now, lets re-run the sharemgr</code> command again and see if this time we do
indeed get our group created:</p>
xistence@webdev.network.lan:~# sharemgr create -P nfs homedir</span></span>
xistence@webdev.network.lan:~# sharemgr show -vp</span></span>
default nfs=()</span></span>
zfs</span></span>
homedir nfs=()</span></span></code></pre>
Yes, there we go. Now I can add a share to that group. Until more errors
start showing up:</p>
xistence@webdev.network.lan:~# sharemgr add-share -s /export/home/xistence/ homedir</span></span>
NFS: Cannot share remote filesystem: /export/home/xistence</span></span>
NFS: Service needs to be enabled by a privileged user</span></span>
Failed to enable share for "nfs": system error</span></span></code></pre>
This time Google does not help out, instead it gives me the option to
search without quotes around the search terms which gives me absolutely
nothing.</p>
Well, lets see if the services are running in the first place:</p>
xistence@webdev.network.lan:~# svcs -a | grep nfs    </span></span>
disabled       22:19:04 svc:/network/nfs/client:default</span></span>
disabled       22:24:26 svc:/network/nfs/server:default</span></span>
online         22:24:20 svc:/network/nfs/rquota:default</span></span>
online         22:24:20 svc:/network/nfs/status:default</span></span>
online         22:24:20 svc:/network/nfs/mapid:default</span></span>
online         22:24:20 svc:/network/nfs/cbd:default</span></span>
online         22:24:21 svc:/network/nfs/nlockmgr:default</span></span></code></pre>
Nope, for some reason the nfs server keeps being disabled even though I
did enable it using svcadmin</code>.</p>
Okay, lets take a look with svcs</code> what is going on:</p>
xistence@webdev.network.lan:/# svcs -l nfs/server</span></span>
fmri         svc:/network/nfs/server:default</span></span>
name         NFS server</span></span>
enabled      false (temporary)</span></span>
state        disabled</span></span>
next_state   none</span></span>
state_time   Fri Feb 20 22:25:26 2009</span></span>
logfile      /var/svc/log/network-nfs-server:default.log</span></span>
restarter    svc:/system/svc/restarter:default</span></span>
contract_id  </span></span>
dependency   require_any/error svc:/milestone/network (online)</span></span>
dependency   require_all/error svc:/network/nfs/nlockmgr (online)</span></span>
dependency   optional_all/error svc:/network/nfs/mapid (online)</span></span>
dependency   require_all/restart svc:/network/rpc/bind (online)</span></span>
dependency   optional_all/none svc:/network/rpc/keyserv (disabled)</span></span>
dependency   optional_all/none svc:/network/rpc/gss (absent)</span></span>
dependency   optional_all/none svc:/network/shares/group (multiple)</span></span>
dependency   require_all/error svc:/system/filesystem/local (online)</span></span></code></pre>
Ah, it has a log file, lets see what that log file says:</p>
xistence@webdev.network.lan:/# cat /var/svc/log/network-nfs-server\:default.log </span></span>
[ Feb 20 22:11:07 Disabled. ]</span></span>
[ Feb 20 22:11:07 Rereading configuration. ]</span></span>
[ Feb 20 22:18:43 Enabled. ]</span></span>
[ Feb 20 22:19:04 Enabled. ]</span></span>
[ Feb 20 22:24:21 Executing start method ("/lib/svc/method/nfs-server start"). ]</span></span>
The NFS server is not supported in a local zone</span></span></code></pre>
Eh? What? That seems weird, but it is of course plausible. Zones are new
to Solaris and thus not everything may be virtualised yet. Taking that
query to google brings me to a web page asking the same question I am
asking: Local zone as NFS server. Taking a look it brings me to a bug
report and ultimately to: Bug ID 4964859 RFE: Zones should be able to be
NFS servers. Well, I guess that ends that little stunt. I will be sharing
it from the global zone. While this is acceptable to me, I do not believe
that it is acceptable to most other people using Zones, and while it is
unfortunate but it does not look like there is a whole lot of activity on
the bug, as apparently there are no resources available.</p>
I ended up doing the following:</p>
sharemgr create -P nfs webdev-homedir</span></span></code></pre>
Then I followed that up with some servers that should be allowed access,
and others that should not:</p>
sharemgr set -P nfs -S sys -p 'rw=10.10.10.226 none=*' webdev-homedir</span></span></code></pre>
And then finally I added the share I wanted to share all along:</p>
sharemgr add-share -r "homedir" -d "xistence home dir" -s /storage/zones/dev-web/root/export/home/xistence webdev-homedir</span></span></code></pre>
This creates a long NFS share to type in, since the full path now becomes:</p>
nfs://keyhole/storage/zones/dev-web/root/export/home/xistence</span></span></code></pre>
Which is not that big of a problem for me, especially since I just save
it in my favourites in Mac OS X and everything is peachy. It works like a
charm.</p>


Upgrading an OpenSolaris ipkg zone
2009-01-18T00:10:02+00:00
Recently I was working on my OpenSolaris machine (file server, ZFS rocks, will
write more on that later), and I have one non-global zone, one that use for web
development, which is aptly called dev-web.</p>
So the following shows up when I run zoneadm:</p>
# zoneadm list -iv</span></span>
  ID NAME             STATUS     PATH                           BRAND    IP    </span></span>
   0 global           running    /                              native   shared</span></span>
   4 dev-web          running    /storage/zones/dev-web         ipkg     shared</span></span></code></pre>
The thing is, I had upgraded the global zone with the latest update available for the version (snv_101b</code>):</p>
pkg</span> image-update</span> -v</span></span></code></pre>
This had not upgraded my one none-global zone. And running pkg image-update</code>
from within the zone itself is not possible, because you can't do an upgrade on
a "live" system, mainly because the image-update</code> wants to create a new bootable
environment, something that was already created when I upgraded the global
zone. So what we have to do is mount the non-global zone to /mnt</code> and tell pkg</code>
with -R</code> where to find it and upgrade it anyway!</p>
First we are going to halt the current zone, important is running on the test
system, I just used:</p>
zoneadm</span> -z</span> dev-web halt</span></span></code></pre>
However, the better way is to off course use the shutdown command:</p>
zlogin</span> dev-web shutdown</span></span></code></pre>
and then for good measure a halt!</p>
Next up, looking at what we are going to be mounting.</p>
# zfs list</span></span>
NAME                               USED  AVAIL  REFER  MOUNTPOINT</span></span>
rpool                             11.9G  42.7G    75K  /rpool</span></span>
rpool/ROOT                        2.93G  42.7G    18K  legacy</span></span>
rpool/ROOT/opensolaris            7.34M  42.7G  2.74G  /</span></span>
rpool/ROOT/opensolaris-1          2.92G  42.7G  2.74G  /</span></span>
rpool/dump                        1.87G  42.7G  1.87G  -</span></span>
rpool/export                      5.27G  42.7G    19K  /export</span></span>
rpool/export/home                 5.27G  42.7G    21K  /export/home</span></span>
rpool/export/home/guest           5.24G  14.8G  5.24G  /export/home/guest</span></span>
rpool/export/home/xistence        37.0M  42.7G  37.0M  /export/home/xistence</span></span>
rpool/swap                        1.87G  43.0G  1.51G  -</span></span>
storage                            493G  3.08T  35.1K  /storage</span></span>
storage/media                      398G  3.08T   398G  /storage/media</span></span>
storage/virtualbox                2.10G  3.08T  2.10G  /storage/virtualbox</span></span>
storage/xistence                  91.7G  3.08T  91.7G  /storage/xistence</span></span>
storage/zones                      957M  99.1G  30.4K  /storage/zones</span></span>
storage/zones/dev-web              957M  19.1G  32.0K  /storage/zones/dev-web</span></span>
storage/zones/dev-web/ROOT         957M  19.1G  28.8K  legacy</span></span>
storage/zones/dev-web/ROOT/zbe    1.60M  19.1G   936M  legacy</span></span>
storage/zones/dev-web/ROOT/zbe-1   955M  19.1G   935M  legacy</span></span></code></pre>
When pkg image-update</code> was run on the global zone it created a new bootable
environment named opensolaris-1, the cool thing is, that beadm</code> at the same time
will also create a new bootable environment for your zones. That way you can
upgrade your zones afterwards, and if stuff does not work, you can revert the
ENTIRE machine back to the previous state (ZFS is cool like that), thereby also
making sure that your zones are reverted so that there are no
incompatibilities.</p>
So what we are looking for in this case is a zbe-1, this is the new root for
the zone that we need to update, so we now need to mount it.</p>
mount</span> -F</span> zfs storage/zones/dev-web/ROOT/zbe-1 /mnt</span></span></code></pre>
Note, that there is no /</code> in front of storage, this is because we are specifying
a pool name, since there is no "real" path that is defined as
/storage/zones/dev-web/ROOT/zbe-1</code>. Now that it is mounted, we are able to pass
the -R flag to pkg, to get it to update our zone:</p>
# pkg -R /mnt image-update -v</span></span>
Creating Plan / Before evaluation:     </span></span>
UNEVALUATED:</span></span>
+pkg:/entire@0.5.11,5.11-0.101:20081204T010954Z</span></span>
</span>
After evaluation:</span></span>
pkg:/entire@0.5.11,5.11-0.101:20081119T235706Z -> pkg:/entire@0.5.11,5.11-0.101:20081204T010954Z</span></span>
Actuators:</span></span>
</span>
None</span></span>
PHASE                                        ACTIONS</span></span>
Update Phase                                     1/1 </span></span>
PHASE                                          ITEMS</span></span>
Reading Existing Index                           9/9 </span></span>
Indexing Packages                                1/1 </span></span>
</span>
---------------------------------------------------------------------------</span></span>
NOTE: Please review release notes posted at:</span></span>
   http://opensolaris.org/os/project/indiana/resources/relnotes/200811/x86/</span></span>
---------------------------------------------------------------------------</span></span></code></pre>
Voilá, and the deed is done. The last command is to off course unmount the
zone, that we can then issue a zoneadm boot command to start it back up:</p>
umount</span> /mnt</span></span>
zoneadm</span> -z</span> dev-web boot</span></span></code></pre>
And then on the zone after we log into it (over SSH in my case):</p>
xistence@webdev.network.lan:~# pkg list -u</span></span>
No installed packages have available updates</span></span></code></pre>
Which is exactly what we wanted! Your zone is now upgraded with the latest
version available from the global zone.</p>


Using DJB's daemontools and netcat to bounce a request around
2008-11-29T17:56:05+00:00
Lately I have been moving the data from one server to another server, located
halfway across the globe, and I needed some way to forward all incoming
requests from the old server to the new server. This had to be done so that DNS
could take its time to update while everything was now already being served
from the new location.</p>
What I ended up doing was using daemontools along with netcat to pipe the
request around the world. Here are the steps I took in doing so:</p>
mkdir</span> /usr/local/redirect/</span></span>
cd</span> /usr/local/redirect/</span></span>
mkdir</span> smtp smtp/env</span></span>
cd</span> smtp</span></span></code></pre>
Put the following in a file named run:</p>
#!/bin/sh</span></span>
exec</span> 2>&1</span> \</span></span>
envdir</span> ./env</span> \</span></span>
sh</span> -c</span> '</span></span>
    case "$REMOTENAME" in h) H=;; p) H=p;; *) H=H;; esac</span></span>
    case "$REMOTEINFO" in r) R=;; [0-9]*) R="t$REMOTEINFO";; *) R=R;; esac</span></span>
    exec \</span></span>
    /usr/local/bin/tcpserver \</span></span>
        -vDU"$H$R" \</span></span>
        ${LOCALNAME+"-l$LOCALNAME"} \</span></span>
        ${BACKLOG+"-b$BACKLOG"} \</span></span>
        ${CONCURRENCY+"-c$CONCURRENCY"} \</span></span>
        -- "${IP-0}" "${PORT}" \</span></span>
        /usr/bin/nc "${REMOTEHOST}" "${REMOTEPORT}"</span></span>
'</span></span></code></pre>
Make it executable: chmod +x run</code></p>
Then we need to set up a few environment variables:</p>
cd</span> env</span></span>
echo</span> "</span>example.net</span>"</span> ></span> REMOTEHOST</span></span>
echo</span> "</span>25</span>"</span> ></span> REMOTEPORT</span></span>
echo</span> "</span>25</span>"</span> ></span> PORT</span></span>
echo</span> `</span>hostname</span>`</span> ></span> LOCALNAME</span></span>
echo</span> "</span>200</span>"</span> ></span> CONCURRENCY</span></span></code></pre>
I made REMOTEPORT</code> and PORT</code> be separate on purpose, in one case I now had more
IP's than before, so instead of having SSL running on a separate port it was
running on the default port, and I needed a clean way to forward that.</p>
Now just add it to your services folder as a symlink and it will automatically
be started, from there it will do it's job! I also suggest adding some simple
logging, or discarding all off the output from tcpserver.</p>


addnumbers.asm updated
2008-02-03T09:59:04+00:00
If you have no clue what I am talking about, check out my previous post</a>.
I have fixed the flaws, and now it will parse the commands it is handed on
the command line, and stick them into an integer. It will now print it to
stdout.</p>
This has been an awesome learning experience for me. Especially with regards
to how to do recursion, how to debug a pure assembly program with gdb and
whatnot.</p>
Here comes the code, as I said before, see my previous thread if you don't
know what I am talking about, as well as instructions on how to compile the
program.</p>
; File: addnumbers2.asm</span></span>
; Delta Regeer</span></span>
; </span></span>
; 2008-01-27</span></span>
; </span></span>
; Function:</span></span>
;	Add numbers together that are provided as arguments to the program in argv[1] and argv[2].</span></span>
;</span></span>
; Known limitations:</span></span>
;	This will hopefully be fixed in the next revision. Floating point numbers will not work.</span></span>
;	Any input that is larger than an integer will cause overflows, and thus will not work.</span></span>
 </span></span>
section .data</span></span>
</span>
	; Define some strings that are going to be used throughout the program</span></span>
</span>
	; This string is to let the user know they failed to provide the proper amount of arguments.</span></span>
args	</span>db</span>	"Program </span>addnumbers</span>:</span> ", </span>0xa</span>, </span>0x9</span>, "addnumbers <number </span>1</span>> <number </span>2</span>>", </span>0xa</span>, </span>0x9</span>, "Arguments </span>1</span> and</span> 2</span> are required.", </span>0xa</span>, </span>0x9</span>, "Anything that will cause addition to overflow an </span>int</span> (</span>2</span>,</span>147</span>,</span>483</span>,</span>647</span>), will fail! :P", </span>0xa</span></span>
largs	</span>equ</span>	$ - args</span></span>
</span>
	; This string contains part of the output that we are going to send to the terminal. The last two</span></span>
	; bytes will be filled automatically by the program, before it is output to stdout.</span></span>
msg	</span>db</span>	'</span>Answer</span>:</span> ',	</span>0</span></span>
lmsg	</span>equ</span>	$ - msg</span></span>
</span>
num1	</span>dd</span>	0</span></span>
num2	</span>dd</span>	0</span></span>
</span>
section .bss</span></span>
	; This is where I am going to store the output of my conversion from an integer to a char</span></span>
answer	</span>resb</span>	64</span></span>
</span>
section .text</span></span>
global start				</span>; Linker defined entry point. Mac OS X this is start. </span></span>
global _start				</span>; FreeBSD and others _start.</span></span>
</span>
</span>
_start</span>:</span></span>
start</span>:</span></span>
	push</span>	ebp</span>			; </span></span>
	mov</span>	ebp</span>, </span>esp</span> 		; Set up the stack frame</span></span>
</span>
	mov</span>	ecx</span>, [</span>ebp</span> + </span>4</span>]		</span>; Get argc, we check if it set to at least 3</span></span>
	mov</span>	edx</span>, </span>ebp</span>		; Put the base pointer into edx, so we can use that in </span></span>
					; our dereferences coming up</span></span>
	add</span>	edx</span>, </span>8</span>			; Add 8. We want to skip ebp and argc</span></span>
</span>
	cmp</span>	ecx</span>, </span>3</span>			; Check if we have at least 3 arguments to the program. </span></span>
					; At least two arguments are required, and the 3rd one is </span></span>
					; the name of the program</span></span>
	jl</span>	exit			</span>; If the value in ecx is less than 3, jump to exit</span></span>
</span>
	mov</span>	esi</span>, </span>1</span>			; Set the index to 1</span></span>
	</span></span>
	mov</span>	eax</span>, [</span>edx</span> + </span>esi</span> * </span>4</span>]	</span>; Move the pointer to the character array into eax</span></span>
	push</span>	eax</span>			; Push eax onto the stack</span></span>
	push</span>	num1			</span>; Push the pointer to num1 onto the stack</span></span>
	call</span>	ctoi			</span>; Call my char to int function</span></span>
	add</span>	esp</span>, </span>byte</span> 8</span>		; Put the stack pointer back to where it was.</span></span>
</span>
	inc</span>	esi</span>			; Increase the index</span></span>
	</span></span>
	mov</span>	eax</span>, [</span>edx</span> + </span>esi</span> * </span>4</span>]	</span>; Move the pointer to the character array into eax</span></span>
	push</span>	eax</span>			; Push eax onto the stack</span></span>
	push</span>	num2			</span>; Push the pointer to num2 onto the stack</span></span>
	call</span>	ctoi			</span>; Call my char to int function</span></span>
	add</span>	esp</span>, </span>byte</span> 8</span>		; Put the stack pointer back to where it was.</span></span>
</span>
	mov</span>	eax</span>, [num1]		</span>; Move value stored in num1 into eax</span></span>
	add</span>	eax</span>, [num2]		</span>; Add num2 to eax, this will now be stored in eax</span></span>
</span>
	push</span>	eax</span>			; Push the new calculated number onto the stack</span></span>
	call</span>	itoa			</span>; Convert the integer to a character array</span></span>
</span>
	push</span>	dword</span> lmsg		</span>; Push the length of the string</span></span>
	push</span>	msg			</span>; Push the location of the string in memory</span></span>
	push</span>	dword</span> 0x1</span>		; Push the file descriptor to write to</span></span>
	mov</span>	eax</span>,</span>4</span>			; Move the syscall number into eax</span></span>
	push</span>	eax</span>			; Push the syscall onto the stack</span></span>
	int</span>	0x80</span>			; Interrupt 80, go to kernel</span></span>
	add</span>	esp</span>, </span>byte</span> 16</span>		; Clean up the stack</span></span>
 </span></span>
	push</span>	answer			</span>; Push answer onto the stack</span></span>
	call</span>	len			</span>; Get it's length</span></span>
</span>
	push</span>	edi</span>			; Push the length onto the stack</span></span>
	push</span>	answer			</span>; Push the pointer to the character string onto the stack</span></span>
	push</span>	dword</span> 0x1</span>		; Push the file descriptor to write to</span></span>
	mov</span>	eax</span>,</span>4</span>			; Push the syscall number into eax</span></span>
	push</span>	eax</span>			; Push the syscall onto the stack</span></span>
	int</span>	0x80</span>			; Interrupt 80, go to kernel</span></span>
	add</span>	esp</span>, </span>byte</span> 16</span>		; Clean up the stack</span></span>
</span>
	jmp</span>	done			</span>; Program is done. Jump to done</span></span>
</span>
exit</span>:</span></span>
	; This label is jumped to when we want to exit the program and let the user know how</span></span>
	; to run the program. Like for instance what paramaters to send the program.</span></span>
				; Call sys_write</span></span>
	push</span>	dword</span> largs		</span>; Push the length of the string</span></span>
	push</span>	dword</span> args		</span>; Push the location of the string in memory</span></span>
	push</span>	dword</span> 0x1</span>		; Push the file descriptor to write to</span></span>
	mov</span>	eax</span>,</span>4</span>			; Move the syscall number into eax</span></span>
	push</span>	eax</span>			; Push the syscall onto the stack</span></span>
	int</span>	0x80</span>			; Interrupt 80, go to kernel</span></span>
	add</span>	esp</span>, </span>byte</span> 16</span>		; Clean up the stack</span></span>
</span>
done</span>:</span></span>
	; This is the label we jump to when we want to exit the program, we set the exit code</span></span>
	; to 0.</span></span>
				; Call sys_exit</span></span>
	push</span>	dword</span> 0x0</span>		; Push the value to return to the operating system</span></span>
	mov</span>	eax</span>,</span>1</span>			; Move the syscall number into eax</span></span>
	push</span>	eax</span>			; Push the syscall onto the stack</span></span>
	int</span>	0x80</span>			; Interrupt 80, go to kernel</span></span>
</span>
	; We never return to this function, so no need to clean the stack.</span></span>
</span>
ctoi</span>:</span></span>
	; char to i. We actually convert entire character array's to integers.</span></span>
	;</span></span>
	; We get two paramaters on the stack. The first one we grab is the pointer to the place to store</span></span>
	; the number. The second is the pointer to the character array.</span></span>
</span>
	push</span>	ebp</span>			; Push the old base pointer onto the stack</span></span>
	mov</span>	ebp</span>, </span>esp</span>		; Create a new base pointer</span></span>
	push</span>	esi</span>			; Store all the original registers</span></span>
	push</span>	eax</span></span>
	push</span>	ebx</span></span>
	push</span>	ecx</span>	</span></span>
	push</span>	edx</span>			; Push edx, so that we can overwrite it</span></span>
	sub</span>	esp</span>, </span>4</span>			; We get another storage space on the stack</span></span>
	mov</span>	[</span>esp</span>], </span>dword</span> 10</span>		; This is the number we are going to multiply by</span></span>
</span>
	mov</span>	eax</span>, [</span>ebp</span> + </span>12</span>]		</span>; Move the pointer to the character array into eax</span></span>
	push</span>	eax</span>			; Push the pointer to the character array onto the stack</span></span>
	call</span>	len			</span>; Call the string length versoin</span></span>
	add</span>	esp</span>, </span>byte</span> 4</span>		; Reclaim the space we lost when we pushed eax onto the stack</span></span>
	</span></span>
	mov</span>	ebx</span>, [</span>ebp</span> + </span>8</span>]		</span>; This is where we are going to store the numbers</span></span>
	mov</span>	esi</span>, [</span>ebp</span> + </span>12</span>]		</span>; This is the pointer to the character array</span></span>
	movzx</span>	ecx</span>, </span>di</span>			; move with extended zero edi.</span></span>
	mov</span>	edi</span>, </span>0</span>			; Clean up edi</span></span>
</span>
	ctoi_loop</span>:</span></span>
	mov</span>	eax</span>, [</span>ebx</span>]		</span>; Move the value stored in ebx into eax</span></span>
	mul</span>	dword</span> [</span>esp</span>]		</span>; Move it over a 10s place.</span></span>
	mov</span>	[</span>ebx</span>], </span>eax</span>		; Move the new number back into ebx</span></span>
</span>
	movzx</span>	eax</span>, </span>byte</span> [</span>esi</span> + </span>edi</span>]	</span>; Move the character into eax</span></span>
	movsx</span>	eax</span>, </span>al</span>			; We just want the lower part of the character</span></span>
</span>
	sub</span>	eax</span>, </span>0x30</span>		; Subtract 0x30, ASCII 0 so that it is an actual number</span></span>
	add</span>	[</span>ebx</span>], </span>eax</span>		; Add the new number to the old number that has been multiplied by 10</span></span>
	inc</span>	edi</span>			; Increase the counter</span></span>
	loop</span> ctoi_loop			</span>; Loop into cx is 0</span></span>
</span>
	add</span>	esp</span>, </span>byte</span> 4</span></span>
	pop</span>	edx</span>			; Restore all the registers</span></span>
	pop</span>	ecx</span></span>
	pop</span>	ebx</span></span>
	pop</span>	eax</span></span>
	pop</span>	esi</span></span>
	mov</span>	esp</span>, </span>ebp</span>		; Make esp the original base pointer again</span></span>
	pop</span>	ebp</span>			; Pop the original base pointer into the register</span></span>
	ret</span>				; Return caller</span></span>
</span>
itoa</span>:</span></span>
	; Recursive function. This is going to convert the integer to the character.</span></span>
	push</span>	ebp</span>			; Setup a new stack frame</span></span>
	mov</span>	ebp</span>, </span>esp</span></span>
	push</span>	eax</span>			; Save the registers</span></span>
	push</span>	ebx</span></span>
	push</span>	ecx</span></span>
	push</span>	edx</span></span>
</span>
	mov</span>	eax</span>, [</span>ebp</span> + </span>8</span>]		</span>; eax is going to contain the integer</span></span>
	mov</span>	ebx</span>, </span>dword</span> 10</span>		; This is our "stop" value as well as our value to divide with</span></span>
	mov</span>	ecx</span>, answer		</span>; Put a pointer to answer into ecx</span></span>
	push</span>	ebx</span>			; Push ebx on the field for our "stop" value</span></span>
</span>
	itoa_loop</span>:</span></span>
	cmp</span>	eax</span>, </span>ebx</span>		; Compare eax, and ebx</span></span>
	jl</span>	itoa_unroll		</span>; Jump if eax is less than ebx (which is 10)</span></span>
	xor</span>	edx</span>, </span>edx</span>		; Clear edx</span></span>
	div</span>	ebx</span>			; Divide by ebx (10)</span></span>
	push</span>	edx</span>			; Push the remainder onto the stack</span></span>
	jmp</span>	itoa_loop		</span>; Jump back to the top of the loop</span></span>
	itoa_unroll</span>:</span>			</span></span>
	add</span>	al</span>, </span>0x30</span>		; Add 0x30 to the bottom part of eax to make it an ASCII char</span></span>
	mov</span>	[</span>ecx</span>], </span>byte</span> al</span>		; Move the ASCII char into the memory references by ecx</span></span>
	inc</span>	ecx</span>			; Increment ecx</span></span>
	pop</span>	eax</span>			; Pop the next variable from the stack</span></span>
	cmp</span>	eax</span>, </span>ebx</span>		; Compare if eax is ebx</span></span>
	jne</span>	itoa_unroll		</span>; If they are not equal, we jump back to the unroll loop</span></span>
				; else we are done, and we execute the next few commands</span></span>
	mov</span>	[</span>ecx</span>], </span>byte</span> 0xa</span>		; Add a newline character to the end of the character array</span></span>
	inc</span>	ecx</span>			; Increment ecx</span></span>
	mov</span>	[</span>ecx</span>], </span>byte</span> 0</span>		; Add a null byte to ecx, so that when we pass it to our</span></span>
				; len function it will properly give us a length</span></span>
</span>
	pop</span>	edx</span>			; Restore registers</span></span>
	pop</span>	ecx</span></span>
	pop</span>	ebx</span></span>
	pop</span>	eax</span></span>
	mov</span>	esp</span>, </span>ebp</span>		</span></span>
	pop</span>	ebp</span></span>
	ret</span></span>
</span>
len</span>:</span></span>
	; Returns the length of a string. The string has to be null terminated. Otherwise this function</span></span>
	; will fail miserably. </span></span>
	; Upon return. edi will contain the length of the string.</span></span>
</span>
	push</span>	ebp</span>			; Save the previous stack pointer. We restore it on return</span></span>
	mov</span>	ebp</span>, </span>esp</span>		; We setup a new stack frame</span></span>
	push</span>	eax</span>			; Save registers we are going to use. edi returns the length of the string</span></span>
	push</span> 	ecx</span></span>
	</span></span>
	mov</span>	ecx</span>,  [</span>ebp</span> + </span>8</span>]		</span>; Move the pointer to eax; we want an offset of one, to jump over the return address</span></span>
</span>
	mov</span>	edi</span>, </span>0</span>			; Set the counter to 0. We are going to increment this each loop</span></span>
</span>
	len_loop</span>:</span>			; Just a quick label to jump to</span></span>
	movzx</span>	eax</span>, </span>byte</span> [</span>ecx</span> + </span>edi</span>]	</span>; Move the character to eax.</span></span>
	movsx</span>	eax</span>, </span>al</span>			; Move al to eax. al is part of eax.</span></span>
	inc</span>	di</span>			; Increase di.</span></span>
	cmp</span>	eax</span>, </span>0</span>			; Compare eax to 0.</span></span>
	jnz</span> 	len_loop		</span>; If it is not zero, we jump back to len_loop and repeat.</span></span>
</span>
	dec</span>	di</span>			; Remove one from the count</span></span>
</span>
	pop</span>	ecx</span>			; Restore registers</span></span>
	pop</span>	eax</span></span>
	mov</span>	esp</span>, </span>ebp</span>		; Set esp back to what ebp used to be.</span></span>
	pop</span>	ebp</span>			; Restore the stack frame</span></span>
	ret</span>				; Return to caller</span></span></code></pre>


Introduction to Intel Assembly
2008-01-27T03:42:44+00:00
This semester I am taking a class on Intel assembly, because I want more of an
insight into how the computer works, and it will allow me to better reverse
engineer new viruses and spyware. The class is also required if one is a
Software Engineering major, so that means I have to take it.</p>
We had our first assignment. Sum two numbers and then output them to the
screen. We were supposed to write inline assembly using Visual Studio C++,
but if we are to do an assembly class, then we should learn how to write
assembly, not have some parts assembly and other parts the compiler. Sure
it makes it easy as you will get immediate access to the standard C
library, but if you want that, you can just link against it.</p>
The following code examples were written on Mac OS X, and will work on
FreeBSD. Linux uses a different calling convention for its syscalls, and as
such this code will not run on Linux, unless it is modified. Do note, you
need an Intel Mac for this to work. This is Intel assembly.</p>
Compile the code with (Mac OS X):</p>
nasm</span> -f</span> macho addnumbers.asm</span></span>
ld</span> -o</span> addnumbers addnumbers.o</span></span></code></pre>
or (FreeBSD):</p>
nasm</span> -f</span> elf addnumbers.asm</span></span>
ld</span> -o</span> addnumbers addnumbers.o</span></span></code></pre>
Then you can run it with:</p>
./addnumbers</span> 1 5</span></span></code></pre>
As you can see in the comments of the source code, there are still some
limitations, but the rest of the source code should be made readable by the
comments that are provided.</p>
Porting to Linux: Please double check that all the syscall numbers are the
same. There are some differences between Linux and FreeBSD/Mac OS X in that
regard.</p>
; File: addnumbers.asm</span></span>
; Delta Regeer</span></span>
; </span></span>
; 2008-01-27</span></span>
; </span></span>
; Function:</span></span>
;	Add numbers together that are provided as arguments to the program in argv[1] and argv[2].</span></span>
;</span></span>
; Known limitations:</span></span>
;	As of right now, the numbers that are provided may not add up to anything more than 9.</span></span>
;	This will hopefully be fixed in the next revision. Floating point numbers will not work.</span></span>
;</span></span>
; Todo:</span></span>
;	Write conversion routine, to convert a string of numbers into a real integer on which</span></span>
;	math may be performed.</span></span>
 </span></span>
</span>
</span>
section .data</span></span>
</span>
	; Define some strings that are going to be used throughout the program</span></span>
</span>
	; This string is to let the user know they failed to provide the proper amount of arguments.</span></span>
args	</span>db</span>	"You failed to provide the proper amount of arguments", </span>0xa</span></span>
largs	</span>equ</span>	$ - args</span></span>
</span>
	; This string contains part of the output that we are going to send to the terminal. The last two</span></span>
	; bytes will be filled automatically by the program, before it is output to stdout.</span></span>
msg	</span>db</span>	'</span>Answer</span>:</span> ',	</span>0</span>,	</span>0</span></span>
lmsg	</span>equ</span>	$ - msg</span></span>
</span>
section .text</span></span>
global start				</span>; Linker defined entry point. Mac OS X this is start. FreeBSD and others _start.</span></span>
global _start</span></span>
</span>
_start</span>:</span></span>
start</span>:</span></span>
</span>
; Start the program here.</span></span>
</span>
	add</span>	esp</span>, </span>byte</span> 8</span>		; We don't care about argc or argv[0]</span></span>
	</span></span>
	pop</span> 	ecx</span>			; Get the first argument or argv[1]</span></span>
	jecxz</span>	exit			</span>; If there was no argument. Exit. Let the user know why</span></span>
</span>
	; Change the number from a character to an actual dword</span></span>
	mov</span>	eax</span>, </span>dword</span> [</span>ecx</span>]	</span>; Move the character into eax so we can manipulate it</span></span>
	sub</span>	eax</span>, </span>0x30</span>		; Remove 0x30 from the character. To make it an actual number, not an ASCII number.</span></span>
</span>
	pop</span>	ecx</span>			; get the second argument or argv[2]</span></span>
	jecxz</span>	exit			</span>; If there was no second argument. Exit. Let the user know why</span></span>
</span>
	mov</span>	ebx</span>, </span>dword</span> [</span>ecx</span>]	</span>; Move the character into ebx so we can manipulate it</span></span>
	sub</span>	ebx</span>, </span>0x30</span>		; Remove 0x30 from the character. To make it an actual number, not an ASCII number.</span></span>
</span>
	add</span>	eax</span>, </span>ebx</span>		; Add the two numbers together</span></span>
	add</span>	eax</span>, </span>0x30</span>		; Make it an ASCII number again</span></span>
</span>
	mov</span>	[msg+lmsg-</span>2</span>], </span>eax</span>	; Replace the null character in the msg with the answer</span></span>
	mov</span>	[msg+lmsg-</span>1</span>], </span>dword</span> 0xa</span>	; Add an newline character so that when it spits it out it is neatly formatted</span></span>
				</span></span>
				; Call sys_write</span></span>
	push</span>	dword</span> lmsg		</span>; Push the length of the string</span></span>
	push</span>	msg			</span>; Push the location of the string in memory</span></span>
	push</span>	dword</span> 0x1</span>		; Push the file descriptor to write to</span></span>
	mov</span>	eax</span>,</span>4</span>			; Move the syscall number into eax</span></span>
	push</span>	eax</span>			; Push the syscall onto the stack</span></span>
	int</span>	0x80</span>			; Interrupt 80, go to kernel</span></span>
	add</span>	esp</span>, </span>byte</span> 16</span>		; Advance the stack pointer</span></span>
 </span></span>
	jmp</span>	done			</span>; Program is done. Jump to done</span></span>
</span>
exit</span>:</span></span>
				; Call sys_write</span></span>
	push</span>	dword</span> largs		</span>; Push the length of the string</span></span>
	push</span>	dword</span> args		</span>; Push the location of the string in memory</span></span>
	push</span>	dword</span> 0x1</span>		; Push the file descriptor to write to</span></span>
	mov</span>	eax</span>,</span>4</span>			; Move the syscall number into eax</span></span>
	push</span>	eax</span>			; Push the syscall onto the stack</span></span>
	int</span>	0x80</span>			; Interrupt 80, go to kernel</span></span>
	add</span>	esp</span>, </span>byte</span> 16</span>		; Advance esp past the part we were just at</span></span>
</span>
done</span>:</span></span>
				; sys_exit</span></span>
	push</span>	dword</span> 0x1</span>		; Push the value to return to the operating system</span></span>
	mov</span>	eax</span>,</span>1</span>			; Move the syscall number into eax</span></span>
	push</span>	eax</span>			; Push the syscall onto the stack</span></span>
	int</span>	0x80</span>			; Interrupt 80, go to kernel</span></span>
</span>
	; We never return to this function, so no need to clean the stack.</span></span></code></pre>


X11 mouse button pressed
2007-03-16T04:51:34+00:00
For a Rube Goldberg device I needed a way to know if a mouse button was
pressed on the root window of an X11 screen. Here is the code for it:</p>
#</span>include</span> <</span>stdio.h</span>></span></span>
#</span>include</span> <</span>stdlib.h</span>></span></span>
#</span>include</span> <</span>string.h</span>></span></span>
</span>
#</span>include</span> <</span>unistd.h</span>></span></span>
</span>
#</span>include</span> <</span>X11/Xlib.h</span>></span></span>
#</span>include</span> <</span>X11/Xutil.h</span>></span></span>
</span>
int</span> main</span>() {</span></span>
</span>
        Display </span>*</span>dsp </span>=</span> XOpenDisplay</span>( NULL )</span>;</span></span>
        if</span>(</span> !</span>dsp ){</span> return</span> 1</span>; }</span></span>
</span>
        int</span> screenNumber </span>=</span> DefaultScreen</span>(dsp)</span>;</span></span>
</span>
        long</span> eventMask </span>=</span> StructureNotifyMask;</span></span>
        XSelectInput</span>( dsp,</span> DefaultRootWindow</span>(dsp), eventMask )</span>;</span></span>
</span>
        XEvent evt;</span></span>
</span>
        eventMask </span>=</span> ButtonPressMask</span>|</span>ButtonReleaseMask;</span></span>
        XSelectInput</span>(dsp,</span> DefaultRootWindow</span>(dsp), eventMask)</span>;</span> // override prev</span></span>
</span>
        do</span>{</span></span>
                XNextEvent</span>( dsp,</span> &</span>evt )</span>;</span>   // calls XFlush()</span></span>
                if</span> ( (</span>evt</span>.</span>type</span> ==</span> ButtonRelease)</span> ||</span> (</span>evt</span>.</span>type</span> ==</span> ButtonPress) )</span></span>
                exit</span>(</span>2</span>)</span>;</span></span>
        }</span> while</span>(</span> 1</span> );</span></span>
</span>
return</span> 0</span>;</span></span>
}</span></span></code></pre>
Compile:</p>
gcc</span> -lX11 -L/usr/local/include</span> x11.c</span> -o</span> x11-mousebutton</span></span></code></pre>
Upon a mouse button being pressed it will exit 2, so using that return value
in some script you can execute a command. For example, to open a CD rom
drive so a domino falls over.</p>


FreeBSD GEOM striping and concatenation
2006-12-13T06:44:20+00:00
Some of the hard drives in my FreeBSD box. Just a little back-story:</p>
/dev/ad0 - 20 GB</span></span>
/dev/ad1 - 40 GB</span></span>
/dev/ad2 - 100 GB</span></span>
/dev/ad3 - 60 GB</span></span>
/dev/da0 - 8 GB</span></span>
/dev/da1 - 8 GB</span></span></code></pre>
I had already made a gstripe(8)</code> out of the two SCSI drives, da[1|2]</code>,
however I wanted to see if I could do the same with ad[1|2|3]</code>. As I did
not want to resort to gvinum, which is rather heavy, and I was unable to
figure out how it worked. The entire point behind gstripe is that since it
is striped, the writes/reads are faster since it writes/reads to all the
drives at the same time. So first I tried:</p>
gstripe</span> label</span> -v</span> st1 /dev/ad1 /dev/ad2 /dev/ad3</span></span></code></pre>
That however complained that it would only use 40 GB's on all of the
drives, since the smallest drive in the collection was 40 GB. I then read
up on gconcat(8)</code>, which concatenates all the drives together to look
like one big drive, without the speed improvement of striping. So I
figured, since FreeBSD's gstripe is GEOM based, it should not care about
what the underlying data sink is, just that it is a device, so just maybe
this could work:</p>
gconcat</span> label</span> -v</span> gb100 /dev/ad1 /dev/ad3</span></span></code></pre>
So now I had created a 100 GB "hd" at /dev/concat/gb100</code>. I now did what
I was planning to do:</p>
gstripe</span> label</span> -v</span> st1 /dev/ad2 /dev/concat/gb100</span></span></code></pre>
No problem. I now had 180.48 GB, of which only about 166 GB was usable.
Which is still excellent. As it still came with a speed improvement.
Followed up with the standard advice from the handbook</a> I did the
following:</p>
bsdlabel</span> -wB</span> /dev/stripe/st1</span></span>
newfs</span> -U</span> /dev/stripe/st1a</span></span>
mount</span> /dev/stripe/st1a /mnt</span></span></code></pre>
Which got me the following:</p>
/dev/stripe/st1a    180G    5.5G    161G     3%    /mnt</span></span></code></pre>
Full:</p>
Filesystem          Size    Used   Avail Capacity  Mounted on</span></span>
/dev/ad0s1a         496M     63M    393M    14%    /</span></span>
devfs               1.0K    1.0K      0B   100%    /dev</span></span>
/dev/ad0s1e         496M    230K    456M     0%    /tmp</span></span>
/dev/ad0s1f          15G    2.2G     11G    17%    /usr</span></span>
/dev/ad0s1d         1.4G    115M    1.2G     9%    /var</span></span>
/dev/stripe/st0a     16G    4.0K     15G     0%    /usr/scsi</span></span>
/dev/stripe/st1a    180G    5.5G    161G     3%    /mnt</span></span></code></pre>
Next up I might actually add gdbe(8)</code> or geli(8)</code> even in front of the
stripe, so that I will have an encrypted stripe. Talk about stacking.
Might give gvinum a try sometime.</p>
All working:</p>
keyhole# gconcat status</span></span>
        Name  Status  Components</span></span>
concat/gb100      UP  ad1</span></span>
                      ad3</span></span>
keyhole# gstripe status</span></span>
      Name  Status  Components</span></span>
stripe/st0      UP  da0</span></span>
                    da1</span></span>
stripe/st1      UP  ad2</span></span>
                    concat/gb100</span></span></code></pre>


FastCGI quick and dirty
2006-09-13T00:19:31+00:00
In this quick and dirty guide for FreeBSD I will assume you have already
compiled and installed PHP5 with fcgi mode enabled, which can be checked by
running:</p>
/usr/local/bin/php-cgi</span> --version</span></span></code></pre>
I will also assume you have installed mod_fastcgi</code> from www/mod_fastcgi</code>
in the ports.</p>
Create the fast cgi ipc temp dir, make sure you place this somewhere it will
keep existing:</p>
cd</span> /var/tmp</span></span>
mkdir</span> -p</span> /var/tmp/fcgi-ipc/dynamic</span></span>
chmod</span> -R</span> 0777</span> /var/tmp/fcgi-ipc</span></span></code></pre>
Let's create the directory where we are going to place our PHP wrapper, this
config is for server wide using the same FastCGI PHP config. This is on
purpose, since it will allow server wide PHP usage. If you want you could then
split it up into virtualhosts if one required a standalone php running for
that.</p>
mkdir</span> /usr/local/www/fastcgi-bin/</span></span>
chmod</span> 755</span> /usr/local/www/fastcgi-bin/</span></span></code></pre>
Next up we create the very simple wrapper:</p>
cat</span> <<</span> EOF</span> ></span> /usr/local/www/fastcgi-bin/php5.fcgi</span></span>
#!/bin/sh</span></span>
# To use your own php.ini, comment the next line and uncomment the following one</span></span>
#PHPRC="/usr/local/etc"</span></span>
export PHPRC</span></span>
PHP_FCGI_CHILDREN=8</span></span>
export PHP_FCGI_CHILDREN</span></span>
exec /usr/local/bin/php-cgi</span></span>
EOF</span></span></code></pre>
Set PHP_FCGI_CHILDREN</code> to whatever value you want, that is how many processes
it will use. I suggest the standard which is 8, if you make it more, you use
more ram, you make it less Apache will have to wait if all of the PHP
processes are in use.</p>
Next up, make it executable:</p>
chmod</span> +x /usr/local/www/fastcgi-bin/php5.fcgi</span></span></code></pre>
Last but not least, edit httpd.conf</code> and make sure to add a comment in front
of the mod_php5</code> line, and uncomment the mod_fastcgi</code> line. Then add this
to the end of your Apache config:</p>
<IfModule mod_fastcgi.c></span></span>
    FastCgiIpcDir /var/tmp/fcgi-ipc/</span></span>
    FastCgiConfig  -pass-header HTTP_AUTHORIZATION</span></span>
</span>
    AddHandler  fastcgi-script              .fcgi .fcg .fpl</span></span>
</span>
    Action      application/x-httpd-php5    /fastcgi-bin/php5.fcgi</span></span>
    AddType     application/x-httpd-php5    .php .php5</span></span>
</IfModule></span></span>
</span>
ScriptAlias /fastcgi-bin/ "/usr/local/www/fastcgi-bin/"</span></span>
<Location /fastcgi-bin/></span></span>
    Options ExecCGI</span></span>
    SetHandler fastcgi-script</span></span>
    Order allow,deny</span></span>
    Allow from all</span></span>
</Location></span></span></code></pre>
That's it. Restart apache and watch as the first time you access a PHP script
FastCGI will spawn several of them, and they start serving requests. Load
usage may seem higher, that is because unlike Apache the standalone running
PHP's handle the jobs as they come in with whatever one is first, Apache will
try to put as much work in one of its preforked modules. As the PHP processes
come and go through FastCGI the memory usage will go up and down. Mine has
an average of about 300 MB, which is very good compared to the 800 MB Apache
with mod_php</code> would rack up.</p>


Backup Script
2006-09-09T00:33:02+00:00
I was working on some backup scripts and I decided I might as well generalise
almost all of it (I am sorry about the hard coded paths) so almost anyone can
come grab it and use it on their servers. The shell script is pretty self
explanatory and I am not very good at documenting code, so the script source
itself is your best bet as to why I did something some way. This script is in
production use on several servers I administrate, I hope someone can use it as
well.</p>
Documentation on how to use it:</p>
A backup script which will mount /backup</code>, then use rsync to copy files from
/usr/home</code> to /backup/yyyy-mm-dd</code>. After it is done, it will remove the
oldest backup, 14 days ago. All paths are hardcoded.</p>
If a file .exclude</code> is in a user's homedir, it is looked at, and is used to
exclude certain directories or files from the rsync. For example:</p>
In /usr/home/xistence/.exclude</code>:</p>
public_html/iso</span></span></code></pre>
No trailing slash, this will cause the folder
/usr/home/xistence/public_html/iso</code> to not be backed up. This might be for
various reasons, but for this example it is because backing up GB sized files
should not be something that is done, only because it takes ages and wastes
valuable space.</p>
Thing to keep in mind is, if you want to backup a 40 GB HD, with 22 GB used,
to keep even a 3 day backup of that would require 3 * 22 GB, or 66 GB of
available space on the backup drive. It is therefore in one's best interest
to exclude very large files, and back them up in a different method since
they are most likely not going to change much across revisions.</p>
This script should be set to cron every 30 minutes, as rsync will do one full
backup when the day changes, and then from there on do incremental backups.</p>
Maybe removing the --delete</code> option might help with customers that delete
files and expect them to still be in the backup for that day, this way
however if a file is removed it will still exist in the backup until it is
deleted after 14 days.</p>
#!/usr/local/bin/bash</span></span>
</span>
# This file REQUIRES bash, and can not be run under /bin/sh!</span></span>
</span>
###</span></span>
 # Copyright 2006 Delta Regeer. All rights  reserved.</span></span>
 #</span></span>
 # Redistribution and use in source and binary forms, with or without</span></span>
 # modification, are permitted provided that the following conditions</span></span>
 # are met:</span></span>
 # 1. Redistributions of source code must retain the above copyright</span></span>
 #    notice, this list of conditions and the following disclaimer.</span></span>
 # 2. Redistributions in binary form must reproduce the above copyright</span></span>
 #    notice, this list of conditions and the following disclaimer in the</span></span>
 #    documentation and/or other materials provided with the distribution.</span></span>
 #</span></span>
 # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND</span></span>
 # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE</span></span>
 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE</span></span>
 # ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE</span></span>
 # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL</span></span>
 # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS</span></span>
 # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)</span></span>
 # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT</span></span>
 # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY</span></span>
 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF</span></span>
 # SUCH DAMAGE.</span></span>
 #</span></span>
 # The views and conclusions contained in the software and  documentation are</span></span>
 # those of the authors and should not be  interpreted as representing official</span></span>
 # policies, either expressed  or implied, of bsdPanel project.</span></span>
 #</span></span>
###</span></span>
</span>
for</span> HOMEDIR</span> in</span> `</span>/usr/bin/find</span> /usr/home</span> -type</span> d</span> -maxdepth</span> 1</span> |</span> grep</span> -v</span> '</span>^.$</span>'</span>`</span>;</span> do</span></span>
	if</span> [</span> -f</span> $HOMEDIR</span>/.exclude ];</span> then</span></span>
		echo</span> "</span>Exclude found for </span>$HOMEDIR</span>"</span></span>
		while</span> read</span> line</span>;</span> do</span></span>
			if</span> [</span> "</span>${</span>line</span>:</span>0</span>:</span>1</span>}</span>"</span> !=</span> "</span>/</span>"</span> ];</span> then</span></span>
				# They are missing a full path, we will be nice and add it</span></span>
				TMPLINE</span>=</span>"</span>$HOMEDIR</span>/</span>$line</span>"</span></span>
				line</span>=</span>$TMPLINE</span></span>
			fi</span></span>
			echo</span> "</span>	Excluding </span>$line</span>"</span></span>
			echo</span> $line</span> >></span> /tmp/exclude.</span>$$</span></span>
		done</span> <</span> $HOMEDIR</span>/.exclude</span></span>
	fi</span></span>
done</span></span>
</span>
mount</span> |</span> grep</span> /backup</span></span>
</span>
if</span> [</span> $?</span> -ne</span> 0</span> ];</span> then</span></span>
	/sbin/mount</span> /backup</span></span>
	if</span> [</span> $?</span> -ne</span> 0</span> ];</span> then</span></span>
		logger</span> -s -p</span> user.err</span> -t</span> backup</span> "</span>Backup drive could not be mounted! Bailing!</span>"</span></span>
		/sbin/umount</span> -f</span> /backup</span></span>
		exit</span> 1</span></span>
	fi</span></span>
fi</span></span>
</span>
BACKUPDIR</span>=</span>"</span>/backup/`</span>date</span> "</span>+%Y-%m-%d</span>"</span>`</span>"</span></span>
OLDDIR</span>=</span>"</span>/backup/`</span>date</span> -v-14d</span> "</span>+%Y-%m-%d</span>"</span>`</span>"</span></span>
</span>
if</span> [</span> ! -d</span> $BACKUPDIR</span> ];</span> then</span></span>
	mkdir</span> $BACKUPDIR</span></span>
fi</span></span>
</span>
if</span> [</span> $?</span> -ne</span> 0</span> ];</span> then</span></span>
	logger</span> -s -p</span> user.err</span> -t</span> backup</span> "</span>Could not create backup folder </span>$BACKUPDIR</span>. Bailing!</span>"</span></span>
	/sbin/umount</span> -f</span> /backup</span></span>
	exit</span> 1</span></span>
fi</span></span>
</span>
# We got this far, now we have to run rsync. Rsync is very verbose on purpose</span></span>
</span>
/usr/local/bin/rsync</span> -av --relative --delete</span> /usr/home/</span> $BACKUPDIR</span> --exclude-from=/tmp/exclude.</span>$$</span></span>
</span>
if</span> [</span> $?</span> -ne</span> 0</span> ];</span> then</span></span>
	logger</span> -s -p</span> user.err</span> -t</span> backup</span> "</span>rsync failed. Do not trust backup (</span>$BACKUPDIR</span>)</span>"</span></span>
	/sbin/umount</span> /backup</span></span>
	exit</span> 1</span></span>
fi</span></span>
</span>
echo</span> "</span>Backup complete! Deleting oldest backup (14 days ago)</span>"</span></span>
</span>
if</span> [</span> -d</span> $OLDDIR</span> ];</span> then</span></span>
	rm</span> -rf</span> $OLDDIR</span></span>
fi</span></span>
</span>
/sbin/umount</span> /backup</span></span>
/bin/rm</span> -f</span> /tmp/exclude.</span>$$</span></span>
</span>
logger</span> -s -p</span> user.notice</span> -t</span> backup</span> "</span>Backup complete at </span>$BACKUPDIR</span>.</span>"</span></span></code></pre>
funcptr

Change one password

Python Packaging and Distribution

Mac OS X El Capitan Installer Removes Custom Group ID and Membership

Cobbler with CentOS 7 failure to boot/kickstart

Neutron L3 agent with multiple provider networks

OpenStack resizing of instances

Build numbers in binaries using waf

Full example</h2> Check out my mdns-announce</a> project on Github for an example of how this is implemented.</p>

Tamper proof session cookies and session storage

Session storage</h2> There are a multitude of ways to store the session data, but it ultimately boils down to server-side or client-side. Server-side can be done in Cassandra, Memcache, Redis or even in a SQL database.</p>

Server-side storage</h3> The main one that has been used for years is to use server side storage. Storing a small file on the servers hard drive that contains the data, and the client is sent a cookie that contains a unique identifier that is linked to the on-disk storage.</p> For example:</p>

Easily expire sessions</h4> The upside to server-side storage is that it is possible for us to very easily expire a session, simply remove the associated file/data that is stored and the users session has now become invalid.</p>

Client-side storage</h3> The other method that has recently started being used more to make it easier to scale the server side is to store session data encoded in base64 in the cookie itself. In this case there is no unique session ID, and no data is stored server side.</p>

Building custom ports with Poudriere and Portshaker

User sessions, what data should be stored where?

Embedding ZeroMQ in the libev Event Loop

ZeroMQ - Edge Triggered Notification

IPv6 -- getaddrinfo() and bind() ordering with V6ONLY

FreeBSD 8.2 to 9.0 update with ZFS on root (mirror)

OpenSSL as a Filter (or non-blocking OpenSSL)

Converting KVM virtual machines to VirtualBox

Generating stylesheets for pygments

NAT with PF on an interface with multiple IP addresses

FreeBSD running within KVM: Serial Console

PostgreSQL setup for external connections

Setting up jails with multiple IPs and providing it with internet access

Apache mod_fastcgi and PHP with PHP-FPM

Magic Properties on Google AppEngine

Auto-updating Properties in Google AppEngine Models

Property class on AppEngine does not support a tuple for choices

Moving from mod_fastcgi to mod_fcgid

Hosting NFS shares from a Zone

Upgrading an OpenSolaris ipkg zone

Using DJB's daemontools and netcat to bounce a request around

addnumbers.asm updated

Introduction to Intel Assembly

X11 mouse button pressed

FreeBSD GEOM striping and concatenation

FastCGI quick and dirty

Backup Script

`Full example</h2> Check out my mdns-announce</a> project on Github for an example of how this is implemented.</p>`

Session storage</h2>
There are a multitude of ways to store the session data, but it ultimately boils down to server-side or client-side. Server-side can be done in Cassandra, Memcache, Redis or even in a SQL database.</p>

Easily expire sessions</h4>
The upside to server-side storage is that it is possible for us to very easily expire a session, simply remove the associated file/data that is stored and the users session has now become invalid.</p>

Client-side storage</h3>
The other method that has recently started being used more to make it easier to scale the server side is to store session data encoded in base64 in the cookie itself. In this case there is no unique session ID, and no data is stored server side.</p>
