jof @jofathan-blog - Tumblr Blog

Ruby ncursesw and OS X 10.6

I love my terminal, and consequently I enjoy using a variety of curses-based applications. Several of these are written in pure Ruby and take advantage of C bindings into the actual curses and terminfo functions needed.

Unfortunately, the "ncursesw" gem that's currently in Rubygems doesn't compile against the version of ncurses that's distributed with Mac OS X anymore. I used to run it just fine in the days of 10.4, but something has broken along the way.

In order to work around this breakage, I decided to take what's in MacPorts (which links just fine), only I didn't actually want to install MacPorts -- I'm a happy Homebrew user.

In order to use MacPorts without actually installing it, I downloaded the distribution tarball and extracted it:

curl -O 'https://distfiles.macports.org/MacPorts/MacPorts-2.0.3.tar.bz2' tar jxvf MacPorts-2.0.3.tar.bz2 cd MacPorts-2.0.3

And created a directory to act like a fake root directory:

mkdir fakeroot

Then, I used the autotools-generated "configure" script to re-point all paths into this "fakeroot" directory, and built everything:

./configure --prefix=/Users/jof/src/MacPorts-2.0.3/fakeroot make -j3 sudo make install

As of writing this creates a "macports" user and group, which I didn't much care for. So I got rid of them with:

sudo dseditgroup -o delete macports sudo dscl . -delete /Users/macports

I then setup my $PATH to reference the new "port" binary, got a working ports tree, and built a cross-arch ncurses library:

export PATH="${PWD}/fakeroot/bin:${PATH}" sudo port -v selfupdate sudo port install ncurses +universal

Now that's taken care of, I tried to build the ncursesw gem with an option to prepend optional paths passed to extconf.rb in the gem:

gem install ncursesw -- --with-opt-dir=/Users/jof/src/mp2/MacPorts-2.0.3/fakeroot

Finally, working Ncurses!

Making Sharp Aquos TV's Function as Advertised

Sharp sells some TVs with the "Aquos" brand that have some neat embedded media features. One of the advertised features is a "web browser" -- only it's locked down to only display approved widgets. Ugh.

I found a way to liberate it from its walled garden by hijacking its requests to the server that serves the widgets and serving back other things. Since it lets you add bookmarks for URLs (but wont let you edit the URL content), it's possible to bookmark something like Google and just search for the URL or sites you want to browse to.

Here's how I convinced it to bookmark "http://google.com".

Redirect traffic to my laptop

Step one in this cunning plan is to re-direct HTTP requests from the television to go to my laptop. In order to support it still reaching the internet, I enabled IP routing on my linux machine with

sysctl -w net.ipv4.conf.all.forwarding=1

and then masqueraded all IP traffic going out with

iptables -t nat -A POSTROUTING -o [OUTGOING INTERFACE] -j MASQUERADE"

Then, I started up arpspoof with

arpspoof -i [INTERFACE] -t [TV IP] [GATEWAY]

to fake out the TV into routing traffic through my laptop instead of its normal default gateway.

I then added an iptables rule to redirect DNS traffic to my computer with

iptables -t nat -A PREROUTING -d [REAL DNS SERVER IP] -p udp --dport 53 -j DNAT --to-destination [MY IP]

and

iptables -t nat -A PREROUTING -d [MY IP] -p udp --dport 53 -j REDIRECT --to-ports 5353"

Start dnsmasq to futz with DNS

I then started dnsmasq as an easy-to-start DNS server that could be used to send fake responses to DNS requests so that connections to "www.aquos.net" could be resolved to my IP.

I invoked it with:

dnsmasq --listen-address=[MY IP] --address=/www.aquos.net/[MY IP] --no-daemon --log-queries --port=5353"

Start a simple web server

Next, I created a temporary directory and started a simple HTTP server to serve it:

mkdir -p ~/tmp/foo && \ cd ~/tmp/foo && \ python -mSimpleHTTPServer

I then created a simple HTML file in there that had a single anchor tag pointing to "http://google.com"

Start stunnel

As the TV access their site with HTTPS, I had to create a fake certificate:

openssl genrsa -des3 -out server.key 4096 openssl req -new -key server.key -out server.csr openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt openssl rsa -in server.key -out server.key.insecure mv server.key server.key.secure mv server.key.insecure server.key

And started up stunnel:

stunnel -p server.pem -d [MY IP]:4343 -r 127.0.0.1:8000 -f -P ''

Add HTTP and HTTPS redirect rules

I needed some iptables rules to redirect TCP/80 and TCP/443 to my servers started on un-privileged ports. So I:

iptables -t nat -A PREROUTING -d [MY IP] -p tcp --dport 80 -j REDIRECT --to-ports 8000 iptables -t nat -A PREROUTING -d [MY IP] -p tcp --dport 443 -j REDIRECT --to-ports 4343

Profit

Then, I fired up the browser and was immediately presented with a file index of my directory! Hurrah! I clicked on the link to Google, bookmarked the page, and then used the TV browser in the manner that Vint intended.

#sharp #arpspoof #iptables #linux #stunnel

Why Do Routers Become Old So Quickly?

One thing I’ve noticed while doing work as a network engineer is that routers (both CPU and hardware-based) seem to have relatively old CPUs compared to the latest hardware on the market.

I suspect that product lines aren't refreshed with new CPUs very often since swapping out a core component like a CPU can potentially require a lot of hardware rework, new boards, QA and testing, etc. I think this is really unfortunate though that router vendors are using custom motherboards and proprietary interconnections, since it means that making changes becomes difficult.

I feel like this mentality of design-once, overhaul later leaves a real gap in the market for those with modest (20k - 200k PPS, FastE/GigE) routing requirements that want very flexible routing policies.

Personally, I often find CPU-based routers much more appropriate for most routing applications compared to more-expensive hardware ASIC devices. The obvious drawback is increased forwarding latency, and a more-easily DOSed platform. This could be mitigated by using ECMP routing across a larger horizontal plane of cheaper routers. Having more makes overwhelming them more difficult, and using smarter routing policies negates the hit of increased latency. By measuring your latency to a variety of endpoints over a multitude of transits and peers, its possible to shave off a few milliseconds by smartly choosing your next-hops. I think that if someone can make some optimized CPU-based routers based on commodity hardware, they'll find a nice niche for small to medium networks that want to work more smartly rather than just using a bigger hammer.

Facebook IPs

I read with some interest that Facebook has been tagging callback emails that they're sending out to their users with the IP of the end user that originated the action that caused that email to be generated.

I find it odd that they decided to store the IP address in Base64 encoding in the email headers. If they're going to hide it, why not actually hide it, instead of just obfuscating it?

I decided to go back in time and search through old email headers to see what ISPs my friends on Facebook use. Interesting results for some (those nerdy enough to set cute rDNS names), but mostly no surprises.

For those of you out there that use sup for your email, here's a little Ruby snippet to find out where those mails came from:

#!/usr/bin/env ruby require 'rubygems' require 'sup' require 'base64' include Redwood start Index.init Index.load msgs = [] q = Index.parse_query("from:facebook") Index.each_id(q) do |id| m = Index.build_message(id) msgs << m end msgs.each do |m| parts = m.raw_header.match(/zuckmail $\[(.*)\]$/) ip = Base64.decode64(parts[1]) rdns = `dig +short -x #{ip}`.strip ss = m.subj.split(/\s+/)[0..2].join(" ") puts "subject: #{ss} -- ip: #{ip} -- hostname: #{rdns}" end

Exuberant ctags rocks

Exuberant ctags is rocking my world at the moment. Here's how I'm keeping track of puppet and nagios configurations:

--langdef=puppet --langmap=puppet:.pp --regex-puppet=/^class[ \t]*([:a-zA-Z0-9_\-]+)[ \t]*/\1/d,definition/ --regex-puppet=/^site[ \t]*([a-zA-Z0-9_\-]+)[ \t]*/\1/d,definition/ --regex-puppet=/^node[ \t]*([a-zA-Z0-9_\-]+)[ \t]*/\1/d,definition/ --regex-puppet=/^define[ \t]*([:a-zA-Z0-9_\-]+)[ \t]*/\1/d,definition/ --langdef=nagios --langmap=nagios:.cfg --regex-nagios=/host_name\s+([^ ]+)/\1/h,hostname/ --regex-nagios=/service_description\s+([^ ]+)/\1/s,service/ --regex-nagios=/timeperiod_name\s+([^ ]+)/\1/t,timeperiod/ --regex-nagios=/command_name\s+([^ ]+)/\1/c,command/ --regex-nagios=/contact_name\s+([^ ]+)/\1/x,contact/ --regex-nagios=/servicegroup_name\s+([^ ]+)/\1/g,servicegroup/ --regex-nagios=/hostgroup_name\s+([^ ]+)/\1/H,hostgroup/ --regex-nagios=/name\s+([^ ]+)/\1/n,name/ --regex-nagios=/alias\s+([^ ]+)/\1/a,alias/

Spam Complaints

At my dayjob at an ISP, I keep my name and work email address listed with ARIN's WHOIS database for our IP address space. Occasionally, someone who knows what they're doing will give me a call or drop an email letting me know about some hooligan on a subnet at work, but for the most part, this address gets harvested for spam.

Then there's this guy:

From: Chatanova <[email protected]> To: Jonathan Lassoff <[email protected]> CC: abuse <[email protected]>, Support <[email protected]>, sales <[email protected]>, help <[email protected]> Date: Fri, 17 Jul 2009 23:44:10 -0700 Subject: Fw: sridhar gowda wants to share approved contacts

Spam Report against your fucking activity in internet You are spamming our 12 email addresses since a year We are going to take a legal and or illegal action against your terrorism activity in internet

----- Original Message -----

...original message follows...

:) I envision this poor guy scouring my employer's website looking for email addresses to contact. Certainly, some of these were not in WHOIS, though they were easy to guess. I seriously don't get people who sit down and hand-write spam complaints for each and every message they get -- their wrists must cramp like crazy!

This is one of the reasons I find quixotic programs like this to keep accurate, direct-to-human type contacts in the WHOIS leaving users like myself with a bit of a dilemma.

Trying out Tumblr

I thought the idea of a simple linkblog or similar might make it a little easier to write more often.

Next, I'm going to see how I can embed or redirect a subdomain or URL under my domain to here.

Trending Blogs

Recently Viewed Blogs

jof