Pietro Bertera's Blog

Kubernetes semaphore Validating Webhook

2020-09-24T20:25:00+02:00

After more than 2 years a new post!

In the path of learning Kubernetes Dynamic Admission Control I wrote a small webhook to be used as a semaphore to deny certains operations on k8s objects with a specific label.

k8s-semaphore is a quick and dirty web.py app implementing the webhook, can be deployed on any Kubernetes cluster.

Here is a self-explaining usage of the admission controller:

$ cat << EOF | oc apply -f -
apiVersion: v1
kind: Pod
metadata:
  annotations:
    bertera.it/k8s-semaphore: red
  name: k8s-semaphore-test
spec:
  containers:
  - name: test
    image: alpine
    # Just spin & wait forever
    command: [ "/bin/bash", "-c", "--" ]
    args: [ "while true; do sleep 30; done;" ]
EOF

$ oc get pod test
NAME     READY   STATUS    RESTARTS   AGE
test     1/1     Running   0          29m

$ oc delete test
Error from server: admission webhook "k8s-semaphore.k8s-semaphore.svc" denied the request: Resource test (kind: Pod, version: v1, group: ) is annotated with bertera.it/k8s-semaphore, cannot be removed

$ oc annotate pod test bertera.it/k8s-semaphore-
pod/test annotated

$ oc delete pod test
pod "test" deleted

The label name and value can be modified via the environemt variables SEMAPHORE_ANNOTATION and SEMAPHORE_RED. Depending on the definition of the ValidatingWebhookConfiguration the admission controller can be applied to any Kubernetes resource and verbs.

Look at the manifest.yaml for an example deployment and ValidatingWebhookConfiguration.

Hint: OpenShift Webhook Certificate Manager can help deploying the Webhook certificate on OpenShift.

Introducing dcw: a Poor Man PaaS tool

2017-03-28T22:25:00+02:00

Dcw (Docker Compose Wrapper) is very small and dirty Bash script wrapping the docker-compose command. The meaning of such wrapper is to expose some docker-compose operations and a set of well defined commands on the host machine.

The typical use-case is an SSH command executed via the ~/.ssh/authorized_keys file, in this way you can provide provide some docker-compose commands that can be execute with some specific docker-compose config files.

The containers pool

A pool is defined via a docker-compose YAML config file. The name of the config file defines the pool name.

All the YAML config files must reside into the folder defined via the dc_confd variable.

Once you created the config file you are ready to use dcw as an SSH command.

Usage

First of all you have to clone the git repo:

$ cd /opt
$ git clone https://github.com/pbertera/dcw

The git repository contains a ready to use docker-compose config file named nginx.yaml.

This file defines a pool of 3 NGINX containers, each container exposes an HTTP and HTTPS port and defines some data volumes, please refer to the docker-compose documentation for the file syntax.

The nginx.yaml defines also a label named management.command.shell with value docker exec -it nginx1 /bin/bash.

Configuring dcw is quite simple: you have to properly configure the following variables:

dc_confd: the directory conatining all the docker-compose YAML files (in this case /opt/dcw)
dc_denied_commands: (optional) a regex defining all the not allowed docker-compose, default ^kill|^rm
In case you want to have the Slack or HipChat integration all the other needed vars.

Now you are ready to use dcw into the ~/.ssh/authorized_keys file: edit the authorized_keys in order to use the dcw script as an SSH command associated with an SSH public key:

command="/opt/dcw/dcw",no-port-forwarding,no-agent-forwarding,no-X11-forwarding ssh-rsa AAAAB3NzaC1 [..] == pietro@hank

At this point everything should be ready and you can start using the tool: connect to the remote host using the proper SSH key and user:

$ ssh pietro.bertera@server help
INFO: SSH Original command: help
Usage:

ssh user@remote-host <pool|command> <args>

Examples:

Run the docker-compose ps over the ldap service pool:
    ssh user@remote-host pool ldap ps

Start the service ldap1 from the ldap pool:
    ssh user@remote-host pool ldap start ldap1

Execute the command defined into the label 'management.command' of the ldap1 container:
    ssh user@remote-host command ldap1 shell

List all the available commands into the container ldap1:
    ssh user@remote-host command ldap1 help

List all the containers in the nginx pool:

$ ssh pietro.bertera@server pool nginx ps
INFO: SSH Original command: pool nginx ps
INFO: executing docker-compose ps on nginx
 Name               Command                State                         Ports                     
--------------------------------------------------------------------------------------------------
nginx1   /entrypoint.sh nginx -g da ...   Exit 137   0.0.0.0:10081->443/tcp, 0.0.0.0:10080->80/tcp 
nginx2   /entrypoint.sh nginx -g da ...   Exit 137   0.0.0.0:10083->443/tcp, 0.0.0.0:10082->80/tcp 
nginx3   /entrypoint.sh nginx -g da ...   Exit 137   0.0.0.0:10085->443/tcp, 0.0.0.0:10084->80/tcp 
nginx4   /entrypoint.sh nginx -g da ...   Exit 137   0.0.0.0:10087->443/tcp, 0.0.0.0:10086->80/tcp

Start the container nginx1:

$ ssh pietro.bertera@server pool nginx up -d nginx1
INFO: SSH Original command: pool nginx up -d nginx1
INFO: executing docker-compose up -d nginx1 on nginx
Creating network "nginx_default" with the default driver
Creating nginx1

Execute the command defined by the management.command.shell Docker label executing the command docker exec -it nginx1 /bin/bash on the host, in this case the -t SSH option is needed in order to allocate a pseudo terminal:

$ ssh -t pietro.bertera@server command nginx1 shell
INFO: SSH Original command: command nginx1 shell
INFO: executing command from label management.command.shell into container nginx1
root@23047d54e97b:/#

If you configured also the Slack or HipChat integration all the command will be logged on Slack or HipChat too.

Security

This tool doesn't provide any security feature, so should be used only to provide a simplified way to start/stop containers and execute commands to trusted users only.

For any suggestion, improvement or idea feel free to contact me.

A DNS server with Batteries Included with PowerDNS, Docker and Python

2016-09-06T03:25:00+02:00

If you have to frequently create, destroy and re-configure DNS zones for testing purposes you will agree that manually editing a Bind zone file is an annoying and error-prone task.

In order to make this job simpler I worked on this Docker container: the container instantiate a PowerDNS and provides an easy-to-use CLI script interacting with the REST API.

How to use:

Inspired by the illuminating @jessfraz post about containerizing everything, I added to my .dockerfunc some helper functions:

pdns() {
    local name=pdns
    if is_running $name; then
        bailout "Container $name is already running"
        return
    fi

    del_stopped $name

    docker run -it --name $name -e API_KEY=MySecretKey -e WEB_PORT=8081 -v ${PDNS_DB}:/data/pdns.db -p 8081:8081 -p 53:53 -p 53:53/udp pbertera/${name}
}

pdns.py(){
    relies_on pdns
    docker exec -it pdns pdns.py "$@"
}

NOTE: for the first run you will need to create an empty database file: touch ${PDNS_DB}

Then I can start the container:

hank-2:~ pietro$ pdns
pdns
Error: near line 3: table domains already exists
Error: near line 13: index name_index already exists
Error: near line 16: table records already exists
Error: near line 31: index rec_name_index already exists
Error: near line 32: index nametype_index already exists
Error: near line 33: index domain_id already exists
Error: near line 34: index orderindex already exists
Error: near line 37: table supermasters already exists
Error: near line 43: index ip_nameserver_pk already exists
Error: near line 46: table comments already exists
Error: near line 57: index comments_domain_id_index already exists
Error: near line 58: index comments_nametype_index already exists
Error: near line 59: index comments_order_idx already exists
Error: near line 62: table domainmetadata already exists
Error: near line 70: index domainmetaidindex already exists
Error: near line 73: table cryptokeys already exists
Error: near line 82: index domainidindex already exists
Error: near line 85: table tsigkeys already exists
Error: near line 92: index namealgoindex already exists
Imported schema structure
Sep 06 01:24:36 Reading random entropy from '/dev/urandom'
Sep 06 01:24:36 Loading '/usr/lib/x86_64-linux-gnu/pdns/libgsqlite3backend.so'
Sep 06 01:24:36 This is a standalone pdns
Sep 06 01:24:36 Listening on controlsocket in '/var/run/pdns.controlsocket'
Sep 06 01:24:36 UDP server bound to 0.0.0.0:53
Sep 06 01:24:36 Unable to enable timestamp reporting for socket
Sep 06 01:24:36 UDPv6 server bound to [::]:53
Sep 06 01:24:36 TCP server bound to 0.0.0.0:53
Sep 06 01:24:36 TCPv6 server bound to [::]:53
Sep 06 01:24:36 PowerDNS Authoritative Server 4.0.0-alpha2 (C) 2001-2016 PowerDNS.COM BV
Sep 06 01:24:36 Using 64-bits mode. Built using gcc 5.3.1 20160330.
Sep 06 01:24:36 PowerDNS comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it according to the terms of the GPL version 2.
Sep 06 01:24:36 Listening for HTTP requests on 0.0.0.0:8081
Sep 06 01:24:36 Creating backend connection for TCP
Sep 06 01:24:36 About to create 3 backend threads for UDP
Sep 06 01:24:36 Done launching threads, ready to distribute questions

Now PowerDNS is running and listening on the port 8081 for the REST API and the port 53 UDP and TCP for the DNS queries, the database is permanently stored into the SQLite DB file ${PDNS_DB}.

Using the command pdns.py you can manage the zones:

Creating a zone:

hank-2:~ pietro$ pdns.py --zone example.com. --zoneType MASTER --nameserver ns.example.com.  add_zone
2016-09-06 01:57:09,938 pdns         INFO     DNS Zone 'example.com.' Successfully Added...
hank-2:~ pietro$ pdns.py --zone example.com. --recordType A --name ns.example.com. --content 172.16.18.15 add_record
2016-09-06 01:58:04,316 pdns         INFO     DNS Record 'ns.example.com.' Successfully Added/Updated

Digging the zone:

hank-2:~ pietro$ dig @localhost example.com NS

; <<>> DiG 9.8.3-P1 <<>> @localhost example.com NS
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57709
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;example.com.           IN  NS

;; ANSWER SECTION:
example.com.        3600    IN  NS  ns.example.com.

;; Query time: 16 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Tue Sep  6 03:59:18 2016
;; MSG SIZE  rcvd: 46

hank-2:~ pietro$ dig @localhost ns.example.com 

; <<>> DiG 9.8.3-P1 <<>> @localhost ns.example.com
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49682
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;ns.example.com.            IN  A

;; ANSWER SECTION:
ns.example.com.     3600    IN  A   172.16.18.15

;; Query time: 13 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Tue Sep  6 03:59:58 2016
;; MSG SIZE  rcvd: 48

Credits

All the credits to Larry Smith Jr. for the original pdns.py script and Renan Gonçalves for the original PowerDNS+MySQL Docker container

How to simulate a slow HTTP server with a Dockerized lighttpd

2016-08-30T00:00:00+02:00

Today I had to work on an issue related to troubled HTTP connections. So in order to reproduce such issue I had to find a way to easily reduce the bandwidth of the HTTP transfer.

After a quick Google search I landed on this Stackoverflow answer which suggested me the idea to create a simple Docker container for that.

The container image is automatically build on Dockerhub from the Dockerfile.

The container can be easily used to serve a local folder or as a proxy in front of another HTTP server.

How this website works

2016-06-29T20:25:00+02:00

After many years on Wordpress I decided to move my website to a static website.

I decided to adopt Pelican: a static website builder based on python and supporting reStructuredText, Markdown, or AsciiDoc.

Moreover I decided to use GitHub pages to host the website.

The pdf plugin comes from Cyrille Rossant.

Docker

In order to maintain a clean approach I use a self-contained Docker container for managing the whole authoring and publishing / deploying workflow: the Dockerfile defines a container based on the python:3 image plus all the needed packages and the Flex theme.

The Docker image is automatically build on Docker hub

The manage script

The manage.sh is a wrapper around the docker run command the script accepts all the valid Makefile target plus the deploy, build and update. The first argument will deploy the website into the gh-pages branch, the second one creates the Docker image. The update argument is the same of make html && make serve inside of the container

Overwriting Latex image positioning in pandoc generated pdf

2015-04-14T20:25:00+02:00

Pandoc is a very powerful tool, I'm extensively using it for writing documentation, papers and so on.
You can generate pdf, html, docx and many other formats trough a compilation of markdown source file.

Often I use it to produce nice PDF documents, in this process your Markdown document is parsed and rendered using a Latex template, you can obtain the default template using the command:

pandoc -D latex

Unfortunately all images with a caption tet are rendered in Latex using the htbp floating positioning, this is hardcoded in pandoc.

Markdown code:
![I/O connector](img/1.jpg)

Latex code:

\begin{figure}[htbp]
\centering
\includegraphics{img/1.jpg}
\caption{I/O connector}
\end{figure}

Sometimes the [htbp] positioning doesn't fits my needs and I prefer to use the fixed [H] positioning.
Over the web you can find a lot of solutions suggesting to compile your Markdown in a Latex file, parse the file with sed and then use pdflatex to generate the PDF.

Now, I found a way to overwrite the Latex {figure} environment directly into the Latex template:

% Overwrite \begin{figure}[htbp] with \begin{figure}[H]
\usepackage{float}
\let\origfigure=\figure
\let\endorigfigure=\endfigure
\renewenvironment{figure}[1][]{%
   \origfigure[H]
}{%
   \endorigfigure
}

A server launcher with log console in Python Tkinter

2015-03-13T15:12:00+01:00

I'm working on an Tk application that should start and stop an UDP server, I need to show server logs in the Tk GUI with a "Pause & Resume" button.

I already have the UDP server implemented using the blocking SocketServer.BaseRequestHandler , so in order to wrap a GUI to the server I need to run the server in a separate Thread.

My server already logs all messages using the Python logging module, this StackExchange snipped shows a good example of how to write on a Text widget from the logging Python module.

Soon I found that Python Tkinter and multithreading is a frequent cause of headache.

The secret for avoiding a big waste of debugging hours is to keep away from all the graphical things child threads. In brief a child thread cannot interact with Tk, otherwise your application is at risk of deadlock or race conditions.

So I found the solution to write from the logging handler in a Python Queue, the Tk widget will read and display the Queue contents using a recursive after callback.

Here the code:

# Copyright 2015 Pietro Bertera \<pietro@bertera.it\>  
#  
# This program is free software: you can redistribute it and/or modify  
# it under the terms of the GNU General Public License as published by  
# the Free Software Foundation, either version 3 of the License, or  
# (at your option) any later version.  
#  
# This program is distributed in the hope that it will be useful,  
# but WITHOUT ANY WARRANTY; without even the implied warranty of  
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the  
# GNU General Public License for more details.  
#  
# You should have received a copy of the GNU General Public License  
# along with this program. If not, see http://www.gnu.org/licenses/

import Queue
import SocketServer
import socket
import sys
import logging
import threading
import Tkinter as tk
from ScrolledText import ScrolledText

class QueueLogger(logging.Handler):
    def __init__(self, queue):
        logging.Handler.__init__(self)
        self.queue = queue

    # write in the queue
    def emit(self, record):
        self.queue.put(self.format(record).rstrip('\n') + '\n')

class LoggedUDPServer(SocketServer.ThreadingMixIn, SocketServer.UDPServer):
    def __init__(self, server_address, RequestHandlerClass, logger):
        SocketServer.UDPServer.__init__(self, server_address, RequestHandlerClass)
        # Add the queue logger
        self.logger = logger

class UDPHandler(SocketServer.BaseRequestHandler):
    def handle(self):
        # Queue logger is un under the self.server object
        self.server.logger.debug(self.request[0])

class MainApplication:
    def __init__(self, root, log_level, ip, port ):
        self.root = root
        self.log_level = log_level
        self.ip = ip
        self.port = port
        self.root.columnconfigure(0, weight=1)
        self.root.rowconfigure(0, weight=1)

        # 2 rows: firts with settings, second with registrar data
        self.main_frame = tk.Frame(self.root)
        # Commands row doesn't expands
        self.main_frame.rowconfigure(0, weight=0)
        # Logs row will grow
        self.main_frame.rowconfigure(1, weight=1)
        # Main fram can enlarge
        self.main_frame.columnconfigure(0, weight=1)
        self.main_frame.columnconfigure(1, weight=1)
        self.main_frame.grid(row=0, column=0, sticky=tk.NSEW)

        # Run/Stop button
        self.control_button = tk.Button(self.main_frame, text="Run Server", command=self.run_server)
        self.control_button.grid(row=0, column=0, sticky=tk.N)

        # Clear button
        self.clear_button = tk.Button(self.main_frame, text="Clear Log", command=self.clear_log)
        self.clear_button.grid(row=0, column=1, sticky=tk.N)

        # Stop log button
        self.control_log_button = tk.Button(self.main_frame, text="Pause Log", command=self.stop_log)
        self.control_log_button.grid(row=0, column=2, sticky=tk.N)

        # Logs Widget
        self.log_widget = ScrolledText(self.main_frame)
        self.log_widget.grid(row=1, column=0, columnspan=3, sticky=tk.NSEW)

        # Not editable
        self.log_widget.config(state='disabled')

        # Queue where the logging handler will write
        self.log_queue = Queue.Queue()

        # Stup the logger
        l = logging.getLogger('logger')
        l.setLevel(self.log_level)
        formatter = logging.Formatter('%(asctime)s %(levelname)s %(message)s')
        # Use the QueueLogger as Handler
        hl = QueueLogger(queue=self.log_queue)
        hl.setFormatter(formatter)
        l.addHandler(hl)
        self.logger = logging.getLogger('logger')

        # Setup the update_widget callback reading logs from the queue
        self.start_log()

    def stop_log(self):
        self.logger.debug("Pausing the logger")
        if self.logger_alarm is not None:
            self.log_widget.after_cancel(self.logger_alarm)
            self.control_log_button.configure(text="Start Log", command=self.start_log)
            self.logger_alarm = None

    def start_log(self):
        self.logger.debug("Starting the logger")
        self.update_widget(self.log_widget, self.log_queue)
        self.control_log_button.configure(text="Pause Log", command=self.stop_log)

    def update_widget(self, widget, queue):
        widget.config(state='normal')
        # Read from the Queue and add to the log widger
        while not queue.empty():
            line = queue.get()
            widget.insert(tk.END, line)
            widget.see(tk.END)  # Scroll to the bottom
            widget.update_idletasks()
        widget.config(state='disabled')
        self.logger_alarm = widget.after(10, self.update_widget, widget, queue)

    def clear_log(self):
        self.log_widget.config(state='normal')
        self.log_widget.delete(0.0, tk.END)
        self.log_widget.config(state='disabled')

    def run_server(self):
        self.logger.debug("Starting thread")
        try:
            self.server = LoggedUDPServer((self.ip, self.port), UDPHandler, self.logger)
            self.server_thread = threading.Thread(name='server', target=self.server.serve_forever)
            self.server_thread.daemon = True
            self.server_thread.start()
            self.control_button.configure(text="Stop Server", command=self.stop_server)
        except Exception, e:
            self.logger.error("Cannot start the server: %s" % e)
            raise e

    def stop_server(self):
        self.logger.debug("Stopping server")
        self.server.shutdown()
        self.server.socket.close()
        self.logger.debug("Server stopped")
        self.control_button.configure(text="Run Server", command=self.run_server)

if __name__ == "__main__":
    root = tk.Tk()
    if len(sys.argv) == 3:
        port = int(sys.argv[2])
        address = sys.argv[1]

        app = MainApplication(root, logging.DEBUG, address, port)
        root.title(sys.argv[0])
        root.mainloop()
    else:
        print "Error: you must specify address and port.."
        sys.exit(-1)

Here a screenshot of the UDP server in action:

Changes on the Italian "Golden Tree"

2015-03-02T21:03:00+01:00

This is a continuation of my previous post about the +39 ENUM DNS zone.

Thanks to the powerful of the RIPE Database you can see all historical changes on a RIPE-assigned domain. Lets see what happen on the domain 9.3.e164.arpa.

List all changes on the domain object:

~ pietro$ whois -h whois.ripe.net -- "--list-versions 9.3.e164.arpa"  
% This is the RIPE Database query service.  
% The objects are in RPSL format.  
%  
% The RIPE Database is subject to Terms and Conditions.  
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Version history for DOMAIN object "9.3.e164.arpa"  
% You can use "--show-version rev\#" to get an exact version of the
object.

rev\# Date Op.

1 2005-11-02 15:21 ADD/UPD  
2 2006-02-10 11:41 ADD/UPD  
3 2006-04-07 17:56 ADD/UPD  
4 2006-04-07 18:00 ADD/UPD

% This query was served by the RIPE Database Query Service version 1.78 (DB-4)

So, the domain was changed 4 times:

Version N°1: 2005-11-02
Version N°2: 2006-02-10
Version N°3 and 4: 2006-04-07

The object in the first version:

~ pietro$ whois -h whois.ripe.net -- "--show-version 1 9.3.e164.arpa"  
% This is the RIPE Database query service.  
% The objects are in RPSL format.  
%  
% The RIPE Database is subject to Terms and Conditions.  
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Version 1 of object "9.3.e164.arpa"  
% This version was a UPDATE operation on 2005-11-02 15:21  
% You can use "--list-versions" to get a list of versions for an
object.

domain: 9.3.e164.arpa  
descr: Italy ENUM Mapping  
descr: Italy ENUM Registry  
admin-c: LF1894-RIPE  
tech-c: GT2177-RIPE  
zone-c: GT2177-RIPE  
nserver: dns.voipex.it  
nserver: dns2.voipex.it  
remarks: Ministero delle Comunicazioni - http://www.comunicazioni.it  
remarks: Istituto Superiore delle Comunicazioni  
remarks: e delle tecnologie dell'Informazione -  
remarks: http://www.iscom.gov.it  
remarks: Consorzio VOIPEX - http://www.voipex.it  
mnt-by: MNT-VOIPEX  
source: RIPE \# Filtered

% This query was served by the RIPE Database Query Service version 1.78 (DB-2)

Ok, the first version was the assignment to the Voipex consortium, see the request.

Here the second version of the object (updated at 2006-02-10 11:41):

~ pietro$ whois -h whois.ripe.net -- "--show-version 2 9.3.e164.arpa"  
% This is the RIPE Database query service.  
% The objects are in RPSL format.  
%  
% The RIPE Database is subject to Terms and Conditions.  
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Version 2 of object "9.3.e164.arpa"  
% This version was a UPDATE operation on 2006-02-10 11:41  
% You can use "--list-versions" to get a list of versions for an
object.

domain: 9.3.e164.arpa  
descr: Italy ENUM Mapping  
descr: Italy ENUM Registry  
admin-c: LF1894-RIPE  
tech-c: LF1894-RIPE  
zone-c: LF1894-RIPE  
nserver: dns.voipex.it  
nserver: dns2.voipex.it  
remarks: Ministero delle Comunicazioni - http://www.comunicazioni.it  
remarks: Istituto Superiore delle Comunicazioni e delle tecnologie
dell'Informazione  
remarks: http://www.iscom.gov.it  
mnt-by: ISCOM-MNT  
source: RIPE \# Filtered

% This query was served by the RIPE Database Query Service version 1.78 (DB-3)

In this second version the domain is now delegated to ISCOM (Istituto Superiore delle Comunicazioni e delle tecnologie dell'Informazione). Nameservers were still on Voipex.

Below the differences between version 2 and version 3: Namserver moved from Voipex to istsupcti.it

~ pietro$ whois -h whois.ripe.net -- "--diff-versions 2:3
9.3.e164.arpa"  
% This is the RIPE Database query service.  
% The objects are in RPSL format.  
%  
% The RIPE Database is subject to Terms and Conditions.  
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Difference between version 2 and 3 of object "9.3.e164.arpa"

@@ -6,4 +6,4 @@  
zone-c: LF1894-RIPE  
-nserver: dns.voipex.it  
-nserver: dns2.voipex.it  
+nserver: dns.istsupcti.it  
+nserver: dns2.istsupcti.it  
remarks: Ministero delle Comunicazioni - http://www.comunicazioni.it

% This query was served by the RIPE Database Query Service version 1.78 (DB-2)

There isn't differences between revisions 3 and 4:

~ pietro$ whois -h whois.ripe.net -- "--diff-versions 3:4
9.3.e164.arpa"  
% This is the RIPE Database query service.  
% The objects are in RPSL format.  
%  
% The RIPE Database is subject to Terms and Conditions.  
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Difference between version 3 and 4 of object "9.3.e164.arpa"

% This query was served by the RIPE Database Query Service version 1.78 (DB-2)

The Vatican long hand

WTF? Vatican ? Yes this is quite interesting: seems that someone at Vatican city has something to do with the Italian golden tree:

~ pietro$ whois -h whois.ripe.net -- "-B 9.3.e164.arpa"  
% This is the RIPE Database query service.  
% The objects are in RPSL format.  
%  
% The RIPE Database is subject to Terms and Conditions.  
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Information related to '9.3.e164.arpa'

domain: 9.3.e164.arpa  
descr: Italy ENUM Mapping  
descr: Italy ENUM Registry  
admin-c: LF1894-RIPE  
tech-c: LF1894-RIPE  
zone-c: LF1894-RIPE  
nserver: dns.istsupcti.it  
nserver: dns2.istsupcti.it  
remarks: Ministero delle Comunicazioni - http://www.comunicazioni.it  
remarks: Istituto Superiore delle Comunicazioni e delle tecnologie
dell'Informazione  
remarks: http://www.iscom.gov.it  
notify: pasquini@vatican.va  
mnt-by: ISCOM-MNT  
changed: pasquini@vatican.va 20060407  
source: RIPE

person: Luisa Franchina  
address: Viale America 201  
address: I-00144 Roma  
address: Italy  
phone: +39 06 54444267  
fax-no: +39 06 54444222  
e-mail: luisa.franchina@comunicazioni.it  
nic-hdl: LF1894-RIPE  
remarks: Ministero delle Comunicazioni  
remarks: Direttore Generale Istituto Superiore Comunicazioni  
notify: pasquini@vatican.va  
mnt-by: ISCOM-MNT  
changed: pasquini@vatican.va 20051031  
source: RIPE

% This query was served by the RIPE Database Query Service version 1.78 (DB-1)

Ok, maybe the reason can be that Vatican City actually shares the Italian country code (+39) despite the fact that ITU-T allocated a dedicated Vatican City one (+379).

Just for the records: I sent an email to Pasquini@Vatican and Franchina of Communication Ministry.

At the moment of writing still no answers on my previous email...

[EDIT:] Today (6 March 2015) I received the permanent delivery failure from my SMTP: comunicazioni.it doesn't has a working email system and my email to the responsible person for the 9.3.e164.arpa cannot be delivered. Still no answers on my other email.

... To be continued ...

What happened to the +39 (Italy) ENUM DNS Zone ?

2015-02-25T16:38:00+01:00

ENUM is a DNS based algorithm used to store data associated with E.164 numbers (aka global phone numbers). Using ENUM you can associate your email or Skype or SIP contact along with your phone number.

So, registering your contacts in the ENUM tree you'll make yourself reachable trough all the ways you published on the ENUM database: someone needing to contact you will do an ENUM query against your E.164 phone number, the server will answer with all your contacts (email, SIP URI, Web URL, Instant message, presence service, etc..).

ENUM implements a global, multiservice addressbook.

How ENUM works?

As first you need to translate the phone number in the E.164 format (for example +39 338 1234567 for the Italian mobile number 338 1234567)
The E.164 number should reduced to numbers only (393381234567)
All digits should reordered front-back (765432183393)
Insert a dot between each digit (7.6.5.4.3.2.1.8.3.3.9.3)
Add the suffix ".e164.arpa" at the end (7.6.5.4.3.2.1.8.3.3.9.3.e164.arpa)
Send a DNS request for the obtained domain and look at the NAPTR record

ENUM is globally managed trough a DNS hierarchy: RFC6116 states:

   Names within this zone are to be delegated to parties consistent with
   ITU Recommendation E.164.  The names allocated should be hierarchic
   in accordance with ITU Recommendation E.164, and the codes should be
   assigned in accordance with that Recommendation.

This means that for example the +49 E.164 country code (Germany) is managed by the German naming authority:

~ pietro$ dig +short NS 9.4.e164.arpa  
enum3.denic.de.  
enum1.denic.de.  
enum2.denic.de.

A working example is the number +43 780 00471:

~ pietro$ dig +short 1.1.7.4.0.0.0.8.7.3.4.e164.arpa NAPTR  
100 10 "u" "E2U+web:http" "!\^.\*\$!http://q.nemox.net/!" .  
100 10 "u" "E2U+email:mailto" "!\^.\*\$!mailto:info@nemox.net!" .  
100 10 "u" "E2U+sip" "!\^.\*\$!sip:enum-test@sip.nemox.net!" .

The 9.3.e164.arpa zone

The DNS manging the +39 country code seems not working:

~ pietro$ dig +short 9.3.e164.arpa ANY  
;; connection timed out; no servers could be reached

Searching the nameserver managing this zone:

~ pietro$ dig +short e164.arpa NS  
sec1.apnic.net.  
tinnie.arin.net.  
pri.authdns.ripe.net.  
sec3.apnic.net.  
ns3.nic.fr.  
sns-pb.isc.org.

~ pietro$ dig @ns3.nic.fr 9.3.e164.arpa NS

; <<>> DiG 9.8.3-P1 <<>> @ns3.nic.fr 9.3.e164.arpa NS  
; (1 server found)  
;; global options: +cmd  
;; Got answer:  
;; ->>HEADER<;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 2,
ADDITIONAL: 0  
;; WARNING: recursion requested but not available

;; QUESTION SECTION:  
;9.3.e164.arpa. IN NS

;; AUTHORITY SECTION:  
9.3.e164.arpa. 172800 IN NS dns2.istsupcti.it.  
9.3.e164.arpa. 172800 IN NS dns.istsupcti.it.

The 9.3.e164.arpa is delegated to dns2.istsupcti.it and dns.istsupcti.it, no one of them seems working:

~ pietro$ dig @dns2.istsupcti.it ANY

; <<>> DiG 9.8.3-P1 <<>> @dns2.istsupcti.it ANY  
; (1 server found)  
;; global options: +cmd  
;; connection timed out; no servers could be reached  
~ pietro$ dig @dns.istsupcti.it ANY

; <<>> DiG 9.8.3-P1 <<>> @dns.istsupcti.it ANY  
; (1 server found)  
;; global options: +cmd  
;; connection timed out; no servers could be reached

Ok, ENUM is totally broken in Italy.

Let me dig a bit more:

Who is istsupcti.it (seems not have even a working web site)?

~ pietro$ whois istsupcti.it

\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
\* Please note that the following result could be a subgroup of \*  
\* the data contained in the database. \*  
\* \*  
\* Additional information can be visualized at: \*  
\* http://www.nic.it/cgi-bin/Whois/whois.cgi \*  

\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

Domain: istsupcti.it  
Status: ok  
Created: 1998-12-23 00:00:00  
Last Update: 2015-02-24 00:54:36  
Expire Date: 2016-02-08

Registrant  
Organization: Istituto Superiore delle Comunicazioni e delle Tecnologie
dell'Informazione  
Address: Viale America, 201  
Roma  
00144  
RM  
IT  
Created: 2008-02-08 12:11:24  
Last Update: 2012-07-16 16:14:51

Admin Contact  
Name: Claudia Passaro  
Organization: Istituto Superiore delle Comunicazioni e delle Tecnologie
dell'Informazione  
Address: Viale America, 201  
Roma  
00144  
RM  
IT  
Created: 2012-07-16 14:30:02  
Last Update: 2012-07-16 16:13:49

Technical Contacts  
Name: Gestione Domini  
Address: Via Caracciolo, 51  
MILANO  
20155  
MI  
IT  
Created: 2005-07-07 00:00:00  
Last Update: 2014-06-20 14:07:55

Registrar  
Organization: Fastweb s.p.a.  
Name: FASTWEB-REG

Nameservers  
dns1.fweds-spc.it  
dns2.fweds-spc.it

Googling for "Istituto Superiore delle Comunicazioni e delle Tecnologie dell'Informazione" I found the website.

10 years of testing

Searching on the RIPE archive I found the delegation request for the +39 ENUM prefix: it was in October 2005: Almost ten years ago! The request comes from the Voipex consortium (from the website it looks more or less died now).

Digging on the Internet you can find some old posts saying that we entered in a test phase for the ENUM introduction.

Searching on the AGCOM (The Italian Communications Authority) website you can see some documents mentioning ENUM as a maybe/future technology to adopt.

The result at the moment is that after 10 years of testing, a consortium foundation, various ISP involved, ENUM isn't working at all and we cannot find test results, adoptions guidelines nor regulation rules.

Just for the taxpayers happiness!

I just sent an email to urp.comunicazioni@mise.gov.it ("Istituto Superiore delle Comunicazioni e delle Tecnologie dell'Informazione" PR office ), I tried to send an email to AGCOM too but I crashed against this message:

]

If you have any information about ENUM in Italy, feel free to contact me.

to be continued ...

SIP packets filtering with iptables

2014-01-22T23:50:00+01:00

One of the most powerful iptables match is the u32 module.
Using the u32 match you are able to write a firewall rule matching against a single bit of a network packet.

If you wanna play with u32 module you have to be prepared to deal with a syntax very far away from the user friendliness: you have to fight with commands like the following:

iptables -I OUTPUT 1 -p udp  \! -f -m u32 --u32 0>>22&0x3C@8=0x494e5649&&0>>22&0x3C@12=0x54452073&&0>>22&0x3C@16=0x69703a33&&0>>22&0x3C@20=0x33383132&&0>>22&0x3C@24=0x33343536&&0>>22&0x3C@28&0xFF000000=0x37000000 -j LOG --log-prefix "--call-to-3381234567 "

More over checking contents in variable positions can be very difficult: you need to know the exact data position into the network frame.

Keeping that in mind you can write your rules.

Writing matching rules against SIP methods, SIP URI or response code is feasible: the IP header comes with a fixed size (this isn't really true, but you can workaround it) and the UDP header too has a fixed size.

For example this rule logs all the outgoing SIP INVITE to sip:3381234567:

[root@bradbury ~]# iptables -I OUTPUT 1 -p udp  \! -f -m u32 --u32 0>>22&0x3C@8=0x494e5649&&0>>22&0x3C@12=0x54452073&&0>>22&0x3C@16=0x69703a33&&0>>22&0x3C@20=0x33383132&&0>>22&0x3C@24=0x33343536&&0>>22&0x3C@28&0xFF000000=0x37000000

Here you can see the network traffic (look at the hex data matching the iptables rule):

root@bradbury ~]# tcpdump -nn -i br0 -XX udp and port 5060 and host xxx.xxxxxxxxxx.xx

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on br0, link-type EN10MB (Ethernet), capture size 65535 bytes

22:48:29.362185 IP xxx.xxx.xxx.xxx.5060 > xxx.xxx.xxx.xxx.5060: SIP, length: 965
0x0000:  001f 1249 0acc 5254 00e7 8e30 0800 45a0  ...I..RT...0..E.
0x0010:  03e1 0000 4000 4011 01dd 511d d3c4 d461  ....@.@...Q....a
0x0020:  3b4c 13c4 13c4 03cd 386e 494e 5649 5445  ;L......8nINVITE <--- HERE: look at the 494e 5649 5445 matching the 'INVITE'
0x0030:  2073 6970 3a33 3338 3132 3334 3536 3740  .sip:3381234567@ <--- HERE: look at the SIP URI
0x0040:  7878 782e 7878 7878 7878 7878 7878 2e78  xxx.xxxxxxxxxx.x
0x0050:  783b 7573 6572 3d70 686f 6e65 2053 4950  x;user=phone.SIP

Messages are logged (the first one is the INVITE without the authentication data):

[root@bradbury ~]# tail -f /var/log/messages
Jan 22 23:00:28 bradbury kernel: --call-to-3381234567IN= OUT=br0 SRC=xxx.xxx.xxx.xxx DST=xxx.xxx.xxx.xxx LEN=993 TOS=0x00 PREC=0xA0 TTL=64 ID=0 DF PROTO=UDP SPT=5060 DPT=5060 LEN=973
Jan 22 23:00:28 bradbury kernel: --call-to-3381234567IN= OUT=br0 SRC=xxx.xxx.xxx.xxx DST=xxx.xxx.xxx.xxx LEN=1285 TOS=0x00 PREC=0xA0 TTL=64 ID=0 DF PROTO=UDP SPT=5060 DPT=5060 LEN=1265

You can write your rules in a more simple way using my

iptables-SIPu32.py python script:

iptables -I OUTPUT 1 -p udp  \! -f -m u32 --u32 $(./iptables-SIPu32.py "INVITE sip:3381234567") -j LOG --log-prefix "-j LOG --log-prefix "--call-to-3381234567 "

Please note that this script can works with every kind of UDP payload.

UPDATE: now the script supports TCP too

Using special chars in Python string Templates

2013-06-05T21:55:00+02:00

PEP-292 introduced a nice Python templating feature.
Templates placehoder names are subject to some restrictions,Documentation says:

$identifier names a substitution placeholder matching a mapping key of "identifier".
By default, "identifier" must spell a Python identifier.
The first non-identifier character after the $ character terminates this placeholder specification.

This means that \${placeholder} names must spell the Python identifier syntax: dots (.), hyphen (-) or other special chars are not allowed.
The default regex that must match the placeolder is:

r'[\_a-z][\_a-z0-9]\*'

You can simply extend this regex overwriting the idpattern property in Template class.

Here a quick example:

>>> from string import Template
>>> class MyTemplate(Template):
...     idpattern = r'[a-z][\.\-_a-z0-9]*'
... 
>>> MyTemplate("a=${ciccio_pippo-b}").substitute({'ciccio_pippo-b': "pasticcio"})
'a=pasticcio'
>>>

UAS Authenticating registrar SIPp scenario

2013-05-30T16:42:00+02:00

SIPp is a real SIP swiss army knife. You can create various SIP scenario and test your devices and environments.

I never found a SIPp scenario implementing an UAs (User Agent server) registrar with authentication.

Following you can find this scenario:

The SIPp XML scenario file: sipp_register_auth_uas.xml

<?xml version="1.0" encoding="ISO-8859-1" ?>
<!DOCTYPE scenario SYSTEM "sipp.dtd">

<scenario name="Basic UAS registrar with authentication">

<label id="badauth"/> 
<recv request="REGISTER" />
  <send><![CDATA[

      SIP/2.0 401 Authorization Required
      [last_Via:]
      [last_From:]
      [last_To:];tag=[pid]SIPpTag01[call_number]
      [last_Call-ID:]
      [last_CSeq:]
      Contact: <sip:[local_ip]:[local_port];transport=[transport]>
      WWW-Authenticate: Digest realm="test.example.com", nonce="47ebe028cda119c35d4877b383027d28da013815"
      Content-Length: [len]

    ]]>
  </send>
  <recv request="REGISTER" >
        <action>
                <ereg regexp="Digest .*username=\"([^\"]*)\"" search_in="hdr" header="Authorization:" assign_to="junk,username" />
                <lookup assign_to="line" file="users.csv" key="[$username]" />
                <assign assign_to="junk" value="0" />
                <log message="Received REGISTER from user -[$username]-" />
                <log message="searching in file at line [$line]: Username: [field0 line=\"[$line]\"] Pass: [field1 line=\"[$line]\"]"/>
                <verifyauth assign_to="authvalid" username="[field0 line=\"[$line]\"]" password="[field1 line=\"[$line]\"]" />
        </action>
  </recv>

  <nop hide="true" test="authvalid" next="goodauth" />
  <nop hide="true" next="badauth" />

  <label id="goodauth"/>
  <send>
    <![CDATA[

      SIP/2.0 200 OK
      [last_Via:]
      [last_From:]
      [last_To:];tag=[call_number]
      [last_Call-ID:]
      [last_CSeq:]
      Contact: <sip:[local_ip]:[local_port];transport=[transport]>
      Content-Length: 0
      Expires: 3600

    ]]>
  </send>


  <!-- definition of the response time repartition table (unit is ms)   -->
  <ResponseTimeRepartition value="10, 20, 30, 40, 50, 100, 150, 200"/>

  <!-- definition of the call length repartition table (unit is ms)     -->
  <CallLengthRepartition value="10, 50, 100, 500, 1000, 5000, 10000"/>

</scenario>

Here the users file: a CSV containing users and password (first column is the username, second column the password). users.csv

USERS  
pippero;1234  
pippo;1234

Now you can run your scenario putting users.csv and sipp_register_auth_uas.xml in the same directory, and running SIPp inside the directory (SIPp handle in a stupid manned direcotories..):

sipp -sf sipp_register_auth_uas.xml -inf users.csv -infindex users.csv 0 -log_file sipp_register_auth_uas.log -trace_logs

And you will see an output like this:

------------------------------ Scenario Screen -------- [1-9]: Change Screen --
  Port   Total-time  Total-calls  Transport
  5060       4.00 s            0  UDP

  0 new calls during 1.001 s period      1 ms scheduler resolution
  0 calls                                Peak was 0 calls, after 0 s
  0 Running, 1 Paused, 3 Woken up
  0 dead call msg (discarded)          
  3 open sockets                        

                                 Messages  Retrans   Timeout   Unexpected-Msg
  ----------> REGISTER           0         0         0         0        
  <---------- 401                0         0                            
  ----------> REGISTER           0         0         0         0        
  <---------- 200                0         0                            
------------------------------ Sipp Server Mode -------------------------------

Now you can register your device configuring the registrar address and credentials, when your device will send the REGISTER request you will the message flow:

------------------------------ Scenario Screen -------- [1-9]: Change Screen --
  Port   Total-time  Total-calls  Transport
  5060     161.28 s            1  UDP

  0 new calls during 1.001 s period      1 ms scheduler resolution
  0 calls                                Peak was 1 calls, after 157 s
  0 Running, 2 Paused, 4 Woken up
  0 dead call msg (discarded)          
  3 open sockets                        

                                 Messages  Retrans   Timeout   Unexpected-Msg
  ----------> REGISTER           1         0         0         0        
  <---------- 401                1         0                            
  ----------> REGISTER           1         0         0         0        
  <---------- 200                1         0                            
------------------------------ Sipp Server Mode -------------------------------

Log messages will be saved in sipp_register_auth_uas.log.
Please note that the verifyauth needs the OpenSSL support.

Ability to set codec in MulticastRTP Asterisk channels

2012-12-12T21:08:00+01:00

Here you can find a port for Asterisk trunk (rev. 377802) of this patch: http://lists.digium.com/pipermail/asterisk-dev/2011-September/051262.html.
This patch permits to set the codec of an outgoing multicast RTP stream via the variable MULTICAST_RTP_CODEC:

exten => 999,1,Answer()  
exten => 999,n,Set(MULTICAST_RTP_CODEC=alaw)  
exten => 999,n,Dial(MulticastRTP/basic/239.255.255.245:5555,,A(/var/lib/asterisk/moh/mymoh))

RTP timestamps fix in Asterisk MulticastRTP channels

2012-12-12T19:09:00+01:00

Starting from Asterisk 1.8 you can send multicast rtp streams using the MulticastRTP channel driver. There is an open issue that breaks outgoing RTP if the source channel doesn't contains timing informations (Eg. playing an audio file with Dial(MulticastRTP/basic/239.255.255.245:5555,,A(my-announce))).
All outgoing RTP frames a timestamp value of 0.

This patch adds timing information in outgoing RTP stream.

Following an example usage in dialplan:

exten => 999,1,Answer()  
exten => 999,n,Dial(MulticastRTP/basic/239.255.255.245:5555,,A(/var/lib/asterisk/moh/mymoh))

Encoding and decoding Encapsulated DHCP options (RFC 2132)

2012-10-19T10:38:00+02:00

Vendor specific DHCP options may be provided encapsulated in DHCP option 43.
With this little script you can encode and decode vendor encapsulated option according to RFC 2132.

For example with this command you can tunnel options 66 (TFTP Server), 67 (TFTP Path), 132 (VLAN ID) and 133 (VLAN QOS):

$ ./dhcp-encapsulated-options.py encode 66 http://provisionig.example.com 67 settings.xml 132 33 133 6
Encoding part 1: http://provisionig.example.com
 Option ID: 66
 Option length: 30
 Encoded Option part: 42:1E:68:74:74:70:3A:2F:2F:70:72:6F:76:69:73:69:6F:6E:69:67:2E:65:78:61:6D:70:6C:65:2E:63:6F:6D

Encoding part 2: settings.xml
 Option ID: 67
 Option length: 12
 Encoded Option part: 43:0C:73:65:74:74:69:6E:67:73:2E:78:6D:6C

Encoding part 3: 33
 Option ID: 132
 Option length: 2
 Encoded Option part: 84:02:33:33

Encoding part 4: 6
 Option ID: 133
 Option length: 1
 Encoded Option part: 85:01:36

Full encoded options: 42:1E:68:74:74:70:3A:2F:2F:70:72:6F:76:69:73:69:6F:6E:69:67:2E:65:78:61:6D:70:6C:65:2E:63:6F:6D:43:0C:73:65:74:74:69:6E:67:73:2E:78:6D:6C:84:02:33:33:85:01:36

And then you can add the encoded options in you dhcpd config file:

host device.labo.local {  
    hardware ethernet 01:04:23:3b:d0:21;  
    fixed-address 172.16.18.30;  
    option vendor-encapsulated-options
    42:1E:68:74:74:70:3A:2F:2F:70:72:6F:76:69:73:69:6F:6E:69:67:2E:65:78:61:6D:70:6C:65:2E:63:6F:6D:43:0C:73:65:74:74:69:6E:67:73:2E:78:6D:6C:84:02:33:33:85:01:36;  
}

And viceversa you can decode an encapsulated option:

$ ./dhcp-encapsulated-options.py decode 42:1E:68:74:74:70:3A:2F:2F:70:72:6F:76:69:73:69:6F:6E:69:67:2E:65:78:61:6D:70:6C:65:2E:63:6F:6D:43:0C:73:65:74:74:69:6E:67:73:2E:78:6D:6C
Decoding part 1: 42:1E:68:74:74:70:3A:2F:2F:70:72:6F:76:69:73:69:6F:6E:69:67:2E:65:78:61:6D:70:6C:65:2E:63:6F:6D
 Option ID: 66
 Option lenght: 30
 Option value: "http://provisionig.example.com"

Decoding part 2: 43:0C:73:65:74:74:69:6E:67:73:2E:78:6D:6C
 Option ID: 67
 Option lenght: 12
 Option value: "settings.xml"

End of encoded options

Asterisk callback from a failed blind transfer

2012-10-07T15:34:00+02:00

This little piece of extensions.conf implements a callback from a failed transfer (attendant and unattendant/bind)

exten => _1XX,1,Dial(SIP/${EXTEN},20,tT)
exten => _1XX,n,GotoIf($[ "a${BLINDTRANSFER}" = "a" ]?TransferFailed)
exten => _1XX,n,Set(CALLER=${CUT(BLINDTRANSFER,-,1)});
exten => _1XX,n,Goto(CallBack)
exten => _1XX,n(TransferFailed),GotoIf($[ "a${TRANSFERERNAME}" = "a" ]?Fail)
exten => _1XX,n,Set(CALLER=${CUT(TRANSFERERNAME,-,1)});
exten => _1XX,n(CallBack),Set(CALLERID(all)=${EXTEN} <${CALLERID(num)}>)
exten => _1XX,n,Dial(${CALLER},,tT)
exten => _1XX,n(Fail),Hangup()

vtiger CRM: Howto add products commissions in invoice

2012-09-27T13:27:00+02:00

During last days I played with vtiger: a very customizable and feature rich PHP/MySQL CRM. Sincerely this task has revived my intimate hate for PHP programming language.

This is the idea: add a function hook in vtiger workflow every time that an invoice is created or edited. This function must take care to update invoice commission based on products commissions rates.

First step: Create the hook function:
Create a new file under "include" folder: vim include/CommissionHandler.php

Following the content of this file:

<?php   
function updateCommission($entity){   
  global $log, $adb;   
  $entityArray = get_object_vars($entity);       
  $invoice_id = vtws_getIdComponents($entity----->getId());
  $invoice_id = $invoice_id[1];
  $log->debug("Entering into function updateRebate(".$invoice_id.").");

  $products = $adb->pquery("SELECT productid, quantity from vtiger_inventoryproductrel WHERE id=?", array($invoice_id));
  $numrows = $adb->num_rows($products);
  $rebate = 0;
  for($index = 0;$index query_result($products,$index,'productid');
    $quantity = $adb->query_result($products,$index,'quantity');

    $commission_info = $adb->pquery("SELECT unit_price, commissionrate from vtiger_products WHERE productid=?", array($productid));

    $commission_rate = $adb->query_result($commission_info, 0, 'commissionrate');
    $price = $adb->query_result($commission_info, 0, 'unit_price');

    $rebate = $rebate + ($quantity * ($price * $commission_rate / 100));
  }
  $adb->pquery("UPDATE vtiger_invoice SET salescommission=$rebate WHERE invoiceid=?", array($invoice_id));
}
?>

Second Step: register the hook

Create a new php file: vim reg.php

Following the content of reg.php:

<?php 
require_once 'include/utils/utils.php'; 
require 'modules/com_vtiger_workflow/VTEntityMethodManager.inc'; 
$emm = new VTEntityMethodManager($adb); 
#addEntityMethod("Module", "LABEL", "FILENAME", "FUNCTION_NAME"); 
$emm->addEntityMethod("Invoice", "Update Commission", "include/CommissionHandler.php", "updateCommission");
?>

Execute the registration script:

via CLI: php -f reg.php or via Web: wget http://your.vtiger.url/vtiger-pat/reg.php -O > /dev/null

Third Step: Associate the function hook to an invoice workflow:

Under the vtiger admin panel, select "Workflow" and then "New Workflow".
Select "For Module", select "Invocie" Module
Fill the description field with a descriptive name eg. "Update Invoice Commission"
Select "Every time the record is saved." radio button
Click Save button
Leave conditions empty
Click on "New Task" button
Select "Invoke custom function"
Assign a Task title and select "Update Commission" method
Click "Save"

Fourth Step: Play with invoice and products commissions.

Backup your Dropbox share with bacula

2012-07-27T22:33:00+02:00

I don't like cloud storage, especially I don't like Dropbox security history.
Anyway Dropbox and others cloud storage are damn cheap and easy to use, I use it for sharing non-important documents.

This little howto explain how you can backup your Dropbox share with Bacula.

First you must install Dropbox in your server:

Download the python CLI script from here: wget https://linux.dropbox.com/packages/dropbox.py
and install: LC_ALL=C python26 ./dropbox.py start -i
run it: LC_ALL=C python26 ./dropbox.py start
Now Dropbox start reply with a link:

To link this computer to a dropbox account, visit the following url:  

https://www.dropbox.com/cli_link?host_id=4258saj1921sa123aa17329a12e3&cl=en_US

Copy and paste the in your browser and insert you DropBox credentials, after you can restart Dropbox.
Dropbox will sync your storage with your ~/Dropbox folder. You can check the status with the command: LC_ALL=C python26 ./dropbox.py status *When your Dropbox folder is fully syncronized you can stop Dropbox LC_ALL=C python26 ./dropbox.py stop

This little script starts local dropbox sync process and check the status, the script exit with success if your Dropbox folder is in-sync, and with an error code you a timeout event is reached (configure maxwait and recheck variabales). You can use this script as Pre-client-script in your bacula job.

#!/bin/bash

maxwait=20 #number of maximum re-check
recheck=2 #seconds between recheck
dropbox="python26 /root/dropbox.py"


do_ok(){
        $dropbox stop
        exit 0
}

cd ~
# start DR
export LC_ALL=C
$dropbox start


x=0
while [ $x -le $maxwait ]
do
        sleep $recheck
        status=$($dropbox filestatus Dropbox | cut -d \  -f2-)
        [ "$status" == "up to date" ] && do_ok
        x=$(( $x + 1 ))
        echo "Dropbox not updated.. ($x)"
done
echo "Timeout reached."
$dropbox stop
exit 255

Following the bacula configuration for this job: Job definition and FilSet:

FileSet {
  Name = "DropBox Full Set"
  Include {
    Options {
      signature = MD5
    }
    File = /root/Dropbox
  }
}

Job {
  Name = "BackupDropBox"
  Client = stoker-fd
  FileSet = "DropBox Full Set"
  JobDefs = "DefaultJob"
  RunScript {
    RunsWhen = Before
    FailJobOnError = Yes
    Command = "/etc/bacula/scripts/sync-dropbox.sh"
  }
}

Poor man virtual consolidated backup update

2012-04-01T15:17:00+02:00

I just received a little patch to my pmvcb from Tilman Schmidt.
This patch add the support for the new ESXi syntax of snapshot.remove.

You can download the last pmvcb from my Github page

Thanks Tilman.

Little file browser with pdmenu

2012-03-10T02:15:00+01:00

Pdmenu is a menu system for Unix. It is designed to be easy to use, and is suitable for a login shell for inexperienced users, or it can just be run at the command line as a handy menu program.

I just modified showdir.pl script in order to implement a small and minimal file browser for using pdmenu.

You can add/delete file and directory and edit files. Some screenshot below:

this is the pdmenu configuration file:

#! /usr/bin/pdmenu -c
#
## Version 2.0
#
## Title
preproc: echo "Title: test"
color:desktop:blue:blue
color:title:red:white
color:base:blue:white
# File manager
menu:provisioning: Provisioning file management : 
group:_Edit a file
    exec::makemenu: (\
            /usr/share/pdmenu/editdir.pl /var/www "" show_directory \
            ) 2>/dev/null
    show:::show_directory
    remove:::show_directory
endgroup
group:_Remove a file or directory
    exec::makemenu: (\
            /usr/share/pdmenu/deldir.pl /var/www "" del_directory \
            ) 2>/dev/null
    show:::del_directory
    remove:::del_directory
endgroup
group:Add a _directory
    exec::makemenu: (\
            /usr/share/pdmenu/adddir.pl /var/www "" add_directory \
            ) 2>/dev/null
    show:::add_directory
    remove:::add_directory
endgroup
group:Add a _file
    exec::makemenu: (\
            /usr/share/pdmenu/addfile.pl /var/www "" add_file \
            ) 2>/dev/null
    show:::add_file
    remove:::add_file
endgroup
nop

nop
exit:E_xit

you can download the showdir.pl script here

All files /usr/share/pdmenu/editdir.pl /usr/share/pdmenu/deldir.pl /usr/share/pdmenu/adddir.pl /usr/share/pdmenu/addfile.pl are symlink to showdir.pl

How to push a public IP on your laptop using SSH bridged tunnel

2012-03-04T23:49:00+01:00

In my previous post I talked about Layer 3 VPN feature of OpenSSH (starting from version 4.3).
Now, I'm talking about bridged VPN or Layer 2 VPN. With this feature you can create a virtual network device that, through the encrypted tunnel, is connected on the same network segment of remote server. In fact the VPN acts as a network switch connecting local virtual device with remote device in same ethernet network.

With this setup your SSH client will connect to remote server and start forwarding packet between local end remote TUN/TAP device.
All packets are forward through the encrypted SSH tunnel.

using -o Tunnel=ethernet instead of -o Tunnel=point-to-point ssh process try to use a tap device and forwards all ethernet frames (layer 2). You can specify TUN/TAP local and remote device index with -w option:

This command: ssh -o Tunnel=ethernet -w 0:1 host.example.com establish an ssh connection to host.example.com and forwards all ethernet frames from local tap0 to remote tap1 and vice-versa.
If tap0 and tap1 doesn't exist ssh will try to create.

In order to setup a public IP on your laptop you need to create a bridge between remote remote public ethernet device and remote TUN/TAP device. Below the accomplishment step for this task:

Assuming that this is the public network configuration:

Public IP: 78.47.249.187
Public Network: 78.47.249.160
Public Gateway: 78.47.249.190
Laptop Public IP: 78.47.249.187

On server side:

create a bridge: brctl addbr br0
create the remote tap device: tunctl -t tap0
add devices to bridge: brctl addif br0 eth0 && brctl addif br0 tap0
setup the remote public IP address on bridge interface: ip addr add 78.47.249.187/27 dev br0
setup link and promiscuous mode: ip link set up promisc on dev tap0 && ip link set up promisc on dev eth0
setup default gateway: ip route add default via 78.47.249.190
Permit tunnel on ssh server: add "PermitTunnel yes" on your sshd_config sshd configuration file

Now the public machine must be connected to public network and reachable.

On client side:

connect your laptop to server and create the tunnel ssh -o Tunnel=ethernet -w 0:0 root@78.47.249.187
add public ip to your client and setup link: ip addr add 78.47.249.188/27 dev tap0 && ip link set up dev tap0

Now your laptop is directly connected to public remote network through tap0 device.
Following steps are needed only if you need to substitute your gateway with public gw:

setup a static route to remote server (you need to know your current default gw): ip route add 78.47.249.187 via my.old.def.gw
setup the new default gw: ip route del default via my.old.def.gw && ip route add default via 78.47.249.190 dev tap0

Tips:

You can automate all client task with a simple bash script
-u and -g tunctl options permit to manage TUN/TAP device with an unprivileged user
use ssh public key authentication and a dedicated unprivileged user
-NTCf -o ServerAliveInterval=60 ssh options are your friends
following the configuration files for automatic and reboot persistent configuration on server side (for RedHat based distro):

/etc/sysconfig/network-scripts/ifcfg-br0

DEVICE="br0"
ONBOOT="yes"
TYPE=Bridge
BOOTPROTO=none
IPADDR=78.47.249.187
PREFIX=27
GATEWAY=78.47.249.190
DEFROUTE=yes
IPV4_FAILURE_FATAL=yes
IPV6INIT=no
NAME="System Bridge"

/etc/sysconfig/network-scripts/ifcfg-tap0

DEVICE=tap0
TYPE=Tap
OWNER=vpnuser #use an unprivileged user for your TUN/TAP device
BRIDGE=br0

/etc/sysconfig/network-scripts/ifcfg-eth0

DEVICE="eth0"
ONBOOT="yes"
TYPE=Ethernet
BRIDGE=br0

Asterisk and SIP session refresh with UPDATE request

2012-02-15T07:12:00+01:00

Using directmedia=update or (canreinvite=update in old-sytle configuration) in chan_sip.conf Asterisk sends SIP UPDATE request to refresh SIP session.

If this UPDATE requests refers to an inactive call the phone reply with SIP/2.0 481 Call Leg/Transaction Does Not Exist.

In this situation Asterisk continue in resending UPDATE and doesn't tear down the previous allocated channel.
Using INVITE instead UPDATE (directmedia=yes) Asterisk correctly terminate the dialog.

This little chan_sip.c patch (Asterisk 1.8.9.1 version) correct this behavior:

--- asterisk-1.8.9.1/channels/chan_sip.c 2012-02-06 22:40:37.000000000 +0100
+++ /root/asterisk-1.8.9.1/channels/chan_sip.c 2012-02-08 15:30:04.552673312 +0100
@@ -20952,6 +20952,17 @@ static void handle_response(struct sip_p
case 481: /* Call leg does not exist */
if (sipmethod == SIP_INVITE) {
handle_response_invite(p, resp, rest, req, seqno);
+ }
+ else if (sipmethod == SIP_UPDATE) {
+ switch (resp) {
+ case 481: /* Call leg does not exist */
+ ast_log(LOG_WARNING, "Re-invite with UPDATE to non-existing call leg on other UA. SIP dialog '%s'. Giving up.\n", p->callid);
+ //xmitres = transmit_request(p, SIP_ACK, seqno, XMIT_UNRELIABLE, FALSE);
+ if (p->owner)
+ ast_queue_control(p->owner, AST_CONTROL_CONGESTION);
+ sip_scheddestroy(p, DEFAULT_TRANS_TIMEOUT);
+ break;
+ }
} else if (sipmethod == SIP_SUBSCRIBE) {
handle_response_subscribe(p, resp, rest, req, seqno);
} else if (sipmethod == SIP_BYE) {

You can download the patch at https://github.com/pbertera/junk/blob/master/asterisk-stuff/asterisk-1.8.9.1-UPDATE-reinvite.patch

Asterisk reported issue: ASTERISK-19313

How to split DNS name resolution in VPN environment

2011-11-30T19:18:00+01:00

I'm in this situation:
a VPN to remote concentrator that load many routes to private networks, vpn server push DNS configuration via OpenVPN protocol (see --dhcp-option DNS in openvpn(8) ).
The scope of this post is to explain how you can use remote DNS pushed by VPN concentrator only for certain zones.
For accomplish this I used a local PowerDNS server and a little OpenVPN up script:

When OpenVPN make the tunnel the up script create a custom forward-zones-file used by PowerDNS. The script insert in the custom file the remote zones and the dns server authoritative for these zones.

PowedDNS configuration:

[pietro@berta ~]$ grep -v ^\# /etc/pdns/pdns.conf | sed -e /^$/d
setuid=pdns
setgid=pdns
allow-recursion=127.0.0.1/8
negquery-cache-ttl=0
query-cache-ttl=0

[pietro@berta ~]$ grep -v ^\# /etc/pdns-recursor/recursor.conf | sed -e /^$/d
setuid=pdns-recursor
setgid=pdns-recursor
forward-zones-file=/etc/pdns-recursor/vpn-zones.conf

OpenVPN configuration:

[pietro@berta ~]$ grep ^up /etc/openvpn/my-vpn.conf
up /etc/openvpn/vpn-dns.sh up
down /etc/oprnvpn/vpn-dns.sh down

the /etc/openvpn/vpn-dns.sh script:

#!/bin/bash

zones="example.com remote.com my.internal.zone"
dns=dns

case $1 in
    up)
        for opt in ${!foreign_option_*}
        do
            eval "dns=${$opt#dhcp-option DNS }"
            if [ "$dns" != "dns" ]
            then
                echo ";; created by openvpn --up ${0} " >/tmp/vpn-zones.conf
                for zone in $zones; do
                    echo "+$zone=$dns" >> /tmp/vpn-zones.conf
                done
                mv -f /tmp/vpn-zones.conf /etc/pdns-recursor/
                rec_control reload-zones
                exit 0
            fi
        done
        ;;

    down)
        echo > /etc/pdns-recursor/vpn-zones.conf
        rec_control reload-zones
        ;;
    * )
        echo usage:
        echo "$0 [up|down]"
        ;;
esac

This script route DNS zones example.com remote.com my.internal.zone to DNS server pushed by OpenVPN.

You can check the right configuration using dig end tcpdump on tunnel interface to see correctly routed DNS query.
In finish you must not forget to instruct your dhcp client to use 127.0.0.1 as a DNS server

Simple CMS using web.py and Markdown

2011-11-18T20:54:00+01:00

With a bit of code you can build a simple but powerful, single page, CMS using python, web.py and content stored in markdown files.

1) the application: application.py

#!/usr/bin/python26
# vi:si:et:sw=4:sts=4:ts=4
# -*- coding: UTF-8 -*-
# -*- Mode: Python -*-
#
# Copyright (C) 2011 Bertera Pietro

import web
import mimetypes

import markdown2

# pages is a list of dictionary: the value of key name represent the name\
# of page, the value of  link represent the routing pattern,
# and content_file is the path of markdown file with the page content
pages = [
        { "name": "Home",
                  "link": "/", 
                  "content_file": "contents/home.md"
                 },
        { "name": "Info",
                  "link": "/info.html", 
                  "content_file": "contents/info.md"
                 },
    ]

# this is the directory with static files (images, css, ...)
static_dir = "public"

# the view, layout.html is a template file
htmlview = web.template.render('views', cache=False, base="layout",\
   globals={'pages':pages, 'ctx': web.ctx})

# generic controller for Markdown pages:
class PageClassTemplate:
    content_file = ""

    def GET(self):
        html = markdown2.markdown_path(self.content_file)
        return htmlview.page(html)

# Controller for static files
class Public:
    def GET(self):
        try:
            file_name = web.ctx.path.split('/')[-1]
            web.header('Content-type', mime_type(file_name))
            return open('.' + web.ctx.path, 'rb').read()
        except IOError:
            raise web.notfound()

# mime type interpreter
def mime_type(filename):
    return mimetypes.guess_type(filename)[0] or 'application/octet-stream'

# initialize the application
myApp = web.application(mapping=(), fvars=globals())

for page in pages:
    pattern = page["link"]
    globals()[page["name"]] = type(page["name"],\
   (PageClassTemplate,object,), dict(content_file=page["content_file"]))
    myApp.add_mapping(pattern, page["name"])

# add static file handler:
try:
    if static_dir:
        myApp.add_mapping("/%s/.+" % static_dir, "Public")
except AttributeError:
    pass

# RUN!
if __name__ == "__main__":
    myApp.run()

2) main template layout: views/layout.html

$def with (page, title="")

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="cs" lang="cs">
  <head>
    <title>Single Page Markdown CMS</title>
  </head>
  <body>

<h1>
Custom header here      
</h1>

    <ul>        
$for item in pages:
    $ attr = ''
    $if ctx.path == item['link']:
        $ attr=' id="current"'
    <li$:(attr)><a href="$item['link']">$item['name']</a></li>
$pass
        </ul>

<hr/>
$:page
<hr/>    

    Custom footer here 
  </body>
</html>

3) content template: views/page.html

$def with (html)

$:html

4) markdown contents:

contents/home.md

## Welcome !!

### This is an Hello word Page!

**web.py** the best python framework for webapps [web.py][].

This is a simple page from a markdown file

  [web.py]: http://www.webpy.org

contents/info.md

## Info

this stupid idea is made by [bertera pietro](http://www.bertera.it)

Php sinippet: howto ignore HTTP errors in file_get_contents()

2011-11-04T12:52:00+01:00

A useful snipped of php code:

echo file_get_contents('http://www.example.com/foo.html',\
  FALSE, stream_context_create(array\
  ('http'=>;array('ignore_errors' =>; TRUE))))

Client side result pagination in python-ldap

2011-10-25T13:28:00+02:00

Sometime I must fighting with monkeys-configured LDAP servers.
This time DIT does not support RFC2696 (Paged Results for LDAP query), the data tree contains over 90000 entries.
Thanks to ldap.resiter is possible to implement client side pagination in ldap scripts.
These simple lines of code explain how to:

import ldap
import pprint
import ldap.resiter
import sys

ldap_uri = "ldap://my.ldap.server"
ldap_base = "dc=example,dc=com"
page_entry_num = 5

class MyLDAPObject(ldap.ldapobject.LDAPObject,ldap.resiter.ResultProcessor):
    pass

ldapconn = MyLDAPObject(ldap_uri)
msg_id = ldapconn.search(ldap_base, ldap.SCOPE_SUBTREE, "(objectclass=*)")

i = 0
for res_type,result,res_msgid,res_controls in ldapconn.allresults(msg_id):
    if i &gt;= page_entry_num:
        try:
            raw_input('Press Enter for nex page or CTRL-C to interrupt:')
        except KeyboardInterrupt:
            ldapconn.abandon(msg_id)
            print "..Bye."
            sys.exit()

        i = 0

    for rdn, ldap_obj in result:
        print "***********************"
        print "RDN: " + rdn
        print "***********************"
        pprint.pprint(ldap_obj)
        print "***********************"
        print ""

    i = i + 1

Howto configure multiple mac address over a single ethernet interface

2011-10-04T18:01:00+02:00

I up against this problem on a server hosted by Hetzner.My server is a virtual hypervisor containing several virtual machines.The Hetzner's politics is to statically associate a public IP to a single mac address, is therefore impossible to have multiple IP address on a single ethernet device. Observing this rule you can associate only one virtual machine with one public IP, and you cannot create a firewall with all public IPs attested on public interface and private interfaces attached to a vSwitchs.

To solve the problem you can use the macvlan module. Macvlan allow to create indipendent logical devices over a single ethernet device. In this way you have three (logical) ethernet device with three IPs and three mac address over a single physical device. This solve the addressing problem but slightly complicates routing and NAT.

Configuration example:

Public IPs:

A.A.A.A associated mac address: aa:aa:aa:aa:aa:aa

B.B.B.B associated mac address: bb:bb:bb:bb:bb:bb

C.C.C.C associated mac address: cc:cc:cc:cc:cc:cc

External interface: eth0

Gateway:
X.X.X.X

Internal Subnets:
a.a.a.0/24 (eth1)
b.b.b.0/24 (eth2)
c.c.c.0/24 (eth3)

Firewall IPs on internal subnets:
eth1: a.a.a.254
eth2: b.b.b.254
eth3: c.c.c.254

Network schema:

I want to map the outgoing connections in this way:

Origin subnet	Public IP
a.a.a.0/24	A.A.A.A
b.b.b.0/24	B.B.B.B
c.c.c.0/24	C.C.C.C

Macvlan interface creation

set-up link on physical device:

    ip link set up dev eth0

create logical interfaces:

    ip link add link eth0 dev peth0 type macvlan address aa:aa:aa:aa:aa:aa
    ip link add link eth0 dev peth1 type macvlan address bb:bb:bb:bb:bb:bb
    ip link add link eth0 dev peth2 type macvlan address cc:cc:cc:cc:cc:cc

Assign ip address and activate link:

    ip addr add A.A.A.A/26 dev peth0
    ip addr add B.B.B.B/26 dev peth1
    ip addr add C.C.C.C/26 dev peth2
    ip link set up dev peth0
    ip link set up dev peth1
    ip link set up dev peth2

Normally configure the internal interfaces (eth1, eth2 eth3):

    ip addr add a.a.a.245/24 dev eth1
    ip addr add b.b.b.245/24 dev eth2
    ip addr add b.b.b.245/24 dev eth3
    ip link set up dev eth1
    ip link set up dev eth2
    ip link set up dev eth3

This is the routing situation:

# ip route sh
127.0.0.0/8 dev lo  proto kernel  scope link  src 127.0.0.1
a.a.a.0/24 dev eth1  proto kernel  scope link  src a.a.a.254
a.a.a.0/24 dev eth2  proto kernel  scope link  src b.b.b.254
a.a.a.0/24 dev eth3  proto kernel  scope link  src c.c.c.254
A.A.A.A/26 dev peth0  proto kernel  scope link  src A.A.A.A
B.B.B.B/26 dev peth1  proto kernel  scope link  src B.B.B.B
C.C.C.C/26 dev peth2  proto kernel  scope link  src C.C.C.C

You must create a routing table for all outgoing interface:

    echo "500 ipA" >> /etc/iproute2/rt_tables
    echo "600 ipB" >> /etc/iproute2/rt_tables
    echo "700 ipC" >> /etc/iproute2/rt_tables

Add a "catch all" routing table:

    echo "1000 catch_all" >> /etc/iproute2/rt_tables

Add gateways for tables:

    ip route add default via X.X.X.X dev peth0 table ipA
    ip route add default via X.X.X.X dev peth1 table ipB
    ip route add default via X.X.X.X dev peth1 table ipC
    ip route add default via X.X.X.X dev peth0 table catch_all

Add routing policy for internal subnet. Note that the priority must be greater than the priority used for the normal and default tables (for show all rules: ip rule show )

    ip rule add from a.a.a.0/24 lookup ipA pref 60000
    ip rule add from b.b.b.0/24 lookup ipB pref 60001
    ip rule add from c.c.c.0/24 lookup ipC pref 60002

Add routing policy for local IPs:

    ip rule add from A.A.A.254 lookup ipA pref 60010
    ip rule add from B.B.B.254 lookup ipB pref 60011
    ip rule add from C.C.C.254 lookup ipC pref 60012

Add a catch all routing policy (with preference greater than all):

    ip rule add from all lookup catch_all pref 70000

Configure the NAT:

    iptables -t nat -I POSTROUTING -o peth0 -s a.a.a.0/24 -j SNAT --to-source A.A.A.A
    iptables -t nat -I POSTROUTING -o peth1 -s b.b.b.0/24 -j SNAT --to-source B.B.B.B
    iptables -t nat -I POSTROUTING -o peth2 -s c.c.c.0/24 -j SNAT --to-source C.C.C.C

cisco IOS: Monitorare una vpn

2011-08-23T20:54:00+02:00

Avere a che fare con delle connettività scadenti è sempre un disastro.

Uno strumento per tenere monitorata una VPN e reagire in caso di down puo' essere comodo.

Esempio:
In questo esempio ho una VPN tra la rete A (192.168.2.0/24) e la rete B (192.168.8.0/24)
L'endpoint della rete A (192.186.2.1) è un router Cisco, l'enpoint B (192.168.8.1) non è in nostra gestione ma parla IPSec. Tramite le configurazione seguenti l'endpoint A tiene monitorato lo stato della VPN e in caso di down effettua il reload della VPN.

1) definiamo lo sla monitor in modo che esegua un ping verso l'host 192.168.8.1. Dobbiamo definire il source address in modo da essere sicuri di utilizzare il tunnel cifrato e lo scheduling in modo da eseguire il test sempre. E' possibile impostare una frequenza di esecuzione, di default è 60 secondi.

 ip sla monitor 5
 type echo protocol ipIcmpEcho 192.168.8.1 source-ipaddr 192.168.2.1
 exit
 ip sla monitor schedule 1 life forever start-time now

2) definiamo un tracker per lo sla monitor creato precedentemente: vogliamo monitorare quando lo sla monitor 5 ritorna route unreachable e reagire solo se lo stato di down permane per piu' di 60 secondi.

 track 1 rtr 5 reachability
 delay down 60

3) definiamo il "reattore"
Le configurazioni immesse finora fanno in modo che se l'host 192.168.8.1 rimane irraggiungibile per piu' di 60 secondi viene generato un evento nel syslog locale. L'event manager applet seguente si occupa di intercettare l'evento syslog, eseguire il reload della VPN e loggare il messaggio "VPN Reloaded"

 event manager applet VPN-IS-DOWN
 event syslog pattern "TRACKING-5-STATE: 5 .*Up->Down"
 action 1.0 cli command "enable"
 action 2.0 cli command "clear crypto session remote b.public.ip"
 action 3.0 cli command "end"
 action 4.0 syslog msg "VPN Reloaded"

Cisco IOS IP SLA configuration guide
Cisco IOS IP SLAs command reference
Writing Cisco embedded event manager policy

Bacula 5.0.3 debian squeeze backport

2011-07-25T22:08:00+02:00

Packages available here: http://www.bertera.it/software/bacula/bacula-backports/

Poor man vmware consolidate backup

2011-07-25T21:59:00+02:00

Update: for an english version of this post you can read the README of pmvcb at github
For bacula integration of pvmcb you can see the instruction on bacula wiki

VMware offre un pacchetto di backup per le macchine virtuali: VCB

Il VCB non fa altro che:

eseguire uno snapshot di una VM
clonare i dischi virtuali della VM
consolidare lo snapshot (rimozione dello snapshot)

I vantaggi di un backup del genere sono:

si ha il backup una macchina virtuale intera
non ci sono downtime: lo snapshot si puo' fare a caldo
se i vmware tools fanno il loro dovere il filesystem dovrebbe essere consistente

Gli svantaggi sono:

si ha il backup di una macchina virtuale intera (leggi: no incrementali)
si hanno gli stessi limiti derivati dall'uso degli snapshot: no RDM, ecc..

In buona sostanza il VCB è un buon sistema per il disaster recovery (se i paletti imposti dall'uso degli snapshot non sono troppo restrittivi).

E' possibile implementare un sistema di backup molto simile automatizzando le operazioni di snapshot, cloning e consolidation tramite uno script.

Lo script in questione è pmvcb: pmvcb esegue le operazioni sopra elencate su un host ESXi.

Di seguito l'help:

Usage: ./pmvcb -v [VM] -d [DIR] -h [host] <options>

options:
    -v <vm>       Virtual machine to backup [*]
    -d <dir>  Remote directory to store backup [*]
    -h <host> ESXi host [*]
    -u <user> ESXi username (default: root)
    -f <opts> vmkfstool optons (default: "-a lsilogic -d zeroedthick")
    -o      overwrite existent backups
    -q      use quiesce snapshot
    -s <opts> ssh options (default: "-i /var/lib/bacula/.ssh/id_rsa")
    -L <cmd>  local command executed after backup of virtual disks, this command is executed on local machine
    -R <cmd>  remote command executed on ESXi host after local command execution

[*] required options

come opzioni obbligatorie richiede il nome della VM da (-v), la directory di appoggio in cui clonare i dischi (-d) e l'host ESXi a cui collegarsi (-h).
Tramite l'opzione -f è possibile specificare diverse opzioni al comando vmkfstool utilizato per le operazioni di cloning, tramite -q richiede un'operazione di Quiescing prima di effettuare lo snapshot.
-s istruisce il comando ssh (es. ad usare l'autenticazione con chiave RSA).
-L e -R eseguono comandi rispettivamente e nell'ordine sull'host locale e sull'host remoto.

pmvcb si occupa di:

verificare che la virtual machine non abbia dischi indipendent oppure RDM.
verificare che non ci siano snapshot attivi sulla virtual machine
eseguire lo snapshot
clonare i dischi e il .vmx della virtual machine nella directory specificata dall'opzione -d
consolidare lo snapshot creato
eseguire i comandi specificati da -L localmente
eseguire i comandi specificati da -R sull'host ESXi remoto

bash snippet: dumping function call trace

2011-07-18T12:44:00+02:00

Uno snippet di codice bash utile nel debugging di script.

#@.. function:: __cm_exit_error([text],[...])
#@
#@   Stampa la stringa passata in stderr ed esce
#@   Se è impostata la variabile __cm_debug stampa lo stack di chiamata delle funzioni
#@
#@   :param text: la stringa da stampare
#@   :type text: String
#@
__cm_exit_error()

{
        echo "Error in ${FUNCNAME[1]}:${BASH_LINENO[0]}: $*" 1>&2
        local i=0
        [ $__cm_debug ] && while [ $i -lt ${#FUNCNAME} ]; do
                [ "${FUNCNAME[$i]}" == "main" ] && break
                echo "${BASH_SOURCE[$i]}::${FUNCNAME[$i + 1]}::${BASH_LINENO[$i]}" 1>&2
                i=$(expr $i + 1)
        done
        exit 1
}

cisco IOS contextual config diffs via syslog

2010-10-11T11:11:00+02:00

Event amanager applet per salvare il diff tra stratup-config e running-config via syslog.

event manager applet wr-mem-match 
 event cli pattern "wr.* mem.*" sync yes
 action 1.0 cli command "enable"
 action 1.1 cli command "show archive config differences nvram:/startup-config system:/running-config"
 action 1.2 syslog msg "$_cli_result"
 set 2.0 _exit_status 1

Authentication username in Astersik SIP peer

2010-07-12T09:01:00+02:00

Asterisk use peername as username during SIP inbound digest authentication.
This patch add authuser parameter in SIP peer definition and use authuser in digest authentication:

Peer definition in /etc/asterisk/sip.conf

...
[pietro](sip-client-base)
authuser=MyUsername
secret=XXXXX
qualify=yes
nat=yes
...

Peer definition in my SIP client (Twinkle)

REGISTER message from my SIP client

REGISTER sip:bertera.it SIP/2.0
Via: SIP/2.0/UDP 88.149.226.66:10458;rport;branch=z9hG4bKkqpevlic
Max-Forwards: 70
To: "Pietro"
From: "Pietro" ;tag=ntlug
Call-ID: mqezxbywgtulavj@bertuccia
CSeq: 681 REGISTER
Contact: ;expires=3600
Authorization: Digest username="MyUsername",realm="bertera.it",nonce="27f804de",uri="sip:bertera.it",response="47dbf0a57d80faffd148b58d84edc2db",algorithm=MD5 Allow: INVITE,ACK,BYE,CANCEL,OPTIONS,PRACK,REFER,NOTIFY,SUBSCRIBE,INFO,MESSAGE
User-Agent: Twinkle/1.4.2
Content-Length: 0

Message in Asterisk CLI:

[Feb 4 23:23:35] NOTICE[24864]: chan_sip.c:13016 register_verify: Trying athenticate peer 'pietro' using authuser: 'MyUsername'
-- Registered SIP 'pietro' at 88.149.226.66 port 10458

REGISTER Confirmation from Asterisk:

SIP/2.0 200 OK
Via: SIP/2.0/UDP 88.149.226.66:10458;branch=z9hG4bKkqpevlic;received=88.149.226.66;rport=10458
From: "Pietro" ;tag=ntlug
To: "Pietro" ;tag=as49faff1f
Call-ID: mqezxbywgtulavj@bertuccia
CSeq: 681 REGISTER
Server: Asterisk PBX 1.6.2.2
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
Supported: replaces, timer
Expires: 3600
Contact: ;expires=3600
Date: Thu, 04 Feb 2010 22:23:35 GMT
Content-Length: 0

Here is the chan_sip.c patch against Asterisk 1.6.2.2

Index: channels/chan_sip.c
===================================================================
--- channels/chan_sip.c (revision 244766)
+++ channels/chan_sip.c (working copy)
@@ -1825,6 +1825,7 @@
        AST_STRING_FIELD(context);      /*!< Default context for incoming calls */
        AST_STRING_FIELD(subscribecontext); /*!< Default context for subscriptions */
        AST_STRING_FIELD(username);     /*!< Temporary username until registration */ 
+       AST_STRING_FIELD(authuser);     /*!< Username used during inbound authentication */ 
        AST_STRING_FIELD(accountcode);      /*!< Account code */
        AST_STRING_FIELD(tohost);       /*!< If not dynamic, IP address */
        AST_STRING_FIELD(regexten);         /*!< Extension to register (if regcontext is used) */
@@ -13011,7 +13012,9 @@
            ast_copy_flags(&p->flags[0], &peer->flags[0], SIP_NAT);
            if (ast_test_flag(&p->flags[1], SIP_PAGE2_REGISTERTRYING))
                transmit_response(p, "100 Trying", req);
-           if (!(res = check_auth(p, req, peer->name, peer->secret, peer->md5secret, SIP_REGISTER, uri, XMIT_UNRELIABLE, req->ignore))) {
+           if (strcmp(peer->authuser, peer->name))
+               ast_log(LOG_NOTICE, "Trying athenticate peer '%s' using authuser: '%s'\n", peer->name, peer->authuser);
+           if (!(res = check_auth(p, req, peer->authuser, peer->secret, peer->md5secret, SIP_REGISTER, uri, XMIT_UNRELIABLE, req->ignore))) {
                if (sip_cancel_destroy(p))
                    ast_log(LOG_WARNING, "Unable to cancel SIP destruction.  Expect bad things.\n");

@@ -14006,7 +14009,7 @@
        ast_string_field_set(p, peersecret, NULL);
        ast_string_field_set(p, peermd5secret, NULL);
    }
-   if (!(res = check_auth(p, req, peer->name, p->peersecret, p->peermd5secret, sipmethod, uri2, reliable, req->ignore))) {
+   if (!(res = check_auth(p, req, peer->authuser, p->peersecret, p->peermd5secret, sipmethod, uri2, reliable, req->ignore))) {
        ast_copy_flags(&p->flags[0], &peer->flags[0], SIP_FLAGS_TO_COPY);
        ast_copy_flags(&p->flags[1], &peer->flags[1], SIP_PAGE2_FLAGS_TO_COPY);
        /* If we have a call limit, set flag */
@@ -15386,6 +15389,7 @@
        }
        ast_cli(fd, "  Secret       : %s\n", ast_strlen_zero(peer->secret)?"<Not set>":"<Set>");
        ast_cli(fd, "  MD5Secret    : %s\n", ast_strlen_zero(peer->md5secret)?"<Not set>":"<Set>");
+       ast_cli(fd, "  Auth User    : %s\n", peer->authuser);
        ast_cli(fd, "  Remote Secret: %s\n", ast_strlen_zero(peer->remotesecret)?"<Not set>":"<Set>");
        for (auth = peer->auth; auth; auth = auth->next) {
            ast_cli(fd, "  Realm-auth   : Realm %-15.15s User %-10.20s ", auth->realm, auth->username);
@@ -23706,8 +23710,10 @@
        set_peer_defaults(peer);    /* Set peer defaults */
        peer->type = 0;
    }
-   if (!found && name)
+   if (!found && name) {
        ast_copy_string(peer->name, name, sizeof(peer->name));
+       ast_string_field_set(peer, authuser, name); /* Set default authuser == peername*/
+   }

GNU/Find posix acl support

2009-09-28T18:25:00+02:00

Cercare file che corrispondono a delle acl posix all'interno di un filesystem molto intricato è sempre un delirio.

Questa patch aggiunge l'opzione -acl al comando find (GNU/Findutils).

Esempio d'uso:

$ touch 1 2 3 4
$ mkdir 5
$ setfacl -m u:root:rx 1
$ setfacl -m g:bin:rw 2
$ setfacl -m u:pietro:--- 3
$ setfacl -m g:bin:rw 3
$ setfacl -m g:wheel:r 4
$ setfacl -m d:u:root:rwx 5
$ touch 5/6
$ setfacl -m g:wheel:r 5/6

$ find . -acl u:root:rx
./1
$ find . -acl u:root:*
./1
./5/6
$ find . -acl u:*:rx
./1
$ find . -acl g:*:*
./4
./3
./5/6
./2
$ find . -acl d:u:*:*
./5

Questa patch e' stata testata solo su Linux, è scaricabile qua: https://github.com/pbertera/junk/tree/master/findutils-acl è disponibile per la versione 4.42 e 4.5.6 di findutils

Verbose bash history

2009-07-02T08:58:00+02:00

Usando questo codice durante l'inizializzasione della shell viene salvata una command history nel file .bash_verbose_history contenete data e ora, tty (oppure l'ip se l'utente è collegato in ssh) eil comando eseguito. Inoltre evita la sovrascrittura del file .bash_verbose_history e .bash_history eseguendone una copia quando il file raggiunge le 3000 righe.

/etc/bashrc

HISTSIZE=4000
HISTFILESIZE=4000

for f in .bash_history .bash_verbose_history; do
        if [ `wc -l $HOME/$f | awk '{print $1}'` -gt 3000 ] ; then
                cp -f $HOME/$f $HOME/$f-`date -I`
        fi
done

if [ -n "$SSH_CLIENT" ]; then
        TTY=`echo $SSH_CLIENT| cut -d   -f1`
else
        TTY=`tty | sed -e "s:/dev/::"`
fi

PROMPT_COMMAND="${PROMPT_COMMAND:+$PROMPT_COMMAND ; }"'echo `date +"%Y-%m-%d %k:%M:%S"` $USER $TTY "$(history 1)" >> ~/.bash_verbose_history'

VPN layer 3 con OpenSSH

2008-12-22T13:48:00+01:00

Dalla versione 4.3 di OpenSSH è stato introdotto il supporto per TUN/TAP. Questo sigifica che è possibile stabilire un tunnel cifrato tra due peer o due (o piu) reti.
Questo script si occupa di fare il discover dei device tun da utilizzare, assegnare gli indirizzi e le rotte al tunnel (locali e sul peer remoto) ed eseguire comandi aggiuntivi tramite un file di configurazione.

testvpn.conf:

SSH_OPTS="-i /home/pietro/.ssh/id_dsa" # optional: options for ssh command
RUSER=root  # user to login on remote peer
PEER=172.42.10.2 # ip of remote peer
RTUNADDR=10.10.100.2 # remote ip of tunnel
LTUNADDR=10.10.100.1 # local ip of tunnel
#LOCAL_TUN=tun0 #optional: static definition of local tun device
#REMOTE_TUN=tun1 #optional: static definition of remote tun device
REMOTE_NET=172.16.40.1 # remote network
ENABLE_PEER_IP_FORWARD=true # enable ip forwarding on remote host
TRY_LOAD_PEER_TUN_MOD=true # try loading tun/tap kernel module
BAILOUT_COMMAND="logger died"
# in POST_TUN_PEER_COMMAND and POST_TUN_LOCAL_COMMAND use ' instead " !!!
# $LOCAL_TUN is local tun device
# $REMOTE_TUN is remote tun device
POST_TUN_PEER_COMMAND='iptables -I FORWARD -i $REMOTE_TUN -j ACCEPT' # optional: command to execute on remote peer
POST_TUN_LOCAL_COMMAND='ip route add 192.168.6.0/24 via $RTUNADDR dev $LOCAL_TUN' # optional: command to execute on local peer
LOCAL_IP="ip" # optional: local ip command binary
REMOTE_IP="ip" # optional: remote ip command binary
SSH="ssh" # optional: ssh binary

Reading Windows and Office product key

2008-12-17T15:04:00+01:00

I product key di M\$ Windows e Office vengono salvati nel registro in alcune chiavi cifrate
Pygetkey decifra le chiavi e le stampa a video oppure le salva in chiaro in un'altra chiave di registro. Puo' inoltre preleveare i product key da un pc remoto.

Pygetkey è scritto in python e richiede un'installazione di python 2.X per windows

Esempio: pygetkey -c SYSTEMTest creerà i valori WINDOWS-KEY e OFFICE-2007-KEY all'interno della chiave HKEY_LOCAL_MACHINESYSTEMTest:

[HKEY_LOCAL_MACHINESYSTEMTest] "WINDOWS-KEY"="XQM13-K3M7R-32HRX-XF3Q-GMF63" "OFFICE-2007-KEY"="JPBW9-BPY6B-79M9M-RJYJV-6G5B6"

i valori vengono creati sotto l'albero di registro HKEY_LOCAL_MACHINE nella chiave specificata dal parametro -c e potranno avere i seguenti nomi:

WINDOWS-KEY: la chiave di windows
OFFICE-{2000,2007,2003,XP}-KEY: le chiavi di office trovate a seconda della versione

La chiave specificata dal comando DEVE esistere, in caso contrario verrà ritornato un errore.

L'opzione -r HOST indica a pygetkey di interrogare un host remoto.

Leggere chiavi di registro su un pc remoto:
readrreg.py è ingrado di leggere le chiavi di registro da un pc remoto:

C:devgetkey>readrreg.py -k "SYSTEMTest" -r RemotePC office-2007-key: XQM13-K3M7R-32HRX-XF3Q-GMF63 windows-key: JPBW9-BPY6B-79M9M-RJYJV-6G5B6

Creazione dei binari
E' possibile creare un eseguibile di pygetkey e readrreg in modo da non installare python sui pc, per creare i binari occorre
installare py2exe (http://www.py2exe.org) per l'appropriata versione di

Python ed eseguire il seguente comando: python.exe setup.py py2exe

Qesto creera' una directory dist contente dei file, quelli strettamente necessari all'esecuzione di pygetkey.exe e readrreg.exe sono:

pygetkey.exe
readrreg.exe
library.zip
python25.dll (il 25 dipende dalla versione di Python installata)
MSVCR71.dll

PS: non sono sicuro funzioni correttamente con Office 2000

Download:

pygetkey è scaricabile qua

python è scaricabile all'indirizzo: http://www.python.org
py2exe è scaricabile all'indirizzo: http://www.py2exe.org

Worstbit posix acl

2008-09-26T18:05:00+02:00

Software C che si occupa dell'encode e decode dei filename contenuti nei dump del comando

 getfacl -R

https://github.com/pbertera/junk/tree/master/worstbit

Check_web_form.py

2008-09-24T16:42:00+02:00

Check script di nagios per eseguire il submit di un form e cercare dei valori nella response del server.

#!/usr/bin/python
# vi:si:et:sw=4:sts=4:ts=4
# -*- coding: UTF-8 -*-
# -*- Mode: Python -*-
#
# Copyright (C) 2006 Bertera Pietro

# This file may be distributed and/or modified under the terms of
# the GNU General Public License version 2 as published by
# the Free Software Foundation.
# This file is distributed without any warranty; without even the implied
# warranty of merchantability or fitness for a particular purpose.
#
# Check web form
# Permette di effettuare il submit di un form HTML e di cercare dei contenuti nella
# response del server
#
# Features:
#
# * Supporto per i Cookie
# * URL personabilizzabile per ricevere i cookie
# * Invio di Header HTTP arbitrari
# * Ricerca nel contenuto e nell'header della response
#
# Esempio:
#
# ./check_web_form -a http://www.spam.com/login.php -i username=CiccioUser -i password=CiccioUser -C "^Logged in as:  CiccioUser"
# Esegue il submit di un form con action="http://www.spam.com/login.php" e passa i campi username=CiccioUser e password=CiccioUser
# e controlla che nel risultato ci sia una riga che inizia con "Logged in as:  CiccioUser"
#
# ./check_web_form -a http://www.spam.com/login.php -i username=user -i password=Passw -H content-type=application/x-www-form-urlencoded -H "User-Agent=Mozilla" -m POST -c -u http://www.spam.com/smolla_il_cookie -R location=http://www.spam.com/*authenticated
#
# * Prende il cookie all' URL http://www.spam.com/smolla_il_cookie (-u)
# * Tramite metodo POST invia gli header content-type=application/x-www-form-urlencoded e User-Agent=Mozilla (-H)
# * Invia i valori username e password (-i)
# * L'invio viene effettuato all'URL http://www.spam.com/login.php (-a)
# * La ricerca del risultato avviene negl'header location della risposta (-R)

# Se l'esito ha buon fine ritorna 0 e stampa OK ...
# Se fallisce ritorna 2 e stampa ERROR ...

import optparse, sys, re
from httplib2 import Http
from urllib import urlencode

class FormSubmitterOptionParser (optparse.OptionParser):

    def check_required (self, opt):
        option = self.get_option(opt)
        if getattr(self.values, option.dest) is None:
            self.error("%s option not supplied" % option)

    def check_method(self):
        method = self.get_option('--method')
        if getattr(self.values, method.dest).upper() not in ('GET', "POST"):
            self.error("HTTP method not implemented use GET or POST")

    def check_input(self):
        input = self.get_option('--input')
        for e in getattr(self.values, input.dest):
            if len(re.split(r's*=s*', e, 1)) != 2:
                self.error("%s must be in format "name=value": %s" % (input, e))

if __name__ == '__main__':
    parser = FormSubmitterOptionParser("usage: %prog [options]")
    parser.add_option('-m', '--method', default='GET', type="string", help="HTTP method (GET or POST), default %default")
    parser.add_option('-i', '--input', action='append', help="input fileld name=value")
    parser.add_option('-a', '--action', action='store', help="Action of form")
    parser.add_option('-c', '--cookie', action='store_true', default=False, help="Support for cookie")
    parser.add_option('-u', '--cookie-url', action='store', help="URL used to retrieve cookie")
    parser.add_option('-H', '--header', action='append', help="Send header hdeadername=HeaderValue")
    parser.add_option('-C', '--content-match', action='store', help='Check for regular expression match in content')
    parser.add_option('-R', '--response-match', action='store', help='Check for regular expression match in response ex: Status=^4??', default=None)
    parser.add_option('-d', '--debug', action="store_true", default=False, help="Debug mode")

    (options,args)=parser.parse_args()

    try:
        # Check required options
        parser.check_required('-a')
        # parser.check_required('-i')
        # check http method
        parser.check_method()
        # check values
        if options.input:
           parser.check_input()

    except  AttributeError, e:
        print "Error: %s" % e
        sys.exit(255)

    # make header dict
    headers = {}
    if options.header != None:
        for val in options.header:
            name = re.split(r's*=s*', val, 1)[0]
            value = re.split(r's*=s*', val, 1)[1]
            headers.update({name: value})

    # make data dict
    fields = {}
    if options.input:
        for val in options.input:
            name = re.split(r's*=s*', val, 1)[0]
            value = re.split(r's*=s*', val, 1)[1]
            fields.update({name: value})

    http = Http()
    #headers = None

    # check in response Header
    if options.response_match != None:
        response_name = re.split(r's*=s*', options.response_match, 1)[0]
        response_value = re.split(r's*=s*', options.response_match, 1)[1]

    # get page to read cookie
    if options.cookie :
        if options.debug:
            print "Sending request to retrieve cookie:"
            print "URL: %s" % options.action
            print "Method: %s" % options.method
            print "Headers: %s" % headers
            print ""

        if options.cookie_url:
            url = options.cookie_url
        else:
            url = options.action
        resp, content = http.request(url , options.method, headers=headers)

        if options.debug:
            print ""
            print "Response: %s" % resp
            print "Content: %s" % content
            print ""

        if resp.has_key('set-cookie'):
            headers.update({'Cookie': resp['set-cookie']})

    try:
        if options.method.upper() == 'GET':
            from urlparse import urlsplit
            from urlparse import urlunsplit

            url = urlsplit(options.action)

            # if exist query string
            if url[3]:
                query_string = url[3] + "&"+urlencode(fields)
            else:
                query_string = urlencode(fields)
            action = urlunsplit((url[0], url[1], url[2], query_string, url[4]))
            body=None

        else:
            action = options.action
            body=urlencode(fields)

        if options.debug:
            print "Sending request:"
            print "URL: %s" % action
            print "Method: %s" % options.method
            print "Headers: %s" % headers
            print "Body: %s" % body
            print ""

        resp, content = http.request(action , options.method, body=body, headers=headers)

    except Exception, e:
        print "CRITICAL : %s" % e
        sys.exit(2)

    if options.debug:
        print ""
        print "Response: %s" % resp
        print "Content: %s" % content
        print ""

    if content:
        if options.content_match:
            try:
                p = re.compile(options.content_match)
            except Exception, e:
                print "Error: regexp not valid: %s" % e
                sys.exit(2)

            m = p.search(content, re.MULTILINE)
            if m:
                print "OK Found: "  + m.group()
                sys.exit(0)

    if options.response_match:
        if resp.has_key(response_name):
            try:
                p = re.compile(response_value)
            except Exception, e:
                print "Error: regexp not valid: %s" % e
                sys.exit(2)

            m = p.search(resp[response_name])
            if m:
                print "OK Found: "  + m.group()
                sys.exit(0)

        else:
            print "CRITICAL: response header %s not found" % response_name
            sys.exit(2)

    print "CRITICAL : Not found"
    sys.exit(2)

Download: check_web_form.py

PowerChute con apcupsd

2008-09-03T17:37:00+02:00

Dalla versione 3.14 apcupsd supporta il protocollo PowerChute di APC:

PowerChute Network Shutdown Driver (PCNET)

I backport per Debian etch: http://www.bertera.it/software/apcupsd

SQL Server backup con Bacula

2008-05-30T17:06:00+02:00

In teoria con una versione recente di Bacula ed il supporto VSS si dovrebbe poter eseguire il backup in maniera consistente prelevando direttamente i file dei database.
Per chi non si fida questa stored procedure esegue il dump di tutti i database utente in file .BAK.

Viene installata ed eseguita tramite questo .bat richiamato da un “ClientRunBeforeJob”. (Ovvio che la directory che contiene i .BAK deve essere compresa nel FIleSet del client).

Lo script post-bakup si occupa di ripulire la directory di appoggio dai dump.

Kecho

2006-05-21T16:41:00+02:00

Kernel echo è un esempio di comunicazione tra userspace e kernelspace
kecho

Nettester

2006-05-21T16:41:00+02:00

un clone di netcat con supporto UDP
nettester

rTCP

2006-05-21T16:40:00+02:00

rTCP è un modulo kernel che inverte i flag fin e syn dei pacchetti tcp diretti verso un dato host.
Installato su due host permette di comunicare con un TCP “inverso”
rtcp

Camilla

2006-05-21T16:38:00+02:00

Camilla è un sistema di booking per camere e case, supporta agenzie multiple e la gestione di calendari e stagioni.

camilla

Arpiglio

2006-05-21T16:36:00+02:00

un tool per forgiare pacchetti ARP/RARP da linea di comando.
arpiglio.c

Wireless Networking in the Developing World

2006-05-21T16:34:00+02:00

Wireless Networking in the Developing World
A powerful interactive packet manipulation program

Hacking della seriale

2006-02-09T16:25:00+01:00

Leggere e modificare lo stato dei pin di seganalzione della seriale:
due script

Software

2006-02-05T16:22:00+01:00

Era un progettino che avevo dato all’università : esegue dei backup differenziali o full utilizzando rsync: Batbu

Bacula: i .deb per sarge della 1.38.5 bacula-1.38.5 UPDATE: non piu' mantenuto

Plugin nagios:

check-imap-login Un plugin per nagios per eseguire un login su un server IMAP (o IMAPS) chek-imap-login
chek-load-login Altro plugin per verificare il carico di una macchina via ssh con due soglie di allarme check_load_ssh
check-horde-login Plugin che fa il logon in horde web mail