Brownian motion

The quick brown fox jumps over the lazy dog

 

Shaper as an effective firewall

Hash-tables based shaper can act as an effective firewall; just take a look.

Now our shaper configurator generates, let’s say, this script for a client’s connection (excerpt):

#
# Contract I-1082,
# connection 606 (0x25e).
#
# input:
/sbin/tc class add dev clients0 classid 1:25e parent 1:fe10 htb rate 96kbit ceil 128kbit quantum 1500 burst 7500 cburst 12500 prio 50
/sbin/tc filter add dev clients0 protocol 802.1q parent 1:0 prio 100 u32 ht 133:5c match ip dst X.X.133.92 flowid 1:25e
/sbin/tc filter add dev clients0 protocol 802.1q parent 1:0 prio 100 u32 ht 133:5d match ip dst X.X.133.93 flowid 1:25e
/sbin/tc filter add dev clients0 protocol 802.1q parent 1:0 prio 100 u32 ht 133:5e match ip dst X.X.133.94 flowid 1:25e
/sbin/tc filter add dev clients0 protocol 802.1q parent 1:0 prio 100 u32 ht 133:5f match ip dst X.X.133.95 flowid 1:25e

Now let’s assume we have a lot of DoS traffic from IP 173.204.53.138 to IP X.X.133.94 — a lot of packets, a client’s bandwidth is exhausted. (Yes, that’s real IP, that was a real DoS attack,-)

All we need is to write a filter into a proper hash table cell:

# input:
/sbin/tc class add dev clients0 classid 1:25e parent 1:fe10 htb rate 96kbit ceil 128kbit quantum 1500 burst 7500 cburst 12500 prio 50
# FIXME:
/sbin/tc filter add dev clients0 protocol 802.1q parent 1:0 prio 100 u32 ht 133:5e match ip src 173.204.53.138 police mtu 1 drop flowid 1:fe49
#
/sbin/tc filter add dev clients0 protocol 802.1q parent 1:0 prio 100 u32 ht 133:5c match ip dst X.X.133.92 flowid 1:25e
/sbin/tc filter add dev clients0 protocol 802.1q parent 1:0 prio 100 u32 ht 133:5d match ip dst X.X.133.93 flowid 1:25e
/sbin/tc filter add dev clients0 protocol 802.1q parent 1:0 prio 100 u32 ht 133:5e match ip dst X.X.133.94 flowid 1:25e
/sbin/tc filter add dev clients0 protocol 802.1q parent 1:0 prio 100 u32 ht 133:5f match ip dst X.X.133.95 flowid 1:25e

«FIXME» — because it’s a manual work, i have to add this feature in my configurator :-)

This filter we have added to a cell, where all filters regarding packets to X.X.133.94 are (there are only one filter normally). And we added it before «normal» filter, which «routes» packets to a client’s class.

This work like this: if a packet from IP 173.204.53.138 has MTU less that 1 byte (physically unreal case) — it should be «routed» to a default class (yes, 1:fe49 is the default class for my shaper now). If this packet has a larger MTU — it should be dropped.

Therefore, our queueing discipline have not to cope with these packets (HTB in my case, but it may be any qdisc).

(No Ratings Yet)

Tags: , , ,
Posted 9 March 2010 in Administration, Programming, Shaper | No Comments »

Python is the winner?-)

Please see some info here. I will translate this post into English, i hope.

;;
 
(use-modules (ice-9 rdelim) (ice-9 regex))
 
(define argv (program-arguments))
 
(define filename (car (cdr (cdr argv))))
(define inputfile (open-input-file filename))
 
(define pattern-string (cadr argv))
(define pattern (make-regexp pattern-string))
 
 
(define records 0)
(define lines 0)
(define selected 0)
 
(define (read-all-lines)
    (let loop ((stack '()) (good #f))
        (let ((line (read-line inputfile)))
            (set! stack (append stack (list line)))
            (set! lines (+ 1 lines))
 
            (if (regexp-exec pattern line)
                (set! good #t)
                (if (equal? "" line)
                    (begin
                        (if (eq? good #t)
                            (begin
                                (for-each (lambda (line) (display line) (newline)) stack)
                                (set! selected (+ 1 selected))))
                        (set! good #f)
                        (set! stack '())
                        (set! records (+ 1 records)))))
 
            (if (not (eof-object? (peek-char inputfile)))
                (loop stack good)))))
 
(read-all-lines)
 
(use-modules (ice-9 format))
 
(format (current-error-port)
"~d records (~d lines) processed
~d records matched
Pattern was: '~a'
" records lines selected pattern-string)
 
;; vim: ts=2:

Scheme:

$ time guile -s fradlog_extract.scm 'Station-Id = \"4494.....\"' detail-20090519 > part-scheme
183764 records (4563405 lines) processed
447 records matched
Pattern was: 'Station-Id = "4494....."'
 
real    0m27.653s
user    0m27.550s
sys     0m0.110s

awk:

$ time awk -f fradlog_extract.awk pattern='Station-Id = \"4494.....\"' detail-20090519 > part-awk
183764 records (4563405 lines) processed
447 records matched
Pattern was: 'Station-Id = "4494....."'
 
real    0m21.680s
user    0m21.490s
sys     0m0.090s

python:

$ time python fradlog_extract.py 'Station-Id = "4494....."' detail-20090519 > part-python
183764 records (4563405 lines) processed
447 records matched
Pattern was: 'Station-Id = "4494....."'
 
real    0m9.766s
user    0m9.670s
sys     0m0.060s
(No Ratings Yet)

Tags: , , , ,
Posted 4 February 2010 in Misc | No Comments »

Messing consoles…

>>> (with-error-to-file (current-error-port) (display "foo"))
  File "", line 1
    (with-error-to-file (current-error-port) (display "foo"))
        ^
SyntaxError: invalid syntax
>>>

Trying to learn Scheme, trying to work with Python…

Yes, right, guile throws another error message, i’ve already learned that :O)

(No Ratings Yet)

Tags: , ,
Posted 4 February 2010 in Misc | No Comments »

REORDER_HDR, again and again

If you wish to use vlan sub-interfaces in linux, and sub-sub-interfaces, and sub-sub-sub-… and if you wish to ping something — sure, you may wish to have them only for switching, but if you wish to ping — don’t forget to re-set REORDER_HDR flag:

ip link set up dev eth2
 
vconfig add eth2 100
ip link set up dev vlan100
vconfig set_flag vlan100 1 0
 
vconfig add vlan100 200
ip link set up dev vlan200
vconfig set_flag vlan200 1 0
 
# ....etc-etc
 
vconfig add vlan800 900
ip link set up dev vlan900
vconfig set_flag vlan900 1 0
 
ip add add 192.168.1.100/24 brd 192.168.1.255 dev vlan900
 
ping 192.168.1.3

Note using command vconfig set_flag DEV 1 0 — i mean exactly this :-)

Now (since 2.6.x?.. can’t remember, doesn’t matter) Linux kernel creates vlan interfaces with REORDER_HDR=1.

You can verify current value of REORDER_HDR flag with command like this:

# cat /proc/net/vlan/vlan900
vlan900  VID: 900	 REORDER_HDR: 0  dev->priv_flags: 1
         total frames received          172
          total bytes received       222546
      Broadcast/Multicast Rcvd            0

      total frames transmitted          405
       total bytes transmitted       283743
            total headroom inc            0
           total encap on xmit           26
Device: vlan900
INGRESS priority mappings: 0:0  1:0  2:0  3:0  4:0  5:0  6:0 7:0
 EGRESS priority mappings:
(No Ratings Yet)

Tags: ,
Posted 23 November 2009 in Misc | No Comments »

“Давай о другом”?.. — Ні, не давай

Це все — про гарного хлопця і його дружину, яку я, на жаль, жодного разу не бачив. Не встиг?.. Не зумів, напевно.

— Давай, если хочешь…
Красивый закат…
А как на работе?
— Нормально пока…
А правда, как горы стоят облака?..
— Действительно, горы… Как сказочный сон…
— А сколько он падал?..
— …Там — метров шестьсот…

Юрій Візбор

…и когда ты без кожи останешься вдруг
оттого, что убили его, не тебя…

Володимир Висоцький

…и не о том же речь,
что я их мог, но не сумел сберечь, —
речь не о том,
но все же, все же, все же…

Олександр Твардовський

Нет, ребята! Все не так!
Все не так, ребята…

Володимир Висоцький

…И там, где окончится глиняная дорога,
Увижу дожди, но не вымокну и не остыну.
Я понял закон
и увидел летящего Бога
и Сына.
Я умер. Не плачьте. Молитесь.
Я выше и выше.
И голубь струится на землю под трубные звуки.
Я, кажется, вышел.
Я вижу: над домом не крыша,
а РУКИ.

Ганна Куземська

(No Ratings Yet)

Tags:
Posted 19 November 2009 in Misc | No Comments »