<?xml version="1.0" encoding="utf-8"?>
<feed xmlns="http://www.w3.org/2005/Atom">
    <title>ChaseVenters.org</title>
    <link rel="alternate" type="text/html" href="http://www.chaseventers.org/" />
    <link rel="self" type="application/atom+xml" href="http://www.chaseventers.org/atom.xml" />
    <id>tag:www.chaseventers.org,2009-01-17://1</id>
    <updated>2012-02-13T03:27:28Z</updated>
    <subtitle>Software development, systems administration, information security, the Internet, and electronic music</subtitle>
    <generator uri="http://www.sixapart.com/movabletype/">Movable Type 4.31-en</generator>

<entry>
    <title>Modifying Your Sports Car</title>
    <link rel="alternate" type="text/html" href="http://www.chaseventers.org/2012/02/modifying-your-sports-car.html" />
    <id>tag:www.chaseventers.org,2012://1.48</id>

    <published>2012-02-12T21:17:25Z</published>
    <updated>2012-02-13T03:27:28Z</updated>

    <summary>I want a fast car! When I was 15 I got a ride in a friend&apos;s WS6. In addition to looking great, it was my first experience with a fast car. I was hooked, and for a while I was...</summary>
    <author>
        <name>Chase Venters</name>
        <uri>http://www.chaseventers.com/</uri>
    </author>
    
    <category term="cars" label="cars" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="etc" label="etc" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="rant" label="rant" scheme="http://www.sixapart.com/ns/types#tag" />
    
    <content type="html" xml:lang="en" xml:base="http://www.chaseventers.org/">
        <![CDATA[<p><b>I want a fast car!</b></p>

<p>When I was 15 I got a ride in a friend's WS6. In addition to looking great, it was my first experience with a fast car. I was hooked, and for a while I was convinced I'd get myself a WS6 when I turned 16.</p>

<p>At 16, of course, I didn't have tens of thousands of dollars to drop on a new car. I was very fortunate that my parents bought me a used Honda Prelude, and I showed my gratitude by totaling it a month later when I tried to negotiate a turn too quickly in the rain. If there is anything I learned from the Prelude (other than the fact that it really sucks to wreck your new car), it was that I could perform simple maintenance on a car, such as an oil change, in my garage.</p>

<p>16, and my high school years in general, occurred during the rise of the rice-burner in America. Imports outnumbered domestics at my school and every morning and afternoon featured a soundtrack of coffee can exhausts farting in and out of the parking lot. There was a giant pissing match between everybody and everybody else over whose car is faster.</p>

<p>Most of us were just dreamers with no means. I replaced the Prelude with a Nissan 240sx and sat to work modifying it -- that is, dreaming of modifying it. I was going to convert it to a Turbo Silvia. But I didn't have any money.</p>

<p>Fate (and my own stupidity) eventually took hold and I smashed the 240sx too. I ended up in a cheaper 5 spd Nissan Sentra. The biggest "mod" the Sentra ever received was a transplant of a decent custom stereo that was once installed in the 240sx. But as I drove this beater over the years, I swapped two clutches, and practically the whole ignition system. I started to gain real confidence that I knew how to work on cars.</p>

<p>Eventually, as a young adult, I took out a loan and swapped the Sentra for a Mazda Miata. I didn't have a lot of money, but I had some, and I was soon pouring money into modifying the Miata. It seemed like the dream I always had about upgrading a car was finally coming true. I was so excited that I barely noticed when a professional mechanic advised me not to get into heavily modifying my daily driver -- especially if I am not a professional mechanic prepared to keep it running. I ignored this advice again when a friend with a heavily modified 350z explained his regrets at having destroyed the car's reliability.</p>

<p>I suppose I thought that they were part of a "club" that didn't want new members. In reality, they were just ensuring they would eventually get a big "I told you so!"</p>

<p><b>I'll build a fast car!</b></p>

<p>I started with a simple tune-up. The car ran a little smoother, but it was no faster.</p>

<p>I added custom seat heaters. They were a nice mod. But it was no faster.</p>

<p>Being a Texas driver, my Miata was often stuck in traffic on hot days. This led to a number of incidents when the car would overheat and require me to switch from comforting A/C to blistering heat. In went my first high-dollar mod, a thousand-dollar aluminum race radiator combined with an oil cooler. I dropped another $400 on a custom fan shroud with two large electric fans. I felt great about my investment, but I still had problems on hot days. And the car was no faster.</p>

<p>Naturally, any fast car should handle very well. The Miata is known for handling well from the factory, and for being very easy to drive, but I decided to supercharge the handling. I bought upgraded anti-roll bars, dropped 2k on a custom coil-over suspension and spent half a grand on 28 replacement suspension bushings from a performance part manufacturer in England.</p>

<p>I installed the coil-overs myself but was not prepared to tackle the massive task of installing bushings alone. I paid a friendly mechanic with a brand new intake for his car (taking another $400 out of my own pocket) and we spent a day doing the bushings with a real lift and hydraulic press. Towards the end of the evening we were both tired, and when he started using the impact wrench to torque down my eccentrics while the wheels were still sagging, I didn't have much energy left to argue the merits of doing the job properly (while the car was resting on its own weight). Although all the bushings were now installed with preloaded stress, the car felt great, and though it didn't accelerate any faster, it probably cornered faster.</p>

<p><b>Nevermind <i>that</i> broken part, I'll just keep upgrading!</b></p>

<p>Before the bushings started to fail, the custom lexan fan shroud was cracking. This gentleman's home-built radiator shroud design was not thought out well. In addition to falling apart, the foam used to seal up the shroud around the edges was melting and forming a disgusting goo on the radiator. I should have stopped there and gotten a real fan shroud, but I was too interested in spending money on more fun parts for the car.</p>

<p>By this time it was clear that I wanted a supercharger. After seeing a deal online for $500 off on an MP62 kit, I put it on a credit card and ended up with a pristine, brand new supercharger in a cardboard box in my closet. Installing the supercharger would be a big ordeal and there was a lot of prep work I'd have to do.</p>

<p>I installed an upgraded header and heat wrapping. The car sounded a little better, and it may have been faster (by a very small amount). But I still wasn't ready to install the supercharger.</p>

<p>In order to support the load of the supercharger, I'd need a new performance clutch. I spent the money on a Stage 3 clutch and decided to get a lightweight flywheel to make the engine rev faster while I was at it. $1000 later I was underneath the car, swapping in the new parts. I thought I would go ahead and replace the rear main seal (which wasn't leaking oil) with a new one. Preventative maintenance and all.</p>

<p>Eventually I decided to get smart and run a compression test on the engine. Bad news -- I needed new rings. That was going to be expensive and would further delay my supercharger installation. But no matter, I was making progress towards my dream. I was going to finish building my fast car.</p>

<p>Unfortunately, dreams are often just that. My car was already less reliable than when I started. I needed frequent alignments to keep the lowered car driving correctly. I was going through tires. And before long, I noticed the car was leaking oil -- from the transmission bellhousing. My brand new $1000 clutch setup started to slip, and then slip more. A year after purchase, its warranty already having expired, I still had the supercharger sitting in a box in my closet.</p>

<p>I must have screwed up the rear main seal. I decided that I needed to replace the clutch. This time I paid a professional Miata shop to do the work. $1000 later I had a new clutch and a resurfaced flywheel. The oil leak had destroyed the old clutch and flywheel. At least the pros did it this time. They replaced my rear main seal again. Surely they would do it correctly.</p>

<p>My fan shroud was falling apart even worse than before. The car started making bad noises when I went over bumps and the handling began to degrade. My suspension bushings were beginning to fail, the result of cutting corners in the install procedure. I poured in yet more money to start replacing these parts as they went.</p>

<p>And then I noticed more oil leaking from the bellhousing. I should have twisted the shop's arm to fix the problem. Instead, I waited a year until the damage was already done.</p>

<p><b>It's just a freaking money pit!</b></p>

<p>My priorities started changing. The Miata is a fun car but there were new things in my life. I had turntables and a small but growing collection of music software. I started pursuing a more productive hobby.</p>

<p>I decided to hawk the brand new supercharger in my closet. I sold it at a loss.</p>

<p>I still have frame rail reinforcements, and a set of new rear drive gears for a different ratio. I still have top of the line sound deadening material I never installed. If I'm lucky, I'll be able to sell some of those parts at a loss too.</p>

<p>By now I was just trying to keep the car running as a daily driver. The clutch continued to get worse and I had to replace the $150 dry cell battery with another one after it lasted no longer than a standard battery. (The factory Panasonic battery the car came with was in no way worn out when I installed the first dry cell battery. It was just another "upgrade")</p>

<p>On the way home from work one day, a driver in a Tahoe was too busy chatting on his cell phone to notice my Miata in the lane next to him, and so he slammed my car into a guardrail. Both of our insurance companies quickly reminded me that the thousands of dollars of custom work done to the car did nothing to increase its actual value. I knew this before I started modifying the car, but it was still a punch in the gut.</p>

<p><b>You told me so!</b></p>

<p>In the end, I caused the Miata enough problems that it actually became slower.</p>

<p>It's true what they say. Modifying a car is an expensive, time consuming proposition. Cars are already depreciating assets; adding custom parts to them makes it even worse.</p>

<p>When cars leave the manufacturer, assuming the vehicle is of reasonable quality, it will have reasonable durability. Virtually everything you do to "customize" beyond the factory specs will negatively impact the longevity. Custom parts break much more often than factory ones, and custom parts often break the factory parts you plug them into.</p>

<p>If I had it all to do over again, I would have upgraded the stereo and installed the seat heaters. I wouldn't have upgraded anything else. I should have just fixed problems when they came up. But like so many things in life, I learned this lesson the hard way.</p>]]>
        
    </content>
</entry>

<entry>
    <title>Migrating from old krb5/NFSv4 to newer krb5/NFSv4</title>
    <link rel="alternate" type="text/html" href="http://www.chaseventers.org/2011/11/migrating-from-old-krb5nfsv4-to-newer-krb5nfsv4.html" />
    <id>tag:www.chaseventers.org,2011://1.47</id>

    <published>2011-11-11T06:17:08Z</published>
    <updated>2011-11-11T06:26:00Z</updated>

    <summary>I thought I&apos;d post a quick tip for anyone upgrading a set of clients in a kerberized NFSv4 network. I&apos;m in the process of pushing out CentOS 6 to a cluster currently supported by NFSv4 on CentOS 5 and my...</summary>
    <author>
        <name>Chase Venters</name>
        <uri>http://www.chaseventers.com/</uri>
    </author>
    
    <category term="krb5" label="krb5" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="nfs" label="nfs" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="sysadmin" label="sysadmin" scheme="http://www.sixapart.com/ns/types#tag" />
    
    <content type="html" xml:lang="en" xml:base="http://www.chaseventers.org/">
        <![CDATA[<p>I thought I'd post a quick tip for anyone upgrading a set of clients in a kerberized NFSv4 network. I'm in the process of pushing out CentOS 6 to a cluster currently supported by NFSv4 on CentOS 5 and my standard "setup krb5/nfsv4 client" script didn't leave me with a working client. Instead, I got this error on the NFS server every time I attempted the NFS mount:</p>

<pre>
gss_kerberos_mech: unsupported algorithm 6
</pre>

<p>or</p>

<pre>
gss_kerberos_mech: unsupported algorithm 23
</pre>

<p>Some <a href="http://www.spinics.net/lists/linux-nfs/msg18450.html">advice</a> pointed out that the keytab might need to be written out without the newer key types, but attempting to limit to des-cbc-crc did not fix the problem.</p>

<p>Instead, I found that the following settings in the [libdefaults] section of /etc/krb5.conf fixed my environment:</p>

<pre>[libdefaults]
 # cventers: These overrides are TEMPORARY until we have abandoned CentOS 5
 default_tgs_enctypes = des-cbc-md5 des-cbc-crc arcfour-hmac-md5 arcfour-hmac-exp
 default_tkt_enctypes = des-cbc-md5 des-cbc-crc arcfour-hmac-md5 arcfour-hmac-exp
 permitted_enctypes = des-cbc-md5 des-cbc-crc arcfour-hmac-md5 arcfour-hmac-exp
 allow_weak_crypto = true</pre>]]>
        
    </content>
</entry>

<entry>
    <title>qpsmtpd plugins</title>
    <link rel="alternate" type="text/html" href="http://www.chaseventers.org/2011/04/qpsmtpd-plugins.html" />
    <id>tag:www.chaseventers.org,2011://1.46</id>

    <published>2011-04-07T00:24:48Z</published>
    <updated>2011-04-07T00:41:11Z</updated>

    <summary>As part of deploying a new Postfix-and-qpsmtpd based mail architecture at work, I have developed some qpsmtpd plugins and extended its native queue/smtp-forward plugin. filter/dkimsign: Signs e-mail using Mail::DKIM. There are a other dkimsign plugins out there but I wanted...</summary>
    <author>
        <name>Chase Venters</name>
        <uri>http://www.chaseventers.com/</uri>
    </author>
    
    <category term="email" label="email" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="oss" label="oss" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="plugins" label="plugins" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="qpsmtpd" label="qpsmtpd" scheme="http://www.sixapart.com/ns/types#tag" />
    
    <content type="html" xml:lang="en" xml:base="http://www.chaseventers.org/">
        <![CDATA[<p>As part of deploying a new Postfix-and-qpsmtpd based mail architecture at work, I have developed some qpsmtpd plugins and extended its native <tt>queue/smtp-forward</tt> plugin.</p>

<ol>
 <li><b><tt>filter/dkimsign</tt></b>: Signs e-mail using <a href="http://search.cpan.org/perldoc?Mail::DKIM">Mail::DKIM</a>. There are a <a href="http://alecto.bittwiddlers.com/files/qpsmtpd/dkimsign">other</a> <a href="http://chaos.ks.ua/pub/dkimsign">dkimsign</a> plugins out there but I wanted to take a stab at doing one myself.</li>
 <li><b><tt>filter/header_whitelist</tt></b>: Possibly controversial, could break many things if misused. I wanted a way to clean up all the extra garbage version headers, etc added by the multitude of scripts and platforms generating email in our environment. If the mere existence of this plugin doesn't violate RFC2822 or e-mail best practices, certain configurations certainly would. Use with care.</li>
 <li><b><tt>queue/smtp-forward</tt></b>: I have extended the stock plugin to support the Postfix <a href="http://www.postfix.org/XCLIENT_README.html">XCLIENT</a> verb. This allows a qpsmtpd to pass information about the client (their IP and HELO, in particular) which Postfix can then use for access control and/or logging. I'll try and submit this back upstream.</li>
</ol>

<p>You can find the plugins at <a href="https://github.com/cventers/qpsmtpd-plugins">my GitHub page</a>.</p>]]>
        
    </content>
</entry>

<entry>
    <title>Southwest In-Flight Wifi Review</title>
    <link rel="alternate" type="text/html" href="http://www.chaseventers.org/2010/11/southwest-in-flight-wifi-review.html" />
    <id>tag:www.chaseventers.org,2010://1.45</id>

    <published>2010-11-19T02:14:51Z</published>
    <updated>2010-11-19T06:01:27Z</updated>

    <summary>I just took a Southwest Airlines flight that was wifi enabled. I couldn&apos;t resist the temptation to give the wifi a spin. My review, in a nutshell? It costs $5, it appears to work with (at least) HTTP(S), Outlook, and...</summary>
    <author>
        <name>Chase Venters</name>
        <uri>http://www.chaseventers.com/</uri>
    </author>
    
    <category term="bandwidth" label="bandwidth" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="performance" label="performance" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="ping" label="ping" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="southwest" label="southwest" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="speedtest" label="speedtest" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="wifi" label="wifi" scheme="http://www.sixapart.com/ns/types#tag" />
    
    <content type="html" xml:lang="en" xml:base="http://www.chaseventers.org/">
        <![CDATA[<p>I just took a <a href="http://www.southwest.com/">Southwest Airlines</a> flight that was wifi enabled. I couldn't resist the temptation to give the wifi a spin.</p>

<p>My review, in a nutshell? It costs $5, it appears to work with (at least) HTTP(S), Outlook, and ssh... but the performance leaves something to be desired.</p>

<p><blockquote><img src="http://www.speedtest.net/result/1036230054.png" border="0" alt="In-flight Wifi Speed Test"/></blockquote></p>

<p>The Wifi gateway also appears to mangle HTML passing through it in order to display a Southwest airlines banner over the top of the pages. This does provide some function -- it indicates your current altitude and ETA. But they could have included a way to disable the behavior.</p>

<p>The bottom line? It works, and that much is neat. But given the performance limitations (and keep in mind this is just one data point), I doubt its utility for anything but basic surfing. But on a long flight, I don't think books or magazines could make the time pass by with such ease.</p>]]>
        
    </content>
</entry>

<entry>
    <title>VIM Plugin: Makesd/Makecsd</title>
    <link rel="alternate" type="text/html" href="http://www.chaseventers.org/2010/09/vim-plugin-makesdmakecsd.html" />
    <id>tag:www.chaseventers.org,2010://1.44</id>

    <published>2010-09-24T12:32:50Z</published>
    <updated>2010-09-24T12:38:52Z</updated>

    <summary>I wanted to share a little VIM plugin I just got done writing, makesd.vim. This plugin is pretty straightforward, and is adapted from a couple of Perl command-line scripts I tend to haul around called makesd and makecsd. In short,...</summary>
    <author>
        <name>Chase Venters</name>
        <uri>http://www.chaseventers.com/</uri>
    </author>
    
    <category term="makesd" label="makesd" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="oss" label="oss" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="vim" label="vim" scheme="http://www.sixapart.com/ns/types#tag" />
    
    <content type="html" xml:lang="en" xml:base="http://www.chaseventers.org/">
        <![CDATA[<p>I wanted to share a little VIM plugin I just got done writing, <a href="/downloads/makesd.vim"><tt>makesd.vim</tt></a>. This plugin is pretty straightforward, and is adapted from a couple of Perl command-line scripts I tend to haul around called <tt>makesd</tt> and <tt>makecsd</tt>.</p>

<p>In short, they produce clean looking separators for use inside source code:</p>

<pre style="font-size: 0.8em">:Makesd "Public Interface"
# ========================================================================== #
# ============================ Public Interface ============================ #
# ========================================================================== #
</pre>
<br/>
<pre style="font-size: 0.8em">:Makecsd "Public Interface"
/* ======================================================================== */
/* =========================== Public Interface =========================== */
/* ======================================================================== */
</pre>

<p>It's my first VIM script. VIM scripting is pretty easy -- <a href="http://vimdoc.sourceforge.net/htmldoc/usr_41.html">give it a try</a>!</p>]]>
        
    </content>
</entry>

<entry>
    <title>Brain Damage</title>
    <link rel="alternate" type="text/html" href="http://www.chaseventers.org/2010/09/brain-damage.html" />
    <id>tag:www.chaseventers.org,2010://1.43</id>

    <published>2010-09-23T18:35:34Z</published>
    <updated>2010-09-23T18:45:27Z</updated>

    <summary>Another one for the record books. Once again, the kind folks at Redmond have proven how truly incompetent they are, and why at the end of the day, a power user can only survive on an open source platform. Microsoft...</summary>
    <author>
        <name>Chase Venters</name>
        <uri>http://www.chaseventers.com/</uri>
    </author>
    
    <category term="email" label="email" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="microsoft" label="microsoft" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="outlook" label="outlook" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="rant" label="rant" scheme="http://www.sixapart.com/ns/types#tag" />
    
    <content type="html" xml:lang="en" xml:base="http://www.chaseventers.org/">
        <![CDATA[<p>Another one for the record books. Once again, the kind folks at <a href="http://www.microsoft.com/">Redmond</a> have proven how truly incompetent they are, and why at the end of the day, a power user can only survive on an open source platform.</p>

<p>Microsoft has <b>stripped</b> the ability to save raw e-mail messages from Outlook 2007. Supposedly this capability exists in Outlook Express and/or Windows Mail. But there are mountains of <a href="http://www.experts-exchange.com/Software/Office_Productivity/Groupware/Outlook/Q_23590428.html">bad</a> <a href="http://superuser.com/questions/75581/how-to-save-a-mail-into-an-eml-file-with-outlook">advice</a> suggesting that export to those programs, followed by an import, or an export to .txt, is an acceptable alternative. (It isn't, in all cases, the transport headers aren't included. Who knows how else Microsoft is molesting the message).</p>

<p>Commercial solutions exist - one for only $14 (are you kidding me?) and one for over $60 (are you kidding me???)</p>]]>
        
    </content>
</entry>

<entry>
    <title>transocks_ev Patch: DNS, Performance, Reliability, Logging</title>
    <link rel="alternate" type="text/html" href="http://www.chaseventers.org/2010/09/transocks-ev-patch-dns-performance-reliability-logging.html" />
    <id>tag:www.chaseventers.org,2010://1.42</id>

    <published>2010-09-20T23:39:00Z</published>
    <updated>2010-09-21T00:24:00Z</updated>

    <summary>I&apos;ve put out a new transocks_ev patch transocks_ev-performance-reliability-dns-logging.patch. transocks_ev is a neat little program by Bernd Holzmueller at tiggersWelt.net that uses the Linux netfilter/iptables stack to intercept outgoing TCP connections and transparently convert them into SOCKS5 proxy connections. It&apos;s based...</summary>
    <author>
        <name>Chase Venters</name>
        <uri>http://www.chaseventers.com/</uri>
    </author>
    
    <category term="libevent" label="libevent" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="loadbalancing" label="load balancing" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="oss" label="oss" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="patch" label="patch" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="postfix" label="postfix" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="socks" label="socks" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="sysadmin" label="sysadmin" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="transocks" label="transocks" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="transocks_ev" label="transocks_ev" scheme="http://www.sixapart.com/ns/types#tag" />
    
    <content type="html" xml:lang="en" xml:base="http://www.chaseventers.org/">
        <![CDATA[<p>I've put out a new <a href="http://oss.tiggerswelt.net/transocks_ev/">transocks_ev</a> patch <a href="/downloads/transocks_ev-performance-reliability-dns-logging.patch"><tt>transocks_ev-performance-reliability-dns-logging.patch</tt></a>. transocks_ev is a neat little program by Bernd Holzmueller at <a href="http://oss.tiggerswelt.net/">tiggersWelt.net</a> that uses the Linux <a href="http://www.netfilter.org/">netfilter</a>/iptables stack to intercept outgoing TCP connections and transparently convert them into SOCKS5 proxy connections. It's based on <a href="http://transocks.sourceforge.net/">transocks</a> which does the same thing. transocks uses a forking model, while transocks_ev uses <a href="http://www.monkey.org/~provos/libevent/">libevent</a> to multiplex connections in a single process's event loop.</p>

<p>I'm planning on using these changes to transparently intercept outgoing <a href="http://www.postfix.org/">Postfix</a> SMTP connections on some backend mail servers and to use DNS-based load balancing to fan those connections out across multiple proxy servers/Internet connections.</p>

<p>In addition, I've improved the logging support of transocks_ev, giving it three levels of verbosity with basic statistics collection for the connections. All blocking operations have been converted to non-block (connect(), write(), the new DNS). The code is using libevent bufferevent to manage low level socket access.</p>]]>
        
    </content>
</entry>

<entry>
    <title>libsoup Ignores DNS TTLs</title>
    <link rel="alternate" type="text/html" href="http://www.chaseventers.org/2010/09/libsoup-ignores-dns-ttls.html" />
    <id>tag:www.chaseventers.org,2010://1.41</id>

    <published>2010-09-19T01:41:03Z</published>
    <updated>2010-09-19T02:00:43Z</updated>

    <summary>I&apos;ve been using libsoup to run a small SOAP engine for one of the back-office programs I maintain. We&apos;ve recently upgraded to a new load-balanced architecture, and we are using DNS-based load balancing to fan these SOAP requests out across...</summary>
    <author>
        <name>Chase Venters</name>
        <uri>http://www.chaseventers.com/</uri>
    </author>
    
    <category term="bug" label="bug" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="dns" label="dns" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="libsoup" label="libsoup" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="loadbalancing" label="load balancing" scheme="http://www.sixapart.com/ns/types#tag" />
    
    <content type="html" xml:lang="en" xml:base="http://www.chaseventers.org/">
        <![CDATA[<p>I've been using <a href="http://live.gnome.org/LibSoup">libsoup</a> to run a small SOAP engine for one of the back-office programs I maintain. We've recently upgraded to a new load-balanced architecture, and we are using DNS-based load balancing to fan these SOAP requests out across our servers.</p>

<p>It only took a few days in production to realize that libsoup was doing something nasty. Prior to any HTTP request, you need to create a <tt>SoupSession</tt> object. This object manages things like connection pools / keepalive. It contains a <tt>GHashTable</tt> called <tt>hosts</tt>, which it uses as a cache of connections to a given hostname.</p>

<pre class='brush: c'>
/* Requires host_lock to be locked */
static SoupSessionHost *
get_host_for_uri (SoupSession *session, SoupURI *uri)
{
    SoupSessionPrivate *priv = SOUP_SESSION_GET_PRIVATE (session);
    SoupSessionHost *host;

    host = g_hash_table_lookup (priv-&gt;hosts, uri);
    if (host)
        return host;

    host = soup_session_host_new (session, uri);
    g_hash_table_insert (priv-&gt;hosts, host-&gt;uri, host);

    return host;
}
</pre>

<p>Unfortunately, entries in this hash table are never removed or expired unless the <tt>SoupSession</tt> object itself goes away. This sucks for a few reasons:</p>

<p><ol>
<li>DNS TTL values are ignored. Instead, the result of the DNS query is cached forever. Obviously this means that if the record is ever changed, libsoup clients need to be restarted to know about it.</li>
<li>DNS load balancing is broken by libsoup, which will repeatedly connect to the same IP address regardless of whether multiple IPs are included in the response to an A query.</li>
<li>You really wouldn't want to write a robot or some other long lived program that would make lots of connections to lots of different hosts using libsoup, as it stands. Aside from the obvious correctness issues listed above, the <tt>hosts</tt> hash table will experience unbounded growth. Thankfully all of our connections are to the same small set of URLs and hostnames.</li>
</ol></p>

<p>I'm not sure how easy it would be to patch libsoup to behave correctly. As far as I can tell the <tt>GResolver</tt> that libsoup relies on doesn't even report TTLs.</p>

<p>Given the nature of this bug I can only see a few workarounds:</p>

<p><ol>
<li>Set the <tt>Host</tt> HTTP header yourself, do the DNS query yourself using <tt>GResolver</tt>, and supply the server's IP address to the <tt>SoupURI</tt> instead of a hostname. This breaks SSL certificate validation.</li>
<li>Recycle/create the <tt>SoupSession</tt> per-request. This breaks keepalive/connection pooling and has obvious overhead issues.</li>
</ol></p>

<p>Given the nature of how I'm using libsoup, I chose the latter option. YMMV.</p>]]>
        
    </content>
</entry>

<entry>
    <title>asterisk-func_dns: Asterisk 1.4 DNS() dialplan function</title>
    <link rel="alternate" type="text/html" href="http://www.chaseventers.org/2010/09/asterisk-func-dns---asterisk-14-dns-dialplan-function.html" />
    <id>tag:www.chaseventers.org,2010://1.40</id>

    <published>2010-09-13T08:07:52Z</published>
    <updated>2010-09-13T09:08:39Z</updated>

    <summary>I&apos;m doing another small code release. This one is asterisk-func_dns, a dialplan function DNS() to do an explicit DNS query without requiring you to launch an external program. It&apos;s an alpha release currently intended for Asterisk 1.4 and only supporting...</summary>
    <author>
        <name>Chase Venters</name>
        <uri>http://www.chaseventers.com/</uri>
    </author>
    
    <category term="asterisk" label="asterisk" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="dns" label="dns" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="loadbalancing" label="load balancing" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="oss" label="oss" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="sysadmin" label="sysadmin" scheme="http://www.sixapart.com/ns/types#tag" />
    
    <content type="html" xml:lang="en" xml:base="http://www.chaseventers.org/">
        <![CDATA[<p>I'm doing another small code release. This one is <a href="http://github.com/cventers/asterisk-func_dns">asterisk-func_dns</a>, a dialplan function DNS() to do an explicit DNS query without requiring you to launch an external program. It's an alpha release currently intended for Asterisk 1.4 and only supporting IPv4 / DNS A record types.</p>

<p>I'm using this to implement DNS-based load-balancing for outgoing calls across a series of proxies and internet connections.<p>

<p>In my dialplan, I request the IP addresses of my proxy servers ahead of any attempt to Dial(). This module returns the list of IP addresses published in the record, separated by commas. This allows me to sequentially fork across the proxy servers, and since I don't need to rely on Dial()'s forking support, I can add additional processing in between attempts. Since I obtain the proxy set by looking up a single DNS name, my Asterisk dialer configurations do not have to change if I add more proxy servers to my network, also meaning that those Asterisk dialers will not waste time trying to contact outbound proxy servers that have gone offline for maintenance or due to a failure. Each Asterisk dialer will try every call amongst all the working proxy servers, up to one attempt each, in a random order.</p>

<p>This code could benefit from some obvious todos: forward port to modern Asterisk versions, implementation of the ability to grab other record types like SRV or AAAA, etc. I may address these eventually but at the moment this is "good enough for me". I release this code (under the same Asterisk licensing terms: GPLv2) with the hopes that someone finds it useful.</p>]]>
        
    </content>
</entry>

<entry>
    <title>Christmas Tree Configuration Files</title>
    <link rel="alternate" type="text/html" href="http://www.chaseventers.org/2010/09/christmas-tree-configuration-files.html" />
    <id>tag:www.chaseventers.org,2010://1.38</id>

    <published>2010-09-09T11:30:00Z</published>
    <updated>2010-09-09T09:08:31Z</updated>

    <summary>Okay, I&apos;m pleading with developers. I&apos;m very impressed at the number of options and switches that your program exposes via its configuration file(s) / directories / databases. Bonus points for those of you who have managed to extensively document each...</summary>
    <author>
        <name>Chase Venters</name>
        <uri>http://www.chaseventers.com/</uri>
    </author>
    
    <category term="asterisk" label="asterisk" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="configuration" label="configuration" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="ivr" label="ivr" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="openvpn" label="openvpn" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="rant" label="rant" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="sysadmin" label="sysadmin" scheme="http://www.sixapart.com/ns/types#tag" />
    
    <content type="html" xml:lang="en" xml:base="http://www.chaseventers.org/">
        <![CDATA[<p>Okay, I'm pleading with developers. I'm very impressed at the number of options and switches that your program exposes via its configuration file(s) / directories / databases. Bonus points for those of you who have managed to extensively document each switch and its default setting with inline comments.</p>

<p>Actually, that strategy even works up to a point. But once your configuration file exceeds a few screens in length you're starting to go off the deep end. Your program's defaults should be <em>minimal</em>, <em>sensible</em> and <em>secure</em>, <strong>especially in the case of network daemons</strong>.</p>

<p>There are some hideous offenders out there like <a href="http://www.asterisk.org/">Asterisk</a>, whose Christmas tree default configuration is often only lightly modified by novice administrators. A default RPM installation of Asterisk on my development virtual machine ships with 63 configuration files -- 7511 lines in total. But I run some perfectly good inbound SIP IVRs with 10 files and 251 lines.</p>

<p>When you throw a huge mess of a default configuration in my face, you leave me with the feeling that I can't even approach your software until I have had the time to digest the security implications of every one of the switches you are exposing.</p>

<p>There are other programs which do it well like <a href="http://openvpn.net/">OpenVPN</a>. They ship sample configuration files for different configurations, from which you can copy and paste your own configuration files together. This approach is much saner than editing a huge file -- take what you need, leave what you don't.</p>

<p>I advise all system administrators faced with such configuration mountains to grit their teeth and write their own configs from scratch after carefully studying the stock configuration. Turn on and configure only the specific features you need, lightly document your intent with comments, and <em>leave the other garbage out of the configuration files</em>. The more scrolling past heaps of irrelevant comments and settings you must do to scan the configuration file, the less you will be able to focus on the big picture of how your system is set up.</p>]]>
        
    </content>
</entry>

<entry>
    <title>Corosync::CPG</title>
    <link rel="alternate" type="text/html" href="http://www.chaseventers.org/2010/09/corosynccpg.html" />
    <id>tag:www.chaseventers.org,2010://1.36</id>

    <published>2010-09-08T09:28:12Z</published>
    <updated>2010-09-08T09:32:11Z</updated>

    <summary>I&apos;m working on releasing a small piece of useful Perl XS module code to the world... Corosync::CPG. This allows you to use the corosync cluster stack&apos;s reliable, ordered multicast messaging bus from within Perl. I have applied for a PAUSE...</summary>
    <author>
        <name>Chase Venters</name>
        <uri>http://www.chaseventers.com/</uri>
    </author>
    
    <category term="corosync" label="corosync" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="libcpg" label="libcpg" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="oss" label="oss" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="perl" label="perl" scheme="http://www.sixapart.com/ns/types#tag" />
    
    <content type="html" xml:lang="en" xml:base="http://www.chaseventers.org/">
        <![CDATA[<p>I'm working on releasing a small piece of useful Perl XS module code to the world... <a href="http://github.com/cventers/perl-Corosync-CPG">Corosync::CPG</a>. This allows you to use the <a href="http://www.corosync.org/doku.php?id=welcome">corosync</a> cluster stack's reliable, ordered multicast messaging bus from within Perl.</p>

<p>I have applied for a <a href="http://pause.perl.org/pause/query?ACTION=pause_04about">PAUSE</a> id and plan on submitting this module to CPAN as well. For now, this is a super-early alpha. It works for me, but the POD documentation is incomplete and there is obviously no warranty.</p>

<p>The terms of this release are the same licensing terms as Perl itself (GPL/Artistic).</p>]]>
        
    </content>
</entry>

<entry>
    <title>Ksplice Review</title>
    <link rel="alternate" type="text/html" href="http://www.chaseventers.org/2010/09/ksplice-review.html" />
    <id>tag:www.chaseventers.org,2010://1.35</id>

    <published>2010-09-08T07:39:56Z</published>
    <updated>2010-09-08T07:48:55Z</updated>

    <summary>We recently signed up for Ksplice, a service offering live Linux kernel updates. (Yes, live means while the kernel is running.) Now, the kinds of updates we are talking about are patches to running code intended to apply critical security...</summary>
    <author>
        <name>Chase Venters</name>
        <uri>http://www.chaseventers.com/</uri>
    </author>
    
    <category term="ksplice" label="ksplice" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="review" label="review" scheme="http://www.sixapart.com/ns/types#tag" />
    
    <content type="html" xml:lang="en" xml:base="http://www.chaseventers.org/">
        <![CDATA[<p>We recently signed up for <a href="http://www.ksplice.com">Ksplice</a>, a service offering live Linux kernel updates. (Yes, live means while the kernel is running.)</p>

<p>Now, the kinds of updates we are talking about are patches to running code intended to apply critical security fixes. Ksplice won't let you upgrade from 2.6.34 to 2.6.35. Nevertheless, for mission critical servers (especially tough ones like database servers, routers and the like), the prospect of not having to reboot to install security updates is a huge win.</p>

<p>LWN <a href="http://lwn.net/Articles/280058/">looked</a> <a href="http://lwn.net/Articles/308409/">at</a> Ksplice, for those who are interested in knowing how it works. (Even if you're not a kernel programmer, you can learn so much from watching the kernel programmers at work.)</p>

<p>Ksplice is a young company but has racked up an impressive list of clients. I've found their solution easy to use. Billing and support is straightforward, and they're very friendly people. We've had no problems applying the updates. I would recommend Ksplice to anyone looking to keep their production GNU/Linux systems up to date.</p>]]>
        
    </content>
</entry>

<entry>
    <title>daemontools patches</title>
    <link rel="alternate" type="text/html" href="http://www.chaseventers.org/2010/09/daemontools-patches.html" />
    <id>tag:www.chaseventers.org,2010://1.34</id>

    <published>2010-09-08T07:06:32Z</published>
    <updated>2010-09-09T08:01:57Z</updated>

    <summary>I&apos;ve been relying extensively on daemontools to manage services on my production servers for years. There are newer entries into the arena like runit and even upstart which replaces init. I&apos;m not ready to replace daemontools on any of my...</summary>
    <author>
        <name>Chase Venters</name>
        <uri>http://www.chaseventers.com/</uri>
    </author>
    
    <category term="daemontools" label="daemontools" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="oss" label="oss" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="patch" label="patch" scheme="http://www.sixapart.com/ns/types#tag" />
    
    <content type="html" xml:lang="en" xml:base="http://www.chaseventers.org/">
        <![CDATA[<p>I've been relying extensively on <a href="http://cr.yp.to/daemontools.html">daemontools</a> to manage services on my production servers for years. There are newer entries into the arena like <a href="http://smarden.org/runit/">runit</a> and even <a href="http://upstart.ubuntu.com/">upstart</a> which replaces init. I'm not ready to replace daemontools on any of my servers just yet; its simple design is something I've come to depend on.</p>

<p>All that being said, I'm like many of the other users of djb code: small patches here and there make things better. So in that spirit, here are two of my contributions.</p>

<p><tt><a href="/downloads/daemontools-0.76-readproctitle-clear-on-sigusr1.patch">daemontools-0.76-readproctitle-clear-on-sigusr1.patch</a></tt><br/>
Causes <a href="http://cr.yp.to/daemontools/readproctitle.html">readproctitle</a> to clear its buffer (reset it to periods) when it receives SIGUSR1. It's useful if you're setting up new services and you need to see if a certain error has really been fixed.</p>

<pre class='brush: diff'>
diff -Nru a/admin/daemontools-0.76/src/readproctitle.c b/admin/daemontools-0.76/src/readproctitle.c
--- a/admin/daemontools-0.76/src/readproctitle.c        2001-07-12 11:49:49.000000000 -0500
+++ b/admin/daemontools-0.76/src/readproctitle.c        2010-09-06 16:09:28.000000000 -0500
@@ -1,10 +1,21 @@
+#include &lt;signal.h&gt;
 #include &lt;unistd.h&gt;
 #include &quot;error.h&quot;

+static char *buf;
+static unsigned int len;
+
+static void
+clear_line(int sig)
+{
+  int i;
+  for (i = 0;i &lt; len;i++) {
+    buf[i] = '.';
+  }
+}
+
 int main(int argc,char **argv)
 {
-  char *buf;
-  unsigned int len;
   int i;
   char ch;

@@ -14,6 +25,8 @@
   while (buf[len]) buf[len++] = '.';
   if (len &lt; 5) _exit(100);

+  signal(SIGUSR1, clear_line);
+
   for (;;)
     switch(read(0,&amp;ch,1)) {
       case 1:
</pre>

<p><tt><a href="/downloads/daemontools-0.76-setuidgid-initgroups.patch">daemontools-0.76-setuidgid-initgroups.patch</a></tt><br/>
Causes <a href="http://cr.yp.to/daemontools/setuidgid.html">setuidgid</a> to initialize the supplementary groups for the user account it is changing to.</p>

<pre class='brush: diff'>
diff -Nru a/admin/daemontools-0.76/src/setuidgid.c b/admin/daemontools-0.76/src/setuidgid.c
--- a/admin/daemontools-0.76/src/setuidgid.c    2001-07-12 11:49:49.000000000 -0500
+++ b/admin/daemontools-0.76/src/setuidgid.c    2010-06-22 16:06:05.000000000 -0500
@@ -21,6 +21,8 @@

   if (prot_gid(pw-&gt;pw_gid) == -1)
     strerr_die2sys(111,FATAL,&quot;unable to setgid: &quot;);
+  if (initgroups(pw-&gt;pw_name, pw-&gt;pw_gid))
+    strerr_die2sys(111,FATAL,&quot;unable to initgroup: &quot;);
   if (prot_uid(pw-&gt;pw_uid) == -1)
     strerr_die2sys(111,FATAL,&quot;unable to setuid: &quot;);

</pre>]]>
        
    </content>
</entry>

<entry>
    <title>NSIS Plugin Released: Pwgen</title>
    <link rel="alternate" type="text/html" href="http://www.chaseventers.org/2009/10/nsis-plugin-released-pwgen.html" />
    <id>tag:www.chaseventers.org,2009://1.32</id>

    <published>2009-10-09T18:32:41Z</published>
    <updated>2010-09-08T07:31:52Z</updated>

    <summary>I&apos;ve been working on an installer for a Windows service using Nullsoft Scriptable Install System. This installer creates a special account to run the service under, but to do so, it has to come up with a random password. NSIS...</summary>
    <author>
        <name>Chase Venters</name>
        <uri>http://www.chaseventers.com/</uri>
    </author>
    
    <category term="nsis" label="nsis" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="oss" label="oss" scheme="http://www.sixapart.com/ns/types#tag" />
    
    <content type="html" xml:lang="en" xml:base="http://www.chaseventers.org/">
        <![CDATA[<p>I've been working on an installer for a Windows service using <a href="http://nsis.sourceforge.net/">Nullsoft Scriptable Install System</a>. This installer creates a special account to run the service under, but to do so, it has to come up with a random password. NSIS offers a few existing mechanisms for random numbers, but neither are anything but basic PRNGs.</p>

<p>In order to get *good* random passwords, we want the equivalent of <tt>/dev/urandom</tt>. Microsoft provides the CryptoAPI, which includes the <a href="http://msdn.microsoft.com/en-us/library/aa379942(VS.85).aspx"><tt>CryptGenRandom()</tt></a> API. I developed a DLL plugin for NSIS called <a href="http://nsis.sourceforge.net/Pwgen_plug-in">Pwgen</a> that collects entropy from the OS and generates a random password, restricted to the 62-character set of alphanumerics.</p>

<p>You can <a href="/downloads/pwgen-001.zip">download pwgen-001</a> directly from me. I also recommend the official <a href="http://nsis.sourceforge.net/Pwgen_plug-in">Pwgen plug-in</a> wiki page on the NSIS wiki and the <a href="http://forums.winamp.com/showthread.php?s=&amp;threadid=313584">discussion thread</a> on the Winamp NSIS forum.</p>]]>
        
    </content>
</entry>

<entry>
    <title>Nokia Further Open-Sources Qt</title>
    <link rel="alternate" type="text/html" href="http://www.chaseventers.org/2009/01/nokia-further-open-sources-qt.html" />
    <id>tag:www.chaseventers.org,2009://1.31</id>

    <published>2009-01-17T16:33:19Z</published>
    <updated>2010-09-08T07:32:11Z</updated>

    <summary> Nokia has announced that they are going to add an additional license to the QPL/GPLv2/GPLv3/Commercial lineup: LGPL v2.1. This is excellent news for the toolkit as it will lead to wider adoption (and more improvements to the core toolkit)....</summary>
    <author>
        <name>Chase Venters</name>
        <uri>http://www.chaseventers.com/</uri>
    </author>
    
    <category term="news" label="news" scheme="http://www.sixapart.com/ns/types#tag" />
    
    <content type="html" xml:lang="en" xml:base="http://www.chaseventers.org/">
        <![CDATA[ <p><a href="http://www.nokia.com/">Nokia</a> has <a href="http://www.qtsoftware.com/about/news/lgpl-license-option-added-to-qt">announced</a> that they are going to add an additional license to the QPL/GPLv2/GPLv3/Commercial lineup: LGPL v2.1. This is excellent news for the toolkit as it will lead to wider adoption (and more improvements to the core toolkit).</p>

<p>I love Qt, because when I'm paid to write software to run on Microsoft Windows, I write that software on Linux, compile it on Linux, test it on Linux, and then the last step is to cross-compile it to Windows and test it inside a kvm virtual machine. I barely have to touch Windows with a 10 foot pole.</p>

<p>I'm not extremely fond of C++, but Qt makes C++ tolerable. The toolkit is quite honestly miles beyond Gtk+, a statement I make having written a Gtk+ app before, a number of glib apps, and being very fond of C. They're now shipping Webkit and an XQuery processor, and your application scan be styled (on the fly) with CSS.</p>]]>
        
    </content>
</entry>

</feed>

