While I was at SysNet, we had been working on a project we called “Shrimp” — Software-defined Home Router Intelligent Monitoring Point. The goal of the project was to provide a framework for easy programmatic access to network monitoring on low-cost, commodity, home router devices. One of the requirements was to have an IDS on the home routers for which we chose Bro — the leading framework for semantic analysis of network traffic.

The OpenWRT OS was chosen as the target platform. Its SDK contained a cross-compile toolchain for CMake projects. However, during the compilation Bro tried to run the binpac and bifcl executables for processing intermediate files. The executables refused to run on the build platform if the target platform architecture was different (mostly the case, e.g., we were building on x86-64 and target was arm).

The (not-so-pretty ™) workaround we used was to build Bro twice. Once for the host, and once for the target. The CMake files were then patched to first generate binpac and bifcl binaries if they weren’t provided and then use the provided binaries if they were defined at make time. The first compile generated the binaries on x86-64 and the second compile (for arm) used the earlier binaries to process the bif files.

The Makefile and patches are available in this tarball: openwrt-bro.tar.gz, while the compiled ipk package is also available for installation. Here is a test execution of Bro on OpenWRT:

# bro –v

bro version 2.0

# cat test.bro

event bro_init()
{
	print "Hello World!";
}

event new_connection(c: connection)
{
	print "New connection created";
}

# bro test.bro

Hello World!

# bro -i br-lan test.bro

Hello World!
New connection created
New connection created

# ls

conn.log           notice_policy.log  reporter.log       weird.log
dns.log            packet_filter.log  test.bro

A heap of thanks to Zaafar for dealing with my messy code and providing the links to hosted files !

Permalink | No comment
Post tags: Bro IDS, Linux, Open Source, OpenWRT, Security, SysNet, Technology

It has been a while since I’ve posted around here and the reasons have been entirely mundane — got a job, moved to a different country and lost track of everything open-source during the transition.

However, open-source is out there and every once a while you’re bound to stumble across gems that make life easier (and fun) no matter which line of work you are in and that’s exactly what happened to me today. Let me admit first, I have a fetish for multiple screens. If it was up to me I would have a circle of screens and sit inside them all day long, just to make revolving chairs lot more exciting. Take that, 3D!

Anyways, the issue with multiple screens is not only having enough video outputs on your graphic card(s), but also the sharing of resources. I want three different machines with different processors, hard-disks, heck even different operating systems to share their I/O devices. One option would be the KVM switches, but that would restrict me to only one “active” machine at a time, plus the switching button is too much of a hindrance in the work flow. Aristotle famously claimed that the whole is greater than the sum of its parts, then cometh Synergy:

(Click on the thumbnail for larger version.)

Three different machines sharing the keyboard, mouse and clipboard across five different screens and it even works across different platforms! Granted, there are some issues with the configuration which you have to take care about (especially on Windows 7+ platforms with UAC) but once it gets going it becomes one of those cute plus practical toys that make you wonder how you ever lived without them.

Permalink | 5 comments
Post tags: Cross-platform, Dual-Head, Open Source, Synergy, Technology

During the course of my work on botnet security we have had to deal with mammoth traffic traces captured at a local ISP. While analyzing the traffic we needed to extract traffic for some certain hosts out of large pcap files. An obvious solution would be to run tshark once for each host, filtering the traffic for that particular IP and writing it to a separate pcap file. However with the number of hosts approaching thousands and the pcap traces approaching terabytes in size tshark didn’t really fit the bill.

Initially I thought of writing a splitter in Python but my colleague’s aversion for using Python on large network traces coupled with lack of maintenance of libpcap bindings resulted in me going for C/libpcap directly. The new C-based slicer is available at our GitHub respository. It needs glib to compile though, as I needed a hash table implementation for maintaining the list of hosts that need to be sliced. The Makefile in the repository should take care of compiling with the appropriate flags.

Onto the performance, the speed of slicing is only throttled by libpcap‘s own read/write throughput as most of the remaining work is done in constant time. It took only 71 minutes (or 1.1 hours) to slice 1019 hosts out of a 180 GB pcap file on 2.5 GHz CPU. In simpler words, it’s lightning fast.

Right now the script does its job well enough. If someone needs to package it I’ll prefer removing the glib dependency in favor of perhaps glibc‘s own hash table implementation (search.h). In any case, I hope it proves helpful for other people playing with large pcap files.

Permalink | 3 comments
Post tags: Botnets, BSG, Code, glib, libpcap, Networking, Open Source, Pcap, slicehosts, Technology

For a little while now I noticed that my Compiz skydome was disappearing whenever I logged in. I could bring it back by disabling and re-enabling the Cube plugin but from a cold-boot I was always greeted to an abysmal looking cube:

(Click on the thumbnail for larger version.)

A little bit of forensics revealed that the issue lied with the loading order of Compiz plugins. At the moment Compiz does not try to resolve any plugin dependencies at startup, so while the skydome relied on the PNG plugin the latter wasn’t pre-loaded — resulting in a blank background.

The solution was to change the following line in config:

[core]
s0_active_plugins = core;composite;opengl;copytex;decor;vpswitch;mousepoll;firepaint;gnomecompat;resize;compiztoolbox;wobbly;cube;screensaver;shift;scale;regex;imgpng;splash;place;move;obs;animation;rotate;expo;workarounds;freewins;ezoom;session;staticswitcher;

To:

[core]
s0_active_plugins = core;composite;opengl;copytex;decor;vpswitch;mousepoll;firepaint;gnomecompat;imgpng;resize;compiztoolbox;wobbly;cube;screensaver;shift;scale;regex;splash;place;move;obs;animation;rotate;expo;workarounds;freewins;ezoom;session;staticswitcher;

imgpng had to be loaded before cube, giving me back the pretty backdrop for all things 3D:

(Click on the thumbnail for larger version.)

Permalink | One comment
Post tags: Compiz, Cube, Desktop, Eye-candy, Open Source, Technology, Workaround

A few weeks back I was renewing this blog’s domain name when I was given a coupon code which would grant me a 20%+ discount for orders >75 USD. Now my order was only touching 70, so grabbing a calculator and dutifully acting like a white-collar citizen made me realize that if I ordered another domain my total order would actually cost me lesser than what I already had. Classic case of “more is less” — I ended up with another domain and a total lack of ideas about what to do with it.

Until, I remembered about this picture from 2 years ago:

“Say hello to my little friend!”
(Click on the thumbnail for larger version.)

The ineffectual Eee PC finally found some practical use. Using Dynamic DNS to point expirated.com towards it, I configured lighttpd to serve the website. As for the content I wrote a few Python scripts to monitor the status of the Tor relay and internet connection at my home. Still not terribly useful, but at least the plots for latter give me a nice idea about how my internet is doing when I’m not at home.

The internet router (Netgear DG834) did not support SSH/SCP so I used Python’s telnetlib module to log in to the router and bring back the modem stats. The results are then fed to a maze of regexes, generating values which are finally plotted via matplotlib.

How I wish I had better things to do with a domain name.

Permalink | No comment
Post tags: DNS, Dynamic DNS, lighttpd, Netgear, Open Source, Rants, Technology

I love code, I love cotton … :

(Click on the thumbnail for larger version.)

… as much as I loved them last year:

(Click on the thumbnail for larger version.)

Permalink | 2 comments
Post tags: EFF, Google, GSoC, Open Source, Rants, Summer of Code, T-Shirts

I recall three distinct things about my visit to BBC’s Islamabad Studios today. Kamil’s very friendly support (he kept reassuring me that everyone gets nervous for their first live appearance on television), a minor car accident right beneath the balcony I was standing in and prevalent general confusion about what to do with my hands when I’m on air (I wasn’t sure if they were on screen so couldn’t decide whether to stuff them in my pockets or not). In any case, it was ultra fun:

Permalink | 8 comments
Post tags: Apple, BBC, Internet, Rants, Steve Jobs, Technology, Video, World Have Your Say, Youtube

Due to a number of commitments which I had pinned back during the summer for GSoC I was unable to attend much to the Internet over the past few weeks. Now that I’m back a summary of this year’s coding festival is in order:

The Program

This year I was working with Electronic Frontier Foundation/The Tor Project for improving the Anonymizing Relay Monitor (arm). The original proposal can be downloaded from this link are accessed via a browser at Google Docs. However, do note that not all of the goals from the proposal were met. Some were modified, some were removed altogether while some new ones were added — the details of which I’ll be explaining in the following sections.

Overall the program has been an extraordinarily enjoyable and learning experience for me. My involvement with Ubuntu last year had already taught me how invaluable it is to merge with your mentoring organizing’s developer community. This year most of my collaboration took place in #tor-dev on OFTC. Many times when I was stuck or heading towards an improper direction with my code the core Tor developers helped me and provided advice for design decisions as well as general guidance about the way things work in Tor. It wasn’t only a privilege to be helped by such rockstars, but was also vital as I can see in hindsight how disastrous it would have been if I had attempted to work through the program entirely on my own.

A huge thanks goes to my mentor Damian. Most of the credit for making this program an enjoyable and stimulating experience for me goes directly to him. He has one of the best combinations of code-people skills among people I’ve known. I would’ve loved meeting him and the Tor community in PETS ’11 but couldn’t travel due to some paperwork fiasco which was entirely a result of my slothful attitude towards anything involving government offices. Nevertheless, I do hope to meet the guys next year in PETS ’12.

The Code

In order to not sound repetitious, I’ll provide a quick summary of the milestones while linking to the posts which explain them in detail:

Menus for arm CLI

My first task was to add dropdown menus for the curses interface to arm. Even though the menus were replaced by Damian’s rewrite, they went a long way in helping me assimilate myself with the arm codebase:

(Click on the thumbnail for larger version.)

Graphs and logs for arm GUI

GTK+ was chosen as the toolkit for developing the arm GUI prototype. While GTK+ has its own disadvantages when compared to Qt (platform portability — or the lack thereof — being the foremost), it fared well in light-weight Unix environment such as Live CDs (e.g., Tails). Bandwidth graphs and logs for various arm events were added to the prototype:

(Click on the thumbnails for larger version.)

Connections and general stats for arm GUI

Moving on with the GUI, next up was to improve its conformity with the rest of the user’s desktop:

(Click on the thumbnail for larger version.)

And then re-use arm’s CLI connection resolvers in order to display stats about Tor circuits and control connections:

(Click on the thumbnail for larger version.)

A small addition was migration of the “sticky” panel from CLI which was moved under a “General” tab and provided miscellaneous info about Tor and arm:

(Click on the thumbnail for larger version.)

Configuration panel for GUI

Another important panel in the arm CLI was its configuration interface which provided a nice and documented approach to altering Tor’s settings. It was migrated to GUI with nice dialogs for validating user input:

(Click on the thumbnail for larger version.)

Along with the configuration panel a few patches to Tor and Vidalia were developed which would allow arm to be notified of changes made by an external program via a CONF_CHANGED event. The support for CONF_CHANGED still isn’t solid in all Tor controllers yet which I plan on addressing in coming months.

Exit node selector for arm CLI & GUI

A popular feature request among Tor users was to be able to select the country for their exit nodes. While I initially planned on providing them more fine-grained control over their circuits (such as path length), Tor developers advised against it and hence the selection was limited to the exit-node’s locale:

(Click on the thumbnails for larger version.)

The Nutshell

“It goes on forever — and — oh my God — it’s full of stars!”

It’s just that awesome, seriously. Stars from the FLOSS strata gather around and help inexperienced and aspiring developers all over the globe for two months in order to bring more code and — more importantly — more people to the open-source world. The experience with GSoC not only helps me in general open-source development, but also proves to be priceless at my workplace for my research in software defined networks. If you’re even remotely interested in open-source do keep an eye on the program’s website for future updates.

Permalink | One comment
Post tags: arm, Code, EFF, Google, GSoC, GTK+, Open Source, PyGTK, Summer of Code, Tor, Vidalia

The final weeks of GSoC 2011 were spent by me working on exit node selection for Tor users. The GUI controller can now be used to define a list of countries, after which only those exit nodes shall be used which lie in one of the specified territories:

(Click on the thumbnail for larger version.)

For the CLI, Damian decided that the general use case for exit node selection is specification of a single country so pressing ‘E’ in the connections panel brings up a list from which one can be chosen:

(Click on the thumbnail for larger version.)

Please note that the exit node restriction works only for circuits built after the selection. Therefore it might be a good idea to send a NEWNYM to Tor after specifying the countries — which you’ll have to do manually for the time being until I add the feature to (g)arm controllers.

In my next post I’ll cover a summary of my involvement with GSoC this year, that is, after I finish with the regular chores of code submission etc.

Permalink | No comment
Post tags: arm, Code, EFF, Google, GSoC, GTK+, Open Source, PyGTK, Summer of Code, Tor

While working for GSoC last year I kept track of Bazaar patches I sent in for Arsenal. This year I was using Git and as the need arose to generate a submission tarball for my commits I wrote this small utility script: git-generate-tarball.py.

To invoke the script, change into your Git repository and provide an author name and a file as an argument:

[krkhan@orthanc tor]$ /home/krkhan/Downloads/git-generate-tarball.py "Kamran Riaz Khan <krkhan@inspirated.com>" /home/krkhan/Downloads/tor-gsoc-krkhan.tar.gz

generating tarball for commits between Mon May 23 00:00:00 2011 +0000 and Mon Aug 22 19:00:00 2011 +0000
generating patch for commit 5a801a8c8b71c9551a80913398135809cb10cecd
…
/home/krkhan/Downloads/tor-gsoc-krkhan.tar.gz created

The default starting and ending dates for the commits correspond to the schedule for GSoC 2011. You can specify a starting date for the commits you want to be packaged using the --since argument:

[krkhan@orthanc arm]$ /home/krkhan/Downloads/git-generate-tarball.py --since="August 1, 2011" "Kamran Riaz Khan <krkhan@inspirated.com>" /home/krkhan/Downloads/arm-gsoc-krkhan.tar.bz2

generating tarball for commits between August 1, 2011 and Mon Aug 22 19:00:00 2011 +0000
generating patch for commit 546ca73259d7863e3efe5e11e09c023c2790a2f6
…
/home/krkhan/Downloads/arm-gsoc-krkhan.tar.bz2 created

Same goes for the --before argument:

[krkhan@orthanc tor]$ /home/krkhan/Downloads/git-generate-tarball.py --before="August 14, 2011" "Kamran Riaz Khan <krkhan@inspirated.com>" /home/krkhan/Downloads/tor-gsoc-krkhan.tar.gz

generating tarball for commits between Mon May 23 00:00:00 2011 +0000 and August 14, 2011
generating patch for commit 5a801a8c8b71c9551a80913398135809cb10cecd
…
/home/krkhan/Downloads/tor-gsoc-krkhan.tar.gz created

Or a combination of both:

[krkhan@orthanc arm]$ /home/krkhan/Downloads/git-generate-tarball.py --since="August 1, 2011" --before="August 14, 2011" "Kamran Riaz Khan <krkhan@inspirated.com>" /home/krkhan/Downloads/arm-gsoc-krkhan.tar.gz

generating tarball for commits between August 1, 2011 and August 14, 2011
generating patch for commit 546ca73259d7863e3efe5e11e09c023c2790a2f6
…
/home/krkhan/Downloads/arm-gsoc-krkhan.tar.gz created

If you want to leave the dates undefined you can leave the arguments empty. For example, the following command shall process all commits before June 1, 2011:

[krkhan@orthanc arm]$ /home/krkhan/Downloads/git-generate-tarball.py --since= --before="June 1, 2011" "Kamran Riaz Khan <krkhan@inspirated.com>" /home/krkhan/Downloads/arm-gsoc-krkhan.tar.gz

generating tarball for commits before June 1, 2011
generating patch for commit 8b4dc162f75d5129e41f028c7253b7b265c8af76
…
/home/krkhan/Downloads/arm-gsoc-krkhan.tar.gz created

Hope this helps fellow GSoCers.

Permalink | 5 comments
Post tags: Code, Git, Google, GSoC, Open Source, Summer of Code