Walk with me

My shortlist of diesel cars

2010-02-28T11:58:00.002+05:30

Looking to buy a diesel car with good safety features, comfort and a nice look.

My short list:

1. Fiat Punto - Emotion (~6.5 L on road chennai)

2. Volkswagen Polo - Comfortline (~6.5 L on road chennai)

3. Ford Figo - Titanium (~6 L on road chennai)

4. Maruti Ritz - ?

Tata motors/Fiat showroom, Ambattur:

I was impressed at the solid build of the Punto. One can feel the solidness just by touching the doors. The seats are comfortable and it's easy to get in to and out of the car - thanks to its height and ground clearance. I am very much impressed by this car but waiting to see the Polo before deciding. The only bad part is that sales and service are from Tata and I had a first hand bad experience when I walked in to the show room - There were no body to attend and 5-6 visitors who were looking at the cars. The booking amount is Rs.10K and it takes 15 days to deliver.

Volkswagen showroom, CIT nagar:

Polo will be available in showroom during 2nd week of march. 80 cars have already been booked in chennai. Petrol car delivery starts from April. One have to wait till june for the diesel engine. 50 K is the booking amount and it takes one month for delivery.

MPL Ford, Anna salai:

Figo is already available in showroom but one has to wait another week for a test drive. The 1.4L diesel engine is the same one from Fiesta. The top end model Titanium has airbags and ABS, but no rear power windows. It has an excellent boot space and good leg room at the back. The car doesn't look stylish though. 25K is the booking amount and it takes one month for delivery. Already 240 Figo's are booked in Chennai. (There is also a new MPL showroom near SRP Tools OMR)

Yet to visit a Maruti showroom.

Parsing and using custom extension in X.509 certificates

2009-01-08T15:50:00.000+05:30

In the last two posts we saw how to create certificates with custom extensions and how to view extension in X.509 certificates, now it's time that we use them for some real purpose. The main purpose of placing custom extension is to express certain capabilities of the certificate holder. The receiving systems verifies the capabilities of the holder based on the presence of these extensions and the corresponding values in the extensions.

In the current example we will see the parsing of a non-standard extension called Admission with oid: 1.3.36.8.3.3 which is defined in the ISIS-MTT document

The ASN.1 description of the extension is given below

AdmissionSyntax ::= SEQUENCE {
admissionAuthority GeneralName OPTIONAL,
contentsOfAdmissions SEQUENCE OF Admissions }

Admissions ::= SEQUENCE {
admissionAuthority [0] EXPLICIT GeneralName OPTIONAL,
namingAuthority [1] EXPLICIT NamingAuthority OPTIONAL,
professionInfos SEQUENCE OF ProfessionInfo }

NamingAuthority ::= SEQUENCE {
namingAuthorityId OBJECT IDENTIFIER OPTIONAL,
namingAuthorityUrlQUENCE OF OBJECT IDENTIFIER OPTIONAL,
registrationNumber PrintableString (SIZE(1..128)) OPTIONAL,
addProfessionInfo OCTET STRING OPTIONAL }

ProfessionInfo ::= SEQUENCE {
namingAuthority [0] EXPLICIT NamingAuthority OPTIONAL,
professionItems SEQUENCE OF DirectoryString (SIZE(1..128)),
professionOIDS SEQUENCE OF OBJECT IDENTIFIER,
registrationNumber PrintableString (SIZE(1..128)) OPTIONAL,
addProfessionInfo OCTET STRING OPTIONAL }

If we build a certificate with this extension and try to display the contents using the method described in the previous post, we will not be able to see the particulars of this extension nor will we be able to query any of the fields from this extension. This is because OpenSSL doesn't yet know to parse the contents of the extension. To help OpenSSL in parsing the data we have to define the structure of the extension. Which is done as follows.

First, the needed data structures are defined:

typedef struct NamingAuthority_st {
ASN1_OBJECT* namingAuthorityId;
ASN1_IA5STRING* namingAuthorityUrl;
ASN1_STRING* namingAuthorityText;
} NAMING_AUTHORITY;
DECLARE_ASN1_ITEM(NAMING_AUTHORITY)

typedef struct ProfessionInfo_st {
NAMING_AUTHORITY* namingAuthority;
STACK_OF(DIRECTORYSTRING)* professionItems;
STACK_OF(ASN1_OBJECT)* professionOIDs;
ASN1_PRINTABLESTRING* registrationNumber;
ASN1_OCTET_STRING* addProfessionInfo;
} PROFESSION_INFO;
DECLARE_ASN1_ITEM(PROFESSION_INFO)

typedef struct Admissions_st {
GENERAL_NAME* admissionAuthority;
NAMING_AUTHORITY* namingAuthority;
STACK_OF(PROFESSION_INFO)* professionInfos;
} ADMISSIONS;
DECLARE_ASN1_ITEM(ADMISSIONS)

typedef struct AdmissionSyntax_st {
GENERAL_NAME* admissionAuthority;
STACK_OF(ADMISSIONS)* contentsOfAdmissions;
} ADMISSION_SYNTAX;
DECLARE_ASN1_ITEM(ADMISSION_SYNTAX)

and then the C translation of ASN.1 representation.

ASN1_SEQUENCE(NAMING_AUTHORITY) = {
ASN1_OPT(NAMING_AUTHORITY, namingAuthorityId, ASN1_OBJECT),
ASN1_OPT(NAMING_AUTHORITY, namingAuthorityUrl, ASN1_IA5STRING),
ASN1_OPT(NAMING_AUTHORITY, namingAuthorityText, DIRECTORYSTRING),
} ASN1_SEQUENCE_END(NAMING_AUTHORITY)

ASN1_SEQUENCE(PROFESSION_INFO) = {
ASN1_EXP_OPT(PROFESSION_INFO, namingAuthority, NAMING_AUTHORITY, 0),
ASN1_SEQUENCE_OF(PROFESSION_INFO, professionItems, DIRECTORYSTRING),
ASN1_SEQUENCE_OF(PROFESSION_INFO, professionOIDs, ASN1_OBJECT),
ASN1_OPT(PROFESSION_INFO, registrationNumber, ASN1_PRINTABLESTRING),
ASN1_OPT(PROFESSION_INFO, addProfessionInfo, ASN1_OCTET_STRING),
} ASN1_SEQUENCE_END(PROFESSION_INFO)

ASN1_SEQUENCE(ADMISSIONS) = {
ASN1_EXP_OPT(ADMISSIONS, admissionAuthority, GENERAL_NAME, 0),
ASN1_EXP_OPT(ADMISSIONS, namingAuthority, NAMING_AUTHORITY, 1),
ASN1_SEQUENCE_OF(ADMISSIONS, professionInfos, PROFESSION_INFO),
} ASN1_SEQUENCE_END(ADMISSIONS)

ASN1_SEQUENCE(ADMISSION_SYNTAX) = {
ASN1_OPT(ADMISSION_SYNTAX, admissionAuthority, GENERAL_NAME),
ASN1_SEQUENCE_OF(ADMISSION_SYNTAX, contentsOfAdmissions, ADMISSIONS),
} ASN1_SEQUENCE_END(ADMISSION_SYNTAX)

Once this is done we have to some how say about our new extension to openssl:

static X509V3_EXT_METHOD ext_admission = {
.ext_nid = 0,
.ext_flags = 0,
.it = ASN1_ITEM_ref(ADMISSION_SYNTAX),
.i2s = NULL,
.s2i = NULL,
.i2v = NULL,
.v2i = NULL,
.r2i = NULL,
.i2r = i2r_AdmissionSyntax,
};

/*
* Tell about our new extension to OpenSSL
*/
void x509_add_custom_extensions()
{
ext_admission.ext_nid
= OBJ_create("1.3.36.8.3.3", "Admission", "Admission");
X509V3_EXT_add(&ext_admission);
}

Now if we have an extension we can convert it to the corresponding data structure and then play with fields / verify them.

ADMISSION_SYNTAX* x = (ADMISSION_SYNTAX*) X509V3_EXT_d2i(ext);
sk_num(x->contentsOfAdmissions)
sk_value(x->contentsOfAdmissions, iAdmission);

i2r_AdmissionSyntax is a simple function (that you may write/or set to NULL) which converts the internal data structure to some human understandable form and is used when the function X509V3_EXT_print_fp is called.

Viewing extensions in X.509 certificates

2009-01-06T15:19:00.000+05:30

In the last post we saw how to create certificates with custom extensions - as a second step let us see how we can access these extensions and make sense of them. The code below opens a certificate, counts the number of extensions in it and iterates over every extension and prints a representation of the extension understandable to, us, humans.

X509V3_add_standard_extensions();

inf = fopen("mycrt.crt", "r");
cert = (X509*) PEM_read_X509(inf, NULL, NULL)
count = X509_get_ext_count(cert);

for(i = 0; i < count; i++) {
ext = X509_get_ext(cert, i);

printf("%s\n", OBJ_nid2ln(OBJ_obj2nid(ext->object)));
if(!X509V3_EXT_print_fp(stdout, ext, 0, 0)) {
ERR_print_errors_fp(stderr);
}
printf("\n");
X509_EXTENSION_free(ext);
}

It doesn't print the human representation of all the extensions found but only for the built in extensions, because the library doesn't yet know to represent the custom extensions that we have placed in the certificate.

More about parsing custom extensions and making sense of the values in it in a later post.

Creating X.509 certificates with custom extensions

2009-01-06T14:29:00.000+05:30

Every time when I need to do something with OpenSSL, it involves searching lot of places including the library code itself to achieve my target - This time the requirement is to generate a X509 v3 certificate which contains non-standard/custom extensions. Luckily I found convincing documents early enough.

Here the task is to generate a CA certificate with standard extensions and then to create another certificate containing custom extensions and sign it with the newly created CA. The code below achieves both of the tasks.

1. To generate the ca certificate, run the script as ./genkey.sh myca ==> which generates myca.key and myca.crt
2. To generate the authentication certificate, run the script as ./genkey.sh myca mycrt ==> which generates mycrt.key and mycrt.crt and signs it with myca.key

The script is mostly self explanatory and contains an inline openssl config file - The main points to note are:
1. Extension are to be placed separately in a named section
2. Custom extension are of the form oid=DER:<DER-Encode-Hex-Values>
3. openssl command x509 should be given the extension file name and section name

#! /bin/sh
# Filename: genkey.sh

if [ $# -lt 1 ]; then
echo "Usage: $0 ca-name [new-cert]"
exit -1
fi

ca="$1"
new=${ca}

if [ $# -ge 2 ]; then
new="$2"
fi

if [ -f ${new}.key ]; then
echo "${new} already exists: Delete ${new}.key & ${new}.crt to proceed"
exit -1
fi

#----[ inline config file ]--------------------------------------------

ca_extensions="ca_extensions"
cert_extensions="cert_extensions"

config=.${new}.config
cat > ${config} << EOF
[ req ]
default_bits = 2048
default_keyfile = ${new}.key
distinguished_name = req_distinguished_name
attributes = req_attributes
prompt = no

[ req_distinguished_name ]
CN = ${new}
OU = ouTest
O = oTest
C = IN

[ req_attributes ]

[ ${ca_extensions} ]
basicConstraints=critical,CA:true
subjectKeyIdentifier=hash
keyUsage=keyCertSign,cRLSign
authorityInfoAccess=OCSP;URI:http://ocsp.test.com:8080/

[ ${cert_extensions} ]
subjectKeyIdentifier=hash
keyUsage=critical,digitalSignature,keyEncipherment
certificatePolicies=1.2.276.0.76.4.64
crlDistributionPoints=URI:ldap://ocsp.test.com:389/cn=test Komponenten Testreferenz CA01
authorityInfoAccess=OCSP;URI:http://ocsp.test.com:8080/CMOCSP/OCSP
authorityKeyIdentifier=keyid
1.3.36.8.3.3=DER:\
304DA421301F310B30090603550406130244453110300E060355\
040A130767656D6174696B302830263024302230150C13416E77\
656E64756E67736B6F6E6E656B746F72300906072A8214004C0477
extendedKeyUsage=clientAuth,serverAuth

EOF

#----[ Generate key and sign ]------------------------------------------

# 1. Generate Key & CSR
openssl req -new -nodes -config ${config} > ${new}.csr

# 2. Self sign (or) Sign with CA
if [ ${new} == ${ca} ]; then
echo "Generating self signed CA: ${ca}.crt"
openssl x509 -extfile ${config} -extensions ${ca_extensions} \
-sha1 -req -signkey ${ca}.key < ${new}.csr > ${new}.crt
else
echo "Signing ${new}.crt with ${ca}.crt"
openssl x509 -extfile ${config} -extensions ${cert_extensions} \
-sha1 -req -CAkey ${ca}.key -CA ${ca}.crt < ${new}.csr > ${new}.crt
fi

rm ${new}.csr
rm ${config}

Resolutions for the year and after

2009-01-03T11:12:00.001+05:30

1. To overcome my laziness.
2. To be more focussed and ignore distraction.

Top two things needed to shape myself in to a better person.
Hopefully I will be able to overpower laziness and distraction.

Bypassing Websense

2008-12-30T13:43:00.000+05:30

Websense is a kind of proxy server that filters request to the internet and will block certain kinds of request - The most common way of blocking is to check the requested url against a black list.
The most common HTTP request is GET and looks like:

GET /path-to-file HTTP/1.0
Simply replacing this with something like the one below seems to confuse Websense, making it to believe that the url is not in the black list.

GET /path-to-file <2048-space> HTTP/1.0
While some web servers are also confused by such a request some others behave normally.

To change the request from the first format to the second one needs some one in between and the easiest is a proxy server and if it's in python it only gets more easier.
TIP: If using windows, the extension of the proxy file can be set as .pyw to run it invisibly.

The browser has to be configured to use a proxy but since some sites doesn't work with this proxy due to the request mangling, it is worth writing a proxy.pac file that uses the proxy only for certain sites.
QuickProxy is a nice add-on for Firefox that makes it easy to switch proxy configuration.

Yet another revival

2008-12-20T10:27:00.000+05:30

Time and again I try to keep my blog alive but after a few posts the interest fades away mainly due to the effort involved in posting. I have tried different tools but none could stand my laziness - but this time posting via email seems to be easy enough to carry forward my lazy ass.

Here it is - Google Chrome

2008-09-03T11:02:00.003+05:30

It's here to flame up the fire and I am exploring it right after waking up.

The first thing that can be noticed is the location of tabs, the tabs are located above the url box - It's like different independent browser windows joined together rather than a single window containing different web pages.

The URL is colour coded - The server name appears dark and the rest of the path appears in grey. https is highlighted in green. A tiny thing but it's much easier to identify the server name.

By default there are two processes while opening Chrome. The process count increases on creating the first new tab but subsequent new tabs doesn't increase the process count - The count increases only on loading a page.

Killing a process displays a message in the tab corresponding to that process and doesn't kill the entire browser - Good.

Very spacious - Tabs are merged with the title bar, no status bar, no menu bar.

Acid test results:

Only a boot strap is available for download which in turn downloads and installs the actual browser - This possibly may be for region specific customization but I had prefer the real installer.

Missing:
- Profiles
- Addons
- Couldn't find offline mode

@Me, should find more time to explore

Yet another new from Google's stable, Google Chrome, an opensource browser

2008-09-02T10:00:00.001+05:30

The war starts again, now with an extra battalion by the name of Google Chrome. With Firefox eating in to the shares of IE, Opera and Flock gaining popularity and with Safari's presence felt, the war is only going to heat up. Microsoft is already pushing IE8 as a safe and standards compliant browser. Firefox3 has set a new bench mark as a secure browser. Success for the new generation browsers will firstly depend on the security they provide against malware and phising sites, then secondly on the customization capabilities. Promises look good but wait till tomorrow.

Unified versioning for windows drivers

2008-09-01T13:52:00.000+05:30

Every new release of a windows driver involved updating the version number in a lot of places, mainly:
- The resource file
- The inf file
- The source file (Mainly for debug purposes)
This was a lot hectic until one day I sat down to unify the version updation to one file, which can be used in all places.

The result is the following file, which we shall call 'version.h'

#ifndef _VERSION_H_
#define _VERSION_H_

#if 0
STAMPINF_VERSION=1,0,0,1
STAMPINF_VERSION_STR="01.00.00.01"
STAMPINF_DATE="12/21/2007"
#else
#define VER_PRODUCTVERSION 1,0,0,1
#define VER_PRODUCTVERSION_STR "01.00.00.01"
#endif

#endif

It can be included in the source and resource file and the defines VER_PRODUCTVERSION and VER_PRODUCTVERSION_STR can be used.

It can also be safely included in makefile.inc and the defines STAMPINF_VERSION, STAMPINF_VERSION_STR and STAMPINF_DATE can be used to update the inf files using the stampinf utility that comes with WDK.

Now, every new release requires updating only a single file and has become a lot easier.

German health card - overly complex

2008-08-26T13:53:00.001+05:30

The German health card system seems to be overly complex for a health sector.

Test post from ScribeFire

2008-05-05T09:15:00.001+05:30

A sample post from ScribeFire.

Today's karate syllabus

2007-12-29T21:22:00.000+05:30

KATA-VASA++

Today's karate syllabus

2007-12-27T21:16:00.000+05:30

KATA-VASA+

Todays karate syllabus

2007-12-25T21:53:00.000+05:30

KATA-VASA - is a movement involving some blocks, punches and kicks.
GYAKU is reverse. Any punch with opposite leg and hand in the front is called a GYAKU-???-ZUKI.

MAE - Front
YOKO - Side
USHIRO - Back

GERI - Kick

MAE-GERI - Front kick

Pledge: (I don't fully remember)
I student of TATSUKAN-... hereby pledge, .... secrecy.

Todays karate syllabus

2007-12-18T21:50:00.000+05:30

4 th block - with the folded fist coming from the ear to the opposite shoulder level blocking with back of the arm.
shuto uke - knife hand block.

Todays karate syllabus

2007-12-15T21:20:00.000+05:30

REI is to bow.
YOI is the ready position.
DACHI-REI is to bow in standing position.
ZA-REI is to bow in the kneeling position.
GI is the karate dress.
OBI is the karate belt.

upper block
middle block
lower block

GIDAN-BA-REI

Third day in Karate class

2007-12-11T20:58:00.000+05:30

First, the master should be addressed as RENSHI. Second, the fist should be formed by tightly folding the first fold of the fingers (the first one from the tip), then the second and finally the third. The thumb should then be folded and pressed on the folded index finger - this makes a hard and solid fist. While attacking/defending, the back leg should be straight, the front leg should be slightly bent, both legs diagonally opposite and the feet should be straight pointing to the front.

Second day in karate class

2007-12-06T20:25:00.000+05:30

Learnt some more warmup exercises - They really are very effective. Learnt some punches (ZUKI) - upper (JODAN), middle (CHUDAN), lower (GIDAN) and the triple punch (SAN ZUKI).

The Japanese numerals:
1 - Ichi
2 - Ni
3 - San
4 - Yon
5 - Go
6 - Roku
7 - Shichi
8 - Hachi
9 - Ku
10 - Ju

First day in karate class

2007-12-04T20:00:00.001+05:30

This was a day come true. After long searches and delays, I finally found a karate school and that too a nice one. It's five minutes walk from my house and the style practiced here is Isshinryu. I was thought some warm up exercises and the bowing method (also called as rei). One should bow before the teacher every time before talking to him and at the end of the class. Also at the end of the class everyone should bow to the hall (dojo) as a mark of respect. Rei is performed by keeping the feet in V shape with the heels touching each other, the hands on the side with the palms resting on the side of the thighs and with a slight forward bend with the eyes facing the feet and pronouncing something which sounded like "HOIZ".

The power of fear

2007-11-24T22:45:00.000+05:30

The belief in a supernatural power, that which holds everything in control, that which can overpower humans, that which brings fear in to minds, and that we name as God, has been responsible in holding the humans together and preventing us from destroying each other. Today, I have been watching a documentary about Tibet on BBC. In Tibet the mountains are considered goddess and the lakes are sacred. This belief is deeply rooted in every tibetian and hence will naturally keep him aware of his environment and prevent him from polluting the lakes. Imagine, Had trees been considered sacred how different the world would have been now. I usually favour the idea of educating people and making them aware of the effects of pollution and teaching them to be environment friendly. But in real life it's much easier to achieve the same effect through fear.

One of those disappointing days

2007-11-22T21:33:00.000+05:30

This is one of those days when all news received are bad news. I just entered the office and the first shock was already awaiting my arrival - One of my colleagues mother passed away this morning. She was being treated for jaundice for the past one week. My heart felt condolence to Sivaraman and his family.

There were more bad news awaiting when I came back after lunch - Multiple failures were reported in submitted for certification.

More disappointments were awaiting in the evening.

:-(

Finding a Karate school

2007-11-20T21:21:00.000+05:30

For quite some time I have been planning to learn Karate. I started seriously searching for a Karate school since last week. My main criteria were quality of the school and the travelling time and my main reason for learning Karate was to keep myself fit and to increase my reflexes. I picked up a bunch of contacts from the internet and started contacting. Most were far away from my home but I found around 3 schools within 30 minutes travel from home. Yesterday, on contacting one of the schools, I was given a few details and was asked to come in person to get the fee details. I thought that I have found my school. Today morning I went to their school in spite of the heavy monsoon downpour. The details goes like this: 3 classes per week with 1 hour practice every class. The fees was Rs. 2000 per 4 months. I was also informed that there is a one year course costing Rs. 18,000 and that black belt will be awarded at the end of the course. I thought "Man how simple is it to get a black belt", but I had doubts in my mind. I consulted with one of my friends who, as a child, has trained for 2 years. He too had doubts and I decided to ask the more informed people and posted a query on the usenet. The response to which has made me rethink about this school. I am back to square one and have started my search again.

Driving you crazy

2007-11-19T21:07:00.000+05:30

With the ever increasing number of vehicles and lack of proper mass public transport system, Chennai roads are becoming worser every day. Lack of courtesy to the fellow road user has made the roads an unpleasant place. One can travel 5 km along any road and easily see one or two instance of quarrels. One of my fried has forwarded this - Driving a cultural change. It's not entirely impossible to get near the goal stated in the link but I believe that no number of rules or enforcement will change the situation. Instead the general attitude of the people should be changed. People should be thought to be considerate to others. Todays news has brought in a little relief, not that the government has changed the rules overnight and the roads will be a different place from tomorrow but because the department has at least acknowledged the fact that we are lacking behind and something has to be done about it. And yes, the driving schools are the right place to start with.

"There is a net addition of about six-seven lakh vehicles on the streets every year."

Thats a woofing sum. Isn't there a city planning / managing division?

Android in the wild

2007-11-15T20:40:00.000+05:30

With the release of "Android", Google has triggered another round of internet activity - Which ever site I happen to land on seems to be talking about Android. Here's one for my part, which, I also see, as an opportunity to revive my blog.

Android is a software development kit from Google using which one can develop applications for mobile phones. Mobile phones have gone a long way from being a simple handy used to talk with each other to a fully blown device with capabilities on par with a desktop computer, hence this seems to be a logical move by Google.

Google is not actually manufacturing the hardware but rather gives the software and the tools required to write softwares for the phone. This has opened up a lot of interest and enthusiasm and I can't just wait to see all the different kinds of applications that will be running on the phone and with the announcement of a prize money for the best application Google has intensified the race to write the best application for this platform.

Android comes with an phone emulator where one can test the applications. The emulator seems to be based on qemu which emulates an ARM v5T chip - ARM926J, 96 MB RAM and a lot of other peripherals and runs Linux 2.6.23.

Rather than this, I am actually looking forward for the release of the kernel and other sources that drives the phone.

The future of mobile phone has changed this October 12.