Replying to @PowerDNS_Bert
overwhelm the resolver with nsec3s and then \(quote Duke Nukem\): “Let God sort them out.”
Mon Jan 31 08:56:47 +0000 2011
The 3 in NSEC3 represents the number of people that actually understand all the corner cases. #dnssec #nsec3
Mon Jan 31 09:00:45 +0000 2011
RT @bdekruijff: Can anyone at #samsung please fire the guy who concieved #kies!? What a worthless piece of crapware..
How about on-the-fly signing? In this example we add a signature
to any packet dealing with www.example.org. Again it is a
matter of defining the matching, action and setup functions.
We don’t have to match anything coming in, we only need to sign pkts on their way out. So the function becomes:
func match(m *dns.Msg, d int) (*dns.Msg, bool) {
// Matching criteria
switch d {
case IN:
// nothing
case OUT:
// nothing
}
// Packet Mangling
switch d {
case IN:
// nothing
case OUT:
if m.Question[0].Name == "www.example.org." {
// On the way out sign the packet
m = sign(m) // keys are global
}
}
return m, true
}
As you can see, it calls the sign() function where the actual signing
takes place. We just sign the first RR in the answer section —
if there is one.
Another application for Funkensturm is: delaying packets.
Here we only delay packets with the recursion desired bit (RD)
set, but it can be easily be changed to check for other
properties of a packet, see godoc dns for all elements of
DNS packets.
The configuration is similar as described here.
The matching function becomes:
// the only matching we do is on the RD bit
// for incoming packets.
func match(m *dns.Msg, d int) (*dns.Msg, bool) {
// Matching criteria
var ok bool
switch d {
case IN:
// only delay pkts with RD bit
ok = m.MsgHdr.RecursionDesired == true
case OUT:
// nothing
}
// Packet Mangling
switch d {
case IN:
// nothing
case OUT:
// nothing
}
return m, ok
}
First a delay helper function. As shown here it returns true if
the delay time isn’t reached, and false if a something should be
delayed.
A transparent proxy is a proxy that does nothing, but it serves as a nice introduction into Funkensturm.
See this post for an architectural overview of Funkensturm.
Currently a configuration is compiled into the Funkensturm binary. As such it must look like a normal Go program.
The matching function checks a packet for features and can optionally modify it.
This is the prototype of a matching function:
func match(m *dns.Msg, d int) (*dns.Msg, bool)
It receives a *dns.Msg which is a packet in Go DNS and a direction d
which can be IN (first incoming packet) or OUT when the packet is
on its way back to the client. It returns a DNS packet and a boolean
value signaling a match.
A proxy is something this sits between a client and a server and does something with the data flowing through it. So a DNS proxy does this for DNS packets.
Funkensturm consists out of 3 configuration parts:
true is returned.With this setup you can change incoming packets before they are send through to the server. And you can change packet coming from the server that are send back to the client.
…Or why shell scripting is not really programming. Two scripts, one
called bash-hate:
#!/bin/bash
count=0
cat /dev/null - | while read line; do
((count++))
done
echo $count
and the other one zsh-love:
#!/bin/zsh
count=0
cat /dev/null - | while read line; do
((count++))
done
echo $count
Then:
% cat testfile | ./bash-hate
0
% cat testfile | ./zsh-love
9
(Yes, I know about subshells. Just learn a real programming language.)
Doing cryptography is hard, luckily there are enough libraries out there that help you with it. OpenSSL is probably one of the best (known). Go has its own crypto library, which is written in pure Go.
Now with these aids crypto becomes doable for mere mortals, but all these libraries work with buffers which hold the data, the signature and sometimes the key also. Off-by-one errors in composing these buffers leads to a “Bogus signature” error (in DNSSEC). The problem here is that you don’t get any other clue on what went wrong. For me as a programmer an error such as “Shift buffer A one byte to the left and you’re OK”, would be much better. But due to the nature of crypto these kind of errors are not possible, nor desirable.
I’ve implemented axfr in my Go DNS
library in nice and Go-like way (at
least that’s what I like to think).
Starting an axfr results in a channel which can then be used with
the range keyword to loop over it, until the entire axfr is
received.
First the normal begin of a Go program:
package main
import (
"fmt"
"dns" // DNS package
)
Then we start the main function in which we define a new resolver and
a channel for receiving the axfr messages. The channels will
send dns.xfr messages which is defined as:
Lekker dat schuifelen over de ijzel
Fri Dec 31 09:33:13 +0000 2010
@WebAudience die was makkelijk! #nsa maar wel leuk
Fri Dec 31 09:37:28 +0000 2010
RT @jeroenbulten: Yes. De validating resolver doet het. http://twitpic.com/3ljnmz
Fri Dec 31 11:55:42 +0000 2010
So I can pack/unpack uint8/16/32, string, hex, etc. Looking at TSIG RFC: time_signed: uint48, 48! *GRRRR* #godns
Fri Dec 31 15:14:38 +0000 2010
Staan hier 2 jongetjes vuurwerk af te steken en het wordt meteen al mistiger. Beloofd wat voor vanavond.
And finally, after so many years miek.nl can be DNSSEC validated from
the root down. Check it
yourself.
[ post updated to reflect changes in the library ]
This library takes a new, innovative and enterprise ready
approach sends and receives queries to and from the DNS.
The
library was forked from the official DNS code in Go (in the net
package). Since that time Go team has thrown out this code and started
to use the system’s C library via a wrapper. I was however struck by the elegance of the
code (esp. the pack and unpack functions), so I forked it and added
new record types (AAAA, DS, RRSIG, etc.) and turned into a more
general DNS API.
I’ve extended the
DNS filesystem
a bit and added the possibility to
WRITE to it. This only works for zones which utilize dynamic
updates.
You can now mount the world and write to it!
Also TSIG should be supported (but I have not tested it - as I’m
lazy). For TSIG you need a file (named “dynupdate” here with the
following):
# domain tsig-key name key
miek.nl tsig-key awwLOTrFPge+rRKF2+DEiw==
Code is still contained in a single Perl file.
This is the second time I’m writing this, but now its much better then the previous attempt.
The idea is as follows, using Fuse and Perl this is an actual filesystem which maps the DNS to files and directories.
You can now mount the world! :-)
The following holds true for this filesystem:
/NL/MIEK/soa
is the soa record of miek.nl;fs ask for ns a aaaa txt soa dnskey rrsig and ds
to see if they exist.So /NL/MIEK/A is the name a.miek.nl and
/NL/MIEK/A/a is the A record for a.miek.nl. /NL/MIEK/soa is the
SOA record for miek.nl (as said above).
@sidn heh, at least it isn’t DNSSEC related
Tue Nov 30 14:12:25 +0000 2010
Replying to @bdekruijff
goede verhalen vertel je het beste in de kroeg! Wanneer?
Tue Nov 30 19:36:54 +0000 2010
@BartVroom @bdekruijff vrijdag it is. 8 uur? Haantje?
Tue Nov 30 20:17:40 +0000 2010
Where is the 10" Android \(3\.0?\) based tablet. Hurry #google. I want to spend money \(not to much though\)
Zo daar sta je dan in santiago de chili, eerste biertje achter kiezen, nu de stad in
Sat Oct 30 16:15:50 +0000 2010
RT @wmacgyver: Learning #golang book available in PDF format http://j.mp/b9AXss
This morning I’ve tagged version 0.2 of “Learning Go”. Among the larger changes is that “Interfaces” is now a separate chapter.
I have also removed/added/updated the text. Fixed mistakes in the text and code (and probably added new ones).
To get it:
Feedback is welcome.
Of course a lot of work still needs to be done:
It is already possible to use filters in Git. But embedding the current file name in the expanded string is somewhat harder.
You can do this by some edit wrapper which inserts the file name “at the right time”, but I think it is much more cleaner to do this in the git-filter script.
For Puppet I want system administrators to see from which directory in the Git repository the file came from, like so:
If you know LaTeX, you know that precise float placement (I want this
figure to positioned right here) is almost impossible. But what nobody
told you is that there exists a
float
package (only since 2001 - maybe even earlier). With this package you get a new placement modifier:
[H], which means: “Put this damn figure right here!”.
LateX users everywhere cheer.
Specifics are described in the pdf in the package. Using it
on Ubuntu/Debian
I’m preparing a 0.2 version of the Go book I’m writing. There are lots of small tweaks in the text and in the layout. I still need to extend the number exercises (and enhance the answers a bit), but it is slowly coming together.
There is a new chapter on how to write programs that communicate with the outside world (via files, sockets, etc.).
Some infrastructure work includes an automatic code checker — sadly written in Perl.
Well, the upgrade was easy enough, some weird LDAP database corruption
that was fixed easily by running db4.7_recover in /var/lib/ldap.
There is something fishy going on in /etc/nsswitch and using ‘files’
instead of compat. Got lots of segfaults:
[90474.491264] zsh[5668]: segfault at bfcf07ef ip 001be398 sp
bfce4efc error 6 in libnss_files-2.12.1.so[1bc000+a000]
Not enough for a bug report (yet), I still need to examine this further.
Hoppa: pxe + puppet + git werkt perfect, servertjes komen op en wordt autom. geconfigureerd
Thu Sep 30 10:53:30 +0000 2010
Nice idea and looks like a promising configuration tool: http://augeas.net/index.html
Thu Sep 30 12:14:45 +0000 2010
Helemaal in mijn sas met mijn nwe samsung galaxy
Replying to @bdekruijff
2 proggies, wat flashen en klaar. Ik ga snel ook de foon van @snavaes flashen
Tue Aug 31 05:32:11 +0000 2010
Mental note to self: nieuw toetsebord regelen. Die HP’s zijn ondingen
Tue Aug 31 09:25:36 +0000 2010
Ja, dat krijg je er nou van... http://tinyurl.com/36b59c8
Tue Aug 31 11:49:24 +0000 2010
Heb de flash kriebels: zo maar eens een nightly build op een hero flashen \(of 'm bricken\)
Congrats to SIDN
% dig +dnssec +multiline DNSKEY nl
;; ANSWER SECTION:
nl. 6547 IN DNSKEY 256 3 8 (
AwEAAbXfJH0LevocrgMOI62Y0+oD02AxPrsXja59z11c
cqgW527Ghac2f1aj32a4c1Wc+H6UhTy+daf6LkVytw0l
lMmzDDVn/YHcfh7B+9DdbVjdBHvY6q+YTnZbsU3wGwod
PMneYJZl8d47eFYmraKKl/endifNukan0z4GkaKYHuI1
) ; key id = 37408
nl. 6547 IN DNSKEY 257 3 8 (
AwEAAekt0eDh+EmOVQMh1av++d5F6eS3B85YkFW9OBQN
8X9EA1rG8vl9TRHFBUfpu/vIaUJeuXV9tm/PO+qhNyIL
WxI26W1t1/EKr1WhbaNsLXPMhjtuelPqpxuQL/onXvhB
83uPcF88pjnKmu73pcdhInLfYkf4JfARztj4e+xaddoL
5eJ0Fj3KMVd303NAsH0tmRPBi3EGMAOtM4Ic84Rn8ZkH
bwmVUQ3n4qRYaLpgvmpX82RUpEkgPxhrrJGENp1QYGPv
0oWPWkcJcSUGsEBgjLSal5IzTJmOEFm7nzbvyrfq/KJX
PZZRfJgPpFPwqNfY+GlTfb39kDEcB34z2LCNM2U=
) ; key id = 38420
nl. 6547 IN RRSIG DNSKEY 8 1 7200 20100902004149 (
20100819064254 38420 nl.
0/C52WJ2OjQZOrP8y7relQWGVS5gmJLnwnrbic7dGNeJ
PVjI7W2gXgt8vVTg36bQ6gVpX7GG2zwvNA/cYTGYnfvF
n+0HpA8oZLqeVh1rbQR3oU+iym5F4vX1pka7pbJk358x
O9B9KsMFXH9exCoHHXzu/SU3D/TPZ60imrNgvJp6iOci
kPeomSQhwKmyyKBUheaOocdV/XIMtzFwOnKYV6bu9wCq
PXtOj4Qhp8Ty7mGMnOSpgAzwWcksvqmSZeNpC/tLT/57
TxefWNNGlbdY7+fxvA0T+AQVn0xctsS1y194SAv92kZW
azVQ9+ZYxQLVZqwSl1/ZBo8spxT1aiwMnw== )
Write a number cruncher that works as follows:
Pick six (6) random numbers from this list:
1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 25, 50, 75, 100
Numbers may be picked multiple times.
Pick one (1) random number (i) in the range:
1 . . . 1000
Tell how, by combining the first 6 numbers or or subset with the operators +,-,* and /, you can make i;
I’ve tagged an 0.1 version of the book I’m writing: “Learning Go”. It currently has 7 chapters. The first five are finished. Chapter 6 and 7 still need work. The exercises can also use some (more) love. The current chapter list of “Learning Go” is:
To get it:
If you have comments, text or exercises feel free to drop an email.
There are no formatting rules when writing Go code, but there is an official
style. If you pipe your code through gofmt, its output is the
official style. So while writing you need to occasionally execute:
%!~/bin/gofmt (which I’ve wrapped in a command, so I only need
to type :Fmt).
But the trouble is that executing this code resets the cursor to the first line and you then have to jump back to whatever line number you were on.
The last couple of days I’ve been working on (better) DNS support in Go. I think it would be very nice to get something like ldns in Go, but then in less lines of code.
I’ve just published the first code on godns @github. This is heavily based on the DNS implementation currently in Go, in the net-package. Current additions consist of:
hex or base64;More info (well not a lot at the moment) can be found here.
I have done programming in (or at least looked at) the following computer languages during my live. Of course the world is not a perfect place, but some languages out there are just plain awful.
BASIC - with line numbers! At the time (I was 11) didn’t know there was something else out there. Fun and easy language, although I never programmed in it ever again.
Pascal - After BASIC, there is no going back to Pascal. Only briefly looked at it in my youth and discarded it in favor for BASIC…
Te hard gewerkt vandaag, pas nu lwn.net lezen...