Lunesu - Knowledge Base

Show current GIT branch in TCC

nospam@example.com (Lio) — Fri, 03 May 2013 07:02:39 +0000

I'm getting more and more familiar with the GIT workflow, which goes kinda like this:

git checkout -b topicbranchX
git add somefile
git commit -m"commit message"
git pull
git rebase master
git push

Unfortunately this means that you'll end up with a bunch of branches (which you can delete once they get pulled into origin/master) but I keep forgetting what branch I currently have checked out. I've seen bash prompts that show the current branch and I decided to do something similar for TCC/LE.

/*
@cl "/Tp%~f0" /nologo /GS- /link /SUBSYSTEM:console /nodefaultlib /entry:_main kernel32.lib
@goto :EOF
*/
#define WIN32_LEAN_AND_MEAN
#include <windows.h>
const WCHAR root[] = L"..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\.git\\HEAD";
int __stdcall _main() {
  int offset = sizeof(root)/2 - 10;
  while (offset >= 0) {
    HANDLE h = CreateFileW(root + offset, GENERIC_READ, FILE_SHARE_READ, NULL, 
      OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
    if (h != INVALID_HANDLE_VALUE) {
      char buf[64];
      DWORD read = 0;
      if (ReadFile(h, buf, sizeof(buf), &read, NULL) && read > 16) {
        DWORD off = 0;
        DWORD len = 7;            // show 7 hex digits
        if ((int&)buf[0] == ':fer') {
          off = 16;               // skip ref: refs/heads/
          len = read - off ;     // keep LF
        }
        WriteFile(GetStdHandle(STD_OUTPUT_HANDLE), buf + off, len, NULL, NULL);
      }
      return 13 - offset / 3;
    }
    offset -= 3;
  }
  return 0;
}

What's fun about this file is that you can save it as "gb.cmd". When you then enter "gb" on the command line, it will actually invoke the C compiler (remember to run vcvars32) to generate the gb.exe. Next time, the exe will be invoked instead.

This is the final prompt:

prompt %%@exec[@gb.exe]$e[1m$P$e[0m$_$+$g

Finally: unbound + dnsmasq

nospam@example.com (Lio) — Mon, 25 Jun 2012 13:33:57 +0000

I've been using unbound as my only DNS server for over a year now. It's a recursive and caching DNS server with DNSSEC (a.o.) support.

This is particularly interesting for people living in China: the GFW's first line of defense (if you can call it that) is spoofing DNS. If you use the DNS server provided by any of the Chinese ISPs, you're unlikely to get any meaningful IP for domain such as facebook or twitter. But if you go through the whole recursive query yourself (ie. ask the root-servers for "com", ask the .com servers for "facebook" and ask the facebook servers for "www") then you will get an IP, which you can potentially verify using DNSSEC. Because facebook and others constantly add new servers to their datacenters, with new IPs, it's likely that once you get the right IP, you can actually connect to the server, without the need for VPN.

Unbound is easy to setup. For me, "opkg install unbound" was half the battle. The other half involved editing /etc/unbound/unbound.conf. For a detailed walk through, check this great site [calomel.org]. Here's my current unbound.conf:

server:
neg-cache-size: 0
use-caps-for-id: yes
prefetch: yes
port: 533
do-udp: yes
do-tcp: yes
interface: 0.0.0.0
#interface: ::0
#do-ip6: no
val-clean-additional: yes
harden-glue: yes
harden-dnssec-stripped: yes
rrset-cache-size: 1m
rrset-cache-slabs: 2
root-hints: "named.cache"
auto-trust-anchor-file: "root.autokey"

All this was working fine, but the problem was that local names in my LAN no longer got resolved. Unbound doesn't no anything about DHCP and it won't accept DNS registrations from local machines. Dnsmasq does know about local names, since it's the one handing out the IPs in the first place. Ideally, I use both DNS servers: unbound for external queries and dnsmasq for internal (and internal only!) queries.

Most of the time I query external names, so I'd tried to get Unbound to forward local queries to Dnsmasq. I configured Unbound to use port 53 and Dnsmasq to use port 533. Then, I added a forward-zone to unbound.conf:

forward-zone:
name: "lan"
forward-addr: 127.0.0.1@533

This was supposed to forward all queries in the "lan" domain (the local domain, as configured in dnsmasq/dhcp) to the dnsmasq server listening on port 533. Unfortunately, this didn't work. No queries got forwarded, even though a lookup for a local name did get suffixed with ".lan" by the clients.

So I flipped it around: dnsmasq on port 53, unbound on 533. Add the following to /etc/config/dhcp:

option 'nonegcache' '1'
list 'server' '127.0.0.1#533'
option 'port' '53'
option 'noresolv' '1'

This works: I can successfully ping my local computers and NAS, while still having other queries resolved (recursively) by unbound. I used dns_verify.sh to check my setup:

root@OpenWrt:~# ./dns_verify.sh

ip -> hostname -> ip
--------------------------------------------------------
ok 192.168.2.1 -> OpenWrt.lan. -> 192.168.2.1
ok 192.168.2.2 -> DaWang.lan. -> 192.168.2.2

DONE.

By the way, the script needs dig, which you can get by doing "opkg install bind-dig".

Real life example

nospam@example.com (Lio) — Sat, 11 Feb 2012 09:37:27 +0000

I never found the need to study those common unix utilities like sed, awk, xargs. Even my knowledge of grep didn't go further than blah | grep foo. Until yesterday, when I needed to accomplish a task that just happened to involve all of these utilities:

grep ppp /proc/net/dev | sed "s/:/ /" | awk '($2+$10>1000000000){print $1}' | xargs --max-args=1 --no-run-if-empty ppp-off

First, grep filters all lines from /proc/net/dev that contain ppp.
Then, sed changes the colon into a space using the regex s/:/ /.
Next, awk parses the values of the 2nd and 10th column [bytes sent and received] and if the sum exceeds 1GB it prints the value in the first column [the interface].
Finally, xargs invokes ppp-off for every interface returned.

Why I needed this is left as an exercise to the reader.

Server-side email filtering

nospam@example.com (Lio) — Tue, 24 Jan 2012 08:58:04 +0000

I hate etc/ and everything in it, but I realize it might not be etc/'s fault. The fault might lie with Google and Bing: most of the results I get are people asking the same question on some forum. These threads often end without any answer. Or worse, wrong information. About half the threads eventually end up with the members discussing a complete different issue. Anyway, I figured it out. The following example assumes you're using the maildir format for your mailbox.

Create a file called .procmailrc in your home folder and add the following contents:
DEFAULT=$HOME/Maildir/
MAILDIR=$HOME/Maildir

:0:
* ^Mailing-list: list staff@somedomain\.com
.SomeFolder/
Tell postfix to use procmail for mail filtering/processing by adding/changing the following line to /etc/postfix/main.cf:
mailbox_command = procmail -a "$EXTENSION"

Restart postfix
sudo /etc/init.d/postfix reload

As you can see, the rules in .procmailrc use regular expressions to find the right mail. Each rule starts with colon-zero-colon (see man procmailrc for more options), followed by a line with the regular expression. Here, ^ means beginning of the line. Note that dots must be escaped with a backslash. A wildcard would be written as .*
The next line describes what to do when the regular expression is matched. In this case we want procmail to deliver the mail to a folder called SomeFolder. (If you're using mbox instead of maildir this would be a filename rather than a folder name.)

Add as many rules as you want, separating them with an empty line.

"110V" really means 110V

nospam@example.com (Lio) — Mon, 16 Aug 2010 12:37:14 +0000

Long story short: I've been to the US a few weeks ago and I thought I'd pick up a new Xbox 360 250GB while I was there, seeing as those are hard to find in China. I assumed its power supply would accept both 110V and 220V (like my PS3 and most modern PCs and laptops.) Well, it did not.

Of course, I did not just plug it in and watch explode. I first opened up the power supply (not an easy feat, let me tell you) and only plugged it in after noticing the board inside had "250V" written on it, with a check mark next to it. Not sure what that meant though. It still blew up after I plugged it in.

I already had a plan B from the moment I bought the Xbox: the power supply output 12V and 5V, much like a regular PC power supply. So I bought a (mini) ATX power supply and went online to see if I could find the pinout. Plenty. When I plugged in the ATX power source, I measured the voltage on a few pins, but got nothing. Then I remembered the fact that an ATX power supply does not really turn on until the PC tells it to. This is done by shorting pin 14 of the ATX plug (green wire) to ground (black, any will do.) Once I did that, I got all the power I needed.

The pinout on the Xbox side was harder to come by. I had found a few for the old Xbox 360, but none for the new slim model. Fortunately there were some hints on the PSU's board:

Yellow 12V
Black GND
Red 5VSB
Blue PS_ON
Gray RSENSE

I thought I'd check what I could get away with: I connected the yellow wire from the Xbox to the yellow wire of the PSU. Same for the red wires, and black wires, matching the colors. Then, I turned on the power supply by connecting the green wire on pin 14 to a black wire. I pressed the button on the Xbox: success!

Having the power supply turned on all the time was not something I liked though. So the next step was to get the power supply to turn on together with the Xbox. By measuring the voltage I saw the blue PS_ON wire being pulled up (~3.3V) when the Xbox wants to turn on. In order to do this, the Xbox needs some power though. This is done by the red "5VSB" wire. The "SB" stands for Stand By. This means that the red wire from the Xbox must not be attached to the red ATX wires, but to the purple wire on pin 9.

This page explained how: use a transistor or optocoupler that will connect the green ATX wire to GND when the blue Xbox wire goes up. I had no optocoupler lying around, or so I thought. I then noticed the blown up power supply on the table. There were some things on it that looked a lot like optocouplers. Sure enough:

The datasheet for the EL817 can be found here.

So, pin 1 of the optocoupler (the pin near the dot) will be pulled high, to ~3.3V. We want to give the LED inside about ~1.2V, that leaves 2.1V for a resistor. At about 20mA this means we need a V/I=R 2.1/0.02= ~100 Ohm resistor. 100 Ohm = 10*10, 10 times 10 to the power 1: we need a resistor with Brown, Black, Brown rings. Luckily I found one

I had everything I needed:

Yellow (Xbox) - Yellow (ATX)
Red (Xbox) - Purple (ATX)
Blue (Xbox) - Resistor - Optocoupler pin 1
Black (Xbox) - Black (ATX)
Optocoupler pin 2 - Black (ATX)
Optocoupler pin 3 - Black (ATX)
Optocoupler pin 4 - Green (ATX)
Gray (Xbox) - unused

I had no idea what the gray RSENSE wire was for, so I just ignored it and it worked fine! Once I got everything figured out, I opened up the ATX PSU and removed all the wires I didn't use. Important: there was a brown wire that got connected to a orange (3.3V) wire IN the ATX power connector. So after cutting of the connector I had to connect the brown wire to 3.3V somewhere inside the PSU.

And all it cost me was an ATX power supply and 1 blister. Not bad

UPDATE: Here's the schematic for the whole thing:

LinkStation playing music!

nospam@example.com (Lio) — Fri, 19 Mar 2010 06:02:40 +0000

Inspired by this page on NAS-Central, I ordered a USB sound card on TaoBao (15 RMB including delivery!) and plugged it into my LinkStation. A quick dmesg showed that the device was detected, but not recognized.

The NAS-Central page mentions that some kernel modules are needed to get USB audio to work, but of course, the device does not have these modules by default. After googling for a few hours I still could not find any precompiled modules that matched my LinkStation's kernel version, 2.6.22. I decided to jump in and try to compile the modules myself.

So how do you compile kernel modules?

Well, first of all you'll need the correct kernel sources, but that's easy: Buffalo provides them. Download the linux-* package that matches your NAS.

Now you need a compiler. Turns out Buffalo uses CodeSourcery so we best stick to that as well. Get the pre-compiled cross-compilation toolchain here. Select "ARM GNU/linux" and the operating system that you will use for building. No need to download the toolchain source.

Before we can compile the modules we need a kernel configuration file. Some Buffalo source packages seem to include it (the file is called .config and is hidden because of the leading dot) but the one I downloaded did not include one. Copy this file into the root of the folder where you've extracted the Buffalo sources. This .config file most likely has all support for audio disabled so we'll enable it by adding CONFIG_SND=m (or check whether there's a CONFIG_SND present and change that to =m). The 'm' tells the make file to build it as a separately loadable module, instead of building it into the kernel. (Since I didn't want to change the stock kernel, I had to build loadable modules instead.)

Now the good part starts: make modules

The make file should notice the new CONFIG_SND directive and ask you about the specific sound related modules. Make sure you answer 'm' to all of 'em. You don't need them all, but figuring which you need/don't need is too much work.

When make is done we need to 'install' the modules, but not in our host/build system of course! Use the INSTALL_MOD_PATH directive to copy the built modules into a separate folder: make modules_install INSTALL_MOD_PATH=/tmp/MyModules

When done, copy all the files from /tmp/MyModules/lib/modules/2.6.22.7ownkernel/kernel/sound (recursive) to your NAS. Now comes another the tricky part: loading the needed modules. The module you need is snd-usb-audio and snd-pcm-oss, but before this one will need you'll have to load a couple of others. The normal way this is done is to move the modules into the NAS's kernel folder and issue a depmod -a to update the module dependecies and a modprobe snd-usb-audio to load the module with its dependencies. I did it the wrong way: using insmod to load each module by hand, and trying to figure out the order in which to load them by trial-and-error. Eventually, insmod snd-usb-audio.ko loaded without complaints.

Last step: create the device nodes. As per the NAS-Central page:

cd /dev
addgroup audio
mknod -m 660 mixer c 14 0 ; chgrp audio mixer
mknod -m 660 mixer1 c 14 16 ; chgrp audio mixer1
mknod -m 660 dsp c 14 3 ; chgrp audio dsp
mknod -m 660 dsp1 c 14 19 ; chgrp audio dsp1

I am now able to stream music using mpg123, madplay, mpd (all installable using ipkg.)

The sound quality of that 15 RMB sound card sucks though

Here's the final .config file I used to build the sound modules.

My first published Android app!

nospam@example.com (Lio) — Thu, 11 Mar 2010 14:51:47 +0000

I've just finished my first app and have published it on the market! The app is very simple: it shows the current air quality in Beijing, as measured by the US Embassy. Scan the QR Code on the right and my app will pop up in the market app.

(project page on Google code)

DKIM: DomainKeys identified mail

nospam@example.com (Lio) — Tue, 09 Mar 2010 04:53:00 +0000

In a last effort to save e-mail from being obsoleted, some guys at Yahoo thought of the DomainKeys system to prevent message spoofing. SMTP servers that are DomainKeys-aware can check the contents of the message to find out whether it was really sent by the person mentioned in the From: mail header.

To be honest, I'm more of a fan of SPF. It's an incredibly simple protocol and I really can't think of any reason it shouldn't be used by any mail server. (Interestingly, the Yahoo mail servers don't use it, probably to boost acceptance of DomainKeys.)

Let's explain SPF first, since it so much easier. In a nutshell: SPF uses DNS records to identify which IPs are allowed to send mail for a domain. So a server receiving mail for somebody@example.com would fetch the SPF record from example.com and check whether the IP of the connected SMTP client is actually allowed to send mail originating from the example.com domain.

That's it, it's that easy. Since I'm hosting my own mail server, my domain's SPF record just mentions my mail server's IP (actually, it doesn't mention the IP directly, but refers to its DNS A record.) A server receiving an e-mail that was allegedly sent by me will just have to check whether the SMTP client is in fact my own mail server and if it isn't, reject the mail.

DomainKeys is a little more advanced. Instead of checking the IP, it will check all contents of the message. It's like the mail server is signing the message on your behalf. Using DKIM, each outgoing message will be signed using the server's private key, and DKIM signatures present in the incoming message will be checked against the originating server's public key. That public key, by they way, is distributed using a DNS record, similar to the way SPF records are distributed.

Here are the steps I did to get DKIM working on my server. First, create an RSA key pair:

openssl genrsa -out private.key 1024
openssl rsa -in private.key -out public.key -pubout -outform PEM
sudo mkdir /etc/mail
sudo cp private.key /etc/mail/dkim.key

Now you'll have to add the public key to your domain(s) DNS entry. Do this by adding a TXT record for selector._domainkeys.yourdomain.com, where selector can be anything, but make sure to mention the same selector in the config file.

Next, install dkim-filter and edit the /etc/dkim-filter.conf Domain, KeyFile and Selector settings. Domain= comma separated list of domains for which to sign the mail; KeyFile= path to above keyfile; Selector= domain name prefix.

sudo apt-get install dkim-filter
sudo vi /etc/dkim-filter.conf
sudo /etc/init.d/dkim-filter restart

Add the following to /etc/postfix/main.conf:

# DKIM
milter_default_action = accept
milter_protocol = 2
smtpd_milters = inet:localhost:8891
non_smtpd_milters = inet:localhost:8891

and restart postfix.

To test whether it's working as it should, send yourself a mail and inspect the headers. Or, you could for example send a mail to a gmail account and gmail will show that the mail is "signed-by" your server.

Site moved!

nospam@example.com (Lio) — Sat, 27 Feb 2010 10:25:22 +0000

I've moved this blog from directnic.com to my own VPS. This blog is using Serendipity, which consists of a bunch of files for the webserver and a MySQL database. (I during the move I noticed that the new version supports SQLite backend, which would have made this whole process a lot easier.)

What I did:

Copy all files from the old server to the new server, using ncftp's recursive mget.
Dump the MySQL database using mysqldump
In MySQL client: create a new database using CREATE DATABASE xxx, select it using use xxx and execute the exported SQL script using source dumpfile
Configure an Apache virtual server for the lunesu.com domain. Note to self: must check Include all addresses in Webmin's Networking and Addresses Apache configuration tab.
Apply the new Apache configuration.
Add lunesu.com to my local hosts file, to be able to test the new site without having to change the DNS settings.
Oops: ncftp did not get the serendipity_config_local.inc.php because it was readable by user httpd only! The only way I was able to copy this file was by uploading a dummy PHP script with the following contents: <? header('Content-Type: text/plain' ); readfile("serendipity_config_local.inc.php");
UPDATE serendipityConfig SET value="/var/bla/path" where name="serendipityPath";
I also had to change some folder permissions: chmod 1777 . archives upload plugins templates_c

The serendipity Weather sidebar plugin failed to work. I read that it needs the PEAR:Services-and-Weather module for PHP so I installed that using sudo apt-get install php-services-weather. Unfortunately, that completely borked my site. I was able to track this down to a function in Serendipity called get_plugin_title. Apparently, even with that module installed, the weather plugin still wouldn't work. Fix: disable the weather plugin.

Mail troubles

nospam@example.com (Lio) — Thu, 10 Sep 2009 14:52:02 +0000

Back from holiday, no job, but my lunesu.com mail stopped working so that should keep me busy a couple of weeks.

The mail (like this site) was still hosted at directnic, so when their mail server stopped working this morning I had enough motivation to move my lunesu.com mail to my new VPS.

Since postfix was up and running from the beginning, there was little left to do. I just had to instruct postfix to accept mail from all my domains, not just the main one from the hostname. This could be done from within webmin: Server, Postfix Mail Server, General Options, What domains to receive mail for. Select the last option. I just appended lunesu.com to the comma separated domain list. Click Save and apply.

Next step: fix the certificate warning I get when trying to send mail through my own server. The fix: in Webmin's Postfix page, select SMTP Authentication And Encryption. Change the paths of the certificate and private key files to the ones created before. Save.

I also use a lot of aliases. Basically, I create a new mail alias each time a vague site wants my email address. Since I have about 25 aliases, I use Webmin's Edit Map Manually option in its Mail Aliases page. This works fine, but it won't be applied automatically after save! I had to run the following command as root for the aliases to start working:

newaliases

Another thing I noticed is that Postifx apparently always recognizes addresses of the form account+suffix@domain and delivers them to account, without the suffix. This how I made most of my aliases in the first place, so all of those with a plus sign could be removed from the aliases map. (Of course, the part before the plus sign must still be an existing account name or alias.)

So, most of it seems to be working at the moment, but no anti-spam yet, which is really the next thing I need to figure out before I get drowned in spam messages.

Static assert in C#!

nospam@example.com (Lio) — Tue, 17 Feb 2009 08:48:27 +0000

partial class StaticAssert
{
byte a = RenderQuality.Low < RenderQuality.Medium ? 0 : -1;
byte b = RenderQuality.Medium < RenderQuality.High ? 0 : -1;
}

Apparently ?: is being folded at compile time, resulting in the following error if the constant expression before it evaluates to false:

Constant value '-1' cannot be converted to a 'byte'

I use partial class to prevent collisions with multiple static asserts in the same namespace, although you will still have to come up with unique variable names.

Also, I've hidden my post about [tee'bet] to see if that will lift the blockade of my site in China.

How to change the language for GIMP/SVN

nospam@example.com (Lio) — Wed, 07 Nov 2007 14:01:00 +0000

The language for the GIMP and the SubVersion command line tools can be changed to another language by setting the LANG-environmentvariable to "en".

LANG=en

Tunneling wget

nospam@example.com (Lio) — Tue, 10 Apr 2007 06:02:00 +0000

It's too bad wget does not support a SOCKS proxy. To tunnel wget through an SSH tunnel you'll have to rely on a statically mapped port:

plink -L 8080:example.com:80 server

This command opens a local TCP port 8080 and routes all connections to example.com port 80, using an SSH connection to server. Here, server can be either the URL or IP of an SSH server or the name of a putty profile.

wget can now be pointed to the localhost:8080, but this won't work if the HTTP server is using virtual hosts. Use the --header= option to insert a fake host string in the HTTP request:

wget --header="Host: example.com" http://localhost:8080/.....

How to add a reference to an assembly inside the GAC

nospam@example.com (Lio) — Sun, 04 Mar 2007 05:41:00 +0000

From mztools.com:

You can follow this procedure to extract the assembly from the GAC:

Open a MS-DOS command window (click Start, Run... type cmd and press enter)
Use the SUBST command to map a drive letter to the GAC folder:

SUBST G: C:\Windows\Assembly

That maps the drive letter G: to the GAC folder. With the SUBST command you bypass the shell extension.

Use Windows Explorer to browse the G: folder. You will see the actual folders, with names like GAC, GAC_32, GAC_MSIL and one subfolder for each assembly. Once you locate the assembly DLL that you are looking for, you can copy it outside the GAC, to the \bin folder of your add-in project and add a reference to it.

When done, you can undo the mapping using:

SUBST G: /D

Outlook and OE address book support in Thunderbird

nospam@example.com (Lio) — Sun, 04 Mar 2007 00:17:00 +0000

From Chris Ilias' Blog:

To make Thunderbird use your Outlook Express address book, close Thunderbird, and add the following lines to your prefs.js file:

user_pref("ldap_2.servers.OE.description", "Outlook Express");
user_pref("ldap_2.servers.OE.dirType", 3);
user_pref("ldap_2.servers.OE.uri", "moz-aboutlookdirectory://oe/");

For Outlook Contacts, use these lines:

user_pref("ldap_2.servers.Outlook.description", "Outlook");
user_pref("ldap_2.servers.Outlook.dirType", 3);
user_pref("ldap_2.servers.Outlook.uri", "moz-aboutlookdirectory://op/");

One important note: in order for it to work with Outlook, Outlook must be set as the system default mail client.