WHMCR

As promised here’s a copy of my iPhone to Android script. Just a quick and dirty python script that reads in a backup from itunes and converts it to a bit of XML able to be read in by SMS Backup and Restore on the android platform

from sqlite3 import *
from sqlite3 import *
from xml.sax.saxutils import escape
import codecs
import re
f = codecs.open('sms.xml','w','utf-8')
f.write ('''< ?xml version='1.0' encoding='UTF-8' standalone='yes' ?>
<smses>
''')
# This is 31bb7ba8914766d4ba40d6dfb6113c8b614be442.mddata or 31bb7ba8914766d4ba40d6dfb6113c8b614be442.mdbackup usally
c = connect('sms.db')
curs = c.cursor()
curs.execute('''SELECT address,date,text,flags FROM message WHERE flags &lt;5 ORDER BY date asc''')
for row in curs:
        a= escape(unicode(row[0]))
        d = escape(unicode(row[1]))
        t = row[3]-1
        t = str(t)
        b = re.sub('"',"'",escape(unicode(row[2])))
 
        f.write( '<sms protocol="0" address="'+a+'" date="'+d+'000" type="'+t+'" subject="null" body="'+b+'" toa="0" sc_toa="0" service_center="null" read="1" status="-1" />'+"\n")
f.write(
'''</smses>''' )

This is just a quick post from the desire to check the WordPress client, which seems to be much a muchness with every other client I’ve tried! Still getting used to the keyboard on this though!

I’m in the process of migrating from my iPhone 3g to an HTC desire. So far i’m really impressed with the desire, but a full view on it is reserved for a month or so after I’ve used it day in day out!

One thing that I did quite want was to have my SMS messages migrated from my iPhone to the Desire. As the iPhone keeps the SMSes in a SQLite DB this wasn’t to hard. I’m going to post the procedure and the script I used later!

I’ve moved this site (and a few others) from its semi-temporary home of one of my NAS boxes (proper x86 machines remember, not any of these silly 200MHz mips devices!) to a Slice at the wonderful slicehosts. I’d Highly recommend them.

Tagging along at lunch with a few colleagues at work today to the local subway and notice a new set of adverts on the window.
It appears that subway are imitating Apple’s “there’s an app for that”. It turns out that this campaign has been done by McCann Erickson and is a ‘light-hearted’ campaign complete with UK TV adverts. The phrase Imitation is the sincerest form of flattery comes to mind.

A quick script to send notifications from IRSSI for privmessages and also for highlights, I’ll put more commentary on later, but for now..

use strict;
use vars qw($VERSION %IRSSI);
use Irssi;
use LWP::UserAgent;
 
$VERSION = '0.1';
 
%IRSSI = (
        authors => 'Welby McRoberts',
        contact => 'irssi@whmcr.com',
        name => 'irssi_prowler',
        description => 'Sends a notification to Prowl to alert an iPhone of a new highlighted message',
        url => 'http://www.whmcr.com/2009/07/irssi-prowl-notifications',
        changes => 'Friday, 10 Jun 2009'
);
 
######## Config
my($PRIV_PRI, $PRIV_EVENT, $HI_PRI, $HI_EVENT, $APP, $UA, $APIKEY);
$PRIV_PRI = 2;
$PRIV_EVENT = 'Private Message';
$HI_PRI = 1;
$HI_EVENT = 'Highlight';
$APP = 'irssi';
$UA = 'irssi_prowler';
$APIKEY='7b5d817bd95911b4c049e3034dcf7a96dfa3fb53';
########
 
####### Highlights
 
sub highlight {
        my ($dest, $text, $stripped) = @_;
        if ($dest->{level} & MSGLEVEL_HILIGHT) {
                print "prowl($HI_PRI, $APP, $HI_EVENT, $text)";
                prowl($HI_PRI, $APP, $HI_EVENT, $text);
        }
}
 
####### Private Messages
 
sub priv {
        my ($server, $text, $nick, $host, $channel) = @_;
        print "prowl($PRIV_PRI, $APP, $PRIV_EVENT, $text)";
        prowl($PRIV_PRI, $APP, $PRIV_EVENT, $text);
}
 
####### Prowl call
 
sub prowl {
        my ($priority, $application, $event, $description) = @_;
        my ($request, $response, $url, $lwp);
        print 'pri: '.$priority;
        print 'app: '.$application;
        print 'event: '.$event;
        print 'description: '.$description;
 
        ######## Setting up the LWP
        $lwp = LWP::UserAgent->new;
        $lwp->agent($UA);
        # URL Encode
        $application =~ s/([^A-Za-z0-9])/sprintf("%%%02X", ord($1))/seg;
    $event =~ s/([^A-Za-z0-9])/sprintf("%%%02X", ord($1))/seg;
    $description =~ s/([^A-Za-z0-9])/sprintf("%%%02X", ord($1))/seg;
        # Setup the url
        $url = sprintf("https://prowl.weks.net/publicapi/add?apikey=%s&priority=%d&application=%s&event=%s&description=%s&",
                                        $APIKEY,
                                        $priority,
                                        $application,
                                        $event,
                                        $description
                                        );
        print $url;
        $request = HTTP::Request->new(GET => $url);
        $response = $lwp->request($request);
        print $response;
}
 
####### Bind "message private" to priv()
Irssi::signal_add_last("message private", "priv");
####### Bind "print text" to highlights()
Irssi::signal_add_last("print text", "highlight");

In most large enterprises there is a requirement to comply with various standards. The hot potato in the Ecommerce space at the moment (and has been for a few years!) is PCI-DSS.

At $WORK we have to comply with PCI-DSS with the full audit and similar occurring due to the number of transactions we perform. Recently we’ve deployed lighttpd for one of our platforms, which has caused an issue for our Information Security Officers and Compliance staff.

PCI-DSS 6.6 requires EITHER a Code review to be preformed, which whilst this may seem to be an easy task, when you’re talking about complex enterprise applications following a very……… agile development process it’s not always an option. The other option is to use a WAF (Web Application Firewall). Now there are multiple products available that sit upstream and perform this task. There is however an issue if you use SSL for your traffic. Most WAF will not do the SSL decryption / reencryption between the client and server (effectively becoming a Man in the Middle). There are however a few products which do this, F5 networks’ ASM being one that springs to mind. Unfortunately this isn’t always an option due to licensing fees and similar. An alternative is to run a WAF on the server its self. A common module for this is Mod_Security for Apache. Unfortunately, a similar module does not exist for Lighttpd.

In response to $WORKs requirement for this I’ve used mod_magnet to run a small lua script to emulate the functionality of mod_security (to an extent at least!). Please note that mod_magent is blocking, so will cause any requests to be blocked until the mod_magnet script has completed, so be very careful with the script, and ensure that it’s not causing any lag in a test environment, prior to deploying into live!

Below is a copy of an early version of the script (most of the mod_security rules that we have are specific to work, so are not being included for various reasons), however I’ll post updates to this soon.

/etc/lighttpd/mod_sec.lua

-- mod_security alike in LUA for mod_magnet
LOG = true
DROP = true
 
function returnError(e)
        if (lighty.env["request.remote-ip"]) then
                remoteip = lighty.env["request.remote-ip"]
        else
                remoteip = "UNKNOWN_IP"
        end
        if (LOG == true) then
                print ( remoteip .. " blocked due to ".. e .. " --- " ..
                                lighty.env["request.method"] .. " " .. lighty.request["Host"] .. " " .. lighty.env["request.uri"])
        end
        if (DROP == true) then
                return 405
        end
end
 
function SQLInjection(content)
        if (string.find(content, "UNION")) then
                return returnError('UNION in uri')
        end
end
 
function UserAgent(UA)
        UA = UA:gsub("%a", string.lower, 1)
        if (string.find(UA, "libwhisker")) then
                return returnError('UserAgent - libwhisker')
        elseif (string.find(UA, "paros")) then
                return returnError('UserAgent - paros')
        elseif (string.find(UA, "wget")) then
                return returnError('UserAgent - wget')
        elseif (string.find(UA, "libwww")) then
                return returnError('UserAgent - libwww')
        elseif (string.find(UA, "perl")) then
                return returnError('UserAgent - perl')
        elseif (string.find(UA, "java")) then
                return returnError('UserAgent - java')
        end
end
 
-- URI = lighty.env["request.uri"]
-- POST = lighty.request
if ( SQLInjection(lighty.env["request.uri"]) == 405) then
       ret = 405
end
if ( UserAgent(lighty.request["User-Agent"]) == 405) then
       ret = 405
end
return ret

The following needs to be added to lighttpd.conf to attach this LUA script via mod magnet

server.modules += ( "mod_magnet" )
magnet.attract-physical-path-to = ( "/etc/lighttpd/mod_sec.lua")

*Update – 23 Aug 09* Updated to return code even if one test passes*

Comments or suggestions are appreciated!

Today when voting in the EU elections (UK EU Parliment – South East) I noticed a rather odd choice at the bottom of the voting form. “The Roman Party. Ave!” I’d never heard of them, but I’ve done a bit of the old googling and found this extract from their manifesto:

ABBEY-WARD THURDAY 3 MAY

MMVII VOTE ROMAN PARTY 2007

In my first election of Reading on BBC Berkshire I suggested we should consider moving British jail to other Eastern European countries to run at less costs for the British tax payers we could seek permission of Vladimir Putin President of Russia. the reason for this is most British jails are run like hotels and sanctuaries. They are able to gain degrees without paying funds out of this type of education, yet we have school leavers and their families paying a substantial amount of money and also finding them selves in debt. This is some thing I feel need to be changed. We also supply them with cigarettes, newspapers etc.

-As For young offenders who disturb the community and rebels that break windows, create fire, and delinquents will be sent for 6 months in military for discipline and respect and learn how to live in society. I will use the military territorial barracks of Oxford Road in reading. We could approach the Ministry Defence and local authorities for disused sites.

The money we save on jail overseas will be used for NHS and to care about elderly people who want to stay in their home and to have the same care than in hospital until a critical level of sickness. These are strong factor that need to be looked at by the government and local councils.

To put down the deficit of NHS we have to create an health option and also eliminate the salt in any food on the supermarkets in the process food.

Last summer there was a water restriction because we had a shortage of water in the reservoirs due to a lack of investments because we need a larger water systems rather than profit going to big fat cat. We must use this formula for the shortage of houses to let our children to gain access onto the properties ladder. So vote a law against ‘gazumping’. Put the first buyer a priority to buy a house and decline any investors gaining more than three properties. I understand we all need to make a living. Not this 50/50 share home. But a low set price to those seriously first time buyers. All that until the house market takes a normal graphic of demand and quantity.

When a political leader leaves his position, he should leave copies of up to date accounts of all expenses occurred and how much debts he left to the country. Those things should be published in the local newspapers.

No politician should have access to pension funds to pay for any taxation or reduce the pension fund of the citizens of this country.

All Military Personnel must be bought back to our Home Land because its not in the interest of this country to be Involved.

Obviously this is slightly old, but I did think on asking if there was a option to vote for the Peoples Front of Judea, or indeed the Judean Peoples Front! It appears that this is a comedy party, with the main and infact only candidate being a taxi driver or bus driver (internets seem to be unclear) from reading. So this does seem to be much in the same vein of The (offical) Monster Raving Loony Party ala. Screaming Lord such. now one thing that people seem to forget about SLS was that he was infact one of the major campaigners for things such as voting under 21, I do some how doubt that the Roman party will be doing similar. However, remebering the above is from 2007 there is one section that did seem to make sense in the current times.

When a political leader leaves his position, he should leave copies of up to date accounts of all expenses occurred and how much debts he left to the country. Those things should be published in the local newspapers

Hmmm!

For those who know me you’ll know that I go into London on occasion but did like the fact that Woking gas no fast ticket system and hence no cheaper fares are available. You’ll also know that me and the ticket machine don’t always see eye to eye!
Imagine my glee in finding out that ousted is now available on the over ground network. Now correct me if I’m wrong but Woking is a feeder town, nothing more. So it would be safe to asume that feeder towns would get oyster. How wrong I was. Turns out that South West Trains can’t be bothered to accept oyster. Now this wouldn’t be a major issue, if the auto ticket machines worked. It takes a good 5 minuites to get a ticket by card from them. To add to the irony TFL have the backup oyster stuff running out of a computer building not even 2 miles away. All that I’m asking for is the ability for me to pre pay for say 5 trips into London and the single fare on the tube or bus, as the only +tube options we have on the auto system is zomes 123456! Why can’t oyster just be added! It would make things simpler and all in all a lot more 21st century! Also think on the trees or something!

At the new year I decided that I was fed up with having my main Unix server acting as a Router (amongst other things) and decided to bite the bullet and get a full blown router. Here in lay a dilema. Being the fact that I’m a geek, I couldn’t settle for a “home” unhackable router. So this instantly ruled out most of the commercial available routers, baring those that run OpenWRT. Now don’t get me wrong, OpenWRT is more than capable, but I just didn’t feel like having to worry about hardware support, fighting with IPTables and getting hardware that probally wouldn’t scale. Now before anyone starts thinking “Scaling, but this is for a home connection!”, this is true. However I do sync my DSL at the full  24244 kbps Downstream, and 2550 kbps upstream (I live under 200m from the exchange according to my line attenuation, also my ISP doesn’t bandwidth cap, and allow for FastPath and similar to be enabled. Go BeThere!) . Also at the time, I was seriously considering investing in a secondary connection for additional bandwidth. This meant that I was left with a few choices

• Build my Own. Using something like an ALIX/Sokeris and use something like FreeBSD (or something with a webgui for when I feel rather lazy, such as m0n0wall or pfsense. Both I’ve used previously with great success)
• Cisco. Yes, the 800 pound gorrila of home. A ‘cheap’ 1800 or similar was going to set me back about £400, however this would have provided me most of what I needed.
• RotuerBoard. These where, to me at least, relativly unknown. I originally looked at them for building my own system with them, and then discovered RouterOS came with the boards. This was an instant sale.

After my first look at RouterOS I was basically sold. Main reasoning behind this was that it was a comercial Linux distribution, that actually worked well as a router, and shipped with both a CLI (Nortel-esq in this case) and a *shock* gui application. It also met my main criteria.

• Support for 802.1Q. I have multiple vLANs at home so having support for dot1q was a necessity
• Support for 802.3ad. As I have a few machines connecting via the router, I needed the throughput, as I don’t have gigabit switching LACP support was a necessity.
• Support for Wireless. All good routers for the home (even a geeky one) need support for 802.11(a/b/g).
• Support for SubSSIDs. Relating to the above, I didn’t want to have 7 wireless cards for my various networks
• Support for WPA2-PSK and WPA2-EAP. I use RADIUS to authenticate all my personal stations to a central authentication system, but I don’t want to have to add guests to this, so PSK should also be supported.
• Support for OpenVPN. I don’t like having my traffic to / from home going in the clear at all, so I needed to be able to connect via a VPN of some sort, My preference is OpenVPN for c2s vpns (s2s is still IPSEC…. which leads onto the next point)
• Support for IPSec. I connect to various friends networks, and yet again, don’t want this sort of traffic in the clear, we made the standard IPSec (3des/md5) a while back
• Support for “Unlimted” Firewall rules. This may sound silly, but anyone who has worked with the lowend Sonicwalls will know what I mean, only being able to put 20 rules is EXTREMELY restrictive especially with multiple vlans! (I’ve got roughly 300 rules)
• Support for setting DHCP options. I used VMWare ESX at home for my test lab, so I require to be able to setup the DHCP server to be able to send the correct options for PXE (or gPXE) so this was a requirement
• Quick booting. As silly as this may sound, I don’t want boot times of upwards of 30 seconds for my router.
• Support for Bridging of interfaces with Firewall rules. This one is rather self explanatory really!
• Support for UPnP. Lets face it, UPnP is required for any form of Voice/Video chat these days over the main IM networks (YIM/AIM/MSNIM)
• Support for NetFlow or similar. This one is a nice to have, as I like to use flow-tools to generate a rough guess on what type of traffic is flowing through my network
• Support for Traffic Shaping. Ah yes, the holy grail of routers. Unfortunately the likes of TC on linux requires a degree in astrophysics to get working how you’d like!
• Easy configuration.

After discovering (via the x86 installable and the demo units) that RouterOS would let me do all of the above, I decided to give it a whirl.