During the course of my work on botnet security we have had to deal with mammoth traffic traces captured at a local ISP. While analyzing the traffic we needed to extract traffic for some certain hosts out of large pcap files. An obvious solution would be to run tshark once for each host, filtering the traffic for that particular IP and writing it to a separate pcap file. However with the number of hosts approaching thousands and the pcap traces approaching terabytes in size tshark didn’t really fit the bill.

Initially I thought of writing a splitter in Python but my colleague’s aversion for using Python on large network traces coupled with lack of maintenance of libpcap bindings resulted in me going for C/libpcap directly. The new C-based slicer is available at our GitHub respository. It needs glib to compile though, as I needed a hash table implementation for maintaining the list of hosts that need to be sliced. The Makefile in the repository should take care of compiling with the appropriate flags.

Onto the performance, the speed of slicing is only throttled by libpcap‘s own read/write throughput as most of the remaining work is done in constant time. It took only 71 minutes (or 1.1 hours) to slice 1019 hosts out of a 180 GB pcap file on 2.5 GHz CPU. In simpler words, it’s lightning fast.

Right now the script does its job well enough. If someone needs to package it I’ll prefer removing the glib dependency in favor of perhaps glibc‘s own hash table implementation (search.h). In any case, I hope it proves helpful for other people playing with large pcap files.

Permalink | 2 comments
Post tags: Botnets, BSG, Code, glib, libpcap, Networking, Open Source, Pcap, slicehosts, Technology

Due to a number of commitments which I had pinned back during the summer for GSoC I was unable to attend much to the Internet over the past few weeks. Now that I’m back a summary of this year’s coding festival is in order:

The Program

This year I was working with Electronic Frontier Foundation/The Tor Project for improving the Anonymizing Relay Monitor (arm). The original proposal can be downloaded from this link are accessed via a browser at Google Docs. However, do note that not all of the goals from the proposal were met. Some were modified, some were removed altogether while some new ones were added — the details of which I’ll be explaining in the following sections.

Overall the program has been an extraordinarily enjoyable and learning experience for me. My involvement with Ubuntu last year had already taught me how invaluable it is to merge with your mentoring organizing’s developer community. This year most of my collaboration took place in #tor-dev on OFTC. Many times when I was stuck or heading towards an improper direction with my code the core Tor developers helped me and provided advice for design decisions as well as general guidance about the way things work in Tor. It wasn’t only a privilege to be helped by such rockstars, but was also vital as I can see in hindsight how disastrous it would have been if I had attempted to work through the program entirely on my own.

A huge thanks goes to my mentor Damian. Most of the credit for making this program an enjoyable and stimulating experience for me goes directly to him. He has one of the best combinations of code-people skills among people I’ve known. I would’ve loved meeting him and the Tor community in PETS ’11 but couldn’t travel due to some paperwork fiasco which was entirely a result of my slothful attitude towards anything involving government offices. Nevertheless, I do hope to meet the guys next year in PETS ’12.

The Code

In order to not sound repetitious, I’ll provide a quick summary of the milestones while linking to the posts which explain them in detail:

Menus for arm CLI

My first task was to add dropdown menus for the curses interface to arm. Even though the menus were replaced by Damian’s rewrite, they went a long way in helping me assimilate myself with the arm codebase:

(Click on the thumbnail for larger version.)

Graphs and logs for arm GUI

GTK+ was chosen as the toolkit for developing the arm GUI prototype. While GTK+ has its own disadvantages when compared to Qt (platform portability — or the lack thereof — being the foremost), it fared well in light-weight Unix environment such as Live CDs (e.g., Tails). Bandwidth graphs and logs for various arm events were added to the prototype:

(Click on the thumbnails for larger version.)

Connections and general stats for arm GUI

Moving on with the GUI, next up was to improve its conformity with the rest of the user’s desktop:

(Click on the thumbnail for larger version.)

And then re-use arm’s CLI connection resolvers in order to display stats about Tor circuits and control connections:

(Click on the thumbnail for larger version.)

A small addition was migration of the “sticky” panel from CLI which was moved under a “General” tab and provided miscellaneous info about Tor and arm:

(Click on the thumbnail for larger version.)

Configuration panel for GUI

Another important panel in the arm CLI was its configuration interface which provided a nice and documented approach to altering Tor’s settings. It was migrated to GUI with nice dialogs for validating user input:

(Click on the thumbnail for larger version.)

Along with the configuration panel a few patches to Tor and Vidalia were developed which would allow arm to be notified of changes made by an external program via a CONF_CHANGED event. The support for CONF_CHANGED still isn’t solid in all Tor controllers yet which I plan on addressing in coming months.

Exit node selector for arm CLI & GUI

A popular feature request among Tor users was to be able to select the country for their exit nodes. While I initially planned on providing them more fine-grained control over their circuits (such as path length), Tor developers advised against it and hence the selection was limited to the exit-node’s locale:

(Click on the thumbnails for larger version.)

The Nutshell

“It goes on forever — and — oh my God — it’s full of stars!”

It’s just that awesome, seriously. Stars from the FLOSS strata gather around and help inexperienced and aspiring developers all over the globe for two months in order to bring more code and — more importantly — more people to the open-source world. The experience with GSoC not only helps me in general open-source development, but also proves to be priceless at my workplace for my research in software defined networks. If you’re even remotely interested in open-source do keep an eye on the program’s website for future updates.

Permalink | One comment
Post tags: arm, Code, EFF, Google, GSoC, GTK+, Open Source, PyGTK, Summer of Code, Tor, Vidalia

The final weeks of GSoC 2011 were spent by me working on exit node selection for Tor users. The GUI controller can now be used to define a list of countries, after which only those exit nodes shall be used which lie in one of the specified territories:

(Click on the thumbnail for larger version.)

For the CLI, Damian decided that the general use case for exit node selection is specification of a single country so pressing ‘E’ in the connections panel brings up a list from which one can be chosen:

(Click on the thumbnail for larger version.)

Please note that the exit node restriction works only for circuits built after the selection. Therefore it might be a good idea to send a NEWNYM to Tor after specifying the countries — which you’ll have to do manually for the time being until I add the feature to (g)arm controllers.

In my next post I’ll cover a summary of my involvement with GSoC this year, that is, after I finish with the regular chores of code submission etc.

Permalink | No comment
Post tags: arm, Code, EFF, Google, GSoC, GTK+, Open Source, PyGTK, Summer of Code, Tor

While working for GSoC last year I kept track of Bazaar patches I sent in for Arsenal. This year I was using Git and as the need arose to generate a submission tarball for my commits I wrote this small utility script: git-generate-tarball.py.

To invoke the script, change into your Git repository and provide an author name and a file as an argument:

[krkhan@orthanc tor]$ /home/krkhan/Downloads/git-generate-tarball.py "Kamran Riaz Khan <krkhan@inspirated.com>" /home/krkhan/Downloads/tor-gsoc-krkhan.tar.gz

generating tarball for commits between Mon May 23 00:00:00 2011 +0000 and Mon Aug 22 19:00:00 2011 +0000
generating patch for commit 5a801a8c8b71c9551a80913398135809cb10cecd
…
/home/krkhan/Downloads/tor-gsoc-krkhan.tar.gz created

The default starting and ending dates for the commits correspond to the schedule for GSoC 2011. You can specify a starting date for the commits you want to be packaged using the --since argument:

[krkhan@orthanc arm]$ /home/krkhan/Downloads/git-generate-tarball.py --since="August 1, 2011" "Kamran Riaz Khan <krkhan@inspirated.com>" /home/krkhan/Downloads/arm-gsoc-krkhan.tar.bz2

generating tarball for commits between August 1, 2011 and Mon Aug 22 19:00:00 2011 +0000
generating patch for commit 546ca73259d7863e3efe5e11e09c023c2790a2f6
…
/home/krkhan/Downloads/arm-gsoc-krkhan.tar.bz2 created

Same goes for the --before argument:

[krkhan@orthanc tor]$ /home/krkhan/Downloads/git-generate-tarball.py --before="August 14, 2011" "Kamran Riaz Khan <krkhan@inspirated.com>" /home/krkhan/Downloads/tor-gsoc-krkhan.tar.gz

generating tarball for commits between Mon May 23 00:00:00 2011 +0000 and August 14, 2011
generating patch for commit 5a801a8c8b71c9551a80913398135809cb10cecd
…
/home/krkhan/Downloads/tor-gsoc-krkhan.tar.gz created

Or a combination of both:

[krkhan@orthanc arm]$ /home/krkhan/Downloads/git-generate-tarball.py --since="August 1, 2011" --before="August 14, 2011" "Kamran Riaz Khan <krkhan@inspirated.com>" /home/krkhan/Downloads/arm-gsoc-krkhan.tar.gz

generating tarball for commits between August 1, 2011 and August 14, 2011
generating patch for commit 546ca73259d7863e3efe5e11e09c023c2790a2f6
…
/home/krkhan/Downloads/arm-gsoc-krkhan.tar.gz created

If you want to leave the dates undefined you can leave the arguments empty. For example, the following command shall process all commits before June 1, 2011:

[krkhan@orthanc arm]$ /home/krkhan/Downloads/git-generate-tarball.py --since= --before="June 1, 2011" "Kamran Riaz Khan <krkhan@inspirated.com>" /home/krkhan/Downloads/arm-gsoc-krkhan.tar.gz

generating tarball for commits before June 1, 2011
generating patch for commit 8b4dc162f75d5129e41f028c7253b7b265c8af76
…
/home/krkhan/Downloads/arm-gsoc-krkhan.tar.gz created

Hope this helps fellow GSoCers.

Permalink | 5 comments
Post tags: Code, Git, Google, GSoC, Open Source, Summer of Code

“O Marvelous! what new configuration will come next? I am bewildered with multiplicity.” — William Carlos Williams

Up until now my GSoC development was dealing with the “monitoring” aspects of arm. In addition to being a monitor a Tor controller is also supposed to, well, control the Tor client. Tor offers a detailed specification which can be used to interact with a running client and control it in a myriad of ways. This specification is then used by controllers like arm and Vidalia to fetch and/or update the client configuration.

The CLI configuration panel for arm already understood the control specification quite well. The first step towards reusing those portions for the GUI was to rewrite the inheritance code so that underlying data structures of the CLI were automagically connected to the Gtk+ models. That made the actual implementation of GUI configuration panel a whole lot cleaner. As things are, the panel detects the data types of configuration options and opens pertinent dialogs for user input:

(Click on the thumbnail for larger version.)

Next item in to-do list was implementing a path selection panel in arm. After a thorough discussion on IRC with the core Tor developers it was decided that giving end-users complete access to the PathSupport component of TorCtl would ultimately hurt their anonymity with little (if any) pay-off. Letting them choose the country of their exit relay was still seen as a useful feature which is what I’m working on right now.

Meanwhile, while setting the configuration options needed to choose an exit country I figured that arm should be notified of any changes made by other controllers to the options in question. Damian pointed me to ticket #1692 which proposed an enhancement for this very purpose. He had already created a patch for the job but few quirks needed to be addressed before the patch was ready for being merged. Thanks to help from Nick Mathewson and Robert Ransom I was able to fix the code and get it inside the tor and tor-spec repositories.

To make use of the new CONF_CHANGED event I also wrote patches for TorCtl and Vidalia. The TorCtl patch shall help me in making arm aware of configuration changes. While the Vidalia one is a proof-of-concept which created a signal and connected it to a debug function which for the time being just logs the options changed for the running Tor instance.

I hope to be done with exit node selection within a couple of days after which I’ll port the feature to CLI version of arm. It’ll be a good little exercise to start decoupling the arm interfaces from its backend so that future development is more streamlined and fun.

Permalink | No comment
Post tags: arm, Code, EFF, Google, GSoC, GTK+, Open Source, PyGTK, Summer of Code, Tor, Vidalia

Damian and I have decided that the GUI prototype for arm should be released to the public for a feedback round. As always, the code is available from the Git repository.

So far, the graphs and logs now support a look more conforming with the rest of the GTK+ theme:

(Click on the thumbnail for larger version.)

The connections panel lists circuits and control ports in use. The resolvers in use are in fact, the same ones used by the CLI so the results are pretty consistent:

(Click on the thumbnail for larger version.)

The “sticky” or “header” panel which provided general Tor/arm info has been moved to the notebook for giving it more horizontal space:

(Click on the thumbnail for larger version.)

Owing to my lack of creativity the GUI was named “garm”. Which coincidentally turned out to be the name of a talking dog from one of Tolkein’s short stories. Proving once again that Tolkein/Middle Earth/Norse mythology are any geek’s safe fallback plan for being imaginative.

While the GUI is still in infancy, we’d love any feedback we can get. If you have a suggestion you can post a comment here, drop by at #tor-dev or (preferably) mail your thoughts to tor-talk. I’ll be grateful for any ideas that end up making garm more useful for relay operators.

Permalink | No comment
Post tags: arm, Code, EFF, Google, GSoC, GTK+, Open Source, PyGTK, Summer of Code, Tor

The great thing about a command line application is being able to SSH into the thing from anywhere and with anything. Nevertheless, the general public appeal of GUIs has always remained undeniable. After all, over the decades one of the favorite pass times of Steve Jobs — the man who knows a thing or two about public appeal — has been suing and/or getting sued for patents related to GUI. It’s not to say that we are planning an iTorMonitor for App Store (you still have iSSH if you’d like), but a graphical interface shall hopefully go a long way for attracting newbie relay operators.

The first items to be ported to GUI were the bandwidth graphs. After a thorough discussion on #tor-dev regarding how to achieve graphing with respect to feature sets, packaging issues and wheel reinvention; cagraph was chosen as the way to go (among Matplotlib and drawing directly to GDK surfaces). I took screenshots of both interfaces running side-by-side in order to judge how accurate the graphs were and the results look fine:

(Click on the thumbnails for larger version.)

Next up were the log messages dispatched by arm or Tor. While Damian would not be entirely happy with the fact that I’m not terribly innovative with the UI translation , I did stumble upon an interesting side-feature of using timestamp based sorting. The user can sort the entries in ascending order and he’ll always see the recent-most entry as it pops up in the view, or he can revert the order and see old entries at his leisure while the new entries populate elsewhere below.

(Click on the thumbnail for larger version.)

One other aspect I noticed while designing the UIs was that I have atrocious color selection skills. The color scheme of the entire application isn’t consistent and might even invite a backlash once it goes public. Therefore I plan on discarding all hardcoded colors in favor of theme colors from GTK+ itself — lest the GUI be packaged into a separate arm-trippy once it makes to major distros.

Permalink | One comment
Post tags: arm, Code, EFF, Google, GSoC, GTK+, Open Source, PyGTK, Summer of Code, Tor

The first thing that comes to mind after seeing “curses” and “Python” in the same sentence is “go away or I shall taunt you a second time”. After spending a while trying to write text-mode interfaces, it only starts ringing truer.

Coding period for Google Summer of Code 2011 officially began last week. Because of exams and some subsequent issues involving my university I had been lagging behind my intended schedule. With help from Damian Johnson though I was able to get my feet wet quickly and start integrating menus in arm. Luckily, the arm codebase was very well-written and neatly organized which simplified my task and allowed me to end up with a functional implementation by the end of first week:

(Click on the thumbnail for larger version.)

The code can be accessed via my Git repository at Tor Project. In addition to that I also now own a shiny krkhan@torproject.org email address which is currently setup to forward messages to my primary mail.

Menus still needs a bit of polishing as the controls are not completely intuitive and I still need to bug-hunt thoroughly on varying screen sizes. For the time being they work well enough to control all aspects of arm except for quitting or resetting Tor, which I shall be fixing after figuring out a few quirks.

“As a child my family’s menu consisted of two choices: take it or leave it.” — Buddy Hackett

Permalink | 2 comments
Post tags: arm, Code, EFF, Google, GSoC, Open Source, Summer of Code, Tor

After completing my project for last year‘s Summer of Code my degree was delayed for a while because of flunking a few courses. Glass half full, this gave me the chance to participate once more before I finally graduate this summer — Deo volente.

In a repeat of last year I once again became a duplicate student as my proposals for both Fedora and Tor projects ended up in top slots. Both organizations were really nice in the de-duplication process and inquired about my preference which inclined towards Tor since it allowed me to contribute to fields of privacy and anonymity. In words of Free Software Foundation:

Using free software, Tor has enabled roughly 36 million people around the world to experience freedom of access and expression on the Internet while keeping them in control of their privacy and anonymity. Its network has proved pivotal in dissident movements in both Iran and more recently Egypt.

This by no means implies any lesser significance for Fedora in my life and I would have been as much enthused had it been my mentoring organization for the summer instead of EFF. However, since I had to make a choice I went for the option where I would be contributing more directly to privacy enhancing technologies.

My project this summer revolves around improving the excellent Anonymizing Relay Monitor (arm) which is used by the Tor community to monitor and control bridges and relays. The complete proposal can be read here (or via the original PDF). It contains nitty-gritty details of my summer aspirations as well as non-technical stuff like why I want to contribute to this particular field.

I Know What I Did Last Summer, and I’m looking forward to doing it again. Quoting myself from FLOSS Manuals:

“Summer of Code is about much more than just code. The sheer fun of integrating with the open-source community and your mentoring organization can in fact outweigh the gratification of actual coding. “

Permalink | 2 comments
Post tags: arm, Code, EFF, Fedora, Google, GSoC, Open Source, Rants, Summer of Code, Tor

Smolt is a hardware profiler for Linux distributions which makes it easier for end-users to report back their machine configurations to a centralized database. Mike McGrath provides an excellent backend for developing Smolt GUIs which I have coupled with GTK+ for GSmolt:

(Click on the thumbnails for larger versions.)

The script can be found at the gsmolt repository on GitHub. Things on todo list include profile reporting in a separate thread and better error handling. I’ll provide RPM and Deb packages when the code is ready for a public release.

As a side note, this is the first project I have tracked using GitHub (as opposed to Launchpad + Bazaar). While Launchpad has its added advantage of PPAs which make it easier to push out public releases for Debian derivatives, I’m liking the Git experience so far. Hopefully some day Copr shall mature to a point where it can be the end-all, be-all Launchpad alternative for Fedora users.

Permalink | No comment
Post tags: Code, Fedora, Git, GitHub, GSmolt, GTK+, GUI, Linux, Open Source, openSUSE, Smolt, Technology