Centroid.EU Blog

Solstice not too far away

June 17th, 2009

In the northern hemisphere (Europe, North America, Asia) we'll have the Summer Solstice on the 21st of June, which means that on this day at high noon the sun is at its highest angle from the horizon. In the southern hemisphere (parts of South America, Australia, parts of Africa) the sun is at its lowest angle from the horizon (at high noon). Why this is is because of the tilt of our earth. This tilt is responsible for our seasons (at least in the northern hemisphere).

0 comments

---

What's up

June 13th, 2009

Not much is up, I wrote a linux client for natally which seems to work. I improved the openbsd client for natally a bit so that routes can be set up which unfortunately doesn't work on the linux client. I'm going to skip putting up a random hackepedia since there is so little content this week.

0 comments

---

Random Hackepedia

June 6th, 2009

tr stands for translate characters and that's what it does.

To read more about tr go here.

0 comments

---

Natally

June 5th, 2009

Natally is a NAT/VPN program that works on a host that cannot do tun/tap. With iptables available, it'll make a packet socket and run with a raw socket. At the same time one can connect to it and have the session blowfish encrypted. So far there is some problems with performance that I'm working on. It's doggedly slow but I'm positive that it can be sped up.

Natally is now hosted at sourceforge. This is its homepage.

There exists a server written for Linux OpenSuse 10.3 and a client written for OpenBSD 4.5. In the future there may be other clients written for linux perhaps, but it's not a priority for me right now.

Update: Progress. I've replaced the ip and tcp checksumming routines and there now isn't any bad checksums which really were part of the slowness as the implementation had to wait for retransmissions and hope the checksums were alright. Phew am I glad that was found.

0 comments

---

Random Hackepedia

May 29th, 2009

ldd as found on Linux or a BSD displays what dynamic dependencies to a dynamic program exist. Some may even tell of breakage of libraries that don't exist anymore.

To read more about ldd go here.

0 comments

---

IPv6 chart

May 28th, 2009

I clicked a little around the ripe.net site and found this chart which is very cool so I copied it.

IPv6 Relative Network Sizes

/128	1 IPv6 address	A network interface
/64	1 IPv6 subnet	18,446,744,073,709,551,616 IPv6 addresses
/56	256 LAN segments	Popular prefix size for one subscriber site
/48	65,536 LAN segments	Popular prefix size for one subscriber site
/32	65,536 /48 subscriber sites	Minimum IPv6 allocation
/24	16,777,216 subscriber sites	256 times larger than the minimum IPv6 allocation

I got this information from this page. As I have a /48 at home I don't think I'll ever run out of IP space even if I gave each single cell in my body an IP address. BTW. a LAN segment in the chart is /64 which is also called an IPv6 subnet. 0 comments

---

Network Map

May 26th, 2009

As you can see this is my network at home all contained within one computer using vmware. The load on uranus (the vmware host) is a constant 20% with all these other vm's on. I created the map with xfig.

0 comments

---

Bug fix

May 22nd, 2009

I've made a bugreport for OpenBSD's tcpdump.

At a later time I found out that another similar bug was in the print-icmp6.c code and did a fix for that as well:

--- print-icmp6.c-orig  Fri May 22 13:09:27 2009
+++ print-icmp6.c       Fri May 22 13:10:10 2009
@@ -125,6 +125,7 @@
                        TCHECK(oip->ip6_nxt);
                        hlen = sizeof(struct ip6_hdr);
                        ouh = (struct udphdr *)(((u_char *)oip) + hlen);
+                       TCHECK(ouh->uh_dport);
                        dport = ntohs(ouh->uh_dport);
                        switch (oip->ip6_nxt) {
                        case IPPROTO_TCP:

0 comments

---

Random Hackepedia

May 22nd, 2009

A broadcast is likened to radio and is by definition one sender and multiple receivers. Ethernet can broadcast, IP can broadcast. Broadcasting is stateless, meaning you cannot use TCP with it. Most broadcasts are done with datagrams.

To read more about Broadcasting go here.

0 comments

---

ICMP Timestamp

May 21st, 2009

Today someone mentioned ICMP timestamps and how they should be firewalled. So I did a bit of research on this. I had the sourcecode handy on BSD and the timestamp returned is seconds since midnight and milliseconds from the microtime clock. The code for this looks somethign like this:

n_time
iptime(void)
{
        struct timeval atv;
        u_long t;

        microtime(&atv);
        t = (atv.tv_sec % (24*60*60)) * 1000 + atv.tv_usec / 1000;
        return (htonl(t));
}

Now all BSD's (Open, Net, Free) allowed ICMP timestamps by default, and OpenBSD had a sysctl where you can turn it off. Darwin had it turned off by default and tweakable by sysctl. I wrote a small module to my codeblue program and tested ICMP timestamps on Windows and Solaris and they don't seem to reply to it:

# ./cb  -s 172.16.0.3 -d 172.16.0.13 -I 13.0 -F timestamp -vv 
--> interface_gateway: looking up gateway mac for 172.16.0.13
--> interface_gateway: resolved to mac address 0.c.29.4b.46.1e
1 packet written at 60 bytes totalling 60 bytes

Now then, someone who wants insight on the time of day on some box can get a fairly accurate count which may help them with programs to attack a host. But this isn't guaranteed. In the old days, for example, TCP sequence numbers were based on the time of day and thus someone could make a good guess at what those sequence numbers are and be malicious. Today that's not possible anymore and someone even emphasized in OpenBSD that "Time is not a secret". That's true but, then again, if it's not a secret then why does OpenBSD's traceroute.c convolute the time in a trace packet. That's a nice idea but if time is not a secret it doesn't fit in the overall policy (just an observation). A good policy, that I like, is that time is nowhere used to seed random number generators, or cryptographic salts. If PRNG (Pseudo Random Number Generators) are seeded with time and time is readable over the network accurately then that PRNG is no good.

I was sorta surprised that NetBSD and FreeBSD had no sysctl to turn this off and especially FreeBSD with it's millions of sysctl's didn't have a knob that turned ICMP timestamps off. I guess the best formula that may make someone feel better about this is just to firewall it locally. I'm tired now, good night.

PS: Oh yes I tested Linux (OpenSuse 10.3) as well and it also replies ICMP timestamps.

0 comments

---