How to deny Postfix SMTP authentication from non-US clients

As the war on spam continues, one of my clients wanted to only provide SMTP AUTH capabilities to IP addresses in the states, as their employees are only located there anyway.

Postfix has a facility for this, called smtpd_sasl_exceptions_networks. It basically denies SASL auth to IP's from the specified ranges. Disregarding IPv6 for now, here's a list of IP ranges from IANA that are non-US (ARIN) allocations:

smtpd_sasl_exceptions_networks = 0.0.0.0/7
  2.0.0.0/8
  5.0.0.0/8
  10.0.0.0/8
  14.0.0.0/8
  25.0.0.0/8
  27.0.0.0/8
  31.0.0.0/8
  36.0.0.0/8
  37.0.0.0/8
  39.0.0.0/8
  41.0.0.0/8
  42.0.0.0/7
  46.0.0.0/8
  49.0.0.0/8
  51.0.0.0/8
  53.0.0.0/8
  57.0.0.0/8
  58.0.0.0/7
  60.0.0.0/7
  62.0.0.0/8
  77.0.0.0/8
  78.0.0.0/7
  80.0.0.0/4
  101.0.0.0/8
  102.0.0.0/7
  105.0.0.0/8
  106.0.0.0/8
  109.0.0.0/8
  110.0.0.0/7
  112.0.0.0/4
  133.0.0.0/8
  141.0.0.0/8
  145.0.0.0/8
  150.0.0.0/7
  153.0.0.0/8
  154.0.0.0/8
  163.0.0.0/8
  171.0.0.0/8
  175.0.0.0/8
  176.0.0.0/4
  193.0.0.0/8
  194.0.0.0/7
  196.0.0.0/7
  200.0.0.0/6
  210.0.0.0/7
  212.0.0.0/7
  217.0.0.0/8
  218.0.0.0/7
  220.0.0.0/6

ARCH Linux on a WM8850-based mini laptop

One of my purchases earlier this year was a mini laptop, powered by a Wondermedia WM8850 chip.

It's kinda handy: runs Android/Linux selectively, has a HDMI interface, wired Ethernet and fullsize USB 2.0 ports. Also, it can be charged from USB, tablet style.

Quirks include no HDMI on Linux (yet), and it takes a bit of effort to turn on the wireless. Missing the gpio binary, you can get there by using the sysfs interface:

echo 6 > /sys/class/gpio/export
echo out > /sys/class/gpio/gpio6/direction
echo 1 > /sys/class/gpio/gpio6/value

Just echo 0 there to turn it off again.

Compiling a kernel needed some scraping on the web, but can be done like this:

cd linux-3.16
nice make ARCH=arm menuconfig
nice make ARCH=arm zImage
cat arch/arm/boot/zImage arch/arm/boot/dts/wm8850-w70v2.dtb > arch/arm/boot/zImage_w_dtb
mkimage -A arm -O linux -T kernel -C none -a 0x8000 -e 0x8000 -n "My Linux" -d arch/arm/boot/zImage_w_dtb ~/uzImage.bin
make ARCH=arm modules
sudo make ARCH=arm modules_install

The kernel config is online here.

It works happy with a 8GB SD card and adding a bit of swap can't hurt as the 512MB of RAM is not that much.

Thanks for the vt8500 developers!

HTML5 video live streaming with ffmpeg and mediaelement.js, Round 2

Follow-up from this summer to the original post.

So, after not rolling out our HTML5 player last year, we've decided to give it a go again this year.
What we've learned: things have changed in Internet-land.

IE no longer requests or supports WMV anymore, which is weird but actually correct. It takes mp4 now as default.

Chrome was still ticking along happy.

Firefox was a big surprise: between version 19 and 20 they've reworked the HTTP engine, so it's a bit quirky now:

• It fetches the first 8k for metadata in a request
• It uses HTTP 206 Partial content requests now
• If it doesn't get an X-Content-Duration, it'll send a new partial request for the end of the file. As it's transcoded on the fly, this is bad for us.

So, we need to give it:

• HTTP 206 headers
• Range headers
• X-Content-Duration headers (in seconds)

This can be done with something like this:

$ua=$_SERVER['HTTP_USER_AGENT'];
$useragent='generic';
# match Firefox 1-19
if ( preg_match('/Gecko.20.*Firefox.(1){0,1}[0-9]\./', $ua) ) {
    $firefox19=true;
}
# match all Firefox
if ( preg_match('/Gecko\/.*Firefox.[1-9]/', $ua) ) {
    $firefox=true;
}
# if Firefox 20-
if ($firefox && !$firefox19) {
    $useragent='ff20';
}

# generic headers
if ($useragent=='generic') {
#header("HTTP/1.1 200 OK");
#header('Content-Disposition: attachment; filename=' . basename($file));
}

# firefox 20+ headers
#   firefox 20 wants partial content with code 206, and likes X-Content-Duration
if ($useragent=='ff20') {
header("HTTP/1.1 206 Partial Content");
header("Range: bytes=0-");
header("X-Content-Duration: $totduration");
}

I couldn't get the Flash fallback of mediaelement.js working and Silverlight was killed by Microsoft, so mediaelement.js was taken out from our setup, with a manual Flash fallback link.
We've also noticed A-V sync issues with ffmpeg, so deployment was pulled again, but we're making progress.

Thanks to Browserstack, for making life easier while testing.

Linux, Network and Datacenter contractor/freelance engineer in Dublin

New year, new-old adventures:

I'm moving back to the contract/freelance market, this time in Ireland. I'll be available as a Linux, networking and datacenter engineer in Dublin and Shannon (as necessary).

Certified to work on the following kit (the list is not exhaustive):

- Cisco

- Juniper

- Brocade

- HP

- D-Link

- Zyxel

For the full list and to contact, please check out my LinkedIn profile.

I'm happy to work through Elance, as it provides protection to all parties.

I have a nice Experts-Exchange profile as well.

Edit:

Now we do Facebook as well!

Edit2:

The website is live: d8ns.com.

JavaScript hype, code ninjas and why does it hurt

After watching some young IT guys in the office, spending the last weeks in jQuery hell, and reading Lincoln Baxter III's article on JS vs Perl and talking to some similar-aged guys, I think I'm starting to understand that this is a generational thing really. Mind you, I'll only turn 31 in a few weeks...

The problem is, JavaScript ain't bad, it's just not good. And it fully supports making it worse. It's been almost 20 years that it popped up us a good idea, needing a lot of refinement, but it managed to stick around. It would be okay to write some small functions in it, but writing full-blown applications like Google Docs or Facebook in a high-level script language? There's a reason we never did that in .bat files either...

On the other hand, as Lincoln points out, JavaScript is superior to any other clientside languages by the virtue of existence. There's nothing else out there: VBScript died, Flash is going away fast, the new things are in development. Normally, high level languages don't really survive 20+ years, or at least not without major refactoring.

It doesn't really help that our new startup-hype culture now worships programmers as code ninjas and other ridiculous names: it's getting into the heads of these cool kids. It seems like a good idea to name their function a dollar sign, or their method an underscore, because it's short and cool. I'm kinda thankful that the full UTF32 set or Wingdings is not permitted for use...

Why might this be a problem? I'm a sysadmin and as such, I'm trying my best to make things work: debug stuff, help developers deploy their apps, the works. I need to debug all kinds of languages, which isn't really a problem, as there's a few control structures and functions to any language, mostly in English. Debug PHP, Perl, Python, even Ruby? Sure, can do, worst case I read the manual a bit. Enter JavaScript: with vanilla, it's actually pretty okay:

var myElement = getElementById("navdiv");

I expect that it'll get, an element, by its ID. See, I know this, a bit of html: things will be fine.
Cool kid notation:

tmpl: _.template($('a').html()),

Say what...? There's more special characters in there than letters... I'm used to that if I read kernel C code, or a Perl regex, but not on some little validation function or something. If I don't have a fairly intimate knowledge about underscore.js and jQuery, which I won't necessarily have, don't expect me to help you out there if it breaks during deployment...

Or declaring a function inside a function call, that in turn calls a function, just because we can:

Todos.each(function (todo) { todo.save({'done': done}); })

Sure, we've saved 2-4 newlines. Who's going to maintain this code 5 years later? Or startup-land really only thinks in the first 3 years and 2 whiz-kids and they don't believe in this enterprise scale thing? If you really are the next Zuckerberg: he needs to maintain stuff after the IPO too.

The moral of the story? No such thing this time, we'll see what'll happen with the new tech bubble, the code ninjas and JavaScript. I still don't really like them and possibly never will.