xcode pod 路径下头文件的“file not found”问题

更换了电脑,重新从git上下拉的工程,发现头文件命名存在,但是编译时提示 “file not found”的问题,初步怀疑环境配置问题,因为之前的环境是ok的。但检查比对了pod和主工程的路径,没发现明显的线索。

所以就重新创建了pod的工作区:

把.xcworkspace,pod开头的文件除了Podfile,全删,然后重新pod install/update,再打开新的xcworkspace 文件,编译,ok

vpn时如何自动区分国内国外-chnroutes-autoddvpn

针对这个需求,有专门的开源项目 chnroutes

最起源的代码仓库:https://code.google.com/p/chnroutes/

1. 与这个最接近的github上的代码:

https://github.com/fivesheep/chnroutes

2. 还有一个差异比较大的,从时间上看是比较旧的,但需要比较代码才能知道哪个更合适

https://github.com/jimmyxu/chnroutes

3. 还有一个改进版,提供 go python 以及window界面版本,从其文档连接看是以 fivesheep 的版本为基线版本。

https://github.com/sabersalv/freedom-routes 

本文验证了pptp windows 环境下的功能,工作OK。

其中python 使用 2.7.10 版,请安装完整版,因为可能需要其他关联库。

脚本执行要使用管理员权限。

1,2,3生成的路由数据略有差异,经简单测试,以 baidu.com 和weibo.com 为test case, 似乎3的效果好些,但因每人宽带出口不同,不作为唯一结论,使用者请自行测试。

如果要让路由器实现上述功能,提供用户透明的vpn体验,也有相应的项目  https://code.google.com/p/autoddvpn/

pptp的安全风险

原文已经无法访问了,特意搬运过来,英文吃力的同学,可以用google翻译,当然你要会科  学  上  网

总结起来最终的要的亮点

  • 明文传输
  • 采用简单的用户名和密码验证,方法过于简单

原文:

http://pptpclient.sourceforge.net/protocol-security.phtml

PPTP Client

Protocol Security

References

by James Cameron

Summary

by Peter Mueller

PPTP is known to be a faulty protocol. The designers of the protocol, Microsoft, recommend not to use it due to the inherent risks. Lots of people use PPTP anyway due to ease of use, but that doesn’t mean it is any less hazardous. The maintainers of PPTP Client and Poptop recommend using OpenVPN (SSL based) or IPSec instead.

(Posted on 2005-08-10 to the mailing list)


Why not use PPTP?

by James Cameron

The point to point tunneling protocol (PPTP) is not secure enough for some information security policies.

It’s the nature of the MSCHAP V2 authentication, how it can be broken trivially by capture of the datastream, and how MPPE depends on the MSCHAP tokens for cryptographic keys. MPPE is also only 128-bit, reasonably straightforward to attack, and the keys used at each end are the same, which lowers the effort required to succeed. The obvious lack of two-factor authentication, instead relying on a single username and password, is also a risk. The increasing use of domestic wireless systems makes information capture more likely.

However, that doesn’t mean people don’t accept the risks. There are many corporations and individuals using PPTP with full knowledge of these risks. Some use mitigating controls, and some don’t.

Many people seem to judge the security of a protocol by the availability of the implementation, the ease of installation, or the level of documentation on our web site. Improving the documentation is the purpose of this web site, and we aren’t doing that in order to say anything about the risks of the software! Any judgement of security should be rigorously applied to the design and implementation alone.

PPTP on Linux, and Microsoft’s PPTP, both implement fixes for vulnerabilities that were detected years ago in Microsoft’s PPTP. But there remain the design vulnerabilities that cannot be fixed without changing the design. The changes needed would break interoperability. We can’t change the Linux PPTP design, because it would stop working with Microsoft PPTP. They can’t change their design, because it would stop working with all the other components out there, such as Nortel and Cisco, embedded routers, ADSL modems and their own Windows installed base.

The only option then is to deprecate the product and promote the replacement. Microsoft promote something else. Our choice for Open Source systems is OpenVPN or IPsec.

Level of acceptance isn’t a good indicator of risk either. Some have said that the shipping of MSCHAP V2, MPPE and PPTP in Linux distributions is an indication of design security, but that’s not the reason. It’s for interoperability. As an example, see how Linux distributions still ship telnet, ftp, and rsh, even though these components are insecure because they reveal the password in cleartext in the network packets. The same can be said of many other components and packages.

Our recommendations are;

  1. do not implement PPTP between open source systems, because there’s no justification, better security can be had from OpenVPN or IPsec,
  2. do not implement PPTP servers unless the justification is that the clients must not have to install anything to get going (Microsoft PPTP is included already), and be aware of the risks of information interception,
  3. do not implement PPTP clients unless the justification is that the server only provides PPTP, and there’s nothing better that can be used, and again be aware of the risks of information interception.

(Posted on 2005-08-10 to the mailing list)

nginx设置后端保持长连接

nginx 做反向代理分发时,为了提高效率,最好使用长连接,以下是nginx 支持的几种后端长连接配置方案:

Nginx从 1.1.4 开始,实现了对后端机器的长连接支持,这是一个激动人心的改进,这意味着 Nginx 与后端机器的通信效率更高,后端机器的负担更低。

例如,对一个没有长连接支持的后端机器,会出现大量TIME_WAIT 状态的连接,使用以下命令验证之:

netstat -n | grep TIME_WAIT

经过查阅官方文档,其目前已经实现了http, fastcgi, memcache 协议的长连接支持。而之前的版本中仅支持memcache 协议。

1. 启用到 memcache 服务器的长连接
在upstream 配置段中增加 keepalive N 指令即可:
upstream memcached_backend {

    server 127.0.0.1:11211;

    server 10.0.0.2:11211;

     keepalive 32;

}

server {

    …

    location /memcached/ {

        set $memcached_key $uri;

        memcached_pass memcached_backend;

    }

}

2.  启用fastcgi 长连接支持
除了需要在upstream 中配置 keepalive N 外,还需要在 location 中增加 fastcgi_keep_conn on;

upstream fastcgi_backend {

    server 127.0.0.1:9000;

     keepalive 8;

}

server {

    …

    location /fastcgi/ {

        fastcgi_pass fastcgi_backend;

         fastcgi_keep_conn on;

        …

    }

}

3.  启用对后端机器HTTP 长连接支持

upstream http_backend {

    server 127.0.0.1:8080;

    keepalive 16;

}

server {

    …

    location /http/ {

        proxy_pass http://http_backend;

        proxy_http_version 1.1;

        proxy_set_header Connection “”;

        …

    }

}

注意:需要设置nginx 代理请求的 http 协议版本号为 1.1,  以及清除掉 Connection 请求header,  官方文档描述:

For HTTP, the proxy_http_version directive should be set to “ 1.1 ”  and the “ Connection ”  header field should be cleared .

The connections parameter should be set low enough to allow upstream servers to process additional new incoming connections as well.

即是说:keepalive N 指令中 , N 的值应该尽可能设置小一些,以便后端机器可以同时接受新的连接。

Too many connections

在php的日志里我们看到了如下的告警日志:
mysql_connect(): Too many connections

查看默认参数:
mysql> show variables;

实时修改:
mysql> set global wait_timeout=10;
Query OK, 0 rows affected (0.01 sec)

mysql> set GLOBAL max_connections=1024;
Query OK, 0 rows affected (0.00 sec)

注意 interactive_timeout  和 wait_timeout,根据不同场景,修改不同的参数。

还可以修改 my.cnf , 然后 重启 mysqld 服务。

还需要关注查询慢的本质原因:

1)DB是innodb 还是myisam

2)  高频查询的表的index创建是否合理

3)业务的mysql 语句写的是否合理

如果以上还搞不定,就需要考虑 分库分表 , 加proxy 做集群来分流了。

关于IOS后台socket长连接的问题

1. 进程退到后体后,只有3-10的时间,如果没有进一步处理,处于功耗考虑,socket就会被系统关闭。 2. ios8后,允许后台,ios8之前的版本,只能通过设置后台模式 Required background modes来实现,但如果本身没有voip功能,苹果审查会遭拒。 ①打开info.plist,添加下面的键值对: Required background modes = App provides Voice over IP services ②配置XMPPStream的enableBackgroundingOnSocket属性为YES: _xmppStream.enableBackgroundingOnSocket = YES; 3. 参考 http://my.oschina.net/bankofchina/blog/281233 voip的方法,理论上定位消息也可以实现 4. 网上大段都是voip的例子,但按照苹果的审查规范,用voip实现后台keepalive 而没有实现voip是会被拒的。 综上所述,ios8以后,直接支持后台。ios8以前的,理论上gps位置信息也是可以在后台触发,从而通过策略实现长连接的,目前没有看到验证的例子,可以在这个方向下尝试下,毕竟所有的app都是需要位置服务器的,不属于伪造服务

c++编译工具链

1. gcc

yum -y install gcc automake autoconf libtool make

安装g++:

yum install gcc gcc-c++

2. protobuf

protobuf-2.4.1.tar.gz

./configure –prefix=/usr/local/protobuf
 make
 make check
 make install
sudo vim /etc/profile
 添加
export PATH=$PATH:/usr/local/protobuf/bin/
export PKG_CONFIG_PATH=/usr/local/protobuf/lib/pkgconfig/
保存执行
source /etc/profile

3. google 库文件,将google的库文件路径添加到gcc 编译路径

1).加到gcc的环境变量 C_INCLUDE_PATH, CPLUS_INCLUDE_PATH, OBJC_INCLUDE_PATH

2).放到系统默认目录
/usr/include
/usr/local/include

我们选择直接拷贝protobuf 生成的目录 includegoogle  到 /usr/local/include 下

4. zlib

编译时提示:”/usr/bin/ld: cannot find -lz”

解决:去lib64目录下看是有libz  相关库的,根据好使的环境比对,猜测是缺少特定的连接

# ln -s libz.so.1 libz.so

编译ok…

 

使用Sublime Text3+Ctags+Cscope替代Source Insight

参考:https://www.zybuluo.com/lanxinyuchs/note/33551

说明:以Windows系统下查看C++代码为例。因为Source Insight(以下简称SI)是收费软件,且界面丑陋,所以考虑其替代方案,发现Sublime Text3(以下简称ST3) + Ctags + Cscope 可以取得很好的效果。使用ST3基本可以实现全键盘操作,同时它又没有学习Vim的陡峭曲线。

安装方法

1. 安装Package Control for ST3

 https://packagecontrol.io/installation

2. 安装Ctags插件

(1) 通过 Preference -> Package Control -> Install Package安装Ctags插件
(2) 下载 Ctags.exe, 通过 Preference -> Package Settings -> Ctags -> Settings Default 中的内容拷贝到 Setting User中,将 command": "" 中的 "" 填入Ctags.exe的路径位置
(3) 在工程根目录上点击右键,选择Ctags:Rebuild tags

3. 安装Cscope插件

(1) 通过 Preference -> Package Control -> Install Package安装Cscope插件
(2) 下载 Cscope.exe, 并在工程根目录下生成cscope.out文件
(3) 打开CscopeSublime.sublime-settings文件(可能需要添加到 Package -> User 目录下),将 "executable": "" 中的"" 填入Cscope.exe的路径位置,将 "database_location": "" 中的 ""填入cscope.out的路径位置

功能实现:

(1) 对于symbol函数的定义查询,ST3自带此功能Go to Definition,且搜索结果有多个时可以预览,不用跳转到另一个文件。Ctags也有此功能navigate_to_definition,搜索结果比ST3要准确一些,但多结果时不支持预览。Csope也有此功能 Cscope: look up function defintion,但搜索结果不支持双击点开。因此实际中多用ST3和Ctags来实现此功能
(2) 对于symbol变量的定义查询,ST3不支持,Ctags有此功能,方法同其查询symbol函数的定义一致。Cscope也可以用查询symbol函数定义的方法实现此功能,搜索结果不支持双击点开。因此实际中多用Ctags来实现此功能
(3) 对于函数caller的查询,只有Cscope有此功能Cscope: look up function calling this function
(4) 全局搜索, ST3可通过Ctrl+Shift+F实现,但搜索耗时较长。Cscope可通过Cscope: look up symbol实现,因为已经通过cscope.out建立了索引,所以结果很快,但结果不一定全面

:使用Cscope的功能时,需按enter键确定才会执行

比较:ST3 + Ctags + Cscope的方案基本可以实现Source Insight的常用有效功能(除了查看类继承关系的Relation Windows),且其速度更快,界面也更为清爽。ST3相比于SI的其他优点还包括:
(1)ST3使用Ctrl+P搜索文件时,使用的是模糊匹配,不像SI必须顺次拼写正确才行
(2)ST3支持tab模式,可方便的在多个文件间切换

ST3实用技巧

(1) Alt+O可以实现头文件和源文件之间的快速切换
(2) 通过 View -> Side bar 可在左侧显示当前打开的文件列表
(3) ST3虽然不像notepad++可以在sidebar上显示函数列表,但是可通过Ctrl+R查看
(3) 通过 Preference -> Key binding user 可根据个人操作习惯自定义快捷键(包括ST3自带的和插件的)
(4) 双击可选中光标所在单词,三击可选中光标所在行
(5) Ctrl+Shift+T可以打开之前关闭的tab页,这点同chrome是一样的

RVCT 远程license 问题

错误:

Error: C9932E: Cannot obtain license for Compiler (feature compiler) with licens
e version >= 3.1:
Terminal Server remote client not allowed.
Feature: compiler
License path: D:ARMLicenseslicense.lic
FLEXnet Licensing error:-103,577
For further information, refer to the FLEXnet Licensing End User Guide,
available at “www.macrovision.com”.

解决:rvds.dat里HOSTID=XXXXX之后加上TS_OK就可以了

Hanging Sockets and Power Consumption – Basics, Part 3

很好的文章,就mobile 空socket 的耗电状态做了深入的分析.

更完整的内容参见:trepn-whitepaper-apps-power

from:https://developer.qualcomm.com/blog/hanging-sockets-and-power-consumption-basics-part-3

Continuing our series on mobile apps and their effect on battery drain, I’ll pick up where the three guidelines in Wayne Lee’s last post left off, especially #3: “Know what your app is doing with the hardware and when it’s doing it.”

One common way that mobile apps use too much power is through hanging sockets –network connections that the app is no longer using, but which the server thinks are still alive because the app has not closed them. The subsequent query from the server results in needless battery drain.

Here’s more background on the problem and how you can deal with it.

“Wake up. It’s time to go to sleep.”

Applications often “forget” to close their socket after they are done with it. Then, after some amount of time without data activity, the server times the socket out and closes it.

Socket termination in TCP requires a four-way handshake, so the server has to send a FIN packet to the device, which usually takes the device from the low-power dormant state to the higher-power active state. The device goes idle for a bit, then back to dormant. It’s like waking somebody up to tell them that it’s time to go to sleep.

Look at the example in the diagram. The red (1) shows the device jumping from dormant to active mode to send and receive data normally for a few seconds. Once finished, the cellular radio drops to a power-saving idle mode (2) in case that it’s needed again. After about 15 seconds of inactivity, the radio goes dormant (3).

    The diagram shows inefficiencies in Socket Termination activity on a device, the multiple steps it goes through to send/receive data and why it’s important to close sockets.

But the app has left the socket open (hanging). The server doesn’t like loose ends, so it sends its FIN packet to the device. This rouses the radio from dormant to active again (4), the same as if it were sending/receiving data for the app. Worse yet, the radio follows the normal curve back down to idle for another 15 seconds, wasting more power (5).

Begin to get the idea?

The phone has to bring up the radio for a simple, easily avoidable handshake because the server has asked the device for something that the app should have provided in the first place. If no other traffic moves between the device and the network, the connection is a complete waste of several hundred milliamperes.

Assuming that the app uses the network four times in an hour, the simple fix of having the app close the socket when finished can reduce network power consumption by about 20 percent, which would be the difference between eight and ten hours of standby power.

The lesson is: Program your app to close sockets when it has finished with them. Otherwise, the phone consumes power to bring up the radio for a needless handshake with the server.

Next Steps

So, to paraphrase Wayne, you need to know what your app is doing with the cellular radio, when it’s doing it and how to turn it off when the app no longer needs it.

Questions? Visit the Trepn Profiler Support Forum or let me know in the comments below.

mysql 中文乱码

默认:
mysql> show variables like “character_set%”;
+————————–+—————————-+
| Variable_name            | Value                      |
+————————–+—————————-+
| character_set_client     | latin1                     |
| character_set_connection | latin1                     |
| character_set_database   | latin1                     |
| character_set_filesystem | binary                     |
| character_set_results    | latin1                     |
| character_set_server     | latin1                     |
| character_set_system     | utf8                       |
| character_sets_dir       | /usr/share/mysql/charsets/ |
+————————–+—————————-+
8 rows in set (0.00 sec)
*************************************************************
*************************************************************
1.修改/etc/my.cnf文件,改成这样:
[mysqld]
default-character-set=utf8
init_connect=’SET NAMES utf8′
[client]
default-character-set=utf8
2./etc/init.d/mysqld restart 重新启动mysql;
mysql重启后字符集更改仍然生效。
mysql> show variables like “character_set%”;
+————————–+—————————-+
| Variable_name            | Value                      |
+————————–+—————————-+
| character_set_client     | utf8                       |
| character_set_connection | utf8                       |
| character_set_database   | utf8                       |
| character_set_filesystem | binary                     |
| character_set_results    | utf8                       |
| character_set_server     | utf8                       |
| character_set_system     | utf8                       |
| character_sets_dir       | /usr/share/mysql/charsets/ |
+————————–+—————————-+
8 rows in set (0.00 sec)
*************************************************************
*************************************************************
注意执行命令:
SET NAMES ‘utf8’;
它相当于下面的三句指令:
SET character_set_client = utf8;
SET character_set_results = utf8;
SET character_set_connection = utf8;

myeclipse 2013 deploy path 修改

文件路径:./.settings/org.eclipse.wst.common.component:

<project-modules id=”moduleCoreId” project-version=”1.5.0″>
<wb-module deploy-name=”web”>
<wb-resource deploy-path=”/” source-path=”/WebRoot” tag=”defaultRootSource”/>
<wb-resource deploy-path=”/WEB-INF/classes” source-path=”/src”/>
<property name=”context-root” value=”web”/>
<property name=”java-output-path” value=”/web/WebRoot/WEB-INF/classes”/>
</wb-module>
</project-modules>

linux sync 木马 .Iptables .Iptablex

现象:linux 主机对外发出高达上G的流量定向攻击互联上的某台主机(1001端口),结果就是,目标挂掉了,你也被云主机封号了(这种攻击会导致云架构共享的网络瘫痪,所有用户无法正常服务,属于致命问题)。

对于站长来说封号就是灭顶之灾,如果数据无法备份,就更悲剧了。

目前木马攻击的注入方式未知,希望有高人研究,根据本人主机的情况,猜测ssh扫描,bug注入的可能性比较高。

防范:

1. 修改ssh默认端口

2. 修改ssh的访问源ip(类似 AWS EC2 的security groups 功能)

同样问题的站长:

http://bbs.chinaunix.net/thread-4118890-1-1.html

http://www.xujiansheng.cn/2014/01/linux-viruses-iptablex-iptables/

可疑样本文件:Iptablex.zip

希望有高人能看到,能发现后门,造福广大站长

经这两天学习和热心网友乌云微博管理员的帮助,初步定位是struct 漏洞:

类似:http://www.beardnote.com/?p=829

 

解决struts2最新s2-016代码执行漏洞–CVE-2013-2251

今天接到外界报告struts2框架存在任意命令执行漏洞,可直接执行任意系统命令。 详细见官方说明:http://struts.apache.org/release/2.3.x/docs/s2-016.html

漏洞版本:
Apache Struts 2.0.0 – Apache Struts 2.3.15

漏洞描述:
CVE-2013-225. Struts2 是第二代基于Model-View-Controller (MVC)模型的java企业级web应用框架。它是WebWork和Struts社区合并后的产物

Apache Struts2的action:、redirect:和redirectAction:前缀参数在实现其功能的过程中使用了Ognl表达式,并将用户通过URL提交的内容拼接入Ognl表达式中,从而造成攻击者可以通过构造恶意URL来执行任意Java代码,进而可执行任意命令

redirect:和redirectAction:此两项前缀为Struts默认开启功能,目前Struts 2.3.15.1以下版本均存在此漏洞

目前Apache Struts2已经在2.3.15.1中修补了这一漏洞。强烈建议Apache Struts2用户检查您是否受此问题影响,并尽快升级到最新版本

< 参考 1. http://struts.apache.org/release/2.3.x/docs/s2-016.html >

测试方法:
@Sebug.net dis 本站提供程序(方法)可能带有攻击性,仅供安全研究与教学之用,风险自负!

由于Apache Struts2 在最新修补版本2.3.15.1中已经禁用了重定向参数,因此只要重定向功能仍然有效,则说明受此漏洞影响:

http://host/struts2-showcase/employee/save.action?redirect:http://www.yahoo.com/

如果页面重定向到www.yahoo.com,则表明当前系统受此漏洞影响。

验证表达式解析和命令执行:

http://host/struts2-showcase/employee/save.action?redirect:%25{3*4}

http://host/struts2-showcase/employee/save.action?redirect:%25{(new+java.lang.ProcessBuilder(new+java.lang.String[]{'command','goes','here'})).start()}`
Sebug安全建议:

厂商状态:
厂商已经发布Apache Struts 2.3.15.1以修复此安全漏洞,建议Struts用户及时升级到最新版本。

厂商安全公告:S2-01. 链接:http://struts.apache.org/release/2.3.x/docs/s2-016.html

软件升级页面:http://struts.apache.org/download.cgi#struts23151

目前存在漏洞的公司
乌云上,已经发布了快60个struts的这个漏洞问题,包括腾讯,百度,网易,京东等国内各大互联网公司。(http://www.wooyun.org/bugs/new_submit/) 

解决办法:
升级到Struts 2.3.15.1(强烈建议)
使用ServletFilter来过滤有问题的参数(临时替换方案)
 
参考资料:
http://sebug.net/appdir/Apache%20Struts

这次struts爆出来的漏洞,一大片的网站受的影响,影响最严重的就是电商了. 对于struts的漏洞,曾经也写过struts2代码执行漏洞,struts2自从使用OGNL表达式的方式后,经常就会报出一些可怕的漏洞出来,建议那些还是struts的童鞋们,学习一些其他的框架吧!比如,spring mvc,简单,好用,高效! 这里有篇对struts漏洞分析很透彻的文章,推荐学习学习. http://www.inbreak.net/archives/507

问题解决参考:
http://www.geek521.com/?p=3278