49 coconut49

System Design Cheatsheet

Picking the right architecture = Picking the right battles + Managing trade-offs

Basic Steps

Clarify and agree on the scope of the system

User cases (description of sequences of events that, taken together, lead to a system doing something useful)
- Who is going to use it?
- How are they going to use it?

Example MacVlan Bridge mode

# add the namespaces
ip netns add ns1
ip netns add ns2

ip link add mv1 link eth0 type macvlan mode bridge
ip link add mv2 link eth0 type macvlan mode bridge

superfish.pem contains:

the Superfish certificate as found by both Chris Palmer and Matt Burke;
the encrypted private key as found by Karl Koscher.

$ openssl x509 -in superfish.pem -text
Certificate:
    Data:
        Version: 3 (0x2)

朴素VPN：一个纯内核级静态隧道

由于路由管控系统的建立，实时动态黑洞路由已成为最有效的封锁手段，TCP连接重置和DNS污染成为次要手段，利用漏洞的穿墙方法已不再具有普遍意义。对此应对方法是多样化协议的VPN来抵抗识别。这里介绍一种太简单、有时很朴素的“穷人VPN”。

朴素VPN只需要一次内核配置（Linux内核），即可永久稳定运行，不需要任何用户态守护进程。所有流量转换和加密全部由内核完成，原生性能，开销几乎没有。静态配置，避免动态握手和参数协商产生指纹特征导致被识别。并且支持NAT，移动的内网用户可以使用此方法。支持广泛，基于L2TPv3标准，Linux内核3.2+都有支持，其他操作系统原则上也能支持。但有两个局限：需要root权限；一个隧道只支持一个用户。

朴素VPN利用UDP封装的静态L2TP隧道实现VPN，内核XFRM实现静态IPsec。实际上IP-in-IP隧道即可实现VPN，但是这种协议无法穿越NAT，因此必须利用UDP封装。内核3.18将支持Foo-over-UDP，在UDP里面直接封装IP，与静态的L2TP-over-UDP很类似。

创建一个朴素VPN

如何在路由器中实现透明代理？

0 互联网现状

目前整个互联网环境，被破坏最严重地部分，是 Web 服务体验。当直接破坏难以实现时，就会从流程链的上下游着手，如：DNS 污染。

其它地互联网服务类型，例如：邮件，可能小部分会受到 Web 服务上下游破坏地余震，但整体上基本不受影响。

	#!/usr/bin/env python

	"""Simple HTTP Server With Upload.
	This module builds on BaseHTTPServer by implementing the standard GET
	and HEAD requests in a fairly straightforward manner.
	"""


	__version__ = "0.1"
	__all__ = ["SimpleHTTPRequestHandler"]

	#!/bin/bash

	mkdir ./cgi-bin/
	cp upload.cgi ./cgi-bin/
	chmod +x ./cgi-bin/upload.cgi
	mkdir ./upload/
	python -m CGIHTTPServer 8080

	#!/usr/bin/env python
	# -- coding: utf-8 --

	""" 测试 Python 在什么情况下会输出 Unicode 字符串
	需要首先理解在 Python 中 Unicode 类型和 Unicode 字符串指的不是同一个东西。
	Unicode 字符串是 str 类型，但它的值的表现形式是 Unicode 编码形式。
	"""


	def printt(str):

	/* player defination ... */
	var Players = {
	Sunyanzi : { HP:100, ATT:20, DEF:5 },
	ikaros : { HP:100, ATT:15, DEF:5 }
	};

	/* initialize battle field ... */
	var queue = [];

	/* decide fighting order ... */

	Sometimes you try to open a remote desktop connection to a machine only to get an error message that "the password has expired".

	If the remote machine does not enforce NLA (Network Level Authentication), it is still possible to start a remote desktop session by disabling NLA on the client (currenlty not possible from the menu on my remote desktop client v.6.3.96000 that came with windows 8.1).

	Add the following setting to your .rdp file ("C:\Users\<User>\Documents\Default.rdp" if you aren't using a specific one).

	enablecredsspsupport:i:0

	Optionally you might need to specify