@aifsair fser

How to build a load balancer with BGP and ECMP using VyOS

According to this cloudflare blog article "Load Balancing without Load Balancers", we can build a rock-solid load balancer only using a router. All the magic comes from BGP and Equal-Cost Multi-Path routing.

In this howto, I will use bird as BGP router on linux instance (ie. servers).

Test environment

I use GNS3 with this architecture :

You Will Need

A local copy of AFL with Doug Birdwell's networking patch
A binary dump of a BGP OPEN packet
Latest copy of Free Range Routing
Patience

Acquiring Resources

A local copy of AFL with Doug Birdwell's networking patch

I wanted to build an LDAP server that queries a MySQL server to fetch users and check their passwords. It is mainly used for old software that does not work with custom OAuth2 providers. Redmine is an example of this.

ldapjs: library to start-off LDAP servers from scratch
node.js driver for mysql: to connect to a mysql server

Instructions:

Create the database and table with insert.sql

Start Kafka service

The following commands will start a container with Kafka and Zookeeper running on mapped ports 2181 (Zookeeper) and 9092 (Kafka).

docker pull spotify/kafka
docker run -d -p 2181:2181 -p 9092:9092 --env ADVERTISED_HOST=kafka --env ADVERTISED_PORT=9092 --name kafka spotify/kafka

Why Spotify?

ADVERTISTED_HOST was set to kafka, which will allow other containers to be able to run Producers and Consumers.

Create bootable USB

dd bs=4M if=/path/to/archlinux.iso of=/dev/sdx status=progress oflag=sync

Boot from USB and set prepare system

loadkeys <your-keymap>

This Gist documents Unix utilities that have options that can be abused to execute other, arbritrary commands. This information can be useful in many scenarios -- the ones that come to mind are abusing certain /etc/sudoers configurations, breaking out of limited shells (eg. the ones provided in many network devices) and getting RCE in webapps even with restrictive filters in place.

Many of these examples originally came from this blogpost.

This is the script that was used to test these examples:

$ cat test.sh
#!/bin/sh

	#!/usr/bin/env bash

	# https://developer.github.com/v3/repos/releases/#create-a-release

	repo=$1
	tag=$2
	name=$3
	text=$4
	token=$GH_TOKEN

	- hosts: docker
	become: yes
	tasks:
	- apt:
	name:
	- apt-transport-https
	- ca-certificates
	- curl
	- software-properties-common
	update_cache: yes

	#define KBUILD_MODNAME "xdp_drop_80_8080"
	#include <uapi/linux/bpf.h>
	#include <linux/in.h>
	#include <linux/if_ether.h>
	#include <linux/if_packet.h>
	#include <linux/if_vlan.h>
	#include <linux/ip.h>
	#include <linux/ipv6.h>

	BPF_HASH(counter, uint32_t, long);

	This is a simple Python3 program, using a CSV file with headers as datasource. Column names are injected in the template rendering to be used as variable substitution.

	This is not perfect. For example, the encoding fails for address headers when there are some accentuated characters (éèà for example) in the firsname or the lastname.

	The template can contain UTF-8 characters, the message is Base64 encoded before beeing sent.