I’m willing to pay a small amount (very miserly, but I hope there are some CMI undergrads who are in enough poverty to take me up on this offer) to get some work done on the CMI/IARCS Online Judge.

• 50 USD for a new professional looking CSS and layout. This is important for me, since I’m on the job hunt, and I link to opc.iarcs.org.in on my resumes, I want it to look good again. No partial credit. The layout will also have to explain considerations as to what is placed where. (For example, currently “Logout” comes on the top menu, which is completely unintuitive.) 100% XHTML Strict. Javascript/AJAX can be allowed.
• 90 USD for a specification and implementation of a tar-ball structure that almost completely defines a problem’s data. By this I mean, I should be able to create a tar-ball with all the input and output files, the problem statement, constraints etc, and just have to upload it to the judge, and the judge should be able to figure out all the parameters to the problem automatically. I have made few attempts toward this, but every time I miss something or the other, which makes it completely useless. 10 USD for a complete written specification, 60 USD for implementation via command line. 20 USD for implementing via web-uploads, with some sort of permission mechanism to allow owners to upload the problem, and edit it if required.

Alright, I know I’m being cheap, but I really can’t afford to pay you a lot more. As a consolation, you could use this as “open source development” experience on your resume.

5$ for a name for the CMI OPC Judge. (It is referred to by several names even within the code. I am planning on putting it up on Sourceforge or something, but I don’t have a name for it.)

Mail me if you’re interested.

Ah, the intoxicating smell of fear and tension:

For a bonus amusement, I found a Masters-turned-PhD student, who used to sit in the front row and ask questions every five minutes last year, sitting at the last row with a coffee and browsing the net on his laptop. The PhD effect.

People asking you the question:

Me being a PhD-turned-Masters student, answering this question becomes very tricky. I usually get it as “What-is-your-research-interest”. It’s even trickier if you are being asked that in a class filled with other people. The first time, I tried to use some fancy term (“Varied”) to avoid the answer; another time, I just didn’t answer it and kept the awkward pause going. Another time I had to write it down on a sheet of paper that was being passed around the class, and against my name and email address I shamelessly wrote a a long hyphen, in a column filled with fancy scientific sounding terms.

I usually don’t post movie reviews, but since I already made the mistake of posting about it before, I thought I should make my stance clear about Inglourious Basterds.

Absolutely sucks.

As a Tarantino fan:

• Dialogs weren’t quite upto Tarantino standard.
• The few decent dialogs were in subtitles. At some points, they show the camera zooming in on objects, while a dialog is in subtitle, exactly where does the viewer look?
• The plot was absolutely unconvincing. I kept hoping that we’re going to find an awesome Tarantino style ending (a la Four Rooms, Reservoir Dogs, Death Proof), to make up for the boring story, but that didn’t happen. Sorry for the “spoiler”.
• Some reviews talked about good background score. There are some Tarantino style selection of music here and there, but they are pretty much there just because it’s Tarantino, and doesn’t really help the movie.
• There wasn’t enough character development, I could hardly remember the faces of the Basterds. (plus, subtitles: I was looking at the subtitles when the introductions were done.)
• Wtf is wrong with the title spelling. “An artistic flourish,” explains Tarantino. That would’ve been an acceptable explanation if the movie was good enough.

Oh, btw, I finally did go alone. And sat in an almost empty theater. Sigh.

I would happily give the task of “management” of any of my open source projects to anybody, and his duties would include telling me what I should be working on implementing, what bugs I should be fixing, and when I’ve been procrastinating, etc. Basically, I wouldn’t mind hiring someone to order me around.

But sometimes I find friends or colleagues with no difference in seniority, telling me what to do, and when this happens, I get pissed off.

For instance, let’s say I’m working in a group of people. In school projects, typically what happens is that everybody is of basically the same seniority, and therefore there is no natural leader. And then as the project progresses, there’s this one guy who takes the initiative, and starts telling people what to do.

And I get pissed off when this happens. Note that I used the positive term “initiative”, and indeed this initiative by this person is in the best interests of the project; I wouldn’t take this initiative just because I don’t want the responsibility. Look, I would have voted for you if we had elected a leader at the beginning of the project, but I am not going to listen to your orders if I haven’t explicitly given you powers to order me. Yes, perhaps it’s my ego: if I elect you, then, in some sense, you’re working for me, and at the same time I’m working for you, and everybody is happy.

Sometimes, I’ve found myself indirectly giving this power to people: for instance, if there was an almost implied leader for a plan, I usually say some self-deprecating remark about how bad I’m at managing stuff, and that therefore I’m leaving everything in their hands, and that I’ll follow orders. When this happens, I would probably listen to them when they say “Sit Arnie, Sit! Good Boy!”

Today I’m pissed off with a particular person, who seems to be assuming some kind of leadership role, and basically giving me sweetly-worded orders. So what happens is that since they are sweetly-worded you have to keep nodding your head, “Oh okay, sure I’ll do that”, “yeah no problem”, and so on. This is not the first time this is happening with this guy, and the last time I ended up doing more work than I should have done. It’s not that I’m stupid to keep accepting, it’s just that I don’t see any way of saying No, unless I show him this blog post, and tell him that I just don’t like him taking the “leadership” initiative.

(Additionally, this guy talks way too much, so I agree to everything he says without argument just to make him stop talking.)

In a recent conversation a friend, he said something which amounted to, “If A happens, then I plan to do B,” to which I informed him that A is not going to happen.

I’m sure that this person probably does not even remember this, but my reply is making me feel guilty to the point that I can’t sleep.

There’s a reason I feel guilt. I’ve been at the receiving end of this several times over the past few months, and I’ve slowly begun noticing a pattern, and I get more and more frustrated each time it happens, because it simply destroys any logical conversation between the two people involved.

For those who haven’t yet understood what I’m talking about: when I tell somebody “If A, then B” (or “I’m doing B just in case A happens”), I have not implied anything about whether A is true, and have not implied anything about the probability of A being true. Simple logic.

Yet, when I have debates (you know, political issues, and the like) with people, the moment I mention “If A, then B”, everybody jumps on me claiming that I’m stupid to assume that A can ever be possible.

For the same reason, when somebody asks me what my plans for the future are, I would avoid the “If A, then B”s, and find the C that is most likely to happen (which happens to be: nobody hires me, and am jobless, as opposed to A being getting a job in Wall Street), and simply say “If C, then D”. When I do get careless, and break away from this format and say, “If A, then B”, I’m attacked as if I’m the most stupid person ever because I’m actually planning for the possibility of A happening.

If the discussion is of value to the attacker (Notice the If), and if the attacker makes me feel stupid about mentioning the As, the attacker learns less from me, and stands to loose.

So should I never question an If-A-then-B? It’s not all that simple.

What if somebody tells me: “I’m raptor-proofing my house, just in case the dinosaurs attack.” At this point, the if-clause is absolutely utterly stupid, and I’m allowed to question it. What’s the difference here? In this case, there’s a cost to taking into consideration the possibility of A. If raptor-proofing is free, I should shut up.

Therefore, in the interest of sane, logical conversations, I propose the following mechanism for determining whether you’re allowed to argue an If-A-then-B. Think of insurance. I had an argument once about why I prefer an expensive medical insurance, “Sure, in most cases I won’t be needing it. Heck, I’ve hardly used a few hundred dollars of it last year. But if a medical emergency does happen, and I don’t have an expensive insurance, I’d get bankrupt and my whole life would be ruined”. At this point, your only valid argument should be whether my annual premium that I pay being worth the small probability. You do not have a right to simply tell me that the probability of such an emergency is too low (worse: telling me it will never happen!), without talking about the cost involved.

And therefore, in the future, if I ever say “If A, then B”, and the cost involved in taking A into consideration is Zero, then heck, you have no right to argue the possibility of A. If needed, argue B given A.

If I say, “If A, then B”, and there’s a cost involved in taking A into consideration, then you have a right to question whether that cost is worth it. Even in this case, be mindful of the differences in valuations of cost between you and me.

And since, in the recent conversation with the friend that I mentioned at the beginning of this post, I claimed that A is not going to happen, in a situation where there was no cost involved in planning for A, I sincerely apologize.

(P.S. I didn’t have the right words while describing the If-A-then-B construct. Any pointers to proper linguistic terms for these if I need to discuss this again?)

No, I haven’t seen it, and this is not a review.

It releases today, and there’s this part of me that does not want to see it.

Over the last one year, I have seen most of the movies that I have been interested in watching, and so now when I watch something, it’s mostly out of boredom than actual interest.

A Tarantino is different.

I’ve been trying to figure out why I’m trying to avoid watching it. I know that this is the only movie I’ve ever really looked forward to.

When you buy a bottle of fine Champagne, you just don’t use it the night you buy it. You treasure it, maybe let it age, and then when the timing is right, when you’re with the right people, with the right atmosphere, and the right everything, that’s when you open it.

I will not drink Champagne alone.

I killed over twenty flies today. Two were … just a few minutes ago. They were humping each other, and I got them both at the peak of their ecstasy. Some were unborn, just larvae [EDIT: looking at WP images, I might be wrong about this]. I had to execute them with my own bare hands, and there was something about it that I didn’t like.

I enjoyed it.

No but seriously, I suddenly, overnight, have a housefly problem at my new apartment. I mean, when you kill houseflies that are humping each other, you know you’ve got a problem. And it’s not stopping, the more I kill the more seem to appear from nowhere (my windows are netted btw, so they won’t even leave). It’s not that all 20 were present at the same time! There seems to be some nest somewhere in the apartment that’s constantly producing them. And according to wikipedia, these things lay eggs in batches of 75 to 150 that hatch within a day. Ugggh. Ewww. *shivers*. I’m screwed.

And I’ll not be at home tomorrow. Tomorrow they’ll have a field day humping and mating and partying on the tiny food crumbs on the kitchen. AAAAAAAAAAAHHHHHHHHHHH!!!

(This is a report for Summer of Code 2009, and is intentionally very technical. Regular readers are requested to not harass me over my recent geeky posts.)

First a screenshot of a theme I liked (Ravenant), and a theme that works decently:

(I’m not going to fool you, and I know many themes don’t work entirely well. And I’ll conveniently blame that on Webkit, and I’ll bring up the rendering issues in a moment.)

Repository and Directories

In my midterm report I mentioned that I was using Git for version control. Soon after, I moved to monotone. I’ve been pushing my changes to the same Git repository for backup, but under a different branch name. So if you want to check out my code for testing, here’s what you do:


$ git clone git://github.com/tdrhq/pidgin-clone.git
$ cd pidgin-clone
$ git checkout -b webkit remotes/origin/im.pidgin.soc.2009.webkitmessageview


[EDIT: I changed the last checkout command to use remotes/origin/im...]

If anybody wishes to pull from my Monotone repository, we could arrange for that.

Since the midterm, I also added support for multiple message styles. Each of the styles go into a directory under ~/.purple/styles/. So e.g., you might have a directory called ~/.purple/styles/Ravenant.AdiumStyles/Content if you have installed the Ravenant style.

You’ll also want to enable the Adium IMs plugin for message styles to work. (Otherwise you’ll still be using WebKit, but without themes.)

What works and doesn’t work

I promise I’m not going to suddenly decide to code while writing this report, so hence and therefore, even if some of the Todo’s that I mention below seem obvious to fix, I will not fix them until this report is done. :-)

There are very few visible changes since the midterm: You can switch between Message Styles now, and I removed support for on-the-fly changing variants. Any changes to the style or options will take effect only in new conversations.

Internally, I’ve changed many things since the midterm. E.g.,

• I use signals instead of UiOps, which is more cleaner, but has its drawbacks. (The current signals that gtkconv emit don’t give the alias and timestamp for the message. Not hard to change the signal itself, but still…).
• I’ve been more careful about waiting for the Webkit document to load completely before appending messages (otherwise the JavaScript fails silently.).
• Since more than one Message style may be loaded at the same time I had to do some refactoring (this refactoring will also enable having different Styles for chats and IMs).
• I currently parse the style’s Info.plist file completely according to [1], and use the DefaultFontFamily and DefaultFontSize. (Some of the other keys depend on changes in Webkit gtk; and I don’t know how to implement ImageMask.)
• User’s selection of style options are saved on a per-style basis. (e.g., for each style I store the last variant the user used.)

Among things that don’t work: most noticeable are the rendering issues. In the first screenshot, you can see that the gradient isn’t smooth. This seems to be an issue with almost all themes that seem to use translucent PNGs for drawing these gradients. (For the record, I am using WebKit trunk.) Some other themes have positioning issues, but are mostly useable.

Another thing I would like to do in the future is HTML-tidy each message and strip off the <html> and <body> tags. Not a show-stopper, but it’ll be easier on Style designers to have standards compliant messages.

Here’s a screenshot of the Adium IMs plugin options:

I have never done Gtk layouting in the past, and I spent a lot of time just getting this little thing together, using a nasty GtkTable, and so despite how ugly it looks, I’m proud of it. (Sean gave me some better ideas as to how to do the layout, and I’ll be doing them soon. As I said, not while this report is in progress.)

As you can see, this does not provide the same level of customizability that the Adium’s “Messages” preference tab provides. (For those like me without access to a Mac, here’s what it looks like on Adium. Screenshot from here.)

This plugin does not implement the “Status.html” and “FileTransfer.html” parts of [1]. This should be fairly easy to implement though. Also the sections on “Image Zooming”, “JavaScript enhancements”, and “Groupchat styling” are not implemented. (Groupchat works, but in a way that is not distinguished from regular IMs.) [Oh crap, so many todos? I better get coding.]

This plugin, like Adium itself, does not support inline typing notifications. This needs changes into the style specification itself. It shouldn’t be too hard, we could allow the style to specify a JavaScript function “setTypingStatus”, that would be called every time the typing status changes. Not too hard, but I would definitely like an opinion from Adium devs on this one.

Disabling the Adium style plugin, and just using plain webkit still breaks inline typing notification. GtkIMHtml had some specific “hacks” for typing notification, which can actually be done using JavaScript with WebKit. My contention with this idea was that this adds additional complexity to GtkConv.c (which is already huge!) and this JS overlaps with the JS of implementing inline typing notifications in the Style, and if ever Pidgin chooses to use Adium styles as default, this would be wasted code.

I also haven’t done anything about gtkconv->entry, which refers to this widget:

so GtkConv still has a dependency on GtkIMHtml.

I haven’t worked out a solution for the Security considerations I raised in my midterm review.

Code quality

I’ll now give my opinion on the quality of code I’ve written. I’ve stuck to the usual Pidgin coding style. (Except, out of habit of coding in Liferea, I have used func<space>() at most places.)

• gtkwebview.{c|h} is fairly well written, being almost a very simple wrapper over WebkitWebView. (It compiles with warnings about “no previous prototypes for gtk_webview_xyz”, which makes absolutely no sense to me as they are declared in gtkwebview.h. I remember reading something about a GCC bug regarding this, but I’m not sure.)
• The changes to GtkConv.c were done in one marathon session. I can’t imagine how I had the patience to do all of those, since reviewing each of those changes is painful enough. However I think I did a “decent” job here, and might have broken a few things like drag-n-drop. Also gives a few warnings about unused symbols.
• webkit.c, and the adium styling code was initially taken from Sean’s plugin (which btw, does a lot of the Style parsing code already!). This code has grown and is now in two files: message-style.c and webkit.c, where message-style.c handles parsing the style data. The exact nature and intent of the PidginMessageStyle struct can be a little confusing, and I need to document it correctly. I need to separate the preferences code into a third module.
• smileyparser.{h|c} is terribly written but does its job. It is intended as a replacement for the smiley text-replacement code which is part of GtkIMHtml, and as of right now is redundant but required for conceptual clarity.

There are other less significant places cases where GtkIMHtml was replaced with WebKit. (About, User Info, Chat logs.)

There are a few printf’s at places, and I promise to replace them with purple_debug_info.

Broken Plugins

A few plugins remain broken becase they depended on gtkconv->imhtml, which no longer exists. Few of the plugins that I have removed temporarily from pidgin/plugins/Makefile.am: gestures, history, markerline, notify, timestamp, timestamp format, xmppconsole, … (I’ll get back to you on this one, I think I’ve disabled more plugins than needed.)

Links, if you reached till this point

[1] http://trac.adium.im/wiki/CreatingMessageStyles
[2] http://pidgin.im/pipermail/devel/2009-July/008542.html

Hello there, tech readers.

I have a question to ask, and I hope one of you out there can give me a good answer to it.

So I have recently been introduced to Unit Testing as a development process, as part of the Software Engineering course I just took at Penn. Now, firstly we didn’t go into very detailed technical aspects of how Unit tests are done, but I did get a chance to write tests while I wrote code, and I found it to be incredibly useful. During the course I also wrote PHPUnit tests for the CMI/IARCS online judge, and, while I think PHPUnit is better than nothing, it still sucks for data-driven applications like the CMI judge.

Now for one thing, PHPUnit is buggy. But I think the major issue is that the entire model (which I think, is called the xUnit model) is crappy for certain types of applications, especially Web Applications.

I also think, that the model is pretty useless for event driven applications like most desktop applications written in C, since it’s going to be ridiculously messy to wait on events and callbacks to proceed the test. On the other hand, most Java programs would probably have a thread for doing anything that would block, and while I would’ve called that absolutely stupid until a month back, I can see why that’s so useful for writing unit tests.

In fact, Java makes unit tests bloody easy even without a framework. We wrote a fairly complex Java program last Spring as part of the Software Systems course, and without knowing anything about Unit testing, writing tests were obvious every time I wrote a new component: public static void main!

I’ve been thinking about how I would like to implement a Unit testing framework for the OPC judge, and I did come up with the following framework, and I do believe that it’s a fairly obvious way of going about it, and that one of the hundreds of unit testing frameworks should provide something like this, and that one you readers can point me to it.

So, first I’d like to argue that we should be able to define the state of the system well. In unit testing terminology, this might be called “fixtures”. There are two parts of the fixture, one is the static data stored by the program before it started, and then a series of actions that changed the system to its present state.

For example in PHP, the state would be [database] x [$_SESSION], and here the $_SESSION is usually small enough. These are the only two things that are remembered across two calls to the Apache server. (In this situation, you can imagine a second user changing the database at the same time, but for the purpose of testing, let’s skip these situations.)

In event driven, single threaded programs, the state is actually very easily defined. Each time you’re in the event loop, waiting for the next event, we have a state. I wouldn’t be concerned much (with some exceptions) about intermediate states. It’s these states where the program is doing nothing that has to be tested.

(In multi-threaded programs, talking of state is pretty useless, so in that case, we should stick to the xUnit style of testing.)

Once you have the state, you can define actions. Actions may or may not change the state. Each unit test would be of the following form: set up the fixture, run a few actions to bring the system state to a state in which we want to test the system, and finally test the action we’re interested in.

Unfortunately, as a developer, I find myself not liking the idea of building the fixture for a particular test. It’s painful, you have to hand compute the results, errors, and any small change to the dataset changes the answers, and so on. So the first thing I want of my testing framework, is that I should be able to write tests without fully knowing how the fixture looks like. But the actions depend on the fixture itself. So e.g., I want to test that the problems/ page works on the IARCS judge. depends on the data. I would should be able to write something like:


$problemname = get_value_for_situation ("problem-name", "Any problem name in the database, maybe one that uses images, so that we can test it");
route ("problems/$problemname");
< sanity checks go here >


Now this is independent of the fixture. So if a user wants to create a new test based on this for a new fixture (or for a new value of problem-name), he might do something like:


$ create-test test-problems-page.php <fixturedir>


and now, the testing framework asks the user to input a value for “problem-name”, and stores this answer in a testing database permanently (which should not be part of the code repository, but you could imagine a central repository, where testers can push their tests to).

This can go on. Answers can depend on the fixture too, for instance if in the above case an Exception is thrown while opening “problems/$problemname”, then the framework should ask the tester:


An exception [ContestNotStartedException] was thrown, is this the expected behavior [y/n] ?


..and the answer goes into the database.

It could be more complex. The tester could write specific tests for his fixture:


The test passed with no assertions failing. Do you want to test anything else [y/n]? y
> assert ($output->xpathQuery ("//img[@href="image1.jpg]").count != 0)


.. and this code goes into the database.

Event driven C programs

The second thing I want in a framework is specific to event driven programs, and very specific to the libraries/languages used. There are some unit tests that I would actually like to write for my Soc 2009 code for Pidgin.

A simple concept that we learnt in Software Engineering was “Design to Test,” which makes lots of sense. Therefore, I believe it makes sense for a C program to emit signals specifically to indicate that some action has completed successfully or changed the state, even if that signal is not intended to be used by other code.

For instance, if I had to rewrite my GoogleSource implementation in Liferea, I should be able to write unit tests that look like:


testParseSuccess (){
<initialize the GoogleSource subscription>
subscription_update (subscription); /* asynchronous network interactions */
g_wait_on_signal (subscription, "update-complete", &xml);
<validate the XML >
}


[technical detail: This scheme may not be easy to implement. One way is to keep continue the event loop within the wait_on_signal function. I'm not sure about the details of this, and I might be wrong. The other is to keep this entire code in another thread, and "subscription_update" should would not be an internal API call, but a "top-level" "action".]

This should make it possible to write linear tests within the event driven model, while keeping the test code as an observer to the state of the system.

I stop here. I’m getting lazy, and I still have work to do on my Pidgin Webkit plugin, and so I’m not proof reading this. Hopefully, even though most of you didn’t reach till this paragraph, this documents some of the ideas I had for how a unit test system should behave. And even better, if you know some unit test framework that I can modify to suit my needs, do let me know.

This is going to be the Ultimate Wi-Fi Hitchhiker’s Guide to Tunnelling.

I’m going to start with the basics, and end up presenting my own scripts and my own setup to create an Ultimate, almost 100% transparent tunnelling setup, without root permissions on the gateway.

What SSH Provides

Situation 1: A –> B –> C

If you are A and you want to connect to an HTTP proxy running on C on port number 3128, but you have access only to B, and B has access to C, this is what you would do:
arnold@A:~$ ssh -L 8000:C:3128 B -N

(B/C are IP address or host names.) This creates a port 8000 locally which maps to port 3128 on C.

Situation 2: C —> A, but A –/–> C

Ok, suppose C is behind a complete firewall, and you can’t even access B, or C directly from A. But C can access A. Well, let’s assume now that you have physical access to C (or ssh access via some long tedious route), well, then connect to C and do:
arnold@C:~$ ssh -R 8000:A:3128 A

Very useful if somebody behind a firewall wants you to help out with system administration remotely.

Situation 3: You just want a “transparent” proxy, and you already have a connection from A –> C

What we do here, is create a SOCKS proxy, which is a kind of super-proxy, that can proxy just about any kind of connection, as long as your client program supports SOCKS. Typically this is what you’d do:
arnold@A~$ ssh -D 9000 arnold@C -N

Now go to your Gnome Network Proxy setting and set your proxy to use SOCKS, with localhost:9000. You might have to manually set it for applications that don’t lookup the Gnome proxy settings. If you’ve done this right you should be able to do almost everything like chatting, browsing etc.

ssh -D is useful, but it’s not convenient when you want a “permanent” transparent solution. For one thing many command line applications don’t support SOCKS by default. We can sort of fix this: Install tsocks, edit the proxy settings in /etc/tsocks.conf, and run tsocks bash. Any command you run now will transparently use the SOCKS proxy you set up.

But that’s not good enough.

Situation 4: A –> C, and you have root access on both A and C

… and you’re running Linux/BSD etc.

arnold@A~$ sudo ssh -w 0 root@C -N

This creates a “virtual” networking device (tun0) on both ends, and connects them, basically creating a VPN. But this step just creates the connection, it does not set up the routing. I can’t show you all the steps here, but this is basically what you do:

arnold@A~$ ifconfig tun0 10.0.0.1 pointtopoint 10.0.0.2
arnold@C~$ ifconfig tun0 10.0.0.2 pointtopoint 10.0.0.1

You should now be able to ping 10.0.0.2. Now set up iptables and NAT on C. (Sigh, I can’t explain those here, and really I don’t know much of it. But you’ll see a few examples of iptables further down.) Once this is set up, you need to set the route on A:

arnold@A~$ sudo route del default dev eth0
arnold@A~$ sudo route add dev eth0 # you still need your SSH to run
arnold@A~$ sudo route add default gw 10.0.0.2


Too messy? Of course it is. Plus, you need root access on the server. We can do better.

The trick

There are multiple “solutions” to the problem. The first one that came to my mind, was to create a tun0 virtual device locally, which maps each connection to a local SOCKS proxy. Fairly simple idea, turned out messy to code because I didn’t know how to easily write a userspace TCP stack that changed the raw packets from the tun device to a stream. I googled a lot but found just one program that claimed to do this, and that was written in C#, and had some GUI code in it, and I definitely didn’t feel comfortable running it. (for the record, socks-tun on Google code.)

So here’s what I finally did: Let’s use iptables to reroute all outgoing TCP streams to a local daemon. This daemon at this point does not know the destination of this stream, but with a little effort it can find that out by looking at /proc/net/ip_conntrack. Now it just uses tsocks to finally route this connection via SOCKS. Simple enough, the code is here (and git clone git://github.com/tdrhq/tunnel-scripts.git), and here’s what I did:

Build it: arnold@laptop:~/tunnel$ gcc lcat.c io_loop.c my_socket.c -g -o lcat.

For the following example, I shall use 61.12.4.27 as an example, since it’s CMI’s IP address, although I would hope that the rest of you reaching here via Google don’t just copy and paste this.

Enable ip_forward: (I’m not sure if you need this step, but still…)
sysctl -w net.ipv4.ip_forward=1

Reroute all connections to destinations other than 61.12.4.27 to a local port:
sudo iptables -t nat -A OUTPUT -p tcp -d \! 61.12.4.27 -o wlan0 -j DNAT --to-destination 127.0.0.1:9000

(Change wlan0 to your interface.)

Now create your SSH socks proxy:
ssh -D 3128 61.12.4.27 -N

Now edit /etc/tsocks.conf with the proxy as localhost and port as 3128. Also set the SOCKS version to 4. We’re almost done:

arnold@laptop:~/tunnel$ sudo tsocks bash
root@laptop:/home/arnold/tunnel# ./lcat -p 9000 -t


And from now on all TCP connections are 100% tunnelled.

Caveats: DNS lookup is not TCP based. The iptables command above routes only TCP connections. It should be possible to route UDP via SOCKS too, however I don’t have support for that in my code yet. So, right now, you better have a valid nameserver to use. Also, because of this same reason, ping won’t work, and so don’t expect to use it to test connectivity during any of the steps.

More notes: SSH tunnels time out if inactive.

Being a responsible Tunneller

As a tunneller, you don’t want to be misusing your gateway’s bandwidth. Let’s all just be resonsible tunnellers. Also, what’s your reason for tunnelling? Right now, mine is that I’m using my neighbor’s wireless, and I don’t want to get caught. (While watching videos, you don’t really need the full bandwidth, but it uses it anyway in pointless buffering.) My lcat script can be used for bandwidth throtling too. You need to run an additional lcat, before the ssh step. To limit the speed to 100 kbps:

arnold@laptop:~/tunnel$ ./lcat -p 6000 -h 61.12.4.27 -s 100
arnold@laptop:~/tunnel$ ssh -D 3128 -p 6000 arnold@localhost

While lcat is running, you can also type in a new speed to change the speed on-the-fly.

And for completeness…

… let me mention Corkscrew for tunnelling an SSH session over an HTTP proxy.