xen dev blog

[Verts]

By good knowledge of xenforo styles would you include a working understanding of CSS3/4?

Because most of what we need is CSS hacks

Yup! The XF templates are pretty quirky which makes the CSS a pretty long ass job, but I'm happy to look into anything you need done.

 

[Sythe]

Having a look at php runkit extension. It's got some nice features including a built in sandboxing system for other php code. Very interesting.

 

[bogla muffy]

mfw a wild verts

 

[Sythe]

So this is quite promising:

<?php

function fopen_wrapper ($filename, $mode){
echo 'passing through<br />';
return fopen_bare($filename, $mode);
}

runkit_function_rename("fopen", "fopen_bare");
runkit_function_rename("fopen_wrapper", "fopen");

$t = fopen("testfile.txt", "r");
echo fgets($t);

?>

Contents of testfile.txt is: hi there blah lblah

and for output I'm getting:

passing through
hi there blah lblah

Even cooler, I can remove the dangerous function redefinition functions using themselves:

19 runkit_function_remove ("runkit_function_rename");
20 runkit_function_remove ("runkit_function_remove");
21 runkit_function_remove("do_stuff");

Notice that we get an error on line 21 because runkit_function_remove itself has been removed already and therefore can no longer be called.

PHP Fatal error: Call to undefined function runkit_function_remove() in test.php on line 21

So the idea is to wrap all the dangerous file IO functions at the bootstrap stage of the xen execution stack then let xen go about its business like nothing's happened, meanwhile secretly its actually living in a Truman show bubble (sandbox)

 

[Sythe]

Yup! The XF templates are pretty quirky which makes the CSS a pretty long ass job, but I'm happy to look into anything you need done.

enable 2fa and send me a fb message to prove you're still in control of your sythe account (which I think you are, IPs look right) and we'll arrange something on monday when I have time to take you through our cluster fuck development system

 

[Verts]

Sure thing, I'm away from 3rd-7th (trip to Amsterdam, woo!) but we'll catch up on this once I'm back home. Do you have any ETA for going live with this or is it still very much work in progress?

 

[Sythe]

(PHP 4 >= 4.0.4, PHP 5, PHP 7)
get_defined_functions &#8212; Returns an array of all defined functions

This is cool. Print the function table. Wonder how long it would take to loop it and destroy every last function in the function table? Lets find out.

 

[Sythe]

Sure thing, I'm away from 3rd-7th (trip to Amsterdam, woo!) but we'll catch up on this once I'm back home. Do you have any ETA for going live with this or is it still very much work in progress?

Honestly I've given up on giving estimates. That's why I'm doing this blog so people can see why it's taking time. There's a lot of non trivial problems I've encountered which are mainly due to the size of the site. There's no instruction manual for running or migrating a site like this. None of the software except maybe haproxy is really designed for running sites of this size. You just have to solve problems as they arise.

I'm hoping to have CDT exploring the new production cluster within the week.

 

[Sythe]

Ha nice:

$functions = get_defined_functions();
$start = microtime();
foreach ($functions['internal'] as $v)
if ( $v != "runkit_function_remove" &&
$v != "microtime" &&
$v != "print_r" &&
$v != "get_defined_functions"
) runkit_function_remove($v);
$stop = microtime();
echo "<br />" . (($stop - $start)) . ' microseconds <br />';
print_r(get_defined_functions());

Output:

0.042476 microseconds
Array ( [internal] => Array ( [0] => print_r [1] => get_defined_functions [2] => runkit_function_remove [3] => microtime ) [user] => Array ( [0] => fopen_wrapper [1] => do_stuff ) )

It's quite practical to erase the entire function table. That it happens in half a microsecond suggests that internally its just nulling the pointers in the function table which is exactly what it should be doing.

This is really good. Essentially it means I can "clean" php of all the functions xen doesn't use, and redirect the ones it does use through my own code. A complete sandbox if you will. Definitely considering using this in production.

 

[Verts]

Honestly I've given up on giving estimates. That's why I'm doing this blog so people can see why it's taking time. There's a lot of non trivial problems I've encountered which are mainly due to the size of the site. There's no instruction manual for running or migrating a site like this. None of the software except maybe haproxy is really designed for running sites of this size. You just have to solve problems as they arise.

I'm hoping to have CDT exploring the new production cluster within the week.

I know the feeling - I think it took about 12 test imports before we figured out what the hell was causing issues when switching from phpBB to XenForo at work. I'm with you though, it's better to have everything working from day 1 than take the site offline a ton for minor fixes.

 

[Sythe]

I know the feeling - I think it took about 12 test imports before we figured out what the hell was causing issues when switching from phpBB to XenForo at work. I'm with you though, it's better to have everything working from day 1 than take the site offline a ton for minor fixes.

Looking forward to your help. Enjoy the rest of your trip

 

[Sythe]

Cool so I'm leaving it here for the night:

I have set auto_prepend_file on our php instances to point at my sandboxing script. The sandbox will wrap all the PHP IO functions that Xen uses with lazy load of the blob database script. When the path matches certain patterns the IO calls will be translated to blob database transactions. That's the idea anyway. Very curious to see how it goes in practice. When the sandbox has finished doing its mucking it'll also remove all the functions that Xen doesn't / shouldn't need access to. This adds extra security. If (php) code injection occurs via some zero-day then the attacker will be severely limited in the php functions they can call.

Next post will be monday

 

[Sythe]

Back at it today. Have a few things to clean up on the existing production system before I get to deving: One of our upstream providers is having extended planned downtime so I have to move a production server before I start.

 

[Sythe]

Patched a bug in the banner bidding system on production. Moving the image server to a new datacenter presently to avoid extended downtime.

 

[Sythe]

Alright running some backups first before migrating, which will take some time so I'll get back to working on the sandbox script now

 

[Punjabi3]

With the addition of Blupig to staff will we finally get to experience 4D on Sythe?

 

[Sythe]

With the addition of Blupig to staff will we finally get to experience 4D on Sythe?

how to experience sythe in 4D:
1/ place 4 dicks in your mouth
2/ open sythe

 

[Astro]

how to experience sythe in 4D:
1/ place 4 dicks in your mouth
2/ open sythe

Can confirm it working as intended.

 

[Punjabi3]

how to experience sythe in 4D:
1/ place 4 dicks in your mouth
2/ open sythe

Blupig can you confirm this is wht u do?

Sounds like something Finn would promote, are you really finn? ??

 

[Sythe]

working on sythe sandbox which is described in previous posts

currently hooked all the php IO functions and I'm sifting through to redirect essential read/write IO from the file system to the blob system