Randomness 101: LavaRand in Production

Introduction

Randomness 101: LavaRand in Production

Randomness 101: LavaRand in Production

Lava lamps in the Cloudflare lobby

Courtesy of @mahtin

As some of you may know, there's a wall of lava lamps in the lobby of our San Francisco office that we use for cryptography. In this post, we’re going to explore how that works. This post assumes no technical background. For a more in-depth look at the technical details, see LavaRand in Production: The Nitty-Gritty Technical Details.

Background

Randomness in Cryptography

As we’ve discussed in the past, cryptography relies on the ability to generate random numbers that are both unpredictable and kept secret from any adversary.

But “random” is a pretty tricky term; it’s used in many different fields to mean slightly different things. And like all of those fields, its use in cryptography is very precise. In some fields, a process is random simply if it has the right statistical properties. For example, the digits of pi are said to be random because all sequences of numbers appear with equal frequency (“15” appears as frequently as “38”, “426” appears as frequently as “297”, etc). But for cryptography, this isn’t enough - random numbers must be unpredictable.

To understand what unpredictable means, it helps to consider that all Continue reading

Rough Guide to IETF 100 – Slinging Standards in Singapore

It’s time for the third and final IETF meeting of 2017. Starting on Sunday, 12 November, the Internet Engineering Task Force will be in Singapore for IETF 100, where about 1000 engineers will discuss the latest issues in open internet standards and protocols. All this week, we’re providing our usual Internet Society Rough Guide to the IETF via a series of blog posts on topics of mutual interest:

  • Internet of Things (IoT)
  • Routing Infrastructure Security Resilience
  • IPv6
  • DNSSEC, DANE and DNS Security
  • Identity, Privacy, and Encryption

All these posts can be found on our blog and will be archived through our Rough Guide to IETF 100 overview page.

Here are some of the activities that the Internet Society is involved in and some of my personal highlights.

IETF Journal

Catch up on highlights from IETF 99 in Prague by reading the IETF Journal. You can read all the articles online at https://www.ietfjournal.org, or pick up a hardcopy in Singapore.

This issue marks the final hardcopy version; starting in 2018, we’ll be shifting our focus to longer-form articles online and via our Twitter and Facebook channels. In the meantime, this issue has articles on the Human Rights Continue reading

Kubernetes on OpenStack: The Technical Details

This is a liveblog of the OpenStack Summit session titled “Kubernetes on OpenStack: The Technical Details”. The speaker is Angus Lees from Bitnami. This is listed as an Advanced session, so I’m hoping we’ll get into some real depth in the session.

Lees starts out with a quick review of Bitnami, and briefly clarifies that this is not a talk about OpenStack on Kubernetes (i.e., using Kubernetes to host the OpenStack control plane); instead, this is about Kubernetes on OpenStack (OpenStack as IaaS, Kubernetes to do container orchestration on said IaaS).

Lees jumps quickly into the content, providing a “compare-and-contrast” of Kubernetes versus OpenStack. One of the key points is that Kubernetes is more application-focused, whereas OpenStack is more machine-focused. Kubernetes’ multi-tenancy story is shaky/immature, and the nature of containers means there is a larger attack surface (VMs provide a smaller attack surface than containers). Lees also points out that Kubernetes is implemented mostly in Golang (versus Python for OpenStack), although I’m not really sure why this matters (unless you are planning to contribute to one of these projects).

Lees next provides an overview of the Kubernetes architecture (Kubernetes master node containing API server talking to controller manager Continue reading

Issues with OpenStack That Are Not OpenStack Issues

This is a liveblog of OpenStack Summit session on Monday afternoon titled “Issues with OpenStack that are not OpenStack Issues”. The speaker for the session is Sven Michels. The premise of the session, as I understand it, is to discuss issues that arise during OpenStack deployments that aren’t actually issues with OpenStack (but instead may be issues with process or culture).

Michels starts with a brief overview of his background, then proceeds to position today’s talk as a follow-up (of sorts) to a presentation he did in Boston. At the Boston Summit, Michels discussed choosing an OpenStack distribution for your particular needs; in this talk, Michels will talk about some of the challenges around “DIY” (Do It Yourself) OpenStack—that is, OpenStack that is not based on some commercial distribution/bundle.

Michels discusses that there are typically two approaches to DIY OpenStack:

  • The “Donald” approach leverages whatever around, including older hardware.
  • The “Scrooge” approach is one in which money is available, which typically means newer hardware.

Each of these approaches has its own challenges. With older hardware, it’s possible you’ll run into older firmware that may not be supported by Linux, or hardware that no longer works as expected. With new hardware, Continue reading

To K8s or Not to K8s Your OpenStack Control Plane

This is a liveblog of the Monday afternoon OpenStack Summit session titled “To K8s or Not to K8s Your OpenStack Control Plane”. The speaker is Robert Starmer of Kumulus Technologies. This session is listed as a Beginner-level session, so I’m hoping it’s not too basic for me (and that readers will still get some value from the liveblog).

Starmer begins with a quick review of his background and expertise, and then proceeds to provide—as a baseline—an overview of containers and Kubernetes for container orchestration. Starmer covers terminology and concepts like Pods, Deployments (and Replica Sets), Services, StatefulSets, and Persistent Volumes. Starmer points out that StatefulSets and Persistent Volumes are particularly applicable to the discussion about using Kubernetes to handle the OpenStack control plane. Following the discussion of Kubernetes components, Starmer points out that the Kubernetes architecture is designed to be resilient, talking about the use of etcd as a distributed state storage system, multiple API servers, separate controller managers, etc.

Next, Starmer spends a few minutes talking about Kubernetes networking and some of the components involved, followed by a high-level discussion around persistent volumes and storage requirements, particularly for StatefulSets.

Having covered Kubernetes, Starmer now starts talking about the requirements Continue reading

OpenStack Summit Sydney Day 1 Keynote

This is a liveblog of the day 1 keynote here at the OpenStack Summit in Sydney, Australia. I think this is my third or fourth trip to Sydney, and this is the first time I’ve run into inclement weather; it’s cloudy, rainy, and wet here, and forecasted to remain that way for most of the Summit.

At 9:02am, the keynotes (there are actually a set of separate keynote presentations this morning) kicks off with a video with Technical Committee memebers, community members, and others talking about the OpenStack community, the OpenStack projects, and the Summit itself. At 9:05am, the founders of the Australian OpenStack User Group—Tristan Goode and Tom Fifield—take the stage to kick off the general session. Goode and Fifield take a few minutes to talk about the history of the Australian OpenStack User Group and the evolution of the OpenStack community in Australia. Goode also takes a few moments to talk about his company, Aptira.

After a few minutes, Goode and Fifield turn the stage over to Mark Collier and Lauren Sell from the OpenStack Foundation. Collier and Sell set the stage for the upcoming presentations, do some housekeeping announcements, and talk about sponsors and support partners. Sell Continue reading

Perfect locality and three epic SystemTap scripts

In a recent blog post we discussed epoll behavior causing uneven load among NGINX worker processes. We suggested a work around - the REUSEPORT socket option. It changes the queuing from "combined queue model" aka Waitrose (formally: M/M/s), to a dedicated accept queue per worker aka "the Tesco superstore model" (formally: M/M/1). With this setup the load is spread more evenly, but in certain conditions the latency distribution might suffer.

After reading that piece, a colleague of mine, John, said: "Hey Marek, don't forget that REUSEPORT has an additional advantage: it can improve packet locality! Packets can avoid being passed around CPUs!"

John had a point. Let's dig into this step by step.

In this blog post we'll explain the REUSEPORT socket option, how it can help with packet locality and its performance implications. We'll show three advanced SystemTap scripts which we used to help us understand and measure the packet locality.

A shared queue

The standard BSD socket API model is rather simple. In order to receive new TCP connections a program calls bind() and then listen() on a fresh socket. This will create a single accept queue. Programs can share the file descriptor - pointing Continue reading

OpenStack now featured in Cumulus in the Cloud

First of all, we’re thrilled to announce that today we launched OpenStack with Cumulus in the Cloud. That means that you can now test out Cumulus Networks technology with an OpenStack environment easily and at zero cost to you.

I’ve written previously about Cumulus In The Cloud (CitC) when we first released it a month ago with Mesos as the initial release flavor. Since then, JR Rivers and his team have been diligently working on adding additional flavors to the CitC offering. I could not have been happier to hear the good news that they had integrated an OpenStack solution with the cloud testing framework.

I immediately launched my own free instance of Cumulus in the Cloud using the standard steps. I was greeted with a new option where I could pick the flavor of CitC I wanted to initiate:

OpenStack Cumulus 1

Since I had already experimented with Mesos, I was eager to tinker with OpenStack to better learn this technology.

To be upfront, I am not an OpenStack expert. I have been diligently learning it over the past six months ever since a majority of my customer engagements have involved private cloud deployments leading with OpenStack. As a network engineer first, Continue reading

Introduction to Point to Point Authentication : PAP and CHAP protocols

Today I am going to talk about the PAP- Password Authentication Protocol and CHAP- challenge handshake authentication protocol. So let's talk about PAP and CHAP one by one.

PAP and CHAP is one of the basic and most important topic for CCNA candidates or the freshers who are going to work on the Point to point networks.

Before we are starting with the PAP and CHAP protocols, I would like to tell you that PAP and CHAP is the authentication procedure in Point to point network. So if you are using Point to point networks in your architecture you should opt for PAP or CHAP protocols as per the design required.

Below is the example showing the pictorial representation where we are defining the acceptance and the refusal of the connection in both the cases.

PAP- Password Authentication Protocol
So PAP is a password-based authentication protocol used by Point to Point Protocol (PPP) to validate users. PAP generally consider as a very basic two-way process. There is no encryption. The username and password are sent in plain text. If it is accepted, the connection is allowed. 
The authentication phase of a PPP session is optional. If used, you can authenticate the Continue reading

Introduction to ACI Multi-Site Fabric Design Network

In my earlier post I talk about the ACI stretched Fabric and ACI multi-pod fabric designs with single and multiple APIC clusters. Now I am going to talk about the basics of the Cisco ACI Multi-site fabric design network in my article. If you want to have a look for my earlier article, please go through the below mentioned link and review before we will start with the Cisco ACI multi-site fabric network design.

Introduction to Cisco ACI stretched fabric and ACI Multi-pod Fabric Designs

So in short, you now understand the Cisco single-pod, Cisco ACI stretched fabric and Cisco ACI multi-pod fabric design. Now we are going to talk about the next level of Cisco ACI deployment model and this model is called as Cisco ACI Multi-site fabric design.

Cisco ACI Multi-site Fabric Network Design 
Making more innovation in the Cisco ACI with the APIC 2.0 release, Cisco said that a Multi-Site design is the architecture interconnecting multiple APIC cluster domains with their associated pods. 

A Multi-Site design could also be called a Multi-Fabric design, because it interconnects separate availability zones (fabrics), each deployed either as a single pod or multiple pods (a Multi-Pod design). Below is Continue reading

Introduction to Cisco ACI stretched fabric and ACI Multi-pod Fabric Designs

Today I am going to talk about Cisco ACI where Cisco is providing two different solutions on Cisco ACI. One solution is Cisco ACI Multi-pod and other solution is named as Cisco ACI Multi-Site design or architecture. 

Earlier Cisco ACI multi-pod environment we were doing the ACI stretched Fabric design but then Cisco come up with the solution called as Cisco ACI multi-pod.

What is Cisco ACI Multi-pod ?
Well ACI multi-pod is a kind of ACI stretched Fabric design with more benefits and features. In simple words we can say that ACI multi-pod is a multiple ACI fabrics that is under control of single management or administration. 

What is the key difference of ACI stretched fabric design and ACI multi-pod ?
Let's talk about the ACI stretched fabric design, Let us suppose we have two ACI fabric design where we have Spine-Leaf architecture. One is ACI-I and other is ACI-II, if you are going to connect the leaf switches of ACI-I with the spine switches of ACI-II and leaf switches of ACI-II with spine switches of ACI-I makes ACI Stretched fabric design. Below diagram shows the best way of Cisco ACI stretched fabric design between three ACI fabric networks.
Continue reading

Setting up multiple networks is going to be much faster in oVirt 4.2

Assume you have an oVirt cluster with hundreds of VM networks. Now you add a new host to the cluster. In order for it to move to the Operational state, it must have all required networks attached to it. The easiest way to do it is to attach networks to a label, and then place that label on a NIC of the added host. However, if there are too many networks, Engine could fail to setup them all at once. This is caused by a slow VDSM setupNetworks call that is not able to finish within the 180 seconds long vdsTimeout of Engine.

VDSM performance changes would be included in ovirt-4.2, currently in ovirt-master.

Initscripts performance patch is targeted for EL 7.5.

The following table shows maximal number of networks that can be handled within the vdsTimeout. The measured setupNetworks command handles one network with static IP and N VLAN+bridge networks with no IP. Edit covered a move of all networks from one NIC to another.

Please note that given numbers are for reference only.

installed N add edit del
ovirt-4.2 190 180s 127s 67s
ovirt-4.2 and patched initscripts 350 138s 176s 89s
ovirt-4.1 150 Continue reading

General – Advice on Numbering Policies in Networking

There are several situations where we need to write some form of policy such as QoS, routing policies used in for example redistribution, filtering and policy-based routing, dot1x and so on. Lately I had to update a policy used by the master controller (MC) in an IWAN design. What are some important things to consider when writing the policy?

The number to start with – If you start with the number one then it won’t be possible to insert anything above this line at a later time. How certain are you that you will never have to put anything before the starting line? My recommendation is to start with a higher number such as 100.

Space between each line – Don’t number your lines 100, 101, 102, 103 and so on. Leave some more space between each line in case you have to insert something later between two lines. A spacing of 10 should be fine for most situations.

Go from most granular to least granular – The policy should go from as granular as possible to the least granular at the end. If you have a statement that is too broad you may catch more than you expected even Continue reading

Introduction to Next Generation Network Technology: IOT- Internet Of Things

Today I am going to talk about the next generation technology where we are going to connect many other infrastructure and electronic things and controlled and managed by single user or with group of the users. IOT is now the demand of many enterprise, Schools, Hospitals, Factories and many other places. IOT helps ease to work with the help of the latest technology.

IOT is the new technology where we automated the various appliances may be electronic and electric to make this world better. A aspect, within the internet of things, can be someone with a heart monitor implant, a farm animal with a biochip transponder, an car that has built-in sensors to alert the driver whilst tire pressure is low -- or every other natural or guy-made item that can be assigned an IP address and provided with the capacity to switch facts over a network.

The IoT permits objects to be sensed and managed remotely across current network infrastructure, developing opportunities for extra direct integration of the physical global into pc-based totally systems, and resulting in improved efficiency, accuracy and financial advantage.

What is the Basic Purpose of IOT ? How it will helpful for my Business ?

The Use of the Asymmetric routing

Today I am going to talk about the the concept of asymmetric routing and what is the purpose of the asymmetric routing in details. In simple words, Asymmetric routing is used when a packet takes one path to the destination and takes another path when returning to the source. It can be used of manual purposes where we want the sending and the receiving path will be different.

Asymmetric routing is common within most networks i.e. the larger the network, the more likely there is asymmetric routing in the network. Asymmetric routing is an undesirable situation for many network devices including, firewalls, VPNs, and Load Balancer appliances. These devices all rely on seeing every packet to function properly. 

Below is the example showing the asymmetric routing where we have two different paths for sending and receiving the packets or you can say traffic flow path are different for sending and receiving the packets. In the below topology, you can see that Site A sending the traffic to internet via Primary Router and then to ASA and then to internet Router while receiving from Internet router then secondary router and then to Site A via MPLS cloud. So this Continue reading

Hive Mind, Help Me Out with A10 AXAPI?

Dear Internet,

I am writing some automation code in Go to create client-ssl templates on an A10 load balancer running AXAPI version 2. It’s going as swimmingly as it can with the v2 API, but one area of non-complete API coverage has led to another issue and I’m wondering if anybody has seen the same thing.

A10 Networks Logo

Background – Disabling SSLv3

SSL access to VIPs on the A10 load balancer is controlled by means of client-ssl templates which define which certificates should be presented and the ciphers and protocols supported for the incoming connection. In this case therefore, disabling SSLv3 is accomplished in the client-ssl template (unfortunately there is no global switch to turn SSLv3 off by default). A typical template might look like this in the configuration:

slb template client-ssl mytemplate
   cert my_certificate
   key my_private_key
   chain-cert some_chain_cert
   disable-sslv3
!

As it turns out, all aspects of the client-ssl template are exposed via the API except for “disable-sslv3” which shows neither as a returned property of the template (highly annoying), nor as a property which can be set when creating a template (also annoying). Thus to replicate a template like the one above, I choose to set everything I can using the Continue reading

New IBM platform turns your data center into a cloud

What if you could flip a switch and turn your stodgy old data center full of legacy apps into a cloud-enabled one capable of migrating apps and data to the public cloud with ease by containerizing your legacy apps?IBM says it has just such an offering in IBM Cloud Private, a platform focused on assisting private data centers looking for a relatively simple way to move into the cloud. The idea is to offer a consistent way of managing your application stack, regardless of where they reside. Also on Network World: IBM’s latest private cloud is built on Kubernetes, and is aimed at Microsoft IBM Cloud Private takes middleware and other legacy applications, places them inside Kubernetes containers and transforms them into contemporary applications using Kubernetes container orchestration. The software itself is already containerized, including IBM tools and most major open source databases. To read this article in full or to leave a comment, please click here

New IBM platform turns your data center into a cloud

What if you could flip a switch and turn your stodgy old data center full of legacy apps into a cloud-enabled one capable of migrating apps and data to the public cloud with ease by containerizing your legacy apps?IBM says it has just such an offering in IBM Cloud Private, a platform focused on assisting private data centers looking for a relatively simple way to move into the cloud. The idea is to offer a consistent way of managing your application stack, regardless of where they reside. Also on Network World: IBM’s latest private cloud is built on Kubernetes, and is aimed at Microsoft IBM Cloud Private takes middleware and other legacy applications, places them inside Kubernetes containers and transforms them into contemporary applications using Kubernetes container orchestration. The software itself is already containerized, including IBM tools and most major open source databases. To read this article in full or to leave a comment, please click here

1 … 1,851 1,852 1,853 1,854 1,855 … 3,855