blog.farhan.codes

Container Primitives - Linux Namespaces

Mon, 18 Aug 2025 00:00:00 +0000

Container technology revolutionized software development and deployment, enabling unprecedented levels of efficiency, scalability, and consistency across computing environments. They allow for greater server density by avoiding rerunning a resource hungry second operating system within a virtual machine. And while Docker leaders the pack, there are numerous other implementations that all conform to the OCI standard, such as Podman, LXC, Mesos, Flatpak and others. Though they may appear different, all of these container technologies are fundamentally built upon the same basic Linux kernel primitives.

BSD WiFi Buffer Management

Mon, 30 Jun 2025 00:00:00 +0000

FreeBSD (and all systems using net80211) utilize memory buffers to receive, manipulate and process network traffic. These buffers are pre-allocated during attachment, due to the performance cost associated with dynamic allocation, and utilize a single-linked queue(3) structure.

Devices utilize two buffer queues, Rx and Tx. The underlying structure is often the same.

Receive Buffers

There are two types of Rx buffers: Inactive and Active, included in the softc as sc_rx_inactive and sc_rx_active, respectively.

Power Management During Driver Development Environment

Fri, 11 Apr 2025 00:00:00 +0000

You can use Power Per Port Switch (PPPS) functionality to power-cycle a USB device during driver development.

Introduction to the Problem

To reduce my hardware footprint, I typically work on device driver development in a VM running on the same multi-use personal system that houses my notes, files, picture backup, etc. This works fine for general development if the kernel crashes often the device is becomes unresponsible without a power-cycle. That leaves me with one of two options:

Debugging a running FreeBSD kernel in a VM using kgdb

Thu, 21 Dec 2023 00:00:00 +0000

Using KGDB Remote Debugging for FreeBSD VMs

This guide explains how to debug a running FreeBSD kernel in a VM using kgdb. The default ddb debugger has decent functionality, but unless you somehow know dynamic memory addresses, those capabilities are effectively unusable. Conversely, kdb offers a more robust interface and set of features.

While there is a handbook section on kgdb, it assumes you are running FreeBSD on bare-metal with a physical serial port connected to another serial host, not on modern virtualized infrastructure. In this guide I hope to bridge this gap and make the process I went through easier for the next person. I ran into this problem after trying to set a breakpoint on a variable, only to realize that ddb required me to know exact memory addresses and setting up kgdb for my use-case was not well documented and hope it benefits someone later down the line.

Sarf Generator

Tue, 21 Nov 2023 00:00:00 +0000

I’m making available a Arabic word conjugator tool I wrote in TypeScript. It is located here https://sarf.farhan.codes. Aside from the basics, it takes into account some foundational rules of تعللات (special conjugation of certain letters)

There is some stuff its missing, such as repeating letters or edge-cases, but its a good general tool that I use myself when I’m confused. It is also the first project I ever wrote in Typescript.

Benchmarking Base32 vs Base64

Mon, 02 Jan 2023 00:00:00 +0000

This is a very rudimentary benchmark of Base32 vs Base64 performance in Golang. This should also serve as an example of Golang’s benchmarking toolchain. Conclusion: Base64 is faster.

This code works by creating 1000 test strings, then performing Base32 and Base64 conversions. Timing is done by Go’s built-in benchmarking tooling, which is part of the testing framework. Here is the code:

package main

import "os"
import "time"
import "testing"
import "math/rand"
import "encoding/base32"
import "encoding/base64"

var strings = []string{}

func setupStrings(n int) []string {
	charset := "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"
	strings := []string{}
	rand.Seed(time.Now().UnixNano())

	for i := 0; i < n; i++ {
		newstring := genRandomString(charset, 32)
		strings = append(strings, newstring)
	}

	return strings
}

func genRandomString(charset string, length int) string {
	b := make([]byte, length)

	for i := range b {
		b[i] = charset[rand.Intn(len(charset))]
	}
	return string(b)
}

func setup() {
	strings = setupStrings(1000)
}

func BenchmarkBase32Run(b *testing.B) {
	for i := 0; i < b.N; i++ {
		for _, s := range strings {
			_ = base32.StdEncoding.EncodeToString([]byte(s))
		}
	}
}

func BenchmarkBase64Run(b *testing.B) {
	for i := 0; i < b.N; i++ {
		for _, s := range strings {
			_ = base64.StdEncoding.EncodeToString([]byte(s))
		}
	}
}

func TestMain(m *testing.M) {
	setup()
	code := m.Run()
	os.Exit(code)
}

You will also need a main function, mine is as follows:

Let IRC Die

Fri, 30 Dec 2022 00:00:00 +0000

For the sake of progress, let IRC die!

IRC was great, but its continued usage is a relic of an older internet, when storage was expensive and servers were expensive. At this stage, communities should migrate off of IRC to slack-like solutions like Mattermost or Matrix.

IRC served as a workhorse for communication, but it has failed to adapt to modern demands. In particular:

Offline sending and retrieval
Referenceable conversations (ie, URLs to a conversation)
Editing messages
Formatted text (including media)
True decentralization

Many of these problems can be remediated at the client-level, but not without a cost.

Simple dtrace use-case

Fri, 22 Jul 2022 00:00:00 +0000

Very small example of using dtrace, mostly for me to refernece in the future.

As I port this wifi card, I am running into a situation where ifconfig is reporting an error that I do not understand. From previous reading, I know that ifconfig interfaces with the kernel through ioctl. Driver code initially handles ioctl requests by implementing the ic->ic_ioctl handler.

To that end, in my handler I printed the u_long cmd variable with the intention of looking up the value. However, the source has them listed like this in /usr/src/sys/sys/sockio.h.

My FreeBSD Development Environment

Wed, 16 Mar 2022 00:00:00 +0000

I’m writing this primarily for myself, but also for others to reference and improve upon.

I run FreeBSD CURRENT in a VM. I use a VM for the inevitable situation where it crashes. I prefer to use Qemu on KVM, almost exclusively because of the ease of using the graphical virt-manager over ssh, and the ease of rebooting.

FreeBSD cannot do crash dumps to VT disks (vtdb0) so I make sure the Disk type is SATA. Also, the disk should be at least 40GBs, or else you won’t be able to dump the kernel core in the event of a crash.

Rebuilt This Blog

Wed, 04 Aug 2021 00:00:00 +0000

I rebuilt this blog after a few months of having it down.

Long story short, I ran the blog off of WordPress and self-hosted on my personal server for years. When I moved into a house and migrated off my personal server, I somehow lost the wp_content.sql file, and only that file, somewhere in the mix. An accidental deletion? Who knows. So all posts died. Bummer. Fortunately, I was able to rebuild the content from Wayback Machine (seriously) and Google Cache (yeah, seriously).

Unexpected IPv6 Behavior on Linux

Mon, 18 May 2020 00:00:00 +0000

Linux has some strange default IPv6 behavior. Here are a few things I noticed…

You can bind to a port on an IPv4 address while all of your tools will report that the port is on IPv6. For example, if your host is 198.51.100.1, you can bind to ::FFFF:198.51.100.1 and all state-checking tools like netstat, ss or lsof will report the listener as on an IPv6-port. You can do this in netcat with nc -6 -l ::FFFF:192.51.100.1.

Capturing Input/Output of Another Process in C

Mon, 26 Aug 2019 00:00:00 +0000

In my travels in C programming, I periodically need to run another process and redirect its standard output back to the first process. While it is straight forward to perform, it is not always obvious. This article will explain the process of how this is done in three sections.

High Level Overview
Explanation of each line
Code Sample

High Level Overview

Create a three pipe(2)s for standard input, output and error fork(2) the process The child process runs dup2(2) to over the pipes to redirect the new processes’s standard input, output and error to the pipe. The parent process reads from the pipe(2) descriptors as needed.

Avoiding Redundancy with Function Pointers

Wed, 24 Jul 2019 00:00:00 +0000

I am currently writing OpenGit, a BSD-licensed re-implementation of Linus Torvald’s Git (lower-cased going forward). This frequently involves reviewing git’s source code to understand how it works under the hood. One of the things I consistently encounter is git performing similar and sizable tasks in multiple different ways and places, resulting in redundancy and a higher maintenance cost.

In this brief entry, I will discuss a classic problem and how I solve it: When minor variants of a routine result in multiple implementations.

Generating a "vanity" PGP Key ID Signature

Thu, 14 Feb 2019 00:00:00 +0000

Here’s a quick bash script I used to generated a “vanity” PGP key with the last two bytes (four characters) set to FFFF.

#!/usr/bin/env bash

while :
do
gpg --debug-quick-random -q --batch --gen-key << EOF
Key-Type: RSA
Key-Length: 2048
Name-Email: user@domain
Name-Real: Real Name
Passphrase: yourverylongpassphrasegoeshere
EOF

if gpg -q --list-keys | head -4 | tail -c 5 | grep FFFF
then
        echo Break
        exit 1
else
        gpg2 --batch -q --yes --delete-secret-and-public-key `gpg -q --list-keys
| head -4 | tail -n 1`
fi

done

I also added no-secmem-warning to ~/.gnupg/options to suppress the insecure memory warnings. When I set it to a 1024-bit key, it only took about 3 hours, while 2048-bit took 20 hours across.

Passing by Reference, C's Garbage Collection

Sun, 13 Jan 2019 00:00:00 +0000

The C programming language has no built-in garbage-collection mechanism – and it very likely never will. This can (and does) lead to memory leaks by even the best programmers. It is also an imputes for the Rust language. However, depending on your use-case, it is still possible to structure your code to use the stack as a sort of zero-cost “garbage collector”.

Lets jump directly into the code!

This is how many applications instantiate and utilize a structure or arbitrary object.

SHA1 on FreeBSD Snippet

Mon, 01 Oct 2018 00:00:00 +0000

I needed some code that produces SHA1 digests for a project I am working on. I hunted through the FreeBSD’s sha1(1) code and produced this minimal snippet. Hopefully this helps someone else in the future.

Including optimized-out kernel symbols in dtrace on FreeBSD

Thu, 16 Aug 2018 00:00:00 +0000

Warning: This is a hack that involves modifying the build scripts. tldr; modify /usr/src/sys/conf/kern.pre.mk to change all references of -O2 to -O0.

Have you ever had dtrace(1) on FreeBSD fail to list a probe that should exist in the kernel? This is because Clang will optimize-out some functions. The result is ctfconvert(1) will not generate debugging symbols that dtrace(1) uses to identify probes. I have a quick solution to getting those probes visible to dtrace(1).

Linux maintains bugs, The real reason ifconfig on Linux is deprecated

Mon, 25 Jun 2018 00:00:00 +0000

In my third installment of FreeBSD vs Linux, I will discuss underlying reasons for why Linux moved away from ifconfig(8) to ip(8).

In the past, when people said, “Linux is a kernel, not an operating system”, I knew that was true but I always thought it was a rather pedantic criticism. Of course no one runs just the Linux kernel, you run a distribution of Linux. But after reviewing userland code, I understand the significant drawbacks to developing “just a kernel” in isolation from the rest of the system.

fsync(2) on FreeBSD vs Linux

Wed, 16 May 2018 00:00:00 +0000

Even with our modern technology, hard-disk operations tend to be the slowest and most painful part of any modern system. As such, modern operations implement buffering mechanism. In this schema, when an application calls write(2), rather than immediately performing physical disk operations, the operating stores data in a kernel buffer. When the buffer exceeds a certain amount or the when an application falls the fsync(2) system call, the kernel begins writing to the disk.

Tracing ifconfig commands from userspace to device driver

Fri, 23 Feb 2018 00:00:00 +0000

I am currently working on expanding FreeBSD’s rtwn(4) wireless device driver. I have the basics down, such as initialization, powering on and off, loading the firmware, etc, and am now trying to fill in specific ifconfig(8) methods. This requires having an in depth knowledge of how ifconfig(8) commands pass are ultimately delivered to the driver. I could not find concise documentation that outlines each stage of the process. So I wrote one! 🙂

That time I Reverse-Engineered the Motorola CBEP Protocol

Mon, 04 Dec 2017 00:00:00 +0000

This is the tale of how I reverse-engineered a Motorola CPS radio protocol to make it work on Linux. While this may have been of questionable legality and thus lost interest in the project, I learned a lot on how to reverse engineer. I’m writing this entry more than a year after I initially did this, so I may be a little rusty on the details, but this is the gist of it.

Migrating from FreeNAS to FreeBSD

Tue, 21 Nov 2017 00:00:00 +0000

I love FreeNAS. Its awesome, well built, well-supported. But as my needs increased, I wanted to use my FreeNAS box for more than the basics. In particular, I was moving towards a single host to run as a:

Family NAS server
Development server
IRC client
VM server
Web server
Email Server
Git Server
Home Firewall
Home IPv6 gateway
IPv6 VPN and Jump box

FreeNAS could easily do all of this. But I found myself using the device for everything but a NAS server. Also, as my experience on FreeBSD reaching proficient-status, I wanted to jump in the deep end and manually configure a production system from scratch. So I thanked FreeNAS for their contribution, yanked out the USB disks and installed FreeBSD 11.1 on a separate USB disk.

FreeBSD kernel Makefile variables SRCTOP and SYSDIR

Wed, 15 Nov 2017 00:00:00 +0000

I am currently writing a FreeBSD device driver and find myself lugging around the entire src. As you can imagine, this is quite large, especially if you are using any sort of version tracking system. So following the example here, I extracted out:

/usr/src/sys/modules/rtwn/
/usr/src/sys/dev/rtwn/

into

/home/user/src/rtwn/sys/modules/rtwn/
/home/user/src/rtwn/sys/dev/rtwn/

However, when I ran make(1) in the /home/user/src/rtwn/sys/modules/rtwn, I received an error saying:

make: don't know how to make r92c_attach.c. Stop

This error message is extremely non-descriptive of the actual issue. After reviewing the aforementioned functioning Makefiles, I identified that the SRCTOP and SYSDIR were not set correctly.

Switched from Ubuntu-based to Fedora

Mon, 25 Sep 2017 00:00:00 +0000

tl;dr: Fedora’s debugging packages work, Ubuntu’s are out of date.

Linux = Linux = Linux, whether Arch or Slackware or Ubuntu or OpenSUSE or Linux from scratch as I once did (before there were instructions!). Unless and until the kernel forks and someone decides to modify the syscall table, they all use the same basic syscalls, they typically share the same basic libraries and core utilities, etc. They’re all the same.

Custom Kernel Modules for Chromebook

Sun, 16 Apr 2017 00:00:00 +0000

Note: I wrote this about a year and a half ago, but I refer to it all the time. Hopefully the instructions have not changed too much! Enjoy!

I recently purchased a Chromebook. It’s great, it symbolizes the direction the PC market should head – inexpensive, low-powered ARM processor, defense in depth resistance to malware and simple for non-technical users. And with crouton, it functions quite cleanly as a Debian-based workstation.

Draw this shape without picking up your pen

Thu, 30 Mar 2017 00:00:00 +0000

For many years, while in a meeting or in a moment of free time, I have tried to draw this shape without picking up my pen or drawing over the same two points twice.

At best I would get 1 line away, but never completed the shape.

I wanted to know if it was even possible. So I wrote some python code to try every possible combination.

But, the code is below.

FreeBSD and Linux Remote Dual Booting

Fri, 10 Mar 2017 00:00:00 +0000

The following is a quick and dirty guide on how to setup remote dual booting for FreeBSD (12.0-CURRENT) and Linux (Ubuntu 16.04). Granted, this method is slightly a hack, but it works and suits my needs.

*Why remote dual-booting? I am currently developing a FreeBSD kernel module for a PCIe card. The device is supported on Linux and I am using the Linux implementation as documentation. As such, I find myself frequently rebooting into Linux to look printk() outputs, or booting into FreeBSD to test kernel code. This device is located at my house, and I typically work on it during my downtime at work.

My Python3 Programming Environment

Mon, 26 Dec 2016 00:00:00 +0000

UPDATE: I have since started using a very good vimrc. I recommend it over mine listed below. My only modification is that I removed all line numbers, eww.

I ssh into a FreeBSD jail with everything setup.

The Jail runs on code.mydomainname.com, which has an internet-routable IPv6 address – and IPv4 behind a NAT, (boo!)

I have a virtualenv already built-out. (more about my pip list later)

The set my ~/.bashrc to execute source enter-env.sh (even though I run ksh)

Hotspot Hijacking & Password Capturing

Mon, 18 Apr 2016 00:00:00 +0000

There are two types of penetration testers in the industry.

Those who identify risk and vulnerabilities beyond a simple Nexpose/Nessus/Qualys scan. And those who want to “win”.

The job of the “winner” is to get DA on their client’s network. Great! But once they’ve gotten it, they show off. Look how much information I can get with the DA account! I can get access to these databases and these spreadsheets. Sensitive Information! Be afraid! I pwned you noobs!!!

Easytether running on ARMv7l Chromebook

Tue, 03 Nov 2015 00:00:00 +0000

Easytether is a proprietary application, so you can’t just apt-get it on a chroot’ed crouton environment. Additionally, I am not running an x86 or x64 CPU, so most of these packages will not work.

Crouton mostly comes for Debian, so I downloaded the Ubuntu package. I installed the package ‘alien’. Then unzipped the deb file as follows:

alien easytether_0.8.5-1_armhf.deb

This will 3 tar.xz files, mostly importantly data.tar.xz. Unzip it with the following command:

Differences between Mint and Ubuntu

Sun, 18 Oct 2015 00:00:00 +0000

I looked into the differences between Mint and Ubuntu to see which was best for me. I watched tons of videos, reviews, comparisons, ran them both for months, etc. Here’s what I learned…

They’re the same damn thing. No really, they are identical. The only differences are what software comes pre-installed and some user interface prettiness. Otherwise, no difference in the underlying system at all. Literally no difference.

Next question?

Adding Arbitrary XML to python-docx

Sat, 15 Aug 2015 00:00:00 +0000

I am thankful to the developers of python-docx, they did a great job, especially since OpenXML is beyond confusing. However, I have two respectful criticisms: Python-docx lacks several key features and though it is properly written…its really confusing to follow the code.

Its just a few steps. Identify the entry-point, create a new tag, and append it to the document.

from docx.oxml.shared import OxmlElement # Necessary Import
tags = document.element.xpath('//w:r') # Locate the right <w:r> tag
tag = tags[0] # Specify which <w:r> tag you want
child = OxmlElement('w:ARBITRARY') # Create arbitrary tag
tag.append(child) # Append in the new tag

And that’s it!

Convert Docx to Markdown

Wed, 31 Dec 2014 00:00:00 +0000

I needed to convert a Docx file to Markdown, but Pandoc kept giving me this obnoxious error:

$ pandoc test.docx -o test.md
pandoc: Cannot decode byte '\xae': Data.Text.Encoding.Fusion.streamUtf8: Invalid UTF-8 stream

However, you can use the tool unoconv to make an intermediary step to convert first to HTML and then to Markdown.

$ unoconv --stdout -f html test.docx | pandoc -f html -t markdown -o test.md

On Ubuntu (And other Debian-based systems I would imagine) you can get unoconv with a simple apt-get install unoconv.

Duplicate a Django modelformset_factory Form

Sun, 14 Dec 2014 00:00:00 +0000

I created a formset_factory and wanted to have a simple “click me to add another form”. This seemed like a routine task, but the solutions I found online were unnecessarily complicated or required me to install a separate Django app, which I had no intention of doing.

So I created my own…

The only pre-requirement that this needs besides standard Django is jQuery.

So here is a rough overview of how this works:

Custom Django Fixture Imports

Sat, 06 Dec 2014 00:00:00 +0000

I needed to convert an XML document into a customize Django model with modifications to the based on programmable logic. Converting it to my model’s fixture would take too long and be unnecessary work, so I instead opted to manually convert the data.

I figured I could just import the Django model object, as is follows:

from tester.models import Control
a = Control()

However, I got the following vexing error in red:

Hotspot Hijacking & Password Capturing

Fri, 16 Mar 2012 00:00:00 +0000

Unless you know enough about security to know what’s going on behind the scenes, Wifi is beyond insecure. Even with SSL as an attempt to secure a web connection, your connection is still fundamentally insecure. This is an explanation of how someone would capture passwords and other variables sent over an SSL connection that uses Wifi. In essence, its a Man in the Middle (MiM) attack over Wifi that modifies the victim’s HTTP connection and thus gathers GET and POST variables. I was not the first to create it, but I independently thought of it and then combined a few techniques together.

Old Chat Framework in C

Sun, 06 Mar 2011 00:00:00 +0000

During my high school years, I used to be part of an “underground” IRC server. We would talk about security-related topics and the latest exploits, usually about some Unix variant. Even though no one would really care about our late-night computer conversations, I thought it best that we chat over an encrypted medium, and considering that I knew nothing about how SSL could serve to transparently encrypt IRC daemons and clients, I decided to write my own encrypted chat server. Below is the C code using the Unix API for the very simple framework. I planned on adding encryption for which I was learning the GMP library - I was not familiar with OpenSSL. I was a kid, sue me 🙄. I wrote the code below my junior year of HS.

Simple Economics of the IPv6 Transition

Fri, 22 Jan 2010 00:00:00 +0000

The vast majority of the Internet currently operates on Internet Protocol Version 4 (IPv4), a 32-bit addressing system which theoretically allows for 4,294,967,295 (2^32-1) unique IP addresses. Though this may seem like an inexhaustible supply of addresses, current figures estimate less than 10% of it remains. The remaining address space would be far less had it not been for the deployment of Network Address Translation (NAT), which extends IPv4’s life, but also breaks the iEnd-to-End principle.

About

Mon, 01 Jan 0001 00:00:00 +0000

Hi! I’m Farhan. As the sub-title says, this is my personal and professional technical blog. It is designed to showcase my contributions to the IT sector.

I’m a tech enthusiast, both for business and pleasure. I work professionally in IT Security and Penetration Testing and I am particularly interested in low-level programming, systems design, radio, IPv6 (check this site’s IPv6 address :), FreeBSD, Linux, security, and anything in “the world of the electron and the switch”.

Current and Future Projects

Mon, 01 Jan 0001 00:00:00 +0000

Here is a list of current and future projects I would like to work on:

Current

Porting the OpenBSD athn driver to FreeBSD, tracked in D45821.
i3e_driver, a software implementation of FreeBSD’s net80211 stack.

Future (no guarantees)

Implementing RTL8188GU (0x0BDA:0xB711) in FreeBSD. In theory, this should just be implementing a subset of specific operations to the rtwn USB driver.
Implementing usb_modeswitch in FreeBSD’s usbconfig utility.
USB-over-IP - Plug in a USB device in one computer and use have it present as plugged into another computer. This is pretty low priority, but would be useful in device driver development.

Maybe?

Porting Linux’s Broadcom BCM43438 driver to FreeBSD. This is already an ISC-licensed driver, but converting from Linux’s ieee80211 stack to FreeBSD’s net80211 stack will not be easy.
Implementing a VS Code SSH remote plugin that works on FreeBSD, maybe I will do, maybe not.

Open Source Contributions

Mon, 01 Jan 0001 00:00:00 +0000

A brief list of my open-source contributions.

Fix psutil.virtual_memory() type mismatch for NetBSD – NetBSD had a minor UTF-8 bug and would crash on NetBSD. I just changed the quotes and set a string type to binary.
Modified wetty to support FreeBSD – Wetty was using a Linuxism when referencing file paths, so I generalized it to utilize /usr/bin/env.
Updated Firefox’s fxa-local-dev scripts to run on FreeBSD – I have a long-term goal to get Firefox’s authentication servers running on FreeBSD. This requires docker support, so it is low on my priorities list. However, there is still value in working through everything up to the point of docker.
Added Canon EOS Jpeg support for python-docx (un-merged) – python-docx would fail to install a a JPEG image, when the image header was slightly different than the standard header.
Added FreeBSD support for node-bigint (un-merged) – This library is now deprecated and the code does not compile anyways, even on Linux.
Revision 342682 Added Realtek RTL8188EE Wifi driver on FreeBSD
Revision 335757 – ifconfig(8): Attempt to render non-printable sequences w/ UTF-8 Environment – Added support for ifconfig(8) on FreeBSD will print UTF-8 characters
Revision 351573 – Document fetchReqHTTP() – Just added documentation for an undocumented call in fetch(3).
Revision rS357968 - Added SOCKS5 support to FreeBSD’s libfetch.
Revision rD54114 - Updated FreeBSD Kerberos documentation.