Hero Image
OIDC(OpenID Connect) 简介

OIDC(OpenID Connect) 简介 Authentication vs. authorization Authentication 通常是指校验是否是用户本人的这个过程，而 Authorization 则更多的是指用户是否有权限。通常我们都是先校验 是否是用户本人，然后再校验用户是否有权限。也就是先开始 Authentication，再开始 Authorization。 Authentication Authorization Determines whether users are who they claim to be Determines what users can and cannot access Challenges the user to validate credentials (for example, through passwords, answers to security questions, or facial recognition) Verifies whether access is allowed through policies and rules Usually done before authorization Usually done after successful authentication Generally, transmits info through an ID Token Generally, transmits info through an Access Token Generally governed by the OpenID Connect (OIDC) protocol Generally governed by the OAuth 2.0 framework Example: Employees in a company are required to authenticate through the network before accessing their company email Example: After an employee successfully authenticates, the system determines what information the employees are allowed to access OAuth 2 Client Credentials Grant 这种模式是最简单的，其实就是客户端告诉服务端自己是哪个客户端，服务器就将 access_token 下发

Wednesday, July 6, 2022 Read
Hero Image
Bash Bitwise Operators

Bash Bitwise Operators Bash’s Tools for Base Conversion Bash’s arithmetic expansion allows us to write numbers in any base by prefixing the numeric digits of the base followed by the hash symbol. $ echo $((2#1001)) 9 bc allows us to convert effortlessly between bases, using the parameters ibase (for the input base) and obase (for the output base). So, let’s convert the decimal number 9 to base 2 $ echo "ibase=10;obase=2;9" | bc 1001

Monday, July 4, 2022 Read
Hero Image
Simple A/B Testing with Nginx split_clients

Simple A/B Testing with Nginx split_clients ngx_http_split_clients_module Configure For example, suppose we want 20% of users to be redirected to https://example.com/, 30% to https://example.org/, and the rest to https://example.edu/. split_clients "${remote_addr}AAA" $variant { 20% https://example.com/; 30% https://example.org/; * https://example.edu/; } server { listen 80; listen [::]:80; server_name _; return 302 ${variant}; } In the example above, the visitor’s IP address plus the string AAA is hashed with MurmurHash2 into a number. If the number falls in the first 20%, $variant is https://example.com/. If it falls in the middle 30%, $variant is https://example.org/. Otherwise it is https://example.edu/.

Monday, July 4, 2022 Read
Hero Image
Monitoring HTTP Requests on a Network Interface in Real Time

Monitoring HTTP Requests on a Network Interface in Real Time tcpflow apt/dnf install tcpflow $ sudo tcpflow -p -c -i wlp0s20f3 port 80 | grep -oE '(GET|POST) .* HTTP/1.[01]|Host: .*' reportfilename: ./report.xml tcpflow: listening on wlp0s20f3 GET /alexlarsson/flatpak/ubuntu/dists/focal/InRelease HTTP/1.1 GET /mirrors.txt HTTP/1.1 -p disables promiscuous mode -c means only print the output to the console and don’t create files -i specifies the network interface grep receives the output of tcpflow -o means show only the matching parts of the lines that match the pattern -E means the pattern is an extended regular expression (ERE) httpry https://github.com/jbittel/httpry.git

Thursday, June 23, 2022 Read
Hero Image
Go pprof in Practice

Go pprof in Practice Bomb program package main import ( // omitted _ "net/http/pprof" // auto-register handlers to the HTTP server for profiling via HTTP // omitted ) func main() { // omitted runtime.GOMAXPROCS(1) // limit CPU usage to avoid overload runtime.SetMutexProfileFraction(1) // enable lock contention profiling runtime.SetBlockProfileRate(1) // enable blocking operation profiling go func() { // start an HTTP server; pprof handlers have already been registered // /debug/pprof/ if err := http.ListenAndServe(":6060", nil); err != nil { log.Fatal(err) } os.Exit(0) }() // omitted } http://localhost:6060/debug/pprof/ Type Description Notes allocs Samples of memory allocations Can open in a browser, but readability is low blocks Samples of blocking operations Can open in a browser, but readability is low cmdline Show program startup command/args Can open in a browser; shows ./go-pprof-practice goroutine Stacks of all current goroutines Can open in a browser, but readability is low heap Samples of heap memory usage Can open in a browser, but readability is low mutex Samples of lock contention Can open in a browser, but readability is low profile Samples of CPU usage Opening in a browser downloads a file threadcreate Samples of system thread creation Can open in a browser, but readability is low trace Program execution traces Opening in a browser downloads a file; not covered here, see Go trace Investigate high CPU usage

Wednesday, June 22, 2022 Read
Hero Image
Parse Command Line Arguments in Bash

Parse Command Line Arguments in Bash getopts getopts optstring opt [arg ...] #!/bin/bash while getopts 'abc:h' opt; do case "$opt" in a) echo "Processing option 'a'" ;; b) echo "Processing option 'b'" ;; c) arg="$OPTARG" echo "Processing option 'c' with '${OPTARG}' argument" ;; ?|h) echo "Usage: $(basename $0) [-a] [-b] [-c arg]" exit 1 ;; esac done shift "$(($OPTIND -1))" optstring represents the supported options. The option expects an argument if there is a colon (:) after it. For instance, if option c expects an argument, then it would be represented as c: in the optstring When an option has an associated argument, then getopts stores the argument as a string in the OPTARG shell variable. For instance, the argument passed to option c would be stored in the OPTARG variable. opt contains the parsed option. #!/bin/bash while getopts ':abc:h' opt; do case "$opt" in a) echo "Processing option 'a'" ;; b) echo "Processing option 'b'" ;; c) arg="$OPTARG" echo "Processing option 'c' with '${OPTARG}' argument" ;; h) echo "Usage: $(basename $0) [-a] [-b] [-c arg]" exit 0 ;; :) echo -e "option requires an argument.\nUsage: $(basename $0) [-a] [-b] [-c arg]" exit 1 ;; ?) echo -e "Invalid command option.\nUsage: $(basename $0) [-a] [-b] [-c arg]" exit 1 ;; esac done shift "$(($OPTIND -1))" Note that we’ve updated optstring as well. Now it starts with the colon(:) character, which suppresses the default error message. The getopts function disables error reporting when the OPTERR variable is set to zero. Parsing Long Command-Line Options With getopt #!/bin/bash VALID_ARGS=$(getopt -o abg:d: --long alpha,beta,gamma:,delta: -- "$@") if [[ $? -ne 0 ]]; then exit 1; fi eval set -- "$VALID_ARGS" while [ : ]; do case "$1" in -a | --alpha) echo "Processing 'alpha' option" shift ;; -b | --beta) echo "Processing 'beta' option" shift ;; -g | --gamma) echo "Processing 'gamma' option. Input argument is '$2'" shift 2 ;; -d | --delta) echo "Processing 'delta' option. Input argument is '$2'" shift 2 ;; --) shift; break ;; esac done -o option represents the short command-line options --long option represents the long command-line options

Tuesday, June 7, 2022 Read
Hero Image
Go code refactoring : the 23x performance hunt

Go code refactoring : the 23x performance hunt $ go test -bench=. -cpuprofile cpu.prof $ go tool pprof -svg cpu.prof > cpu.svg $ go test -bench=. -trace trace.out $ go tool trace trace.out

Tuesday, June 7, 2022 Read
Hero Image
Dockertest: A Fast Way to Set Up Integration Test Environments

Dockertest: A Fast Way to Set Up Integration Test Environments dockertest

Thursday, May 12, 2022 Read
Hero Image
Tcpdump Usage Summary

Tcpdump Usage Summary Command usage tcpdump uses the command line. The command format is: tcpdump [ -AdDeflLnNOpqRStuUvxX ] [ -c count ] [ -C file_size ] [ -F file ] [ -i interface ] [ -m module ] [ -M secret ] [ -r file ] [ -s snaplen ] [ -T type ] [ -w file ] [ -W filecount ] [ -E spi@ipaddr algo:secret, ... ] [ -y datalinktype ] [ -Z user ] [ expression ] Simple option notes for tcpdump -E spi@ipaddr algo:secret , ... can decrypt IPsec ESP packets using spi@ipaddr algo:secret. The secret is the ESP key, expressed as an ASCII string. If it starts with 0x, the key is read as hex. In addition to the syntax above (spi@ipaddr algo:secret), you can append a syntax input filename for tcpdump to use (replace … in spi@ipaddr algo:secret, ... with a syntax filename). This file is opened when the first ESP packet arrives, so it is best to drop some privileges at that time (to reduce risk if the file is malicious). -T type forces tcpdump to analyze packets according to the protocol structure specified by type. Known type values include: aodv (Ad-hoc On-demand Distance Vector protocol, used in Ad hoc peer-to-peer networks) cnfp (Cisco NetFlow protocol) rpc (Remote Procedure Call) rtp (Real-Time Applications protocol) rtcp (Real-Time Applications control protocol) snmp (Simple Network Management Protocol) tftp (Trivial File Transfer Protocol) vat (Visual Audio Tool, an application-layer protocol used for video conferencing on the internet) wb (distributed White Board, an application-layer protocol for online meetings) Practical command examples Capture communication between host 210.27.48.1 and host 210.27.48.2 or 210.27.48.3

Thursday, May 5, 2022 Read
Hero Image
Go High-Performance Programming Handbook (Long Read)

Go High-Performance Programming Handbook (Long Read) Common data structures Reflection is nice, but don’t overuse it Prefer strconv over fmt A small amount of repetition is not worse than reflection Use binary.Read and binary.Write with caution binary.Read and binary.Write use reflection and are slow. If you need these two functions, implement the required logic manually instead of using them directly. Avoid repeated conversions from string to byte slice Specify container (slice/map) capacity

Friday, April 22, 2022 Read
Hero Image
How to Make an iPhone Ringtone: Turn an MP3 into a Ringtone or Alarm

How to Make an iPhone Ringtone: Turn an MP3 into a Ringtone or Alarm Video version of the iPhone ringtone steps Step 1: Prepare the MP3 you want to use as an iPhone ringtone First, prepare the music you want to use as a ringtone. MP3 is recommended. Save it in the Files app. Step 2: Make an iPhone ringtone with GarageBand Next, open the built-in GarageBand app on iPhone (re-download it if you deleted it), tap “Create Song”, and choose “Recorder”.

Sunday, April 10, 2022 Read
Hero Image
How to Choose a Go File Reading Approach

How to Choose a Go File Reading Approach Go provides one-shot methods for reading file content: os.ReadFile and ioutil.ReadFile. Starting from Go 1.16, ioutil.ReadFile is equivalent to os.ReadFile. The pros and cons of loading a file in one shot are obvious: it reduces IO operations, but it loads the entire file into memory. For large files, this risks running out of memory. Read line by line In Go, the bufio.Reader type provides ReadLine(), but in practice we more often use ReadBytes(’\n’) or ReadString(’\n’).

Tuesday, March 29, 2022 Read