https Client and Server

建立證書
參考 OpenSSL 證書

===
自我認證 CA
$ mkdir ca; cd ca
產生私鑰
$ mkdir private
$ openssl genrsa -out private/cakey.pem 2048
產生自簽章證書
$ cp /etc/ssl/openssl.cnf .
$ vi openssl.cnf
dir = .
default_md = sha512
keyUsage = cRLSign, keyCertSign
$ openssl req -new -x509 -nodes -key private/cakey.pem -out cacert.pem \
-days 3650 -subj "/C=TW/ST=Taiwan/L=Taichung/O=SDL/OU=R&D/CN=z390-CA" \
-config openssl.cnf
顯示證書
$ openssl x509 -text -noout -in cacert.pem

===
產生網站的證書
$ mkdir web1; cd web1
產生私鑰

$ openssl genrsa -out server.key 2048

$ vi ssl.conf

[ req ]

prompt = no

default_md = sha512

default_bits = 2048

distinguished_name = dn

req_extensions = v3_req

[ dn ]

C = TW

ST = Taiwan

L = Taichung

O = SDL

OU = R&D

emailAddress = mark@localhost

CN = mark-z390-u

[ v3_req ]

basicConstraints = CA:FALSE

subjectAltName = @alt_names

subjectKeyIdentifier = hash

keyUsage = nonRepudiation, digitalSignature, keyEncipherment

[ alt_names ]

DNS.1 = localhost

DNS.2 = mark-z390-u

DNS.3 = dixx.vigorddns.com

DNS.4 = 192.168.0.101

IP.1 = 127.0.0.1

IP.2 = 192.168.0.101

$ openssl req -new -sha512 -key server.key -out server.csr -config ssl.conf

顯示需求證書

$ openssl req -text -noout -in server.csr

顯示私鑰

$ openssl rsa -out -noout -in server.key

顯示公鑰

$ openssl rsa -in server.key -pubout -out server_pub.key

$ openssl rsa -in server_pub.key -pubin -noout -text

===

使用 自我認證 CA 簽署 需求證書

回到 ca 目錄

$ mkdir newcerts

$ touch index.txt

$ echo "01">serial

$ openssl ca -in ../web1/server.csr -out ../web1/server.crt -days 3650 -extennsions v3_req -extfile ../web1/ssl.conf -config openssl.cnf

===
匯入憑證到 Windows 10
cacert.pem 改名為 cacert.crt

本機裝置 的憑證 certlm.msc
目前的使用者憑證 certmgr.msc
受信任的根憑證授權單位/憑證
按滑鼠右鍵/所有工作/匯入 選擇 cacert.crt

金鑰使用方法
Certificate Signing, Off-line CRL Signing, CRL Signing (06)

===
參考 OCSP & CRL 介紹
CRL(Certificate Revocation List) 被 CA 撤銷的憑證清單
OCSP(Online Certificate Status Protocal) 線上查詢憑證狀態

參考根憑證
AAA Certificate Services
CRL 發佈點
CRL Distribution Point
URL=http://crl.comodoca.com/AAACertificateServices.crl

---

參考 Visual Studio(VS2017)編譯並配置C/C++-libcurl開發環境
從 https://curl.haxx.se/download.html 下載 curl-7.68.0.zip
解壓縮後進入 curl 目錄
執行 buildconf.bat
以 x86 為例(64為原則改為 x64)
開始/Visual Studio 2017/x86 Native Tools Command Prompt for VS 2017
按滑鼠右鍵選擇 Run as administrator
進入 curl/winbuild
nmake /f Makefile.vc mode=static VC=15 MACHINE=x86 DEBUG=yes
nmake /f Makefile.vc mode=static VC=15 MACHINE=x86 DEBUG=no
編譯的結果在 builds 下

---

Visual Studio 使用 libcurl
Configuration Properties/C/C++/Preprocessor/Preprocessor Definitions 加入 CURL_STATICLIB
#include <curl/curl.h>
加入下列 library

libcurl_a.lib(libcurl_a_debug.lib)

Ws2_32.lib

Wldap32.lib

winmm.lib(似乎不用)

Crypt32.lib

Normaliz.lib

form 使用
curl_easy_setopt(curl, CURLOPT_MIMEPOST, form);

json 使用

curl_easy_setopt(curl, CURLOPT_POSTFIELDS, strU8);

curl_easy_setopt(curl, CURLOPT_POST, 1);

libcurl 之傳送接收使用  UTF-8, 函數之參數使用 Big5

在 vc 上使用 CStringA 儲存 Big5 和 UTF-8, 轉換要經過 CStringW (Unicode)

curl 之 --tlsv1.3 等於
curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_3);

curl 之 --insecure 等於
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, false);
不使用 --insecure 等於
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, true);
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 2); // 0 不檢查 host
curl_easy_setopt(curl, CURLOPT_CAINFO, "cacert.pem");

curl 之 --ssl-no-revoke 等於
curl_easy_setopt(curl, CURLOPT_SSL_OPTIONS, CURLSSLOPT_NO_REVOKE);

---

使用 curl 測試
===
在 windows 下，引號不能使用'要使用"
--insecure 不檢查證書
===
D:\temp\aaa>curl.exe -v https://dixx.vigorddns.com:5000/api/Json -X
POST -H "Content-Type:application/json" -d "{\"updDate\":\"aaa\", \"camera\":\"b
bb\", \"ipaddress\":\"ccc\", \"addr\":\"ddd\"}" --insecure
*   Trying 114.35.104.33:5000...
* TCP_NODELAY set
* Connected to dixx.vigorddns.com (114.35.104.33) port 5000 (#0)
* schannel: next InitializeSecurityContext failed: SEC_E_INVALID_TOKEN (0x800903
08) - 提供給功能的權杖不正確
* Closing connection 0
* schannel: shutting down SSL/TLS connection with dixx.vigorddns.com por
t 5000
curl: (35) schannel: next InitializeSecurityContext failed: SEC_E_INVALID_TOKEN
(0x80090308) - 提供給功能的權杖不正確

===
Windows 7 要加上 --tlsv1.3
Windows 10 不用
===

D:\temp\aaa>curl.exe -v https://dixx.vigorddns.com:5000/api/Json -X

POST -H "Content-Type:application/json" -d "{\"updDate\":\"aaa\", \"camera\":\"b

bb\", \"ipaddress\":\"ccc\", \"addr\":\"ddd\"}" --insecure --tlsv1.3

D:\temp\aaa>curl.exe -v https://dixx.vigorddns.com:5000/api/Json -X
POST -H "Content-Type:application/json" -d "{\"updDate\":\"aaa\", \"camera\":\"b
bb\", \"ipaddress\":\"ccc\", \"addr\":\"ddd\"}" --tlsv1.3
Note: Unnecessary use of -X or --request, POST is already inferred.
*   Trying 114.35.104.33:5000...
* TCP_NODELAY set
* Connected to dixx.vigorddns.com (114.35.104.33) port 5000 (#0)
* schannel: next InitializeSecurityContext failed: Unknown error (0x80092012) -
撤銷功能無法檢查憑證的撤銷。
* Closing connection 0
* schannel: shutting down SSL/TLS connection with dixx.vigorddns.com por
t 5000
curl: (35) schannel: next InitializeSecurityContext failed: Unknown error (0x800
92012) - 撤銷功能無法檢查憑證的撤銷。

===
要檢查證書，用參數 --cacert 傳入證書檔
===
D:\temp\aaa>curl.exe -v https://dixx.vigorddns.com:5000/api/Json -X
POST -H "Content-Type:application/json" -d "{\"updDate\":\"aaa\", \"camera\":\"b
bb\", \"ipaddress\":\"ccc\", \"addr\":\"ddd\"}" --tlsv1.3 --cacert cacert.pem
Note: Unnecessary use of -X or --request, POST is already inferred.
*   Trying 114.35.104.33:5000...
* TCP_NODELAY set
* Connected to dixx.vigorddns.com (114.35.104.33) port 5000 (#0)
* schannel: added 1 certificate(s) from CA file 'cacert.pem'
* schannel: CertGetCertificateChain trust error CERT_TRUST_REVOCATION_STATUS_UNK
NOWN 0x00000040
* Closing connection 0
* schannel: shutting down SSL/TLS connection with dixx.vigorddns.com por
t 5000
curl: (60) schannel: CertGetCertificateChain trust error CERT_TRUST_REVOCATION_S
TATUS_UNKNOWN 0x00000040
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

===
因檢查證書時，會去檢查證書是否已經撤銷
--ssl-no-revoke 避免檢查
===
D:\temp\aaa>curl.exe -v https://dixx.vigorddns.com:5000/api/Json -X
POST -H "Content-Type:application/json" -d "{\"updDate\":\"aaa\", \"camera\":\"b
bb\", \"ipaddress\":\"ccc\", \"addr\":\"ddd\"}" --tlsv1.3 --cacert cacert.pem --
ssl-no-revoke

===
使用 form
D:\temp\aaa>curl.exe -v https://dixx.vigorddns.com:5000/api/SendForm
-X POST -d "location=aaa&dt=bbb&text=ccc&camera_name=eee&X=x&Y=y&plateId=ddd" --
tlsv1.3 --cacert cacert.pem --ssl-no-revoke

Scale for menu and title bars

參考下列設定
udev匹配規則的編寫
How to automatically mirror screens when an HDMI cable is plugged in
How to reload udev rules without reboot?

Run script on screen lock/unlock


因為4K的解析度太高，導致字形按鈕等物件太小，可以直接修改下列設定
System Settings/Displays/Scale for menu and title bars
但是開關螢幕和結束螢幕保護時，會自動恢復設定

nvidia@nvidia-desktop:~$ udevadm monitor --environment --udev
monitor will print the received events for:
UDEV - the event which udev sends out after rule processing

拔起 HDMI, 出現
UDEV  [38201.950691] change   /devices/virtual/switch/hdmi (switch)
ACTION=change
DEVPATH=/devices/virtual/switch/hdmi
SEQNUM=6034
SUBSYSTEM=switch
SWITCH_NAME=hdmi
SWITCH_STATE=0
USEC_INITIALIZED=14008647
net.ifnames=0

插入 HDMI, 出現
UDEV  [38204.241016] change   /devices/virtual/switch/hdmi (switch)
ACTION=change
DEVPATH=/devices/virtual/switch/hdmi
SEQNUM=6039
SUBSYSTEM=switch
SWITCH_NAME=hdmi
SWITCH_STATE=1
USEC_INITIALIZED=14008647
net.ifnames=0

nvidia@nvidia-desktop:~$ udevadm info -a -p /devices/virtual/switch/hdmi

Udevadm info starts with the device specified by the devpath and then
walks up the chain of parent devices. It prints for every device
found, all possible attributes in the udev rules key format.
A rule to match, can be composed by the attributes of the device
and the attributes from one single parent device.

  looking at device '/devices/virtual/switch/hdmi':
    KERNEL=="hdmi"
    SUBSYSTEM=="switch"
    DRIVER==""
    ATTR{name}=="hdmi"
    ATTR{state}=="1"
    ATTR{uevent_in_suspend}=="Y"


HDMI 接頭插入時執行
nvidia@nvidia-desktop:~$ cat /etc/udev/rules.d/95-hdmi-hotplug.rules
SUBSYSTEM!="switch", GOTO="hdmi_end"
KERNEL!="hdmi", GOTO="hdmi_end"

ATTRS{state}=="1", RUN+="/bin/bash /home/nvidia/hdmi_on.sh"
ATTRS{state}=="0", RUN+="/bin/bash /home/nvidia/hdmi_off.sh"

LABEL="hdmi_end"
nvidia@nvidia-desktop:~$ cat /home/nvidia/hdmi_on.sh
sleep 1
# 需要切換不同身份執行
su -c '/home/nvidia/scale_factor.sh' - nvidia
nvidia@nvidia-desktop:~$ cat /home/nvidia/hdmi_off.sh
#echo "`date` off">>/home/nvidia/hdmi.log
nvidia@nvidia-desktop:~$ cat scale_factor.sh
/usr/bin/gsettings set com.ubuntu.user-interface scale-factor "{'HDMI-0': 16}"
nvidia@nvidia-desktop:~$

編寫完成 udev rule 時, 要重新載入
nvidia@nvidia-desktop:~$ sudo udevadm control --reload-rules && udevadm trigger
[sudo] password for nvidia:
nvidia@nvidia-desktop:~$

螢幕解鎖時執行

nvidia@nvidia-desktop:~$ cat screen_unlock.sh 

dbus-monitor --session "type='signal',interface='org.gnome.ScreenSaver'" |

while read x; do

case "$x" in

*"boolean false"*)

/bin/bash /home/nvidia/scale_factor.sh

;;

esac

done

nvidia@nvidia-desktop:~$ 

DVR 之 rtsp 協定

昇銳DVR N9000
rtsp://username:password@ip:port/chID=0&streamType=main&linkType=tcp
chID 頻道
streamType 可以為 main 或 sub

Ubuntu 建立桌面捷徑 和 桌面啟動時自動執行

建立桌面捷徑

sudo apt-get install --no-install-recommends gnome-panel
gnome-desktop-item-edit ~/Desktop/ --create-new


桌面啟動時自動執行

開始/Startup Applications/Add

(sleep 10; shellcommand.sh)&

gitea in ubuntu

參考 如何在Ubuntu 18.04上安裝Gitea

安裝 Nginx
$ sudo apt update
$ sudo apt -y install nginx
安裝完成可以用瀏覽器測試 http://localhost
自動啟動 nginx
$ sudo systemctl stop nginx.service
$ sudo systemctl start nginx.service
$ sudo systemctl restart nginx.service
$ sudo systemctl reload nginx.service
$ sudo systemctl enable nginx.service

安裝 Git
$ sudo apt -y install git
$ git --version

安裝 MariaDB
$ sudo apt -y install mariadb-server mariadb-client
$ sudo systemctl stop mariadb.service
$ sudo systemctl start mariadb.service
$ sudo systemctl restart mariadb.service
$ sudo systemctl reload mariadb.service
$ sudo systemctl enable mariadb.service

建立 MariaDB root 密碼，並禁止遠端連接
$ sudo mysql_secure_installation
Enter current password for root (enter for none): Just press the Enter
Set root password? [Y/n]: Y
New password: Enter password
Re-enter new password: Repeat password
Remove anonymous users? [Y/n]: Y
Disallow root login remotely? [Y/n]: Y
Remove test database and access to it? [Y/n]: Y
Reload privilege tables now? [Y/n]: Y

重新啟動 MariaDB
$ sudo systemctl restart mariadb.service

建立 gitea 資料庫, giteauser 使用者

$ sudo mysql -u root -p

CREATE DATABASE gitea;

CREATE USER 'giteauser'@'localhost' IDENTIFIED BY 'password';
GRANT ALL ON gitea.* TO 'giteauser'@'localhost' IDENTIFIED BY 'password' WITH GRANT OPTION;
FLUSH PRIVILEGES;
EXIT;

建立 git 使用者，以便運行 gitea
$ sudo adduser --system --shell /bin/bash --gecos 'Git Version Control' --group --disabled-password --home /home/git git
$ sudo mkdir -p /var/lib/gitea/{custom,data,indexers,public,log}
$ sudo chown git:git /var/lib/gitea/{data,indexers,log}
$ sudo chmod 750 /var/lib/gitea/{data,indexers,log}
$ sudo mkdir /etc/gitea
$ sudo chown root:git /etc/gitea
$ sudo chmod 770 /etc/gitea

下載並安裝 gitea
$ sudo wget -O gitea https://dl.gitea.io/gitea/1.5.0/gitea-1.5.0-linux-amd64
$ sudo chmod +x gitea
$ sudo cp gitea /usr/local/bin/gitea
$ sudo vi /etc/systemd/system/gitea.service
[Unit]
Description=Gitea (Git with a cup of tea)
After=syslog.target
After=network.target
#After=mysqld.service
#After=postgresql.service
#After=memcached.service
#After=redis.service

[Service]
# Modify these two values and uncomment them if you have
# repos with lots of files and get an HTTP error 500 because
# of that
###
#LimitMEMLOCK=infinity
#LimitNOFILE=65535
RestartSec=2s
Type=simple
User=git
Group=git
WorkingDirectory=/var/lib/gitea/
ExecStart=/usr/local/bin/gitea web -c /etc/gitea/app.ini
Restart=always
Environment=USER=git HOME=/home/git GITEA_WORK_DIR=/var/lib/gitea
# If you want to bind Gitea to a port below 1024 uncomment
# the two values below
###
#CapabilityBoundingSet=CAP_NET_BIND_SERVICE
#AmbientCapabilities=CAP_NET_BIND_SERVICE

[Install]
WantedBy=multi-user.target

$ sudo systemctl daemon-reload
$ sudo systemctl enable gitea
$ sudo systemctl start gitea
$ sudo system status gitea

使用 Nginx 代理 gitea
$ sudo vi /etc/nginx/sites-available/git
upstream gitea {
 server 127.0.0.1:3000;
}

server {
 listen 80 default_server;
 listen [::]:80 default_server;
 server_name example.com;
 root /var/lib/gitea/public;
 access_log off;
 error_log off;

 location / {
 try_files maintain.html $uri $uri/index.html @node;
 }

 location @node {
 client_max_body_size 0;
 proxy_pass http://localhost:3000;
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_set_header X-Real-IP $remote_addr;
 proxy_set_header Host $http_host;
 proxy_set_header X-Forwarded-Proto $scheme;
 proxy_max_temp_file_size 0;
 proxy_redirect off;
 proxy_read_timeout 120;
 }
}

$ sudo ln -s /etc/nginx/sites-available/git /etc/nginx/sites-enabled

$ sudo systemctl reload nginx.service

開啟網頁設定 Gitea

http://localhost/install

---

錯誤排除

最後安裝動作 http://localhost:3000 出現下列錯誤
Index column size too large. The maximum column size is 767 bytes

sudo mysql -u root -p
[sudo] password for user: (os 的密碼)
Enter password:(mysql 的密碼)
MariaDB [(none)]> show global variables like 'innodb_large%';
MariaDB [(none)]> set global innodb_large_prefix = ON;
MariaDB [(none)]> set global innodb_default_row_format=dynamic;

MariaDB [(none)]> select user, host from mysql.user;
MariaDB [(none)]> show grants for 'giteauser'@'localhost';
MariaDB [(none)]> revoke all privileges, grant option from 'giteauser'@'localhost';
MariaDB [(none)]> drop user 'giteauser'@'localhost';
MariaDB [(none)]> drop database gitea;

http://localhost:3000/install
只能執行一次，下一次就回 404
sudo vi /etc/gitea/app.ini
INSTALL_LOCK=false
sudo systemctl stop gitea
sudo systemctl start gitea

http://localhost:3000/install

主要填寫 Database

Username=giteauser

Password=

點開 Server and Third-Party Service Settings

Disable Self-Registration

Require Sign-In to View Pages

點開 Administrator Account Settings

建立第一個 gitea 管理者

Jetson Nano 不接螢幕 預設螢幕解析度

編輯 /etc/X11/xorg.conf

新增

Section "Monitor"
    Identifier "DSI-0"
    Option "Ignore"
EndSection

Section "Screen"
    Identifier "Default Screen"
    Monitor "Configured Monitor"
    Device "Default Device"
    SubSection "Display"
        Depth 24
        Virtual 1280 800
    EndSubSection
EndSection

tensorflow 和 cuda cudnn 版本

查看各個版本的對應

查看目前 cuda 版本
cat /usr/local/cuda/version.txt

查看目前 cudnn 版本
grep CUDNN_MAJOR -A 2 /usr/local/cuda/include/cudnn.h

查看工具版本

which nvcc

nvcc --version

查看驅動程式版本
cat /proc/driver/nvidia/version

nvidia-smi