#!/usr/bin/env python3
"""Los experimentos de CDN de los apuntes, sobre cdn/cdn.clab.yml (make up-cdn).

  python3 cdn_demo.py dns        cada cliente pregunta el mismo nombre al mismo DNS
  python3 cdn_demo.py anycast    cada cliente va a la misma dirección y llega a su réplica
  python3 cdn_demo.py failover   se cae una réplica: qué pasa con las peticiones nuevas
  python3 cdn_demo.py cut        se cae una réplica en plena descarga: qué pasa con esa conexión
"""
import re
import subprocess
import sys
import time

from netlab import Lab, wait_until

CDN = Lab("cdn", "w13-cdn", "redes-w13-cdn")
ANYCAST = "10.213.50.1"
NS = "10.213.30.10"
NAME = "cdn.redes.test"


def start_services():
    """Levanta los servidores web de las réplicas y el DNS, si no están arriba."""
    for node in ("s1", "s2"):
        CDN.sh(node, "pkill", "-f", "http.server")
        CDN.daemon(node, "exec python3 -m http.server 80 --directory /www >/tmp/http.log 2>&1")
    CDN.sh("ns", "pkill", "-f", "geo_dns")
    CDN.daemon("ns", "exec python3 /geo_dns.py 53 >/tmp/dns.log 2>&1")
    time.sleep(1.0)


def converged():
    """Los dos clientes llegan a la dirección de anycast y al DNS."""
    return all(CDN.sh(node, "ping", "-c1", "-W1", target).returncode == 0
               for node in ("c1", "c2") for target in (ANYCAST, NS))


def rtt(node, target):
    output = CDN.out(node, "ping", "-c5", "-i0.2", "-q", target)
    match = re.search(r"= [\d.]+/([\d.]+)/", output)
    return float(match[1]) if match else None


def who(node, target=ANYCAST, wait="3"):
    done = CDN.sh(node, "curl", "-s", "--max-time", wait, f"http://{target}/quien.txt")
    return done.stdout.strip() or f"sin respuesta (curl {done.returncode})"


def dns():
    start_services()
    for node in ("c1", "c2"):
        answer = CDN.out(node, "dig", "+short", f"@{NS}", NAME, "A").strip()
        print(f"{node} pregunta {NAME} a {NS}: {answer}")
        print(f"   curl a esa dirección: {who(node, answer)}, RTT {rtt(node, answer):.1f} ms")
        other = "10.213.22.10" if answer == "10.213.21.10" else "10.213.21.10"
        print(f"   la otra réplica, {other}: RTT {rtt(node, other):.1f} ms")
    print("\nLa respuesta completa, en c1:")
    print(CDN.out("c1", "dig", f"@{NS}", NAME, "A", "+noall", "+answer", "+comments").strip())


def anycast():
    start_services()
    print("Rutas de r1 hacia el prefijo de anycast:")
    print(CDN.vtysh("r1", "show bgp ipv4 unicast 10.213.50.0/24").strip())
    print()
    for node in ("c1", "c2"):
        print(f"{node} -> {ANYCAST}: {who(node)}, RTT {rtt(node, ANYCAST):.1f} ms")


def withdraw(node):
    """La réplica deja de anunciar el prefijo, como si se cayera el sitio."""
    CDN.sh(node, "vtysh", "-c", "conf t", "-c", "router bgp 65310", "-c", "address-family ipv4 unicast",
           "-c", "no network 10.213.50.0/24")


def announce(node):
    CDN.sh(node, "vtysh", "-c", "conf t", "-c", "router bgp 65310", "-c", "address-family ipv4 unicast",
           "-c", "network 10.213.50.0/24")


def failover():
    start_services()
    print(f"antes:   c1 -> {who('c1')}, RTT {rtt('c1', ANYCAST):.1f} ms")
    withdraw("s1")
    began = time.monotonic()
    wait_until(lambda: "s2" in who("c1", wait="1"), seconds=30, step=0.2)
    print(f"s1 deja de anunciar; c1 llega a otra réplica tras {time.monotonic() - began:.1f} s")
    print(f"después: c1 -> {who('c1')}, RTT {rtt('c1', ANYCAST):.1f} ms")
    announce("s1")
    wait_until(lambda: "s1" in who("c1", wait="1"), seconds=30, step=0.2)
    print(f"s1 vuelve: c1 -> {who('c1')}")


def cut():
    """Una conexión TCP abierta no se muda: la otra réplica no la conoce."""
    start_services()
    download = subprocess.Popen(
        ["docker", "exec", CDN.prefix + "c1", "curl", "-sS", "-o", "/dev/null", "--limit-rate", "1M",
         "--max-time", "30", "-w", "%{size_download} bytes", f"http://{ANYCAST}/grande.bin"],
        stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
    time.sleep(2.0)
    withdraw("s1")
    output = download.communicate(timeout=60)[0].strip()
    print("curl en c1, descargando mientras s1 deja de anunciar:")
    print(output)
    print("código de salida:", download.returncode)
    announce("s1")
    wait_until(lambda: "s1" in who("c1", wait="1"), seconds=30, step=0.2)


COMMANDS = {"dns": dns, "anycast": anycast, "failover": failover, "cut": cut}


def main():
    if len(sys.argv) != 2 or sys.argv[1] not in COMMANDS:
        print(__doc__)
        return 2
    if not wait_until(converged, seconds=60):
        print("la red no convergió; ¿corrieron make up-cdn?")
        return 1
    COMMANDS[sys.argv[1]]()
    return 0


if __name__ == "__main__":
    sys.exit(main())

#!/usr/bin/env python3
"""Por qué un connection ID sobrevive a un cambio de dirección y una conexión TCP no.

No es QUIC: es un eco de juguete sobre UDP, sin cifrado y sin validar el camino, para mostrar
una sola idea. El servidor busca la sesión por el ID que viene en el mensaje, y no por la
dirección y el puerto de origen. Al lado corre un eco TCP, que la busca por los cuatro campos.

  cid_echo.py serve <puerto>
  cid_echo.py udp <servidor> <puerto>     el cliente cambia de red a la mitad
  cid_echo.py tcp <servidor> <puerto>     lo mismo, con una conexión TCP
  cid_echo.py restore                     devuelve al cliente a su red original
"""
import socket
import subprocess
import sys
import threading
import time

ROUNDS = 12
SWITCH_AT = 6
GAP = 0.1
WAIT = 1.0
DEVICE = "eth1"
# Dos redes del router mb: es lo que le pasa a un celular al dejar el Wi-Fi.
FIRST = ("10.213.1.10", "10.213.1.1")
SECOND = ("10.213.3.20", "10.213.3.1")


def serve_udp(port):
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.bind(("0.0.0.0", port))
    sessions = {}
    while True:
        data, source = sock.recvfrom(2048)
        cid, _, text = data.partition(b" ")
        session = sessions.setdefault(cid, {"count": 0, "source": source})
        session["count"] += 1
        if session["source"] != source:
            print(f"sesión {cid.decode()}: cambió de {session['source']} a {source}, sigue en "
                  f"el mensaje {session['count']}", flush=True)
            session["source"] = source
        sock.sendto(b"%s %d %s" % (cid, session["count"], text), source)


def serve_tcp(port):
    listener = socket.create_server(("0.0.0.0", port))
    while True:
        conn, _ = listener.accept()
        threading.Thread(target=echo_tcp, args=(conn,), daemon=True).start()


def echo_tcp(conn):
    with conn:
        while True:
            data = conn.recv(2048)
            if not data:
                return
            conn.sendall(data)


def move(old, new):
    """Pone la dirección nueva, con su ruta por defecto, y quita la vieja."""
    subprocess.run(["ip", "addr", "add", f"{new[0]}/24", "dev", DEVICE], check=True, capture_output=True)
    subprocess.run(["ip", "addr", "del", f"{old[0]}/24", "dev", DEVICE], check=True, capture_output=True)
    subprocess.run(["ip", "route", "replace", "default", "via", new[1]], check=True, capture_output=True)


def client_udp(server, port):
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.bind((FIRST[0], 0))
    sock.settimeout(WAIT)
    answered = 0
    for number in range(ROUNDS):
        if number == SWITCH_AT:
            move(FIRST, SECOND)
            sock.close()
            sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
            sock.bind((SECOND[0], 0))
            sock.settimeout(WAIT)
            print(f"-- el cliente cambia a {SECOND[0]}, con otro puerto y otro socket", flush=True)
        sock.sendto(b"c0ffee mensaje-%d" % number, (server, port))
        try:
            reply = sock.recv(2048)
            answered += 1
            print(f"{number}: {reply.decode()}", flush=True)
        except socket.timeout:
            print(f"{number}: sin respuesta", flush=True)
        time.sleep(GAP)
    print(f"respondidos: {answered} de {ROUNDS}", flush=True)
    return answered


def client_tcp(server, port):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.bind((FIRST[0], 0))
    sock.connect((server, port))
    sock.settimeout(WAIT)
    answered = 0
    for number in range(ROUNDS):
        if number == SWITCH_AT:
            move(FIRST, SECOND)
            print(f"-- el cliente cambia a {SECOND[0]}; el socket sigue atado a {FIRST[0]}", flush=True)
        try:
            sock.sendall(b"mensaje-%d" % number)
            reply = sock.recv(2048)
            answered += 1
            print(f"{number}: {reply.decode()}", flush=True)
        except OSError as error:
            print(f"{number}: sin respuesta ({error})", flush=True)
        time.sleep(GAP)
    sock.close()
    print(f"respondidos: {answered} de {ROUNDS}", flush=True)
    return answered


def main():
    if len(sys.argv) == 3 and sys.argv[1] == "serve":
        port = int(sys.argv[2])
        threading.Thread(target=serve_tcp, args=(port,), daemon=True).start()
        serve_udp(port)
    elif len(sys.argv) == 4 and sys.argv[1] in ("udp", "tcp"):
        client = client_udp if sys.argv[1] == "udp" else client_tcp
        client(sys.argv[2], int(sys.argv[3]))
    elif len(sys.argv) == 2 and sys.argv[1] == "restore":
        move(SECOND, FIRST)
    else:
        print(__doc__)
        return 2
    return 0


if __name__ == "__main__":
    sys.exit(main())

#!/usr/bin/env python3
"""Criptografía de juguete: Diffie-Hellman, RSA, hash y MAC con números que se ven.

Los números de DH y RSA son diminutos a propósito, para poder seguir las cuentas a mano.
Este código no protege nada: se rompe en menos de un segundo, y la demostración lo hace.
"""
import hashlib
import hmac


def dh_shared(p, g, a, b):
    """Diffie-Hellman: cada lado publica g^x mod p y llega al mismo secreto."""
    big_a = pow(g, a, p)
    big_b = pow(g, b, p)
    return big_a, big_b, pow(big_b, a, p), pow(big_a, b, p)


def dh_break(p, g, public):
    """Logaritmo discreto a la fuerza: con p pequeño, basta probar exponentes."""
    value = 1
    for exponent in range(p):
        if value == public:
            return exponent
        value = value * g % p
    raise ValueError("no hay exponente")


def rsa_keys(p, q, e):
    """Devuelve (n, e, d). d es el inverso de e módulo (p-1)(q-1)."""
    phi = (p - 1) * (q - 1)
    return p * q, e, pow(e, -1, phi)


def rsa_apply(message, exponent, n):
    """La misma operación cifra, descifra, firma y verifica: solo cambia el exponente."""
    if not 0 <= message < n:
        raise ValueError("el mensaje debe estar entre 0 y n-1")
    return pow(message, exponent, n)


def differing_bits(first, second):
    return sum(bin(x ^ y).count("1") for x, y in zip(first, second))


def main():
    print("== Diffie-Hellman con p=2087, g=5")
    p, g, a, b = 2087, 5, 731, 1289
    big_a, big_b, secret_a, secret_b = dh_shared(p, g, a, b)
    print(f"Ana elige a={a} y publica A = g^a mod p = {big_a}")
    print(f"Beto elige b={b} y publica B = g^b mod p = {big_b}")
    print(f"Ana calcula B^a mod p = {secret_a}")
    print(f"Beto calcula A^b mod p = {secret_b}")
    print(f"quien solo vio A y B, probando exponentes, halla a={dh_break(p, g, big_a)}")

    print("\n== RSA con p=61, q=53, e=17")
    n, e, d = rsa_keys(61, 53, 17)
    message = 65
    cipher = rsa_apply(message, e, n)
    print(f"n={n} e={e} d={d}")
    print(f"cifrar con la pública:  {message}^{e} mod {n} = {cipher}")
    print(f"descifrar con la privada: {cipher}^{d} mod {n} = {rsa_apply(cipher, d, n)}")
    signature = rsa_apply(message, d, n)
    print(f"firmar con la privada:  {message}^{d} mod {n} = {signature}")
    print(f"verificar con la pública: {signature}^{e} mod {n} = {rsa_apply(signature, e, n)}")

    print("\n== Hash: un carácter cambia cerca de la mitad de los bits")
    one = hashlib.sha256(b"pagar 100 soles").digest()
    two = hashlib.sha256(b"pagar 900 soles").digest()
    print("sha256('pagar 100 soles') =", one.hex())
    print("sha256('pagar 900 soles') =", two.hex())
    print(f"bits distintos: {differing_bits(one, two)} de {len(one) * 8}")

    print("\n== MAC: el hash solo no autentica, porque cualquiera lo recalcula")
    key = b"clave compartida"
    print("hmac(clave, 'pagar 100 soles') =", hmac.new(key, b"pagar 100 soles", "sha256").hexdigest())
    print("hmac(otra,  'pagar 100 soles') =", hmac.new(b"otra", b"pagar 100 soles", "sha256").hexdigest())


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""Cifrar no es proteger la integridad: cambiar bits de un texto cifrado con AES-CTR.

El atacante no conoce la clave, pero sí el formato del mensaje. Cambia un carácter con un
XOR sobre el texto cifrado, y el destinatario descifra otra cosa sin notar nada. Un MAC sí
lo detecta. Por eso TLS 1.3 solo usa cifrado autenticado (AEAD).
"""
import hmac
import subprocess

KEY = "000102030405060708090a0b0c0d0e0f"
IV = "a0a1a2a3a4a5a6a7a8a9aaabacadaeaf"
MAC_KEY = b"otra clave, solo para el MAC"
MESSAGE = b"pagar 0100 soles a Ana"


def aes_ctr(data):
    """AES-128-CTR con el comando openssl. Cifrar y descifrar son la misma operación."""
    done = subprocess.run(["openssl", "enc", "-aes-128-ctr", "-K", KEY, "-iv", IV],
                          input=data, capture_output=True, check=True)
    return done.stdout


def flip(cipher, position, old, new):
    """Sin la clave: si se sabe qué byte hay en una posición, se puede poner otro."""
    tampered = bytearray(cipher)
    tampered[position] ^= old ^ new
    return bytes(tampered)


def main():
    cipher = aes_ctr(MESSAGE)
    tag = hmac.new(MAC_KEY, cipher, "sha256").digest()
    print("mensaje:         ", MESSAGE.decode())
    print("cifrado:         ", cipher.hex())
    tampered = flip(cipher, MESSAGE.index(b"0100"), ord("0"), ord("9"))
    print("cifrado alterado:", tampered.hex())
    print("se descifra como:", aes_ctr(tampered).decode())
    valid = hmac.compare_digest(hmac.new(MAC_KEY, tampered, "sha256").digest(), tag)
    print("MAC del original sobre el alterado:", "válido" if valid else "NO coincide, se descarta")


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""Cliente DASH real, sin reproducir nada: lee el MPD, baja segmentos y lleva la cuenta del buffer.

La decisión de calidad la toma aquí el cliente, en cada segmento. El servidor solo guarda archivos.

  dash_client.py http://servidor:puerto/video.mpd [fixed|last|ruta/a/abr.py] [--segments N]
"""
import argparse
import sys
import time
import urllib.request
import xml.etree.ElementTree as ET

from dash_sim import BUFFER_MAX_S, fixed_top, last_sample, load_choose

NS = {"mpd": "urn:mpeg:dash:schema:mpd:2011"}


def read_manifest(url):
    """Devuelve (lista de (bitrate, id) ordenada, template, duración de segmento, total)."""
    with urllib.request.urlopen(url, timeout=10) as answer:
        root = ET.fromstring(answer.read())
    adaptation = root.find("mpd:Period/mpd:AdaptationSet", NS)
    template = adaptation.find("mpd:SegmentTemplate", NS)
    duration = int(template.get("duration")) / int(template.get("timescale"))
    total = int(root.get("mediaPresentationDuration")[2:-1])
    reps = sorted((int(rep.get("bandwidth")), rep.get("id"))
                  for rep in adaptation.findall("mpd:Representation", NS))
    return reps, template.get("media"), duration, int(total / duration)


def play(mpd_url, choose, limit=None):
    """Baja todos los segmentos. Imprime una línea por segmento; devuelve los segundos congelados."""
    reps, media, duration, total = read_manifest(mpd_url)
    bitrates = [bitrate for bitrate, _ in reps]
    base = mpd_url.rsplit("/", 1)[0]
    samples = []
    buffer_s = 0.0
    frozen_total = 0.0
    start = time.monotonic()
    print(" seg      t  calidad   medido   buffer  congelado", flush=True)
    for number in range(limit or total):
        if buffer_s > BUFFER_MAX_S - duration:
            pause = buffer_s - (BUFFER_MAX_S - duration)
            time.sleep(pause)
            buffer_s -= pause
        quality = choose(bitrates, list(samples), buffer_s)
        path = media.replace("$RepresentationID$", reps[quality][1]).replace("$Number$", str(number))
        began = time.monotonic()
        with urllib.request.urlopen(f"{base}/{path}", timeout=30) as answer:
            size = len(answer.read())
        took = time.monotonic() - began
        samples.append(size * 8 / took)
        frozen = max(0.0, took - buffer_s) if number > 0 else 0.0
        frozen_total += frozen
        buffer_s = max(0.0, buffer_s - took) + duration
        print(f"{number:4} {time.monotonic() - start:5.1f}s {bitrates[quality] // 1000:6}k "
              f"{samples[-1] / 1e6:6.2f}M {buffer_s:7.1f}s {frozen:8.1f}s", flush=True)
    print(f"congelado total: {frozen_total:.1f} s", flush=True)
    return frozen_total


def main():
    parser = argparse.ArgumentParser(description="Cliente DASH")
    parser.add_argument("url")
    parser.add_argument("strategy", nargs="?", default="last")
    parser.add_argument("--segments", type=int)
    args = parser.parse_args()
    choose = {"fixed": fixed_top, "last": last_sample}.get(args.strategy) or load_choose(args.strategy)
    play(args.url, choose, args.segments)
    return 0


if __name__ == "__main__":
    sys.exit(main())

#!/usr/bin/env python3
"""Simulador de un cliente DASH: misma decisión que el cliente real, tiempos exactos.

La red es una lista de tramos (hasta qué segundo, a cuántos bit/s). Un segmento tarda lo que
indique esa lista, y el video avanza mientras tanto. Si el buffer se vacía, la imagen se congela.
Cada estrategia es una función choose(bitrates, samples, buffer_s) que devuelve la calidad.

  dash_sim.py [fixed|last|ruta/a/abr.py] [--oscillating]
"""
import importlib.util
import sys

BITRATES = [400_000, 1_000_000, 2_500_000, 5_000_000]
SEGMENT_S = 2
BUFFER_MAX_S = 10
# 40 s buenos, 30 s de caída, y se recupera.
NETWORK = [(40, 6_000_000), (70, 1_200_000), (float("inf"), 6_000_000)]
# Una red que sube y baja cada 3 s, sin llegar a caer.
OSCILLATING = [(3 * (i + 1), 6_000_000 if i % 2 == 0 else 3_000_000) for i in range(200)] + \
              [(float("inf"), 6_000_000)]


def fixed_top(bitrates, samples, buffer_s):
    """Siempre la mejor calidad: lo que pide quien no quiere pensar en la red."""
    del samples, buffer_s
    return len(bitrates) - 1


def last_sample(bitrates, samples, buffer_s):
    """La mejor calidad que cabe en la última medición, sin margen."""
    del buffer_s
    if not samples:
        return 0
    return max((i for i, rate in enumerate(bitrates) if rate <= samples[-1]), default=0)


def load_choose(path):
    """Carga la función choose de un archivo de Python."""
    spec = importlib.util.spec_from_file_location("abr_module", path)
    module = importlib.util.module_from_spec(spec)
    spec.loader.exec_module(module)
    return module.choose


def download_time(bits, start, network):
    """Avanza por los tramos de la red hasta terminar de bajar esos bits."""
    now = start
    left = bits
    for until, rate in network:
        if now >= until:
            continue
        possible = (until - now) * rate
        if possible >= left:
            return now + left / rate - start
        left -= possible
        now = until
    raise ValueError("la red no alcanza")


def simulate(choose, segments=45, network=None, bitrates=None):
    """Devuelve una fila por segmento y el total de segundos congelado."""
    network = network or NETWORK
    bitrates = bitrates or BITRATES
    now = 0.0
    buffer_s = 0.0
    samples = []
    rows = []
    frozen_total = 0.0
    for number in range(segments):
        # Con el buffer lleno se espera: no tiene sentido bajar medio video por adelantado.
        if buffer_s > BUFFER_MAX_S - SEGMENT_S:
            pause = buffer_s - (BUFFER_MAX_S - SEGMENT_S)
            now += pause
            buffer_s -= pause
        quality = choose(bitrates, list(samples), buffer_s)
        bits = bitrates[quality] * SEGMENT_S
        took = download_time(bits, now, network)
        frozen = max(0.0, took - buffer_s) if number > 0 else 0.0
        frozen_total += frozen
        buffer_s = max(0.0, buffer_s - took) + SEGMENT_S
        now += took
        samples.append(bits / took)
        rows.append({"segment": number, "start": now - took, "bitrate": bitrates[quality], "took": took,
                     "sample": samples[-1], "buffer": buffer_s, "frozen": frozen})
    return rows, frozen_total


def score(rows):
    """Bitrate promedio y número de cambios de calidad."""
    rates = [row["bitrate"] for row in rows]
    switches = sum(1 for a, b in zip(rates, rates[1:]) if a != b)
    return sum(rates) / len(rates), switches


def show(rows, frozen):
    print(" seg  inicio  calidad  tarda  medido    buffer  congelado")
    for row in rows:
        print(f"{row['segment']:4} {row['start']:6.1f}s {row['bitrate'] // 1000:6}k {row['took']:5.1f}s "
              f"{row['sample'] / 1e6:5.2f}M {row['buffer']:7.1f}s {row['frozen']:8.1f}s")
    average, switches = score(rows)
    print(f"bitrate promedio: {average / 1e6:.2f} Mbit/s; cambios: {switches}; congelado: {frozen:.1f} s")


def main():
    args = [arg for arg in sys.argv[1:] if arg != "--oscillating"]
    name = args[0] if args else "fixed"
    choose = {"fixed": fixed_top, "last": last_sample}.get(name) or load_choose(name)
    network = OSCILLATING if "--oscillating" in sys.argv else NETWORK
    rows, frozen = simulate(choose, network=network)
    show(rows, frozen)


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""Un servidor DNS autoritativo mínimo que contesta según quién pregunta.

Es la idea de la selección por DNS de una CDN, reducida a una tabla: el prefijo de quien
consulta decide qué réplica se devuelve. Solo sabe contestar registros A, de un solo nombre.

  geo_dns.py <puerto>
"""
import ipaddress
import socket
import struct
import sys

NAME = "cdn.redes.test"
TTL = 30
# Quien consulta -> réplica más cercana. La última fila atrapa todo lo demás.
TABLE = [
    (ipaddress.ip_network("10.213.11.0/24"), "10.213.21.10"),
    (ipaddress.ip_network("10.213.12.0/24"), "10.213.22.10"),
    (ipaddress.ip_network("0.0.0.0/0"), "10.213.21.10"),
]
TYPE_A = 1
CLASS_IN = 1
FLAG_RESPONSE_AA = 0x8400
RCODE_NXDOMAIN = 3
RCODE_NOTIMP = 4


def read_question(query):
    """Devuelve (nombre, tipo, clase, fin de la pregunta). Sin compresión: es la primera pregunta."""
    labels = []
    pos = 12
    while query[pos] != 0:
        length = query[pos]
        labels.append(query[pos + 1:pos + 1 + length].decode("ascii"))
        pos += 1 + length
    pos += 1
    qtype, qclass = struct.unpack("!HH", query[pos:pos + 4])
    return ".".join(labels).lower(), qtype, qclass, pos + 4


def answer_for(source):
    address = ipaddress.ip_address(source)
    for network, replica in TABLE:
        if address in network:
            return replica
    raise ValueError("la tabla no tiene ruta por defecto")


def respond(query, source):
    """Arma la respuesta a una consulta, o None si no se puede ni leer."""
    if len(query) < 17:
        return None
    query_id = query[:2]
    try:
        name, qtype, qclass, end = read_question(query)
    except (IndexError, UnicodeDecodeError, struct.error):
        return None
    question = query[12:end]
    if name != NAME:
        return query_id + struct.pack("!HHHHH", FLAG_RESPONSE_AA | RCODE_NXDOMAIN, 1, 0, 0, 0) + question
    if qtype != TYPE_A or qclass != CLASS_IN:
        return query_id + struct.pack("!HHHHH", FLAG_RESPONSE_AA | RCODE_NOTIMP, 1, 0, 0, 0) + question
    replica = answer_for(source)
    # 0xc00c es un puntero al nombre que ya está en la pregunta.
    record = struct.pack("!HHHIH", 0xc00c, TYPE_A, CLASS_IN, TTL, 4) + socket.inet_aton(replica)
    return query_id + struct.pack("!HHHHH", FLAG_RESPONSE_AA, 1, 1, 0, 0) + question + record


def main():
    port = int(sys.argv[1]) if len(sys.argv) > 1 else 53
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.bind(("0.0.0.0", port))
    while True:
        query, peer = sock.recvfrom(512)
        reply = respond(query, peer[0])
        if reply:
            sock.sendto(reply, peer)


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""Un paquete perdido, tres streams: cuándo recibe la aplicación cada dato.

Simulador, no una medición: no hay servidor HTTP/3 en el contenedor del curso. El modelo se
reduce a lo que importa aquí, sin ventanas, ni ACK, ni control de congestión:

  - Los paquetes salen de a uno cada TX ms, y llegan ONE_WAY ms después.
  - Cada paquete lleva datos de un stream, por turnos: A, B, C, A, B, C...
  - El paquete perdido se recupera con una retransmisión que llega RECOVERY ms más tarde.

La única diferencia entre los modos es qué ordena el receptor:
  tcp   hay un solo orden, el del stream de bytes de TCP. Un hueco detiene todo lo que sigue.
  quic  hay un orden por stream. Un hueco detiene solo a su stream.
"""
import argparse

TX = 10
ONE_WAY = 50
RECOVERY = 100
STREAMS = "ABC"


def packets(count, streams=STREAMS):
    """Lista de (número, stream, número dentro del stream)."""
    seen = {name: 0 for name in streams}
    result = []
    for number in range(count):
        name = streams[number % len(streams)]
        result.append((number, name, seen[name]))
        seen[name] += 1
    return result


def arrival_times(count, lost):
    times = {number: number * TX + ONE_WAY for number in range(count)}
    if lost is not None:
        times[lost] += RECOVERY
    return times


def deliver(count, lost, mode, streams=STREAMS):
    """Devuelve {número de paquete: instante en que la aplicación recibe sus datos}."""
    times = arrival_times(count, lost)
    delivered = {}
    latest = {}
    for number, name, _ in packets(count, streams):
        key = "todos" if mode == "tcp" else name
        # Se entrega cuando llegó él y todo lo anterior en su mismo orden.
        latest[key] = max(latest.get(key, 0), times[number])
        delivered[number] = latest[key]
    return delivered


def delayed_by_stream(count, lost, mode, streams=STREAMS):
    """Por stream: cuántos paquetes esperaron más de lo necesario y cuánto, como máximo."""
    delivered = deliver(count, lost, mode, streams)
    clean = arrival_times(count, None)
    result = {name: [0, 0] for name in streams}
    for number, name, _ in packets(count, streams):
        wait = delivered[number] - clean[number]
        if wait > 0:
            result[name][0] += 1
            result[name][1] = max(result[name][1], wait)
    return result


def table(count, lost):
    tcp = deliver(count, lost, "tcp")
    quic = deliver(count, lost, "quic")
    times = arrival_times(count, lost)
    print("paq stream llega  entrega(TCP)  entrega(QUIC)")
    for number, name, index in packets(count):
        mark = "  <- perdido, llega retransmitido" if number == lost else ""
        print(f"{number:3} {name}{index:<5} {times[number]:5} {tcp[number]:12} {quic[number]:14}{mark}")


def summary(count, lost):
    print(f"\n{'':6}{'TCP: esperan, máx.':>22}{'QUIC: esperan, máx.':>24}")
    tcp = delayed_by_stream(count, lost, "tcp")
    quic = delayed_by_stream(count, lost, "quic")
    for name in STREAMS:
        print(f"{name:6}{tcp[name][0]:>12}{tcp[name][1]:>7} ms{quic[name][0]:>15}{quic[name][1]:>6} ms")


def main():
    parser = argparse.ArgumentParser(description="Un paquete perdido: TCP frente a QUIC")
    parser.add_argument("--packets", type=int, default=12)
    parser.add_argument("--lost", type=int, default=3, help="número del paquete perdido")
    args = parser.parse_args()
    print(f"TX={TX} ms, retardo={ONE_WAY} ms, recuperación={RECOVERY} ms, se pierde el paquete {args.lost}")
    table(args.packets, args.lost)
    summary(args.packets, args.lost)


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""Los pasos del laboratorio que necesitan Internet. Corren en el contenedor del curso.

  python3 internet.py chain [sitio]     versión de TLS y cadena de certificados
  python3 internet.py h2h3 [sitio]      HTTP/2 frente a HTTP/3, en medianas de 11 descargas
  python3 internet.py quic [sitio]      captura una conexión QUIC: qué se lee sin claves y con claves
  python3 internet.py dns               el mismo nombre, preguntado a tres resolvers públicos

Los números dependen de su conexión y del sitio.
"""
import os
import re
import statistics
import subprocess
import sys
import time

HERE = os.path.dirname(os.path.abspath(__file__))
CAPTURES = os.path.join(HERE, "captures")
DEFAULT_SITE = "www.cloudflare.com"
DEFAULT_PATH = "/cdn-cgi/trace"
RESOLVERS = ["1.1.1.1", "8.8.8.8", "9.9.9.9"]
CDN_NAMES = ["www.akamai.com", "www.cloudflare.com"]
FORMAT = "%{http_version} %{time_namelookup} %{time_connect} %{time_appconnect} %{time_starttransfer} %{time_total}"


def run(args, **kwargs):
    return subprocess.run(args, capture_output=True, text=True, timeout=kwargs.pop("timeout", 60), **kwargs)


def chain(site):
    """openssl s_client imprime el certificado y la cadena; nos quedamos con lo que importa."""
    done = run(["openssl", "s_client", "-connect", f"{site}:443", "-servername", site, "-tls1_3"],
               input="", timeout=20)
    for line in done.stdout.splitlines():
        if re.match(r"\s*(\d+ s:|i:|a:|v:)", line) or line.startswith(("New, ", "Verify return code", "Verification")):
            print(line)
    print(next((line.strip() for line in done.stdout.splitlines() if "Protocol" in line), ""))


def sample(flag, site, path):
    done = run(["curl", "-s", "-o", "/dev/null", flag, "--max-time", "10", "-w", FORMAT, f"https://{site}{path}"])
    parts = done.stdout.split()
    return parts[0], [float(value) * 1000 for value in parts[1:]]


def h2h3(site, path, rounds=11):
    print(f"{site}{path}: medianas de {rounds} conexiones nuevas, en ms")
    print(f"{'':8}{'versión':>8}{'DNS':>7}{'conexión':>10}{'TLS listo':>11}{'primer byte':>13}{'total':>8}")
    for title, flag in (("HTTP/2", "--http2"), ("HTTP/3", "--http3-only")):
        rows = []
        version = "?"
        for _ in range(rounds):
            version, values = sample(flag, site, path)
            rows.append(values)
        lookup, connect, tls, first, total = [statistics.median(col) for col in zip(*rows)]
        print(f"{title:8}{version:>8}{lookup:7.1f}{connect:10.1f}{tls:11.1f}{first:13.1f}{total:8.1f}")


def quic(site, path):
    """Captura en la interfaz por defecto del contenedor, filtrando el puerto 443 de UDP."""
    os.makedirs(CAPTURES, exist_ok=True)
    pcap = os.path.join(CAPTURES, "quic.pcap")
    keys = os.path.join(CAPTURES, "quic-keys.log")
    for name in (pcap, keys):
        if os.path.exists(name):
            os.remove(name)
    address = run(["dig", "+short", site, "A"]).stdout.split()[-1]
    capture = subprocess.Popen(["tcpdump", "-i", "any", "-n", "-U", "-s0", "-w", pcap, f"udp port 443 and host {address}"],
                               stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
    time.sleep(1.5)
    env = dict(os.environ, SSLKEYLOGFILE=keys)
    subprocess.run(["curl", "-s", "-o", "/dev/null", "--http3-only", "--resolve", f"{site}:443:{address}",
                    "--max-time", "10", f"https://{site}{path}"], env=env, check=False)
    time.sleep(1)
    capture.terminate()
    capture.wait()
    fields = ["-T", "fields", "-e", "frame.number", "-e", "udp.length", "-e", "_ws.col.Info"]
    print("Sin claves:")
    print(run(["tshark", "-r", pcap, "-c", "11", *fields]).stdout.rstrip())
    print("\nSNI y ALPN que tshark lee sin claves:")
    print(run(["tshark", "-r", pcap, "-Y", "tls.handshake.type == 1", "-T", "fields",
               "-e", "tls.handshake.extensions_server_name", "-e", "tls.handshake.extensions_alpn_str"]).stdout.strip())
    print("\nCon SSLKEYLOGFILE, los paquetes que llevan streams:")
    decrypted = run(["tshark", "-r", pcap, "-o", f"tls.keylog_file:{keys}", "-T", "fields",
                     "-e", "frame.number", "-e", "_ws.col.Protocol", "-e", "_ws.col.Info"]).stdout
    shown = [line for line in decrypted.splitlines() if "STREAM" in line]
    print("\n".join(shown[:8]))


def dns():
    for name in CDN_NAMES:
        for resolver in RESOLVERS:
            answer = run(["dig", "+short", "+time=3", f"@{resolver}", name, "A"]).stdout.split()
            addresses = [item for item in answer if not item.endswith(".")]
            print(f"{name:22} @{resolver:9} {' '.join(sorted(addresses))}")


def main():
    if len(sys.argv) < 2:
        print(__doc__)
        return 2
    command = sys.argv[1]
    site = sys.argv[2] if len(sys.argv) > 2 else DEFAULT_SITE
    path = DEFAULT_PATH if site == DEFAULT_SITE else "/"
    if command == "chain":
        chain(site)
    elif command == "h2h3":
        h2h3(site, path)
    elif command == "quic":
        quic(site, path)
    elif command == "dns":
        dns()
    else:
        print(__doc__)
        return 2
    return 0


if __name__ == "__main__":
    sys.exit(main())

#!/usr/bin/env python3
"""Prepara un "video" para DASH: varias calidades, segmentos cortos y un manifiesto MPD.

El contenido son bytes al azar del tamaño correcto: a la red y al cliente les da igual. El MPD
sí tiene la forma de los reales (Period, AdaptationSet, Representation y SegmentTemplate).

  make_dash.py <carpeta> [--segments 15] [--duration 2]
"""
import argparse
import os

BITRATES = [400_000, 1_000_000, 2_500_000, 5_000_000]

MPD = """<?xml version="1.0"?>
<MPD xmlns="urn:mpeg:dash:schema:mpd:2011" type="static" mediaPresentationDuration="PT{total}S"
     minBufferTime="PT{duration}S" profiles="urn:mpeg:dash:profile:isoff-on-demand:2011">
  <Period>
    <AdaptationSet mimeType="video/mp4" segmentAlignment="true">
      <SegmentTemplate timescale="1" duration="{duration}" startNumber="0"
                       media="$RepresentationID$/seg-$Number$.m4s"/>
{representations}
    </AdaptationSet>
  </Period>
</MPD>
"""


def build(folder, segments, duration, bitrates=None):
    bitrates = bitrates or BITRATES
    os.makedirs(folder, exist_ok=True)
    lines = []
    for bitrate in bitrates:
        name = f"{bitrate // 1000}k"
        lines.append(f'      <Representation id="{name}" bandwidth="{bitrate}"/>')
        os.makedirs(os.path.join(folder, name), exist_ok=True)
        size = bitrate * duration // 8
        for number in range(segments):
            with open(os.path.join(folder, name, f"seg-{number}.m4s"), "wb") as file:
                file.write(os.urandom(size))
    with open(os.path.join(folder, "video.mpd"), "w", encoding="utf-8") as file:
        file.write(MPD.format(total=segments * duration, duration=duration, representations="\n".join(lines)))


def main():
    parser = argparse.ArgumentParser(description="Genera segmentos y un MPD")
    parser.add_argument("folder")
    parser.add_argument("--segments", type=int, default=15)
    parser.add_argument("--duration", type=int, default=2)
    args = parser.parse_args()
    build(args.folder, args.segments, args.duration)


if __name__ == "__main__":
    main()