Note the security section which disables some paranoid protection IIS has switched on by default. If your server doesn’t allow double escaping of request strings, the YOURLS links with a + in them don’t work. This breaks the admin interface and the stats reporting pages.

The rest of the web.config is standard stuff to fix a non-canonical hostname, and make sure the IDs are rewritten to the right pages:

<system.webServer>
	<security>
		<requestFiltering allowDoubleEscaping="true" />
	</security>
	<rewrite>
	<rules>
		<rule name="Canonical Host Name" stopProcessing="true">
			<match url="(.*)" />
			<conditions>
				<add input="{HTTP_HOST}" negate="true" pattern="^domain\.com$" />
			</conditions>
			<action type="Redirect" url="http://domain.com/{R:1}" redirectType="Permanent" />
		</rule>
		<rule name="YOURLS 1" stopProcessing="true">
			<match url="^([0-9A-Za-z]+)/?$" ignoreCase="false" />
			<conditions logicalGrouping="MatchAll">
				<add input="{REQUEST_FILENAME}" matchType="IsFile" ignoreCase="false" negate="true" />
				<add input="{REQUEST_FILENAME}" matchType="IsDirectory" ignoreCase="false" negate="true" />
			</conditions>
			<action type="Rewrite" url="/yourls-go.php?id={R:1}" appendQueryString="false" />
		</rule>
		<rule name="YOURLS 2" stopProcessing="true">
			<match url="^([0-9A-Za-z]+)\+/?$" ignoreCase="false" />
			<action type="Rewrite" url="/yourls-infos.php?id={R:1}" appendQueryString="false" />
		</rule>
		<rule name="YOURLS 3" stopProcessing="true">
			<match url="^([0-9A-Za-z]+)\+all/?$" ignoreCase="false" />
			<action type="Rewrite" url="/yourls-infos.php?id={R:1}&amp;all=1" appendQueryString="false" />
		</rule>
	</rules>
	</rewrite>
</system.webServer>

1) I run my own Exchange Server.  It provides ActiveSync, Outlook Web Access, and Outlook Anywhere for my company’s email domains and my personal durdle.com domain.

2) I provide email addresses at durdle.com for family members (and a few people who just happen to share the family name).

Historically all those family emails have been maintained by Gradwell without going near my Exchange Server.  The durdle.com MX records in DNS pointed to Gradwell’s servers for mail delivery and I had a forwarder at Gradwell that would redirect my – and only my – messages to the Exchange Server.  For a number of reasons I needed to change this so that all email is delivered via my Exchange Server.  I made this change yesterday, discovering one problem in the process.

Email Suffixes

Gradwell’s mail server supports email suffix matching.  If you have a GMail account you may be familiar with the approach.  Say you have an email john@gmail.com.  Gmail will actually deliver mail to john+anything@gmail.com; you can add any suffix you like after the + and GMail will still deliver it to your inbox.  Gradwell support this by allowing you to place a period after the local part so you can use john.anything@example.com.  You don’t have to create these email addresses anywhere – you can just start using it and the mail server will make sure it gets to you.

This is fantastically useful because it means that when a website asks for your email address you can give out a custom throwaway email just for that site.  So when you sign up at DodgyCo.com, you give them the email john.dodgyco@example.com.  If you ever receive spam because DodgyCo sold your email address you’ll know a) who sold you out, and b) which email address to add to your spam filter.

Exchange Server

Enter Microsoft Exchange Server.  I’m currently running the 2010 edition, but the problem I’m about to describe (and solve!) exists in every recent version.  Exchange Server doesn’t support email suffixes.  Every recipient has to have an alias created on the server.  If you want to deliver to john.suffix@example.com you’d better remember to create an alias for that user, otherwise the Exchange Recipient Filter will reject the message since – as far as it is concerned – the user does not exist on the server.

Worse, Exchange doesn’t even implement any generic CatchAll functionality.  CatchAll would allow the server to redirect messages for non-existing recipients to a specific address. Smart people have created solutions to the CatchAll problem but all that does is allow you to define one mailbox for ALL non-deliverable messages to be delivered to.  Since I need to provide suffix matching to multiple users this doesn’t work for me.

Time to extend Exchange’s functionality!

Transport Agents

Transport Agents were introduced in Exchange 2007 to replace Exchange 2003’s SMTP Event Sinks and have been retained largely unchanged in Exchange 2010.  Broadly speaking when a message arrives at an Exchange Server it is moved through the transport pipeline as each SMTP event occurs.  Each SMTP event (Connect, MAIL FROM, RCPT TO, etc) can trigger an interested Transport Agent to perform some actions on the message.
The complete list of SMTP events and their sequence is described on this Exchange Server TechCenter page.

Transport Agents are simply DLLs written in managed code that fire on SMTP events.  Back when I contracted for the MOD I wrote a Transport Agent for Exchange 2007 which demonstrated that Exchange was capable of performing Dominance Checking on outgoing emails so I knew that it wouldn’t take to long to write a Transport Agent to filter incoming messages.  I was able to reuse some of that code and also made use of some of Wilbert De Graaf’s CatchAll Agent code which made the handling of a configuration file very quick to implement.  Thank you Wilbert!

Requirements

I had a couple of requirements for my Transport Agent:

1) It should allow redirection of multiple suffixes to different recipients.

2) It should allow me to ban delivery to any previously used suffixes and ensure that the sender receives a non-deliverable report.

I ended up meeting these requirements by using C# to write a Transport Agent that accepts its configuration from an XML file.  The config.xml defines multiple regular expressions to match against along with associated redirect addresses.  It also lists banned email addresses which the Transport Agent should reject.

To mimic the Gradwell behaviour which we were already making use of I needed to match firstname then a dot and then any word before the domain.  This is a fairly simple regular expression in C#, and looks like this:

^firstname+\.[a-z]+@example.com$

The config.xml takes the form:

<config>
    <redirect pattern="^john+\.[a-z]+@domain.com$" address="john@domain.com" />
    <redirect pattern="^jane+\.[a-z]+@domain.com$" address="jane.doe@gmail.com" />
    <banned address="john.spam@domain.com" />
    <banned address="jane.newsletter@domain.com" />
</config>

Here we define two patterns for redirect, one to an internal recipient and one redirect to an external SMTP address.  We also ban two known “bad” recipient addresses.

You’ll need to provide at least one redirect entry, but you’re not required to ban any addresses if you don’t want to.  Also, while redirects specifiy regular expressions to match, banned addresses are just strings which are simply compared. I leave it as an exercise for the reader to add regular expressions to the banned list!

The Code

Whenever the config.xml file is changed, the agent reloads it and parses the XML.  It puts the banned emails into a List and the regular expression patterns and redirect addresses into a Dictionary.  If any of the emails in the config appear invalid the new configuration is rejected and the agent continues to use the running config.

The agent defines a RCPT TO: handler.  This event is fired as soon as the sending MTA starts to transmit the recipient addresses. rcptArgs contains the argument we need: RecipientAddress, which we store as a lowercase string for comparison. Although the spec (RFC2821) actually requires email addresses to be case sensitive, I’ve never met an MTA that adheres to that part of the spec. So for our purposes email addresses are case insensitive and we can do all comparisons in lowercase.

public void RcptToHandler(ReceiveCommandEventSource source, RcptCommandEventArgs rcptArgs)
{
// Get the recipient address as a lowercase string.
string strRecipientAddress = rcptArgs.RecipientAddress.ToString().ToLower();

It performs two checks. First – is the recipient address in the ban list?

// Search the banned email List for the recipient.
bool exists = catchAllConfig.Banned.Exists(element => element == strRecipientAddress);
if (exists)
{
	// If found respond to the sending MTA with the reject response.
	source.RejectCommand(CatchAllAgent.rejectResponse);
 
	// No further processing.
	return;
}

And second, does the recipient address match any of the regular expressions?

// For each pair of regexps to email addresses
foreach (var pair in catchAllConfig.AddressMap)
{
	// Create the regular expression and the routing address from the dictionary.
	Regex emailPattern = new Regex(pair.Key);
	RoutingAddress emailAddress = pair.Value;
 
	// If the recipient address matches the regular expression.
	if (emailPattern.IsMatch(strRecipientAddress))
	{
		// And if the recipient is NOT in the address book.
		if ((this.addressBook != null) &&
			(this.addressBook.Find(rcptArgs.RecipientAddress) == null))
		{
			// Redirect the recipient to the other address.
			rcptArgs.RecipientAddress = emailAddress;
 
			// No further processing.
			return;
		}
	}
}

Note that in both cases as soon as we’ve got a positive result we stop further processing. If an address is in the ban list we immediately reject it, and if we find a matching regular expression we use its paired address to redirect the message and stop looking for further matches.

I’ve given enough information here that a C# developer with some spare time could create this Transport Agent themselves. However I know that it is really useful to have a package you can just download and install without having to worry about compiling it yourself. So I’ve packaged the DLL together with installation scripts and the install and configuration guide.

Please visit the product page for more information and to purchase the Transport Agent. Payment is via PayPal, you will receive the download link within minutes of payment.

PciRoot(0x1)/Pci(0x1c,0x0)/Pci(0x0,0x0) for the GTS in slot one.
PciRoot(0x1)/Pci(0x1,0x0)/Pci(0x0,0x0) for the GTX in slot two (PEG2).

You’ll need this for when you generate the EFI hex string in EFI Studio.

Remember also to change the BIOS to boot from PEG2.

Maybe that’ll save someone else the pain of pulling the cards and running gfxutil -f display on each one!

First, list the orphan users to make sure this is the problem:

EXEC sp_change_users_login 'Report'

Usually I already have the login and password set up on the server, this being the case you can fix the orphan by doing:

EXEC sp_change_users_login 'Auto_Fix', 'user'

If not, and you want/need to create the login and password, you’ll need to do this instead:

EXEC sp_change_users_login 'Auto_Fix', 'user', 'login', 'password'

For example, I want a canonical host name (so visitors always see workavoidance.net with no www prefix in the address bar) and to ensure that the Wordpress permalinks work properly. While I was at it I took the opportunity to disable hot-linking of our images, since for some reason a Russian website had taken a shine to some of our Armory graphics.

Below is the web.config I created. It redirects users to the canonical host name, enables Wordpress permalinks and disables hot-linking of our images. The redirect proved something of a problem to begin with. Our iPhone App “Monkey Shaker” has an online high score system. Scores are submitted from the app via an encrypted HTTP POST to a PHP page which decrypts the information and updates the database. I discovered that when you issue a server side redirect most clients won’t re-POST their data to the new page – they will issue a GET for the new page and the original POST data is lost. This meant that highscore submissions were failing.

(NB: this isn’t as big a disaster as it sounds since we built a very robust mechanism to retry score submission into the app.)

So, you’ll note an extra entry in the web.config to exclude that page from a redirect:

<add input="{URL}" negate="true" pattern="scoresubmit\.php$" />

“Why not just change the URL in the app to be canonical?!” You may well ask. Yes, we probably will, but that relies on issuing an update and getting over a quarter of a million users to download it. This way we don’t have to rely on that.

Still to come – how I implemented caching in Wordpress and in our high score system to improve performance.

Here’s the rewrite rules section of the completed web.config:

<rule name="Canonical Host Name" stopProcessing="true">
<match url="(.*)" />
<conditions>
<add input="{HTTP_HOST}" negate="true" pattern="^workavoidance\.net$" />
<add input="{URL}" negate="true" pattern="scoresubmit\.php$" />
</conditions>
<action type="Redirect" url="http://workavoidance.net/{R:1}" redirectType="Permanent" />
</rule>
 
<rule name="Prevent image hotlinking">
<match url=".*\.(gif|jpg|png)$"/>
<conditions>
<add input="{HTTP_REFERER}" pattern="^$" negate="true" />
<add input="{HTTP_REFERER}" pattern="^http://workavoidance\.net/.*$" negate="true" />
</conditions>
<action type="Rewrite" url="/no.png" />
</rule>
 
<rule name="wordpress" patternSyntax="Wildcard">
<match url="*" />
<conditions>
<add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
<add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
</conditions>
<action type="Rewrite" url="index.php" />
</rule>

Windows Server Performance Team Blog : Increase VMBus buffer sizes to increase network throughput to guest VMs.

Well thanks to the sterling efforts of one man and his EFI hacking skills, we now have a solution as this image demonstrates. The image on the left shows the result of the VMWare Virtualization Technology test CD confirming that VT is now enabled on my Vaio Z11.

I’ve mirrored his code and instructions here in case his site disappears, read more after the jump…

Download this EFI application and put it on a FAT32 formatted USB stick in the \EFI\BOOT directory.

Boot from the USB stick. When this USB stick is plugged in to your laptop it will boot from it regardless of your settings to deny booting from external devices.

If all goes well you will see the following message:

> Welcome to GRUB!
>
> Entering rescue mode...
> error: file not found
> grub rescue>

At this prompt, type:

setup_var

You’ll be informed of the risks but most importantly you should see confirmation that the tool has found the correct setup variable. You want to see the message say “the GUID should match the expected GUID”. If it does not don’t continue – visit the site of the author and let him know.

Since this definitely works on a Vaio Z11, you should have got this far and can now look at the current setting of the VT offset which is at 0×1af. Type:

setup_var 0x1af

Verify that the variable is set to 0×00. If it is not, do not continue.

Assuming that the variable is as expected, we’ll change the setting, locking VT for your processor to ON:

setup_var 0x1af 0x1

You can verify that this change has been accepted by typing:

setup_var 0x1af

And confirming that the output is now 0×01.

That’s it! Hit CTRL-ALT-DEL and remove the USB stick. You can now check that VT is enabled using whichever tool you prefer. I confirmed mine from a VMWare boot CD and also within Windows using Steve Gibson’s SecurAble tool.

If you install Java 6 Update 13 and then try and log into Cisco SDM 2.5 it will fail. The SDM console will not load.

I found I had to go back to Java 6 Update 6 (available at the Java archive page, or direct download.).

With that the Cisco SDM started working again. I’ve not found anything about this on the Cisco site.

So, I opened up my master socket and disconnected the wire at pin 3 – the bell wire.  Plugged it all back in and found an immediate speed boost of approximately 2Mb.  I fully expect this to increase as my ISP (Be Unlimited) rate up their equipment to match my now far less lossy line.

If you’re handy with a screwdriver and don’t much care about the rules about messing with BT’s sockets it could well be worth your while pulling the wire out of pin 3.  And if you’re a bit scared of that and you have the right master socket, BroadbandBuyer can ship you an iPlate for less than BT charge, and they actually have them in stock!

Unsurprisingly, this is old news for some people.