April 2012 - tor-commits - lists.torproject.org

[flashproxy/master] Give remote hosts 2 seconds to make their WebSocket request.
by dcf＠torproject.org 09 Apr '12

09 Apr '12

commit d469ec913900395011245fb53b7a0a1bf139d1da Author: David Fifield <david(a)bamsoftware.com> Date: Thu Mar 29 19:26:03 2012 -0700 Give remote hosts 2 seconds to make their WebSocket request. --- connector.py | 26 ++++++++++++++++++++++++-- 1 files changed, 24 insertions(+), 2 deletions(-) diff --git a/connector.py b/connector.py index 07f0f3e..908f988 100755 --- a/connector.py +++ b/connector.py @@ -358,6 +358,9 @@ def format_peername(s): except socket.error, e: return "<unconnected>" +# How long to wait for a WebSocket request on the remote socket. It is limited +# to avoid Slowloris-like attacks. +WEBSOCKET_REQUEST_TIMEOUT = 2.0 class WebSocketRequestHandler(BaseHTTPServer.BaseHTTPRequestHandler): def __init__(self, request_text, fd): @@ -601,6 +604,17 @@ def match_proxies(): if remote.buf: local.send_chunk(remote.buf) +class TimeoutSocket(object): + def __init__(self, fd): + self.fd = fd + self.birthday = time.time() + + def age(self): + return time.time() - self.birthday + + def __getattr__(self, name): + return getattr(self.fd, name) + class RemoteSocket(object): def __init__(self, fd, protocols): self.fd = fd @@ -635,12 +649,12 @@ class LocalSocket(object): def main(): while True: rset = [remote_s, local_s] + websocket_pending + socks_pending + locals + remotes - rset, _, _ = select.select(rset, [], []) + rset, _, _ = select.select(rset, [], [], WEBSOCKET_REQUEST_TIMEOUT) for fd in rset: if fd == remote_s: remote_c, addr = fd.accept() log(u"Remote connection from %s." % format_addr(addr)) - websocket_pending.append(remote_c) + websocket_pending.append(TimeoutSocket(remote_c)) elif fd == local_s: local_c, addr = fd.accept() log(u"Local connection from %s." % format_addr(addr)) @@ -687,6 +701,14 @@ def main(): locals.remove(fd) report_pending() match_proxies() + while websocket_pending: + pending = websocket_pending[0] + if pending.age() < WEBSOCKET_REQUEST_TIMEOUT: + break + log(u"Expired remote connection from %s." % format_peername(pending)) + pending.close() + websocket_pending.pop(0) + report_pending() if __name__ == "__main__": opts, args = getopt.gnu_getopt(sys.argv[1:], "hl:", ["daemon", "help", "log=", "pidfile="])

1 0

[flashproxy/master] Parse facilitator response and call a dummy make_proxy_pair.
by dcf＠torproject.org 09 Apr '12

09 Apr '12

commit 2cefb3f850b24d68bf2145e76122b95d5ab77b2e Author: David Fifield <david(a)bamsoftware.com> Date: Thu Mar 29 19:39:43 2012 -0700 Parse facilitator response and call a dummy make_proxy_pair. --- flashproxy.js | 31 ++++++++++++++++++++++++++++++- 1 files changed, 30 insertions(+), 1 deletions(-) diff --git a/flashproxy.js b/flashproxy.js index 32497e6..d823a3b 100644 --- a/flashproxy.js +++ b/flashproxy.js @@ -161,7 +161,36 @@ function FlashProxy() }; this.fac_complete = function(text) { - this.puts("Facilitator: got response \"" + text + "\"."); + var response; + var client_addr; + var relay_addr; + + response = parse_query_string(text); + + if (!response.client) { + this.puts("No clients."); + return; + } + client_addr = parse_addr_spec(response.client); + if (client_addr === null) { + this.puts("Error: can't parse client spec " + repr(response.client) + "."); + } + if (!response.relay) { + this.puts("Error: missing relay in response."); + return; + } + relay_addr = parse_addr_spec(response.relay); + if (relay_addr === null) { + this.puts("Error: can't parse relay spec " + repr(response.relay) + "."); + } + puts("Facilitator: got client:" + repr(client_spec) + " " + + "relay:" + repr(relay_spec) + "."); + + this.make_proxy_pair(client_addr, relay_addr); + }; + + this.make_proxy_pair = function(client_addr, relay_addr) { + this.puts("make_proxy_pair"); }; }

1 0

[flashproxy/master] Make flashproxy-test.js quiet by default.
by dcf＠torproject.org 09 Apr '12

09 Apr '12

commit ce13b018776a775b85e51d9048dbf99f60bacaf0 Author: David Fifield <david(a)bamsoftware.com> Date: Thu Mar 29 18:49:10 2012 -0700 Make flashproxy-test.js quiet by default. --- flashproxy-test.js | 15 +++++++++++---- 1 files changed, 11 insertions(+), 4 deletions(-) diff --git a/flashproxy-test.js b/flashproxy-test.js index 0f1ac3f..6250eac 100755 --- a/flashproxy-test.js +++ b/flashproxy-test.js @@ -3,6 +3,10 @@ /* To run this test program, install the Rhino JavaScript interpreter (apt-get install rhino). */ +var VERBOSE = false; +if ("-v" in arguments) + VERBOSE = true; + var num_tests = 0; var num_failed = 0; @@ -32,16 +36,19 @@ function objects_equal(a, b) var top = true; function announce(test_name) { - if (!top) - print(); + if (VERBOSE) { + if (!top) + print(); + print(test_name); + } top = false; - print(test_name); } function pass(test) { num_tests++; - print("PASS " + repr(test)); + if (VERBOSE) + print("PASS " + repr(test)); } function fail(test, expected, actual)

1 0

[flashproxy/master] Add "client" and "relay" parameters for debugging.
by dcf＠torproject.org 09 Apr '12

09 Apr '12

commit ecad6941a633d639d8180b2adab0de383c74f548 Author: David Fifield <david(a)bamsoftware.com> Date: Thu Mar 29 19:46:20 2012 -0700 Add "client" and "relay" parameters for debugging. --- flashproxy.js | 27 +++++++++++++++++++++++++-- 1 files changed, 25 insertions(+), 2 deletions(-) diff --git a/flashproxy.js b/flashproxy.js index d823a3b..1dca870 100644 --- a/flashproxy.js +++ b/flashproxy.js @@ -2,9 +2,19 @@ * For example: * http://www.example.com/embed.html?facilitator=127.0.0.1:9002&debug=1 * + * client=<HOST>:<PORT> + * The address of the client to connect to. The proxy normally receives this + * information from the facilitator. When this option is used, the facilitator + * query is not done. The "relay" parameter must be given as well. + * * facilitator=<HOST>:<PORT> * The address of the facilitator to use. By default it is * DEFAULT_FACILITATOR_ADDR. Both <HOST> and <PORT> must be present. + * + * relay=<HOST>:<PORT> + * The address of the relay to connect to. The proxy normally receives this + * information from the facilitator. When this option is used, the facilitator + * query is not done. The "client" parameter must be given as well. */ var DEFAULT_FACILITATOR_ADDR = { @@ -112,6 +122,8 @@ function FlashProxy() this.start = function() { var query; var fac_addr; + var client_addr; + var relay_addr; query = parse_query_string(window.location.search.substr(1)); @@ -120,8 +132,19 @@ function FlashProxy() this.puts("Error: Facilitator spec must be in the form \"host:port\"."); return; } - - this.proxy_main(fac_addr); + client_addr = get_query_param_addr(query, "client"); + relay_addr = get_query_param_addr(query, "relay"); + if (client_addr !== undefined && relay_addr !== undefined) { + this.make_proxy_pair(client_addr, relay_addr); + } else if (client_addr !== undefined) { + this.puts("Error: the \"client\" parameter requires \"relay\" also.") + return; + } else if (relay_addr !== undefined) { + this.puts("Error: the \"relay\" parameter requires \"client\" also.") + return; + } else { + this.proxy_main(fac_addr); + } }; this.proxy_main = function(fac_addr) {

1 0

[flashproxy/master] Make puts more like a global function.
by dcf＠torproject.org 09 Apr '12

09 Apr '12

commit 766544907a67a8b3785bc646dce41913afa72113 Author: David Fifield <david(a)bamsoftware.com> Date: Thu Mar 29 20:16:58 2012 -0700 Make puts more like a global function. It is still specific to one FlashProxy instance, but it can be called without "this.". It makes it easier for inner functions to call without changing their "this" binding. --- flashproxy.js | 35 +++++++++++++++++------------------ 1 files changed, 17 insertions(+), 18 deletions(-) diff --git a/flashproxy.js b/flashproxy.js index 25999d4..b69809d 100644 --- a/flashproxy.js +++ b/flashproxy.js @@ -103,11 +103,7 @@ function FlashProxy() { var debug_div = document.createElement("pre"); debug_div.className = "debug"; - - this.badge_elem = debug_div; - this.badge_elem.setAttribute("id", "flashproxy-badge"); - - this.puts = function(s) { + function puts(s) { if (debug_div) { var at_bottom; @@ -119,6 +115,9 @@ function FlashProxy() } }; + this.badge_elem = debug_div; + this.badge_elem.setAttribute("id", "flashproxy-badge"); + this.start = function() { var query; var fac_addr; @@ -129,7 +128,7 @@ function FlashProxy() fac_addr = get_query_param_addr(query, "facilitator", DEFAULT_FACILITATOR_ADDR); if (!fac_addr) { - this.puts("Error: Facilitator spec must be in the form \"host:port\"."); + puts("Error: Facilitator spec must be in the form \"host:port\"."); return; } client_addr = get_query_param_addr(query, "client"); @@ -137,10 +136,10 @@ function FlashProxy() if (client_addr !== undefined && relay_addr !== undefined) { this.make_proxy_pair(client_addr, relay_addr); } else if (client_addr !== undefined) { - this.puts("Error: the \"client\" parameter requires \"relay\" also.") + puts("Error: the \"client\" parameter requires \"relay\" also.") return; } else if (relay_addr !== undefined) { - this.puts("Error: the \"relay\" parameter requires \"client\" also.") + puts("Error: the \"relay\" parameter requires \"client\" also.") return; } else { this.proxy_main(fac_addr); @@ -151,7 +150,7 @@ function FlashProxy() var fac_url; var xhr; - this.puts("Using facilitator " + format_addr(fac_addr) + "."); + puts("Using facilitator " + format_addr(fac_addr) + "."); fac_url = "http://" + encodeURIComponent(fac_addr.host) + ":" + encodeURIComponent(fac_addr.port) + "/"; @@ -164,7 +163,7 @@ function FlashProxy() it's trying to make the HTTP request. The exception message is like "Component returned failure code: 0x805e0006 [nsIXMLHttpRequest.open]" on Firefox. */ - this.puts("Facilitator: exception while connecting: " + repr(err.message) + "."); + puts("Facilitator: exception while connecting: " + repr(err.message) + "."); return; } xhr.responseType = "text"; @@ -174,12 +173,12 @@ function FlashProxy() if (xhr.status == 200) this.fac_complete(xhr.responseText); else if (xhr.status == 0 && xhr.statusText == "") - this.puts("Facilitator: same-origin error."); + puts("Facilitator: same-origin error."); else - this.puts("Facilitator: can't connect: got status " + repr(xhr.status) + " and status text " + repr(xhr.statusText) + "."); + puts("Facilitator: can't connect: got status " + repr(xhr.status) + " and status text " + repr(xhr.statusText) + "."); } }.bind(this); - this.puts("Facilitator: connecting to " + fac_url + "."); + puts("Facilitator: connecting to " + fac_url + "."); xhr.send(null); }; @@ -191,20 +190,20 @@ function FlashProxy() response = parse_query_string(text); if (!response.client) { - this.puts("No clients."); + puts("No clients."); return; } client_addr = parse_addr_spec(response.client); if (client_addr === null) { - this.puts("Error: can't parse client spec " + repr(response.client) + "."); + puts("Error: can't parse client spec " + repr(response.client) + "."); } if (!response.relay) { - this.puts("Error: missing relay in response."); + puts("Error: missing relay in response."); return; } relay_addr = parse_addr_spec(response.relay); if (relay_addr === null) { - this.puts("Error: can't parse relay spec " + repr(response.relay) + "."); + puts("Error: can't parse relay spec " + repr(response.relay) + "."); } puts("Facilitator: got client:" + repr(client_spec) + " " + "relay:" + repr(relay_spec) + "."); @@ -213,7 +212,7 @@ function FlashProxy() }; this.make_proxy_pair = function(client_addr, relay_addr) { - this.puts("make_proxy_pair"); + puts("make_proxy_pair"); }; }

1 0

[flashproxy/master] debug_div doesn't need external visibility.
by dcf＠torproject.org 09 Apr '12

09 Apr '12

commit 724153e69c6a811f2a7b7017680661294212eede Author: David Fifield <david(a)bamsoftware.com> Date: Thu Mar 29 20:08:37 2012 -0700 debug_div doesn't need external visibility. --- flashproxy.js | 14 +++++++------- 1 files changed, 7 insertions(+), 7 deletions(-) diff --git a/flashproxy.js b/flashproxy.js index 1dca870..25999d4 100644 --- a/flashproxy.js +++ b/flashproxy.js @@ -101,21 +101,21 @@ function format_addr(addr) function FlashProxy() { - this.debug_div = document.createElement("pre"); - this.debug_div.className = "debug"; + var debug_div = document.createElement("pre"); + debug_div.className = "debug"; - this.badge_elem = this.debug_div; + this.badge_elem = debug_div; this.badge_elem.setAttribute("id", "flashproxy-badge"); this.puts = function(s) { - if (this.debug_div) { + if (debug_div) { var at_bottom; /* http://www.w3.org/TR/cssom-view/#element-scrolling-members */ - at_bottom = (this.debug_div.scrollTop + this.debug_div.clientHeight == this.debug_div.scrollHeight); - this.debug_div.appendChild(document.createTextNode(s + "\n")); + at_bottom = (debug_div.scrollTop + debug_div.clientHeight == debug_div.scrollHeight); + debug_div.appendChild(document.createTextNode(s + "\n")); if (at_bottom) - this.debug_div.scrollTop = this.debug_div.scrollHeight; + debug_div.scrollTop = debug_div.scrollHeight; } };

1 0

[flashproxy/master] Add make_websocket function.
by dcf＠torproject.org 09 Apr '12

09 Apr '12

commit 111db68d84945b6b55c5f6bd4880860e80aeed4c Author: David Fifield <david(a)bamsoftware.com> Date: Thu Mar 29 20:49:28 2012 -0700 Add make_websocket function. This builds a ws URL and attempts to work around the WebSocket/MozWebSocket naming. --- flashproxy.js | 10 ++++++++++ 1 files changed, 10 insertions(+), 0 deletions(-) diff --git a/flashproxy.js b/flashproxy.js index b69809d..1ea366f 100644 --- a/flashproxy.js +++ b/flashproxy.js @@ -99,6 +99,16 @@ function format_addr(addr) return addr.host + ":" + addr.port; } +function make_websocket(addr) +{ + var url; + + url = "ws://" + encodeURIComponent(addr.host) + + ":" + encodeURIComponent(addr.port) + "/"; + + return (window.WebSocket || window.MozWebSocket)(url, "base64"); +} + function FlashProxy() { var debug_div = document.createElement("pre");

1 0

[flashproxy/master] Add dummy rate limit.
by dcf＠torproject.org 09 Apr '12

09 Apr '12

commit 2929f9fb835c4b6f286b6ee4d5e2783e5ebc4445 Author: David Fifield <david(a)bamsoftware.com> Date: Thu Mar 29 20:51:47 2012 -0700 Add dummy rate limit. --- flashproxy.js | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) diff --git a/flashproxy.js b/flashproxy.js index 1ea366f..90a8869 100644 --- a/flashproxy.js +++ b/flashproxy.js @@ -125,6 +125,11 @@ function FlashProxy() } }; + var rate_limit = { + is_limited: function() { return false; }, + when: function() { return 0; } + }; + this.badge_elem = debug_div; this.badge_elem.setAttribute("id", "flashproxy-badge");

1 0

[flashproxy/master] Don't report_pending on every remote read.
by dcf＠torproject.org 09 Apr '12

09 Apr '12

commit 97afedb002906991d15161fadd85b42daa9a8114 Author: David Fifield <david(a)bamsoftware.com> Date: Fri Mar 30 01:03:32 2012 -0700 Don't report_pending on every remote read. --- connector.py | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/connector.py b/connector.py index 908f988..24630f3 100755 --- a/connector.py +++ b/connector.py @@ -689,7 +689,7 @@ def main(): else: if not receive_unlinked(fd, "remote"): remotes.remove(fd) - report_pending() + report_pending() elif fd in locals: remote = fd.partner if remote:

1 0

[flashproxy/master] Make a functioning proxy pair.
by dcf＠torproject.org 09 Apr '12

09 Apr '12

commit b7ce3b5be07dbe6caba6db01964da7e69c37d61e Author: David Fifield <david(a)bamsoftware.com> Date: Fri Mar 30 00:23:17 2012 -0700 Make a functioning proxy pair. --- flashproxy.js | 128 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 128 insertions(+), 0 deletions(-) diff --git a/flashproxy.js b/flashproxy.js index 90a8869..59bf103 100644 --- a/flashproxy.js +++ b/flashproxy.js @@ -130,6 +130,8 @@ function FlashProxy() when: function() { return 0; } }; + this.proxy_pairs = []; + this.badge_elem = debug_div; this.badge_elem.setAttribute("id", "flashproxy-badge"); @@ -227,8 +229,134 @@ function FlashProxy() }; this.make_proxy_pair = function(client_addr, relay_addr) { + var proxy_pair; + puts("make_proxy_pair"); + + proxy_pair = new ProxyPair(client_addr, relay_addr); + this.proxy_pairs.push(proxy_pair); + proxy_pair.connect(); }; + + /* An instance of a client-relay connection. */ + function ProxyPair(client_addr, relay_addr) + { + function log(s) + { + puts(s) + } + + this.client_addr = client_addr; + this.relay_addr = relay_addr; + + this.c2r_schedule = []; + this.r2c_schedule = []; + + this.flush_timeout_id = null; + + /* Return a function that shows an error message and closes the other + half of a communication pair. */ + this.make_onerror_callback = function(partner) + { + return function(event) { + var ws = event.target; + + log(ws.label + ": error."); + partner.close(); + // dispatchEvent(new Event(Event.COMPLETE)); + }; + }; + + this.onopen_callback = function(event) { + var ws = event.target; + + log(ws.label + ": connected."); + }.bind(this); + + this.onclose_callback = function(event) { + var ws = event.target; + + log(ws.label + ": closed."); + this.flush(); + }.bind(this); + + this.onmessage_client_to_relay = function(event) { + this.c2r_schedule.push(event.data); + this.flush(); + }.bind(this); + + this.onmessage_relay_to_client = function(event) { + this.r2c_schedule.push(event.data); + this.flush(); + }.bind(this); + + this.connect = function() { + log("Client: connecting."); + this.client_s = make_websocket(this.client_addr); + + log("Relay: connecting."); + this.relay_s = make_websocket(this.relay_addr); + + this.client_s.label = "Client"; + this.client_s.onopen = this.onopen_callback; + this.client_s.onclose = this.onclose_callback; + this.client_s.onerror = this.make_onerror_callback(this.relay_s); + this.client_s.onmessage = this.onmessage_client_to_relay; + + this.relay_s.label = "Relay"; + this.relay_s.onopen = this.onopen_callback; + this.relay_s.onclose = this.onclose_callback; + this.relay_s.onerror = this.make_onerror_callback(this.client_s); + this.relay_s.onmessage = this.onmessage_relay_to_client; + }; + + function is_open(ws) + { + return ws.readyState == ws.OPEN; + } + + function is_closed(ws) + { + return ws.readyState == ws.CLOSED; + } + + /* Send as much data as the rate limit currently allows. */ + this.flush = function() { + var busy; + + if (this.flush_timeout_id) + clearTimeout(this.flush_timeout_id); + this.flush_timeout_id = null; + + busy = true; + while (busy && !rate_limit.is_limited()) { + busy = false; + if (is_open(this.client_s) && this.r2c_schedule.length > 0) { + this.client_s.send(this.r2c_schedule.shift()); + busy = true; + } + if (is_open(this.relay_s) && this.c2r_schedule.length > 0) { + this.relay_s.send(this.c2r_schedule.shift()); + busy = true; + } + } + + if (is_closed(this.relay_s) && !is_closed(this.client_s) && this.r2c_schedule.length == 0) { + log("Client: closing."); + this.client_s.close(); + } + if (is_closed(this.client_s) && !is_closed(this.relay_s) && this.c2r_schedule.length == 0) { + log("Relay: closing."); + this.relay_s.close(); + } + + if (is_closed(this.client_s) && is_closed(this.relay_s)) + // dispatchEvent(new Event(Event.COMPLETE)); + ; + else if (this.r2c_schedule.length > 0 || this.c2r_schedule.length > 0) + this.flush_timeout_id = setTimeout(this.flush, rate_limit.when() * 1000); + }; + } } /* This is the non-functional badge that occupies space when

1 0