September 2012 - tor-commits - lists.torproject.org

[flashproxy/master] Comment FACILITATOR_PUBKEY_PEM.
by dcf＠torproject.org 28 Sep '12

28 Sep '12

commit 75ae4c721f807a019586484fb340800a1a974769 Author: David Fifield <david(a)bamsoftware.com> Date: Wed Sep 19 14:38:44 2012 -0700 Comment FACILITATOR_PUBKEY_PEM. --- flashproxy-reg-email | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) diff --git a/flashproxy-reg-email b/flashproxy-reg-email index debe16d..03f0b3a 100755 --- a/flashproxy-reg-email +++ b/flashproxy-reg-email @@ -61,6 +61,8 @@ A4GBAFjOKer89961zgK5F7WF0bnj4JXMJTENAKaSbn+2kmOeUJXRmm/kEd5jhW6Y # hashing the public key, not the entire certificate. PUBKEY_SHA1 = "e341556ff3fd18e155ce30971fc93e740aa4b185".decode("hex") +# Registrations are encrypted with this public key before being emailed. Only +# the facilitator operators should have the corresponding private key. # openssl genrsa reg-email 2048 # openssl rsa -pubout < reg-email > reg-email.pub FACILITATOR_PUBKEY_PEM = """\

1 0

[flashproxy/master] format string
by dcf＠torproject.org 28 Sep '12

28 Sep '12

commit cc1ab4a3798788b6115fe8d6627568a8c19d898f Author: David Fifield <david(a)bamsoftware.com> Date: Wed Sep 19 14:40:06 2012 -0700 format string --- flashproxy-reg-email | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/flashproxy-reg-email b/flashproxy-reg-email index 03f0b3a..d919de5 100755 --- a/flashproxy-reg-email +++ b/flashproxy-reg-email @@ -225,7 +225,7 @@ try: if pubkey_digest != PUBKEY_SHA1: raise ValueError("Public key does not match pin: got %s but expected %s" % - pubkey_digest.encode("hex"), PUBKEY_SHA1.encode("hex")) + (pubkey_digest.encode("hex"), PUBKEY_SHA1.encode("hex"))) smtp.ehlo(EHLO_FQDN)

1 0

[flashproxy/master] Move get_reg and put_reg into fac.py.
by dcf＠torproject.org 28 Sep '12

28 Sep '12

commit 9c570dd3a0d8c9c86c92b9bab7a0543dfa92e4c9 Author: David Fifield <david(a)bamsoftware.com> Date: Wed Sep 19 15:21:29 2012 -0700 Move get_reg and put_reg into fac.py. --- facilitator/fac.py | 53 +++++++++++++++++++++++++++++++++++++++ facilitator/facilitator.cgi | 58 +----------------------------------------- 2 files changed, 55 insertions(+), 56 deletions(-) diff --git a/facilitator/fac.py b/facilitator/fac.py index 494b378..cb77ccc 100644 --- a/facilitator/fac.py +++ b/facilitator/fac.py @@ -181,3 +181,56 @@ def render_transaction(command, *params): for key, value in params: parts.append("%s=%s" % (key, quote_string(value))) return " ".join(parts) + +def fac_socket(facilitator_addr): + return socket.create_connection(facilitator_addr, 1.0).makefile() + +def transact(f, command, *params): + transaction = render_transaction(command, *params) + print >> f, transaction + f.flush() + line = f.readline() + if not (len(line) > 0 and line[-1] == '\n'): + raise ValueError("No newline at end of string returned by facilitator") + return parse_transaction(line[:-1]) + +def put_reg(facilitator_addr, client_addr, registrant_addr): + """Send a registration to the facilitator using a one-time socket. Returns + true iff the command was successful.""" + f = fac_socket(facilitator_addr) + try: + command, params = transact(f, "PUT", ("CLIENT", format_addr(client_addr)), ("FROM", format_addr(registrant_addr))) + finally: + f.close() + return command == "OK" + +def get_reg(facilitator_addr, proxy_addr): + """Get a registration from the facilitator using a one-time socket. Returns + a dict with keys "client" and "relay" if successful, or a dict with the key + "client" mapped to the value "" if there are no registrations available for + proxy_addr. Raises an exception otherwise.""" + f = fac_socket(facilitator_addr) + try: + command, params = transact(f, "GET", ("FROM", format_addr(proxy_addr))) + finally: + f.close() + if command == "NONE": + return { + "client": "" + } + elif command == "OK": + client_spec = param_first("CLIENT", params) + relay_spec = param_first("RELAY", params) + if not client_spec: + raise ValueError("Facilitator did not return CLIENT") + if not relay_spec: + raise ValueError("Facilitator did not return RELAY") + # Check the syntax returned by the facilitator. + client = parse_addr_spec(client_spec) + relay = parse_addr_spec(relay_spec) + return { + "client": format_addr(client), + "relay": format_addr(relay), + } + else: + raise ValueError("Facilitator response was not \"OK\"") diff --git a/facilitator/facilitator.cgi b/facilitator/facilitator.cgi index 6ccb479..2ef4cfa 100755 --- a/facilitator/facilitator.cgi +++ b/facilitator/facilitator.cgi @@ -17,57 +17,6 @@ Status: %d\r \r""" % status sys.exit() -def fac_socket(): - return socket.create_connection(FACILITATOR_ADDR, 1.0).makefile() - -def transact(f, command, *params): - transaction = fac.render_transaction(command, *params) - print >> f, transaction - f.flush() - line = f.readline() - if not (len(line) > 0 and line[-1] == '\n'): - raise ValueError("No newline at end of string returned by facilitator") - return fac.parse_transaction(line[:-1]) - -def put_reg(client_addr, registrant_addr): - f = fac_socket() - try: - command, params = transact(f, "PUT", ("CLIENT", fac.format_addr(client_addr)), ("FROM", fac.format_addr(registrant_addr))) - finally: - f.close() - if command == "OK": - pass - else: - exit_error(500) - -def get_reg(proxy_addr): - f = fac_socket() - try: - command, params = transact(f, "GET", ("FROM", fac.format_addr(proxy_addr))) - finally: - f.close() - if command == "NONE": - return { - "client": "" - } - elif command == "OK": - client_spec = fac.param_first("CLIENT", params) - relay_spec = fac.param_first("RELAY", params) - if not client_spec or not relay_spec: - exit_error(500) - try: - # Check the syntax returned by the backend. - client = fac.parse_addr_spec(client_spec) - relay = fac.parse_addr_spec(relay_spec) - except ValueError: - exit_error(500) - return { - "client": fac.format_addr(client), - "relay": fac.format_addr(relay), - } - else: - exit_error(500) - method = os.environ.get("REQUEST_METHOD") path_info = os.environ.get("PATH_INFO") proxy_addr = (os.environ.get("REMOTE_ADDR"), None) @@ -83,7 +32,7 @@ def do_get(): if path != "/": exit_error(400) try: - reg = get_reg(proxy_addr) or "" + reg = fac.get_reg(FACILITATOR_ADDR, proxy_addr) or "" except: exit_error(500) # Allow XMLHttpRequest from any domain. http://www.w3.org/TR/cors/. @@ -106,10 +55,7 @@ def do_post(): client_addr = fac.parse_addr_spec(client_spec, defhost=proxy_addr[0]) except ValueError: exit_error(400) - try: - put_reg(client_addr, proxy_addr) - except: - raise + if not fac.put_reg(FACILITATOR_ADDR, client_addr, proxy_addr): exit_error(500) print """\ Status: 200\r

1 0

[flashproxy/master] Add facilitator IMAP Gmail poller.
by dcf＠torproject.org 28 Sep '12

28 Sep '12

commit d046f5b6bf9815a37107262168a054d8e793a2d1 Author: David Fifield <david(a)bamsoftware.com> Date: Wed Sep 19 13:09:49 2012 -0700 Add facilitator IMAP Gmail poller. --- facilitator/facilitator-email-poller | 234 ++++++++++++++++++++++++++++++++++ 1 files changed, 234 insertions(+), 0 deletions(-) diff --git a/facilitator/facilitator-email-poller b/facilitator/facilitator-email-poller new file mode 100755 index 0000000..c9d9a84 --- /dev/null +++ b/facilitator/facilitator-email-poller @@ -0,0 +1,234 @@ +#!/usr/bin/env python + +import email +import getopt +import imaplib +import os +import socket +import ssl +import stat +import sys +import tempfile +import time + +import fac + +from hashlib import sha1 +from M2Crypto import BIO, RSA, X509 + +DEFAULT_IMAP_HOST = "imap.gmail.com" +DEFAULT_IMAP_PORT = 993 +DEFAULT_EMAIL_ADDRESS = "hoddwee(a)gmail.com" + +POLL_INTERVAL = 60 + +FACILITATOR_ADDR = ("127.0.0.1", 9002) + +# We trust no other CA certificate than this. +# +# To find the certificate to copy here, +# $ strace openssl s_client -connect imap.gmail.com:993 -verify 10 -CApath /etc/ssl/certs 2>&1 | grep /etc/ssl/certs +# stat("/etc/ssl/certs/XXXXXXXX.0", {st_mode=S_IFREG|0644, st_size=YYYY, ...}) = 0 +CA_CERTS = """\ +subject=/C=US/O=Equifax/OU=Equifax Secure Certificate Authority +issuer=/C=US/O=Equifax/OU=Equifax Secure Certificate Authority +-----BEGIN CERTIFICATE----- +MIIDIDCCAomgAwIBAgIENd70zzANBgkqhkiG9w0BAQUFADBOMQswCQYDVQQGEwJV +UzEQMA4GA1UEChMHRXF1aWZheDEtMCsGA1UECxMkRXF1aWZheCBTZWN1cmUgQ2Vy +dGlmaWNhdGUgQXV0aG9yaXR5MB4XDTk4MDgyMjE2NDE1MVoXDTE4MDgyMjE2NDE1 +MVowTjELMAkGA1UEBhMCVVMxEDAOBgNVBAoTB0VxdWlmYXgxLTArBgNVBAsTJEVx +dWlmYXggU2VjdXJlIENlcnRpZmljYXRlIEF1dGhvcml0eTCBnzANBgkqhkiG9w0B +AQEFAAOBjQAwgYkCgYEAwV2xWGcIYu6gmi0fCG2RFGiYCh7+2gRvE4RiIcPRfM6f +BeC4AfBONOziipUEZKzxa1NfBbPLZ4C/QgKO/t0BCezhABRP/PvwDN1Dulsr4R+A +cJkVV5MW8Q+XarfCaCMczE1ZMKxRHjuvK9buY0V7xdlfUNLjUA86iOe/FP3gx7kC +AwEAAaOCAQkwggEFMHAGA1UdHwRpMGcwZaBjoGGkXzBdMQswCQYDVQQGEwJVUzEQ +MA4GA1UEChMHRXF1aWZheDEtMCsGA1UECxMkRXF1aWZheCBTZWN1cmUgQ2VydGlm +aWNhdGUgQXV0aG9yaXR5MQ0wCwYDVQQDEwRDUkwxMBoGA1UdEAQTMBGBDzIwMTgw +ODIyMTY0MTUxWjALBgNVHQ8EBAMCAQYwHwYDVR0jBBgwFoAUSOZo+SvSspXXR9gj +IBBPM5iQn9QwHQYDVR0OBBYEFEjmaPkr0rKV10fYIyAQTzOYkJ/UMAwGA1UdEwQF +MAMBAf8wGgYJKoZIhvZ9B0EABA0wCxsFVjMuMGMDAgbAMA0GCSqGSIb3DQEBBQUA +A4GBAFjOKer89961zgK5F7WF0bnj4JXMJTENAKaSbn+2kmOeUJXRmm/kEd5jhW6Y +7qj/WsjTVbJmcVfewCHrPSqnI0kBBIZCe/zuf6IWUrVnZ9NA2zsmWLIodz2uFHdh +1voqZiegDfqnc1zqcPGUIWVEX/r87yloqaKHee9570+sB3c4 +-----END CERTIFICATE----- +""" +# SHA-1 digest of expected public key. See +# http://www.imperialviolet.org/2011/05/04/pinning.html for the reason behind +# hashing the public key, not the entire certificate. +PUBKEY_SHA1 = "5d97e1ec007e48c1f36e736e652eeaf2184697c3".decode("hex") + +class options(object): + email_addr = None + imap_addr = None + key_filename = None + password_filename = None + debug = False + +def usage(f = sys.stdout): + print >> f, """\ +Usage: %(progname)s --key=KEYFILE --pass=PASSFILE +Facilitator-side helper for the facilitator-reg-email rendezvous. Polls +an IMAP server for email messages with client registrations, deletes +them, and forwards the registrations to the facilitator. + + -d, --debug enable debugging output (Python imaplib messages); + beware that the login password will be shown. + -e, --email=ADDRESS log in as ADDRESS (default "%(email_addr)s"). + -h, --help show this help. + -i, --imap=HOST[:PORT] use the given IMAP server (default "%(imap_addr)s"). + -k, --key=KEYFILE read a facilitator private key from KEYFILE. + -p, --pass=PASSFILE use the email password contained in PASSFILE.\ +""" % { + "progname": sys.argv[0], + "email_addr": DEFAULT_EMAIL_ADDRESS, + "imap_addr": fac.format_addr((DEFAULT_IMAP_HOST, DEFAULT_IMAP_PORT)), +} + +options.email_addr = DEFAULT_EMAIL_ADDRESS +options.imap_addr = (DEFAULT_IMAP_HOST, DEFAULT_IMAP_PORT) + +opts, args = getopt.gnu_getopt(sys.argv[1:], "de:hi:k:p:", ["debug", "email=", "help", "imap=", "key=", "pass="]) +for o, a in opts: + if o == "-d" or o == "--debug": + options.debug = True + elif o == "-e" or o == "--email": + options.email_addr = a + elif o == "-h" or o == "--help": + usage() + sys.exit() + elif o == "-i" or o == "--imap": + options.imap_addr = fac.parse_addr_spec(a, DEFAULT_IMAP_HOST, DEFAULT_IMAP_PORT) + elif o == "-k" or o == "--key": + options.key_filename = a + elif o == "-p" or o == "--pass": + options.password_filename = a + +if len(args) != 0: + usage(sys.stderr) + sys.exit(1) + +# Return true iff the given fd is readable, writable, and executable only by its +# owner. +def check_perms(fd): + mode = os.fstat(fd)[0] + return (mode & (stat.S_IRWXG | stat.S_IRWXO)) == 0 + +# Load the email password. +if options.password_filename is None: + print >> sys.stderr, "The --pass option is required." + sys.exit(1) +try: + password_file = open(options.password_filename) +except OSError, e: + print >> sys.stderr, """\ +Failed to open password file "%s": %s.\ +""" % (options.password_filename, str(e)) + sys.exit(1) +else: + if not check_perms(password_file.fileno()): + print >> sys.stderr, "Refusing to run with group- or world-readable password file. Try" + print >> sys.stderr, "\tchmod 600 %s" % options.password_filename + sys.exit(1) + email_password = password_file.read().strip() +finally: + password_file.close() + +# Load the private key specific to this registration method. +if options.key_filename is None: + print >> sys.stderr, "The --key option is required." + sys.exit(1) +try: + key_file = open(options.key_filename) +except OSError, e: + print >> sys.stderr, """\ +Failed to open private key file "%s": %s.\ +""" % (options.key_filename, str(e)) + sys.exit(1) +else: + if not check_perms(key_file.fileno()): + print >> sys.stderr, "Refusing to run with group- or world-readable private key file. Try" + print >> sys.stderr, "\tchmod 600 %s" % options.key_filename + sys.exit(1) + rsa = RSA.load_key_string(key_file.read()) +finally: + key_file.close() + +class IMAP4_SSL_REQUIRED(imaplib.IMAP4_SSL): + """A subclass of of IMAP4_SSL that uses ssl_version=ssl.PROTOCOL_TLSv1 and + cert_reqs=ssl.CERT_REQUIRED.""" + def open(self, host = "", port = imaplib.IMAP4_SSL_PORT): + self.host = host + self.port = port + self.sock = socket.create_connection((host, port)) + self.sslobj = ssl.wrap_socket(self.sock, ssl_version=ssl.PROTOCOL_TLSv1, + cert_reqs=ssl.CERT_REQUIRED, ca_certs=self.certfile) + self.file = self.sslobj.makefile('rb') + +def find_client_addr(body): + """Find and parse the first client line of the form + client=... + Returns None if no client line was found. + """ + for line in body.splitlines(): + if line.startswith("client="): + _, client_spec = line.split("=", 1) + return fac.parse_addr_spec(client_spec) + return None + +def handle_message(msg): + ciphertext = msg.get_payload().decode("base64") + plaintext = rsa.private_decrypt(ciphertext, RSA.pkcs1_oaep_padding) + client_addr = find_client_addr(plaintext) + fac.put_reg(FACILITATOR_ADDR, client_addr) + +def imap_loop(imap): + while True: + typ, data = imap.select() + exists = int(data[0]) + + for i in range(exists): + # Grab and delete message 1 on each iteration; remaining messages + # shift down so the next message we process is also message 1. + typ, data = imap.fetch(1, "(BODY[])") + if data[0] is None: + break + + try: + msg = email.message_from_string(data[0][1]) + handle_message(msg) + except Exception, e: + print >> sys.stderr, "Error processing message, deleting anyway:", e + + imap.store(1, "+FLAGS", "\\Deleted") + imap.expunge() + + time.sleep(POLL_INTERVAL) + +if options.debug: + imaplib.Debug = 4 + +ca_certs_file = tempfile.NamedTemporaryFile(prefix="facilitator-email-poller-", suffix=".crt", delete=True) +try: + ca_certs_file.write(CA_CERTS) + ca_certs_file.flush() + imap = IMAP4_SSL_REQUIRED(options.imap_addr[0], options.imap_addr[1], + None, ca_certs_file.name) +finally: + ca_certs_file.close() + +# Check that the public key is what we expect. +cert_der = imap.ssl().getpeercert(binary_form=True) +cert = X509.load_cert_string(cert_der, format=X509.FORMAT_DER) +pubkey_der = cert.get_pubkey().as_der() +pubkey_digest = sha1(pubkey_der).digest() + +if pubkey_digest != PUBKEY_SHA1: + raise ValueError("Public key does not match pin: got %s but expected %s" % + (pubkey_digest.encode("hex"), PUBKEY_SHA1.encode("hex"))) + +imap.login(options.email_addr, email_password) + +imap_loop(imap) + +imap.close() +imap.logout()

1 0

[flashproxy/master] Install facilitator-email-poller.
by dcf＠torproject.org 28 Sep '12

28 Sep '12

commit 71e364b9903aceac5e1b914fca9a5306ea9e8101 Author: David Fifield <david(a)bamsoftware.com> Date: Wed Sep 19 16:02:51 2012 -0700 Install facilitator-email-poller. --- facilitator/Makefile | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/facilitator/Makefile b/facilitator/Makefile index ee8d527..effa583 100644 --- a/facilitator/Makefile +++ b/facilitator/Makefile @@ -6,7 +6,7 @@ all: install: mkdir -p $(BINDIR) - cp -f facilitator facilitator.cgi fac.py $(BINDIR) + cp -f facilitator facilitator-email-poller facilitator.cgi fac.py $(BINDIR) cp -f init.d/facilitator /etc/init.d/ clean:

1 0

[flashproxy/master] Make the registrant_addr parameter optional.
by dcf＠torproject.org 28 Sep '12

28 Sep '12

commit 21473325c7dcb66a87ee0d1d0471ecf6226cb2fc Author: David Fifield <david(a)bamsoftware.com> Date: Wed Sep 19 16:00:56 2012 -0700 Make the registrant_addr parameter optional. --- facilitator/fac.py | 7 +++++-- 1 files changed, 5 insertions(+), 2 deletions(-) diff --git a/facilitator/fac.py b/facilitator/fac.py index cb77ccc..9d77b95 100644 --- a/facilitator/fac.py +++ b/facilitator/fac.py @@ -194,12 +194,15 @@ def transact(f, command, *params): raise ValueError("No newline at end of string returned by facilitator") return parse_transaction(line[:-1]) -def put_reg(facilitator_addr, client_addr, registrant_addr): +def put_reg(facilitator_addr, client_addr, registrant_addr=None): """Send a registration to the facilitator using a one-time socket. Returns true iff the command was successful.""" f = fac_socket(facilitator_addr) + params = [("CLIENT", format_addr(client_addr))] + if registrant_addr is not None: + params.append(("FROM", format_addr(registrant_addr))) try: - command, params = transact(f, "PUT", ("CLIENT", format_addr(client_addr)), ("FROM", format_addr(registrant_addr))) + command, params = transact(f, "PUT", *params) finally: f.close() return command == "OK"

1 0

[flashproxy/master] Add flashproxy-reg-email to install and dist.
by dcf＠torproject.org 28 Sep '12

28 Sep '12

commit 589ee5df7932d9b921072e8a188e72684da8e10c Author: David Fifield <david(a)bamsoftware.com> Date: Wed Sep 19 16:19:36 2012 -0700 Add flashproxy-reg-email to install and dist. --- Makefile | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index f79918f..a83a77e 100644 --- a/Makefile +++ b/Makefile @@ -3,14 +3,14 @@ BINDIR = $(PREFIX)/bin VERSION = 0.4 -CLIENT_DIST_FILES = flashproxy-client flashproxy-reg-http README LICENSE torrc +CLIENT_DIST_FILES = flashproxy-client flashproxy-reg-email flashproxy-reg-http README LICENSE torrc all: : install: mkdir -p $(BINDIR) - cp -f flashproxy-client flashproxy-reg-http $(BINDIR) + cp -f flashproxy-client flashproxy-reg-email flashproxy-reg-http $(BINDIR) clean: rm -f *.pyc

1 0

[flashproxy/master] Add daemon options to facilitator-email-poller.
by dcf＠torproject.org 28 Sep '12

28 Sep '12

commit eac7da3fc2ec852966a582bd48f8018df4f2a340 Author: David Fifield <david(a)bamsoftware.com> Date: Wed Sep 19 16:50:27 2012 -0700 Add daemon options to facilitator-email-poller. --- facilitator/facilitator-email-poller | 72 ++++++++++++++++++++++++++++++--- 1 files changed, 65 insertions(+), 7 deletions(-) diff --git a/facilitator/facilitator-email-poller b/facilitator/facilitator-email-poller index c9d9a84..42bf2dc 100755 --- a/facilitator/facilitator-email-poller +++ b/facilitator/facilitator-email-poller @@ -19,6 +19,7 @@ from M2Crypto import BIO, RSA, X509 DEFAULT_IMAP_HOST = "imap.gmail.com" DEFAULT_IMAP_PORT = 993 DEFAULT_EMAIL_ADDRESS = "hoddwee(a)gmail.com" +DEFAULT_LOG_FILENAME = "facilitator-email-poller.log" POLL_INTERVAL = 60 @@ -57,12 +58,19 @@ A4GBAFjOKer89961zgK5F7WF0bnj4JXMJTENAKaSbn+2kmOeUJXRmm/kEd5jhW6Y # hashing the public key, not the entire certificate. PUBKEY_SHA1 = "5d97e1ec007e48c1f36e736e652eeaf2184697c3".decode("hex") +LOG_DATE_FORMAT = "%Y-%m-%d %H:%M:%S" + class options(object): email_addr = None imap_addr = None key_filename = None password_filename = None - debug = False + log_filename = DEFAULT_LOG_FILENAME + log_file = sys.stdout + daemonize = True + pid_filename = None + safe_logging = True + imaplib_debug = False def usage(f = sys.stdout): print >> f, """\ @@ -71,26 +79,42 @@ Facilitator-side helper for the facilitator-reg-email rendezvous. Polls an IMAP server for email messages with client registrations, deletes them, and forwards the registrations to the facilitator. - -d, --debug enable debugging output (Python imaplib messages); - beware that the login password will be shown. + -d, --debug don't daemonize, log to stdout. -e, --email=ADDRESS log in as ADDRESS (default "%(email_addr)s"). -h, --help show this help. -i, --imap=HOST[:PORT] use the given IMAP server (default "%(imap_addr)s"). + --imaplib-debug show raw IMAP messages. -k, --key=KEYFILE read a facilitator private key from KEYFILE. - -p, --pass=PASSFILE use the email password contained in PASSFILE.\ + -l, --log FILENAME write log to FILENAME (default \"%(log)s\"). + -p, --pass=PASSFILE use the email password contained in PASSFILE. + --pidfile FILENAME write PID to FILENAME after daemonizing. + --unsafe-logging don't scrub email password and IP addresses from logs.\ """ % { "progname": sys.argv[0], "email_addr": DEFAULT_EMAIL_ADDRESS, "imap_addr": fac.format_addr((DEFAULT_IMAP_HOST, DEFAULT_IMAP_PORT)), + "log": DEFAULT_LOG_FILENAME, } +def safe_str(s): + """Return s if options.safe_logging is true, and "[scrubbed]" otherwise.""" + if options.safe_logging: + return "[scrubbed]" + else: + return s + +def log(msg): + print >> options.log_file, (u"%s %s" % (time.strftime(LOG_DATE_FORMAT), msg)).encode("UTF-8") + options.log_file.flush() + options.email_addr = DEFAULT_EMAIL_ADDRESS options.imap_addr = (DEFAULT_IMAP_HOST, DEFAULT_IMAP_PORT) -opts, args = getopt.gnu_getopt(sys.argv[1:], "de:hi:k:p:", ["debug", "email=", "help", "imap=", "key=", "pass="]) +opts, args = getopt.gnu_getopt(sys.argv[1:], "de:hi:k:l:p:", ["debug", "email=", "help", "imap=", "imaplib-debug", "key=", "log=", "pass=", "pidfile=", "unsafe-logging"]) for o, a in opts: if o == "-d" or o == "--debug": - options.debug = True + options.daemonize = False + options.log_filename = None elif o == "-e" or o == "--email": options.email_addr = a elif o == "-h" or o == "--help": @@ -98,10 +122,18 @@ for o, a in opts: sys.exit() elif o == "-i" or o == "--imap": options.imap_addr = fac.parse_addr_spec(a, DEFAULT_IMAP_HOST, DEFAULT_IMAP_PORT) + if o == "--imaplib-debug": + options.imaplib_debug = True elif o == "-k" or o == "--key": options.key_filename = a + elif o == "-l" or o == "--log": + options.log_filename = a elif o == "-p" or o == "--pass": options.password_filename = a + elif o == "--pidfile": + options.pid_filename = a + elif o == "--unsafe-logging": + options.safe_logging = False if len(args) != 0: usage(sys.stderr) @@ -179,6 +211,7 @@ def handle_message(msg): ciphertext = msg.get_payload().decode("base64") plaintext = rsa.private_decrypt(ciphertext, RSA.pkcs1_oaep_padding) client_addr = find_client_addr(plaintext) + log(u"registering %s" % safe_str(fac.format_addr(client_addr))) fac.put_reg(FACILITATOR_ADDR, client_addr) def imap_loop(imap): @@ -204,7 +237,24 @@ def imap_loop(imap): time.sleep(POLL_INTERVAL) -if options.debug: +if options.log_filename: + options.log_file = open(options.log_filename, "a") + # Send error tracebacks to the log. + sys.stderr = options.log_file +else: + options.log_file = sys.stdout + +if options.daemonize: + log(u"daemonizing") + pid = os.fork() + if pid != 0: + if options.pid_filename: + f = open(options.pid_filename, "w") + print >> f, pid + f.close() + sys.exit(0) + +if options.imaplib_debug: imaplib.Debug = 4 ca_certs_file = tempfile.NamedTemporaryFile(prefix="facilitator-email-poller-", suffix=".crt", delete=True) @@ -226,9 +276,17 @@ if pubkey_digest != PUBKEY_SHA1: raise ValueError("Public key does not match pin: got %s but expected %s" % (pubkey_digest.encode("hex"), PUBKEY_SHA1.encode("hex"))) +pre_debug = imap.debug +if options.safe_logging: + # Don't log the login call without --unsafe-logging because it contains a + # secret password. + imap.debug = 0 +log(u"logging in as %s" % options.email_addr) imap.login(options.email_addr, email_password) +imap.debug = pre_debug imap_loop(imap) +log(u"closing") imap.close() imap.logout()

1 0

[flashproxy/master] Add init script for facilitator-email-poller.
by dcf＠torproject.org 28 Sep '12

28 Sep '12

commit 0aca7ce3dc14b28f58806e47f6ac3665734f0931 Author: David Fifield <david(a)bamsoftware.com> Date: Wed Sep 19 16:55:10 2012 -0700 Add init script for facilitator-email-poller. --- facilitator/Makefile | 2 +- facilitator/init.d/facilitator-email-poller | 121 +++++++++++++++++++++++++++ 2 files changed, 122 insertions(+), 1 deletions(-) diff --git a/facilitator/Makefile b/facilitator/Makefile index effa583..14d7807 100644 --- a/facilitator/Makefile +++ b/facilitator/Makefile @@ -7,7 +7,7 @@ all: install: mkdir -p $(BINDIR) cp -f facilitator facilitator-email-poller facilitator.cgi fac.py $(BINDIR) - cp -f init.d/facilitator /etc/init.d/ + cp -f init.d/facilitator init.d/facilitator-email-poller /etc/init.d/ clean: rm -f *.pyc diff --git a/facilitator/init.d/facilitator-email-poller b/facilitator/init.d/facilitator-email-poller new file mode 100755 index 0000000..94fb0a0 --- /dev/null +++ b/facilitator/init.d/facilitator-email-poller @@ -0,0 +1,121 @@ +#! /bin/sh +### BEGIN INIT INFO +# Provides: facilitator-email-poller +# Required-Start: $remote_fs $syslog +# Required-Stop: $remote_fs $syslog +# Default-Start: 2 3 4 5 +# Default-Stop: 0 1 6 +# Short-Description: Flash proxy email rendezvous poller +# Description: Debian init script for the flash proxy email rendezvous poller. +### END INIT INFO +# +# Author: David Fifield <david(a)bamsoftware.com> +# + +# Based on /etc/init.d/skeleton from Debian 6. + +# The relay must support the websocket pluggable transport. +RELAY=tor1.bamsoftware.com:9901 + +PATH=/sbin:/usr/sbin:/bin:/usr/bin +DESC="Flash proxy email rendezvous poller" +NAME=facilitator-email-poller +PIDFILE=/var/run/$NAME.pid +LOGFILE=/var/log/$NAME.log +CONFDIR=/etc/flashproxy +DAEMON=/usr/local/bin/$NAME +DAEMON_ARGS="--pass $CONFDIR/reg-email.pass --key $CONFDIR/reg-email.key --log $LOGFILE --pidfile $PIDFILE" +SCRIPTNAME=/etc/init.d/$NAME + +# Exit if the package is not installed +[ -x "$DAEMON" ] || exit 0 + +. /lib/init/vars.sh +. /lib/lsb/init-functions + +# +# Function that starts the daemon/service +# +do_start() +{ + # Return + # 0 if daemon has been started + # 1 if daemon was already running + # 2 if daemon could not be started + start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON --test > /dev/null \ + || return 1 + start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON -- \ + $DAEMON_ARGS \ + || return 2 +} + +# +# Function that stops the daemon/service +# +do_stop() +{ + # Return + # 0 if daemon has been stopped + # 1 if daemon was already stopped + # 2 if daemon could not be stopped + # other if a failure occurred + start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE + RETVAL="$?" + [ "$RETVAL" = 2 ] && return 2 + # Wait for children to finish too if this is a daemon that forks + # and if the daemon is only ever run from this initscript. + # If the above conditions are not satisfied then add some other code + # that waits for the process to drop all resources that could be + # needed by services started subsequently. A last resort is to + # sleep for some time. + start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --exec $DAEMON + [ "$?" = 2 ] && return 2 + rm -f $PIDFILE + return "$RETVAL" +} + +case "$1" in + start) + [ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME" + do_start + case "$?" in + 0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;; + 2) [ "$VERBOSE" != no ] && log_end_msg 1 ;; + esac + ;; + stop) + [ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME" + do_stop + case "$?" in + 0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;; + 2) [ "$VERBOSE" != no ] && log_end_msg 1 ;; + esac + ;; + status) + status_of_proc "$DAEMON" "$NAME" && exit 0 || exit $? + ;; + restart|force-reload) + log_daemon_msg "Restarting $DESC" "$NAME" + do_stop + case "$?" in + 0|1) + do_start + case "$?" in + 0) log_end_msg 0 ;; + 1) log_end_msg 1 ;; # Old process is still running + *) log_end_msg 1 ;; # Failed to start + esac + ;; + *) + # Failed to stop + log_end_msg 1 + ;; + esac + ;; + *) + echo "Usage: $SCRIPTNAME {start|stop|status|restart|force-reload}" >&2 + exit 3 + ;; +esac + +:

1 0

[flashproxy/master] Add email poller to facilitator setup docs.
by dcf＠torproject.org 28 Sep '12

28 Sep '12

commit 8b405f90d5f8905ea08794dbf569f1bc8faf5b3c Author: David Fifield <david(a)bamsoftware.com> Date: Wed Sep 19 17:17:43 2012 -0700 Add email poller to facilitator setup docs. --- doc/facilitator-howto.txt | 64 +++++++++++++++++++++++++++------- facilitator/facilitator-email-poller | 4 ++ flashproxy-reg-email | 4 +- 3 files changed, 57 insertions(+), 15 deletions(-) diff --git a/doc/facilitator-howto.txt b/doc/facilitator-howto.txt index 560eeaf..5157659 100644 --- a/doc/facilitator-howto.txt +++ b/doc/facilitator-howto.txt @@ -3,16 +3,27 @@ We will use the domain name tor-facilitator.example.com. == Overview -The facilitator consists of three parts: an HTTP server, a CGI program, -and a backend. The HTTP server is responsible for speaking TLS and -invoking the CGI program. The CGI program receives client registrations -and proxy requests for clients, parses them, and forwards them to the -backend. The backend is stateful and is responsible for assigning -clients to proxies and remembering client registrations. - -We use Apache 2 as the HTTP server. The CGI script is facilitator.cgi. -The backend is facilitator. fac.py is a Python module containing code -common to facilitator.cgi and facilitator. +The facilitator consists of a backend server that is essentially a +dynamic database of client addresses, as well as helper programs that +receive client registrations from the Internet over various means and +pass them to the backend. There are two supported helper rendezvous +methods: HTTP and email. + +The HTTP rendezvous uses an HTTP server and a CGI program. The HTTP +server is responsible for speaking TLS and invoking the CGI program. The +CGI program receives client registrations and proxy requests for +clients, parses them, and forwards them to the backend. We use Apache 2 +as the HTTP server. The CGI script is facilitator.cgi. The backend is +facilitator. + +The email rendezvous uses the helper program facilitator-email-poller. +Clients use the flashproxy-reg-email program to send an encrypted +message to a Gmail address. The poller constantly checks for new +messages, decrypts and deletes them, and forwards the registrations to +the facilitator. + +fac.py is a Python module containing code common to the various +facilitator programs. == Basic and security setup @@ -88,12 +99,14 @@ Restart servers. # cd flashproxy/facilitator # make install -This installs facilitator.cgi, facilitator, and fac.py to -/usr/local/bin. It also installs a System V init file to -/etc/init.d/facilitator. +This installs facilitator.cgi, facilitator, facilitator-email-poller, +and fac.py to /usr/local/bin. It also installs System V init files to +/etc/init.d/. # update-rc.d facilitator defaults # /etc/init.d/facilitator start + # update-rc.d facilitator-email-poller defaults + # /etc/init.d/facilitator-email-poller start == HTTP server setup @@ -149,3 +162,28 @@ Copy the new tor-facilitator.pem to the facilitator server as /etc/apache2/tor-facilitator.pem. # /etc/init.d/apache2 restart + +=== Email poller setup + +The facilitator-email-poller program requires a private RSA key (used to +decrypt encrypted client registrations), and a password that is used to +log in to the designated Gmail account. See the file gmail-setup.txt for +instructions on setting up a Gmail account. After you've set up the +account and have the password, save it to a file reg-email.pass and make +it not readable or writable by anyone but its owner. + + # chmod 600 /etc/flashproxy/reg-email.pass + +You need an RSA keypair because all client registrations over email are +encrypted. + + # openssl genrsa /etc/flashproxy/reg-email.key 2048 + # chmod 600 /etc/flashproxy/reg-email.key + # openssl rsa -pubout < /etc/flashproxy/reg-email.key > reg-email.pub + +You will have to edit flashproxy-reg-email and copy the contents of +reg-email.pub into the appropriate place. + +Install reg-email.key and reg-email.pass to /etc/flashproxy to match +what the init scritp expects, or else use the --key and --pass options +if you have them stored in another place. diff --git a/facilitator/facilitator-email-poller b/facilitator/facilitator-email-poller index 42bf2dc..77f81e0 100755 --- a/facilitator/facilitator-email-poller +++ b/facilitator/facilitator-email-poller @@ -58,6 +58,10 @@ A4GBAFjOKer89961zgK5F7WF0bnj4JXMJTENAKaSbn+2kmOeUJXRmm/kEd5jhW6Y # hashing the public key, not the entire certificate. PUBKEY_SHA1 = "5d97e1ec007e48c1f36e736e652eeaf2184697c3".decode("hex") +# Generating an RSA keypair for use by this program: +# openssl genrsa reg-email 2048 +# chmod 600 reg-email + LOG_DATE_FORMAT = "%Y-%m-%d %H:%M:%S" class options(object): diff --git a/flashproxy-reg-email b/flashproxy-reg-email index d919de5..cdac964 100755 --- a/flashproxy-reg-email +++ b/flashproxy-reg-email @@ -62,8 +62,8 @@ A4GBAFjOKer89961zgK5F7WF0bnj4JXMJTENAKaSbn+2kmOeUJXRmm/kEd5jhW6Y PUBKEY_SHA1 = "e341556ff3fd18e155ce30971fc93e740aa4b185".decode("hex") # Registrations are encrypted with this public key before being emailed. Only -# the facilitator operators should have the corresponding private key. -# openssl genrsa reg-email 2048 +# the facilitator operators should have the corresponding private key. Given a +# private key in reg-email, get the public key like this: # openssl rsa -pubout < reg-email > reg-email.pub FACILITATOR_PUBKEY_PEM = """\ -----BEGIN PUBLIC KEY-----

1 0