January 2013 - tor-commits - lists.torproject.org

[flashproxy/master] Limit sent WebSocket messages to 1500 bytes.
by dcf＠torproject.org 30 Jan '13

30 Jan '13

commit 2f1243f897318e5b731d9e520d36b8ad37929fc0 Author: David Fifield <david(a)bamsoftware.com> Date: Sun Nov 11 18:50:19 2012 -0800 Limit sent WebSocket messages to 1500 bytes. --- websocket-transport/websocket-client.go | 75 +++++++++++++++++++++++++++--- 1 files changed, 67 insertions(+), 8 deletions(-) diff --git a/websocket-transport/websocket-client.go b/websocket-transport/websocket-client.go index 5c1c882..f8ae8ef 100644 --- a/websocket-transport/websocket-client.go +++ b/websocket-transport/websocket-client.go @@ -11,26 +11,83 @@ import ( ) const socksTimeout = 2 +const bufSiz = 1500 func logDebug(format string, v ...interface{}) { fmt.Fprintf(os.Stderr, format+"\n", v...) } -func proxy(local *net.TCPConn, ws *websocket.Conn) error { +func proxy(local *net.TCPConn, ws *websocket.Conn) { + var localToWs chan bool + var wsToLocal chan bool + // Local-to-WebSocket read loop. + localToWs = make(chan bool, 1) go func() { - n, err := io.Copy(ws, local) - logDebug("end local-to-WebSocket %d %s", n, err) + buf := make([]byte, bufSiz) + var err error + for { + n, er := local.Read(buf[:]) + if n > 0 { + ew := websocket.Message.Send(ws, buf[:n]) + if ew != nil { + err = ew + break + } + } + if er != nil { + err = er + break + } + } + if err != nil && err != io.EOF { + logDebug("%s", err) + } + local.CloseRead() + ws.Close() + + localToWs <- true }() // WebSocket-to-local read loop. + wsToLocal = make(chan bool, 1) go func() { - n, err := io.Copy(local, ws) - logDebug("end WebSocket-to-local %d %s", n, err) + var buf []byte + var err error + for { + er := websocket.Message.Receive(ws, &buf) + if er != nil { + err = er + break + } + n, ew := local.Write(buf) + if ew != nil { + err = ew + break + } + if n != len(buf) { + err = io.ErrShortWrite + break + } + } + if err != nil && err != io.EOF { + logDebug("%s", err) + } + local.CloseWrite() + ws.Close() + + wsToLocal <- true }() - select {} - return nil + // Select twice, once for each read loop. + select { + case <-localToWs: + case <-wsToLocal: + } + select { + case <-localToWs: + case <-wsToLocal: + } } func handleConnection(conn *net.TCPConn) error { @@ -64,7 +121,9 @@ func handleConnection(conn *net.TCPConn) error { sendSocks4aResponseGranted(conn, destAddr) - return proxy(conn, ws) + proxy(conn, ws) + + return nil } func socksAcceptLoop(ln *net.TCPListener) error {

1 0

[flashproxy/master] Use the official sync.WaitGroup to wait for read loops to finish.
by dcf＠torproject.org 30 Jan '13

30 Jan '13

commit f61c5d1ead3eb9551b87d014dd175948ed27caba Author: David Fifield <david(a)bamsoftware.com> Date: Sun Nov 11 20:14:46 2012 -0800 Use the official sync.WaitGroup to wait for read loops to finish. --- websocket-transport/websocket-client.go | 14 +++++++------- 1 files changed, 7 insertions(+), 7 deletions(-) diff --git a/websocket-transport/websocket-client.go b/websocket-transport/websocket-client.go index 7205517..7e483f6 100644 --- a/websocket-transport/websocket-client.go +++ b/websocket-transport/websocket-client.go @@ -9,6 +9,7 @@ import ( "net/url" "os" "os/signal" + "sync" "time" ) @@ -24,7 +25,9 @@ func logDebug(format string, v ...interface{}) { } func proxy(local *net.TCPConn, ws *websocket.Conn) { - finishedChan := make(chan int) + var wg sync.WaitGroup + + wg.Add(2) // Local-to-WebSocket read loop. go func() { @@ -50,7 +53,7 @@ func proxy(local *net.TCPConn, ws *websocket.Conn) { local.CloseRead() ws.Close() - finishedChan <- 1 + wg.Done() }() // WebSocket-to-local read loop. @@ -79,13 +82,10 @@ func proxy(local *net.TCPConn, ws *websocket.Conn) { local.CloseWrite() ws.Close() - finishedChan <- 1 + wg.Done() }() - // Wait for both read loops to finish. - for i := 0; i < 2; i++ { - <-finishedChan - } + wg.Wait() } func handleConnection(conn *net.TCPConn) error {

1 0

[flashproxy/master] Add a --socks option to override port auto-selection.
by dcf＠torproject.org 30 Jan '13

30 Jan '13

commit b03e42ce9c1de0521f0b098fe8809568faf7e19d Author: David Fifield <david(a)bamsoftware.com> Date: Sun Nov 11 19:54:40 2012 -0800 Add a --socks option to override port auto-selection. --- websocket-transport/websocket-client.go | 12 +++++++++++- 1 files changed, 11 insertions(+), 1 deletions(-) diff --git a/websocket-transport/websocket-client.go b/websocket-transport/websocket-client.go index fcb9767..7205517 100644 --- a/websocket-transport/websocket-client.go +++ b/websocket-transport/websocket-client.go @@ -2,6 +2,7 @@ package main import ( "code.google.com/p/go.net/websocket" + "flag" "fmt" "io" "net" @@ -164,7 +165,16 @@ func startListener(addrStr string) (*net.TCPListener, error) { func main() { const ptMethodName = "websocket" - var socksAddrStrs = [...]string{"127.0.0.1:0", "[::1]:0"} + var defaultSocksAddrStrs = []string{"127.0.0.1:0", "[::1]:0"} + var socksAddrStrs []string + + var socksArg = flag.String("socks", "", "address on which to listen for SOCKS connections") + flag.Parse() + if *socksArg != "" { + socksAddrStrs = []string{*socksArg} + } else { + socksAddrStrs = defaultSocksAddrStrs + } ptClientSetup([]string{ptMethodName})

1 0

[flashproxy/master] Use a simpler means of waiting for read loops to end.
by dcf＠torproject.org 30 Jan '13

30 Jan '13

commit fd2f3d523bf5a6f20fdfbb9fe7ed8b91bc7f906d Author: David Fifield <david(a)bamsoftware.com> Date: Sun Nov 11 19:39:28 2012 -0800 Use a simpler means of waiting for read loops to end. --- websocket-transport/websocket-client.go | 20 ++++++-------------- 1 files changed, 6 insertions(+), 14 deletions(-) diff --git a/websocket-transport/websocket-client.go b/websocket-transport/websocket-client.go index 6cce020..fcb9767 100644 --- a/websocket-transport/websocket-client.go +++ b/websocket-transport/websocket-client.go @@ -23,11 +23,9 @@ func logDebug(format string, v ...interface{}) { } func proxy(local *net.TCPConn, ws *websocket.Conn) { - var localToWs chan bool - var wsToLocal chan bool + finishedChan := make(chan int) // Local-to-WebSocket read loop. - localToWs = make(chan bool, 1) go func() { buf := make([]byte, bufSiz) var err error @@ -51,11 +49,10 @@ func proxy(local *net.TCPConn, ws *websocket.Conn) { local.CloseRead() ws.Close() - localToWs <- true + finishedChan <- 1 }() // WebSocket-to-local read loop. - wsToLocal = make(chan bool, 1) go func() { var buf []byte var err error @@ -81,17 +78,12 @@ func proxy(local *net.TCPConn, ws *websocket.Conn) { local.CloseWrite() ws.Close() - wsToLocal <- true + finishedChan <- 1 }() - // Select twice, once for each read loop. - select { - case <-localToWs: - case <-wsToLocal: - } - select { - case <-localToWs: - case <-wsToLocal: + // Wait for both read loops to finish. + for i := 0; i < 2; i++ { + <-finishedChan } }

1 0

[flashproxy/master] Add ptclient shell script to run a managed transport from the command line.
by dcf＠torproject.org 30 Jan '13

30 Jan '13

commit 8101833b81fdf42bb0a6f4dc33891059e365807a Author: David Fifield <david(a)bamsoftware.com> Date: Sun Nov 11 20:15:37 2012 -0800 Add ptclient shell script to run a managed transport from the command line. ./ptclient ./websocket-client --socks=:5000 --- websocket-transport/ptclient | 8 ++++++++ 1 files changed, 8 insertions(+), 0 deletions(-) diff --git a/websocket-transport/ptclient b/websocket-transport/ptclient new file mode 100755 index 0000000..578c4ba --- /dev/null +++ b/websocket-transport/ptclient @@ -0,0 +1,8 @@ +#!/bin/sh + +# Fakes a Tor pluggable transports client environment. + +export TOR_PT_MANAGED_TRANSPORT_VER="1" +export TOR_PT_CLIENT_TRANSPORTS="*" + +exec $@

1 0

[flashproxy/master] Add some websocket buffering links.
by dcf＠torproject.org 30 Jan '13

30 Jan '13

commit b747fdcc57724bb015d23a6b280ca8e74d4a65ac Author: David Fifield <david(a)bamsoftware.com> Date: Sat Nov 24 21:11:47 2012 -0800 Add some websocket buffering links. --- websocket-transport/README | 14 ++++++++++++++ 1 files changed, 14 insertions(+), 0 deletions(-) diff --git a/websocket-transport/README b/websocket-transport/README index 2cb9b85..4d813f4 100644 --- a/websocket-transport/README +++ b/websocket-transport/README @@ -1,3 +1,17 @@ ClientTransportPlugin websocket exec ./websocket-client Bridge websocket tor1.bamsoftware.com:9901 UseBridges 1 + +"Denial of Service Protection in Go HTTP Servers" +https://code.google.com/p/go/issues/detail?id=2093 + +"go.websocket: Read/Copy fail with long frames" +https://code.google.com/p/go/issues/detail?id=2134 + +http://golang.org/pkg/net/textproto/#pkg-bugs +"To let callers manage exposure to denial of service attacks, Reader +should allow them to set and reset a limit on the number of bytes read +from the connection." + +"websocket.Dial doesn't limit response header length as http.Get does" +https://groups.google.com/forum/?fromgroups=#!topic/golang-nuts/2Tge6U8-QYI

1 0

[flashproxy/master] Bail out sooner in ptGetClientTransports loop.
by dcf＠torproject.org 30 Jan '13

30 Jan '13

commit 357759d1b3b476f34770e8cae8b0ee505a9fd0b6 Author: David Fifield <david(a)bamsoftware.com> Date: Sun Nov 25 10:55:35 2012 -0800 Bail out sooner in ptGetClientTransports loop. --- websocket-transport/pt.go | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/websocket-transport/pt.go b/websocket-transport/pt.go index 9eaed84..c3fc2cb 100644 --- a/websocket-transport/pt.go +++ b/websocket-transport/pt.go @@ -74,6 +74,7 @@ func ptGetClientTransports(supported []string) []string { for _, methodName := range supported { if requested == methodName { result = append(result, methodName) + break } } }

1 0

[flashproxy/master] Factor out abort on missing environment variable.
by dcf＠torproject.org 30 Jan '13

30 Jan '13

commit 996072d9c335542cda7ac389f732a4ec6873ff79 Author: David Fifield <david(a)bamsoftware.com> Date: Sun Nov 25 19:03:39 2012 -0800 Factor out abort on missing environment variable. --- websocket-transport/pt.go | 17 +++++++++++------ 1 files changed, 11 insertions(+), 6 deletions(-) diff --git a/websocket-transport/pt.go b/websocket-transport/pt.go index c3fc2cb..686cc76 100644 --- a/websocket-transport/pt.go +++ b/websocket-transport/pt.go @@ -8,6 +8,15 @@ import ( "strings" ) +// Abort with an ENV-ERROR if the environment variable isn't set. +func getenvRequired(key string) string { + value := os.Getenv(key) + if value == "" { + ptEnvError(fmt.Sprintf("no %s environment variable", key)) + } + return value +} + // Escape a string so it contains no byte values over 127 and doesn't contain // any of the characters '\x00', '\n', or '\\'. func escape(s string) string { @@ -52,7 +61,7 @@ func ptCmethodError(methodName, msg string) { func ptGetManagedTransportVer() string { const transportVersion = "1" - for _, offered := range strings.Split(os.Getenv("TOR_PT_MANAGED_TRANSPORT_VER"), ",") { + for _, offered := range strings.Split(getenvRequired("TOR_PT_MANAGED_TRANSPORT_VER"), ",") { if offered == transportVersion { return offered } @@ -61,14 +70,10 @@ func ptGetManagedTransportVer() string { } func ptGetClientTransports(supported []string) []string { - clientTransports := os.Getenv("TOR_PT_CLIENT_TRANSPORTS") - if clientTransports == "" { - ptEnvError("no TOR_PT_CLIENT_TRANSPORTS environment variable") - } + clientTransports := getenvRequired("TOR_PT_CLIENT_TRANSPORTS") if clientTransports == "*" { return supported } - result := make([]string, 0) for _, requested := range strings.Split(clientTransports, ",") { for _, methodName := range supported {

1 0

[flashproxy/master] Add server pluggable transports functions.
by dcf＠torproject.org 30 Jan '13

30 Jan '13

commit 1854f66a59942347b5d3c66bbe2d6260d37bb075 Author: David Fifield <david(a)bamsoftware.com> Date: Sun Nov 25 19:04:01 2012 -0800 Add server pluggable transports functions. --- websocket-transport/pt.go | 116 +++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 116 insertions(+), 0 deletions(-) diff --git a/websocket-transport/pt.go b/websocket-transport/pt.go index 686cc76..e63dd6a 100644 --- a/websocket-transport/pt.go +++ b/websocket-transport/pt.go @@ -110,3 +110,119 @@ func ptClientSetup(methodNames []string) []string { return methods } + +func ptSmethodError(methodName, msg string) { + ptLine("SMETHOD-ERROR", methodName, msg) + os.Exit(1) +} + +func ptSmethod(name string, addr net.Addr) { + ptLine("SMETHOD", name, addr.String()) +} + +func ptSmethodsDone() { + ptLine("SMETHODS", "DONE") +} + +func resolveBindAddr(bindAddr string) (*net.TCPAddr, error) { + addr, err := net.ResolveTCPAddr("tcp", bindAddr) + if err == nil { + return addr, nil + } + // Before the fixing of bug #7011, tor doesn't put brackets around IPv6 + // addresses. Split after the last colon, assuming it is a port + // separator, and try adding the brackets. + parts := strings.Split(bindAddr, ":") + if len(parts) <= 2 { + return nil, err + } + bindAddr = "[" + strings.Join(parts[:len(parts)-1], ":") + "]:" + parts[len(parts)-1] + return net.ResolveTCPAddr("tcp", bindAddr) +} + +type ptBindAddr struct { + MethodName string + Addr *net.TCPAddr +} + +func filterBindAddrs(addrs []ptBindAddr, supported []string) []ptBindAddr { + var result []ptBindAddr + + for _, ba := range addrs { + for _, methodName := range supported { + if ba.MethodName == methodName { + result = append(result, ba) + break + } + } + } + + return result +} + +// Return a map from method names to bind addresses. The map is the contents of +// TOR_PT_SERVER_BINDADDR, with keys filtered by TOR_PT_SERVER_TRANSPORTS, and +// further filtered by methods that we know. +func ptGetServerBindAddrs(supported []string) []ptBindAddr { + var result []ptBindAddr + + // Get the list of all requested bindaddrs. + var serverBindAddr = getenvRequired("TOR_PT_SERVER_BINDADDR") + for _, spec := range strings.Split(serverBindAddr, ",") { + var bindAddr ptBindAddr + + parts := strings.SplitN(spec, "-", 2) + if len(parts) != 2 { + ptEnvError(fmt.Sprintf("TOR_PT_SERVER_BINDADDR: %q: doesn't contain \"-\"", spec)) + } + bindAddr.MethodName = parts[0] + addr, err := resolveBindAddr(parts[1]) + if err != nil { + ptEnvError(fmt.Sprintf("TOR_PT_SERVER_BINDADDR: %q: %s", spec, err.Error())) + } + bindAddr.Addr = addr + result = append(result, bindAddr) + } + + // Filter by TOR_PT_SERVER_TRANSPORTS. + serverTransports := getenvRequired("TOR_PT_SERVER_TRANSPORTS") + if serverTransports != "*" { + result = filterBindAddrs(result, strings.Split(serverTransports, ",")) + } + + // Finally filter by what we understand. + result = filterBindAddrs(result, supported) + + return result +} + +type ptServerInfo struct { + BindAddrs []ptBindAddr + OrAddr *net.TCPAddr +} + +func ptServerSetup(methodNames []string) ptServerInfo { + var info ptServerInfo + var err error + + ver := ptGetManagedTransportVer() + if ver == "" { + ptVersionError("no-version") + } else { + ptLine("VERSION", ver) + } + + var orPort = getenvRequired("TOR_PT_ORPORT") + info.OrAddr, err = net.ResolveTCPAddr("tcp", orPort) + if err != nil { + ptEnvError(fmt.Sprintf("cannot resolve TOR_PT_ORPORT %q: %s", orPort, err.Error())) + } + + info.BindAddrs = ptGetServerBindAddrs(methodNames) + if len(info.BindAddrs) == 0 { + ptSmethodsDone() + os.Exit(1) + } + + return info +}

1 0

[flashproxy/master] Add ptserver to fake a pluggable transports server environment.
by dcf＠torproject.org 30 Jan '13

30 Jan '13

commit 05ec772527b481c96adbeb468ba5cf36e2bb9b6f Author: David Fifield <david(a)bamsoftware.com> Date: Sun Nov 25 19:17:24 2012 -0800 Add ptserver to fake a pluggable transports server environment. --- websocket-transport/ptserver | 10 ++++++++++ 1 files changed, 10 insertions(+), 0 deletions(-) diff --git a/websocket-transport/ptserver b/websocket-transport/ptserver new file mode 100755 index 0000000..5b74112 --- /dev/null +++ b/websocket-transport/ptserver @@ -0,0 +1,10 @@ +#!/bin/sh + +# Fakes a Tor pluggable transports server environment. + +export TOR_PT_MANAGED_TRANSPORT_VER="1" +export TOR_PT_SERVER_TRANSPORTS="*" +export TOR_PT_SERVER_BINDADDR="websocket-127.0.0.1:0" +export TOR_PT_ORPORT="127.0.0.1:9001" + +exec $@

1 0