October 2013 - tor-commits - lists.torproject.org

[flashproxy/master] Ticket number for source code rearrangement.
by dcf＠torproject.org 14 Oct '13

14 Oct '13

commit fac9c32e867c346f2dc4642434ed0af5fe857a01 Author: David Fifield <david(a)bamsoftware.com> Date: Mon Oct 14 12:40:56 2013 -0700 Ticket number for source code rearrangement. --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 1b41ad9..309de8e 100644 --- a/ChangeLog +++ b/ChangeLog @@ -30,6 +30,7 @@ is now under facilitator/doc. The App Engine source code is under facilitator/appengine. The directory containing other ways to use the proxy moved from modules to proxy/modules. Patch by Ximin Luo. + Fixed bug 9668. Changes in version 1.3 o Added a new observed Google public key pin.

1 0

[tor-browser-bundle/master] Bump versions and URLs for TBB 3.0beta1.
by mikeperry＠torproject.org 14 Oct '13

14 Oct '13

commit 019c4c308d612f680fe98ba11ec452b788dd5e10 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Fri Oct 11 17:28:11 2013 -0700 Bump versions and URLs for TBB 3.0beta1. --- gitian/fetch-inputs.sh | 4 ++-- gitian/versions | 16 +++++++++------- 2 files changed, 11 insertions(+), 9 deletions(-) diff --git a/gitian/fetch-inputs.sh b/gitian/fetch-inputs.sh index cce3331..2d345ce 100755 --- a/gitian/fetch-inputs.sh +++ b/gitian/fetch-inputs.sh @@ -156,8 +156,8 @@ do done cd .. -# Noscript and PDF.JS are magikal and special: -wget -N https://addons.mozilla.org/firefox/downloads/file/224880/${NOSCRIPT_PACKAGE} +# NoScript and PDF.JS are magikal and special: +wget -N ${NOSCRIPT_URL} wget -N https://addons.mozilla.org/firefox/downloads/file/201180/${PDFJS_PACKAGE} # So is mingw: diff --git a/gitian/versions b/gitian/versions index 8f3585e..731fb7c 100755 --- a/gitian/versions +++ b/gitian/versions @@ -1,13 +1,13 @@ -TORBROWSER_VERSION=3.0-alpha-4 +TORBROWSER_VERSION=3.0-beta-1 BUNDLE_LOCALES="de es-ES fa fr it ko nl pl pt-PT ru vi zh-CN" VERIFY_TAGS=1 -TORBROWSER_TAG=tor-browser-17.0.9esr-3.0alpha4-build2 +TORBROWSER_TAG=tor-browser-17.0.9esr-3.0beta1-build1 TOR_TAG=tor-0.2.4.17-rc TORLAUNCHER_TAG=0.2.3-alpha -TORBUTTON_TAG=1.6.2.1 -HTTPSE_TAG=3.3.1 +TORBUTTON_TAG=1.6.3 +HTTPSE_TAG=3.4.2 NSIS_TAG=v0.1 ZLIB_TAG=v1.2.8 LIBEVENT_TAG=release-2.0.21-stable @@ -22,7 +22,7 @@ GCC_VER=4.6.3 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz -NOSCRIPT_PACKAGE=noscript_security_suite-2.6.7.1-sm+fn+fx.xpk +NOSCRIPT_PACKAGE=noscript_security_suite-2.6.8.2-fx+fn+sm.xpi PDFJS_PACKAGE=pdf_viewer-0.8.1-sm+fx+an.xpi TOOLCHAIN4_PACKAGE=multiarch-darwin11-cctools127.2-gcc42-5666.3-llvmgcc42-2336.1-Linux-120724.tar.xz OSXSDK_PACKAGE=apple-uni-sdk-10.6_20110407-0.flosoft1_i386.deb @@ -31,17 +31,19 @@ MSVCR100_PACKAGE=msvcr100.dll BINUTILS_PACKAGE=binutils-${BINUTILS_VER}.tar.bz2 GCC_PACKAGE=gcc-${GCC_VER}.tar.bz2 -# Hashes for things with weak sigs or no sigs +# Hashes for packages with weak sigs or no sigs OPENSSL_HASH=f74f15e8c8ff11aa3d5bb5f276d202ec18d7246e95f961db76054199c69c1ae3 OSXSDK_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc TOOLCHAIN4_HASH=65c1b2d302358a6b95a26c6828a66908a199276193bb0b268f2dcc1a997731e9 -NOSCRIPT_HASH=e9ee8f45b0b025236c5e04e270edeb05de6ed8a73822c74d7122a2ade3d25f33 +NOSCRIPT_HASH=52b309f2e5ca1bee4d0f97cbb342fdac3be6a447c35f744a90348df55eea635f PDFJS_HASH=2e3e6811f5294b24aafeba44e8206ddc81fb15e5934e5166a2c7df3a4405020b MINGW_HASH=457f11d29f6e95425d190711a73955fa54a98a2113ce2c2bfd76291be71e3e2b MSVCR100_HASH=1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067 +## Non-git package URLs OPENSSL_URL=https://www.openssl.org/source/${OPENSSL_PACKAGE} TOOLCHAIN4_URL=https://mingw-and-ndk.googlecode.com/files/${TOOLCHAIN4_PACK… OSXSDK_URL=https://launchpad.net/~flosoft/+archive/cross-apple/+files/${OSX… BINUTILS_URL=https://ftp.gnu.org/gnu/binutils/${BINUTILS_PACKAGE} GCC_URL=https://ftp.gnu.org/gnu/gcc/gcc-${GCC_VER}/${GCC_PACKAGE} +NOSCRIPT_URL=https://addons.cdn.mozilla.net/storage/public-staging/722/${NOSCRIPT_PACKAGE}

1 0

[tor-browser-bundle/master] For some reason, Firefox wants an empty Caches directory alongside the profile dir.
by mikeperry＠torproject.org 14 Oct '13

14 Oct '13

commit 956bd6d3bb7f2e80a681e0c42f0a71865d427b1b Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Fri Oct 11 17:27:33 2013 -0700 For some reason, Firefox wants an empty Caches directory alongside the profile dir. --- gitian/descriptors/linux/gitian-bundle.yml | 1 + gitian/descriptors/mac/gitian-bundle.yml | 1 + gitian/descriptors/windows/gitian-bundle.yml | 1 + 3 files changed, 3 insertions(+) diff --git a/gitian/descriptors/linux/gitian-bundle.yml b/gitian/descriptors/linux/gitian-bundle.yml index 115eb6f..1728358 100644 --- a/gitian/descriptors/linux/gitian-bundle.yml +++ b/gitian/descriptors/linux/gitian-bundle.yml @@ -49,6 +49,7 @@ script: | umask 0022 # mkdir -p $OUTDIR/ + mkdir -p tor-browser/Data/Browser/Caches mkdir -p tor-browser/Data/Browser/profile.default/extensions/https-everywhere(a)eff.org mkdir -p tor-browser/Docs/sources/ # diff --git a/gitian/descriptors/mac/gitian-bundle.yml b/gitian/descriptors/mac/gitian-bundle.yml index a4d5835..85df0e7 100644 --- a/gitian/descriptors/mac/gitian-bundle.yml +++ b/gitian/descriptors/mac/gitian-bundle.yml @@ -45,6 +45,7 @@ script: | # mkdir -p $OUTDIR/ mkdir -p TorBrowserBundle.app/Data/Browser/profile.default/extensions/https-everywhere(a)eff.org + mkdir -p TorBrowserBundle.app/Data/Browser/Caches mkdir -p TorBrowserBundle.app/Contents/MacOS/TorBrowser.app/Contents/MacOS/ mkdir -p TorBrowserBundle.app/Docs/sources # diff --git a/gitian/descriptors/windows/gitian-bundle.yml b/gitian/descriptors/windows/gitian-bundle.yml index 0af203f..abe4549 100644 --- a/gitian/descriptors/windows/gitian-bundle.yml +++ b/gitian/descriptors/windows/gitian-bundle.yml @@ -47,6 +47,7 @@ script: | # mkdir -p $OUTDIR/ mkdir -p tbb-windows-installer/"Tor Browser"/Data/Browser/profile.default/extensions/https-everywhere(a)eff.org + mkdir -p tbb-windows-installer/"Tor Browser"/Data/Browser/Caches mkdir -p tbb-windows-installer/"Tor Browser"/Docs/sources # cd tor-launcher

1 0

[tor/master] Merge remote-tracking branch 'asn/bug9651'
by nickm＠torproject.org 14 Oct '13

14 Oct '13

commit 7f2415683a86dcd72270b75c467a6ddc5649a7a8 Merge: a26a579 43b9b51 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Oct 14 11:43:33 2013 -0400 Merge remote-tracking branch 'asn/bug9651' src/or/config.c | 11 +++++++++++ 1 file changed, 11 insertions(+)

1 0

[tor/master] changes file for bug9651
by nickm＠torproject.org 14 Oct '13

14 Oct '13

commit 1129362bd7208413d93f7f8e1b4317883a5c7910 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Oct 14 11:44:20 2013 -0400 changes file for bug9651 --- changes/bug9651 | 3 +++ 1 file changed, 3 insertions(+) diff --git a/changes/bug9651 b/changes/bug9651 new file mode 100644 index 0000000..453fe9a --- /dev/null +++ b/changes/bug9651 @@ -0,0 +1,3 @@ + o Minor features: + - Warn when the Extended ORPort should be set, but it isn't. Resolves + ticket 9651.

1 0

[tor/master] Warn when the Extended ORPort should be on but it's not.
by nickm＠torproject.org 14 Oct '13

14 Oct '13

commit 43b9b5138999f0b8619cc7f90c1b09c1b9aac42c Author: George Kadianakis <desnacked(a)riseup.net> Date: Tue Sep 24 12:30:25 2013 +0100 Warn when the Extended ORPort should be on but it's not. --- src/or/config.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/src/or/config.c b/src/or/config.c index 37b42e8..8f5e544 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -3176,6 +3176,17 @@ options_validate(or_options_t *old_options, or_options_t *options, smartlist_free(options_sl); } + /* If we are a bridge with a pluggable transport proxy but no + Extended ORPort, inform the user that she is missing out. */ + if (server_mode(options) && options->ServerTransportPlugin && + !options->ExtORPort_lines) { + log_notice(LD_CONFIG, "We are a bridge with a pluggable transport " + "proxy but the Extended ORPort is disabled. The " + "Extended ORPort helps Tor communicate with the pluggable " + "transport proxy. Please enable it using the ExtORPort " + "torrc option."); + } + if (options->ConstrainedSockets) { /* If the user wants to constrain socket buffer use, make sure the desired * limit is between MIN|MAX_TCPSOCK_BUFFER in k increments. */

1 0

[doctor/master] Dropping Tonga from checks
by atagar＠torproject.org 14 Oct '13

14 Oct '13

commit 30a40e7014aea5c32658bc2f31bf1f53721c9af1 Author: Damian Johnson <atagar(a)torproject.org> Date: Mon Oct 14 08:34:55 2013 -0700 Dropping Tonga from checks We were downloading Tonga's consensus but not its vote so it would be included in checks for the former but not later. Up side is that this checked that Tonga was up and healthy (still important since it's an authority, even it it doesn't vote). But this is already covered by 'descriptor_checker.py'. This is in response to... https://lists.torproject.org/pipermail/tor-dev/2013-October/005618.html --- consensus_health_checker.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/consensus_health_checker.py b/consensus_health_checker.py index 02149da..8a3a9c9 100755 --- a/consensus_health_checker.py +++ b/consensus_health_checker.py @@ -575,7 +575,7 @@ def _get_documents(label, resource): queries, documents, issues = {}, {}, [] for authority in DIRECTORY_AUTHORITIES.values(): - if label == 'vote' and authority.v3ident is None: + if authority.v3ident is None: continue # not a voting authority queries[authority.nickname] = downloader.query(

1 0

[doctor/master] Skipping initial vote download for non-voting authorities
by atagar＠torproject.org 14 Oct '13

14 Oct '13

commit 1bfbc46b72848adf1bc8c11822bf2a047d9f3f90 Author: Damian Johnson <atagar(a)torproject.org> Date: Mon Oct 14 08:21:45 2013 -0700 Skipping initial vote download for non-voting authorities Huh. Code around this was a little odd, we were trying to download votes from non-voting authorities once then short circuiting on the retry. Perfectly fine, just a little odd. --- consensus_health_checker.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/consensus_health_checker.py b/consensus_health_checker.py index 734c5ea..02149da 100755 --- a/consensus_health_checker.py +++ b/consensus_health_checker.py @@ -575,6 +575,9 @@ def _get_documents(label, resource): queries, documents, issues = {}, {}, [] for authority in DIRECTORY_AUTHORITIES.values(): + if label == 'vote' and authority.v3ident is None: + continue # not a voting authority + queries[authority.nickname] = downloader.query( resource, endpoints = [(authority.address, authority.dir_port)], @@ -585,14 +588,11 @@ def _get_documents(label, resource): try: documents[authority] = query.run()[0] except Exception, exc: - if label == 'vote' and authority in DIRECTORY_AUTHORITIES: + if label == 'vote': # try to download the vote via the other authorities v3ident = DIRECTORY_AUTHORITIES[authority].v3ident - if v3ident is None: - continue # not a voting authority - query = downloader.query( '/tor/status-vote/current/%s' % v3ident, default_params = False,

1 0

[onionoo/master] Fix index.html display bug in Opera.
by karsten＠torproject.org 14 Oct '13

14 Oct '13

commit 7eadc13776c9f6b9ae563796b3d0fa8b7fce6e80 Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Mon Oct 14 11:34:02 2013 +0200 Fix index.html display bug in Opera. rndm says: "There was a bug in the opera browser that misplaced the "returns a x" on each request method. I changed the css from "float:right" to a "position: absolute; right: 0" that does the same. It now looks the same on firefox, chromium and opera." Thanks, rndm! --- web/index.html | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/web/index.html b/web/index.html index 6899c53..d70a112 100644 --- a/web/index.html +++ b/web/index.html @@ -7,7 +7,7 @@ body { font-family: "Open Sans","lucida grande","Segoe UI",arial,verdana, "lucida sans unicode",tahoma,sans-serif; background: #fafafa; font-size: 13px; line-height: 22px; color: #222; } h1 { font-size: 20px; font-weight: normal; text-align: center; } -h3 { color: #7D4698; } +h3 { color: #7D4698; position: relative } a { color: #7D4698; text-decoration: none; font-weight: bold; } ul { list-style: none; padding: 0; margin: 0; } p { margin: 0; padding: 0; } @@ -17,12 +17,13 @@ a[name] { padding: 0; margin: 0; } .box > * { margin-left: 30px; margin-right: 30px; } .box h3 a { visibility: hidden; } .box:hover h3 a { visibility: visible; } -.api-request { border-bottom: 1px solid #eee; } +.api-request { border-bottom: 1px solid #eee; position: relative } .request-url, .request-type, .request-response { padding: 8px 10px; vertical-align: middle } .request-type { color: #57145F; display: inline-block; } .request-url { color: #333; font-size: 18px; } -.request-response { float: right; color: #666; } +.request-response { position: absolute; color: #666; right: 0; } +h3 .request-response { padding: 0 !important; } .api-urls>li:last-child { border-bottom: 0; } .required-true, .required-false, .typeof { display: inline-block; vertical-align: middle; padding: 5px 10px; }

1 0

[flashproxy/master] move appengine and facilitator docs to facilitator subtree
by dcf＠torproject.org 13 Oct '13

13 Oct '13

commit e59943493584cb0c704763eadffb8802c36aebdd Author: Ximin Luo <infinity0(a)gmx.com> Date: Wed Sep 11 17:21:09 2013 +0100 move appengine and facilitator docs to facilitator subtree --- appengine/README | 11 -- appengine/app.yaml | 9 -- appengine/fp-reg.go | 54 --------- doc/appengine-howto.txt | 56 ---------- doc/facilitator-howto.txt | 199 --------------------------------- doc/gmail-setup.txt | 61 ---------- facilitator/appengine/README | 11 ++ facilitator/appengine/app.yaml | 9 ++ facilitator/appengine/fp-reg.go | 54 +++++++++ facilitator/doc/appengine-howto.txt | 56 ++++++++++ facilitator/doc/facilitator-howto.txt | 199 +++++++++++++++++++++++++++++++++ facilitator/doc/gmail-setup.txt | 61 ++++++++++ 12 files changed, 390 insertions(+), 390 deletions(-) diff --git a/appengine/README b/appengine/README deleted file mode 100644 index 00d0611..0000000 --- a/appengine/README +++ /dev/null @@ -1,11 +0,0 @@ -This is the server-side code that runs on Google App Engine for the -"appspot" registration method. - -See doc/appengine-howto.txt for information about setting up an -application. - -To run with the development server: -$ ~/google_appengine/dev_appserver.py appengine/ - -To upload a new version: -$ torify ~/google_appengine/appcfg.py update appengine/ diff --git a/appengine/app.yaml b/appengine/app.yaml deleted file mode 100644 index 3b99ada..0000000 --- a/appengine/app.yaml +++ /dev/null @@ -1,9 +0,0 @@ -application: fp-reg-a -version: 1 -runtime: go -api_version: go1 - -handlers: -- url: /.* - script: _go_app - secure: always diff --git a/appengine/fp-reg.go b/appengine/fp-reg.go deleted file mode 100644 index d4f84c2..0000000 --- a/appengine/fp-reg.go +++ /dev/null @@ -1,54 +0,0 @@ -package fp_reg - -import ( - "io" - "net" - "net/http" - "path" - - "appengine" - "appengine/urlfetch" -) - -const BASE = "https://fp-facilitator.org/reg/" - -func robotsTxtHandler(w http.ResponseWriter, r *http.Request) { - w.Header().Set("Content-Type", "text/plain; charset=utf-8") - w.Write([]byte("User-agent: *\nDisallow:\n")) -} - -func ipHandler(w http.ResponseWriter, r *http.Request) { - remoteAddr := r.RemoteAddr - if net.ParseIP(remoteAddr).To4() == nil { - remoteAddr = "[" + remoteAddr + "]" - } - w.Header().Set("Content-Type", "text/plain; charset=utf-8") - w.Write([]byte(remoteAddr)) -} - -func regHandler(w http.ResponseWriter, r *http.Request) { - dir, blob := path.Split(path.Clean(r.URL.Path)) - if dir != "/reg/" { - http.NotFound(w, r) - return - } - client := urlfetch.Client(appengine.NewContext(r)) - resp, err := client.Get(BASE + blob) - if err != nil { - http.Error(w, err.Error(), http.StatusInternalServerError) - return - } - for key, values := range resp.Header { - for _, value := range values { - w.Header().Add(key, value) - } - } - w.WriteHeader(resp.StatusCode) - io.Copy(w, resp.Body) -} - -func init() { - http.HandleFunc("/robots.txt", robotsTxtHandler) - http.HandleFunc("/ip", ipHandler) - http.HandleFunc("/reg/", regHandler) -} diff --git a/doc/appengine-howto.txt b/doc/appengine-howto.txt deleted file mode 100644 index 44c5324..0000000 --- a/doc/appengine-howto.txt +++ /dev/null @@ -1,56 +0,0 @@ -These are instructions for how to set up a Google App Engine application -to run at appspot.com. - -General links: -https://developers.google.com/appengine/ -https://developers.google.com/appengine/docs/whatisgoogleappengine -https://developers.google.com/appengine/docs/go/gettingstarted/ - -You first need to create a Google account. See gmail-howto.txt for how -to do that. - -Download the SDK: -https://developers.google.com/appengine/docs/go/gettingstarted/devenvironment - -Write your program and app.yaml file: -https://developers.google.com/appengine/docs/go/gettingstarted/helloworld - -When you're ready to upload, log in with your Google account and follow -the directions: -https://appengine.google.com/ -https://developers.google.com/appengine/docs/go/gettingstarted/uploading - -Enter an application ID and create the application. - -Use the appcfg.py program to upload the program. It should look -something like this: - -$ torify ./google_appengine/appcfg.py update myapp/ -07:25 PM Host: appengine.google.com -07:25 PM Application: application-id; version: 1 -07:25 PM -Starting update of app: application-id, version: 1 -07:25 PM Getting current resource limits. -Email: xxx(a)gmail.com -Password for xxx(a)gmail.com: -07:26 PM Scanning files on local disk. -07:26 PM Cloning 2 application files. -07:26 PM Uploading 1 files and blobs. -07:26 PM Uploaded 1 files and blobs -07:26 PM Compilation starting. -07:26 PM Compilation: 1 files left. -07:26 PM Compilation completed. -07:26 PM Starting deployment. -07:26 PM Checking if deployment succeeded. -07:26 PM Deployment successful. -07:26 PM Checking if updated app version is serving. -07:26 PM Completed update of app: application-id, version: 1 - -Uploading the program in this way seems to create the files -~/.appcfg_nag and ~/.appcfg_cookies. Running the update command again -doesn't require you to enter your password again. - -Once logged in, you can disable logging for the application. Click -"Logs" on the left panel. Under "Total Logs Storage", click "Change -Settings". Enter "0" in the "days of logs" box and click "Save -Settings". diff --git a/doc/facilitator-howto.txt b/doc/facilitator-howto.txt deleted file mode 100644 index 8bafce9..0000000 --- a/doc/facilitator-howto.txt +++ /dev/null @@ -1,199 +0,0 @@ -This document describes how to run a flash proxy facilitator on Debian 7. -We will use the domain name fp-facilitator.example.com. - -== Overview - -The facilitator consists of a backend server that is essentially a -dynamic database of client addresses, as well as helper programs that -receive client registrations from the Internet over various means and -pass them to the backend. There are three supported helper rendezvous -methods: HTTP, URL, and email. - -The HTTP rendezvous uses an HTTP server and a CGI program. The HTTP -server is responsible for speaking TLS and invoking the CGI program. The -CGI program receives client registrations and proxy requests for -clients, parses them, and forwards them to the backend. We use Apache 2 -as the HTTP server. The CGI script is facilitator.cgi. The backend is -facilitator. - -The email rendezvous uses the helper program facilitator-email-poller. -Clients use the flashproxy-reg-email program to send an encrypted -message to a Gmail address. The poller constantly checks for new -messages and forwards them to facilitator-reg. - -facilitator-reg is a simple program that forwards its standard input to -a locally running facilitator-reg-daemon process. - -facilitator-reg-daemon accepts connections containing encrypted client -registrations and forwards them to the facilitator. It exists as a -process of its own so that only one program requires access to the -facilitator's private key. - -The URL rendezvous uses the helper program flashproxy-reg-email. The -helper program doesn't actually make a registration; rather, it prints -out a URL which, when retrieved, makes the registration. - -fac.py is a Python module containing code common to the various -facilitator programs. - -== Basic and security setup - -Install some essential packages and configure a firewall. - - # cat >/etc/apt/apt.conf.d/90suggests<<EOF -APT::Install-Recommends "0"; -APT::Install-Suggests "0"; -EOF - # apt-get remove portmap - # apt-get update - # apt-get upgrade - # apt-get install shorewall shorewall6 - -Away from the facilitator, generate an SSH key for authentication: - - $ ssh-keygen -f ~/.ssh/fp-facilitator - $ ssh-copy-id -i ~/.ssh/fp-facilitator.pub root(a)fp-facilitator.example.com - -Then log in and edit /etc/ssh/sshd_config to disable password -authentication: - - PasswordAuthentication no - -Configure the firewall to allow only SSH and HTTPS. - - # cd /etc/shorewall - # cp /usr/share/doc/shorewall/examples/Universal/{interfaces,policy,rules,zones} . - Edit /etc/shorewall/rules: -SECTION NEW -SSH(ACCEPT) net $FW -HTTPS(ACCEPT) net $FW - - # cd /etc/shorewall6 - # cp /usr/share/doc/shorewall6/examples/Universal/{interfaces,policy,rules,zones} . - Edit /etc/shorewall6/rules: -SECTION NEW -SSH(ACCEPT) all $FW -HTTPS(ACCEPT) all $FW - -Edit /etc/default/shorewall and /etc/default/shorewall6 and set - - startup=1 - -Restart servers. - - # /etc/init.d/ssh restart - # /etc/init.d/shorewall start - # /etc/init.d/shorewall6 start - -== Facilitator program installation - -Create the user the daemons will run as. - - # useradd --shell /usr/sbin/nologin --system --home /nonexistent -M facilitator-nobody - -Install the programs. - - # cd - # apt-get install git python-m2crypto make - # git clone https://git.torproject.org/flashproxy.git - # cd flashproxy/facilitator - # make install - -This installs facilitator.cgi, facilitator, facilitator-email-poller, -facilitator-reg-daemon, facilitator-reg, and fac.py to /usr/local/bin. -It also installs System V init files to /etc/init.d/. - -=== Registration daemon setup - -The facilitator-reg-daemon program requires a private RSA key (used to -decrypt encrypted client registrations). - - # mkdir /etc/flashproxy - # openssl genrsa -out /etc/flashproxy/reg-daemon.key 2048 - # chmod 600 /etc/flashproxy/reg-daemon.key - # openssl rsa -pubout < /etc/flashproxy/reg-daemon.key > reg-daemon.pub - -You will have to edit flashproxy-reg-email and copy the contents of -reg-daemon.pub into the appropriate place. - -Install reg-daemon.key /etc/flashproxy to match what the init script -expects. - -=== Init script setup - - # update-rc.d facilitator defaults - # /etc/init.d/facilitator start - # update-rc.d facilitator-reg-daemon defaults - # /etc/init.d/facilitator-reg-daemon start - -== HTTP server setup - -Apache is the web server that runs the CGI program. - - # apt-get install apache2 libapache2-mod-evasive - # a2enmod ssl headers - -Edit /etc/apache2/ports.conf and comment out the port 80 configuration. - - # NameVirtualHost *:80 - # Listen 80 - -Create a new file /etc/apache2/sites-available/fp-facilitator with -these contents: - MaxClients 256 - <VirtualHost *:443> - ServerName fp-facilitator.example.com - DocumentRoot /dev/null - ScriptAliasMatch ^(.*) /usr/local/bin/facilitator.cgi$1 - CustomLog /dev/null common - ErrorLog ${APACHE_LOG_DIR}/error.log - LogLevel warn - SSLEngine on - SSLCertificateFile /etc/apache2/fp-facilitator.pem - SSLCertificateChainFile /etc/apache2/intermediate.pem - Header add Strict-Transport-Security "max-age=15768000" - </VirtualHost> -intermediate.pem is a possible intermediate certificate file provided by -the CA; if you did not get one, then leave off the -SSLCertificateChainFile line. - -Link the configured site into sites-enabled. - # a2ensite fp-facilitator - -=== HTTPS setup - -The HTTP server should serve only over HTTPS and not unencrypted HTTP. -You will need a certificate and private key from a certificate -authority. An article on making a certificate signing request and -getting it signed is here: - http://www.debian-administration.org/articles/284 -This is the basic command to generate a CSR. - $ openssl req -new -nodes -out fp-facilitator.csr.pem -The instructions below assume you have an offline private key -in fp-facilitator.key.pem and a certificate in fp-facilitator.crt.pem. - -Make a file containing both the private key and a certificate. - - $ cat fp-facilitator.key.pem fp-facilitator.crt.pem > fp-facilitator.pem - $ chmod 400 fp-facilitator.pem - -Copy the new fp-facilitator.pem to the facilitator server as -/etc/apache2/fp-facilitator.pem. - - # /etc/init.d/apache2 restart - -=== Email poller setup - -The facilitator-email-poller program requires a password that is used to -log in to the designated Gmail account. See the file gmail-setup.txt for -instructions on setting up a Gmail account. After you've set up the -account and have the password, save it to a file reg-email.pass and make -it not readable or writable by anyone but its owner. - - # chmod 600 /etc/flashproxy/reg-email.pass - -Install reg-email.pass to /etc/flashproxy to match what the init script -expects. - - # update-rc.d facilitator-email-poller defaults - # /etc/init.d/facilitator-email-poller start diff --git a/doc/gmail-setup.txt b/doc/gmail-setup.txt deleted file mode 100644 index b51ce90..0000000 --- a/doc/gmail-setup.txt +++ /dev/null @@ -1,61 +0,0 @@ -These are instructions for setting up a Gmail account for use with the -email-based rendezvous and flashproxy-reg-email. These instructions were -current as of May 2013. - -You may have trouble if you are using Tor to create the account, for two -reasons. The first is that exit nodes are a source of abuse and Google -is more suspicious of them. The second is that Gmail is suspicious and -can lock you out of the account when your IP address is changing. While -setting up the account, use a single node in your torrc ExitNodes -configuration. Choose a U.S. exit node, one with low bandwidth. - -Go to https://mail.google.com/. Allow JavaScript to run (even from -youtube.com; it seems to be necessary). Click the "CREATE AN ACCOUNT" -button. - -Enter the account details. You don't need to fill in "Your current email -address". Enter a mobile phone number for later activation of two-factor -authentication. Solve the captcha. Click "Next Step". You may have to do -a phone SMS verification here. - -At this point the Gmail account is created. If you are pushed into -joining Google+, close everything out and go back to -https://mail.google.com/. - -Log out of the account and then back in again. There will be new text in -the lower right reading "Last account activity". Click "Details" and -turn off the unusual activity alerts. This will keep you from getting -locked out when you come from different IP addresses. At this point you -should remove the temporary ExitNodes configuration from torrc. - -Add a filter to prevent registrations from being marked as spam. Click -on the gear icon and select "Settings". Select "Filters" then "Create a -new filter". For "Has the words" type "in:spam", then "Create filter -with this search". There will be a warning that filters using "in:" will -never match incoming mail; this appears to be false and you can just -click OK. Check "Never send it to Spam" and click "Create filter". - -Enable IMAP. Click the gear icon, then "Settings", then "Forwarding and -POP/IMAP". - * Disable POP - * Enable IMAP - * Auto-Expunge on -Click "Save Changes". - -Enable two-factor authentication. We do this not so much for the -two-factor, but because it allows creating an independent password that -is used only for IMAP and does not have access to the web interface of -Gmail. Click the email address in the upper right, then "Account". Click -"Security". By "2-step verification" click "Edit". Click through until -it lets you set up. The phone number you provided when the account was -created will be automatically filled in. Choose "Text message (SMS)" -then click "Send code". Get your text message, type it in, and hit -"Verify". Uncheck "Trust this computer" on the next screen. Finally -"Confirm". On the following summary page, click "Show backup codes" and -save the codes to encrypted storage. Future codes can be generated at -https://www.google.com/accounts/SmsAuthConfig. - -Still on the 2-step summary page, click "Manage application-specific -passwords". Enter "IMAP" for the name and click "Generate password". -Save the password to encrypted storage. This is the password that will -be used with the --pass option of facilitator-email-poller. diff --git a/facilitator/appengine/README b/facilitator/appengine/README new file mode 100644 index 0000000..00d0611 --- /dev/null +++ b/facilitator/appengine/README @@ -0,0 +1,11 @@ +This is the server-side code that runs on Google App Engine for the +"appspot" registration method. + +See doc/appengine-howto.txt for information about setting up an +application. + +To run with the development server: +$ ~/google_appengine/dev_appserver.py appengine/ + +To upload a new version: +$ torify ~/google_appengine/appcfg.py update appengine/ diff --git a/facilitator/appengine/app.yaml b/facilitator/appengine/app.yaml new file mode 100644 index 0000000..3b99ada --- /dev/null +++ b/facilitator/appengine/app.yaml @@ -0,0 +1,9 @@ +application: fp-reg-a +version: 1 +runtime: go +api_version: go1 + +handlers: +- url: /.* + script: _go_app + secure: always diff --git a/facilitator/appengine/fp-reg.go b/facilitator/appengine/fp-reg.go new file mode 100644 index 0000000..d4f84c2 --- /dev/null +++ b/facilitator/appengine/fp-reg.go @@ -0,0 +1,54 @@ +package fp_reg + +import ( + "io" + "net" + "net/http" + "path" + + "appengine" + "appengine/urlfetch" +) + +const BASE = "https://fp-facilitator.org/reg/" + +func robotsTxtHandler(w http.ResponseWriter, r *http.Request) { + w.Header().Set("Content-Type", "text/plain; charset=utf-8") + w.Write([]byte("User-agent: *\nDisallow:\n")) +} + +func ipHandler(w http.ResponseWriter, r *http.Request) { + remoteAddr := r.RemoteAddr + if net.ParseIP(remoteAddr).To4() == nil { + remoteAddr = "[" + remoteAddr + "]" + } + w.Header().Set("Content-Type", "text/plain; charset=utf-8") + w.Write([]byte(remoteAddr)) +} + +func regHandler(w http.ResponseWriter, r *http.Request) { + dir, blob := path.Split(path.Clean(r.URL.Path)) + if dir != "/reg/" { + http.NotFound(w, r) + return + } + client := urlfetch.Client(appengine.NewContext(r)) + resp, err := client.Get(BASE + blob) + if err != nil { + http.Error(w, err.Error(), http.StatusInternalServerError) + return + } + for key, values := range resp.Header { + for _, value := range values { + w.Header().Add(key, value) + } + } + w.WriteHeader(resp.StatusCode) + io.Copy(w, resp.Body) +} + +func init() { + http.HandleFunc("/robots.txt", robotsTxtHandler) + http.HandleFunc("/ip", ipHandler) + http.HandleFunc("/reg/", regHandler) +} diff --git a/facilitator/doc/appengine-howto.txt b/facilitator/doc/appengine-howto.txt new file mode 100644 index 0000000..44c5324 --- /dev/null +++ b/facilitator/doc/appengine-howto.txt @@ -0,0 +1,56 @@ +These are instructions for how to set up a Google App Engine application +to run at appspot.com. + +General links: +https://developers.google.com/appengine/ +https://developers.google.com/appengine/docs/whatisgoogleappengine +https://developers.google.com/appengine/docs/go/gettingstarted/ + +You first need to create a Google account. See gmail-howto.txt for how +to do that. + +Download the SDK: +https://developers.google.com/appengine/docs/go/gettingstarted/devenvironment + +Write your program and app.yaml file: +https://developers.google.com/appengine/docs/go/gettingstarted/helloworld + +When you're ready to upload, log in with your Google account and follow +the directions: +https://appengine.google.com/ +https://developers.google.com/appengine/docs/go/gettingstarted/uploading + +Enter an application ID and create the application. + +Use the appcfg.py program to upload the program. It should look +something like this: + +$ torify ./google_appengine/appcfg.py update myapp/ +07:25 PM Host: appengine.google.com +07:25 PM Application: application-id; version: 1 +07:25 PM +Starting update of app: application-id, version: 1 +07:25 PM Getting current resource limits. +Email: xxx(a)gmail.com +Password for xxx(a)gmail.com: +07:26 PM Scanning files on local disk. +07:26 PM Cloning 2 application files. +07:26 PM Uploading 1 files and blobs. +07:26 PM Uploaded 1 files and blobs +07:26 PM Compilation starting. +07:26 PM Compilation: 1 files left. +07:26 PM Compilation completed. +07:26 PM Starting deployment. +07:26 PM Checking if deployment succeeded. +07:26 PM Deployment successful. +07:26 PM Checking if updated app version is serving. +07:26 PM Completed update of app: application-id, version: 1 + +Uploading the program in this way seems to create the files +~/.appcfg_nag and ~/.appcfg_cookies. Running the update command again +doesn't require you to enter your password again. + +Once logged in, you can disable logging for the application. Click +"Logs" on the left panel. Under "Total Logs Storage", click "Change +Settings". Enter "0" in the "days of logs" box and click "Save +Settings". diff --git a/facilitator/doc/facilitator-howto.txt b/facilitator/doc/facilitator-howto.txt new file mode 100644 index 0000000..8bafce9 --- /dev/null +++ b/facilitator/doc/facilitator-howto.txt @@ -0,0 +1,199 @@ +This document describes how to run a flash proxy facilitator on Debian 7. +We will use the domain name fp-facilitator.example.com. + +== Overview + +The facilitator consists of a backend server that is essentially a +dynamic database of client addresses, as well as helper programs that +receive client registrations from the Internet over various means and +pass them to the backend. There are three supported helper rendezvous +methods: HTTP, URL, and email. + +The HTTP rendezvous uses an HTTP server and a CGI program. The HTTP +server is responsible for speaking TLS and invoking the CGI program. The +CGI program receives client registrations and proxy requests for +clients, parses them, and forwards them to the backend. We use Apache 2 +as the HTTP server. The CGI script is facilitator.cgi. The backend is +facilitator. + +The email rendezvous uses the helper program facilitator-email-poller. +Clients use the flashproxy-reg-email program to send an encrypted +message to a Gmail address. The poller constantly checks for new +messages and forwards them to facilitator-reg. + +facilitator-reg is a simple program that forwards its standard input to +a locally running facilitator-reg-daemon process. + +facilitator-reg-daemon accepts connections containing encrypted client +registrations and forwards them to the facilitator. It exists as a +process of its own so that only one program requires access to the +facilitator's private key. + +The URL rendezvous uses the helper program flashproxy-reg-email. The +helper program doesn't actually make a registration; rather, it prints +out a URL which, when retrieved, makes the registration. + +fac.py is a Python module containing code common to the various +facilitator programs. + +== Basic and security setup + +Install some essential packages and configure a firewall. + + # cat >/etc/apt/apt.conf.d/90suggests<<EOF +APT::Install-Recommends "0"; +APT::Install-Suggests "0"; +EOF + # apt-get remove portmap + # apt-get update + # apt-get upgrade + # apt-get install shorewall shorewall6 + +Away from the facilitator, generate an SSH key for authentication: + + $ ssh-keygen -f ~/.ssh/fp-facilitator + $ ssh-copy-id -i ~/.ssh/fp-facilitator.pub root(a)fp-facilitator.example.com + +Then log in and edit /etc/ssh/sshd_config to disable password +authentication: + + PasswordAuthentication no + +Configure the firewall to allow only SSH and HTTPS. + + # cd /etc/shorewall + # cp /usr/share/doc/shorewall/examples/Universal/{interfaces,policy,rules,zones} . + Edit /etc/shorewall/rules: +SECTION NEW +SSH(ACCEPT) net $FW +HTTPS(ACCEPT) net $FW + + # cd /etc/shorewall6 + # cp /usr/share/doc/shorewall6/examples/Universal/{interfaces,policy,rules,zones} . + Edit /etc/shorewall6/rules: +SECTION NEW +SSH(ACCEPT) all $FW +HTTPS(ACCEPT) all $FW + +Edit /etc/default/shorewall and /etc/default/shorewall6 and set + + startup=1 + +Restart servers. + + # /etc/init.d/ssh restart + # /etc/init.d/shorewall start + # /etc/init.d/shorewall6 start + +== Facilitator program installation + +Create the user the daemons will run as. + + # useradd --shell /usr/sbin/nologin --system --home /nonexistent -M facilitator-nobody + +Install the programs. + + # cd + # apt-get install git python-m2crypto make + # git clone https://git.torproject.org/flashproxy.git + # cd flashproxy/facilitator + # make install + +This installs facilitator.cgi, facilitator, facilitator-email-poller, +facilitator-reg-daemon, facilitator-reg, and fac.py to /usr/local/bin. +It also installs System V init files to /etc/init.d/. + +=== Registration daemon setup + +The facilitator-reg-daemon program requires a private RSA key (used to +decrypt encrypted client registrations). + + # mkdir /etc/flashproxy + # openssl genrsa -out /etc/flashproxy/reg-daemon.key 2048 + # chmod 600 /etc/flashproxy/reg-daemon.key + # openssl rsa -pubout < /etc/flashproxy/reg-daemon.key > reg-daemon.pub + +You will have to edit flashproxy-reg-email and copy the contents of +reg-daemon.pub into the appropriate place. + +Install reg-daemon.key /etc/flashproxy to match what the init script +expects. + +=== Init script setup + + # update-rc.d facilitator defaults + # /etc/init.d/facilitator start + # update-rc.d facilitator-reg-daemon defaults + # /etc/init.d/facilitator-reg-daemon start + +== HTTP server setup + +Apache is the web server that runs the CGI program. + + # apt-get install apache2 libapache2-mod-evasive + # a2enmod ssl headers + +Edit /etc/apache2/ports.conf and comment out the port 80 configuration. + + # NameVirtualHost *:80 + # Listen 80 + +Create a new file /etc/apache2/sites-available/fp-facilitator with +these contents: + MaxClients 256 + <VirtualHost *:443> + ServerName fp-facilitator.example.com + DocumentRoot /dev/null + ScriptAliasMatch ^(.*) /usr/local/bin/facilitator.cgi$1 + CustomLog /dev/null common + ErrorLog ${APACHE_LOG_DIR}/error.log + LogLevel warn + SSLEngine on + SSLCertificateFile /etc/apache2/fp-facilitator.pem + SSLCertificateChainFile /etc/apache2/intermediate.pem + Header add Strict-Transport-Security "max-age=15768000" + </VirtualHost> +intermediate.pem is a possible intermediate certificate file provided by +the CA; if you did not get one, then leave off the +SSLCertificateChainFile line. + +Link the configured site into sites-enabled. + # a2ensite fp-facilitator + +=== HTTPS setup + +The HTTP server should serve only over HTTPS and not unencrypted HTTP. +You will need a certificate and private key from a certificate +authority. An article on making a certificate signing request and +getting it signed is here: + http://www.debian-administration.org/articles/284 +This is the basic command to generate a CSR. + $ openssl req -new -nodes -out fp-facilitator.csr.pem +The instructions below assume you have an offline private key +in fp-facilitator.key.pem and a certificate in fp-facilitator.crt.pem. + +Make a file containing both the private key and a certificate. + + $ cat fp-facilitator.key.pem fp-facilitator.crt.pem > fp-facilitator.pem + $ chmod 400 fp-facilitator.pem + +Copy the new fp-facilitator.pem to the facilitator server as +/etc/apache2/fp-facilitator.pem. + + # /etc/init.d/apache2 restart + +=== Email poller setup + +The facilitator-email-poller program requires a password that is used to +log in to the designated Gmail account. See the file gmail-setup.txt for +instructions on setting up a Gmail account. After you've set up the +account and have the password, save it to a file reg-email.pass and make +it not readable or writable by anyone but its owner. + + # chmod 600 /etc/flashproxy/reg-email.pass + +Install reg-email.pass to /etc/flashproxy to match what the init script +expects. + + # update-rc.d facilitator-email-poller defaults + # /etc/init.d/facilitator-email-poller start diff --git a/facilitator/doc/gmail-setup.txt b/facilitator/doc/gmail-setup.txt new file mode 100644 index 0000000..b51ce90 --- /dev/null +++ b/facilitator/doc/gmail-setup.txt @@ -0,0 +1,61 @@ +These are instructions for setting up a Gmail account for use with the +email-based rendezvous and flashproxy-reg-email. These instructions were +current as of May 2013. + +You may have trouble if you are using Tor to create the account, for two +reasons. The first is that exit nodes are a source of abuse and Google +is more suspicious of them. The second is that Gmail is suspicious and +can lock you out of the account when your IP address is changing. While +setting up the account, use a single node in your torrc ExitNodes +configuration. Choose a U.S. exit node, one with low bandwidth. + +Go to https://mail.google.com/. Allow JavaScript to run (even from +youtube.com; it seems to be necessary). Click the "CREATE AN ACCOUNT" +button. + +Enter the account details. You don't need to fill in "Your current email +address". Enter a mobile phone number for later activation of two-factor +authentication. Solve the captcha. Click "Next Step". You may have to do +a phone SMS verification here. + +At this point the Gmail account is created. If you are pushed into +joining Google+, close everything out and go back to +https://mail.google.com/. + +Log out of the account and then back in again. There will be new text in +the lower right reading "Last account activity". Click "Details" and +turn off the unusual activity alerts. This will keep you from getting +locked out when you come from different IP addresses. At this point you +should remove the temporary ExitNodes configuration from torrc. + +Add a filter to prevent registrations from being marked as spam. Click +on the gear icon and select "Settings". Select "Filters" then "Create a +new filter". For "Has the words" type "in:spam", then "Create filter +with this search". There will be a warning that filters using "in:" will +never match incoming mail; this appears to be false and you can just +click OK. Check "Never send it to Spam" and click "Create filter". + +Enable IMAP. Click the gear icon, then "Settings", then "Forwarding and +POP/IMAP". + * Disable POP + * Enable IMAP + * Auto-Expunge on +Click "Save Changes". + +Enable two-factor authentication. We do this not so much for the +two-factor, but because it allows creating an independent password that +is used only for IMAP and does not have access to the web interface of +Gmail. Click the email address in the upper right, then "Account". Click +"Security". By "2-step verification" click "Edit". Click through until +it lets you set up. The phone number you provided when the account was +created will be automatically filled in. Choose "Text message (SMS)" +then click "Send code". Get your text message, type it in, and hit +"Verify". Uncheck "Trust this computer" on the next screen. Finally +"Confirm". On the following summary page, click "Show backup codes" and +save the codes to encrypted storage. Future codes can be generated at +https://www.google.com/accounts/SmsAuthConfig. + +Still on the 2-step summary page, click "Manage application-specific +passwords". Enter "IMAP" for the name and click "Generate password". +Save the password to encrypted storage. This is the password that will +be used with the --pass option of facilitator-email-poller.

1 0