November 2013 - tor-commits - lists.torproject.org

[flashproxy/master] add the infrastructure needed to install facilitator.cgi in the right place
by infinity0＠torproject.org 21 Nov '13

21 Nov '13

commit 1491303f9118c872effb4a550dcba368cbf36853 Author: Ximin Luo <infinity0(a)gmx.com> Date: Wed Nov 6 13:37:08 2013 +0000 add the infrastructure needed to install facilitator.cgi in the right place --- facilitator/.gitignore | 5 +++-- facilitator/Makefile.am | 17 ++++++++++++++-- facilitator/configure.ac | 12 +++++++++++ facilitator/examples/fp-facilitator.conf | 29 --------------------------- facilitator/examples/fp-facilitator.conf.in | 28 ++++++++++++++++++++++++++ 5 files changed, 58 insertions(+), 33 deletions(-) diff --git a/facilitator/.gitignore b/facilitator/.gitignore index 9c6d1c7..cd4d36b 100644 --- a/facilitator/.gitignore +++ b/facilitator/.gitignore @@ -1,5 +1,6 @@ # files build by autogen.sh /aclocal.m4 +/autom4te.cache /configure /depcomp /install-sh @@ -15,8 +16,8 @@ /config.status /config.log -# files built by autoconf not meant for source-distribution -/autom4te.cache +# files built by make +/examples/fp-facilitator.conf # files for binary-distribution /flashproxy-facilitator-*.tar.* diff --git a/facilitator/Makefile.am b/facilitator/Makefile.am index 6960e32..7e117ba 100644 --- a/facilitator/Makefile.am +++ b/facilitator/Makefile.am @@ -2,6 +2,9 @@ fpfacilitatoruser = @fpfacilitatoruser@ initconfdir = @initconfdir@ +# TODO(infinity0): switch this to @cgibindir@ once we replace fac.py with +# flashproxy-common, so that we install facilitator.cgi in the right place +cgibindir = @bindir@ # unfortunately sysvinit does not support having initscripts in /usr/local/etc # yet, so we have to hard code a path here. :( @@ -13,7 +16,8 @@ appengineconfdir = $(pkgconfdir)/reg-appspot # automake PLVs -dist_bin_SCRIPTS = facilitator facilitator-email-poller facilitator-reg-daemon facilitator-reg facilitator.cgi fac.py +dist_bin_SCRIPTS = facilitator facilitator-email-poller facilitator-reg-daemon facilitator-reg fac.py +dist_cgibin_SCRIPTS = facilitator.cgi if DO_INITSCRIPTS initscript_SCRIPTS = init.d/facilitator init.d/facilitator-email-poller init.d/facilitator-reg-daemon dist_initconf_DATA = default/facilitator default/facilitator-email-poller default/facilitator-reg-daemon @@ -23,6 +27,8 @@ dist_doc_DATA = doc/appspot-howto.txt doc/facilitator-design.txt doc/email-howto dist_example_DATA = examples/fp-facilitator.conf examples/reg-email.pass dist_appengine_DATA = appengine/app.yaml appengine/config.go appengine/fp-reg.go appengine/README appengineconf_DATA = appengine/config.go +CLEANFILES = examples/fp-facilitator.conf +EXTRA_DIST = examples/fp-facilitator.conf.in $(TESTS) TESTS = facilitator-test.py # see http://www.gnu.org/software/automake/manual/html_node/Parallel-Test-Harness… @@ -31,10 +37,17 @@ PY_LOG_COMPILER = $(PYTHON) AM_TESTS_ENVIRONMENT = PYTHONPATH='$(srcdir)'; export PYTHONPATH; AM_PY_LOG_FLAGS = -EXTRA_DIST = $(TESTS) +# AC_CONFIG_FILES doesn't fully-expand directory variables +# see http://www.gnu.org/software/automake/manual/automake.html#Scripts +subst_vars = sed -e 's,[@]cgibindir[@],$(cgibindir),g' # our own targets +examples/fp-facilitator.conf: examples/fp-facilitator.conf.in Makefile +# mkdir needed for out-of-source build + mkdir -p $$(dirname "$@") + $(subst_vars) "$<" > "$@" + # The {pre,post}-{install,remove} targets are just given as reference, and # ought to be separate scripts as part of your distro's installation process. # They are intentionally not linked to the install target since they require diff --git a/facilitator/configure.ac b/facilitator/configure.ac index a89e01b..1b589a7 100644 --- a/facilitator/configure.ac +++ b/facilitator/configure.ac @@ -26,6 +26,18 @@ AC_MSG_ERROR([could not determine system initscripts config dir; please set init fi fi +# Try to detect cgi-bin directory, falling back to $(libexec) if not found +# from http://wiki.apache.org/httpd/DistrosDefaultLayout +AC_ARG_VAR(cgibindir, [directory for CGI executables]) +if test "x$cgibindir" = x; then +AC_CHECK_FILE(/usr/lib/cgi-bin, [cgibindir='$(libdir)/cgi-bin'], [ +AC_CHECK_FILE(/var/www/cgi-bin, [cgibindir='/var/www/cgi-bin'], [ +AC_CHECK_FILE(/srv/httpd/cgi-bin, [cgibindir='/srv/httpd/cgi-bin'], [ +AC_MSG_WARN([could not determine system CGI executables dir, using \$(libexecdir); set cgibindir to override.]) +cgibindir='$(libexecdir)' +])])]) +fi + AC_PROG_LN_S AM_PATH_PYTHON diff --git a/facilitator/examples/fp-facilitator.conf b/facilitator/examples/fp-facilitator.conf deleted file mode 100644 index 40182cc..0000000 --- a/facilitator/examples/fp-facilitator.conf +++ /dev/null @@ -1,29 +0,0 @@ -# This is an example apache2 config for serving the facilitator. -# -# For instructions on how to install it, see doc/http-howto.txt. You -# should also edit the contents according to the instructions below. -# -MaxClients 256 -<VirtualHost *:443> - # Update this with your hostname! - ServerName fp-facilitator.example.com - DocumentRoot /dev/null - # Make sure the path below matchs where you installed the facilitator. - ScriptAliasMatch ^(.*) /usr/bin/facilitator.cgi$1 - - # Non-Debian distros will need to tweak this too - CustomLog ${APACHE_LOG_DIR}/fp-access.log common - ErrorLog ${APACHE_LOG_DIR}/fp-error.log - LogLevel warn - - # requires mod_ssl - SSLEngine on - # Manually install your certificate to the following location. - SSLCertificateFile /etc/apache2/fp-facilitator.pem - # If you got an intermediate certificate, uncomment the following line - # and install the certificate to that location too. - #SSLCertificateChainFile /etc/apache2/fp-intermediate.pem - - # requires mod_headers - Header add Strict-Transport-Security "max-age=15768000" -</VirtualHost> diff --git a/facilitator/examples/fp-facilitator.conf.in b/facilitator/examples/fp-facilitator.conf.in new file mode 100644 index 0000000..729d85e --- /dev/null +++ b/facilitator/examples/fp-facilitator.conf.in @@ -0,0 +1,28 @@ +# This is an example apache2 config for serving the facilitator. +# +# For instructions on how to install it, see doc/http-howto.txt. You +# should also edit the contents according to the instructions below. +# +MaxClients 256 +<VirtualHost *:443> + # Update this with your hostname! + ServerName fp-facilitator.example.com + DocumentRoot /dev/null + ScriptAliasMatch ^(.*) @cgibindir@/facilitator.cgi$1 + + # Non-Debian distros will need to tweak this too + CustomLog ${APACHE_LOG_DIR}/fp-access.log common + ErrorLog ${APACHE_LOG_DIR}/fp-error.log + LogLevel warn + + # requires mod_ssl + SSLEngine on + # Manually install your certificate to the following location. + SSLCertificateFile /etc/apache2/fp-facilitator.pem + # If you got an intermediate certificate, uncomment the following line + # and install the certificate to that location too. + #SSLCertificateChainFile /etc/apache2/fp-intermediate.pem + + # requires mod_headers + Header add Strict-Transport-Security "max-age=15768000" +</VirtualHost>

1 0

[flashproxy/master] doc additions
by infinity0＠torproject.org 21 Nov '13

21 Nov '13

commit bf52bbaf90d096810018217ca6d16f999b227194 Author: Ximin Luo <infinity0(a)gmx.com> Date: Tue Nov 5 11:28:40 2013 +0000 doc additions - relate flashproxy-reg-url to the end-to-end encrypted HTTP registration - facilitator.cgi also serves the browser proxies, so you must enable it --- facilitator/README | 11 ++++++----- facilitator/doc/facilitator-design.txt | 14 ++++++++++---- facilitator/doc/http-howto.txt | 6 ++++-- 3 files changed, 20 insertions(+), 11 deletions(-) diff --git a/facilitator/README b/facilitator/README index 737d1b3..2b98c5c 100644 --- a/facilitator/README +++ b/facilitator/README @@ -15,15 +15,16 @@ as system services, and you should be able to configure them in the appropriate place for your system (e.g. /etc/default/facilitator for a Debian-based system using initscripts). -At a minimum, each installation has its own public-private keypair at -reg-daemon.{pub,key} in the flashproxy config directory. You will need -to securely distribute the public part (.pub) to your users - e.g. by -publishing it somewhere, signed by your own PGP key. +Each installation has its own public-private keypair, stored in the +flashproxy config directory. You will need to securely distribute the +public key (reg-daemon.pub) to your users - e.g. by publishing it +somewhere, signed by your own PGP key. There are three supported helper rendezvous methods: HTTP, email, and appspot. Each helper method may require additional manual configuration and might also depend on other helper methods; see the corresponding -doc/x-howto.txt for more details. +doc/x-howto.txt for more details. At a very minimum, you must configure +and enable the HTTP method, since that also serves the browser proxies. For suggestions on configuring a dedicated facilitator machine, see doc/server-howto.txt. diff --git a/facilitator/doc/facilitator-design.txt b/facilitator/doc/facilitator-design.txt index 3f4f801..0d84da3 100644 --- a/facilitator/doc/facilitator-design.txt +++ b/facilitator/doc/facilitator-design.txt @@ -17,11 +17,17 @@ The HTTP rendezvous uses an HTTP server and a CGI program. The HTTP server is responsible for speaking TLS and invoking the CGI program. The CGI program receives client registrations and proxy requests for clients, parses them, and forwards them to the backend. We use Apache 2 -as the HTTP server. The CGI script is facilitator.cgi. There are two -formats - plain vs. (end-to-end) encrypted. Direct client registrations +as the HTTP server. The CGI script is facilitator.cgi. Currently this +is also the only method for accepting browser proxy registrations, so +you must enable this method, otherwise your clients will not be served. + +For the HTTP rendezvous, there are two formats you may use for a client +registration - plain vs. (end-to-end) encrypted. Direct registrations (e.g. flashproxy-reg-http) can use the plain format over HTTPS, which provides transport encryption; but if you proxy registrations through another service (e.g. reg-appspot), you must use the end-to-end format. +On the client side, you may use flashproxy-reg-url to generate +registration URLs for the end-to-end encrypted format. The email rendezvous uses the helper program facilitator-email-poller. Clients use the flashproxy-reg-email program to send an encrypted @@ -31,8 +37,8 @@ messages and forwards them to facilitator-reg. The appspot rendezvous uses Google's appengine platform as a proxy for the HTTP method, either yours or that of another facilitator. It takes advantage of the fact that a censor cannot distinguish between a TLS -connection to appspot.com or google.com, since the IPs are the same, and -it is highly unlikely that anyone will try to block the latter. +connection to appspot.com or google.com, since the IPs are the same, +and it is highly unlikely that anyone will try to block the latter. fac.py is a Python module containing code common to the various facilitator programs. diff --git a/facilitator/doc/http-howto.txt b/facilitator/doc/http-howto.txt index 99ebf9b..bd7daa4 100644 --- a/facilitator/doc/http-howto.txt +++ b/facilitator/doc/http-howto.txt @@ -1,5 +1,7 @@ -These are instructions for how to set up an Apache Web Server for handling -the HTTP registration method (facilitator.cgi / flashproxy-reg-http). +These are instructions for how to set up an Apache Web Server for +handling the HTTP client registration method (facilitator.cgi / +flashproxy-reg-http / flashproxy-reg-url), as well as for browser +proxies to poll and receive a client to serve. == HTTP server setup

1 0

[flashproxy/master] move some documentation around for a more coherent structure
by infinity0＠torproject.org 21 Nov '13

21 Nov '13

commit 1ab29f3a4aa4c9243ab82931f778a0e9d7ce9c85 Author: Ximin Luo <infinity0(a)gmx.com> Date: Mon Nov 4 21:07:38 2013 +0000 move some documentation around for a more coherent structure - separate HTTP-rendezvous-specific info out of facilitator-howto.txt - move technical design info away from the top-level README - make it clear the need to distribute your public key --- facilitator/INSTALL | 13 ++------- facilitator/Makefile.am | 2 +- facilitator/README | 45 ++++++++---------------------- facilitator/doc/facilitator-design.txt | 32 ++++++++++++++++++++++ facilitator/doc/facilitator-howto.txt | 47 ++++---------------------------- facilitator/doc/gmail-howto.txt | 14 ++++++++-- facilitator/doc/http-howto.txt | 43 +++++++++++++++++++++++++++++ 7 files changed, 106 insertions(+), 90 deletions(-) diff --git a/facilitator/INSTALL b/facilitator/INSTALL index 345d74a..5a89f6f 100644 --- a/facilitator/INSTALL +++ b/facilitator/INSTALL @@ -14,17 +14,8 @@ facilitator-reg-daemon, facilitator-reg, and fac.py to /usr/local/bin. It also installs System V init files to /etc/init.d/. The pre/post-install scripts create a user for the daemon to as, and -sets up the initscripts in the default system runlevels. - -They also generate a RSA key in /usr/local/etc/flashproxy/reg-daemon.{key,pub}. -You should securely distribute the public key to anyone that wants to -use your facilitator; they will need to pass it as the ---facilitator-pubkey option to flashproxy-reg-email. - -You should also edit /usr/local/etc/default/facilitator-email-poller to -contain your Gmail address and /usr/local/etc/flashproxy/reg-email.pass -to contain your app-specific password; see doc/gmail-howto.txt for -instructions. +sets up the initscripts in the default system runlevels. They also +generate a RSA key in /usr/local/etc/flashproxy/reg-daemon.{key,pub}. Uninstall. diff --git a/facilitator/Makefile.am b/facilitator/Makefile.am index 6a3cdfc..6252596 100644 --- a/facilitator/Makefile.am +++ b/facilitator/Makefile.am @@ -19,7 +19,7 @@ initscript_SCRIPTS = init.d/facilitator init.d/facilitator-email-poller init.d/f dist_initconf_DATA = default/facilitator default/facilitator-email-poller default/facilitator-reg-daemon endif -dist_doc_DATA = doc/appengine-howto.txt doc/facilitator-howto.txt doc/gmail-howto.txt README +dist_doc_DATA = doc/appengine-howto.txt doc/facilitator-design.txt doc/facilitator-howto.txt doc/gmail-howto.txt doc/http-howto.txt README dist_example_DATA = examples/fp-facilitator examples/reg-email.pass dist_appengine_DATA = appengine/app.yaml appengine/config.go appengine/fp-reg.go appengine/README appengineconf_DATA = appengine/config.go diff --git a/facilitator/README b/facilitator/README index 49f17ce..f994977 100644 --- a/facilitator/README +++ b/facilitator/README @@ -6,40 +6,17 @@ For instructions on building/installing this package from source, see INSTALL. (This should only be necessary if your distro does not already integrate this package into its repositories.) -For instructions on setting up and running the facilitator, see -doc/facilitator-howto.txt. - -== Overview - -The facilitator consists of a backend server that is essentially a -dynamic database of client addresses, as well as helper programs that -receive client registrations from the Internet over various means and -pass them to the backend. There are three supported helper rendezvous -methods: HTTP, URL, and email. - -The HTTP rendezvous uses an HTTP server and a CGI program. The HTTP -server is responsible for speaking TLS and invoking the CGI program. The -CGI program receives client registrations and proxy requests for -clients, parses them, and forwards them to the backend. We use Apache 2 -as the HTTP server. The CGI script is facilitator.cgi. The backend is -facilitator. +Each installation has its own public-private keypair, typically in +reg-daemon.{pub,key} in your flashproxy config directory. You will need +to securely distribute the public part (.pub) to your users - e.g. by +publishing it somewhere, signed by your own PGP key. -The email rendezvous uses the helper program facilitator-email-poller. -Clients use the flashproxy-reg-email program to send an encrypted -message to a Gmail address. The poller constantly checks for new -messages and forwards them to facilitator-reg. +There are three supported helper rendezvous methods: HTTP, URL, and +email. Each helper method may require additional manual configuration; +see the corresponding doc/x-howto.txt for more details. -facilitator-reg is a simple program that forwards its standard input to -a locally running facilitator-reg-daemon process. - -facilitator-reg-daemon accepts connections containing encrypted client -registrations and forwards them to the facilitator. It exists as a -process of its own so that only one program requires access to the -facilitator's private key. - -The URL rendezvous uses the helper program flashproxy-reg-email. The -helper program doesn't actually make a registration; rather, it prints -out a URL which, when retrieved, makes the registration. +For suggestions on configuring a dedicated facilitator machine, see +doc/facilitator-howto.txt. -fac.py is a Python module containing code common to the various -facilitator programs. +For documentation on the design of the facilitator components, see +doc/facilitator-design.txt. diff --git a/facilitator/doc/facilitator-design.txt b/facilitator/doc/facilitator-design.txt new file mode 100644 index 0000000..f26acc2 --- /dev/null +++ b/facilitator/doc/facilitator-design.txt @@ -0,0 +1,32 @@ +The main facilitator program is a backend server that is essentially a +dynamic database of client addresses, as well as helper programs that +receive client registrations from the Internet over various means and +pass them to the backend. There are three supported helper rendezvous +methods: HTTP, URL, and email. + +facilitator-reg is a simple program that forwards its standard input to +a locally running facilitator-reg-daemon process. + +facilitator-reg-daemon accepts connections containing encrypted client +registrations and forwards them to the facilitator. It exists as a +process of its own so that only one program requires access to the +facilitator's private key. + +The HTTP rendezvous uses an HTTP server and a CGI program. The HTTP +server is responsible for speaking TLS and invoking the CGI program. The +CGI program receives client registrations and proxy requests for +clients, parses them, and forwards them to the backend. We use Apache 2 +as the HTTP server. The CGI script is facilitator.cgi. The backend is +facilitator. + +The email rendezvous uses the helper program facilitator-email-poller. +Clients use the flashproxy-reg-email program to send an encrypted +message to a Gmail address. The poller constantly checks for new +messages and forwards them to facilitator-reg. + +The URL rendezvous uses the helper program flashproxy-reg-email. The +helper program doesn't actually make a registration; rather, it prints +out a URL which, when retrieved, makes the registration. + +fac.py is a Python module containing code common to the various +facilitator programs. diff --git a/facilitator/doc/facilitator-howto.txt b/facilitator/doc/facilitator-howto.txt index 7cd2f78..6f71772 100644 --- a/facilitator/doc/facilitator-howto.txt +++ b/facilitator/doc/facilitator-howto.txt @@ -1,4 +1,8 @@ -This document describes how to configure a flash proxy facilitator on Debian 7. +This document describes how to configure a server running the facilitator on +Debian 7. It is not necessary to make things work, but gives you some added +security, and is a good reference if you want to create a dedicated VM for a +facilitator from scratch. + We will use the domain name fp-facilitator.example.com. == Basic and security setup @@ -49,44 +53,3 @@ Restart servers. # /etc/init.d/ssh restart # /etc/init.d/shorewall start # /etc/init.d/shorewall6 start - -== HTTP server setup - -Apache is the web server that runs the CGI program. - - # apt-get install apache2 libapache2-mod-evasive - # a2enmod ssl headers - -Edit /etc/apache2/ports.conf and comment out the port 80 configuration. - - # NameVirtualHost *:80 - # Listen 80 - -Edit examples/fp-facilitator as per the instructions given in that file, and -install it to /etc/apache2/sites-available/fp-facilitator or whatever is -appropriate for your apache2 installation. - -Link the configured site into sites-enabled. - # a2ensite fp-facilitator - -=== HTTPS setup - -The HTTP server should serve only over HTTPS and not unencrypted HTTP. -You will need a certificate and private key from a certificate -authority. An article on making a certificate signing request and -getting it signed is here: - http://www.debian-administration.org/articles/284 -This is the basic command to generate a CSR. - $ openssl req -new -nodes -out fp-facilitator.csr.pem -The instructions below assume you have an offline private key -in fp-facilitator.key.pem and a certificate in fp-facilitator.crt.pem. - -Make a file containing both the private key and a certificate. - - $ cat fp-facilitator.key.pem fp-facilitator.crt.pem > fp-facilitator.pem - $ chmod 400 fp-facilitator.pem - -Copy the new fp-facilitator.pem to the facilitator server as -/etc/apache2/fp-facilitator.pem. - - # /etc/init.d/apache2 restart diff --git a/facilitator/doc/gmail-howto.txt b/facilitator/doc/gmail-howto.txt index f7c0598..426d52c 100644 --- a/facilitator/doc/gmail-howto.txt +++ b/facilitator/doc/gmail-howto.txt @@ -1,6 +1,16 @@ These are instructions for setting up a Gmail account for use with the -email-based rendezvous and flashproxy-reg-email. These instructions were -current as of May 2013. +email-based rendezvous (facilitator-email-poller / flashproxy-reg-email). + +You are strongly advised to use a new Google account dedicated for this +purpose. For those that need to protect their information even from +Google, we provide some instructions on how to do this below. + +Once you have an email address and the password for it, you should add +this information to reg-email.pass in your flashproxy config directory. + +== Creating a Google account securely + +These instructions were current as of May 2013. You may have trouble if you are using Tor to create the account, for two reasons. The first is that exit nodes are a source of abuse and Google diff --git a/facilitator/doc/http-howto.txt b/facilitator/doc/http-howto.txt new file mode 100644 index 0000000..99ebf9b --- /dev/null +++ b/facilitator/doc/http-howto.txt @@ -0,0 +1,43 @@ +These are instructions for how to set up an Apache Web Server for handling +the HTTP registration method (facilitator.cgi / flashproxy-reg-http). + +== HTTP server setup + +Apache is the web server that runs the CGI program. + + # apt-get install apache2 libapache2-mod-evasive + # a2enmod ssl headers + +Edit /etc/apache2/ports.conf and comment out the port 80 configuration. + + # NameVirtualHost *:80 + # Listen 80 + +Edit examples/fp-facilitator as per the instructions given in that file, and +install it to /etc/apache2/sites-available/fp-facilitator or whatever is +appropriate for your apache2 installation. + +Link the configured site into sites-enabled. + # a2ensite fp-facilitator + +=== HTTPS setup + +The HTTP server should serve only over HTTPS and not unencrypted HTTP. +You will need a certificate and private key from a certificate +authority. An article on making a certificate signing request and +getting it signed is here: + http://www.debian-administration.org/articles/284 +This is the basic command to generate a CSR. + $ openssl req -new -nodes -out fp-facilitator.csr.pem +The instructions below assume you have an offline private key +in fp-facilitator.key.pem and a certificate in fp-facilitator.crt.pem. + +Make a file containing both the private key and a certificate. + + $ cat fp-facilitator.key.pem fp-facilitator.crt.pem > fp-facilitator.pem + $ chmod 400 fp-facilitator.pem + +Copy the new fp-facilitator.pem to the facilitator server as +/etc/apache2/fp-facilitator.pem. + + # /etc/init.d/apache2 restart

1 0

[flashproxy/master] some more doc tweaks
by infinity0＠torproject.org 21 Nov '13

21 Nov '13

commit b318c3e51e881e61d8912959b08c15b79c6a961a Author: Ximin Luo <infinity0(a)gmx.com> Date: Tue Nov 5 00:08:09 2013 +0000 some more doc tweaks - more precise autotools dependencies - note more config locations in README - fix appengine README relative path - note about public key when running appspot against a foreign facilitator - note about secure storage for reg-email.pass - note about plain vs end-to-end encrypted HTTP registrations, and when to use each - copy-then-edit apache config, rather than edit-then-copy --- facilitator/INSTALL | 2 +- facilitator/README | 13 +++++++++++-- facilitator/appengine/README | 4 ++-- facilitator/doc/appspot-howto.txt | 4 +++- facilitator/doc/email-howto.txt | 5 ++--- facilitator/doc/facilitator-design.txt | 7 +++++-- facilitator/examples/fp-facilitator | 6 +++--- 7 files changed, 27 insertions(+), 14 deletions(-) diff --git a/facilitator/INSTALL b/facilitator/INSTALL index 5a89f6f..8e66a81 100644 --- a/facilitator/INSTALL +++ b/facilitator/INSTALL @@ -1,7 +1,7 @@ Install the dependencies. $ apt-get install make openssl python-m2crypto - $ apt-get install gnulib # if running from git + $ apt-get install automake autoconf # if running from git Configure and install. diff --git a/facilitator/README b/facilitator/README index 4c50eed..737d1b3 100644 --- a/facilitator/README +++ b/facilitator/README @@ -6,8 +6,17 @@ For instructions on building/installing this package from source, see INSTALL. (This should only be necessary if your distro does not already integrate this package into its repositories.) -Each installation has its own public-private keypair, typically in -reg-daemon.{pub,key} in your flashproxy config directory. You will need +The flashproxy config directory is installation-dependant, usually at +/etc/flashproxy or /usr/local/etc/flashproxy. You are strongly +recommended to keep this on encrypted storage. + +The main backends, facilitator and facilitator-reg-daemon, are installed +as system services, and you should be able to configure them in the +appropriate place for your system (e.g. /etc/default/facilitator for a +Debian-based system using initscripts). + +At a minimum, each installation has its own public-private keypair at +reg-daemon.{pub,key} in the flashproxy config directory. You will need to securely distribute the public part (.pub) to your users - e.g. by publishing it somewhere, signed by your own PGP key. diff --git a/facilitator/appengine/README b/facilitator/appengine/README index dee3130..95215d3 100644 --- a/facilitator/appengine/README +++ b/facilitator/appengine/README @@ -5,7 +5,7 @@ See doc/appspot-howto.txt for information about setting up an application. To run locally using the development server: -$ ~/google_appengine/dev_appserver.py appengine/ +$ ~/google_appengine/dev_appserver.py . To upload a new version: -$ torify ~/google_appengine/appcfg.py -A $YOUR_APP_ID update appengine/ +$ torify ~/google_appengine/appcfg.py -A $YOUR_APP_ID update . diff --git a/facilitator/doc/appspot-howto.txt b/facilitator/doc/appspot-howto.txt index 6485a18..9202417 100644 --- a/facilitator/doc/appspot-howto.txt +++ b/facilitator/doc/appspot-howto.txt @@ -1,7 +1,9 @@ These are instructions for how to set up a Google App Engine application for the appspot rendezvous method (flashproxy-reg-appspot). It requires the HTTP rendezvous to be available, so you should set that up first and -ensure it is working correctly, or find someone else's to use. +ensure it is working correctly, or find someone else's to use. If you +choose the latter, note that it is *their* reg-daemon.pub that your users +must give to flashproxy-reg-appspot. General links: https://developers.google.com/appengine/ diff --git a/facilitator/doc/email-howto.txt b/facilitator/doc/email-howto.txt index f7cb934..9cbfdb6 100644 --- a/facilitator/doc/email-howto.txt +++ b/facilitator/doc/email-howto.txt @@ -7,6 +7,7 @@ app-specific password rather than your account password. Once you have an email address and the password for it, you should add this information to reg-email.pass in your flashproxy config directory. +For your security, this file should be on encrypted storage. The following section provides some instructions on how to set up a new Google account whilst revealing as little information to Google as is @@ -71,6 +72,4 @@ https://www.google.com/accounts/SmsAuthConfig. Still on the 2-step summary page, click "Manage application-specific passwords". Enter "IMAP" for the name and click "Generate password". -Save the password to encrypted storage. You should save this password -into /etc/flashproxy/reg-email.pass (or wherever you installed it), so -that facilitator-email-poller can pick it up. +Now store this in reg-email.pass, as mentioned in the introduction. diff --git a/facilitator/doc/facilitator-design.txt b/facilitator/doc/facilitator-design.txt index 8917d0d..3f4f801 100644 --- a/facilitator/doc/facilitator-design.txt +++ b/facilitator/doc/facilitator-design.txt @@ -17,8 +17,11 @@ The HTTP rendezvous uses an HTTP server and a CGI program. The HTTP server is responsible for speaking TLS and invoking the CGI program. The CGI program receives client registrations and proxy requests for clients, parses them, and forwards them to the backend. We use Apache 2 -as the HTTP server. The CGI script is facilitator.cgi. The backend is -facilitator. +as the HTTP server. The CGI script is facilitator.cgi. There are two +formats - plain vs. (end-to-end) encrypted. Direct client registrations +(e.g. flashproxy-reg-http) can use the plain format over HTTPS, which +provides transport encryption; but if you proxy registrations through +another service (e.g. reg-appspot), you must use the end-to-end format. The email rendezvous uses the helper program facilitator-email-poller. Clients use the flashproxy-reg-email program to send an encrypted diff --git a/facilitator/examples/fp-facilitator b/facilitator/examples/fp-facilitator index 500521d..c979ea6 100644 --- a/facilitator/examples/fp-facilitator +++ b/facilitator/examples/fp-facilitator @@ -1,8 +1,8 @@ # This is an example apache2 config for serving the facilitator. # -# You can edit this file according to the instructions below, then copy it to -# /etc/apache2/sites-available/fp-facilitator, or wherever is appropriate. Then -# you can run `a2ensite fp-facilitator` to enable it. +# To use this file, copy it to /etc/apache2/sites-available/fp-facilitator, or +# wherever is appropriate. Then edit it according to the instructions below. +# Finally, run `a2ensite fp-facilitator` to enable it. # # You should also run `a2enmod ssl headers` to enable SSL and HSTS. #

1 0

[flashproxy/master] document appspot method more thoroughly, and rename howtos to be consistent with the method name.
by infinity0＠torproject.org 21 Nov '13

21 Nov '13

commit 7ed4f653df3b7b6ec92fef41efd3f2295bd097d8 Author: Ximin Luo <infinity0(a)gmx.com> Date: Mon Nov 4 22:04:11 2013 +0000 document appspot method more thoroughly, and rename howtos to be consistent with the method name. - also ditch the "url" method since it is not really a separate method from HTTP; both provided by facilitator.cgi --- facilitator/Makefile.am | 4 +- facilitator/README | 9 ++-- facilitator/appengine/README | 2 +- facilitator/doc/appengine-howto.txt | 56 ----------------------- facilitator/doc/appspot-howto.txt | 56 +++++++++++++++++++++++ facilitator/doc/email-howto.txt | 76 ++++++++++++++++++++++++++++++++ facilitator/doc/facilitator-design.txt | 13 +++--- facilitator/doc/facilitator-howto.txt | 55 ----------------------- facilitator/doc/gmail-howto.txt | 72 ------------------------------ facilitator/doc/server-howto.txt | 55 +++++++++++++++++++++++ facilitator/examples/reg-email.pass | 4 +- 11 files changed, 205 insertions(+), 197 deletions(-) diff --git a/facilitator/Makefile.am b/facilitator/Makefile.am index 6252596..2a9086b 100644 --- a/facilitator/Makefile.am +++ b/facilitator/Makefile.am @@ -9,7 +9,7 @@ initscriptdir = /etc/init.d exampledir = $(docdir)/examples appenginedir = $(pkgdatadir)/appengine pkgconfdir = $(sysconfdir)/flashproxy -appengineconfdir = $(pkgconfdir)/reg-appengine +appengineconfdir = $(pkgconfdir)/reg-appspot # automake PLVs @@ -19,7 +19,7 @@ initscript_SCRIPTS = init.d/facilitator init.d/facilitator-email-poller init.d/f dist_initconf_DATA = default/facilitator default/facilitator-email-poller default/facilitator-reg-daemon endif -dist_doc_DATA = doc/appengine-howto.txt doc/facilitator-design.txt doc/facilitator-howto.txt doc/gmail-howto.txt doc/http-howto.txt README +dist_doc_DATA = doc/appspot-howto.txt doc/facilitator-design.txt doc/email-howto.txt doc/http-howto.txt doc/server-howto.txt README dist_example_DATA = examples/fp-facilitator examples/reg-email.pass dist_appengine_DATA = appengine/app.yaml appengine/config.go appengine/fp-reg.go appengine/README appengineconf_DATA = appengine/config.go diff --git a/facilitator/README b/facilitator/README index f994977..4c50eed 100644 --- a/facilitator/README +++ b/facilitator/README @@ -11,12 +11,13 @@ reg-daemon.{pub,key} in your flashproxy config directory. You will need to securely distribute the public part (.pub) to your users - e.g. by publishing it somewhere, signed by your own PGP key. -There are three supported helper rendezvous methods: HTTP, URL, and -email. Each helper method may require additional manual configuration; -see the corresponding doc/x-howto.txt for more details. +There are three supported helper rendezvous methods: HTTP, email, and +appspot. Each helper method may require additional manual configuration +and might also depend on other helper methods; see the corresponding +doc/x-howto.txt for more details. For suggestions on configuring a dedicated facilitator machine, see -doc/facilitator-howto.txt. +doc/server-howto.txt. For documentation on the design of the facilitator components, see doc/facilitator-design.txt. diff --git a/facilitator/appengine/README b/facilitator/appengine/README index 2e1e33d..dee3130 100644 --- a/facilitator/appengine/README +++ b/facilitator/appengine/README @@ -1,7 +1,7 @@ This is the server-side code that runs on Google App Engine for the "appspot" registration method. -See doc/appengine-howto.txt for information about setting up an +See doc/appspot-howto.txt for information about setting up an application. To run locally using the development server: diff --git a/facilitator/doc/appengine-howto.txt b/facilitator/doc/appengine-howto.txt deleted file mode 100644 index 44c5324..0000000 --- a/facilitator/doc/appengine-howto.txt +++ /dev/null @@ -1,56 +0,0 @@ -These are instructions for how to set up a Google App Engine application -to run at appspot.com. - -General links: -https://developers.google.com/appengine/ -https://developers.google.com/appengine/docs/whatisgoogleappengine -https://developers.google.com/appengine/docs/go/gettingstarted/ - -You first need to create a Google account. See gmail-howto.txt for how -to do that. - -Download the SDK: -https://developers.google.com/appengine/docs/go/gettingstarted/devenvironment - -Write your program and app.yaml file: -https://developers.google.com/appengine/docs/go/gettingstarted/helloworld - -When you're ready to upload, log in with your Google account and follow -the directions: -https://appengine.google.com/ -https://developers.google.com/appengine/docs/go/gettingstarted/uploading - -Enter an application ID and create the application. - -Use the appcfg.py program to upload the program. It should look -something like this: - -$ torify ./google_appengine/appcfg.py update myapp/ -07:25 PM Host: appengine.google.com -07:25 PM Application: application-id; version: 1 -07:25 PM -Starting update of app: application-id, version: 1 -07:25 PM Getting current resource limits. -Email: xxx(a)gmail.com -Password for xxx(a)gmail.com: -07:26 PM Scanning files on local disk. -07:26 PM Cloning 2 application files. -07:26 PM Uploading 1 files and blobs. -07:26 PM Uploaded 1 files and blobs -07:26 PM Compilation starting. -07:26 PM Compilation: 1 files left. -07:26 PM Compilation completed. -07:26 PM Starting deployment. -07:26 PM Checking if deployment succeeded. -07:26 PM Deployment successful. -07:26 PM Checking if updated app version is serving. -07:26 PM Completed update of app: application-id, version: 1 - -Uploading the program in this way seems to create the files -~/.appcfg_nag and ~/.appcfg_cookies. Running the update command again -doesn't require you to enter your password again. - -Once logged in, you can disable logging for the application. Click -"Logs" on the left panel. Under "Total Logs Storage", click "Change -Settings". Enter "0" in the "days of logs" box and click "Save -Settings". diff --git a/facilitator/doc/appspot-howto.txt b/facilitator/doc/appspot-howto.txt new file mode 100644 index 0000000..6485a18 --- /dev/null +++ b/facilitator/doc/appspot-howto.txt @@ -0,0 +1,56 @@ +These are instructions for how to set up a Google App Engine application +for the appspot rendezvous method (flashproxy-reg-appspot). It requires +the HTTP rendezvous to be available, so you should set that up first and +ensure it is working correctly, or find someone else's to use. + +General links: +https://developers.google.com/appengine/ +https://developers.google.com/appengine/docs/whatisgoogleappengine +https://developers.google.com/appengine/docs/go/gettingstarted/ + +You first need to create a Google account. See email-howto.txt for how +to do that. + +Download the SDK: +https://developers.google.com/appengine/docs/go/gettingstarted/devenvironment + +Find your facilitator appengine installation, probably in reg-appspot/ +in your flashproxy config dir. Edit config.go to point to the address of +the HTTP facilitator. + +Follow the directions to register a new application: +https://developers.google.com/appengine/docs/go/gettingstarted/uploading +Enter an application ID and create the application. + +Use the appcfg.py program to upload the program. It should look +something like this: + +$ torify ./google_appengine/appcfg.py -A <YOUR_APP_ID> update reg-appspot/ +07:25 PM Host: appengine.google.com +07:25 PM Application: application-id; version: 1 +07:25 PM +Starting update of app: application-id, version: 1 +07:25 PM Getting current resource limits. +Email: xxx(a)gmail.com +Password for xxx(a)gmail.com: +07:26 PM Scanning files on local disk. +07:26 PM Cloning 2 application files. +07:26 PM Uploading 1 files and blobs. +07:26 PM Uploaded 1 files and blobs +07:26 PM Compilation starting. +07:26 PM Compilation: 1 files left. +07:26 PM Compilation completed. +07:26 PM Starting deployment. +07:26 PM Checking if deployment succeeded. +07:26 PM Deployment successful. +07:26 PM Checking if updated app version is serving. +07:26 PM Completed update of app: application-id, version: 1 + +Uploading the program in this way seems to create the files +~/.appcfg_nag and ~/.appcfg_cookies. Running the update command again +doesn't require you to enter your password again. + +Once logged in, you can disable logging for the application. Click +"Logs" on the left panel. Under "Total Logs Storage", click "Change +Settings". Enter "0" in the "days of logs" box and click "Save +Settings". diff --git a/facilitator/doc/email-howto.txt b/facilitator/doc/email-howto.txt new file mode 100644 index 0000000..f7cb934 --- /dev/null +++ b/facilitator/doc/email-howto.txt @@ -0,0 +1,76 @@ +These are instructions for setting up an email account for use with the +email-based rendezvous (facilitator-email-poller / flashproxy-reg-email). + +You are strongly advised to use an email account dedicated for this +purpose. If your email provider supports it, we advise you to use an +app-specific password rather than your account password. + +Once you have an email address and the password for it, you should add +this information to reg-email.pass in your flashproxy config directory. + +The following section provides some instructions on how to set up a new +Google account whilst revealing as little information to Google as is +feasible. + +== Creating a Google account securely + +These instructions were current as of May 2013. + +You may have trouble if you are using Tor to create the account, for two +reasons. The first is that exit nodes are a source of abuse and Google +is more suspicious of them. The second is that Gmail is suspicious and +can lock you out of the account when your IP address is changing. While +setting up the account, use a single node in your torrc ExitNodes +configuration. Choose a U.S. exit node, one with low bandwidth. + +Go to https://mail.google.com/. Allow JavaScript to run (even from +youtube.com; it seems to be necessary). Click the "CREATE AN ACCOUNT" +button. + +Enter the account details. You don't need to fill in "Your current email +address". Enter a mobile phone number for later activation of two-factor +authentication. Solve the captcha. Click "Next Step". You may have to do +a phone SMS verification here. + +At this point the Gmail account is created. If you are pushed into +joining Google+, close everything out and go back to +https://mail.google.com/. + +Log out of the account and then back in again. There will be new text in +the lower right reading "Last account activity". Click "Details" and +turn off the unusual activity alerts. This will keep you from getting +locked out when you come from different IP addresses. At this point you +should remove the temporary ExitNodes configuration from torrc. + +Add a filter to prevent registrations from being marked as spam. Click +on the gear icon and select "Settings". Select "Filters" then "Create a +new filter". For "Has the words" type "in:spam", then "Create filter +with this search". There will be a warning that filters using "in:" will +never match incoming mail; this appears to be false and you can just +click OK. Check "Never send it to Spam" and click "Create filter". + +Enable IMAP. Click the gear icon, then "Settings", then "Forwarding and +POP/IMAP". + * Disable POP + * Enable IMAP + * Auto-Expunge on +Click "Save Changes". + +Enable two-factor authentication. We do this not so much for the +two-factor, but because it allows creating an independent password that +is used only for IMAP and does not have access to the web interface of +Gmail. Click the email address in the upper right, then "Account". Click +"Security". By "2-step verification" click "Edit". Click through until +it lets you set up. The phone number you provided when the account was +created will be automatically filled in. Choose "Text message (SMS)" +then click "Send code". Get your text message, type it in, and hit +"Verify". Uncheck "Trust this computer" on the next screen. Finally +"Confirm". On the following summary page, click "Show backup codes" and +save the codes to encrypted storage. Future codes can be generated at +https://www.google.com/accounts/SmsAuthConfig. + +Still on the 2-step summary page, click "Manage application-specific +passwords". Enter "IMAP" for the name and click "Generate password". +Save the password to encrypted storage. You should save this password +into /etc/flashproxy/reg-email.pass (or wherever you installed it), so +that facilitator-email-poller can pick it up. diff --git a/facilitator/doc/facilitator-design.txt b/facilitator/doc/facilitator-design.txt index f26acc2..8917d0d 100644 --- a/facilitator/doc/facilitator-design.txt +++ b/facilitator/doc/facilitator-design.txt @@ -2,10 +2,11 @@ The main facilitator program is a backend server that is essentially a dynamic database of client addresses, as well as helper programs that receive client registrations from the Internet over various means and pass them to the backend. There are three supported helper rendezvous -methods: HTTP, URL, and email. +methods: HTTP, email, and appspot. facilitator-reg is a simple program that forwards its standard input to -a locally running facilitator-reg-daemon process. +a locally running facilitator-reg-daemon process. It is not used by the +other components, but is useful for debugging and test purposes. facilitator-reg-daemon accepts connections containing encrypted client registrations and forwards them to the facilitator. It exists as a @@ -24,9 +25,11 @@ Clients use the flashproxy-reg-email program to send an encrypted message to a Gmail address. The poller constantly checks for new messages and forwards them to facilitator-reg. -The URL rendezvous uses the helper program flashproxy-reg-email. The -helper program doesn't actually make a registration; rather, it prints -out a URL which, when retrieved, makes the registration. +The appspot rendezvous uses Google's appengine platform as a proxy for +the HTTP method, either yours or that of another facilitator. It takes +advantage of the fact that a censor cannot distinguish between a TLS +connection to appspot.com or google.com, since the IPs are the same, and +it is highly unlikely that anyone will try to block the latter. fac.py is a Python module containing code common to the various facilitator programs. diff --git a/facilitator/doc/facilitator-howto.txt b/facilitator/doc/facilitator-howto.txt deleted file mode 100644 index 6f71772..0000000 --- a/facilitator/doc/facilitator-howto.txt +++ /dev/null @@ -1,55 +0,0 @@ -This document describes how to configure a server running the facilitator on -Debian 7. It is not necessary to make things work, but gives you some added -security, and is a good reference if you want to create a dedicated VM for a -facilitator from scratch. - -We will use the domain name fp-facilitator.example.com. - -== Basic and security setup - -Install some essential packages and configure a firewall. - - # cat >/etc/apt/apt.conf.d/90suggests<<EOF -APT::Install-Recommends "0"; -APT::Install-Suggests "0"; -EOF - # apt-get remove portmap - # apt-get update - # apt-get upgrade - # apt-get install shorewall shorewall6 - -Away from the facilitator, generate an SSH key for authentication: - - $ ssh-keygen -f ~/.ssh/fp-facilitator - $ ssh-copy-id -i ~/.ssh/fp-facilitator.pub root(a)fp-facilitator.example.com - -Then log in and edit /etc/ssh/sshd_config to disable password -authentication: - - PasswordAuthentication no - -Configure the firewall to allow only SSH and HTTPS. - - # cd /etc/shorewall - # cp /usr/share/doc/shorewall/examples/Universal/{interfaces,policy,rules,zones} . - Edit /etc/shorewall/rules: -SECTION NEW -SSH(ACCEPT) net $FW -HTTPS(ACCEPT) net $FW - - # cd /etc/shorewall6 - # cp /usr/share/doc/shorewall6/examples/Universal/{interfaces,policy,rules,zones} . - Edit /etc/shorewall6/rules: -SECTION NEW -SSH(ACCEPT) all $FW -HTTPS(ACCEPT) all $FW - -Edit /etc/default/shorewall and /etc/default/shorewall6 and set - - startup=1 - -Restart servers. - - # /etc/init.d/ssh restart - # /etc/init.d/shorewall start - # /etc/init.d/shorewall6 start diff --git a/facilitator/doc/gmail-howto.txt b/facilitator/doc/gmail-howto.txt deleted file mode 100644 index 426d52c..0000000 --- a/facilitator/doc/gmail-howto.txt +++ /dev/null @@ -1,72 +0,0 @@ -These are instructions for setting up a Gmail account for use with the -email-based rendezvous (facilitator-email-poller / flashproxy-reg-email). - -You are strongly advised to use a new Google account dedicated for this -purpose. For those that need to protect their information even from -Google, we provide some instructions on how to do this below. - -Once you have an email address and the password for it, you should add -this information to reg-email.pass in your flashproxy config directory. - -== Creating a Google account securely - -These instructions were current as of May 2013. - -You may have trouble if you are using Tor to create the account, for two -reasons. The first is that exit nodes are a source of abuse and Google -is more suspicious of them. The second is that Gmail is suspicious and -can lock you out of the account when your IP address is changing. While -setting up the account, use a single node in your torrc ExitNodes -configuration. Choose a U.S. exit node, one with low bandwidth. - -Go to https://mail.google.com/. Allow JavaScript to run (even from -youtube.com; it seems to be necessary). Click the "CREATE AN ACCOUNT" -button. - -Enter the account details. You don't need to fill in "Your current email -address". Enter a mobile phone number for later activation of two-factor -authentication. Solve the captcha. Click "Next Step". You may have to do -a phone SMS verification here. - -At this point the Gmail account is created. If you are pushed into -joining Google+, close everything out and go back to -https://mail.google.com/. - -Log out of the account and then back in again. There will be new text in -the lower right reading "Last account activity". Click "Details" and -turn off the unusual activity alerts. This will keep you from getting -locked out when you come from different IP addresses. At this point you -should remove the temporary ExitNodes configuration from torrc. - -Add a filter to prevent registrations from being marked as spam. Click -on the gear icon and select "Settings". Select "Filters" then "Create a -new filter". For "Has the words" type "in:spam", then "Create filter -with this search". There will be a warning that filters using "in:" will -never match incoming mail; this appears to be false and you can just -click OK. Check "Never send it to Spam" and click "Create filter". - -Enable IMAP. Click the gear icon, then "Settings", then "Forwarding and -POP/IMAP". - * Disable POP - * Enable IMAP - * Auto-Expunge on -Click "Save Changes". - -Enable two-factor authentication. We do this not so much for the -two-factor, but because it allows creating an independent password that -is used only for IMAP and does not have access to the web interface of -Gmail. Click the email address in the upper right, then "Account". Click -"Security". By "2-step verification" click "Edit". Click through until -it lets you set up. The phone number you provided when the account was -created will be automatically filled in. Choose "Text message (SMS)" -then click "Send code". Get your text message, type it in, and hit -"Verify". Uncheck "Trust this computer" on the next screen. Finally -"Confirm". On the following summary page, click "Show backup codes" and -save the codes to encrypted storage. Future codes can be generated at -https://www.google.com/accounts/SmsAuthConfig. - -Still on the 2-step summary page, click "Manage application-specific -passwords". Enter "IMAP" for the name and click "Generate password". -Save the password to encrypted storage. You should save this password -into /etc/flashproxy/reg-email.pass (or wherever you installed it), so -that facilitator-email-poller can pick it up. diff --git a/facilitator/doc/server-howto.txt b/facilitator/doc/server-howto.txt new file mode 100644 index 0000000..6f71772 --- /dev/null +++ b/facilitator/doc/server-howto.txt @@ -0,0 +1,55 @@ +This document describes how to configure a server running the facilitator on +Debian 7. It is not necessary to make things work, but gives you some added +security, and is a good reference if you want to create a dedicated VM for a +facilitator from scratch. + +We will use the domain name fp-facilitator.example.com. + +== Basic and security setup + +Install some essential packages and configure a firewall. + + # cat >/etc/apt/apt.conf.d/90suggests<<EOF +APT::Install-Recommends "0"; +APT::Install-Suggests "0"; +EOF + # apt-get remove portmap + # apt-get update + # apt-get upgrade + # apt-get install shorewall shorewall6 + +Away from the facilitator, generate an SSH key for authentication: + + $ ssh-keygen -f ~/.ssh/fp-facilitator + $ ssh-copy-id -i ~/.ssh/fp-facilitator.pub root(a)fp-facilitator.example.com + +Then log in and edit /etc/ssh/sshd_config to disable password +authentication: + + PasswordAuthentication no + +Configure the firewall to allow only SSH and HTTPS. + + # cd /etc/shorewall + # cp /usr/share/doc/shorewall/examples/Universal/{interfaces,policy,rules,zones} . + Edit /etc/shorewall/rules: +SECTION NEW +SSH(ACCEPT) net $FW +HTTPS(ACCEPT) net $FW + + # cd /etc/shorewall6 + # cp /usr/share/doc/shorewall6/examples/Universal/{interfaces,policy,rules,zones} . + Edit /etc/shorewall6/rules: +SECTION NEW +SSH(ACCEPT) all $FW +HTTPS(ACCEPT) all $FW + +Edit /etc/default/shorewall and /etc/default/shorewall6 and set + + startup=1 + +Restart servers. + + # /etc/init.d/ssh restart + # /etc/init.d/shorewall start + # /etc/init.d/shorewall6 start diff --git a/facilitator/examples/reg-email.pass b/facilitator/examples/reg-email.pass index 6f34e06..75b6aa4 100644 --- a/facilitator/examples/reg-email.pass +++ b/facilitator/examples/reg-email.pass @@ -3,8 +3,8 @@ # imap.(<email> domain):993. # # If your email provider supports it, we advise you to use an app-specific -# password rather than your account password; see gmail-howto.txt in this -# package's documentation for details on how to do this for a Google account. +# password rather than your account password; see email-howto.txt in this +# package's documentation for details on how to do this. # #imap.gmail.com:993 flashproxyreg.a(a)gmail.com topsecret11!one #flashproxyreg.a(a)gmail.com passwords with spaces are ok too

1 0

[flashproxy/master] - fix VPATH build and `make distcheck`
by infinity0＠torproject.org 21 Nov '13

21 Nov '13

commit 0f6d43d6f9b08876f5d19bd9ffeb5b4e404164de Author: Ximin Luo <infinity0(a)gmx.com> Date: Tue Oct 15 15:08:35 2013 +0100 - fix VPATH build and `make distcheck` --- facilitator/Makefile.am | 2 ++ facilitator/facilitator-test.py | 4 +++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/facilitator/Makefile.am b/facilitator/Makefile.am index 0164d76..d4a4021 100644 --- a/facilitator/Makefile.am +++ b/facilitator/Makefile.am @@ -34,6 +34,8 @@ AM_PY_LOG_FLAGS = # see http://www.gnu.org/software/automake/manual/html_node/Scripts.html CLEANFILES = $(initscript_SCRIPTS) +EXTRA_DIST = $(TESTS) + # our own targets # The {pre,post}-{install,remove} targets are just given as reference, and diff --git a/facilitator/facilitator-test.py b/facilitator/facilitator-test.py index 6dec76d..e5ed843 100755 --- a/facilitator/facilitator-test.py +++ b/facilitator/facilitator-test.py @@ -1,5 +1,6 @@ #!/usr/bin/env python +import os import socket import subprocess import time @@ -28,7 +29,8 @@ class FacilitatorTest(unittest.TestCase): return gimme_socket(FACILITATOR_HOST, FACILITATOR_PORT) def setUp(self): - self.process = subprocess.Popen(["./facilitator", "-d", "-p", str(FACILITATOR_PORT), "-r", "0.0.1.0:1", "-l", "/dev/null"]) + fn = os.path.join(os.path.dirname(__file__), "./facilitator") + self.process = subprocess.Popen(["python", fn, "-d", "-p", str(FACILITATOR_PORT), "-r", "0.0.1.0:1", "-l", "/dev/null"]) time.sleep(0.1) def tearDown(self):

1 0

[flashproxy/master] email-poller: configure user data (imap_host, email, password) in the same file
by infinity0＠torproject.org 21 Nov '13

21 Nov '13

commit a310c1d0f893ebd18a128a9d92684b3cf51d70a4 Author: Ximin Luo <infinity0(a)gmx.com> Date: Mon Nov 4 20:49:58 2013 +0000 email-poller: configure user data (imap_host, email, password) in the same file - means we don't depend on initscripts for user config, and easier to explain - breaks backwards compatibility, but since the email was hardcoded we only had one user anyway - smarter default IMAP host; and resolve DNS by default - previously one had to use an IP address - add a nameOk option to parse_addr_spec as certificate verification requires imap host to be a name --- facilitator/Makefile.am | 7 ++-- facilitator/default/facilitator-email-poller | 8 ----- facilitator/examples/reg-email.pass | 10 ++++++ facilitator/fac.py | 11 +++--- facilitator/facilitator-email-poller | 50 ++++++++++++++------------ facilitator/facilitator-test.py | 5 +++ 6 files changed, 51 insertions(+), 40 deletions(-) diff --git a/facilitator/Makefile.am b/facilitator/Makefile.am index 6d4325b..6a3cdfc 100644 --- a/facilitator/Makefile.am +++ b/facilitator/Makefile.am @@ -20,7 +20,7 @@ dist_initconf_DATA = default/facilitator default/facilitator-email-poller defaul endif dist_doc_DATA = doc/appengine-howto.txt doc/facilitator-howto.txt doc/gmail-howto.txt README -dist_example_DATA = examples/fp-facilitator +dist_example_DATA = examples/fp-facilitator examples/reg-email.pass dist_appengine_DATA = appengine/app.yaml appengine/config.go appengine/fp-reg.go appengine/README appengineconf_DATA = appengine/config.go @@ -87,10 +87,7 @@ install-secrets: openssl rsa -pubout > $(pkgconfdir)/reg-daemon.pub; } test -f $(pkgconfdir)/reg-email.pass || { \ install -m 600 /dev/null $(pkgconfdir)/reg-email.pass && \ - echo >> $(pkgconfdir)/reg-email.pass \ - "Replace this file's contents with your Gmail app-specific password;" && \ - echo >> $(pkgconfdir)/reg-email.pass \ - "see gmail-howto.txt in this package's documentation for details."; } + cat $(exampledir)/reg-email.pass > $(pkgconfdir)/reg-email.pass; } remove-secrets: rm -f $(pkgconfdir)/reg-* diff --git a/facilitator/default/facilitator-email-poller b/facilitator/default/facilitator-email-poller index 42f4dc6..b71503f 100644 --- a/facilitator/default/facilitator-email-poller +++ b/facilitator/default/facilitator-email-poller @@ -5,11 +5,3 @@ RUN_DAEMON="no" # This may be useful for debugging or diagnosing functional problems, but # should be avoided in a high-risk environment. #UNSAFE_LOGGING="yes" - -# Replace this with the email address for your facilitator. -# You should also edit the reg-email.pass file as needed. -FACILITATOR_EMAIL_ADDR="invalid" - -# Set the host:port for the remote IMAP service to contact -# If not set, uses the default (imap.gmail.com:993). -#IMAPADDR="imap.gmail.com:993" diff --git a/facilitator/examples/reg-email.pass b/facilitator/examples/reg-email.pass new file mode 100644 index 0000000..6f34e06 --- /dev/null +++ b/facilitator/examples/reg-email.pass @@ -0,0 +1,10 @@ +# This file should contain "[<imap_host>] <email> <password>" on a single line, +# separated by whitespace. If <imap_host> is omitted, it defaults to +# imap.(<email> domain):993. +# +# If your email provider supports it, we advise you to use an app-specific +# password rather than your account password; see gmail-howto.txt in this +# package's documentation for details on how to do this for a Google account. +# +#imap.gmail.com:993 flashproxyreg.a(a)gmail.com topsecret11!one +#flashproxyreg.a(a)gmail.com passwords with spaces are ok too diff --git a/facilitator/fac.py b/facilitator/fac.py index 70d482d..695cc29 100644 --- a/facilitator/fac.py +++ b/facilitator/fac.py @@ -46,7 +46,7 @@ def catch_epipe(fn): raise return ret -def parse_addr_spec(spec, defhost = None, defport = None, resolve = False): +def parse_addr_spec(spec, defhost = None, defport = None, resolve = False, nameOk = False): """Parse a host:port specification and return a 2-tuple ("host", port) as understood by the Python socket functions. >>> parse_addr_spec("192.168.0.1:9999") @@ -67,9 +67,9 @@ def parse_addr_spec(spec, defhost = None, defport = None, resolve = False): >>> parse_addr_spec("", defhost="192.168.0.1", defport=9999) ('192.168.0.1', 9999) - If resolve is true, then the host in the specification or the defhost may be - a domain name, which will be resolved. If resolve is false, then the host - must be a numeric IPv4 or IPv6 address. + If nameOk is true, then the host in the specification or the defhost may be + a domain name. Otherwise, it must be a numeric IPv4 or IPv6 address. + If resolve is true, this implies nameOk, and the host will be resolved. IPv6 addresses must be enclosed in square brackets.""" host = None @@ -107,6 +107,9 @@ def parse_addr_spec(spec, defhost = None, defport = None, resolve = False): # done only if resolve is true; otherwise the address must be numeric. if resolve: flags = 0 + elif nameOk: + # don't pass through the getaddrinfo numeric check, just return directly + return host, int(port) else: flags = socket.AI_NUMERICHOST try: diff --git a/facilitator/facilitator-email-poller b/facilitator/facilitator-email-poller index 32dc2d4..d4e1e16 100755 --- a/facilitator/facilitator-email-poller +++ b/facilitator/facilitator-email-poller @@ -21,7 +21,6 @@ import fac from hashlib import sha1 from M2Crypto import SSL, X509 -DEFAULT_IMAP_HOST = "imap.gmail.com" DEFAULT_IMAP_PORT = 993 DEFAULT_LOG_FILENAME = "facilitator-email-poller.log" @@ -74,8 +73,6 @@ PUBKEY_SHA1 = ( LOG_DATE_FORMAT = "%Y-%m-%d %H:%M:%S" class options(object): - email_addr = None - imap_addr = None password_filename = None log_filename = DEFAULT_LOG_FILENAME log_file = sys.stdout @@ -132,18 +129,18 @@ them, and forwards the registrations to the facilitator. -d, --debug don't daemonize, log to stdout. --disable-pin don't check server public key against a known pin. - -e, --email=ADDRESS log in as ADDRESS -h, --help show this help. - -i, --imap=HOST[:PORT] use the given IMAP server (default "%(imap_addr)s"). --imaplib-debug show raw IMAP messages (will include email password). -l, --log FILENAME write log to FILENAME (default \"%(log)s\"). - -p, --pass=PASSFILE use the email password contained in PASSFILE. + -p, --pass=PASSFILE use the email/password contained in PASSFILE. This file + should contain "[<imap_host>] <email> <password>" on a + single line, separated by whitespace. If <imap_host> is + omitted, it defaults to imap.(<email> domain):993. --pidfile FILENAME write PID to FILENAME after daemonizing. --privdrop-user USER switch UID and GID to those of USER. --unsafe-logging don't scrub email password and IP addresses from logs.\ """ % { "progname": sys.argv[0], - "imap_addr": fac.format_addr((DEFAULT_IMAP_HOST, DEFAULT_IMAP_PORT)), "log": DEFAULT_LOG_FILENAME, } @@ -158,9 +155,6 @@ def log(msg): print >> options.log_file, (u"%s %s" % (time.strftime(LOG_DATE_FORMAT), msg)).encode("UTF-8") options.log_file.flush() -options.email_addr = None -options.imap_addr = (DEFAULT_IMAP_HOST, DEFAULT_IMAP_PORT) - opts, args = getopt.gnu_getopt(sys.argv[1:], "de:hi:l:p:", [ "debug", "disable-pin", @@ -180,13 +174,9 @@ for o, a in opts: options.log_filename = None elif o == "--disable-pin": options.use_certificate_pin = False - elif o == "-e" or o == "--email": - options.email_addr = a elif o == "-h" or o == "--help": usage() sys.exit() - elif o == "-i" or o == "--imap": - options.imap_addr = fac.parse_addr_spec(a, DEFAULT_IMAP_HOST, DEFAULT_IMAP_PORT) if o == "--imaplib-debug": options.imaplib_debug = True elif o == "-l" or o == "--log": @@ -204,11 +194,6 @@ if len(args) != 0: usage(sys.stderr) sys.exit(1) -# Check the email -if not options.email_addr or '@' not in options.email_addr: - print >> sys.stderr, "The --email option is required and must be an email address." - sys.exit(1) - # Load the email password. if options.password_filename is None: print >> sys.stderr, "The --pass option is required." @@ -225,7 +210,26 @@ try: print >> sys.stderr, "Refusing to run with group- or world-readable password file. Try" print >> sys.stderr, "\tchmod 600 %s" % options.password_filename sys.exit(1) - email_password = password_file.read().strip() + for line in password_file.readlines(): + line = line.strip("\n") + if not line or line.startswith('#'): continue + # we do this stricter regex match because passwords might have spaces in + res = re.match(r"(?:(\S+)\s)?(\S+@\S+)\s(.+)", line) + if not res: + raise ValueError("could not find email or password: %s" % line) + (imap_addr_spec, email_addr, email_password) = res.groups() + default_imap_host = "imap.%s" % (email_addr.split('@', 1)[1]) + imap_addr = fac.parse_addr_spec( + imap_addr_spec or "", default_imap_host, DEFAULT_IMAP_PORT, nameOk=True) + break + else: + raise ValueError("no email line found") +except Exception, e: + print >> sys.stderr, """\ +Failed to parse password file "%s": %s. +Syntax is [<imap_host>] <email> <password>. +""" % (options.password_filename, str(e)) + sys.exit(1) finally: password_file.close() @@ -375,7 +379,7 @@ def imap_login(): try: ca_certs_file.write(CA_CERTS) ca_certs_file.flush() - imap = IMAP4_SSL_REQUIRED(options.imap_addr[0], options.imap_addr[1], + imap = IMAP4_SSL_REQUIRED(imap_addr[0], imap_addr[1], None, ca_certs_file.name) finally: ca_certs_file.close() @@ -393,8 +397,8 @@ def imap_login(): expected = "(" + ", ".join(x.encode("hex") for x in PUBKEY_SHA1) + ")" raise ValueError("Public key does not match pin: got %s but expected any of %s" % (found, expected)) - log(u"logging in as %s" % options.email_addr) - imap.login(options.email_addr, email_password) + log(u"logging in as %s" % email_addr) + imap.login(email_addr, email_password) return imap diff --git a/facilitator/facilitator-test.py b/facilitator/facilitator-test.py index e5ed843..e00ea5e 100755 --- a/facilitator/facilitator-test.py +++ b/facilitator/facilitator-test.py @@ -156,6 +156,11 @@ class ParseAddrSpecTest(unittest.TestCase): """Test that parse_addr_spec does not do DNS resolution by default.""" self.assertRaises(ValueError, fac.parse_addr_spec, "example.com") + def test_noresolve_nameok(self): + """Test that nameok passes through a domain name without resolving it.""" + self.assertEqual(fac.parse_addr_spec("example.com:8888", defhost="other.com", defport=9999, nameOk=True), ("example.com", 8888)) + self.assertEqual(fac.parse_addr_spec("", defhost="other.com", defport=9999, nameOk=True), ("other.com", 9999)) + class ParseTransactionTest(unittest.TestCase): def test_empty_string(self): self.assertRaises(ValueError, fac.parse_transaction, "")

1 0

[flashproxy/master] don't hard code /etc/default; try to detect the correct one and bug the user to specify it, if that fails
by infinity0＠torproject.org 21 Nov '13

21 Nov '13

commit d736b4b218077b09666f38e21723b00fca611df8 Author: Ximin Luo <infinity0(a)gmx.com> Date: Mon Nov 4 16:31:50 2013 +0000 don't hard code /etc/default; try to detect the correct one and bug the user to specify it, if that fails --- facilitator/Makefile.am | 5 +++-- facilitator/configure.ac | 7 +++++++ 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/facilitator/Makefile.am b/facilitator/Makefile.am index 7708f21..6d4325b 100644 --- a/facilitator/Makefile.am +++ b/facilitator/Makefile.am @@ -1,13 +1,14 @@ # our own variables fpfacilitatoruser = @fpfacilitatoruser@ +initconfdir = @initconfdir@ + # unfortunately sysvinit does not support having initscripts in /usr/local/etc # yet, so we have to hard code a path here. :( initscriptdir = /etc/init.d exampledir = $(docdir)/examples appenginedir = $(pkgdatadir)/appengine pkgconfdir = $(sysconfdir)/flashproxy -initdefaultdir = $(sysconfdir)/default appengineconfdir = $(pkgconfdir)/reg-appengine # automake PLVs @@ -15,7 +16,7 @@ appengineconfdir = $(pkgconfdir)/reg-appengine dist_bin_SCRIPTS = facilitator facilitator-email-poller facilitator-reg-daemon facilitator-reg facilitator.cgi fac.py if DO_INITSCRIPTS initscript_SCRIPTS = init.d/facilitator init.d/facilitator-email-poller init.d/facilitator-reg-daemon -dist_initdefault_DATA = default/facilitator default/facilitator-email-poller default/facilitator-reg-daemon +dist_initconf_DATA = default/facilitator default/facilitator-email-poller default/facilitator-reg-daemon endif dist_doc_DATA = doc/appengine-howto.txt doc/facilitator-howto.txt doc/gmail-howto.txt README diff --git a/facilitator/configure.ac b/facilitator/configure.ac index 397894f..32d5fa4 100644 --- a/facilitator/configure.ac +++ b/facilitator/configure.ac @@ -4,6 +4,13 @@ AM_INIT_AUTOMAKE([-Wall -Werror foreign]) AC_ARG_VAR(fpfacilitatoruser, [the user/group for the facilitator to run as]) fpfacilitatoruser="${fpfacilitatoruser:-flashproxy-fac}" +AC_ARG_VAR(initconfdir, [directory for initscripts configuration]) +# Try to detect the appropriate conf dir. Several systems have both /etc/default +# and /etc/sysconfig but latter is always primary. +AC_CHECK_FILE(/etc/conf.d, [initconfdir="${initconfdir:-\$(sysconfdir)/conf.d}"], [# Gentoo/Arch +AC_CHECK_FILE(/etc/sysconfig, [initconfdir="${initconfdir:-\$(sysconfdir)/sysconfig}"], [# RedHat/Fedora/Slax/Mandriva/SuSE +AC_CHECK_FILE(/etc/default, [initconfdir="${initconfdir:-\$(sysconfdir)/default}"], [# Debian/Ubuntu +AC_MSG_ERROR([could not determine system\'s initscripts config dir, please set initconfdir manually])])])]) AC_PROG_LN_S AM_PATH_PYTHON

1 0

[flashproxy/master] add more initscripts default files for users to override various options
by infinity0＠torproject.org 21 Nov '13

21 Nov '13

commit 15f0aa4a1750793b1128ff893edd69434dd900ea Author: Ximin Luo <infinity0(a)gmx.com> Date: Tue Oct 15 16:14:23 2013 +0100 add more initscripts default files for users to override various options --- facilitator/Makefile.am | 2 +- facilitator/default/facilitator | 11 +++++++++++ facilitator/default/facilitator-email-poller | 11 ++++++++++- facilitator/default/facilitator-reg-daemon | 11 +++++++++++ facilitator/init.d/facilitator-email-poller.in | 25 ++++++++++++------------ facilitator/init.d/facilitator-reg-daemon.in | 11 +++++++++++ facilitator/init.d/facilitator.in | 11 +++++++++++ 7 files changed, 68 insertions(+), 14 deletions(-) diff --git a/facilitator/Makefile.am b/facilitator/Makefile.am index d4a4021..fa1ba71 100644 --- a/facilitator/Makefile.am +++ b/facilitator/Makefile.am @@ -15,7 +15,7 @@ appengineconfdir = $(pkgconfdir)/reg-appengine dist_bin_SCRIPTS = facilitator facilitator-email-poller facilitator-reg-daemon facilitator-reg facilitator.cgi fac.py if DO_INITSCRIPTS initscript_SCRIPTS = init.d/facilitator init.d/facilitator-email-poller init.d/facilitator-reg-daemon -initdefault_DATA = default/facilitator-email-poller +dist_initdefault_DATA = default/facilitator default/facilitator-email-poller default/facilitator-reg-daemon endif dist_doc_DATA = doc/appengine-howto.txt doc/facilitator-howto.txt doc/gmail-howto.txt README diff --git a/facilitator/default/facilitator b/facilitator/default/facilitator new file mode 100644 index 0000000..51ed4a1 --- /dev/null +++ b/facilitator/default/facilitator @@ -0,0 +1,11 @@ +# Change to "yes" to run the service. +RUN_DAEMON="no" + +# Uncomment this to log potentially sensitive information from your users. +# This may be useful for debugging or diagnosing functional problems, but +# should be avoided in a high-risk environment. +#UNSAFE_LOGGING="yes" + +# Set the port for this service to listen on. +# If not set, uses the default (9002). +#PORT=9002 diff --git a/facilitator/default/facilitator-email-poller b/facilitator/default/facilitator-email-poller index af2f8ca..42f4dc6 100644 --- a/facilitator/default/facilitator-email-poller +++ b/facilitator/default/facilitator-email-poller @@ -1,6 +1,15 @@ -# Change to "yes" to run the email poller. +# Change to "yes" to run the service. RUN_DAEMON="no" +# Uncomment this to log potentially sensitive information from your users. +# This may be useful for debugging or diagnosing functional problems, but +# should be avoided in a high-risk environment. +#UNSAFE_LOGGING="yes" + # Replace this with the email address for your facilitator. # You should also edit the reg-email.pass file as needed. FACILITATOR_EMAIL_ADDR="invalid" + +# Set the host:port for the remote IMAP service to contact +# If not set, uses the default (imap.gmail.com:993). +#IMAPADDR="imap.gmail.com:993" diff --git a/facilitator/default/facilitator-reg-daemon b/facilitator/default/facilitator-reg-daemon new file mode 100644 index 0000000..d39be20 --- /dev/null +++ b/facilitator/default/facilitator-reg-daemon @@ -0,0 +1,11 @@ +# Change to "yes" to run the service. +RUN_DAEMON="no" + +# Uncomment this to log potentially sensitive information from your users. +# This may be useful for debugging or diagnosing functional problems, but +# should be avoided in a high-risk environment. +#UNSAFE_LOGGING="yes" + +# Set the port for this service to listen on. +# If not set, uses the default (9003). +#PORT=9003 diff --git a/facilitator/init.d/facilitator-email-poller.in b/facilitator/init.d/facilitator-email-poller.in index 44cc527..e39fb56 100755 --- a/facilitator/init.d/facilitator-email-poller.in +++ b/facilitator/init.d/facilitator-email-poller.in @@ -24,22 +24,23 @@ PIDFILE=@localstatedir@/run/$NAME.pid LOGFILE=@localstatedir@/log/$NAME.log CONFDIR=@sysconfdir@/flashproxy PRIVDROP_USER=@fpfacilitatoruser@ -DEFAULTSFILE=@sysconfdir@/default/$NAME - -# Include defaults if available -if [ -f $DEFAULTSFILE ] ; then - . $DEFAULTSFILE -fi - DAEMON=@bindir@/$NAME -DAEMON_ARGS="--email $FACILITATOR_EMAIL_ADDR --pass $CONFDIR/reg-email.pass --log $LOGFILE --pidfile $PIDFILE --privdrop-user $PRIVDROP_USER" +DAEMON_ARGS="--pass $CONFDIR/reg-email.pass --log $LOGFILE --pidfile $PIDFILE --privdrop-user $PRIVDROP_USER" +DEFAULTSFILE=@sysconfdir@/default/$NAME # Exit if the package is not installed [ -x "$DAEMON" ] || exit 0 +# Read configuration variable file if it is present +[ -r "$DEFAULTSFILE" ] && . "$DEFAULTSFILE" + . /lib/init/vars.sh . /lib/lsb/init-functions +[ "$UNSAFE_LOGGING" = "yes" ] && DAEMON_ARGS="$DAEMON_ARGS --unsafe-logging" +[ -n "$IMAPADDR" ] && DAEMON_ARGS="$DAEMON_ARGS --imap $IMAPADDR" +DAEMON_ARGS="$DAEMON_ARGS --email $FACILITATOR_EMAIL_ADDR" + # # Function that starts the daemon/service # @@ -83,10 +84,10 @@ do_stop() case "$1" in start) - if [ "$RUN_DAEMON" != "yes" ]; then - log_action_msg "Not starting $DESC (Disabled in $DEFAULTSFILE)." - exit 0 - fi + if [ "$RUN_DAEMON" != "yes" ]; then + log_action_msg "Not starting $DESC (Disabled in $DEFAULTSFILE)." + exit 0 + fi [ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME" do_start case "$?" in diff --git a/facilitator/init.d/facilitator-reg-daemon.in b/facilitator/init.d/facilitator-reg-daemon.in index 5126baa..aa4afde 100755 --- a/facilitator/init.d/facilitator-reg-daemon.in +++ b/facilitator/init.d/facilitator-reg-daemon.in @@ -26,10 +26,17 @@ CONFDIR=@sysconfdir@/flashproxy PRIVDROP_USER=@fpfacilitatoruser@ DAEMON=@bindir@/$NAME DAEMON_ARGS="--key $CONFDIR/reg-daemon.key --log $LOGFILE --pidfile $PIDFILE --privdrop-user $PRIVDROP_USER" +DEFAULTSFILE=@sysconfdir@/default/$NAME # Exit if the package is not installed [ -x "$DAEMON" ] || exit 0 +# Read configuration variable file if it is present +[ -r "$DEFAULTSFILE" ] && . "$DEFAULTSFILE" + +[ "$UNSAFE_LOGGING" = "yes" ] && DAEMON_ARGS="$DAEMON_ARGS --unsafe-logging" +[ -n "$PORT" ] && DAEMON_ARGS="$DAEMON_ARGS --port $PORT" + . /lib/init/vars.sh . /lib/lsb/init-functions @@ -76,6 +83,10 @@ do_stop() case "$1" in start) + if [ "$RUN_DAEMON" != "yes" ]; then + log_action_msg "Not starting $DESC (Disabled in $DEFAULTSFILE)." + exit 0 + fi [ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME" do_start case "$?" in diff --git a/facilitator/init.d/facilitator.in b/facilitator/init.d/facilitator.in index 53c27b4..d6dc0ec 100755 --- a/facilitator/init.d/facilitator.in +++ b/facilitator/init.d/facilitator.in @@ -30,13 +30,20 @@ CONFDIR=@sysconfdir@/flashproxy PRIVDROP_USER=@fpfacilitatoruser@ DAEMON=@bindir@/$NAME DAEMON_ARGS="-r $RELAY --log $LOGFILE --pidfile $PIDFILE --privdrop-user $PRIVDROP_USER" +DEFAULTSFILE=@sysconfdir@/default/$NAME # Exit if the package is not installed [ -x "$DAEMON" ] || exit 0 +# Read configuration variable file if it is present +[ -r "$DEFAULTSFILE" ] && . "$DEFAULTSFILE" + . /lib/init/vars.sh . /lib/lsb/init-functions +[ "$UNSAFE_LOGGING" = "yes" ] && DAEMON_ARGS="$DAEMON_ARGS --unsafe-logging" +[ -n "$PORT" ] && DAEMON_ARGS="$DAEMON_ARGS --port $PORT" + # # Function that starts the daemon/service # @@ -80,6 +87,10 @@ do_stop() case "$1" in start) + if [ "$RUN_DAEMON" != "yes" ]; then + log_action_msg "Not starting $DESC (Disabled in $DEFAULTSFILE)." + exit 0 + fi [ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME" do_start case "$?" in

1 0

[flashproxy/master] - rm CLEANFILES; it's only needed if we have custom rules to build them
by infinity0＠torproject.org 21 Nov '13

21 Nov '13

commit 4afdef621e3061b0254ab18424d6cb4ac83129b1 Author: Ximin Luo <infinity0(a)gmx.com> Date: Tue Oct 15 16:15:20 2013 +0100 - rm CLEANFILES; it's only needed if we have custom rules to build them --- facilitator/Makefile.am | 4 ---- 1 file changed, 4 deletions(-) diff --git a/facilitator/Makefile.am b/facilitator/Makefile.am index fa1ba71..7708f21 100644 --- a/facilitator/Makefile.am +++ b/facilitator/Makefile.am @@ -30,10 +30,6 @@ PY_LOG_COMPILER = $(PYTHON) AM_TESTS_ENVIRONMENT = PYTHONPATH='$(srcdir)'; export PYTHONPATH; AM_PY_LOG_FLAGS = -# stuff built from AC_CONFIG_FILES -# see http://www.gnu.org/software/automake/manual/html_node/Scripts.html -CLEANFILES = $(initscript_SCRIPTS) - EXTRA_DIST = $(TESTS) # our own targets

1 0