March 2013 - tor-commits - lists.torproject.org

[flashproxy/master] Change facilitator-reg-url shebang to match other python programs.
by dcf＠torproject.org 13 Mar '13

13 Mar '13

commit 682bf964dfe261662d7a3a7eeef5519d1d6e93c7 Author: Alexandre Allaire <alexandre.allaire(a)mail.mcgill.ca> Date: Mon Jan 21 17:36:08 2013 -0500 Change facilitator-reg-url shebang to match other python programs. --- facilitator/facilitator-reg-url | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/facilitator/facilitator-reg-url b/facilitator/facilitator-reg-url old mode 100644 new mode 100755 index 0127719..609346e --- a/facilitator/facilitator-reg-url +++ b/facilitator/facilitator-reg-url @@ -1,4 +1,4 @@ -#!/usr/bin/python +#!/usr/bin/env python import sys import base64

1 0

[flashproxy/master] Add documentation for URL registrations.
by dcf＠torproject.org 13 Mar '13

13 Mar '13

commit ba9b827ebeb986e849f8a898397f3b7099fdce7c Author: Alexandre Allaire <alexandre.allaire(a)mail.mcgill.ca> Date: Wed Jan 23 10:38:10 2013 -0500 Add documentation for URL registrations. Modify the facilitator howto to provide a short explanation of URL registrations and give setup instructions. --- doc/facilitator-howto.txt | 35 ++++++++++++++++++++++++++++++----- 1 files changed, 30 insertions(+), 5 deletions(-) diff --git a/doc/facilitator-howto.txt b/doc/facilitator-howto.txt index fda9b8c..1de552f 100644 --- a/doc/facilitator-howto.txt +++ b/doc/facilitator-howto.txt @@ -6,8 +6,8 @@ We will use the domain name tor-facilitator.example.com. The facilitator consists of a backend server that is essentially a dynamic database of client addresses, as well as helper programs that receive client registrations from the Internet over various means and -pass them to the backend. There are two supported helper rendezvous -methods: HTTP and email. +pass them to the backend. There are three supported helper rendezvous +methods: HTTP, URL and email. The HTTP rendezvous uses an HTTP server and a CGI program. The HTTP server is responsible for speaking TLS and invoking the CGI program. The @@ -22,6 +22,12 @@ message to a Gmail address. The poller constantly checks for new messages, decrypts and deletes them, and forwards the registrations to the facilitator. +The URL method uses the facilitator-reg-url daemon and the +flashproxy-reg-url helper program. flashproxy-reg-url prints +out URLs that can be used to register a client with a facilitator. +These URLs can then be pasted into a unblocked third-party URL retreival +serice, like the W3C Markup Validation Service. + fac.py is a Python module containing code common to the various facilitator programs. @@ -94,19 +100,21 @@ Restart servers. == Facilitator program installation - # apt-get install git + # apt-get install git python-m2crypto # git clone https://git.torproject.org/flashproxy.git # cd flashproxy/facilitator # make install This installs facilitator.cgi, facilitator, facilitator-email-poller, -and fac.py to /usr/local/bin. It also installs System V init files to -/etc/init.d/. +facilitator-reg-url, and fac.py to /usr/local/bin. It also installs +System V init files to /etc/init.d/. # update-rc.d facilitator defaults # /etc/init.d/facilitator start # update-rc.d facilitator-email-poller defaults # /etc/init.d/facilitator-email-poller start + # update-rc.d facilitator-reg-url defaults + # /etc/init.d/facilitator-reg-url start == HTTP server setup @@ -186,3 +194,20 @@ reg-email.pub into the appropriate place. Install reg-email.key and reg-email.pass to /etc/flashproxy to match what the init script expects, or else use the --key and --pass options if you have them stored in another place. + +=== URL registration daemon setup + +The facilitator-reg-url program handles the decryption of registrations +by URL. Like facilitator-email-poller, it requires an RSA keypair. + +# openssl genrsa -out /etc/flashproxy/reg-url.key 2048 +# chmod 600 /etc/flashproxy/reg-url.key +# openssl rsa -pubout < /etc/flashproxy/reg-url.key > reg-url.pub + + +You will have to edit flashproxy-reg-url and copy the contents of +reg-url.pub into the appropriate place. + +Install the private key to /etc/flashproxy to match what the init +script expects or use the --key option to specify a different +location.

1 0

[flashproxy/master] Use UTF-8 encoding for client registrations.
by dcf＠torproject.org 13 Mar '13

13 Mar '13

commit 2f1cc8411fb3f99dc7d56239ee7036001b9b9d44 Author: Alex <alex(a)alex-macair.(none)> Date: Sun Feb 24 20:46:13 2013 -0500 Use UTF-8 encoding for client registrations. facilitator-reg-url was receiving registrations in UTF-32 encoding and passing them on verbatim to getaddrinfo(), which caused it to return bogus results. --- facilitator/facilitator-reg-url | 2 +- flashproxy-reg-url | 1 + 2 files changed, 2 insertions(+), 1 deletions(-) diff --git a/facilitator/facilitator-reg-url b/facilitator/facilitator-reg-url index 609346e..591c0f1 100755 --- a/facilitator/facilitator-reg-url +++ b/facilitator/facilitator-reg-url @@ -69,7 +69,7 @@ def log(msg): def register(reg): try: ciphertext = base64.urlsafe_b64decode(reg) - client_spec = rsa.private_decrypt(ciphertext, RSA.pkcs1_oaep_padding) + client_spec = str(rsa.private_decrypt(ciphertext, RSA.pkcs1_oaep_padding).decode('UTF-8')) except: log(u"Error occurred while decoding and decrypting registration:") traceback.print_exc(file=options.log_file) diff --git a/flashproxy-reg-url b/flashproxy-reg-url index 60f7e7b..4e73ed9 100755 --- a/flashproxy-reg-url +++ b/flashproxy-reg-url @@ -104,6 +104,7 @@ if len(args) != 1: addr = parse_addr_spec(args[0], defport=DEFAULT_REMOTE_PORT) spec = format_addr(addr) +spec = spec.encode('UTF-8') rsa = RSA.load_pub_key_bio(BIO.MemoryBuffer(FACILITATOR_PUBKEY_PEM)) ciphertext = rsa.public_encrypt(spec, RSA.pkcs1_oaep_padding)

1 0

[flashproxy/master] Some changes for uniformity.
by dcf＠torproject.org 13 Mar '13

13 Mar '13

commit de8b2d0c1f38a11f9989e7d8a783acb045a7f5d6 Author: David Fifield <david(a)bamsoftware.com> Date: Sun Feb 3 01:54:48 2013 -0800 Some changes for uniformity. --- flashproxy-reg-url | 7 +++---- 1 files changed, 3 insertions(+), 4 deletions(-) diff --git a/flashproxy-reg-url b/flashproxy-reg-url index 2d525c7..20156cd 100755 --- a/flashproxy-reg-url +++ b/flashproxy-reg-url @@ -14,7 +14,7 @@ DEFAULT_FACILITATOR_URL = "https://tor-facilitator.bamsoftware.com/" class options(object): facilitator_url = None -def usage(f=sys.stdout): +def usage(f = sys.stdout): print >> f, """\ Usage: %(progname)s REMOTE[:PORT] Print a URL, which, when retrieved, will cause the client address @@ -80,8 +80,7 @@ def format_addr(addr): return u":%d" % port # Numeric IPv6 address? try: - addrs = socket.getaddrinfo(host, port, 0, socket.SOCK_STREAM, -socket.IPPROTO_TCP, socket.AI_NUMERICHOST) + addrs = socket.getaddrinfo(host, port, 0, socket.SOCK_STREAM, socket.IPPROTO_TCP, socket.AI_NUMERICHOST) af = addrs[0][0] except socket.gaierror, e: af = 0 @@ -101,7 +100,7 @@ for o, a in opt: options.facilitator_url = a elif o == "-h" or o == "--help": usage() - sys.exit(0) + sys.exit() if len(args) != 1: usage(f=sys.stderr)

1 0

[flashproxy/master] Factor out output_status function.
by dcf＠torproject.org 13 Mar '13

13 Mar '13

commit 7d116e83f14410070e7a3c75f0850a2fff366b79 Author: David Fifield <david(a)bamsoftware.com> Date: Wed Mar 6 21:37:31 2013 -0800 Factor out output_status function. --- facilitator/facilitator.cgi | 5 ++++- 1 files changed, 4 insertions(+), 1 deletions(-) diff --git a/facilitator/facilitator.cgi b/facilitator/facilitator.cgi index 72bbf89..fdcc431 100755 --- a/facilitator/facilitator.cgi +++ b/facilitator/facilitator.cgi @@ -12,10 +12,13 @@ import fac FACILITATOR_ADDR = ("127.0.0.1", 9002) FACILITATOR_REG_URL_ADDR = ("127.0.0.1", 9003) -def exit_error(status): +def output_status(status): print """\ Status: %d\r \r""" % status + +def exit_error(status): + output_status(status) sys.exit() # Send a client registration to the helper daemon,

1 0

[flashproxy/master] Add -f/--facilitator option to flashproxy-reg-url.
by dcf＠torproject.org 13 Mar '13

13 Mar '13

commit d10cdc4fd238d2bc304bdbe8486353d59c8200f5 Author: David Fifield <david(a)bamsoftware.com> Date: Sun Feb 3 01:51:27 2013 -0800 Add -f/--facilitator option to flashproxy-reg-url. --- flashproxy-reg-url | 29 +++++++++++++++++------------ 1 files changed, 17 insertions(+), 12 deletions(-) diff --git a/flashproxy-reg-url b/flashproxy-reg-url index 4e73ed9..2d525c7 100755 --- a/flashproxy-reg-url +++ b/flashproxy-reg-url @@ -8,23 +8,25 @@ import getopt from M2Crypto import RSA, BIO -FACILITATOR_URL = "https://tor-facilitator.bamsoftware.com/" DEFAULT_REMOTE_PORT = 9000 +DEFAULT_FACILITATOR_URL = "https://tor-facilitator.bamsoftware.com/" + +class options(object): + facilitator_url = None def usage(f=sys.stdout): print >> f, """\ Usage: %(progname)s REMOTE[:PORT] +Print a URL, which, when retrieved, will cause the client address +REMOTE[:PORT] to be registered with the flash proxy facilitator. The default +PORT is %(port)d. -Print a URL suitable for registering your client with the facilitator -at %(fac)s. This URL can be copy-pasted into an unblocked URL retrieval -service. The argument is the external address and port you wish to register. -If you omit the port, it will default to %(port)s. - - -h, --help show this message and exit. - + -f, --facilitator=URL register with the given facilitator + (by default "%(fac_url)s"). + -h, --help show this help.\ """ % { "progname": sys.argv[0], - "fac": FACILITATOR_URL, + "fac_url": DEFAULT_FACILITATOR_URL, "port": DEFAULT_REMOTE_PORT, } @@ -91,10 +93,13 @@ socket.IPPROTO_TCP, socket.AI_NUMERICHOST) result += u":%d" % port return result +options.facilitator_url = DEFAULT_FACILITATOR_URL -opt, args = getopt.gnu_getopt(sys.argv[1:], "h", ["help"]) +opt, args = getopt.gnu_getopt(sys.argv[1:], "f:h", ["facilitator=", "help"]) for o, a in opt: - if o == "-h" or o == "--help": + if o == "-f" or o == "--facilitator": + options.facilitator_url = a + elif o == "-h" or o == "--help": usage() sys.exit(0) @@ -110,4 +115,4 @@ rsa = RSA.load_pub_key_bio(BIO.MemoryBuffer(FACILITATOR_PUBKEY_PEM)) ciphertext = rsa.public_encrypt(spec, RSA.pkcs1_oaep_padding) reg = base64.urlsafe_b64encode(ciphertext) -print "/".join([FACILITATOR_URL.strip("/"), "reg", reg]) +print "/".join([options.facilitator_url.strip("/"), "reg", reg])

1 0

[flashproxy/master] Remove length limit on reg URLs.
by dcf＠torproject.org 13 Mar '13

13 Mar '13

commit c840adc2059eeaa6ebfa3c6526c1c806591af1bc Author: David Fifield <david(a)bamsoftware.com> Date: Wed Mar 6 21:26:22 2013 -0800 Remove length limit on reg URLs. --- facilitator/facilitator.cgi | 3 --- 1 files changed, 0 insertions(+), 3 deletions(-) diff --git a/facilitator/facilitator.cgi b/facilitator/facilitator.cgi index 28c1606..72bbf89 100755 --- a/facilitator/facilitator.cgi +++ b/facilitator/facilitator.cgi @@ -47,9 +47,6 @@ def do_get(): if args[0] != "reg": exit_error(400) reg = args[1] - # 256 byte RSA encryption, base64-encoded, should be no longer than 344 bytes. - if len(reg) > 350: - exit_error(400) if not url_reg(reg): exit_error(500) print """\

1 0

[flashproxy/master] Use status 204 (No content) after URL registration.
by dcf＠torproject.org 13 Mar '13

13 Mar '13

commit be24f2a807dd24c843c7587416c3f750415e1167 Author: David Fifield <david(a)bamsoftware.com> Date: Wed Mar 6 21:39:25 2013 -0800 Use status 204 (No content) after URL registration. --- facilitator/facilitator.cgi | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/facilitator/facilitator.cgi b/facilitator/facilitator.cgi index 57eb417..003cf86 100755 --- a/facilitator/facilitator.cgi +++ b/facilitator/facilitator.cgi @@ -49,7 +49,7 @@ def do_get(): # This is a URL-based registration. if not url_reg(path_parts[1]): exit_error(500) - output_status(200) + output_status(204) elif len(path_parts) == 0: try: reg = fac.get_reg(FACILITATOR_ADDR, remote_addr) or ""

1 0

[flashproxy/master] Simplify some URL registration code.
by dcf＠torproject.org 13 Mar '13

13 Mar '13

commit eb49f30fc3902b94eafe6119c7ef59e1e3d519ce Author: David Fifield <david(a)bamsoftware.com> Date: Wed Mar 6 21:39:12 2013 -0800 Simplify some URL registration code. --- facilitator/facilitator.cgi | 17 ++++++----------- 1 files changed, 6 insertions(+), 11 deletions(-) diff --git a/facilitator/facilitator.cgi b/facilitator/facilitator.cgi index fdcc431..57eb417 100755 --- a/facilitator/facilitator.cgi +++ b/facilitator/facilitator.cgi @@ -44,18 +44,13 @@ if not method or not remote_addr[0]: fs = cgi.FieldStorage() def do_get(): - args = [arg for arg in path_info.split("/") if arg] - # Check if we have a URL registration or a request for a client. - if len(args) == 2: - if args[0] != "reg": - exit_error(400) - reg = args[1] - if not url_reg(reg): + path_parts = [x for x in path_info.split("/") if x] + if len(path_parts) == 2 and path_parts[0] == "reg": + # This is a URL-based registration. + if not url_reg(path_parts[1]): exit_error(500) - print """\ -Status: 200\r -\r""" - elif len(args) == 0: + output_status(200) + elif len(path_parts) == 0: try: reg = fac.get_reg(FACILITATOR_ADDR, remote_addr) or "" except:

1 0

[flashproxy/master] Serial comma.
by dcf＠torproject.org 13 Mar '13

13 Mar '13

commit 4c430f589a65634afae0bf4637847c36e1c9749b Author: David Fifield <david(a)bamsoftware.com> Date: Wed Mar 6 21:46:19 2013 -0800 Serial comma. --- doc/facilitator-howto.txt | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/doc/facilitator-howto.txt b/doc/facilitator-howto.txt index 1de552f..bbf5a7a 100644 --- a/doc/facilitator-howto.txt +++ b/doc/facilitator-howto.txt @@ -7,7 +7,7 @@ The facilitator consists of a backend server that is essentially a dynamic database of client addresses, as well as helper programs that receive client registrations from the Internet over various means and pass them to the backend. There are three supported helper rendezvous -methods: HTTP, URL and email. +methods: HTTP, URL, and email. The HTTP rendezvous uses an HTTP server and a CGI program. The HTTP server is responsible for speaking TLS and invoking the CGI program. The

1 0