April 2013 - tor-commits - lists.torproject.org

[ooni-probe/master] Fix #8358. Add correct formatting and parsing of OpenSSL.crypto.X509Name
by art＠torproject.org 30 Apr '13

30 Apr '13

commit 2a474c23522bc3accc76754dd4f5f7c3a7f4f4a8 Author: Isis Lovecruft <isis(a)torproject.org> Date: Thu Feb 28 13:08:05 2013 +0000 Fix #8358. Add correct formatting and parsing of OpenSSL.crypto.X509Name objects and their fields to reports. --- nettests/experimental/tls_handshake.py | 37 ++++++++++++++++++++++++++++++- 1 files changed, 35 insertions(+), 2 deletions(-) diff --git a/nettests/experimental/tls_handshake.py b/nettests/experimental/tls_handshake.py index d990a5b..5dcc107 100644 --- a/nettests/experimental/tls_handshake.py +++ b/nettests/experimental/tls_handshake.py @@ -200,6 +200,37 @@ class TLSHandshakeTest(nettest.NetTestCase): cert_chain.append(pem_cert) return cert_chain + @staticmethod + def getX509Name(certificate, get_components=False): + """ + Get the DER encoded form of the Name portions of and X509 certificate. + + @param certificate: A :class:`OpenSSL.crypto.X509Name` object. + @param get_components: A boolean. If True, returns a list of tuples of + the (name, value)s of each Name field in the + :param:`certificate`. If False, returns the DER + encoded form of the Name fields of the + :param:`certificate`. + """ + x509_name = None + + try: + assert isinstance(certificate, crypto.X509Name), \ + "getX509Name takes OpenSSL.crypto.X509Name as first argument!" + x509_name = crypto.X509Name(certificate) + except AssertionError as ae: + log.err(ae) + except Exception as exc: + log.exception(exc) + + if not x509_name is None: + if not get_components: + return x509_name.der() + else: + return x509_name.get_components() + else: + log.debug("getX509Name: got None for ivar x509_name") + def test_tlsv1_handshake(self): """xxx fill me in""" @@ -538,9 +569,11 @@ class TLSHandshakeTest(nettest.NetTestCase): server_cert_chain = self.getPeerCert(connection, get_chain=True) s_cert = connection.get_peer_certificate() - cert_subject = s_cert.get_subject() + cert_subject = getX509Name(s_cert.get_subject(), + get_components=True) cert_subj_hash = s_cert.subject_name_hash() - cert_issuer = s_cert.get_issuer() + cert_issuer = getX509Name(s_cert.get_issuer(), + get_components=True) cert_public_key = s_cert.get_pubkey() cert_serial_no = s_cert.get_serial_number() cert_sig_algo = s_cert.get_signature_algorithm()

1 0

[ooni-probe/master] Fix #8359. Report server public key in PEM format. There is a bug in
by art＠torproject.org 30 Apr '13

30 Apr '13

commit 96a1640e614eee8fa7f84837a84066e01261c622 Author: Isis Lovecruft <isis(a)torproject.org> Date: Thu Feb 28 13:31:57 2013 +0000 Fix #8359. Report server public key in PEM format. There is a bug in pyOpenSSL where the dumped public key begins with '----- BEGIN PRIVATE KEY -----' due to the OpenSSL.crypto.dump_privatekey() method hardcoding incorrect PEM headers, which would need to be fixed in the upstream if we care enough. --- nettests/experimental/tls_handshake.py | 30 +++++++++++++++++++++++------- 1 files changed, 23 insertions(+), 7 deletions(-) diff --git a/nettests/experimental/tls_handshake.py b/nettests/experimental/tls_handshake.py index 34a917c..28c9990 100644 --- a/nettests/experimental/tls_handshake.py +++ b/nettests/experimental/tls_handshake.py @@ -32,8 +32,8 @@ import types from ipaddr import IPAddress from OpenSSL import SSL -from OpenSSL.crypto import dump_certificate, FILETYPE_PEM -from OpenSSL.crypto import X509Name +from OpenSSL.crypto import dump_certificate, dump_privatekey +from OpenSSL.crypto import X509Name, PKey, FILETYPE_PEM from twisted.internet import defer from twisted.python import usage from twisted.python.failure import Failure @@ -232,6 +232,22 @@ class TLSHandshakeTest(nettest.NetTestCase): else: log.debug("getX509Name: got None for ivar x509_name") + @staticmethod + def getPublicKey(key): + """ + Get the PEM-encoded format of a host certificate's public key. + + @param key: A :class:`OpenSSL.crypto.PKey` object. + """ + try: + assert isinstance(key, PKey), \ + "getPublicKey expects type OpenSSL.crypto.PKey for parameter key" + except AssertionError as ae: + log.err(ae) + else: + pubkey = dump_privatekey(FILETYPE_PEM, key) + return pubkey + def test_tlsv1_handshake(self): """xxx fill me in""" @@ -570,12 +586,12 @@ class TLSHandshakeTest(nettest.NetTestCase): server_cert_chain = self.getPeerCert(connection, get_chain=True) s_cert = connection.get_peer_certificate() - cert_subject = getX509Name(s_cert.get_subject(), - get_components=True) + cert_subject = self.getX509Name(s_cert.get_subject(), + get_components=True) cert_subj_hash = s_cert.subject_name_hash() - cert_issuer = getX509Name(s_cert.get_issuer(), - get_components=True) - cert_public_key = s_cert.get_pubkey() + cert_issuer = self.getX509Name(s_cert.get_issuer(), + get_components=True) + cert_public_key = self.getPublicKey(s_cert.get_pubkey()) cert_serial_no = s_cert.get_serial_number() cert_sig_algo = s_cert.get_signature_algorithm()

1 0

[ooni-probe/master] Add reporting mechanisms to handshakeSucceeded() for storing the x509
by art＠torproject.org 30 Apr '13

30 Apr '13

commit 28bb44a8b21c8b2488580f2fdbbf10cd1a5ccd75 Author: Isis Lovecruft <isis(a)torproject.org> Date: Thu Feb 28 04:35:09 2013 +0000 Add reporting mechanisms to handshakeSucceeded() for storing the x509 certificate and chain in a way that YAML won't complain about. * TODO: we may want to look into a better method for serialising certificates that is compatible with YAML, rather than just storing them as PEM encoded certs in a string. * Also, pyOpenSSL will segfault if you try to check the cert. Added a warning in the docstring of method handshakeSucceeded() about that. --- nettests/experimental/tls_handshake.py | 66 ++++++++++++++++++++++++++----- 1 files changed, 55 insertions(+), 11 deletions(-) diff --git a/nettests/experimental/tls_handshake.py b/nettests/experimental/tls_handshake.py index c77682d..da6cbc0 100644 --- a/nettests/experimental/tls_handshake.py +++ b/nettests/experimental/tls_handshake.py @@ -506,17 +506,61 @@ class TLSHandshakeTest(nettest.NetTestCase): return connection def handshakeSucceeded(connection): - if connection: - host, port = connection.getpeername() - self.report['host'] = host - self.report['port'] = port - self.report['state'] = connection.state_string() - - def handshakeFailed(connection, addr, port): - if connection is None: - self.report['host'] = addr - self.report['port'] = port - self.report['state'] = 'FAILED' + """ + Get the details from the server certificate, cert chain, and + server ciphersuite list, and put them in our report. + + WARNING: do *not* do this: + >>> server_cert.get_pubkey() + <OpenSSL.crypto.PKey at 0x4985d28> + >>> pk = server_cert.get_pubkey() + >>> pk.check + <function check> + >>> pk.check() + Segmentation fault + + @param connection: A :class:`OpenSSL.SSL.Connection`. + @returns: None. + """ + host, port = connection.getpeername() + server_cert = self.getPeerCert(connection) + server_cert_chain = self.getPeerCert(connection, get_chain=True) + + s_cert = connection.get_peer_certificate() + cert_subject = s_cert.get_subject() + cert_subj_hash = s_cert.subject_name_hash() + cert_issuer = s_cert.get_issuer() + cert_public_key = s_cert.get_pubkey() + cert_serial_no = s_cert.get_serial_number() + cert_sig_algo = s_cert.get_signature_algorithm() + + self.report['host'] = host + self.report['port'] = port + self.report['state'] = connection.state_string() + self.report['renegotiations'] = connection.total_renegotiations() + self.report['server_cert'] = server_cert + self.report['server_cert_chain'] = \ + ''.join([cert for cert in server_cert_chain]) + self.report['server_ciphersuite'] = connection.get_cipher_list() + self.report['cert_subject'] = str(cert_subject) + self.report['cert_subj_hash'] = str(cert_subj_hash) + self.report['cert_issuer'] = str(cert_issuer) + ## xxx this needs to be parsed into PEM also + self.report['cert_public_key'] = str(cert_public_key) + self.report['cert_serial_no'] = str(cert_serial_no) + self.report['cert_sig_algo'] = str(cert_sig_algo) + + ## The session's master key is only valid for that session, and + ## will allow us to decrypt any packet captures (if they were + ## collected). Because we are not requesting URLs, only host:port + ## (which would be visible in pcaps anyway, since the FQDN is + ## never encrypted) I do not see a way for this to log any user or + ## identifying information. Correct me if I'm wrong. + self.report['session_key'] = connection.master_key() + + ## xxx do we need this? + #return connection + else: return handshakeSucceeded(connection)

1 0

[ooni-probe/master] Update imports for tls_handshake.py.
by art＠torproject.org 30 Apr '13

30 Apr '13

commit 34d7ebc3bcde788a2f4dfaeec105b1b4b069e368 Author: Isis Lovecruft <isis(a)torproject.org> Date: Thu Feb 28 17:39:04 2013 +0000 Update imports for tls_handshake.py. --- nettests/experimental/tls_handshake.py | 34 +++++++++++++++++++------------ 1 files changed, 21 insertions(+), 13 deletions(-) diff --git a/nettests/experimental/tls_handshake.py b/nettests/experimental/tls_handshake.py index 28c9990..76b9d3f 100644 --- a/nettests/experimental/tls_handshake.py +++ b/nettests/experimental/tls_handshake.py @@ -21,7 +21,8 @@ @copyright: © 2013 Isis Lovecruft, The Tor Project Inc. """ -from socket import error as socket_error +from socket import error as socket_error +from socket import timeout as socket_timeout from time import sleep import os @@ -30,13 +31,12 @@ import struct import sys import types +import OpenSSL + from ipaddr import IPAddress -from OpenSSL import SSL -from OpenSSL.crypto import dump_certificate, dump_privatekey -from OpenSSL.crypto import X509Name, PKey, FILETYPE_PEM -from twisted.internet import defer -from twisted.python import usage -from twisted.python.failure import Failure +from OpenSSL import SSL, crypto +from twisted.internet import defer, threads +from twisted.python import usage, failure from ooni import nettest, config from ooni.utils import log, NotRootError @@ -82,6 +82,13 @@ class HostUnreachableError(Exception): """Raised when there the host IP address appears to be unreachable.""" pass +class ConnectionTimeout(Exception): + """ + Raised when we receive a :class:`socket.timeout`, in order to pass the + Exception along to :func:`connectionFailed`. + """ + pass + class UsageOptions(usage.Options): optParameters = [ ['host', 'h', None, 'Remote host IP address (v4/v6)'], @@ -191,13 +198,14 @@ class TLSHandshakeTest(nettest.NetTestCase): def getPeerCert(connection, get_chain=False): if not get_chain: x509_cert = connection.get_peer_certificate() - pem_cert = dump_certificate(FILETYPE_PEM, x509_cert) + pem_cert = crypto.dump_certificate(crypto.FILETYPE_PEM, x509_cert) return pem_cert else: cert_chain = [] x509_cert_chain = connection.get_peer_cert_chain() for x509_cert in x509_cert_chain: - pem_cert = dump_certificate(FILETYPE_PEM, x509_cert) + pem_cert = crypto.dump_certificate(crypto.FILETYPE_PEM, + x509_cert) cert_chain.append(pem_cert) return cert_chain @@ -216,9 +224,9 @@ class TLSHandshakeTest(nettest.NetTestCase): x509_name = None try: - assert isinstance(certificate, X509Name), \ + assert isinstance(certificate, crypto.X509Name), \ "getX509Name takes OpenSSL.crypto.X509Name as first argument!" - x509_name = X509Name(certificate) + x509_name = crypto.X509Name(certificate) except AssertionError as ae: log.err(ae) except Exception as exc: @@ -240,12 +248,12 @@ class TLSHandshakeTest(nettest.NetTestCase): @param key: A :class:`OpenSSL.crypto.PKey` object. """ try: - assert isinstance(key, PKey), \ + assert isinstance(key, crypto.PKey), \ "getPublicKey expects type OpenSSL.crypto.PKey for parameter key" except AssertionError as ae: log.err(ae) else: - pubkey = dump_privatekey(FILETYPE_PEM, key) + pubkey = crypto.dump_privatekey(crypto.FILETYPE_PEM, key) return pubkey def test_tlsv1_handshake(self):

1 0

[ooni-probe/master] Fix import statements to include X509Name class.
by art＠torproject.org 30 Apr '13

30 Apr '13

commit ebdf72719f82a575717a2713f52d5fa2665bf835 Author: Isis Lovecruft <isis(a)torproject.org> Date: Thu Feb 28 13:23:45 2013 +0000 Fix import statements to include X509Name class. --- nettests/experimental/tls_handshake.py | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-) diff --git a/nettests/experimental/tls_handshake.py b/nettests/experimental/tls_handshake.py index 5dcc107..34a917c 100644 --- a/nettests/experimental/tls_handshake.py +++ b/nettests/experimental/tls_handshake.py @@ -33,6 +33,7 @@ import types from ipaddr import IPAddress from OpenSSL import SSL from OpenSSL.crypto import dump_certificate, FILETYPE_PEM +from OpenSSL.crypto import X509Name from twisted.internet import defer from twisted.python import usage from twisted.python.failure import Failure @@ -215,9 +216,9 @@ class TLSHandshakeTest(nettest.NetTestCase): x509_name = None try: - assert isinstance(certificate, crypto.X509Name), \ + assert isinstance(certificate, X509Name), \ "getX509Name takes OpenSSL.crypto.X509Name as first argument!" - x509_name = crypto.X509Name(certificate) + x509_name = X509Name(certificate) except AssertionError as ae: log.err(ae) except Exception as exc:

1 0

[ooni-probe/master] Fix tls_handshake.py method makeConnection to handle socket timeouts.
by art＠torproject.org 30 Apr '13

30 Apr '13

commit 176901bd0f8411f6cc7ddaf56c242ff9ee71b92e Author: Isis Lovecruft <isis(a)torproject.org> Date: Thu Feb 28 17:39:46 2013 +0000 Fix tls_handshake.py method makeConnection to handle socket timeouts. * makeConnection() now returns a ConnectionTimeout wrapped in a t.p.failure.Failure() if it receives a socket timeout. --- nettests/experimental/tls_handshake.py | 9 +++++++-- 1 files changed, 7 insertions(+), 2 deletions(-) diff --git a/nettests/experimental/tls_handshake.py b/nettests/experimental/tls_handshake.py index 76b9d3f..4c42017 100644 --- a/nettests/experimental/tls_handshake.py +++ b/nettests/experimental/tls_handshake.py @@ -273,8 +273,13 @@ class TLSHandshakeTest(nettest.NetTestCase): sckt = self.buildSocket(addr) context = self.getContext() connection = SSL.Connection(context, sckt) - connection.connect(host) - return connection + try: + connection.connect(host) + except socket_timeout as stmo: + error = ConnectionTimeout(stmo.message) + return failure.Failure(error) + else: + return connection def connectionFailed(connection, host): """

1 0

[tor-launcher/master] Remove TODO comments.
by brade＠torproject.org 30 Apr '13

30 Apr '13

commit 566c8a931a7359eb55ca3cc7c9bbfc561d3c3971 Author: Kathy Brade <brade(a)torproject.org> Date: Tue Apr 30 08:53:46 2013 -0400 Remove TODO comments. --- src/components/tl-process.js | 8 -------- 1 files changed, 0 insertions(+), 8 deletions(-) diff --git a/src/components/tl-process.js b/src/components/tl-process.js index 1057795..3c6ed23 100644 --- a/src/components/tl-process.js +++ b/src/components/tl-process.js @@ -307,13 +307,6 @@ TorProcessService.prototype = if (isInitialBootstrap) { - // TODO: Sometimes the code in network-settings.js tries to retrieve - // Tor settings (via GETCONF) before the Tor process has time - // to open its control port listener. We either need to add - // a short delay here, find a way to monitor Tor to know when - // it is ready to accept control port connections, or we need - // to delay before retry inside TorSendCommand()... which is - // difficult b/c that is a synchronous API. if (this.mProtocolSvc) this._openNetworkSettings(true); // Blocks until dialog is closed. } @@ -363,7 +356,6 @@ TorProcessService.prototype = if (!aStatusObj) return; - // TODO: keep viewable log of RECOMMENDATION == "ignore" messages. if (100 == aStatusObj.PROGRESS) { this.mIsBootstrapDone = true;

1 0

[flashproxy/master] #8626 seems to be fixed with the request timeout.
by dcf＠torproject.org 30 Apr '13

30 Apr '13

commit e5e76f5a48d5b6b1599fc97cd235ed713c486a05 Author: David Fifield <david(a)bamsoftware.com> Date: Tue Apr 30 01:02:10 2013 -0700 #8626 seems to be fixed with the request timeout. --- ChangeLog | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/ChangeLog b/ChangeLog index 879563b..ff0f59b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -9,6 +9,7 @@ Changes in version 1.0 port protocol to identify incoming connections as websocket. o There is now a 10-second HTTP request timeout in websocket-server. + Fixes bug 8626. Changes in version 0.12 o The new flashproxy-reg-url program prints a URL which, when

1 0

[flashproxy/master] get_facilitator_pubkey read from the global options.
by dcf＠torproject.org 30 Apr '13

30 Apr '13

commit 4041f936d599f2aeb3c099668b8f46ff30937a91 Author: David Fifield <david(a)bamsoftware.com> Date: Mon Apr 29 23:44:54 2013 -0700 get_facilitator_pubkey read from the global options. --- flashproxy-reg-email | 8 ++++---- flashproxy-reg-url | 8 ++++---- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/flashproxy-reg-email b/flashproxy-reg-email index 45609c9..5164c7e 100755 --- a/flashproxy-reg-email +++ b/flashproxy-reg-email @@ -78,9 +78,9 @@ gwIDAQAB -----END PUBLIC KEY----- """ -def get_facilitator_pubkey(filename): - if filename is not None: - return RSA.load_pub_key(filename) +def get_facilitator_pubkey(): + if options.facilitator_pubkey_filename is not None: + return RSA.load_pub_key(options.facilitator_pubkey_filename) else: return RSA.load_pub_key_bio( BIO.MemoryBuffer(DEFAULT_FACILITATOR_PUBKEY_PEM)) @@ -281,7 +281,7 @@ try: options.remote_addr = parse_addr_spec(spec, *options.remote_addr) body_plain = (u"client=%s" % format_addr(options.remote_addr)).encode("utf-8") - rsa = get_facilitator_pubkey(options.facilitator_publickey_filename) + rsa = get_facilitator_pubkey() body_crypt = rsa.public_encrypt(body_plain, RSA.pkcs1_oaep_padding) body = body_crypt.encode("base64") diff --git a/flashproxy-reg-url b/flashproxy-reg-url index b9cdcc9..b094b9b 100755 --- a/flashproxy-reg-url +++ b/flashproxy-reg-url @@ -23,9 +23,9 @@ gwIDAQAB -----END PUBLIC KEY----- """ -def get_facilitator_pubkey(filename): - if filename is not None: - return RSA.load_pub_key(filename) +def get_facilitator_pubkey(): + if options.facilitator_pubkey_filename is not None: + return RSA.load_pub_key(options.facilitator_pubkey_filename) else: return RSA.load_pub_key_bio( BIO.MemoryBuffer(DEFAULT_FACILITATOR_PUBKEY_PEM)) @@ -124,7 +124,7 @@ if remote_addr[0] is None: sys.exit(1) reg_plain = (u"client=%s" % format_addr(remote_addr)).encode("utf-8") -rsa = get_facilitator_pubkey(options.facilitator_publickey_filename) +rsa = get_facilitator_pubkey() reg_crypt = rsa.public_encrypt(reg_plain, RSA.pkcs1_oaep_padding) reg = base64.urlsafe_b64encode(reg_crypt)

1 0

[flashproxy/master] Add --facilitator-pubkey option to registration helpers.
by dcf＠torproject.org 30 Apr '13

30 Apr '13

commit e0dacb98ad9737b3c86b47df14cc8dd7da46f2f5 Author: Arlo Breault <arlolra(a)gmail.com> Date: Mon Apr 29 12:04:51 2013 -0700 Add --facilitator-pubkey option to registration helpers. It lets you give the name of a file holding a non-default facilitator public key. See https://trac.torproject.org/projects/tor/ticket/8800. --- flashproxy-reg-email | 18 +++++++++++++++--- flashproxy-reg-url | 45 ++++++++++++++++++++++++++++----------------- 2 files changed, 43 insertions(+), 20 deletions(-) diff --git a/flashproxy-reg-email b/flashproxy-reg-email index e446590..6336bb1 100755 --- a/flashproxy-reg-email +++ b/flashproxy-reg-email @@ -66,7 +66,7 @@ PUBKEY_SHA1 = "1926a5cb3fd7e48328188946e73ade84f55787dc".decode("hex") # the facilitator operators should have the corresponding private key. Given a # private key in reg-email, get the public key like this: # openssl rsa -pubout < reg-email > reg-email.pub -FACILITATOR_PUBKEY_PEM = """\ +DEFAULT_FACILITATOR_PUBKEY_PEM = """\ -----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA44Mt8c599/4N2fgu6ppN oatPW1GOgZxxObljFtEy0OWM1eHB35OOn+Kn9MxNHTRxVWwCEi0HYxWNVs2qrXxV @@ -78,6 +78,13 @@ gwIDAQAB -----END PUBLIC KEY----- """ +def get_facilitator_pubkey(filename): + if filename is not None: + return RSA.load_pub_key(filename) + else: + return RSA.load_pub_key_bio( + BIO.MemoryBuffer(DEFAULT_FACILITATOR_PUBKEY_PEM)) + class options(object): remote_addr = None email_addr = None @@ -102,6 +109,7 @@ This program requires the M2Crypto library for Python. -6 name lookups use only IPv6. -d, --debug enable debugging output (Python smtplib messages). -e, --email=ADDRESS send mail to ADDRESS (default "%(email_addr)s"). + -k, --facilitator-pubkey=FILE corresponds to the reg-daemon private key -h, --help show this help. -s, --smtp=HOST[:PORT] use the given SMTP server (default "%(smtp_addr)s").\ @@ -178,8 +186,10 @@ def get_state_dir(): options.remote_addr = (DEFAULT_REMOTE_ADDRESS, DEFAULT_REMOTE_PORT) options.email_addr = DEFAULT_EMAIL_ADDRESS options.smtp_addr = (DEFAULT_SMTP_HOST, DEFAULT_SMTP_PORT) +options.facilitator_publickey_filename = None -opts, args = getopt.gnu_getopt(sys.argv[1:], "46de:hs:", ["debug", "email=", "help", "smtp="]) +opts, args = getopt.gnu_getopt(sys.argv[1:], "46de:k:hs:", + ["debug", "email=", "facilitator-pubkey=", "help", "smtp="]) for o, a in opts: if o == "-4": options.address_family = socket.AF_INET @@ -189,6 +199,8 @@ for o, a in opts: options.debug = True elif o == "-e" or o == "--email": options.email_addr = a + elif o == "-k" or o == "--facilitator-pubkey": + options.facilitator_publickey_filename = a elif o == "-h" or o == "--help": usage() sys.exit() @@ -269,7 +281,7 @@ try: options.remote_addr = parse_addr_spec(spec, *options.remote_addr) body_plain = (u"client=%s" % format_addr(options.remote_addr)).encode("utf-8") - rsa = RSA.load_pub_key_bio(BIO.MemoryBuffer(FACILITATOR_PUBKEY_PEM)) + rsa = get_facilitator_pubkey(options.facilitator_publickey_filename) body_crypt = rsa.public_encrypt(body_plain, RSA.pkcs1_oaep_padding) body = body_crypt.encode("base64") diff --git a/flashproxy-reg-url b/flashproxy-reg-url index 75f6905..4a4a555 100755 --- a/flashproxy-reg-url +++ b/flashproxy-reg-url @@ -11,6 +11,24 @@ from M2Crypto import RSA, BIO DEFAULT_REMOTE_PORT = 9000 DEFAULT_FACILITATOR_URL = "https://fp-facilitator.org/" +DEFAULT_FACILITATOR_PUBKEY_PEM = """\ +-----BEGIN PUBLIC KEY----- +MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA44Mt8c599/4N2fgu6ppN +oatPW1GOgZxxObljFtEy0OWM1eHB35OOn+Kn9MxNHTRxVWwCEi0HYxWNVs2qrXxV +84LmWBz6A65d2qBlgltgLXusiXLrpwxVmJeO+GfmbF8ur0U9JSYxA20cGW/kujNg +XYDGQxO1Gvxq2lHK2LQmBpkfKEE1DMFASmIvlHDQgDj3XBb5lYeOsHZmg16UrGAq +1UH238hgJITPGLXBtwLtJkYbrATJvrEcmvI7QSm57SgYGpaB5ZdCbJL5bag5Pgt6 +M5SDDYYY4xxEPzokjFJfCQv+kcyAnzERNMQ9kR41ePTXG62bpngK5iWGeJ5XdkxG +gwIDAQAB +-----END PUBLIC KEY----- +""" + +def get_facilitator_pubkey(filename): + if filename is not None: + return RSA.load_pub_key(filename) + else: + return RSA.load_pub_key_bio( + BIO.MemoryBuffer(DEFAULT_FACILITATOR_PUBKEY_PEM)) class options(object): facilitator_url = None @@ -22,27 +40,16 @@ Print a URL, which, when retrieved, will cause the client address REMOTE[:PORT] to be registered with the flash proxy facilitator. The default PORT is %(port)d. - -f, --facilitator=URL register with the given facilitator - (by default "%(fac_url)s"). - -h, --help show this help.\ + -f, --facilitator=URL register with the given facilitator + (by default "%(fac_url)s"). + -k, --facilitator-pubkey=FILE corresponds to the reg-daemon private key + -h, --help show this help.\ """ % { "progname": sys.argv[0], "fac_url": DEFAULT_FACILITATOR_URL, "port": DEFAULT_REMOTE_PORT, } -FACILITATOR_PUBKEY_PEM = """\ ------BEGIN PUBLIC KEY----- -MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA44Mt8c599/4N2fgu6ppN -oatPW1GOgZxxObljFtEy0OWM1eHB35OOn+Kn9MxNHTRxVWwCEi0HYxWNVs2qrXxV -84LmWBz6A65d2qBlgltgLXusiXLrpwxVmJeO+GfmbF8ur0U9JSYxA20cGW/kujNg -XYDGQxO1Gvxq2lHK2LQmBpkfKEE1DMFASmIvlHDQgDj3XBb5lYeOsHZmg16UrGAq -1UH238hgJITPGLXBtwLtJkYbrATJvrEcmvI7QSm57SgYGpaB5ZdCbJL5bag5Pgt6 -M5SDDYYY4xxEPzokjFJfCQv+kcyAnzERNMQ9kR41ePTXG62bpngK5iWGeJ5XdkxG -gwIDAQAB ------END PUBLIC KEY----- -""" - def parse_addr_spec(spec, defhost = None, defport = None): host = None port = None @@ -94,11 +101,15 @@ def format_addr(addr): return result options.facilitator_url = DEFAULT_FACILITATOR_URL +options.facilitator_publickey_filename = None -opt, args = getopt.gnu_getopt(sys.argv[1:], "f:h", ["facilitator=", "help"]) +opt, args = getopt.gnu_getopt(sys.argv[1:], "f:k:h", + ["facilitator=", "facilitator-pubkey=", "help"]) for o, a in opt: if o == "-f" or o == "--facilitator": options.facilitator_url = a + elif o == "-k" or o == "--facilitator-pubkey": + options.facilitator_publickey_filename = a elif o == "-h" or o == "--help": usage() sys.exit() @@ -113,7 +124,7 @@ if remote_addr[0] is None: sys.exit(1) reg_plain = (u"client=%s" % format_addr(remote_addr)).encode("utf-8") -rsa = RSA.load_pub_key_bio(BIO.MemoryBuffer(FACILITATOR_PUBKEY_PEM)) +rsa = get_facilitator_pubkey(options.facilitator_publickey_filename) reg_crypt = rsa.public_encrypt(reg_plain, RSA.pkcs1_oaep_padding) reg = base64.urlsafe_b64encode(reg_crypt)

1 0