May 2013 - tor-commits - lists.torproject.org

[flashproxy/master] App Engine app handling /ip and /reg.
by dcf＠torproject.org 19 May '13

19 May '13

commit 427e9834d71ad30274f924dd20d0cd692396bf40 Author: Arlo Breault <arlolra(a)gmail.com> Date: Fri May 10 15:02:20 2013 -0700 App Engine app handling /ip and /reg. Works with the prototype described in #8860 --- appspot/app.yaml | 9 +++++++++ appspot/fp.go | 32 ++++++++++++++++++++++++++++++++ flashproxy-reg-appspot | 6 +++--- 3 files changed, 44 insertions(+), 3 deletions(-) diff --git a/appspot/app.yaml b/appspot/app.yaml new file mode 100644 index 0000000..27cccb3 --- /dev/null +++ b/appspot/app.yaml @@ -0,0 +1,9 @@ +application: flashproxy-reg +version: 1 +runtime: go +api_version: go1 + +handlers: +- url: /(ip|(reg/.+)) + script: _go_app + secure: always diff --git a/appspot/fp.go b/appspot/fp.go new file mode 100644 index 0000000..ee569a2 --- /dev/null +++ b/appspot/fp.go @@ -0,0 +1,32 @@ +package fp + +import ( + "fmt" + "net/http" + + "appengine" + "appengine/urlfetch" +) + +const BASE = "https://fp-facilitator.org/reg/" + +func ipHandler(w http.ResponseWriter, r *http.Request) { + fmt.Fprintf(w, "%s", r.RemoteAddr) +} + +func regHandler(w http.ResponseWriter, r *http.Request) { + c := appengine.NewContext(r) + blob := r.URL.String()[5:] + client := urlfetch.Client(c) + _, err := client.Get(BASE + blob) + if err != nil { + http.Error(w, err.Error(), http.StatusInternalServerError) + return + } + fmt.Fprintf(w, "Thanks.") +} + +func init() { + http.HandleFunc("/ip", ipHandler) + http.HandleFunc("/reg/", regHandler) +} diff --git a/flashproxy-reg-appspot b/flashproxy-reg-appspot index 9b9b4c3..cb595ce 100755 --- a/flashproxy-reg-appspot +++ b/flashproxy-reg-appspot @@ -32,7 +32,7 @@ def get_facilitator_pubkey(): def get_external_ip(): try: - f = urllib2.urlopen("https://agentgatech.appspot.com/") + f = urllib2.urlopen("https://flashproxy-reg.appspot.com/ip") except: return None ip = f.read() @@ -140,5 +140,5 @@ rsa = get_facilitator_pubkey() reg_crypt = rsa.public_encrypt(reg_plain, RSA.pkcs1_oaep_padding) reg = base64.urlsafe_b64encode(reg_crypt) -url = urlparse.urljoin(options.facilitator_url, "reg/" + reg) -urllib2.urlopen("https://g-proxy.appspot.com/" + urllib2.quote(url)) +url = urlparse.urljoin("http://flashproxy-reg.appspot.com/reg/", reg) +urllib2.urlopen(url)

1 0

[flashproxy/master] Error checking and diagnostics.
by dcf＠torproject.org 19 May '13

19 May '13

commit f53c7f3fb3dd8cb1e6eadf0f9830c10ce75193d4 Author: David Fifield <david(a)bamsoftware.com> Date: Sat May 18 19:12:04 2013 -0700 Error checking and diagnostics. --- flashproxy-reg-appspot | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/flashproxy-reg-appspot b/flashproxy-reg-appspot index 5415ac1..c1c9763 100755 --- a/flashproxy-reg-appspot +++ b/flashproxy-reg-appspot @@ -137,7 +137,8 @@ if remote_addr[0] is None: print >> sys.stderr, "Could not determine external ip address." sys.exit(1) -reg_plain = (u"client=%s" % format_addr(remote_addr)).encode("utf-8") +spec = format_addr(remote_addr) +reg_plain = (u"client=%s" % spec).encode("utf-8") rsa = get_facilitator_pubkey() reg_crypt = rsa.public_encrypt(reg_plain, RSA.pkcs1_oaep_padding) reg = base64.urlsafe_b64encode(reg_crypt) @@ -145,4 +146,17 @@ reg = base64.urlsafe_b64encode(reg_crypt) url = urlparse.urljoin("https://www.google.com/reg/", reg) req = urllib2.Request(url) req.add_header("Host", "flashproxy-reg.appspot.com") -urllib2.urlopen(req) +try: + http = urllib2.urlopen(req) +except urllib2.HTTPError, e: + print >> sys.stderr, "Status code was %d, not 200" % e.code + sys.exit(1) +except urllib2.URLError, e: + print >> sys.stderr, "Failed to register: %s" % str(e.reason) + sys.exit(1) +except Exception, e: + print >> sys.stderr, "Failed to register: %s" % str(e) + sys.exit(1) +http.close() + +print "Registered \"%s\" with %s." % (spec, "flashproxy-reg.appspot.com")

1 0

[flashproxy/master] Command-line parameters are optional in flashproxy-reg-appspot.
by dcf＠torproject.org 19 May '13

19 May '13

commit 112406b409531ae990dce9d3e7e246d0fba8528b Author: David Fifield <david(a)bamsoftware.com> Date: Sat May 18 22:49:33 2013 -0700 Command-line parameters are optional in flashproxy-reg-appspot. --- flashproxy-reg-appspot | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/flashproxy-reg-appspot b/flashproxy-reg-appspot index f0c5d5e..dddf7ec 100755 --- a/flashproxy-reg-appspot +++ b/flashproxy-reg-appspot @@ -48,10 +48,10 @@ class options(object): def usage(f = sys.stdout): print >> f, """\ -Usage: %(progname)s REMOTE[:PORT] -Print a URL, which, when retrieved, will cause the client address -REMOTE[:PORT] to be registered with the flash proxy facilitator. The -default PORT is %(port)d. +Usage: %(progname)s [REMOTE][:PORT] +Register with a flash proxy facilitator through a Google App Engine app. +By default the remote address registered is "%(remote_addr)s" (the +external IP address is guessed). -f, --facilitator=URL register with the given facilitator (by default "%(fac_url)s"). @@ -61,8 +61,8 @@ default PORT is %(port)d. -h, --help show this help.\ """ % { "progname": sys.argv[0], + "remote_addr": format_addr((DEFAULT_REMOTE_ADDRESS, DEFAULT_REMOTE_PORT)), "fac_url": DEFAULT_FACILITATOR_URL, - "port": DEFAULT_REMOTE_PORT, } def parse_addr_spec(spec, defhost = None, defport = None): @@ -127,16 +127,20 @@ for o, a in opt: usage() sys.exit() -if len(args) != 1: +if len(args) == 0: + remote_addr = (DEFAULT_REMOTE_ADDRESS, DEFAULT_REMOTE_PORT) +elif len(args) == 1: + remote_addr = parse_addr_spec(args[0], DEFAULT_REMOTE_ADDRESS, DEFAULT_REMOTE_PORT) +else: usage(sys.stderr) sys.exit(1) -remote_addr = parse_addr_spec(args[0], DEFAULT_REMOTE_ADDRESS, DEFAULT_REMOTE_PORT) if not remote_addr[0]: - remote_addr = parse_addr_spec(get_external_ip(), defport=remote_addr[1]) -if not remote_addr[0]: - print >> sys.stderr, "Could not determine external ip address." - sys.exit(1) + spec = get_external_ip() + remote_addr = parse_addr_spec(spec, *remote_addr) + if not remote_addr[0]: + print >> sys.stderr, "Could not determine external ip address." + sys.exit(1) spec = format_addr(remote_addr) reg_plain = (u"client=%s" % spec).encode("utf-8")

1 0

[flashproxy/master] Remove unused facilitator_url.
by dcf＠torproject.org 19 May '13

19 May '13

commit f0319e954c0d60f2c72407b417146d62d93113c1 Author: David Fifield <david(a)bamsoftware.com> Date: Sat May 18 22:59:48 2013 -0700 Remove unused facilitator_url. --- flashproxy-reg-appspot | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-) diff --git a/flashproxy-reg-appspot b/flashproxy-reg-appspot index dddf7ec..88d192d 100755 --- a/flashproxy-reg-appspot +++ b/flashproxy-reg-appspot @@ -12,7 +12,6 @@ from M2Crypto import RSA, BIO DEFAULT_REMOTE_ADDRESS = None DEFAULT_REMOTE_PORT = 9000 -DEFAULT_FACILITATOR_URL = "https://fp-facilitator.org/" DEFAULT_FACILITATOR_PUBKEY_PEM = """\ -----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA44Mt8c599/4N2fgu6ppN @@ -43,7 +42,6 @@ def get_external_ip(): return ip class options(object): - facilitator_url = None facilitator_pubkey_filename = None def usage(f = sys.stdout): @@ -53,8 +51,6 @@ Register with a flash proxy facilitator through a Google App Engine app. By default the remote address registered is "%(remote_addr)s" (the external IP address is guessed). - -f, --facilitator=URL register with the given facilitator - (by default "%(fac_url)s"). --facilitator-pubkey=FILENAME encrypt registrations to the given PEM-formatted public key (default built-in). @@ -62,7 +58,6 @@ external IP address is guessed). """ % { "progname": sys.argv[0], "remote_addr": format_addr((DEFAULT_REMOTE_ADDRESS, DEFAULT_REMOTE_PORT)), - "fac_url": DEFAULT_FACILITATOR_URL, } def parse_addr_spec(spec, defhost = None, defport = None): @@ -115,13 +110,9 @@ def format_addr(addr): result += u":%d" % port return result -options.facilitator_url = DEFAULT_FACILITATOR_URL - -opt, args = getopt.gnu_getopt(sys.argv[1:], "f:h", ["facilitator=", "facilitator-pubkey=", "help"]) +opt, args = getopt.gnu_getopt(sys.argv[1:], "h", ["facilitator-pubkey=", "help"]) for o, a in opt: - if o == "-f" or o == "--facilitator": - options.facilitator_url = a - elif o == "--facilitator-pubkey": + if o == "--facilitator-pubkey": options.facilitator_pubkey_filename = a elif o == "-h" or o == "--help": usage()

1 0

[flashproxy/master] Split out if block for flashproxy-reg-appspot.
by dcf＠torproject.org 19 May '13

19 May '13

commit 02a307b7fe7d0c2f858cc596aaa2a2850abeb7f8 Author: David Fifield <david(a)bamsoftware.com> Date: Sat May 18 22:57:53 2013 -0700 Split out if block for flashproxy-reg-appspot. --- flashproxy-client | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/flashproxy-client b/flashproxy-client index 7fc36fa..69405d0 100755 --- a/flashproxy-client +++ b/flashproxy-client @@ -963,8 +963,13 @@ def build_register_command(method): af = ["-4"] elif options.address_family == socket.AF_INET6: af = ["-6"] - if method in ["email", "appspot"]: - command = [os.path.join(script_dir, "flashproxy-reg-" + method)] + af + if method == "appspot": + command = [os.path.join(script_dir, "flashproxy-reg-appspot"] + af + if options.facilitator_pubkey_filename is not None: + command += ["--facilitator-pubkey", options.facilitator_pubkey_filename] + return command + elif method == "email": + command = [os.path.join(script_dir, "flashproxy-reg-email"] + af if options.facilitator_pubkey_filename is not None: command += ["--facilitator-pubkey", options.facilitator_pubkey_filename] return command

1 0

[flashproxy/master] I'm guessing these extra parens aren't needed.
by dcf＠torproject.org 19 May '13

19 May '13

commit e30e005503bc22ef6c8e54c6db45b8df1ef43446 Author: David Fifield <david(a)bamsoftware.com> Date: Sat May 18 19:23:55 2013 -0700 I'm guessing these extra parens aren't needed. --- appspot/app.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/appspot/app.yaml b/appspot/app.yaml index 27cccb3..fa86e75 100644 --- a/appspot/app.yaml +++ b/appspot/app.yaml @@ -4,6 +4,6 @@ runtime: go api_version: go1 handlers: -- url: /(ip|(reg/.+)) +- url: /(ip|reg/.+) script: _go_app secure: always

1 0

[flashproxy/master] Code uniformity.
by dcf＠torproject.org 19 May '13

19 May '13

commit 8692851568c88ffb4fd2a387ba2ef4f12c99e69f Author: David Fifield <david(a)bamsoftware.com> Date: Sat May 18 22:45:25 2013 -0700 Code uniformity. --- flashproxy-reg-appspot | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/flashproxy-reg-appspot b/flashproxy-reg-appspot index c1c9763..f0c5d5e 100755 --- a/flashproxy-reg-appspot +++ b/flashproxy-reg-appspot @@ -10,6 +10,7 @@ import urllib2 from M2Crypto import RSA, BIO +DEFAULT_REMOTE_ADDRESS = None DEFAULT_REMOTE_PORT = 9000 DEFAULT_FACILITATOR_URL = "https://fp-facilitator.org/" DEFAULT_FACILITATOR_PUBKEY_PEM = """\ @@ -127,13 +128,13 @@ for o, a in opt: sys.exit() if len(args) != 1: - usage(f=sys.stderr) + usage(sys.stderr) sys.exit(1) -remote_addr = parse_addr_spec(args[0], defport=DEFAULT_REMOTE_PORT) -if remote_addr[0] is None: +remote_addr = parse_addr_spec(args[0], DEFAULT_REMOTE_ADDRESS, DEFAULT_REMOTE_PORT) +if not remote_addr[0]: remote_addr = parse_addr_spec(get_external_ip(), defport=remote_addr[1]) -if remote_addr[0] is None: +if not remote_addr[0]: print >> sys.stderr, "Could not determine external ip address." sys.exit(1)

1 0

[flashproxy/master] Make flashproxy-reg-appspot call flashproxy-reg-url.
by dcf＠torproject.org 19 May '13

19 May '13

commit 07eb363644ef798dfeb0ab30ac4a666cd2d3da9c Author: David Fifield <david(a)bamsoftware.com> Date: Sat May 18 23:15:40 2013 -0700 Make flashproxy-reg-appspot call flashproxy-reg-url. Rather than do all the crypto itself. --- flashproxy-reg-appspot | 51 +++++++++++++++++++++++------------------------- 1 file changed, 24 insertions(+), 27 deletions(-) diff --git a/flashproxy-reg-appspot b/flashproxy-reg-appspot index a38f86a..7cd43dd 100755 --- a/flashproxy-reg-appspot +++ b/flashproxy-reg-appspot @@ -1,34 +1,16 @@ #!/usr/bin/env python -import base64 import getopt import re +import os import socket +import subprocess import sys import urlparse import urllib2 -from M2Crypto import RSA, BIO - DEFAULT_REMOTE_ADDRESS = None DEFAULT_REMOTE_PORT = 9000 -DEFAULT_FACILITATOR_PUBKEY_PEM = """\ ------BEGIN PUBLIC KEY----- -MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA44Mt8c599/4N2fgu6ppN -oatPW1GOgZxxObljFtEy0OWM1eHB35OOn+Kn9MxNHTRxVWwCEi0HYxWNVs2qrXxV -84LmWBz6A65d2qBlgltgLXusiXLrpwxVmJeO+GfmbF8ur0U9JSYxA20cGW/kujNg -XYDGQxO1Gvxq2lHK2LQmBpkfKEE1DMFASmIvlHDQgDj3XBb5lYeOsHZmg16UrGAq -1UH238hgJITPGLXBtwLtJkYbrATJvrEcmvI7QSm57SgYGpaB5ZdCbJL5bag5Pgt6 -M5SDDYYY4xxEPzokjFJfCQv+kcyAnzERNMQ9kR41ePTXG62bpngK5iWGeJ5XdkxG -gwIDAQAB ------END PUBLIC KEY----- -""" - -def get_facilitator_pubkey(): - if options.facilitator_pubkey_filename is not None: - return RSA.load_pub_key(options.facilitator_pubkey_filename) - else: - return RSA.load_pub_key_bio(BIO.MemoryBuffer(DEFAULT_FACILITATOR_PUBKEY_PEM)) def get_external_ip(): req = urllib2.Request("https://www.google.com/ip") @@ -113,6 +95,22 @@ def format_addr(addr): result += u":%d" % port return result +def generate_url(addr): + if getattr(sys, "frozen", False): + script_dir = os.path.dirname(sys.executable) + else: + script_dir = sys.path[0] + if not script_dir: + # Maybe the script was read from stdin; in any case don't guess at the directory. + raise ValueError("Can't find executable directory for registration helpers") + command = [os.path.join(script_dir, "flashproxy-reg-url"), "-f", "https://www.google.com/"] + if options.facilitator_pubkey_filename is not None: + command += ["--facilitator-pubkey", options.facilitator_pubkey_filename] + command.append(format_addr(addr)) + p = subprocess.Popen(command, stdout=subprocess.PIPE) + stdout, stderr = p.communicate() + return stdout.strip() + opt, args = getopt.gnu_getopt(sys.argv[1:], "46h", ["facilitator-pubkey=", "help"]) for o, a in opt: if o == "-4": @@ -146,13 +144,12 @@ if not remote_addr[0]: print >> sys.stderr, "Could not determine external ip address." sys.exit(1) -spec = format_addr(remote_addr) -reg_plain = (u"client=%s" % spec).encode("utf-8") -rsa = get_facilitator_pubkey() -reg_crypt = rsa.public_encrypt(reg_plain, RSA.pkcs1_oaep_padding) -reg = base64.urlsafe_b64encode(reg_crypt) +try: + url = generate_url(remote_addr) +except Exception, e: + print >> sys.stderr, "Error running flashproxy-reg-url: %s" % str(e) + sys.exit(1) -url = urlparse.urljoin("https://www.google.com/reg/", reg) req = urllib2.Request(url) req.add_header("Host", "flashproxy-reg.appspot.com") try: @@ -168,4 +165,4 @@ except Exception, e: sys.exit(1) http.close() -print "Registered \"%s\" with %s." % (spec, "flashproxy-reg.appspot.com") +print "Registered \"%s\" with %s." % (format_addr(remote_addr), "flashproxy-reg.appspot.com")

1 0

[flashproxy/master] go fmt.
by dcf＠torproject.org 19 May '13

19 May '13

commit 5597f222cc9c4c2080c5d5668446758882972304 Author: David Fifield <david(a)bamsoftware.com> Date: Sat May 18 19:24:39 2013 -0700 go fmt. --- appspot/fp.go | 32 ++++++++++++++++---------------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/appspot/fp.go b/appspot/fp.go index 1218681..ea19c89 100644 --- a/appspot/fp.go +++ b/appspot/fp.go @@ -1,32 +1,32 @@ package fp import ( - "fmt" - "net/http" + "fmt" + "net/http" - "appengine" - "appengine/urlfetch" + "appengine" + "appengine/urlfetch" ) const BASE = "https://fp-facilitator.org/reg/" func ipHandler(w http.ResponseWriter, r *http.Request) { - fmt.Fprintf(w, "%s", r.RemoteAddr) + fmt.Fprintf(w, "%s", r.RemoteAddr) } func regHandler(w http.ResponseWriter, r *http.Request) { - c := appengine.NewContext(r) - blob := r.URL.Path[5:] - client := urlfetch.Client(c) - _, err := client.Get(BASE + blob) - if err != nil { - http.Error(w, err.Error(), http.StatusInternalServerError) - return - } - fmt.Fprintf(w, "Thanks.") + c := appengine.NewContext(r) + blob := r.URL.Path[5:] + client := urlfetch.Client(c) + _, err := client.Get(BASE + blob) + if err != nil { + http.Error(w, err.Error(), http.StatusInternalServerError) + return + } + fmt.Fprintf(w, "Thanks.") } func init() { - http.HandleFunc("/ip", ipHandler) - http.HandleFunc("/reg/", regHandler) + http.HandleFunc("/ip", ipHandler) + http.HandleFunc("/reg/", regHandler) }

1 0

[flashproxy/master] Abstract Host substitution.
by dcf＠torproject.org 19 May '13

19 May '13

commit 3194f6b18ff9e295329679177ffb0dc61e56b319 Author: David Fifield <david(a)bamsoftware.com> Date: Sat May 18 23:24:39 2013 -0700 Abstract Host substitution. --- flashproxy-reg-appspot | 31 ++++++++++++++++++------------- 1 file changed, 18 insertions(+), 13 deletions(-) diff --git a/flashproxy-reg-appspot b/flashproxy-reg-appspot index 7cd43dd..b9bc621 100755 --- a/flashproxy-reg-appspot +++ b/flashproxy-reg-appspot @@ -12,16 +12,17 @@ import urllib2 DEFAULT_REMOTE_ADDRESS = None DEFAULT_REMOTE_PORT = 9000 +# The domain to which requests appear to go. +FRONT_DOMAIN = "www.google.com" +# The value of the Host header within requests. +TARGET_DOMAIN = "flashproxy-reg.appspot.com" + def get_external_ip(): - req = urllib2.Request("https://www.google.com/ip") - req.add_header("Host", "flashproxy-reg.appspot.com") + f = urlopen(urlparse.urlunparse(("https", FRONT_DOMAIN, "/ip", "", "", ""))) try: - f = urllib2.urlopen(req) - except: - return "" - ip = f.read() - f.close() - return ip + return f.read() + finally: + f.close() class options(object): address_family = socket.AF_UNSPEC @@ -103,7 +104,8 @@ def generate_url(addr): if not script_dir: # Maybe the script was read from stdin; in any case don't guess at the directory. raise ValueError("Can't find executable directory for registration helpers") - command = [os.path.join(script_dir, "flashproxy-reg-url"), "-f", "https://www.google.com/"] + command = [os.path.join(script_dir, "flashproxy-reg-url")] + command += ["-f", urlparse.urlunparse(("https", "www.google.com", "/", "", "", ""))] if options.facilitator_pubkey_filename is not None: command += ["--facilitator-pubkey", options.facilitator_pubkey_filename] command.append(format_addr(addr)) @@ -111,6 +113,11 @@ def generate_url(addr): stdout, stderr = p.communicate() return stdout.strip() +def urlopen(url): + req = urllib2.Request(url) + req.add_header("Host", TARGET_DOMAIN) + return urllib2.urlopen(req) + opt, args = getopt.gnu_getopt(sys.argv[1:], "46h", ["facilitator-pubkey=", "help"]) for o, a in opt: if o == "-4": @@ -150,10 +157,8 @@ except Exception, e: print >> sys.stderr, "Error running flashproxy-reg-url: %s" % str(e) sys.exit(1) -req = urllib2.Request(url) -req.add_header("Host", "flashproxy-reg.appspot.com") try: - http = urllib2.urlopen(req) + http = urlopen(url) except urllib2.HTTPError, e: print >> sys.stderr, "Status code was %d, not 200" % e.code sys.exit(1) @@ -165,4 +170,4 @@ except Exception, e: sys.exit(1) http.close() -print "Registered \"%s\" with %s." % (format_addr(remote_addr), "flashproxy-reg.appspot.com") +print "Registered \"%s\" with %s." % (format_addr(remote_addr), TARGET_DOMAIN)

1 0