May 2013 - tor-commits - lists.torproject.org

[flashproxy/master] Add -4 and -6 options to flashproxy-reg-appspot.
by dcf＠torproject.org 19 May '13

19 May '13

commit 98c687ba76d20df884d76de7d7d08edfc824182d Author: David Fifield <david(a)bamsoftware.com> Date: Sat May 18 23:01:00 2013 -0700 Add -4 and -6 options to flashproxy-reg-appspot. --- flashproxy-reg-appspot | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/flashproxy-reg-appspot b/flashproxy-reg-appspot index 88d192d..a38f86a 100755 --- a/flashproxy-reg-appspot +++ b/flashproxy-reg-appspot @@ -42,6 +42,7 @@ def get_external_ip(): return ip class options(object): + address_family = socket.AF_UNSPEC facilitator_pubkey_filename = None def usage(f = sys.stdout): @@ -51,6 +52,8 @@ Register with a flash proxy facilitator through a Google App Engine app. By default the remote address registered is "%(remote_addr)s" (the external IP address is guessed). + -4 name lookups use only IPv4. + -6 name lookups use only IPv6. --facilitator-pubkey=FILENAME encrypt registrations to the given PEM-formatted public key (default built-in). @@ -110,9 +113,13 @@ def format_addr(addr): result += u":%d" % port return result -opt, args = getopt.gnu_getopt(sys.argv[1:], "h", ["facilitator-pubkey=", "help"]) +opt, args = getopt.gnu_getopt(sys.argv[1:], "46h", ["facilitator-pubkey=", "help"]) for o, a in opt: - if o == "--facilitator-pubkey": + if o == "-4": + options.address_family = socket.AF_INET + elif o == "-6": + options.address_family = socket.AF_INET6 + elif o == "--facilitator-pubkey": options.facilitator_pubkey_filename = a elif o == "-h" or o == "--help": usage() @@ -126,6 +133,12 @@ else: usage(sys.stderr) sys.exit(1) +if options.address_family != socket.AF_UNSPEC: + getaddrinfo = socket.getaddrinfo + def getaddrinfo_replacement(host, port, family, *args, **kwargs): + return getaddrinfo(host, port, options.address_family, *args, **kwargs) + socket.getaddrinfo = getaddrinfo_replacement + if not remote_addr[0]: spec = get_external_ip() remote_addr = parse_addr_spec(spec, *remote_addr)

1 0

[flashproxy/master] Certificate pinning for flashproxy-reg-appspot.
by dcf＠torproject.org 19 May '13

19 May '13

commit 844344efa6c975daa9ef4378eff2966adf623058 Author: David Fifield <david(a)bamsoftware.com> Date: Sun May 19 00:34:03 2013 -0700 Certificate pinning for flashproxy-reg-appspot. --- flashproxy-reg-appspot | 105 +++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 104 insertions(+), 1 deletion(-) diff --git a/flashproxy-reg-appspot b/flashproxy-reg-appspot index b9bc621..9764937 100755 --- a/flashproxy-reg-appspot +++ b/flashproxy-reg-appspot @@ -1,14 +1,25 @@ #!/usr/bin/env python import getopt +import httplib import re import os import socket +import ssl import subprocess import sys +import tempfile import urlparse import urllib2 +from hashlib import sha1 + +try: + from M2Crypto import X509 +except ImportError: + # Defer the error reporting so that --help works even without M2Crypto. + X509 = None + DEFAULT_REMOTE_ADDRESS = None DEFAULT_REMOTE_PORT = 9000 @@ -17,6 +28,39 @@ FRONT_DOMAIN = "www.google.com" # The value of the Host header within requests. TARGET_DOMAIN = "flashproxy-reg.appspot.com" +# We trust no other CA certificate than this. +# +# To find the certificate to copy here, +# $ strace openssl s_client -connect FRONT_DOMAIN:443 -verify 10 -CApath /etc/ssl/certs 2>&1 | grep /etc/ssl/certs +# stat("/etc/ssl/certs/XXXXXXXX.0", {st_mode=S_IFREG|0644, st_size=YYYY, ...}) = 0 +CA_CERTS = """\ +subject=/C=US/O=Equifax/OU=Equifax Secure Certificate Authority +issuer=/C=US/O=Equifax/OU=Equifax Secure Certificate Authority +-----BEGIN CERTIFICATE----- +MIIDIDCCAomgAwIBAgIENd70zzANBgkqhkiG9w0BAQUFADBOMQswCQYDVQQGEwJV +UzEQMA4GA1UEChMHRXF1aWZheDEtMCsGA1UECxMkRXF1aWZheCBTZWN1cmUgQ2Vy +dGlmaWNhdGUgQXV0aG9yaXR5MB4XDTk4MDgyMjE2NDE1MVoXDTE4MDgyMjE2NDE1 +MVowTjELMAkGA1UEBhMCVVMxEDAOBgNVBAoTB0VxdWlmYXgxLTArBgNVBAsTJEVx +dWlmYXggU2VjdXJlIENlcnRpZmljYXRlIEF1dGhvcml0eTCBnzANBgkqhkiG9w0B +AQEFAAOBjQAwgYkCgYEAwV2xWGcIYu6gmi0fCG2RFGiYCh7+2gRvE4RiIcPRfM6f +BeC4AfBONOziipUEZKzxa1NfBbPLZ4C/QgKO/t0BCezhABRP/PvwDN1Dulsr4R+A +cJkVV5MW8Q+XarfCaCMczE1ZMKxRHjuvK9buY0V7xdlfUNLjUA86iOe/FP3gx7kC +AwEAAaOCAQkwggEFMHAGA1UdHwRpMGcwZaBjoGGkXzBdMQswCQYDVQQGEwJVUzEQ +MA4GA1UEChMHRXF1aWZheDEtMCsGA1UECxMkRXF1aWZheCBTZWN1cmUgQ2VydGlm +aWNhdGUgQXV0aG9yaXR5MQ0wCwYDVQQDEwRDUkwxMBoGA1UdEAQTMBGBDzIwMTgw +ODIyMTY0MTUxWjALBgNVHQ8EBAMCAQYwHwYDVR0jBBgwFoAUSOZo+SvSspXXR9gj +IBBPM5iQn9QwHQYDVR0OBBYEFEjmaPkr0rKV10fYIyAQTzOYkJ/UMAwGA1UdEwQF +MAMBAf8wGgYJKoZIhvZ9B0EABA0wCxsFVjMuMGMDAgbAMA0GCSqGSIb3DQEBBQUA +A4GBAFjOKer89961zgK5F7WF0bnj4JXMJTENAKaSbn+2kmOeUJXRmm/kEd5jhW6Y +7qj/WsjTVbJmcVfewCHrPSqnI0kBBIZCe/zuf6IWUrVnZ9NA2zsmWLIodz2uFHdh +1voqZiegDfqnc1zqcPGUIWVEX/r87yloqaKHee9570+sB3c4 +-----END CERTIFICATE----- +""" +# SHA-1 digest of expected public key. See +# http://www.imperialviolet.org/2011/05/04/pinning.html for the reason behind +# hashing the public key, not the entire certificate. +PUBKEY_SHA1 = "c70ccd442ff4528c603aefef85206fd693990e09".decode("hex") + def get_external_ip(): f = urlopen(urlparse.urlunparse(("https", FRONT_DOMAIN, "/ip", "", "", ""))) try: @@ -96,6 +140,19 @@ def format_addr(addr): result += u":%d" % port return result +def get_state_dir(): + """Get a directory where we can put temporary files. Returns None if any + suitable temporary directory will do.""" + pt_dir = os.environ.get("TOR_PT_STATE_LOCATION") + if pt_dir is None: + return None + try: + os.makedirs(pt_dir) + except OSError, e: + if e.errno != errno.EEXIST: + raise + return pt_dir + def generate_url(addr): if getattr(sys, "frozen", False): script_dir = os.path.dirname(sys.executable) @@ -113,10 +170,45 @@ def generate_url(addr): stdout, stderr = p.communicate() return stdout.strip() +# Certificate validation and pinning for urllib2. Inspired by +# http://web.archive.org/web/20110125104752/http://www.muchtooscrawled.com/20…. + +class PinHTTPSConnection(httplib.HTTPSConnection): + def connect(self): + sock = socket.create_connection((self.host, self.port), self.timeout, self.source_address) + if self._tunnel_host: + self.sock = sock + self._tunnel() + + ca_certs_fd, ca_certs_path = tempfile.mkstemp(prefix="flashproxy-reg-appspot-", + dir=get_state_dir(), suffix=".crt") + try: + os.write(ca_certs_fd, CA_CERTS) + os.close(ca_certs_fd) + self.sock = ssl.wrap_socket(sock, ssl_version=ssl.PROTOCOL_TLSv1, + cert_reqs=ssl.CERT_REQUIRED, ca_certs=ca_certs_path) + finally: + os.unlink(ca_certs_path) + + # Check that the public key is what we expect. + cert_der = self.sock.getpeercert(binary_form=True) + cert = X509.load_cert_string(cert_der, format=X509.FORMAT_DER) + pubkey_der = cert.get_pubkey().as_der() + pubkey_digest = sha1(pubkey_der).digest() + + if pubkey_digest != PUBKEY_SHA1: + raise ValueError("Public key does not match pin: got %s but expected %s" % + (pubkey_digest.encode("hex"), PUBKEY_SHA1.encode("hex"))) + +class PinHTTPSHandler(urllib2.HTTPSHandler): + def https_open(self, req): + return self.do_open(PinHTTPSConnection, req) + def urlopen(url): req = urllib2.Request(url) req.add_header("Host", TARGET_DOMAIN) - return urllib2.urlopen(req) + opener = urllib2.build_opener(PinHTTPSHandler()) + return opener.open(req) opt, args = getopt.gnu_getopt(sys.argv[1:], "46h", ["facilitator-pubkey=", "help"]) for o, a in opt: @@ -138,6 +230,17 @@ else: usage(sys.stderr) sys.exit(1) +if X509 is None: + print >> sys.stderr, """\ +This program requires the M2Crypto library, which is not installed. + +You can install it using one of the packages at +http://chandlerproject.org/Projects/MeTooCrypto#Downloads. + +On Debian-like systems, use the command "apt-get install python-m2crypto".\ +""" + sys.exit(1) + if options.address_family != socket.AF_UNSPEC: getaddrinfo = socket.getaddrinfo def getaddrinfo_replacement(host, port, family, *args, **kwargs):

1 0

[flashproxy/master] Error message formatting.
by dcf＠torproject.org 19 May '13

19 May '13

commit 9a482155f8120d12c8bc046128a8eb088e5e1d88 Author: David Fifield <david(a)bamsoftware.com> Date: Sun May 19 00:36:51 2013 -0700 Error message formatting. --- flashproxy-reg-appspot | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/flashproxy-reg-appspot b/flashproxy-reg-appspot index 9764937..569f8b9 100755 --- a/flashproxy-reg-appspot +++ b/flashproxy-reg-appspot @@ -251,7 +251,7 @@ if not remote_addr[0]: spec = get_external_ip() remote_addr = parse_addr_spec(spec, *remote_addr) if not remote_addr[0]: - print >> sys.stderr, "Could not determine external ip address." + print >> sys.stderr, "Could not guess external IP address." sys.exit(1) try:

1 0

[flashproxy/master] Strip output of get_external_ip.
by dcf＠torproject.org 19 May '13

19 May '13

commit a17ad76818bddb0ede4b3198e5b0559bcb20835e Author: David Fifield <david(a)bamsoftware.com> Date: Sun May 19 00:39:53 2013 -0700 Strip output of get_external_ip. --- flashproxy-reg-appspot | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/flashproxy-reg-appspot b/flashproxy-reg-appspot index fa5378e..8975fc7 100755 --- a/flashproxy-reg-appspot +++ b/flashproxy-reg-appspot @@ -206,7 +206,7 @@ def urlopen(url): def get_external_ip(): f = urlopen(urlparse.urlunparse(("https", FRONT_DOMAIN, "/ip", "", "", ""))) try: - return f.read() + return f.read().strip() finally: f.close()

1 0

[flashproxy/master] Rearrange.
by dcf＠torproject.org 19 May '13

19 May '13

commit 1279ff633a330242587f56bc0b24c6ab235032a6 Author: David Fifield <david(a)bamsoftware.com> Date: Sun May 19 00:38:19 2013 -0700 Rearrange. --- flashproxy-reg-appspot | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/flashproxy-reg-appspot b/flashproxy-reg-appspot index 569f8b9..fa5378e 100755 --- a/flashproxy-reg-appspot +++ b/flashproxy-reg-appspot @@ -61,13 +61,6 @@ A4GBAFjOKer89961zgK5F7WF0bnj4JXMJTENAKaSbn+2kmOeUJXRmm/kEd5jhW6Y # hashing the public key, not the entire certificate. PUBKEY_SHA1 = "c70ccd442ff4528c603aefef85206fd693990e09".decode("hex") -def get_external_ip(): - f = urlopen(urlparse.urlunparse(("https", FRONT_DOMAIN, "/ip", "", "", ""))) - try: - return f.read() - finally: - f.close() - class options(object): address_family = socket.AF_UNSPEC facilitator_pubkey_filename = None @@ -210,6 +203,13 @@ def urlopen(url): opener = urllib2.build_opener(PinHTTPSHandler()) return opener.open(req) +def get_external_ip(): + f = urlopen(urlparse.urlunparse(("https", FRONT_DOMAIN, "/ip", "", "", ""))) + try: + return f.read() + finally: + f.close() + opt, args = getopt.gnu_getopt(sys.argv[1:], "46h", ["facilitator-pubkey=", "help"]) for o, a in opt: if o == "-4":

1 0

[flashproxy/master] Add constant FLASHPROXY_REG_URL.
by dcf＠torproject.org 19 May '13

19 May '13

commit d0b5adcf48b629300e2a5e947c2d95259c74988a Author: David Fifield <david(a)bamsoftware.com> Date: Sun May 19 00:44:57 2013 -0700 Add constant FLASHPROXY_REG_URL. --- flashproxy-reg-appspot | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/flashproxy-reg-appspot b/flashproxy-reg-appspot index 8975fc7..dd1f8ff 100755 --- a/flashproxy-reg-appspot +++ b/flashproxy-reg-appspot @@ -28,6 +28,8 @@ FRONT_DOMAIN = "www.google.com" # The value of the Host header within requests. TARGET_DOMAIN = "flashproxy-reg.appspot.com" +FLASHPROXY_REG_URL = "flashproxy-reg-url" + # We trust no other CA certificate than this. # # To find the certificate to copy here, @@ -154,7 +156,7 @@ def generate_url(addr): if not script_dir: # Maybe the script was read from stdin; in any case don't guess at the directory. raise ValueError("Can't find executable directory for registration helpers") - command = [os.path.join(script_dir, "flashproxy-reg-url")] + command = [os.path.join(script_dir, FLASHPROXY_REG_URL)] command += ["-f", urlparse.urlunparse(("https", "www.google.com", "/", "", "", ""))] if options.facilitator_pubkey_filename is not None: command += ["--facilitator-pubkey", options.facilitator_pubkey_filename] @@ -257,7 +259,7 @@ if not remote_addr[0]: try: url = generate_url(remote_addr) except Exception, e: - print >> sys.stderr, "Error running flashproxy-reg-url: %s" % str(e) + print >> sys.stderr, "Error running %s: %s" % (FLASHPROXY_REG_URL, str(e)) sys.exit(1) try:

1 0

[doctor/master] Add UseNTorHandshake to known consensus parameters.
by karsten＠torproject.org 19 May '13

19 May '13

commit a2faef08b2bd8c033aacd1942cb58d94f1b3bcd2 Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Sun May 19 09:23:42 2013 +0200 Add UseNTorHandshake to known consensus parameters. --- src/org/torproject/doctor/Checker.java | 3 ++- src/org/torproject/doctor/MetricsWebsiteReport.java | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/src/org/torproject/doctor/Checker.java b/src/org/torproject/doctor/Checker.java index 5681e56..707bd62 100644 --- a/src/org/torproject/doctor/Checker.java +++ b/src/org/torproject/doctor/Checker.java @@ -262,7 +262,8 @@ public class Checker { + "cbtdisabled,cbtnummodes,cbtrecentcount,cbtmaxtimeouts," + "cbtmincircs,cbtquantile,cbtclosequantile,cbttestfreq," + "cbtmintimeout,cbtinitialtimeout,perconnbwburst,perconnbwrate," - + "UseOptimisticData,pb_disablepct").split(","))); + + "UseOptimisticData,pb_disablepct,UseNTorHandshake"). + split(","))); SortedSet<String> conflicts = new TreeSet<String>(); for (RelayNetworkStatusVote vote : this.downloadedVotes) { Map<String, Integer> voteConsensusParams = diff --git a/src/org/torproject/doctor/MetricsWebsiteReport.java b/src/org/torproject/doctor/MetricsWebsiteReport.java index a03b5e1..d465e71 100644 --- a/src/org/torproject/doctor/MetricsWebsiteReport.java +++ b/src/org/torproject/doctor/MetricsWebsiteReport.java @@ -427,7 +427,8 @@ public class MetricsWebsiteReport { + "cbtdisabled,cbtnummodes,cbtrecentcount,cbtmaxtimeouts," + "cbtmincircs,cbtquantile,cbtclosequantile,cbttestfreq," + "cbtmintimeout,cbtinitialtimeout,perconnbwburst," - + "perconnbwrate,UseOptimisticData,pb_disablepct").split(","))); + + "perconnbwrate,UseOptimisticData,pb_disablepct," + + "UseNTorHandshake").split(","))); Map<String, Integer> consensusConsensusParams = downloadedConsensus.getConsensusParams(); for (RelayNetworkStatusVote vote : this.downloadedVotes.values()) {

1 0

[flashproxy/master] Add M2Crypto check to flashproxy-reg-url.
by dcf＠torproject.org 19 May '13

19 May '13

commit e182e4b68fee4fdfe9358e7e238fc9902aae2d29 Author: David Fifield <david(a)bamsoftware.com> Date: Sat May 18 23:28:19 2013 -0700 Add M2Crypto check to flashproxy-reg-url. Like in flashproxy-reg-email. --- flashproxy-reg-url | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/flashproxy-reg-url b/flashproxy-reg-url index 77935e1..b30c550 100755 --- a/flashproxy-reg-url +++ b/flashproxy-reg-url @@ -7,7 +7,11 @@ import socket import sys import urlparse -from M2Crypto import RSA, BIO +try: + from M2Crypto import BIO, RSA +except ImportError: + # Defer the error reporting so that --help works even without M2Crypto. + RSA = None DEFAULT_REMOTE_ADDRESS = None DEFAULT_REMOTE_PORT = 9000 @@ -124,6 +128,17 @@ if not remote_addr[0]: print >> sys.stderr, "An IP address (not just a port) is required." sys.exit(1) +if RSA is None: + print >> sys.stderr, """\ +This program requires the M2Crypto library, which is not installed. + +You can install it using one of the packages at +http://chandlerproject.org/Projects/MeTooCrypto#Downloads. + +On Debian-like systems, use the command "apt-get install python-m2crypto".\ +""" + sys.exit(1) + reg_plain = (u"client=%s" % format_addr(remote_addr)).encode("utf-8") rsa = get_facilitator_pubkey() reg_crypt = rsa.public_encrypt(reg_plain, RSA.pkcs1_oaep_padding)

1 0

[flashproxy/master] Code uniformity.
by dcf＠torproject.org 19 May '13

19 May '13

commit d1b3a5f301aec1df333198144d4844225d4916b8 Author: David Fifield <david(a)bamsoftware.com> Date: Sat May 18 22:43:01 2013 -0700 Code uniformity. --- flashproxy-reg-email | 5 ++--- flashproxy-reg-url | 7 ++++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/flashproxy-reg-email b/flashproxy-reg-email index 5bbf6fa..edfaff1 100755 --- a/flashproxy-reg-email +++ b/flashproxy-reg-email @@ -18,7 +18,7 @@ except ImportError: # Defer the error reporting so that --help works even without M2Crypto. X509 = None -DEFAULT_REMOTE_ADDRESS = "" +DEFAULT_REMOTE_ADDRESS = None DEFAULT_REMOTE_PORT = 9000 DEFAULT_EMAIL_ADDRESS = "flashproxyreg.a(a)gmail.com" # dig MX gmail.com @@ -185,7 +185,6 @@ def get_facilitator_pubkey(): else: return RSA.load_pub_key_bio(BIO.MemoryBuffer(DEFAULT_FACILITATOR_PUBKEY_PEM)) -options.remote_addr = (DEFAULT_REMOTE_ADDRESS, DEFAULT_REMOTE_PORT) options.email_addr = DEFAULT_EMAIL_ADDRESS options.smtp_addr = (DEFAULT_SMTP_HOST, DEFAULT_SMTP_PORT) @@ -208,7 +207,7 @@ for o, a in opts: options.smtp_addr = parse_addr_spec(a, DEFAULT_SMTP_HOST, DEFAULT_SMTP_PORT) if len(args) == 0: - pass + options.remote_addr = (DEFAULT_REMOTE_ADDRESS, DEFAULT_REMOTE_PORT) elif len(args) == 1: options.remote_addr = parse_addr_spec(args[0], DEFAULT_REMOTE_ADDRESS, DEFAULT_REMOTE_PORT) else: diff --git a/flashproxy-reg-url b/flashproxy-reg-url index bdd8cc6..77935e1 100755 --- a/flashproxy-reg-url +++ b/flashproxy-reg-url @@ -9,6 +9,7 @@ import urlparse from M2Crypto import RSA, BIO +DEFAULT_REMOTE_ADDRESS = None DEFAULT_REMOTE_PORT = 9000 DEFAULT_FACILITATOR_URL = "https://fp-facilitator.org/" DEFAULT_FACILITATOR_PUBKEY_PEM = """\ @@ -115,11 +116,11 @@ for o, a in opt: sys.exit() if len(args) != 1: - usage(f=sys.stderr) + usage(sys.stderr) sys.exit(1) -remote_addr = parse_addr_spec(args[0], defport=DEFAULT_REMOTE_PORT) -if remote_addr[0] is None: +remote_addr = parse_addr_spec(args[0], DEFAULT_REMOTE_ADDRESS, DEFAULT_REMOTE_PORT) +if not remote_addr[0]: print >> sys.stderr, "An IP address (not just a port) is required." sys.exit(1)

1 0

[flashproxy/master] Rearrange.
by dcf＠torproject.org 19 May '13

19 May '13

commit 8455c29b121f852584777fedb559fb9f5eebac47 Author: David Fifield <david(a)bamsoftware.com> Date: Sat May 18 22:30:31 2013 -0700 Rearrange. --- flashproxy-reg-email | 12 ++++++------ flashproxy-reg-url | 12 ++++++------ 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/flashproxy-reg-email b/flashproxy-reg-email index 20381cc..5bbf6fa 100755 --- a/flashproxy-reg-email +++ b/flashproxy-reg-email @@ -78,12 +78,6 @@ gwIDAQAB -----END PUBLIC KEY----- """ -def get_facilitator_pubkey(): - if options.facilitator_pubkey_filename is not None: - return RSA.load_pub_key(options.facilitator_pubkey_filename) - else: - return RSA.load_pub_key_bio(BIO.MemoryBuffer(DEFAULT_FACILITATOR_PUBKEY_PEM)) - class options(object): remote_addr = None email_addr = None @@ -185,6 +179,12 @@ def get_state_dir(): raise return pt_dir +def get_facilitator_pubkey(): + if options.facilitator_pubkey_filename is not None: + return RSA.load_pub_key(options.facilitator_pubkey_filename) + else: + return RSA.load_pub_key_bio(BIO.MemoryBuffer(DEFAULT_FACILITATOR_PUBKEY_PEM)) + options.remote_addr = (DEFAULT_REMOTE_ADDRESS, DEFAULT_REMOTE_PORT) options.email_addr = DEFAULT_EMAIL_ADDRESS options.smtp_addr = (DEFAULT_SMTP_HOST, DEFAULT_SMTP_PORT) diff --git a/flashproxy-reg-url b/flashproxy-reg-url index e8aa61a..bdd8cc6 100755 --- a/flashproxy-reg-url +++ b/flashproxy-reg-url @@ -23,12 +23,6 @@ gwIDAQAB -----END PUBLIC KEY----- """ -def get_facilitator_pubkey(): - if options.facilitator_pubkey_filename is not None: - return RSA.load_pub_key(options.facilitator_pubkey_filename) - else: - return RSA.load_pub_key_bio(BIO.MemoryBuffer(DEFAULT_FACILITATOR_PUBKEY_PEM)) - class options(object): facilitator_url = None facilitator_pubkey_filename = None @@ -102,6 +96,12 @@ def format_addr(addr): result += u":%d" % port return result +def get_facilitator_pubkey(): + if options.facilitator_pubkey_filename is not None: + return RSA.load_pub_key(options.facilitator_pubkey_filename) + else: + return RSA.load_pub_key_bio(BIO.MemoryBuffer(DEFAULT_FACILITATOR_PUBKEY_PEM)) + options.facilitator_url = DEFAULT_FACILITATOR_URL opt, args = getopt.gnu_getopt(sys.argv[1:], "f:h", ["facilitator=", "facilitator-pubkey=", "help"])

1 0