May 2014 - tor-commits - lists.torproject.org

[bridgedb/develop] Whitespace fix for one line in scripts/make-ssl-cert.
by isis＠torproject.org 29 May '14

29 May '14

commit 14ff79b443ca17f2b9140ee00ab3092c2647d180 Author: Isis Lovecruft <isis(a)torproject.org> Date: Tue May 20 18:11:43 2014 +0000 Whitespace fix for one line in scripts/make-ssl-cert. --- scripts/make-ssl-cert | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/make-ssl-cert b/scripts/make-ssl-cert index 77fd728..ea2fc39 100755 --- a/scripts/make-ssl-cert +++ b/scripts/make-ssl-cert @@ -27,7 +27,7 @@ while [ -h "$THIS_FILE" ]; do THIS_FILE="$(readlink "$THIS_FILE")" # if $THIS_FILE was a relative symlink, we need to resolve it relative to # the path where the symlink file was located: - [[ $THIS_FILE != /* ]] && THIS_FILE="$THIS_PATH/$THIS_FILE" + [[ $THIS_FILE != /* ]] && THIS_FILE="$THIS_PATH/$THIS_FILE" done THIS_PATH="$( cd -P "$( dirname "$THIS_FILE" )" && pwd )"

1 0

[bridgedb/develop] Hush OpenSSL during key/cert creation in scripts/make-ssl-cert.
by isis＠torproject.org 29 May '14

29 May '14

commit da121b3a5135d66095edb469b02c47f8ccb1adab Author: Isis Lovecruft <isis(a)torproject.org> Date: Tue May 20 18:14:41 2014 +0000 Hush OpenSSL during key/cert creation in scripts/make-ssl-cert. --- scripts/make-ssl-cert | 47 +++++++++++++++++++++++++++-------------------- 1 file changed, 27 insertions(+), 20 deletions(-) diff --git a/scripts/make-ssl-cert b/scripts/make-ssl-cert index ce8f7c2..76e4d70 100755 --- a/scripts/make-ssl-cert +++ b/scripts/make-ssl-cert @@ -34,27 +34,34 @@ THIS_PATH="$( cd -P "$( dirname "$THIS_FILE" )" && pwd )" REPO_PATH=${THIS_PATH%%/scripts} function usage () { - printf "Usage: %s\n\n" $NAME - printf "This script will create an SSL key and certificate ('privkey.pem' and 'cert'\n" - printf "respectively). The key has had it's password removed, and thus is suitable\n" - printf "for automation and CI tests." - printf "\n" + cat <<EOF +Usage: $NAME + +This script will create an SSL key and certificate ('privkey.pem' and 'cert' +respectively). The key has had it's password removed, and thus is suitable +for automation and CI tests. + +EOF } if test "$#" -ge 1 ; then usage ; exit 1 ; fi -# Go to the toplevel directory of the BridgeDB repo: -cd $REPO_PATH -#printf "%s: Current working directory:\n\t%s\n" $NAME $PWD - -openssl genrsa -des3 -passout pass:bridgedb -out privkey 4096 -openssl req -batch -passin pass:bridgedb -new -key privkey -out server.csr -cp privkey privkey.nopasswd -openssl rsa -passin pass:bridgedb -in privkey.nopasswd -out privkey.pem -openssl x509 -req -days 365 -in server.csr -signkey privkey.pem -out cert -test -f "privkey.nopasswd" && rm -f privkey.nopasswd -test -f "privkey" && rm -f privkey -test -f "server.csr" && rm -f server.csr - -printf "Done. Your private key was saved in ${REPO_PATH}/privkey.pem \n" -printf "and your certificate is in ${REPO_PATH}/cert \n" +{ + # Go to the toplevel directory of the BridgeDB repo: + cd $REPO_PATH + + openssl genrsa -des3 -passout pass:bridgedb -out privkey 4096 + openssl req -batch -passin pass:bridgedb -new -key privkey -out server.csr + cp privkey privkey.nopasswd + openssl rsa -passin pass:bridgedb -in privkey.nopasswd -out privkey.pem + openssl x509 -req -days 365 -in server.csr -signkey privkey.pem -out cert + + test -f "privkey.nopasswd" && rm -f privkey.nopasswd + test -f "privkey" && rm -f privkey + test -f "server.csr" && rm -f server.csr + +} 1>/dev/null 2>&1 + + +printf "Created private key: ${REPO_PATH}/privkey.pem \n" +printf "Created certificate: ${REPO_PATH}/cert \n"

1 0

[bridgedb/develop] Fix scripts/make-ssl-cert to use `exit 1` after wrong number of args.
by isis＠torproject.org 29 May '14

29 May '14

commit 2100e35252b1e828c173f3a2b38d364d8bfcc015 Author: Isis Lovecruft <isis(a)torproject.org> Date: Tue May 20 18:12:55 2014 +0000 Fix scripts/make-ssl-cert to use `exit 1` after wrong number of args. --- scripts/make-ssl-cert | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/scripts/make-ssl-cert b/scripts/make-ssl-cert index ea2fc39..ce8f7c2 100755 --- a/scripts/make-ssl-cert +++ b/scripts/make-ssl-cert @@ -40,7 +40,8 @@ function usage () { printf "for automation and CI tests." printf "\n" } -if test "$#" -gt "1" ; then usage ; fi + +if test "$#" -ge 1 ; then usage ; exit 1 ; fi # Go to the toplevel directory of the BridgeDB repo: cd $REPO_PATH

1 0

[bridgedb/develop] Add more logging to b.e.server.checkDKIM() function.
by isis＠torproject.org 29 May '14

29 May '14

commit 07ca1978ceb841e22d2c7389a0116f1d92677039 Author: Isis Lovecruft <isis(a)torproject.org> Date: Wed May 28 18:12:15 2014 +0000 Add more logging to b.e.server.checkDKIM() function. --- lib/bridgedb/email/server.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/lib/bridgedb/email/server.py b/lib/bridgedb/email/server.py index c0ea273..2a2a66f 100644 --- a/lib/bridgedb/email/server.py +++ b/lib/bridgedb/email/server.py @@ -65,6 +65,9 @@ def checkDKIM(message, rules): 2. Those headers were *not* okay. Otherwise, returns ``True``. """ + logging.info("Checking DKIM verification results...") + logging.debug("Domain has rules: %s" % ', '.join(rules)) + if 'dkim' in rules: # getheader() returns the last of a given kind of header; we want # to get the first, so we use getheaders() instead.

1 0

[bridgedb/develop] Clarify comment string for EMAIL_SMTP_FROM_ADDR in config.
by isis＠torproject.org 29 May '14

29 May '14

commit a56a5a2978179ae8a88a6c3f8a19eb1119fd6711 Author: Isis Lovecruft <isis(a)torproject.org> Date: Tue May 27 22:21:09 2014 +0000 Clarify comment string for EMAIL_SMTP_FROM_ADDR in config. --- bridgedb.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bridgedb.conf b/bridgedb.conf index eaf82ed..eac6a34 100644 --- a/bridgedb.conf +++ b/bridgedb.conf @@ -279,7 +279,7 @@ EMAIL_DIST = True # EMAIL_FROM_ADDR goes in the 'From:' header on outgoing emails: EMAIL_FROM_ADDR = "bridges(a)torproject.org" -# EMAIL_SMTP_FROM_ADDR goes in the 'Mail-From:' header in outgoing SMTP: +# EMAIL_SMTP_FROM_ADDR goes in the 'MAIL FROM:' command in outgoing SMTP: EMAIL_SMTP_FROM_ADDR = "bridges(a)torproject.org" EMAIL_SMTP_HOST = "127.0.0.1"

1 0

[bridgedb/develop] Update b.e.server.validateTo() docstring.
by isis＠torproject.org 29 May '14

29 May '14

commit 5827bc9136d66bc5a97dc80995b6079cc5787890 Author: Isis Lovecruft <isis(a)torproject.org> Date: Wed May 28 18:18:13 2014 +0000 Update b.e.server.validateTo() docstring. --- lib/bridgedb/email/server.py | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/lib/bridgedb/email/server.py b/lib/bridgedb/email/server.py index cdc1721..b7e90ef 100644 --- a/lib/bridgedb/email/server.py +++ b/lib/bridgedb/email/server.py @@ -736,9 +736,21 @@ class MailDelivery(object): return origin # This method *cannot* return None, or it'll cause a 503. def validateTo(self, user): - """If the local user that was addressed isn't our configured local user - or doesn't contain a '+' with a prefix matching the local configured - user: Yell. + """Validate the SMTP ``RCPT TO:`` address for the incoming connection. + + The local username and domain name to which this SMTP message is + addressed, after being stripped of any ``'+'`` aliases, **must** be + identical to those in the email address set our + ``EMAIL_SMTP_FROM_ADDR`` configuration file option. + + :type user: :api:`twisted.mail.smtp.User` + :param user: Information about the user this SMTP message was + addressed to. + :raises: A :api:`twisted.mail.smtp.SMTPBadRcpt` if any of the above + conditions weren't met. + :rtype: callable + :returns: A parameterless function which returns an instance of + :class:`SMTPMessage`. """ u = user.dest.local # Hasplus? If yes, strip '+foo'

1 0

[bridgedb/develop] Fix ivar and incomplete items in email.server.MailContext docstring.
by isis＠torproject.org 29 May '14

29 May '14

commit bb50b474c3f16c1061498b183f68d7846c58b1cc Author: Isis Lovecruft <isis(a)torproject.org> Date: Tue May 27 22:23:10 2014 +0000 Fix ivar and incomplete items in email.server.MailContext docstring. --- lib/bridgedb/email/server.py | 43 ++++++++++++++++++++++-------------------- 1 file changed, 23 insertions(+), 20 deletions(-) diff --git a/lib/bridgedb/email/server.py b/lib/bridgedb/email/server.py index dbc0c67..c0ea273 100644 --- a/lib/bridgedb/email/server.py +++ b/lib/bridgedb/email/server.py @@ -189,32 +189,35 @@ def generateResponse(fromAddress, clientAddress, body, subject=None, class MailContext(object): - """Helper object that holds information used by email subsystem.""" + """Helper object that holds information used by email subsystem. + + :ivar str username: Reject any RCPT TO lines that aren't to this + user. See the ``EMAIL_USERNAME`` option in the config file. + (default: ``'bridges'``) + :ivar int maximumSize: Reject any incoming emails longer than + this size (in bytes). (default: 3084 bytes). + :ivar int smtpPort: The port to use for outgoing SMTP. + :ivar str smtpServer: The IP address to use for outgoing SMTP. + :ivar str smtpFromAddr: Use this address in the raw SMTP ``MAIL FROM`` + line for outgoing mail. (default: ``bridges(a)torproject.org``) + :ivar str fromAddr: Use this address in the email :header:`From:` + line for outgoing mail. (default: ``bridges(a)torproject.org``) + :ivar int nBridges: The number of bridges to send for each email. + :ivar gpgContext: A ``gpgme.GpgmeContext`` (as created by + :func:`bridgedb.crypto.getGPGContext`), or None if we couldn't create + a proper GPGME context for some reason. + """ def __init__(self, config, distributor, schedule): - """DOCDOC - - :ivar str username: Reject any RCPT TO lines that aren't to this - user. See the ``EMAIL_USERNAME`` option in the config file. - (default: ``'bridges'``) - :ivar int maximumSize: Reject any incoming emails longer than - this size (in bytes). (default: 3084 bytes). - :ivar int smtpPort: The port to use for outgoing SMTP. - :ivar str smtpServer: The IP address to use for outgoing SMTP. - :ivar str smtpFromAddr: Use this address in the raw SMTP ``MAIL FROM`` - line for outgoing mail. (default: ``bridges(a)torproject.org``) - :ivar str fromAddr: Use this address in the email :header:`From:` - line for outgoing mail. (default: ``bridges(a)torproject.org``) - :ivar int nBridges: The number of bridges to send for each email. - :ivar gpgContext: A ``gpgme.GpgmeContext`` (as created by - :func:`bridgedb.crypto.getGPGContext`), or None if we couldn't - create a proper GPGME context for some reason. + """Create a context for storing configs for email bridge distribution. :type config: :class:`bridgedb.persistent.Conf` :type distributor: :class:`bridgedb.Dist.EmailBasedDistributor`. - :param distributor: DOCDOC + :param distributor: The distributor will handle getting the correct + bridges (or none) for a client for us. :type schedule: :class:`bridgedb.schedule.ScheduledInterval`. - :param schedule: DOCDOC + :param schedule: An interval-based scheduler, used to help the + :ivar:`distributor` know if we should give bridges to a client. """ self.config = config self.distributor = distributor

1 0

[bridgedb/develop] Update b.e.server.MailDelivery.validateFrom() docstring.
by isis＠torproject.org 29 May '14

29 May '14

commit 180c1141123301764db43dfd435d8063048b1502 Author: Isis Lovecruft <isis(a)torproject.org> Date: Wed May 28 18:15:30 2014 +0000 Update b.e.server.MailDelivery.validateFrom() docstring. --- lib/bridgedb/email/server.py | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/lib/bridgedb/email/server.py b/lib/bridgedb/email/server.py index 96527f5..cdc1721 100644 --- a/lib/bridgedb/email/server.py +++ b/lib/bridgedb/email/server.py @@ -692,11 +692,19 @@ class MailDelivery(object): return hdr def validateFrom(self, helo, origin): - """Validate the ``"From:"`` address on the incoming email. + """Validate the ``MAIL FROM:`` address on the incoming SMTP connection. This is done at the SMTP layer. Meaning that if a Postfix or other email server is proxying emails from the outside world to BridgeDB, - the ``origin.domain`` will be set to the local hostname. + the :api:`origin.domain <twisted.email.smtp.Address.domain` will be + set to the local hostname. Therefore, if the SMTP ``MAIL FROM:`` + domain name is our own hostname (as returned from + :func:`socket.gethostname`) or our own FQDN, allow the connection. + + Otherwise, if the ``MAIL FROM:`` domain has a canonical domain in our + mapping (taken from :ivar:`context.canon <MailContext.canon>`, which + is taken in turn from the ``EMAIL_DOMAIN_MAP``), then our + :ivar:`fromCanonicalSMTP` is set to that domain. :type helo: tuple :param helo: The lines received during SMTP client HELO.

1 0

[bridgedb/develop] Update b.e.server.addServer() docstring.
by isis＠torproject.org 29 May '14

29 May '14

commit c053bffea4648e58568de961b4cf93005db10c75 Author: Isis Lovecruft <isis(a)torproject.org> Date: Wed May 28 18:18:55 2014 +0000 Update b.e.server.addServer() docstring. --- lib/bridgedb/email/server.py | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/lib/bridgedb/email/server.py b/lib/bridgedb/email/server.py index b7e90ef..03643dc 100644 --- a/lib/bridgedb/email/server.py +++ b/lib/bridgedb/email/server.py @@ -785,12 +785,8 @@ class MailFactory(smtp.SMTPFactory): def addServer(config, distributor, schedule): """Set up a SMTP server for responding to requests for bridges. - :param config: A configuration object from Main. We use these - options:: - EMAIL_BIND_IP - EMAIL_PORT - EMAIL_N_BRIDGES_PER_ANSWER - EMAIL_DOMAIN_RULES + :type config: :class:`bridgedb.persistent.Conf` + :param config: A configuration object. :type distributor: :class:`bridgedb.Dist.EmailBasedDistributor` :param dist: A distributor which will handle database interactions, and will decide which bridges to give to who and when.

1 0

[bridgedb/develop] Fix Sphinx method link in b.e.server.generateResponse() docstring.
by isis＠torproject.org 29 May '14

29 May '14

commit d2387ae03f1f3564ee7e8cccf76f5e4cf7851e0f Author: Isis Lovecruft <isis(a)torproject.org> Date: Wed May 28 18:12:58 2014 +0000 Fix Sphinx method link in b.e.server.generateResponse() docstring. --- lib/bridgedb/email/server.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/bridgedb/email/server.py b/lib/bridgedb/email/server.py index 2a2a66f..96527f5 100644 --- a/lib/bridgedb/email/server.py +++ b/lib/bridgedb/email/server.py @@ -173,7 +173,7 @@ def generateResponse(fromAddress, clientAddress, body, subject=None, :rtype: :class:`MailResponse` :returns: A ``MailResponse`` which contains the entire email. To obtain the contents of the email, including all headers, simply use - :meth:`MailResponse.read`. + :meth:`MailResponse.readContents`. """ response = MailResponse(gpgContext) response.writeHeaders(fromAddress, clientAddress, subject,

1 0