March 2016 - tor-commits - lists.torproject.org

[snowflake/master] Use "ExtORPort auto" in documentation.
by dcf＠torproject.org 26 Mar '16

26 Mar '16

commit 346f316038947765e74a9a764d6b9ad5837c2b54 Author: David Fifield <david(a)bamsoftware.com> Date: Sat Mar 26 15:34:27 2016 -0700 Use "ExtORPort auto" in documentation. --- server/server.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/server.go b/server/server.go index 6729266..c424c29 100644 --- a/server/server.go +++ b/server/server.go @@ -3,7 +3,7 @@ // "snowflake" and does not forward the remote address to the ExtORPort. // // Usage in torrc: -// ExtORPort 6669 +// ExtORPort auto // ServerTransportPlugin snowflake exec server --port 9901 package main

1 0

[websocket/master] Use "ExtORPort auto" everywhere.
by dcf＠torproject.org 26 Mar '16

26 Mar '16

commit 6dc990ad6a898bc507605c51a5aa860fb9f74201 Author: David Fifield <david(a)bamsoftware.com> Date: Sat Mar 26 15:33:24 2016 -0700 Use "ExtORPort auto" everywhere. --- README | 2 +- websocket-server/websocket-server.go | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README b/README index 718dd67..85ddc9b 100644 --- a/README +++ b/README @@ -26,5 +26,5 @@ Git master as of 15 August, 2013 works. Add configuration like the following to the relay's torrc. You can change the --port option; make sure that port is open in the firewall. - ExtORPort 6669 + ExtORPort auto ServerTransportPlugin websocket exec /usr/local/bin/websocket-server --port 9901 diff --git a/websocket-server/websocket-server.go b/websocket-server/websocket-server.go index 6fb5a0b..e555152 100644 --- a/websocket-server/websocket-server.go +++ b/websocket-server/websocket-server.go @@ -1,7 +1,7 @@ // Tor websocket server transport plugin. // // Usage in torrc: -// ExtORPort 6669 +// ExtORPort auto // ServerTransportPlugin websocket exec ./websocket-server --port 9901 package main

1 0

[snowflake/master] Move server to server-webrtc.
by dcf＠torproject.org 26 Mar '16

26 Mar '16

commit c4cfc7f8ba2a3be9dbccad6d6d7bab35cb7fb8f9 Author: David Fifield <david(a)bamsoftware.com> Date: Sat Mar 26 11:00:20 2016 -0700 Move server to server-webrtc. To make room for the WebSocket server we're actually going to use as a primary server. Move server-webrtc docs to server-webrtc/README.md. --- .gitignore | 2 +- Makefile | 2 +- README.md | 37 +----- server-webrtc/README.md | 26 ++++ server-webrtc/http.go | 67 ++++++++++ server-webrtc/snowflake.go | 300 +++++++++++++++++++++++++++++++++++++++++++++ server-webrtc/torrc | 8 ++ server/http.go | 67 ---------- server/snowflake.go | 300 --------------------------------------------- server/torrc | 8 -- 10 files changed, 408 insertions(+), 409 deletions(-) diff --git a/.gitignore b/.gitignore index f9356ae..784e6c4 100644 --- a/.gitignore +++ b/.gitignore @@ -5,7 +5,7 @@ .DS_Store datadir/ client/client -server/server +server-webrtc/server-webrtc snowflake.log proxy/test proxy/build diff --git a/Makefile b/Makefile index 688e273..fbf12ae 100644 --- a/Makefile +++ b/Makefile @@ -2,4 +2,4 @@ .PHONY: check check: ! gofmt -l . 2>&1 | read - go vet ./broker ./client ./server \ No newline at end of file + go vet ./broker ./client ./server-webrtc diff --git a/README.md b/README.md index f9f1b1f..db896e6 100644 --- a/README.md +++ b/README.md @@ -70,9 +70,6 @@ method (see `torrc-manual`): ClientTransportPlugin snowflake exec ./client --meek ``` -Also, it is possible to connect directly to the go-webrtc server plugin -(skipping all the browser snowflake / broker stuff - see appendix) - #### Building a Snowflake @@ -134,35 +131,6 @@ abundance of ephemeral and short-lived (and special!) volunteer proxies... ### Appendix -##### -- Testing directly via WebRTC Server -- - -Ordinarily, the WebRTC client plugin speaks with a Broker which helps -match and signal with a browser proxy, which ultimately speaks with a default -websocket server. - - -However, there is a WebRTC server plugin which uses an HTTP server that -simulates the interaction that a client would have with the broker, for -direct testing. - -Edit server/torrc and add "-http 127.0.0.1:8080" to the end of the -ServerTransportPlugin line: -``` -ServerTransportPlugin snowflake exec ./server -http 127.0.0.1:8080 -``` - -``` -cd server/ -go build -tor -f torrc -``` - -Edit client/torrc and add "-url http://127.0.0.1:8080" to the end of the -ClientTransportPlugin line: -``` -ClientTransportPlugin snowflake exec ./client -url http://127.0.0.1:8080/ -``` - ##### -- Testing Copy-Paste Via Browser Proxy -- Open a browser proxy, passing the `manual` parameter; e.g. @@ -183,6 +151,11 @@ Then, in the browser proxy: - Once WebRTC successfully connects, the browser terminal should turn green. Shortly after, the tor client should bootstrap to 100%. +##### -- Testing directly via WebRTC Server -- + +See server-webrtc/README.md for information on connecting directly to a +WebRTC server transport plugin, bypassing the Broker and browser proxy. + More documentation on the way. Also available at: diff --git a/server-webrtc/README.md b/server-webrtc/README.md new file mode 100644 index 0000000..53cad14 --- /dev/null +++ b/server-webrtc/README.md @@ -0,0 +1,26 @@ +Ordinarily, the WebRTC client plugin speaks with a Broker which helps +match and signal with a browser proxy, which ultimately speaks with a default +websocket server. + + +However, this directory contains a WebRTC server plugin which uses an +HTTP server that simulates the interaction that a client would have with +the broker, for direct testing. + +Edit server-webrtc/torrc and add "-http 127.0.0.1:8080" to the end of the +ServerTransportPlugin line: +``` +ServerTransportPlugin snowflake exec ./server-webrtc -http 127.0.0.1:8080 +``` + +``` +cd server-webrtc/ +go build +tor -f torrc +``` + +Edit client/torrc and add "-url http://127.0.0.1:8080" to the end of the +ClientTransportPlugin line: +``` +ClientTransportPlugin snowflake exec ./client -url http://127.0.0.1:8080/ +``` diff --git a/server-webrtc/http.go b/server-webrtc/http.go new file mode 100644 index 0000000..f0ecb88 --- /dev/null +++ b/server-webrtc/http.go @@ -0,0 +1,67 @@ +// An HTTP-based signaling channel for the WebRTC server. It imitates the +// broker as seen by clients, but it doesn't connect them to an +// intermediate WebRTC proxy, rather connects them directly to this WebRTC +// server. This code should be deleted when we have proxies in place. + +package main + +import ( + "fmt" + "io/ioutil" + "log" + "net/http" + + "github.com/keroserene/go-webrtc" +) + +type httpHandler struct { + config *webrtc.Configuration +} + +func (h *httpHandler) ServeHTTP(w http.ResponseWriter, req *http.Request) { + switch req.Method { + case "GET": + w.Header().Set("Content-Type", "text/plain; charset=utf-8") + w.WriteHeader(http.StatusOK) + w.Write([]byte(`HTTP signaling channel + +Send a POST request containing an SDP offer. The response will +contain an SDP answer. +`)) + return + case "POST": + break + default: + http.Error(w, "Bad request.", http.StatusBadRequest) + return + } + + // POST handling begins here. + body, err := ioutil.ReadAll(http.MaxBytesReader(w, req.Body, 100000)) + if err != nil { + http.Error(w, "Bad request.", http.StatusBadRequest) + return + } + offer := webrtc.DeserializeSessionDescription(string(body)) + if offer == nil { + http.Error(w, "Bad request.", http.StatusBadRequest) + return + } + + pc, err := makePeerConnectionFromOffer(offer, h.config) + if err != nil { + http.Error(w, fmt.Sprintf("Cannot create offer: %s", err), http.StatusInternalServerError) + return + } + + log.Println("answering HTTP POST") + + w.WriteHeader(http.StatusOK) + w.Write([]byte(pc.LocalDescription().Serialize())) +} + +func receiveSignalsHTTP(addr string, config *webrtc.Configuration) error { + http.Handle("/", &httpHandler{config}) + log.Printf("listening HTTP on %s", addr) + return http.ListenAndServe(addr, nil) +} diff --git a/server-webrtc/snowflake.go b/server-webrtc/snowflake.go new file mode 100644 index 0000000..9a9c7dc --- /dev/null +++ b/server-webrtc/snowflake.go @@ -0,0 +1,300 @@ +package main + +import ( + "bufio" + "flag" + "fmt" + "io" + "log" + "net" + "os" + "os/signal" + "sync" + "syscall" + "time" + + "git.torproject.org/pluggable-transports/goptlib.git" + "github.com/keroserene/go-webrtc" +) + +var ptMethodName = "snowflake" +var ptInfo pt.ServerInfo +var logFile *os.File + +// When a datachannel handler starts, +1 is written to this channel; +// when it ends, -1 is written. +var handlerChan = make(chan int) + +func copyLoop(a, b net.Conn) { + var wg sync.WaitGroup + wg.Add(2) + go func() { + io.Copy(b, a) + wg.Done() + }() + go func() { + io.Copy(a, b) + wg.Done() + }() + wg.Wait() +} + +type webRTCConn struct { + dc *webrtc.DataChannel + pc *webrtc.PeerConnection + pr *io.PipeReader +} + +func (c *webRTCConn) Read(b []byte) (int, error) { + return c.pr.Read(b) +} + +func (c *webRTCConn) Write(b []byte) (int, error) { + // log.Printf("webrtc Write %d %+q", len(b), string(b)) + log.Printf("Write %d bytes --> WebRTC", len(b)) + c.dc.Send(b) + return len(b), nil +} + +func (c *webRTCConn) Close() error { + return c.pc.Close() +} + +func (c *webRTCConn) LocalAddr() net.Addr { + return nil +} + +func (c *webRTCConn) RemoteAddr() net.Addr { + return nil +} + +func (c *webRTCConn) SetDeadline(t time.Time) error { + return fmt.Errorf("SetDeadline not implemented") +} + +func (c *webRTCConn) SetReadDeadline(t time.Time) error { + return fmt.Errorf("SetReadDeadline not implemented") +} + +func (c *webRTCConn) SetWriteDeadline(t time.Time) error { + return fmt.Errorf("SetWriteDeadline not implemented") +} + +func datachannelHandler(conn *webRTCConn) { + defer conn.Close() + + handlerChan <- 1 + defer func() { + handlerChan <- -1 + }() + + or, err := pt.DialOr(&ptInfo, "", ptMethodName) // TODO: Extended OR + if err != nil { + log.Printf("Failed to connect to ORPort: " + err.Error()) + return + } + defer or.Close() + + copyLoop(conn, or) +} + +// Create a PeerConnection from an SDP offer. Blocks until the gathering of ICE +// candidates is complete and the answer is available in LocalDescription. +// Installs an OnDataChannel callback that creates a webRTCConn and passes it to +// datachannelHandler. +func makePeerConnectionFromOffer(sdp *webrtc.SessionDescription, config *webrtc.Configuration) (*webrtc.PeerConnection, error) { + errChan := make(chan error) + answerChan := make(chan struct{}) + + pc, err := webrtc.NewPeerConnection(config) + if err != nil { + return nil, fmt.Errorf("accept: NewPeerConnection: %s", err) + } + pc.OnNegotiationNeeded = func() { + panic("OnNegotiationNeeded") + } + pc.OnIceComplete = func() { + answerChan <- struct{}{} + } + pc.OnDataChannel = func(dc *webrtc.DataChannel) { + log.Println("OnDataChannel") + + pr, pw := io.Pipe() + + dc.OnOpen = func() { + log.Println("OnOpen channel") + } + dc.OnClose = func() { + log.Println("OnClose channel") + pw.Close() + } + dc.OnMessage = func(msg []byte) { + log.Printf("OnMessage <--- %d bytes", len(msg)) + n, err := pw.Write(msg) + if err != nil { + pw.CloseWithError(err) + } + if n != len(msg) { + panic("short write") + } + } + + conn := &webRTCConn{pc: pc, dc: dc, pr: pr} + go datachannelHandler(conn) + } + + err = pc.SetRemoteDescription(sdp) + if err != nil { + pc.Close() + return nil, fmt.Errorf("accept: SetRemoteDescription: %s", err) + } + log.Println("sdp offer successfully received.") + + go func() { + log.Println("Generating answer...") + answer, err := pc.CreateAnswer() // blocking + if err != nil { + errChan <- err + return + } + err = pc.SetLocalDescription(answer) + if err != nil { + errChan <- err + return + } + }() + + // Wait until answer is ready. + select { + case err = <-errChan: + pc.Close() + return nil, err + case _, ok := <-answerChan: + if !ok { + pc.Close() + return nil, fmt.Errorf("Failed gathering ICE candidates.") + } + } + + return pc, nil +} + +// Create a signaling named pipe and feed offers from it into +// makePeerConnectionFromOffer. +func receiveSignalsFIFO(filename string, config *webrtc.Configuration) error { + err := syscall.Mkfifo(filename, 0600) + if err != nil { + if err.(syscall.Errno) != syscall.EEXIST { + return err + } + } + signalFile, err := os.OpenFile(filename, os.O_RDONLY, 0600) + if err != nil { + return err + } + defer signalFile.Close() + + s := bufio.NewScanner(signalFile) + for s.Scan() { + msg := s.Text() + sdp := webrtc.DeserializeSessionDescription(msg) + if sdp == nil { + log.Printf("ignoring invalid signal message %+q", msg) + continue + } + + pc, err := makePeerConnectionFromOffer(sdp, config) + if err != nil { + log.Printf("makePeerConnectionFromOffer: %s", err) + continue + } + // Write offer to log for manual signaling. + log.Printf("----------------") + fmt.Fprintln(logFile, pc.LocalDescription().Serialize()) + log.Printf("----------------") + } + return s.Err() +} + +func main() { + var err error + var httpAddr string + + flag.StringVar(&httpAddr, "http", "", "listen for HTTP signaling") + flag.Parse() + + logFile, err = os.OpenFile("snowflake.log", os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0600) + if err != nil { + log.Fatal(err) + } + defer logFile.Close() + log.SetOutput(logFile) + + log.Println("starting") + webrtc.SetLoggingVerbosity(1) + + ptInfo, err = pt.ServerSetup(nil) + if err != nil { + log.Fatal(err) + } + + webRTCConfig := webrtc.NewConfiguration(webrtc.OptionIceServer("stun:stun.l.google.com:19302")) + + // Start FIFO-based signaling receiver. + go func() { + err := receiveSignalsFIFO("signal", webRTCConfig) + if err != nil { + log.Printf("receiveSignalsFIFO: %s", err) + } + }() + + // Start HTTP-based signaling receiver. + if httpAddr != "" { + go func() { + err := receiveSignalsHTTP(httpAddr, webRTCConfig) + if err != nil { + log.Printf("receiveSignalsHTTP: %s", err) + } + }() + } + + for _, bindaddr := range ptInfo.Bindaddrs { + switch bindaddr.MethodName { + case ptMethodName: + bindaddr.Addr.Port = 12345 // lies!!! + pt.Smethod(bindaddr.MethodName, bindaddr.Addr) + default: + pt.SmethodError(bindaddr.MethodName, "no such method") + } + } + pt.SmethodsDone() + + var numHandlers int = 0 + var sig os.Signal + sigChan := make(chan os.Signal, 1) + signal.Notify(sigChan, syscall.SIGINT, syscall.SIGTERM) + + // wait for first signal + sig = nil + for sig == nil { + select { + case n := <-handlerChan: + numHandlers += n + case sig = <-sigChan: + } + } + + if sig == syscall.SIGTERM { + return + } + + // wait for second signal or no more handlers + sig = nil + for sig == nil && numHandlers != 0 { + select { + case n := <-handlerChan: + numHandlers += n + case sig = <-sigChan: + } + } +} diff --git a/server-webrtc/torrc b/server-webrtc/torrc new file mode 100644 index 0000000..44b5964 --- /dev/null +++ b/server-webrtc/torrc @@ -0,0 +1,8 @@ +BridgeRelay 1 +ORPort 9001 +ExtORPort auto +SocksPort 0 +ExitPolicy reject *:* +DataDirectory datadir + +ServerTransportPlugin snowflake exec ./server diff --git a/server/http.go b/server/http.go deleted file mode 100644 index f0ecb88..0000000 --- a/server/http.go +++ /dev/null @@ -1,67 +0,0 @@ -// An HTTP-based signaling channel for the WebRTC server. It imitates the -// broker as seen by clients, but it doesn't connect them to an -// intermediate WebRTC proxy, rather connects them directly to this WebRTC -// server. This code should be deleted when we have proxies in place. - -package main - -import ( - "fmt" - "io/ioutil" - "log" - "net/http" - - "github.com/keroserene/go-webrtc" -) - -type httpHandler struct { - config *webrtc.Configuration -} - -func (h *httpHandler) ServeHTTP(w http.ResponseWriter, req *http.Request) { - switch req.Method { - case "GET": - w.Header().Set("Content-Type", "text/plain; charset=utf-8") - w.WriteHeader(http.StatusOK) - w.Write([]byte(`HTTP signaling channel - -Send a POST request containing an SDP offer. The response will -contain an SDP answer. -`)) - return - case "POST": - break - default: - http.Error(w, "Bad request.", http.StatusBadRequest) - return - } - - // POST handling begins here. - body, err := ioutil.ReadAll(http.MaxBytesReader(w, req.Body, 100000)) - if err != nil { - http.Error(w, "Bad request.", http.StatusBadRequest) - return - } - offer := webrtc.DeserializeSessionDescription(string(body)) - if offer == nil { - http.Error(w, "Bad request.", http.StatusBadRequest) - return - } - - pc, err := makePeerConnectionFromOffer(offer, h.config) - if err != nil { - http.Error(w, fmt.Sprintf("Cannot create offer: %s", err), http.StatusInternalServerError) - return - } - - log.Println("answering HTTP POST") - - w.WriteHeader(http.StatusOK) - w.Write([]byte(pc.LocalDescription().Serialize())) -} - -func receiveSignalsHTTP(addr string, config *webrtc.Configuration) error { - http.Handle("/", &httpHandler{config}) - log.Printf("listening HTTP on %s", addr) - return http.ListenAndServe(addr, nil) -} diff --git a/server/snowflake.go b/server/snowflake.go deleted file mode 100644 index 9a9c7dc..0000000 --- a/server/snowflake.go +++ /dev/null @@ -1,300 +0,0 @@ -package main - -import ( - "bufio" - "flag" - "fmt" - "io" - "log" - "net" - "os" - "os/signal" - "sync" - "syscall" - "time" - - "git.torproject.org/pluggable-transports/goptlib.git" - "github.com/keroserene/go-webrtc" -) - -var ptMethodName = "snowflake" -var ptInfo pt.ServerInfo -var logFile *os.File - -// When a datachannel handler starts, +1 is written to this channel; -// when it ends, -1 is written. -var handlerChan = make(chan int) - -func copyLoop(a, b net.Conn) { - var wg sync.WaitGroup - wg.Add(2) - go func() { - io.Copy(b, a) - wg.Done() - }() - go func() { - io.Copy(a, b) - wg.Done() - }() - wg.Wait() -} - -type webRTCConn struct { - dc *webrtc.DataChannel - pc *webrtc.PeerConnection - pr *io.PipeReader -} - -func (c *webRTCConn) Read(b []byte) (int, error) { - return c.pr.Read(b) -} - -func (c *webRTCConn) Write(b []byte) (int, error) { - // log.Printf("webrtc Write %d %+q", len(b), string(b)) - log.Printf("Write %d bytes --> WebRTC", len(b)) - c.dc.Send(b) - return len(b), nil -} - -func (c *webRTCConn) Close() error { - return c.pc.Close() -} - -func (c *webRTCConn) LocalAddr() net.Addr { - return nil -} - -func (c *webRTCConn) RemoteAddr() net.Addr { - return nil -} - -func (c *webRTCConn) SetDeadline(t time.Time) error { - return fmt.Errorf("SetDeadline not implemented") -} - -func (c *webRTCConn) SetReadDeadline(t time.Time) error { - return fmt.Errorf("SetReadDeadline not implemented") -} - -func (c *webRTCConn) SetWriteDeadline(t time.Time) error { - return fmt.Errorf("SetWriteDeadline not implemented") -} - -func datachannelHandler(conn *webRTCConn) { - defer conn.Close() - - handlerChan <- 1 - defer func() { - handlerChan <- -1 - }() - - or, err := pt.DialOr(&ptInfo, "", ptMethodName) // TODO: Extended OR - if err != nil { - log.Printf("Failed to connect to ORPort: " + err.Error()) - return - } - defer or.Close() - - copyLoop(conn, or) -} - -// Create a PeerConnection from an SDP offer. Blocks until the gathering of ICE -// candidates is complete and the answer is available in LocalDescription. -// Installs an OnDataChannel callback that creates a webRTCConn and passes it to -// datachannelHandler. -func makePeerConnectionFromOffer(sdp *webrtc.SessionDescription, config *webrtc.Configuration) (*webrtc.PeerConnection, error) { - errChan := make(chan error) - answerChan := make(chan struct{}) - - pc, err := webrtc.NewPeerConnection(config) - if err != nil { - return nil, fmt.Errorf("accept: NewPeerConnection: %s", err) - } - pc.OnNegotiationNeeded = func() { - panic("OnNegotiationNeeded") - } - pc.OnIceComplete = func() { - answerChan <- struct{}{} - } - pc.OnDataChannel = func(dc *webrtc.DataChannel) { - log.Println("OnDataChannel") - - pr, pw := io.Pipe() - - dc.OnOpen = func() { - log.Println("OnOpen channel") - } - dc.OnClose = func() { - log.Println("OnClose channel") - pw.Close() - } - dc.OnMessage = func(msg []byte) { - log.Printf("OnMessage <--- %d bytes", len(msg)) - n, err := pw.Write(msg) - if err != nil { - pw.CloseWithError(err) - } - if n != len(msg) { - panic("short write") - } - } - - conn := &webRTCConn{pc: pc, dc: dc, pr: pr} - go datachannelHandler(conn) - } - - err = pc.SetRemoteDescription(sdp) - if err != nil { - pc.Close() - return nil, fmt.Errorf("accept: SetRemoteDescription: %s", err) - } - log.Println("sdp offer successfully received.") - - go func() { - log.Println("Generating answer...") - answer, err := pc.CreateAnswer() // blocking - if err != nil { - errChan <- err - return - } - err = pc.SetLocalDescription(answer) - if err != nil { - errChan <- err - return - } - }() - - // Wait until answer is ready. - select { - case err = <-errChan: - pc.Close() - return nil, err - case _, ok := <-answerChan: - if !ok { - pc.Close() - return nil, fmt.Errorf("Failed gathering ICE candidates.") - } - } - - return pc, nil -} - -// Create a signaling named pipe and feed offers from it into -// makePeerConnectionFromOffer. -func receiveSignalsFIFO(filename string, config *webrtc.Configuration) error { - err := syscall.Mkfifo(filename, 0600) - if err != nil { - if err.(syscall.Errno) != syscall.EEXIST { - return err - } - } - signalFile, err := os.OpenFile(filename, os.O_RDONLY, 0600) - if err != nil { - return err - } - defer signalFile.Close() - - s := bufio.NewScanner(signalFile) - for s.Scan() { - msg := s.Text() - sdp := webrtc.DeserializeSessionDescription(msg) - if sdp == nil { - log.Printf("ignoring invalid signal message %+q", msg) - continue - } - - pc, err := makePeerConnectionFromOffer(sdp, config) - if err != nil { - log.Printf("makePeerConnectionFromOffer: %s", err) - continue - } - // Write offer to log for manual signaling. - log.Printf("----------------") - fmt.Fprintln(logFile, pc.LocalDescription().Serialize()) - log.Printf("----------------") - } - return s.Err() -} - -func main() { - var err error - var httpAddr string - - flag.StringVar(&httpAddr, "http", "", "listen for HTTP signaling") - flag.Parse() - - logFile, err = os.OpenFile("snowflake.log", os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0600) - if err != nil { - log.Fatal(err) - } - defer logFile.Close() - log.SetOutput(logFile) - - log.Println("starting") - webrtc.SetLoggingVerbosity(1) - - ptInfo, err = pt.ServerSetup(nil) - if err != nil { - log.Fatal(err) - } - - webRTCConfig := webrtc.NewConfiguration(webrtc.OptionIceServer("stun:stun.l.google.com:19302")) - - // Start FIFO-based signaling receiver. - go func() { - err := receiveSignalsFIFO("signal", webRTCConfig) - if err != nil { - log.Printf("receiveSignalsFIFO: %s", err) - } - }() - - // Start HTTP-based signaling receiver. - if httpAddr != "" { - go func() { - err := receiveSignalsHTTP(httpAddr, webRTCConfig) - if err != nil { - log.Printf("receiveSignalsHTTP: %s", err) - } - }() - } - - for _, bindaddr := range ptInfo.Bindaddrs { - switch bindaddr.MethodName { - case ptMethodName: - bindaddr.Addr.Port = 12345 // lies!!! - pt.Smethod(bindaddr.MethodName, bindaddr.Addr) - default: - pt.SmethodError(bindaddr.MethodName, "no such method") - } - } - pt.SmethodsDone() - - var numHandlers int = 0 - var sig os.Signal - sigChan := make(chan os.Signal, 1) - signal.Notify(sigChan, syscall.SIGINT, syscall.SIGTERM) - - // wait for first signal - sig = nil - for sig == nil { - select { - case n := <-handlerChan: - numHandlers += n - case sig = <-sigChan: - } - } - - if sig == syscall.SIGTERM { - return - } - - // wait for second signal or no more handlers - sig = nil - for sig == nil && numHandlers != 0 { - select { - case n := <-handlerChan: - numHandlers += n - case sig = <-sigChan: - } - } -} diff --git a/server/torrc b/server/torrc deleted file mode 100644 index 44b5964..0000000 --- a/server/torrc +++ /dev/null @@ -1,8 +0,0 @@ -BridgeRelay 1 -ORPort 9001 -ExtORPort auto -SocksPort 0 -ExitPolicy reject *:* -DataDirectory datadir - -ServerTransportPlugin snowflake exec ./server

1 0

[snowflake/master] Add a copy of websocket-server in the server directory.
by dcf＠torproject.org 26 Mar '16

26 Mar '16

commit e53705519e1aace78da1fad441c49114c90b858b Author: David Fifield <david(a)bamsoftware.com> Date: Sat Mar 26 12:05:06 2016 -0700 Add a copy of websocket-server in the server directory. From commit ea3ee6b5cf035a9465c02b4a2b38882c9c6a7050 in https://git.torproject.org/pluggable-transports/websocket.git --- server/server.go | 291 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 291 insertions(+) diff --git a/server/server.go b/server/server.go new file mode 100644 index 0000000..6fb5a0b --- /dev/null +++ b/server/server.go @@ -0,0 +1,291 @@ +// Tor websocket server transport plugin. +// +// Usage in torrc: +// ExtORPort 6669 +// ServerTransportPlugin websocket exec ./websocket-server --port 9901 +package main + +import ( + "encoding/base64" + "errors" + "flag" + "fmt" + "io" + "log" + "net" + "net/http" + "os" + "os/signal" + "sync" + "syscall" + "time" + + "../websocket" + + "git.torproject.org/pluggable-transports/goptlib.git" +) + +const ptMethodName = "websocket" +const requestTimeout = 10 * time.Second + +// "4/3+1" accounts for possible base64 encoding. +const maxMessageSize = 64*1024*4/3 + 1 + +var logFile = os.Stderr + +var ptInfo pt.ServerInfo + +// When a connection handler starts, +1 is written to this channel; when it +// ends, -1 is written. +var handlerChan = make(chan int) + +func usage() { + fmt.Printf("Usage: %s [OPTIONS]\n", os.Args[0]) + fmt.Printf("WebSocket server pluggable transport for Tor.\n") + fmt.Printf("Works only as a managed proxy.\n") + fmt.Printf("\n") + fmt.Printf(" -h, --help show this help.\n") + fmt.Printf(" --log FILE log messages to FILE (default stderr).\n") + fmt.Printf(" --port PORT listen on PORT (overrides Tor's requested port).\n") +} + +// An abstraction that makes an underlying WebSocket connection look like an +// io.ReadWriteCloser. It internally takes care of things like base64 encoding +// and decoding. +type webSocketConn struct { + Ws *websocket.WebSocket + Base64 bool + messageBuf []byte +} + +// Implements io.Reader. +func (conn *webSocketConn) Read(b []byte) (n int, err error) { + for len(conn.messageBuf) == 0 { + var m websocket.Message + m, err = conn.Ws.ReadMessage() + if err != nil { + return + } + if m.Opcode == 8 { + err = io.EOF + return + } + if conn.Base64 { + if m.Opcode != 1 { + err = errors.New(fmt.Sprintf("got non-text opcode %d with the base64 subprotocol", m.Opcode)) + return + } + conn.messageBuf = make([]byte, base64.StdEncoding.DecodedLen(len(m.Payload))) + var num int + num, err = base64.StdEncoding.Decode(conn.messageBuf, m.Payload) + if err != nil { + return + } + conn.messageBuf = conn.messageBuf[:num] + } else { + if m.Opcode != 2 { + err = errors.New(fmt.Sprintf("got non-binary opcode %d with no subprotocol", m.Opcode)) + return + } + conn.messageBuf = m.Payload + } + } + + n = copy(b, conn.messageBuf) + conn.messageBuf = conn.messageBuf[n:] + + return +} + +// Implements io.Writer. +func (conn *webSocketConn) Write(b []byte) (n int, err error) { + if conn.Base64 { + buf := make([]byte, base64.StdEncoding.EncodedLen(len(b))) + base64.StdEncoding.Encode(buf, b) + err = conn.Ws.WriteMessage(1, buf) + if err != nil { + return + } + n = len(b) + } else { + err = conn.Ws.WriteMessage(2, b) + n = len(b) + } + return +} + +// Implements io.Closer. +func (conn *webSocketConn) Close() error { + // Ignore any error in trying to write a Close frame. + _ = conn.Ws.WriteFrame(8, nil) + return conn.Ws.Conn.Close() +} + +// Create a new webSocketConn. +func newWebSocketConn(ws *websocket.WebSocket) webSocketConn { + var conn webSocketConn + conn.Ws = ws + conn.Base64 = (ws.Subprotocol == "base64") + return conn +} + +// Copy from WebSocket to socket and vice versa. +func proxy(local *net.TCPConn, conn *webSocketConn) { + var wg sync.WaitGroup + wg.Add(2) + + go func() { + _, err := io.Copy(conn, local) + if err != nil { + log.Printf("error copying ORPort to WebSocket") + } + local.CloseRead() + conn.Close() + wg.Done() + }() + go func() { + _, err := io.Copy(local, conn) + if err != nil { + log.Printf("error copying WebSocket to ORPort") + } + local.CloseWrite() + conn.Close() + wg.Done() + }() + + wg.Wait() +} + +func webSocketHandler(ws *websocket.WebSocket) { + // Undo timeouts on HTTP request handling. + ws.Conn.SetDeadline(time.Time{}) + conn := newWebSocketConn(ws) + defer conn.Close() + + handlerChan <- 1 + defer func() { + handlerChan <- -1 + }() + + or, err := pt.DialOr(&ptInfo, ws.Conn.RemoteAddr().String(), ptMethodName) + if err != nil { + log.Printf("Failed to connect to ORPort: " + err.Error()) + return + } + defer or.Close() + + proxy(or, &conn) +} + +func startListener(addr *net.TCPAddr) (*net.TCPListener, error) { + ln, err := net.ListenTCP("tcp", addr) + if err != nil { + return nil, err + } + go func() { + defer ln.Close() + var config websocket.Config + config.Subprotocols = []string{"base64"} + config.MaxMessageSize = maxMessageSize + s := &http.Server{ + Handler: config.Handler(webSocketHandler), + ReadTimeout: requestTimeout, + } + err = s.Serve(ln) + if err != nil { + log.Printf("http.Serve: " + err.Error()) + } + }() + return ln, nil +} + +func main() { + var logFilename string + var port int + + flag.Usage = usage + flag.StringVar(&logFilename, "log", "", "log file to write to") + flag.IntVar(&port, "port", 0, "port to listen on if unspecified by Tor") + flag.Parse() + + if logFilename != "" { + f, err := os.OpenFile(logFilename, os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0600) + if err != nil { + fmt.Fprintf(os.Stderr, "Can't open log file %q: %s.\n", logFilename, err.Error()) + os.Exit(1) + } + log.SetOutput(f) + } + + log.SetFlags(log.LstdFlags | log.LUTC) + log.Printf("starting") + var err error + ptInfo, err = pt.ServerSetup(nil) + if err != nil { + log.Printf("error in setup: %s", err) + os.Exit(1) + } + + listeners := make([]*net.TCPListener, 0) + for _, bindaddr := range ptInfo.Bindaddrs { + // Override tor's requested port (which is 0 if this transport + // has not been run before) with the one requested by the --port + // option. + if port != 0 { + bindaddr.Addr.Port = port + } + + switch bindaddr.MethodName { + case ptMethodName: + ln, err := startListener(bindaddr.Addr) + if err != nil { + pt.SmethodError(bindaddr.MethodName, err.Error()) + break + } + pt.Smethod(bindaddr.MethodName, ln.Addr()) + log.Printf("listening on %s", ln.Addr().String()) + listeners = append(listeners, ln) + default: + pt.SmethodError(bindaddr.MethodName, "no such method") + } + } + pt.SmethodsDone() + + var numHandlers int = 0 + var sig os.Signal + sigChan := make(chan os.Signal, 1) + signal.Notify(sigChan, syscall.SIGINT, syscall.SIGTERM) + + // wait for first signal + sig = nil + for sig == nil { + select { + case n := <-handlerChan: + numHandlers += n + case sig = <-sigChan: + } + } + log.Printf("Got first signal %q with %d running handlers.", sig, numHandlers) + for _, ln := range listeners { + ln.Close() + } + + if sig == syscall.SIGTERM { + log.Printf("Caught signal %q, exiting.", sig) + return + } + + // wait for second signal or no more handlers + sig = nil + for sig == nil && numHandlers != 0 { + select { + case n := <-handlerChan: + numHandlers += n + log.Printf("%d remaining handlers.", numHandlers) + case sig = <-sigChan: + } + } + if sig != nil { + log.Printf("Got second signal %q with %d running handlers.", sig, numHandlers) + } +}

1 0

[snowflake/master] Build the websocket-server.
by dcf＠torproject.org 26 Mar '16

26 Mar '16

commit cfca47674e79c6853bdfb2410a3c42ae240fd929 Author: David Fifield <david(a)bamsoftware.com> Date: Sat Mar 26 12:06:06 2016 -0700 Build the websocket-server. Patch server.go to refer to out-of-tree websocket library. --- .gitignore | 1 + Makefile | 2 +- server/server.go | 3 +-- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 784e6c4..22101d6 100644 --- a/.gitignore +++ b/.gitignore @@ -6,6 +6,7 @@ datadir/ client/client server-webrtc/server-webrtc +server/server snowflake.log proxy/test proxy/build diff --git a/Makefile b/Makefile index fbf12ae..0608eca 100644 --- a/Makefile +++ b/Makefile @@ -2,4 +2,4 @@ .PHONY: check check: ! gofmt -l . 2>&1 | read - go vet ./broker ./client ./server-webrtc + go vet ./broker ./client ./server ./server-webrtc diff --git a/server/server.go b/server/server.go index 6fb5a0b..986fd35 100644 --- a/server/server.go +++ b/server/server.go @@ -20,9 +20,8 @@ import ( "syscall" "time" - "../websocket" - "git.torproject.org/pluggable-transports/goptlib.git" + "git.torproject.org/pluggable-transports/websocket.git/websocket" ) const ptMethodName = "websocket"

1 0

[snowflake/master] Make Snowflake-specific changes to the websocket server.
by dcf＠torproject.org 26 Mar '16

26 Mar '16

commit a269053ac205eec949ce133b71a7d1e2b6b3e1e6 Author: David Fifield <david(a)bamsoftware.com> Date: Sat Mar 26 12:34:47 2016 -0700 Make Snowflake-specific changes to the websocket server. Change the transport name to "snowflake" and don't report the remote client address to the ExtORPort. --- server/server.go | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/server/server.go b/server/server.go index 986fd35..6729266 100644 --- a/server/server.go +++ b/server/server.go @@ -1,8 +1,10 @@ -// Tor websocket server transport plugin. +// Snowflake-specific websocket server plugin. This is the same as the websocket +// server used by flash proxy, except that it reports the transport name as +// "snowflake" and does not forward the remote address to the ExtORPort. // // Usage in torrc: // ExtORPort 6669 -// ServerTransportPlugin websocket exec ./websocket-server --port 9901 +// ServerTransportPlugin snowflake exec server --port 9901 package main import ( @@ -24,7 +26,7 @@ import ( "git.torproject.org/pluggable-transports/websocket.git/websocket" ) -const ptMethodName = "websocket" +const ptMethodName = "snowflake" const requestTimeout = 10 * time.Second // "4/3+1" accounts for possible base64 encoding. @@ -166,7 +168,10 @@ func webSocketHandler(ws *websocket.WebSocket) { handlerChan <- -1 }() - or, err := pt.DialOr(&ptInfo, ws.Conn.RemoteAddr().String(), ptMethodName) + // Pass an empty string for the client address. The remote address on + // the incoming connection reflects that of the browser proxy, not of + // the client. See https://bugs.torproject.org/18628. + or, err := pt.DialOr(&ptInfo, "", ptMethodName) if err != nil { log.Printf("Failed to connect to ORPort: " + err.Error()) return

1 0

[snowflake/master] We don't need to worry about the base64 WebSockets.
by dcf＠torproject.org 26 Mar '16

26 Mar '16

commit 2d871a1a4f8e3a3be60d3a11c4842e70ae260c82 Author: David Fifield <david(a)bamsoftware.com> Date: Sat Mar 26 14:23:22 2016 -0700 We don't need to worry about the base64 WebSockets. That's only for very very old Firefox. Even for flash proxy it was only relevant for a short time. --- proxy/websocket.coffee | 1 - 1 file changed, 1 deletion(-) diff --git a/proxy/websocket.coffee b/proxy/websocket.coffee index e4a9550..94cf274 100644 --- a/proxy/websocket.coffee +++ b/proxy/websocket.coffee @@ -47,7 +47,6 @@ buildUrl = (scheme, host, port, path, params) -> makeWebsocket = (addr) -> url = buildUrl 'ws', addr.host, addr.port, '/' - # TODO: Do we need to worry about the base64 version? ws = new WebSocket url ### 'User agents can use this as a hint for how to handle incoming binary data: if

1 0

[snowflake/master] Fix local web server URL (127.0.0.1 not 0.0.0.0).
by dcf＠torproject.org 26 Mar '16

26 Mar '16

commit 0fc2c8b22e5892a11ac162148c7370df733e3a88 Author: David Fifield <david(a)bamsoftware.com> Date: Sat Mar 26 13:20:48 2016 -0700 Fix local web server URL (127.0.0.1 not 0.0.0.0). --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 28481ac..c971cdc 100644 --- a/README.md +++ b/README.md @@ -94,7 +94,7 @@ cd build/ python -m http.server ``` -Then, open a browser tab to `0.0.0.0:8000/snowflake.html`, +Then, open a browser tab to `http://127.0.0.1:8000/snowflake.html`, which causes you to act as an ephemeral Tor bridge. ### FAQ

1 0

[snowflake/master] Add a note that you need to pass "manual" for copy-paste.
by dcf＠torproject.org 26 Mar '16

26 Mar '16

commit 7248cf92f3b08780ad4d942a49263357e864652c Author: David Fifield <david(a)bamsoftware.com> Date: Sat Mar 26 13:21:38 2016 -0700 Add a note that you need to pass "manual" for copy-paste. --- README.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/README.md b/README.md index c971cdc..f9f1b1f 100644 --- a/README.md +++ b/README.md @@ -165,6 +165,9 @@ ClientTransportPlugin snowflake exec ./client -url http://127.0.0.1:8080/ ##### -- Testing Copy-Paste Via Browser Proxy -- +Open a browser proxy, passing the `manual` parameter; e.g. +`http://127.0.0.1:8000/snowflake.html?manual=1`, + Open up three terminals for the **client:** A: `tor -f torrc-manual SOCKSPort auto`

1 0

[snowflake/master] Typo.
by dcf＠torproject.org 26 Mar '16

26 Mar '16

commit 6efb5cb8ef56bc84a56a8244f81a0817d7202912 Author: David Fifield <david(a)bamsoftware.com> Date: Sat Mar 26 10:41:38 2016 -0700 Typo. --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index b909df5..28481ac 100644 --- a/README.md +++ b/README.md @@ -136,7 +136,7 @@ abundance of ephemeral and short-lived (and special!) volunteer proxies... ##### -- Testing directly via WebRTC Server -- -Ordinarily, the WebrTC client plugin speaks with a Broker which helps +Ordinarily, the WebRTC client plugin speaks with a Broker which helps match and signal with a browser proxy, which ultimately speaks with a default websocket server.

1 0