- tor-commits - lists.torproject.org

[flashproxy/master] Isolate address family manipulation and name resolution within parse_addr_spec.
by dcf＠torproject.org 31 Aug '12

31 Aug '12

commit 23d3a7d9756c7bbb5ce6675102b3aefe97d28b32 Author: David Fifield <david(a)bamsoftware.com> Date: Sat Jul 28 12:25:23 2012 -0700 Isolate address family manipulation and name resolution within parse_addr_spec. facilitator wants to resolve the name given to the --relay option; most other places we want to insist on numeric address. The facilitator had a special version of parse_addr_spec that also returned the address family, in order to allow it to resolve the name itself. Now put all this special handling inside parse_addr_spec, controlled by a boolean parameter, and use one parse_addr_spec between facilitator and facilitator.cgi. --- fac.py | 46 +++++++++++++++++++++++++++++++++++++++++++--- facilitator | 24 ++++-------------------- 2 files changed, 47 insertions(+), 23 deletions(-) diff --git a/fac.py b/fac.py index bace28c..b9ad435 100644 --- a/fac.py +++ b/fac.py @@ -1,7 +1,28 @@ import re import socket -def parse_addr_spec(spec, defhost = None, defport = None): +def parse_addr_spec(spec, defhost = None, defport = None, resolve = False): + """Parse a host:port specification and return a 2-tuple ("host", port) as + understood by the Python socket functions. + >>> parse_addr_spec("192.168.0.1:9999") + ('192.168.0.1', 9999) + + If defhost or defport are given, those parts of the specification may be + omitted; if so, they will be filled in with defaults. + >>> parse_addr_spec("192.168.0.2:8888", defhost="192.168.0.1", defport=9999) + ('192.168.0.2', 8888) + >>> parse_addr_spec(":8888", defhost="192.168.0.1", defport=9999) + ('192.168.0.1', 9999) + >>> parse_addr_spec("192.168.0.2:", defhost="192.168.0.1", defport=9999) + ('192.168.0.2', 9999) + >>> parse_addr_spec(":", defhost="192.168.0.1", defport=9999) + ('192.168.0.1', 9999) + + If resolve is true, then the host in the specification or the defhost may be + a domain name, which will be resolved. If resolve is false, then the host + must be a numeric IPv4 or IPv6 address. + + IPv6 addresses must be enclosed in square brackets.""" host = None port = None m = None @@ -32,9 +53,28 @@ def parse_addr_spec(spec, defhost = None, defport = None): af = 0 host = host or defhost port = port or defport - if not (host and port): + if host is None or port is None: raise ValueError("Bad address specification \"%s\"" % spec) - return af, host, int(port) + + # Now we have split around the colon and have a guess at the address family. + # Forward-resolve the name into an addrinfo struct. Real DNS resolution is + # done only if resolve is true; otherwise the address must be numeric. + if resolve: + flags = 0 + else: + flags = socket.AI_NUMERICHOST + try: + addrs = socket.getaddrinfo(host, port, af, socket.SOCK_STREAM, socket.IPPROTO_TCP, flags) + except socket.gaierror, e: + raise ValueError("Bad host or port: \"%s\" \"%s\": %s" % (host, port, str(e))) + if not addrs: + raise ValueError("Bad host or port: \"%s\" \"%s\"" % (host, port)) + + # Convert the result of socket.getaddrinfo (which is a 2-tuple for IPv4 and + # a 4-tuple for IPv6) into a (host, port) 2-tuple. + host, port = socket.getnameinfo(addrs[0][4], socket.NI_NUMERICHOST | socket.NI_NUMERICSERV) + port = int(port) + return host, port def format_addr(addr): host, port = addr diff --git a/facilitator b/facilitator index d1e25a4..99ef63d 100755 --- a/facilitator +++ b/facilitator @@ -33,10 +33,8 @@ class options(object): @staticmethod def set_relay_spec(spec): - af, host, port = fac.parse_addr_spec(spec, defport = DEFAULT_RELAY_PORT) - # Resolve to get an IP address. - addrs = socket.getaddrinfo(host, port, af) - options.relay_spec = fac.format_addr(addrs[0][4]) + spec = fac.parse_addr_spec(spec, defport = DEFAULT_RELAY_PORT, resolve = True) + options.relay_spec = fac.format_addr(spec) def usage(f = sys.stdout): print >> f, """\ @@ -92,22 +90,8 @@ class TCPReg(object): class Reg(object): @staticmethod def parse(spec, defhost = None, defport = None): - try: - af, host, port = fac.parse_addr_spec(spec, defhost, defport) - except ValueError: - pass - else: - try: - addrs = socket.getaddrinfo(host, port, af, socket.SOCK_STREAM, socket.IPPROTO_TCP, socket.AI_NUMERICHOST) - except socket.gaierror, e: - raise ValueError("Bad host or port: \"%s\" \"%s\": %s" % (host, port, str(e))) - if not addrs: - raise ValueError("Bad host or port: \"%s\" \"%s\"" % (host, port)) - - host, port = socket.getnameinfo(addrs[0][4], socket.NI_NUMERICHOST | socket.NI_NUMERICSERV) - return TCPReg(host, int(port)) - - raise ValueError("Bad spec format: %s" % repr(spec)) + host, port = fac.parse_addr_spec(spec, defhost, defport) + return TCPReg(host, port) class RegSet(object): def __init__(self):

1 0

[flashproxy/master] Catch EPIPE in handle and finish.
by dcf＠torproject.org 31 Aug '12

31 Aug '12

commit 22ecf31753d059262dcb254d274f65ca5c4d4ceb Author: David Fifield <david(a)bamsoftware.com> Date: Sat Jul 28 16:29:56 2012 -0700 Catch EPIPE in handle and finish. --- facilitator | 21 +++++++++++++++++++++ 1 files changed, 21 insertions(+), 0 deletions(-) diff --git a/facilitator b/facilitator index 99ef63d..3695b52 100755 --- a/facilitator +++ b/facilitator @@ -1,6 +1,7 @@ #!/usr/bin/env python import SocketServer +import errno import getopt import os import socket @@ -126,6 +127,23 @@ class RegSet(object): finally: self.cv.release() +# A decorator to ignore "broken pipe" errors. +def catch_epipe(fn): + def ret(self, *args): + try: + return fn(self, *args) + except socket.error, e: + try: + err_num = e.errno + except AttributeError: + # Before Python 2.6, exception can be a pair. + err_num, errstr = e + except: + raise + if err_num != errno.EPIPE: + raise + return ret + class Handler(SocketServer.StreamRequestHandler): def __init__(self, *args, **kwargs): self.deadline = time.time() + CLIENT_TIMEOUT @@ -166,6 +184,7 @@ class Handler(SocketServer.StreamRequestHandler): if buflen >= READLINE_MAX_LENGTH: raise socket.error("readline: refusing to buffer %d bytes (last read was %d bytes)" % (buflen, len(data))) + @catch_epipe def handle(self): num_lines = 0 while True: @@ -239,6 +258,8 @@ class Handler(SocketServer.StreamRequestHandler): self.send_ok() return True + finish = catch_epipe(SocketServer.StreamRequestHandler.finish) + class Server(SocketServer.ThreadingMixIn, SocketServer.TCPServer): allow_reuse_address = True

1 0

[flashproxy/master] Implement GET in facilitator.cgi.
by dcf＠torproject.org 31 Aug '12

31 Aug '12

commit 1fb78b99e0a63247d2ef3177ac973528206cefd3 Author: David Fifield <david(a)bamsoftware.com> Date: Sat Jul 28 09:46:13 2012 -0700 Implement GET in facilitator.cgi. --- facilitator.cgi | 50 +++++++++++++++++++++++++++++++++++++++++++------- 1 files changed, 43 insertions(+), 7 deletions(-) diff --git a/facilitator.cgi b/facilitator.cgi index 061b847..31c632e 100755 --- a/facilitator.cgi +++ b/facilitator.cgi @@ -1,10 +1,13 @@ #!/usr/bin/env python import cgi -import sys import os +import socket +import sys import urllib +import fac + FACILITATOR_ADDR = ("127.0.0.1", 9002) def exit_error(status): @@ -13,16 +16,49 @@ Status: %d\r \r""" % status sys.exit() +def fac_socket(): + return socket.create_connection(FACILITATOR_ADDR, 1.0).makefile() + +def transact(f, command, *params): + transaction = fac.render_transaction(command, *params) + print >> f, transaction + f.flush() + line = f.readline() + if not (len(line) > 0 and line[-1] == '\n'): + raise ValueError("No newline at end of string returned by facilitator") + return fac.parse_transaction(line[:-1]) + def put_reg(client_addr, registrant_addr): # Pretending to register client_addr as reported by registrant_addr. pass def get_reg(proxy_addr): - # Pretending to ask for a client for the proxy at proxy_addr. - return { - "client": "2.2.2.2:2222", - "relay": "199.1.1.1:9001", - } + f = fac_socket() + try: + command, params = transact(f, "GET", ("FROM", fac.format_addr(proxy_addr))) + finally: + f.close() + if command == "NONE": + return { + "client": "" + } + elif command == "OK": + client_spec = fac.param_first("CLIENT", params) + relay_spec = fac.param_first("RELAY", params) + if not client_spec or not relay_spec: + exit_error(500) + try: + # Check the syntax returned by the backend. + client = fac.parse_addr_spec(client_spec) + relay = fac.parse_addr_spec(relay_spec) + except ValueError: + exit_error(500) + return { + "client": fac.format_addr(client), + "relay": fac.format_addr(relay), + } + else: + exit_error(500) method = os.environ.get("REQUEST_METHOD") proxy_addr = (os.environ.get("REMOTE_ADDR"), None) @@ -42,7 +78,7 @@ Content-Type: application/x-www-form-urlencoded\r Cache-Control: no-cache\r Access-Control-Allow-Origin: *\r \r""" - print urllib.urlencode(reg) + sys.stdout.write(urllib.urlencode(reg)) if method == "GET": do_get()

1 0

[flashproxy/master] Install init.d/facilitator.
by dcf＠torproject.org 31 Aug '12

31 Aug '12

commit 71695a3410c04fa8a0504c7996f9841f0e46777c Author: David Fifield <david(a)bamsoftware.com> Date: Thu Aug 30 14:17:11 2012 -0700 Install init.d/facilitator. --- facilitator/Makefile | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/facilitator/Makefile b/facilitator/Makefile index 1d9cb54..ee8d527 100644 --- a/facilitator/Makefile +++ b/facilitator/Makefile @@ -7,6 +7,7 @@ all: install: mkdir -p $(BINDIR) cp -f facilitator facilitator.cgi fac.py $(BINDIR) + cp -f init.d/facilitator /etc/init.d/ clean: rm -f *.pyc

1 0

[flashproxy/master] Add commented-out test descriptions.
by dcf＠torproject.org 31 Aug '12

31 Aug '12

commit e562a85c58649f5b3f60f25a3a1173063746aa94 Author: David Fifield <david(a)bamsoftware.com> Date: Sat Jul 7 07:55:01 2012 -0700 Add commented-out test descriptions. --- facilitator-test | 31 +++++++++++++++++++++++++++++++ flashproxy-client-test | 12 ++++++------ 2 files changed, 37 insertions(+), 6 deletions(-) diff --git a/facilitator-test b/facilitator-test index 4e37dd1..b06f5d7 100755 --- a/facilitator-test +++ b/facilitator-test @@ -55,6 +55,37 @@ class FacilitatorTest(unittest.TestCase): except socket.error: pass +# def test_same_proxy(self): +# """Test that the same proxy doesn't get the same client when asking +# twice.""" +# self.fail() +# +# def test_num_clients(self): +# """Test that the same proxy can pick up up to five different clients but +# no more. Test that a proxy ceasing to handle a client allows the proxy +# to handle another, different client.""" +# self.fail() +# +# def test_num_proxies(self): +# """Test that a single client is handed out to five different proxies but +# no more. Test that a proxy ceasing to handle a client reduces its count +# so another proxy can handle it.""" +# self.fail() +# +# def test_proxy_timeout(self): +# """Test that a proxy ceasing to connect for some time period causes that +# proxy's clients to be unhandled by that proxy.""" +# self.fail() +# +# def test_localhost_only(self): +# """Test that the facilitator doesn't listen on any external +# addresses.""" +# self.fail() +# +# def test_hostname(self): +# """Test that the facilitator rejects hostnames.""" +# self.fail() + class ParseTransactionTest(unittest.TestCase): def test_empty_string(self): self.assertRaises(ValueError, fac.parse_transaction, "") diff --git a/flashproxy-client-test b/flashproxy-client-test index 2992bd0..527093c 100755 --- a/flashproxy-client-test +++ b/flashproxy-client-test @@ -222,12 +222,12 @@ class TestConnectionLimit(unittest.TestCase): def tearDown(self): self.p.terminate() - def test_remote_limit(self): - """Test that the client transport plugin limits the number of remote - connections that it will accept.""" - for i in range(5): - s = socket.create_connection(REMOTE_ADDRESS, 2) - self.assertRaises(socket.error, socket.create_connection, REMOTE_ADDRESS) +# def test_remote_limit(self): +# """Test that the client transport plugin limits the number of remote +# connections that it will accept.""" +# for i in range(5): +# s = socket.create_connection(REMOTE_ADDRESS, 2) +# self.assertRaises(socket.error, socket.create_connection, REMOTE_ADDRESS) if __name__ == "__main__": unittest.main()

1 0

[flashproxy/master] Redo init.d/facilitator for Debian rather than CentOS.
by dcf＠torproject.org 31 Aug '12

31 Aug '12

commit 80724e2d1c94a5fe6c381bcf355da7a5ab03d3a2 Author: David Fifield <david(a)bamsoftware.com> Date: Thu Aug 30 17:08:35 2012 -0400 Redo init.d/facilitator for Debian rather than CentOS. --- facilitator/init.d/facilitator | 151 +++++++++++++++++++++++++++------------- 1 files changed, 102 insertions(+), 49 deletions(-) diff --git a/facilitator/init.d/facilitator b/facilitator/init.d/facilitator index 5510d11..fbb30c5 100755 --- a/facilitator/init.d/facilitator +++ b/facilitator/init.d/facilitator @@ -1,67 +1,120 @@ -#!/bin/sh +#! /bin/sh +### BEGIN INIT INFO +# Provides: facilitator +# Required-Start: $remote_fs $syslog +# Required-Stop: $remote_fs $syslog +# Default-Start: 2 3 4 5 +# Default-Stop: 0 1 6 +# Short-Description: Flash proxy facilitator +# Description: Debian init script for the flash proxy facilitator. +### END INIT INFO # -# facilitator This shell script takes care of starting and stopping -# the flash proxy facilitator. +# Author: David Fifield <david(a)bamsoftware.com> # -# chkconfig: 2345 90 10 -# description: Flash proxy facilitator. -# processname: facilitator -# pidfile: /var/flashproxy/facilitator.pid -# Installation instructions: -# cp facilitator /etc/init.d/facilitator -# chkconfig --add facilitator -# service facilitator start +# Based on /etc/init.d/skeleton from Debian 6. -# Source function library. -. /etc/rc.d/init.d/functions - -# Replace this with the address of a Tor relay with a websocket pluggable -# transport. You can use host:port syntax. +# The relay must support the websocket pluggable transport. RELAY=tor1.bamsoftware.com:9901 -BINDIR=/usr/local/bin -VARDIR=/var/flashproxy -PROG=$BINDIR/facilitator -PIDFILE=$VARDIR/facilitator.pid -USER=flashproxy +PATH=/sbin:/usr/sbin:/bin:/usr/bin +DESC="Flash proxy facilitator" +NAME=facilitator +PIDFILE=/var/run/$NAME.pid +LOGFILE=/var/log/facilitator.log +DAEMON=/usr/local/bin/$NAME +DAEMON_ARGS="-r $RELAY --log $LOGFILE --pidfile $PIDFILE" +SCRIPTNAME=/etc/init.d/$NAME + +# Exit if the package is not installed +[ -x "$DAEMON" ] || exit 0 + +. /lib/init/vars.sh +. /lib/lsb/init-functions + +# +# Function that starts the daemon/service +# +do_start() +{ + # Return + # 0 if daemon has been started + # 1 if daemon was already running + # 2 if daemon could not be started + start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON --test > /dev/null \ + || return 1 + start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON -- \ + $DAEMON_ARGS \ + || return 2 +} + +# +# Function that stops the daemon/service +# +do_stop() +{ + # Return + # 0 if daemon has been stopped + # 1 if daemon was already stopped + # 2 if daemon could not be stopped + # other if a failure occurred + start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE + RETVAL="$?" + [ "$RETVAL" = 2 ] && return 2 + # Wait for children to finish too if this is a daemon that forks + # and if the daemon is only ever run from this initscript. + # If the above conditions are not satisfied then add some other code + # that waits for the process to drop all resources that could be + # needed by services started subsequently. A last resort is to + # sleep for some time. + start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --exec $DAEMON + [ "$?" = 2 ] && return 2 + rm -f $PIDFILE + return "$RETVAL" +} -# See how we were called. case "$1" in start) - [ -x $PROG ] || exit 1 - echo -n $"Starting flash proxy facilitator: " - cd $VARDIR && daemon --user $USER --pidfile $PIDFILE $PROG --pidfile $PIDFILE -r $RELAY - RETVAL=$? - echo - [ $RETVAL -eq 0 ] && touch /var/lock/subsys/facilitator + [ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME" + do_start + case "$?" in + 0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;; + 2) [ "$VERBOSE" != no ] && log_end_msg 1 ;; + esac ;; stop) - # Stop daemon. - echo -n $"Shutting down flash proxy facilitator: " - killproc -p $PIDFILE - RETVAL=$? - echo - if [ $RETVAL -eq 0 ]; then - rm -f /var/lock/subsys/facilitator - rm -f $PIDFILE - fi + [ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME" + do_stop + case "$?" in + 0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;; + 2) [ "$VERBOSE" != no ] && log_end_msg 1 ;; + esac ;; status) - status -p $PIDFILE facilitator - RETVAL=$? - ;; - restart|reload) - $0 stop - $0 start - ;; - condrestart) - [ -f /var/lock/subsys/facilitator ] && restart || : + status_of_proc "$DAEMON" "$NAME" && exit 0 || exit $? + ;; + restart|force-reload) + log_daemon_msg "Restarting $DESC" "$NAME" + do_stop + case "$?" in + 0|1) + do_start + case "$?" in + 0) log_end_msg 0 ;; + 1) log_end_msg 1 ;; # Old process is still running + *) log_end_msg 1 ;; # Failed to start + esac + ;; + *) + # Failed to stop + log_end_msg 1 + ;; + esac ;; *) - echo $"Usage: $0 {start|stop|status|restart}" - RETVAL=3 + echo "Usage: $SCRIPTNAME {start|stop|status|restart|force-reload}" >&2 + exit 3 ;; esac -exit $RETVAL +:

1 0

[flashproxy/master] Move facilitator files into a subdirectory.
by dcf＠torproject.org 31 Aug '12

31 Aug '12

commit 59ced2a86af9414115a594b499f7307bc7821b69 Author: David Fifield <david(a)bamsoftware.com> Date: Thu Aug 30 12:31:50 2012 -0700 Move facilitator files into a subdirectory. --- Makefile | 3 +- fac.py | 182 ---------------------- facilitator | 330 ---------------------------------------- facilitator-test | 124 --------------- facilitator.cgi | 115 -------------- facilitator/Makefile | 17 ++ facilitator/fac.py | 182 ++++++++++++++++++++++ facilitator/facilitator | 330 ++++++++++++++++++++++++++++++++++++++++ facilitator/facilitator-test | 124 +++++++++++++++ facilitator/facilitator.cgi | 115 ++++++++++++++ facilitator/init.d/facilitator | 67 ++++++++ init.d/facilitator | 67 -------- 12 files changed, 836 insertions(+), 820 deletions(-) diff --git a/Makefile b/Makefile index 3a15e54..78de922 100644 --- a/Makefile +++ b/Makefile @@ -10,14 +10,13 @@ all: install: mkdir -p $(BINDIR) - cp -f flashproxy-client flashproxy-reg-http facilitator $(BINDIR) + cp -f flashproxy-client flashproxy-reg-http $(BINDIR) clean: rm -f *.pyc rm -rf dist test: - ./facilitator-test ./flashproxy-client-test ./flashproxy-test.js diff --git a/fac.py b/fac.py deleted file mode 100644 index b9ad435..0000000 --- a/fac.py +++ /dev/null @@ -1,182 +0,0 @@ -import re -import socket - -def parse_addr_spec(spec, defhost = None, defport = None, resolve = False): - """Parse a host:port specification and return a 2-tuple ("host", port) as - understood by the Python socket functions. - >>> parse_addr_spec("192.168.0.1:9999") - ('192.168.0.1', 9999) - - If defhost or defport are given, those parts of the specification may be - omitted; if so, they will be filled in with defaults. - >>> parse_addr_spec("192.168.0.2:8888", defhost="192.168.0.1", defport=9999) - ('192.168.0.2', 8888) - >>> parse_addr_spec(":8888", defhost="192.168.0.1", defport=9999) - ('192.168.0.1', 9999) - >>> parse_addr_spec("192.168.0.2:", defhost="192.168.0.1", defport=9999) - ('192.168.0.2', 9999) - >>> parse_addr_spec(":", defhost="192.168.0.1", defport=9999) - ('192.168.0.1', 9999) - - If resolve is true, then the host in the specification or the defhost may be - a domain name, which will be resolved. If resolve is false, then the host - must be a numeric IPv4 or IPv6 address. - - IPv6 addresses must be enclosed in square brackets.""" - host = None - port = None - m = None - # IPv6 syntax. - if not m: - m = re.match(ur'^\[(.+)\]:(\d+)$', spec) - if m: - host, port = m.groups() - af = socket.AF_INET6 - if not m: - m = re.match(ur'^\[(.+)\]:?$', spec) - if m: - host, = m.groups() - af = socket.AF_INET6 - # IPv4 syntax. - if not m: - m = re.match(ur'^(.+):(\d+)$', spec) - if m: - host, port = m.groups() - af = socket.AF_INET - if not m: - m = re.match(ur'^:?(\d+)$', spec) - if m: - port, = m.groups() - af = 0 - if not m: - host = spec - af = 0 - host = host or defhost - port = port or defport - if host is None or port is None: - raise ValueError("Bad address specification \"%s\"" % spec) - - # Now we have split around the colon and have a guess at the address family. - # Forward-resolve the name into an addrinfo struct. Real DNS resolution is - # done only if resolve is true; otherwise the address must be numeric. - if resolve: - flags = 0 - else: - flags = socket.AI_NUMERICHOST - try: - addrs = socket.getaddrinfo(host, port, af, socket.SOCK_STREAM, socket.IPPROTO_TCP, flags) - except socket.gaierror, e: - raise ValueError("Bad host or port: \"%s\" \"%s\": %s" % (host, port, str(e))) - if not addrs: - raise ValueError("Bad host or port: \"%s\" \"%s\"" % (host, port)) - - # Convert the result of socket.getaddrinfo (which is a 2-tuple for IPv4 and - # a 4-tuple for IPv6) into a (host, port) 2-tuple. - host, port = socket.getnameinfo(addrs[0][4], socket.NI_NUMERICHOST | socket.NI_NUMERICSERV) - port = int(port) - return host, port - -def format_addr(addr): - host, port = addr - host_str = u"" - port_str = u"" - if host is not None: - # Numeric IPv6 address? - try: - addrs = socket.getaddrinfo(host, port, 0, socket.SOCK_STREAM, socket.IPPROTO_TCP, socket.AI_NUMERICHOST) - af = addrs[0][0] - except socket.gaierror, e: - af = 0 - if af == socket.AF_INET6: - host_str = u"[%s]" % host - else: - host_str = u"%s" % host - if port is not None: - if not (0 < port <= 65535): - raise ValueError("port must be between 1 and 65535 (is %d)" % port) - port_str = u":%d" % port - - if not host_str and not port_str: - raise ValueError("host and port may not both be None") - return u"%s%s" % (host_str, port_str) - -def skip_space(pos, line): - """Skip a (possibly empty) sequence of space characters (the ASCII character - '\x20' exactly). Returns a pair (pos, num_skipped).""" - begin = pos - while pos < len(line) and line[pos] == "\x20": - pos += 1 - return pos, pos - begin - -TOKEN_CHARS = set("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_-") -def get_token(pos, line): - begin = pos - while pos < len(line) and line[pos] in TOKEN_CHARS: - pos += 1 - if begin == pos: - raise ValueError("No token found at position %d" % pos) - return pos, line[begin:pos] - -def get_quoted_string(pos, line): - chars = [] - if not (pos < len(line) and line[pos] == '"'): - raise ValueError("Expected '\"' at beginning of quoted string.") - pos += 1 - while pos < len(line) and line[pos] != '"': - if line[pos] == '\\': - pos += 1 - if not (pos < len(line)): - raise ValueError("End of line after backslash in quoted string") - chars.append(line[pos]) - pos += 1 - if not (pos < len(line) and line[pos] == '"'): - raise ValueError("Expected '\"' at end of quoted string.") - pos += 1 - return pos, "".join(chars) - -def parse_transaction(line): - """A transaction is a command followed by zero or more key-value pairs. Like so: - COMMAND KEY="VALUE" KEY="\"ESCAPED\" VALUE" - Values must be quoted. Any byte value may be escaped with a backslash. - Returns a pair: (COMMAND, ((KEY1, VALUE1), (KEY2, VALUE2), ...)). - """ - pos = 0 - pos, skipped = skip_space(pos, line) - pos, command = get_token(pos, line) - - pairs = [] - while True: - pos, skipped = skip_space(pos, line) - if not (pos < len(line)): - break - if skipped == 0: - raise ValueError("Expected space before key-value pair") - pos, key = get_token(pos, line) - if not (pos < len(line) and line[pos] == '='): - raise ValueError("No '=' found after key") - pos += 1 - pos, value = get_quoted_string(pos, line) - pairs.append((key, value)) - return command, tuple(pairs) - -def param_first(key, params): - for k, v in params: - if key == k: - return v - return None - -def quote_string(s): - chars = [] - for c in s: - if c == "\\": - c = "\\\\" - elif c == "\"": - c = "\\\"" - chars.append(c) - return "\"" + "".join(chars) + "\"" - -def render_transaction(command, *params): - parts = [command] - for key, value in params: - parts.append("%s=%s" % (key, quote_string(value))) - return " ".join(parts) diff --git a/facilitator b/facilitator deleted file mode 100755 index 3695b52..0000000 --- a/facilitator +++ /dev/null @@ -1,330 +0,0 @@ -#!/usr/bin/env python - -import SocketServer -import errno -import getopt -import os -import socket -import sys -import threading -import time - -import fac - -LISTEN_ADDRESS = "127.0.0.1" -DEFAULT_LISTEN_PORT = 9002 -DEFAULT_RELAY_PORT = 9001 -DEFAULT_LOG_FILENAME = "facilitator.log" - -# Don't indulge clients for more than this many seconds. -CLIENT_TIMEOUT = 1.0 -# Buffer no many than this many bytes when trying to read a line. -READLINE_MAX_LENGTH = 10240 - -LOG_DATE_FORMAT = "%Y-%m-%d %H:%M:%S" - -class options(object): - listen_port = DEFAULT_LISTEN_PORT - log_filename = DEFAULT_LOG_FILENAME - log_file = sys.stdout - relay_spec = None - daemonize = True - pid_filename = None - safe_logging = True - - @staticmethod - def set_relay_spec(spec): - spec = fac.parse_addr_spec(spec, defport = DEFAULT_RELAY_PORT, resolve = True) - options.relay_spec = fac.format_addr(spec) - -def usage(f = sys.stdout): - print >> f, """\ -Usage: %(progname)s -r RELAY <OPTIONS> -Flash proxy facilitator: Register client addresses and serve them out -again. Listen on 127.0.0.1 and port PORT (by default %(port)d). - -d, --debug don't daemonize, log to stdout. - -h, --help show this help. - -l, --log FILENAME write log to FILENAME (default \"%(log)s\"). - -p, --port PORT listen on PORT (by default %(port)d). - --pidfile FILENAME write PID to FILENAME after daemonizing. - -r, --relay RELAY send RELAY (host:port) to proxies as the relay to use. - --unsafe-logging don't scrub IP addresses from logs.\ -""" % { - "progname": sys.argv[0], - "port": DEFAULT_LISTEN_PORT, - "log": DEFAULT_LOG_FILENAME, -} - -def safe_str(s): - """Return s if options.safe_logging is true, and "[scrubbed]" otherwise.""" - if options.safe_logging: - return "[scrubbed]" - else: - return s - -log_lock = threading.Lock() -def log(msg): - log_lock.acquire() - try: - print >> options.log_file, (u"%s %s" % (time.strftime(LOG_DATE_FORMAT), msg)).encode("UTF-8") - options.log_file.flush() - finally: - log_lock.release() - -class TCPReg(object): - def __init__(self, host, port): - self.host = host - self.port = port - - def __unicode__(self): - return fac.format_addr((self.host, self.port)) - - def __str__(self): - return unicode(self).encode("UTF-8") - - def __cmp__(self, other): - if isinstance(other, TCPReg): - return cmp((self.host, self.port), (other.host, other.port)) - else: - return False - -class Reg(object): - @staticmethod - def parse(spec, defhost = None, defport = None): - host, port = fac.parse_addr_spec(spec, defhost, defport) - return TCPReg(host, port) - -class RegSet(object): - def __init__(self): - self.set = [] - self.cv = threading.Condition() - - def add(self, reg): - self.cv.acquire() - try: - if reg not in list(self.set): - self.set.append(reg) - self.cv.notify() - return True - else: - return False - finally: - self.cv.release() - - def fetch(self): - self.cv.acquire() - try: - if not self.set: - return None - return self.set.pop(0) - finally: - self.cv.release() - - def __len__(self): - self.cv.acquire() - try: - return len(self.set) - finally: - self.cv.release() - -# A decorator to ignore "broken pipe" errors. -def catch_epipe(fn): - def ret(self, *args): - try: - return fn(self, *args) - except socket.error, e: - try: - err_num = e.errno - except AttributeError: - # Before Python 2.6, exception can be a pair. - err_num, errstr = e - except: - raise - if err_num != errno.EPIPE: - raise - return ret - -class Handler(SocketServer.StreamRequestHandler): - def __init__(self, *args, **kwargs): - self.deadline = time.time() + CLIENT_TIMEOUT - # Buffer for readline. - self.buffer = "" - SocketServer.StreamRequestHandler.__init__(self, *args, **kwargs) - - def recv(self): - timeout = self.deadline - time.time() - self.connection.settimeout(timeout) - return self.connection.recv(1024) - - def readline(self): - # A line already buffered? - i = self.buffer.find("\n") - if i >= 0: - line = self.buffer[:i+1] - self.buffer = self.buffer[i+1:] - return line - - auxbuf = [] - buflen = len(self.buffer) - while True: - data = self.recv() - if not data: - if self.buffer or auxbuf: - raise socket.error("readline: stream does not end with a newline") - else: - return "" - i = data.find("\n") - if i >= 0: - line = self.buffer + "".join(auxbuf) + data[:i+1] - self.buffer = data[i+1:] - return line - else: - auxbuf.append(data) - buflen += len(data) - if buflen >= READLINE_MAX_LENGTH: - raise socket.error("readline: refusing to buffer %d bytes (last read was %d bytes)" % (buflen, len(data))) - - @catch_epipe - def handle(self): - num_lines = 0 - while True: - try: - line = self.readline() - if not line: - break - num_lines += 1 - except socket.error, e: - log("socket error after reading %d lines: %s" % (num_lines, str(e))) - break - if not self.handle_line(line): - break - - def handle_line(self, line): - if not (len(line) > 0 and line[-1] == '\n'): - raise ValueError("No newline at end of string returned by readline") - try: - command, params = fac.parse_transaction(line[:-1]) - except ValueError, e: - log("fac.parse_transaction: %s" % e) - self.send_error() - return False - - if command == "GET": - return self.do_GET(params) - if command == "PUT": - return self.do_PUT(params) - else: - self.send_error() - return False - - def send_ok(self): - print >> self.wfile, "OK" - - def send_error(self): - print >> self.wfile, "ERROR" - - def do_GET(self, params): - reg = REGS.fetch() - if reg: - log(u"proxy gets %s, relay %s (now %d)" % - (safe_str(unicode(reg)), options.relay_spec, len(REGS))) - print >> self.wfile, fac.render_transaction("OK", ("CLIENT", str(reg)), ("RELAY", options.relay_spec)) - else: - log(u"proxy gets none") - print >> self.wfile, fac.render_transaction("NONE") - return True - - def do_PUT(self, params): - client_spec = fac.param_first("CLIENT", params) - if client_spec is None: - log(u"PUT missing CLIENT param") - self.send_error() - return False - - # FROM - - try: - reg = Reg.parse(client_spec, self.client_address[0]) - except ValueError, e: - log(u"syntax error in %s: %s" % (safe_str(repr(client_spec)), repr(str(e)))) - self.send_error() - return False - - if REGS.add(reg): - log(u"client %s (now %d)" % (safe_str(unicode(reg)), len(REGS))) - else: - log(u"client %s (already present, now %d)" % (safe_str(unicode(reg)), len(REGS))) - - self.send_ok() - return True - - finish = catch_epipe(SocketServer.StreamRequestHandler.finish) - -class Server(SocketServer.ThreadingMixIn, SocketServer.TCPServer): - allow_reuse_address = True - -REGS = RegSet() - -def main(): - opts, args = getopt.gnu_getopt(sys.argv[1:], "dhl:p:r:", - ["debug", "help", "log=", "port=", "pidfile=", "relay=", "unsafe-logging"]) - for o, a in opts: - if o == "-d" or o == "--debug": - options.daemonize = False - options.log_filename = None - elif o == "-h" or o == "--help": - usage() - sys.exit() - elif o == "-l" or o == "--log": - options.log_filename = a - elif o == "-p" or o == "--port": - options.listen_port = int(a) - elif o == "--pidfile": - options.pid_filename = a - elif o == "-r" or o == "--relay": - try: - options.set_relay_spec(a) - except socket.gaierror, e: - print >> sys.stderr, u"Can't resolve relay %s: %s" % (repr(a), str(e)) - sys.exit(1) - elif o == "--unsafe-logging": - options.safe_logging = False - - if not options.relay_spec: - print >> sys.stderr, """\ -The -r option is required. Give it the relay that will be sent to proxies. - -r HOST[:PORT]\ - """ - sys.exit(1) - - if options.log_filename: - options.log_file = open(options.log_filename, "a") - # Send error tracebacks to the log. - sys.stderr = options.log_file - else: - options.log_file = sys.stdout - - addrinfo = socket.getaddrinfo(LISTEN_ADDRESS, options.listen_port, 0, socket.SOCK_STREAM, socket.IPPROTO_TCP)[0] - - server = Server(addrinfo[4], Handler) - - log(u"start on %s" % fac.format_addr(addrinfo[4])) - log(u"using relay address %s" % options.relay_spec) - - if options.daemonize: - log(u"daemonizing") - pid = os.fork() - if pid != 0: - if options.pid_filename: - f = open(options.pid_filename, "w") - print >> f, pid - f.close() - sys.exit(0) - - try: - server.serve_forever() - except KeyboardInterrupt: - sys.exit(0) - -if __name__ == "__main__": - main() diff --git a/facilitator-test b/facilitator-test deleted file mode 100755 index b06f5d7..0000000 --- a/facilitator-test +++ /dev/null @@ -1,124 +0,0 @@ -#!/usr/bin/env python - -import socket -import subprocess -import time -import unittest - -import fac - -FACILITATOR_HOST = "127.0.0.1" -FACILITATOR_PORT = 9002 - -def gimme_socket(host, port): - addrinfo = socket.getaddrinfo(host, port, 0, socket.SOCK_STREAM, socket.IPPROTO_TCP)[0] - s = socket.socket(addrinfo[0], addrinfo[1], addrinfo[2]) - s.settimeout(10.0) - s.connect(addrinfo[4]) - return s - -class FacilitatorTest(unittest.TestCase): - def gimme_socket(self): - return gimme_socket(FACILITATOR_HOST, FACILITATOR_PORT) - - def setUp(self): - self.process = subprocess.Popen(["./facilitator", "-d", "-p", str(FACILITATOR_PORT), "-r", "0.0.1.0:1", "-l", "/dev/null"]) - time.sleep(0.1) - - def tearDown(self): - self.process.terminate() - - def test_timeout(self): - """Test that the socket will not accept slow writes indefinitely. - Successive sends should not reset the timeout counter.""" - s = self.gimme_socket() - time.sleep(0.3) - s.send("w") - time.sleep(0.3) - s.send("w") - time.sleep(0.3) - s.send("w") - time.sleep(0.3) - s.send("w") - time.sleep(0.3) - self.assertRaises(socket.error, s.send, "w") - - def test_readline_limit(self): - """Test that reads won't buffer indefinitely.""" - s = self.gimme_socket() - buflen = 0 - try: - while buflen + 1024 < 200000: - s.send("X" * 1024) - buflen += 1024 - self.fail("should have raised a socket error") - except socket.error: - pass - -# def test_same_proxy(self): -# """Test that the same proxy doesn't get the same client when asking -# twice.""" -# self.fail() -# -# def test_num_clients(self): -# """Test that the same proxy can pick up up to five different clients but -# no more. Test that a proxy ceasing to handle a client allows the proxy -# to handle another, different client.""" -# self.fail() -# -# def test_num_proxies(self): -# """Test that a single client is handed out to five different proxies but -# no more. Test that a proxy ceasing to handle a client reduces its count -# so another proxy can handle it.""" -# self.fail() -# -# def test_proxy_timeout(self): -# """Test that a proxy ceasing to connect for some time period causes that -# proxy's clients to be unhandled by that proxy.""" -# self.fail() -# -# def test_localhost_only(self): -# """Test that the facilitator doesn't listen on any external -# addresses.""" -# self.fail() -# -# def test_hostname(self): -# """Test that the facilitator rejects hostnames.""" -# self.fail() - -class ParseTransactionTest(unittest.TestCase): - def test_empty_string(self): - self.assertRaises(ValueError, fac.parse_transaction, "") - - def test_correct(self): - self.assertEqual(fac.parse_transaction("COMMAND"), ("COMMAND", ())) - self.assertEqual(fac.parse_transaction("COMMAND X=\"\""), ("COMMAND", (("X", ""),))) - self.assertEqual(fac.parse_transaction("COMMAND X=\"ABC\""), ("COMMAND", (("X", "ABC"),))) - self.assertEqual(fac.parse_transaction("COMMAND X=\"\\A\\B\\C\""), ("COMMAND", (("X", "ABC"),))) - self.assertEqual(fac.parse_transaction("COMMAND X=\"\\\\\\\"\""), ("COMMAND", (("X", "\\\""),))) - self.assertEqual(fac.parse_transaction("COMMAND X=\"ABC\" Y=\"DEF\""), ("COMMAND", (("X", "ABC"), ("Y", "DEF")))) - self.assertEqual(fac.parse_transaction("COMMAND KEY-NAME=\"ABC\""), ("COMMAND", (("KEY-NAME", "ABC"),))) - self.assertEqual(fac.parse_transaction("COMMAND KEY_NAME=\"ABC\""), ("COMMAND", (("KEY_NAME", "ABC"),))) - - def test_missing_command(self): - self.assertRaises(ValueError, fac.parse_transaction, "X=\"ABC\"") - self.assertRaises(ValueError, fac.parse_transaction, " X=\"ABC\"") - - def test_missing_space(self): - self.assertRaises(ValueError, fac.parse_transaction, "COMMAND/X=\"ABC\"") - self.assertRaises(ValueError, fac.parse_transaction, "COMMAND X=\"ABC\"Y=\"DEF\"") - - def test_bad_quotes(self): - self.assertRaises(ValueError, fac.parse_transaction, "COMMAND X=\"") - self.assertRaises(ValueError, fac.parse_transaction, "COMMAND X=\"ABC") - self.assertRaises(ValueError, fac.parse_transaction, "COMMAND X=\"ABC\" Y=\"ABC") - self.assertRaises(ValueError, fac.parse_transaction, "COMMAND X=\"ABC\\") - - def test_truncated(self): - self.assertRaises(ValueError, fac.parse_transaction, "COMMAND X=") - - def test_newline(self): - self.assertRaises(ValueError, fac.parse_transaction, "COMMAND X=\"ABC\" \nY=\"DEF\"") - -if __name__ == "__main__": - unittest.main() diff --git a/facilitator.cgi b/facilitator.cgi deleted file mode 100755 index 39566d3..0000000 --- a/facilitator.cgi +++ /dev/null @@ -1,115 +0,0 @@ -#!/usr/bin/env python - -import cgi -import os -import socket -import sys -import urllib - -import fac - -FACILITATOR_ADDR = ("127.0.0.1", 9002) - -def exit_error(status): - print """\ -Status: %d\r -\r""" % status - sys.exit() - -def fac_socket(): - return socket.create_connection(FACILITATOR_ADDR, 1.0).makefile() - -def transact(f, command, *params): - transaction = fac.render_transaction(command, *params) - print >> f, transaction - f.flush() - line = f.readline() - if not (len(line) > 0 and line[-1] == '\n'): - raise ValueError("No newline at end of string returned by facilitator") - return fac.parse_transaction(line[:-1]) - -def put_reg(client_addr, registrant_addr): - f = fac_socket() - try: - command, params = transact(f, "PUT", ("CLIENT", fac.format_addr(client_addr)), ("FROM", fac.format_addr(registrant_addr))) - finally: - f.close() - if command == "OK": - pass - else: - exit_error(500) - -def get_reg(proxy_addr): - f = fac_socket() - try: - command, params = transact(f, "GET", ("FROM", fac.format_addr(proxy_addr))) - finally: - f.close() - if command == "NONE": - return { - "client": "" - } - elif command == "OK": - client_spec = fac.param_first("CLIENT", params) - relay_spec = fac.param_first("RELAY", params) - if not client_spec or not relay_spec: - exit_error(500) - try: - # Check the syntax returned by the backend. - client = fac.parse_addr_spec(client_spec) - relay = fac.parse_addr_spec(relay_spec) - except ValueError: - exit_error(500) - return { - "client": fac.format_addr(client), - "relay": fac.format_addr(relay), - } - else: - exit_error(500) - -method = os.environ.get("REQUEST_METHOD") -proxy_addr = (os.environ.get("REMOTE_ADDR"), None) - -if not method or not proxy_addr[0]: - exit_error(400) - -fs = cgi.FieldStorage() - -def do_get(): - try: - reg = get_reg(proxy_addr) or "" - except: - exit_error(500) - # Allow XMLHttpRequest from any domain. http://www.w3.org/TR/cors/. - print """\ -Status: 200\r -Content-Type: application/x-www-form-urlencoded\r -Cache-Control: no-cache\r -Access-Control-Allow-Origin: *\r -\r""" - sys.stdout.write(urllib.urlencode(reg)) - -def do_post(): - client_specs = fs.getlist("client") - if len(client_specs) != 1: - exit_error(400) - client_spec = client_specs[0] - try: - client_addr = fac.parse_addr_spec(client_spec, defhost=proxy_addr[0]) - except ValueError: - exit_error(400) - try: - put_reg(client_addr, proxy_addr) - except: - raise - exit_error(500) - print """\ -Status: 200\r -\r""" - -if method == "GET": - do_get() -elif method == "POST": - do_post() -else: - exit_error(405) diff --git a/facilitator/Makefile b/facilitator/Makefile new file mode 100644 index 0000000..1d9cb54 --- /dev/null +++ b/facilitator/Makefile @@ -0,0 +1,17 @@ +PREFIX = /usr/local +BINDIR = $(PREFIX)/bin + +all: + : + +install: + mkdir -p $(BINDIR) + cp -f facilitator facilitator.cgi fac.py $(BINDIR) + +clean: + rm -f *.pyc + +test: + ./facilitator-test + +.PHONY: all install clean test diff --git a/facilitator/fac.py b/facilitator/fac.py new file mode 100644 index 0000000..b9ad435 --- /dev/null +++ b/facilitator/fac.py @@ -0,0 +1,182 @@ +import re +import socket + +def parse_addr_spec(spec, defhost = None, defport = None, resolve = False): + """Parse a host:port specification and return a 2-tuple ("host", port) as + understood by the Python socket functions. + >>> parse_addr_spec("192.168.0.1:9999") + ('192.168.0.1', 9999) + + If defhost or defport are given, those parts of the specification may be + omitted; if so, they will be filled in with defaults. + >>> parse_addr_spec("192.168.0.2:8888", defhost="192.168.0.1", defport=9999) + ('192.168.0.2', 8888) + >>> parse_addr_spec(":8888", defhost="192.168.0.1", defport=9999) + ('192.168.0.1', 9999) + >>> parse_addr_spec("192.168.0.2:", defhost="192.168.0.1", defport=9999) + ('192.168.0.2', 9999) + >>> parse_addr_spec(":", defhost="192.168.0.1", defport=9999) + ('192.168.0.1', 9999) + + If resolve is true, then the host in the specification or the defhost may be + a domain name, which will be resolved. If resolve is false, then the host + must be a numeric IPv4 or IPv6 address. + + IPv6 addresses must be enclosed in square brackets.""" + host = None + port = None + m = None + # IPv6 syntax. + if not m: + m = re.match(ur'^\[(.+)\]:(\d+)$', spec) + if m: + host, port = m.groups() + af = socket.AF_INET6 + if not m: + m = re.match(ur'^\[(.+)\]:?$', spec) + if m: + host, = m.groups() + af = socket.AF_INET6 + # IPv4 syntax. + if not m: + m = re.match(ur'^(.+):(\d+)$', spec) + if m: + host, port = m.groups() + af = socket.AF_INET + if not m: + m = re.match(ur'^:?(\d+)$', spec) + if m: + port, = m.groups() + af = 0 + if not m: + host = spec + af = 0 + host = host or defhost + port = port or defport + if host is None or port is None: + raise ValueError("Bad address specification \"%s\"" % spec) + + # Now we have split around the colon and have a guess at the address family. + # Forward-resolve the name into an addrinfo struct. Real DNS resolution is + # done only if resolve is true; otherwise the address must be numeric. + if resolve: + flags = 0 + else: + flags = socket.AI_NUMERICHOST + try: + addrs = socket.getaddrinfo(host, port, af, socket.SOCK_STREAM, socket.IPPROTO_TCP, flags) + except socket.gaierror, e: + raise ValueError("Bad host or port: \"%s\" \"%s\": %s" % (host, port, str(e))) + if not addrs: + raise ValueError("Bad host or port: \"%s\" \"%s\"" % (host, port)) + + # Convert the result of socket.getaddrinfo (which is a 2-tuple for IPv4 and + # a 4-tuple for IPv6) into a (host, port) 2-tuple. + host, port = socket.getnameinfo(addrs[0][4], socket.NI_NUMERICHOST | socket.NI_NUMERICSERV) + port = int(port) + return host, port + +def format_addr(addr): + host, port = addr + host_str = u"" + port_str = u"" + if host is not None: + # Numeric IPv6 address? + try: + addrs = socket.getaddrinfo(host, port, 0, socket.SOCK_STREAM, socket.IPPROTO_TCP, socket.AI_NUMERICHOST) + af = addrs[0][0] + except socket.gaierror, e: + af = 0 + if af == socket.AF_INET6: + host_str = u"[%s]" % host + else: + host_str = u"%s" % host + if port is not None: + if not (0 < port <= 65535): + raise ValueError("port must be between 1 and 65535 (is %d)" % port) + port_str = u":%d" % port + + if not host_str and not port_str: + raise ValueError("host and port may not both be None") + return u"%s%s" % (host_str, port_str) + +def skip_space(pos, line): + """Skip a (possibly empty) sequence of space characters (the ASCII character + '\x20' exactly). Returns a pair (pos, num_skipped).""" + begin = pos + while pos < len(line) and line[pos] == "\x20": + pos += 1 + return pos, pos - begin + +TOKEN_CHARS = set("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_-") +def get_token(pos, line): + begin = pos + while pos < len(line) and line[pos] in TOKEN_CHARS: + pos += 1 + if begin == pos: + raise ValueError("No token found at position %d" % pos) + return pos, line[begin:pos] + +def get_quoted_string(pos, line): + chars = [] + if not (pos < len(line) and line[pos] == '"'): + raise ValueError("Expected '\"' at beginning of quoted string.") + pos += 1 + while pos < len(line) and line[pos] != '"': + if line[pos] == '\\': + pos += 1 + if not (pos < len(line)): + raise ValueError("End of line after backslash in quoted string") + chars.append(line[pos]) + pos += 1 + if not (pos < len(line) and line[pos] == '"'): + raise ValueError("Expected '\"' at end of quoted string.") + pos += 1 + return pos, "".join(chars) + +def parse_transaction(line): + """A transaction is a command followed by zero or more key-value pairs. Like so: + COMMAND KEY="VALUE" KEY="\"ESCAPED\" VALUE" + Values must be quoted. Any byte value may be escaped with a backslash. + Returns a pair: (COMMAND, ((KEY1, VALUE1), (KEY2, VALUE2), ...)). + """ + pos = 0 + pos, skipped = skip_space(pos, line) + pos, command = get_token(pos, line) + + pairs = [] + while True: + pos, skipped = skip_space(pos, line) + if not (pos < len(line)): + break + if skipped == 0: + raise ValueError("Expected space before key-value pair") + pos, key = get_token(pos, line) + if not (pos < len(line) and line[pos] == '='): + raise ValueError("No '=' found after key") + pos += 1 + pos, value = get_quoted_string(pos, line) + pairs.append((key, value)) + return command, tuple(pairs) + +def param_first(key, params): + for k, v in params: + if key == k: + return v + return None + +def quote_string(s): + chars = [] + for c in s: + if c == "\\": + c = "\\\\" + elif c == "\"": + c = "\\\"" + chars.append(c) + return "\"" + "".join(chars) + "\"" + +def render_transaction(command, *params): + parts = [command] + for key, value in params: + parts.append("%s=%s" % (key, quote_string(value))) + return " ".join(parts) diff --git a/facilitator/facilitator b/facilitator/facilitator new file mode 100755 index 0000000..3695b52 --- /dev/null +++ b/facilitator/facilitator @@ -0,0 +1,330 @@ +#!/usr/bin/env python + +import SocketServer +import errno +import getopt +import os +import socket +import sys +import threading +import time + +import fac + +LISTEN_ADDRESS = "127.0.0.1" +DEFAULT_LISTEN_PORT = 9002 +DEFAULT_RELAY_PORT = 9001 +DEFAULT_LOG_FILENAME = "facilitator.log" + +# Don't indulge clients for more than this many seconds. +CLIENT_TIMEOUT = 1.0 +# Buffer no many than this many bytes when trying to read a line. +READLINE_MAX_LENGTH = 10240 + +LOG_DATE_FORMAT = "%Y-%m-%d %H:%M:%S" + +class options(object): + listen_port = DEFAULT_LISTEN_PORT + log_filename = DEFAULT_LOG_FILENAME + log_file = sys.stdout + relay_spec = None + daemonize = True + pid_filename = None + safe_logging = True + + @staticmethod + def set_relay_spec(spec): + spec = fac.parse_addr_spec(spec, defport = DEFAULT_RELAY_PORT, resolve = True) + options.relay_spec = fac.format_addr(spec) + +def usage(f = sys.stdout): + print >> f, """\ +Usage: %(progname)s -r RELAY <OPTIONS> +Flash proxy facilitator: Register client addresses and serve them out +again. Listen on 127.0.0.1 and port PORT (by default %(port)d). + -d, --debug don't daemonize, log to stdout. + -h, --help show this help. + -l, --log FILENAME write log to FILENAME (default \"%(log)s\"). + -p, --port PORT listen on PORT (by default %(port)d). + --pidfile FILENAME write PID to FILENAME after daemonizing. + -r, --relay RELAY send RELAY (host:port) to proxies as the relay to use. + --unsafe-logging don't scrub IP addresses from logs.\ +""" % { + "progname": sys.argv[0], + "port": DEFAULT_LISTEN_PORT, + "log": DEFAULT_LOG_FILENAME, +} + +def safe_str(s): + """Return s if options.safe_logging is true, and "[scrubbed]" otherwise.""" + if options.safe_logging: + return "[scrubbed]" + else: + return s + +log_lock = threading.Lock() +def log(msg): + log_lock.acquire() + try: + print >> options.log_file, (u"%s %s" % (time.strftime(LOG_DATE_FORMAT), msg)).encode("UTF-8") + options.log_file.flush() + finally: + log_lock.release() + +class TCPReg(object): + def __init__(self, host, port): + self.host = host + self.port = port + + def __unicode__(self): + return fac.format_addr((self.host, self.port)) + + def __str__(self): + return unicode(self).encode("UTF-8") + + def __cmp__(self, other): + if isinstance(other, TCPReg): + return cmp((self.host, self.port), (other.host, other.port)) + else: + return False + +class Reg(object): + @staticmethod + def parse(spec, defhost = None, defport = None): + host, port = fac.parse_addr_spec(spec, defhost, defport) + return TCPReg(host, port) + +class RegSet(object): + def __init__(self): + self.set = [] + self.cv = threading.Condition() + + def add(self, reg): + self.cv.acquire() + try: + if reg not in list(self.set): + self.set.append(reg) + self.cv.notify() + return True + else: + return False + finally: + self.cv.release() + + def fetch(self): + self.cv.acquire() + try: + if not self.set: + return None + return self.set.pop(0) + finally: + self.cv.release() + + def __len__(self): + self.cv.acquire() + try: + return len(self.set) + finally: + self.cv.release() + +# A decorator to ignore "broken pipe" errors. +def catch_epipe(fn): + def ret(self, *args): + try: + return fn(self, *args) + except socket.error, e: + try: + err_num = e.errno + except AttributeError: + # Before Python 2.6, exception can be a pair. + err_num, errstr = e + except: + raise + if err_num != errno.EPIPE: + raise + return ret + +class Handler(SocketServer.StreamRequestHandler): + def __init__(self, *args, **kwargs): + self.deadline = time.time() + CLIENT_TIMEOUT + # Buffer for readline. + self.buffer = "" + SocketServer.StreamRequestHandler.__init__(self, *args, **kwargs) + + def recv(self): + timeout = self.deadline - time.time() + self.connection.settimeout(timeout) + return self.connection.recv(1024) + + def readline(self): + # A line already buffered? + i = self.buffer.find("\n") + if i >= 0: + line = self.buffer[:i+1] + self.buffer = self.buffer[i+1:] + return line + + auxbuf = [] + buflen = len(self.buffer) + while True: + data = self.recv() + if not data: + if self.buffer or auxbuf: + raise socket.error("readline: stream does not end with a newline") + else: + return "" + i = data.find("\n") + if i >= 0: + line = self.buffer + "".join(auxbuf) + data[:i+1] + self.buffer = data[i+1:] + return line + else: + auxbuf.append(data) + buflen += len(data) + if buflen >= READLINE_MAX_LENGTH: + raise socket.error("readline: refusing to buffer %d bytes (last read was %d bytes)" % (buflen, len(data))) + + @catch_epipe + def handle(self): + num_lines = 0 + while True: + try: + line = self.readline() + if not line: + break + num_lines += 1 + except socket.error, e: + log("socket error after reading %d lines: %s" % (num_lines, str(e))) + break + if not self.handle_line(line): + break + + def handle_line(self, line): + if not (len(line) > 0 and line[-1] == '\n'): + raise ValueError("No newline at end of string returned by readline") + try: + command, params = fac.parse_transaction(line[:-1]) + except ValueError, e: + log("fac.parse_transaction: %s" % e) + self.send_error() + return False + + if command == "GET": + return self.do_GET(params) + if command == "PUT": + return self.do_PUT(params) + else: + self.send_error() + return False + + def send_ok(self): + print >> self.wfile, "OK" + + def send_error(self): + print >> self.wfile, "ERROR" + + def do_GET(self, params): + reg = REGS.fetch() + if reg: + log(u"proxy gets %s, relay %s (now %d)" % + (safe_str(unicode(reg)), options.relay_spec, len(REGS))) + print >> self.wfile, fac.render_transaction("OK", ("CLIENT", str(reg)), ("RELAY", options.relay_spec)) + else: + log(u"proxy gets none") + print >> self.wfile, fac.render_transaction("NONE") + return True + + def do_PUT(self, params): + client_spec = fac.param_first("CLIENT", params) + if client_spec is None: + log(u"PUT missing CLIENT param") + self.send_error() + return False + + # FROM + + try: + reg = Reg.parse(client_spec, self.client_address[0]) + except ValueError, e: + log(u"syntax error in %s: %s" % (safe_str(repr(client_spec)), repr(str(e)))) + self.send_error() + return False + + if REGS.add(reg): + log(u"client %s (now %d)" % (safe_str(unicode(reg)), len(REGS))) + else: + log(u"client %s (already present, now %d)" % (safe_str(unicode(reg)), len(REGS))) + + self.send_ok() + return True + + finish = catch_epipe(SocketServer.StreamRequestHandler.finish) + +class Server(SocketServer.ThreadingMixIn, SocketServer.TCPServer): + allow_reuse_address = True + +REGS = RegSet() + +def main(): + opts, args = getopt.gnu_getopt(sys.argv[1:], "dhl:p:r:", + ["debug", "help", "log=", "port=", "pidfile=", "relay=", "unsafe-logging"]) + for o, a in opts: + if o == "-d" or o == "--debug": + options.daemonize = False + options.log_filename = None + elif o == "-h" or o == "--help": + usage() + sys.exit() + elif o == "-l" or o == "--log": + options.log_filename = a + elif o == "-p" or o == "--port": + options.listen_port = int(a) + elif o == "--pidfile": + options.pid_filename = a + elif o == "-r" or o == "--relay": + try: + options.set_relay_spec(a) + except socket.gaierror, e: + print >> sys.stderr, u"Can't resolve relay %s: %s" % (repr(a), str(e)) + sys.exit(1) + elif o == "--unsafe-logging": + options.safe_logging = False + + if not options.relay_spec: + print >> sys.stderr, """\ +The -r option is required. Give it the relay that will be sent to proxies. + -r HOST[:PORT]\ + """ + sys.exit(1) + + if options.log_filename: + options.log_file = open(options.log_filename, "a") + # Send error tracebacks to the log. + sys.stderr = options.log_file + else: + options.log_file = sys.stdout + + addrinfo = socket.getaddrinfo(LISTEN_ADDRESS, options.listen_port, 0, socket.SOCK_STREAM, socket.IPPROTO_TCP)[0] + + server = Server(addrinfo[4], Handler) + + log(u"start on %s" % fac.format_addr(addrinfo[4])) + log(u"using relay address %s" % options.relay_spec) + + if options.daemonize: + log(u"daemonizing") + pid = os.fork() + if pid != 0: + if options.pid_filename: + f = open(options.pid_filename, "w") + print >> f, pid + f.close() + sys.exit(0) + + try: + server.serve_forever() + except KeyboardInterrupt: + sys.exit(0) + +if __name__ == "__main__": + main() diff --git a/facilitator/facilitator-test b/facilitator/facilitator-test new file mode 100755 index 0000000..b06f5d7 --- /dev/null +++ b/facilitator/facilitator-test @@ -0,0 +1,124 @@ +#!/usr/bin/env python + +import socket +import subprocess +import time +import unittest + +import fac + +FACILITATOR_HOST = "127.0.0.1" +FACILITATOR_PORT = 9002 + +def gimme_socket(host, port): + addrinfo = socket.getaddrinfo(host, port, 0, socket.SOCK_STREAM, socket.IPPROTO_TCP)[0] + s = socket.socket(addrinfo[0], addrinfo[1], addrinfo[2]) + s.settimeout(10.0) + s.connect(addrinfo[4]) + return s + +class FacilitatorTest(unittest.TestCase): + def gimme_socket(self): + return gimme_socket(FACILITATOR_HOST, FACILITATOR_PORT) + + def setUp(self): + self.process = subprocess.Popen(["./facilitator", "-d", "-p", str(FACILITATOR_PORT), "-r", "0.0.1.0:1", "-l", "/dev/null"]) + time.sleep(0.1) + + def tearDown(self): + self.process.terminate() + + def test_timeout(self): + """Test that the socket will not accept slow writes indefinitely. + Successive sends should not reset the timeout counter.""" + s = self.gimme_socket() + time.sleep(0.3) + s.send("w") + time.sleep(0.3) + s.send("w") + time.sleep(0.3) + s.send("w") + time.sleep(0.3) + s.send("w") + time.sleep(0.3) + self.assertRaises(socket.error, s.send, "w") + + def test_readline_limit(self): + """Test that reads won't buffer indefinitely.""" + s = self.gimme_socket() + buflen = 0 + try: + while buflen + 1024 < 200000: + s.send("X" * 1024) + buflen += 1024 + self.fail("should have raised a socket error") + except socket.error: + pass + +# def test_same_proxy(self): +# """Test that the same proxy doesn't get the same client when asking +# twice.""" +# self.fail() +# +# def test_num_clients(self): +# """Test that the same proxy can pick up up to five different clients but +# no more. Test that a proxy ceasing to handle a client allows the proxy +# to handle another, different client.""" +# self.fail() +# +# def test_num_proxies(self): +# """Test that a single client is handed out to five different proxies but +# no more. Test that a proxy ceasing to handle a client reduces its count +# so another proxy can handle it.""" +# self.fail() +# +# def test_proxy_timeout(self): +# """Test that a proxy ceasing to connect for some time period causes that +# proxy's clients to be unhandled by that proxy.""" +# self.fail() +# +# def test_localhost_only(self): +# """Test that the facilitator doesn't listen on any external +# addresses.""" +# self.fail() +# +# def test_hostname(self): +# """Test that the facilitator rejects hostnames.""" +# self.fail() + +class ParseTransactionTest(unittest.TestCase): + def test_empty_string(self): + self.assertRaises(ValueError, fac.parse_transaction, "") + + def test_correct(self): + self.assertEqual(fac.parse_transaction("COMMAND"), ("COMMAND", ())) + self.assertEqual(fac.parse_transaction("COMMAND X=\"\""), ("COMMAND", (("X", ""),))) + self.assertEqual(fac.parse_transaction("COMMAND X=\"ABC\""), ("COMMAND", (("X", "ABC"),))) + self.assertEqual(fac.parse_transaction("COMMAND X=\"\\A\\B\\C\""), ("COMMAND", (("X", "ABC"),))) + self.assertEqual(fac.parse_transaction("COMMAND X=\"\\\\\\\"\""), ("COMMAND", (("X", "\\\""),))) + self.assertEqual(fac.parse_transaction("COMMAND X=\"ABC\" Y=\"DEF\""), ("COMMAND", (("X", "ABC"), ("Y", "DEF")))) + self.assertEqual(fac.parse_transaction("COMMAND KEY-NAME=\"ABC\""), ("COMMAND", (("KEY-NAME", "ABC"),))) + self.assertEqual(fac.parse_transaction("COMMAND KEY_NAME=\"ABC\""), ("COMMAND", (("KEY_NAME", "ABC"),))) + + def test_missing_command(self): + self.assertRaises(ValueError, fac.parse_transaction, "X=\"ABC\"") + self.assertRaises(ValueError, fac.parse_transaction, " X=\"ABC\"") + + def test_missing_space(self): + self.assertRaises(ValueError, fac.parse_transaction, "COMMAND/X=\"ABC\"") + self.assertRaises(ValueError, fac.parse_transaction, "COMMAND X=\"ABC\"Y=\"DEF\"") + + def test_bad_quotes(self): + self.assertRaises(ValueError, fac.parse_transaction, "COMMAND X=\"") + self.assertRaises(ValueError, fac.parse_transaction, "COMMAND X=\"ABC") + self.assertRaises(ValueError, fac.parse_transaction, "COMMAND X=\"ABC\" Y=\"ABC") + self.assertRaises(ValueError, fac.parse_transaction, "COMMAND X=\"ABC\\") + + def test_truncated(self): + self.assertRaises(ValueError, fac.parse_transaction, "COMMAND X=") + + def test_newline(self): + self.assertRaises(ValueError, fac.parse_transaction, "COMMAND X=\"ABC\" \nY=\"DEF\"") + +if __name__ == "__main__": + unittest.main() diff --git a/facilitator/facilitator.cgi b/facilitator/facilitator.cgi new file mode 100755 index 0000000..39566d3 --- /dev/null +++ b/facilitator/facilitator.cgi @@ -0,0 +1,115 @@ +#!/usr/bin/env python + +import cgi +import os +import socket +import sys +import urllib + +import fac + +FACILITATOR_ADDR = ("127.0.0.1", 9002) + +def exit_error(status): + print """\ +Status: %d\r +\r""" % status + sys.exit() + +def fac_socket(): + return socket.create_connection(FACILITATOR_ADDR, 1.0).makefile() + +def transact(f, command, *params): + transaction = fac.render_transaction(command, *params) + print >> f, transaction + f.flush() + line = f.readline() + if not (len(line) > 0 and line[-1] == '\n'): + raise ValueError("No newline at end of string returned by facilitator") + return fac.parse_transaction(line[:-1]) + +def put_reg(client_addr, registrant_addr): + f = fac_socket() + try: + command, params = transact(f, "PUT", ("CLIENT", fac.format_addr(client_addr)), ("FROM", fac.format_addr(registrant_addr))) + finally: + f.close() + if command == "OK": + pass + else: + exit_error(500) + +def get_reg(proxy_addr): + f = fac_socket() + try: + command, params = transact(f, "GET", ("FROM", fac.format_addr(proxy_addr))) + finally: + f.close() + if command == "NONE": + return { + "client": "" + } + elif command == "OK": + client_spec = fac.param_first("CLIENT", params) + relay_spec = fac.param_first("RELAY", params) + if not client_spec or not relay_spec: + exit_error(500) + try: + # Check the syntax returned by the backend. + client = fac.parse_addr_spec(client_spec) + relay = fac.parse_addr_spec(relay_spec) + except ValueError: + exit_error(500) + return { + "client": fac.format_addr(client), + "relay": fac.format_addr(relay), + } + else: + exit_error(500) + +method = os.environ.get("REQUEST_METHOD") +proxy_addr = (os.environ.get("REMOTE_ADDR"), None) + +if not method or not proxy_addr[0]: + exit_error(400) + +fs = cgi.FieldStorage() + +def do_get(): + try: + reg = get_reg(proxy_addr) or "" + except: + exit_error(500) + # Allow XMLHttpRequest from any domain. http://www.w3.org/TR/cors/. + print """\ +Status: 200\r +Content-Type: application/x-www-form-urlencoded\r +Cache-Control: no-cache\r +Access-Control-Allow-Origin: *\r +\r""" + sys.stdout.write(urllib.urlencode(reg)) + +def do_post(): + client_specs = fs.getlist("client") + if len(client_specs) != 1: + exit_error(400) + client_spec = client_specs[0] + try: + client_addr = fac.parse_addr_spec(client_spec, defhost=proxy_addr[0]) + except ValueError: + exit_error(400) + try: + put_reg(client_addr, proxy_addr) + except: + raise + exit_error(500) + print """\ +Status: 200\r +\r""" + +if method == "GET": + do_get() +elif method == "POST": + do_post() +else: + exit_error(405) diff --git a/facilitator/init.d/facilitator b/facilitator/init.d/facilitator new file mode 100755 index 0000000..5510d11 --- /dev/null +++ b/facilitator/init.d/facilitator @@ -0,0 +1,67 @@ +#!/bin/sh +# +# facilitator This shell script takes care of starting and stopping +# the flash proxy facilitator. +# +# chkconfig: 2345 90 10 +# description: Flash proxy facilitator. +# processname: facilitator +# pidfile: /var/flashproxy/facilitator.pid + +# Installation instructions: +# cp facilitator /etc/init.d/facilitator +# chkconfig --add facilitator +# service facilitator start + +# Source function library. +. /etc/rc.d/init.d/functions + +# Replace this with the address of a Tor relay with a websocket pluggable +# transport. You can use host:port syntax. +RELAY=tor1.bamsoftware.com:9901 + +BINDIR=/usr/local/bin +VARDIR=/var/flashproxy +PROG=$BINDIR/facilitator +PIDFILE=$VARDIR/facilitator.pid +USER=flashproxy + +# See how we were called. +case "$1" in + start) + [ -x $PROG ] || exit 1 + echo -n $"Starting flash proxy facilitator: " + cd $VARDIR && daemon --user $USER --pidfile $PIDFILE $PROG --pidfile $PIDFILE -r $RELAY + RETVAL=$? + echo + [ $RETVAL -eq 0 ] && touch /var/lock/subsys/facilitator + ;; + stop) + # Stop daemon. + echo -n $"Shutting down flash proxy facilitator: " + killproc -p $PIDFILE + RETVAL=$? + echo + if [ $RETVAL -eq 0 ]; then + rm -f /var/lock/subsys/facilitator + rm -f $PIDFILE + fi + ;; + status) + status -p $PIDFILE facilitator + RETVAL=$? + ;; + restart|reload) + $0 stop + $0 start + ;; + condrestart) + [ -f /var/lock/subsys/facilitator ] && restart || : + ;; + *) + echo $"Usage: $0 {start|stop|status|restart}" + RETVAL=3 + ;; +esac + +exit $RETVAL diff --git a/init.d/facilitator b/init.d/facilitator deleted file mode 100755 index 5510d11..0000000 --- a/init.d/facilitator +++ /dev/null @@ -1,67 +0,0 @@ -#!/bin/sh -# -# facilitator This shell script takes care of starting and stopping -# the flash proxy facilitator. -# -# chkconfig: 2345 90 10 -# description: Flash proxy facilitator. -# processname: facilitator -# pidfile: /var/flashproxy/facilitator.pid - -# Installation instructions: -# cp facilitator /etc/init.d/facilitator -# chkconfig --add facilitator -# service facilitator start - -# Source function library. -. /etc/rc.d/init.d/functions - -# Replace this with the address of a Tor relay with a websocket pluggable -# transport. You can use host:port syntax. -RELAY=tor1.bamsoftware.com:9901 - -BINDIR=/usr/local/bin -VARDIR=/var/flashproxy -PROG=$BINDIR/facilitator -PIDFILE=$VARDIR/facilitator.pid -USER=flashproxy - -# See how we were called. -case "$1" in - start) - [ -x $PROG ] || exit 1 - echo -n $"Starting flash proxy facilitator: " - cd $VARDIR && daemon --user $USER --pidfile $PIDFILE $PROG --pidfile $PIDFILE -r $RELAY - RETVAL=$? - echo - [ $RETVAL -eq 0 ] && touch /var/lock/subsys/facilitator - ;; - stop) - # Stop daemon. - echo -n $"Shutting down flash proxy facilitator: " - killproc -p $PIDFILE - RETVAL=$? - echo - if [ $RETVAL -eq 0 ]; then - rm -f /var/lock/subsys/facilitator - rm -f $PIDFILE - fi - ;; - status) - status -p $PIDFILE facilitator - RETVAL=$? - ;; - restart|reload) - $0 stop - $0 start - ;; - condrestart) - [ -f /var/lock/subsys/facilitator ] && restart || : - ;; - *) - echo $"Usage: $0 {start|stop|status|restart}" - RETVAL=3 - ;; -esac - -exit $RETVAL

1 0

[flashproxy/master] Make instructions for running a facilitator on Debian.
by dcf＠torproject.org 31 Aug '12

31 Aug '12

commit 14fa361ab133009f9f52c3ba89f4cb429d496388 Author: David Fifield <david(a)bamsoftware.com> Date: Thu Aug 30 14:19:14 2012 -0700 Make instructions for running a facilitator on Debian. --- README | 57 ++++------------- doc/facilitator-howto.txt | 147 +++++++++++++++++++++++++++++++++++++++++++++ facilitator/README | 3 + 3 files changed, 164 insertions(+), 43 deletions(-) diff --git a/README b/README index 0db5973..f5654cf 100644 --- a/README +++ b/README @@ -100,12 +100,20 @@ re-register: == How to run a relay The relay runs with a WebSocket proxy in external proxy mode. - git clone git://github.com/kanaka/websockify.git - git apply ~/flashproxy/patches/websockify-binary-default.patch -This command proxies WebSocket on port 9901 to a local ORPort on 9001. - ./websockify :9901 127.0.0.1:9001 -The init.d script described under "Installing so as to restart at boot" -does this automatically. + $ git clone git://github.com/kanaka/websockify.git + $ git apply ~/flashproxy/patches/websockify-binary-default.patch +Install websockify as a daemon that will restart at boot. These +instructions are for CentOS 5. + $ cd websockify + $ git apply ~/flashproxy/patches/websockify-binary-default.patch + $ su + # cp websockify websocket.py /usr/local/bin + # useradd -d /dev/null -s /bin/false websockify + # mkdir /var/websockify + # chown -R websockify.websockify /var/websockify + # cp ~/flashproxy/init.d/websockify /etc/init.d/websockify + # chkconfig --add websockify + # service websockify start Add this line to torrc to make the relay use the external proxy: ServerTransportPlugin websocket proxy 127.0.0.1:9901 @@ -115,40 +123,3 @@ Add this line to torrc to make the relay use the external proxy: Paste in this HTML where you want the badge to appear: <iframe src="//crypto.stanford.edu/flashproxy/embed.html" width="80" height="15" frameborder="0" scrolling="no"></iframe> - - -== For developers - -See design.txt for some more technical information. - -=== Running a facilitator - -On the facilitator, run - $ facilitator -r <relay-ip> -You can use "tor1.bamsoftware.com" for <relay-ip>. The facilitator runs -on port 9002 by default. - -=== Installing so as to restart at boot - -The directory init.d contains scripts to start the facilitator on -CentOS. "make install" copies files to /usr/local/bin. - - # make install - # useradd -d /dev/null -s /bin/false flashproxy - # mkdir /var/flashproxy - # chown -R flashproxy.flashproxy /var/flashproxy/ - - # cp init.d/facilitator /etc/init.d/facilitator - -- Edit /etc/init.d/facilitator to set $RELAY. - # chkconfig --add facilitator - # service facilitator start - - # cd websockify - # git apply ~/flashproxy/patches/websockify-binary-default.patch - # cp websockify websocket.py /usr/local/bin - # useradd -d /dev/null -s /bin/false websockify - # mkdir /var/websockify - # chown -R websockify.websockify /var/websockify - # cp ~/flashproxy/init.d/websockify /etc/init.d/websockify - # chkconfig --add websockify - # service websockify start diff --git a/doc/facilitator-howto.txt b/doc/facilitator-howto.txt new file mode 100644 index 0000000..c46902b --- /dev/null +++ b/doc/facilitator-howto.txt @@ -0,0 +1,147 @@ +This document describes how to run a flash proxy facilitator on Debian 6. +We will use the domain name tor-facilitator.example.com. + +== Overview + +The facilitator consists of three parts: an HTTP server, a CGI program, +and a backend. The HTTP server is responsible for speaking TLS and +invoking the CGI program. The CGI program receives client registrations +and proxy requests for clients, parses them, and forwards them to the +backend. The backend is stateful and is responsible for assigning +clients to proxies and remembering client registrations. + +We use Apache 2 as the HTTP server. The CGI script is facilitator.cgi. +The backend is facilitator. fac.py is a Python module containing code +common to facilitator.cgi and facilitator. + +== Basic and security setup + +Install some essential packages and configure a firewall. + + # cat >/etc/apt/apt.conf.d/90suggests<<EOF +APT::Install-Recommends "0"; +APT::Install-Suggests "0"; +EOF + # apt-get remove nfs-common portmap + # apt-get update + # apt-get upgrade + # apt-get install shorewall shorewall6 + +Away from the facilitator, generate an SSH key for authentication: + + $ ssh-keygen -f ~/.ssh/tor-facilitator + $ ssh-copy-id -i ~/.ssh/tor-facilitator.pub root(a)tor-facilitator.example.com + +Then log in and edit /etc/ssh/sshd_config to disable password +authentication: + + PasswordAuthentication no + +Configure the firewall to allow only SSH and HTTPS. + + # cd /etc/shorewall + # cp /usr/share/doc/shorewall/default-config/{interfaces,policy,rules,zones} . + Edit /etc/shorewall/interfaces: +net eth0 - tcpflags,norfc1918,routefilter,nosmurfs,logmartians + Edit /etc/shorewall/policy: +$FW all ACCEPT +net $FW DROP +all all DROP + Edit /etc/shorewall/rules: +SECTION NEW +SSH/ACCEPT all $FW +HTTPS/ACCEPT all $FW + Edit /etc/shorewall/zones: +fw firewall +net ipv4 + + # cd /etc/shorewall6 + # cp /usr/share/doc/shorewall6/default-config/{interfaces,policy,rules,zones} . + Edit /etc/shorewall/interfaces: +net eth0 - tcpflags + Edit /etc/shorewall/policy: +$FW all ACCEPT +net $FW DROP +all all DROP + Edit /etc/shorewall/rules: +SECTION NEW +SSH/ACCEPT all $FW +HTTPS/ACCEPT all $FW + Edit /etc/shorewall/zones: +fw firewall +net ipv6 + +Edit /etc/default/shorewall and /etc/default/shorewall6 and set + + startup=1 + +Restart servers. + + # /etc/init.d/ssh restart + # /etc/init.d/shorewall start + # /etc/init.d/shorewall6 start + +== Facilitator program installation + + # apt-get install git + # git clone https://git.torproject.org/flashproxy.git + # cd flashproxy/facilitator + # make install + +This installs facilitator.cgi, facilitator, and fac.py to +/usr/local/bin. It also installs a System V init file to +/etc/init.d/facilitator. + + # update-rc.d facilitator defaults + # /etc/init.d/facilitator start + +== HTTP server setup + +Apache is the web server that runs the CGI program. + + # apt-get install apache2 + # a2enmod ssl + +Edit /etc/apache2/ports.conf and comment out the port 80 configuration. + + # NameVirtualHost *:80 + # Listen 80 + +Create a new file /etc/apache2/sites-available/tor-facilitator with +these contents: + <VirtualHost *:443> + ServerName tor-facilitator.bamsoftware.com + DocumentRoot /dev/null + ScriptAliasMatch ^(.*) /usr/local/bin/facilitator.cgi$1 + ErrorLog ${APACHE_LOG_DIR}/error.log + LogLevel warn + SSLEngine on + SSLCertificateFile /etc/apache2/tor-facilitator.pem + </VirtualHost> + +We purposely do not include a CustomLog directive so as to not to log +client and proxy IP addresses. + +=== HTTPS setup + +The HTTP server should serve only over HTTPS and not unencrypted HTTP. +You will need a certificate and private key from a certificate +authority. An article on making a certificate signing request and +getting it signed is here: + http://www.debian-administration.org/articles/284 +The instructions below assume you have an offline private key +in tor-facilitator.key and a certificate in tor-facilitator.crt. + +Remove any passphrase from the private key. + + $ openssl rsa -in tor-facilitator.key -out tor-facilitator.pem + +Make a file containing both the private key and a certificate. + + $ cat tor-facilitator.crt >> tor-facilitator.pem + $ chmod 400 tor-facilitator.pem + +Copy the new tor-facilitator.pem to the facilitator server as +/etc/apache2/tor-facilitator.pem. + + # /etc/init.d/apache2 restart diff --git a/facilitator/README b/facilitator/README new file mode 100644 index 0000000..d3c5593 --- /dev/null +++ b/facilitator/README @@ -0,0 +1,3 @@ +This directory contains files needed to run a flash proxy facilitator. +Normal users don't need any of these files. For instructions on setting +up a facilitator, see doc/faciliator.txt.

1 0

[flashproxy/master] Increase version to 0.4.
by dcf＠torproject.org 31 Aug '12

31 Aug '12

commit 8a6084dff33fcdb9ae9cf610112fc047cf4f657c Author: David Fifield <david(a)bamsoftware.com> Date: Fri Aug 31 04:38:11 2012 -0700 Increase version to 0.4. --- Makefile | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/Makefile b/Makefile index 78de922..f79918f 100644 --- a/Makefile +++ b/Makefile @@ -1,7 +1,7 @@ PREFIX = /usr/local BINDIR = $(PREFIX)/bin -VERSION = 0.3 +VERSION = 0.4 CLIENT_DIST_FILES = flashproxy-client flashproxy-reg-http README LICENSE torrc

1 0

[flashproxy/master] Use HTTPS in flashproxy.js.
by dcf＠torproject.org 31 Aug '12

31 Aug '12

commit 82736119d8bad82ecd3ee5db4a006f28e8647306 Author: David Fifield <david(a)bamsoftware.com> Date: Thu Aug 30 16:15:53 2012 -0700 Use HTTPS in flashproxy.js. --- flashproxy.js | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/flashproxy.js b/flashproxy.js index 6d70fe7..b0bdf21 100644 --- a/flashproxy.js +++ b/flashproxy.js @@ -51,7 +51,7 @@ var DEFAULT_FACILITATOR_ADDR = { host: "tor-facilitator.bamsoftware.com", - port: 9002 + port: 443 }; var DEFAULT_MAX_NUM_PROXY_PAIRS = 10; @@ -372,7 +372,7 @@ function FlashProxy() { return; } - fac_url = "http://" + encodeURIComponent(this.fac_addr.host) + fac_url = "https://" + encodeURIComponent(this.fac_addr.host) + ":" + encodeURIComponent(this.fac_addr.port) + "/"; xhr = new XMLHttpRequest(); try {

1 0