- tor-commits - lists.torproject.org

[flashproxy/master] Do the __name__ == "__main__" trick in connector.py.
by dcf＠torproject.org 09 Apr '12

09 Apr '12

commit c6e3c10ef6e73ca9fd6fe730699e1f2161114df3 Author: David Fifield <david(a)bamsoftware.com> Date: Sun Mar 25 10:53:23 2012 -0700 Do the __name__ == "__main__" trick in connector.py. --- connector.py | 139 +++++++++++++++++++++++++++++----------------------------- 1 files changed, 70 insertions(+), 69 deletions(-) diff --git a/connector.py b/connector.py index 85fc4ad..f84f8a2 100755 --- a/connector.py +++ b/connector.py @@ -115,40 +115,6 @@ def format_addr(addr): else: return u"%s:%d" % (host, port) -opts, args = getopt.gnu_getopt(sys.argv[1:], "f:hl:", ["daemon", "facilitator=", "help", "log=", "pidfile="]) -for o, a in opts: - if o == "--daemon": - options.daemonize = True - elif o == "-f" or o == "--facilitator": - options.facilitator_addr = parse_addr_spec(a, None, DEFAULT_FACILITATOR_PORT) - elif o == "-h" or o == "--help": - usage() - sys.exit() - elif o == "-l" or o == "--log": - options.log_filename = a - elif o == "--pidfile": - options.pid_filename = a - -if len(args) == 0: - options.local_addr = (DEFAULT_LOCAL_ADDRESS, DEFAULT_LOCAL_PORT) - options.remote_addr = (DEFAULT_REMOTE_ADDRESS, DEFAULT_REMOTE_PORT) -elif len(args) == 1: - options.local_addr = parse_addr_spec(args[0], DEFAULT_LOCAL_ADDRESS, DEFAULT_LOCAL_PORT) - options.remote_addr = (DEFAULT_REMOTE_ADDRESS, DEFAULT_REMOTE_PORT) -elif len(args) == 2: - options.local_addr = parse_addr_spec(args[0], DEFAULT_LOCAL_ADDRESS, DEFAULT_LOCAL_PORT) - options.remote_addr = parse_addr_spec(args[1], DEFAULT_REMOTE_ADDRESS, DEFAULT_REMOTE_PORT) -else: - usage(sys.stderr) - sys.exit(1) - -if options.log_filename: - options.log_file = open(options.log_filename, "a") - # Send error tracebacks to the log. - sys.stderr = options.log_file -else: - options.log_file = sys.stdout - class BufferSocket(object): """A socket containing a time of creation and a buffer of data received. The @@ -180,22 +146,6 @@ def format_peername(s): except socket.error, e: return "<unconnected>" -# Local socket, accepting SOCKS requests from localhost -local_s = listen_socket(options.local_addr) -# Remote socket, accepting remote WebSocket connections from proxies. -remote_s = listen_socket(options.remote_addr) - -# Remote connection sockets. -remotes = [] -# New local sockets waiting to finish their SOCKS negotiation. -socks_pending = [] -# Local Tor sockets, after SOCKS negotiation. -locals = [] - -# Bidirectional mapping between local sockets and remote sockets. -local_for = {} -remote_for = {} - def grab_string(s, pos): """Grab a NUL-terminated string from the given string, starting at the given @@ -327,18 +277,6 @@ def match_proxies(): remote_for[local.fd] = remote.fd local_for[remote.fd] = local.fd -if options.daemonize: - log(u"Daemonizing.") - pid = os.fork() - if pid != 0: - if options.pid_filename: - f = open(options.pid_filename, "w") - print >> f, pid - f.close() - sys.exit(0) - -register() - def main(): while True: rset = [remote_s, local_s] + socks_pending + remote_for.keys() + local_for.keys() + locals + remotes @@ -347,8 +285,9 @@ def main(): if fd == remote_s: remote_c, addr = fd.accept() log(u"Remote connection from %s." % format_addr(addr)) - remotes.append(fd) - handle_remote_connection(fd) + remotes.append(BufferSocket(remote_c)) + handle_remote_connection(remote_c) + report_pending() elif fd == local_s: local_c, addr = fd.accept() log(u"Local connection from %s." % format_addr(addr)) @@ -385,8 +324,70 @@ def main(): report_pending() match_proxies() -try: - main() -except Exception: - exc = traceback.format_exc() - log("".join(exc)) +if __name__ == "__main__": + opts, args = getopt.gnu_getopt(sys.argv[1:], "f:hl:", ["daemon", "facilitator=", "help", "log=", "pidfile="]) + for o, a in opts: + if o == "--daemon": + options.daemonize = True + elif o == "-f" or o == "--facilitator": + options.facilitator_addr = parse_addr_spec(a, None, DEFAULT_FACILITATOR_PORT) + elif o == "-h" or o == "--help": + usage() + sys.exit() + elif o == "-l" or o == "--log": + options.log_filename = a + elif o == "--pidfile": + options.pid_filename = a + + if len(args) == 0: + options.local_addr = (DEFAULT_LOCAL_ADDRESS, DEFAULT_LOCAL_PORT) + options.remote_addr = (DEFAULT_REMOTE_ADDRESS, DEFAULT_REMOTE_PORT) + elif len(args) == 1: + options.local_addr = parse_addr_spec(args[0], DEFAULT_LOCAL_ADDRESS, DEFAULT_LOCAL_PORT) + options.remote_addr = (DEFAULT_REMOTE_ADDRESS, DEFAULT_REMOTE_PORT) + elif len(args) == 2: + options.local_addr = parse_addr_spec(args[0], DEFAULT_LOCAL_ADDRESS, DEFAULT_LOCAL_PORT) + options.remote_addr = parse_addr_spec(args[1], DEFAULT_REMOTE_ADDRESS, DEFAULT_REMOTE_PORT) + else: + usage(sys.stderr) + sys.exit(1) + + if options.log_filename: + options.log_file = open(options.log_filename, "a") + # Send error tracebacks to the log. + sys.stderr = options.log_file + else: + options.log_file = sys.stdout + + # Local socket, accepting SOCKS requests from localhost + local_s = listen_socket(options.local_addr) + # Remote socket, accepting remote WebSocket connections from proxies. + remote_s = listen_socket(options.remote_addr) + + # Remote connection sockets. + remotes = [] + # New local sockets waiting to finish their SOCKS negotiation. + socks_pending = [] + # Local Tor sockets, after SOCKS negotiation. + locals = [] + + # Bidirectional mapping between local sockets and remote sockets. + local_for = {} + remote_for = {} + + register() + + if options.daemonize: + log(u"Daemonizing.") + pid = os.fork() + if pid != 0: + if options.pid_filename: + f = open(options.pid_filename, "w") + print >> f, pid + f.close() + sys.exit(0) + try: + main() + except Exception: + exc = traceback.format_exc() + log("".join(exc))

1 0

[flashproxy/master] Add ServerTransportPlugin line for websocket transport.
by dcf＠torproject.org 09 Apr '12

09 Apr '12

commit eea30d38701d66e308c3d0ce3023bcb69f72186a Author: David Fifield <david(a)bamsoftware.com> Date: Sun Mar 25 10:51:23 2012 -0700 Add ServerTransportPlugin line for websocket transport. --- README | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) diff --git a/README b/README index d362ed7..46776d5 100644 --- a/README +++ b/README @@ -125,6 +125,8 @@ The relay runs with a WebSocket proxy in external proxy mode. This command proxies WebSocket on port 9901 to a local ORPort on 9001. ./websockify :9901 127.0.0.1:9001 +Add this line to torrc to make the relay use the external proxy: + ServerTransportPlugin websocket proxy 127.0.0.1:9901 == How to put a flash proxy badge on a web page.

1 0

[flashproxy/master] Add WebSocketDecoder and tests.
by dcf＠torproject.org 09 Apr '12

09 Apr '12

commit 4726aa424262be3af244a57fe274805da6f26842 Author: David Fifield <david(a)bamsoftware.com> Date: Tue Mar 27 22:59:31 2012 -0700 Add WebSocketDecoder and tests. --- Makefile | 1 + connector-test.py | 151 ++++++++++++++++++++++++++++++++++++++++++++++++++++ connector.py | 153 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 305 insertions(+), 0 deletions(-) diff --git a/Makefile b/Makefile index 0fb0c79..61c3901 100644 --- a/Makefile +++ b/Makefile @@ -20,6 +20,7 @@ clean: rm -f $(TARGETS) test: + ./connector-test.py ./flashproxy-test.js .PHONY: all clean test diff --git a/connector-test.py b/connector-test.py new file mode 100755 index 0000000..c0479bd --- /dev/null +++ b/connector-test.py @@ -0,0 +1,151 @@ +#!/usr/bin/env python +# -*- coding: utf-8 -*- + +import unittest +from connector import WebSocketDecoder + +def read_frames(dec): + frames = [] + while True: + frame = dec.read_frame() + if frame is None: + break + frames.append((frame.fin, frame.opcode, frame.payload)) + return frames + +def read_messages(dec): + messages = [] + while True: + message = dec.read_message() + if message is None: + break + messages.append((message.opcode, message.payload)) + return messages + +class TestWebSocketDecoder(unittest.TestCase): + def test_rfc(self): + """Test samples from RFC 6455 section 5.7.""" + TESTS = [ + ("\x81\x05\x48\x65\x6c\x6c\x6f", False, + [(True, 1, "Hello")], + [(1, u"Hello")]), + ("\x81\x85\x37\xfa\x21\x3d\x7f\x9f\x4d\x51\x58", True, + [(True, 1, "Hello")], + [(1, u"Hello")]), + ("\x01\x03\x48\x65\x6c\x80\x02\x6c\x6f", False, + [(False, 1, "Hel"), (True, 0, "lo")], + [(1, u"Hello")]), + ("\x89\x05\x48\x65\x6c\x6c\x6f", False, + [(True, 9, "Hello")], + [(9, u"Hello")]), + ("\x8a\x85\x37\xfa\x21\x3d\x7f\x9f\x4d\x51\x58", True, + [(True, 10, "Hello")], + [(10, u"Hello")]), + ("\x82\x7e\x01\x00" + "\x00" * 256, False, + [(True, 2, "\x00" * 256)], + [(2, "\x00" * 256)]), + ("\x82\x7f\x00\x00\x00\x00\x00\x01\x00\x00" + "\x00" * 65536, False, + [(True, 2, "\x00" * 65536)], + [(2, "\x00" * 65536)]), + ] + for data, use_mask, expected_frames, expected_messages in TESTS: + dec = WebSocketDecoder(use_mask = use_mask) + dec.feed(data) + actual_frames = read_frames(dec) + self.assertEqual(actual_frames, expected_frames) + + dec = WebSocketDecoder(use_mask = use_mask) + dec.feed(data) + actual_messages = read_messages(dec) + self.assertEqual(actual_messages, expected_messages) + + dec = WebSocketDecoder(use_mask = not use_mask) + dec.feed(data) + self.assertRaises(WebSocketDecoder.MaskingError, dec.read_frame) + + def test_empty_feed(self): + """Test that the decoder can handle a zero-byte feed.""" + dec = WebSocketDecoder() + self.assertIsNone(dec.read_frame()) + dec.feed("") + self.assertIsNone(dec.read_frame()) + dec.feed("\x81\x05H") + self.assertIsNone(dec.read_frame()) + dec.feed("ello") + self.assertEqual(read_frames(dec), [(True, 1, u"Hello")]) + + def test_empty_frame(self): + """Test that a frame may contain a zero-byte payload.""" + dec = WebSocketDecoder() + dec.feed("\x81\x00") + self.assertEqual(read_frames(dec), [(True, 1, u"")]) + dec.feed("\x82\x00") + self.assertEqual(read_frames(dec), [(True, 2, "")]) + + def test_empty_message(self): + """Test that a message may have a zero-byte payload.""" + dec = WebSocketDecoder() + dec.feed("\x01\x00\x00\x00\x80\x00") + self.assertEqual(read_messages(dec), [(1, u"")]) + dec.feed("\x02\x00\x00\x00\x80\x00") + self.assertEqual(read_messages(dec), [(2, "")]) + + def test_interleaved_control(self): + """Test that control messages interleaved with fragmented messages are + returned.""" + dec = WebSocketDecoder() + dec.feed("\x89\x04PING\x01\x03Hel\x8a\x04PONG\x80\x02lo\x89\x04PING") + self.assertEqual(read_messages(dec), [(9, "PING"), (10, "PONG"), (1, u"Hello"), (9, "PING")]) + + def test_fragmented_control(self): + """Test that illegal fragmented control messages cause an error.""" + dec = WebSocketDecoder() + dec.feed("\x09\x04PING") + self.assertRaises(ValueError, dec.read_message) + + def test_zero_opcode(self): + """Test that it is an error for the first frame in a message to have an + opcode of 0.""" + dec = WebSocketDecoder() + dec.feed("\x80\x05Hello") + self.assertRaises(ValueError, dec.read_message) + dec = WebSocketDecoder() + dec.feed("\x00\x05Hello") + self.assertRaises(ValueError, dec.read_message) + + def test_nonzero_opcode(self): + """Test that every frame after the first must have a zero opcode.""" + dec = WebSocketDecoder() + dec.feed("\x01\x01H\x01\x02el\x80\x02lo") + self.assertRaises(ValueError, dec.read_message) + dec = WebSocketDecoder() + dec.feed("\x01\x01H\x00\x02el\x01\x02lo") + self.assertRaises(ValueError, dec.read_message) + + def test_utf8(self): + """Test that text frames (opcode 1) are decoded from UTF-8.""" + text = u"Hello World or Καλημέρα κόσμε or こんにちは世界 or \U0001f639" + utf8_text = text.encode("utf-8") + dec = WebSocketDecoder() + dec.feed("\x81" + chr(len(utf8_text)) + utf8_text) + self.assertEqual(read_messages(dec), [(1, text)]) + + def test_wrong_utf8(self): + """Test that failed UTF-8 decoding causes an error.""" + TESTS = [ + "\xc0\x41", # Non-shortest form. + "\xc2", # Unfinished sequence. + ] + for test in TESTS: + dec = WebSocketDecoder() + dec.feed("\x81" + chr(len(test)) + test) + self.assertRaises(ValueError, dec.read_message) + + def test_overly_large_payload(self): + """Test that large payloads are rejected.""" + dec = WebSocketDecoder() + dec.feed("\x82\x7f\x00\x00\x00\x00\x01\x00\x00\x00") + self.assertRaises(ValueError, dec.read_frame) + +if __name__ == "__main__": + unittest.main() diff --git a/connector.py b/connector.py index f84f8a2..39d89e8 100755 --- a/connector.py +++ b/connector.py @@ -130,6 +130,159 @@ class BufferSocket(object): def is_expired(self, timeout): return time.time() - self.birthday > timeout + +class WebSocketFrame(object): + def __init__(self): + self.fin = False + self.opcode = None + self.payload = None + + def is_control(self): + return (self.opcode & 0x08) != 0 + +class WebSocketMessage(object): + def __init__(self): + self.opcode = None + self.payload = None + + def is_control(self): + return (self.opcode & 0x08) != 0 + +class WebSocketDecoder(object): + """RFC 6455 section 5 is about the WebSocket framing format.""" + # Raise an exception rather than buffer anything arger than this. + MAX_MESSAGE_LENGTH = 1024 * 1024 + + class MaskingError(ValueError): + pass + + def __init__(self, use_mask = False): + """use_mask should be True for server-to-client sockets, and False for + client-to-server sockets.""" + self.use_mask = use_mask + + # Per-frame state. + self.buf = "" + + # Per-message state. + self.message_buf = "" + self.message_opcode = None + + def feed(self, data): + self.buf += data + + @staticmethod + def mask(payload, mask_key): + result = [] + for i, c in enumerate(payload): + mc = chr(ord(payload[i]) ^ ord(mask_key[i%4])) + result.append(mc) + return "".join(result) + + def read_frame(self): + """Read a frame from the internal buffer, if one is available. Returns a + WebSocketFrame object, or None if there are no complete frames to + read.""" + # RFC 6255 section 5.2. + if len(self.buf) < 2: + return None + offset = 0 + b0, b1 = struct.unpack_from(">BB", self.buf, offset) + offset += 2 + fin = (b0 & 0x80) != 0 + opcode = b0 & 0x0f + frame_masked = (b1 & 0x80) != 0 + payload_len = b1 & 0x7f + + if payload_len == 126: + if len(self.buf) < offset + 2: + return None + payload_len, = struct.unpack_from(">H", self.buf, offset) + offset += 2 + elif payload_len == 127: + if len(self.buf) < offset + 8: + return None + payload_len, = struct.unpack_from(">Q", self.buf, offset) + offset += 8 + + if frame_masked: + if not self.use_mask: + # "A client MUST close a connection if it detects a masked + # frame." + raise self.MaskingError("Got masked payload from server") + if len(self.buf) < offset + 4: + return None + mask_key = self.buf[offset:offset+4] + offset += 4 + else: + if self.use_mask: + # "The server MUST close the connection upon receiving a frame + # that is not masked." + raise self.MaskingError("Got unmasked payload from client") + mask_key = "\x00\x00\x00\x00" + + if payload_len > self.MAX_MESSAGE_LENGTH: + raise ValueError("Refusing to buffer payload of %d bytes" % payload_len) + + if len(self.buf) < offset + payload_len: + return None + payload = WebSocketDecoder.mask(self.buf[offset:offset+payload_len], mask_key) + self.buf = self.buf[offset+payload_len:] + + frame = WebSocketFrame() + frame.fin = fin + frame.opcode = opcode + frame.payload = payload + + return frame + + def read_message(self): + """Read a complete message. If the opcode is 1, the payload is decoded + from a UTF-8 binary string to a unicode string. If a control frame is + read while another fragmented message is in progress, the control frame + is returned as a new message immediately. Returns None if there is no + complete frame to be read.""" + # RFC 6455 section 5.4 is about fragmentation. + while True: + frame = self.read_frame() + if frame is None: + return None + # "Control frames (see Section 5.5) MAY be injected in the middle of + # a fragmented message. Control frames themselves MUST NOT be + # fragmented. + if frame.is_control(): + if not frame.fin: + raise ValueError("Control frame (opcode %d) has FIN bit clear" % frame.opcode) + message = WebSocketMessage() + message.opcode = frame.opcode + message.payload = frame.payload + return message + + if self.message_opcode is None: + if frame.opcode == 0: + raise ValueError("First frame has opcode 0") + self.message_opcode = frame.opcode + else: + if frame.opcode != 0: + raise ValueError("Non-first frame has nonzero opcode %d" % frame.opcode) + self.message_buf += frame.payload + + if frame.fin: + break + message = WebSocketMessage() + message.opcode = self.message_opcode + message.payload = self.message_buf + self.postprocess_message(message) + self.message_opcode = None + self.message_buf = "" + + return message + + def postprocess_message(self, message): + if message.opcode == 1: + message.payload = message.payload.decode("utf-8") + return message + def listen_socket(addr): """Return a nonblocking socket listening on the given address.""" addrinfo = socket.getaddrinfo(addr[0], addr[1], 0, socket.SOCK_STREAM, socket.IPPROTO_TCP)[0]

1 0

[flashproxy/master] Add WebSocketEncoder and tests.
by dcf＠torproject.org 09 Apr '12

09 Apr '12

commit 7ea31933aef27276cb443eee49369bccb6661ffa Author: David Fifield <david(a)bamsoftware.com> Date: Wed Mar 28 00:14:51 2012 -0700 Add WebSocketEncoder and tests. --- connector-test.py | 28 +++++++++++++++++++++++++++- connector.py | 51 ++++++++++++++++++++++++++++++++++++++++++--------- 2 files changed, 69 insertions(+), 10 deletions(-) diff --git a/connector-test.py b/connector-test.py index c0479bd..a15c1ad 100755 --- a/connector-test.py +++ b/connector-test.py @@ -2,7 +2,7 @@ # -*- coding: utf-8 -*- import unittest -from connector import WebSocketDecoder +from connector import WebSocketDecoder, WebSocketEncoder def read_frames(dec): frames = [] @@ -147,5 +147,31 @@ class TestWebSocketDecoder(unittest.TestCase): dec.feed("\x82\x7f\x00\x00\x00\x00\x01\x00\x00\x00") self.assertRaises(ValueError, dec.read_frame) +class TestWebSocketEncoder(unittest.TestCase): + def test_length(self): + """Test that payload lengths are encoded using the smallest number of + bytes.""" + TESTS = [(0, 0), (125, 0), (126, 2), (65535, 2), (65536, 8)] + for length, encoded_length in TESTS: + enc = WebSocketEncoder(use_mask = False) + eframe = enc.encode_frame(2, "\x00" * length) + self.assertEqual(len(eframe), 1 + 1 + encoded_length + length) + enc = WebSocketEncoder(use_mask = True) + eframe = enc.encode_frame(2, "\x00" * length) + self.assertEqual(len(eframe), 1 + 1 + encoded_length + 4 + length) + + def test_roundtrip(self): + TESTS = [ + (1, u"Hello world"), + (1, u"Hello \N{WHITE SMILING FACE}"), + ] + for opcode, payload in TESTS: + for use_mask in (False, True): + enc = WebSocketEncoder(use_mask = use_mask) + enc_message = enc.encode_message(opcode, payload) + dec = WebSocketDecoder(use_mask = use_mask) + dec.feed(enc_message) + self.assertEqual(read_messages(dec), [(opcode, payload)]) + if __name__ == "__main__": unittest.main() diff --git a/connector.py b/connector.py index 39d89e8..2a06523 100755 --- a/connector.py +++ b/connector.py @@ -131,6 +131,13 @@ class BufferSocket(object): return time.time() - self.birthday > timeout +def apply_mask(payload, mask_key): + result = [] + for i, c in enumerate(payload): + mc = chr(ord(payload[i]) ^ ord(mask_key[i%4])) + result.append(mc) + return "".join(result) + class WebSocketFrame(object): def __init__(self): self.fin = False @@ -171,14 +178,6 @@ class WebSocketDecoder(object): def feed(self, data): self.buf += data - @staticmethod - def mask(payload, mask_key): - result = [] - for i, c in enumerate(payload): - mc = chr(ord(payload[i]) ^ ord(mask_key[i%4])) - result.append(mc) - return "".join(result) - def read_frame(self): """Read a frame from the internal buffer, if one is available. Returns a WebSocketFrame object, or None if there are no complete frames to @@ -226,7 +225,7 @@ class WebSocketDecoder(object): if len(self.buf) < offset + payload_len: return None - payload = WebSocketDecoder.mask(self.buf[offset:offset+payload_len], mask_key) + payload = apply_mask(self.buf[offset:offset+payload_len], mask_key) self.buf = self.buf[offset+payload_len:] frame = WebSocketFrame() @@ -283,6 +282,40 @@ class WebSocketDecoder(object): message.payload = message.payload.decode("utf-8") return message +class WebSocketEncoder(object): + def __init__(self, use_mask = False): + self.use_mask = use_mask + + def encode_frame(self, opcode, payload): + if opcode >= 16: + raise ValueError("Opcode of %d is >= 16" % opcode) + length = len(payload) + + if self.use_mask: + mask_key = os.urandom(4) + payload = apply_mask(payload, mask_key) + mask_bit = 0x80 + else: + mask_key = "" + mask_bit = 0x00 + + if length < 126: + len_b, len_ext = length, "" + elif length < 0x10000: + len_b, len_ext = 126, struct.pack(">H", length) + elif length < 0x10000000000000000: + len_b, len_ext = 127, struct.pack(">Q", length) + else: + raise ValueError("payload length of %d is too long" % length) + + return chr(0x80 | opcode) + chr(mask_bit | len_b) + len_ext + mask_key + payload + + def encode_message(self, opcode, payload): + if opcode == 1: + payload = payload.encode("utf-8") + return self.encode_frame(opcode, payload) + + def listen_socket(addr): """Return a nonblocking socket listening on the given address.""" addrinfo = socket.getaddrinfo(addr[0], addr[1], 0, socket.SOCK_STREAM, socket.IPPROTO_TCP)[0]

1 0

[flashproxy/master] Add WebSocketBinaryDecoder and WebSocketBinaryEncoder.
by dcf＠torproject.org 09 Apr '12

09 Apr '12

commit 05a8c895644ab098f7118c326c5904a6e9a217b6 Author: David Fifield <david(a)bamsoftware.com> Date: Wed Mar 28 01:20:27 2012 -0700 Add WebSocketBinaryDecoder and WebSocketBinaryEncoder. --- connector.py | 46 ++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 46 insertions(+), 0 deletions(-) diff --git a/connector.py b/connector.py index 2a06523..4077f69 100755 --- a/connector.py +++ b/connector.py @@ -1,5 +1,6 @@ #!/usr/bin/env python +import base64 import getopt import httplib import os @@ -315,6 +316,51 @@ class WebSocketEncoder(object): payload = payload.encode("utf-8") return self.encode_frame(opcode, payload) +# WebSocket implementations generally support text (opcode 1) messages, which +# are UTF-8-encoded text. Not all support binary (opcode 2) messages. During the +# WebSocket handshake, we use the "base64" value of the Sec-WebSocket-Protocol +# header field to indicate that text frames should encoded UTF-8-encoded +# base64-encoded binary data. Binary messages are always interpreted verbatim, +# but text messages are rejected if "base64" was not negotiated. +# +# The idea here is that browsers that know they don't support binary messages +# can negotiate "base64" with both endpoints and still reliably transport binary +# data. Those that know they can support binary messages can just use binary +# messages in the straightforward way. + +class WebSocketBinaryDecoder(object): + def __init__(self, protocols, use_mask = False): + self.dec = WebSocketDecoder(use_mask) + self.base64 = "base64" in protocols + + def feed(self, data): + self.dec.feed(data) + + def read(self): + while True: + message = self.dec.read_message() + if message is None: + return None + elif message.opcode == 1: + if not self.base64: + raise ValueError("Received text message on decoder incapable of base64") + return base64.b64decode(message.payload) + elif message.opcode == 2: + return message.payload + # Ignore all other opcodes. + return None + +class WebSocketBinaryEncoder(object): + def __init__(self, protocols, use_mask = False): + self.enc = WebSocketEncoder(use_mask) + self.base64 = "base64" in protocols + + def encode(self, data): + if self.base64: + return self.enc.encode_message(1, base64.b64encode(data)) + else: + return self.enc.encode_message(2, data) + def listen_socket(addr): """Return a nonblocking socket listening on the given address."""

1 0

[flashproxy/master] Answer WebSocket requests.
by dcf＠torproject.org 09 Apr '12

09 Apr '12

commit 662d389ce92810a16405d0f9ad1323e5a203c9f6 Author: David Fifield <david(a)bamsoftware.com> Date: Wed Mar 28 03:06:42 2012 -0700 Answer WebSocket requests. --- connector.py | 136 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++-- 1 files changed, 132 insertions(+), 4 deletions(-) diff --git a/connector.py b/connector.py index 4077f69..3268a64 100755 --- a/connector.py +++ b/connector.py @@ -1,7 +1,9 @@ #!/usr/bin/env python import base64 +import cStringIO import getopt +import hashlib import httplib import os import re @@ -13,6 +15,7 @@ import time import traceback import urllib import xml.sax.saxutils +import BaseHTTPServer DEFAULT_REMOTE_ADDRESS = "0.0.0.0" DEFAULT_REMOTE_PORT = 9000 @@ -379,6 +382,121 @@ def format_peername(s): return "<unconnected>" +class WebSocketRequestHandler(BaseHTTPServer.BaseHTTPRequestHandler): + def __init__(self, request_text, fd): + self.rfile = cStringIO.StringIO(request_text) + self.wfile = fd.makefile() + self.error = False + self.raw_requestline = self.rfile.readline() + self.parse_request() + + def log_message(self, *args): + pass + + def send_error(self, code, message = None): + BaseHTTPServer.BaseHTTPRequestHandler.send_error(self, code, message) + self.error = True + +MAGIC_GUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11" + +def handle_websocket_request(fd): + log(u"handle_websocket_request") + request_text = fd.recv(10 * 1024) + handler = WebSocketRequestHandler(request_text, fd) + method = handler.command + path = handler.path + headers = handler.headers + + # See RFC 6455 section 4.2.1 for this sequence of checks. + # + # 1. An HTTP/1.1 or higher GET request, including a "Request-URI"... + if method != "GET": + handler.send_error(405) + return None + if path != "/": + handler.send_error(404) + return None + + # 2. A |Host| header field containing the server's authority. + # We deliberately skip this test. + + # 3. An |Upgrade| header field containing the value "websocket", treated as + # an ASCII case-insensitive value. + if "websocket" not in [x.strip().lower() for x in headers.get("upgrade").split(",")]: + handler.send_error(400) + return None + + # 4. A |Connection| header field that includes the token "Upgrade", treated + # as an ASCII case-insensitive value. + if "upgrade" not in [x.strip().lower() for x in headers.get("connection").split(",")]: + handler.send_error(400) + return None + + # 5. A |Sec-WebSocket-Key| header field with a base64-encoded value that, + # when decoded, is 16 bytes in length. + try: + key = headers.get("sec-websocket-key") + if len(base64.b64decode(key)) != 16: + raise TypeError("Sec-WebSocket-Key must be 16 bytes") + except TypeError: + handler.send_error(400) + return None + + # 6. A |Sec-WebSocket-Version| header field, with a value of 13. We also + # allow 8 from draft-ietf-hybi-thewebsocketprotocol-10. + version = headers.get("sec-websocket-version") + KNOWN_VERSIONS = ["8", "13"] + if version not in KNOWN_VERSIONS: + # "If this version does not match a version understood by the server, + # the server MUST abort the WebSocket handshake described in this + # section and instead send an appropriate HTTP error code (such as 426 + # Upgrade Required) and a |Sec-WebSocket-Version| header field + # indicating the version(s) the server is capable of understanding." + handler.send_response(426) + handler.send_header("Sec-WebSocket-Version", ", ".join(KNOWN_VERSIONS)) + handler.end_headers() + return None + + # 7. Optionally, an |Origin| header field. + + # 8. Optionally, a |Sec-WebSocket-Protocol| header field, with a list of + # values indicating which protocols the client would like to speak, ordered + # by preference. + protocols_str = headers.get("sec-websocket-protocol") + if protocols_str is None: + protocols = [] + else: + protocols = [x.strip().lower() for x in protocols_str.split(",")] + + # 9. Optionally, a |Sec-WebSocket-Extensions| header field... + + # 10. Optionally, other header fields... + + # See RFC 6455 section 4.2.2, item 5 for these steps. + + # 1. A Status-Line with a 101 response code as per RFC 2616. + handler.send_response(101) + # 2. An |Upgrade| header field with value "websocket" as per RFC 2616. + handler.send_header("Upgrade", "websocket") + # 3. A |Connection| header field with value "Upgrade". + handler.send_header("Connection", "Upgrade") + # 4. A |Sec-WebSocket-Accept| header field. The value of this header field + # is constructed by concatenating /key/, defined above in step 4 in Section + # 4.2.2, with the string "258EAFA5-E914-47DA-95CA-C5AB0DC85B11", taking the + # SHA-1 hash of this concatenated value to obtain a 20-byte value and + # base64-encoding (see Section 4 of [RFC4648]) this 20-byte hash. + accept_key = base64.b64encode(hashlib.sha1(key + MAGIC_GUID).digest()) + handler.send_header("Sec-WebSocket-Accept", accept_key) + # 5. Optionally, a |Sec-WebSocket-Protocol| header field, with a value + # /subprotocol/ as defined in step 4 in Section 4.2.2. + if "base64" in protocols: + handler.send_header("Sec-WebSocket-Protocol", "base64") + # 6. Optionally, a |Sec-WebSocket-Extensions| header field... + + handler.end_headers() + + return protocols + def grab_string(s, pos): """Grab a NUL-terminated string from the given string, starting at the given offset. Return (pos, str) tuple, or (pos, None) on error.""" @@ -511,20 +629,28 @@ def match_proxies(): def main(): while True: - rset = [remote_s, local_s] + socks_pending + remote_for.keys() + local_for.keys() + locals + remotes + rset = [remote_s, local_s] + websocket_pending + socks_pending + remote_for.keys() + local_for.keys() + locals + remotes rset, _, _ = select.select(rset, [], []) for fd in rset: if fd == remote_s: remote_c, addr = fd.accept() log(u"Remote connection from %s." % format_addr(addr)) - remotes.append(BufferSocket(remote_c)) - handle_remote_connection(remote_c) - report_pending() + websocket_pending.append(BufferSocket(remote_c)) elif fd == local_s: local_c, addr = fd.accept() log(u"Local connection from %s." % format_addr(addr)) socks_pending.append(local_c) register() + elif fd in websocket_pending: + log(u"Data from WebSocket-pending %s." % format_addr(addr)) + protocols = handle_websocket_request(fd) + if protocols is not None: + remotes.append(fd) + handle_remote_connection(fd) + else: + fd.close() + websocket_pending.remove(fd) + report_pending() elif fd in socks_pending: log(u"SOCKS request from %s." % format_addr(addr)) if handle_socks_request(fd): @@ -596,6 +722,8 @@ if __name__ == "__main__": # Remote socket, accepting remote WebSocket connections from proxies. remote_s = listen_socket(options.remote_addr) + # New remote sockets waiting to finish their WebSocket negotiation. + websocket_pending = [] # Remote connection sockets. remotes = [] # New local sockets waiting to finish their SOCKS negotiation.

1 0

[flashproxy/master] Do WebSocket linking of locals and remotes.
by dcf＠torproject.org 09 Apr '12

09 Apr '12

commit aae557431a0b1bbdb2d60d92aeaf98727317a35c Author: David Fifield <david(a)bamsoftware.com> Date: Thu Mar 29 18:40:13 2012 -0700 Do WebSocket linking of locals and remotes. --- connector.py | 144 ++++++++++++++++++++++++++++++++++++--------------------- 1 files changed, 91 insertions(+), 53 deletions(-) diff --git a/connector.py b/connector.py index ec30401..07f0f3e 100755 --- a/connector.py +++ b/connector.py @@ -111,20 +111,6 @@ def format_addr(addr): return u"%s:%d" % (host, port) -class BufferSocket(object): - """A socket containing a time of creation and a buffer of data received. The - buffer stores data to make the socket selectable again.""" - def __init__(self, fd): - self.fd = fd - self.birthday = time.time() - self.buf = "" - - def __getattr__(self, name): - return getattr(self.fd, name) - - def is_expired(self, timeout): - return time.time() - self.birthday > timeout - def apply_mask(payload, mask_key): result = [] @@ -545,21 +531,36 @@ def report_pending(): log(u"locals (%d): %s" % (len(locals), [format_peername(x) for x in locals])) log(u"remotes (%d): %s" % (len(remotes), [format_peername(x) for x in remotes])) +def proxy_chunk_local_to_remote(local, remote): + try: + data = local.recv(65536) + except socket.error, e: # Can be "Connection reset by peer". + log(u"Socket error from local: %s" % repr(str(e))) + remote.close() + return False + if not data: + log(u"EOF from local %s." % format_peername(local)) + local.close() + remote.close() + return False + else: + remote.send_chunk(data) + return True -def proxy_chunk(fd_r, fd_w, label): +def proxy_chunk_remote_to_local(remote, local): try: - data = fd_r.recv(65536) + data = remote.recv(65536) except socket.error, e: # Can be "Connection reset by peer". - log(u"Socket error from %s: %s" % (label, repr(str(e)))) - fd_w.close() + log(u"Socket error from remote: %s" % repr(str(e))) + local.close() return False if not data: - log(u"EOF from %s %s." % (label, format_peername(fd_r))) - fd_r.close() - fd_w.close() + log(u"EOF from remote %s." % format_peername(remote)) + remote.close() + local.close() return False else: - fd_w.sendall(data) + local.send_chunk(data) return True def receive_unlinked(fd, label): @@ -587,28 +588,59 @@ def receive_unlinked(fd, label): return True def match_proxies(): - while locals and remotes: - remote = remotes.pop(0) - local = locals.pop(0) + while unlinked_remotes and unlinked_locals: + remote = unlinked_remotes.pop(0) + local = unlinked_locals.pop(0) remote_addr, remote_port = remote.getpeername() local_addr, local_port = local.getpeername() log(u"Linking %s and %s." % (format_peername(local), format_peername(remote))) + remote.partner = local + local.partner = remote if local.buf: - remote.sendall(local.buf) + remote.send_chunk(local.buf) if remote.buf: - local.sendall(remote.buf) - remote_for[local.fd] = remote.fd - local_for[remote.fd] = local.fd + local.send_chunk(remote.buf) + +class RemoteSocket(object): + def __init__(self, fd, protocols): + self.fd = fd + self.buf = "" + self.partner = None + self.dec = WebSocketBinaryDecoder(protocols, use_mask = True) + self.enc = WebSocketBinaryEncoder(protocols, use_mask = False) + + def send_chunk(self, data): + self.sendall(self.enc.encode(data)) + + def __getattr__(self, name): + return getattr(self.fd, name) + +class LocalSocket(object): + def __init__(self, fd): + self.fd = fd + self.buf = "" + self.partner = None + + def send_chunk(self, data): + self.partner.dec.feed(data) + while True: + data = self.partner.dec.read() + if not data: + break + self.sendall(data) + + def __getattr__(self, name): + return getattr(self.fd, name) def main(): while True: - rset = [remote_s, local_s] + websocket_pending + socks_pending + remote_for.keys() + local_for.keys() + locals + remotes + rset = [remote_s, local_s] + websocket_pending + socks_pending + locals + remotes rset, _, _ = select.select(rset, [], []) for fd in rset: if fd == remote_s: remote_c, addr = fd.accept() log(u"Remote connection from %s." % format_addr(addr)) - websocket_pending.append(BufferSocket(remote_c)) + websocket_pending.append(remote_c) elif fd == local_s: local_c, addr = fd.accept() log(u"Local connection from %s." % format_addr(addr)) @@ -617,7 +649,9 @@ def main(): log(u"Data from WebSocket-pending %s." % format_addr(addr)) protocols = handle_websocket_request(fd) if protocols is not None: - remotes.append(fd) + wrapped = RemoteSocket(fd, protocols) + remotes.append(wrapped) + unlinked_remotes.append(wrapped) else: fd.close() websocket_pending.remove(fd) @@ -625,29 +659,33 @@ def main(): elif fd in socks_pending: log(u"SOCKS request from %s." % format_addr(addr)) if handle_socks_request(fd): - locals.append(BufferSocket(fd)) + wrapped = LocalSocket(fd) + locals.append(wrapped) + unlinked_locals.append(wrapped) else: fd.close() socks_pending.remove(fd) report_pending() - elif fd in local_for: - local = local_for[fd] - if not proxy_chunk(fd, local, "remote"): - del local_for[fd] - del remote_for[local] - elif fd in remote_for: - remote = remote_for[fd] - if not proxy_chunk(fd, remote, "local"): - del remote_for[fd] - del local_for[remote] - elif fd in locals: - if not receive_unlinked(fd, "local"): - locals.remove(fd) - report_pending() elif fd in remotes: - if not receive_unlinked(fd, "remote"): - remotes.remove(fd) + local = fd.partner + if local: + if not proxy_chunk_remote_to_local(fd, local): + remotes.remove(fd) + locals.remove(local) + else: + if not receive_unlinked(fd, "remote"): + remotes.remove(fd) report_pending() + elif fd in locals: + remote = fd.partner + if remote: + if not proxy_chunk_local_to_remote(fd, remote): + remotes.remove(remote) + locals.remove(fd) + else: + if not receive_unlinked(fd, "local"): + locals.remove(fd) + report_pending() match_proxies() if __name__ == "__main__": @@ -692,14 +730,14 @@ if __name__ == "__main__": websocket_pending = [] # Remote connection sockets. remotes = [] + # Remotes not yet linked with a local. This is a subset of remotes. + unlinked_remotes = [] # New local sockets waiting to finish their SOCKS negotiation. socks_pending = [] # Local Tor sockets, after SOCKS negotiation. locals = [] - - # Bidirectional mapping between local sockets and remote sockets. - local_for = {} - remote_for = {} + # Locals not yet linked with a remote. This is a subset of remotes. + unlinked_locals = [] if options.daemonize: log(u"Daemonizing.")

1 0

[flashproxy/master] Get rid of registration in the connector.
by dcf＠torproject.org 09 Apr '12

09 Apr '12

commit 3e92fc1e67ada8e50f7fc82710f7108d9faefedb Author: David Fifield <david(a)bamsoftware.com> Date: Thu Mar 29 14:55:47 2012 -0700 Get rid of registration in the connector. Move it to an external program, connector-reg-http.py. --- README | 12 +++-- connector.py | 30 +------------- flashproxy-reg-http.py | 106 ++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 115 insertions(+), 33 deletions(-) diff --git a/README b/README index 46776d5..c4f0f46 100644 --- a/README +++ b/README @@ -58,14 +58,16 @@ only communication your computer makes with a fixed IP address is registration with the facilitator: everything else happens over ephemeral proxies. -1. Run the connector and instruct it to register with a public - facilitator. - $ python connector.py -f tor-facilitator.bamsoftware.com +1. Run the connector. + $ python connector.py + Register with a public facilitator. + $ python flashproxy-reg-http.py By default the connector listens on Internet-facing TCP port 9000. If you have to use a different port (to get through a firewall, for - example), give it on the command line like this (here using port + example), give it on the command lines like this (here using port 8888): - $ python connector.py -f tor-facilitator.bamsoftware.com :9001 :8888 + $ python connector.py 127.0.0.1:9001 :8888 + $ python flashproxy-reg-http.py -a :8888 2. Run Tor using the included torrc file. $ tor -f flashproxy/torrc diff --git a/connector.py b/connector.py index 3268a64..571289e 100755 --- a/connector.py +++ b/connector.py @@ -4,7 +4,6 @@ import base64 import cStringIO import getopt import hashlib -import httplib import os import re import select @@ -21,14 +20,12 @@ DEFAULT_REMOTE_ADDRESS = "0.0.0.0" DEFAULT_REMOTE_PORT = 9000 DEFAULT_LOCAL_ADDRESS = "127.0.0.1" DEFAULT_LOCAL_PORT = 9001 -DEFAULT_FACILITATOR_PORT = 9002 LOG_DATE_FORMAT = "%Y-%m-%d %H:%M:%S" class options(object): local_addr = None remote_addr = None - facilitator_addr = None log_filename = None log_file = sys.stdout @@ -41,7 +38,7 @@ UNCONNECTED_BUFFER_LIMIT = 10240 def usage(f = sys.stdout): print >> f, """\ -Usage: %(progname)s -f FACILITATOR[:PORT] [LOCAL][:PORT] [REMOTE][:PORT] +Usage: %(progname)s [LOCAL][:PORT] [REMOTE][:PORT] Wait for connections on a local and a remote port. When any pair of connections exists, data is ferried between them until one side is closed. By default LOCAL is "%(local)s" and REMOTE is "%(remote)s". @@ -49,12 +46,7 @@ LOCAL is "%(local)s" and REMOTE is "%(remote)s". The local connection acts as a SOCKS4a proxy, but the host and port in the SOCKS request are ignored and the local connection is always linked to a remote connection. - -If the -f option is given, then the REMOTE address is advertised to the given -FACILITATOR. --daemon daemonize (Unix only). - -f, --facilitator=HOST[:PORT] advertise willingness to receive connections to - HOST:PORT. By default PORT is %(fac_port)d. -h, --help show this help. -l, --log FILENAME write log to FILENAME (default stdout). --pidfile FILENAME write PID to FILENAME after daemonizing.\ @@ -62,7 +54,6 @@ FACILITATOR. "progname": sys.argv[0], "local": format_addr((DEFAULT_LOCAL_ADDRESS, DEFAULT_LOCAL_PORT)), "remote": format_addr((DEFAULT_REMOTE_ADDRESS, DEFAULT_REMOTE_PORT)), - "fac_port": DEFAULT_FACILITATOR_PORT, } def log(msg): @@ -556,22 +547,12 @@ def handle_remote_connection(fd): def handle_local_connection(fd): log(u"handle_local_connection") - register() match_proxies() def report_pending(): log(u"locals (%d): %s" % (len(locals), [format_peername(x) for x in locals])) log(u"remotes (%d): %s" % (len(remotes), [format_peername(x) for x in remotes])) -def register(): - if options.facilitator_addr is None: - return False - spec = format_addr((None, options.remote_addr[1])) - log(u"Registering \"%s\" with %s." % (spec, format_addr(options.facilitator_addr))) - http = httplib.HTTPConnection(*options.facilitator_addr) - http.request("POST", "/", urllib.urlencode({"client": spec})) - http.close() - return True def proxy_chunk(fd_r, fd_w, label): try: @@ -640,7 +621,6 @@ def main(): local_c, addr = fd.accept() log(u"Local connection from %s." % format_addr(addr)) socks_pending.append(local_c) - register() elif fd in websocket_pending: log(u"Data from WebSocket-pending %s." % format_addr(addr)) protocols = handle_websocket_request(fd) @@ -665,13 +645,11 @@ def main(): if not proxy_chunk(fd, local, "remote"): del local_for[fd] del remote_for[local] - register() elif fd in remote_for: remote = remote_for[fd] if not proxy_chunk(fd, remote, "local"): del remote_for[fd] del local_for[remote] - register() elif fd in locals: if not receive_unlinked(fd, "local"): locals.remove(fd) @@ -683,12 +661,10 @@ def main(): match_proxies() if __name__ == "__main__": - opts, args = getopt.gnu_getopt(sys.argv[1:], "f:hl:", ["daemon", "facilitator=", "help", "log=", "pidfile="]) + opts, args = getopt.gnu_getopt(sys.argv[1:], "hl:", ["daemon", "help", "log=", "pidfile="]) for o, a in opts: if o == "--daemon": options.daemonize = True - elif o == "-f" or o == "--facilitator": - options.facilitator_addr = parse_addr_spec(a, None, DEFAULT_FACILITATOR_PORT) elif o == "-h" or o == "--help": usage() sys.exit() @@ -735,8 +711,6 @@ if __name__ == "__main__": local_for = {} remote_for = {} - register() - if options.daemonize: log(u"Daemonizing.") pid = os.fork() diff --git a/flashproxy-reg-http.py b/flashproxy-reg-http.py new file mode 100755 index 0000000..032a0fb --- /dev/null +++ b/flashproxy-reg-http.py @@ -0,0 +1,106 @@ +#!/usr/bin/env python + +import getopt +import httplib +import socket +import sys +import urllib + +DEFAULT_REMOTE_ADDR = None +DEFAULT_REMOTE_PORT = 9000 +DEFAULT_FACILITATOR_HOST = "tor-facilitator.bamsoftware.com" +DEFAULT_FACILITATOR_PORT = 9002 + +class options(object): + facilitator_addr = None + remote_addr = None + +def usage(f = sys.stdout): + print >> f, """\ +Usage: %(progname)s [HOSTNAME][:PORT] +Register with a flash proxy facilitator using an HTTP POST. By default the +facilitator address is "%(fac_addr)s". + + -a, --address=ADDRESS register the given address instead of \"%(remote_addr)s\". + -h, --help show this help. \ +""" % { + "progname": sys.argv[0], + "fac_addr": format_addr((DEFAULT_FACILITATOR_HOST, DEFAULT_FACILITATOR_PORT)), + "remote_addr": format_addr((DEFAULT_REMOTE_ADDR, DEFAULT_REMOTE_PORT)), +} + +def parse_addr_spec(spec, defhost = None, defport = None): + host = None + port = None + m = None + # IPv6 syntax. + if not m: + m = re.match(ur'^\[(.+)\]:(\d+)$', spec) + if m: + host, port = m.groups() + af = socket.AF_INET6 + if not m: + m = re.match(ur'^\[(.+)\]:?$', spec) + if m: + host, = m.groups() + af = socket.AF_INET6 + # IPv4 syntax. + if not m: + m = re.match(ur'^(.+):(\d+)$', spec) + if m: + host, port = m.groups() + af = socket.AF_INET + if not m: + m = re.match(ur'^:?(\d+)$', spec) + if m: + port, = m.groups() + af = 0 + if not m: + host = spec + af = 0 + host = host or defhost + port = port or defport + if not (host and port): + raise ValueError("Bad address specification \"%s\"" % spec) + return host, int(port) + +def format_addr(addr): + host, port = addr + if not host: + return u":%d" % port + # Numeric IPv6 address? + try: + addrs = socket.getaddrinfo(host, port, 0, socket.SOCK_STREAM, socket.IPPROTO_TCP, socket.AI_NUMERICHOST) + af = addrs[0][0] + except socket.gaierror, e: + af = 0 + if af == socket.AF_INET6: + return u"[%s]:%d" % (host, port) + else: + return u"%s:%d" % (host, port) + +options.facilitator_addr = (DEFAULT_FACILITATOR_HOST, DEFAULT_FACILITATOR_PORT) +options.remote_addr = (DEFAULT_REMOTE_ADDR, DEFAULT_REMOTE_PORT) + +opts, args = getopt.gnu_getopt(sys.argv[1:], "a:h", ["address=", "help"]) +for o, a in opts: + if o == "-a" or o == "--address": + options.remote_addr = parse_addr_spec(a, DEFAULT_REMOTE_ADDR, DEFAULT_REMOTE_PORT) + elif o == "-h" or o == "--help": + usage() + sys.exit() + +if len(args) == 0: + pass +elif len(args) == 1: + options.facilitator_addr = parse_addr_spec(args[0], DEFAULT_FACILITATOR_HOST, DEFAULT_FACILITATOR_PORT) +else: + usage(sys.stderr) + sys.exit(1) + +spec = format_addr(options.remote_addr) +http = httplib.HTTPConnection(*options.facilitator_addr) +http.request("POST", "/", urllib.urlencode({"client": spec})) +http.close() + +print "Registered \"%s\" with %s." % (spec, format_addr(options.facilitator_addr))

1 0

[flashproxy/master] Remove do-nothing handle_remote_connection and handle_local_connection.
by dcf＠torproject.org 09 Apr '12

09 Apr '12

commit e979b0ffe0aa47e3ae4a7f7c01417cec8d2595a9 Author: David Fifield <david(a)bamsoftware.com> Date: Thu Mar 29 18:32:56 2012 -0700 Remove do-nothing handle_remote_connection and handle_local_connection. --- connector.py | 10 ---------- 1 files changed, 0 insertions(+), 10 deletions(-) diff --git a/connector.py b/connector.py index 571289e..ec30401 100755 --- a/connector.py +++ b/connector.py @@ -541,14 +541,6 @@ def handle_socks_request(fd): # Note we throw away the requested address and port. return True -def handle_remote_connection(fd): - log(u"handle_remote_connection") - match_proxies() - -def handle_local_connection(fd): - log(u"handle_local_connection") - match_proxies() - def report_pending(): log(u"locals (%d): %s" % (len(locals), [format_peername(x) for x in locals])) log(u"remotes (%d): %s" % (len(remotes), [format_peername(x) for x in remotes])) @@ -626,7 +618,6 @@ def main(): protocols = handle_websocket_request(fd) if protocols is not None: remotes.append(fd) - handle_remote_connection(fd) else: fd.close() websocket_pending.remove(fd) @@ -635,7 +626,6 @@ def main(): log(u"SOCKS request from %s." % format_addr(addr)) if handle_socks_request(fd): locals.append(BufferSocket(fd)) - handle_local_connection(fd) else: fd.close() socks_pending.remove(fd)

1 0

[flashproxy/master] Give remote hosts 2 seconds to make their WebSocket request.
by dcf＠torproject.org 09 Apr '12

09 Apr '12

commit d469ec913900395011245fb53b7a0a1bf139d1da Author: David Fifield <david(a)bamsoftware.com> Date: Thu Mar 29 19:26:03 2012 -0700 Give remote hosts 2 seconds to make their WebSocket request. --- connector.py | 26 ++++++++++++++++++++++++-- 1 files changed, 24 insertions(+), 2 deletions(-) diff --git a/connector.py b/connector.py index 07f0f3e..908f988 100755 --- a/connector.py +++ b/connector.py @@ -358,6 +358,9 @@ def format_peername(s): except socket.error, e: return "<unconnected>" +# How long to wait for a WebSocket request on the remote socket. It is limited +# to avoid Slowloris-like attacks. +WEBSOCKET_REQUEST_TIMEOUT = 2.0 class WebSocketRequestHandler(BaseHTTPServer.BaseHTTPRequestHandler): def __init__(self, request_text, fd): @@ -601,6 +604,17 @@ def match_proxies(): if remote.buf: local.send_chunk(remote.buf) +class TimeoutSocket(object): + def __init__(self, fd): + self.fd = fd + self.birthday = time.time() + + def age(self): + return time.time() - self.birthday + + def __getattr__(self, name): + return getattr(self.fd, name) + class RemoteSocket(object): def __init__(self, fd, protocols): self.fd = fd @@ -635,12 +649,12 @@ class LocalSocket(object): def main(): while True: rset = [remote_s, local_s] + websocket_pending + socks_pending + locals + remotes - rset, _, _ = select.select(rset, [], []) + rset, _, _ = select.select(rset, [], [], WEBSOCKET_REQUEST_TIMEOUT) for fd in rset: if fd == remote_s: remote_c, addr = fd.accept() log(u"Remote connection from %s." % format_addr(addr)) - websocket_pending.append(remote_c) + websocket_pending.append(TimeoutSocket(remote_c)) elif fd == local_s: local_c, addr = fd.accept() log(u"Local connection from %s." % format_addr(addr)) @@ -687,6 +701,14 @@ def main(): locals.remove(fd) report_pending() match_proxies() + while websocket_pending: + pending = websocket_pending[0] + if pending.age() < WEBSOCKET_REQUEST_TIMEOUT: + break + log(u"Expired remote connection from %s." % format_peername(pending)) + pending.close() + websocket_pending.pop(0) + report_pending() if __name__ == "__main__": opts, args = getopt.gnu_getopt(sys.argv[1:], "hl:", ["daemon", "help", "log=", "pidfile="])

1 0