func main() {
var generateServerIPaddress string
var generateWebServerPort, generateSSHServerPort, generateObfuscatedSSHServerPort int
var runConfigFilenames stringListFlag
flag.StringVar(
&generateServerIPaddress,
"ipaddress",
server.DEFAULT_SERVER_IP_ADDRESS,
"generate with this server `IP address`")
flag.IntVar(
&generateWebServerPort,
"webport",
server.DEFAULT_WEB_SERVER_PORT,
"generate with this web server `port`; 0 for no web server")
flag.IntVar(
&generateSSHServerPort,
"sshport",
server.DEFAULT_SSH_SERVER_PORT,
"generate with this SSH server `port`; 0 for no SSH server")
flag.IntVar(
&generateObfuscatedSSHServerPort,
"osshport",
server.DEFAULT_OBFUSCATED_SSH_SERVER_PORT,
"generate with this Obfuscated SSH server `port`; 0 for no Obfuscated SSH server")
flag.Var(
&runConfigFilenames,
"config",
"run with this config `filename`; flag may be repeated to load multiple config files")
flag.Usage = func() {
fmt.Fprintf(os.Stderr,
"Usage:\n\n"+
"%s <flags> generate generates a configuration and server entry\n"+
"%s <flags> run runs configured services\n\n",
os.Args[0], os.Args[0])
flag.PrintDefaults()
}
flag.Parse()
args := flag.Args()
configFilename := server.SERVER_CONFIG_FILENAME
serverEntryFilename := server.SERVER_ENTRY_FILENAME
if len(args) < 1 {
flag.Usage()
os.Exit(1)
} else if args[0] == "generate" {
configFileContents, serverEntryFileContents, err := server.GenerateConfig(
&server.GenerateConfigParams{
ServerIPAddress: generateServerIPaddress,
WebServerPort: generateWebServerPort,
SSHServerPort: generateSSHServerPort,
ObfuscatedSSHServerPort: generateObfuscatedSSHServerPort,
})
if err != nil {
fmt.Errorf("generate failed: %s", err)
os.Exit(1)
}
err = ioutil.WriteFile(configFilename, configFileContents, 0600)
if err != nil {
fmt.Errorf("error writing configuration file: %s", err)
os.Exit(1)
}
err = ioutil.WriteFile(serverEntryFilename, serverEntryFileContents, 0600)
if err != nil {
fmt.Errorf("error writing server entry file: %s", err)
os.Exit(1)
}
} else if args[0] == "run" {
if len(runConfigFilenames) == 0 {
runConfigFilenames = []string{configFilename}
}
var configFileContents [][]byte
for _, configFilename := range runConfigFilenames {
ccontents, err := ioutil.ReadFile(configFilename)
if err != nil {
fmt.Errorf("error loading configuration file: %s", err)
os.Exit(1)
}
configFileContents = append(configFileContents, ccontents)
}
err := server.RunServices(configFileContents)
if err != nil {
fmt.Errorf("run failed: %s", err)
os.Exit(1)
}
}
}
func main() {
var generateTrafficRulesFilename string
var generateServerEntryFilename string
var generateLogFilename string
var generateServerIPaddress string
var generateServerNetworkInterface string
var generateWebServerPort int
var generateProtocolPorts stringListFlag
var configFilename string
flag.StringVar(
&generateTrafficRulesFilename,
"trafficRules",
server.SERVER_TRAFFIC_RULES_FILENAME,
"generate with this traffic rules `filename`")
flag.StringVar(
&generateServerEntryFilename,
"serverEntry",
server.SERVER_ENTRY_FILENAME,
"generate with this server entry `filename`")
flag.StringVar(
&generateLogFilename,
"logFilename",
"",
"set application log file name and path; blank for stderr")
flag.StringVar(
&generateServerIPaddress,
"ipaddress",
server.DEFAULT_SERVER_IP_ADDRESS,
"generate with this server `IP address`")
flag.StringVar(
&generateServerNetworkInterface,
"interface",
"",
"generate with server IP address from this `network-interface`")
flag.IntVar(
&generateWebServerPort,
"web",
0,
"generate with web server `port`; 0 for no web server")
flag.Var(
&generateProtocolPorts,
"protocol",
"generate with `protocol:port`; flag may be repeated to enable multiple protocols")
flag.StringVar(
&configFilename,
"config",
server.SERVER_CONFIG_FILENAME,
"run or generate with this config `filename`")
flag.Usage = func() {
fmt.Fprintf(os.Stderr,
"Usage:\n\n"+
"%s <flags> generate generates configuration files\n"+
"%s <flags> run runs configured services\n\n",
os.Args[0], os.Args[0])
flag.PrintDefaults()
}
flag.Parse()
args := flag.Args()
if len(args) < 1 {
flag.Usage()
os.Exit(1)
} else if args[0] == "generate" {
serverIPaddress := generateServerIPaddress
if generateServerNetworkInterface != "" {
var err error
serverIPaddress, err = common.GetInterfaceIPAddress(generateServerNetworkInterface)
if err != nil {
fmt.Printf("generate failed: %s\n", err)
os.Exit(1)
}
}
tunnelProtocolPorts := make(map[string]int)
for _, protocolPort := range generateProtocolPorts {
parts := strings.Split(protocolPort, ":")
if len(parts) == 2 {
port, err := strconv.Atoi(parts[1])
if err != nil {
fmt.Printf("generate failed: %s\n", err)
os.Exit(1)
}
tunnelProtocolPorts[parts[0]] = port
}
}
configJSON, trafficRulesJSON, encodedServerEntry, err :=
server.GenerateConfig(
&server.GenerateConfigParams{
LogFilename: generateLogFilename,
ServerIPAddress: serverIPaddress,
EnableSSHAPIRequests: true,
WebServerPort: generateWebServerPort,
TunnelProtocolPorts: tunnelProtocolPorts,
TrafficRulesFilename: generateTrafficRulesFilename,
})
if err != nil {
fmt.Printf("generate failed: %s\n", err)
os.Exit(1)
}
err = ioutil.WriteFile(configFilename, configJSON, 0600)
if err != nil {
fmt.Printf("error writing configuration file: %s\n", err)
os.Exit(1)
}
err = ioutil.WriteFile(generateTrafficRulesFilename, trafficRulesJSON, 0600)
if err != nil {
fmt.Printf("error writing traffic rule configuration file: %s\n", err)
os.Exit(1)
}
err = ioutil.WriteFile(generateServerEntryFilename, encodedServerEntry, 0600)
if err != nil {
fmt.Printf("error writing server entry file: %s\n", err)
os.Exit(1)
}
} else if args[0] == "run" {
configJSON, err := ioutil.ReadFile(configFilename)
if err != nil {
fmt.Printf("error loading configuration file: %s\n", err)
os.Exit(1)
}
err = server.RunServices(configJSON)
if err != nil {
fmt.Printf("run failed: %s\n", err)
os.Exit(1)
}
}
}
func TestObfuscatedRemoteServerLists(t *testing.T) {
testDataDirName, err := ioutil.TempDir("", "psiphon-remote-server-list-test")
if err != nil {
t.Fatalf("TempDir failed: %s", err)
}
defer os.RemoveAll(testDataDirName)
//
// create a server
//
serverIPaddress := ""
for _, interfaceName := range []string{"eth0", "en0"} {
serverIPaddress, err = common.GetInterfaceIPAddress(interfaceName)
if err == nil {
break
}
}
if err != nil {
t.Fatalf("error getting server IP address: %s", err)
}
serverConfigJSON, _, encodedServerEntry, err := server.GenerateConfig(
&server.GenerateConfigParams{
ServerIPAddress: serverIPaddress,
EnableSSHAPIRequests: true,
WebServerPort: 8001,
TunnelProtocolPorts: map[string]int{"OSSH": 4001},
})
if err != nil {
t.Fatalf("error generating server config: %s", err)
}
//
// pave OSLs
//
oslConfigJSONTemplate := `
{
"Schemes" : [
{
"Epoch" : "%s",
"Regions" : [],
"PropagationChannelIDs" : ["%s"],
"MasterKey" : "vwab2WY3eNyMBpyFVPtsivMxF4MOpNHM/T7rHJIXctg=",
"SeedSpecs" : [
{
"ID" : "KuP2V6gLcROIFzb/27fUVu4SxtEfm2omUoISlrWv1mA=",
"UpstreamSubnets" : ["0.0.0.0/0"],
"Targets" :
{
"BytesRead" : 1,
"BytesWritten" : 1,
"PortForwardDurationNanoseconds" : 1
}
}
],
"SeedSpecThreshold" : 1,
"SeedPeriodNanoseconds" : %d,
"SeedPeriodKeySplits": [
{
"Total": 1,
"Threshold": 1
}
]
}
]
}`
now := time.Now().UTC()
seedPeriod := 24 * time.Hour
epoch := now.Truncate(seedPeriod)
epochStr := epoch.Format(time.RFC3339Nano)
propagationChannelID, _ := common.MakeRandomStringHex(8)
oslConfigJSON := fmt.Sprintf(
oslConfigJSONTemplate,
epochStr,
propagationChannelID,
seedPeriod)
oslConfig, err := osl.LoadConfig([]byte(oslConfigJSON))
if err != nil {
t.Fatalf("error loading OSL config: %s", err)
}
signingPublicKey, signingPrivateKey, err := common.GenerateAuthenticatedDataPackageKeys()
if err != nil {
t.Fatalf("error generating package keys: %s", err)
}
paveFiles, err := oslConfig.Pave(
epoch,
propagationChannelID,
signingPublicKey,
signingPrivateKey,
[]map[time.Time]string{
map[time.Time]string{
epoch: string(encodedServerEntry),
},
})
if err != nil {
t.Fatalf("error paving OSL files: %s", err)
}
//
// mock seeding SLOKs
//
singleton = dataStore{}
os.Remove(filepath.Join(testDataDirName, DATA_STORE_FILENAME))
err = InitDataStore(&Config{DataStoreDirectory: testDataDirName})
if err != nil {
t.Fatalf("error initializing client datastore: %s", err)
}
if CountServerEntries("", "") > 0 {
t.Fatalf("unexpected server entries")
}
seedState := oslConfig.NewClientSeedState("", propagationChannelID, nil)
seedPortForward := seedState.NewClientSeedPortForward(net.ParseIP("0.0.0.0"))
seedPortForward.UpdateProgress(1, 1, 1)
payload := seedState.GetSeedPayload()
if len(payload.SLOKs) != 1 {
t.Fatalf("expected 1 SLOKs, got %d", len(payload.SLOKs))
}
SetSLOK(payload.SLOKs[0].ID, payload.SLOKs[0].Key)
//
// run mock remote server list host
//
remoteServerListHostAddress := net.JoinHostPort(serverIPaddress, "8081")
// The common remote server list fetches will 404
remoteServerListURL := fmt.Sprintf("http://%s/server_list_compressed", remoteServerListHostAddress)
remoteServerListDownloadFilename := filepath.Join(testDataDirName, "server_list_compressed")
obfuscatedServerListRootURL := fmt.Sprintf("http://%s/", remoteServerListHostAddress)
obfuscatedServerListDownloadDirectory := testDataDirName
go func() {
startTime := time.Now()
serveMux := http.NewServeMux()
for _, paveFile := range paveFiles {
file := paveFile
serveMux.HandleFunc("/"+file.Name, func(w http.ResponseWriter, req *http.Request) {
md5sum := md5.Sum(file.Contents)
w.Header().Add("Content-Type", "application/octet-stream")
w.Header().Add("ETag", hex.EncodeToString(md5sum[:]))
http.ServeContent(w, req, file.Name, startTime, bytes.NewReader(file.Contents))
})
}
httpServer := &http.Server{
Addr: remoteServerListHostAddress,
Handler: serveMux,
}
err := httpServer.ListenAndServe()
if err != nil {
// TODO: wrong goroutine for t.FatalNow()
t.Fatalf("error running remote server list host: %s", err)
}
}()
//
// run Psiphon server
//
go func() {
err := server.RunServices(serverConfigJSON)
if err != nil {
// TODO: wrong goroutine for t.FatalNow()
t.Fatalf("error running server: %s", err)
}
}()
//
// disrupt remote server list downloads
//
disruptorProxyAddress := "127.0.0.1:2162"
disruptorProxyURL := "socks4a://" + disruptorProxyAddress
go func() {
listener, err := socks.ListenSocks("tcp", disruptorProxyAddress)
if err != nil {
fmt.Errorf("disruptor proxy listen error: %s", err)
return
}
for {
localConn, err := listener.AcceptSocks()
if err != nil {
fmt.Errorf("disruptor proxy accept error: %s", err)
return
}
go func() {
remoteConn, err := net.Dial("tcp", localConn.Req.Target)
if err != nil {
fmt.Errorf("disruptor proxy dial error: %s", err)
return
}
err = localConn.Grant(&net.TCPAddr{IP: net.ParseIP("0.0.0.0"), Port: 0})
if err != nil {
fmt.Errorf("disruptor proxy grant error: %s", err)
return
}
waitGroup := new(sync.WaitGroup)
waitGroup.Add(1)
go func() {
defer waitGroup.Done()
io.Copy(remoteConn, localConn)
}()
if localConn.Req.Target == remoteServerListHostAddress {
io.CopyN(localConn, remoteConn, 500)
} else {
io.Copy(localConn, remoteConn)
}
localConn.Close()
remoteConn.Close()
waitGroup.Wait()
}()
}
}()
//
// connect to Psiphon server with Psiphon client
//
SetEmitDiagnosticNotices(true)
// Note: calling LoadConfig ensures all *int config fields are initialized
clientConfigJSONTemplate := `
{
"ClientPlatform" : "",
"ClientVersion" : "0",
"SponsorId" : "0",
"PropagationChannelId" : "0",
"ConnectionPoolSize" : 1,
"EstablishTunnelPausePeriodSeconds" : 1,
"FetchRemoteServerListRetryPeriodSeconds" : 1,
"RemoteServerListSignaturePublicKey" : "%s",
"RemoteServerListUrl" : "%s",
"RemoteServerListDownloadFilename" : "%s",
"ObfuscatedServerListRootURL" : "%s",
"ObfuscatedServerListDownloadDirectory" : "%s",
"UpstreamProxyUrl" : "%s"
}`
clientConfigJSON := fmt.Sprintf(
clientConfigJSONTemplate,
signingPublicKey,
remoteServerListURL,
remoteServerListDownloadFilename,
obfuscatedServerListRootURL,
obfuscatedServerListDownloadDirectory,
disruptorProxyURL)
clientConfig, _ := LoadConfig([]byte(clientConfigJSON))
controller, err := NewController(clientConfig)
if err != nil {
t.Fatalf("error creating client controller: %s", err)
}
tunnelEstablished := make(chan struct{}, 1)
SetNoticeOutput(NewNoticeReceiver(
func(notice []byte) {
noticeType, payload, err := GetNotice(notice)
if err != nil {
return
}
printNotice := false
switch noticeType {
case "Tunnels":
printNotice = true
count := int(payload["count"].(float64))
if count == 1 {
tunnelEstablished <- *new(struct{})
}
case "RemoteServerListResourceDownloadedBytes":
// TODO: check for resumed download for each URL
//url := payload["url"].(string)
printNotice = true
case "RemoteServerListResourceDownloaded":
printNotice = true
}
if printNotice {
fmt.Printf("%s\n", string(notice))
}
}))
go func() {
controller.Run(make(chan struct{}))
}()
establishTimeout := time.NewTimer(30 * time.Second)
select {
case <-tunnelEstablished:
case <-establishTimeout.C:
t.Fatalf("tunnel establish timeout exceeded")
}
for _, paveFile := range paveFiles {
u, _ := url.Parse(obfuscatedServerListRootURL)
u.Path = path.Join(u.Path, paveFile.Name)
etag, _ := GetUrlETag(u.String())
md5sum := md5.Sum(paveFile.Contents)
if etag != hex.EncodeToString(md5sum[:]) {
t.Fatalf("unexpected ETag for %s", u)
}
}
}
