Seth Schoen
ee3a942118
let's have a CA server policy file
2012-11-09 11:54:37 -08:00
Seth Schoen
1b8db0695c
whoops, forgot to add these in this directory after deleting the subdirectory
2012-11-09 11:36:37 -08:00
Seth Schoen
5fb6a5b07d
som eminor changes, fixes, and reorganization
2012-11-05 17:32:35 -08:00
Seth Schoen
12d8d34672
Merge branch 'nonpolling'
2012-11-05 12:36:35 -08:00
Seth Schoen
8f9f2b1374
Merge branch 'master' into nonpolling
2012-10-24 23:39:38 -07:00
Seth Schoen
ef7489d080
warning: we apparently need to replace urllib2
2012-10-24 23:38:00 -07:00
Seth Schoen
83de53725c
Merge branch 'master' of ssh://github.com/research/chocolate
2012-10-24 23:34:09 -07:00
Seth Schoen
581c362d97
warning: we apparently need to replace urllib2
2012-10-24 23:33:45 -07:00
Seth Schoen
dce90e945c
formalize disabling Observatory check for now
2012-10-22 16:40:41 -07:00
Seth Schoen
a70cda636a
formalize disabling Observatory check for now
2012-10-22 16:39:47 -07:00
Seth Schoen
6fc950f28c
TODO on telling server when challenges couldn't be met
2012-10-18 17:29:15 -07:00
Seth Schoen
900120de95
move docstring to the right place
2012-10-18 17:20:59 -07:00
Seth Schoen
de867e26c8
reorganize daemons!
...
This splits out the single daemon into four different daemons (for
makechallenge, testchallenge, and issue, and for logging), switches
all but the logging daemon to no longer use pubsub (but instead
use brpop, which is a blocking queue pop), and tracks the number of
times that a given session has been tested (limited to 3).
There are also new scripts to try to start and stop all the daemons
with a single command.
2012-10-17 18:36:24 -07:00
Seth Schoen
90944557bf
update client to send hashcash per-name
2012-10-10 17:19:00 -07:00
Seth Schoen
4dfd31a315
implement requirement of hashcash *per subject name*
2012-10-10 12:15:33 -07:00
Seth Schoen
8ea8f361a1
more detailed comment
2012-10-08 18:05:02 -07:00
Seth Schoen
ed9a02af65
only schedule sessions for testing if they aren't already scheduled for testing
2012-10-05 17:47:54 -07:00
Seth Schoen
9cebf1e268
make the client actually send completedchallenge
2012-10-05 14:44:02 -07:00
Seth Schoen
f404be638c
Merge branch 'master' into nonpolling
2012-10-05 14:26:08 -07:00
Seth Schoen
b4eaf10a49
poll_interval variable to control frequency of client requests
2012-10-03 12:33:55 -07:00
Seth Schoen
0fa26c1cf3
push notification implementation with one-shot lock
2012-10-03 12:29:14 -07:00
Seth Schoen
7c486c7c63
Pythonic, not LISPy, naming
2012-08-31 15:45:04 -07:00
Seth Schoen
da59639b8b
organize exit nodes by country
2012-08-31 15:43:43 -07:00
Seth Schoen
d6d55e159b
and my cached-consensus exit geography parser
2012-08-31 11:42:29 -07:00
Seth Schoen
2731f85032
(old) partial upstream pygeoip (LGPLv3)
2012-08-31 11:41:53 -07:00
Seth Schoen
985652be87
script to hash factorable moduli and store them in the blacklist
2012-08-20 15:40:54 -07:00
Seth Schoen
f212aa207c
fix typo on format string
2012-08-13 00:55:36 -07:00
Seth Schoen
41b59fbc91
improving logging again
2012-08-13 00:52:31 -07:00
Seth Schoen
2d1ca6bf6f
show what names the cert was issued for
2012-08-13 00:47:48 -07:00
Seth Schoen
4847670654
even nicer logging :-)
2012-08-13 00:42:06 -07:00
Seth Schoen
57a48d1c1d
balance parens
2012-08-13 00:38:38 -07:00
Seth Schoen
4f0d86587e
Merge branch 'master' of ssh://github.com/research/chocolate
2012-08-13 00:37:01 -07:00
Seth Schoen
ae0e4a422a
try to failure reason textual instead of numeric
2012-08-13 00:36:32 -07:00
Seth Schoen
d03bc6f8ea
add space after comma for prettier logs
2012-08-13 00:25:57 -07:00
Seth Schoen
6e897496b3
use pubsub for logging!
2012-08-13 00:16:38 -07:00
Seth Schoen
34e3e27a6e
use abbreviated session IDs in logging for readability
2012-08-12 23:42:24 -07:00
Seth Schoen
036e7f3bed
fix typo
2012-08-12 23:32:47 -07:00
Seth Schoen
4a892b0e02
more logging including client IP address
2012-08-12 23:31:32 -07:00
Seth Schoen
8cda7066b4
make logging clearer to read
2012-08-12 23:22:35 -07:00
Seth Schoen
7b0a68d79c
don't set stdout inside check_output
2012-08-12 19:04:28 -07:00
Seth Schoen
24f4e065e5
lowercase names and remove duplicates
2012-08-12 18:49:26 -07:00
Seth Schoen
d10434974a
check wildcards in Observatory
2012-08-12 18:32:16 -07:00
Seth Schoen
966181d52e
if CHOCOLATESERVER is unspecified, use ca.theobroma.info
2012-08-12 17:43:47 -07:00
Seth Schoen
c04564b68c
merged into client.py
2012-08-10 18:47:14 -07:00
Seth Schoen
3c474aa163
merged into client.py
2012-08-10 18:45:16 -07:00
Seth Schoen
50466263ff
remove name conflict with existing function
2012-08-10 18:43:01 -07:00
Seth Schoen
a57bf4824a
where is the remaining output coming from?
2012-08-10 18:24:54 -07:00
Seth Schoen
4aea7885b6
suppressing even more output in curses mode!
2012-08-10 18:23:02 -07:00
Seth Schoen
7099ac8c8f
display individual challenges in curses mode
2012-08-10 18:21:20 -07:00
Seth Schoen
ebe5e36152
wow, you really do have to open /dev/null to discard the output
2012-08-10 18:19:39 -07:00
Seth Schoen
be5c017d9c
debugging quietness
2012-08-10 18:16:15 -07:00
Seth Schoen
12b8050b56
trying to suppress more output
2012-08-10 18:14:54 -07:00
Seth Schoen
3fc22615e8
right, we actually already collect the stdout of this process!
2012-08-10 18:13:11 -07:00
Seth Schoen
294ddb91b6
supress subprocess output in curses mode
2012-08-10 18:12:42 -07:00
Seth Schoen
d1ae767443
supress subprocess output in curses mode
2012-08-10 18:12:30 -07:00
Seth Schoen
5997ac8ddf
more curses status updates
2012-08-10 18:06:34 -07:00
Seth Schoen
e884c7f460
more curses updates
2012-08-10 18:04:29 -07:00
Seth Schoen
931ca5701e
more curses updates
2012-08-10 18:04:08 -07:00
Seth Schoen
215c305842
more global variables
2012-08-10 17:59:54 -07:00
Seth Schoen
efa9714b23
use global version of server variable
2012-08-10 17:59:09 -07:00
Seth Schoen
846d476d21
extra closing paren
2012-08-10 17:58:21 -07:00
Seth Schoen
8cdc23a132
set server on command line with --server, or CHOCOLATESERVER
2012-08-10 17:57:17 -07:00
Seth Schoen
3988f6f04b
integrate some of the curses interface
2012-08-10 17:49:41 -07:00
Seth Schoen
8b082f9fde
evidently, current best practice is to include ALL DNS names, including the primary name, as SANs
2012-08-10 16:26:25 -07:00
Seth Schoen
12ef7489ec
output the name that we're doing the test for
2012-08-10 10:41:29 -07:00
Seth Schoen
f3d1b4b996
fix logic to not test ancientness of nonexistent sessions
2012-08-10 10:18:35 -07:00
Seth Schoen
6dcf213ff6
rename function and add sanity-checking assertion
2012-08-09 23:38:46 -07:00
Seth Schoen
b3dba8e6db
function to generate RSA keypair and corresponding CSR
2012-08-09 18:52:12 -07:00
Seth Schoen
f449f538dd
upstream changed API :-)
2012-08-09 17:41:38 -07:00
Seth Schoen
f167fe732b
show ncurses menu for configuration choices
2012-08-09 17:26:56 -07:00
Seth Schoen
f6e3a301a8
now there is a dependency on python-dialog
2012-08-09 16:36:52 -07:00
Seth Schoen
bff90ee86f
let's use dialog and getopt!
2012-08-09 16:36:27 -07:00
Seth Schoen
c9cc928dc4
implement Observatory blacklist
2012-08-09 14:20:18 -07:00
Seth Schoen
c6453513b6
switch to Peter's round-robin scheduling approach
2012-08-08 17:30:44 -07:00
Seth Schoen
c4c8bd04f9
argh, ugly hack for problem of stale requests poisoning queues
2012-08-08 13:41:15 -07:00
Seth Schoen
cb2040a3ac
add missing colon
2012-08-08 13:13:14 -07:00
Seth Schoen
67da1f65dd
just in case there are DOS-style EOLs in the CSR
2012-07-28 18:43:20 -07:00
Seth Schoen
c75f154bd6
have daemon send a pubsub message to itself to achieve prompt clean shutdowns
2012-07-20 23:54:58 -07:00
Seth Schoen
7ee2b9ef21
note priority inversion bug is now somewhat less severe
2012-07-20 18:47:29 -07:00
Seth Schoen
2ba0eae5d6
support for distributing certificate chain file
2012-07-20 18:37:47 -07:00
Seth Schoen
cb5922edd8
switch to pubsub mechanism instead of polling
2012-07-20 16:48:10 -07:00
Seth Schoen
d02883ca38
add field for certficate chain
2012-07-20 16:43:42 -07:00
Seth Schoen
8db37e5501
add cert_chain_file config option
2012-07-20 16:43:18 -07:00
Seth Schoen
06357addf0
min_key_size → min_keysize
2012-07-19 23:22:52 -07:00
Seth Schoen
90f4b4daeb
move configuratoin parameters into config file; add extra sanity checks
2012-07-19 23:19:39 -07:00
Seth Schoen
b1b7257c2a
what kind of getopt is the upstream hashcash using, anyway?
2012-07-18 22:36:22 -07:00
Seth Schoen
c89a0e8f8e
mint hashcash with expiry stated down to the second
2012-07-18 22:31:54 -07:00
Seth Schoen
6f5d15cddf
whoops, the past is the past, not the future
2012-07-18 22:28:41 -07:00
Seth Schoen
c117582ece
drop privileges and use external hashcash binary again
2012-07-18 22:25:23 -07:00
Seth Schoen
1e17b222ab
document priority inversion bug
2012-07-18 19:38:00 -07:00
Seth Schoen
707dedbd9b
add verification probe via Tor
2012-07-18 18:43:23 -07:00
Seth Schoen
bb0c4bf316
notes on future blacklist import speedups
2012-07-18 17:08:35 -07:00
Seth Schoen
df97026c72
Python hashcash minting is slow, so only generate 20 bits for now
2012-07-18 15:07:17 -07:00
Seth Schoen
e857154682
updated modulus blacklisting stuff
2012-07-17 00:33:45 -07:00
Seth Schoen
7fbb146ba6
weak Debian keys, via http://certlogik.com/debian-weak-key-check/
2012-07-17 00:19:08 -07:00
Seth Schoen
93f7afbf82
no longer use Python hashcash library
2012-07-16 19:26:42 -07:00
Seth Schoen
4352ff0e13
need to import subprocess
2012-07-16 19:25:41 -07:00
Seth Schoen
1b88b67544
use C language hashcash program to generate cash from client
2012-07-16 19:25:27 -07:00
Seth Schoen
bc7b55d0d6
client supports servername as command-line argument
2012-07-16 15:13:50 -07:00
Seth Schoen
62c2f5fa49
function name collision
2012-07-16 15:13:06 -07:00
Seth Schoen