Seth Schoen
7c486c7c63
Pythonic, not LISPy, naming
2012-08-31 15:45:04 -07:00
Seth Schoen
da59639b8b
organize exit nodes by country
2012-08-31 15:43:43 -07:00
Seth Schoen
d6d55e159b
and my cached-consensus exit geography parser
2012-08-31 11:42:29 -07:00
Seth Schoen
2731f85032
(old) partial upstream pygeoip (LGPLv3)
2012-08-31 11:41:53 -07:00
Seth Schoen
985652be87
script to hash factorable moduli and store them in the blacklist
2012-08-20 15:40:54 -07:00
Seth Schoen
f212aa207c
fix typo on format string
2012-08-13 00:55:36 -07:00
Seth Schoen
41b59fbc91
improving logging again
2012-08-13 00:52:31 -07:00
Seth Schoen
2d1ca6bf6f
show what names the cert was issued for
2012-08-13 00:47:48 -07:00
Seth Schoen
4847670654
even nicer logging :-)
2012-08-13 00:42:06 -07:00
Seth Schoen
57a48d1c1d
balance parens
2012-08-13 00:38:38 -07:00
Seth Schoen
4f0d86587e
Merge branch 'master' of ssh://github.com/research/chocolate
2012-08-13 00:37:01 -07:00
Seth Schoen
ae0e4a422a
try to failure reason textual instead of numeric
2012-08-13 00:36:32 -07:00
Seth Schoen
d03bc6f8ea
add space after comma for prettier logs
2012-08-13 00:25:57 -07:00
Seth Schoen
6e897496b3
use pubsub for logging!
2012-08-13 00:16:38 -07:00
Seth Schoen
34e3e27a6e
use abbreviated session IDs in logging for readability
2012-08-12 23:42:24 -07:00
Seth Schoen
036e7f3bed
fix typo
2012-08-12 23:32:47 -07:00
Seth Schoen
4a892b0e02
more logging including client IP address
2012-08-12 23:31:32 -07:00
Seth Schoen
8cda7066b4
make logging clearer to read
2012-08-12 23:22:35 -07:00
Seth Schoen
7b0a68d79c
don't set stdout inside check_output
2012-08-12 19:04:28 -07:00
Seth Schoen
24f4e065e5
lowercase names and remove duplicates
2012-08-12 18:49:26 -07:00
Seth Schoen
d10434974a
check wildcards in Observatory
2012-08-12 18:32:16 -07:00
Seth Schoen
966181d52e
if CHOCOLATESERVER is unspecified, use ca.theobroma.info
2012-08-12 17:43:47 -07:00
Seth Schoen
c04564b68c
merged into client.py
2012-08-10 18:47:14 -07:00
Seth Schoen
3c474aa163
merged into client.py
2012-08-10 18:45:16 -07:00
Seth Schoen
50466263ff
remove name conflict with existing function
2012-08-10 18:43:01 -07:00
Seth Schoen
a57bf4824a
where is the remaining output coming from?
2012-08-10 18:24:54 -07:00
Seth Schoen
4aea7885b6
suppressing even more output in curses mode!
2012-08-10 18:23:02 -07:00
Seth Schoen
7099ac8c8f
display individual challenges in curses mode
2012-08-10 18:21:20 -07:00
Seth Schoen
ebe5e36152
wow, you really do have to open /dev/null to discard the output
2012-08-10 18:19:39 -07:00
Seth Schoen
be5c017d9c
debugging quietness
2012-08-10 18:16:15 -07:00
Seth Schoen
12b8050b56
trying to suppress more output
2012-08-10 18:14:54 -07:00
Seth Schoen
3fc22615e8
right, we actually already collect the stdout of this process!
2012-08-10 18:13:11 -07:00
Seth Schoen
294ddb91b6
supress subprocess output in curses mode
2012-08-10 18:12:42 -07:00
Seth Schoen
d1ae767443
supress subprocess output in curses mode
2012-08-10 18:12:30 -07:00
Seth Schoen
5997ac8ddf
more curses status updates
2012-08-10 18:06:34 -07:00
Seth Schoen
e884c7f460
more curses updates
2012-08-10 18:04:29 -07:00
Seth Schoen
931ca5701e
more curses updates
2012-08-10 18:04:08 -07:00
Seth Schoen
215c305842
more global variables
2012-08-10 17:59:54 -07:00
Seth Schoen
efa9714b23
use global version of server variable
2012-08-10 17:59:09 -07:00
Seth Schoen
846d476d21
extra closing paren
2012-08-10 17:58:21 -07:00
Seth Schoen
8cdc23a132
set server on command line with --server, or CHOCOLATESERVER
2012-08-10 17:57:17 -07:00
Seth Schoen
3988f6f04b
integrate some of the curses interface
2012-08-10 17:49:41 -07:00
Seth Schoen
8b082f9fde
evidently, current best practice is to include ALL DNS names, including the primary name, as SANs
2012-08-10 16:26:25 -07:00
Seth Schoen
12ef7489ec
output the name that we're doing the test for
2012-08-10 10:41:29 -07:00
Seth Schoen
f3d1b4b996
fix logic to not test ancientness of nonexistent sessions
2012-08-10 10:18:35 -07:00
Seth Schoen
6dcf213ff6
rename function and add sanity-checking assertion
2012-08-09 23:38:46 -07:00
Seth Schoen
b3dba8e6db
function to generate RSA keypair and corresponding CSR
2012-08-09 18:52:12 -07:00
Seth Schoen
f449f538dd
upstream changed API :-)
2012-08-09 17:41:38 -07:00
Seth Schoen
f167fe732b
show ncurses menu for configuration choices
2012-08-09 17:26:56 -07:00
Seth Schoen
f6e3a301a8
now there is a dependency on python-dialog
2012-08-09 16:36:52 -07:00
Seth Schoen
bff90ee86f
let's use dialog and getopt!
2012-08-09 16:36:27 -07:00
Seth Schoen
c9cc928dc4
implement Observatory blacklist
2012-08-09 14:20:18 -07:00
Seth Schoen
c6453513b6
switch to Peter's round-robin scheduling approach
2012-08-08 17:30:44 -07:00
Seth Schoen
c4c8bd04f9
argh, ugly hack for problem of stale requests poisoning queues
2012-08-08 13:41:15 -07:00
Seth Schoen
cb2040a3ac
add missing colon
2012-08-08 13:13:14 -07:00
Seth Schoen
67da1f65dd
just in case there are DOS-style EOLs in the CSR
2012-07-28 18:43:20 -07:00
Seth Schoen
c75f154bd6
have daemon send a pubsub message to itself to achieve prompt clean shutdowns
2012-07-20 23:54:58 -07:00
Seth Schoen
7ee2b9ef21
note priority inversion bug is now somewhat less severe
2012-07-20 18:47:29 -07:00
Seth Schoen
2ba0eae5d6
support for distributing certificate chain file
2012-07-20 18:37:47 -07:00
Seth Schoen
cb5922edd8
switch to pubsub mechanism instead of polling
2012-07-20 16:48:10 -07:00
Seth Schoen
d02883ca38
add field for certficate chain
2012-07-20 16:43:42 -07:00
Seth Schoen
8db37e5501
add cert_chain_file config option
2012-07-20 16:43:18 -07:00
Seth Schoen
06357addf0
min_key_size → min_keysize
2012-07-19 23:22:52 -07:00
Seth Schoen
90f4b4daeb
move configuratoin parameters into config file; add extra sanity checks
2012-07-19 23:19:39 -07:00
Seth Schoen
b1b7257c2a
what kind of getopt is the upstream hashcash using, anyway?
2012-07-18 22:36:22 -07:00
Seth Schoen
c89a0e8f8e
mint hashcash with expiry stated down to the second
2012-07-18 22:31:54 -07:00
Seth Schoen
6f5d15cddf
whoops, the past is the past, not the future
2012-07-18 22:28:41 -07:00
Seth Schoen
c117582ece
drop privileges and use external hashcash binary again
2012-07-18 22:25:23 -07:00
Seth Schoen
1e17b222ab
document priority inversion bug
2012-07-18 19:38:00 -07:00
Seth Schoen
707dedbd9b
add verification probe via Tor
2012-07-18 18:43:23 -07:00
Seth Schoen
bb0c4bf316
notes on future blacklist import speedups
2012-07-18 17:08:35 -07:00
Seth Schoen
df97026c72
Python hashcash minting is slow, so only generate 20 bits for now
2012-07-18 15:07:17 -07:00
Seth Schoen
e857154682
updated modulus blacklisting stuff
2012-07-17 00:33:45 -07:00
Seth Schoen
7fbb146ba6
weak Debian keys, via http://certlogik.com/debian-weak-key-check/
2012-07-17 00:19:08 -07:00
Seth Schoen
93f7afbf82
no longer use Python hashcash library
2012-07-16 19:26:42 -07:00
Seth Schoen
4352ff0e13
need to import subprocess
2012-07-16 19:25:41 -07:00
Seth Schoen
1b88b67544
use C language hashcash program to generate cash from client
2012-07-16 19:25:27 -07:00
Seth Schoen
bc7b55d0d6
client supports servername as command-line argument
2012-07-16 15:13:50 -07:00
Seth Schoen
62c2f5fa49
function name collision
2012-07-16 15:13:06 -07:00
Seth Schoen
ac0defac00
remove client-side dependency on CSR.py
2012-07-16 15:11:10 -07:00
Seth Schoen
e70424dd4a
database-backed blacklisting of moduli and names
2012-07-16 15:02:07 -07:00
Seth Schoen
acd5a77fc3
make the process faster by reducing delay times
2012-07-15 16:37:39 -07:00
Seth Schoen
f07275a99d
another comment on locking
2012-07-15 16:33:23 -07:00
Seth Schoen
ad71e39d31
simplify by removing hashes of random numbers
...
There may be circumstances where hashing random numbers might be
useful, but in order to justify it we would need to know something
about the generator that provides them. However, checking with
strace shows that the CSPRNG in Crypto.Random may not reseed its
entropy enough, so we might ultimately want to use a different one.
It only reseeds 8 bytes per call even if you read megabytes of
random numbers from it!
2012-07-15 16:16:28 -07:00
Seth Schoen
a5c70283e8
wait after performing challenge, in the hope the server notices the first time
2012-07-14 23:34:39 -07:00
Seth Schoen
f2a3f830e6
right now challenges get issued pretty fast; polldelay = 10 seems high
2012-07-14 23:30:01 -07:00
Seth Schoen
1019a47b31
oops, confused module name and class name
2012-07-14 23:02:55 -07:00
Seth Schoen
88c5b270ef
implement locking for issuing certs with openssl ca
2012-07-14 23:01:39 -07:00
Seth Schoen
97caf0f61a
implementation of Redis-mediated lock in Python
2012-07-14 22:54:19 -07:00
Seth Schoen
f2d755d3d5
check recipient string before hashcash to produce more useful error message
...
This is more work for the server but if we don't do it in this
order we always get a hashcash error instead of a recipient error
if the client is confused about what server it meant to query.
Giving the wrong error in this sense is OK from a protocol point
of view but quite frustrating for a human being on the client end
trying to figure out why the server is rejecting its apparently
perfectly valid hashcash...
2012-07-14 17:35:22 -07:00
Seth Schoen
1756a29a6a
forgot an underscore
2012-07-14 17:32:26 -07:00
Seth Schoen
19bcb8486c
make some things more general; allow command line arguments
2012-07-14 17:31:43 -07:00
Seth Schoen
1fd5ae1c9d
er, the parameter is only known as h inside the called function
2012-07-14 17:18:22 -07:00
Seth Schoen
088c97bbf5
use database to prevent double-spending of hashcash
2012-07-14 17:16:51 -07:00
Seth Schoen
0b1b8e42d5
switch to hashlib
2012-07-14 15:08:15 -07:00
Seth Schoen
c1927aed26
switch to hashlib
2012-07-14 15:02:26 -07:00
Seth Schoen
f9eb363311
we're using git pull rather than scp/rsync to deploy now
2012-07-14 14:56:30 -07:00
Seth Schoen
be58b8759a
notes on locking and concurrency
2012-07-14 14:56:19 -07:00
Seth Schoen
ecfc275a1e
continue with request after displaying it :-)
2012-07-14 14:42:07 -07:00
Seth Schoen
064148df29
use hashcash in protocol
2012-07-14 14:34:24 -07:00
Seth Schoen